pwn 0.5.784 → 0.5.787

data/documentation/diagrams/reinforcement-learning.svg

@@ -4,13 +4,13 @@
 <!-- Generated by graphviz version 14.1.2 (0)
  -->
 <!-- Title: PWN_Reinforcement_Learning Pages: 1 -->
-<svg width="978pt" height="901pt"
- viewBox="0.00 0.00 978.00 901.00" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">
+<svg width="1020pt" height="901pt"
+ viewBox="0.00 0.00 1020.00 901.00" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">
 <g id="graph0" class="graph" transform="scale(1 1) rotate(0) translate(28.8 872.29)">
 <title>PWN_Reinforcement_Learning</title>
-<polygon fill="#0f172a" stroke="none" points="-28.8,28.8 -28.8,-872.29 948.8,-872.29 948.8,28.8 -28.8,28.8"/>
-<text xml:space="preserve" text-anchor="start" x="178" y="-821.49" font-family="sans-Serif" font-weight="bold" font-size="20.00" fill="#e2e8f0">PWN::AI::Agent &#45; Reward + Curriculum Reinforcement Loop</text>
-<text xml:space="preserve" text-anchor="start" x="272.5" y="-810.04" font-family="sans-Serif" font-size="11.00" fill="#94a3b8">live accounting · optional curriculum / weights · explicit routing&#45;policy evaluation</text>
+<polygon fill="#0f172a" stroke="none" points="-28.8,28.8 -28.8,-872.29 990.8,-872.29 990.8,28.8 -28.8,28.8"/>
+<text xml:space="preserve" text-anchor="start" x="199" y="-821.49" font-family="sans-Serif" font-weight="bold" font-size="20.00" fill="#e2e8f0">PWN::AI::Agent &#45; Reward + Curriculum Reinforcement Loop</text>
+<text xml:space="preserve" text-anchor="start" x="293.5" y="-810.04" font-family="sans-Serif" font-size="11.00" fill="#94a3b8">live accounting · optional curriculum / weights · explicit routing&#45;policy evaluation</text>
 <g id="clust1" class="cluster">
 <title>cluster_live</title>
 <path fill="#1e293b" stroke="#334155" d="M20,-8C20,-8 286,-8 286,-8 292,-8 298,-14 298,-20 298,-20 298,-777.74 298,-777.74 298,-783.74 292,-789.74 286,-789.74 286,-789.74 20,-789.74 20,-789.74 14,-789.74 8,-783.74 8,-777.74 8,-777.74 8,-20 8,-20 8,-14 14,-8 20,-8"/>
@@ -18,13 +18,13 @@
 </g>
 <g id="clust2" class="cluster">
 <title>cluster_curriculum</title>
-<path fill="#1e293b" stroke="#94a3b8" stroke-dasharray="5,2" d="M324,-8C324,-8 602,-8 602,-8 608,-8 614,-14 614,-20 614,-20 614,-784.49 614,-784.49 614,-790.49 608,-796.49 602,-796.49 602,-796.49 324,-796.49 324,-796.49 318,-796.49 312,-790.49 312,-784.49 312,-784.49 312,-20 312,-20 312,-14 318,-8 324,-8"/>
-<text xml:space="preserve" text-anchor="middle" x="463" y="-781.09" font-family="sans-Serif" font-size="12.00" fill="#e2e8f0">OPTIONAL CURRICULUM &#160;· &#160;independent invocation</text>
+<path fill="#1e293b" stroke="#94a3b8" stroke-dasharray="5,2" d="M326,-8C326,-8 636,-8 636,-8 642,-8 648,-14 648,-20 648,-20 648,-784.49 648,-784.49 648,-790.49 642,-796.49 636,-796.49 636,-796.49 326,-796.49 326,-796.49 320,-796.49 314,-790.49 314,-784.49 314,-784.49 314,-20 314,-20 314,-14 320,-8 326,-8"/>
+<text xml:space="preserve" text-anchor="middle" x="481" y="-781.09" font-family="sans-Serif" font-size="12.00" fill="#e2e8f0">OPTIONAL CURRICULUM &#160;· &#160;independent invocation</text>
 </g>
 <g id="clust3" class="cluster">
 <title>cluster_policy</title>
-<path fill="#1e293b" stroke="#94a3b8" stroke-dasharray="5,2" d="M634,-142.29C634,-142.29 900,-142.29 900,-142.29 906,-142.29 912,-148.29 912,-154.29 912,-154.29 912,-777.74 912,-777.74 912,-783.74 906,-789.74 900,-789.74 900,-789.74 634,-789.74 634,-789.74 628,-789.74 622,-783.74 622,-777.74 622,-777.74 622,-154.29 622,-154.29 622,-148.29 628,-142.29 634,-142.29"/>
-<text xml:space="preserve" text-anchor="middle" x="767" y="-774.34" font-family="sans-Serif" font-size="12.00" fill="#e2e8f0">FROZEN POLICY &#160;· &#160;explicit operator workflow</text>
+<path fill="#1e293b" stroke="#94a3b8" stroke-dasharray="5,2" d="M676,-142.29C676,-142.29 942,-142.29 942,-142.29 948,-142.29 954,-148.29 954,-154.29 954,-154.29 954,-777.74 954,-777.74 954,-783.74 948,-789.74 942,-789.74 942,-789.74 676,-789.74 676,-789.74 670,-789.74 664,-783.74 664,-777.74 664,-777.74 664,-154.29 664,-154.29 664,-148.29 670,-142.29 676,-142.29"/>
