pwn 0.5.639 → 0.5.643

data/lib/pwn/ai/agent/learning.rb

@@ -39,7 +39,13 @@ module PWN
 
         public_class_method def self.note_outcome(opts = {})
           task    = opts[:task].to_s
-          success = opts[:success] ? true : false
+          # 4.1 — allow success: 'soft' (HER) distinct from true/false
+          raw_ok  = opts[:success]
+          success = if ['soft', :soft].include?(raw_ok)
+                      'soft'
+                    else
+                      raw_ok ? true : false
+                    end
           raise 'ERROR: task is required' if task.strip.empty?
 
           entry = {
@@ -80,7 +86,7 @@ module PWN
             nil
           end
           rows.compact!
-          rows.select! { |r| r[:success] == want_ok } unless want_ok.nil?
+          rows.select! { |r| want_ok == true ? r[:success] == true : r[:success] == want_ok } unless want_ok.nil?
           rows.select! { |r| Array(r[:tags]).any? { |t| t.to_s.downcase.include?(tag) } } unless tag.empty?
           rows.reverse.first(limit)
         end
@@ -91,7 +97,7 @@ module PWN
         public_class_method def self.stats
           rows   = outcomes(limit: 10_000)
           total  = rows.length
-          ok     = rows.count { |r| r[:success] }
+          ok     = rows.count { |r| r[:success] == true }
           jsum   = rows.sum { |r| r[:score] ? r[:score].to_f : { true => 1.0, false => 0.0 }[r[:success]] }
           skills = defined?(PWN::Skills) && PWN::Skills.is_a?(Hash) ? PWN::Skills.keys.length : 0
           mem    = defined?(PWN::Memory) ? PWN::Memory.load.keys.length : 0
@@ -159,12 +165,18 @@ module PWN
 
           now = Time.now.utc
           # C2 — prioritized replay: priority = judge_score × recency_decay × keyword_sim
+          # C2 — strict success:true only (excludes HER success:'soft'). Also
+          # down-weight any residual hindsight-tagged rows so partial failures
+          # never launder into full-strength few-shot exemplars.
           pool = outcomes(limit: 500, success: true).reject { |r| r[:session_id].to_s.empty? }
           scored = pool.map do |r|
             sim   = tokens.count { |t| r[:task].to_s.downcase.include?(t) }.to_f / tokens.length
             age_d = (now - Time.parse(r[:timestamp].to_s)) / 86_400.0
             decay = Math.exp(-age_d / 30.0)
             score = (r[:score] || 1.0).to_f
+            tags  = Array(r[:tags]).map(&:to_s)
+            # HER / soft / hindsight → 0.35× so they cannot dominate C2 priority
+            score *= 0.35 if r[:success].to_s == 'soft' || tags.intersect?(%w[hindsight her soft])
             [r, sim * decay * score]
           rescue StandardError
             [r, 0.0]
@@ -196,7 +208,12 @@ module PWN
           FileUtils.mkdir_p(FINETUNE_DIR)
           out = opts[:out] || File.join(FINETUNE_DIR, "pwn-#{Time.now.utc.strftime('%Y%m%d')}.jsonl")
 
