pwn 0.5.766 → 0.5.771

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 48f9dad90543bf3140d52f14058c9b59c0e011daa42b8729ff4614fb01b34d60
-  data.tar.gz: e04116b2e14a9f728a1a583762ad9395f4858dcad190211c05988e8e5d60830b
+  metadata.gz: 4a5ecce60b421a59e80f691710dd5ae25cd79d083b59207b25baccf8fe8e5b35
+  data.tar.gz: 725ceb379d5436565b707e29d26e61e9cc10262b31e7cec537aec0e210d77fea
 SHA512:
-  metadata.gz: e10732fcb06f209fd72fa0518241143fb9dccd448fdbf75c0d78d0da155ef0206f2bd068906e4be0b8605e1a15d73a7f1844f1a10b9f756f0cc34ff3b788495d
-  data.tar.gz: 734bef29b1fb747424b676a0277095175b37816b6b7ca272dd3ff720ec36872ab69a7700afc10f74ba6542c7855282a97666ae6127e1bf8ccc66c78b8a5c3b1c
+  metadata.gz: b94c6d9ca4ebb2cf3835ed1f6951a15eae48e3484966e272861105a1c361964fd90235731e8c9ccfd10cfa03af736b42d69edb990b17aed37cd1c1504954ed11
+  data.tar.gz: 39dd6eac404a8f55906c56f9dda74836bd9b934374eea9a8168d556b383ccfd69722b1a16debc893d20a0e58f37adfce54da11fef999a0666bf4f9a4f2258863

data/Gemfile

@@ -20,7 +20,7 @@ gem 'base32', '0.3.4'
 gem 'bitcoin-ruby', '0.0.20'
 gem 'brakeman', '8.1.0'
 gem 'bson', '5.2.0'
-gem 'bundler', '>=4.0.22'
+gem 'bundler', '>=4.0.23'
 gem 'bundler-audit', '>=0.9.3'
 gem 'bunny', '3.4.0'
 gem 'colorize', '1.1.0'
@@ -50,7 +50,7 @@ gem 'libusb', '0.8.0'
 gem 'luhn', '3.0.0'
 gem 'mail', '2.9.1'
 gem 'mcp', '1.7.0'
-gem 'meshtastic', '0.0.187'
+gem 'meshtastic', '0.0.188'
 gem 'metasm', '1.0.6'
 gem 'mongo', '2.26.0'
 gem 'msfrpc-client', '1.1.2'
@@ -94,7 +94,7 @@ gem 'selenium-webdriver', '4.51.0'
 gem 'slack-ruby-client', '3.3.0'
 gem 'socksify', '1.8.1'
 gem 'spreadsheet', '1.3.5'
-gem 'sqlite3', '2.9.6'
+gem 'sqlite3', '2.10.0'
 gem 'thin', '2.0.1'
 gem 'tty-prompt', '0.23.1'
 gem 'tty-spinner', '0.9.3'

data/documentation/Configuration.md

@@ -234,6 +234,7 @@ plugins:
         topic: 2/e/#               # MQTT topic filter to subscribe/publish for this channel.
         channel_num: 8             # Meshtastic channel index (slot number on the device).
         from: '!deadbeef'          # Sender node id used on outbound packets. Optional - defaults to !<mqtt client_id>.
+        short_name:                # Optional display name for that from node. When set, it replaces the last four bytes of from.
       PWN:                         # Example second (private) channel definition.
         psk: ...                     # Private channel pre-shared key (base64). Redacted.
         region: US/UT              # LoRa region tag for this channel.
@@ -403,6 +404,7 @@ PWN::Config.refresh_env
 | `plugins.meshtastic.channel.<NAME>.topic` | String | - | `pwn-mesh` | MQTT topic filter to subscribe/publish (e.g. `2/e/#`). |
 | `plugins.meshtastic.channel.<NAME>.channel_num` | Integer | - | `pwn-mesh` | Meshtastic channel index. |
 | `plugins.meshtastic.channel.<NAME>.from` | String | `!<mqtt client_id>` | `pwn-mesh` | Sender node id used on outbound packets. |
+| `plugins.meshtastic.channel.<NAME>.short_name` | String | - | `pwn-mesh` | Optional short name for that `from` node. A non-empty value is shown instead of the last four bytes of `from`. |
 | `plugins.shodan.api_key` | String | - | `PWN::Plugins::Shodan` | Shodan API key (passed as `api_key:` to `Shodan.*`). |
 
 ### `memory` / `sessions` / `cron`

data/documentation/General-PWN-Usage.md

@@ -51,6 +51,74 @@ history                             # what you've typed → copy into a driver
 | `welcome-banner` | Redraw a random `PWN::Banner` |
 | `toggle-pager` | Pry pager on/off |
 
