specpi 0.15.0 → 0.16.0

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog
 
+## 0.16.0 - 2026-09-05
+
+- Enable experimental read-only delegation by default at the first session start of each Pi process, including TUI, RPC, print and JSON modes. Startup preflights the host without launching workers or model inference; selective review/scout admission, Guard checks, source restrictions and resource ceilings remain unchanged.
+- Keep `/delegate off` and safety revocations effective through reloads and session switches. `/delegate on` explicitly re-enables dispatch; restarting Pi reapplies the on default. Invalid settings, unsupported providers and locked, unready or ambiguous Guard policies still block activation.
+- Update delegation guidance and release references, and add startup/default-on regression coverage alongside real-Pi lifecycle checks. Restart Pi after updating SpecPi to load the changed delegation runtime.
+
 ## 0.15.0 - 2026-09-05
 
 - Add **SpecPi Chat 0.3.1**, a separately packaged VS Code sidebar with streamed Pi replies, safe Markdown, expanded thinking and collapsed tool output by default, model/thinking controls, exact approvals, and a compact composer. It reuses the user's Pi configuration without managing credentials or installing the harness.

package/README.md

@@ -24,19 +24,19 @@ SpecPi adds task contracts, workflow controls, and a local improvement loop to P
 
 Collection is disabled until explicitly enabled. Reports are sanitized, bounded, deduplicated by task, and never uploaded. Later evidence can reopen an item for review, but never restarts implementation automatically.
 
-Version `0.15.0` adds the separately packaged SpecPi Chat sidebar and RPC-compatible Guard startup and report dialogs. The terminal harness, optional read-only delegation, browser checks, and human-selected improvement workflow remain available. See the [release notes](CHANGELOG.md) for the change list.
+Version `0.16.0` enables bounded read-only delegation by default at Pi startup. One agent still owns edits and verification; worker use remains selective. SpecPi Chat, browser checks, and the human-selected improvement workflow remain available. See the [release notes](CHANGELOG.md) for the change list.
 
 ## SpecPi Chat for VS Code
 
-The `vscode/` source contains **SpecPi Chat 0.3.1**, a separately packaged native sidebar with streamed replies, tool results, file and image attachments, model/thinking controls, Pi approvals, and searchable workspace conversation history. Rename or archive chats, switch between independent live conversations, branch or edit an earlier prompt, search and export visible messages, inspect usage, and review changes through VS Code's native diff tools. Switching chats preserves background work, approvals, drafts, and attachments. Connected conversations share workspace files; use separate worktrees for isolated writers. Opening the sidebar does not start Pi.
+The `vscode/` source contains **SpecPi Chat 0.3.2**, a separately packaged native sidebar with streamed replies, tool results, file and image attachments, model/thinking controls, Pi approvals, and searchable workspace conversation history. Rename or archive chats, switch between independent live conversations, branch or edit an earlier prompt, search and export visible messages, inspect usage, and review changes through VS Code's native diff tools. Switching chats preserves background work, approvals, drafts, and attachments. Connected conversations share workspace files; use separate worktrees for isolated writers. Opening the sidebar does not start Pi.
 
-From a repository checkout, build a local VSIX with `npm --prefix vscode run package`, then install `.specpi-test/vscode/specpi-chat-0.3.1.vsix` through **Extensions: Install from VSIX…**. See the [extension guide](https://github.com/TannerMidd/SpecPi/blob/main/vscode/README.md) for prerequisites, image/provider limits, commands, privacy, and testing. Pi owns provider authentication and tool execution. Stop and Disconnect affect the selected conversation only; branching does not undo code changes. The extension is separate from the SpecPi npm package and has not been published to a marketplace.
+From a repository checkout, build a local VSIX with `npm --prefix vscode run package`, then install `.specpi-test/vscode/specpi-chat-0.3.2.vsix` through **Extensions: Install from VSIX…**. See the [extension guide](https://github.com/TannerMidd/SpecPi/blob/main/vscode/README.md) for prerequisites, image/provider limits, commands, privacy, and testing. Pi owns provider authentication and tool execution. Stop and Disconnect affect the selected conversation only; branching does not undo code changes. The extension is separate from the SpecPi npm package and has not been published to a marketplace.
 
-## Optional delegation
+## Selective delegation
 
 One agent owns edits and verifies results. Experimental delegation adds up to two read-only Pi workers: `review` checks a frozen artifact; `scout` answers a focused question using selected sources. Workers cannot write, run shell commands, browse the web, or delegate further.
 
