226 Commits

Author	SHA1	Message	Date
Patrick Buckley	cc84f9d176	fix(memory): harden project scope authorization and consistency	2026-08-11 21:58:21 -07:00
Patrick Buckley	480a1426b3	Fail-closed history-commit handoff (#1005) ... * fix(session): fail-closed history-commit handoff (#981) The deleted-workstream discovery is now a terminal, ws_id-keyed latch: keyed conversation commits refuse admission once the durable parent is gone (convergence finalizers and force-abandon are exempt), history handoff refuses to mint a proof token so /history fails closed with a 503 instead of silently wiping the pane, and the SSE stream carries a workstream_gone resync reason. Discarded commits leave a forensic log of commit keys and roles, never content. Conversation rows gain a commit_key (migration 071): keyed saves are idempotent under retry, validated against the full commit identity, and refused when they would cross a workstream deletion. The prune orphan category now requires a NULL alias plus a two-hour updated grace, with cutoffs computed at discovery time and carried into both dialects' rechecks. The mid-turn interjection queue is owner-partitioned with no per-site mode flags: pops take the acting principal's and unowned rows, other participants' rows are structurally retained, and enforcement lives at queue admission plus the shared before_spawn gates. The retraction ledger is bounded by open pop windows: pops open a window atomically with the queue delete, restores close their ids atomically with the ledger consume, every other exit closes through one helper, and misses for unheld ids record nothing. The workstream-gone latch refuses unattended wakes at all three gates (watcher spawn, claim, delivery pre-pop), and the retry dispatcher regained its pre-envelope cancel/error convergence net. Persistence-state reporting derives through the session bound to each UI instead of a registry lookup by id that failed open to healthy during tombstone retention. The dashboard roster no longer re-inserts ghost entries from trailing activity events, the history tool-outcome scan tolerates interleaved non-turn rows, and the shared handoff-deadline handle owns its own retirement. Single-sourced across call sites: keyed-commit row values, attachment save wrappers, tail-truncation and conflict-resolution bodies for both storage dialects; worker-slot lifecycle field sets; the direct-commit admission frame; queued-row layout accessors; the string-aware comment stripper shared by every JS harness suite. Refs #981 #964 * fix(session): sweep handoff fixes to their sibling surfaces The interactive replay loop treated a system row as a tool-batch boundary, so every tool result after an interleaved row vanished from that pane while the coordinator rendered the same history correctly. Only a conversational turn ends the batch window now, matching the shared outcome index. Accepted user turns clear the composer's attachment chips on the same viewer policy that settles optimistic bubbles rather than on having matched a local bubble, so a workstream created with an upload no longer keeps a chip for an attachment the create dispatch already consumed. The coordinator's raced-Stop arm emits the stream-end hook it inherits alongside the idle state, leaving no unfinalized bubble or unflushed tool output. Ending a session surfaces a failure toast when the request never lands or answers with a non-JSON body. The per-second persistence reconcile now probes each session without blocking: a workstream whose generation and handoff locks are held is skipped until the next pass instead of contending the locks every commit needs. The one-shot repair that gates workstream creation at capacity keeps a definite probe — it has no next pass, and the sessions likeliest to be contended are the ones whose unresolved journals emptied its candidate list. Single-sourced: the attachment lane builds its conversation row through the shared commit-identity builder; the ordinary worker exit releases its slot through the lifecycle owner; both operator surfaces snapshot their counters through one non-consuming helper; the replay preamble loses its per-kind wrappers and its config hook; the browser harness suites share one brace walker; and each in-flight history attempt is one record carrying both its abort controller and its deadline. Refs #981 #964	2026-08-11 04:18:36 -07:00
Patrick Buckley	f4fd7e1f67	fix(security): classify outbound addresses by what they reach (GHSA-wm4f-79pw-pfr9) (#1003) ... * fix(security): classify outbound addresses by what they reach (GHSA-wm4f-79pw-pfr9) Five guards screened outbound URLs and each hand-rolled its own address normalization and policy tests, so each had a different hole. An IPv6 transition address carries an IPv4 destination in its low bits and `ipaddress` classifies the wrapper, not the destination: 64:ff9b::a9fe:a9fe reports is_global because 64:ff9b::/96 is global unicast, while a NAT64 gateway routes it to the cloud metadata endpoint. CGNAT (100.64.0.0/10) is neither is_private nor is_global, so a denylist built on is_private missed it with no gateway involved at all. Add turnstone/core/ip_classify.py as the single classifier. One function returns exactly one policy lane — PUBLIC, PRIVATE (operator-approvable) or NEVER — and every guard branches on the lane rather than re-deriving it. Two overlapping booleans would make a verdict depend on which one a caller tested first; several addresses are simultaneously globally routable and metadata-reaching. - Decode transition addresses per RFC 6052 §2.2 (NAT64 well-known and local-use prefixes, 6to4, Teredo, IPv4-mapped, IPv4-compatible) and judge them by the IPv4 they reach. The local-use prefix does not say which layout its gateway uses, so every length it can carry is decoded and the worst result classified. - Share hostname resolution too. The five copies had already drifted on which failures they caught, and getaddrinfo raises UnicodeError — not an OSError — from the IDNA encoder. - Resolution failure is a refusal, not a pass: the fetch resolves again, so an authority answering the guard with SERVFAIL and the fetch with an internal address would otherwise switch the guard off for that hop. - Screen every redirect hop in every mode. allow_private_origin widens which lanes are acceptable rather than turning screening off, and the permission is revoked after any hop that is not wholly private. - Cleartext http is allowed only for a hostname that RESOLVES to loopback. *.localhost is ordinary DNS, and trusting the name put an OIDC token exchange on the wire in the clear. - Screen doctor and console-probe URLs through the classifier. Both used a host.startswith("169.254.") string test that never resolved, so any DNS name pointing at the metadata service passed and its body was returned to the model. - Add known vendor metadata prefixes the stdlib does not flag, and place deprecated IPv6 site-local outside the public lane. The operator's private-network opt-in still admits the whole home lab, including IPv6 loopback, CGNAT and split-horizon hosts. Metadata, link-local, multicast, unspecified and reserved addresses stay refused regardless of the opt-in, including as a redirect target from an approved private origin — the settings help and docs now say so. Reported by @tonghuaroot. * fix(security): close Azure/Oracle metadata gap and restore dual-stack origins Review follow-ups on the address-classification rework. Azure's host-agent endpoint (168.63.129.16) and Oracle Cloud's metadata endpoint (192.0.0.192) sit in ordinary unicast space, so the stdlib reported them as globally routable and both classified PUBLIC — reachable with no opt-in at all, a worse position than the RFC 1918 host beside them, and directly contradicting the "metadata stays refused even with the opt-in" guarantee the settings help and docs now advertise. Both join the shared vendor list. Revoking the private-hop permission on the ORIGIN hop broke the case `_screen_tool_url` deliberately admits: a dual-stack or split-horizon home-lab host answering with both a LAN and a public record was approved, then refused on its own `302 /login` — one hop was all it ever got. Track the approved HOST instead, so redirects that stay on it remain covered while a redirect to any other private host is still refused once the chain is no longer wholly private. Also: - Try several registry candidates for the collector-scope probe instead of abandoning it when the first is unresolvable, which also stopped a healthy registry from logging as malformed. - Bound the probe's name resolution with an explicit timeout matching the 2s the httpx connect deadline used to provide; it runs before the console lifespan yields and getaddrinfo has no timeout of its own. - Route doctor and the console probe through `web.screen_url` rather than keeping a third and fourth copy of parse/resolve/classify/fold, which had already diverged on default port and empty-hostname wording. An empty hostname no longer reports as a cloud-metadata refusal. - Give `screen_url` a scheme-aware default port. - Stop doubling the word "hostname" in the OAuth resolution refusal. - Correct the `_screen_tool_url` docstring: it described `private_origin` as requiring every record to be private, which the mixed-record decision reversed, and `private_block` as a property of a refusal when it reports the lane on the success path too. - Make the preview tests' screening stub opt-in rather than autouse — as a module-wide fixture it also stubbed the tests whose subject IS the screen, so one of them would have passed even if screening refused everything. Verified the module now passes with all name resolution blocked. * fix(security): refuse mixed-record private origins instead of exempting them The previous commit let an approved private origin redirect to itself by exempting its hostname from the chain-wide revocation. That exemption was wrong three ways: it was captured once and never cleared, so a public hop could steer the fetcher back into the approved host at a path of its choosing — reopening the private -> public -> private bypass; it was re-entrant across same-host redirects with fresh DNS each time, so a self-redirecting host could walk arbitrary internal addresses; and it matched on bare hostname, so it spanned every port on the approved box. All three were reproduced against the parent commit, which refuses them. Delete the exemption rather than repair it. The case it existed for — a dual-stack host answering with both a LAN and a public record — is now refused where it is actually decidable, in `_screen_tool_url`, with the remedy in the message: point the tool at the LAN address directly. A granted chain therefore always starts wholly private, so the fetch guard needs no notion of an approved host and stays one unconditional rule. That the accommodation could not be expressed safely in the guard is the signal: the connection may land on either record, so approving such a host never described where the fetch would go. Also from the same review: - Walk the whole service registry for a collector-scope probe candidate instead of the first three, and split the outcome into three log lines, so entries that are merely unreachable stop raising the malformed-registry alarm and skipping the boot check cluster-wide. - Stop the candidate walk on a resolver timeout. `asyncio.timeout` bounds the await, not the work, so continuing left one parked thread per timed-out candidate on the shared executor. - Move the metadata-hostname denylist into `ip_classify` and enforce it in `screen_url`, so doctor and the console probe inherit it instead of each keeping a copy. - Drop the scheme-aware default port: a numeric service does not change which addresses resolution returns, and classification reads only those. `parsed.port` is still touched so an out-of-range value refuses. - Correct the vendor-metadata comment, which generalized a claim true of Azure's and Oracle's addresses to Alibaba's CGNAT one. - Rename a test class that was still named for the rule it no longer tests.	2026-08-11 02:18:03 -07:00