+### Concurrent mesh reception and reply routing
+
+`pwn-mesh` keeps the selected primary transport for manual TX and RX. A
+nonempty `plugins.meshtastic.mqtt` configuration also opens an independent
+MQTT receiver when the primary is Serial, Bluetooth, or TCP. Missing/empty
+MQTT configuration makes no additional connection attempt; primary MQTT uses
+only one subscription. MQTT connection failures leave the primary usable and
+are reported in the UI. `/transport` reconnects both subscriptions; `/back`
+closes them. Ctrl+T switches the active pane between COMPOSE and
+CONVERSATION. COMPOSE keeps Up/Down history. CONVERSATION scrolls with
+Up/Down one row, PgUp/PgDn a page, Home to the top, and End to the live
+bottom. The live bottom is not row 0, so PgDn there stays put. Typing or
+Enter returns to COMPOSE; Enter does not send while CONVERSATION is active.
+The active title is reversed and marked active.
+
+There is **no dual TX or automatic bridging**. Compose and `/msg` use only the
+selected primary, including explicit node/channel targets. The implicit `/msg`
+target remains the primary's last sender/channel; secondary MQTT arrivals do
+not change it. Automatic AI replies instead use only the connection that
+received the triggering message. A duplicate arriving over both links is
+displayed once. If that packet is also seen on Serial, Bluetooth, or TCP, the
+row is relabeled to that primary transport even when MQTT arrived first.
+MQTT remains the label only when it is the sole observation. Automatic AI
+replies still use the first owning connection, not the display label. Dedup
+uses sender, packet ID, network/channel path, destination and payload (not
+text alone), retaining at most 1000 packets for five minutes. No-ID packets
+cannot be safely merged.
+
+Each header ends with the sender's last known position. A valid fix is
+`lat,lon >> https://maps.google.com/?q=lat,lon` on that same header. The pane
+wraps on ` · `, and only at ` >> ` if the GPS field itself does not fit, so
+the coordinate is not split. This is the compact Maps URL; a maps.app.goo.gl
+code cannot be minted without a Google share request. Unknown, unset, or
+out-of-range positions display `GPS N/A` and omit the URL. `0,0` is kept when
+a real location source is present and omitted when the source is unset. The
+value is the last position recorded for that sender, not a freshness guarantee.
+
+MQTT TX uses `channel.<name>.from` when set, otherwise the connected radio's
+node number, otherwise a node-shaped `mqtt.client_id`. It does not publish the
+Meshtastic library default `!00000b0b` when one of those identities exists.
+When that `from` value is not empty, the short name for that node is its last
+four bytes, unless the same channel sets a non-empty `short_name`. Other
+senders keep their own short names.
+
+AI dispatch still requires the toggle, a private channel PSK, `ai_whitelist`,
+and leading `@ai`. MQTT-origin shared-channel replies publish through that
+MQTT connection only; radio-origin replies use that radio only. MQTT PKI DMs
+remain unsupported: no AI DM dispatch, no radio fallback, and no plaintext or
+legacy-PSK DM fallback. Closing/replacing the origin while AI is running leaves
+its reply unsent. Host submission and local conversation display are not proof
+of RF or peer delivery.
+
+MQTT TX selects the resolved channel name explicitly as `channel_id` (for
+example, `LongFast`); the Meshtastic encoder calculates its wire channel hash.
+That name is not the radio's numeric slot or the legacy `channel_num` setting.
+Multiple configured names may share a PSK without changing the reply channel.
+Radio replies retain the received slot; an unnamed slot with an ambiguous PSK
+needs an explicit `radio_index` mapping rather than choosing the first key.
+
+AI conversations use durable `PWN::Sessions` transcripts scoped to the sender,
+network/channel, private channel key and destination. Reconnecting or receiving
+the same scope on another transport keeps that history; ordinary non-`@ai` RX
+does not create an AI session. Session/runtime/provider errors are reported as
+`AI failed`, separately from `TX failed` after a reply has been generated.
+Broker EOF/protocol errors appear as bounded, generation-scoped UI notices;
+they close the failed receiver without a Ruby thread crash dump. Use
+`/transport` to open fresh subscriptions rather than replaying failed AI sends.
+
 ## A 60-second attack chain
 
 ```ruby

data/documentation/Harness-Evaluation.md

@@ -0,0 +1,312 @@
+# Deployment fingerprints and fair harness evaluation
+
+## Deployment diagnosis
+
+`PWN::RuntimeFingerprint.report(expected_root: '/intended/gem/lib')` is read-only.
+The existing pwn-ai `/status` prints the report. The observer starts from `pwn.rb`,
+before version/config loading. It reports PID, Linux boot ID/process start ticks
+(or unavailable), observer timestamp, loaded version, activated gem root, actual
+loaded Ruby source paths, SHA-256 observed on disk at compilation, and current
+on-disk SHA-256. Changed or missing observed source and expected-root mismatches
+require restart. Unknown pre-observer bytes are **not** reported as a match.
+
+These are disk observations at compilation, **not VM bytecode attestation**.
+Concurrent replacement during compilation, native extensions, evaluated strings,
+and later monkey patches cannot be attested. `restart_required: false` means no
+known mismatch, not proof every component is current. `pwn.rb` and the observer
+itself were compiled before observation and intentionally remain unknown.
+
+Preserve the original request, session ID, request checkpoint and evidence first.
+Rebuild/install the intended tree, restart the process, and recheck the report.
+Do not hot-reload an active request or equate restoring a checkpoint with safely
+replaying a side effect. No automatic deployment or recovery mutation occurs.
+
+## Offline acceptance (no credentials or provider calls)
+
+```sh
+HOME=$(mktemp -d /tmp/pwn-rspec-home.XXXXXX) bundle exec rspec \
+  spec/integration/harness_evaluation_spec.rb \
+  spec/integration/harness_package_spec.rb \
+  spec/integration/harness_layout_spec.rb
+```
+