+<text xml:space="preserve" text-anchor="middle" x="809" y="-774.34" font-family="sans-Serif" font-size="12.00" fill="#e2e8f0">FROZEN POLICY &#160;· &#160;explicit operator workflow</text>
 </g>
 <!-- Run -->
 <g id="node1" class="node">
@@ -117,158 +117,158 @@
 <!-- Schedule -->
 <g id="node7" class="node">
 <title>Schedule</title>
-<path fill="#7dd3fc" stroke="#334155" stroke-width="1.3" d="M583.8,-766.24C583.8,-766.24 334.2,-766.24 334.2,-766.24 328.2,-766.24 322.2,-760.24 322.2,-754.24 322.2,-754.24 322.2,-687.7 322.2,-687.7 322.2,-681.7 328.2,-675.7 334.2,-675.7 334.2,-675.7 583.8,-675.7 583.8,-675.7 589.8,-675.7 595.8,-681.7 595.8,-687.7 595.8,-687.7 595.8,-754.24 595.8,-754.24 595.8,-760.24 589.8,-766.24 583.8,-766.24"/>
-<text xml:space="preserve" text-anchor="middle" x="459" y="-744.27" font-family="sans-Serif" font-size="11.00" fill="#0f172a">A &#160;OPT IN / INVOKE EXPLICITLY</text>
-<text xml:space="preserve" text-anchor="middle" x="459" y="-730.77" font-family="sans-Serif" font-size="11.00" fill="#0f172a">Cron seeds disabled by default:</text>
-<text xml:space="preserve" text-anchor="middle" x="459" y="-717.27" font-family="sans-Serif" font-size="11.00" fill="#0f172a">practice 03:00; offline_judge 03:30 daily</text>
-<text xml:space="preserve" text-anchor="middle" x="459" y="-703.77" font-family="sans-Serif" font-size="11.00" fill="#0f172a">train dry_run 04:00 Sunday</text>
-<text xml:space="preserve" text-anchor="middle" x="459" y="-690.27" font-family="sans-Serif" font-size="11.00" fill="#0f172a">Seeding jobs does not install system crontab</text>
+<path fill="#7dd3fc" stroke="#334155" stroke-width="1.3" d="M628.15,-766.24C628.15,-766.24 333.85,-766.24 333.85,-766.24 327.85,-766.24 321.85,-760.24 321.85,-754.24 321.85,-754.24 321.85,-687.7 321.85,-687.7 321.85,-681.7 327.85,-675.7 333.85,-675.7 333.85,-675.7 628.15,-675.7 628.15,-675.7 634.15,-675.7 640.15,-681.7 640.15,-687.7 640.15,-687.7 640.15,-754.24 640.15,-754.24 640.15,-760.24 634.15,-766.24 628.15,-766.24"/>
+<text xml:space="preserve" text-anchor="middle" x="481" y="-744.27" font-family="sans-Serif" font-size="11.00" fill="#0f172a">A &#160;OPT IN / INVOKE EXPLICITLY</text>
+<text xml:space="preserve" text-anchor="middle" x="481" y="-730.77" font-family="sans-Serif" font-size="11.00" fill="#0f172a">Curriculum jobs are not seeded</text>
+<text xml:space="preserve" text-anchor="middle" x="481" y="-717.27" font-family="sans-Serif" font-size="11.00" fill="#0f172a">Create a CURRICULUM_JOBS template only when wanted</text>
+<text xml:space="preserve" text-anchor="middle" x="481" y="-703.77" font-family="sans-Serif" font-size="11.00" fill="#0f172a">Templates stay disabled until explicitly enabled</text>
+<text xml:space="preserve" text-anchor="middle" x="481" y="-690.27" font-family="sans-Serif" font-size="11.00" fill="#0f172a">Seeding does not install system crontab</text>
 </g>
 <!-- Practice -->
 <g id="node8" class="node">
 <title>Practice</title>
-<path fill="#6ee7b7" stroke="#334155" stroke-width="1.3" d="M583.8,-627.7C583.8,-627.7 334.2,-627.7 334.2,-627.7 328.2,-627.7 322.2,-621.7 322.2,-615.7 322.2,-615.7 322.2,-549.16 322.2,-549.16 322.2,-543.16 328.2,-537.16 334.2,-537.16 334.2,-537.16 583.8,-537.16 583.8,-537.16 589.8,-537.16 595.8,-543.16 595.8,-549.16 595.8,-549.16 595.8,-615.7 595.8,-615.7 595.8,-621.7 589.8,-627.7 583.8,-627.7"/>
-<text xml:space="preserve" text-anchor="middle" x="459" y="-605.73" font-family="sans-Serif" font-size="11.00" fill="#0f172a">B &#160;PRACTICE / OFFLINE JUDGING</text>
-<text xml:space="preserve" text-anchor="middle" x="459" y="-592.23" font-family="sans-Serif" font-size="11.00" fill="#0f172a">Practice: budget&#45;first; real tools may run</text>
-<text xml:space="preserve" text-anchor="middle" x="459" y="-578.73" font-family="sans-Serif" font-size="11.00" fill="#0f172a">Judge&#45;qualified resolution + winning traces</text>
