pi-daddy 0.46.1 → 0.47.1

package/extensions/session.ts

@@ -1,3 +1,5 @@
+import type { EcosystemVersions } from "../src/products/ecosystem-versions.ts";
+import type { AutoModeReader } from "../src/kernel/auto-mode.ts";
 /**
  * The session object — the one place this extension's state is named.
  *
@@ -141,6 +143,9 @@ export function activityChildEnv(activity: { rootId: string; path: string; taskI
 }
 /** Keep each child's pane after it finishes, for inspection. Off by default: fan-out would flood it. */
 export interface GrantsSession extends NativeSessionHost {
+  ecosystemVersions?: () => EcosystemVersions;
+  autoMode?: AutoModeReader;
+  autoModeFailure?: string;
   /** Reconciled from the actual owner root on reload; captured call owners stay immutable. */
   publicEvidence?: PublicEvidenceOwner;
   /** Legacy PI_GRANTS_* names adopted at construction (ADR-0076 PR 3b); the session-start warning names them. */
@@ -659,43 +664,47 @@ export function createGrantsSession(
     discovery: Object.freeze({ ...discovery }),
     catalog: emptyCatalog,
     catalogReady: Promise.resolve(emptyCatalog),
-    delegationContext: async (approved?: InheritableApproval[]) => ({
-      ownGrant: session.ownGrant,
-      episodeId: session.episodeId,
-      depth: session.depth,
-      maxDepth: session.maxDepth,
-      gated: session.gated,
-      ledgerPath: session.ledgerPath,
-      extensionPath: session.extensionPath,
-      observerExtensionPath: session.observerExtensionPath,
-      childEnv: activityChildEnv(session.activity),
-      // ADR-0042: the pin this session holds, handed to the kernel so a delegated child inherits a narrowed
-      // one through the same builder `publishChildEnv` uses. Read here rather than in the kernel so there is
-      // one place that knows the environment is where a session's own pin lives.
-      ...(session.workspacePin ? { workspacePin: session.workspacePin } : {}),
-      // Context is staged only after its capability survives the ceiling, grant and gate.
-      stageHandoff: (granted, options) =>
-        createHandoffStager({
-          cwd: session.cwd,
-          forkRoot: join(agentDir(), "context-forks"),
-          ...(session.parentSession ? { parentSession: session.parentSession } : {}),
-        })(granted, options),
-      catalog: await delegationCatalog(session),
-      // R-32: where each granted skill lives, so `planSpawn` can pass `--skill` for those and only those.
-      // Derived from the catalog's own `source`, so it cannot drift from what was discovered.
-      skillPaths: skillPathsFromCatalog(await delegationCatalog(session)),
-      // ADR-0016: operator-authored SKILL.md definitions, so `delegate({agent})` can name one.
-      definitions: session.definitions,
-      // The herdr executor drives the child after starting it, so its plan must NOT carry `--print`.
-      // Threaded through the plan rather than patched afterwards: the argv is what the ledger records, and
-      // an executor quietly rewriting it would make the record describe a spawn that did not happen.
-      //
-      // Read live off `session.executor` (ADR-0031) rather than a boolean captured in the factory: the probe
-      // has not run when this session object is built, so a captured value would plan `--print` for a session
-      // that turns out to use panes — and `runHerdrPane` refuses a plan containing `--print` by design.
-      interactive: false, // Both qualified backends use the same one-shot Pi JSON protocol.
-      ...(approved ? { approved } : {}),
-    }),
+    delegationContext: async (approved?: InheritableApproval[]) => {
+      if (session.autoModeFailure) throw new Error(session.autoModeFailure);
+      return {
+        autoModeRef: session.autoMode?.reference,
+        ownGrant: session.ownGrant,
+        episodeId: session.episodeId,
