pwn 0.5.647 → 0.5.650

data/lib/pwn/ai/agent/learning.rb

@@ -25,8 +25,41 @@ module PWN
       module Learning
         LEARNING_FILE      = File.join(Dir.home, '.pwn', 'learning.jsonl')
         FINETUNE_DIR       = File.join(Dir.home, '.pwn', 'finetune')
+        # P0 — post-answer introspect must not train "stop early" while
+        # spending the iteration budget after the final. Soft cap skips
+        # expensive stages (tool critic, PRM-LLM, reflect, extrospect);
+        # hard cap keeps only note_outcome + judge(heuristic) + sentinel.
+        INTROSPECT_SOFT_MS = 2_500
+        INTROSPECT_HARD_MS = 8_000
+        INTROSPECT_MIN_STAGES = %i[judge note_outcome fold_judge sentinel].freeze
+
         MAX_MEMORY_ENTRIES = 200
-        CLAIM_RX           = /CVE-\d{4}-\d{4,7}|\b[A-Za-z][\w.+-]{2,}\s+v?\d+\.\d+(?:\.\d+)?\b/
+        # E3/P26 — only CVE-ids or software-name + full semver (x.y.z).
+        # Two-part floats ("cap 0.2", "proxy 1.0", "judge 37.0") are RL
+        # metric crumbs that were scraped by verify_as_reward and flooded
+        # learning.jsonl with extro_verify :unknown failures.
+        CLAIM_METRIC_WORDS = %w[
+          cap share proxy judge success only now clears gap score rate mean
+          brier overconf distrust trajectory_fraction handler orm prm delta
+          limit window pct percent ms iter budget conf confidence n
+          ruby python linux kernel host cwd e.g e.g.
+        ].freeze
+        CLAIM_RX = /
+          CVE-\d{4}-\d{4,7}
+          |
+          \b
+          (?!
+            (?:cap|share|proxy|judge|success|only|now|clears|gap|score|rate|mean|
+               brier|overconf|distrust|trajectory_fraction|handler|orm|prm|delta|
+               limit|window|pct|percent|ms|iter|budget|conf|confidence|
+               ruby|python|linux|kernel|host|cwd|e\.g)
+            \b
+          )
+          [A-Za-z][\w.+-]{2,}
+          \s+
+          v?\d+\.\d+\.\d+(?:[-+][\w.]+)?
+          \b
+        /x
 
         # Supported Method Parameters::
         # entry = PWN::AI::Agent::Learning.note_outcome(
@@ -359,18 +392,33 @@ module PWN
           return unless session_id
           return unless auto_introspect_enabled?
 