-Delegation is **off by default**. In Pi, use `/delegate on` to enable it, `/delegate status` to inspect work, and `/delegate off` to revoke it. Research informed the design; SpecPi quality, speed, and cost gains remain unmeasured.
+Delegation is **on by default at Pi startup**, subject to compatibility, settings, and Guard checks. Startup does not launch workers or model inference. Use `/delegate status` to inspect work and limits, `/delegate off` to revoke it, and `/delegate on` to re-enable it. Off and safety revocations survive reloads and session switches; restarting Pi reapplies the on default. Research informed the design; SpecPi quality, speed, and cost gains remain unmeasured.
 
 See [setup and limits](docs/delegation/README.md) or [how the research shaped the architecture](https://tannermidd.github.io/SpecPi/single-agent/).
 
@@ -61,14 +61,14 @@ specpi doctor
 Pin the reusable CLI when installing a reviewed release, or inspect its plan without retaining a global CLI installation:
 
 ```bash
-npm install --global specpi@0.15.0
-npx --package specpi@0.15.0 specpi plan
+npm install --global specpi@0.16.0
+npx --package specpi@0.16.0 specpi plan
 ```
 
 For a source-audited installation, clone the exact release:
 
 ```bash
-git clone --branch v0.15.0 --depth 1 https://github.com/TannerMidd/SpecPi.git
+git clone --branch v0.16.0 --depth 1 https://github.com/TannerMidd/SpecPi.git
 cd SpecPi
 ./specpi plan
 ./specpi install

package/SECURITY_MODEL.md

@@ -6,19 +6,19 @@ This document describes SpecPi's architecture-level security assumptions, enforc
 
 ### Experimental native delegation
 
-Delegation is a native extension discovered through the ordinary Pi package and SpecPi lifecycle. Start `pi` normally; workers remain disabled and the model-facing schema absent until human activation. It adds no launcher, separate host process, service or trust override. Parent Pi retains normal resource discovery, trust decisions and proxy policy. Delegation checks required public SDK capabilities, not exact version identifiers. Missing session/runtime/settings/thinking APIs prevent activation; session construction and every request still enforce the tool, model and resource policy. API presence is not proof of every future SDK behavior or a passing integration receipt. Normal installation's minimum Pi version and 0.84.4 bootstrap pin are separate contracts.
+Delegation is a native extension discovered through the ordinary Pi package and SpecPi lifecycle. Start `pi` normally; delegation is enabled by default at the first session start of each Pi process, including TUI, RPC, print and JSON modes, after settings, host and Guard checks. Startup launches no workers or model inference, but Pi-owned authentication/OAuth preparation may occur. The model-facing schema is present only while dispatch is enabled. It adds no launcher, separate host process, service or trust override. Parent Pi retains normal resource discovery, trust decisions and proxy policy. Delegation checks required public SDK capabilities, not exact version identifiers. Missing session/runtime/settings/thinking APIs prevent activation; session construction and every request still enforce the tool, model and resource policy. API presence is not proof of every future SDK behavior or a passing integration receipt. Normal installation's minimum Pi version and 0.84.4 bootstrap pin are separate contracts.
 
 Each worker is an SDK `createAgentSession` instance with in-memory session storage. Pi owns its model/tool loop. A fresh Pi `ModelRuntime` uses standard authentication, environment and `models.json` resolution. Child transport and thinking budgets come from configured global settings; project settings are not loaded. Parent model/thinking are explicit with Pi's supported-level clamping. SpecPi does not extract credentials, copy authentication state or inspect private runtime fields. Preflight rejects runtime-only authentication, selected extension-registered provider overrides, model-specific headers, startup proxy configuration and mismatched safe model descriptors because those routes cannot be faithfully reconstructed. These rejections leave parent configuration unchanged.
 
 This is not full parent inference parity: parent request hooks, ephemeral runtime settings and session affinity are not automatically inherited. Keep delegation disabled if those inherited controls are required for every request. Children load no ambient extensions, skills, AGENTS files or parent transcript. Their only tools are selected-source list/read/literal-search; shell, write, arbitrary plugin, live-web and nested delegation tools are absent. Trusted parent extensions remain privileged in the same process. This is an application boundary, not an OS sandbox against malicious extensions.
 
-Human `/delegate on` activates the displayed experimental calls/time policy. Admission supports only frozen `review` and bounded `scout` analysis. Each job receives its assigned requirement IDs and fixed global constraints. Review needs inline context or selected files; scouts need selected files. A declared parallel benefit requires useful parent work. Structural checks reject unsupported mode/benefit combinations and duplicate normalized questions; they do not prove semantic independence or improved outcomes. Command Guard still intercepts the parent tool; Strict approval binds its capability summary to the exact call and policy generation. Guard, task, scope, model, session and branch changes revoke old generations; normal leaf advancement does not. Model requests cannot enable delegation, change models, raise ceilings or grant tools. Parent acceptance does not mint human authorization, actual verification or wishlist selection.