+        depth: session.depth,
+        maxDepth: session.maxDepth,
+        gated: session.gated,
+        ledgerPath: session.ledgerPath,
+        extensionPath: session.extensionPath,
+        observerExtensionPath: session.observerExtensionPath,
+        childEnv: activityChildEnv(session.activity),
+        // ADR-0042: the pin this session holds, handed to the kernel so a delegated child inherits a narrowed
+        // one through the same builder `publishChildEnv` uses. Read here rather than in the kernel so there is
+        // one place that knows the environment is where a session's own pin lives.
+        ...(session.workspacePin ? { workspacePin: session.workspacePin } : {}),
+        // Context is staged only after its capability survives the ceiling, grant and gate.
+        stageHandoff: (granted, options) =>
+          createHandoffStager({
+            cwd: session.cwd,
+            forkRoot: join(agentDir(), "context-forks"),
+            ...(session.parentSession ? { parentSession: session.parentSession } : {}),
+          })(granted, options),
+        catalog: await delegationCatalog(session),
+        // R-32: where each granted skill lives, so `planSpawn` can pass `--skill` for those and only those.
+        // Derived from the catalog's own `source`, so it cannot drift from what was discovered.
+        skillPaths: skillPathsFromCatalog(await delegationCatalog(session)),
+        // ADR-0016: operator-authored SKILL.md definitions, so `delegate({agent})` can name one.
+        definitions: session.definitions,
+        // The herdr executor drives the child after starting it, so its plan must NOT carry `--print`.
+        // Threaded through the plan rather than patched afterwards: the argv is what the ledger records, and
+        // an executor quietly rewriting it would make the record describe a spawn that did not happen.
+        //
+        // Read live off `session.executor` (ADR-0031) rather than a boolean captured in the factory: the probe
+        // has not run when this session object is built, so a captured value would plan `--print` for a session
+        // that turns out to use panes — and `runHerdrPane` refuses a plan containing `--print` by design.
+        interactive: false, // Both qualified backends use the same one-shot Pi JSON protocol.
+        ...(approved ? { approved } : {}),
+      };
+    },
     storeCwd,
     ...(grantStoreRefusal ? { grantStoreRefusal } : {}),
     adoptGrant: (grant: Capability[], projectLedger?: string) => {
@@ -725,6 +734,7 @@ export function createGrantsSession(
     },
     publishChildEnv: () => {
       const env = childEnv({
+        autoModeRef: session.autoMode?.reference,
         ownGrant: session.ownGrant,
         episodeId: session.episodeId,
         depth: session.depth,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-daddy",
-  "version": "0.46.1",
+  "version": "0.47.1",
   "description": "Capability governance for pi sub-agents: spawn Agent Skills (SKILL.md) definitions whose allowed-tools becomes a grant that can only narrow going down a delegation tree, enforced by pi's own --tools allowlist, with an append-only ledger.",
   "keywords": [
     "pi-package",
@@ -53,7 +53,7 @@
     "typecheck": "tsc -p tsconfig.check.json",
     "test": "node scripts/unit-tests.ts",
     "test:integration": "node --test test-integration/*.it.ts",
-    "test:integration:ci": "node --test test-integration/approval.it.ts test-integration/governance.it.ts test-integration/activity.it.ts",
+    "test:integration:ci": "node --test test-integration/approval.it.ts test-integration/governance.it.ts test-integration/activity.it.ts test-integration/auto-chain.it.ts",
     "contracts:generate": "node scripts/generate-ledger-record-contract.ts",
     "prepack": "npm run build",
     "test:smoke": "node scripts/smoke-installed.mjs",

