pi-daddy 0.45.0 → 0.46.1

package/extensions/execute-child.ts

@@ -1,7 +1,7 @@
 import { BoundedReadCleanupError } from "../src/kernel/bounded-read.ts";
 import { retainDiscoveryCleanupFailure } from "./session.ts";
 import type { CapacityReservation } from "../src/kernel/capacity.ts";
-import { HERDR_UNQUALIFIED_REASON } from "../src/executors/executor.ts";
+import { runHerdrOwned } from "../src/executors/herdr-owned.ts";
 import { runCapturedExecution } from "../src/executors/captured-execution.ts";
 import type { ChildFinal } from "../src/executors/child-final.ts";
 import type { CapturedWorkerCleanup } from "../src/kernel/captured-worker-contract.ts";
@@ -20,13 +20,12 @@ import {
   ENV_CHILD_IDLE_TIMEOUT,
   ENV_CHILD_TIMEOUT,
   idleTimeoutFromEnv,
-  runChild,
   timeoutFromEnv,
 } from "../src/kernel/run-child.ts";
 import { activitySessionFor } from "../src/executors/activity-session.ts";
 import { processTreeActivity } from "../src/executors/process-activity.ts";
 import { resolveWorkspace } from "../src/executors/herdr-cli.ts";
-import { HerdrWriterCloseError, runHerdrPane } from "../src/executors/run-herdr.ts";
+import { HerdrWriterCloseError } from "../src/executors/run-herdr.ts";
 import { GovernanceRefusal, refusal, type StructuredRefusal } from "../src/kernel/refusals.ts";
 import { ENV_HERDR_KEEP_PANE, type GrantsSession } from "./session.ts";
 import { CHILD_ATTRIBUTION_ENV_KEYS, ENV_EPISODE_ID } from "../src/kernel/env-names.ts";
@@ -138,15 +137,49 @@ export interface ChildExecutionInput {
 }
 export async function executePlannedChild(input: ChildExecutionInput): Promise<DelegationOutcome> {
   let executorEntered = false;
+  const runtime = input.session.reloadLifecycle?.runtimeSettlement;
+  let registered = false;
   try {
-    return await executePreparedChild(input, () => {
-      executorEntered = true;
-    });
+    runtime?.begin(input.executionId);
+    registered = Boolean(runtime);
+    const result = await executePreparedChild(
+      input,
+      () => {
+        executorEntered = true;
+      },
+      runtime,
+    );
+    try {
+      await runtime?.finish(
+        input.executionId,
+        result.cleanup ?? { state: "unknown", reason: "executor omitted cleanup" },
+        result.control === "failed" ? (result.reason ?? "runtime control failed") : undefined,
+      );
+    } catch (error) {
+      return {
+        ...result,
+        control: "failed",
+        reason: [result.reason, `runtime settlement record failed: ${String(error)}`].filter(Boolean).join("; "),
+      };
+    }
+    return result;
   } catch (error) {
-    if (executorEntered) throw error;
-    // Every operation above the executor-entry marker is local setup: no helper or worker exists yet.
-    input.capacityReservation?.finalize({ state: "not-started", reason: "child setup failed before executor entry" });
     const failures: unknown[] = [error];
+    if (registered)
+      try {
+        await runtime?.finish(input.executionId, {
+          state: executorEntered ? "unknown" : "not-started",
+          reason: String(error),
+        });
+      } catch (recordError) {
+        failures.push(recordError);
+      }
+    if (executorEntered) {
+      if (failures.length > 1) throw new AggregateError(failures, failures.map(String).join("; "));
+      throw error;
+    }
+    // Setup failures prove no worker started, even if recording that fact also failed.
+    input.capacityReservation?.finalize({ state: "not-started", reason: "child setup failed before executor entry" });
     try {
       const released = await releaseDelegationWorkspace({
         prepared: input.preparedWorkspace,
@@ -174,6 +207,7 @@ export async function executePlannedChild(input: ChildExecutionInput): Promise<D
 async function executePreparedChild(
   input: ChildExecutionInput,
   onExecutorEntry: () => void,
+  runtime?: import("../src/governance/runtime-settlement.ts").RuntimeSettlement,
 ): Promise<DelegationOutcome> {
   const { session, plan, childId, executionId, parentExecutionId, preparedWorkspace, signal, onProgress } = input;
   const ledgerPath = session.ledgerPath;
@@ -229,7 +263,7 @@ async function executePreparedChild(
   const activitySession = await activitySessionFor(plan.args, executionId);
   // Disposed on every path (review finding: it leaked on every throw), except when the operator keeps a Herdr pane,
   // where the interactive pi in that pane is still alive and still appending to this file.
-  const keepPaneRequested = session.executor.kind === "herdr" && process.env[ENV_HERDR_KEEP_PANE] === "1";
+  const keepPaneRequested = false; // The qualified pane launcher exits; retained panes contain no live Pi writer.
   try {
     return await executeWithActivitySession();
   } finally {
@@ -368,73 +402,63 @@ async function executePreparedChild(
       }
     };
     try {
-      if (String(session.executor.kind) === "herdr")
-        throw new GovernanceRefusal(refusal("EXECUTOR_UNAVAILABLE", HERDR_UNQUALIFIED_REASON));
+      if (session.executor.refusal)