github-actions[bot]	9211c4fb29	chore: download vendored JS files	2026-08-10 21:04:25 -07:00
Patrick Buckley	766223e774	feat(judge): parallelize batch evaluations (#991)	2026-08-08 23:56:15 -07:00
Patrick Buckley	98e96ab5f3	Add per-alias model concurrency admission (#990) ... * feat(models): add per-alias concurrency admission Add registry-backed FIFO admission limits with queue-aware deadlines and full-stream leases. Expose max_concurrency through storage, admin configuration, OpenAPI, documentation, and diagrams, with role and live backend count coverage. * fix(api): omit null concurrency schema default Keep max_concurrency optional for presence-keyed updates without advertising a null default for its non-null integer OpenAPI shape.	2026-08-08 22:01:04 -07:00
Patrick Buckley	7a06f5e8bc	refactor(session): make ModelLane the provider boundary (#979) (#989) ... * refactor(session): make ModelLane the provider boundary (#979) ## Summary This closes the model-lane ownership gap left by #832: `ChatSession` no longer stores raw provider/client handles. `ResolvedModelBinding` now carries the provider, client, model, capabilities, registry generation, and backend-auth configuration as one coherent snapshot. - Atomically rebind existing sessions after model-registry changes while pinning each in-flight send, fallback, judge, output guard, task agent, title, compaction, perception, and voice operation to its initiating principal and binding. - Fence UI publication, canonical trajectory folds, durable writes, streams, retries, child scopes, and judge work by generation. Stop can hand off to a successor without accepting late state; cancelled tools retain typed effect receipts, and concurrent approval batches resolve by exact cycle or call. - Make create, fork, open, close, and delete race-safe with hidden `creating` reservations, incarnation-aware state tails, and an ACL-rechecked transaction that clones checkpoint-bounded history, configuration, project/persona state, and attachment references. - Extend REST/OpenAPI and Python/TypeScript SDK contracts for create/fork inputs, routed-create metadata, live-workstream probes, targeted approvals, and structured cancellation results. - Update architecture, storage, authentication, judge, channel, console, API, and SDK documentation, including regenerated architecture diagrams and OpenAPI artifacts. ## Validation - SQLite suite: 11,188 passed, 9 skipped, 10 deselected - PostgreSQL suite: 11,195 passed, 2 skipped, 10 deselected - Live backend: 3 passed - SSE recovery: 6 passed; browser recovery harness passed all scenarios - Ruff: clean; 595 files correctly formatted - mypy: 243 source files clean - TypeScript: typecheck/build and 35 tests passed - OpenAPI artifacts fresh; all 14 changed diagrams reproduce byte-for-byte - `git diff --check` and Git LFS integrity clean Closes #979. * fix(deps): update nanoid for GHSA-2v37-7h3g-55p8 Refresh the transitive lock entry admitted by PostCSS so the TypeScript security gate no longer resolves the vulnerable custom-generator implementation. Validation: - npm ci - npm audit --audit-level=moderate: 0 vulnerabilities - TypeScript typecheck and build - TypeScript tests: 35 passed * fix(test): assert canonical model registry URLs Replace prefix checks with exact canonical base URL assertions so the tests do not model incomplete URL validation. Validation: tests/test_model_registry.py (185 passed); Ruff check/format; mypy.	2026-08-08 16:13:35 -07:00
Patrick Buckley	aa4371ea99	fix(832): retire the dead attempt's armed state in the re-create window ... Between a mid-stream death and the next begin_attempt there is no live attempt, but the consumer kept the dead attempt's armed _CancelRef: a Stop in that window re-emitted the discarded splitter carry as fresh content behind a duplicate stream_end, and a walk-preamble failure was classified as another armed death, replacing the operator-actionable stream-death error. end_attempt() now pronounces the attempt dead at partial-capture; the consumer gains a single per-attempt initializer (_reset_attempt), a lane-free constructor (one resolve_lane walk per turn), and a saw-chunk classifier fallback so a never-arming adapter's mid-stream death still classifies mid-stream instead of silently double-rendering the same lane. Wire-preparation failures are typed at the seam: model_turn wraps prepare_wire raises in WirePreparationError, both walk arms forward it verbatim (no health record, no fallback walk — a session-data fault would otherwise paint every backend degraded), the fatal formatter gets a dedicated branch, and the re-issue ladder's last-death mask exempts it alongside BackendAuthUnavailableError so an auth outage mid-turn is not misdiagnosed as a network flap. Riding fixes: the tag-scan gate gets its single spelling (lane_scans_inline_reasoning) shared by drain and display; the citations fold's separator+gate become a shared pair in _protocol; _build_main_lane stops passing config_store (dead derivation — the session's own knobs replace both values it feeds); the debug wire dump is ruled per-invocation (the overflow-recovery re-print is the dump that diagnoses the recovery) and pinned; dead delegates _ensure_tool_call_ids and _finalize_provider_blocks deleted; the parity runner adapts to the pre-fold seam signature by inspection and refuses to record a harness-shape TypeError as a baseline; the streaming provider fakes move to tests/_session_helpers (their tree-wide home) and test_cancel's duplicate helper is deleted; committed parity pins restate their rulings in full; architecture.md's circuit-breaker section is replaced by the real passive health-tracker story and the send-flow diagram stops attributing tool-call assembly to the display consumer; stale pre-fold names and ragged comment paragraphs cleaned. New pins are mutation-probed: disabling end_attempt, the saw-chunk fallback, the auth exemption, or the WirePreparationError arm each fails its pin.	2026-08-06 01:04:32 -07:00
Patrick Buckley	5a20916eec	docs+test(832): retire pre-fold names from prose; pin the eager-append contract ... The docs sweep re-points every stale reference to the deleted seam (architecture.md's flow diagram and ladder inventory, the lowering and anthropic docstrings, the protocol's shared-rule docstrings that described the pre-fold dual-assembler world). The Protocol's cancel_ref contract is strengthened from 'before the first chunk' to 'inside the call body, before the iterator is returned' — the instant the fold's creation-vs-midstream classifier and health recording key on — and three real-SDK-over-mock-transport tripwires pin it per adapter, so a future lazily-issued generator adapter fails loudly instead of silently reclassifying every pre-first-chunk death.	2026-08-06 01:04:32 -07:00
Patrick Buckley	8605c9783d	feat(models): rfc8693_obo auth mode, per-alias exchange scopes, identity-keyed mint cache ... Adds the dedicated `rfc8693_obo` model auth mode (#955): model definitions gain an `obo_scopes` column (migration 069), the mint threads the scopes to the token-exchange leg (RFC 8693), and every dynamic mode pins its grant leg — a mode is a dialect commitment, not a hint the deployment profile resolves. Exchange-capable IdPs refuse an audience whose scope was not requested; this closes the structurally unmintable model-OBO path on token-exchange deployments. The model mint-cache is identity-keyed on the owning definition's alias (`__model_obo__:<alias>` per user, `__model_app__:<alias>` under the shared app principal), matching the MCP discipline where rows key on the unique server name. The bearer's shape lives in the row's audience/scopes columns and the freshness gate compares it on every read, so a re-aimed alias refuses its old row and overwrites the same key in place. Admin lifecycle (rename, re-aim, scope change, delete) purges a definition's own rows through one shared helper — sound because one definition owns each key; a sibling's rows are untouchable by construction. Cooldown and backoff additionally key on the dispatch shape, so an operator's config repair is an instant clean slate. Cause records, cooldowns, locks and memoization are per-alias end to end, and the session heartbeat reads refusal causes under the same keys. Console: default-deny write gating for dynamic rows (value-diff over the full column ladder, admin.mcp escalation, a never-blockable pure-disable carve-out), a two-tier validator (audience allow-list on every write; deployment-posture checks when the pair is chosen), one shared scopes parser whose omit-unchanged arm keeps over-cap DB-direct residue rows disarmable without ungating real changes, and served constraints (dynamic/scopes/app-identity mode lists, mode-to-profile pairing) so the shelf tracks the registry by data. The admin shelf gains the mode option, a scopes input with residue affordances, pairing-aware option greying, and a derived auth badge. Registry load refuses control characters in alias, audience, and scopes — including the C0 separator block that str.split() would silently collapse — and the C0/DEL class has one exported spelling shared by every surface. Profile-mismatch visibility warns at reload and boot with the mode-correct cause, gated on OIDC being enabled. Breaking: a stored `entra_obo` alias on a deployment whose `[oidc] obo_grant_profile` is `rfc8693` (or the inverse pairing) no longer mints via the profile-driven overload — the mint refuses before any IdP traffic with cause `grant_profile_mismatch`, and the `model.auth_fail_closed` policy governs static fallback. Such rows never minted usefully on scope-gating IdPs; the shelf now surfaces the pairing and the per-turn heartbeat names the refusal cause. Live-verified end to end: scoped token exchange mints, the warm cache serves with zero IdP calls, and the mode/profile mismatch refuses with zero IdP traffic (scripts/obo-e2e/keycloak_e2e.sh); the refresh-redemption profile's E1-E7 hold via scripts/obo-e2e/entra_e2e.py. Closes #955.	2026-08-04 05:19:03 -07:00
