pi-daddy 0.44.4 → 0.46.0

package/dist/products/public-evidence.d.ts

@@ -0,0 +1,62 @@
+import type { DefinitionSourceSnapshot } from "../kernel/definition-sources.ts";
+export declare const PUBLIC_EVIDENCE_SCHEMA = "pi-daddy-public-evidence-v1";
+export declare const MAX_PUBLIC_EVIDENCE_BYTES: number;
+export declare const MAX_PUBLIC_EVIDENCE_FILES = 64;
+export interface PublicEvidenceRef {
+    path: string;
+    sha256: string;
+    bytes: number;
+}
+export interface PublicEvidenceOwner {
+    readonly directory: string;
+    readonly ownerId: string;
+}
+export interface PublicDefinitionEvidence {
+    agent: string;
+    definitionId: string;
+    sourceHash: string | null;
+    bodySha256: string;
+    binding: Readonly<{
+        package: string;
+        phase: string;
+    }> | null;
+    snapshot?: DefinitionSourceSnapshot;
+}
+export interface PublicEvidenceRequest {
+    ordinal: number;
+    agent: string | null;
+    requestedDefinitionId: string | null;
+    definitionId: string | null;
+    executionId: string | null;
+}
+export interface PublicFinalEvidence {
+    ordinal: number;
+    executionId: string | null;
+    final: {
+        state: "complete";
+        text: string;
+        sessionId: string;
+        messageId: string;
+        leafId: string;
+        sha256: string;
+    } | null;
+}
+export interface PublicEvidenceInput {
+    toolCallId: string;
+    tool: "delegate_describe" | "delegate" | "delegate_all" | "delegate_chain";
+    response: {
+        isError: boolean;
+        content: readonly {
+            type: "text";
+            text: string;
+        }[];
+    };
+    requested: readonly PublicEvidenceRequest[];
+    runtimeEvidence: unknown;
+    definitions: readonly PublicDefinitionEvidence[];
+    finals: readonly PublicFinalEvidence[];
+}
+export declare function createPublicEvidenceOwner(directory: string | undefined): PublicEvidenceOwner | undefined;
+/** No schema accepts arbitrary filenames, output paths, raw arguments, environment, or native details. */
+export declare function capturePublicEvidence(owner: PublicEvidenceOwner, input: PublicEvidenceInput): PublicEvidenceRef;
+//# sourceMappingURL=public-evidence.d.ts.map

package/dist/products/public-evidence.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"public-evidence.d.ts","sourceRoot":"","sources":["../../src/products/public-evidence.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,iCAAiC,CAAC;AAChF,eAAO,MAAM,sBAAsB,gCAAgC,CAAC;AACpE,eAAO,MAAM,yBAAyB,QAAmB,CAAC;AAC1D,eAAO,MAAM,yBAAyB,KAAK,CAAC;AAC5C,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;CACf;AACD,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AACD,MAAM,WAAW,wBAAwB;IACvC,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,QAAQ,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,GAAG,IAAI,CAAC;IAC7D,QAAQ,CAAC,EAAE,wBAAwB,CAAC;CACrC;AACD,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,qBAAqB,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B;AACD,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,KAAK,EAAE;QACL,KAAK,EAAE,UAAU,CAAC;QAClB,IAAI,EAAE,MAAM,CAAC;QACb,SAAS,EAAE,MAAM,CAAC;QAClB,SAAS,EAAE,MAAM,CAAC;QAClB,MAAM,EAAE,MAAM,CAAC;QACf,MAAM,EAAE,MAAM,CAAC;KAChB,GAAG,IAAI,CAAC;CACV;AACD,MAAM,WAAW,mBAAmB;IAClC,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,mBAAmB,GAAG,UAAU,GAAG,cAAc,GAAG,gBAAgB,CAAC;IAC3E,QAAQ,EAAE;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,SAAS;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAA;SAAE,EAAE,CAAA;KAAE,CAAC;IACnF,SAAS,EAAE,SAAS,qBAAqB,EAAE,CAAC;IAC5C,eAAe,EAAE,OAAO,CAAC;IACzB,WAAW,EAAE,SAAS,wBAAwB,EAAE,CAAC;IACjD,MAAM,EAAE,SAAS,mBAAmB,EAAE,CAAC;CACxC;AACD,wBAAgB,yBAAyB,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,GAAG,mBAAmB,GAAG,SAAS,CAIxG;AAGD,0GAA0G;AAC1G,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,mBAAmB,EAAE,KAAK,EAAE,mBAAmB,GAAG,iBAAiB,CAyG/G"}