+The startup default activates the documented experimental calls/time policy. Human `/delegate off` revokes it and `/delegate on` re-enables it. Off and safety revocations survive reloads and session switches; restarting Pi reapplies the on default. No on/off preference is persisted. Admission supports only frozen `review` and bounded `scout` analysis. Each job receives its assigned requirement IDs and fixed global constraints. Review needs inline context or selected files; scouts need selected files. A declared parallel benefit requires useful parent work. Structural checks reject unsupported mode/benefit combinations and duplicate normalized questions; they do not prove semantic independence or improved outcomes. Command Guard still intercepts the parent tool; Strict approval binds its capability summary to the exact call and policy generation. Guard, task, scope, model, session and branch changes revoke old generations; normal leaf advancement does not. Model requests cannot enable delegation, change models, raise ceilings or grant tools. Parent acceptance does not mint human authorization, actual verification or wishlist selection.
 
-Command Guard is optional for delegation. Human activation works when Guard is absent or Off; read-only snapshot tools, admission policy and resource limits are enforced by delegation itself. An installed Guard's Strict approvals and explicit locks still apply. A responder with an unready policy, or multiple responders, blocks activation with a specific error. Guard installation, removal or mode changes invalidate the enabled generation before further worker calls.
+Command Guard is optional for delegation. Activation works when Guard is absent or Off; read-only snapshot tools, admission policy and resource limits are enforced by delegation itself. An installed Guard's Strict approvals and explicit locks still apply. A responder with an unready policy, or multiple responders, blocks activation with a specific error. Guard installation, removal or mode changes invalidate the enabled generation before further worker calls.
 
 Guard responders reattach on each session startup, including reuse of an extension instance. Invalid commands, declined confirmations and no-op mode requests do not revoke delegation. Accepted changes and critical locks do; an asynchronous confirmation must still match the active Guard generation before it can commit.
 
-The human activation choice follows subsequent parent provider/model and thinking selections. A selection revokes old generations and preflights the new host before automatically resuming dispatch; unsupported selections pause without falling back to the previous model. No job is automatically retried and no quota or settling slot is reset. New model generations invalidate old Strict approval fingerprints. Concurrent setup is bound to the latest selection and extension instance; completion cannot undo explicit off, Guard revocation or session/task/scope changes. Status distinguishes the requested on/off choice from whether dispatch is ready.
+The default or human activation choice follows subsequent parent provider/model and thinking selections. A selection revokes old generations and preflights the new host before automatically resuming dispatch; unsupported selections pause without falling back to the previous model. No job is automatically retried and no quota or settling slot is reset. New model generations invalidate old Strict approval fingerprints. Concurrent setup is bound to the latest selection and extension instance; completion cannot undo explicit off, Guard revocation or session/task/scope changes. Status distinguishes the requested on/off choice from whether dispatch is ready.
 
 The broker reads only explicitly selected, bounded regular text files under the fixed canonical working root captured for the Pi process, with private-path, traversal, symlink/junction, hardlink, binary and size checks. Restart Pi to change this root or load a new delegation runtime version. It rechecks source identity/content and validates evidence line ranges. Each job sees only its selected IDs. These checks assume a trusted local filesystem: portable Node APIs do not establish an atomic OS snapshot against hostile filesystem races, and filenames cannot reveal secrets embedded in ordinary source files. No live web adapter is included.
 

package/docs/delegation/README.md

@@ -1,6 +1,6 @@
 # Bounded delegation
 
-Status: experimental in SpecPi 0.15.0. Disabled by default.
+Status: experimental in SpecPi 0.16.0. Enabled by default at Pi startup.
 The package remains `specpi`; no separate npm package or background service is required.
 
 SpecPi keeps one agent responsible for changes and acceptance. This extension adds
@@ -62,12 +62,16 @@ those inherited controls for every request must keep delegation disabled. Receip
 bind supported model and source descriptors; they cannot certify an unchanged remote
 service or every configuration change behind a stable provider identity.
 
-## Enable deliberately
+## Control delegation
 
-In the interactive session:
+The first session start of each Pi process enables delegation after settings, host and
+Guard checks, in TUI, RPC, print and JSON modes. Startup does not launch workers or
+model inference. Preflight may perform Pi-owned authentication/OAuth preparation.
+Use one agent for small or sequential work; delegate only a justified independent question.
+
+In an interactive session:
 
 ```text
-/delegate on
 /delegate status
 /delegate limits
 /delegate cancel <batchId>
@@ -93,7 +97,10 @@ it does not retain or display live child reasoning. RPC and print mode keep the
 structured tool responses and do not mount terminal widgets. The UI uses Pi's public
 [widget and tool-rendering APIs](https://github.com/earendil-works/pi/blob/main/packages/coding-agent/docs/extensions.md).
 