Patrick Buckley	33ace975d2	feat(models): default-deny governance and admin UI for per-alias backend auth ... Follow-up to the per-alias Entra OBO/app-identity backend auth: the console write path now applies default-deny field classification, the admin shelf gains full backend-auth support, and the session/registry rebind machinery is hardened for config changes landing under live sessions. Console write gate: - Default-deny classification: any non-neutral change to a row that is or becomes dynamic requires admin.mcp plus validation; the provably auth-neutral columns are enumerated (MODEL_AUTH_NEUTRAL_FIELDS) and a live-schema classification test forces every future column to be classified. The derivation is a pure function (_derive_auth_gate) with unit-pinned exclusivity invariants. - Two-tier validation mirroring the MCP oauth_obo validator: the row tier (audience allow-list) runs on every gated write; the posture tier (OIDC configured, token store present) runs on pair changes and on enable-arming. - Pure-disable carve-out: disabling a dynamic row is de-escalation and is never blocked — admin.models suffices and validation is skipped, including for rows with corrupt or skewed stored values. - Capabilities are compared canonically (key order, integral floats), the audience compare normalizes both sides, and staging an audience on a static row is refused on both write twins. - Calibrate writes the capabilities column under an enforced confinement invariant with a compare-and-swap persist. Admin shelf: - Backend-auth section with a per-open constraints fetch (GET /model-definitions/auth-constraints: audience allow-list, grant profile, dynamic modes), datalist audience suggestions, server-defined modes preserved on round-trip, and permission-aware visibility built on cache-skew-safe helpers shared through auth.js. - Refused live-registry swaps surface as an amber registry_warning on the write, delete, reload, and calibrate responses; audit rows carry auth_gated / auth_disarmed markers visible in the audit view. Registry and sessions: - The encryption-key requirement for dynamic auth is enforced inside ModelRegistry.reload() itself — nodes refuse with 503 and the console records coord_registry_error — and reload bumps the generation before the map swap so a racing reader can never pair a stale generation with new maps. - resolve()/resolve_binding() return the generation from inside the registry lock; sessions rebind per send on generation change with atomic client/provider/config commits, fallback-first handling of removed or unconstructable aliases, and judge/limiter resets only when the binding actually changed. - Mint refusals record per-user causes surfaced in the per-turn heartbeat logs; misconfiguration warnings are deduplicated with bounded state. Verification: 10417 tests (99 added on this branch), a 71-scenario browser harness over the real admin shelf, and a live rfc8693 token-exchange e2e run (MCP legs verified end to end; the model-leg scope gap is tracked as #955 under a narrow known-gap signature). Closes #950.	2026-08-03 20:11:28 -07:00
metaclassing	9adde920d4	feat(models): per-alias backend auth via Entra OBO and app identity (#898) ... Adds a per-alias `auth_mode` on model definitions so a model backend can authenticate to an Entra-fronted gateway with a per-request minted token instead of one shared static API key, letting the gateway attribute calls to the actual user or to the app as a machine identity. - `static` (default, unchanged) sends the stored `api_key`. - `entra_obo` mints a per-user On-Behalf-Of token for `obo_audience` from the caller's captured refresh credential. - `entra_app` mints an app-identity token via the client-credentials grant, and covers userless turns that OBO cannot. Reuses the existing OBO grant legs, refresh-token rotation CAS, cluster advisory lock and the `mcp_user_tokens` mint-cache, keyed under synthetic `__model_obo__:<audience>` / `__model_app__:<audience>` rows. The token binds at the call site through `client.with_options(api_key=...)` so each SDK emits it on its own auth path rather than through header injection. Migration 068 adds `auth_mode` and `obo_audience`. Both are additive and existing rows default to `static`, so behaviour is unchanged unless an alias opts in. Operator controls: `model.auth_audience_allowlist` is an exact-match allow-list that gates which audiences may be configured and denies all by default, and changing a mode or audience requires `admin.mcp`. `model.auth_fail_closed` decides whether a failed mint may fall back to an explicitly configured static key. A delegated call with no user, or a dynamic alias with no real static key, always refuses. Two changes here apply regardless of whether any alias opts in: - Storage and app state are now wired into the console MCP client manager. This fixes per-user `oauth_user` / `oauth_obo` dispatch for coordinator-hosted sessions, which previously raised `RuntimeError` on first call because `set_app_state` was only ever called on the node. - Unattended watch restores and `--resume` resolve the persisted workstream owner instead of constructing the session under an empty principal. A workstream with no owner is now a permanent refusal rather than an anonymous, auto-approved run.	2026-08-02 15:15:02 -07:00
Patrick Buckley	3960aeef88	docs(readme): lead the what-is-a-harness section with the diagram ... - docs/diagrams/harness.png: cartoon rendering of the HYPOTHESIS.md tuple (256-color quantized, 803KB) - README: image served via absolute raw URL so the PyPI page renders it; caption formula corrected to tau_H (the doc's notation) and the ill-typed rho(M_W(pi), E) composition shorthand dropped; formalism linked beside the primer	2026-08-02 13:13:54 -07:00
Patrick Buckley	0d52b63b50	feat(coordinator): nudge a coordinator that goes idle holding unfinished work ... Two nudge classes can fire from one IDLE event, tasks first, each asserting only its own domain. idle_tasks (advice) fires when open (pending/in_progress) tasks exist. The body is a counts opener, the open task ids with statuses, and typed branches that each end in a runnable tasks(...) or wait_for_workstream(...) call populated with real server-minted ids. Everything it says about children is governed by one observed fact: live children present adds the caveat sentence and the blocked-on-a-child branch; affirmatively none says nothing about children at all. Any needs_user row parks the class entirely — at the fire gate and the drain predicate — because with no task graph an open task may be gated on a parked one's unanswered question; the operator's answer is the re-arm. Gated on memory.nudges and on the persona actually exposing the tasks tool; carries the per-class cooldown as well as the per-bracket cap. The tasks tool itself gains the needs_user status and a note field — the typed escalation the body's branches point at. idle_children (liveness) fires when children are in a live state — the wake that lets an idle coordinator collect a finished child's results. The body is a roster of workstream id prefixes and states, never names: a child's name is model-authored text and does not enter a system turn. Cap-only and cooldown-free by design, not gated on memory.nudges, and it survives an operator Stop. Fail-closed, event-wide: if any storage read fails while the observer handles an IDLE event, neither nudge is queued and neither cap is charged. Both paths run as side-effect-free plans; the commit tail is storage-free, so no read can fail past the veto point; both drain predicates drop on a failed read. A path's own fault (a generic raise) still costs only that path's fire, so one class's bug cannot strand the other. Task text is stored verbatim and projected per audience at render: the model-facing projection deletes angle brackets, the operator projection keeps them, and both strip newlines and bidi/zero-width runs. Idle cards render what the model was told, formatted for the operator, never augmented with content the model did not receive.	2026-07-29 22:11:38 -07:00
Patrick Buckley	b38e9be17c	docs(session): scope the zero-band geometry claims to the default compact threshold ... The drain comment and the architecture docs stated the zero-budget band relative to the auto-compact threshold as if 0.8 were universal ("well below the auto-compact threshold"); with an operator-set auto_compact_pct under the ~70% zero point the claim reads inverted. State the geometry against the DEFAULT threshold and make explicit what was always true of the mechanism: the trigger's predicate is the exhausted budget itself, never a threshold, so with low thresholds the owed path compacts first and the trigger is its bail/insufficient backstop.	2026-07-21 17:48:09 -07:00
Patrick Buckley	6c4c848a08	fix(session): survive tool-result truncation at zero context budget (#883) ... At an exhausted context budget the drain loop replaced every tool result with a placeholder that read as a successful-but-trimmed call. For structural results — spawn_workstream's ws_id, the tasks scratchpad — the model lost the handle orchestration depends on and silently stalled, while the UI (told the real summary before the drain) kept showing success. Worse, the budget zeroes near 70% fullness when max_tokens ≥ context_window/4, well below the 80% auto-compact threshold, so a stalled coordinator could sit in that band indefinitely with no compaction ever firing. Three guarantees at the truncation seam, one renewal trigger at the drain: - structural-tool and error results get a guaranteed 2048-char admission floor (head+tail beyond it) — never the zero-budget drop - any result at or under the floor passes verbatim (denial notices, spawn acks: never destroy what is smaller than the guarantee) - bulky non-structural results get an explicit drop notice stating the call RAN but its output could not be admitted — never a trim impersonation the model cannot distinguish from success - a zero truncation budget triggers one mid-turn compaction (no threshold_pct — none was evaluated, same rule as the ctx-overflow retry), closing the 70-80% band where the budget zeroed but compaction was never owed Background-bash spawn acks ride the small-result pass; a name-keyed floor cannot distinguish them from foreground bash — see #891.	2026-07-21 17:48:09 -07:00
github-actions[bot]	e4604c278e	chore: download vendored JS files	2026-07-20 07:21:23 -07:00
Patrick Buckley	8d1190d17a	docs(tools): apply review round-1 findings (cwd notes) ... - docs/tools.md: sync the tool-JSON metadata-keys table to _META_KEYS — it had drifted to 3 of 8 keys (coordinator, interactive, kind_variants were already missing; cwd_note/workspace_note are new). - tests: cover the third note-rebuild trigger (_drop_mcp_surface) with a count==1 assertion on both lanes, and pin the deliberately uniform workspace_note wording across the fs tools so a one-file reword cannot drift the copies apart.	2026-07-19 19:09:58 -07:00
Patrick Buckley	460308241d	fix(tools): lower working directory and workspace into fs tool descriptions ... The process cwd was nowhere in the model's context: shells start in the inherited process cwd (spawn_group_leader passes no cwd), relative file paths resolve against it, but nothing told the model where it was standing — in stock Docker every shell ran in /data while user files sat in the /workspace mount, and the model's only recourse was to probe with pwd (#857, #833). Lower both facts into the tool schemas, where they gate intrinsically on tool availability (a persona without fs tools carries no note, and coordinator envelopes are untouched): - tools/*.json: cwd_note/workspace_note metadata templates on bash, read_file, write_file, edit_file, search, diff_file; bash also states the fresh-shell-per-call semantics (cd does not persist) and drops a stale reference to the removed man tool. - tools.apply_cwd_context(): renders the notes into descriptions; deep-copies noted tools (the fs dicts are shared across TOOLS/INTERACTIVE_TOOLS/TASK_AGENT_TOOLS and aliased through merge_mcp_tools), passes note-less tools through by reference. - ChatSession._apply_cwd_notes(): wraps every fresh interactive build of _tools AND _task_tools (construction, MCP catalog change, MCP disconnect) — assignment-time, so the wire tools block stays byte-stable for provider prompt caches. os.getcwd() is OSError-guarded (MCP rebuilds run on a background thread; eval tears down its workdir); the workspace hint drops when the dir is missing or equals the cwd. Task-agent sub-agents carry their own notes via _task_tools, independent of parent persona visibility. - config.get_workspace_dir(): [tools] workspace_dir with TURNSTONE_WORKSPACE env fallback (searxng pattern), informational only — no chdir, no path confinement (per-workstream working-dir grants are a separate planned feature). - Dockerfile: ENV TURNSTONE_WORKSPACE=/workspace so stock deployments surface the mount with zero operator config. - docs/docker.md: document the /data working directory, the working_dir: /workspace compose override as the operator-level fix, and the SQLite-fallback-DB-in-cwd caveat. Closes #857	2026-07-19 19:09:58 -07:00
