specpi 0.11.2 → 0.12.0

package/docs/delegation/research.md

@@ -0,0 +1,216 @@
+# Evidence behind the delegation design
+
+Reviewed through 5 September 2026. This ledger distinguishes published studies,
+preprints, production accounts and API contracts. Design implications are our
+inferences. None of these sources benchmarks SpecPi's experimental implementation.
+The [implemented guide](README.md) and [calls/time protocol](protocol.md) describe its
+current behavior. The [archived design](design.md) preserves the broader proposal;
+publication of supporting research does not establish that either design improves
+SpecPi outcomes. Deterministic fixture tests and empirical evaluation are separate.
+
+## Existing seven-study foundation
+
+The [architecture article](../../site/single-agent/index.html) and its
+[reviewed chart data](../../site/charts/research-data.json) contain the detailed
+comparisons. The relevant implications for this design are:
+
+| Primary source                                                                                                                                        | Evidence relevant to the decision                                                                                  | Consequence for the protocol                                                                       |
+| ----------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------ | -------------------------------------------------------------------------------------------------- |
+| [Kim et al., Nature Machine Intelligence, 24 July 2026](https://www.nature.com/articles/s42256-026-01268-y)                                           | Coordination helps some task classes and degrades others under matched system ceilings; software samples are small | Keep a parent-only route and evaluate by task class; no universal capability cutoff                |
+| [Tran and Kiela, preprint v2, 11 April 2026](https://arxiv.org/html/2604.02460v2)                                                                     | Requested reasoning budget changes the single-versus-multi-agent ranking; actual accounting is imperfect           | Give the single agent the same additional resources before attributing gains to delegation         |
+| [Wunderlich et al., ACL SRW, July 2026](https://aclanthology.org/2026.acl-srw.1/)                                                                     | Configured ensembles can improve static-question accuracy at comparable modeled compute                            | Allow measured exceptions; distinguish ensembles from tool-using repository work                   |
+| [SwarmBench, preprint v1, 31 August 2026](https://arxiv.org/html/2608.30661v1)                                                                        | Swarm gains on several context-intensive tasks; only four task types have cost-matched comparisons                 | Prioritize bounded independent research; preserve metrics, model composition and cost denominators |
+| [Anthropic research system, 13 June 2025](https://www.anthropic.com/engineering/multi-agent-research-system)                                          | Parallel research can improve coverage, with substantially greater token use                                       | Budget source collection and synthesis together; no automatic assumption of cheaper outcomes       |
+| [OneFlow, preprint v1, 18 January 2026](https://arxiv.org/html/2601.12307v1)                                                                          | Useful workflow structure can survive single-conversation execution; latency changes depend on workflow            | Test serial structured execution as an alternative; track caching and latency independently        |
+| [MAST, NeurIPS 2025](https://papers.nips.cc/paper_files/paper/2025/hash/b1041e52d3be19f0a9bc491657488e4a-Abstract-Datasets_and_Benchmarks_Track.html) | Taxonomy covers design, coordination and verification failures; no matched single-agent control                    | Require explicit coverage, provenance, incomplete states and parent acceptance                     |
+
+## Additional empirical evidence
+
+### CooperBench: communication does not solve integration
+
+[CooperBench, v2, 26 January 2026](https://arxiv.org/html/2601.13295v2), Sections 2,
+4–5 and Appendix C/Table 5, evaluates 652 paired-feature tasks across 12 repositories
+and four languages. Tasks deliberately involve overlapping or interdependent code;
+agents work in separate containers. Communication reduced merge conflicts for four
+models without a significant cooperation-success gain for any model. GPT-5's
+successful-task counts were 315 solo versus 183 cooperative. Communication could consume
+up to 20% of execution steps.
+
+**Inference:** file separation, successful messaging and a clean merge are weak
+acceptance criteria. Keep one integration owner and specify behavior and interfaces,
+not only paths. A writing-worker proposal needs its own end-to-end evidence.
+
+**Limits:** the 100-action ceiling is per agent, not a demonstrated match of total
+spending. Conflict-heavy coding tasks do not characterize independent research scouts.
+Observed associations between early planning and fewer conflicts are not a causal
+evaluation of a planning protocol.
+
+### MTRouter: routing is a capability with a training cost
+
+[MTRouter, ACL final proceedings, July 2026](https://aclanthology.org/2026.acl-long.2045.pdf),
+Sections 3–4, Table 3 and Appendix A.2, studies sequential selection among six models.
+On 359 in-distribution HLE questions, GPT-5 achieved 25.1±1.6% accuracy at $61.8, versus
+26.0±2.3% at $35.0 for MTRouter. Values are mean±SD over three runs, and costs aggregate
+evaluated episodes. Both use a $2 episode ceiling and a 30-turn limit. Training-data
+collection used 29,693 trajectories at approximately $1,620.
+
+**Inference:** evaluate model routing separately from delegation. Use observed
+task-state evidence and account for training and switching costs; an untrained
