pi-daddy 0.48.3 → 0.49.1

package/extensions/delegation-operations.ts

@@ -4,7 +4,7 @@ import { realpath } from "node:fs/promises";
 import { Type } from "typebox";
 import { shouldSeekApproval } from "../src/kernel/approval.ts";
 import { planDelegation } from "../src/kernel/delegate.ts";
-import type { OperationClaim } from "../src/kernel/dispatch-operation.ts";
+import type { OperationClaim, OperationReference } from "../src/kernel/dispatch-operation.ts";
 import { validOperationId } from "../src/kernel/dispatch-operation.ts";
 import { GovernanceRefusal } from "../src/kernel/refusals.ts";
 import { assertDefinitionIdentity } from "./definition-describe.ts";
@@ -15,6 +15,79 @@ import type { ChildSpec, DelegationToolContext } from "./run-delegation.ts";
 import type { ExecutionOccurrenceIds } from "./execution-occurrence.ts";
 import type { DelegationOutcome } from "./execute-child.ts";
 
+// Short-lived exact finals for explicit workflow retention. The operation registry/socket
+// remains identity-only; losing this observation never changes the original child result.
+// The native-owner lifecycle survives extension reloads, which create a new GrantsSession.
+const FINAL_BYTES = 4 * 1024 * 1024,
+  FINAL_ENTRIES = 128;
+type Final = Extract<NonNullable<DelegationOutcome["final"]>, { state: "complete" }>;
+export interface OperationFinalStore {
+  lifecycle: object;
+  owner: string;
+  bytes: number;
+  entries: Map<string, { executionId: string; final: Final }>;
+}
+export function bindOperationFinals(session: GrantsSession, sessionId: string, cwd: string) {
+  const owner = JSON.stringify([sessionId, cwd]),
+    old = session.reloadLifecycle.operationFinals;
+  if (!old || old.lifecycle !== session.reloadLifecycle || old.owner !== owner)
+    session.reloadLifecycle.operationFinals = {
+      lifecycle: session.reloadLifecycle,
+      owner,
+      bytes: 0,
+      entries: new Map(),
+    };
+}
+/** Capture before admitting work; a late child cannot write a replacement session's store. */
+export function operationFinalScope(session: GrantsSession): object | undefined {
+  return session.reloadLifecycle?.operationFinals;
+}
+export function operationFinal(session: GrantsSession, operation: OperationReference) {
+  const store = session.reloadLifecycle?.operationFinals,
+    item = store?.entries.get(operation.operationId);
+  if (!store || store.lifecycle !== session.reloadLifecycle || !item || item.executionId !== operation.executionId)
+    return {
+      state: "unavailable" as const,
+      reason:
+        "exact native final was not retained, expired from the 4 MiB session buffer, or belongs to an earlier session",
+    };
+  const observed = operation.runtime?.final,
+    final = item.final;
+  if (
+    operation.state !== "settled" ||
+    observed?.state !== "complete" ||
+    ["sessionId", "messageId", "leafId", "sha256"].some(
+      (key) => observed[key as keyof typeof observed] !== final[key as keyof Final],
+    )
+  )
+    return { state: "unavailable" as const, reason: "native final identity no longer matches the operation" };
+  return { ...final };
+}
+function retainOperationFinal(
+  session: GrantsSession,
+  claim: OperationClaim,
+  result: DelegationOutcome,
+  scope: object | undefined,
+) {
+  const store = session.reloadLifecycle?.operationFinals,
+    final = result.final;
+  if (!store || store !== scope || store.lifecycle !== session.reloadLifecycle || final?.state !== "complete") return;
+  const bytes = Buffer.byteLength(final.text);
+  if (!bytes || bytes > FINAL_BYTES || createHash("sha256").update(final.text).digest("hex") !== final.sha256) return;
+  const old = store.entries.get(claim.operation.operationId);
+  if (old) {
+    store.bytes -= Buffer.byteLength(old.final.text);
+    store.entries.delete(claim.operation.operationId);
+  }
+  while (store.bytes + bytes > FINAL_BYTES || store.entries.size >= FINAL_ENTRIES) {
+    const first = store.entries.entries().next().value!;
+    store.bytes -= Buffer.byteLength(first[1].final.text);
+    store.entries.delete(first[0]);
+  }
+  store.entries.set(claim.operation.operationId, { executionId: claim.operation.executionId, final: { ...final } });
+  store.bytes += bytes;
+}
+
 export const operationIdShape = () =>
   Type.Optional(
     Type.String({
@@ -121,7 +194,12 @@ export function existingOperationOutcome(claim: OperationClaim, depth: number):
     operation: { ...claim.operation, reused: true },
   };
 }
-export async function finishDelegationOperation(claim: OperationClaim, result: DelegationOutcome) {
+export async function finishDelegationOperation(
+  claim: OperationClaim,
+  result: DelegationOutcome,
+  session: GrantsSession,
+  finalScope: object | undefined,
+) {
   const cleanup = result.cleanup;
   const state =
     cleanup?.state === "settled"
@@ -161,6 +239,7 @@ export async function finishDelegationOperation(claim: OperationClaim, result: D
         }
       : {}),
   });
+  retainOperationFinal(session, claim, result, finalScope);
   result.operation = {
     ...claim.operation,
     state,

