# Delegation verification

## Restricted general inheritance integrated with current main

PR 24 was locally rebased from `fde232151a66cb3a1b2e7e10afd90dc50a5e42bd` onto immutable main `653764c09483a7c204b4bbb6354ac5ab5a2225bd`, retaining the original head in `refs/heads/backup/pr24-before-main-rebase`. Conflict reconciliation preserves main’s 16-task concurrency, absolute depth-two scout/review targets for all bundled profiles, two-panel profile viewer and Hub footer/imagery, alongside restricted general inheritance. Read-only nested fixtures now explicitly narrow general’s builtin ceiling and retain existing spawn revocations rather than regaining writer authority.

The viewer now supplies available skill metadata from public command `getSystemPromptOptions().skills` to the same profile validator, without exposing parent instructions or context files. Its general details describe builtin inheritance and reviewed leaf ceilings, not a read-only role. Command metadata reports base prompt inputs; per-turn hooks may change the skills used at admission, and callable tools remain unknown in command context. The regression first failed with an empty inherited skill list, then passed with exact skill paths, project revocation, default builtin/spawn ceilings, unchanged non-TUI JSON envelope, privacy and rendered-detail assertions.

Observed checks: worktree-local `npm ci --ignore-scripts` installed 130 packages (0 audit vulnerabilities; no dependency or lockfile edits); targeted viewer/profile/general-inheritance/scheduling tests passed **39/39**. `npm run check` passed lint, formatting, typecheck, the full default **172/172** tests (zero failed/skipped/cancelled) and the actual controlled SDK exercise. SDK tests cover real builtin/leaf effects, permission hooks, live config/callability/reaching/provenance revocation, conservative leaf writer serialization, cancellation/drain, renewal and ancestor ceilings; default nesting/depth/request revocation coverage remains intact. No new verification framework, dependency, runner default or weakened safety assertion was introduced. One scoped minimality review retained the existing validator/renderer/dispatcher and only added the missing skill-input connection and explanatory details.

The refreshed `images/subagent-profiles.svg` typesets actual production `createProfileViewer().render(120)` output at 23 rows with synthetic bundled data and an injected neutral palette. It explicitly remains an illustration, **not a screenshot**; no available skills are supplied in that synthetic example. Hub illustration and footer sources are unchanged from main. No fresh interactive terminal capture, human visual acceptance, live-provider calls, sandbox guarantee or publication is claimed. Leaf grants remain operator assertions about reviewed trusted code; undeclared orchestration in arbitrary extension JavaScript is not contained.

## Resolved Subagent Profiles overlay

The read-only `/subagent-profiles` command now resolves operator and trusted-project policy for the current cwd with the same profile/skill validator as admission. TUI uses a two-panel list/details component, with stacked narrow geometry and a tiny resize fallback. Non-TUI keeps the `{toolPolicy, profiles}` JSON message. Callable tools are explicitly unknown in command context; this is not an active-tool approximation or an admission preview.

Local verification: lint, format check, typecheck and diff whitespace check passed. Focused profile viewer/profile/CLI tests passed **9/9**; the full suite passed **156/156** with no failures, skips or cancellations. The controlled SDK exercise also passed. New tests cover operator/project resolution and trust, command mode routing, unchanged JSON envelope, malformed project config, arbitrary extra roles, selection/detail scrolling, sanitized output and widths 0–120/heights 1–25. One scoped simplification review retained the small snapshot consumer and existing validator/sanitizer/terminal-width helpers; no new runtime, dependency, policy defaults or inheritance mechanism was introduced.

`images/subagent-profiles.svg` typesets actual production `createProfileViewer().render(120)` rows at 23 rows, using synthetic bundled profiles and a neutral injected palette. It is a native-component illustration, **not a terminal screenshot**, live-provider exercise, PTY capture or human visual acceptance. The initial image-generation attempt requested an unexported `theme` symbol and failed before writing; the final illustration uses the explicitly synthetic palette, with no private API. The existing fleet illustrations and their disclosure remain unchanged. Interactive terminal capture and arbitrary custom-theme visual acceptance were not performed for this change.

Current terminology is **Subagent Hub**, **Subagent Profiles** and **Subagents**. Current commands are `/subagent-hub`, `/subagent-profiles`, `/subagent-status`, `/subagent-steer` and `/subagent-stop`; no old aliases are registered. The verification records below describe their original candidates, including historical labels and commands, not current usage instructions. See the [current command reference](delegation-contract.md#registry-controls-and-final-delivery).

## Workflow-independent discovery

Startup guidance, examples and compatibility tests describe native Pi delegation without naming or requiring an external workflow package. The compatibility suite is `test/compatibility.test.ts`. The full default suite passes **145/145**, with no failures, skips or cancellations; typecheck passes. Tested source/test manifest digest: `3c8877dc49ad7385e324bf90b4d16018861f99ee84b71c369b2c46a86c756163`. Live-model automatic tool selection remains unrun; controlled startup tests establish tool availability and guidance projection, not model choice.

## Native delegation compatibility — initial verification

The approved follow-up adds startup `subagent` discovery/guidance, common launch/control calls, supplied-workspace execution and native completion wake-ups. It does not import another extension or promise full API/configuration parity. Source/test manifest digest: `41d44bc852b2c6b60a61112232992a704d13a0e590abd5ac152a5f7b8f5d470c`.

**Controlled SDK/CLI integration:** the default suite passes 145/145 with zero failures, cancellations or skips. Typecheck, SDK exercise, 19-file package dry run and diff checks pass. The actual isolated Pi CLI exposes `subagent` at ordinary startup without an enable call and completes two scouts without activating extra builtins. Real SDK children read/edit/write/run bash in a throwaway Git worktree containing spaces and an apostrophe; root hooks see the actual adapted arguments and retain their real parent cwd. Tests cover root tool/write refusal, failed-cd no-fallback behavior, global writer queue/parent-write exclusion, atomic invalid-cwd admission, search defaults/shorthand refusal, parent-policy retention, task-file cwd, explicitly granted nested workspace inheritance, exact model selection, idle-parent wake once, fresh-generation resume/workspace retention and stale-control refusal. The first focused attempt used obsolete edit arguments and allowed the controlled parent to replay worker steps; the fixture now uses the current `edits[]` schema and acknowledges parent results. No assertions, runner concurrency or timeouts were weakened.

**Unrun:** live-model automatic tool selection and complete multi-task delivery with disposable remote PR/stack creation. This run authorized neither live inference nor a separate smoke repository's external writes. Controlled SDK/CLI results do not prove a model automatically chooses the extension or follows a complete external workflow. No installed-package cutover, active-session reload, retained-run migration or new human visual acceptance was performed. Replacement use requires only one loaded `subagent` provider; Pi's first-registration behavior is not a provider-priority mechanism.

## PR 9 rebase onto merged main

PR 9 was rebased onto main `a65a18e2405c02b3261fcfe417b83441d32bfb86` after its predecessor PRs merged. The reconciliation preserves main's writer admission/subtree cancellation fix (`6004646`) and generation FIFO fix (`482e217`), including all three added regression tests. The Hub, native thread renderer and other local follow-ups are unchanged by the rebase. The upstream GitHub workflow is retained unchanged.

The default suite passes 136/136, with zero failures, cancellations or skips. Typecheck, the controlled SDK exercise, the 18-file package dry run and diff checks pass. Source/test manifest digest: `fb8d52595419ba6e3486609bf51814b68d8ff4069b59b503e8cdc71881bf3b65`. No live-provider calls or new terminal captures were run; earlier UI evidence applies to the unchanged Hub/thread sources.

The README was shortened from 3389 to 1519 words. All ten code blocks remain byte-identical and in order; existing link targets are retained and local links/anchors checked. Earlier verification records below describe their original candidates, not additional runs against this rebased head.

## Historical: Agent Hub naming and unused-widget visibility

At this verification point, the command was `/agent-hub`, with the visible title **Agent Hub** throughout UI/help/examples. It replaced the former Hub command without an alias. The pinned heading was **Sub-agents**. An empty current registry renders no widget rows; admitted queued/setup/running/draining work and retained terminal tasks still appear. No extra visibility flag, timer or lifecycle owner was introduced.

The empty-widget regression was reproduced before the fix. Focused component/SDK lifecycle tests **27/27** and the default suite **133/133** pass with zero failures/skips/cancellations, as do typecheck, SDK exercise, 18-file package dry run and diff checks. Existing full-identity controls, short-geometry refusal, live-follow/scrolling, native renderer/privacy and writer-drain assertions remain. A fresh isolated offline CLI PTY exited **0**, observing no unused Sub-agents heading at startup, the heading after a controlled launch, and `/agent-hub` opening Agent Hub with its Sub-agents roster. These are actual emitted terminal fragments, not screenshots or a human visual-acceptance claim. No live-provider calls, user settings changes or active-session reload were needed. Source/test digest: `90662331e566749fdb9bcf355f2cb20835054416133d8635336054f4b268fb24`. The pending installation-first, standalone introduction and sourced feature-comparison README edits are preserved.

## Recognizable local extension name

The production entrypoint is now `src/pi-extended-subagents.ts`, declared in the package manifest and used by current examples/tests/docs. Pi labels local extensions from their filenames, so this replaces the generic `extension.ts` startup label. Entrypoint contents are byte-identical to the prior module; no compatibility shim or runtime change was added.

A real public `DefaultResourceLoader` test loads the local package through its manifest and verifies the named entrypoint with zero loader errors. Focused CLI/package tests **3/3**, default suite **133/133**, typecheck, SDK exercise, 18-file package dry run and diff checks pass. No live-provider calls or current-session reload were needed. Source/test digest: `ef76002358cdbb8c02eabd5a7211d526b58e0e4f18ffb06fbf98d177c96927c9` (sorted top-level source/test TypeScript files, then package manifests). Earlier verification below records the entrypoint's historical name.

## Hub navigation and compact agent tree — user follow-up

Admitted clean source HEAD **bdc4460e3858a29521e863cb6a7224d326434edb**. Only Hub/widget presentation, tests and docs change; native main-chat components, registry/permission/scheduler/model authority, exact UUID+generation actions and the short-height visible-original-target-or-refuse guard remain intact. Reference: `tintinweb/pi-subagents` **8df7fa7d8e8130151a8fbfa991a1d3fa6b443739**, README UI section/widget hierarchy and actual screenshot, read-only. The widget is an independent visual interpretation, not copied runtime/source/assets or a reference plugin.

Three focused REDs reproduce the actual missing behaviors: thread opens at old offset0 rather than tail, no normalized wheel handler, and old flat FLEET widget. PgUp/PgDn were already registered; no broken-keyboard theory is asserted. Thread now opens/follows newest output through partial/final/new messages and resize (**LIVE**); upward scrolling/Home detaches (**READING**) and preserves its row offset on append. End or scrolling down to bottom resumes. j/k line-scroll and Ctrl-u/d page-scroll supplement configured page bindings, without taking keys from native search/steer/inbox input; ↑↓ remains roster selection. Steering/inbox submission no longer resets a detached reader to offset0. Details/Tools start at top and do not auto-follow. The public fullscreen host normalizes wheel events into `Component.handleMouse`; only the reading viewport scrolls, and wheel elsewhere inside the Hub is consumed to suppress main-transcript fallback. Regular mode intentionally remains terminal-owned mouse/scrollback, with keyboard fallback. No global terminal/mouse-mode or host settings changes.

Widget: semantic status, bold role + short assignment, dim known direct request/tool/token/cost usage and render-time admission-to-disposal elapsed; newest accumulated activity uses public Unicode column slicing with leading ellipsis. Unknown usage is omitted, requests are not turns, context percentage is not synthesized, and no timer is added. Live draining/running/setup rows outrank recent terminal rows; queues are collapsed into a count, overflow counts remaining nonqueued agents, actual leases alone produce writer warnings. Existing 1–5-row/roughly-quarter-height bound is retained, including the warning at one-row budget.