+        throw new GovernanceRefusal(refusal("EXECUTOR_UNAVAILABLE", session.executor.refusal));
       executorEntered = true;
       onExecutorEntry();
-      const output =
-        session.executor.kind === "herdr"
-          ? await runHerdrPane({
-              args: args.slice(0, -1),
-              prompt: args[args.length - 1].trimStart(),
-              env: plan.env,
-              cwd,
-              name: `${input.agent ?? "delegate"}-${childId}`,
-              workspace: resolveWorkspace(process.env),
-              signal: executionSignal,
-              timeoutMs: remainingTimeoutMs,
-              idleTimeoutMs: configuredIdleMs,
-              activityProbe: activitySession.probe, // Herdr: session file plus pane text when a display is attached
-              keepPane: writerLease ? false : process.env[ENV_HERDR_KEEP_PANE] === "1",
-              closeOnSettle: Boolean(writerLease),
-              onPane: (paneId, agentName) => {
-                retention.native({ paneId, agentName });
-                onProgress?.({ paneId, agentName, state: "starting" });
-              },
-              onObservation: (bytes) => retention.capture("paneSnapshot", bytes, true),
-              onSessionReference: (reference) => retention.observeSession(reference),
-              onRunning: (paneId, agentName) => {
-                // Record first: runHerdrPane isolates this display callback, so a renderer exception after the
-                // observation cannot suppress the authoritative running event.
-                recordRunning("herdr", { id: paneId, agentName });
-                onProgress?.({ paneId, agentName, state: "running" });
-              },
-              onTab: preparedWorkspace ? (tabId) => preparedWorkspace.lease.attachHerdrTab(tabId) : undefined,
-              onNativeTab: (tabId) => retention.native({ tabId }),
-              onSnapshot: onProgress ? (snapshot) => onProgress({ snapshot }) : undefined,
-            })
-          : await runCapturedExecution({
-              executionId,
-              sessionPath: activitySession.path,
-              onReadCleanup,
-              onOwnership: async (identity) => {
-                input.capacityReservation?.bindOwnership(identity);
-                await preparedWorkspace?.lease.attachCapturedWorker(identity);
-              },
-              command: "pi",
-              args,
-              env: mergeChildEnv(process.env, plan.env),
-              cwd,
-              signal: executionSignal,
-              // SIGTERM gets only grace that fits INSIDE the recorded deadline. The independent hard timer
-              // prevents a delayed soft-timeout callback from starting a fresh grace period beyond that bound.
-              timeoutMs: Math.max(1, remainingTimeoutMs - terminationGraceMs),
-              hardDeadlineAt: Date.parse(deadlineAt),
-              idleTimeoutMs: configuredIdleMs,
-              activityProbe: probe,
-              onOutput: onProgress ? (chunk) => onProgress({ chunk }) : undefined,
-              onObservation: (stream, bytes) => retention.capture(stream, bytes),
-              onSpawn: (pid) => {
-                childPid = pid;
-                // Lease attachment is a security hook and may fail the spawn. The shared reporters isolate
-                // display exceptions before they reach this callback; runChild deliberately kills on any error
-                // here, so presentation must never be added directly without that reporter boundary.
+      let displayHerdr: ((text: string) => void) | undefined;
+      const output = await runCapturedExecution(
+        {
+          executionId,
+          sessionPath: activitySession.path,
+          onReadCleanup,
+          onOwnership: async (identity) => {
+            runtime?.bind(identity);
+            input.capacityReservation?.bindOwnership(identity);
+            await preparedWorkspace?.lease.attachCapturedWorker(identity);
+          },
+          command: "pi",
+          args,
+          env: mergeChildEnv(process.env, plan.env),
+          cwd,
+          signal: executionSignal,
+          // SIGTERM gets only grace that fits INSIDE the recorded deadline. The independent hard timer
+          // prevents a delayed soft-timeout callback from starting a fresh grace period beyond that bound.
+          timeoutMs: Math.max(1, remainingTimeoutMs - terminationGraceMs),
+          hardDeadlineAt: Date.parse(deadlineAt),
+          idleTimeoutMs: configuredIdleMs,
+          activityProbe: probe,
+          onOutput: (chunk) => {
+            displayHerdr?.(chunk);
+            onProgress?.({ chunk });
+          },
+          onObservation: (stream, bytes) => retention.capture(stream, bytes),
+          onSpawn: (pid) => {
+            childPid = pid;
+            // Lease attachment is a security hook and may fail the spawn. The shared reporters isolate
+            // display exceptions before they reach this callback; runChild deliberately kills on any error
+            // here, so presentation must never be added directly without that reporter boundary.
 