package/dist/products/public-evidence.js

@@ -0,0 +1,116 @@
+/** Exact public extension-return capture. Opt-in local observation, never an authority/acceptance source.
+ * Existing operator-created root must be canonical, private and owned by this uid. Held directory
+ * descriptors anchor every exclusive write; successful refs are returned only after fsync and close.
+ * Hashes detect accidental edits; this does not authenticate against a hostile process with the same uid.
+ */
+import { randomUUID, createHash } from "node:crypto";
+import { constants, openSync, closeSync, fstatSync, fsyncSync, writeFileSync, mkdirSync, realpathSync, statSync, } from "node:fs";
+import { isAbsolute, join, resolve } from "node:path";
+export const PUBLIC_EVIDENCE_SCHEMA = "pi-daddy-public-evidence-v1";
+export const MAX_PUBLIC_EVIDENCE_BYTES = 64 * 1024 * 1024;
+export const MAX_PUBLIC_EVIDENCE_FILES = 64;
+export function createPublicEvidenceOwner(directory) {
+    return directory === undefined || directory === "off"
+        ? undefined
+        : Object.freeze({ directory, ownerId: randomUUID() });
+}
+const sha256 = (bytes) => createHash("sha256").update(bytes).digest("hex");
+const json = (value) => Buffer.from(JSON.stringify(value) + "\n", "utf8");
+/** No schema accepts arbitrary filenames, output paths, raw arguments, environment, or native details. */
+export function capturePublicEvidence(owner, input) {
+    const directory = owner.directory;
+    if (process.platform !== "linux" ||
+        !isAbsolute(directory) ||
+        resolve(directory) !== directory ||
+        realpathSync(directory) !== directory)
+        throw Error("public evidence root must be an existing canonical absolute Linux directory");
+    const rootFd = openSync(directory, constants.O_RDONLY | constants.O_DIRECTORY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+    try {
+        const root = fstatSync(rootFd);
+        if (!root.isDirectory() || root.uid !== process.getuid?.() || (root.mode & 0o077) !== 0)
+            throw Error("public evidence root must be owned by this user and private (mode 0700)");
+        const captureId = randomUUID(), target = join(directory, captureId);
+        const rootPath = `/proc/self/fd/${rootFd}`;
+        mkdirSync(join(rootPath, captureId), { mode: 0o700 });
+        const captureFd = openSync(join(rootPath, captureId), constants.O_RDONLY | constants.O_DIRECTORY | constants.O_NOFOLLOW);
+        let manifest;
+        try {
+            let bytes = 0, files = 0;
+            const put = (name, content) => {
+                bytes += content.byteLength;
+                files += 1;
+                if (bytes > MAX_PUBLIC_EVIDENCE_BYTES || files > MAX_PUBLIC_EVIDENCE_FILES)
+                    throw Error("public evidence capture exceeds its byte/file limit; no complete manifest published");
+                const fd = openSync(join(`/proc/self/fd/${captureFd}`, name), constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW | constants.O_NONBLOCK, 0o600);
+                try {
+                    if (!fstatSync(fd).isFile())
+                        throw Error("public evidence target is not an ordinary file");
+                    writeFileSync(fd, content);
+                    fsyncSync(fd);
+                }
+                finally {
+                    closeSync(fd);
+                }
+                return { path: join(target, name), sha256: sha256(content), bytes: content.byteLength };
+            };
+            const response = put("response.json", json(input.response));
+            const finals = input.finals.map((outcome) => {
+                if (!outcome.final)
+                    return { ordinal: outcome.ordinal, executionId: outcome.executionId, final: null };
+                const { text, ...identity } = outcome.final;
+                const bytes = Buffer.from(text, "utf8");
+                if (sha256(bytes) !== identity.sha256)
+                    throw Error("attributed final bytes do not match the native final hash");
+                if (!text || !input.response.content.some((block) => block.text.includes(text)))
+                    throw Error("attributed final is not present in the public returned content");
+                return {
+                    ordinal: outcome.ordinal,
+                    executionId: outcome.executionId,
+                    final: { ...identity, content: put(`outcome-${outcome.ordinal}-final.txt`, bytes) },
+                };
+            });
+            const definitions = input.definitions.map((definition, index) => {
+                if (!definition.snapshot)
+                    throw Error(`selected source snapshot unavailable for ${definition.agent}`);
+                const resources = definition.snapshot.resources.map((source, resource) => ({
+                    kind: source.kind,
+                    path: source.path,
+                    copy: put(`definition-${index}-source-${resource}.bin`, Buffer.from(source.base64, "base64")),
+                }));
+                const { snapshot: _snapshot, ...identity } = definition;
+                return {
+                    ...identity,
+                    resources,
+                    body: put(`definition-${index}-body.txt`, Buffer.from(definition.snapshot.body, "utf8")),
+                };
+            });
+            manifest = put("manifest.json", json({
+                schema: PUBLIC_EVIDENCE_SCHEMA,
+                version: 1,
+                captureId,
+                ownerId: owner.ownerId,
+                toolCallId: input.toolCallId,
+                tool: input.tool,
+                state: "returned",
+                response,
+                requested: input.requested,
+                runtimeEvidence: input.runtimeEvidence,
+                finals,
+                definitions,
+            }));
+            fsyncSync(captureFd);
+        }
+        finally {
+            closeSync(captureFd);
+        }
+        fsyncSync(rootFd);
+        const current = statSync(directory);
+        if (realpathSync(directory) !== directory || current.dev !== root.dev || current.ino !== root.ino)
+            throw Error("public evidence root changed before reference publication");
+        return manifest;
+    }
+    finally {
+        closeSync(rootFd);
+    }
+}
+//# sourceMappingURL=public-evidence.js.map