Final focused **27/27** and DEFAULT **132/132**, zero failed/skipped/cancelled (about **7.5 seconds**); typecheck, actual SDK exercise, **18-file** package dry run, diff/index checks pass. The first default run was **131/132**: an overlooked nested-drain widget assertion expected old `cancelled 2` wording, while the actual new heading correctly emitted `2 cancelled`. Only that presentation regex changed; disposal ordering, nested ancestry, final timestamps and aborted-transcript assertions remain untouched. Failed evidence is retained, not waived; no default runner, serialization, timeout, skip or clock change. New tests cover live opening/detachment/append/final/resize/End/natural resume, physical page/laptop key data, input isolation, normalized wheel viewport/roster/footer/pin containment, known versus unknown direct metrics, tree/queue/overflow/lease budgets. Native equivalence/privacy/CJK/sanitization, original full-identity filter/stale/draining/history controls, short-geometry refusal/shrink-before-redraw and real held-writer drain remain green. Local no-download impeccable detector reports `[]`, not human visual acceptance.

Final actual isolated offline **ordinary-default-tool** CLI PTYs: dark/light/tinted **fullscreen**, dark **regular**, all exit **0** via normal Ctrl+D/public shutdown. A scratch content-only controlled-provider adaptation emits native Markdown/read/thinking/200-line streaming and then a real queued steering message/new SDK messages; it does not replace any renderer or make network/paid calls. Actual physical PgUp/PgDn, j/k, Ctrl-u/d, Home/End and resize are exercised. In dark fullscreen, opening ends LIVE90–109/109; while SDK transcript bytes grow5996→38254, detached reading stays21–39 while total rows grow155→255; End shows LIVE237–255/255 with the new steered final text. Resize to40×16 yields LIVE460–465/465, k detaches459–464 and End resumes. All themes show the same behavior. Real fullscreen SGR wheel traverses the host parser/public normalized dispatch and emits READING; roster wheel leaves thread selection/reading unchanged. Regular-mode mouse support is deliberately not claimed. Native dark↔light switching and widget wide/narrow states are emitted. These are sanitized ANSI/cursor-separated fragments, not screenshots, screen reconstruction, live inference or human contrast/glyph certification.

The first scratch PTY harness streamed too fast: by `s` the child was already settled, correctly refused steering, and the harness's subsequent Enter closed the Hub (one owned host required termination). That failed attempt is preserved under `first-harness-attempt/`; only controlled-provider speed was reduced to keep the designated child genuinely running. No production delay or acceptance refusal was weakened. The later `before-latest-activity-preview/` captures precede the final newest-activity refinement; final per-theme files are freshly emitted from final source. Temporary HOME/cwd/agent/session/theme data were isolated and removed.

Evidence **`/tmp/hub-navigation-widget-evidence/`**: RED/focused/default logs (including failed runs), typecheck/exercise/pack/diff/index, `api-proof.txt`, actual `.ansi`/step `.rows.txt`, per-theme readable `*-sample.txt`, `terminal-observations.json`, scratch harness/provider, digest/ownership. Source/test SHA-256 (sorted `src/*.ts`, then sorted `test/*.ts`, then manifests): **59d9ee0bf8c955b803db2d58fdb42e9f456e336d5b4348a6d1bc51acd89ecaa7**. Installed checkout remains clean at **bdc4460** pending coordinator acceptance; settings, active sessions, dependencies and other worktrees are untouched. No staging/commit/install/push/publication; writer relinquished after handoff. Advisor excluded; isolation deferred/unimplemented. Public private-renderer/settings limitations from the preceding increment remain; arbitrary custom-theme contrast and human glyph rendering are not certified.

## Readable labels and native main-chat renderer — user follow-up

Admitted clean source HEAD **da0915ee7c7c3589582a37fb7118c8b195bf3710**. This bounded UI increment derives display labels from assignment headline + role for Hub roster/headings, fleet widget and card headings. It introduces no name registry or new identity. Generation/history markers remain; compact labels reserve room for generation/position. Full UUID+generation remains in details/cards and pinned controls, search still finds full identities, and all execution/control keys remain the existing `ChildRef`. The prior short-height visible-original-target-or-refuse guard is unchanged.

Public Pi 1.5.2 API proof: package-root `dist/index.d.ts` line **37** exports `UserMessageComponent`, `AssistantMessageComponent`, `ToolExecutionComponent`; line **38** exports `getMarkdownTheme`; line **26** exports builtin `create*ToolDefinition` factories. Actual main interactive source uses these exact classes at **3312/3327/3376**. `src/thread.ts` constructs those classes, not copied renderers or handwritten Markdown. The existing custom callback injects its actual host TUI and public cwd; there is no second production TUI, parent runner/session bridge or builtin execution. Builtin definitions are reduced immediately to `renderShell/renderCall/renderResult`; the owned task definition similarly contributes only its existing renderers. Other owned/unknown tools use the native generic component. The ordinary Pi extension loader resolves public package imports to host exports; native singleton-theme behavior is additionally verified through real dark/light switching and cache invalidation. No private host imports are used.

Exact boundaries: public default Markdown, visible thinking and expanded tool output are used. Extension context does not expose the root renderer resolver chain, third-party overrides, Markdown transformers, or private hide-thinking/outputPad state; exact settings/override equivalence is not claimed. Native edit `argsComplete` stays false because its completed-args preview otherwise reads cwd files; only recorded sanitized `diff`/`firstChangedLine` details are passed for edit presentation. Arbitrary tool details and opaque provider signatures are withheld; images become explicit MIME/omission text. No observer execution-start clocks/timers are invented. Native edit/write may intentionally hide success prose/argument detail, so the existing Tools view retains full sanitized call arguments/result text and Details retains full outcome/result/artifacts. Native styling is not flattened/recolored: inputs are sanitized before rendering, only native SGR survives the output boundary (not terminal controls, links or shell zones), and native background resets restore the opaque neutral outer panel while inner native message/tool semantic backgrounds remain intact.

Final focused **24/24**, typecheck and full DEFAULT **129/129**, zero failures/skips/cancellations (about **7.2 seconds**). Four new tests cover human same-role label distinction/full identity search and readonly access; actual public user/assistant-class output equivalence with Markdown headings/lists/code/thinking; native read component/renderer output equivalence; cache reuse/real theme invalidation/assistant and partial-tool streaming; recorded edit diff with no args-complete preview or asynchronous observer clock; generic error/image/opaque-details privacy. Existing paging, CJK/emoji/reset bounds, historical structured results/artifacts, stale/draining/disposed/filter-drift pins, hidden-target refusal/shrink-before-redraw and real held-writer drain all remain. Existing presentation expectations were deliberately changed from short UUID/manual role headings to assignment labels/native formatting; behavioral target/refusal assertions remain. Test-only real unstarted TUIs suppress `requestRender` terminal writes; production uses the actual injected host. Focused setup corrections (explicit readonly dependency wiring, schema-specific renderer type narrowing, literal style capability and wrapped omission-marker expectations) preceded the final checks; no runner default, skip, timeout or safety-assertion relaxation occurred. `npm run exercise` passes; package dry run includes **18** files; diff/index checks pass. The local no-download impeccable detector returns `[]`, not human visual/accessibility acceptance.

Fresh actual offline default-tool CLI PTYs ran dark, light and deliberately tinted themes, each exiting **0** via normal public shutdown. A scratch **content-only** adaptation of the existing controlled fleet provider emits Markdown heading/list/code and thinking; no renderer implementation was copied and no paid/live model was used. Temporary cwd/HOME/agent/provider/themes/session data were isolated and cleaned. Actual 100×30 / 90-column rows show readable Reader alpha/beta labels beside native `read input.txt`, thinking, formatted Findings/list and `const validated = true;`. Live 40×16 / 36-column rows retain human label preview + generation/position, role/status and bounded native thread paging. Pinned full-UUID input, inbox receipt explicitly not model acknowledgment, x→Enter non-confirmation, x→y drain, theme switches, old/new generation history, native renewal and UI f/r refusal remain exercised. Native inner surfaces intentionally retain main-chat semantic colors; only the surrounding panel is achromatic. These are ANSI/row emissions, not reconstructed screens, screenshots or human contrast/glyph acceptance.

Evidence: **`/tmp/native-thread-evidence/`**, including `focused-final.txt`, `npm-test-final.txt`, `typecheck.txt`, `exercise.txt`, package output, per-theme sanitized ANSI/cursor-separated rows/readable `*-sample.txt`, `terminal-observations.json`, and public API/source excerpts. Original runtime/Phase 2 evidence below is retained as history. Source/test SHA-256 (sorted `src/*.ts`, sorted `test/*.ts`, then `package.json` and `package-lock.json`): **`6e63209e2d6281dd31708a9b452605f3fea106cb742022e4f807486c046f54d1`**. No scheduler/permission/model/grant policy changes, new tool activation, dependency installation, current user-session reload, staging, commit, installation, push or publication was performed. Installed checkout remains clean at da0915e until coordinator acceptance/install; advisor remains excluded and isolation deferred/unimplemented.

## Selected-thread Hub layout — Phase 2

Source allocation `feat/integrated-fleet`, admitted clean HEAD **17213bc38e556656026a642601ccb7f57d282e5d** (accepted Phase 1). This is a scoped native TUI consumer redesign, not a new executor: a capped left roster/tree/history and dominant right **THREAD** replace the stacked metadata-first Hub. At 90 panel columns the left pane is 28 columns and the right reading pane 55; below 76 panel columns a selected-generation header replaces the roster. Thread/details/tools remain full readonly, independently scrollable from the roster window; history and controls still use exact UUID+generation. Details retain assignment/result/error, structured validation/value/artifact pointers, effective `snapshot.tools`, physical model/effort/full prewalk, presence/resources, ancestry, limits and direct-only telemetry. No backend, permission, profile, model, scheduler, artifact-store or Phase 1 source changed.

Focused RED first rejected the old stacked/default-inspector layout. An additional actual native-Input regression reproduced the inherited prefilled-filter cursor bug (`" betaalpha"` rather than `"alpha beta"` after cancelling an empty control); opening a saved filter now calls public `Input.handleInput` with native End after `setValue`, without private cursor access or a replacement editor. Existing stale/disposed/filter-drift/no-redirect assertions remain; new draining-during-input and already-draining refusal assertions cover steer/message/stop. Stop still requires x then y (Enter does not confirm) and awaits actual native disposal; only repeated UI actions on draining targets are refused, not native stop semantics.

Final focused `node --test test/hub.test.ts test/observability.test.ts test/widget-lifecycle.test.ts`: **17/17**. Four new tests cover two-pane adjacency/default thread and selected-row windowing, compact fallback, complete paginated role/thinking/tool-call/arguments/results/errors/final text, CJK/emoji, ANSI/OSC/bidi sanitation and reset/background restoration, stream append without reading-position drift, empty/queued/setup/terminal states, and prefilled-filter editing. Image MIME/omission text remains explicit; opaque provider signatures, tool-result details and image payloads are not exposed. Existing real SDK cases retain leased-writer drain/queued transcript barriers and historical structured outcomes/artifacts across actual renewal; only their deliberately changed default-view/tab expectations were adapted. New fixture setup corrections (missing import/message mock, exact omission wording, native cursor positioning) did not remove behavioral assertions. A new mock callback's implicit TypeScript parameter was explicitly typed after typecheck caught it.