-<text xml:space="preserve" text-anchor="middle" x="459" y="-565.23" font-family="sans-Serif" font-size="11.00" fill="#0f172a">Offline judge: backfill, calibrate, warm sentinel</text>
-<text xml:space="preserve" text-anchor="middle" x="459" y="-551.73" font-family="sans-Serif" font-size="11.00" fill="#0f172a">Records: curriculum/ + mistakes / preferences</text>
+<path fill="#6ee7b7" stroke="#334155" stroke-width="1.3" d="M605.8,-627.7C605.8,-627.7 356.2,-627.7 356.2,-627.7 350.2,-627.7 344.2,-621.7 344.2,-615.7 344.2,-615.7 344.2,-549.16 344.2,-549.16 344.2,-543.16 350.2,-537.16 356.2,-537.16 356.2,-537.16 605.8,-537.16 605.8,-537.16 611.8,-537.16 617.8,-543.16 617.8,-549.16 617.8,-549.16 617.8,-615.7 617.8,-615.7 617.8,-621.7 611.8,-627.7 605.8,-627.7"/>
+<text xml:space="preserve" text-anchor="middle" x="481" y="-605.73" font-family="sans-Serif" font-size="11.00" fill="#0f172a">B &#160;PRACTICE / OFFLINE JUDGING</text>
+<text xml:space="preserve" text-anchor="middle" x="481" y="-592.23" font-family="sans-Serif" font-size="11.00" fill="#0f172a">Practice: budget&#45;first; real tools may run</text>
+<text xml:space="preserve" text-anchor="middle" x="481" y="-578.73" font-family="sans-Serif" font-size="11.00" fill="#0f172a">Judge&#45;qualified resolution + winning traces</text>
+<text xml:space="preserve" text-anchor="middle" x="481" y="-565.23" font-family="sans-Serif" font-size="11.00" fill="#0f172a">Offline judge: backfill, calibrate, warm sentinel</text>
+<text xml:space="preserve" text-anchor="middle" x="481" y="-551.73" font-family="sans-Serif" font-size="11.00" fill="#0f172a">Records: curriculum/ + mistakes / preferences</text>
 </g>
 <!-- Schedule&#45;&gt;Practice -->
 <g id="edge6" class="edge">
 <title>Schedule&#45;&gt;Practice</title>
-<path fill="none" stroke="#94a3b8" stroke-width="1.3" stroke-dasharray="5,2" d="M459,-675.26C459,-663.36 459,-650.36 459,-637.99"/>
-<polygon fill="#94a3b8" stroke="#94a3b8" stroke-width="1.3" points="461.8,-638.21 459,-630.21 456.2,-638.21 461.8,-638.21"/>
-<text xml:space="preserve" text-anchor="middle" x="530.62" y="-648.2" font-family="sans-Serif" font-size="10.00" fill="#cbd5e1">independent jobs; not a job chain</text>
+<path fill="none" stroke="#94a3b8" stroke-width="1.3" stroke-dasharray="5,2" d="M481,-675.26C481,-663.36 481,-650.36 481,-637.99"/>
+<polygon fill="#94a3b8" stroke="#94a3b8" stroke-width="1.3" points="483.8,-638.21 481,-630.21 478.2,-638.21 483.8,-638.21"/>
+<text xml:space="preserve" text-anchor="middle" x="552.62" y="-648.2" font-family="sans-Serif" font-size="10.00" fill="#cbd5e1">independent jobs; not a job chain</text>
 </g>
 <!-- Export -->
 <g id="node9" class="node">
 <title>Export</title>
-<path fill="#fcd34d" stroke="#334155" stroke-width="1.3" d="M583.8,-489.16C583.8,-489.16 334.2,-489.16 334.2,-489.16 328.2,-489.16 322.2,-483.16 322.2,-477.16 322.2,-477.16 322.2,-410.62 322.2,-410.62 322.2,-404.62 328.2,-398.62 334.2,-398.62 334.2,-398.62 583.8,-398.62 583.8,-398.62 589.8,-398.62 595.8,-404.62 595.8,-410.62 595.8,-410.62 595.8,-477.16 595.8,-477.16 595.8,-483.16 589.8,-489.16 583.8,-489.16"/>
-<text xml:space="preserve" text-anchor="middle" x="459" y="-467.19" font-family="sans-Serif" font-size="11.00" fill="#0f172a">C &#160;EXPORT TRAINING DATA</text>
-<text xml:space="preserve" text-anchor="middle" x="459" y="-453.69" font-family="sans-Serif" font-size="11.00" fill="#0f172a">Learning.export_finetune + Reward.export_dpo</text>
-<text xml:space="preserve" text-anchor="middle" x="459" y="-440.19" font-family="sans-Serif" font-size="11.00" fill="#0f172a">Eligible sessions / outcomes + preference pairs</text>
-<text xml:space="preserve" text-anchor="middle" x="459" y="-426.69" font-family="sans-Serif" font-size="11.00" fill="#0f172a">Scrub, geometry and source&#45;balance filters</text>
-<text xml:space="preserve" text-anchor="middle" x="459" y="-413.19" font-family="sans-Serif" font-size="11.00" fill="#0f172a">Output: finetune/*.jsonl + evaluation set</text>