+confidence heuristic is not the studied router.
+
+**Limits:** HLE and ScienceWorld are not repository coding; the small accuracy
+difference does not establish superiority. Exact switch probabilities differ between
+Figure 4 and its prose, so they are not used here. Cache-related explanations are not
+isolated causal measurements.
+
+### Paritok-4B: a smaller packet is not automatically a better packet
+
+[Paritok-4B, v1, 25 August 2026](https://arxiv.org/html/2608.24188v1), Section 6.2,
+Table 9 and Section 7, tests all 300 SWE-bench Lite instances. Its line-numbered
+compression configuration retained 27.8% of context tokens by per-instance
+macro-average. Uncompressed context solved 122/300 tasks (40.7%); compressed context
+solved 109/300 (36.3%). Patch-application failures were five versus sixteen. The paired
+solve difference had exact McNemar p=0.079.
+
+**Inference:** preserve retrieval of original source inside the grant. Count omissions
+and downstream accepted results, not just reduction in packet size. Select relevant
+material before adding another model to compress it.
+
+**Limits:** this is one tool-free Sonnet 4.5 request with oracle file context and
+diff re-anchoring, not a running coding agent. Non-significance does not demonstrate
+equivalence. Token reduction does not include compression, caching, latency or recovery
+costs and must not be presented as end-to-end savings.
+
+### OrchestraBench: recovery requires a useful change in state
+
+[OrchestraBench, v1, 5 August 2026](https://arxiv.org/html/2608.05263v1), Sections
+5.2–5.5, Table 8 and the trusted-state ablation, separates transient tool faults from
+latent semantic corruption in controlled arithmetic chains. Blind retry reproduced
+latent faults. In the N=180 trusted-state ablation, latent recovery fell from 0.67 to
+0.08 when the trusted upstream value was removed. The paired comparison used 24 pairs.
+
+**Inference:** a recovery request must identify the failed assumption and new evidence
+or validated state. Preserve incomplete and uncertain outcomes. A replay of the same
+instructions is not a recovery strategy.
+
+**Limits:** these are small synthetic mechanism probes; some outcomes are deterministic
+by construction. A simple TF-IDF comparator solved all ten adversarial routing cases.
+The study does not justify a dedicated LLM router or production reliability claims.
+
+## Additional production guidance
+
+### Cognition: useful collaborators around a single writer
+
+[Multi-Agents: What's Actually Working, 22 April 2026](https://cognition.com/blog/multi-agents-working)
+updates Cognition's earlier skepticism. It describes useful fresh-context review and
+capable-model consultation while retaining one writer. Its weaker-primary consultation
+experiment improved cost and speed but hit a quality ceiling because the primary
+struggled to recognize when and how to ask for help.
+
+**Inference:** preserve a strong parent; keep review context free of implementation
+rationalization; return concrete context requests when evidence is missing. Evaluate
+different-model consultation against a same-model fresh context. Do not infer that
+different context makes errors statistically independent.
+
+**Limits:** this is a production account, not a controlled budget-matched comparison.
+Full-history forking is one reported consultation technique, but SpecPi's privacy and
+explicit-packet boundary means it is not adopted here. No reported product bug count
+is used as a target for SpecPi.
+
+### Anthropic: keep the standing harness small
+
+[The new rules of context engineering, 24 July 2026](https://claude.com/blog/the-new-rules-of-context-engineering-for-claude-5-generation-models)
+reports reducing Claude Code's system prompt by over 80% for newer models without a
+measured loss on its coding evaluations. It emphasizes interface design, progressive
+disclosure, and avoiding repeated instructions.
+
+**Inference:** put constraints in the controller and broker; load short mode instructions
+only when needed. Do not add a second planner, repeated role prompts, or several pages
+of standing routing heuristics to every SpecPi session.
+
+**Limits:** this is model- and harness-specific engineering guidance. It is not evidence
+that deleting arbitrary safety checks, context, or instructions helps every model.
+
+## Narrow admission policy
+
+The implemented purposes are `review` of a frozen artifact and `scout` analysis of a
+bounded evidence question. Both may use selected-source tools. A review gets original
+requirements, relevant constraints and actual validation facts without the parent's
+reasoning or verdict. A scout needs selected sources and an independently checkable
+answer. A claimed parallel benefit also needs useful concurrent parent work; a fresh
+review or context-isolated analysis may run while the parent waits.
+
+These are **promising experimental scenarios, not measured SpecPi improvements**.
+SwarmBench's cost-matched gains on three of four task types do not establish an
+advantage for every investigation or this same-model snapshot-only implementation.
+Cognition's cross-frontier consultation does not validate a separate generic same-model
+consultation mode. Investigation and supplied-source research therefore share `scout`;
+there is no live-web or model-routing route.
+
+Small edits, routine lookups, coupled mutable work, repeated role answers, writing
+teams and blind retries remain outside this policy. Parallel parent tool calls remain
+an alternative to creating a worker. Mode/benefit checks and rejection of duplicate
+normalized questions constrain structure; they cannot certify semantic independence.
+The two-worker ceiling and all numeric quotas are engineering choices awaiting local
+evaluation, not empirical optima extracted from the papers.
+
+## Pi compatibility evidence
+
+The experimental SDK integration checks required public capabilities rather than an
