pi-daddy 0.47.1 → 0.48.0

package/extensions/delegation-operations.ts

@@ -0,0 +1,171 @@
+/** Non-authorizing dispatch election. The elected caller still runs the ordinary governance path. */
+import { createHash } from "node:crypto";
+import { realpath } from "node:fs/promises";
+import { Type } from "typebox";
+import { shouldSeekApproval } from "../src/kernel/approval.ts";
+import { planDelegation } from "../src/kernel/delegate.ts";
+import type { OperationClaim } from "../src/kernel/dispatch-operation.ts";
+import { validOperationId } from "../src/kernel/dispatch-operation.ts";
+import { GovernanceRefusal } from "../src/kernel/refusals.ts";
+import { assertDefinitionIdentity } from "./definition-describe.ts";
+import { assertDelegationAuthority } from "./delegation-authority.ts";
+import { recordDelegationDecision } from "./delegation-ledger.ts";
+import type { GrantsSession } from "./session.ts";
+import type { ChildSpec, DelegationToolContext } from "./run-delegation.ts";
+import type { ExecutionOccurrenceIds } from "./execution-occurrence.ts";
+import type { DelegationOutcome } from "./execute-child.ts";
+
+export const operationIdShape = () =>
+  Type.Optional(
+    Type.String({
+      minLength: 1,
+      maxLength: 160,
+      pattern: "^[a-zA-Z0-9][a-zA-Z0-9._:/-]*$",
+      description:
+        "Stable caller operation ID. Identical concurrent dispatch returns its existing reference; terminal IDs never replay work. Use a new ID only for an intentional new attempt.",
+    }),
+  );
+function canonical(value: unknown): unknown {
+  if (Array.isArray(value)) return value.map(canonical);
+  if (value && typeof value === "object")
+    return Object.fromEntries(
+      Object.entries(value)
+        .filter(([, v]) => v !== undefined)
+        .sort(([a], [b]) => a.localeCompare(b))
+        .map(([k, v]) => [k, canonical(v)]),
+    );
+  return value;
+}
+export async function claimDelegationOperation(
+  session: GrantsSession,
+  spec: ChildSpec,
+  ids: ExecutionOccurrenceIds,
+  ctx: DelegationToolContext,
+  signal?: AbortSignal,
+): Promise<OperationClaim | undefined> {
+  if (spec.operation_id === undefined) return undefined;
+  assertDelegationAuthority(session);
+  if (!validOperationId(spec.operation_id)) throw Error("Invalid operation_id");
+  if (signal?.aborted) throw Error("Operation request aborted");
+  await session.ensureDefinitions?.();
+  assertDefinitionIdentity(session, spec);
+  const context = await session.delegationContext();
+  const model = spec.model ?? (ctx.model ? `${ctx.model.provider}/${ctx.model.id}` : undefined);
+  const preview = planDelegation(
+    { ...spec, model, boundWorkspaceId: spec.workspace?.workspace_id },
+    {
+      ...context,
+      stageHandoff: undefined,
+      fanoutBudget: 0,
+      spawnId: ids.parentId,
+      childSpawnId: ids.childId,
+      childExecutionId: ids.executionId,
+    },
+  );
+  if (!preview.ok && !shouldSeekApproval(preview.result)) {
+    await recordDelegationDecision({ session, plan: preview, ids, agent: spec.agent });
+    if (preview.refusal) throw new GovernanceRefusal(preview.refusal);
+    throw Error(preview.reason ?? "Operation request is not authorized");
+  }
+  const operations = session.autoMode?.operations;
+  if (!operations) throw Error("Session operation admission is unavailable; no dispatch started");
+  const cwd = await realpath(ctx.cwd);
+  const { operation_id: _id, ...request } = spec;