package/src/governance/approval-prompt.ts

@@ -10,6 +10,8 @@
  * no-op UI context whose `select` resolves undefined, so even a missed `hasUI` check would deny.
  */
 
+import { randomUUID } from "node:crypto";
+import type { AutoModeReader } from "../kernel/auto-mode.ts";
 import { approvalKey, offeredScopes, type ApprovalPath, type ApprovalScope } from "../kernel/approval.ts";
 import type { Capability } from "../kernel/resolve.ts";
 
@@ -72,6 +74,8 @@ export interface PromptOutcome {
    * one. The rider's honest source is `session`, and this flag is how the caller can tell.
    */
   joined?: boolean;
+  /** Provisional Auto permission; the admission caller must still check the live owner policy. */
+  source?: "auto";
 }
 
 export interface ApprovalGateOptions {
@@ -82,6 +86,7 @@ export interface ApprovalGateOptions {
   mode: string;
   /** Resolve only when this caller must open a new dialog; unused invalid settings cannot revoke authority. */
   timeoutMs?: number | (() => number | undefined);
+  autoMode?: AutoModeReader;
 }
 
 export interface ApprovalGate {
@@ -106,6 +111,8 @@ function labelToScope(label: string, scopes: ApprovalScope[]): ApprovalScope | n
   return scopes.find((s) => SCOPE_LABELS[s] === label) ?? null;
 }
 
+const autoApproval = (): PromptOutcome => ({ scope: "once", kind: "granted", source: "auto" });
+
 const interrupted = (request: PromptRequest, kind: "expired" | "aborted"): PromptOutcome => ({
   scope: null,
   kind,
@@ -124,26 +131,61 @@ async function selectApproval(
   const timeout = typeof options.timeoutMs === "function" ? options.timeoutMs() : options.timeoutMs;
   const controller = new AbortController();
   let outcome: PromptOutcome | undefined;
+  let settled = false;
   let wake!: (value: PromptOutcome) => void;
   const stopped = new Promise<PromptOutcome>((resolve) => {
     wake = resolve;
   });
-  const stop = (kind: "expired" | "aborted") => {
-    if (outcome) return;
-    outcome = interrupted(request, kind);
+  const settle = (next: PromptOutcome) => {
+    if (settled) return;
+    settled = true;
+    outcome = next;
     // Resolve our tagged outcome before a UI reacts to abort by returning undefined.
     wake(outcome);
     controller.abort();
   };
+  const stop = (kind: "expired" | "aborted") => settle(interrupted(request, kind));
   const abort = () => stop("aborted");
   request.signal?.addEventListener("abort", abort, { once: true });
   const timer = timeout === undefined ? undefined : setTimeout(() => stop("expired"), timeout);
+  let untrack: (() => void) | undefined;
   try {
     if (request.signal?.aborted) stop("aborted");
     if (outcome) return outcome;
-    const chosen = await Promise.race([options.ui.select(title, labels, { signal: controller.signal }), stopped]);
+    untrack = options.autoMode?.trackPending({
+      id: randomUUID(),
+      subject: request.subject,
+      capability: request.capability,
+    });
+    const selection = options.ui.select(title, labels, { signal: controller.signal }).then((chosen) => {
+      settled = true;
+      return chosen;
+    });
+    if (options.autoMode) {
+      const auto = options.autoMode;
+      void (async () => {
+        while (!controller.signal.aborted) {
+          await auto.waitEnabled(controller.signal);
+          // A notification is not authority: ON may already have changed back to OFF.
+          if (!controller.signal.aborted && (await auto.read()).enabled) {
+            settle(autoApproval());
+            return;
+          }
+        }
+      })().catch((error) => {
+        if (!controller.signal.aborted)
+          settle({
+            scope: null,
+            kind: "error",
+            reason: `Auto permission policy unavailable, denying (${String(error)})`,
+          });
+      });
+    }
+    const chosen = await Promise.race([selection, stopped]);
     return outcome ?? chosen;
   } finally {
+    controller.abort();
+    untrack?.();
     if (timer !== undefined) clearTimeout(timer);
     request.signal?.removeEventListener("abort", abort);
   }
@@ -211,6 +253,15 @@ export function createApprovalGate(
   inFlight: InFlightApprovals = new Map(),
 ): ApprovalGate {
   const ask = async (request: PromptRequest): Promise<PromptOutcome> => {
+    // A queued once waiter owns its own decision. Auto may have changed while it joined another dialog.
+    if (options.autoMode) {
+      try {
+        if ((await options.autoMode.read()).enabled)
+          return request.signal?.aborted ? interrupted(request, "aborted") : autoApproval();
+      } catch (error) {
+        return { scope: null, kind: "error", reason: `Auto permission policy unavailable, denying (${String(error)})` };
+      }
+    }
     const scopes = offeredScopes(request.path);
     const title =
       `grants: approve ${request.capability} for ${request.subject}?` +
@@ -251,6 +302,13 @@ export function createApprovalGate(
   return {
     async request(request: PromptRequest): Promise<PromptOutcome> {
       if (request.signal?.aborted) return interrupted(request, "aborted");
+      try {
+        if (options.autoMode && (await options.autoMode.read()).enabled) {
+          return request.signal?.aborted ? interrupted(request, "aborted") : autoApproval();
+        }
+      } catch (error) {
+        return { scope: null, kind: "error", reason: `Auto permission policy unavailable, denying (${String(error)})` };
+      }
       if (!options.hasUI) {
         // Nobody was there to ask — distinct from a person declining, which is why this is its own kind
         // rather than being folded into "declined" (see PromptOutcomeKind).