package/dist/products/public-evidence.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"public-evidence.js","sourceRoot":"","sources":["../../src/products/public-evidence.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EACL,SAAS,EACT,QAAQ,EACR,SAAS,EACT,SAAS,EACT,SAAS,EACT,aAAa,EACb,SAAS,EACT,YAAY,EACZ,QAAQ,GACT,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEtD,MAAM,CAAC,MAAM,sBAAsB,GAAG,6BAA6B,CAAC;AACpE,MAAM,CAAC,MAAM,yBAAyB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAC1D,MAAM,CAAC,MAAM,yBAAyB,GAAG,EAAE,CAAC;AA8C5C,MAAM,UAAU,yBAAyB,CAAC,SAA6B;IACrE,OAAO,SAAS,KAAK,SAAS,IAAI,SAAS,KAAK,KAAK;QACnD,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,OAAO,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC;AAC1D,CAAC;AACD,MAAM,MAAM,GAAG,CAAC,KAAiB,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACvF,MAAM,IAAI,GAAG,CAAC,KAAc,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,IAAI,EAAE,MAAM,CAAC,CAAC;AACnF,0GAA0G;AAC1G,MAAM,UAAU,qBAAqB,CAAC,KAA0B,EAAE,KAA0B;IAC1F,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC;IAClC,IACE,OAAO,CAAC,QAAQ,KAAK,OAAO;QAC5B,CAAC,UAAU,CAAC,SAAS,CAAC;QACtB,OAAO,CAAC,SAAS,CAAC,KAAK,SAAS;QAChC,YAAY,CAAC,SAAS,CAAC,KAAK,SAAS;QAErC,MAAM,KAAK,CAAC,6EAA6E,CAAC,CAAC;IAC7F,MAAM,MAAM,GAAG,QAAQ,CACrB,SAAS,EACT,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,WAAW,GAAG,SAAS,CAAC,UAAU,GAAG,SAAS,CAAC,UAAU,CACzF,CAAC;IACF,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;QAC/B,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,IAAI,CAAC,GAAG,KAAK,OAAO,CAAC,MAAM,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC;YACrF,MAAM,KAAK,CAAC,yEAAyE,CAAC,CAAC;QACzF,MAAM,SAAS,GAAG,UAAU,EAAE,EAC5B,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QACtC,MAAM,QAAQ,GAAG,iBAAiB,MAAM,EAAE,CAAC;QAC3C,SAAS,CAAC,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACtD,MAAM,SAAS,GAAG,QAAQ,CACxB,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,EACzB,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,WAAW,GAAG,SAAS,CAAC,UAAU,CAClE,CAAC;QACF,IAAI,QAA2B,CAAC;QAChC,IAAI,CAAC;YACH,IAAI,KAAK,GAAG,CAAC,EACX,KAAK,GAAG,CAAC,CAAC;YACZ,MAAM,GAAG,GAAG,CAAC,IAAY,EAAE,OAAe,EAAqB,EAAE;gBAC/D,KAAK,IAAI,OAAO,CAAC,UAAU,CAAC;gBAC5B,KAAK,IAAI,CAAC,CAAC;gBACX,IAAI,KAAK,GAAG,yBAAyB,IAAI,KAAK,GAAG,yBAAyB;oBACxE,MAAM,KAAK,CAAC,qFAAqF,CAAC,CAAC;gBACrG,MAAM,EAAE,GAAG,QAAQ,CACjB,IAAI,CAAC,iBAAiB,SAAS,EAAE,EAAE,IAAI,CAAC,EACxC,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,OAAO,GAAG,SAAS,CAAC,MAAM,GAAG,SAAS,CAAC,UAAU,GAAG,SAAS,CAAC,UAAU,EACvG,KAAK,CACN,CAAC;gBACF,IAAI,CAAC;oBACH,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE;wBAAE,MAAM,KAAK,CAAC,gDAAgD,CAAC,CAAC;oBAC3F,aAAa,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;oBAC3B,SAAS,CAAC,EAAE,CAAC,CAAC;gBAChB,CAAC;wBAAS,CAAC;oBACT,SAAS,CAAC,EAAE,CAAC,CAAC;gBAChB,CAAC;gBACD,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC;YAC1F,CAAC,CAAC;YACF,MAAM,QAAQ,GAAG,GAAG,CAAC,eAAe,EAAE,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;YAC5D,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE;gBAC1C,IAAI,CAAC,OAAO,CAAC,KAAK;oBAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;gBACvG,MAAM,EAAE,IAAI,EAAE,GAAG,QAAQ,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC;gBAC5C,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;gBACxC,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,QAAQ,CAAC,MAAM;oBAAE,MAAM,KAAK,CAAC,2DAA2D,CAAC,CAAC;gBAChH,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;oBAC7E,MAAM,KAAK,CAAC,gEAAgE,CAAC,CAAC;gBAChF,OAAO;oBACL,OAAO,EAAE,OAAO,CAAC,OAAO;oBACxB,WAAW,EAAE,OAAO,CAAC,WAAW;oBAChC,KAAK,EAAE,EAAE,GAAG,QAAQ,EAAE,OAAO,EAAE,GAAG,CAAC,WAAW,OAAO,CAAC,OAAO,YAAY,EAAE,KAAK,CAAC,EAAE;iBACpF,CAAC;YACJ,CAAC,CAAC,CAAC;YACH,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,KAAK,EAAE,EAAE;gBAC9D,IAAI,CAAC,UAAU,CAAC,QAAQ;oBAAE,MAAM,KAAK,CAAC,4CAA4C,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC;gBACtG,MAAM,SAAS,GAAG,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;oBACzE,IAAI,EAAE,MAAM,CAAC,IAAI;oBACjB,IAAI,EAAE,MAAM,CAAC,IAAI;oBACjB,IAAI,EAAE,GAAG,CAAC,cAAc,KAAK,WAAW,QAAQ,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;iBAC9F,CAAC,CAAC,CAAC;gBACJ,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,QAAQ,EAAE,GAAG,UAAU,CAAC;gBACxD,OAAO;oBACL,GAAG,QAAQ;oBACX,SAAS;oBACT,IAAI,EAAE,GAAG,CAAC,cAAc,KAAK,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;iBACzF,CAAC;YACJ,CAAC,CAAC,CAAC;YACH,QAAQ,GAAG,GAAG,CACZ,eAAe,EACf,IAAI,CAAC;gBACH,MAAM,EAAE,sBAAsB;gBAC9B,OAAO,EAAE,CAAC;gBACV,SAAS;gBACT,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,KAAK,EAAE,UAAU;gBACjB,QAAQ;gBACR,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,eAAe,EAAE,KAAK,CAAC,eAAe;gBACtC,MAAM;gBACN,WAAW;aACZ,CAAC,CACH,CAAC;YACF,SAAS,CAAC,SAAS,CAAC,CAAC;QACvB,CAAC;gBAAS,CAAC;YACT,SAAS,CAAC,SAAS,CAAC,CAAC;QACvB,CAAC;QACD,SAAS,CAAC,MAAM,CAAC,CAAC;QAClB,MAAM,OAAO,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC;QACpC,IAAI,YAAY,CAAC,SAAS,CAAC,KAAK,SAAS,IAAI,OAAO,CAAC,GAAG,KAAK,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,KAAK,IAAI,CAAC,GAAG;YAC/F,MAAM,KAAK,CAAC,2DAA2D,CAAC,CAAC;QAC3E,OAAO,QAAQ,CAAC;IAClB,CAAC;YAAS,CAAC;QACT,SAAS,CAAC,MAAM,CAAC,CAAC;IACpB,CAAC;AACH,CAAC"}