+RSpec owns acceptance and is included in the default offline `bundle exec rake`
+gate. Callable execution/grading helpers and subprocess-only preloads live in
+`spec/support/harness`; locked JSON manifests, independent gold and SHA-256 files
+live in `spec/fixtures/harness`. Helpers are explicitly required, not recursively
+loaded into the test process: the provider preloads must only run in isolated
+children. There is no separate script-suite CLI. The package example builds and
+executes the installed gem, not a mocked packaging check.
+
+The package lane copies current tracked and nonignored untracked working files
+into a temporary checkout, records every copied SHA-256, builds the actual gem,
+installs it using `--local --ignore-dependencies` into a temporary GEM_HOME, and
+runs that installation's **actual pwn-ai executable → CLI → Loop → provider →
+Dispatch → shell**. It never stages the source checkout or modifies its installed
+gem. Dependencies are read from existing gem paths; this is **not** proof of a
+clean dependency installation. Source edits concurrent with snapshot creation
+are represented by the copied-byte ledger, not an atomic Git revision claim.
+
+Each subprocess gets an isolated temporary HOME and cleared environment. The
+configuration loader and provider methods are replaced in a test-only preload;
+transparent observers forward to real Dispatch, Learning and Swarm methods.
+Fault stimuli supply public Loop runtime/steering options without replacing its
+implementation. Loop, Dispatch, the verifier and tools remain real. The commands are local
+file operations. HTTP/TCP provider access is rejected, and no credentials are
+passed. This is not a general OS-level sandbox for arbitrary untrusted fixtures.
+The preload is never selected by production configuration.
+
+The fixed public tasks cover exact-file output, structured extraction, safe Ruby
+coding and a nonexecuted parameterized-SQL toy classification. Grading reads
+actual artifact bytes against authored literal expectations, separately from
+provider text. An intentionally wrong artifact with a success claim must remain
+FAIL with CLI exit 1 and `false_success: false`. The arbiter checks the explicit
+`containing exactly ... followed by newline` literal against the observed digest;
+this deliberately narrow grammar is not a general natural-language content judge.
+The CLI now derives its exit code from the persisted outcome, not answer prose.
+A detected false success is a defect and fails the evaluator itself. Fixture
+outcomes are not evidence of live model competence.
+
+`runtime_faults.rb` retains the older, explicitly labeled component fixtures.
+`cli_faults.rb` adds actual executable → Loop → runtime → real shell fault lanes:
+
+- **Compaction plus additive steering:** real writes/reads generate long context,
+  a small runtime window forces EngagementMemory, a public Steering submission
+  adds a second deliverable, and independent checks require both actual files.
+- **Provider retry after a successful effect:** the fake provider raises EOFError,
+  the real retry path recovers, and the effect log must still contain one write.
+- **Cancel during a blocked provider:** after one real write, Steering cancels
+  the sleeping provider; the runtime must be cancelled, no final claim released,
+  and the CLI nonzero. This is not a native-terminal Ctrl+C test.
+- **Checkpoint restart:** one real mutation times out, the process exits abruptly,
+  then a new CLI process restores the same request and refuses duplicate replay.
+- **Hard resource cap and restart:** after at most 35 seconds of bounded executable
+  startup, an observed provider-fault readiness marker arms a four-second hard
+  process-group cap. The supervisor records INCOMPLETE, restores the real checkpoint
+  and proves that the uncertain mutation is not repeated. Missing readiness cannot
+  pass this lane. This separates cold gem activation from the injected blocked
+  provider: killing a still-booting executable proves neither effect nor recovery.
+
+The fault preload supplies public request/session/runtime/steering objects.
+These are real CLI integration tests with injected controls; the separate
+`session_acceptance.rb` exercises public session selection and replacement approval
+without injected runtime objects. They cover finite stimuli, not every provider HTTP
+retry implementation. Package acceptance runs these same lanes against installed
+gem code and checks deployment fingerprints. No live provider is contacted.
+
+The additional baseline `timeout-replay` task executes one append before timeout,
+refuses the second mutation, and must exit nonzero. The evaluator now reports
+INCOMPLETE when a real observed Dispatch timeout prevents success; it does not
+mistake an incomplete task for model-quality failure or hide it from results.
+
+## Request-lifetime integration boundary
+
+RequestRuntime persists tool start/end events and uncertain mutation fingerprints
+before releasing results. An interrupted write is not automatically replayed,
+including after checkpoint restore. Changing the action ID or timeout does not
+change that fingerprint. This is conservative uncertainty handling, not proof of
+remote exactly-once execution; spelling changes can still change the fingerprint.
+Explicit caller timeouts are not increased by Dispatch on runtime-owned requests.
+Legacy standalone Dispatch budgeting remains separate. Runtime-owned inference
+has one total provider/profile attempt allowance; all six provider adapters use
+private configuration snapshots and one transport attempt under that owner.
+
+Runtime-bound OpenGoal files are session/request-keyed, private atomic JSON, with
+a session pointer for bare `continue` in the same session. Legacy global records
+are read only for their matching session. Checkpoint generations reject stale
+writers. Loop also holds an exclusive per-session execution flock for the entire
+request, acquired before runtime loading/checkpointing and released on return,
+exception or process death. This is separate from Sessions' shared cleanup lease;
+both apply to real CLI/TUI requests. Distinct sessions remain independent. The