package/src/governance/auto-mode-policy.ts

@@ -0,0 +1,297 @@
+/** Root-owned live Auto authority. Descendants receive read/admit access, never mutation access. */
+import { randomBytes, randomUUID } from "node:crypto";
+import { chmod, unlink } from "node:fs/promises";
+import { unlinkSync } from "node:fs";
+import { createServer, createConnection, type Socket } from "node:net";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import type {
+  AutoModeReader,
+  AutoModeRef,
+  AutoModeSnapshot,
+  AutoModeSource,
+  PendingApproval,
+} from "../kernel/auto-mode.ts";
+
+const aborted = () => new Error("Auto approval request aborted");
+const unavailable = () => new Error("Auto policy owner is unavailable; no automatic permission was granted");
+const validPending = (value: unknown): value is PendingApproval => {
+  if (!value || typeof value !== "object") return false;
+  const v = value as PendingApproval;
+  return [v.id, v.subject, v.capability].every((x) => typeof x === "string" && x.length > 0 && x.length <= 256);
+};
+export interface AutoModeAuthority extends AutoModeReader {
+  snapshot(): AutoModeSnapshot;
+  set(enabled: boolean, source: AutoModeSource): AutoModeSnapshot;
+}
+
+export async function createAutoModeAuthority(initial: {
+  enabled: boolean;
+  source: AutoModeSource;
+}): Promise<AutoModeAuthority> {
+  const reference = {
+    socketPath: join(tmpdir(), `daddy-auto-${process.pid}-${randomBytes(8).toString("hex")}.sock`),
+    token: randomBytes(24).toString("hex"),
+    ownerId: randomBytes(16).toString("hex"),
+  };
+  let enabled = initial.enabled,
+    source = initial.source,
+    revision = 0,
+    closed = false;
+  const pending = new Map<string, PendingApproval>();
+  const waiters = new Set<() => void>();
+  const sockets = new Set<Socket>();
+  const assertOpen = () => {
+    if (closed) throw unavailable();
+  };
+  const snapshot = (): AutoModeSnapshot => {
+    assertOpen();
+    return {
+      enabled,
+      source,
+      revision,
+      ownerId: reference.ownerId,
+      pendingApprovals: [...pending.values()].map((v) => ({ ...v })),
+    };
+  };
+  const waitEnabled = async (signal: AbortSignal): Promise<void> => {
+    assertOpen();
+    if (signal.aborted) throw aborted();
+    if (enabled) return;
+    await new Promise<void>((resolve, reject) => {
+      const clean = () => {
+        waiters.delete(wake);
+        signal.removeEventListener("abort", cancel);
+      };
+      const wake = () => {
+        clean();
+        closed ? reject(unavailable()) : resolve();
+      };
+      const cancel = () => {
+        clean();
+        reject(aborted());
+      };
+      waiters.add(wake);
+      signal.addEventListener("abort", cancel, { once: true });
+      if (signal.aborted) cancel();
+    });
+  };
+  const trackPending = (approval: PendingApproval) => {
+    assertOpen();
+    if (!validPending(approval)) throw new Error("Invalid pending approval");
+    const key = randomUUID();
+    pending.set(key, { ...approval });
+    return () => {
+      pending.delete(key);
+    };
+  };
+  const server = createServer((socket) => {
+    sockets.add(socket);
+    socket.setEncoding("utf8");
+    socket.setTimeout(2000, () => socket.destroy());
+    const controller = new AbortController();
+    let input = "",
+      handled = false,
+      untrack: (() => void) | undefined;
+    socket.on("error", () => {});