-          proxy_ok = infer_success(session_id: session_id, final: opts[:final])
-          # S3 — tool-armed constitutional critic runs BEFORE the reward
-          # model so its verdict is evidence, not hindsight.
-          # P7 — force critic when W3 says this engine is overconfident
-          # P24 — under budget_exhaustion_hot?, skip tool-armed critic entirely
-          # (or single-shot text) so the critic cannot re-thrash the budget.
+          t0 = Process.clock_gettime(Process::CLOCK_MONOTONIC)
+          stages_run = []
+          stages_skipped = []
           budget_hot = begin
             defined?(Loop) && Loop.respond_to?(:budget_exhaustion_hot?, true) &&
               Loop.send(:budget_exhaustion_hot?)
           rescue StandardError
             false
           end
+
+          elapsed_ms = lambda do
+            ((Process.clock_gettime(Process::CLOCK_MONOTONIC) - t0) * 1000).round
+          end
+          # soft = skip expensive; hard = stop almost everything
+          over_soft = lambda do
+            ms = elapsed_ms.call
+            ms >= INTROSPECT_SOFT_MS || budget_hot
+          end
+          over_hard = lambda do
+            ms = elapsed_ms.call
+            ms >= INTROSPECT_HARD_MS
+          end
+
+          proxy_ok = infer_success(session_id: session_id, final: opts[:final])
+
+          # S3 critic — BEFORE reward so verdict is evidence.
+          # P24/P0 — budget_hot or soft-cap → text_only or skip.
           force_critic = begin
             eng = (PWN::Env.dig(:ai, :active) if defined?(PWN::Env))
             cal = defined?(Metrics) ? Metrics.calibration(engine: eng) : { n: 0 }
@@ -378,39 +426,51 @@ module PWN
           rescue StandardError
             false
           end
-          crit = if budget_hot && defined?(Curriculum)
-                   # P24 — cheap text-only critic: no persona tool swarm
-                   Curriculum.critic(
-                     request: opts[:request],
-                     final: opts[:final],
-                     session_id: session_id,
-                     text_only: true
-                   )
-                 elsif defined?(Curriculum)
-                   if force_critic
-                     prev = (PWN::Env[:ai][:agent][:critic] if defined?(PWN::Env) && PWN::Env[:ai].is_a?(Hash) && PWN::Env[:ai][:agent].is_a?(Hash))
-                     begin
-                       PWN::Env[:ai][:agent][:critic] = true if defined?(PWN::Env) && PWN::Env[:ai].is_a?(Hash) && PWN::Env[:ai][:agent].is_a?(Hash) && !PWN::Env[:ai][:agent].frozen?
-                       Curriculum.critic(request: opts[:request], final: opts[:final], session_id: session_id)
-                     ensure
-                       PWN::Env[:ai][:agent][:critic] = prev if defined?(PWN::Env) && PWN::Env[:ai].is_a?(Hash) && PWN::Env[:ai][:agent].is_a?(Hash) && !PWN::Env[:ai][:agent].frozen?
-                     end
-                   else
-                     Curriculum.critic(request: opts[:request], final: opts[:final], session_id: session_id)
-                   end
-                 else
-                   { verdict: :pass }
-                 end
-          # R1 — LLM Outcome Reward Model (falls back to calibrated heuristic)
+          # P0 — when W1 mix urgently needs :critic pairs, prefer running critic
+          need_critic_mix = begin
+            mix = defined?(Reward) && Reward.respond_to?(:generator_mix) ? Reward.generator_mix : {}
+            Array(mix[:urgent]).include?('critic')
+          rescue StandardError
+            false
+          end
+
+          crit = { verdict: :pass, source: :skipped }
+          # Single skip path (Lint/DuplicateBranch): hard-budget OR no Curriculum.
+          if !defined?(Curriculum) || (over_hard.call && !need_critic_mix)
+            stages_skipped << :critic
+          elsif budget_hot || (over_soft.call && !force_critic && !need_critic_mix)
+            stages_run << :critic_text_only
+            crit = Curriculum.critic(
+              request: opts[:request],
+              final: opts[:final],
+              session_id: session_id,
+              text_only: true
+            )
+          elsif force_critic
+            stages_run << :critic_forced
+            prev = (PWN::Env[:ai][:agent][:critic] if defined?(PWN::Env) && PWN::Env[:ai].is_a?(Hash) && PWN::Env[:ai][:agent].is_a?(Hash))
+            begin
+              PWN::Env[:ai][:agent][:critic] = true if defined?(PWN::Env) && PWN::Env[:ai].is_a?(Hash) && PWN::Env[:ai][:agent].is_a?(Hash) && !PWN::Env[:ai][:agent].frozen?
+              crit = Curriculum.critic(request: opts[:request], final: opts[:final], session_id: session_id)
+            ensure
+              PWN::Env[:ai][:agent][:critic] = prev if defined?(PWN::Env) && PWN::Env[:ai].is_a?(Hash) && PWN::Env[:ai][:agent].is_a?(Hash) && !PWN::Env[:ai][:agent].frozen?
+            end
+          else
+            stages_run << :critic
+            crit = Curriculum.critic(request: opts[:request], final: opts[:final], session_id: session_id)
+          end
+
+          # R1 judge — always attempt (heuristic is cheap; LLM gated inside)
+          stages_run << :judge
           v = Reward.judge(request: opts[:request], final: opts[:final], session_id: session_id, proxy_ok: proxy_ok) if defined?(Reward)
           v ||= { score: proxy_ok ? 1.0 : 0.0, success: proxy_ok, verdict: proxy_ok ? :solved : :wrong }
           v[:score] = [v[:score], 0.3].min if crit[:verdict] == :flaw
           ok = v[:score] >= 0.6
 
-          # W1 — complete any pending (rejected, chosen) pair from a
-          # user correction on the previous turn.
+          # W1 pending user_correction pair
           pend = Thread.current[:pwn_pending_pref]
           if pend && ok && defined?(Reward)
+            stages_run << :user_correction_pref
             Reward.record_preference(
               prompt: pend[:prompt],
               rejected: pend[:rejected],
@@ -422,6 +482,7 @@ module PWN
             Thread.current[:pwn_pending_pref] = nil
           end
 