Patrick Buckley	1224b02d03	fix(compaction): review round 8 — seam obligations become primitives ... Eight rounds of findings against the defer-and-drain seam shared one generator: N sites each hand-copying M obligations (spawn discipline, the order-barrier pair, backpressure, best-effort emission, the client settle matrix), with every review finding an empty (site x obligation) cell. This round makes each obligation a single primitive: - The order barrier is Workstream.send_barrier_active() — one definition of the two-term pair (pending entries OR drain alive), consulted by the /send route, the coordinator adapter, and the queued-nudge wake gate, which previously carried only the list term and let a synthetic wake jump an acknowledged send during the claimed-entry window. _PendingSend moved to workstream.py beside the invariant that justifies the drain-alive term; the pending fields got precise types and worker_kind became a Literal, so a typo'd "command" comparison is now a type error instead of a silently never-firing defer guard. - _defer_send probes the barrier before constructing anything, bounds acceptance at 10 pending (the interjection queue's own backpressure contract — unbounded acceptance pinned message + attachment bytes per entry for a whole command window and then ran one unattended turn each), and spawns the drain with rollback: a Thread.start failure pops the just-accepted entry and answers the retryable queue_full instead of 500ing after registration (a phantom the client could neither see nor retract, dispatched later as duplicate turns). start() deliberately stays inside the lock, unlike session_worker's outside-lock discipline: this slot is is_alive()-gated, false for a constructed-but-unstarted thread, so an outside-lock start would open a double-drain window. - A /command whose worker never spawned answers 503 {"status": "error"} (spec + docs + a pane error arm) instead of the generic 200 ok that told SDK callers their /clear ran. - The compaction lifecycle emitter is raise-proof at its single dispatch tail: a raising duck-typed hook degrades to a lost render, never a lost end event — previously a raising on_error or a raising failed-end emit left every pane a frozen progress bar, and a raising SUCCESS end after the committed swap fabricated a failed end. - The client settle matrix lives once: composer_queue's settleSendResponse owns every /send response arm for both panes (the near-verbatim twins were already drifting), parsePriority is shared, and the busy stamp is centralized in setBusy(b, source) with "server" as the fail-safe default. Deferred sends release the composer (no worker exists for them; retracting the chip no longer strands the pane in Stop mode), queue_full on an idle-looking pane removes the optimistic bubble and restores busy (the refusal can now fire with no worker and no drain to ever emit a state event), and the pre-bind settle buffer is TTL-based — a burst of deferred dispatches parked this tab's own raced settle first, where the old size cap evicted exactly it. - The command backstop / console proxy timeout inequality is enforced by a test importing both named constants (both proxy_client constructions, startup and the mTLS re-create); the compaction card wears blue (magenta is reserved for the MCP surface); the redundant TerminalUI.on_compaction override is gone (the inherited protocol default is the policy site).	2026-07-17 11:28:44 -07:00
Patrick Buckley	fd5d3efb43	fix(compaction): review round 7 — drain crash/order/settle rows, protocol-default fallback, bool event-id guard ... Completes the defer-and-drain seam against the matrix rows round 6 never enumerated (the defer contract itself took no hits): - Crash row: a claimed entry survives a dispatch crash — the per-iteration handler re-inserts it at head (claim-flagged so a claim-section failure can't duplicate it), backs off ~1s, retries. The last-resort handler spawns no successor (Thread.start fails under the exact exhaustion that reaches it): the route's ensure-drain stays the single spawn site, so single-flight is structural and a dead drain revives on the next defer. - Order row: the pending list is the order authority. The /send route pre-checks pending/drain-alive under the same lock acquisition that appends (one _defer_send helper serves the barrier and command-window triggers); the coordinator adapter refuses via its return value; the queued-nudge wake gate yields to pending sends and is re-armed by the drain's clean exit — which covers lists emptied by pure retraction — as well as every deferred turn's exit; retry-after-rewind is a documented accepted overtake; init/create is fresh-ws-by-construction. - Client settle row: queued responses carry "deferred": true (SendResponse + regenerated openapi-server.json, status enumeration completed); bind(el, msgId, {deferred, attachedCount}) replaces the _deferredAttachments expando; the idle sweep skips deferred and unbound chips; the shared dispatch attempt emits pane-tier message_dispatched (folded: true for interjection fold-ins — the chip clears only its deferred flag and keeps a live x while DELETE still genuinely retracts); settles that beat bind() park in a bounded buffer; an idle-thinking pane retro-converts its optimistic bubble into a real queued chip instead of presenting a parked message as sent. Rejection polling waits on the slot flags — one dispatch attempt per slot-state change, not 4 Hz. - SessionUI.on_compaction's protocol stub became a real default body (the classic on_info rendering): explicit subclasses inherit protocol members as real methods, which defeated _compaction_event's getattr fallback for exactly the pre-1.8 embedders it serves. - _coerce_event_id() rejects bools (isinstance(True, int) is True) at all three duck-typed event-id coercions: the compaction marker stamp, on_system_turn's persisted return, and _ui_event_id. - Quick-command backstop 60s -> 25s, under the console proxy's 30s so the degraded "running" answer can traverse a proxied pane (which now surfaces it); /resume docs drop the fictional history SSE event (clear_ui + REST re-fetch is the contract); /send response docs match the wire.	2026-07-17 11:28:44 -07:00
Patrick Buckley	e99673eb0c	fix(compaction): review round 6 — defer-and-drain send windows, workstream-scoped notify, ERROR badge survives /compact ... Replace park-and-abandon /send semantics with defer-and-drain: a send landing in a command window is answered {status: queued, msg_id} immediately and dispatched full-fidelity by a per-workstream drain thread when the window closes. Parking encoded client disconnect as message retraction — true only for the composer's ✕-abort; every bounded caller (coordinator client and console proxy at timeout=30, SDKs, stock proxies) timed out and lost its message for the whole window, and the compensating client machinery was racy (one-shot sendAbortMs sample) and over-broad (_sendAbort fired on the interjection path, dispatching dismissed messages while showing a connection error). Dismissal is now uniformly bind() → DELETE, with a fall-through that retracts pending entries; retracting an attachment-bearing deferred send surfaces the discarded-attachments consequence. The drain claims entries under ws._lock immediately before dispatch (DELETE can never remove an in-flight message), refuses the truncating interjection fallback for oversized or attachment entries atomically inside the enqueue callback, and never gives up while the workstream lives; durability is documented as node-local at-most-once. sendAbortMs, _sendAbort, the 600s bound and the park loop are deleted; route and drain share one dispatch implementation (spawn metrics included). Also: the initial-send completion notify is un-gated from slot ownership (_fire_notify_targets has exactly one call site — successor turns never notify, so the round-5 guard prevented a duplicate that cannot exist while converting force-cancel into permanent notification loss for scheduled workstreams); /compact on an ERROR workstream restores the badge instead of stamping idle over it; duck-typed SessionUIs without on_compaction get the classic on_info lines back via a shared renderer (superseded OK ends included — a committed swap must never be silent; pre-1.8 SSE clients are deliberately not dual-emitted, documented as a 1.8 breaking change); failed-end notice suppression is computed once by the emitter as a notice bool on the end event (SDK py+ts), replacing the hand-synced cli/JS policy while the panes keep their pane-local card-ownership clause.	2026-07-17 11:28:44 -07:00
Patrick Buckley	1dbf7f410c	feat(compaction): lifecycle events, web progress card, history re-render ... Compaction becomes visible: a first-class 'compaction' SSE lifecycle (start/progress/end, compaction_id-correlated, superseded-flagged ends) replaces the loose info lines; both web panes render a progress-bar card that settles into a persistent result card, re-rendered after reload via the /history projection of the compaction marker row. Slash commands echo as command chips instead of fake user turns. The enabling rework: /command dispatches onto the workstream worker slot (the old inline path blocked the node's event loop for whole compactions and let /clear interleave with live turns). Busy refusals answer 409; quick commands are awaited loop-natively with a 60s backstop; /compact is fire-and-forget. Sends during a command window park in the /send route and dispatch full-fidelity afterwards — the interjection queue (length cap, cross-user guard, identity-swap hazards) is unreachable there — with a compaction-aware client abort bound shared by both panes. compact_now() carries send()'s full generation discipline; Stop aborts the in-flight summary HTTP stream via a generation-scoped cancel ref; force-abandoned compactions retire at their next checkpoint and their stragglers are fenced off every surface (panes, pill latch, CLI). Every session retry backoff is cancel-aware via one shared helper. Docs, OpenAPI spec, and both SDKs updated. Verified: 9457-test non-live suite, JS pin suites, headless-Chrome reducer harness; five unprimed multi-agent review rounds (correctness trend 15/6/6/4/4) with plan-level design passes on every fix round.	2026-07-17 11:28:44 -07:00