+    socket.once("close", () => {
+      sockets.delete(socket);
+      controller.abort();
+      untrack?.();
+    });
+    const reply = (value: unknown) => {
+      if (!socket.destroyed) socket.end(JSON.stringify(value) + "\n");
+    };
+    socket.on("data", (chunk) => {
+      if (handled) {
+        socket.destroy();
+        return;
+      }
+      input += chunk;
+      if (input.length > 4096) {
+        socket.destroy();
+        return;
+      }
+      if (!input.includes("\n")) return;
+      handled = true;
+      try {
+        const request = JSON.parse(input.slice(0, input.indexOf("\n")));
+        if (request.token !== reference.token || request.ownerId !== reference.ownerId)
+          throw new Error("Unauthorized Auto policy request");
+        assertOpen();
+        if (request.action === "read") reply({ ok: true, value: snapshot() });
+        else if (request.action === "admit") reply({ ok: true, value: enabled });
+        else if (request.action === "wait") {
+          socket.setTimeout(0);
+          void waitEnabled(controller.signal)
+            .then(() => reply({ ok: true }))
+            .catch((error) => reply({ ok: false, error: String(error) }));
+        } else if (request.action === "pending" && validPending(request.approval)) {
+          socket.setTimeout(0);
+          untrack = trackPending(request.approval);
+        } else throw new Error("Unknown Auto policy action");
+      } catch (error) {
+        reply({ ok: false, error: String(error) });
+      }
+    });
+  });
+  await new Promise<void>((resolve, reject) => {
+    server.once("error", reject);
+    server.listen(reference.socketPath, resolve);
+  });
+  try {
+    await chmod(reference.socketPath, 0o600);
+  } catch (error) {
+    server.close();
+    await unlink(reference.socketPath).catch(() => {});
+    throw error;
+  }
+  server.unref();
+  const exit = () => {
+    try {
+      unlinkSync(reference.socketPath);
+    } catch {}
+  };
+  process.once("exit", exit);
+  return {
+    reference,
+    snapshot,
+    read: async () => snapshot(),
+    waitEnabled,
+    trackPending,
+    admit: async (signal) => {
+      assertOpen();
+      if (signal?.aborted) throw aborted();
+      return enabled;
+    },
+    set: (next, from) => {
+      assertOpen();
+      enabled = next;
+      source = from;
+      revision++;
+      if (enabled) for (const wake of [...waiters]) wake();
+      return snapshot();
+    },
+    close: async () => {
+      if (closed) return;
+      closed = true;
+      enabled = false;
+      for (const wake of [...waiters]) wake();
+      for (const socket of sockets) socket.destroy();
+      pending.clear();
+      process.off("exit", exit);
+      await new Promise<void>((resolve) => server.close(() => resolve()));
+      await unlink(reference.socketPath).catch((error) => {
+        if (error.code !== "ENOENT") throw error;
+      });
+    },
+  };
+}
+
+function request(ref: AutoModeRef, action: "read" | "admit" | "wait", signal?: AbortSignal): Promise<unknown> {
+  return new Promise((resolve, reject) => {
+    if (signal?.aborted) {
+      reject(aborted());
+      return;
+    }
+    const socket = createConnection(ref.socketPath);
+    let output = "",
+      settled = false;
+    const finish = (error?: Error, value?: unknown) => {
+      if (settled) return;
+      settled = true;