Final **DEFAULT `npm test`: 122/122**, zero failed/skipped/cancelled, about **7 seconds**, versus Phase 1's 118. `npm run typecheck`, actual SDK `npm run exercise`, `npm pack --dry-run` (**17** files), and `git diff --check` pass; the index is empty. Installed UI guidance and public Pi 1.5.2 TUI material were read; the local impeccable launcher ran with download disabled, using incumbent native code plus the supplied scoped brief (not a new product/world). Its one scoped `detect --json src/hub.ts` returned `[]`; that static result is not terminal accessibility or human visual acceptance. No tooling/dependency installation, runner changes or generic verifier was introduced.

Actual offline Pi CLI PTYs reused `examples/controlled-fleet.ts`, with isolated temporary cwd/HOME/agent/provider/session/theme data, **ordinary default tools (no --tools override)**, and only the explicitly loaded source extensions. Dark, light and deliberately pink custom-theme runs each exited **0** via Ctrl+D/public shutdown; synthetic roots were cleaned. Emitted 100×30 terminal / 90-column overlay rows show left AGENTS/selected generation adjacent to the right THREAD and actual read payload. Live 40×16 terminal / 36-column overlay rows show the compact selected header and full-width reading, including page scrolling. The compact footer was reduced from three rows to two after the first actual resize inspection; with simultaneous filter/writer/stop notice the refreshed trace retains four reading rows, rather than three. Input target/accepted inbox receipt explicitly not model acknowledgment, x→Enter non-confirmation, x→y stopping/drained/cancelled, disposed control refusal, public dark↔light switches and native model-issued followup→park→revive were exercised. Old #1 remains separately readable beside #2/history; Hub f/r still allocate/dispatch nothing. Observed native AGENTS-row background segments are achromatic **55/55/55**, **229/229/229**, and custom **142/142/142**; underlying chat/gutter colors are not mistaken for panel interiors.

Evidence: **`/tmp/hub-split-evidence/`**, including focused RED/green, final full-suite/typecheck/exercise/pack logs, sanitized `.ansi`, cursor-separated `.rows.txt`, cropped readable `dark/light/fleet-tinted-sample.txt`, per-theme CLI results and `terminal-observations.json`. These are actual emitted fragments, **not reconstructed screens, screenshots, paid/live inference or human contrast/glyph acceptance**. Nested ancestry, held unabortable drain, structured artifacts and exact authority races are controlled SDK/component evidence, not separate PTY scenarios. The one-off external PTY adaptation is not a repository framework. Arbitrary custom-theme foreground contrast is not certified. Source/test SHA-256 (sorted `src/*.ts`, `test/*.ts`, then manifests): **`f61f871280a5bb39e6c9480c3a7747dc3021a913dfa9dbad9fb9dbb826282f84`**.

Data/control trace: native registry snapshots/detached messages + in-flight SDK projections → selected UUID+generation → two-pane/compact native width-wrapped render; pinned input → fresh snapshot/refusal → existing steer/root inbox/wait/park/stop → original SDK/parent dispatcher permission hooks → actual drain/disposal/leases/history. Full text is sanitized before native foreground styling; native reset restoration and opaque neutral row painting are retained. No authority bridge, replay, implicit parent prompt, cached executable, new grant store or background policy was added. Advisor remains excluded; isolation remains deferred/unimplemented. No staging/commit/install/push/publication, installed-checkout/configuration changes or user-session reload was performed. Delivery remains coordinator-owned.

### Reconciliation correction: short-height pinned controls

A coordinator probe found that at **90×8**, filtering on changing progress could fall back to live B while the footer dropped the full original A target but retained stop confirmation. This was a real visibility/safety defect, not a stale-target refusal. The correction treats the complete pinned UUID+generation and its two control rows as indivisible, yielding optional footer text first. If geometry cannot accommodate the target and meaningful controls, a resize/Escape placeholder replaces the actionable view. Submission requires that the pinned interaction has actually been rendered at the current height; a blocked attempt preserves the original target/input, Escape cancels, and resize restores that same interaction. No coordinator/backend authority changed.

Three new stop/steer/message regressions first reproduced the missing target at height 8, then passed with both A/B still live and progress-only filter drift. They verify full A identity at 90×8, no dispatch before the interaction is displayed, no dispatch at 20×4 or when height shrinks before redraw, small→90×27 restoration to A, cancellation/reset and a new B pin at 36×14. Two incumbent tests now explicitly render/assert their target before submission; all stale/disposed/draining/no-redirect and actual leased-writer drain assertions remain. The new fixture replaces readonly snapshots rather than assigning their fields, as caught by typecheck. Final focused **20/20**, typecheck and full DEFAULT **125/125** pass (zero failed/skipped/cancelled).

Fresh synthetic native-component rows and exact dispatch results are in `/tmp/hub-split-evidence/short-controls-probe.txt`: at 90×8, B is selected while **PINNED_A_FULLY_VISIBLE=true**; at 20×4, **STOP_TARGETS_WHILE_BLOCKED=[]**; after 90×27 resize, only A #7 is stopped. This is a component probe, not another PTY/provider/session run. Prior actual dark/light/tinted PTY evidence remains applicable to unchanged normal 90×27/36×14 layout and neutral painting: their existing footer budgets already fit the complete target/control block. No redundant three-theme rerun was performed. Fresh RED/focused/typecheck/default logs use the `short-controls-` prefix. Updated source/test digest: **`148e72853266caa0b8a5345ef63aa0ecac858c17244075ae29f457d9ca5ce193`**. All six Phase 2 paths are preserved; no staging, commit, installation or push was performed.

## Default parent tool loadout correction — Phase 1

Source allocation `feat/integrated-fleet`, admitted clean HEAD **021c5b0abd5779b463901047361183d7b73c5c3f**. This correction changes role tool lists from mandatory loadouts to admission ceilings intersected with live callable parent builtins. It does not activate tools, change parent settings, add fallback shell access or redesign the Hub. The installed checkout and other allocations were untouched; installation and any later UI redesign are not claimed by this evidence.

Actual RED: new `test/effective-tools.test.ts` used the ordinary SDK default loadout (no explicit builtin override), confirmed `read,bash,edit,write` active and `grep/find/ls` inactive, then requested two background scouts. Before the fix it failed with **`Parent tool grant unavailable: grep`**, with no children started. Public Pi 1.5.2 `ExtensionToolContext.tools` is the callable tool surface, not `pi.getAllTools()`'s registered-tool catalog; native normalized provider declarations live in system-message `toolsAdded`, not a `context.tools` property.

Current observations:

- Central `admit` narrows every input profile against live callable names, checks effective builtin provenance through a required originating `pi.getAllTools()` validator, then applies existing batch/model/ancestor/renewal/scheduler checks. Missing validators and empty effective builtin sets reject before any identity/setup/lease, including direct SDK callers and tasks with owned submission/coordination capabilities. `ChildSnapshot.tools` records admitted effective builtin rights. The callback is never serialized and is not a grant store, backend or arbitrary-JavaScript sandbox.
- The ordinary-default two-scout SDK case passes with **two actual root read hooks**, only `read` declared to each child, retained real read output and unchanged parent tool activation. Effective default implementation keeps `read,write,edit,bash` and a real writer lease; a read-only parent subset gives implementation only `read` and no writer lease. Invalid later empty intersections leave zero batch identities/setup. `taskFile` still requires genuine callable read and retains all lexical/canonical privacy tests.
- Native tests cover inactive replacements outside the effective set, callable replacement provenance denial, live deactivation/replacement while the first real read hook is held (no second forwarded hook or custom backend call), default nested read authority/root permission refusal, required direct-call validator, original-generation history and effective tool ceilings across direct and native root followup/park/revive after parent activation. Newly admitted identities may use newly available allowed tools; old identities cannot regain rights. Existing current-operator, ancestor, request, coordination/model/prewalk and generation-safety cases remain in the full suite.
- `test/cli.test.ts` adds an **actual isolated ordinary-default Pi CLI** invocation with no `--tools` override, synthetic cwd/HOME/agent/provider and explicit production extension. It observes exactly **two** scouts settling/disposal, `tools:["read"]`, two real root read hooks and actual transcript payloads; `grep/find/ls` stay inactive while default root `read,bash,edit,write` stay active. A short fixture `agent_end` observer awaits the registry's real disposal events before normal CLI shutdown; no production lifecycle is replaced. Exit is **0**, with temporary roots cleaned. The original print-exit/abort CLI protection remains unchanged.
- Focused effective-tools + CLI: **12/12**. Focused authority/coordination/failure cases also passed. Final full **DEFAULT `npm test`: 118/118**, zero failed/skipped/cancelled, approximately **6.8 seconds**: all 107 previous cases plus ten focused effective-tools cases and one default CLI case. `npm run typecheck` passes; `npm run exercise` reports PASS for actual SDK task/child/steer/reload-drain/abort-transcript lifecycle. `npm pack --dry-run` includes **17** declared files. `git diff --check`, empty-index and real nonsymlink local dependency checks pass. Existing local lockfile dependencies were reused; no manifest/dependency installation changes or runner-default changes.

Two existing fixtures were adapted to the approved semantics without removing their protections: the old “missing grep despite callable read” failure now checks an actually empty callable set plus the original unsupported-schema rejection; the descendant renewal test narrows current tools to `grep` instead of `[]`, retaining its assertion that read cannot return, exact ancestry, cumulative spawn budget and expired-parent refusal. Manual Hub snapshot fixtures only gained the required tools field; production `src/hub.ts` was not edited.

New fixture setup failures were corrected before final checks: provider declarations were initially looked up on the wrong native context shape; a root control was initially given a full snapshot instead of strict `{id,generation}`; and the CLI responder initially reissued its launch after receiving a background custom completion. The CLI responder now recognizes an already-issued `delegate_task` in its actual transcript. These were fixture corrections, not production fallback, relaxed assertions or test-retry acceptance. The full default suite was run once after the focused corrections and passed.

Manual trace: role/operator/project/request ceiling → live public callable builtin intersection → public provenance check → captured effective profile and actual mutating-subset writer classification → whole-batch/ancestor/renewal admission → scoped real SDK tool declarations → per-invocation live callability/provenance check → original root `ctx.executeTool` validation/permissions → native drain/settlement/history. No cached raw tool executor, auto-activation, read-only bash fallback, implicit spawn/coordination grant, extra model inference or second execution registry was introduced. One scoped least-code pass reused this registry/profile/context boundary. Advisor remains excluded; isolation remains deferred/unimplemented, neither a current release gate.

Evidence: **`/tmp/effective-tools-evidence/`** contains RED, focused/default CLI, full default test, typecheck, exercise and package output. Source/test SHA-256 (sorted `src/*.ts`, `test/*.ts`, then `package.json`, `package-lock.json`): **`5def5b0b8389b7a63c72e852a80dadf5403ecbdaf67b43e7adc06ad2b3bace19`**. Documentation-only evidence updates do not change that digest. These are controlled-provider real SDK/tool/filesystem/CLI checks, not paid/live model reasoning, new PTY/visual acceptance or installation evidence. No staging, commits, push/publication, credentials/global settings changes, active user-session reload or other-worktree edits were performed.

## Joined fleet consumer — current local integration evidence

Canonical workspace `feat/integrated-fleet`, admitted clean runtime HEAD **f704e5acf7970883c05151710b5ae790e1d2f3be**. Full UI source was read from immutable **08eb183288941cbde1e33d9e7eee7d42aee1bc19**, diffed against common core **5211269** and joined as a consumer of the current scheduler/outcomes/coordination/advanced runtime. The old UI coordinator/extension were **not** substituted wholesale. Only this allocation was written; no staging, commits, publication, installed-checkout changes, new workers or workspace were made. This local integration is not installed/full parity/human acceptance. Production isolation and retained advisor remain **UNIMPLEMENTED** as in the capability ledger; native draft stack graph reconciliation/publication remains blocked and coordinator-owned.