+<path fill="#fcd34d" stroke="#334155" stroke-width="1.3" d="M605.8,-489.16C605.8,-489.16 356.2,-489.16 356.2,-489.16 350.2,-489.16 344.2,-483.16 344.2,-477.16 344.2,-477.16 344.2,-410.62 344.2,-410.62 344.2,-404.62 350.2,-398.62 356.2,-398.62 356.2,-398.62 605.8,-398.62 605.8,-398.62 611.8,-398.62 617.8,-404.62 617.8,-410.62 617.8,-410.62 617.8,-477.16 617.8,-477.16 617.8,-483.16 611.8,-489.16 605.8,-489.16"/>
+<text xml:space="preserve" text-anchor="middle" x="481" y="-467.19" font-family="sans-Serif" font-size="11.00" fill="#0f172a">C &#160;EXPORT TRAINING DATA</text>
+<text xml:space="preserve" text-anchor="middle" x="481" y="-453.69" font-family="sans-Serif" font-size="11.00" fill="#0f172a">Learning.export_finetune + Reward.export_dpo</text>
+<text xml:space="preserve" text-anchor="middle" x="481" y="-440.19" font-family="sans-Serif" font-size="11.00" fill="#0f172a">Eligible sessions / outcomes + preference pairs</text>
+<text xml:space="preserve" text-anchor="middle" x="481" y="-426.69" font-family="sans-Serif" font-size="11.00" fill="#0f172a">Scrub, geometry and source&#45;balance filters</text>
+<text xml:space="preserve" text-anchor="middle" x="481" y="-413.19" font-family="sans-Serif" font-size="11.00" fill="#0f172a">Output: finetune/*.jsonl + evaluation set</text>
 </g>
 <!-- Practice&#45;&gt;Export -->
 <g id="edge7" class="edge">
 <title>Practice&#45;&gt;Export</title>
-<path fill="none" stroke="#94a3b8" stroke-width="1.3" stroke-dasharray="5,2" d="M459,-536.72C459,-524.82 459,-511.82 459,-499.45"/>
-<polygon fill="#94a3b8" stroke="#94a3b8" stroke-width="1.3" points="461.8,-499.67 459,-491.67 456.2,-499.67 461.8,-499.67"/>
-<text xml:space="preserve" text-anchor="middle" x="503.62" y="-509.66" font-family="sans-Serif" font-size="10.00" fill="#cbd5e1">eligible retained data</text>
+<path fill="none" stroke="#94a3b8" stroke-width="1.3" stroke-dasharray="5,2" d="M481,-536.72C481,-524.82 481,-511.82 481,-499.45"/>
+<polygon fill="#94a3b8" stroke="#94a3b8" stroke-width="1.3" points="483.8,-499.67 481,-491.67 478.2,-499.67 483.8,-499.67"/>
+<text xml:space="preserve" text-anchor="middle" x="525.62" y="-509.66" font-family="sans-Serif" font-size="10.00" fill="#cbd5e1">eligible retained data</text>
 </g>
 <!-- Train -->
 <g id="node10" class="node">
 <title>Train</title>
-<path fill="#fda4af" stroke="#334155" stroke-width="1.3" d="M583.8,-361.62C583.8,-361.62 334.2,-361.62 334.2,-361.62 328.2,-361.62 322.2,-355.62 322.2,-349.62 322.2,-349.62 322.2,-283.08 322.2,-283.08 322.2,-277.08 328.2,-271.08 334.2,-271.08 334.2,-271.08 583.8,-271.08 583.8,-271.08 589.8,-271.08 595.8,-277.08 595.8,-283.08 595.8,-283.08 595.8,-349.62 595.8,-349.62 595.8,-355.62 589.8,-361.62 583.8,-361.62"/>
-<text xml:space="preserve" text-anchor="middle" x="459" y="-339.65" font-family="sans-Serif" font-size="11.00" fill="#0f172a">D &#160;train_and_gate</text>
-<text xml:space="preserve" text-anchor="middle" x="459" y="-326.15" font-family="sans-Serif" font-size="11.00" fill="#0f172a">Dry run or no trainer → export_ready only</text>
-<text xml:space="preserve" text-anchor="middle" x="459" y="-312.65" font-family="sans-Serif" font-size="11.00" fill="#0f172a">Otherwise: configured trainer → LoRA adapter</text>
-<text xml:space="preserve" text-anchor="middle" x="459" y="-299.15" font-family="sans-Serif" font-size="11.00" fill="#0f172a">ollama create → candidate vs baseline gate</text>
-<text xml:space="preserve" text-anchor="middle" x="459" y="-285.65" font-family="sans-Serif" font-size="11.00" fill="#0f172a">Preference&#45;diet gate also required</text>
+<path fill="#fda4af" stroke="#334155" stroke-width="1.3" d="M605.8,-361.62C605.8,-361.62 356.2,-361.62 356.2,-361.62 350.2,-361.62 344.2,-355.62 344.2,-349.62 344.2,-349.62 344.2,-283.08 344.2,-283.08 344.2,-277.08 350.2,-271.08 356.2,-271.08 356.2,-271.08 605.8,-271.08 605.8,-271.08 611.8,-271.08 617.8,-277.08 617.8,-283.08 617.8,-283.08 617.8,-349.62 617.8,-349.62 617.8,-355.62 611.8,-361.62 605.8,-361.62"/>