+          stages_run << :note_outcome
           note_outcome(
             task: opts[:request].to_s[0, 120],
             success: ok,
@@ -430,41 +491,69 @@ module PWN
             session_id: session_id,
             tags: ['auto', 'loop', v[:verdict].to_s]
           )
-          # P20 — fold episode ORM score into per-tool Metrics so UCB/Thompson
-          # /advantage track judge, not only handler-ok. Attribution: every
-          # tool touched this session gets the episode score (coarse but
-          # closes the bandit onto the north-star scalar).
-          fold_judge_into_metrics(session_id: session_id, score: v[:score])
-          # R2 — per-step credit assignment ALWAYS (1.6): failed trajectories
-          # are where step credit matters; feed negative steps into counterfactual.
-          # C3 — HER soft-relabel on failure only.
-          Reward.prm(request: opts[:request], session_id: session_id) if defined?(Reward)
-          Curriculum.hindsight(request: opts[:request], final: opts[:final], session_id: session_id) if !ok && defined?(Curriculum)
-          # W3 — calibration: predicted (from plan_first) vs actual.
-          # Always try: also recover p(success)= from session PLAN if the
-          # live return value was lost (nil) but plan_first did emit one.
+
+          stages_run << :fold_judge
+          fold_judge_into_metrics(session_id: session_id, score: v[:score], confidence: v[:confidence])
+
+          # R2 PRM — skip under hard cap (expensive LLM); keep under soft if heuristic path
+          if over_hard.call
+            stages_skipped << :prm
+          elsif defined?(Reward)
+            stages_run << :prm
+            Reward.prm(request: opts[:request], session_id: session_id)
+          end
+
+          # C3 HER — only on failure; skip hard
+          if !ok && defined?(Curriculum) && !over_hard.call
+            stages_run << :hindsight
+            Curriculum.hindsight(request: opts[:request], final: opts[:final], session_id: session_id)
+          else
+            stages_skipped << :hindsight unless ok
+          end
+
+          # W3 calibrate — cheap; always when predicted available
           predicted = opts[:predicted]
           predicted = recover_predicted_from_session(session_id: session_id) if predicted.nil?
-          Curriculum.calibrate(predicted: predicted, actual: v[:score], engine: PWN::Env.dig(:ai, :active)) if !predicted.nil? && defined?(Curriculum)
-          reflect(session_id: session_id) if ok
-          Reward.sentinel if defined?(Reward)
-          Extrospection.auto_extrospect(session_id: session_id) if defined?(Extrospection)
+          if !predicted.nil? && defined?(Curriculum)
+            stages_run << :calibrate
+            Curriculum.calibrate(predicted: predicted, actual: v[:score], engine: PWN::Env.dig(:ai, :active))
+          end
+
+          # reflect on success — skip soft/hard (LLM + memory writes)
+          if ok && !over_soft.call
+            stages_run << :reflect
+            reflect(session_id: session_id)
+          elsif ok
+            stages_skipped << :reflect
+          end
+
+          # R3 sentinel — cheap disk math; always
+          if defined?(Reward)
+            stages_run << :sentinel
+            Reward.sentinel
+          end
+
+          # E ambient extrospect — skip soft (can launch probes)
+          if defined?(Extrospection) && !over_soft.call
+            stages_run << :extrospect
+            Extrospection.auto_extrospect(session_id: session_id)
+          else
+            stages_skipped << :extrospect
+          end
+
+          {
+            ok: ok,
+            score: v[:score],
+            elapsed_ms: elapsed_ms.call,
+            budget_hot: budget_hot,
+            stages_run: stages_run,
+            stages_skipped: stages_skipped
+          }
         rescue StandardError => e
           warn "[pwn-ai/learning] auto_introspect swallowed: #{e.class}: #{e.message}"
           nil
         end
 
-        # Supported Method Parameters::
-        # PWN::AI::Agent::Learning.flip_last_outcome(
-        #   session_id: 'optional - only flip if the newest outcome belongs to this session',
-        #   reason: 'optional - why it is being flipped (usually the user correction text)'
-        # )
-        #
-        # Rewrites the most-recently-appended learning.jsonl entry from
-        # success:true to success:false. Called by Mistakes.check_user_correction
-        # when the user's next message rejects the previous answer, so the
-        # 100 %-success illusion is broken and the failure enters the corpus.
-
         public_class_method def self.flip_last_outcome(opts = {})
           return { flipped: false } unless File.exist?(LEARNING_FILE)
 