+  const requestDigest = createHash("sha256")
+    .update(
+      JSON.stringify(
+        canonical({
+          request,
+          cwd,
+          model,
+          piThinking: session.currentThinking?.(),
+          definitionDigest: preview.definitionDigest,
+          grant: [...session.ownGrant].sort(),
+          gated: [...session.gated].sort(),
+          depth: session.depth,
+          maxDepth: session.maxDepth,
+          executor: session.executor.kind,
+          definition: spec.agent ? session.definitions.get(spec.agent)?.body : null,
+          runtimeSettings: session.definitionRuntimeSettings,
+          runtimeOverrides: [...session.definitionRuntimeOverrides.entries()].sort(([a], [b]) => a.localeCompare(b)),
+          workspaceRoot: spec.workspace ? session.workspacePin?.get(spec.workspace.workspace_id) : null,
+        }),
+      ),
+    )
+    .digest("hex");
+  return operations.claim(
+    {
+      operationId: spec.operation_id,
+      requestDigest,
+      executionId: ids.executionId,
+      cwd,
+      workspaceId: spec.workspace?.workspace_id ?? null,
+    },
+    signal,
+  );
+}
+export function existingOperationOutcome(claim: OperationClaim, depth: number): DelegationOutcome {
+  const active = ["admitting", "running"].includes(claim.operation.state);
+  return {
+    ok: false,
+    work: "unknown",
+    text:
+      `No new child started. Operation ${claim.operation.operationId} already exists (${claim.operation.state}), execution ${claim.operation.executionId}. ` +
+      (active
+        ? "Follow the original operation; this reference is not its final result."
+        : "No mutation result was replayed. Inspect the original outcome before an intentional new attempt with a new operation_id."),
+    reason: active ? "existing-operation" : "operation-already-ended",
+    granted: [],
+    depth,
+    exitCode: null,
+    operation: { ...claim.operation, reused: true },
+  };
+}
+export async function finishDelegationOperation(claim: OperationClaim, result: DelegationOutcome) {
+  const cleanup = result.cleanup;
+  const state =
+    cleanup?.state === "settled"
+      ? "settled"
+      : cleanup?.state === "not-started" || (!result.work && !result.final && !cleanup)
+        ? "not-started"
+        : "uncertain";
+  await claim.finish!(state, {
+    work: result.work,
+    control: result.control,
+    ...(result.final
+      ? {
+          final:
+            result.final.state === "complete"
+              ? {
+                  state: result.final.state,
+                  sessionId: result.final.sessionId,
+                  messageId: result.final.messageId,
+                  leafId: result.final.leafId,
+                  sha256: result.final.sha256,
+                }
+              : { state: result.final.state },
+        }
+      : {}),
+    ...(state === "not-started" && !cleanup ? { cleanup: { state: "not-started" } } : {}),
+    ...(cleanup
+      ? {
+          cleanup: {
+            state: cleanup.state,
+            ...(cleanup.state === "settled"
+              ? {
+                  receiptPath: cleanup.identity.receiptPath,
+                  executionId: cleanup.identity.executionId,
+                }
+              : {}),
+          },
+        }
+      : {}),
+  });
+  result.operation = {
+    ...claim.operation,
+    state,
+    cwd: result.cwd ?? claim.operation.cwd,
+    workspaceId: result.workspaceId ?? claim.operation.workspaceId,
+    reused: false,
+  };
+}