Current observed checks on the joined source:

- `npm ci --ignore-scripts`: **125** actual worktree-local packages, audit **0** vulnerabilities, `node_modules` a real directory (not a symlink); manifests/lockfile unchanged.
- Focused `node --test test/hub.test.ts test/observability.test.ts`: **12/12**. Native observability cases: actual held parent write-hook → Hub exact-target x/y → draining lease retained with next writer queued/no transcript → hook release/disposal → next writer; selected finalized structured outcome/value/artifact and detached messages stay immutable across real SDK renewal; f/r UI refusal allocates/dispatches nothing; actual two running SDK readers → pending m input pinned → selected target draining/filter fallback → refusal, never redirecting to second UUID, with default-off child inbox authority preserved. Deterministic presentation races separately cover steering/message/stop with stale generations and filter drift; they are not misrepresented as native race tests.
- Existing scheduler-lifecycle tests gained actual ancestry→card and disposed-subtree→fleet/epoch assertions; focused suite **7/7**. Existing grants, permission hooks, exact models/prewalk, ordered batches, task-file canonical target denial, native followup/revive/current narrowed authority, shutdown and all unique current safety protections remain in the default suite. The UI fork's source-named Hub/transcript/card/neutral-surface protections are retained against the union.
- Final full **DEFAULT `npm test`: 107/107**, **0** failed/skipped/cancelled, about **6.7 seconds**. `npm run typecheck` passes; `npm run exercise` prints PASS for actual model-task→SDK child/streaming/steer/reload drain/persistent abort transcript. `npm pack --dry-run` includes **17** declared source/docs/manifest files, no tests/dependencies/host data. `git diff --check` and empty-index checks pass. An earlier complete joined run also passed 107/107; the final run refreshed evidence after a one-line transcript metadata sanitizer strengthening and its regression, not an until-green loop.

Native interactive evidence: a one-off Python standard-library PTY invocation of this worktree's actual Pi CLI and `examples/controlled-fleet.ts`, with dedicated synthetic cwd/HOME/agent/themes/sessions and controlled offline provider. **Dark, light and deliberately pink custom-theme runs all exited 0 through Ctrl+D/public shutdown**. Each emitted real fleet/cards/Hub inspector/transcript/tools, filter input and detail scrolling, pinned input target, explicit x/y stop with “Stopping and draining…” before “Stopped and drained”, 100×30→40×16 resize, dark↔light public theme changes, and explicit parent-model `delegate_coordinate` followup→park→revive with observed generations 2/3 and controlled revived outcome. Hub itself never starts renewal. Synthetic task roots were cleaned after lifecycle shutdown. Captured Hub neutral RGB surfaces were dark **55/55/55**, light **229/229/229**, tinted **142/142/142**; ordinary host cards outside the Hub still use their native semantic colors. Component tests separately assert full-row painting/background restoration at reset/truncation and tiny widths. These are **ANSI/row emissions, not screenshots, reconstructed terminal screens or human contrast/glyph acceptance**. Nested ancestry, held unabortable drain and structured values are stronger controlled SDK assertions, not claimed as separate nested/structured PTY scenarios.

Retained sanitized evidence: **`/tmp/integrated-fleet-evidence/`**, including `npm-test-final.txt`, `typecheck-final.txt`, `exercise-final.txt`, `pack-final.txt`, `hub-final.txt`, `scheduling.txt`, `dark/light/fleet-tinted.ansi`, matching `.rows.txt`/`.json`, and `terminal-observations.json`. The one-off external `terminal-exercise.py` is reproducibility evidence, not a repository runner/framework. Captures substitute synthetic-root/check-out/user paths and contain only the explicitly controlled synthetic scenario, not credentials or retained user sessions. The initial Python filename `pty.py` shadowed stdlib and failed before launching a CLI; renaming it corrected that setup error, with no product change.

Diagnostic history: initial imported observability streamed 600-line results with one-token timed chunks and timed out under the new FIFO capacity; the fixture uses the existing native controlled provider's speed=0/1024-token chunks while retaining exact line599/full-output assertions. Initial typecheck identified missing new snapshot fields in old UI fixture records and two untyped mock callback parameters, all corrected. Held-writer test wrapper timeouts were traced to a **fixture** warmup user-content string comparison (native content is text-block arrays), entering its own gate before cleanup. It now normalizes native text, gates only designated `writer.txt`, encloses gate-owning work in `finally`, and selects/asserts the exact ChildRef by UUID filter rather than fragile warmup navigation. Focused native tests then pass; no runtime cancellation/lease relaxation, serial runner default, retry-until-lucky, assertion weakening or new diagnostic framework was introduced. No owned timed-out test processes remained at reassessment.

Manual authority trace: Hub selected UUID+generation → original pinned input/confirmation → existing coordinator `steer`, root `message`, `coordinateWait`, `park`, or subtree `stop` validation → original native public SDK/root `ctx.executeTool` permission/validation path → actual prompt/tool/descendant drain → disposal/epoch/lease projection → registry-driven widget/cards/Hub. Historical messages are detached before releasing SDK graphs and remain keyed to immutable old-generation snapshots. Native model-issued renewal still re-resolves current authority/auth/model/effort and exact original active parent generation; no slash-command dispatcher, raw builtin bypass, implicit model prompt, new grants, parallel execution registry/artifact store, historical replay or private host API was introduced. Root/operator message acceptance is not model acknowledgment; copied previews are labeled and full output remains in readonly registry transcript/result views and exclusive artifacts.

One cumulative scoped least-code pass reused the existing registry/history record, SDK messages, native components and context boundaries; removed the overwritten latest-only UI path, retained only in-flight message/tool view projections, and avoided any generic control broker or persistence layer. Direct Hub followup/revive was explicitly parked with coordinator approval because public `ExtensionCommandContext` lacks `tools/executeTool`; native model-tool renewal remains supported. This is the only affected capability parked by the JOIN, not a loss of native renewal. Evidence uses no paid/live inference, credentials/global configuration/account changes, OMP runtime/prompt copies or pi-subagents API support.

Source/test digest: **`29f41370bc2041f5ca24d9a35fdcad27a00dc56c2dd708301e801be9c324b134`**, computed with `cat $(printf '%s\n' src/*.ts test/*.ts | LC_ALL=C sort) package.json package-lock.json | shasum -a 256`. This digest excludes example/docs; final documentation-only evidence updates do not change it. Coordinator normal source/evidence reconciliation owns acceptance, not an invented additional independent-review gate. Write ownership is relinquished at the final handoff.

## Slice 7 exact policies, prewalk and bounded capability evidence

Workspace `feat/advanced-policies`, clean admitted base **57e06cf2ce6544d5f1182a7b91011468b62c5e23**, public Pi **1.5.2**. Implemented and parked boundaries are authoritative in the [advanced policy ledger](advanced-policies.md). No installed/core/UI/scheduler/outcomes/coordination/isolation allocation was edited. No staging, commit, push, PR, stack/publication change, live inference, provider-account/credential/config change or historical-data scan occurred.

`test/model-policy.test.ts` adds **13 actual SDK tests**:

- An operator-granted exact alternative physical provider/model receives the actual `high` reasoning option and its parent-registry in-memory key; snapshots name that model/effort, one direct request is recorded, and the key is absent from disk transcript evidence. Existing default adapter key/header/no-secret-artifact regressions remain meaningful.
- Missing grants, granted unknown models, unsupported effort, parent model/effort scope pins and unknown/nonpositive finite context/output limits deny without fallback. A later invalid batch selection **or prewalk target** creates zero new identities/setup, even with an earlier valid task. Trusted project and request allowlists cannot mint model/effort grants; a request-narrowed ancestor denies an otherwise operator-granted child alternative. A positive actual nested child inherits its immediate parent's alternative model/effort rather than the root selection.
- Current operator revocation during a real permission hook prevents the next provider dispatch; direct count remains one. Source→target prewalk happens in the same actual session after a completed permitted builtin write at awaited public `turn_end`; source and target transcript usage sums equal final direct token/cost counters exactly once. A real held write cancellation keeps the writer lease/permit through drain and never consumes the target response. Removing prewalk during the write hook prevents handoff even when the alternative model grant remains.
- Fresh-generation renewal retains the consumed target/effort with no rearm and one new direct request, while old snapshots/artifacts stay independent; removed current grants deny renewal. An explicit task-item exact model suppresses inherited role prewalk (including an unavailable dormant role default/target), reports `suppressed-exact`, remains exact across renewal, and cannot fall back when revoked. This aligns with pinned OMP `task/executor.ts` and `executor-exact-model.test.ts`, confirmed with the coordinator before the adjustment. An identical role target is an observable `no-op`, with no planning nudge or extra dispatch.

`test/advanced-capabilities.test.ts` adds **2 bounded real public SDK counterexamples**: exact synthetic extension-file loading executes with ambient project discovery disabled, and its Node write proves this is trusted executable code, not model-tool isolation; a second ordinary prompt during a held active session rejects with no extra dispatch, and there is no public `runEphemeralTurn` method. No real MCP server, worker pool, cloud backend, old session or provider account was touched. Advisor retained-delta/cadence/advice semantics were traced to the pinned runtime/session sources; public sessions/events are building blocks, but the retained-observer grant/capacity/lifetime contract is not established here. The coordinator explicitly parked the proposed boundary-only review substitute pending owner choice. Missing a method named advisor alone is not claimed as impossibility. Other investigations and precise resume boundaries are in the ledger.

Local lockfile install: `npm ci --ignore-scripts` installed **125** worktree-local packages, audit **0** vulnerabilities; `node_modules` is a real directory, no symlink and no dependency/lockfile changes. Focused final `node --test test/model-policy.test.ts test/advanced-capabilities.test.ts`: **15/15** pass. Final full **DEFAULT `npm test`: 97/97**, zero failed/skipped/cancelled, approximately **6.1 seconds**, including the actual isolated Pi CLI exit regression and every original safety fixture. `npm run typecheck` passes. `npm run exercise` prints **PASS** for actual SDK parent/tool/child/steering/reload/abort-transcript lifecycle. `npm pack --dry-run` includes **17** declared source/docs/manifest files and no tests/dependencies/host data. `git diff --check` and empty-index checks pass. Final source/test digest (`cat src/*.ts test/*.ts package.json package-lock.json | shasum -a 256`): **e1595adc1b03bf88e9810827792e72d216b719067a636515501f2526b2829682**. Later documentation-only evidence updates do not change it.

Diagnostic history is not hidden: the first expanded full run was **88/89**, solely because an existing coordination assertion expected known missing auth to allocate a failed successor. New required synchronous model/auth preflight denies before identity allocation instead. That test was strengthened to assert a tool error, zero successor events/setup/dispatch, while keeping concurrent-revive generation-race assertions. Subsequent integrated DEFAULT checks passed **93/93** and, after additional targeted reference/edge-case protection, **97/97**. Early new-test/typecheck failures were actual fixture syntax/type corrections (native faux model list and result narrowing), not relaxed production safety, serialization, skips or timeout changes. No retry-until-green or new verifier framework was used.

Manual trace: exact operator profile grants → trusted project/request narrowing → whole-batch selection/target and ancestry preflight → captured source/effort/cwd/public registry → deny-ambient owned inline hooks → current per-turn policy and per-dispatch model/auth/scope/effort checks → one direct request count → genuine root permission/tool path → awaited turn-boundary handoff or exact suppression → native usage/results/exclusive artifacts → current-policy fresh-generation renewal with admitted ceilings/no rearm → cancel/limit/descendant drain → writer/permit release and shutdown. No model/tool history replay or extra observer inference is introduced.