+exact version list. Compatible Pi updates can activate without a SpecPi patch. Missing
+APIs and incompatible session/provider behavior detected by the runtime checks fail closed.
+The installer still bootstraps 0.84.4; its minimum-version contract is separate. The investigation used
+public tagged source and official documentation without live provider calls or private
+Pi state inspection. The current implementation uses public SDK `createAgentSession`,
+in-memory sessions and a fresh Pi `ModelRuntime` with standard authentication,
+environment and `models.json` resolution. Child transport/thinking budgets use configured
+global settings without project settings. Parent model/thinking are explicit, with Pi
+clamping; unsupported runtime-only authentication, selected extension-provider overrides,
+model-specific headers, startup proxy configuration and safe descriptor mismatches fail
+preflight. These integration limits leave the parent's setup unchanged.
+
+Pi runs the child loop. SpecPi admits each SDK invocation, disables retries/compaction
+and checks SDK-visible streaming. No ambient child resources or parent transcript are
+loaded. Parent request hooks, ephemeral runtime settings and session affinity are not
+automatically transferred. Full parent parity and hard raw-transport, hidden-attempt,
+memory or invoice bounds are not claimed. SDK contract tests and comparative outcomes
+remain distinct evidence requirements.
+
+| Contract                                | Primary source                                                                                                                     | Design consequence                                                                      |
+| --------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------- |
+| Credential-blind completion facade      | [ModelRegistry at v0.84.4](https://github.com/earendil-works/pi/blob/v0.84.4/packages/coding-agent/src/core/model-registry.ts#L59) | Useful building block; does not expose the configured streaming pipeline                |
+| Runtime auth and request preparation    | [ModelRuntime](https://github.com/earendil-works/pi/blob/v0.84.4/packages/coding-agent/src/core/model-runtime.ts#L541)             | Keep credential handling inside Pi; preserve composed provider behavior                 |
+| Agent sessions and thinking translation | [SDK](https://github.com/earendil-works/pi/blob/v0.84.4/packages/coding-agent/src/core/sdk.ts#L283)                                | Use the Pi agent loop with explicit model/thinking; full parent policy is not automatic |
+| Tool interception                       | [AgentSession](https://github.com/earendil-works/pi/blob/v0.84.4/packages/coding-agent/src/core/agent-session.ts#L451)             | Built-in factories and `pi.exec()` do not automatically inherit Command Guard           |
+| Resource discovery                      | [ResourceLoader](https://github.com/earendil-works/pi/blob/v0.84.4/packages/coding-agent/src/core/resource-loader.ts#L36)          | In-memory session storage alone does not create a sterile child                         |
+| Tool scheduling                         | [Agent defaults](https://github.com/earendil-works/pi/blob/v0.84.4/packages/agent/src/agent.ts#L205)                               | Explicitly select execution policy and enforce each limit before work                   |
+| Error and usage semantics               | [Message types](https://github.com/earendil-works/pi/blob/v0.84.4/packages/ai/src/types.ts#L332)                                   | Inspect terminal status; do not double-count reasoning output or assume errors are free |
+| Session identity and navigation         | [Extension types](https://github.com/earendil-works/pi/blob/v0.84.4/packages/coding-agent/src/core/extensions/types.ts#L522)       | Invalidate actual navigation and task revisions, not every advancing leaf               |
+
+[Latest SDK](https://pi.dev/docs/latest/sdk), [latest extensions](https://pi.dev/docs/latest/extensions)
+and [latest provider documentation](https://pi.dev/docs/latest/custom-provider) were
+cross-checked. These are moving references, not proof of compatibility with a specific
+version. The [Pi 0.85.0 release notes](https://github.com/earendil-works/pi/releases/tag/v0.85.0)
+confirm its 4 September 2026 release. An isolated installation also reported CLI version
+0.85.0, prompting review of that released SDK alongside the tagged 0.84.4 baseline cited
+above. Isolated native and provider integration checks have passed on 0.85.0. These
+prove the exercised fixtures, not every provider/setup or comparative task benefit.
+The local activation failure on Pi 0.85.1 exposed the fragility of exact-version gating.
+The [0.85.1 tag](https://github.com/earendil-works/pi/releases/tag/v0.85.1) and an isolated
+installation were checked; its SDK session, agent-session and model-runtime modules
+match 0.85.0. The provider and ordinary-startup integration suites also pass on 0.85.1,
+including actual SDK tool replay, cancellation settlement, resource isolation and
+reload behavior. Unit fixtures accept newer and absent version identifiers while
+rejecting missing required APIs and unsupported provider routes. These synthetic
+identifiers do not claim that future SDK releases have been tested. Version labels
+now record test coverage rather than grant permission.
+Full repository and package validation remain separate release checks; API presence
+and a successful CLI version check cannot replace them.
+
+## What remains unproven
+
+The research does not establish an optimal default packet size, worker count, retry
+count, or routing threshold for SpecPi. It does not demonstrate production reliability
+for this implementation, a financial return, or a general advantage for parallel code
+writers. The target design and experimental protocol turn these uncertainties into
+testable choices. Runtime compatibility and measured user value remain distinct gates.