package/extensions/delegation.ts

@@ -1,3 +1,4 @@
+import { operationIdShape, claimDelegationOperation } from "./delegation-operations.ts";
 import { publicEvidenceCall } from "./public-evidence.ts";
 import { executionEvidenceContent } from "./execution-evidence.ts";
 import { reconcileDelegationCapacity, reserveDelegationCapacity } from "./session-capacity.ts";
@@ -190,6 +191,7 @@ export function registerDelegationTools(pi: ExtensionAPI, session: GrantsSession
     ),
   );
   const childShape = Type.Object({
+    operation_id: operationIdShape(),
     definitionId: Type.Optional(
       Type.String({ description: "Snapshot id returned by delegate_describe; required for Principal phases." }),
     ),
@@ -212,6 +214,7 @@ export function registerDelegationTools(pi: ExtensionAPI, session: GrantsSession
   });
 
   const delegateParams = Type.Object({
+    operation_id: operationIdShape(),
     definitionId: Type.Optional(
       Type.String({ description: "Snapshot id returned by delegate_describe; required for Principal phases." }),
     ),
@@ -255,16 +258,18 @@ export function registerDelegationTools(pi: ExtensionAPI, session: GrantsSession
       // `delegate` for up to DEFAULT_TIMEOUT_MS — sixty minutes by default.
       const progress = progressReporter(session, [params.agent ?? "delegate"], onUpdate as never);
       const occurrence = newDelegationOccurrence(session, 0);
+      const operationClaim = await claimDelegationOperation(session, params, occurrence, ctx, signal);
       const capture = publicEvidenceCall(
         session.publicEvidence,
         _toolCallId,
         "delegate",
         [params],
-        [occurrence.executionId],
+        [operationClaim?.operation.executionId ?? occurrence.executionId],
       );
       const outcome = await runOneDelegation(
         session,
         {
+          operation_id: params.operation_id,
           definitionId: params.definitionId,
           task: params.task,
           agent: params.agent,
@@ -281,6 +286,7 @@ export function registerDelegationTools(pi: ExtensionAPI, session: GrantsSession
         ctx,
         signal,
         {
+          operationClaim,
           onProgress: progress.sink(0),
           toolCallId: _toolCallId,
           onDefinition: (definition) => capture.selected(0, definition),
@@ -296,7 +302,7 @@ export function registerDelegationTools(pi: ExtensionAPI, session: GrantsSession
         throw new Error(message);
       }
       // Pi 1.0.4 preserves returned isError. Keep every outcome dimension and useful output together.
-      const failed = !outcome.ok || outcome.control === "failed";
+      const failed = !outcome.operation?.reused && (!outcome.ok || outcome.control === "failed");
       return capture.finish(
         {
           isError: failed,
@@ -348,8 +354,19 @@ export function registerDelegationTools(pi: ExtensionAPI, session: GrantsSession
       const children = params.children ?? [];
       if (session.capacityRefusal) throw new GovernanceRefusal(session.capacityRefusal);
       await reconcileDelegationCapacity(session);
-      const split = splitBudget(session.capacity.available, children.length);
+      const occurrences = children.map((_, index) => newDelegationOccurrence(session, index));
+      const claims: Array<import("../src/kernel/dispatch-operation.ts").OperationClaim | undefined> = [];