package/extensions/execute-child.ts

@@ -1,3 +1,4 @@
+import { childExecutionLimits } from "./dashboard-settings.ts";
 import { realpath } from "node:fs/promises";
 import { BoundedReadCleanupError } from "../src/kernel/bounded-read.ts";
 import { retainDiscoveryCleanupFailure } from "./session.ts";
@@ -16,13 +17,7 @@ import { appendLedgerEvent, buildChildLifecycleEvent } from "../src/governance/l
 import { hasFinalizerError } from "../src/governance/finalization.ts";
 import { mergeChildEnv } from "../src/kernel/propagation.ts";
 import type { Capability } from "../src/kernel/resolve.ts";
-import {
-  DEFAULT_KILL_GRACE_MS,
-  ENV_CHILD_IDLE_TIMEOUT,
-  ENV_CHILD_TIMEOUT,
-  idleTimeoutFromEnv,
-  timeoutFromEnv,
-} from "../src/kernel/run-child.ts";
+import { DEFAULT_KILL_GRACE_MS, ENV_CHILD_IDLE_TIMEOUT, ENV_CHILD_TIMEOUT } from "../src/kernel/run-child.ts";
 import { activitySessionFor } from "../src/executors/activity-session.ts";
 import { processTreeActivity } from "../src/executors/process-activity.ts";
 import { resolveWorkspace } from "../src/executors/herdr-cli.ts";
@@ -147,6 +142,7 @@ export async function executePlannedChild(input: ChildExecutionInput): Promise<D
   const runtime = input.session.reloadLifecycle?.runtimeSettlement;
   let registered = false;
   try {
+    const limits = childExecutionLimits(input.session);
     input = { ...input, cwd: await realpath(input.preparedWorkspace?.workspace.root ?? input.cwd) };
     runtime?.begin(input.executionId);
     registered = Boolean(runtime);
@@ -157,6 +153,7 @@ export async function executePlannedChild(input: ChildExecutionInput): Promise<D
         input.onExecutorEntry?.();
       },
       runtime,
+      limits,
     );
     try {
       await runtime?.finish(
@@ -220,7 +217,8 @@ export async function executePlannedChild(input: ChildExecutionInput): Promise<D
 async function executePreparedChild(
   input: ChildExecutionInput,
   onExecutorEntry: () => void,
-  runtime?: import("../src/governance/runtime-settlement.ts").RuntimeSettlement,
+  runtime: import("../src/governance/runtime-settlement.ts").RuntimeSettlement | undefined,
+  limits: ReturnType<typeof childExecutionLimits>,
 ): Promise<DelegationOutcome> {
   const { session, plan, childId, executionId, parentExecutionId, preparedWorkspace, signal, onProgress } = input;
   const ledgerPath = session.ledgerPath;
@@ -269,10 +267,10 @@ async function executePreparedChild(
     );
     activityStarted = true;
   } catch {}
-  const configuredTimeoutMs = timeoutFromEnv(process.env[ENV_CHILD_TIMEOUT]);
+  const configuredTimeoutMs = limits.wallMs;
   // PR 3e: the working bound is inactivity; `deadlineAt` below is the runaway ceiling. Every child gets a pi session
   // file so the parent can see it working when its stdout is quiet (pi appends each message and tool result to it).
-  const configuredIdleMs = idleTimeoutFromEnv(process.env[ENV_CHILD_IDLE_TIMEOUT]);
+  const configuredIdleMs = limits.idleMs;
   const activitySession = await activitySessionFor(plan.args, executionId);
   // Disposed on every path (review finding: it leaked on every throw), except when the operator keeps a Herdr pane,
   // where the interactive pi in that pane is still alive and still appending to this file.
@@ -378,7 +376,7 @@ async function executePreparedChild(
       workspaceId: preparedWorkspace?.workspace.workspaceId ?? null,
     });
     const sessionFlag = plan.args.indexOf("--session");
-    if (sessionFlag >= 0) retention.observeSession({ source: "pi-session-file", value: plan.args[sessionFlag + 1] });
+    // Pi creates the file during execution; observe its exact final below, not a guaranteed pre-spawn miss.
     let releaseReason = "failed";
     let retainWriterLease = false;
     let terminalAttempted = false;