package/extensions/command-guard/index.ts

@@ -18,6 +18,7 @@ type State = {
     categories: Record<string, number>;
     rules: Record<string, number>;
     criticalRule?: string;
+    onModeChanged?: () => void;
 };
 
 function validRecord(value: unknown): value is Record<string, unknown> {
@@ -138,12 +139,17 @@ function decisionPrompt(decision: any, cwd: string, affected: string): string {
     return boundedReason(fields, 1200);
 }
 
+function lockSession(state: State): void {
+    state.mode = "locked";
+    state.generation += 1;
+    state.sessionApprovals.clear();
+    state.onModeChanged?.();
+}
+
 function deny(state: State, reason: string, critical = false): { block: true; reason: string } {
     state.blocks += 1;
     if (critical) {
-        state.mode = "locked";
-        state.generation += 1;
-        state.sessionApprovals.clear();
+        lockSession(state);
     }
 
     return { block: true, reason: boundedReason(reason) };
@@ -175,6 +181,34 @@ export default function registerCommandGuard(
         categories: {},
         rules: {},
     };
+    state.onModeChanged = () => pi.events?.emit("specpi:guard-policy-changed", { reason: "guard policy changed" });
+    let guardStateSubscription: (() => void) | undefined;
+    const subscribeGuardState = () => {
+        if (!guardStateSubscription) {
+            guardStateSubscription = pi.events?.on?.("specpi:guard-state", (request: any) => {
+                request.reply({ mode: state.ready && !state.startupFailed ? state.mode : undefined });
+            });
+        }
+    };
+
+    subscribeGuardState();
+    const delegationPolicy = (input: unknown): { fingerprint: string; summary: string } | undefined => {
+        let replies = 0;
+        let policy: any;
+        pi.events?.emit("specpi:delegation-policy", {
+            input,
+            reply(value: any) {
+                replies += 1;
+                policy = value;
+            },
+        });
+        if (replies !== 1 || !/^[a-f0-9]{64}$/u.test(policy?.fingerprint) || typeof policy?.summary !== "string") {
+            return undefined;
+        }
+
+        return { fingerprint: policy.fingerprint, summary: boundedReason(policy.summary, 1600) };
+    };
+
     const reset = () => {
         clearAnalysisCache();
         state.mode = "guard";
@@ -192,10 +226,17 @@ export default function registerCommandGuard(
 