Patrick Buckley	f8f191686f	fix(mcp): review round 2 — busy-skip the refresh pass, fail-fast list pairs, health-tick refresh retry ... - _refresh_server never parks on a held connect lock: the holder is itself a catalog publisher whose publish supersedes the pass, and parking burned refresh_sync's whole 30s budget on ONE busy server (a reconnect attempt holds the lock up to 45s), failing the operator pass for every healthy server queued behind it. Busy → skip (None), no publish, no status writes; the identity/state recheck stays as belt-and-braces for the one-tick check→acquire race. - _list_resource_pair: the ONE copy of the paired resources/templates list protocol (both twins). Fail-fast — a fast real error (auth / method rejection) surfaces as ITSELF instead of being masked behind a hung sibling's eventual 30s TimeoutError — with the survivor CANCELLED and REAPED inside the timeout scope, never left detached on the shared session. - Health-tick refresh retry: there is NO periodic refresh pass (removed in eb2a119d; the docs still claimed the 4h tier — fixed), so a push refresh that failed while the transport stayed up had no automatic recovery and the shared catalog stayed stale for every user until an operator intervened. Failures and busy-skips arm _static_refresh_retry via the shared recorder; the health tick drains it with one bounded, lock-serialized full pass per tick; success, session drops, removal, and the post-reconnect spawns clear it. This also un-latches the error pill: the retry's completion clears it within a tick. - _record_refresh_failure: the bearer-redaction policy (type + message, never exc_info) lives exactly once; all three refresh-failure sites route through it. - Static runner discards its coalesce marker only AFTER the lock-identity check: on the superseded path a marker present in the set belongs to the re-added generation's parked runner, and discarding it would mint duplicates past the one-parked-runner bound (the pool runner deliberately differs — nothing else clears pool markers, so its marker is its own to release). - _clear_static_push_state: the ONE (server, kind) keyspace walk for stamps + retry flag (+ markers on removal). - Tests: busy-skip, superseded-no-status, fail-fast + reap (<5s bound), retry arm/drain/re-arm/clear quartet, logged-wrapper contract updated to the shared recorder's arg shape; vacuous stamp-math test deleted (behavioral per-kind coverage retained); _free_port/_wait_tcp_ready/_wait_session_live hoisted to conftest for both live tests. Refs #839	2026-07-14 11:39:25 -07:00
Patrick Buckley	747177a76c	fix(providers): review round 9 — orphan/harvest collision, shared shim gate, retired-id rationale ... Correctness: - Responses: orphan argument deltas (streamed without any output_item.added) now count as a streamed tool-call signal, so the terminal harvest stands down instead of re-emitting the same call onto the same slot — the reproduced collision concatenated the arguments JSON into an unparseable double copy. Cleanup / documentation: - finish_shim_due in _protocol is THE gate for the lax-server finish shim — one predicate (and one definition of 'delivered output') for all three adapter families, so the same capability flag cannot acquire per-family completion semantics. - The Responses error/response.failed branches share one failure tail (only code/message extraction differs) — the same server failure can never become retryable through one event type and fatal through the other, pre- or post-terminal. - _format_refusal pins the refusal rendering the streamed event and the terminal harvest both use. - The capability-table floor comment and CHANGELOG Removed entry now state the real rationale: OpenAI has RETIRED the pruned ids from the API — the rows described unreachable contracts, not unpopular ones. - CHANGELOG names the stream-entitlement break class (verified-org streaming, pre-stream_options gateway api-versions) with its serving-side remediation; deliberately no non-streaming fallback. - docs/architecture.md retry section describes the collapsed transport: the two stacked retry ladders, IncompleteStreamError / ResponsesStreamFailedError retryability, finish_reason_optional remediation; stale non-streaming mentions updated (+ puml). - Anthropic whole-block emission carries its residual hybrid-gateway bet as an explicit comment. Held on standing rulings: post-finish usage forfeiture (keep result + warn, rounds 4/8), session merge_usage twin and StreamAbortRef twin (#832), stream_options wire delta (round 2, caveat now names Azure).	2026-07-13 22:39:19 -07:00
Patrick Buckley	3ffa8b9057	fix(providers): review round 2 — complete-or-error drain, code-gated retries, truncation-safe blocks ... Correctness (3 confirmed + 2 plausible, all fixed): - drain_stream now raises typed, retryable IncompleteStreamError when a stream exhausts without any finish reason — every adapter emits one on a healthy stream, so its absence means the generation died mid-response behind a cleanly-closing proxy. This restores the retired transport's complete-or-error contract (a half-generated compaction summary was previously returned as finish=stop and stored, silently replacing real history) and DELETES round 1's suffix-info fold: with no finish-less success path there is nothing to classify, so a trailing status ping can never be stored as content either. - Index-degenerate parallel tool calls get distinct slots: a delta whose id differs from its slot's opens a new call (id-less fragments still follow their index's current call), so historical compat servers that emit every parallel call at index 0 no longer fuse distinct calls into concatenated garbage arguments. Result order stays index-sorted (stable) like the retired array parse. - response.failed retryability is code-gated: only transient codes (server_error, rate_limit_exceeded) raise the retryable typed error; deterministic rejections (invalid prompt, image fetch, policy) raise plain RuntimeError and stop retry loops on attempt zero instead of running the full backoff ladder against a doomed request. - Terminal Responses events rebuild provider_blocks from response.output when present: the item being generated at max_output_tokens truncation never receives output_item.done, and storing a reasoning item without its required following item made the next turn's replay a 400. - merge_usage's base case uses dataclasses.replace so a future UsageInfo field can't be silently zeroed on drained lanes. Cleanup: run_abortable_with_deadline bundles the three-point abort wiring (ref + cancel_ref + on_abandon) so it cannot be half-wired — both judges converted; scripted_chat_client hoists the 14 chat-lane fake_create closures (call scripts + .calls recording replace per-test counter cells); fake_chat_stream gains reasoning=, collapsing the reasoning-capture suite's hand-rolled chunk shape; FakeAnthropicBlock hoists the duplicated _Block test class; the class and judge PlantUML diagrams drop the retired create_completion flow. Also converts test_model_registry's agent-model fakes, which returned legacy response objects that iterated as EMPTY streams — they only passed through the old drain's silent finish=stop default, exactly the hazard the new gate exists to catch.	2026-07-13 22:39:19 -07:00
Patrick Buckley	08580f25f9	fix(providers): review round 1 — streaming parity gaps the collapse exposed ... Correctness (4 confirmed + 1 plausible fixed, 2 accepted+documented): - Anthropic _iter_anthropic_stream handles citations_delta: text-block citations now ride the raw block into provider_blocks, as replay requires (the retired non-streaming lane preserved them via model_dump; the streaming lane dropped them — a pre-existing main-loop gap the collapse would have extended to single-shot lanes). - Anthropic text blocks separate with "\n" at each subsequent block start, restoring the retired lane's "\n".join rendering on drained lanes AND un-fusing streamed web-search responses in the chat loop. - response.failed raises typed ResponsesStreamFailedError, listed in the provider's retryable_error_names — retry loops treat an in-band failure like the wire errors it stands in for instead of hard-stopping on a bare RuntimeError (judges keep their heuristic fallback after retries). - drain_stream folds a finish-less stream's terminal citations footer (suffix rule: pre-finish info invalidated by any later payload), so lax compat servers that never send finish_reason keep their Sources. - usage max-merge extracted as merge_usage() in _protocol.py — the one definition drain uses now and the session's inline consumer adopts on #832. Accepted + release-noted instead of coded around: strict pre-2024 compat servers that 400 on stream_options (such a server already cannot serve the chat loop; CHANGELOG caveat extended), and repeated-index parallel tool-call merging on legacy compat servers (identical to the main loop's accumulator semantics; a shared guard belongs in the #832 unification). Cleanup: run_with_deadline grows on_abandon (best-effort, cannot mask the deadline error) and both judges drop the copy-pasted abort choreography; StreamAbortRef documents the _CancelRef adoption plan; test_model_turn's fake replays through the shared as_stream adapter; docs/architecture.md drops the retired Protocol row. Tests: refusal handler pinned (was advertised, untested); typed-failed retryability; citations capture; text-block separator (plus the mixed text+search expectation updated for the separator chunk); finish-less citation fold; on_abandon firing matrix; StreamAbortRef arrival race.	2026-07-13 22:39:19 -07:00
Patrick Buckley	9391509e85	fix(oidc): trust Entra's graph.microsoft.com userinfo out of the box ... Microsoft Entra's discovery document advertises userinfo_endpoint on graph.microsoft.com — a host distinct from the login.microsoftonline.com issuer — so discover_oidc's cross-host guard rejected it and disabled OIDC unless the operator set trusted_endpoint_hosts. Add login.microsoftonline.com to the built-in KNOWN_TRUSTED_OAUTH_ENDPOINT_HOSTS allow-list (mirroring the Google entry) so Azure AD OIDC works with no extra configuration. Surfaced by the live obo integration test.	2026-07-12 19:03:35 -07:00
Patrick Buckley	d2e69ca527	fix(mcp): coherent obo auth-type carry-over + honest error affordances ... Round-2 review follow-up. The headline is a redesign of the OAuth column carry-over so scopes/audience can no longer leak or vanish across an auth-type flip: - oauth_audience and oauth_scopes keep their meaning only WITHIN an auth type (a resource indicator vs. an IdP app id; AS-consent scopes vs. an rfc8693 exchange scope). On any oauth_user<->oauth_obo flip they are now recomputed from the request (present -> value, absent -> NULL) and never carried from the old row. A shared _oauth_columns_to_clear policy drives both the create and update handlers. No-op normalization of a re-sent equal value applies only to same-type edits. - The console form clears both semantic fields when the auth type changes and always submits the visible values; the previous "omit unchanged scopes" logic collided with the backend's flip handling and could silently drop or carry scopes. Write-time validation now rejects oauth_obo rows that can never mint — OIDC disabled/unconfigured, or an invalid obo_grant_profile — instead of letting them surface per-dispatch as a retryable transient that never heals. Honest failure affordances for sign-in passthrough (no per-server consent flow exists): - the token_revoked audit fires only when a row was actually deleted, so a permanent mint rejection against a surviving credential no longer appends a bogus revocation on every post-cooldown dispatch/prime; - the 403 insufficient-scope detail and the chat error card's action button are now auth-model-aware — obo errors point at the administrator rather than a dead-end re-consent, and the Connect button renders only when a real consent URL is present; - the read-side freshness gate now enforces scopes as well as audience, so an rfc8693 scope narrowing takes effect on the next dispatch even if the best-effort admin cache purge failed. Cleanups: the five decrypt-failure result constructions collapse into _decrypt_failure_result; the cleared-pairs TTL bookkeeping into _mark_pending_consent_cleared; drop the dead USER_SCOPED_AUTH_TYPES re-export from mcp_oauth; correct the now-bidirectional oidc<->mcp_oauth lazy-import note. Docs updated for the flip semantics and the OIDC prerequisite.	2026-07-12 19:03:35 -07:00