+      try {
+        for (const [index, child] of children.entries())
+          claims.push(await claimDelegationOperation(session, child, occurrences[index], ctx, signal));
+      } catch (error) {
+        await Promise.all(claims.map((claim) => claim?.finish?.("not-started")));
+        throw error;
+      }
+      const fresh = children.filter((_, index) => !claims[index]?.reused).length;
+      const split = fresh === 0 ? { ok: true as const, perChild: 0 } : splitBudget(session.capacity.available, fresh);
       if (!split.ok) {
+        await Promise.all(claims.map((claim) => claim?.finish?.("not-started")));
         // Thrown, not returned: a returned `isError` is discarded by pi, so a refusal that came back as a
         // normal result would read to the orchestrator as a successful fan-out of zero children.
         throw new GovernanceRefusal(refusal("FANOUT_EXCEEDED", `fan-out refused: ${split.reason}`));
@@ -370,25 +387,32 @@ export function registerDelegationTools(pi: ExtensionAPI, session: GrantsSession
       // live and its writer lease is deliberately retained" — a resource-retention notice, not a per-child
       // failure. Losing it meant nobody was told a lease is held with no owner until the process exits
       // (R-116).
-      const infrastructureErrors: unknown[] = [],
-        occurrences = children.map((_, index) => newDelegationOccurrence(session, index));
+      const infrastructureErrors: unknown[] = [];
       const capture = publicEvidenceCall(
         session.publicEvidence,
         _toolCallId,
         "delegate_all",
         children,
-        occurrences.map((row) => row.executionId),
+        occurrences.map((row, index) => claims[index]?.operation.executionId ?? row.executionId),
       );
       const pending = children.map(async (child, index): Promise<DelegationOutcome> => {
+        let enteredDelegation = false;
         try {
+          // Reserve each batch share synchronously here, before another dispatch can interleave.
+          const capacityReservation = claims[index]?.reused
+            ? undefined
+            : reserveDelegationCapacity(session, occurrences[index].executionId, split.perChild);
+          enteredDelegation = true;
           return await runOneDelegation(session, child, occurrences[index], split.perChild, ctx, signal, {
-            // Reserve each batch share synchronously here, before another dispatch can interleave.
-            capacityReservation: reserveDelegationCapacity(session, occurrences[index].executionId, split.perChild),
+            operationClaim: claims[index],
+            capacityReservation,
             onDefinition: (definition) => capture.selected(index, definition),
             onProgress: progress.sink(index),
             toolCallId: _toolCallId,
           });
         } catch (error) {
+          if (!enteredDelegation)
+            await claims[index]?.finish?.("not-started", { cleanup: { state: "not-started" } }).catch(() => undefined);
           infrastructureErrors.push(error);
           return childFailureOutcome(error, session.depth + 1);
         }
@@ -401,7 +425,7 @@ export function registerDelegationTools(pi: ExtensionAPI, session: GrantsSession
       // critical block landed in the same fan-out (R-117).
       throwFanoutInfrastructure(outcomes, infrastructureErrors);
 