package/extensions/execution-controls.ts

@@ -1,3 +1,4 @@
+import type { childExecutionLimits } from "./dashboard-settings.ts";
 /** Operator-facing execution settings; display never changes admission, deadlines or retention. */
 import { timeoutFromEnv, idleTimeoutFromEnv } from "../src/kernel/run-child.ts";
 import { timeoutMsFromEnv } from "../src/governance/approval-prompt.ts";
@@ -11,6 +12,7 @@ import {
 export function renderExecutionControls(
   nativeSessionRoot: string | undefined,
   env: NodeJS.ProcessEnv = process.env,
+  limits?: ReturnType<typeof childExecutionLimits>,
 ): string[] {
   let approval: string;
   try {
@@ -20,9 +22,12 @@ export function renderExecutionControls(
     approval = `${ENV_APPROVAL_TIMEOUT} invalid; a needed new prompt will refuse`;
   }
   const source = (key: string) => (env[key] === undefined ? "default" : `from ${key}; zero/invalid uses default`);
+  const wallSource = limits?.wallSource === "session" ? "session override; future children" : source(ENV_CHILD_TIMEOUT);
+  const idleSource =
+    limits?.idleSource === "session" ? "session override; future children" : source(ENV_CHILD_IDLE_TIMEOUT);
   return [
-    `  child wall ${timeoutFromEnv(env[ENV_CHILD_TIMEOUT]) / 1000}s (${source(ENV_CHILD_TIMEOUT)})`,
-    `  child idle ${idleTimeoutFromEnv(env[ENV_CHILD_IDLE_TIMEOUT]) / 1000}s (${source(ENV_CHILD_IDLE_TIMEOUT)})`,
+    `  child wall ${(limits?.wallMs ?? timeoutFromEnv(env[ENV_CHILD_TIMEOUT])) / 1000}s (${wallSource})`,
+    `  child idle ${(limits?.idleMs ?? idleTimeoutFromEnv(env[ENV_CHILD_IDLE_TIMEOUT])) / 1000}s (${idleSource})`,
     "             process safety controls; no time/token budget is added to the model prompt",
     `  approval   ${approval}`,
     `  transcripts ${