+<text xml:space="preserve" text-anchor="middle" x="481" y="-339.65" font-family="sans-Serif" font-size="11.00" fill="#0f172a">D &#160;train_and_gate</text>
+<text xml:space="preserve" text-anchor="middle" x="481" y="-326.15" font-family="sans-Serif" font-size="11.00" fill="#0f172a">Dry run or no trainer → export_ready only</text>
+<text xml:space="preserve" text-anchor="middle" x="481" y="-312.65" font-family="sans-Serif" font-size="11.00" fill="#0f172a">Otherwise: configured trainer → LoRA adapter</text>
+<text xml:space="preserve" text-anchor="middle" x="481" y="-299.15" font-family="sans-Serif" font-size="11.00" fill="#0f172a">ollama create → candidate vs baseline gate</text>
+<text xml:space="preserve" text-anchor="middle" x="481" y="-285.65" font-family="sans-Serif" font-size="11.00" fill="#0f172a">Preference&#45;diet gate also required</text>
 </g>
 <!-- Export&#45;&gt;Train -->
 <g id="edge8" class="edge">
 <title>Export&#45;&gt;Train</title>
-<path fill="none" stroke="#94a3b8" stroke-width="1.3" d="M459,-398.28C459,-389.78 459,-380.79 459,-372.02"/>
-<polygon fill="#94a3b8" stroke="#94a3b8" stroke-width="1.3" points="461.8,-372.21 459,-364.21 456.2,-372.21 461.8,-372.21"/>
+<path fill="none" stroke="#94a3b8" stroke-width="1.3" d="M481,-398.28C481,-389.78 481,-380.79 481,-372.02"/>
+<polygon fill="#94a3b8" stroke="#94a3b8" stroke-width="1.3" points="483.8,-372.21 481,-364.21 478.2,-372.21 483.8,-372.21"/>
 </g>
 <!-- Model -->
 <g id="node11" class="node">
 <title>Model</title>
-<path fill="#6ee7b7" stroke="#334155" stroke-width="1.3" d="M583.8,-227.33C583.8,-227.33 334.2,-227.33 334.2,-227.33 328.2,-227.33 322.2,-221.33 322.2,-215.33 322.2,-215.33 322.2,-162.29 322.2,-162.29 322.2,-156.29 328.2,-150.29 334.2,-150.29 334.2,-150.29 583.8,-150.29 583.8,-150.29 589.8,-150.29 595.8,-156.29 595.8,-162.29 595.8,-162.29 595.8,-215.33 595.8,-215.33 595.8,-221.33 589.8,-227.33 583.8,-227.33"/>
-<text xml:space="preserve" text-anchor="middle" x="459" y="-205.36" font-family="sans-Serif" font-size="11.00" fill="#0f172a">E &#160;RETAIN GATED ADAPTER VERSION</text>
-<text xml:space="preserve" text-anchor="middle" x="459" y="-191.86" font-family="sans-Serif" font-size="11.00" fill="#0f172a">On passing gates: update curriculum model state</text>
-<text xml:space="preserve" text-anchor="middle" x="459" y="-178.36" font-family="sans-Serif" font-size="11.00" fill="#0f172a">Optional local weight path, not routing policy</text>
-<text xml:space="preserve" text-anchor="middle" x="459" y="-164.86" font-family="sans-Serif" font-size="11.00" fill="#0f172a">Export alone is not training or improvement</text>
+<path fill="#6ee7b7" stroke="#334155" stroke-width="1.3" d="M605.8,-227.33C605.8,-227.33 356.2,-227.33 356.2,-227.33 350.2,-227.33 344.2,-221.33 344.2,-215.33 344.2,-215.33 344.2,-162.29 344.2,-162.29 344.2,-156.29 350.2,-150.29 356.2,-150.29 356.2,-150.29 605.8,-150.29 605.8,-150.29 611.8,-150.29 617.8,-156.29 617.8,-162.29 617.8,-162.29 617.8,-215.33 617.8,-215.33 617.8,-221.33 611.8,-227.33 605.8,-227.33"/>
+<text xml:space="preserve" text-anchor="middle" x="481" y="-205.36" font-family="sans-Serif" font-size="11.00" fill="#0f172a">E &#160;RETAIN GATED ADAPTER VERSION</text>
+<text xml:space="preserve" text-anchor="middle" x="481" y="-191.86" font-family="sans-Serif" font-size="11.00" fill="#0f172a">On passing gates: update curriculum model state</text>
+<text xml:space="preserve" text-anchor="middle" x="481" y="-178.36" font-family="sans-Serif" font-size="11.00" fill="#0f172a">Optional local weight path, not routing policy</text>
+<text xml:space="preserve" text-anchor="middle" x="481" y="-164.86" font-family="sans-Serif" font-size="11.00" fill="#0f172a">Export alone is not training or improvement</text>
 </g>
 <!-- Train&#45;&gt;Model -->
 <g id="edge9" class="edge">
 <title>Train&#45;&gt;Model</title>
-<path fill="none" stroke="#94a3b8" stroke-width="1.3" d="M459,-270.74C459,-259.94 459,-248.37 459,-237.44"/>