+session execution lock serializes OpenGoal pointer updates on production Loop
+paths; individual atomic file writes are not a general multi-file transaction.
+A new one-shot CLI session is not an automatic cross-session resume.
+
+Explicit operator entry points:
+
+```sh
+pwn-ai --resume-session EXACT_SESSION_ID
+pwn-ai --ai 'New objective' --verification-contract /path/to/authored.json
+pwn-ai --replace-session EXACT_SESSION_ID --ai 'Replacement objective' \
+  --verification-contract /path/to/replacement.json --approve-replacement
+```
+
+`--resume-session` rejects a replacement prompt/contract, selects the saved request
+identity, and preserves its original objective, permissions and authored checks.
+The existing TUI Sessions workspace and `/sessions resume ID` select exact stable
+session IDs; a subsequent `continue` uses the same core restore path. A replacement
+requires explicit approval, creates a **new** request identity and contract, and
+retains the old checkpoint unchanged. It never edits the immutable original
+objective or weakens an existing request's contract. `--resume RUN_ID` still means
+TaskDAG resume and is not repurposed. Bare steering `replace:` remains an explicit
+operator instruction; an existing authored contract is not replaced by steering.
+
+Nested Loop turns now bind their own runtime artifact contract. Completed child
+host receipts cross the enclosing Loop boundary only for a parent-required exact
+path, matching child turn, current stat/readback/SHA-256 and a child started during
+the parent request. Parent receipts retain child request/turn/action provenance.
+The parent reruns its own literal/authored integration checks; child prose is never
+proof. `swarm_acceptance.rb` executes agent_spawn → agent_ask → nested Loop and
+real shell operations for correct, lying, preexisting/stale, missing and later
+tampered artifacts. Negative task outcomes remain blocked/nonzero; PASS there
+means the rejection invariant held, not that the requested work succeeded.
+
+For nonreasoning OpenAI requests, explicit or configured temperature `0` is now
+preserved in the actual serialized HTTP payload. The adapter regression intercepts
+RestClient at the transport boundary rather than checking declared settings alone.
+This is offline payload evidence, not a paired live reference-provider comparison.
+
+Host-supplied verification contracts and tool permissions survive checkpoint
+reload. Dispatch checks runtime permissions in addition to existing boundaries.
+Additive steering verification binds the ordered original/amendment transcript,
+not merely the last user line. Verifier events include original/effective request
+and amendment digests, and report requirement character spans. An explicit
+`answer` check compares actual final text and, when supplied, quoted/cited source
+files through the bounded in-root verifier. No assistant PASS string is evidence.
+These authored checks do not imply arbitrary research-answer semantic coverage.
+
+These fixtures do not by themselves certify universal retry ownership, every
+provider configuration, general semantic verification or scheduler correctness.
+Those production requirements need their own acceptance evidence. An executable
+arm which exposes a production defect remains FAIL and fails the aggregate
+acceptance; actual correct artifact bytes do not override a nonzero CLI exit.
+
+Results preserve stdout, stderr, exit/signal status, observed provider calls,
+fingerprints, artifact hashes, wall latency, fixture-marked repeated effects and
+interventions. Distinct effect IDs are distinct writes, not duplication: only
+repeated observed IDs contribute to repeated_effects. Tool attempts alone do not.
+Unknown usage/cost and uninstrumented all-learning activity remain null. The
+parent supervisor kills the process group on wall cap and records INCOMPLETE,
+never success. A generic child error is not silently converted into a pass.
+
+## Recorded offline integration acceptance
+
+Final integration artifacts are retained under `/tmp/pwn-harness-final-acceptance`.
+These are local execution results, not live provider scores:
+
+- `HOME=/tmp/pwn-harness-final-acceptance/home bundle exec rake`:
+  **4369 examples, 0 failures**, then **1150 files, no RuboCop offenses**, exit 0
+  (`rake-post-package-fix.log`). The process was awaited through actual exit.
+- The focused Loop/runtime/Dispatch/Swarm/verifier/CLI/OpenAI/console/evaluator
+  suite: **423 examples, 0 failures**, exit 0 (`focused-post-package-fix.log`).
+- `HOME=/tmp/pwn-harness-final-acceptance/home bundle exec rubocop`:
+  **1150 files, no offenses**, exit 0 (`rubocop-post-package-fix.log`).
+- Historical offline evaluator run (before the RSpec layout migration):
+  exit 0. Four baseline tasks PASS; artifact-lie remains FAIL/exit1, and
+  timeout-replay remains INCOMPLETE/exit1 with no repeated effect. All five
+  executable fault acceptance lanes, eight frozen task/arm trials, five Swarm
+  evidence acceptance lanes and two public session-selection lanes passed.
+  Negative task outcomes were not relabeled successful work.
+- Reusing `offline-final/experiments` as the frozen source via
+  `HarnessExperiments.run(output: '/tmp/pwn-harness-final-acceptance/frozen-replay',
+  frozen: '/tmp/pwn-harness-final-acceptance/offline-final/experiments')` returned
+  exit 0 with equal snapshot digest, schedule, input hashes and graded outcomes.
+- Historical packaged acceptance output: `package-verified` beneath the artifact root above.
+  Current entry point: `bundle exec rspec spec/integration/harness_package_spec.rb`.
+  Its `acceptance.json` is the authority for installed execution and source-byte
+  equality, not the earlier source-only counts above.
+
+The initial real evaluator's two Swarm failures, temperature-zero red regression,
+cold-gem cap-before-readiness package failure and corrected lint failures remain
+in the acceptance ledger rather than being hidden. Natural-language truth requires
+authored checks; all live/private model
+comparison, quality and superiority claims remain **NOT_RUN**.
+
+## Live comparison protocol — NOT_RUN
+
+`manifest.json` and `adapters.json` have SHA-256 lock files. The runner rejects