-          sids = outcomes(limit: 10_000, success: true).map { |r| r[:session_id] }.compact.uniq
+          # 4.1 — exclude HER soft-success from SFT gold (success: 'soft' or tags)
+          gold = outcomes(limit: 10_000, success: true).reject do |r|
+            r[:success].to_s == 'soft' ||
+              Array(r[:tags]).any? { |t| %w[hindsight her].include?(t.to_s) }
+          end
+          sids = gold.map { |r| r[:session_id] }.compact.uniq
           rows = 0
           File.open(out, 'w') do |f|
             sids.each do |sid|
@@ -299,7 +316,29 @@ module PWN
           proxy_ok = infer_success(session_id: session_id, final: opts[:final])
           # S3 — tool-armed constitutional critic runs BEFORE the reward
           # model so its verdict is evidence, not hindsight.
-          crit = defined?(Curriculum) ? Curriculum.critic(request: opts[:request], final: opts[:final], session_id: session_id) : { verdict: :pass }
+          # P7 — force critic when W3 says this engine is overconfident
+          force_critic = begin
+            eng = (PWN::Env.dig(:ai, :active) if defined?(PWN::Env))
+            cal = defined?(Metrics) ? Metrics.calibration(engine: eng) : { n: 0 }
+            cal[:n].to_i >= 8 && (cal[:brier].to_f > 0.35 || cal[:overconfidence].to_f > 0.25)
+          rescue StandardError
+            false
+          end
+          crit = if defined?(Curriculum)
+                   if force_critic
+                     prev = (PWN::Env[:ai][:agent][:critic] if defined?(PWN::Env) && PWN::Env[:ai].is_a?(Hash) && PWN::Env[:ai][:agent].is_a?(Hash))
+                     begin
+                       PWN::Env[:ai][:agent][:critic] = true if defined?(PWN::Env) && PWN::Env[:ai].is_a?(Hash) && PWN::Env[:ai][:agent].is_a?(Hash) && !PWN::Env[:ai][:agent].frozen?
+                       Curriculum.critic(request: opts[:request], final: opts[:final], session_id: session_id)
+                     ensure
+                       PWN::Env[:ai][:agent][:critic] = prev if defined?(PWN::Env) && PWN::Env[:ai].is_a?(Hash) && PWN::Env[:ai][:agent].is_a?(Hash) && !PWN::Env[:ai][:agent].frozen?
+                     end
+                   else
+                     Curriculum.critic(request: opts[:request], final: opts[:final], session_id: session_id)
+                   end
+                 else
+                   { verdict: :pass }
+                 end
           # R1 — LLM Outcome Reward Model (falls back to calibrated heuristic)
           v = Reward.judge(request: opts[:request], final: opts[:final], session_id: session_id, proxy_ok: proxy_ok) if defined?(Reward)
           v ||= { score: proxy_ok ? 1.0 : 0.0, success: proxy_ok, verdict: proxy_ok ? :solved : :wrong }
@@ -322,8 +361,10 @@ module PWN
             session_id: session_id,
             tags: ['auto', 'loop', v[:verdict].to_s]
           )
-          # R2 — per-step credit assignment; C3 — HER on failure
-          Reward.prm(request: opts[:request], session_id: session_id) if defined?(Reward) && ok
+          # R2 — per-step credit assignment ALWAYS (1.6): failed trajectories
+          # are where step credit matters; feed negative steps into counterfactual.
+          # C3 — HER soft-relabel on failure only.
+          Reward.prm(request: opts[:request], session_id: session_id) if defined?(Reward)
           Curriculum.hindsight(request: opts[:request], final: opts[:final], session_id: session_id) if !ok && defined?(Curriculum)
           # W3 — calibration: predicted (from plan_first) vs actual
           Curriculum.calibrate(predicted: opts[:predicted], actual: v[:score], engine: PWN::Env.dig(:ai, :active)) if opts[:predicted] && defined?(Curriculum)
@@ -541,19 +582,50 @@ module PWN
           sid = opts[:session_id]
           cap = opts[:max_msgs] || 6
           t = PWN::Sessions.load(session_id: sid)
-          user = t.find  { |e| e[:role].to_s == 'user' }
-          fin  = t.rfind { |e| e[:role].to_s == 'assistant' }
-          return [] unless user && fin
+          return [] if t.nil? || t.empty?
+
+          # Prefer the LAST non-empty assistant as the exemplar final.
+          # Blank assistants (common when a prior local-model turn stopped
+          # with empty content / eval_count=1) must never be few-shot into
+          # the next Ollama turn — Qwen/abliterated builds then echo the
+          # empty final and the agent loop returns "" to the user.
+          fin_idx = t.rindex { |e| e[:role].to_s == 'assistant' && !e[:content].to_s.strip.empty? }
+          return [] if fin_idx.nil?
+
+          fin = t[fin_idx]
+          # Pair with the nearest preceding user so multi-turn sessions do
+          # not attach an unrelated first-user prompt to a later answer.
+          user = t[0...fin_idx].reverse.find { |e| e[:role].to_s == 'user' }
+          return [] unless user
 