package/extensions/grants-command.ts

@@ -1,3 +1,4 @@
+import type { childExecutionLimits } from "./dashboard-settings.ts";
 /**
  * The `/grants` command — session status, approvals, and ledger integrity.
  *
@@ -28,6 +29,7 @@ export interface GrantsCommandContext {
   governed: boolean;
   /** Host opt-in captured by this session, not a later environment reread. */
   nativeSessionRoot?: string;
+  executionLimits?: ReturnType<typeof childExecutionLimits>;
   autoModeStatus?: string;
   /** Explicit owner mutation; the command parser itself holds no permission authority. */
   changeAutoMode?: (enabled: boolean) => Promise<string>;
@@ -439,7 +441,7 @@ export const grantsCommand = {
       // ADR-0031, and its probe is only defensible because this line exists. Placed next to `holding` so the
       // two facts about what a spawn will be sit together.
       `  executor   ${executor.disclosure}`,
-      ...renderExecutionControls(ctx.grants.nativeSessionRoot),
+      ...renderExecutionControls(ctx.grants.nativeSessionRoot, process.env, ctx.grants.executionLimits),
       `  Auto       ${ctx.grants.autoModeStatus ?? "OFF (default)"}`,
       `  depth      ${depth} of max ${maxDepth}${maxDepth <= 0 ? " (spawning disabled)" : ""}`,
       `  ledger     ${ledgerPath || "(not recording — set PI_DADDY_LEDGER)"}`,

package/extensions/grants.ts

@@ -1,3 +1,4 @@
+import { registerDashboardSettings, childExecutionLimits } from "./dashboard-settings.ts";
 import { bindEcosystemVersions } from "./ecosystem-versions.ts";
 import {
   initializeSessionAutoMode,
@@ -90,6 +91,7 @@ export default function (pi: ExtensionAPI, trustedSession?: GrantsSession) {
   session.currentThinking = typeof pi.getThinkingLevel === "function" ? () => pi.getThinkingLevel() : undefined;
   registerActivityTimeline(pi, session);
   const runtimeSnapshot = registerRuntimeSnapshot(pi, session);
+  registerDashboardSettings(pi, session);
   const dashboardPluginRoot = fileURLToPath(new URL("../herdr-plugin/", import.meta.url));
   const dashboardPaths = defaultDashboardPaths(agentDir());
   // Definitions are registered only after owner-bound session_start. Until then there is no delegation
@@ -481,6 +483,7 @@ export default function (pi: ExtensionAPI, trustedSession?: GrantsSession) {
               }
             : {}),
           nativeSessionRoot: session.nativeSessionRoot,
+          executionLimits: childExecutionLimits(session),
           changeAutoMode: async (enabled: boolean) => {
             const { auto } = await setAutoApproval(session, enabled, "command");
             return `${auto.enabled ? "ON" : "OFF"} (${auto.source}; current session permissions)`;

package/extensions/reload-environment.ts

@@ -5,6 +5,8 @@ import type { BoundedReadCleanupError } from "../src/kernel/bounded-read.ts";
 
 /** The root baseline and latest child publication for one real Pi session owner. */
 export interface ReloadLifecycle {
+  operationFinals?: import("./delegation-operations.ts").OperationFinalStore;
+  executionSettings?: { nativeSessionId: string; wallMs?: number; idleMs?: number };
   autoMode?: import("./session-auto-mode.ts").SessionAutoLifecycle;
   runtimeSnapshotUnsubscribe?: () => void;
   runtimeSnapshotGeneration?: object;
@@ -115,6 +117,7 @@ export function bindReloadLifecycle(
       existing = {
         root: current,
         autoMode: existing.autoMode,
+        executionSettings: existing.executionSettings,
         activityRootId: existing.activityRootId,
         episodeId: existing.episodeId,
         capacity: existing.capacity,

package/extensions/run-delegation.ts

@@ -2,6 +2,7 @@ import {
   claimDelegationOperation,
   existingOperationOutcome,
   finishDelegationOperation,
+  operationFinalScope,
 } from "./delegation-operations.ts";
 import type { OperationClaim } from "../src/kernel/dispatch-operation.ts";
 import { reconcileDelegationCapacity, reserveDelegationCapacity } from "./session-capacity.ts";
@@ -552,6 +553,7 @@ export async function runOneDelegation(
   ...args: Parameters<typeof runOneDelegationImplementation>
 ): Promise<DelegationOutcome> {
   const [session, spec, ids, , ctx, signal] = args;
+  const finalScope = operationFinalScope(session);
   const options = args[6] ?? {};
   const claim = options.operationClaim ?? (await claimDelegationOperation(session, spec, ids, ctx, signal));
   if (claim?.reused) {
@@ -571,7 +573,7 @@ export async function runOneDelegation(
     const result = await runOneDelegationImplementation(...args);
     if (claim) {
       try {
-        await finishDelegationOperation(claim, result);
+        await finishDelegationOperation(claim, result, session, finalScope);
       } catch (error) {
         // A post-execution observation failure must not erase the native final or settlement receipt.
         result.control = "failed";