package/extensions/definition-describe.ts

@@ -1,4 +1,5 @@
 /** Read-only handshake with the exact immutable definition dispatched by this extension instance. */
+import { publicEvidenceCall } from "./public-evidence.ts";
 import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
 import { Type } from "typebox";
 import { digestDefinition } from "../src/kernel/definitions.ts";
@@ -38,7 +39,9 @@ export function registerDefinitionDescribe(pi: ExtensionAPI, session: GrantsSess
         binding: definition.binding ?? null,
         definitionId: definition.definitionId,
       };
-      return { content: [{ type: "text" as const, text: JSON.stringify(details) }], details };
+      const capture = publicEvidenceCall(session.publicEvidence, _id, "delegate_describe", [{ agent: params.agent }]);
+      capture.selected(0, definition);
+      return capture.finish({ content: [{ type: "text" as const, text: JSON.stringify(details) }], details });
     },
   });
 }

package/extensions/delegate-chain.ts

@@ -1,3 +1,4 @@
+import { publicEvidenceCall } from "./public-evidence.ts";
 import { executionEvidenceContent } from "./execution-evidence.ts";
 import { assertDefinitionIdentity } from "./definition-describe.ts";
 /**
@@ -142,6 +143,7 @@ export function registerChainTool(pi: ExtensionAPI, session: GrantsSession): voi
       // Plan every step first. A step that can never run refuses the chain HERE, before anyone is asked — see
       // `planChain`.
       const executionIds = steps.map(() => newExecutionId());
+      const capture = publicEvidenceCall(session.publicEvidence, _toolCallId, "delegate_chain", steps, executionIds);
       await reconcileDelegationCapacity(session);
       const firstReservation = reserveDelegationCapacity(session, executionIds[0]);
       try {
@@ -326,6 +328,7 @@ export function registerChainTool(pi: ExtensionAPI, session: GrantsSession): voi
             {
               ...(index === 0 ? { capacityReservation: firstReservation } : {}),
               resolvedRuntime: runtimeChoices.get(step),
+              onDefinition: (definition) => capture.selected(index, definition),
               preApproved: availableForStep,
               toolCallId: _toolCallId,
               // Only approvals actually offered to this step are attributed or consumed here.
@@ -407,22 +410,25 @@ export function registerChainTool(pi: ExtensionAPI, session: GrantsSession): voi
           if (outcomes[0].refusal) throw new GovernanceRefusal({ ...outcomes[0].refusal, message });
           throw new Error(message);
         }
-        return {
-          isError: aborted || outcomes.some((o) => o.control === "failed"),
-          content: [
-            { type: "text", text: `${report}${tail}` },
-            executionEvidenceContent("delegate_chain", outcomes, steps.length),
-          ],
-          details: {
-            outcomes,
-            steps: steps.length,
-            completed: outcomes.filter((o) => o.ok).length,
-            aborted,
-            budgetPerStep: firstReservation.childAllowance,
-            ...(blockedReason ? { blockedReason } : {}),
-            refusals: outcomes.map((outcome) => outcome.refusal ?? null),
+        return capture.finish(
+          {
+            isError: aborted || outcomes.some((o) => o.control === "failed"),
+            content: [
+              { type: "text", text: `${report}${tail}` },
+              executionEvidenceContent("delegate_chain", outcomes, steps.length),
+            ],
+            details: {
+              outcomes,
+              steps: steps.length,
+              completed: outcomes.filter((o) => o.ok).length,
+              aborted,
+              budgetPerStep: firstReservation.childAllowance,
+              ...(blockedReason ? { blockedReason } : {}),
+              refusals: outcomes.map((outcome) => outcome.refusal ?? null),
+            },
           },
-        };
+          outcomes,
+        );
       } finally {
         firstReservation.finalize({ state: "not-started", reason: "chain ended before its first execution" });
       }

package/extensions/delegation.ts

@@ -1,3 +1,4 @@
+import { publicEvidenceCall } from "./public-evidence.ts";
 import { executionEvidenceContent } from "./execution-evidence.ts";
 import { reconcileDelegationCapacity, reserveDelegationCapacity } from "./session-capacity.ts";
 import { registerDefinitionDescribe } from "./definition-describe.ts";
@@ -253,6 +254,14 @@ export function registerDelegationTools(pi: ExtensionAPI, session: GrantsSession
       // ADR-0032: one child, same block. `_onUpdate` was discarded here, so a delegation showed the bare word
       // `delegate` for up to DEFAULT_TIMEOUT_MS — sixty minutes by default.
       const progress = progressReporter(session, [params.agent ?? "delegate"], onUpdate as never);
+      const occurrence = newDelegationOccurrence(session, 0);
+      const capture = publicEvidenceCall(
+        session.publicEvidence,
+        _toolCallId,
+        "delegate",
+        [params],
+        [occurrence.executionId],
+      );
       const outcome = await runOneDelegation(
         session,
         {
@@ -266,12 +275,16 @@ export function registerDelegationTools(pi: ExtensionAPI, session: GrantsSession
           correlation: params.correlation,
           workspace: params.workspace,
         },
-        newDelegationOccurrence(session, 0),
+        occurrence,
         // Reserve one actual child plus the currently available disjoint subtree allowance.
         undefined,
         ctx,
         signal,
-        { onProgress: progress.sink(0), toolCallId: _toolCallId },
+        {
+          onProgress: progress.sink(0),
+          toolCallId: _toolCallId,
+          onDefinition: (definition) => capture.selected(0, definition),
+        },
       );
       progress.settle([outcome]);
 