           # C4 — minimal sufficient trace: prefer steps PRM tagged reward>0
-          tools = t.select { |e| e[:role].to_s == 'tool' }
+          # scoped to the window between that user and the final answer.
+          user_idx = t[0...fin_idx].rindex { |e| e.equal?(user) || (e[:role].to_s == 'user' && e[:content] == user[:content]) } || 0
+          window = t[user_idx..fin_idx] || []
+          tools = window.select { |e| e[:role].to_s == 'tool' }
           rewarded = tools.select { |e| e[:step_reward].to_i.positive? }
           tools = rewarded unless rewarded.empty?
           tools = tools.first([cap - 2, 0].max)
-          msgs  = [{ role: 'user', content: "[exemplar] #{user[:content].to_s[0, 400]}" }]
-          tools.each { |e| msgs << { role: 'assistant', content: "[exemplar tool] #{e[:content].to_s[0, 300]}" } }
-          msgs << { role: 'assistant', content: "[exemplar final] #{fin[:content].to_s[0, 400]}" }
-          msgs
+
+          # Emit a SINGLE user/assistant pair (never consecutive assistant
+          # turns). Many local chat templates (Qwen3, Llama-3) collapse or
+          # early-stop when two assistant messages land back-to-back with
+          # no user between them — observed as done_reason=stop, eval_count=1,
+          # empty content, no tool_calls.
+          tool_bits = tools.map { |e| e[:content].to_s[0, 220] }.reject { |s| s.strip.empty? }
+          body = +''
+          unless tool_bits.empty?
+            body << "[exemplar tools]\n"
+            tool_bits.each_with_index { |s, i| body << "#{i + 1}. #{s}\n" }
+            body << "\n"
+          end
+          body << "[exemplar final]\n#{fin[:content].to_s.strip[0, 400]}"
+          return [] if fin[:content].to_s.strip.empty?
+
+          [
+            { role: 'user', content: "[exemplar] #{user[:content].to_s[0, 400]}" },
+            { role: 'assistant', content: body }
+          ]
         rescue StandardError
           []
         end

data/lib/pwn/ai/agent/loop.rb

@@ -79,11 +79,42 @@ module PWN
 
         private_class_method def self.max_iters
           v = (PWN::Env.dig(:ai, :agent, :max_iters) if defined?(PWN::Env))
-          v.to_i.positive? ? v.to_i : DEFAULT_MAX_ITERS
+          n = v.to_i.positive? ? v.to_i : DEFAULT_MAX_ITERS
+          # 0.3 — frontier leakage: live max_iters=80 burns local models.
+          # Cap ollama at 25 unless the operator set an explicit lower value.
+          n = 25 if active_engine == :ollama && n > 25
+          # P7 — W3 controller: when this engine is badly overconfident,
+          # shrink the tool budget so thrash can't compound on bad plans.
+          cal = calibration_state
+          n = [n, cal[:max_iters_cap]].min if cal[:overconfident]
+          n
         rescue StandardError
           DEFAULT_MAX_ITERS
         end
 