-`on` grants the displayed experimental calls/time envelope. There is no model-call
+The startup default enables the documented experimental calls/time envelope. Use
+`/delegate off` to revoke it and `/delegate on` to explicitly re-enable it. Off and
+safety revocations survive `/reload` and session switches; restarting Pi reapplies the
+on default. No on/off preference is written to disk. There is no model-call
 permission toggle in the model-facing tool. `limits` is read-only; prompts cannot
 change timeouts or raise other ceilings. Turning delegation off, changing guard policy, switching
 sessions or models, navigating branches, and changing task/scope bindings revoke the
@@ -108,7 +115,7 @@ unsettled slots and consumed quotas, and checks the new host before resuming dis
 Old jobs are not retried. An unsupported selection pauses delegation with a reason;
 selecting a compatible model resumes it automatically. `/delegate off` remains off
 through later model changes. Guard, task/scope and session lifecycle changes still
-revoke activation. Status separates the user's `requested` choice from `enabled`
+revoke activation. Status separates the default or human `requested` choice from `enabled`
 dispatch, with `updating` and `pauseReason` for model setup.
 
 While delegation is off, its tool is removed from the parent's active tool list.

package/docs/delegation/design.md

@@ -2,7 +2,7 @@
 
 Status: archived target architecture, not the implemented runtime contract.
 
-The experimental implementation is part of `specpi` and is disabled by default.
+The experimental implementation is part of `specpi` and is enabled by default at Pi startup.
 Read the [implemented guide](README.md) and [calls/time protocol](protocol.md) for
 supported commands, tested API compatibility, limits and trust assumptions. This
 document preserves the original broader proposal, including unimplemented live-web,

package/docs/delegation/protocol.md

@@ -4,8 +4,12 @@ This is the implemented in-process API. It has no HTTP listener, daemon, child p
 or child session store. The broader [target protocol](design-protocol.md) remains a
 proposal; its stronger transport/attempt/cost gates are not supplied by this version.
 
-The extension loads through normal `pi` package discovery and remains disabled until
-the human runs `/delegate on`. Compatibility is checked through required public SDK
+The extension loads through normal `pi` package discovery and enables delegation at
+the first session start of each Pi process, including noninteractive modes. Startup
+preflights the host but launches no workers or model inference; Pi-owned authentication
+preparation may occur. `/delegate off` and safety revocations survive reloads and session
+switches; `/delegate on` re-enables it, and restarting Pi reapplies the on default.
+Compatibility is checked through required public SDK
 capabilities; there is no exact-version allowlist. Missing APIs prevent activation and
 are named in the error. The runtime also verifies the created session's thinking,
 tools and streaming interface. Tested versions are evidence, not an activation gate.
@@ -18,7 +22,7 @@ overrides, model-specific headers, startup proxy configuration and safe model-de
 mismatches fail preflight. Parent request hooks,
 ephemeral runtime settings, session affinity and ambient resources are not inherited.
 
-Command Guard is optional. Absent and Off states permit human activation; an installed
+Command Guard is optional. Absent and Off states permit activation; an installed
 Guard's Strict approvals and explicit locks remain enforced. Unready or duplicate
 Guard responders prevent activation with a specific error. Guard state changes revoke
 the current delegation generation. Snapshot tools and resource limits are enforced
@@ -51,7 +55,7 @@ policy rather than assuming the shipped default.
 