-<polygon fill="#94a3b8" stroke="#94a3b8" stroke-width="1.3" points="461.8,-237.6 459,-229.6 456.2,-237.6 461.8,-237.6"/>
+<path fill="none" stroke="#94a3b8" stroke-width="1.3" d="M481,-270.74C481,-259.94 481,-248.37 481,-237.44"/>
+<polygon fill="#94a3b8" stroke="#94a3b8" stroke-width="1.3" points="483.8,-237.6 481,-229.6 478.2,-237.6 483.8,-237.6"/>
 </g>
 <!-- Hygiene -->
 <g id="node12" class="node">
 <title>Hygiene</title>
-<path fill="#1e293b" stroke="#334155" stroke-width="1.3" stroke-dasharray="5,2" d="M587.8,-106.54C587.8,-106.54 338.2,-106.54 338.2,-106.54 332.2,-106.54 326.2,-100.54 326.2,-94.54 326.2,-94.54 326.2,-28 326.2,-28 326.2,-22 332.2,-16 338.2,-16 338.2,-16 587.8,-16 587.8,-16 593.8,-16 599.8,-22 599.8,-28 599.8,-28 599.8,-94.54 599.8,-94.54 599.8,-100.54 593.8,-106.54 587.8,-106.54"/>
-<text xml:space="preserve" text-anchor="middle" x="463" y="-84.57" font-family="sans-Serif" font-size="11.00" fill="#cbd5e1">SEPARATE ENABLED HYGIENE SEED</text>
-<text xml:space="preserve" text-anchor="middle" x="463" y="-71.07" font-family="sans-Serif" font-size="11.00" fill="#cbd5e1">Learning.consolidate at 05:00 daily</text>
-<text xml:space="preserve" text-anchor="middle" x="463" y="-57.57" font-family="sans-Serif" font-size="11.00" fill="#cbd5e1">Memory maintenance, not model training</text>
-<text xml:space="preserve" text-anchor="middle" x="463" y="-44.07" font-family="sans-Serif" font-size="11.00" fill="#cbd5e1">ESR = verified_exploit_tools / vulnerable_tools</text>
-<text xml:space="preserve" text-anchor="middle" x="463" y="-30.57" font-family="sans-Serif" font-size="11.00" fill="#cbd5e1">ASR = successful_attacks / total_attack_attempts</text>
+<path fill="#1e293b" stroke="#334155" stroke-width="1.3" stroke-dasharray="5,2" d="M605.8,-106.54C605.8,-106.54 356.2,-106.54 356.2,-106.54 350.2,-106.54 344.2,-100.54 344.2,-94.54 344.2,-94.54 344.2,-28 344.2,-28 344.2,-22 350.2,-16 356.2,-16 356.2,-16 605.8,-16 605.8,-16 611.8,-16 617.8,-22 617.8,-28 617.8,-28 617.8,-94.54 617.8,-94.54 617.8,-100.54 611.8,-106.54 605.8,-106.54"/>
+<text xml:space="preserve" text-anchor="middle" x="481" y="-84.57" font-family="sans-Serif" font-size="11.00" fill="#cbd5e1">SEPARATE ENABLED HYGIENE SEED</text>
+<text xml:space="preserve" text-anchor="middle" x="481" y="-71.07" font-family="sans-Serif" font-size="11.00" fill="#cbd5e1">session_cleanup at 03:45 daily</text>
+<text xml:space="preserve" text-anchor="middle" x="481" y="-57.57" font-family="sans-Serif" font-size="11.00" fill="#cbd5e1">Includes memory consolidation; not model training</text>
+<text xml:space="preserve" text-anchor="middle" x="481" y="-44.07" font-family="sans-Serif" font-size="11.00" fill="#cbd5e1">ESR = verified_exploit_tools / vulnerable_tools</text>
+<text xml:space="preserve" text-anchor="middle" x="481" y="-30.57" font-family="sans-Serif" font-size="11.00" fill="#cbd5e1">ASR = successful_attacks / total_attack_attempts</text>
 </g>
 <!-- Select -->
 <g id="node13" class="node">
 <title>Select</title>
-<path fill="#c4b5fd" stroke="#334155" stroke-width="1.3" d="M891.8,-759.49C891.8,-759.49 642.2,-759.49 642.2,-759.49 636.2,-759.49 630.2,-753.49 630.2,-747.49 630.2,-747.49 630.2,-694.45 630.2,-694.45 630.2,-688.45 636.2,-682.45 642.2,-682.45 642.2,-682.45 891.8,-682.45 891.8,-682.45 897.8,-682.45 903.8,-688.45 903.8,-694.45 903.8,-694.45 903.8,-747.49 903.8,-747.49 903.8,-753.49 897.8,-759.49 891.8,-759.49"/>
-<text xml:space="preserve" text-anchor="middle" x="767" y="-737.52" font-family="sans-Serif" font-size="11.00" fill="#0f172a">I &#160;SELECT SNAPSHOTS</text>
-<text xml:space="preserve" text-anchor="middle" x="767" y="-724.02" font-family="sans-Serif" font-size="11.00" fill="#0f172a">Explicit baseline + candidate policy bytes</text>
-<text xml:space="preserve" text-anchor="middle" x="767" y="-710.52" font-family="sans-Serif" font-size="11.00" fill="#0f172a">PolicyEvaluation; not live online writers</text>
-<text xml:space="preserve" text-anchor="middle" x="767" y="-697.02" font-family="sans-Serif" font-size="11.00" fill="#0f172a">No automatic handoff from RSI or training</text>