-                retention.native({ pid });
-                recordRunning("process");
-                onProgress?.({ state: "running" });
-              },
-            });
+            retention.native({ pid });
+            recordRunning(session.executor.kind);
+            onProgress?.({ state: "running" });
+          },
+        },
+        session.executor.kind === "herdr"
+          ? (request) =>
+              runHerdrOwned(request, {
+                onDisplay: (display) => {
+                  displayHerdr = display;
+                },
+                workspace: resolveWorkspace(process.env),
+                keepPane: process.env[ENV_HERDR_KEEP_PANE] === "1",
+                onPane: (paneId, tabId) => {
+                  retention.native({ paneId, tabId });
+                  onProgress?.({ paneId, state: "starting" });
+                },
+              })
+          : undefined,
+      );
 
       if (sessionFlag >= 0) retention.observeSession({ source: "pi-session-file", value: plan.args[sessionFlag + 1] });
       retention.capture("result", Buffer.from(output.text), true);

package/extensions/execution-controls.ts

@@ -0,0 +1,42 @@
+/** Operator-facing execution settings; display never changes admission, deadlines or retention. */
+import { timeoutFromEnv, idleTimeoutFromEnv } from "../src/kernel/run-child.ts";
+import { timeoutMsFromEnv } from "../src/governance/approval-prompt.ts";
+import {
+  ENV_APPROVAL_TIMEOUT,
+  ENV_CHILD_TIMEOUT,
+  ENV_CHILD_IDLE_TIMEOUT,
+  ENV_EXECUTION_ARCHIVE,
+} from "../src/kernel/env-names.ts";
+
+export function renderExecutionControls(
+  nativeSessionRoot: string | undefined,
+  env: NodeJS.ProcessEnv = process.env,
+): string[] {
+  let approval: string;
+  try {
+    const timeout = timeoutMsFromEnv(env[ENV_APPROVAL_TIMEOUT]);
+    approval = timeout === undefined ? "wait for human; no deadline" : `${timeout / 1000}s configured deadline`;
+  } catch {
+    approval = `${ENV_APPROVAL_TIMEOUT} invalid; a needed new prompt will refuse`;
+  }
+  const source = (key: string) => (env[key] === undefined ? "default" : `from ${key}; zero/invalid uses default`);
+  return [
+    `  child wall ${timeoutFromEnv(env[ENV_CHILD_TIMEOUT]) / 1000}s (${source(ENV_CHILD_TIMEOUT)})`,
+    `  child idle ${idleTimeoutFromEnv(env[ENV_CHILD_IDLE_TIMEOUT]) / 1000}s (${source(ENV_CHILD_IDLE_TIMEOUT)})`,
+    "             process safety controls; no time/token budget is added to the model prompt",
+    `  approval   ${approval}`,
+    `  transcripts ${
+      nativeSessionRoot === undefined
+        ? "off"
+        : nativeSessionRoot
+          ? `opted in at ${JSON.stringify(nativeSessionRoot)}; destination checked at dispatch`
+          : "opted in but native session root is missing"
+    }`,
+    `  diagnostics ${
+      env[ENV_EXECUTION_ARCHIVE]
+        ? `configured at ${JSON.stringify(env[ENV_EXECUTION_ARCHIVE])}; check each result's retention status`
+        : "off"
+    }`,
+    "             local diagnostic retention is separate from JEV/LoRA consent",
+  ];
+}