+        # P7 — read Metrics.calibration for the active engine and decide
+        # whether to force plan_first/critic and cap iters.
+        # Thresholds: brier > 0.35 OR overconfidence > 0.25 with n >= 8.
+        private_class_method def self.calibration_state
+          eng = active_engine
+          cal = defined?(Metrics) && Metrics.respond_to?(:calibration) ? Metrics.calibration(engine: eng) : { n: 0 }
+          n = cal[:n].to_i
+          return { overconfident: false, force_plan: false, force_critic: false, max_iters_cap: 25, cal: cal } if n < 8
+
+          brier = cal[:brier].to_f
+          over  = cal[:overconfidence].to_f
+          bad   = brier > 0.35 || over > 0.25
+          {
+            overconfident: bad,
+            force_plan: bad,
+            force_critic: bad,
+            max_iters_cap: bad ? 12 : 25,
+            cal: cal
+          }
+        rescue StandardError
+          { overconfident: false, force_plan: false, force_critic: false, max_iters_cap: 25 }
+        end
+
         private_class_method def self.active_engine
           e = (PWN::Env.dig(:ai, :active) if defined?(PWN::Env)).to_s.downcase.to_sym
           e == :'' ? :openai : e
@@ -115,14 +146,17 @@ module PWN
           # !semantic_ok. Kills the phantom 31f1871b8a15 class permanently.
           sem = defined?(Reward) ? Reward.semantic_ok(name: name, raw: raw, args: opts[:args]) : { ok: raw.include?('"success":true'), semantic_ok: raw.include?('"success":true'), err: raw[/"error":"([^"]{1,300})"/, 1] }
           dur = started ? (Time.now - started) : 0.0
-          Metrics.record(name: name, success: sem[:ok], duration: dur, error: sem[:err], engine: opts[:engine]) if defined?(Metrics)
+          # 1.2 — align Metrics proxy with R4 semantic_ok (handler-ok alone
+          # was the reward-signal lie: grep exit 1 looked like 100% success
+          # while Mistakes stayed quiet, OR the inverse phantom class).
+          Metrics.record(name: name, success: sem[:semantic_ok], duration: dur, error: sem[:err], engine: opts[:engine]) if defined?(Metrics)
           m = nil
           if !sem[:semantic_ok] && defined?(Mistakes)
             # E1 — automatic blame attribution: if this tool just tripped a
             # CUSUM changepoint AND extro drift is present, tag the mistake
             # cause: :env_drift so it does NOT count toward [REPEATING].
             cause = attribute_cause(name: name)
-            m = Mistakes.record(tool: name, error: sem[:err] || raw[0, 300], args: opts[:args], session_id: opts[:session_id], source: :tool, cause: cause)
+            m = Mistakes.record(tool: name, error: sem[:err] || raw[0, 300], args: opts[:args], session_id: opts[:session_id], source: :tool, cause: cause, shape: sem[:shape])
           end
           { ok: sem[:semantic_ok], err: sem[:err], mistake: m, benign: sem[:benign] }
         rescue StandardError
@@ -225,11 +259,28 @@ module PWN
         # persona for a 3-line corrective hint and inject it as a synthetic
         # tool result. Every escalation is recorded as a Mistake so
         # export_finetune can later teach the LoRA to NOT need it.
+        @escalate_warned = false
         private_class_method def self.escalate(opts = {})
           request    = opts[:request]
           turn_fails = opts[:turn_fails]
           persona    = agent_flag(key: :escalation_persona)
-          return nil unless persona && defined?(Swarm) && Swarm.personas.key?(persona.to_sym)
+          # Vault files pre-dating PR-A leave escalation_persona nil; if the
+          # default "escalator" persona exists on disk, use it automatically.
+          persona = :escalator if (persona.nil? || persona.to_s.empty?) && defined?(Swarm) && Swarm.personas.key?(:escalator)
+          unless persona && defined?(Swarm)
+            unless @escalate_warned
+              warn '[pwn-ai/loop] escalation_persona unset or Swarm unavailable — local thrash will burn iters without a frontier hint. Set PWN::Env[:ai][:agent][:escalation_persona] (default: escalator).'
+              @escalate_warned = true
+            end
+            return nil
+          end
+          unless Swarm.personas.key?(persona.to_sym)
+            unless @escalate_warned
+              warn "[pwn-ai/loop] escalation_persona=#{persona.inspect} not in ~/.pwn/agents.yml — define it or set nil. ESCALATE_AFTER_FAILS is a no-op."
+              @escalate_warned = true
+            end
+            return nil
+          end
 
           summary = turn_fails.map { |k, v| "#{k}: #{v}×" }.join(', ')
           hint = Swarm.ask(
@@ -296,10 +347,20 @@ module PWN
           msg = resp.dig(:choices, 0, :message) || resp[:assistant_message]
           return nil unless msg
 