package/extensions/runtime-snapshot.ts

@@ -5,6 +5,7 @@ import { openRuntimeSettlement, settlementHash } from "../src/governance/runtime
 import { reconcileDelegationCapacity } from "./session-capacity.ts";
 import { agentDir } from "../src/kernel/project-paths.ts";
 import type { GrantsSession } from "./session.ts";
+import { bindOperationFinals, operationFinal } from "./delegation-operations.ts";
 export const OPERATION_STATUS_EVENT = "pi-daddy:operation-status:v1";
 export const RUNTIME_SNAPSHOT_EVENT = "pi-daddy:runtime-snapshot:v1";
 export function registerRuntimeSnapshot(
@@ -99,6 +100,7 @@ export function registerRuntimeSnapshot(
       sessionId?: string;
       cwd?: string;
       operationId?: string;
+      includeFinal?: boolean;
       reply?: (value: unknown) => void;
     };
     if (
@@ -139,7 +141,12 @@ export function registerRuntimeSnapshot(
           lifecycle.runtimeSnapshotGeneration !== generation
         )
           throw Error("operation owner changed during read");
-        request.reply!({ ...envelope, qualified: true, operation });
+        request.reply!({
+          ...envelope,
+          qualified: true,
+          operation,
+          ...(request.includeFinal === true && operation ? { final: operationFinal(session, operation) } : {}),
+        });
       } catch (error) {
         request.reply!({ ...envelope, qualified: false, operation: null, reason: String(error) });
       }
@@ -172,6 +179,7 @@ export function registerRuntimeSnapshot(
         }
         if (sequence !== bindSequence || session.reloadLifecycle !== lifecycle) return;
         lifecycle.runtimeSettlement = runtime;
+        bindOperationFinals(session, sessionId, cwd);
         bound = { sessionId, cwd, lifecycle: session.reloadLifecycle };
       } catch (error) {
         if (sequence === bindSequence && session.reloadLifecycle === lifecycle) problem = String(error);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-daddy",
-  "version": "0.48.3",
+  "version": "0.49.1",
   "description": "Capability governance for pi sub-agents: spawn Agent Skills (SKILL.md) definitions whose allowed-tools becomes a grant that can only narrow going down a delegation tree, enforced by pi's own --tools allowlist, with an append-only ledger.",
   "keywords": [
     "pi-package",

package/src/cli.ts

@@ -50,6 +50,7 @@ Usage:
   pi-daddy report [--since <date>] [--definition <name>] [--model <id>]
                   [--group-by definition|model|thinking] [--json]
   pi-daddy outcomes                       append changed episode outcomes from Git and CI
+  pi-daddy diagnostics export <selection.json> <new-directory>  private filtered local evidence
   pi-daddy --help | --version
 
 init references skills already enabled in Pi at their installed or local paths. Legacy unregistered npm
@@ -61,8 +62,11 @@ stays unspawnable. Capabilities that can change your machine
             It never rewrites ${SETTINGS_REL} — delete that file if you want it regenerated.`;
 
 export interface ParsedArgs {
-  command: "init" | "ledger-repair" | "ledger-import" | "report" | "outcomes" | "help" | "version";
+  command:
+    "init" | "ledger-repair" | "ledger-import" | "report" | "outcomes" | "diagnostics-export" | "help" | "version";
   importTarget?: string;
+  selectionPath?: string;
+  exportDirectory?: string;
   /** `ledger repair <path>`: the ledger file; `yes` applies, otherwise preview only. */
   ledgerPath?: string;
   yes?: boolean;
@@ -91,6 +95,19 @@ export function parseArgs(argv: string[]): ParsedArgs {
   if (args.includes("--version") || args.includes("-v")) return { command: "version", force: false, errors: [] };
 