-      const failed = outcomes.filter((o) => !o.ok);
+      const failed = outcomes.filter((o) => !o.ok && !o.operation?.reused);
       // Every child is reported, including the ones that failed. R-03's rule: a missing result must never
       // be indistinguishable from an empty one, and a fan-out that hid its refusals would let an
       // orchestrator summarise four reviews when only three happened.
@@ -411,7 +435,7 @@ export function registerDelegationTools(pi: ExtensionAPI, session: GrantsSession
 
       return capture.finish(
         {
-          isError: outcomes.some((o) => !o.ok || o.control === "failed"),
+          isError: outcomes.some((o) => !o.operation?.reused && (!o.ok || o.control === "failed")),
           content: [
             { type: "text", text: report },
             executionEvidenceContent("delegate_all", outcomes, children.length),

package/extensions/execute-child.ts

@@ -1,9 +1,10 @@
+import { realpath } from "node:fs/promises";
 import { BoundedReadCleanupError } from "../src/kernel/bounded-read.ts";
 import { retainDiscoveryCleanupFailure } from "./session.ts";
 import type { CapacityReservation } from "../src/kernel/capacity.ts";
 import { runHerdrOwned } from "../src/executors/herdr-owned.ts";
 import { runCapturedExecution } from "../src/executors/captured-execution.ts";
-import type { ChildFinal } from "../src/executors/child-final.ts";
+import { capturedFinalSession, type ChildFinal } from "../src/executors/child-final.ts";
 import type { CapturedWorkerCleanup } from "../src/kernel/captured-worker-contract.ts";
 import type { Delegation } from "../src/kernel/delegate.ts";
 import {
@@ -33,6 +34,9 @@ import { releaseDelegationWorkspace, type PreparedWorkspace } from "./workspace-
 import { ActivityTimelineRecorder, ENV_ACTIVITY_PARENT_TASK } from "../src/products/activity-timeline.ts";
 import { resolvedModelOf, type ResolvedDefinitionRuntime } from "./definition-runtime.ts";
 export interface DelegationOutcome {
+  operation?: import("../src/kernel/dispatch-operation.ts").OperationReference & { reused: boolean };
+  cwd?: string;
+  workspaceId?: string | null;
   ok: boolean;
   text: string;
   reason?: string;
@@ -121,6 +125,9 @@ export interface ChildProgressUpdate {
  * blaming "ledger" (R-99). The failure is reported alongside the outcome instead of replacing it.
  */
 export interface ChildExecutionInput {
+  operationClaim?: import("../src/kernel/dispatch-operation.ts").OperationClaim;
+  /** Composition-only launch observation; no permission or result authority. */
+  onExecutorEntry?: () => void;
   session: GrantsSession;
   capacityReservation?: CapacityReservation;
   plan: Delegation;
@@ -140,12 +147,14 @@ export async function executePlannedChild(input: ChildExecutionInput): Promise<D
   const runtime = input.session.reloadLifecycle?.runtimeSettlement;
   let registered = false;
   try {
+    input = { ...input, cwd: await realpath(input.preparedWorkspace?.workspace.root ?? input.cwd) };
     runtime?.begin(input.executionId);
     registered = Boolean(runtime);
     const result = await executePreparedChild(
       input,
       () => {
         executorEntered = true;
+        input.onExecutorEntry?.();
       },
       runtime,
     );
@@ -162,7 +171,11 @@ export async function executePlannedChild(input: ChildExecutionInput): Promise<D
         reason: [result.reason, `runtime settlement record failed: ${String(error)}`].filter(Boolean).join("; "),
       };
     }
-    return result;
+    return {
+      ...result,
+      cwd: input.preparedWorkspace?.workspace.root ?? input.cwd,
+      workspaceId: input.preparedWorkspace?.workspace.workspaceId ?? null,
+    };
   } catch (error) {
     const failures: unknown[] = [error];
     if (registered)
@@ -336,6 +349,7 @@ async function executePreparedChild(
     const remainingTimeoutMs = Math.max(1, Date.parse(deadlineAt) - Date.now());
     const terminationGraceMs = Math.min(DEFAULT_KILL_GRACE_MS, Math.max(1, Math.floor(remainingTimeoutMs / 10)));
     const cwd = preparedWorkspace?.workspace.root ?? input.cwd;
+    await input.operationClaim?.started?.(cwd, preparedWorkspace?.workspace.workspaceId ?? null);
     const leaseAbort = new AbortController();
     const writerLease = preparedWorkspace?.lease.access === "write" ? preparedWorkspace.lease : undefined;
     // Tracked as a FACT, not only as an abort: "the kernel lock protecting this workspace evaporated under
@@ -460,7 +474,11 @@ async function executePreparedChild(
           : undefined,
       );
 
-      if (sessionFlag >= 0) retention.observeSession({ source: "pi-session-file", value: plan.args[sessionFlag + 1] });
+      const capturedBranch = capturedFinalSession(output.final);
+      if (capturedBranch)
+        retention.observeSession({ source: "pi-captured-final", value: capturedBranch.path, capturedBranch });
+      else if (sessionFlag >= 0)
+        retention.observeSession({ source: "pi-session-file", value: plan.args[sessionFlag + 1] });
       retention.capture("result", Buffer.from(output.text), true);
       if ("diagnosticsTruncated" in output && output.diagnosticsTruncated)
         teardownFailures.push("diagnostic output truncated");

package/extensions/execution-evidence.ts

@@ -49,6 +49,9 @@ function outcomeEvidence(outcome: DelegationOutcome, index: number) {
   const final = outcome.final;
   return {
     ordinal: index + 1,
+    cwd: outcome.cwd ?? outcome.operation?.cwd ?? null,
+    workspaceId: outcome.workspaceId ?? outcome.operation?.workspaceId ?? null,
+    operation: outcome.operation ?? null,
     ok: outcome.ok,
     work: outcome.work ?? null,
     control: outcome.control ?? null,