+manifest drift. Adapter metadata pins the inspected reference source revision
+`601b550b4b5addecc0b6dacf9a472a54dd8c6799` and relevant source hashes. It documents
+real inspected entry points and constructor fields rather than invented CLI
+flags. The reference API is `run_agent.AIAgent(...).run_conversation(...)`.
+No reference agent or live provider is launched by the offline evaluator.
+`reference_adapter.py` is a separate optional Python-library boundary. It checks
+the source revision/hashes and real constructor signature, then invokes the
+public API with explicit provider, endpoint, model, reasoning, temperature via
+`request_overrides`, toolsets, token/iteration/wall budgets, fresh history, and
+disabled context files/memory/background review. It requires `--approve-live`,
+an explicitly supplied key, temporary HOME/cwd, a locked same-model parity
+manifest, reviewed sandbox/tool parity, and an operator-attested provider-side
+hard cost cap. Unknown or unequal provider/model/revision values reject execution.
+Raw returned data stays UNVERIFIED until an independent artifact checker grades
+it. Aggregate unobserved usage/cost remain null rather than fabricated zeros.
+
+The optional `spec/integration/harness_live_spec.rb` is tagged `:harness_live`
+and excluded unless `PWN_TEST_HARNESS_LIVE=1`. It never adds pending examples to
+the default gate. Explicit opt-in also requires `PWN_HARNESS_REFERENCE_SOURCE`,
+`PWN_HARNESS_LIVE_MANIFEST`, `PWN_HARNESS_PROMPT_FILE`, and `PWN_EVAL_API_KEY`;
+missing prerequisites fail rather than skip. The adapter's approval, locked
+parity, pinned-source, temporary HOME/cwd and cost-cap checks remain mandatory.
+This optional example observes only the reference API response; it does not
+establish a paired comparison or model-quality gain. No live lane was run for
+the layout migration.
+
+Safe static inspection (does not import the agent or read credentials):
+
+```sh
+python3 spec/support/harness/reference_adapter.py --inspect-source /path/to/pinned/reference/source
+```
+
+`live_comparison.json` deliberately has unselected provider/model/revision fields
+and unapproved budget/parity. It is not runnable until an operator supplies and
+locks those choices. Static API validation is not live provider validation or
+proof that both providers honor all parity settings on the wire.
+
+Before any comparison, fill and freeze the **same immutable model/version,
+reasoning setting, temperature, tools/permissions, task inputs, environment,
+iteration/token/wall/cost budget and learned snapshot** for both adapters. These
+fields are deliberately unselected, not guessed. Audit equivalent sandbox and
+sidecar behavior, instrument all provider calls and billable usage, and enforce
+operator-approved cost caps outside both agents. Missing parity means NOT_RUN.
+
+Use paired repeated seeds and randomized arm order. Freeze independently authored
+heldout tasks before tuning; these public scripted regression examples are not a
+private holdout. Keep raw transcripts and independent artifact checks. Report
+success, false-success, repeated effects, interventions, latency and observed
+usage/cost, including failures and caps; do not drop incomplete runs. Confidence
+intervals and claims of improvement require actual paired live trials.
+
+## Frozen split execution and scoped ablations
+
+`experiments.rb` executes separate train, validation and heldout task identities.
+`experiment_tasks.json` and separately authored `experiment_gold.json` are locked
+before execution. The checker reads actual bytes; gold is not included in provider
+fixtures or task workspaces. Duplicate task IDs, prompts or input bytes across
+splits are rejected. This checks explicit leakage, not semantic dataset similarity.
+The supplied public corpus and scripted provider are infrastructure regressions,
+**not a secret holdout, a live intelligence benchmark, or evidence of learning gains**.
+
+Training uses the real CLI and real Policy paths. After host byte checks succeed,
+the real Learning.note_outcome API records a labeled synthetic result without an
+invented reward score. The entire isolated training state is copied and frozen
+with a per-file hash ledger. Every evaluation trial clones it into a fresh HOME;
+no heldout writes flow back into the source snapshot or another trial. The runner
+checks the source ledger again after evaluation. Per-trial policy episode counts
+exclude episodes inherited from the snapshot. A seeded randomized schedule is
+recorded verbatim; reusing a frozen snapshot preserves the input state, not elapsed
+times or model randomness.
+
+All offered arms execute real PWN paths:
+
+| Arm | Executed path |
+| --- | --- |
+| `single-cold` | CLI → Loop, empty HOME, policy disabled |
+| `single-snapshot` | CLI → Loop → real learning retrieval, frozen training stores, policy disabled |
+| `single-policy` | CLI → Loop → Policy begin/observe/finish, same snapshot, per-trial writes |
+| `swarm-snapshot` | CLI → Dispatch agent_spawn/agent_ask → Swarm.ask → nested Loop → real shell; parent readback |
+
+Cold HOME is **not** an all-learning-off switch. The fixture disables automatic
+introspection/extrospection in every arm, but ordinary metrics and retrieval are
+real. No unimplemented all-learning-off/on arm is offered. Swarm provider calls,
+learning-context invocations and policy episodes are observed rather than inferred.
+These unequal fixture call counts are wiring evidence, not fair budget-normalized
+model superiority. Model quality remains NOT_RUN.
+
+For a diagnostic replay of a previously retained frozen training state, require
+`spec/support/harness/experiments` and call `HarnessExperiments.run(output: ...,
+frozen: ...)` from Ruby. Use a fresh `/tmp` output directory. This returns raw
+observations; the integration specs own acceptance, not a helper's exit status.
+Custom locked manifests and gold use the `manifest:` and `gold:` options. They
+are trusted local executable fixtures, not untrusted code; the HTTP guard is not
+an OS sandbox for arbitrary shell commands. Keep private benchmark gold outside
+any live agent sandbox. Do not tune on heldout outcomes.