+      signal?.removeEventListener("abort", cancel);
+      socket.destroy();
+      error ? reject(error) : resolve(value);
+    };
+    const cancel = () => finish(aborted());
+    signal?.addEventListener("abort", cancel, { once: true });
+    socket.setEncoding("utf8");
+    socket.setTimeout(2000, () => finish(unavailable()));
+    socket.once("error", () => finish(unavailable()));
+    socket.once("connect", () => {
+      if (action === "wait") socket.setTimeout(0);
+      socket.write(JSON.stringify({ ...ref, action }) + "\n");
+    });
+    socket.on("data", (chunk) => {
+      output += chunk;
+      if (output.length > 256 * 1024) finish(new Error("Auto policy response too large"));
+    });
+    socket.once("end", () => {
+      try {
+        const reply = JSON.parse(output);
+        if (reply.ok !== true) throw new Error(reply.error ?? "Auto policy request failed");
+        finish(undefined, reply.value);
+      } catch (error) {
+        finish(error instanceof Error ? error : unavailable());
+      }
+    });
+    socket.once("close", () => {
+      if (!settled) finish(unavailable());
+    });
+  });
+}
+
+export function connectAutoMode(reference: AutoModeRef): AutoModeReader {
+  let closed = false;
+  const active = new Set<AbortController>();
+  const pending = new Set<Socket>();
+  const call = async (action: "read" | "admit" | "wait", signal?: AbortSignal) => {
+    if (closed) throw unavailable();
+    const controller = new AbortController();
+    active.add(controller);
+    const abort = () => controller.abort();
+    signal?.addEventListener("abort", abort, { once: true });
+    if (signal?.aborted) abort();
+    try {
+      return await request(reference, action, controller.signal);
+    } finally {
+      active.delete(controller);
+      signal?.removeEventListener("abort", abort);
+    }
+  };
+  return {
+    reference,
+    read: async () => {
+      const value = (await call("read")) as AutoModeSnapshot;
+      if (
+        !value ||
+        value.ownerId !== reference.ownerId ||
+        typeof value.enabled !== "boolean" ||
+        !["default", "environment", "session"].includes(value.source) ||
+        !Number.isSafeInteger(value.revision) ||
+        value.revision < 0 ||
+        !Array.isArray(value.pendingApprovals) ||
+        !value.pendingApprovals.every(validPending)
+      )
+        throw unavailable();
+      return value;
+    },
+    admit: async (signal) => {
+      const value = await call("admit", signal);
+      if (typeof value !== "boolean") throw unavailable();
+      return value;
+    },
+    waitEnabled: async (signal) => {
+      await call("wait", signal);
+    },
+    trackPending: (approval) => {
+      if (closed) throw unavailable();
+      if (!validPending(approval)) throw new Error("Invalid pending approval");
+      const socket = createConnection(reference.socketPath);
+      pending.add(socket);
+      socket.once("error", () => {});
+      socket.once("close", () => pending.delete(socket));
+      socket.once("connect", () => socket.write(JSON.stringify({ ...reference, action: "pending", approval }) + "\n"));
+      return () => {
+        pending.delete(socket);
+        socket.destroy();
+      };
+    },
+    close: async () => {
+      closed = true;
+      for (const controller of active) controller.abort();
+      for (const socket of pending) socket.destroy();
+    },
+  };
+}