 ## Submit a batch
 
-After the human runs `/delegate on`, the parent calls the `delegate` tool:
+When delegation is enabled, the parent calls the `delegate` tool:
 
 ```json
 {
@@ -248,7 +252,7 @@ maximum. These are experiment limits, not research-derived optimal values.
 Human off/on, task changes,
 branch navigation, model selection, guard changes and reloads revoke old generations;
 they do not create a new resource allowance. Normal parent turns do not revoke a job.
-Model and thinking selections retain the human's activation choice. The extension
+Model and thinking selections retain the default or human activation choice. The extension
 preflights the latest selected host and resumes dispatch automatically, without
 replaying old jobs. Unsupported selections pause dispatch and report `pauseReason`;
 a compatible selection resumes it. Status exposes `requested`, `updating` and

package/extensions/delegation/extension.mjs

@@ -104,6 +104,7 @@ export function createDelegationExtension(
     let detach = () => {};
 
     let requested = false;
+    let startupActivation = true;
     let requestedGuard;
     let boundHost;
     let pending;
@@ -166,7 +167,11 @@ export function createDelegationExtension(
         panel?.update();
     }
 
-    function invalidate(reason) {
+    function invalidate(reason, preserveStartupDefault = false) {
+        if (!preserveStartupDefault) {
+            startupActivation = false;
+        }
+
         requested = false;
         pending = undefined;
         boundHost = undefined;
@@ -197,7 +202,7 @@ export function createDelegationExtension(
         const isBound = () => issuedEpoch === bindingEpoch;
         toolsReady = false;
         prepareContext(undefined, true);
-        invalidate("runtime factory rebound");
+        invalidate("runtime factory rebound", true);
         currentPi = pi;
         currentContext = undefined;
         const refreshSelection = async (ctx) => {
@@ -336,7 +341,7 @@ export function createDelegationExtension(
             });
         }
 
-        pi.on("session_start", (_event, ctx) => {
+        pi.on("session_start", async (_event, ctx) => {
             if (!isBound()) {
                 return;
             }
@@ -344,13 +349,27 @@ export function createDelegationExtension(
             currentContext = ctx;
             toolsReady = true;
             panel?.bind(ctx);
-            invalidate("session started or resources reloaded");
+            invalidate("session started or resources reloaded", true);
             try {
                 loadTimeout();
                 prepareContext(ctx, true);
+                // Consume the default only after synchronous preparation, which
+                // may revoke it. Off and safety events cancel it even before startup.
+                const activate = startupActivation;
+                startupActivation = false;
+                if (activate && isBound()) {
+                    requested = true;
+                    requestedGuard = getGuard();
+                    await refreshSelection(ctx);
+                    if (isBound() && requested && pauseReason) {
+                        ctx.ui.notify(`Delegation paused: ${pauseReason}`, "warning");
+                    }
+                }
             } catch (error) {
                 pauseReason = publicErrorMessage(error);
                 ctx.ui.notify(`Delegation unavailable: ${pauseReason}`, "warning");
+            } finally {
+                startupActivation = false;
             }
         });
         pi.on("session_shutdown", () => {
@@ -380,7 +399,8 @@ export function createDelegationExtension(
             }
         });
         pi.registerCommand("delegate", {
-            description: "Enable read-only delegation, inspect limits, or save timeout <minutes> (1–60; reset: 10)",
+            description:
+                "Control read-only delegation (on at Pi startup), inspect limits, or save timeout <minutes> (1–60; reset: 10)",
             getArgumentCompletions: (prefix) =>
                 [
                     "on",
@@ -496,7 +516,7 @@ export function createDelegationExtension(
             name: "delegate",
             label: "Delegate",
             description:
-                "Delegate an independent frozen review or substantial selected-source analysis to a real Pi child session. Only after human /delegate on. review: check artifacts against assigned requirements in fresh context; scout: answer a distinct evidence question over selected sources. Prefer one worker and parent-only execution for small, sequential or routine work. No shell, edits or live web. run returns immediately; collect waits for advisory evidence, then resolve findings after verification. One changed-input follow_up shares the original budget/deadline. Never grants permission or proves task completion.",
+                "Delegate an independent frozen review or substantial selected-source analysis to a real Pi child session. Enabled by default at Pi startup; respect /delegate off and safety revocations. review: check artifacts against assigned requirements in fresh context; scout: answer a distinct evidence question over selected sources. Prefer one worker and parent-only execution for small, sequential or routine work. No shell, edits or live web. run returns immediately; collect waits for advisory evidence, then resolve findings after verification. One changed-input follow_up shares the original budget/deadline. Never grants permission or proves task completion.",
             parameters: DELEGATE_SCHEMA,
             ...(presentation ? createToolRenderers(presentation) : {}),
             execute: async (_id, input, signal, _update, ctx) => {

package/extensions/delegation/native.mjs

@@ -7,7 +7,7 @@ import { DelegationError } from "./errors.mjs";
 import { createTimeoutStore } from "./settings.mjs";
 
 const stateKey = Symbol.for("specpi.delegation.native.v1");
-const revision = 8;
+const revision = 9;
 
 export async function withPiCompatibility(sdk, loadCompatibility) {
     if (typeof sdk.clampThinkingLevel === "function") {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "specpi",
-  "version": "0.15.0",
+  "version": "0.16.0",
   "description": "An explicit, privacy-conscious, self-improving harness for the Pi coding agent",
   "author": "Tanner Middleton",
   "repository": {