@@ -557,6 +646,7 @@ module PWN
 
           sid = opts[:session_id]
           score = opts[:score]
+          conf = opts[:confidence]
           return if sid.to_s.empty? || score.nil?
           return unless defined?(PWN::Sessions)
 
@@ -565,7 +655,7 @@ module PWN
                                .map { |e| e[:content].to_s[/\A([a-z0-9_]+)\s*→/i, 1] }
                                .compact
                                .uniq
-          names.each { |n| Metrics.record_judge(name: n, score: score) }
+          names.each { |n| Metrics.record_judge(name: n, score: score, confidence: conf) }
         rescue StandardError
           nil
         end
@@ -680,6 +770,23 @@ module PWN
           lessons.uniq.first(5)
         end
 
+        # P26 — is this CLAIM_RX hit worth spending a headless browser on?
+        # Reject metric crumbs, OS/runtime banner lines, and bare versions.
+        private_class_method def self.checkable_claim?(opts = {})
+          c = opts[:claim].to_s.strip
+          return false if c.empty? || c.length < 8
+          return true if c.match?(/CVE-\d{4}-\d{4,7}/i)
+
+          head = c[/\A[A-Za-z][\w.+-]*/].to_s
+          return false if CLAIM_METRIC_WORDS.any? { |w| head.casecmp?(w) }
+          # require full semver x.y.z for non-CVE claims
+          return false unless c.match?(/\bv?\d+\.\d+\.\d+/)
+
+          true
+        rescue StandardError
+          false
+        end
+
         # Auto fact-check post-filter: local models hallucinate CVEs /
         # versions ~5-10x more than frontier ones. When the active engine is
         # :ollama, scan the final for CVE / version-shaped claims and hand
@@ -690,7 +797,8 @@ module PWN
           return unless defined?(PWN::Env) && PWN::Env.dig(:ai, :active).to_s.downcase.to_sym == :ollama
           return unless defined?(Extrospection) && Extrospection.respond_to?(:verify)
 
-          claims = opts[:final].to_s.scan(CLAIM_RX).flatten.compact.uniq.first(3)
+          claims = opts[:final].to_s.scan(CLAIM_RX).flatten.compact.uniq
+          claims = claims.select { |c| checkable_claim?(claim: c) }.first(3)
           claims.each { |c| Extrospection.verify(claim: c, commit: true) }
         rescue StandardError => e
           warn "[pwn-ai/learning] fact_check swallowed: #{e.class}: #{e.message}"

data/lib/pwn/ai/agent/loop.rb

@@ -112,8 +112,15 @@ module PWN
           n = [n, cal[:max_iters_cap]].min if cal[:overconfident]
           # P17 — tighter default when agent_loop budget_exhaustion dominates
           # open mistakes: finish-under-N is the skill gap, not more thrash.
+          # Caps are intentionally harsh (8 local / 12 remote): the open
+          # fingerprint is "iteration budget exhausted" ×N; more headroom
+          # only produces more empty terminal failures for ORM/PRM/DPO.
           if budget_exhaustion_hot?
-            n = [n, active_engine == :ollama ? 12 : 20].min
+            # Remote/overconfident thrash (this host): 12 was still burning full
+            # 12-step tool plans. Cap tighter when calibration also says overconfident.
+            base = active_engine == :ollama ? 8 : 12
+            base = [base, 8].min if cal[:overconfident]
+            n = [n, base].min
           end
           n
         rescue StandardError
@@ -261,17 +268,31 @@ module PWN
         # without leaking to the user.
         private_class_method def self.plan_first(opts = {})
           messages = opts[:messages]
+          # P17 — under budget_exhaustion_hot the plan must be ultra-short:
+          # red_team_plan is a nested agent loop and was the #1 amplifier of
+          # iteration-budget exhaustion on this host (together with CF).
+          hot = begin
+            budget_exhaustion_hot?
+          rescue StandardError
+            false
+          end
+          plan_prompt = if hot
+                          'Before acting: write AT MOST 3 numbered tool calls (name + key args) that finish the ask. Prefer fewer. LAST line: "p(success)=<0.0-1.0>". Reply ONLY with the plan + that line — no tools, no prose.'
+                        else
+                          'Before acting: (1) list the exact tool calls (name + key args) you will make, in order; (2) on the LAST line write "p(success)=<0.0-1.0>". Reply ONLY with the numbered plan + that line — do NOT call any tool yet.'
+                        end
           plan_msg = call_engine(
-            messages: messages + [{ role: 'user',
-                                    content: 'Before acting: (1) list the exact tool calls (name + key args) you will make, in order; (2) on the LAST line write "p(success)=<0.0-1.0>". Reply ONLY with the numbered plan + that line — do NOT call any tool yet.' }],
+            messages: messages + [{ role: 'user', content: plan_prompt }],
             tools: nil
           )
           return nil unless plan_msg && !plan_msg[:content].to_s.strip.empty?
 