@@ -284,19 +297,22 @@ export function registerDelegationTools(pi: ExtensionAPI, session: GrantsSession
       }
       // Pi 1.0.4 preserves returned isError. Keep every outcome dimension and useful output together.
       const failed = !outcome.ok || outcome.control === "failed";
-      return {
-        isError: failed,
-        content: [
-          {
-            type: "text",
-            text: failed
-              ? `delegation failed: ${outcome.reason ?? "required control failed"}${outcome.text ? `\n\n${outcome.text}` : ""}`
-              : outcome.text || "(no output)",
-          },
-          executionEvidenceContent("delegate", [outcome], 1),
-        ],
-        details: outcome,
-      };
+      return capture.finish(
+        {
+          isError: failed,
+          content: [
+            {
+              type: "text",
+              text: failed
+                ? `delegation failed: ${outcome.reason ?? "required control failed"}${outcome.text ? `\n\n${outcome.text}` : ""}`
+                : outcome.text || "(no output)",
+            },
+            executionEvidenceContent("delegate", [outcome], 1),
+          ],
+          details: outcome,
+        },
+        [outcome],
+      );
     },
   });
 
@@ -356,11 +372,19 @@ export function registerDelegationTools(pi: ExtensionAPI, session: GrantsSession
       // (R-116).
       const infrastructureErrors: unknown[] = [],
         occurrences = children.map((_, index) => newDelegationOccurrence(session, index));
+      const capture = publicEvidenceCall(
+        session.publicEvidence,
+        _toolCallId,
+        "delegate_all",
+        children,
+        occurrences.map((row) => row.executionId),
+      );
       const pending = children.map(async (child, index): Promise<DelegationOutcome> => {
         try {
           return await runOneDelegation(session, child, occurrences[index], split.perChild, ctx, signal, {
             // Reserve each batch share synchronously here, before another dispatch can interleave.
             capacityReservation: reserveDelegationCapacity(session, occurrences[index].executionId, split.perChild),
+            onDefinition: (definition) => capture.selected(index, definition),
             onProgress: progress.sink(index),
             toolCallId: _toolCallId,
           });
@@ -385,19 +409,25 @@ export function registerDelegationTools(pi: ExtensionAPI, session: GrantsSession
       if (failed.length === children.length && outcomes.every((o) => !o.work && !o.final && !o.cleanup))
         throw totalFanoutFailure(failed, `fan-out failed: every child was refused or failed.\n\n${report}`);
 
-      return {
-        isError: outcomes.some((o) => !o.ok || o.control === "failed"),
-        content: [{ type: "text", text: report }, executionEvidenceContent("delegate_all", outcomes, children.length)],
-        details: {
-          outcomes,
-          children: outcomes.length,
-          failed: failed.length,
-          budgetPerChild: split.perChild,
-          granted: outcomes.map((o) => o.granted),
-          refusals: outcomes.map((o) => o.refusal ?? null),
-          retention: outcomes.map((o) => o.retention ?? null),
+      return capture.finish(
+        {
+          isError: outcomes.some((o) => !o.ok || o.control === "failed"),
+          content: [
+            { type: "text", text: report },
+            executionEvidenceContent("delegate_all", outcomes, children.length),
+          ],
+          details: {
+            outcomes,
+            children: outcomes.length,
+            failed: failed.length,
+            budgetPerChild: split.perChild,
+            granted: outcomes.map((o) => o.granted),
+            refusals: outcomes.map((o) => o.refusal ?? null),
+            retention: outcomes.map((o) => o.retention ?? null),
+          },
         },
-      };
+        outcomes,
+      );
     },
   });
 