package/extensions/fanout-outcome.ts

@@ -43,6 +43,7 @@ export function buildFanoutReport(
   return outcomes
     .map((outcome, index) => {
       const label = `### child ${index + 1}${children[index]?.agent ? ` (${children[index].agent})` : ""}`;
+      if (outcome.operation?.reused) return `${label} — existing operation\n\n${outcome.text}`;
       return outcome.ok && outcome.control !== "failed"
         ? `${label} — completed\n\n${outcome.text || "(no output)"}`
         : `${label} — FAILED: ${outcome.reason}${outcome.text ? `\n\n${outcome.text}` : ""}`;

package/extensions/grants.ts

@@ -365,12 +365,11 @@ export default function (pi: ExtensionAPI, trustedSession?: GrantsSession) {
     return undefined;
   });
 
-  // Observe this session's real tool surface once, and tighten the grant to it. Authoritative because
-  // it is exactly what pi sent the model.
+  // Observe the native reachable tool surface, including callable tools whose declarations Codemode hides.
   pi.on("before_provider_request", (event, ctx) => {
     try {
       if (session.observed) return undefined;
-      const names = observeToolNames(event.payload);
+      const names = observeToolNames(event.payload, pi.getAllTools(), pi.getActiveTools?.());
       if (names === null) return undefined;
       session.observed = true;
       session.observedTools = names;

package/extensions/run-delegation.ts

@@ -1,3 +1,9 @@
+import {
+  claimDelegationOperation,
+  existingOperationOutcome,
+  finishDelegationOperation,
+} from "./delegation-operations.ts";
+import type { OperationClaim } from "../src/kernel/dispatch-operation.ts";
 import { reconcileDelegationCapacity, reserveDelegationCapacity } from "./session-capacity.ts";
 import type { CapacityReservation } from "../src/kernel/capacity.ts";
 import { assertDefinitionIdentity } from "./definition-describe.ts";
@@ -43,7 +49,8 @@ import {
 } from "./workspace-runtime.ts";
 
 /** What one child was asked to do. The shape both tools accept, per child. */
-interface ChildSpec {
+export interface ChildSpec {
+  operation_id?: string;
   definitionId?: string;
   task: string;
   agent?: string;
@@ -64,7 +71,7 @@ interface ChildSpec {
  * bridged the gap, which is the same "a value that was whatever happened to be in scope" shape the module
  * header lists four defects for.
  */
-interface DelegationToolContext extends ApprovalUIContext {
+export interface DelegationToolContext extends ApprovalUIContext {
   cwd: string;
   model?: { provider: string; id: string };
   modelRegistry: ModelCatalogue;
@@ -242,7 +249,7 @@ export async function planWithApprovals(
  * was refused". `delegate` converts a failure back into a throw to keep its own contract, which matters:
  * `AgentToolResult` has no `isError` field, so a returned error is silently discarded by pi.
  */
-export async function runOneDelegation(
+async function runOneDelegationImplementation(
   session: GrantsSession,
   spec: ChildSpec,
   ids: ExecutionOccurrenceIds,
@@ -265,6 +272,9 @@ export async function runOneDelegation(
    * mistake unspellable.
    */
   options: {
+    operationClaim?: OperationClaim;
+    /** Trusted observation at the actual executor boundary, not a caller/tool parameter. */
+    onExecutorEntry?: () => void;
     /** Trusted reservation made before a chain's upfront gate. */
     capacityReservation?: CapacityReservation;
     /** Exact pair selected during the chain preflight; never reselect after its approval. */
@@ -513,6 +523,8 @@ export async function runOneDelegation(
     executorEntered = true;
     return await executePlannedChild({
       capacityReservation: capacity,
+      operationClaim: options.operationClaim,
+      onExecutorEntry: options.onExecutorEntry,
       session,
       plan,
       agent: spec.agent,
@@ -534,3 +546,46 @@ export async function runOneDelegation(
     );
   }
 }
+
+/** Duplicate references never enter the executor, consume capacity, or become chain input. */
+export async function runOneDelegation(
+  ...args: Parameters<typeof runOneDelegationImplementation>
+): Promise<DelegationOutcome> {
+  const [session, spec, ids, , ctx, signal] = args;
+  const options = args[6] ?? {};
+  const claim = options.operationClaim ?? (await claimDelegationOperation(session, spec, ids, ctx, signal));
+  if (claim?.reused) {
+    options.capacityReservation?.finalize({ state: "not-started", reason: "existing operation reused" });
+    return existingOperationOutcome(claim, session.depth + 1);
+  }
+  let executorEntered = false;
+  try {
+    args[6] = {
+      ...options,
+      operationClaim: claim,
+      onExecutorEntry: () => {
+        executorEntered = true;
+        options.onExecutorEntry?.();
+      },
+    };
+    const result = await runOneDelegationImplementation(...args);
+    if (claim) {
+      try {
+        await finishDelegationOperation(claim, result);
+      } catch (error) {
+        // A post-execution observation failure must not erase the native final or settlement receipt.
+        result.control = "failed";
+        result.reason = [result.reason, `operation status update failed: ${String(error)}`].filter(Boolean).join("; ");
+        result.operation = { ...claim.operation, state: "uncertain", reused: false };
+      }
+    }
+    return result;
+  } catch (error) {
+    if (claim)
+      await claim.finish!(
+        executorEntered ? "uncertain" : "not-started",
+        executorEntered ? undefined : { cleanup: { state: "not-started" } },
+      ).catch(() => undefined);
+    throw error;
+  }
+}