+          content = msg[:content]
+          tool_calls = Array(msg[:tool_calls])
+          # Local/thinking models (Ollama Qwen3, DeepSeek-R1, etc.) sometimes
+          # return only :thinking with empty :content and no tool_calls. Promote
+          # thinking so the agent does not print a blank final answer.
+          if content.to_s.strip.empty? && tool_calls.empty?
+            thinking = msg[:thinking].to_s
+            content = thinking unless thinking.strip.empty?
+          end
+
           out = {
             role: 'assistant',
-            content: msg[:content],
-            tool_calls: Array(msg[:tool_calls]).map do |tc|
+            content: content,
+            tool_calls: tool_calls.map do |tc|
               {
                 id: tc[:id],
                 type: 'function',
@@ -314,6 +375,7 @@ module PWN
           # them exactly on the next iteration (e.g. Anthropic requires the
           # original tool_use block to precede a tool_result).
           out[:_native_content] = msg[:_native_content] if msg[:_native_content]
+          out[:thinking] = msg[:thinking] if msg[:thinking]
           out
         end
 
@@ -350,6 +412,64 @@ module PWN
           end
         end
 
+        # 3.1 — sliding-window history compaction for local models.
+        # Keep: system, original user, PLAN assistant (if any), last K tool
+        # pairs (assistant+tool), and the most recent assistant. Stale tool
+        # bodies are truncated to history_tool_max_chars.
+        private_class_method def self.compact_history!(opts = {})
+          messages = opts[:messages]
+          return messages unless messages.is_a?(Array) && messages.length > 12
+
+          keep_pairs = (agent_flag(key: :history_keep_tool_pairs, default: 6) || 6).to_i
+          max_chars  = (agent_flag(key: :history_tool_max_chars, default: 2_000) || 2_000).to_i
+
+          head = []
+          rest = messages.dup
+          # always keep leading system + first user + optional PLAN
+          while rest.any? && %w[system user].include?(rest.first[:role].to_s)
+            head << rest.shift
+            break if head.any? { |m| m[:role].to_s == 'user' }
+          end
+          head << rest.shift if rest.any? && rest.first[:role].to_s == 'assistant' && rest.first[:content].to_s.start_with?('PLAN:')
+
+          # find indices of tool messages in rest; keep only last keep_pairs tool groups
+          tool_idxs = rest.each_index.select { |i| rest[i][:role].to_s == 'tool' }
+          drop_before = tool_idxs.length > keep_pairs ? tool_idxs[-keep_pairs] : 0
+          # include the assistant tool_call message immediately before first kept tool
+          start = drop_before
+          start -= 1 if start.positive? && rest[start - 1] && rest[start - 1][:role].to_s == 'assistant'
+          kept = rest[start..] || []
+          kept.each do |m|
+            next unless m[:role].to_s == 'tool' && m[:content].to_s.length > max_chars
+
+            m[:content] = "#{m[:content].to_s[0, max_chars]}…[compacted]"
+          end
+          messages.replace(head + kept)
+          messages
+        rescue StandardError => e
+          warn "[pwn-ai/loop] compact_history swallowed: #{e.class}: #{e.message}"
+          opts[:messages]
+        end
+
+        # 3.2 — local models cannot afford auto_introspect (judge+prm+critic+
+        # sentinel+extro) on every success. Default :failure_only when local.
+        private_class_method def self.should_auto_introspect?(opts = {})
+          return true unless opts[:local]
+
+          policy = agent_flag(key: :local_introspect, default: :failure_only).to_s.to_sym
+          case policy
+          when :always then true
+          when :every_n
+            n = (agent_flag(key: :introspect_every_n, default: 3) || 3).to_i
+            n = 3 if n < 1
+            (opts[:iter].to_i % n).zero?
+          else # :failure_only
+            opts[:turn_fails].is_a?(Hash) && opts[:turn_fails].values.sum.positive?
+          end
+        rescue StandardError
+          true
+        end
+
         # Supported Method Parameters::
         # final = PWN::AI::Agent::Loop.run(
         #   request: 'required - what the human typed',
@@ -378,22 +498,53 @@ module PWN
           append_session(session_id: session_id, role: 'user', content: request)
 