package/extensions/executor-session.ts

@@ -1,9 +1,10 @@
 import { chooseExecutor, needsProbe, ENV_HERDR } from "../src/executors/executor.ts";
+import { qualifyHerdr } from "../src/executors/herdr-qualification.ts";
 import { probeHerdr } from "../src/executors/herdr-cli.ts";
 import type { GrantsSession } from "./session.ts";
 
 /** Settle one executor at session start; a later daemon change never relocates siblings. */
 export async function resolveExecutor(session: GrantsSession): Promise<void> {
   const raw = process.env[ENV_HERDR];
-  session.executor = chooseExecutor(raw, needsProbe(raw) ? await probeHerdr() : null);
+  session.executor = chooseExecutor(raw, needsProbe(raw) ? await qualifyHerdr(await probeHerdr()) : null);
 }

package/extensions/grants-command.ts

@@ -12,6 +12,7 @@
  * being whatever happened to be in scope.
  */
 
+import { renderExecutionControls } from "./execution-controls.ts";
 import type { Capability } from "../src/kernel/resolve.ts";
 import type { ExecutorChoice } from "../src/executors/executor.ts";
 import type { Catalog } from "../src/kernel/catalog.ts";
@@ -25,6 +26,8 @@ import type { ResolvedDefinitionRuntime } from "./definition-runtime.ts";
 export interface GrantsCommandContext {
   cwd: string;
   governed: boolean;
+  /** Host opt-in captured by this session, not a later environment reread. */
+  nativeSessionRoot?: string;
   ownGrant: Capability[];
   /**
    * Which executor this session settled on, and why — ADR-0031.
@@ -407,6 +410,7 @@ export const grantsCommand = {
       // ADR-0031, and its probe is only defensible because this line exists. Placed next to `holding` so the
       // two facts about what a spawn will be sit together.
       `  executor   ${executor.disclosure}`,
+      ...renderExecutionControls(ctx.grants.nativeSessionRoot),
       `  depth      ${depth} of max ${maxDepth}${maxDepth <= 0 ? " (spawning disabled)" : ""}`,
       `  ledger     ${ledgerPath || "(not recording — set PI_DADDY_LEDGER)"}`,
       `  approvals  ${sessionApprovals.size} this session, ${valid.size} persisted` +

package/extensions/grants.ts

@@ -20,6 +20,7 @@
  * spawn triggered the human prompt, and `childEnv` clamps it to the grant again on the way out. Each
  * child derives its own grant from the tool array of its first provider request.
  */
+import { registerRuntimeSnapshot } from "./runtime-snapshot.ts";
 import { fileURLToPath } from "node:url";
 import { homedir } from "node:os";
 import { join, resolve } from "node:path";
@@ -80,6 +81,7 @@ export default function (pi: ExtensionAPI, trustedSession?: GrantsSession) {
   const session = trustedSession ?? createGrantsSession(extensionPath, undefined, observerExtensionPath);
   session.currentThinking = typeof pi.getThinkingLevel === "function" ? () => pi.getThinkingLevel() : undefined;
   registerActivityTimeline(pi, session);
+  const runtimeSnapshot = registerRuntimeSnapshot(pi, session);
   const dashboardPluginRoot = fileURLToPath(new URL("../herdr-plugin/", import.meta.url));
   const dashboardPaths = defaultDashboardPaths(agentDir());
   // Definitions are registered only after owner-bound session_start. Until then there is no delegation
@@ -215,6 +217,7 @@ export default function (pi: ExtensionAPI, trustedSession?: GrantsSession) {
       // (R-60), and `probeHerdr` is documented as never throwing precisely so this is belt-and-braces.
       try {
         await resolveExecutor(session);
+        if (session.reloadLifecycle === reload.lifecycle) await runtimeSnapshot.bind(ctx);
       } catch (error) {
         if (session.reloadLifecycle !== reload.lifecycle) return undefined;
         // Says what is actually true of the state left behind, which depends on the variable: with
@@ -459,6 +462,7 @@ export default function (pi: ExtensionAPI, trustedSession?: GrantsSession) {
                 },
               }
             : {}),
+          nativeSessionRoot: session.nativeSessionRoot,
           catalog: session.catalog,
           definitions: session.definitions,
           sessionApprovals: session.sessionApprovals,

package/extensions/reload-environment.ts

@@ -4,6 +4,10 @@ import type { BoundedReadCleanupError } from "../src/kernel/bounded-read.ts";
 