package/extensions/runtime-snapshot.ts

@@ -5,6 +5,7 @@ import { openRuntimeSettlement, settlementHash } from "../src/governance/runtime
 import { reconcileDelegationCapacity } from "./session-capacity.ts";
 import { agentDir } from "../src/kernel/project-paths.ts";
 import type { GrantsSession } from "./session.ts";
+export const OPERATION_STATUS_EVENT = "pi-daddy:operation-status:v1";
 export const RUNTIME_SNAPSHOT_EVENT = "pi-daddy:runtime-snapshot:v1";
 export function registerRuntimeSnapshot(
   pi: ExtensionAPI,
@@ -15,7 +16,7 @@ export function registerRuntimeSnapshot(
   let bound: { sessionId: string; cwd: string; lifecycle: object } | undefined, problem: string | undefined;
   const generation = {};
   let bindSequence = 0;
-  const unsubscribe = pi.events?.on?.(RUNTIME_SNAPSHOT_EVENT, (input: unknown) => {
+  const unsubscribeRuntime = pi.events?.on?.(RUNTIME_SNAPSHOT_EVENT, (input: unknown) => {
     const request = input as {
       version?: number;
       requestId?: string;
@@ -91,6 +92,63 @@ export function registerRuntimeSnapshot(
       }
     })().catch(() => undefined);
   });
+  const unsubscribeOperations = pi.events?.on?.(OPERATION_STATUS_EVENT, (input: unknown) => {
+    const request = input as {
+      version?: number;
+      requestId?: string;
+      sessionId?: string;
+      cwd?: string;
+      operationId?: string;
+      reply?: (value: unknown) => void;
+    };
+    if (
+      request?.version !== 1 ||
+      typeof request.requestId !== "string" ||
+      request.requestId.length > 512 ||
+      typeof request.operationId !== "string" ||
+      typeof request.reply !== "function"
+    )
+      return;
+    if (bound && session.reloadLifecycle.runtimeSnapshotGeneration !== generation) return;
+    void (async () => {
+      const current = bound,
+        lifecycle = session.reloadLifecycle;
+      const envelope = {
+        version: 1,
+        requestId: request.requestId,
+        sessionId: current?.sessionId ?? "",
+        cwd: current?.cwd ?? "",
+        operationId: request.operationId,
+      };
+      if (
+        !current ||
+        current.lifecycle !== lifecycle ||
+        request.sessionId !== current.sessionId ||
+        request.cwd !== current.cwd ||
+        !session.ownerBound ||
+        !session.autoMode?.operations
+      ) {
+        request.reply!({ ...envelope, qualified: false, operation: null, reason: "operation owner is not ready" });
+        return;
+      }
+      try {
+        const operation = await session.autoMode.operations.read(request.operationId!);
+        if (
+          bound !== current ||
+          session.reloadLifecycle !== lifecycle ||
+          lifecycle.runtimeSnapshotGeneration !== generation
+        )
+          throw Error("operation owner changed during read");
+        request.reply!({ ...envelope, qualified: true, operation });
+      } catch (error) {
+        request.reply!({ ...envelope, qualified: false, operation: null, reason: String(error) });
+      }
+    })().catch(() => undefined);
+  });
+  const unsubscribe = () => {
+    unsubscribeRuntime?.();
+    unsubscribeOperations?.();
+  };
   return {
     async bind(ctx) {
       const sequence = ++bindSequence,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-daddy",
-  "version": "0.47.1",
+  "version": "0.48.0",
   "description": "Capability governance for pi sub-agents: spawn Agent Skills (SKILL.md) definitions whose allowed-tools becomes a grant that can only narrow going down a delegation tree, enforced by pi's own --tools allowlist, with an append-only ledger.",
   "keywords": [
     "pi-package",