package/src/governance/execution-retention.ts

@@ -96,6 +96,9 @@ export const retentionConfigurationDigest = (configuration: unknown): string =>
  * A bounded, coalescing observation queue. No worker-control path awaits publication. A failed or stalled
  * archive never changes required ledger/lease semantics. `flush` is exclusively for external archival at
  * quiescence; it is NOT called by the spawner. Missing terminal publication means incomplete observation.
+ * Streams checkpoint at doubling byte milestones and once at finish: total stream blob bytes are below
+ * three times each stream's largest retained prefix, rather than one cumulative copy per chunk. A crash can lose the newest
+ * suffix since the last checkpoint; running manifests mark that lag. Existing archive files are untouched.
  */
 export function beginExecutionRetention(identity: RetentionIdentity, directory = process.env[ENV_EXECUTION_ARCHIVE]) {
   const archiveId = randomUUID();
@@ -143,6 +146,7 @@ export function beginExecutionRetention(identity: RetentionIdentity, directory =
   };
   const buffers = new Map<keyof typeof manifest.content, Buffer>();
   const written = new Set<string>();
+  const streamCheckpoints = new Map<"stdout" | "stderr", RetainedContent>();
   let total = 0;
   let dirty = false;
   let running: Promise<void> | undefined;
@@ -161,6 +165,9 @@ export function beginExecutionRetention(identity: RetentionIdentity, directory =
   const loss = (reason: string) => {
     if (!manifest.coverage.losses.includes(reason)) manifest.coverage.losses.push(reason);
   };
+  const clearLoss = (reason: string) => {
+    manifest.coverage.losses = manifest.coverage.losses.filter((value) => value !== reason);
+  };
   const release = () => {
     if (admitted && !released) {
       active--;
@@ -178,6 +185,13 @@ export function beginExecutionRetention(identity: RetentionIdentity, directory =
         const checkpoint: ExecutionRetentionManifest = JSON.parse(JSON.stringify(manifest));
         const contents = [...buffers];
         for (const [kind, bytes] of contents) {
+          const stream = kind === "stdout" || kind === "stderr" ? kind : undefined;
+          const previous = stream && streamCheckpoints.get(stream);
+          if (previous && checkpoint.state !== "terminal" && bytes.length < previous.bytes! * 2) {
+            checkpoint.content[kind] = previous;
+            if (bytes.length !== previous.bytes) checkpoint.coverage.losses.push(`${kind}-checkpoint-lagging`);
+            continue;
+          }
           const sha256 = digest(bytes);
           const name = `${kind}-${sha256}.bin`;
           if (!written.has(name)) {
@@ -185,6 +199,7 @@ export function beginExecutionRetention(identity: RetentionIdentity, directory =
             written.add(name);
           }
           checkpoint.content[kind] = { status: "retained", path: name, sha256, bytes: bytes.length };
+          if (stream) streamCheckpoints.set(stream, checkpoint.content[kind]);
         }
         await writeFile(
           join(root!, "manifest.pending"),
@@ -263,6 +278,15 @@ export function beginExecutionRetention(identity: RetentionIdentity, directory =
           manifest.native.branchLeafId = observation.branchLeafId;
           buffers.delete("session");
           if (captured.bytes && observation === captured.observation) buffers.set("session", captured.bytes);
+          if (buffers.has("session") && observation.status === "verified") {
+            clearLoss("native-session-content-unavailable");
+            if (manifest.coverage.losses.includes("native-session-read-failed")) {
+              clearLoss("native-session-read-failed");
+              loss("native-session-read-failed-earlier");
+            }
+          } else loss("native-session-content-unavailable");
+          if (observation.branchState === "observed") clearLoss("active-branch-unknown");
+          else loss("active-branch-unknown");
           if (observation.reason) loss(observation.reason);
           schedule();
         }

package/src/governance/ledger-events.ts

@@ -212,8 +212,9 @@ export interface SessionConfigEvent extends Omit<LedgerEventBase, "correlation">
   event: "session_config";
   episodeId: string;
   outcome: "kept" | "changed";
-  trigger: "first-delegation" | "grants-models";
+  trigger: "first-delegation" | "grants-models" | "auto-mode";
   overrides: Record<string, { model: string; thinking: string }>;
+  autoMode?: { enabled: boolean; source: "default" | "environment" | "session"; revision: number };
 }
 
 export type RuntimeLedgerEvent =
@@ -244,6 +245,26 @@ export function buildSessionConfigEvent(args: {
   });
 }
 
+/** Auto authorization changes are explicit session facts, never fabricated prompt approvals. */
+export function buildAutoModeConfigEvent(args: {
+  episodeId: string;
+  enabled: boolean;
+  source: "default" | "environment" | "session";
+  revision: number;
+  now: Date;
+}): SessionConfigEvent {
+  return assertLedgerV3Wire({
+    ledgerVersion: LEDGER_VERSION,
+    event: "session_config",
+    ts: args.now.toISOString(),
+    episodeId: args.episodeId,
+    outcome: "changed",
+    trigger: "auto-mode",
+    overrides: {},
+    autoMode: { enabled: args.enabled, source: args.source, revision: args.revision },
+  });
+}
+
 export function buildEpisodeOutcomeEvent(args: {
   episodeId: string;
   commit: string;