One cumulative least-code/scope pass reused the existing registry, native resource-loader inline factory, shared profile intersection, public model adapter and SDK turn boundary. It consolidated current-policy revalidation, reused exact selection equality, caught immediate-parent default inheritance and handoff-time revocation gaps, and kept model policy in one small module. No parallel executor/persistence/observer service, provider router, shell interception, worker queue, compatibility layer or copied prompt machinery was added. Minimal base UI text exposes actual model/effort/prewalk and advisor unavailability only; the independent full UI and production isolation remain separate owner-controlled work.

Evidence is controlled-provider **actual SDK/runtime/tool/filesystem/CLI** behavior, not live model reasoning, network/OAuth/cache/external billing reliability, OS sandboxing, provider-internal request precision, retained-history consultation or fresh interactive visual acceptance. Advisor implementation acceptance remains parked, not satisfied by ordinary review delegation. Coordinator review/reconciliation remains required; this worker relinquishes write ownership at handoff and performed no publication.

## Slice 5 live-parent coordination evidence

Workspace `feat/agent-coordination`, immutable parent **aa07c967b8eaa4ac992331e8a2832bdd65f96d96**, public Pi **1.5.2**. Only this worktree changed; no UI #4 dependency/copy, installed allocation changes, staging, commits or publication. Native SDK/session/extensions/tool documentation, public declarations and SDK examples were read; the pinned inventory's G/L messaging/wait/parking references were reconciled, including read-only upstream `peer-message-after-report.test.ts` and `parked-subagent-session-release.test.ts` at `eda28eff97cf7a352fd3057a03581be1686dbc7a`. No OMP runtime, prompts, tests or compatibility API were copied.

`test/coordination.test.ts` adds **12 native tests** using actual parent/child SDK sessions, model-issued tools, public dispatch/hooks, transcript/filesystem storage and controlled provider outputs:

- Root→child inbox/wait reaches actual recipient tool/model-visible output; child→root messages expose the closure-authenticated UUID/generation. Default-off tools, spoofed sender fields, missing/stale identities, foreign family targets and foreign receipts reject. Operator/project/request/ancestor action narrowing cannot mint authority. A real grandchild cannot wait on its ancestor or message an unrelated family.
- Actual public steer/followUp are held behind a real parent read-hook barrier: receipts say queued before release, then the actual recipient model sees the prefixed message and its JSONL contains it. Delivery receipts use SDK user-message observation, not a guessed acknowledgment. Tool/inbox delivery is distinct from assignment success.
- Native event/promise waits cover timeout, abort, shutdown, terminal outcome, a 64-waiter bound, self/cycle/queued-capacity refusal, and stop of a real running waiter while its sibling remains active. Input byte/mailbox/512-message retention limits run against a held actual SDK recipient, without a substitute protocol simulator.
- Real idle follow-up→park→revive increments one stable UUID through fresh generations/direct telemetry, new session/artifact paths and fresh schema submission. Previous transcript/text/structured evidence and detached snapshots remain unchanged. Missing new submission fails rather than reusing a valid old value. Reduced current tools/coordination grants disappear; stale stop/message/revive cannot act on the successor. Concurrent real root revive calls admit only one generation. A controlled denial of public `ModelRegistry.hasConfiguredAuth` fails new-generation setup without model dispatch; it is not a live credential/auth-server test.
- Descendant renewal preserves **exact parentId+parentGeneration**, with that original parent still active behind a real root read hook. Unavailable immediate capacity and current revoked ancestor spawn authority reject before generation mutation; reduced current ancestor tools are not regained. Successful renewal consumes the parent's remaining cumulative spawn budget. Parent completion closes descendant presence; expired-owner renewal/parking rejects rather than reparenting. This explicit active-original-ancestor boundary follows coordinator direction, not an invented SDK limitation.
- Reload with a real child blocked in its inbox wait cancels/drains/disposes it, clears old parked presence and produces no old-runtime final message. Existing CLI shutdown, held-tool/auth/writer ownership, descendant drain, schema/artifact/task-file and widget/reload tests remain meaningful.

The first integrated default suite passed **78/78** before the additional bounds/ancestry/reload cases. Final full DEFAULT `npm test` passed **82/82**, zero failed/skipped/cancelled, approximately **8.3 seconds**, including the real isolated Pi CLI lifecycle regression and all original 70 safety cases. Focused `node --test test/coordination.test.ts` passed **12/12**; `node --test test/coordination.test.ts test/hub.test.ts test/widget-lifecycle.test.ts` passed **15/15** before the last family-only case was added. No serial runner defaults, skipped tests, paid inference or until-green broad rerun loop. Early focused failures identified test callers passing full snapshots where strict ChildRef input was required, the fixture's last-tool response masking queued-message visibility, and an unavailable guessed runtime unregister method; tests now use exact refs, actual received model context and the public auth-denial seam. These were not waived passes or production timing workarounds.

`npm ci --ignore-scripts` installed **125 worktree-local packages**, audit 0 vulnerabilities; `node_modules` is a real directory, no symlink. No dependency/lockfile changes. `npm run typecheck` passes; `npm run exercise` prints PASS for actual SDK model-tool→child/steer/reload/abort transcript lifecycle; `npm pack --dry-run` contains **15** declared source/docs/manifest files, not tests/dependencies/host data. Diff whitespace and empty-index checks pass. After the scoped resource-reference release and receipt wake/generation-pinning corrections, focused coordination remains **12/12** and the refreshed full DEFAULT suite passes **82/82** (zero failed/skipped/cancelled, approximately **6.1 seconds**). Typecheck, exercise, package dry-run and diff/index checks were refreshed successfully on that source. Inbox consumption directly wakes pending receipt waiters without relying on a later SDK event; an undelivered old-generation inbox/receipt never enters or counts against a fresh successor. Final source/test digest (`cat src/*.ts test/*.ts package.json package-lock.json | shasum -a 256`): **4a5c92e30ba454a3693881f2344637a855d790a9e75cb09b7cca981fa87a4445**. Later documentation-only evidence updates do not change this digest.

Manual instruction trace: operator/project/request profile actions and spawn/limits → root or captured child actor → exact current target/family/receipt validation → bounded mailbox or public SDK steer/followUp → event-driven wait/timeout/cancellation → current profile/policy/ancestor/model/auth revalidation on renewal → atomic fresh-generation admission → fresh tools/submission/budgets/artifacts → actual prompt/tool/descendant drain → disposal, presence close and shutdown. Root snapshots/history remain distinct from active presence; direct usage is per generation, never parent-plus-subtree billing.

One cumulative least-code pass reused the existing registry/admission/scheduler/public model adapter and native SDK sessions instead of introducing a broker, executor or recovery service. Shared profile-grant intersection and destructive inbox consumption removed duplicated logic. Completed generation history contains detached snapshots only; disposal drops its SDK session/subscription reference. Latest widget/Hub text adds only presence/generation; full independent UI #4 remains excluded. Its eventual roster/tree/transcript/cards must join queued/draining ancestry with idle/parked presence, immutable generation history and bounded messaging/waits, preserve pinned controls and sum each direct generation once.

Supported limits: reassignment is explicit new prompt/session, not warm conversation reuse, automatic idle TTL or cross-process recovery. Provide relevant prior conclusions explicitly; old tool actions/history are never replayed or consulted. Park only accepts disposed idle presence; active work must be stopped explicitly (stopped identities are not revivable). Child pending root-receipt waits reject to avoid a foreground-parent dependency deadlock. No cross-parent broker/RPC, filesystem isolation, manual-shell coordination, durable migration, full UI join, paid/live model/provider/OAuth/network reliability, exhaustive GC/terminal/media proof or restart recovery is claimed. Controlled tests exercise real host/runtime effects, not model reasoning or external billing. Coordinator normal source/evidence reconciliation remains pending; no additional independent-review gate was introduced.

## Slice 4 structured outcomes and checked inputs

Local workspace `feat/structured-outcomes`, scheduler checkpoint **4fb5ee593006ddad353f8733aa178e2b0e4532fc**, public Pi **1.5.2**. No installed/core/UI/scheduler allocation was edited; independent UI #4 is neither copied nor made a prerequisite. Publication remains coordinator-owned and parked on the prerequisite/stack-graph policy in the assignment.

Observed on this source:

- `test/outcomes.test.ts` exercises actual model-issued child `submit_result` through native SDK custom tools, strict native value validation (a numeric string fails), actionable correction, duplicate rejection, first-valid immutable acceptance, missing/invalid outcomes, provider failure after acceptance, and normal hard request/tool cancellation. Accepted state is explicitly provisional before drain. Root ordered batch and authorized nested schema outcomes retain independent identities, transcripts and direct dispatch counts without parent `usage` charges.
- Held actual root parent read permission work and held descendant read work prove submission cannot cause early success/disposal. Subtree stop retains ownership until the real hook returns, disposes the descendant before the parent, and preserves cancellation despite submitted data. Replaying `submit_result` on the parent after disposal fails because the capability is child-local, not an addressable result/control API. Existing stale-generation/startup/reload/shutdown protections remain meaningful in the full suite; no direct stale-target submission API was added.
- Large final plain text (over 50KB, including Unicode/newlines) and large structured values have bounded explicitly truncated previews with artifact references. Actual filesystem artifacts reproduce full untrimmed last-assistant text and exact JSON values. A useful first failing assertion exposed Pi's existing final-text-helper trimming; registry `result` was preserved while artifacts use raw completed text blocks. Exclusive publication rejects duplicate/escaping names without replacing the original. An actual child builtin write colliding with `result.txt` makes final persistence fail visibly, retains original data/final text and publishes no false text-artifact reference.
- Task files flow as literal instructions through actual effective parent builtin read hooks. Empty, missing, denied, native line-truncated, non-file, invalid-encoding, absolute/traversing/hidden and escaping-symlink inputs reject; an invalid later file/schema leaves zero new child events/directories. A nested file cannot regain the root read grant. Metadata/path checks use Node but never raw file content reads. Permission-checked input reads are awaited sequentially, including on failure; executable nested reads consume the ancestor tool budget, not a new transport or grant.

Initial Slice 4 checks (before the focused fixture repair below): worktree-local `npm ci --ignore-scripts` installed **125** packages (audit 0 vulnerabilities), no symlink dependencies. Authoritative registry lookup `npm view @earendil-works/pi-schema@1.5.2 version dist.integrity` confirmed the already-transitive pinned native validator; only its direct runtime declaration and lockfile dev classification changed, no versions/churn. `npm run typecheck` passes. The earlier full suite with native resource control, `node --test --test-concurrency=1 test/*.test.ts`, passes **68/68** (0 failed/skipped/cancelled, about 42 seconds), including all existing scheduler/core tests and the actual isolated Pi CLI test. Earlier integrated default runs passed 50/50 and 67/67; later default-parallel `npm test` runs failed 1/68 then 2/68 in existing timing-sensitive lifecycle fixtures (100ms deadline/write-entry assumption, foreground-abort startup wait, and widget expecting running immediately after background setup acknowledgment). These failures remain visible, not waived or repaired outside this allocation. Host load averages reached approximately 44/45/30; serial full-suite success distinguishes a healthy bounded validation mode but does not establish reliable default-parallel acceptance. The two large-output cases now use the native controlled provider's 1024-token chunk option through the existing fixture (default 1-token chunks unchanged for all other tests), preserving exact full-value assertions while reducing needless tiny-delta CPU/observer churn. `npm run exercise` reports PASS; `npm pack --dry-run` includes **15** declared source/docs/manifest files, not tests/dependencies/host data; `git diff --check` passes; no files staged/committed/pushed. Pre-repair source digest, computed by `cat src/*.ts test/outcomes.test.ts test/fixtures.ts package.json package-lock.json | shasum -a 256`: **adbf70255d37218912b7a20c4cbe9cf35a8c3541a5e2dc953eb9634a4171552a**.