package/src/executors/child-final.ts

@@ -4,6 +4,7 @@ import { isDeepStrictEqual } from "node:util";
 import { join } from "node:path";
 import { readdir } from "node:fs/promises";
 import { SessionManager, type FileEntry } from "@earendil-works/pi-coding-agent";
+import type { CapturedSessionBranch } from "../governance/native-session.ts";
 import { BoundedReadCleanupError, readBoundedBytes } from "../kernel/bounded-read.ts";
 const MAX_FINAL_BYTES = 4 * 1024 * 1024,
   MAX_LINE_BYTES = 32 * 1024 * 1024,
@@ -13,6 +14,11 @@ const hash = (s: string) => createHash("sha256").update(s, "utf8").digest("hex")
 export type ChildFinal =
   | { state: "complete"; text: string; sessionId: string; messageId: string; leafId: string; sha256: string }
   | { state: "unavailable"; reason: string; diagnosticText?: string };
+const capturedSessions = new WeakMap<ChildFinal, Readonly<CapturedSessionBranch>>();
+/** Only the original in-process final carries this observation; JSON/copies do not recreate it. */
+export function capturedFinalSession(final: ChildFinal): Readonly<CapturedSessionBranch> | undefined {
+  return capturedSessions.get(final);
+}
 export class ChildFinalCapture {
   private decoder = new TextDecoder("utf-8", { fatal: true });
   private buffer = "";
@@ -171,7 +177,7 @@ export class ChildFinalCapture {
         !isDeepStrictEqual(currentUser.message, this.user)
       )
         throw Error("stream final does not match the current persisted branch and turn");
-      return {
+      const complete: ChildFinal = {
         state: "complete",
         text,
         sessionId: this.sessionId,
@@ -179,6 +185,16 @@ export class ChildFinalCapture {
         leafId: manager.getLeafId()!,
         sha256: hash(text),
       };
+      capturedSessions.set(
+        complete,
+        Object.freeze({
+          path,
+          sessionId: this.sessionId,
+          leafId: complete.leafId,
+          sha256: createHash("sha256").update(read.bytes).digest("hex"),
+        }),
+      );
+      return complete;
     } catch (error) {
       if (error instanceof BoundedReadCleanupError) {
         if (!this.onReadCleanup) throw error;