     pi.on("session_start", async (_event, ctx) => {
         reset();
+        const startupGeneration = state.generation;
         try {
+            subscribeGuardState();
             const choice = ctx.hasUI ? await startupChoice(ctx, startupTimeoutMs) : undefined;
+            if (state.generation !== startupGeneration) {
+                return;
+            }
+
+            let mode: "guard" | "strict" | "off" = "guard";
             if (choice === "Strict") {
-                state.mode = "strict";
+                mode = "strict";
             } else if (choice === "Off for this session") {
                 const confirmed = ctx.hasUI
                     ? await withTimeout(
@@ -207,10 +248,15 @@ export default function registerCommandGuard(
                           startupTimeoutMs,
                       )
                     : false;
-                state.mode = confirmed ? "off" : "guard";
+                if (state.generation !== startupGeneration) {
+                    return;
+                }
+
+                mode = confirmed ? "off" : "guard";
             }
 
-            state.baseMode = state.mode;
+            state.mode = mode;
+            state.baseMode = mode;
             state.ready = true;
             state.startupFailed = false;
             updateStatus(ctx, state);
@@ -221,6 +267,10 @@ export default function registerCommandGuard(
                 state.mode === "off" ? "warning" : "info",
             );
         } catch {
+            if (state.generation !== startupGeneration) {
+                return;
+            }
+
             state.startupFailed = true;
             state.ready = false;
             try {
@@ -232,6 +282,11 @@ export default function registerCommandGuard(
     });
     pi.on("session_shutdown", (_event, ctx) => {
         reset();
+        if (typeof guardStateSubscription === "function") {
+            guardStateSubscription();
+            guardStateSubscription = undefined;
+        }
+
         try {
             ctx.ui.setStatus("specpi-command-guard", undefined);
         } catch {
@@ -256,6 +311,12 @@ export default function registerCommandGuard(
                 return;
             }
 
+            if (!["guard", "strict", "off", "unlock", "clear-approvals"].includes(action)) {
+                ctx.ui.notify("Usage: /guard [status|guard|strict|off|unlock|clear-approvals]", "error");
+
+                return;
+            }
+
             if (state.mode === "locked" && action !== "unlock") {
                 ctx.ui.notify(
                     "The command guard is locked. Use /guard unlock after reviewing the critical rule.",
@@ -268,6 +329,7 @@ export default function registerCommandGuard(
             if (action === "clear-approvals") {
                 state.sessionApprovals.clear();
                 state.generation += 1;
+                state.onModeChanged?.();
                 ctx.ui.notify("Session approvals cleared.", "info");
 
                 return;
@@ -280,6 +342,7 @@ export default function registerCommandGuard(
                     return;
                 }
 
+                const approvalGeneration = state.generation;
                 const ok =
                     ctx.hasUI &&
                     (await withTimeout(
@@ -290,11 +353,12 @@ export default function registerCommandGuard(
                         false,
                         approvalTimeoutMs,
                     ));
-                if (ok) {
+                if (ok && state.generation === approvalGeneration) {
                     state.mode = state.baseMode;
                     state.generation += 1;
                     state.sessionApprovals.clear();
                     state.criticalRule = undefined;
+                    state.onModeChanged?.();
                     updateStatus(ctx, state);
                     ctx.ui.notify(`Command guard unlocked in ${state.baseMode} mode.`, "warning");
                 }
@@ -303,6 +367,11 @@ export default function registerCommandGuard(
             }
 
             if (action === "off") {
+                if (state.mode === "off") {
+                    return;
+                }
+
+                const approvalGeneration = state.generation;
                 if (
                     !ctx.hasUI ||
                     !(await withTimeout(
@@ -312,7 +381,8 @@ export default function registerCommandGuard(
                         ),
                         false,
                         approvalTimeoutMs,
-                    ))
+                    )) ||
+                    state.generation !== approvalGeneration
                 ) {
                     return;
                 }
@@ -321,24 +391,31 @@ export default function registerCommandGuard(
                 state.baseMode = "off";
                 state.generation += 1;
                 state.sessionApprovals.clear();
+                state.onModeChanged?.();
                 updateStatus(ctx, state);
 