data/documentation/pwn-ai-Agent.md

@@ -9,6 +9,75 @@ so it doesn't repeat it**.
 
 ## Two ways to run it
 
+### Local operator workspace
+
+The curses console exposes these local views through the command menu:
+
+* `/sessions` (or `/sessions picker`) opens a searchable picker. Type to filter
+  titles or stable IDs, use Up/Down to select, Enter to inspect local activity,
+  held activity lease, summary provenance, referenced-by paths and any recorded
+  unfinished goal, then `r` to resume that exact ID. Duplicate titles are never
+  guessed. Tab refreshes while preserving the selected ID. Esc restores the draft.
+* `/readiness` previews the configured four-role routes, credential **presence**
+  (never credential values), local required tool paths, workspace and limits.
+  `w` toggles optional Git-worktree execution, `+`/`-` sets 1–10 repair rounds,
+  `t` cycles the bounded per-check timeout and `r` cycles the per-role timeout.
+  These console-lifetime options
+  feed the next mission without modifying the objective or encrypted config.
+  Navigation never logs in, installs dependencies or calls a provider. Readiness
+  is not a connectivity test; task-specific dependencies are not inferred.
+* `/evidence` lists retained mission records and current console mission snapshots.
+  Enter inspects the original requirements, candidate revision, artifacts,
+  executed checks, observations, blockers and recorded outcome. Tab reloads
+  persisted records. A canceled mission retains its evidence. On a worktree
+  result, `d` opens the checksum-verified changed/deleted-file patch; `a` then
+  requires typing `APPLY <tested-revision>`. The backend rechecks source,
+  candidate, patch and tested revision before applying; it never stages or commits.
+  `x` requests removal of an owned checkout after typing `DISCARD <revision>`
+  (or its displayed ownership token before a candidate exists). A changed checkout
+  is refused with recovery guidance; patch and evidence are retained.
+  Running phase checkpoints are atomically persisted before publication, including
+  actual check records, uncovered requirements and repair reasons.
+  Worktrees isolate edits, **not** arbitrary code execution or network access.
+* `/sessions cleanup` previews the same provenance/dependency policy as scheduled
+  cleanup. Inspect the exact IDs, paths, fingerprints, retention reasons and
+  uncertainty. `a`, then Enter confirms only the displayed candidate set.
+  Newly discovered or changed records are excluded. Apply rechecks activity,
+  references and source bytes under locks, backs up candidate bytes, and reports
+  actual deletions and skipped records. No deletion happens during preview.
+* `/learning inbox` lists learning outcomes and retained skill proposals.
+  Enter inspects the exact procedure, source fields and fingerprints; `e` inspects
+  retained execution evidence. `a` approves, `x` rejects and `u` rolls back, each
+  requiring Enter confirmation. For skills, approval appends the proposed procedure
+  to an existing non-generated skill; rollback restores its backup only if the
+  approved file is unchanged. Source changes, absent or failing independent proof,
+  conflicted outcomes, generated skills and legacy proposals without procedure
+  payload remain blocked. Creation of a new skill is not enabled by this approval
+  API. Outcome decisions remain audit records, never fabricated training labels.
+  SkillReview evidence references use `learning_id` and `learning_sha256` for an
+  immutable learning row with retained full-session evidence and passing host
+  Verification checks. A model's `fixture_passed` assertion alone is insufficient,
+  including in `auto-safe` mode. No provider is called during review.
+* `/guide` is a short dismissible guide. Its numbered examples insert editable
+  draft text without executing it; existing drafts are retained. `x` records
+  dismissal in a private local preference marker; Esc closes without writing it.
+
+All these overlays support scrollback with PgUp/PgDn/Home/End and preserve the
+mission draft. Requested cancellation and pause are not reported as completion:
+pause becomes observed only at a coordinator boundary. Local list/readiness scans
+run on a coalesced event worker; stale results cannot replace a newly opened view.
+Ordinary curses and legacy steerable requests and missions share canonical-workspace
+admission locks; a second writer receives
+an actionable busy error. Other applications and unupgraded clients do not honor
+these advisory locks.
+
+For Ruby callers, `PWN::AI::Agent::Swarm.solve(request: objective, workspace: root,
+worktree: true, rounds: 3, verification_timeout: 60, role_timeout: 300)` uses the
+same mission backend. Timeouts are 1–600 seconds; rounds are 1–10. Worktree mode
+requires a clean Git root (including ignored and untracked files). It does not
+stage, commit or automatically apply the candidate. Preserve `request` verbatim;
+options are separate from the objective.
+
 ```text
 # 1. Interactive curses console (inside the pwn REPL)
 pwn[CURRENT_VERSION]:001 >>> pwn-ai
@@ -164,6 +233,7 @@ changes only default values, not the configuration schema; no migration is neede
 | PgUp/PgDn | Scroll the timeline; new output does not pull a scrolled viewport to the bottom |
 | `/model`, `/sessions resume ID` | Show model settings / change the next request's model or session while idle |
 | `/system-role` | Open the active engine's multiline SYSTEM ROLE CONTENT editor while idle; Ctrl+S saves, Esc cancels |
+| `/vault edit [key ...]` | Privately edit encrypted configuration or one nested mapping scope; Ctrl+S saves, Esc/Ctrl+C cancels |
 | `/steer INSTRUCTION` | Redirect the active request at a safe boundary |
 | `/input TEXT` | Send one line to an ordinary tool stdin prompt; not retained in input recall |
 | Ctrl+C | Cancel the active request cooperatively, or clear an idle draft |
@@ -197,6 +267,58 @@ the new role immediately, and a new session loads it from the vault. Request or
 swarm activity blocks role changes. No schema migration is required. The legacy
 non-curses interface reports that this editor requires an interactive terminal.
 