   const [command, ...tail] = args;
+  if (command === "diagnostics") {
+    const [verb, selectionPath, exportDirectory, ...extra] = tail;
+    if (
+      verb !== "export" ||
+      !selectionPath ||
+      !exportDirectory ||
+      selectionPath.startsWith("-") ||
+      exportDirectory.startsWith("-") ||
+      extra.length
+    )
+      return { command: "help", force: false, errors: ["diagnostics needs: export <selection.json> <new-directory>"] };
+    return { command: "diagnostics-export", force: false, errors: [], selectionPath, exportDirectory };
+  }
   if (command === "ledger") {
     // ADR-0076 PR 3d: `ledger repair <path> [--yes]` previews, --yes truncates; `ledger import <source> <target>`.
     const [verb, target, ...flags] = tail;
@@ -388,6 +405,12 @@ export async function main(
     console.log(USAGE);
     return 0;
   }
+  if (parsed.command === "diagnostics-export") {
+    const { exportDiagnostics } = await import("./products/diagnostic-export.ts");
+    const result = await exportDiagnostics(parsed.selectionPath!, parsed.exportDirectory!);
+    console.log(JSON.stringify(result));
+    return result.missing ? 1 : 0;
+  }
   if (parsed.command === "outcomes") {
     const cwd = process.cwd();
     const result = await updateEpisodeOutcomes({

package/src/governance/retention-contract.ts

@@ -1,4 +1,4 @@
-import { Compile } from "typebox/compile";
+import { compileRetentionShape } from "./retention-validator.ts";
 import { parseRetentionJson } from "./retention-json.ts";
 import type { ExecutionRetentionManifest } from "./execution-retention.ts";
 
@@ -121,7 +121,7 @@ export const RETENTION_SCHEMA = freeze({
     },
   ],
 });
-const validator = Compile(RETENTION_SCHEMA);
+const validateShape = compileRetentionShape(RETENTION_SCHEMA);
 function freeze<T>(value: T): T {
   if (value && typeof value === "object") {
     for (const child of Object.values(value)) freeze(child);
@@ -166,7 +166,7 @@ export function buildExecutionRetentionManifest(value: unknown): ExecutionRetent
     }
   };
   inspect(value, 0);
-  if (!validator.Check(value)) throw new TypeError("invalid execution-retention 2.x manifest");
+  if (!validateShape(value)) throw new TypeError("invalid execution-retention 2.x manifest");
   const m = JSON.parse(JSON.stringify(value)) as ExecutionRetentionManifest;
   if (
     m.native.sessionId !== m.nativeSession.sessionId ||