 /** The root baseline and latest child publication for one real Pi session owner. */
 export interface ReloadLifecycle {
+  runtimeSnapshotUnsubscribe?: () => void;
+  runtimeSnapshotGeneration?: object;
+  runtimeSettlements?: Map<string, import("../src/governance/runtime-settlement.ts").RuntimeSettlement>;
+  runtimeSettlement?: import("../src/governance/runtime-settlement.ts").RuntimeSettlement;
   root: Record<string, string | undefined>;
   /** Never replaced for the same owner, even when an explicit root environment changes. */
   capacity?: OwnerCapacity;
@@ -99,6 +103,10 @@ export function bindReloadLifecycle(
         activityRootId: existing.activityRootId,
         episodeId: existing.episodeId,
         capacity: existing.capacity,
+        runtimeSettlement: existing.runtimeSettlement,
+        runtimeSettlements: existing.runtimeSettlements,
+        runtimeSnapshotUnsubscribe: existing.runtimeSnapshotUnsubscribe,
+        runtimeSnapshotGeneration: existing.runtimeSnapshotGeneration,
       };
       holder.owners.set(owner, existing);
     }

package/extensions/runtime-snapshot.ts

@@ -0,0 +1,123 @@
+/** Trusted extension event bridge. Tool calls and model-produced text cannot supply runtime facts. */
+import type { ExtensionAPI, ExtensionContext } from "@earendil-works/pi-coding-agent";
+import { realpath } from "node:fs/promises";
+import { openRuntimeSettlement, settlementHash } from "../src/governance/runtime-settlement.ts";
+import { reconcileDelegationCapacity } from "./session-capacity.ts";
+import { agentDir } from "../src/kernel/project-paths.ts";
+import type { GrantsSession } from "./session.ts";
+export const RUNTIME_SNAPSHOT_EVENT = "pi-daddy:runtime-snapshot:v1";
+export function registerRuntimeSnapshot(
+  pi: ExtensionAPI,
+  session: GrantsSession,
+): {
+  bind(ctx: ExtensionContext): Promise<void>;
+} {
+  let bound: { sessionId: string; cwd: string; lifecycle: object } | undefined, problem: string | undefined;
+  const generation = {};
+  let bindSequence = 0;
+  const unsubscribe = pi.events?.on?.(RUNTIME_SNAPSHOT_EVENT, (input: unknown) => {
+    const request = input as {
+      version?: number;
+      requestId?: string;
+      sessionId?: string;
+      cwd?: string;
+      reply?: (value: unknown) => void;
+    };
+    if (
+      request?.version !== 1 ||
+      typeof request.requestId !== "string" ||
+      request.requestId.length > 512 ||
+      typeof request.reply !== "function"
+    )
+      return;
+    if (bound && session.reloadLifecycle.runtimeSnapshotGeneration !== generation) return;
+    void (async () => {
+      const current = bound,
+        lifecycle = session.reloadLifecycle;
+      const unavailable = (reason: string) => ({
+        version: 1,
+        requestId: request.requestId,
+        sessionId: current?.sessionId ?? "",
+        cwd: current?.cwd ?? "",
+        ownerScope: "",
+        ownerId: "",
+        backend: session.executor.kind,
+        qualified: false,
+        state: "unknown",
+        evidenceDigest: settlementHash({ reason }),
+        settledExecutionIds: [],
+        outstandingExecutionIds: [],
+        reason,
+      });
+      if (
+        !current ||
+        current.lifecycle !== lifecycle ||
+        request.sessionId !== current.sessionId ||
+        request.cwd !== current.cwd ||
+        !lifecycle.runtimeSettlement
+      ) {
+        request.reply!(unavailable(problem ?? "runtime owner is not ready"));
+        return;
+      }
+      try {
+        if (Array.isArray(session.capacity.retainedReservations)) await reconcileDelegationCapacity(session);
+        const snapshot = await lifecycle.runtimeSettlement.snapshot();
+        if (
+          bound !== current ||
+          session.reloadLifecycle !== lifecycle ||
+          lifecycle.runtimeSnapshotGeneration !== generation
+        ) {
+          request.reply!(unavailable("runtime owner changed during snapshot"));