           plan = plan_msg[:content].to_s.strip
           messages << { role: 'assistant', content: "PLAN:\n#{plan}" }
-          # S4 — adversarial plan review grounded in THIS host's telemetry
-          if defined?(Curriculum)
+          # S4 — adversarial plan review grounded in THIS host's telemetry.
+          # P17 — never fork red_team when budget fingerprints dominate: it is
+          # another mini agent loop and compounds iteration-budget exhaustion.
+          if defined?(Curriculum) && !hot
             rt = Curriculum.red_team_plan(request: opts[:request], plan: plan)
             messages << { role: 'user', content: rt } if rt
           end
@@ -563,7 +584,25 @@ module PWN
             # 3.1 — compact history on local so tool dumps don't fill num_ctx
             compact_history!(messages: messages) if local
 
-            msg = call_engine(messages: messages, tools: tools)
+            # P17 — on the final iteration, strip tools and demand a plain-text
+            # answer. Without this the model happily emits one more tool_calls
+            # batch, burns the last slot, and lands on budget_exhausted with
+            # nothing the user (or ORM) can use.
+            # P17 deepen — when budget_hot, force text-only on the LAST TWO
+            # iters so a final tool_calls batch cannot burn the terminal slot.
+            text_only_iters = budget_exhaustion_hot? ? 2 : 1
+            last_iter = (i >= max_iters - text_only_iters)
+            if last_iter
+              tag = i >= max_iters - 1 ? 'FINAL ITERATION' : 'PENULTIMATE — wrap up'
+              messages << {
+                role: 'user',
+                content: "[pwn-ai/p17] #{tag} — do NOT call any more tools. " \
+                         'Write the best answer you can from evidence already in this ' \
+                         'transcript. If blocked, say what failed and the next single step.'
+              }
+            end
+
+            msg = call_engine(messages: messages, tools: last_iter ? nil : tools)
             return '[pwn-ai] engine returned no message' if msg.nil?
 
             calls = Array(msg[:tool_calls])
@@ -613,7 +652,10 @@ module PWN
                 # alt-persona branch, judge both, inject the winner. Real
                 # advantage estimation; (loser, winner) → DPO preference.
                 thresh = defined?(Mistakes) ? Mistakes::REPEAT_THRESHOLD : 3
-                if count >= thresh && !escalated && defined?(Curriculum)
+                # P17 — never fork counterfactual when budget fingerprints dominate:
+                # CF is another mini agent loop and is the #1 amplifier of
+                # iteration-budget exhaustion on this host.
+                if count >= thresh && !escalated && defined?(Curriculum) && !budget_exhaustion_hot?
                   cf = (turn_fails["cf:#{fkey}"] += 1) == 1 ? Curriculum.counterfactual(request: request, name: name, args: args, error: tele[:err] || raw[0, 200], hint: hint) : nil
                   hint = "#{hint}\n[pwn-ai/counterfactual] branch #{cf[:branch]} (score=#{cf[:score].round(2)}): #{cf[:content]}" if cf
                 end
@@ -670,8 +712,29 @@ module PWN
             escalated = true
           end
 