Manual source trace: optional inline/file/schema input → awaited public read/profile preflight → whole-batch registry schema/grant/limit validation → ordered admission → public model adapter and grant-scoped builtin dispatcher/local submission tool → native strict submission acceptance → prompt/tool/descendant drain → exclusive artifacts → terminal snapshot/disposal/delivery. Stop/limit/shutdown intent always precedes final status selection, including during asynchronous artifact publication. One cumulative simplification pass kept the single registry/tool limiter, native validator and fixed artifact names; removed duplicate schema compilation from the root tool and avoided parallel preflight reads that could outlive a rejected call. No separate executor, copied value validator, reusable artifact/verification framework or UI bridge was introduced.

Evidence limits: these are controlled-provider **real SDK/runtime/tool/filesystem/CLI** checks, not paid/live inference, credentials/OAuth/network reliability, fresh interactive UI/media or billing proof. Public read metadata checks cannot atomically exclude malicious concurrent filesystem swaps; trusted permission/result hooks may transform reads. No OS sandbox, fsync/crash durability, external-process write isolation, historical migration, recovery, peer messaging or full UI join is claimed. Artifacts are sensitive like transcripts and never uploaded/logged externally. Schema support is deliberately finite/no-ref/no-regex; unsupported schema features reject, not silently downgrade. Coordinator source/evidence reconciliation owns acceptance and any eligible publication; no additional independent-review gate is imposed.

### Focused default-run lifecycle fixture repair (initial repair; remaining failure resolved below)

The two named failures from the default-parallel **66/68** run were investigated against actual Pi 1.5.2 SDK/provider lifecycle behavior, not treated as waived by the earlier serial pass:

- **Foreground abort startup timeout (`test/failures.test.ts`):** the test put 4200 characters of assignment text into the _parent's streamed tool-call arguments_, on the same controlled provider capped at 300 tokens/s. Native faux `splitStringByTokenSize` makes four-character chunks for `tokenSize:1`; `scheduleChunk` awaits a timer for every chunk, then parses accumulated tool arguments. Only after that entire parent tool call completes can child admission/startup begin. The test nevertheless started a five-second `eventually(running)` clock before calling the parent prompt. A pre-repair isolated run passed in **4.78 seconds**, demonstrating its very small margin even without full-suite contention; the observed full-run failure was **5.15 seconds** at that startup assertion, not an orphan/disposal assertion. The repair keeps the parent payload small and moves long slow output to the child. It waits for an actual child SDK **text_delta**, asserts the child is still running/not disposed, then aborts the foreground parent and verifies exactly-once child cancellation/disposal and its persisted aborted assistant message. The prompt is raced against premature completion, and `finally` always aborts/awaits it, including on an assertion failure. A finite 15-second test-runner guard covers missing-event failures; there is no production delay/timeout or arbitrary startup sleep.
- **Widget setup versus running (`test/widget-lifecycle.test.ts`):** the failed assertion rendered `setup / Preparing SDK child` immediately after a background parent prompt returned. Production intentionally returns `admit(...)` snapshots without awaiting SDK setup; a background acknowledgment is not a running acknowledgment. The test now observes actual registry SDK **agent_start and text_delta** events and compares render counters at those events, instead of assuming running or sleeping 300ms. It retains stop/cancelled-widget assertions, reload replacement and dark/light/tinted palette checks. It then streams a second actual child, verifies the detached old widget remains pinned to its cancelled task, and reloads with that second child active, asserting real cancellation/disposal before replacement and no new inference or SDK extension errors. This replaces the former 100ms negative-observation sleep with an actual replacement activity/drain scenario.
- **Stale context/unhandled activity after the widget assertion failed:** its old teardown called bare SDK `dispose()` without emitting extension shutdown/draining the owned background child. SDK `dispose()` immediately invalidates the extension runner and does not await the extension's coordinator. The still-live child could later complete the background delivery closure using that invalidated runner, matching the observed stale-context unhandled rejection; storage cleanup also did not await child drain. Correct host lifecycle is already documented and implemented by production shutdown/reload. Test teardown now always awaits parent abort and public `session_shutdown` dispatch before SDK disposal and temporary-root/environment cleanup. No production lifetime relaxation or suppression of the stale-context error was added; successful test execution captures and asserts an empty SDK extension-error list.

Focused actual SDK tests: `node --test test/failures.test.ts test/widget-lifecycle.test.ts` **5/5 pass** after repair; `npm run typecheck` passes. The full **default** `npm test` was then run **once**, with **67/68 passing in about 16 seconds**: both repaired tests passed (about 524ms and 1457ms), all outcome/schema/file/artifact tests passed, and no stale-context/unhandled-activity warning occurred. The sole remaining failure is the earlier `test/scheduling-lifecycle.test.ts:38` expectation that the first writer is not disposed, in its existing 100ms-deadline/shared-write-entry-latch fixture. Its predicate can conflate the second writer's entry with the first writer's draining state, but this repair did not capture that run's actual event timeline and therefore does **not** claim a proven fixture-only cause or default acceptance. That boundary is **parked for coordinator reconciliation**, without scheduler source/test edits, assertion weakening, serialization defaults or repeated broad-suite attempts. Earlier serial 68/68 remains separate historical evidence, not a substitute.

After the final default run: `npm run typecheck`, `npm run exercise` (PASS), `npm pack --dry-run` (15 declared files), `git diff --check` and empty-index checks pass. No dependencies, runner defaults or production source changed in this focused repair. Source/test digest at that repair, computed by `cat src/*.ts test/*.ts package.json package-lock.json | shasum -a 256`: **4557ac8a7e1091373c404dce18c8324290b54f9251a37bcded37d7af227080df**. Coordinator source/evidence reconciliation owns acceptance; no additional independent-review gate is required. No staging, commits, publication, live inference or changes to completed sibling allocations occurred.

### Remaining scheduler-lifecycle barrier repair and final default acceptance evidence

One bounded diagnostic reproduced the exact old `first.disposed === false` assertion failure using actual SDK children, public auth/permission hooks and per-UUID registry snapshots. The diagnostic deliberately held the first public auth preflight until its 100ms admission deadline; it did not replace the coordinator or simulate registry/tool execution. Recorded real elapsed sequence (milliseconds from fixture start):

| Time    | Actual identity/path                        | Observed event                                                              |
| ------- | ------------------------------------------- | --------------------------------------------------------------------------- |
| 125     | first `b56a64e8…` and second `a5b08c19…`    | admitted queued; first enters setup with writer lease                       |
| 132     | first                                       | public auth preflight held                                                  |
| 225–226 | first                                       | deadline reason then draining, not disposed, lease still held               |
| 239–240 | first                                       | cancelled then disposed, lease released                                     |
| 240–258 | second                                      | setup then running, lease acquired only after first disposal                |
| 285     | `second.txt`, public nested call `tool:…/1` | only write permission-hook entry; old unscoped `entered` latch becomes true |

At that point the old predicate combined **second writer's** hook entry with a historical `first.draining` event, then read the first writer's now-disposed latest snapshot. The original assertion failed exactly as reported. This is a controlled causal reproduction of the fixture bug, **not a recovered event trace from the earlier failed default run**. It demonstrates why that assertion could fail despite correct ownership ordering and why host load alone was insufficient diagnosis. The temporary diagnostic instrumentation was removed after this one useful negative run; no generalized verifier was retained.

The corrected `test/scheduling-lifecycle.test.ts` pins the held permission call to `first.txt`, captures its current **first UUID** and actual public nested tool-call ID, and acknowledges that exact hook before cancellation. It then initiates `/task-stop` without awaiting completion, waits for actual first-child draining, asserts the original writer lease/undisposed state and second queued state, and proves stop has not acknowledged completion. Operator concurrency 1 makes the capacity boundary explicit. Only releasing the real permission gate allows first disposal, second write-hook entry and second disposal, in that asserted order. `finally` releases the gate and awaits any control call, retaining cleanup on assertion failure.

To preserve the former active-tool **deadline** safety coverage without replacing it with real-time startup luck, the same assertions run in a second case with Node's native `TestContext.mock.timers` advancing the real admission deadline **only after the designated first hook is entered**. Native controlled provider `speed:0` streams through microtasks, not hidden timer advancement; SDK/session/tool/filesystem work remains real. This controls test clock scheduling, not production cancellation logic. Existing real-clock deadline-during-auth and per-task deadline tests remain unchanged and green. No production timeout/delay, runner serialization, dependency, skipped case or weakened ownership assertion was added.

After correction: focused `node --test test/scheduling-lifecycle.test.ts` **7/7 pass**. Then the full **DEFAULT `npm test` ran once and passed 69/69**, 0 failed/skipped/cancelled, approximately **12.5 seconds**. Both prior lifecycle repairs, all outcome/schema/task-file/artifact tests, scheduler/grant/lifetime tests and actual isolated CLI checks remain green. This final default result supersedes the earlier parked 67/68 result; serial evidence is not used to close it. `npm run typecheck`, `npm run exercise` (PASS), `npm pack --dry-run` (15 declared files), `git diff --check`, and empty-index checks pass. No default-suite retry-until-green loop was used.

Source/test digest after the scheduler repair (`cat src/*.ts test/*.ts package.json package-lock.json | shasum -a 256`): **d9c2d139bc3bd8fcbec4c8d0e0191abb6469e498c9c701840d3185911019a389**. This final repair changes only the named scheduler-lifecycle test in this allocation and this evidence document; production source and completed sibling allocations are untouched. Coordinator source/evidence reconciliation owns acceptance; no additional independent-review gate is imposed. No staging, commits, publication, live inference or historical-data mutation occurred.

### Resolved task-file target policy correction

Coordinator reconciliation identified a genuine privacy/policy gap: caller spelling rejected hidden/`node_modules` components, but an ordinary-looking in-workspace symlink to such a target could pass containment and reach the content dispatcher. A new real-filesystem/SDK regression failed before the fix because `tasks/alias--env.txt` was accepted, confirming that the advertised policy was not merely lexical. All private target text in these tests is newly created fixture data, never actual credentials or installed dependencies.

`readTaskInput` now applies one shared denied-component predicate to both the caller path and the canonical workspace-relative target, **before metadata/content dispatch and before nested read-budget charging**. The genuine parent read dispatcher/permission hooks remain the only content reader. Ordinary nonescaping aliases to allowed files remain supported and are tested alongside the original literal-file/hook behavior. Existing before/after metadata checks and the documented hostile-concurrent-swap limitation remain unchanged; this is not atomic filesystem isolation or a sandbox.

The added regressions cover nonhidden aliases to an in-workspace hidden file, hidden directory and `node_modules` file, both single and later-invalid batch input. Every denied case asserts a tool error, **zero read-content permission-hook calls, zero new child events/setup and no delegation directory**. Focused `node --test test/outcomes.test.ts` passes **19/19**. After this source correction the full **DEFAULT `npm test` ran once and passed 70/70** (zero failed/skipped/cancelled, about **10.9 seconds**), including the previously repaired lifecycle cases. `npm run typecheck`, `npm run exercise` (PASS), `npm pack --dry-run` (15 declared files), `git diff --check` and empty-index checks also pass; exercise/package evidence was refreshed rather than assumed applicable. No dependency, path framework, runner-default or other production-boundary change was added.

Current source/test digest (`cat src/*.ts test/*.ts package.json package-lock.json | shasum -a 256`): **127d159fa527b3537d5b38b88e8e4e91dda0f1dfbe755c45af1dde36ceb67cf9**. Current policy/results supersede the earlier main-slice/scheduler digests above. No live inference, retained-data access/migration, staging, commits, publication or sibling-allocation edits occurred. Coordinator reconciliation owns acceptance without an additional independent-review gate.