+### Private vault editor
+
+`/vault edit` opens the complete **PRIVATE YAML** document; `/vault edit ai
+anthropic` opens that nested mapping, and `/vault edit ai anthropic model`
+opens a scalar. Tokens identify one nested key path, never filenames or multiple
+disjoint scopes. The target and decryptor are the same `driver_opts.pwn_env_path`
+and `driver_opts.pwn_dec_path` used by `pwn-vault`, defaulting to
+`~/.pwn/pwn.yaml` and its existing `.decryptor` sidecar. Unknown paths are rejected; edit the parent mapping
+to add a new key. Arrays are edited as a whole, not by numeric path indices.
+Existing non-null types must be retained; an existing null may remain null or
+be replaced by a YAML value. The root must retain an `ai` mapping, a supported
+`ai.active`, and its engine mapping. Mapping keys may be added or removed within
+the selected scope. Duplicate keys, aliases, object tags and multiple documents
+are rejected. Nesting is limited to 100 mappings/sequences, including the merged
+full document and decryptor parsing, before recursive YAML conversion. Invalid
+input leaves the encrypted file intact. YAML formatting/comments are normalized on save.
+
+Enter inserts a newline, arrows move, Home/End move to the document ends and
+Ctrl+U clears. **Ctrl+S** explicitly saves encrypted; **Esc/Ctrl+C** discards
+changes, and Ctrl+D leaves without saving. Save errors remain redacted inside
+the modal so the text can be corrected. No editor contents enter SESSION,
+history, completion suggestions, logs or provider requests. Completion suggests
+only shipped schema key names, never reads/decrypts the vault, and never offers
+configuration values; existing custom keys can be typed explicitly.
+
+Plaintext is decrypted/edited in memory. Only encrypted bytes enter the private
+temporary file, which is atomically renamed over the vault using the same
+AES-256-CBC format/key/IV as `pwn-vault`; the decryptor is not regenerated.
+Save re-reads the current document, preserves changes outside the selected scope,
+and refuses a changed selected scope (the whole document for unscoped edits).
+Editor instances serialize saves with a directory lock; a final ciphertext check
+also detects intervening changes from other writers. Configuration is updated
+locally without running authentication or `Config.refresh_env`. Editing is
+blocked while a request/swarm is active. The legacy non-curses interface explains
+that an interactive curses console is required and makes no changes.
+
+### Bounded nested data
+
+JSON-bound tool results, schema copies/normalization, MCP arguments, Swarm key
+conversion and persistence redaction reject cyclic or over-deep containers with
+`JSON::NestingError`, using the serializer's 100-container default. Credential
+collection for result redaction walks the environment by identity without Ruby
+recursion, so repeated or cyclic mappings do not prevent credential replacement.
+Redaction validates even sensitive-field containers before inspecting them;
+invalid input fails closed rather than returning a raw value. Valid shared
+branches remain independent output copies and inputs are not modified.
+
+Local XML ingestion preflights element depth (maximum 100) before recursive
+REXML XPath/formatting, and rejects excessive nesting with `ArgumentError`
+before database or embedding work. These bounds cover the named preprocessing
+paths, not arbitrary Ruby/plugin callbacks or all possible VM stack failures.
+
 ### Model and reasoning selection
 