Patrick Buckley	32c76499fa	fix(mcp): harden obo mint path and admin lifecycle after review ... Mint engine: guard the credential-rotation persist so a storage blip cannot escape the classified-result contract mid-mint (and cannot brick the user's other obo servers on strict-rotation IdPs); stop borrowing the login flow's httpx client across event loops — mints use a transient per-request client (obo_http_client remains as a test seam); retry OIDC discovery at runtime (cooldown-gated, single-flight) so a node that booted during an IdP outage can mint again without a restart; key the under-lock force-refresh reuse gate on created, which delete+create makes the mint time (obo rows never set last_refreshed, so the copied oauth_user gate never fired and serialized waiters each re-redeemed). Cross-node consent badges: the cleared-pairs set becomes a TTL map with bounded growth, so a badge written by another node after this node's last clear self-heals within one TTL window instead of surviving until a restart. Admin lifecycle: purge the mint cache when oauth_scopes changes on an obo row (an rfc8693 privilege reduction now applies immediately, like audience changes); normalize no-op scope/audience re-sends out of updates — the admin form re-submits pre-filled fields on every save, which both re-triggered purges and made entra-profile rows with legacy scopes un-editable; make flip-into-obo scope handling grant-profile aware (entra clears the carry-over, rfc8693 honors the request); clear obo-era audience/scopes when flipping back to oauth_user (the IdP-side app identifier is not a resource indicator); mirror the same column policy in the create handler. Revocation honesty: hide obo mint-cache rows from the user connections list and refuse the per-server disconnect with 409 — deleting the row returned 204, audited token_revoked, and then session-start priming silently re-minted from the surviving captured credential. Console form: keep the audience-from-URL autofill off for sign-in passthrough (the audience there is an IdP application identifier, and the prefilled URL passed every validation layer then failed every mint); clear the autofill artifact when switching modes; omit unchanged scopes from submissions. Dispatchers: route tool/resource/prompt through one shared lookup-error mapping and an auth-model-aware 401-exhausted detail (obo users are no longer pointed at a consent flow that does not exist). The consent-url audit count drops 13 → 7: the three per-dispatcher mapping copies collapsed into _pool_lookup_error. Priming: skip all obo servers for users with no captured credential via one existence SELECT (previously three reads per server per session). Also: USER_SCOPED_AUTH_TYPES now lives in storage._protocol so the backend SQL predicates share the application layer's set; docs describe the actual purge-on-transition behavior (the orphan-and-reactivate claims were wrong); the entra e2e setup script no longer aborts silently under set -e with suppressed stderr.	2026-07-12 19:03:35 -07:00
Patrick Buckley	891c8b1785	docs(mcp): operator guide for oauth_obo single-credential sign-in passthrough (slice 5) ... Adds the oauth_obo section to docs/mcp-oauth.md: - when to use it vs oauth_user (mode table row) - deployment config ([oidc] capture_user_credential + obo_grant_profile, encryption-key requirement) - per-IdP setup: Entra (delegated permissions + admin consent, plus the verified admin-consent-propagation AADSTS65001 gotcha) and Keycloak RFC 8693 (standard token exchange + audience client scopes) - revocation & custody model: identity-unlink cuts a user off (credential + cache purge); flush-cache is an honest re-mint, not a revoke; per-server revocation is IdP-governed - auth-type-transition + troubleshooting table rows for obo - interim #682 note (Entra pre-authorized-clients removes the second consent for plain oauth_user, tenant-config only) Refs #551.	2026-07-12 19:03:35 -07:00
Patrick Buckley	6a94dc1d57	fix(judge): thread model-definition capabilities into judge completions ... The intent judge and output-guard judge were the only create_completion callers that never passed model-definition capabilities, so operator-declared capabilities (effort passthrough, tool support, temperature, verbosity) were silently ignored on judge calls. Every in-ChatSession lane threads them via _resolve_capabilities; the judges live outside the session and never reached it. Add a shared _resolve_model_capabilities() helper mirroring ChatSession._resolve_capabilities, and have both judges resolve self._capabilities — from the judge alias's model definition, or the injected session capabilities on the session-model fallback — and pass capabilities= into create_completion. Replace each judge's context_window int arg with session_capabilities: the fallback window now derives from the resolved caps (identical to what the session passed before), while the alias path keeps reading ModelConfig.context_window, a separate field the capability merge must not touch. Refresh the stale docs/judge.md note claiming sub-agents are exempt from intent validation — task agents have been judge-gated since #773. Refs #823	2026-07-11 17:53:24 -07:00
Patrick Buckley	03861e0cf5	feat(console): verbosity and reasoning-mode controls in the model shelf ... - capability-gated "Response controls" on the Models create/edit shelf: Output verbosity (low/medium/high) and Reasoning mode (Standard/Pro), shown only for Responses-surface models; the empty selection means provider default and omits the capability key - values lift out of the capabilities JSON into the selects on edit and merge back on save with identity tracking, so changing the provider/model/surface resets them instead of carrying a value across models; the Advanced JSON textarea wins unless the select was touched last - known GPT-5.6 models inherit support from the static table without persisting redundant support flags; OpenAI-compatible models pinned to the Responses surface opt in via the supports_verbosity / supports_pro_mode tiles - invalidate in-flight capability lookups on any identity field change and on modal open so a stale response cannot clobber a fresh shelf; API-surface changes now run the full field-change path - model list rows surface verbosity= / mode= override chips	2026-07-10 15:59:40 -07:00
Patrick Buckley	b450b9ad20	fix(providers): align GPT-5.6 with the GA API surface ... - every 5.6 tier accepts effort "max" and reasoning.mode "standard"/"pro" (GA docs: pro is a request mode on any GPT-5.6 model) -- drop the Sol-only gating - GPT-5.6 deprecates prompt_cache_retention; send prompt_cache_options={"ttl": "30m"} (its only supported lifetime) and keep the 24h retention policy for pre-5.6 models - never inject commercial cache params into local lanes: dropped from the Chat Completions lane (which serves only openai-compatible and google) and gated off the compat-pinned Responses lane -- a gpt-5* served-model name is not an OpenAI account - account cache writes: usage *_tokens_details.cache_write_tokens flows into cache_creation_tokens (5.6 bills writes at 1.25x the uncached input rate) - drop non-string verbosity/reasoning_mode overrides with a warning instead of raising on unhashable capability-JSON values - keep ModelCapabilities' public positional prefix stable by appending the verbosity/pro fields at the tail; pin it with a constructor test - openai floor 2.44 -> 2.45, the first release with the typed prompt_cache_options kwarg	2026-07-10 15:59:40 -07:00
Patrick Buckley	e60c19befd	fix(watch): harden nudge/wake delivery across eviction, cancel, and identity rebinds ... Wake path: - Denial metacog nudge moves to the tool channel so it drains with the denied tool batch instead of the next user-message seam. - wake_workstream_if_pending: shared wake gate for watch fires on already-idle workstreams (no IDLE transition for the watcher to observe), wired as wake_fn at every set_watch_runner site via the shared _watch_fire_wake_fn helper (closes over the Workstream OBJECT — after eviction+restore an id-keyed manager lookup would miss). - session_worker exit backstop re-runs the wake gate the moment worker ownership clears: IDLE fans out on the worker thread, so transition-time wakes always landed on the reuse path and no-op'd (the coordinator idle_children strand). - deliver_wake_nudge_from_queue contains GenerationCancelled — it is the wake worker's run() closure and only Exception is caught downstream. Watch delivery: - Terminal fires that cannot reach their workstream are HELD and redelivered on min(interval, 60s) without re-running the command, bounded by MAX_DELIVERY_ATTEMPTS per cycle and the watch's own max_polls across cycles; the poll charge commits durably at hold time so restarts stay budget-bounded. - Restore admission control: per-ws dedup + MAX_CONCURRENT_RESTORES cap, presence-only re-check under the lock, detection-only stall alerts (reclaiming a wedged admission would trade capped degradation for total poll-pool collapse). - Permanent-vs-transient restore taxonomy: corrupt persona stamp and genuinely-missing history (confirmed by a raising storage probe — the resume loader swallows read blips into []) deactivate the watch immediately; everything else holds and retries. - Cancel-race defense: delivery paths re-check is_watch_active before stashing/dispatching, cancel paths write the row BEFORE forget_terminal_dispatched, the HTTP cancel endpoint clears runner state, and a per-tick sweep bounds the residual stash-after-clear interleaving to one check_interval. - Abandon/exhaustion commits are write-then-clear so storage that can read but not write retries the row write instead of re-running the command every cycle; the fresh-fire unrestorable path stashes before its deactivation write for the same reason. Registry follows identity: - The dispatch registry is keyed by _ws_id at registration time; every rebind now moves it: non-fork resume() and /new go through _follow_watch_registration (new key live before the old is removed, never stealing a registration another live session holds), removals are owner-checked so tearing down a watch-restore shell or a resumed-away session cannot unregister a live pane, the restore shell yields to a registration that appears mid-restore, CLI --resume registers after the successful resume, and both the open path and the detail-GET lazy rehydrate wire the registration. Teardown gating and backpressure honesty: - cleanup_session_ui marks ws._closed FIRST under ws._lock — every teardown path (close, close_idle, evict, delete, discard) funnels through it — and session_worker.send re-checks under the same lock, so a wake can never spawn a worker on a torn-down workstream. - Create responses carry initial_message_status when the initial message could not be delivered (queue_full / refused_closed) instead of reading as success; staged attachments survive for the retry; /send surfaces a closed workstream as 404 rather than queue_full. Docs/spec: OpenAPI artifacts regenerated; api-reference documents the new create-response field; TS SDK type extended. Tests: ~30 new pins (cancel races, budget durability across restarts, owner-checked registry moves, teardown gating, stall alerts, backpressure surfaces, wait_until final re-check); wide subsystem sweep green (2353 passed).	2026-07-07 16:42:36 -07:00
