Application child spec.

Cancel a running Subagent, or close a queued/terminal Subagent as cleanup.

Default runtime limits.

Return a read-only snapshot of the Subagent Manager runtime for one parent Session.

This is volatile process health evidence, not durable history. Use the Session Log and Session tree for canonical lifecycle facts.

List Subagents for a parent Session.

Reconstruct Subagent relationships and terminal state from parent History.

@spec restrict_resume_posture(map() | nil, Pixir.Permissions.mode(), map() | nil) ::
  {:ok, map() | nil} | {:error, map()}

Apply the common restrict-never-widen rules to a restored posture.

@spec resume_posture(
  String.t(),
  keyword()
) :: {:ok, map()} | {:error, map()}

Rehydrate a Session's durable permission posture for a cold resume.

Root Sessions record their posture at creation (Pixir.Conversation.start/1, lineage root, trusted only in root position: first non-session_fork event, runtime-authored source) and restore the recorded capability ceiling — including unbounded auto when the marker declared it. Spawned children record theirs in the Subagent Manager (lineage child) and keep the stricter contract: write-capable history restores only with a bounded policy. Legacy Logs without posture evidence remain resumable only when they contain no write-capable evidence, and then restore an explicit read-only ceiling; otherwise they fail closed with reason missing, which is the one classification the operator may override via the CLI's explicit legacy-root attestation (never as unbounded auto).

Send follow-up input to an idle Subagent.

Spawn or queue a Subagent.

All known Subagent lifecycle statuses.

Summarize agent maps for model-facing output.

Build model-facing text for a structured wait outcome.

Whether a status is terminal.

Statuses that no longer have a live child runtime.

Whether the public lifecycle contract allows a status transition.

closed is retained as Pixir's local close/cleanup state. Completed, failed, timed-out, and cancelled Subagents may be restarted by send_input/4; detached children cannot be resumed because there is no live process handle.

Validate and normalize a Subagent spawn without creating runtime state.

Wait for selected Subagents to reach a terminal status.

Wait for selected Subagents and return a structured outcome.

Unlike wait/4, this keeps partial fanout visible: timed-out, failed, detached, cancelled, and still-incomplete children are bucketed instead of turning the parent tool call into an opaque failure. The returned "partial" boolean is true for any non-completed aggregate status; consumers should use "status" when they need to distinguish "partial" from "incomplete".