-          Mistakes.record(tool: 'agent_loop', error: 'iteration budget exhausted without a final answer', session_id: session_id, source: :loop, shape: :budget_exhausted) if defined?(Mistakes)
-          '[pwn-ai] iteration budget exhausted'
+          # P17 — exhaust path must still feed Learning so ORM/PRM/HER see the
+          # failure (previously we only Mistakes.record'd and returned a bare
+          # string — no session row, no judge, no hindsight).
+          final_msg = '[pwn-ai] iteration budget exhausted'
+          if defined?(Mistakes)
+            Mistakes.record(
+              tool: 'agent_loop',
+              error: 'iteration budget exhausted without a final answer',
+              session_id: session_id,
+              source: :loop,
+              shape: :budget_exhausted
+            )
+          end
+          append_session(session_id: session_id, role: 'assistant', content: final_msg)
+          if defined?(Learning) && should_auto_introspect?(local: local, turn_fails: turn_fails, iter: max_iters)
+            Learning.auto_introspect(
+              session_id: session_id,
+              request: request,
+              final: final_msg,
+              predicted: predicted
+            )
+          end
+          final_msg
         end
 
         # Author(s):: 0day Inc. <support@0dayinc.com>

data/lib/pwn/ai/agent/metrics.rb

@@ -166,7 +166,23 @@ module PWN
             "  - #{r[:name]}: calls=#{r[:calls]} success=#{(adj * 100).round(1)}%#{tag}#{jtag} avg=#{r[:avg_duration]}s#{err}"
           end
           warn_line = distrust.positive? ? "WARNING: reward proxy diverges from judge — success rates haircut by distrust=#{distrust.round(2)}; prefer judge-scored exemplars over raw rates.\n" : ''
-          "#{warn_line}TOOL EFFECTIVENESS (#{scope}, adapt tool choice accordingly)\n#{lines.join("\n")}\n\n"
+          # P0 ops — surface W1 generator_mix when diet is unhealthy so the
+          # online controller (and the model) prefer underfilled sources.
+          mix_line = ''
+          if defined?(Reward) && Reward.respond_to?(:generator_mix)
+            begin
+              m = Reward.generator_mix
+              unless m[:healthy]
+                mix_line = "W1 MIX: n=#{m[:n]} traj=#{m[:trajectory_fraction]} " \
+                           "urgent=#{Array(m[:urgent]).join(',')} " \
+                           "suppress=#{Array(m[:suppress]).join(',')} " \
+                           "rec=#{m[:recommendation]}\n"
+              end
+            rescue StandardError
+              mix_line = ''
+            end
+          end
+          "#{warn_line}#{mix_line}TOOL EFFECTIVENESS (#{scope}, adapt tool choice accordingly)\n#{lines.join("\n")}\n\n"
         end
 
         # P4 helper — Registry.rank calls this so β·advantage is scaled down
@@ -239,30 +255,51 @@ module PWN
           0.0
         end
 
-        # P18 — rolling mean step_reward for a tool (from Reward.prm annotations
-        # folded into Metrics via record_step_reward). Range ≈ [-1, 1].
+        # P18/P2 — rolling mean step_reward advantage for a tool.
+        # Sample-efficiency gate: < PRM_MIN_N samples → 0 (no rank noise).
+        # Shrinkage: adv *= min(1, n/PRM_FULL_N) so sparse signal cannot
+        # dominate UCB. Zero-variance windows (all +1 or all -1 from a
+        # single session) damp to 0.5×.
+        PRM_MIN_N  = 5
+        PRM_FULL_N = 20
+
         public_class_method def self.prm_advantage(opts = {})
           data = load[:tools] || {}
           t = data[opts[:name].to_s.to_sym]
           return 0.0 unless t
 
           win = Array(t[:prm_window])
-          return 0.0 if win.empty?
+          n = win.length
+          return 0.0 if n < PRM_MIN_N
 
-          mean = win.sum.to_f / win.length
-          # global mean across tools that have prm signal
-          globals = data.values.map { |v| Array(v[:prm_window]) }.reject(&:empty?)
+          mean = win.sum.to_f / n
+          globals = data.values.map { |v| Array(v[:prm_window]) }.select { |w| w.length >= PRM_MIN_N }
           gmean = if globals.empty?
                     0.0
                   else
                     all = globals.flatten
                     all.sum.to_f / all.length
                   end
-          (mean - gmean).round(3)
+          adv = mean - gmean
+          # shrinkage toward 0 until PRM_FULL_N
+          shrink = [n.to_f / PRM_FULL_N, 1.0].min
+          # variance damp: if all equal, halve influence
+          uniq = win.uniq
+          var_damp = uniq.length <= 1 ? 0.5 : 1.0
+          (adv * shrink * var_damp).round(3)
         rescue StandardError
           0.0
         end
 