Patrick Buckley	09abc9d199	feat(tools): allow_private_network opt-in for private-address fetch/preview ... turnstone's primary audience self-hosts it beside other lab services — a web_fetch or open_preview aimed at Grafana, Home Assistant, or a dev node on the local network is the operator using their own network, not an attack. The hard SSRF refusal made those targets unreachable. New runtime setting tools.allow_private_network (settings registry, default off, rendered in console Settings → Tools; hot — read per tool call, no restart). When enabled, a call NAMING a private address becomes approvable: the approval prompt tags it "(private network)" so the operator approves it as what it is, and the human gate stays. The redirect side-door stays closed either way: a PUBLIC target that 302s into private address space is refused regardless of the opt-in — that address never appeared on the approval card, so it is never fetched. Only a chain whose approved origin was itself private skips hop screening (its redirects are the operator's own network). Refusals now teach the knob (mirrors the oidc opt-in hint): the error names tools.allow_private_network and where to enable it. Surfaces without a ConfigStore (bare CLI, eval) stay strict — there is no admin surface to have opted in on.	2026-07-07 08:20:57 -07:00
Patrick Buckley	1e2ab91ec2	feat(preview): probe preflight, legacy charsets, remote-assets opt-in, md vendor parity ... Four follow-ups to the preview pane: - Probe-mode preflight: the pane preflights src-loaded kinds with GET ?probe=1 (204, real hardening headers, no body) instead of HEAD — the console reverse proxy forwards HEAD as a full GET, so the old preflight dragged the whole blob across the node→console hop twice. Ownership gate + renderable-type check still run on probes. - Legacy-charset text: table/text/markdown now transcode to UTF-8 at store time (declared charset → UTF-8 → cp1252-replace ladder), same model the web kind already used. The ladder applies only when the text kind was DECLARED (MIME/extension/override); the bare no-hint fallback stays strict UTF-8 and NUL bytes still hard-reject, so binary rejection is unchanged. - Remote assets default OFF: previewed pages are now served under "sandbox; default-src 'none'; style-src 'unsafe-inline'; img-src data:; font-src data:" — they render with inline styling but cannot contact their origin site (no viewer IP/traffic disclosure). A per-pane "Load remote images & styles" checkbox (web previews only, sticky, not persisted) reloads with ?assets=1 for the permissive bare-sandbox mode. - Markdown vendor parity: preview markdown now runs renderer.js's postRenderMarkdown (hljs token coloring + lazy mermaid diagrams) like the conversation pane, with preview-scoped code-block/KaTeX chrome (the conversation theme is .msg.assistant-scoped). Tests: probe/assets HTTP + policy coverage, charset ladder units + stored-bytes round-trip, JS static guards for the probe form, the default-off toggle, and the post-pass; headless-chrome harness grew to 41 assertions (probe-not-HEAD, toggle visibility/default, fenced-code render). Full suite green.	2026-07-07 08:20:57 -07:00
Patrick Buckley	e010124008	feat(preview): rich preview pane + open_preview tool ... Tool results only ever rendered as plain text in the transcript. This adds the model-driven rich-preview lane every comparable surface has, in turnstone's developer-tool idiom: a preview pane that opens BESIDE the conversation, keyboard-operable, sandboxed, never replacing the transcript that spawned it. Backend - New built-in open_preview(target, kind?, title?): resolves an http(s) URL, a file path, or attachment:<id> to bytes; classifies into web/pdf/image/table/text/markdown (magic bytes > MIME hint > extension > UTF-8 fallback, legacy-charset pages transcoded); caps size per kind; persists content-addressed with kind="preview" — refcounted and GC'd with the workstream, skipped by trajectory reconstruction so preview bytes can never materialize onto the wire. URL targets gate like web_fetch (network egress); paths/attachments run unprompted like read_file. - New core.web.fetch_with_ssrf_guard: manual redirect walk that SSRF-screens every hop BEFORE requesting it (follow_redirects=True checked nothing between hops); adopted by both open_preview and web_fetch. URL userinfo is stripped before the descriptor or the stored bytes see it; <base href> is injected doctype-safely so relative assets resolve without quirks mode. - The preview descriptor rides the tool turn's meta side channel with ONE shape on every boundary: the live tool_result SSE event, the conversations.meta column, and the /history projection. Cancelled batches commit an already-announced preview (blob + meta) instead of stranding the open pane on a permanent 404. - New GET {ws}/attachments/{id}/preview (read scope, same ownership gate as /content) serves the STORED type with per-MIME hardening: bare CSP sandbox for text/html (renderable, scriptless, opaque origin), no CSP for application/pdf (Chromium's viewer refuses sandboxed contexts), full default-src 'none' otherwise; filenames fold to latin-1-safe ASCII. The console /node proxy now forwards CSP/nosniff/disposition/cache-control instead of dropping them. - History loads exclude preview blobs from the bulk content fetch at the query (they were read and discarded on every load). Frontend - New "preview" pane type registered in the shared shell (server + console): openPaneBeside placement, per-kind renderers — fully sandboxed iframe for pages, browser PDF viewer, sortable tables (CSV/TSV/JSON, ragged-file safe, 5k-row cap), rendered markdown, text — plus back/forward history with arrow keys, reload persistence via pane meta, and backoff auto-retry (0.9s..7.2s) bridging the gap between the live descriptor and the batch fold that commits its blob. - Tool results carrying a descriptor render a credential-redacted preview chip (the reopen + replay affordance); live results auto-open the pane only while the originating pane holds focus. Docs: docs/tools.md + prompts/tools.md. Tests: policy unit tests, tool prepare/exec (mocked fetch), serving route + proxy header pass-through, storage exclusion on both backends, cancel-path commit, JS static guards; a headless-Chrome harness drives the real module graph (32 DOM assertions).	2026-07-07 08:20:57 -07:00
Patrick Buckley	9c74673fd4	feat(oidc): allow_private_network opt-in for self-hosted IdPs ... The SSRF guard on OIDC endpoint URLs hard-refused any hostname resolving to a non-public address, which made it impossible to use a self-hosted IdP (Keycloak, Authentik, Dex) on an internal network — even though the login-flow issuer is operator-configured, i.e. trusted input. Add [oidc] allow_private_network in config.toml (or TURNSTONE_OIDC_ALLOW_PRIVATE_NETWORK), default off. When set, the issuer and its discovered endpoints may resolve to private-range, unique-local, CGNAT, and loopback addresses. Link-local, multicast, unspecified, and reserved ranges stay refused regardless — cloud metadata services live on link-local and no legitimate IdP does. The HTTPS requirement and same-origin endpoint checks are unchanged. The private-address refusal now raises OAuthSSRFPrivateAddressError, and the OIDC wrapper appends the remediation hint to the error message so the failure is self-service. mcp_oauth call sites — where endpoint URLs come from untrusted remote-server metadata — do not get the knob and keep the strict public-address rule.	2026-07-06 21:52:42 -07:00
Patrick Buckley	457b01737a	feat(personas): agent discoverability + forgiving name resolution ... Coordinators and interactive agents had no way to enumerate valid persona names: task_agent / spawn_workstream / spawn_batch described `persona=` but nothing listed what it accepts, and resolution was an exact case-sensitive slug match - users reaching for the display name or a case variant got an unexplained failure. - Inject the live persona catalog (enabled, interactive-kind; children and sub-agents are always interactive) into the `persona` parameter description of task_agent / spawn_workstream / spawn_batch, riding the same render path as the model-alias injection. Rebuilt from the pristine TOOLS base every render, so repeated renders are idempotent and archived personas drop out instead of lingering. Entries carry name + default marker + <=96-char description; names-only past 25 personas. spawn_batch's persona property is nested per-child under children.items.properties (located via _persona_property, null-safe against name-colliding MCP tools). Storage-less sessions keep the base text: the render runs at session construction, so it gates on is_storage_initialized() rather than get_storage(), which would auto-init SQLite as a side effect. - resolve_persona_for_kind - the ONE shared rule behind the HTTP create handler, CLI --persona, the coordinator spawn precheck, and task_agent prep - is now forgiving: exact slug, then the lowercased input (created names are regex-enforced lowercase slugs), then a case-insensitive display-name match accepted only when unique among the kind's enabled personas. Duplicates refuse loudly naming the candidate slugs; a same-label persona of another kind neither blocks nor wins (the label the caller saw came from a kind-filtered surface); whitespace-only input never matches blank display names (display_name defaults to ""). Every failure now enumerates the kind's valid names, so a stale injected list or a typo self-corrects on the next attempt. - The canonical slug is stamped everywhere: task_agent prep rewrites its arg from the resolved snapshot, _validate_child_persona returns (canonical, error) and both spawn call sites adopt it - approval chrome, the wire, and workstream_config never carry a forgiven variant. - Create-persona shelf: label hint under Name explaining agents and the CLI launch the persona by this name (case-insensitive) and the display name is only a list label. docs/personas.md gains a "How agents discover personas" section and drops the stale claim that task_agent has no persona parameter. Tests: resolver unit suite (case/display/ambiguity/cross-kind/ whitespace/disabled/storage-failure) + guards for injection content and ordering, idempotent re-render, archive drop, the 25-persona prose cutoff, coordinator-kind exclusion, and canonical stamping through spawn_workstream / spawn_batch / task_agent.	2026-07-06 19:58:36 -07:00
Patrick Buckley	1035fe05eb	fix(console): effort annotations say in plain words what the request carries ... Aliased knob positions were labeled after the lowest sibling sharing their wire token — a toggle-only model rendered 'Max (= minimal)', implying a minimal-effort downgrade the wire doesn't contain, and with declared values 'High (= minimal)' while the wire carries high. Each position now states its delivered level: exact matches stay plain ('Max'), snapped positions say 'Low — sends high', the adaptive none position warns 'thinking stays on', budget detail stays in the tooltip. Effort-param placeholder corrected to the real graded keys (reasoning_effort / reasoning).	2026-07-05 01:59:38 -07:00