package/extensions/execute-child.ts

@@ -1,7 +1,7 @@
 import { BoundedReadCleanupError } from "../src/kernel/bounded-read.ts";
 import { retainDiscoveryCleanupFailure } from "./session.ts";
 import type { CapacityReservation } from "../src/kernel/capacity.ts";
-import { HERDR_UNQUALIFIED_REASON } from "../src/executors/executor.ts";
+import { runHerdrOwned } from "../src/executors/herdr-owned.ts";
 import { runCapturedExecution } from "../src/executors/captured-execution.ts";
 import type { ChildFinal } from "../src/executors/child-final.ts";
 import type { CapturedWorkerCleanup } from "../src/kernel/captured-worker-contract.ts";
@@ -20,13 +20,12 @@ import {
   ENV_CHILD_IDLE_TIMEOUT,
   ENV_CHILD_TIMEOUT,
   idleTimeoutFromEnv,
-  runChild,
   timeoutFromEnv,
 } from "../src/kernel/run-child.ts";
 import { activitySessionFor } from "../src/executors/activity-session.ts";
 import { processTreeActivity } from "../src/executors/process-activity.ts";
 import { resolveWorkspace } from "../src/executors/herdr-cli.ts";
-import { HerdrWriterCloseError, runHerdrPane } from "../src/executors/run-herdr.ts";
+import { HerdrWriterCloseError } from "../src/executors/run-herdr.ts";
 import { GovernanceRefusal, refusal, type StructuredRefusal } from "../src/kernel/refusals.ts";
 import { ENV_HERDR_KEEP_PANE, type GrantsSession } from "./session.ts";
 import { CHILD_ATTRIBUTION_ENV_KEYS, ENV_EPISODE_ID } from "../src/kernel/env-names.ts";
@@ -138,15 +137,49 @@ export interface ChildExecutionInput {
 }
 export async function executePlannedChild(input: ChildExecutionInput): Promise<DelegationOutcome> {
   let executorEntered = false;
+  const runtime = input.session.reloadLifecycle?.runtimeSettlement;
+  let registered = false;
   try {
-    return await executePreparedChild(input, () => {
-      executorEntered = true;
-    });
+    runtime?.begin(input.executionId);
+    registered = Boolean(runtime);
+    const result = await executePreparedChild(
+      input,
+      () => {
+        executorEntered = true;
+      },
+      runtime,
+    );
+    try {
+      await runtime?.finish(
+        input.executionId,
+        result.cleanup ?? { state: "unknown", reason: "executor omitted cleanup" },
+        result.control === "failed" ? (result.reason ?? "runtime control failed") : undefined,
+      );
+    } catch (error) {
+      return {
+        ...result,
+        control: "failed",
+        reason: [result.reason, `runtime settlement record failed: ${String(error)}`].filter(Boolean).join("; "),
+      };
+    }
+    return result;
   } catch (error) {
-    if (executorEntered) throw error;
-    // Every operation above the executor-entry marker is local setup: no helper or worker exists yet.
-    input.capacityReservation?.finalize({ state: "not-started", reason: "child setup failed before executor entry" });
     const failures: unknown[] = [error];
+    if (registered)
+      try {
+        await runtime?.finish(input.executionId, {
+          state: executorEntered ? "unknown" : "not-started",
+          reason: String(error),
+        });
+      } catch (recordError) {
+        failures.push(recordError);
+      }
+    if (executorEntered) {
+      if (failures.length > 1) throw new AggregateError(failures, failures.map(String).join("; "));
+      throw error;
+    }
+    // Setup failures prove no worker started, even if recording that fact also failed.
+    input.capacityReservation?.finalize({ state: "not-started", reason: "child setup failed before executor entry" });
     try {
       const released = await releaseDelegationWorkspace({
         prepared: input.preparedWorkspace,
@@ -174,6 +207,7 @@ export async function executePlannedChild(input: ChildExecutionInput): Promise<D
 async function executePreparedChild(
   input: ChildExecutionInput,
   onExecutorEntry: () => void,
+  runtime?: import("../src/governance/runtime-settlement.ts").RuntimeSettlement,
 ): Promise<DelegationOutcome> {
   const { session, plan, childId, executionId, parentExecutionId, preparedWorkspace, signal, onProgress } = input;
   const ledgerPath = session.ledgerPath;
@@ -229,7 +263,7 @@ async function executePreparedChild(
   const activitySession = await activitySessionFor(plan.args, executionId);
   // Disposed on every path (review finding: it leaked on every throw), except when the operator keeps a Herdr pane,
   // where the interactive pi in that pane is still alive and still appending to this file.
-  const keepPaneRequested = session.executor.kind === "herdr" && process.env[ENV_HERDR_KEEP_PANE] === "1";
+  const keepPaneRequested = false; // The qualified pane launcher exits; retained panes contain no live Pi writer.
   try {
     return await executeWithActivitySession();
   } finally {
@@ -368,73 +402,63 @@ async function executePreparedChild(
       }
     };
     try {
-      if (String(session.executor.kind) === "herdr")
-        throw new GovernanceRefusal(refusal("EXECUTOR_UNAVAILABLE", HERDR_UNQUALIFIED_REASON));
+      if (session.executor.refusal)
+        throw new GovernanceRefusal(refusal("EXECUTOR_UNAVAILABLE", session.executor.refusal));
       executorEntered = true;
       onExecutorEntry();
-      const output =
-        session.executor.kind === "herdr"
-          ? await runHerdrPane({
-              args: args.slice(0, -1),
-              prompt: args[args.length - 1].trimStart(),
-              env: plan.env,
-              cwd,
-              name: `${input.agent ?? "delegate"}-${childId}`,
-              workspace: resolveWorkspace(process.env),
-              signal: executionSignal,
-              timeoutMs: remainingTimeoutMs,