           predicted = nil
-          predicted = plan_first(messages: messages, request: request) if agent_flag(key: :plan_first, default: local) && !Array(tools).empty?
+          cal_state = calibration_state
+          force_plan = cal_state[:force_plan]
+          predicted = plan_first(messages: messages, request: request) if (force_plan || agent_flag(key: :plan_first, default: local)) && !Array(tools).empty?
+          if force_plan && cal_state[:cal]
+            messages << {
+              role: 'user',
+              content: "[pwn-ai/w3] engine=#{active_engine} is overconfident " \
+                       "(brier=#{cal_state[:cal][:brier]}, overconf=#{cal_state[:cal][:overconfidence]}). " \
+                       'Prefer high-judge exemplars, verify claims, and avoid speculative tool calls.'
+            }
+          end
 
           turn_fails = Hash.new(0)
           escalated  = false
 
           max_iters.times do |i|
+            # 3.1 — compact history on local so tool dumps don't fill num_ctx
+            compact_history!(messages: messages) if local
+
             msg = call_engine(messages: messages, tools: tools)
             return '[pwn-ai] engine returned no message' if msg.nil?
 
-            messages << msg
             calls = Array(msg[:tool_calls])
+            text  = msg[:content].to_s
+
+            # Empty-final guard (local/thinking models): Ollama sometimes
+            # returns done_reason=stop with eval_count<=1, empty content, no
+            # tool_calls — historically surface as a blank TUI reply. Do NOT
+            # commit that as the answer; drop the empty assistant turn,
+            # inject a one-shot nudge, and keep iterating.
+            if calls.empty? && text.strip.empty?
+              warn "[pwn-ai/loop] empty final from #{engine} on iter=#{i}; nudging" if local
+              messages << {
+                role: 'user',
+                content: 'Your previous reply was empty (no tool_calls and no content). ' \
+                         'Either call a tool now, or write the final answer for the user as plain text. ' \
+                         'Do not reply with an empty message.'
+              }
+              turn_fails['empty_final'] += 1
+              next
+            end
+
+            messages << msg
 
             if calls.empty?
-              text = msg[:content].to_s
               append_session(session_id: session_id, role: 'assistant', content: text)
-              Learning.auto_introspect(session_id: session_id, request: request, final: text, predicted: predicted) if defined?(Learning)
+              Learning.auto_introspect(session_id: session_id, request: request, final: text, predicted: predicted) if defined?(Learning) && should_auto_introspect?(local: local, turn_fails: turn_fails, iter: i)
               return text
             end
 
@@ -416,8 +567,8 @@ module PWN
                 # alt-persona branch, judge both, inject the winner. Real
                 # advantage estimation; (loser, winner) → DPO preference.
                 thresh = defined?(Mistakes) ? Mistakes::REPEAT_THRESHOLD : 3
-                if count == thresh && defined?(Curriculum)
-                  cf = Curriculum.counterfactual(request: request, name: name, args: args, error: tele[:err] || raw[0, 200], hint: hint)
+                if count >= thresh && !escalated && defined?(Curriculum)
+                  cf = (turn_fails["cf:#{fkey}"] += 1) == 1 ? Curriculum.counterfactual(request: request, name: name, args: args, error: tele[:err] || raw[0, 200], hint: hint) : nil
                   hint = "#{hint}\n[pwn-ai/counterfactual] branch #{cf[:branch]} (score=#{cf[:score].round(2)}): #{cf[:content]}" if cf
                 end
                 result = guard_repeated_failure(name: name, count: count, hint: hint, result: result)
@@ -476,7 +627,7 @@ module PWN
 