Patrick Buckley	530958e06b	fix(providers): the session effort level always reaches the local-lane wire ... Local lanes dropped the knob's graded value unless the operator declared reasoning_effort_values (and, on the template channel, an effort key) — picking Max sent a bare thinking toggle and the effort select degenerated into seven positions that all meant 'on'. The user's setting now always rides: - openai-compatible: the flat reasoning_effort param carries the knob verbatim (effort_passthrough on the lane default); declared values still snap ordinally, and a declared effort_param still claims the template channel and suppresses the flat param. - anthropic-compatible: the graded value rides chat_template_kwargs alongside the toggle whenever reasoning control is engaged — under the operator's effort_param, else the conventional fallback key (reasoning_effort); templates that don't reference the kwarg ignore it. thinking_mode=none still injects nothing. - Commercial lanes untouched: empty declared values still mean 'no effort control' (o1-mini) and the ordinal snap is unchanged. Golden writer now pins ensure_ascii=False: the baselines' literal em dashes came from a hand edit (03f82521) the default-escaping writer could never reproduce — regens no longer churn unrelated lines.	2026-07-05 01:59:38 -07:00
Patrick Buckley	e136237b63	fix(providers): openai-compatible never consults the commercial table ... Local-lane model ids are operator-chosen strings (vLLM --served-model-name), so a prefix collision with a cloud model id inherited that model's sampling and effort contract: a box named o3-distill silently lost temperature support, and one named gpt-5.5-my-finetune was sent gpt-5.5's snapped reasoning_effort values it never declared. Both surfaces of the lane now return plain defaults (OPENAI_COMPAT_DEFAULT in _openai_common): the chat class directly, and the responses pin via a compat-mode OpenAIResponsesProvider mirroring AnthropicProvider(compat=True). Everything beyond the defaults is declared by the operator on the model definition, matching the anthropic-compatible lane and lookup_model_capabilities' documented 'no static table for local models' contract. The commercial openai lane (Responses-only) is untouched. Pre-split tests that reached commercial rows through the chat-class OpenAIProvider alias now source them from lookup_openai_capabilities; their subject (registry rows + shared gating helpers) is unchanged.	2026-07-05 01:59:38 -07:00
Patrick Buckley	3607517814	fix(providers): registry effort truth — o-series/gpt-5.5/codex-max/sonnet-5; forward declared none ... Capability-registry corrections verified against the official OpenAI reasoning guide, the Azure reasoning-models matrix (2026-06 revision), and the Anthropic models-overview/effort/migration pages (2026-07): OpenAI (vocabulary confirmed none/minimal/low/medium/high/xhigh — no "max" level exists; knob max rides the xhigh ceiling via the ordinal snap): - o1/o3/o3-mini/o3-pro/o4-mini declare low/medium/high (every o-series model except o1-mini) — without declared values the session knob was silently dropped for these models. o1-mini stays effort-free. - gpt-5.5 default corrected none -> medium (5.5 reasons by default, unlike 5.1-5.4). - gpt-5.1-codex-max gets an explicit row: it prefix-matched the gpt-5.1 row (no xhigh), capping the knob's xhigh at high on the one model xhigh was introduced for. Anthropic (effort-page matrix): - claude-sonnet-5 row added — it previously fell through to _ANTHROPIC_DEFAULT (manual budgets, 200k ctx, no effort), all wrong: adaptive-by-default thinking (manual budgets are a 400), sampling params rejected, 1M ctx / 128k out, effort low..max incl. xhigh. - claude-sonnet-4-6 gains its documented "max" effort level (knob xhigh now rides max, not high) and the stale 64k max_output becomes the documented 128k. - fable-5 / opus-4-8 / opus-4-7 / opus-4-6 / opus-4-5 rows verified correct as declared. Knob semantics completed: resolve_reasoning_effort now forwards the knob's "none" position verbatim when the model DECLARES an explicit none level (gpt-5.1+, grok-4.3) — omitting the param there leaves a reasoning-on server default (gpt-5.5: medium) in charge of a knob that promises off. Models without a declared none still omit, and none is never a snap target. Parity harness swaps its synthetic openai shape for the real gpt-5.5 registry row.	2026-07-04 20:54:20 -07:00
Patrick Buckley	a0e04a8588	fix(providers): effort snapping is ordinal — round up, cap at the ceiling ... The knob domain grew xhigh/max after the snapping fallbacks were written, which silently inverted their semantics: off-list meant "unrecognized string" then, but now usually means "above the model's ceiling", where falling back to the default tier is directionally wrong (grok-4.3 at knob max got low; values low/medium/high at knob xhigh got medium; Anthropic manual mode gave xhigh/max a 4096 budget while high got 16384). One rule everywhere now, via snap_reasoning_effort in _protocol: exact match wins; otherwise the smallest declared level ranking at or above the knob; above the ceiling, the ceiling. "none" is never a snap target, and default_reasoning_effort only catches values the ordinal snap cannot rank. - resolve_reasoning_effort (flat chat / responses / validated effort_param lanes) snaps ordinally: xhigh over (low, medium, high) now sends high; xhigh over DeepSeek-style (high, max) sends max — matching DeepSeek's official xhigh-to-max aliasing, so a declared values list now reproduces that contract instead of defeating it. - _map_reasoning_to_effort (native output_config) rounds up too: knob xhigh on Opus 4.6 (low, medium, high, max) rides max instead of silently dropping output_config. - EFFORT_BUDGET_MAP is monotone across the whole knob domain: minimal/low 1024 (API floor), medium 4096, high 16384, xhigh 32768, max 65536. Unknown strings still fall to the 4096 default. Google defaults are unaffected (ceiling and default coincide at high); wire goldens unchanged. Parity harness caught the budget clamp interacting with its own max_tokens during development — capture budget raised above the largest manual budget.	2026-07-04 20:54:20 -07:00
Patrick Buckley	59a527f2f2	feat(console): surface each model's effective effort ladder ... Seven knob positions render as seven behaviors in the UI, but the real ladder depends on the lane and the model: qwen3.6 has two (off/on), DeepSeek-V4 three, Claude 4.6 five. Operators had no way to see which positions alias — the confusion class behind silently-equal effort levels. providers/effort_ladder.py projects the knob domain through the same mapping functions the providers use at request time (resolve_reasoning_ effort, reasoning_template_kwargs, the manual budget map — hoisted to a shared constant so the projection can't drift), yielding {value, effective} rows where equal tokens promise identical requests. /v1/api/models rows now carry the ladder (guarded per row), and POST /v1/api/admin/models/effort-ladder computes it for the admin modal's unsaved edits. The admin per-model effort select and the skill launch-config effort select annotate aliased positions ("Max (= high)", "None (model default)") with a sends-tooltip; annotations refresh as thinking-mode / effort-param / capabilities fields change. The ladder describes what Turnstone sends — server-side templates may alias further (DeepSeek-V4 folds low/medium into its default high tier).	2026-07-04 20:54:20 -07:00
Patrick Buckley	c64dc16319	feat(console): Always-on thinking-mode option in the model form ... Post effort-knob rework, "Enabled" (manual) means knob-controlled — effort none turns thinking off. Operators who want the pre-#771 always-on behavior (knob never disables) previously had to hand-write thinking_mode "adaptive" into the raw capabilities JSON. The dropdown now offers all three representable modes — None / Effort-knob controlled / Always on — and the edit-load lift captures adaptive instead of relegating it to raw JSON.	2026-07-04 20:54:20 -07:00
Patrick Buckley	d564cee43d	docs(providers): ground the effort_param values caution in official template contracts ... Cross-checked online: Qwen3.6's template documents enable_thinking + preserve_thinking only — no effort parameter exists (vLLM's flat reasoning_effort convenience boolean-maps to the same toggle). DeepSeek-V4 officially accepts reasoning_effort high/max with Think High as the default thinking tier and low/medium→high, xhigh→max aliasing — so freeform effort_param passthrough matches the contract exactly, and a declared values list omitting xhigh/max would make Think Max unreachable. Live probes on both boxes agree with the official contracts once the default-tier framing is applied.	2026-07-04 20:54:20 -07:00
Patrick Buckley	2cf23b6fe2	fix(providers): address high-effort review of the reasoning-knob branch ... Verified findings applied: - adaptive thinking_mode never knob-disables: the shared mapping now sends the toggle unconditionally true for adaptive (the native adaptive branch ignores the knob's none), while manual keeps the knob-driven contract. Restores the invariant the deleted chat-lane code upheld. - a set effort_param suppresses the flat top-level reasoning_effort on the chat lane: the template channel replaces it — double-sending could 400 on schema-strict servers and disagree with operator pins. - admin edit-save no longer drops a stored thinking_param when the thinking-mode dropdown is empty: the raw-JSON strip now only fires when a mode value actually round-trips through the dropdown. - effort_param persistence gated on the local-server lanes so a value lingering across a provider switch never lands on commercial rows. - three stale _compat_extra_params references renamed to merge_reasoning_template_kwargs. Documented dispositions (no code change): the knob-none-disables flip on upgrade is intentional and now carries an upgrade note; gateways fronting real Claude belong on provider=anthropic with a custom base_url (the compat lane is vLLM-schema-only); nonstandard thinking_mode strings staying inert is the intended allowlist contract. The real anthropic provider is unaffected throughout — official Claude models keep native thinking/output_config.	2026-07-04 20:54:20 -07:00
Patrick Buckley	68b22adfa3	feat(providers): share the effort-knob→chat_template_kwargs mapping with the openai-compatible lane ... Hoist the compat-lane injection into _protocol.merge_reasoning_template_kwargs (next to ModelCapabilities — one implementation for both local-server lanes) and retire OpenAIChatCompletionsProvider._apply_thinking_mode in its favor: _finalize_extra_body now receives the session effort knob, so thinking_mode manual/adaptive maps knob "none" to an explicit thinking_param false (previously the toggle was unconditionally true) and caps.effort_param carries the graded effort key on chat completions too. Operator server_compat pins still win; the Responses surface is untouched (native reasoning handles effort itself). The admin Models form grows an "Effort param" field that round-trips like thinking_param: lifted out of the raw capabilities JSON on edit-load, re-added on save, cleared by emptying the field. Verified live against qwen3.6-27b /v1/chat/completions: knob medium streams reasoning_content, knob none suppresses it.	2026-07-04 20:54:20 -07:00