package/src/governance/retention-validator.ts

@@ -0,0 +1,110 @@
+/** Dependency-free evaluator for the fixed retention schema; unsupported vocabulary fails at construction. */
+type Check = (value: unknown) => boolean;
+type Schema = Record<string, any>;
+const object = (value: unknown): value is Record<string, unknown> =>
+  value !== null && typeof value === "object" && !Array.isArray(value);
+const keywords = new Set([
+  "$schema",
+  "$id",
+  "type",
+  "const",
+  "enum",
+  "properties",
+  "required",
+  "additionalProperties",
+  "minLength",
+  "maxLength",
+  "pattern",
+  "minimum",
+  "maximum",
+  "items",
+  "maxItems",
+  "uniqueItems",
+  "anyOf",
+  "oneOf",
+  "allOf",
+  "not",
+  "if",
+  "then",
+  "else",
+]);
+
+/** This is internal retention vocabulary, not a general JSON Schema implementation. */
+export function compileRetentionShape(schema: Schema): Check {
+  for (const key of Object.keys(schema))
+    if (!keywords.has(key)) throw new TypeError(`unsupported retention schema keyword: ${key}`);
+  const checks: Check[] = [];
+  if (schema.type !== undefined) {
+    const types: Record<string, Check> = {
+      object,
+      array: Array.isArray,
+      string: (value) => typeof value === "string",
+      boolean: (value) => typeof value === "boolean",
+      integer: Number.isInteger,
+      null: (value) => value === null,
+    };
+    if (!Object.hasOwn(types, schema.type)) throw new TypeError("unsupported retention schema type");
+    checks.push(types[schema.type]);
+  }
+  if (Object.hasOwn(schema, "const")) checks.push((value) => value === schema.const);
+  if (schema.enum) checks.push((value) => schema.enum.includes(value));
+  if (schema.properties) {
+    const properties = Object.entries(schema.properties).map(
+      ([key, shape]) => [key, compileRetentionShape(shape as Schema)] as const,
+    );
+    checks.push(
+      (value) => !object(value) || properties.every(([key, check]) => !Object.hasOwn(value, key) || check(value[key])),
+    );
+  }
+  if (schema.required)
+    checks.push((value) => !object(value) || schema.required.every((key: string) => Object.hasOwn(value, key)));
+  if (schema.additionalProperties !== undefined) {
+    if (schema.additionalProperties !== false) throw new TypeError("unsupported retention additionalProperties");
+    checks.push(
+      (value) => !object(value) || Object.keys(value).every((key) => Object.hasOwn(schema.properties ?? {}, key)),
+    );
+  }
+  if (schema.pattern) {
+    const pattern = new RegExp(schema.pattern);
+    checks.push((value) => typeof value !== "string" || pattern.test(value));
+  }
+  if (schema.minLength !== undefined || schema.maxLength !== undefined)
+    checks.push(
+      (value) =>
+        typeof value !== "string" ||
+        ([...value].length >= (schema.minLength ?? 0) && [...value].length <= (schema.maxLength ?? Infinity)),
+    );
+  if (schema.minimum !== undefined || schema.maximum !== undefined)
+    checks.push(
+      (value) =>
+        typeof value !== "number" || (value >= (schema.minimum ?? -Infinity) && value <= (schema.maximum ?? Infinity)),
+    );
+  if (schema.items) {
+    const check = compileRetentionShape(schema.items);
+    checks.push((value) => !Array.isArray(value) || value.every(check));
+  }
+  if (schema.maxItems !== undefined) checks.push((value) => !Array.isArray(value) || value.length <= schema.maxItems);
+  if (schema.uniqueItems) checks.push((value) => !Array.isArray(value) || new Set(value).size === value.length);
+  for (const kind of ["anyOf", "oneOf", "allOf"] as const) {
+    if (!schema[kind]) continue;
+    const alternatives = schema[kind].map(compileRetentionShape) as Check[];
+    checks.push((value) =>
+      kind === "anyOf"
+        ? alternatives.some((check) => check(value))
+        : kind === "allOf"
+          ? alternatives.every((check) => check(value))
+          : alternatives.filter((check) => check(value)).length === 1,
+    );
+  }
+  if (schema.not) {
+    const check = compileRetentionShape(schema.not);
+    checks.push((value) => !check(value));
+  }
+  if (schema.if) {
+    const condition = compileRetentionShape(schema.if);
+    const yes = schema.then ? compileRetentionShape(schema.then) : () => true;
+    const no = schema.else ? compileRetentionShape(schema.else) : () => true;
+    checks.push((value) => (condition(value) ? yes(value) : no(value)));
+  }
+  return (value) => checks.every((check) => check(value));
+}

package/src/index.ts

@@ -191,3 +191,5 @@ export {
   type WorkspacePins,
   type ParsedPin,
 } from "./kernel/workspace-pin.ts";
+
+export { exportDiagnostics, parseDiagnosticSelection, type DiagnosticSelection } from "./products/diagnostic-export.ts";