               Local-model scaffolding (PWN::Env[:ai][:agent]):
                 :plan_first          - Boolean, plan-then-act pre-pass (default: engine == :ollama)
-                :tool_router         - Boolean, slim Registry.definitions to CORE + top-K relevant
+                :tool_router         - Boolean/nil, slim Registry.definitions (nil=auto on for ollama)
                 :escalation_persona  - Swarm persona name for frontier corrective hints when stuck
                 :critic              - S3 constitutional critic before every final (Boolean)
                 :red_team_plan       - S4 adversarial plan review after plan_first (Boolean)

data/lib/pwn/ai/agent/metrics.rb

@@ -55,8 +55,20 @@ module PWN
           metrics = opts[:metrics] ||= { tools: {} }
           metrics[:updated_at] = Time.now.utc.iso8601
           FileUtils.mkdir_p(File.dirname(METRICS_FILE))
-          File.write(METRICS_FILE, JSON.pretty_generate(metrics))
+          # 4.4 — flock + atomic rename
+          path = METRICS_FILE
+          tmp  = File.join(File.dirname(path), ".#{File.basename(path)}.#{Process.pid}.tmp")
+          body = JSON.pretty_generate(metrics)
+          File.open(tmp, File::WRONLY | File::CREAT | File::TRUNC, 0o644) do |f|
+            f.flock(File::LOCK_EX)
+            f.write(body)
+            f.flush
+            f.fsync
+          end
+          File.rename(tmp, path)
           metrics
+        ensure
+          FileUtils.rm_f(tmp) if defined?(tmp) && tmp && File.exist?(tmp)
         end
 
         # Supported Method Parameters::
@@ -131,24 +143,31 @@ module PWN
           rows   = summary(limit: limit, engine: engine)
           return '' if rows.empty?
 
+          # P4 — when Reward.sentinel says proxy is hacked, haircut displayed
+          # success rates so the model does not trust the lie in the prompt.
+          distrust = defined?(Reward) && Reward.respond_to?(:proxy_distrust) ? Reward.proxy_distrust : 0.0
           scope = engine.to_s.empty? ? 'historical' : "engine=#{engine}"
+          scope = "#{scope}, proxy_distrust=#{distrust.round(2)}" if distrust.positive?
           lines = rows.map do |r|
+            rate = r[:success_rate].to_f
+            # blend toward 0.5 (uninformative) proportional to distrust
+            adj = rate - ((rate - 0.5) * distrust)
             err = r[:last_error] ? " last_err=#{r[:last_error][0, 60]}" : ''
-            "  - #{r[:name]}: calls=#{r[:calls]} success=#{(r[:success_rate] * 100).round(1)}% avg=#{r[:avg_duration]}s#{err}"
+            tag = distrust.positive? ? ' (adj)' : ''
+            "  - #{r[:name]}: calls=#{r[:calls]} success=#{(adj * 100).round(1)}%#{tag} avg=#{r[:avg_duration]}s#{err}"
           end
-          "TOOL EFFECTIVENESS (#{scope}, adapt tool choice accordingly)\n#{lines.join("\n")}\n\n"
+          warn_line = distrust.positive? ? "WARNING: reward proxy diverges from judge — success rates haircut by distrust=#{distrust.round(2)}; prefer judge-scored exemplars over raw rates.\n" : ''
+          "#{warn_line}TOOL EFFECTIVENESS (#{scope}, adapt tool choice accordingly)\n#{lines.join("\n")}\n\n"
         end
 
-        # Supported Method Parameters::
-        # score = PWN::AI::Agent::Metrics.ucb(
-        #   name: 'required - tool name',
-        #   c: 'optional - exploration constant (default 1.4)'
-        # )
-        #
-        # C1 — Upper Confidence Bound. Tools with few calls get an
-        # exploration bonus so a single early failure (before its dep was
-        # installed) does NOT permanently blacklist it. Registry.rank uses
-        # this instead of raw success_rate.
+        # P4 helper — Registry.rank calls this so β·advantage is scaled down
+        # when the proxy is untrustworthy.
+        public_class_method def self.proxy_trust
+          d = defined?(Reward) && Reward.respond_to?(:proxy_distrust) ? Reward.proxy_distrust : 0.0
+          (1.0 - d.to_f).clamp(0.0, 1.0)
+        rescue StandardError
+          1.0
+        end
 
         public_class_method def self.ucb(opts = {})
           name = opts[:name].to_s