+          return;
+        }
+        const qualified = !session.executor.refusal && !session.discoveryCleanupFailure && !session.capacityRefusal;
+        request.reply!({
+          version: 1,
+          requestId: request.requestId,
+          sessionId: current.sessionId,
+          cwd: current.cwd,
+          ...snapshot,
+          backend: session.executor.kind,
+          qualified,
+          state: !qualified
+            ? "unknown"
+            : session.capacity.reserved > 0 && snapshot.state === "idle"
+              ? "busy"
+              : snapshot.state,
+          ...(problem ? { reason: problem } : {}),
+        });
+      } catch (error) {
+        request.reply!(unavailable(String(error)));
+      }
+    })().catch(() => undefined);
+  });
+  return {
+    async bind(ctx) {
+      const sequence = ++bindSequence,
+        lifecycle = session.reloadLifecycle;
+      lifecycle.runtimeSettlement = undefined;
+      bound = undefined;
+      problem = undefined;
+      try {
+        const sessionId = ctx.sessionManager.getSessionId(),
+          cwd = await realpath(ctx.cwd);
+        if (sequence !== bindSequence || session.reloadLifecycle !== lifecycle) return;
+        if (lifecycle.runtimeSnapshotUnsubscribe !== unsubscribe) lifecycle.runtimeSnapshotUnsubscribe?.();
+        lifecycle.runtimeSnapshotUnsubscribe = unsubscribe;
+        lifecycle.runtimeSnapshotGeneration = generation;
+        lifecycle.runtimeSettlements ??= new Map();
+        const key = JSON.stringify([sessionId, cwd]);
+        let runtime = lifecycle.runtimeSettlements.get(key);
+        if (!runtime) {
+          runtime = await openRuntimeSettlement(agentDir(), sessionId, cwd);
+          lifecycle.runtimeSettlements.set(key, runtime);
+        }
+        if (sequence !== bindSequence || session.reloadLifecycle !== lifecycle) return;
+        lifecycle.runtimeSettlement = runtime;
+        bound = { sessionId, cwd, lifecycle: session.reloadLifecycle };
+      } catch (error) {
+        if (sequence === bindSequence && session.reloadLifecycle === lifecycle) problem = String(error);
+      }
+    },
+  };
+}

package/extensions/session.ts

@@ -693,7 +693,7 @@ export function createGrantsSession(
       // Read live off `session.executor` (ADR-0031) rather than a boolean captured in the factory: the probe
       // has not run when this session object is built, so a captured value would plan `--print` for a session
       // that turns out to use panes — and `runHerdrPane` refuses a plan containing `--print` by design.
-      interactive: session.executor.kind === "herdr",
+      interactive: false, // Both qualified backends use the same one-shot Pi JSON protocol.
       ...(approved ? { approved } : {}),
     }),
     storeCwd,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-daddy",
-  "version": "0.45.0",
+  "version": "0.46.1",
   "description": "Capability governance for pi sub-agents: spawn Agent Skills (SKILL.md) definitions whose allowed-tools becomes a grant that can only narrow going down a delegation tree, enforced by pi's own --tools allowlist, with an append-only ledger.",
   "keywords": [
     "pi-package",

package/src/executors/captured-execution.ts

@@ -15,6 +15,7 @@ export async function runCapturedExecution(
     sessionPath: string;
     onReadCleanup?: (error: BoundedReadCleanupError) => void;
   },
+  runOwned: typeof runOwnedChild = runOwnedChild,
 ): Promise<CapturedExecutionResult> {
   let directory: string;
   try {
@@ -36,7 +37,7 @@ export async function runCapturedExecution(
   }
   const capture = new ChildFinalCapture(request.onOutput, request.onReadCleanup);
   const args = [...request.args.slice(0, -1), "--mode", "json", request.args.at(-1)!];
-  const output = await runOwnedChild({
+  const output = await runOwned({
     ...request,
     args,
     ownershipDir: join(directory, "ownership"),