+        public_class_method def self.prm_n(opts = {})
+          t = (load[:tools] || {})[opts[:name].to_s.to_sym]
+          return 0 unless t
+
+          Array(t[:prm_window]).length
+        rescue StandardError
+          0
+        end
+
         # P18 — called by Reward.prm after session annotate so live routing
         # can bias toward tools that recently advanced goals (+1 step_reward).
         public_class_method def self.record_step_reward(opts = {})
@@ -290,10 +327,12 @@ module PWN
           return if name.empty?
 
           score = opts[:score].to_f.clamp(0.0, 1.0)
+          conf  = opts.key?(:confidence) ? opts[:confidence].to_f.clamp(0.0, 1.0) : 0.7
           m = load
           m[:tools] ||= {}
           t = m[:tools][name.to_sym] ||= blank_bucket
           t[:judge_window] = (Array(t[:judge_window]) + [score]).last(40)
+          t[:judge_conf_window] = (Array(t[:judge_conf_window]) + [conf]).last(40)
           t[:judge_sum] = t[:judge_window].sum.to_f
           t[:judge_n] = t[:judge_window].length
           save(metrics: m)
@@ -302,6 +341,19 @@ module PWN
           nil
         end
 
+        # P1 — mean judge confidence for a tool (nil when no samples).
+        public_class_method def self.judge_confidence(opts = {})
+          t = (load[:tools] || {})[opts[:name].to_s.to_sym]
+          return nil unless t
+
+          win = Array(t[:judge_conf_window])
+          return nil if win.empty?
+
+          (win.sum.to_f / win.length).round(3)
+        rescue StandardError
+          nil
+        end
+
         # Mean judge score for a tool (nil when no ORM samples yet).
         public_class_method def self.judge_rate(opts = {})
           t = (load[:tools] || {})[opts[:name].to_s.to_sym]
@@ -331,8 +383,15 @@ module PWN
           distrust = 1.0 - proxy_trust
           jrate = judge_rate(name: name)
           if distrust > 0.05 && !jrate.nil?
-            # blend: higher distrust → more judge weight
-            ((proxy * (1.0 - distrust)) + (jrate * distrust)).clamp(0.0, 1.0).round(3)
+            # P1 — scale judge weight by judge confidence so a thin local
+            # heuristic ORM cannot fully replace proxy when distrust is high.
+            # effective_distrust = distrust * mean(confidence), floor 0.15 when
+            # we do have judge samples so the signal still moves the needle.
+            jconf = judge_confidence(name: name)
+            jconf = 0.7 if jconf.nil?
+            eff_d = (distrust * jconf).clamp(0.0, 1.0)
+            eff_d = [eff_d, 0.15].max if jconf >= 0.3
+            ((proxy * (1.0 - eff_d)) + (jrate * eff_d)).clamp(0.0, 1.0).round(3)
           else
             proxy.round(3)
           end

data/lib/pwn/ai/agent/registry.rb

@@ -145,8 +145,27 @@ module PWN
           trust = defined?(Metrics) && Metrics.respond_to?(:proxy_trust) ? Metrics.proxy_trust : 1.0
           beta  = 0.3 * trust
           gamma = 0.2
-          # P18 — PRM step_reward advantage closes R2 into the controller
-          delta = 0.25 * trust
+          # P18/P2 — PRM step_reward advantage closes R2 into the controller.
+          # Sample-efficiency: if fewer than 3 tools have prm_n≥PRM_MIN_N,
+          # drop delta to 0 so sparse PRM cannot inject rank variance.
+          # Otherwise scale delta by fleet coverage fraction.
+          prm_ready = 0
+          if defined?(Metrics) && Metrics.respond_to?(:prm_n)
+            prm_ready = entries.count do |e|
+              Metrics.prm_n(name: e.name).to_i >= begin
+                Metrics::PRM_MIN_N
+              rescue StandardError
+                5
+              end
+            end
+          end
+          fleet = [entries.length, 1].max
+          coverage = prm_ready.to_f / fleet
+          delta = if prm_ready < 3
+                    0.0
+                  else
+                    0.25 * trust * [coverage / 0.3, 1.0].min
+                  end
           scored = entries.map do |e|
             hay   = "#{e.name} #{e.toolset} #{e.schema[:description]} #{Array(e.schema.dig(:parameters, :properties)&.keys).join(' ')}".downcase
             sim   = tokens.count { |t| hay.include?(t) }