## Slice 3 scheduling evidence

Workspace `feat/delegation-scheduling`, immutable core checkpoint `5211269a9803fd5fcd0ed02fadec82fb790dcce8`, public Pi **1.5.2**. This section supersedes historical core-only scheduling exclusions below. See the [current contract](delegation-contract.md) for exact inputs, default/ceiling policy and safe unsupported patterns.

Observed local acceptance:

- Native model-issued parent batch → actual SDK children, whole-batch invalid-later assignment/profile/permission/limit preflight (zero new identities/setup), bounded FIFO scheduling with stopped queued items, input-ordered mixed cancelled/failed/success outcomes and one background batch delivery.
- Multiple implementation children serialize writer leases. Actual parent dispatcher permissions deny writes with no created files; separate real JSONL transcripts retain denials. Existing parent sibling preflight mutation/blocked-tool cleanup protections remain green.
- Explicit operator grant enables actual SDK child-local **model-only** `delegate_task` → grandchild. Real parent read permission hooks still run; real parentId/depth, separate transcripts, direct dispatch counts and no duplicate parent tool usage are asserted. Default recursive spawn remains denied. Operator/project/request cannot mint or restore removed roles; target/ancestor tools and skills remain subset-only.
- Capacity/depth/role/ancestor-grant/spawn/writer-under-writer adversarial patterns reject before descendant setup. Nested parents retain permits; insufficient immediate nested capacity rejects instead of borrowing/overcommitting. Request depth/spawn narrowing is enforced.
- Admission deadlines produce a drained retained-session pause; direct registry dispatch and executable tool hard limits produce one cancellation/disposal with stable reasons. A deliberately blocked **real parent tool permission hook** proves the active writer/permit is retained until drain, and the next writer cannot start early. A blocked public auth preflight proves deadline pausing cannot pretend to stop unabortable setup or release its capacity early; it never dispatches after setup returns.
- Subtree stop drains actual grandchild before ancestor. Reload cancels queued/active batch work with no queued transcript and no late old-runtime final message. Shutdown at queued admission and atomic queue-set cancellation protect reentrant observer/dequeue races.
- Existing core behaviors remain meaningful: SDK streaming/steering/prompt acceptance/transcript reopen, complete deny-ambient loader, selected model/public auth forwarding, permission enforcement, generation-safe controls, manual-shell exclusion, actual CLI exit lifecycle, native widget/Hub surface, and reload drain. The former second-writer rejection test now asserts queued serialization; no regression is hidden by preserving the obsolete rejection expectation.

Commands observed on the final runtime source: `npm ci --ignore-scripts` (125 packages, audit 0 vulnerabilities; unchanged lockfile/no symlink), focused native tests, `npm run typecheck`, `npm test` (**50/50**, including nested subtests and isolated actual Pi CLI lifecycle), `npm run exercise` (PASS), `npm pack --dry-run`, `git diff --check`. Tests add no runner/service and use only controlled Pi providers, public SDK sessions, tool dispatch, runtime/storage and temporary fixture roots. Early diagnostic runs exposed obsolete writer-rejection expectations and test-result parsing assumptions; both were corrected without weakening current invariants. A queued-admission shutdown inspection also found and fixed a timer/duplicate-observation race; its regression test is retained.

Manual trace covered profile/config → native schema/tool execution → whole-batch coordinator admission → customTools/resource loader → root public model/tool dispatcher → prompt finalization → subtree cancellation → disposal/writer release/shutdown. One cumulative least-code pass reused the registry rather than adding a semaphore/execution registry, shared one root/child task definition and hard-limit validation, and removed repeated inherited-limit calculation. No private imports, shell wrappers, dependencies, changes to installed/core/UI checkouts, staging, commits or publication.

Evidence limits: no paid/live provider invocation, credentials/global configuration changes, retained-data migration or fresh interactive display-level UI proof. Unabortable external auth/provider/hook work may prolong drain; tests prove ownership is retained, not that arbitrary providers can be forcibly stopped. OMP soft-yield/probe/provider-internal accounting and unlimited policies are explicitly not claimed. Independent UI #4 remains separate; consumer integration requirements are documented in the current contract, not implemented as a duplicate UI or dependency. Publication remains coordinator-owned and pending the real core prerequisite/approved stack graph, not an invented UI prerequisite.

## Slice 1 current evidence

Source: isolated `feat/delegation-core` worktree based on `0cf7bf92a4a9ae952ac023070cb0d45ed089a261`, Pi **1.5.2**, Node **24.21.0**. Production fake-provider execution is removed. The current interface is [delegation-contract.md](delegation-contract.md); historical proof commands below describe only the base implementation.

### Acceptance disposition

The production extension now delegates read-only and implementation tasks through real SDK children. Explicit profiles/resources, the selected-parent public provider/auth adapter, registry/events/control, actual tools/storage and parent-lifetime cleanup are implemented. **Writer coordination covers parent/child model-invoked tools only.** The user explicitly classified manual !/!! commands like external terminals, outside the guarantee; the operator must not perform conflicting manual/external writes while children write. No shell interception, hook bypass, global ban, fallback heuristic or private runtime access was added. Production writer admission and model-tool conflicts are exercised with controlled provider outputs. Live-provider and fresh interactive UI acceptance remain unverified; this is not full replacement/parity acceptance.

No real-model inference, paid/live provider calls, credential changes, global config/package changes or old-data migration were authorized or performed. All actual inference dispatch uses controlled Pi providers in test/example fixtures. The installed checkout was not edited; dependencies were installed from this worktree's lockfile with `npm ci --ignore-scripts` (125 packages, audit 0 vulnerabilities), without symlinks or new dependencies.

### Current tests and walkthrough

- `test/coordinator.test.ts`: actual SDK selected-provider streaming and queued second request; prompt-settled final text; new JSONL reopen into a fresh SDK session; hostile project extension/context exclusion; complete loader resource boundary; idempotent shutdown/dispose; acknowledged pre-delta abort; setup/shutdown race; view close/width/observer separation; real model-issued foreground/background task result exactly once; parent reload drains work; RPC overlay guard; real parent-dispatched read/grep/write/edit on a temporary Git repository (production implementation-profile task; controlled model outputs).
- `test/profiles.test.ts`: explicit bundled profile grants, operator/project subset precedence and trust, valid selected skills, missing/forbidden resources, model/provider/auth/scope preflight denial.
- `test/model-adapter.test.ts`: selected parent provider actually receives the exact model and in-memory key/headers for parent and child; direct child dispatch count excludes parent; transcripts/child agent directory contain no copied auth artifacts; explicit skill metadata enters actual child prompt; forbidden executable extension grants reject before setup.
- `test/writer-lease.test.ts`: production task tool admits implementation children; one child writer, concurrent readers, actual parent write/bash blocked with no files created, sibling preflight parent bash prevents writer launch, delegated writes respect parent permission hooks. Manual shell hooks remain untouched and do not disable writers, including after reload.
- `test/failures.test.ts`: provider failure is terminal once; parent abort drains foreground child; read-only child cannot write or self-spawn; missing parent tools and unsupported schema fields fail before child setup.
- `test/startup-abort.test.ts`: stale generation controls reject; stop before first delta persists an actual abort, never success.
- `test/hub.test.ts` and `test/widget-lifecycle.test.ts`: original neutral full-row surface, tiny/narrow geometry, sanitization, key hints, dark/light/tinted theme behavior, widget live updates/final cancellation, reload replacement and stale observer detachment retained against real registry state. No duplicate production UI runtime.
- `test/cli.test.ts`: actual isolated Pi CLI with offline example parent provider and minimal fresh environment loads production extension, model-calls task tool, exits 0 and persists a child abort rather than scripted completion. No credentials or ambient resource discovery.
- `npm run exercise`: actual isolated SDK parent → model tool → child, public selected-provider adapter, streamed state, background identity, steering, reload abort/drain, transcript inspection; temporary roots removed. SDK model is supplied explicitly from the controlled runtime (no ambient/fallback selection).

The initial command-registration probe found that registering a tool during `session_start` did not satisfy an explicit SDK allowlist. The tool now registers during the extension factory using Pi's native conflict handling, and callers select its native name. An SDK-only reload fixture initially omitted any host UI/error/shutdown binding, so Pi did not emit replacement `session_start`; fixture now supplies a real host error binding and uses the supported lifecycle. A controlled shared provider queue test now waits for actual child streaming before replacing parent scripted responses; no production delay was added. Original startup-abort protection remains intact.

### Limits

- Manual !/!! shells, external terminals/editors/unrelated sessions are intentionally uncoordinated under the explicit approved scope. Tests do not establish external-process exclusion or an OS sandbox. Operators must not conflict with active child writers.
- External provider behavior, OAuth refresh against real services, provider cancellation/reliability/billing, deferred provider jobs and provider-internal request counting are not verified. `requests` is direct parent-registry dispatch; tokens/cost/context are the SDK's values, with null for unknown. Parent footer is not an aggregate child-cost UI. Virtual-model routing is explicitly rejected, not silently replaced.
- No fresh interactive PTY/screenshots/human display-level acceptance for the Slice 1 text/state update; original neutral-surface component/regression protections remain. Historical Slice 0 PTY evidence below is not new Slice 1 acceptance.
- Public auth preflight can await operator-configured auth resolution; no bounded setup/auth timeout is claimed. Shutdown drains setup before disposal; no detached work/recovery framework is introduced.
- No independent reviewer/subagent was launched. Coordinator review/reconciliation remains required; no publication/commit/staging authority was exercised by this worker.

### Final local checks

Observed on the integrated Slice 1 source: `npm run typecheck` passes; `npm test` passes **25/25** (0 failed/skipped/cancelled; approximately 5.4 seconds); `npm run exercise` prints PASS; `npm pack --dry-run` includes only the 12 declared source/docs/README/notices/manifest files, no dependencies/tests/host state; `git diff --check` passes and `git diff --cached --name-only` is empty. `node_modules` is a real worktree-local directory, not a symlink. No files were staged or committed. The final acceptance report names the tested source digest and any later refreshed check output. Historical results below do not substitute for these checks.

Scoped simplification pass: removed the proof runtime rather than preserving aliases/parallel executors, unused writer/shell hazard scaffolding and duplicate state; kept one registry and native loaders/dispatcher/test runner. Captured model/cwd/effort once at admission to avoid mutable parent selection during setup. Shared bounded preview formatting now preserves transcript references and explicitly reports truncation. No scheduler, persistence framework, verifier service, dependency or global installation was added.

---

# Historical Group 1 verification evidence

This record applies to this repository's parity-inventory/adapter-proof implementation and **Pi 1.5.2**. It does not establish full OMP parity, pi-subagents replacement readiness, external-provider behavior, or comprehensive interactive UI quality.

## Observed environment and inputs

- Node 24.21.0; package minimum Node 22.19.0.
- npm registry resolved `@earendil-works/pi-coding-agent`, `pi-ai`, `pi-tui` **1.5.2**; exact development versions and package integrity are recorded in `package-lock.json`.
- TypeScript 7.0.2 and Node types 24.19.2 resolved from npm. Host Pi 1.5.2 docs/examples were read before implementation; installed package public declarations and runtime behavior were checked against the independently installed dependencies.
- OMP behavioral reference: `eda28eff97cf7a352fd3057a03581be1686dbc7a`. GitHub recursive tree/raw fetches only; no checkout/import/port of OMP and no upstream test execution.
- During the worker implementation and verification phase, no symlinked dependencies, global Pi config/package installation changes, paid provider/model calls, credential changes, external provisioning, commits, pushes or publication were performed. Authorized commit and draft publication operations belong to the coordinator.