package/src/executors/executor.ts

@@ -44,15 +44,17 @@ export function needsProbe(raw: string | undefined): boolean {
 }
 
 export const HERDR_UNQUALIFIED_REASON =
-  "Herdr governed execution is not qualified for complete current finals and subtree cleanup in this release. " +
+  "Herdr governed execution is not qualified for complete current finals and subtree cleanup on the detected transport. " +
   "Delegation is refused; set PI_DADDY_HERDR=0 explicitly to select captured execution. No backend fallback occurs.";
 
 export function chooseExecutor(raw: string | undefined, probe: HerdrProbe | null): ExecutorChoice {
   const choice = selectExecutor(raw, probe);
   if (choice.kind !== "herdr") return choice;
+  if (!choice.refusal && probe?.qualified === true)
+    return { ...choice, disclosure: `${choice.disclosure} — qualified native ownership` };
   return {
     ...choice,
-    refusal: [choice.refusal, HERDR_UNQUALIFIED_REASON].filter(Boolean).join(" "),
+    refusal: [choice.refusal, HERDR_UNQUALIFIED_REASON, probe?.qualificationReason].filter(Boolean).join(" "),
     disclosure: `${choice.disclosure} — unqualified; governed delegation will refuse`,
   };
 }

package/src/executors/herdr-cli.ts

@@ -19,17 +19,22 @@ export type HerdrExec = (args: string[]) => Promise<{ code: number | null; stdou
 
 export const defaultExec: HerdrExec = (args) =>
   new Promise((settle) => {
-    execFile("herdr", args, { maxBuffer: 32 * 1024 * 1024 }, (error, stdout, stderr) => {
-      const raw = (error as { code?: unknown } | null)?.code;
-      const code = typeof raw === "number" ? raw : error ? 1 : 0;
-      // **A string `code` is a spawn failure, and it used to be thrown away.** `ENOENT` — herdr not installed —
-      // arrives as `code: "ENOENT"`, so the numeric test failed, the message was dropped, and an operator with
-      // `PI_DADDY_HERDR=1` on a machine without herdr was told *"herdr is not answering (unparseable herdr
-      // reply: (no output))"* rather than that the binary is missing. Rule 8 wants the loud version, and this is
-      // the first diagnostic such an operator meets.
-      const spawnFailure = typeof raw === "string" ? `herdr could not be run (${raw}): ${error?.message ?? ""}` : "";
-      settle({ code, stdout: String(stdout), stderr: spawnFailure || String(stderr) });
-    });
+    execFile(
+      "herdr",
+      args,
+      { maxBuffer: 32 * 1024 * 1024, timeout: 10000, killSignal: "SIGKILL" },
+      (error, stdout, stderr) => {
+        const raw = (error as { code?: unknown } | null)?.code;
+        const code = typeof raw === "number" ? raw : error ? 1 : 0;
+        // **A string `code` is a spawn failure, and it used to be thrown away.** `ENOENT` — herdr not installed —
+        // arrives as `code: "ENOENT"`, so the numeric test failed, the message was dropped, and an operator with
+        // `PI_DADDY_HERDR=1` on a machine without herdr was told *"herdr is not answering (unparseable herdr
+        // reply: (no output))"* rather than that the binary is missing. Rule 8 wants the loud version, and this is
+        // the first diagnostic such an operator meets.
+        const spawnFailure = typeof raw === "string" ? `herdr could not be run (${raw}): ${error?.message ?? ""}` : "";
+        settle({ code, stdout: String(stdout), stderr: spawnFailure || String(stderr) });
+      },
+    );
   });
 
 /**
@@ -44,7 +49,7 @@ export function parseReply(reply: { stdout: string; stderr: string }): {
   error?: string;
 } {
   try {
-    const parsed = JSON.parse(reply.stdout) as {
+    const parsed = JSON.parse(reply.stdout.trim() || reply.stderr.trim()) as {
       result?: Record<string, unknown>;
       error?: { message?: string; code?: string };
     };
@@ -63,6 +68,8 @@ export const PROBE_TIMEOUT_MS = 2000;
 
 export interface HerdrProbe {
   ok: boolean;
+  qualified?: boolean;
+  qualificationReason?: string;
   /** herdr's own words when it is not reachable. Carried so the disclosure line can name the reason. */
   error?: string;
 }