+<path fill="#c4b5fd" stroke="#334155" stroke-width="1.3" d="M933.8,-759.49C933.8,-759.49 684.2,-759.49 684.2,-759.49 678.2,-759.49 672.2,-753.49 672.2,-747.49 672.2,-747.49 672.2,-694.45 672.2,-694.45 672.2,-688.45 678.2,-682.45 684.2,-682.45 684.2,-682.45 933.8,-682.45 933.8,-682.45 939.8,-682.45 945.8,-688.45 945.8,-694.45 945.8,-694.45 945.8,-747.49 945.8,-747.49 945.8,-753.49 939.8,-759.49 933.8,-759.49"/>
+<text xml:space="preserve" text-anchor="middle" x="809" y="-737.52" font-family="sans-Serif" font-size="11.00" fill="#0f172a">I &#160;SELECT SNAPSHOTS</text>
+<text xml:space="preserve" text-anchor="middle" x="809" y="-724.02" font-family="sans-Serif" font-size="11.00" fill="#0f172a">Explicit baseline + candidate policy bytes</text>
+<text xml:space="preserve" text-anchor="middle" x="809" y="-710.52" font-family="sans-Serif" font-size="11.00" fill="#0f172a">PolicyEvaluation; not live online writers</text>
+<text xml:space="preserve" text-anchor="middle" x="809" y="-697.02" font-family="sans-Serif" font-size="11.00" fill="#0f172a">No automatic handoff from RSI or training</text>
 </g>
 <!-- Eval -->
 <g id="node14" class="node">
 <title>Eval</title>
-<path fill="#c4b5fd" stroke="#334155" stroke-width="1.3" d="M891.8,-627.7C891.8,-627.7 642.2,-627.7 642.2,-627.7 636.2,-627.7 630.2,-621.7 630.2,-615.7 630.2,-615.7 630.2,-549.16 630.2,-549.16 630.2,-543.16 636.2,-537.16 642.2,-537.16 642.2,-537.16 891.8,-537.16 891.8,-537.16 897.8,-537.16 903.8,-543.16 903.8,-549.16 903.8,-549.16 903.8,-615.7 903.8,-615.7 903.8,-621.7 897.8,-627.7 891.8,-627.7"/>
-<text xml:space="preserve" text-anchor="middle" x="767" y="-605.73" font-family="sans-Serif" font-size="11.00" fill="#0f172a">II &#160;EVALUATE LOCALLY</text>
-<text xml:space="preserve" text-anchor="middle" x="767" y="-592.23" font-family="sans-Serif" font-size="11.00" fill="#0f172a">Public fixed held&#45;out tasks</text>
-<text xml:space="preserve" text-anchor="middle" x="767" y="-578.73" font-family="sans-Serif" font-size="11.00" fill="#0f172a">Off / baseline / candidate comparisons</text>
-<text xml:space="preserve" text-anchor="middle" x="767" y="-565.23" font-family="sans-Serif" font-size="11.00" fill="#0f172a">Two disposable filesystem environments</text>
-<text xml:space="preserve" text-anchor="middle" x="767" y="-551.73" font-family="sans-Serif" font-size="11.00" fill="#0f172a">Regression replay is a separate split</text>
+<path fill="#c4b5fd" stroke="#334155" stroke-width="1.3" d="M933.8,-627.7C933.8,-627.7 684.2,-627.7 684.2,-627.7 678.2,-627.7 672.2,-621.7 672.2,-615.7 672.2,-615.7 672.2,-549.16 672.2,-549.16 672.2,-543.16 678.2,-537.16 684.2,-537.16 684.2,-537.16 933.8,-537.16 933.8,-537.16 939.8,-537.16 945.8,-543.16 945.8,-549.16 945.8,-549.16 945.8,-615.7 945.8,-615.7 945.8,-621.7 939.8,-627.7 933.8,-627.7"/>
+<text xml:space="preserve" text-anchor="middle" x="809" y="-605.73" font-family="sans-Serif" font-size="11.00" fill="#0f172a">II &#160;EVALUATE LOCALLY</text>
+<text xml:space="preserve" text-anchor="middle" x="809" y="-592.23" font-family="sans-Serif" font-size="11.00" fill="#0f172a">Public fixed held&#45;out tasks</text>
+<text xml:space="preserve" text-anchor="middle" x="809" y="-578.73" font-family="sans-Serif" font-size="11.00" fill="#0f172a">Off / baseline / candidate comparisons</text>
+<text xml:space="preserve" text-anchor="middle" x="809" y="-565.23" font-family="sans-Serif" font-size="11.00" fill="#0f172a">Two disposable filesystem environments</text>
+<text xml:space="preserve" text-anchor="middle" x="809" y="-551.73" font-family="sans-Serif" font-size="11.00" fill="#0f172a">Regression replay is a separate split</text>
 </g>
 <!-- Select&#45;&gt;Eval -->
 <g id="edge10" class="edge">
 <title>Select&#45;&gt;Eval</title>
-<path fill="none" stroke="#94a3b8" stroke-width="1.3" d="M767,-681.94C767,-668.21 767,-652.45 767,-637.61"/>
-<polygon fill="#94a3b8" stroke="#94a3b8" stroke-width="1.3" points="769.8,-637.99 767,-629.99 764.2,-637.99 769.8,-637.99"/>