package/src/kernel/selected-definitions.ts

@@ -12,7 +12,8 @@ export interface SelectedCommand {
   name: string;
   sourceInfo?: { path?: string };
 }
-const phases = ["plan", "build", "review", "debug", "investigate"];
+const requiredPhases = ["plan", "build", "review", "debug", "investigate"];
+const phases = [...requiredPhases, "test-review"];
 const hash = (value: string) => createHash("sha256").update(value, "utf8").digest("hex");
 const object = (x: unknown): x is Record<string, unknown> => !!x && typeof x === "object" && !Array.isArray(x);
 const exact = (x: Record<string, unknown>, keys: string[]) =>
@@ -57,10 +58,10 @@ async function principalBinding(
     manifest.version !== 1 ||
     manifest.package !== "principal-pi-skills" ||
     !object(manifest.bindings) ||
-    !exact(manifest.bindings, phases)
+    !exact(manifest.bindings, Object.hasOwn(manifest.bindings, "test-review") ? phases : requiredPhases)
   )
     throw Error("invalid Principal binding manifest");
-  for (const name of phases) {
+  for (const name of Object.keys(manifest.bindings)) {
     const row = manifest.bindings[name];
     if (
       !object(row) ||
@@ -74,6 +75,7 @@ async function principalBinding(
     )
       throw Error("invalid Principal binding row");
   }
+  if (!Object.hasOwn(manifest.bindings, phase)) throw Error("selected Principal phase has no binding row");
   const row = manifest.bindings[phase] as Record<string, string>;
   const agentPath = join(root, row.agent);
   if (

package/src/products/dashboard-cli.ts

@@ -376,6 +376,17 @@ export async function runDashboard(argv = process.argv.slice(2), env: NodeJS.Pro
       notice = (await connection.change({ action: "set", edits: trimmed.slice(2).trim() }))
         ? "Session models updated"
         : connection.state.error || "Session controls unavailable";
+    } else if (trimmed.startsWith("limit ")) {
+      const edit = /^limit (wall|idle) ([0-9]+)$/.exec(trimmed);
+      if (!edit) notice = "Use limit wall <seconds> or limit idle <seconds>; 0 restores default";
+      else
+        notice = (await connection.change({
+          action: "set-limit",
+          key: edit[1] as "wall" | "idle",
+          seconds: Number(edit[2]),
+        }))
+          ? "Session limit updated for future children; running children unchanged"
+          : connection.state.error || "Settings unavailable";
     } else notice = display.input(line) ? "" : `Unknown command: ${trimmed}. Press ? for help.`;
     redraw();
   };
@@ -397,7 +408,7 @@ export async function runDashboard(argv = process.argv.slice(2), env: NodeJS.Pro
       redraw();
       return;
     }
-    const action = display.key(
+    let action = display.key(
       key.name === "return"
         ? "return"
         : ["up", "down", "escape", "tab"].includes(key.name || "")
@@ -409,6 +420,32 @@ export async function runDashboard(argv = process.argv.slice(2), env: NodeJS.Pro
       return;
     }
     if (action === "command") command = "";
+    if (action === "setting") {
+      const selected = display.screen.settingKey ?? "auto";
+      const settings = connection.state.snapshot?.settings;
+      if (!settings?.editable) notice = "Settings can only be changed in the connected owning parent";
+      else if (selected === "auto") action = "auto";
+      else if (selected === "wall" || selected === "idle") command = `limit ${selected} `;
+      else if (selected === "descendants") notice = "Startup only: set PI_DADDY_FANOUT before restarting Pi";
+      else if (selected === "depth") notice = "Startup only: set PI_DADDY_MAX_DEPTH before restarting Pi";
+      else if (selected === "perCall") notice = "Children per call is a fixed safety bound";
+      else if (!settings.jev.available)
+        notice = "JEV controls unavailable; load skill-harness in the parent Pi session";
+      else {
+        void connection
+          .change({ action: "set-jev", enabled: !(settings.jev.enabled || settings.jev.pending) })
+          .then((changed) => {
+            const jev = connection.state.snapshot?.settings?.jev;
+            notice = !changed
+              ? connection.state.error || "JEV change already pending"
+              : jev?.pending
+                ? "Complete JEV paid-call and LoRA-storage choices in the parent Pi session"
+                : jev?.error ||
+                  `JEV ${jev?.enabled ? "enabled" : "disabled"}; ${jev?.availability ?? "status unknown"}`;
+            redraw();
+          });
+      }
+    }
     if (action === "auto") {
       const snapshot = connection.state.snapshot;
       if (!snapshot) notice = "Daddy permission controls unavailable";