                 return;
             }
 
             if (action === "strict" || action === "guard") {
+                if (state.mode === action) {
+                    return;
+                }
+
+                const approvalGeneration = state.generation;
                 if (
-                    action === "guard" &&
-                    state.mode === "strict" &&
-                    (!ctx.hasUI ||
-                        !(await withTimeout(
-                            ctx.ui.confirm(
-                                "Switch to Guard mode?",
-                                "This weakens protection for the rest of this session.",
-                            ),
-                            false,
-                            approvalTimeoutMs,
-                        )))
+                    (action === "guard" &&
+                        state.mode === "strict" &&
+                        (!ctx.hasUI ||
+                            !(await withTimeout(
+                                ctx.ui.confirm(
+                                    "Switch to Guard mode?",
+                                    "This weakens protection for the rest of this session.",
+                                ),
+                                false,
+                                approvalTimeoutMs,
+                            )))) ||
+                    state.generation !== approvalGeneration
                 ) {
                     return;
                 }
@@ -347,12 +424,11 @@ export default function registerCommandGuard(
                 state.baseMode = action;
                 state.generation += 1;
                 state.sessionApprovals.clear();
+                state.onModeChanged?.();
                 updateStatus(ctx, state);
 
                 return;
             }
-
-            ctx.ui.notify("Usage: /guard [status|guard|strict|off|unlock|clear-approvals]", "error");
         },
     });
 
@@ -462,9 +538,7 @@ export default function registerCommandGuard(
                     }
 
                     if (answer === "Lock session") {
-                        state.mode = "locked";
-                        state.generation += 1;
-                        state.sessionApprovals.clear();
+                        lockSession(state);
                         updateStatus(ctx, state);
 
                         return deny(state, "The session was locked by command-guard approval.");
@@ -557,9 +631,7 @@ export default function registerCommandGuard(
                     }
 
                     if (answer === "Lock session") {
-                        state.mode = "locked";
-                        state.generation += 1;
-                        state.sessionApprovals.clear();
+                        lockSession(state);
                         updateStatus(ctx, state);
 
                         return deny(state, "The session was locked by command-guard approval.");
@@ -573,7 +645,15 @@ export default function registerCommandGuard(
 
             if (state.mode === "strict") {
                 recordDecision(state, { category: "unknown", ruleIds: ["tool.unknown-capability"] });
-                const approvalFingerprint = toolFingerprint(name, input, ctx.cwd, state.mode);
+                const capability = name === "delegate" ? delegationPolicy(input) : undefined;
+                if (name === "delegate" && !capability) {
+                    return deny(state, "Delegation policy is unavailable or ambiguous; execution is denied.");
+                }
+
+                const effectiveInput = capability
+                    ? { input, delegationPolicyFingerprint: capability.fingerprint }
+                    : input;
+                const approvalFingerprint = toolFingerprint(name, effectiveInput, ctx.cwd, state.mode);
                 if (!approvalFingerprint) {
                     return deny(state, "Unknown-tool approval input is malformed or exceeds the safety bound.");
                 }
@@ -589,7 +669,7 @@ export default function registerCommandGuard(
                 const approvalGeneration = state.generation;
                 const answer = await withTimeout(
                     ctx.ui.select(
-                        `Unknown tool approval — name: ${boundedReason(name, 96)}; mode: ${state.mode}; capability is not in the reviewed command-guard catalog.`,
+                        `Unknown tool approval — name: ${boundedReason(name, 96)}; mode: ${state.mode}; ${capability?.summary ?? "capability is not in the reviewed command-guard catalog."}`,
                         ["Deny (Recommended)", "Allow once", "Allow exact call for session", "Lock session"],
                     ),
                     undefined,
@@ -598,7 +678,14 @@ export default function registerCommandGuard(
                 if (
                     state.generation !== approvalGeneration ||
                     state.mode === "locked" ||
-                    toolFingerprint(name, input, ctx.cwd, state.mode) !== approvalFingerprint
+                    toolFingerprint(
+                        name,
+                        capability
+                            ? { input, delegationPolicyFingerprint: delegationPolicy(input)?.fingerprint }
+                            : input,
+                        ctx.cwd,
+                        state.mode,
+                    ) !== approvalFingerprint
                 ) {
                     return deny(state, "Command-guard state or input changed during approval; execution is denied.");
                 }
@@ -619,9 +706,7 @@ export default function registerCommandGuard(
                 }
 
                 if (answer === "Lock session") {
-                    state.mode = "locked";
-                    state.generation += 1;
-                    state.sessionApprovals.clear();
+                    lockSession(state);
                     updateStatus(ctx, state);
                 }