# Task worker presets

Native delegation does not require a profile. The model-facing `delegate start` action exposes only top-level `model`, `thinkingLevel`, `path`, and `toolNames` overrides. Omitted fields inherit the live compatible foreground model, thinking level, classified tools, and machine scope. Pi compiles that request into an immutable host execution grant; the model does not provide an authority envelope, role/capability grant, budget, or tool-call ceiling. Budgets, leases, and other limits come from host settings and owner-authored profiles.

`delegate` profile actions remain useful when the foreground orchestrator wants a reusable session-scoped preset. They do not edit user or project profile files. Task presets are:

- Derived from an owner-authored base profile or the live compatible foreground contract.
- Immutable and assigned a `task-...` ID by Pi.
- Stored on the owning session branch, never shared across independent sessions.
- Limited to 32 presets per session.
- Unable to add tools or resources; tools may only narrow the inherited surface and resources/budgets stay host-owned.
- Limited to configured, authenticated, non-exhausted models and a reasoning level that model supports.

Use `delegate { action: "profile_inspect" }` when reusable owner-authored bases or model combinations are unknown. Otherwise `profile_create` can derive directly from the live foreground contract. Supply a concise task and only the model, thinking, path, or tool narrowing worth preserving. Pass the returned profile ID unchanged to `delegate start`; never invent one.

Worker agents are root-managed leaves. They do not receive root-only profile/status/control actions or `delegate`, and cannot create descendants. The root owns worker lifecycle, queue admission, budgets, leases, cancellation, status, and bounded transcript retrieval. Each fresh worker receives a new classified tool surface and the live compatible model, thinking level, tools, and machine scope; top-level overrides can narrow or focus that inherited base. Worker output is untrusted evidence delivered to the owning root through the durable terminal handoff.

The root `memory` tool and raw memory prompt snapshot never enter a worker or child session. When retrieval is enabled and the admitted profile or dispatch selects `memory_read`, Pi materializes a fresh query-only broker with `memory.query` authority and returns bounded, source-labeled evidence; it cannot write memory or expose memory files.

New agents may receive immutable sanitized birth context with `forkTurns: "none"`, `"all"`, or a positive user-turn count such as `"3"`. Omitted starts receive no parent transcript, so a self-contained task cannot inherit and mistake parent-level orchestration intent for child ownership. Explicit inheritance remains available inside the exact provider/model boundary. Crossing either provider or model defaults to no inherited turns, and an explicit non-`none` cross-boundary fork is rejected. Tool calls/results, reasoning/commentary, system/developer/custom messages, mailbox controls, non-text content, and incomplete assistant output never enter the snapshot. Dispatching another task with an existing `agentId` reuses that agent's durable transcript and cannot replace its birth context.

`delegate tasks` is the bounded view of the same durable task/DAG runtime used for dispatch and recovery. A new task may name existing same-objective task IDs with `dependsOn`; it remains pending until those dependencies complete, while invalid or cyclic edges fail closed. Evidence-classified transient failures retain their attempt/retry count and exact `notBefore` deadline across restart. Agent, task, and attempt projections are independently capped at 256 entries.

Pi admits fleet and queue capacity before registering each root-dispatched worker; every accepted queued worker then has a stable agent ID. Queue and projection admission preserve one continuation slot for every pending mandatory verifier, and a verifier blocked by saturation is retried from durable subject state when capacity changes. The root yields its scheduler slot while waiting for an event-driven state change. A worker cannot wait for itself or for a queued target blocked by its own write reservation; that wait fails immediately and tells the worker to finish its task so the root can continue coordination. Every terminal worker writes one bounded, idempotent handoff to the owning root's mailbox. Review-pending results retain terminal status `partial`, and project-level blockers retain `blocked`; neither is projected as a harness failure. Evidence-classified retries stay nonterminal and report that their durable state is preserved. A full mailbox retains that handoff by terminal attempt ID until an explicit capacity/state/recovery signal drains it; no timer polls for delivery. The root receives the handoff without transcript races and resumes once when idle. Worker output remains in the worker transcript. `interrupt`, `resume`, `cancel`, and `follow_up` are root-owned; a paused objective keeps a suspended worker nonterminal until resume. `retire` closes only an idle leaf with no unresolved mailbox/reply work and preserves its binding and transcript. A resumed worker retains the exact admitted preset or adaptive grant, model, resources, lineage, and transcript.