-              idleTimeoutMs: configuredIdleMs,
-              activityProbe: activitySession.probe, // Herdr: session file plus pane text when a display is attached
-              keepPane: writerLease ? false : process.env[ENV_HERDR_KEEP_PANE] === "1",
-              closeOnSettle: Boolean(writerLease),
-              onPane: (paneId, agentName) => {
-                retention.native({ paneId, agentName });
-                onProgress?.({ paneId, agentName, state: "starting" });
-              },
-              onObservation: (bytes) => retention.capture("paneSnapshot", bytes, true),
-              onSessionReference: (reference) => retention.observeSession(reference),
-              onRunning: (paneId, agentName) => {
-                // Record first: runHerdrPane isolates this display callback, so a renderer exception after the
-                // observation cannot suppress the authoritative running event.
-                recordRunning("herdr", { id: paneId, agentName });
-                onProgress?.({ paneId, agentName, state: "running" });
-              },
-              onTab: preparedWorkspace ? (tabId) => preparedWorkspace.lease.attachHerdrTab(tabId) : undefined,
-              onNativeTab: (tabId) => retention.native({ tabId }),
-              onSnapshot: onProgress ? (snapshot) => onProgress({ snapshot }) : undefined,
-            })
-          : await runCapturedExecution({
-              executionId,
-              sessionPath: activitySession.path,
-              onReadCleanup,
-              onOwnership: async (identity) => {
-                input.capacityReservation?.bindOwnership(identity);
-                await preparedWorkspace?.lease.attachCapturedWorker(identity);
-              },
-              command: "pi",
-              args,
-              env: mergeChildEnv(process.env, plan.env),
-              cwd,
-              signal: executionSignal,
-              // SIGTERM gets only grace that fits INSIDE the recorded deadline. The independent hard timer
-              // prevents a delayed soft-timeout callback from starting a fresh grace period beyond that bound.
-              timeoutMs: Math.max(1, remainingTimeoutMs - terminationGraceMs),
-              hardDeadlineAt: Date.parse(deadlineAt),
-              idleTimeoutMs: configuredIdleMs,
-              activityProbe: probe,
-              onOutput: onProgress ? (chunk) => onProgress({ chunk }) : undefined,
-              onObservation: (stream, bytes) => retention.capture(stream, bytes),
-              onSpawn: (pid) => {
-                childPid = pid;
-                // Lease attachment is a security hook and may fail the spawn. The shared reporters isolate
-                // display exceptions before they reach this callback; runChild deliberately kills on any error
-                // here, so presentation must never be added directly without that reporter boundary.
+      let displayHerdr: ((text: string) => void) | undefined;
+      const output = await runCapturedExecution(
+        {
+          executionId,
+          sessionPath: activitySession.path,
+          onReadCleanup,
+          onOwnership: async (identity) => {
+            runtime?.bind(identity);
+            input.capacityReservation?.bindOwnership(identity);
+            await preparedWorkspace?.lease.attachCapturedWorker(identity);
+          },
+          command: "pi",
+          args,
+          env: mergeChildEnv(process.env, plan.env),
+          cwd,
+          signal: executionSignal,
+          // SIGTERM gets only grace that fits INSIDE the recorded deadline. The independent hard timer
+          // prevents a delayed soft-timeout callback from starting a fresh grace period beyond that bound.
+          timeoutMs: Math.max(1, remainingTimeoutMs - terminationGraceMs),
+          hardDeadlineAt: Date.parse(deadlineAt),
+          idleTimeoutMs: configuredIdleMs,
+          activityProbe: probe,
+          onOutput: (chunk) => {
+            displayHerdr?.(chunk);
+            onProgress?.({ chunk });
+          },
+          onObservation: (stream, bytes) => retention.capture(stream, bytes),
+          onSpawn: (pid) => {
+            childPid = pid;
+            // Lease attachment is a security hook and may fail the spawn. The shared reporters isolate
+            // display exceptions before they reach this callback; runChild deliberately kills on any error
+            // here, so presentation must never be added directly without that reporter boundary.
 
-                retention.native({ pid });
-                recordRunning("process");
-                onProgress?.({ state: "running" });
-              },
-            });
+            retention.native({ pid });
+            recordRunning(session.executor.kind);
+            onProgress?.({ state: "running" });
+          },
+        },
+        session.executor.kind === "herdr"
+          ? (request) =>
+              runHerdrOwned(request, {
+                onDisplay: (display) => {
+                  displayHerdr = display;
+                },
+                workspace: resolveWorkspace(process.env),
+                keepPane: process.env[ENV_HERDR_KEEP_PANE] === "1",
+                onPane: (paneId, tabId) => {
+                  retention.native({ paneId, tabId });
+                  onProgress?.({ paneId, state: "starting" });
+                },
+              })
+          : undefined,
+      );
 
       if (sessionFlag >= 0) retention.observeSession({ source: "pi-session-file", value: plan.args[sessionFlag + 1] });
       retention.capture("result", Buffer.from(output.text), true);