## Reproducible checks

Run from a repository clone:

```sh
npm ci --ignore-scripts
npm run typecheck
npm test
npm run exercise
npm pack --dry-run
git diff --check
git diff --cached --name-only
```

`npm ci --ignore-scripts` installs only within this checkout. The tests/exercise own temporary roots and clean them in `finally`/test cleanup; the child SDK resource boundaries are explicit. The CLI test supplies a fresh, minimal environment (no inherited provider credentials), temporary HOME/agent/cwd/session storage, offline mode and discovery/tool suppression flags. It closes piped stdin before waiting for Pi, because Pi consumes stdin before processing supplied CLI prompts.

## Observed results

| Check                  | Actual observation                                                                                                                                                           | What this does not prove                                                                         |
| ---------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------ |
| Registry install       | Local dependencies installed; npm audit reported 0 vulnerabilities at installation                                                                                           | A security audit of this extension or all future dependency releases                             |
| Strict typecheck       | `tsc --noEmit` passes                                                                                                                                                        | Compatibility with Pi versions other than 1.5.2                                                  |
| Node tests             | **10 tests pass** using real Pi runtime/SDK and its public faux provider                                                                                                     | Actual external model/HTTP provider integration or load/performance bounds                       |
| Direct SDK exercise    | PASS: streamed progress, queued steering, final capture, persistent transcript reopen, shutdown/dispose; temporary files removed                                             | Actual model reasoning, paid provider credentials or interactive UI                              |
| CLI exercise/test      | Exit 0; child transcript contains `stopReason=aborted`, not scripted `stop`, on normal print-parent exit                                                                     | Ctrl+C/SIGTERM in an interactive terminal, crash/SIGKILL recovery                                |
| Interactive PTY repair | Real Pi widget/Hub output, Escape/Enter focus return evidenced by subsequent commands, resize to 40×16, dark-to-light settings selection, completed/cancelled state retained | Human screenshot inspection, display contrast/glyph measurements or every terminal/theme         |
| Package dry run        | Only declared source/docs/README/third-party notice/manifest are included; no node_modules, tests, host state or secrets                                                     | Publication (none performed during worker verification), or installation into a user's global Pi |
| Diff hygiene           | `git diff --check` passes; index remains unstaged                                                                                                                            | Merge readiness                                                                                  |

### Behavior tests

`test/coordinator.test.ts`:

1. Real SDK streamed deltas, queue acceptance and a second assistant request carrying steering; final text from message events; on-disk JSONL; reopen into a fresh actual `AgentSession`. Hostile project extension and AGENTS context do not execute/leak; the original persisted transcript and reopened session have no tools. Loader returns no extension, skill, prompt or context resources.
2. Abort persists an actual aborted assistant record; instrumented `AgentSession.dispose` invokes the original implementation for exactly that child. Shutdown is idempotent and later starts are rejected.
3. Shutdown racing asynchronous session construction waits and disposes without launching a model run.
4. Live view requests render from real streamed state; truncation fits 0/1/2/8/40/80 columns with wide/emoji/control text; keyboard completion/disposal does not cancel the child or keep observer callbacks attached.
5. Real parent `session.reload()` emits shutdown to the loaded extension and aborts the owned child. Parent commands make zero parent model calls; RPC cannot enter the terminal overlay.

`test/startup-abort.test.ts`:

6. Acknowledged startup is abortable even before the first text delta. The transcript contains `aborted` and no successful scripted completion.

`test/cli.test.ts`:

7. The real published Pi CLI loads this extension under an isolated HOME/cwd/config/environment and normal print-parent exit stops the child. This protects the complete extension registration/lifecycle/SDK path, not just a coordinator called directly in a test.

`test/hub.test.ts` adds two presentation regressions: full-row neutral opaque background/frame/padding, widths 0–80 and heights 1–24, configured-key hints and theme invalidation; and widget state coverage, control sanitization, latest-activity truncation and final result retention.

`test/widget-lifecycle.test.ts` adds a real-parent extension regression: the empty widget is registered, real child deltas request renders, cancellation remains visible, reload clears the widget before replacing it, and the old subscription no longer requests renders. It also renders Hub rows through Pi's real theme styling for native dark/light and a deliberately pink custom panel color, asserting explicit equal-channel backgrounds, full width, background restoration after truncation resets at widths 1/4/8/40, and lighter output for the light theme. Its UI callback is instrumented; actual terminal rendering is covered separately below.

The controlled provider scripts assistant text, but **session construction, provider dispatch, event delivery, message queues, transcript writes/reopening, extension loading, reload/exit dispatch, abort signals and dispose are Pi's real implementations**. Tests use no replacement AgentSession implementation or mocked storage. Disposal instrumentation wraps and calls the real method.

## Failures that changed the proof

- The first typecheck found that Pi's base `Component` type omits optional disposal. The Hub return type now states `Component & { dispose(): void }`, retaining observer cleanup rather than casting it away.
- An initial immediate-shutdown exercise produced a successful child transcript after cancellation: `prompt()` input preparation can precede abort-signal ownership. Startup now waits for actual `agent_start` (or early prompt settlement) before acknowledging the child. A regression test and isolated CLI exit test protect this boundary. A snapshot flag alone would not have caught it.
- The initial automated CLI fixture timed out because its stdin pipe remained open; Pi was waiting for stdin, not executing the proof command. The fixture now explicitly sends EOF. The final integrated suite passes. This was a fixture correction, not a fallback to mocks or a waived CLI criterion.

## Unavailable / still unmet

- **Display-level/UI limits:** interactive PTY rendering, keyboard focus return, representative resize and live theme change were exercised for the repair below. No screenshots, human graphical visual inspection, display contrast/glyph measurement, regular-mode terminal run or exhaustive theme/terminal compatibility checks were performed. ANSI/text output is not a reconstructed full-screen screenshot.
- **Real external provider/model behavior:** deliberately not exercised; no credentials or paid calls. The fixture cannot establish tool-using model reliability, billing accuracy, provider cancellation/network behavior or production routing.
- **Full parity/consumer readiness:** not the assignment. Inventory rows marked unproved, blocked or adjacent remain so. In particular selective inheritance, useful tools, nested delegation, result schemas, filesystem apply/conflicts, worker execution, advisor/probes and within-parent park/revive need separate implementation and acceptance.
- **Review evidence:** independent agent review was not performed. Coordinator source/evidence reconciliation is not independent review; this record adds no independent-review acceptance gate.

## Interactive terminal repair evidence

The user reported that the main screen showed no child and the original borderless Hub looked like unstructured text. The bounded repair adds only a session-bound `ctx.ui.setWidget` observer and a framed, fully padded semantic-background Hub. Both read the existing single-child coordinator snapshot; neither owns execution. Child resources/provider/lifetime behavior are unchanged.

A one-off Python standard-library `pty` exercise launched the real Pi 1.5.2 interactive CLI from the checkout. Each invocation used its own temporary HOME/agent/cwd/session directories, a fresh minimal environment without provider credentials, offline mode, all ambient discovery/tools disabled and the explicit proof extension. Only those temporary processes/data were cleaned up. No runner/framework was added to the repository.

Observed actual PTY output and interactions:

- **100 columns × 30 rows, dark theme:** empty widget above the editor; `/proof-start` changed it to running and streamed activity; `/proof-hub` emitted a complete themed title/border, padded body and close hint with the configured `escape/ctrl+c/enter` keys. Every cell inside the frame received the background; chat remained visible only outside the frame's gutters.
- **Escape → editor → steering:** closing the Hub left the widget live. The next `/proof-steer` command was accepted as queued, establishing that keyboard control returned to the editor and the child was not stopped by viewing/closing.
- **Live resize to 40×16:** the open Hub remained framed and width-contained; Enter dismissed it. The widget remained visible within the narrow width, then `/proof-cancel` changed it to cancelled. Returning to 100×30 and `/proof-result` confirmed the same cancelled child snapshot. Final status/activity remained on the main screen.
- **Live dark → light:** `/settings`, search `theme`, Enter, Down to light, Enter, Escape. Actual settings output confirmed `Theme light`. In that earlier tinted implementation, emitted Hub panel background changed from indexed color 59 to 189 through Pi's semantic theme. This did not establish neutrality and is superseded by the Slice 0 surface correction below.
- **Unicode/completion:** a controlled assignment containing Chinese text and a joined emoji streamed to completion; the completed widget remained above the editor and the Hub showed the same final status/text. Enter/Escape returned to the editor without altering execution. Ctrl+D exited both retained scenarios normally.

Evidence consists of redacted `.ansi` captures plus cursor-separated `.rows.txt` output fragments, retained outside the checkout for the coordinator. They are actual terminal emissions, not component-test output, screenshots or a terminal-emulator screen reconstruction. The initial theme exercise typed `light` into a non-searchable submenu and did not change it; the retained successful theme evidence uses the supported Down/Enter path described above. Pi's no-model startup warning is expected because the parent has no credentials; proof slash commands still use only the child's controlled provider.

To reproduce, use the README's isolated interactive invocation, optionally adding `--use-theme dark`, at 100×30; follow the commands above, resize to 40×16, and use the ordinary settings theme picker. Do not send normal parent model prompts. Tiny component-only geometries are additionally covered by tests: when there is no room for a frame, one bounded status row is rendered and configured close keys remain active.

### Slice 0: neutral panel surface

The user rejected the pink Hub surface. `customMessageBg` is a tinted message role, not a neutral panel guarantee. The correction uses public Pi TUI color conversion to keep that active theme color's OKLCH lightness and set chroma to zero. `theme.style` applies the resulting concrete background to every fully padded row, including borders and tiny status-only layouts. This preserves dark/light adaptation without adopting another possibly tinted semantic token or hard-coding a palette. A custom theme's hue cannot tint the derived surface. Semantic foreground/status colors, widget behavior, configured close keys and execution ownership are unchanged. Pi's truncation helper inserts full-style resets; the paint boundary styles each reset-separated segment so narrow text cannot clear the surface. The focused regression first failed on the unpainted ellipsis at width 1, then passed after this correction.

Fresh isolated interactive Pi 1.5.2 PTY runs selected native `dark` and `light` separately with `--use-theme`; truecolor capability was explicit. Actual Hub output used **RGB 55/55/55** in dark and **229/229/229** in light. Both runs showed the normal 100×30 frame, resized to 40×16, dismissed with Enter, cancelled the still-running child, reopened its cancelled Hub, dismissed with Escape and accepted `/proof-result` back in the editor. The final widget retained cancellation. Each host exited 0 after Ctrl+D and its test-owned temporary HOME/cwd/agent/session directories were removed. No user session was reloaded; no global configuration, installation, credentials, retained proof data or old evidence artifacts were changed.

The new redacted ANSI and cursor-separated text captures are retained outside the checkout and handed to the coordinator. They establish emitted achromatic opaque colors and keyboard interactions, not screenshots, human contrast/glyph judgment or exhaustive custom-theme legibility. The deliberately tinted custom palette is covered by the real-theme styling regression, not claimed as an additional custom-theme PTY run. Only this neutral surface slice was implemented; later orchestration/replacement slices remain untouched.

## Simplification pass

Reviewed only this task's changes before final checks. Removed redundant shutdown waits/nested cleanup scaffolding by letting the existing cancellation method own the startup barrier, preserving `finally` disposal. Kept one child, one observable snapshot and one observer subscription; no scheduler, generalized verifier, recovery service or duplicate terminal renderer. Removed an arbitrary finite scripted-response queue in favor of reusing Pi's response factory for each actual request. The final checks cover these changes. For the UI repair, kept rendering stateless (theme recalculated each render), one shared status/activity presentation and native width helpers; no new timers, retained command UI context, scheduler or terminal renderer. The widget subscription is removed before shutdown/disposal so stale children cannot repaint a replacement session.

For Slice 0, the scoped pass retained one native color conversion per render and reused the existing row-paint boundary; no color cache, theme classifier, palette configuration or verifier framework was added. Simplified the real-theme regression's per-row comparison before the final full-suite checks.