 `/model` (also `show` or `status`) displays the current selection. Existing

data/etc/default_cron/session_cleanup.rb

@@ -149,7 +149,7 @@ module PWN
       publish(File.join(result[:archive_dir], 'ledger.json'), JSON.pretty_generate(result))
     end
 
-    def self.run(dry_run: true, current_session_id: nil, proc_root: '/proc')
+    def self.run(dry_run: true, current_session_id: nil, proc_root: '/proc', approved_candidates: nil)
       raise 'Session cleanup requires the updated Sessions activity API; load the updated source or deploy it before running this helper' unless PWN::Sessions.respond_to?(:activate)
 
       root = PWN::Sessions.sessions_dir
@@ -177,6 +177,11 @@ module PWN
         end
         expected = snapshot(path)
         record[:files] = expected
+        if approved_candidates && approved_candidates[id] != expected
+          record[:skip] = :not_approved_or_changed
+          result[:skipped][:not_approved_or_changed] += 1
+          next
+        end
         result[:unnamed] += 1
         if PWN::Sessions.active?(session_id: id)
           record[:skip] = :active

data/etc/default_skills/pwn/ai/agent/dispatch/SKILL.md

@@ -36,6 +36,7 @@ PWN::AI::Agent::Dispatch.call(opts)
 - `call`
 - `repair_name`
 - `tool_calls_from_text`
+- `scheduling`
 - `effect`
 - `authors`
 - `help`

data/etc/default_skills/pwn/ai/agent/open_goal/SKILL.md

@@ -35,6 +35,7 @@ PWN::AI::Agent::OpenGoal.goal_file(opts)
 
 - `goal_file`
 - `current`
+- `for_session`
 - `begin`
 - `clear`
 - `resume`

data/etc/default_skills/pwn/ai/agent/skill_review/SKILL.md

@@ -36,6 +36,8 @@ PWN::AI::Agent::SkillReview.review(opts)
 - `review`
 - `review_turn`
 - `note_reuse`
+- `decide`
+- `evidence_transcript`
 - `authors`
 - `help`