+<path fill="none" stroke="#94a3b8" stroke-width="1.3" d="M809,-681.94C809,-668.21 809,-652.45 809,-637.61"/>
+<polygon fill="#94a3b8" stroke="#94a3b8" stroke-width="1.3" points="811.8,-637.99 809,-629.99 806.2,-637.99 811.8,-637.99"/>
 </g>
 <!-- Gate -->
 <g id="node15" class="node">
 <title>Gate</title>
-<path fill="#fcd34d" stroke="#334155" stroke-width="1.3" d="M891.8,-489.16C891.8,-489.16 642.2,-489.16 642.2,-489.16 636.2,-489.16 630.2,-483.16 630.2,-477.16 630.2,-477.16 630.2,-410.62 630.2,-410.62 630.2,-404.62 636.2,-398.62 642.2,-398.62 642.2,-398.62 891.8,-398.62 891.8,-398.62 897.8,-398.62 903.8,-404.62 903.8,-410.62 903.8,-410.62 903.8,-477.16 903.8,-477.16 903.8,-483.16 897.8,-489.16 891.8,-489.16"/>
-<text xml:space="preserve" text-anchor="middle" x="767" y="-467.19" font-family="sans-Serif" font-size="11.00" fill="#0f172a">III &#160;REPLAY ACCEPTANCE</text>
-<text xml:space="preserve" text-anchor="middle" x="767" y="-453.69" font-family="sans-Serif" font-size="11.00" fill="#0f172a">Fresh replay + aggregate nonregression</text>
-<text xml:space="preserve" text-anchor="middle" x="767" y="-440.19" font-family="sans-Serif" font-size="11.00" fill="#0f172a">Per&#45;task nonregression + held&#45;out gain</text>
-<text xml:space="preserve" text-anchor="middle" x="767" y="-426.69" font-family="sans-Serif" font-size="11.00" fill="#0f172a">Local controller evidence only</text>
-<text xml:space="preserve" text-anchor="middle" x="767" y="-413.19" font-family="sans-Serif" font-size="11.00" fill="#0f172a">Not proof of general live LLM gains</text>
+<path fill="#fcd34d" stroke="#334155" stroke-width="1.3" d="M933.8,-489.16C933.8,-489.16 684.2,-489.16 684.2,-489.16 678.2,-489.16 672.2,-483.16 672.2,-477.16 672.2,-477.16 672.2,-410.62 672.2,-410.62 672.2,-404.62 678.2,-398.62 684.2,-398.62 684.2,-398.62 933.8,-398.62 933.8,-398.62 939.8,-398.62 945.8,-404.62 945.8,-410.62 945.8,-410.62 945.8,-477.16 945.8,-477.16 945.8,-483.16 939.8,-489.16 933.8,-489.16"/>
+<text xml:space="preserve" text-anchor="middle" x="809" y="-467.19" font-family="sans-Serif" font-size="11.00" fill="#0f172a">III &#160;REPLAY ACCEPTANCE</text>
+<text xml:space="preserve" text-anchor="middle" x="809" y="-453.69" font-family="sans-Serif" font-size="11.00" fill="#0f172a">Fresh replay + aggregate nonregression</text>
+<text xml:space="preserve" text-anchor="middle" x="809" y="-440.19" font-family="sans-Serif" font-size="11.00" fill="#0f172a">Per&#45;task nonregression + held&#45;out gain</text>
+<text xml:space="preserve" text-anchor="middle" x="809" y="-426.69" font-family="sans-Serif" font-size="11.00" fill="#0f172a">Local controller evidence only</text>
+<text xml:space="preserve" text-anchor="middle" x="809" y="-413.19" font-family="sans-Serif" font-size="11.00" fill="#0f172a">Not proof of general live LLM gains</text>
 </g>
 <!-- Eval&#45;&gt;Gate -->
 <g id="edge11" class="edge">
 <title>Eval&#45;&gt;Gate</title>
-<path fill="none" stroke="#94a3b8" stroke-width="1.3" d="M767,-536.72C767,-524.82 767,-511.82 767,-499.45"/>
-<polygon fill="#94a3b8" stroke="#94a3b8" stroke-width="1.3" points="769.8,-499.67 767,-491.67 764.2,-499.67 769.8,-499.67"/>
+<path fill="none" stroke="#94a3b8" stroke-width="1.3" d="M809,-536.72C809,-524.82 809,-511.82 809,-499.45"/>
+<polygon fill="#94a3b8" stroke="#94a3b8" stroke-width="1.3" points="811.8,-499.67 809,-491.67 806.2,-499.67 811.8,-499.67"/>
 </g>
 <!-- Approve -->
 <g id="node16" class="node">
 <title>Approve</title>
-<path fill="#6ee7b7" stroke="#334155" stroke-width="1.3" d="M891.8,-354.87C891.8,-354.87 642.2,-354.87 642.2,-354.87 636.2,-354.87 630.2,-348.87 630.2,-342.87 630.2,-342.87 630.2,-289.83 630.2,-289.83 630.2,-283.83 636.2,-277.83 642.2,-277.83 642.2,-277.83 891.8,-277.83 891.8,-277.83 897.8,-277.83 903.8,-283.83 903.8,-289.83 903.8,-289.83 903.8,-342.87 903.8,-342.87 903.8,-348.87 897.8,-354.87 891.8,-354.87"/>
-<text xml:space="preserve" text-anchor="middle" x="767" y="-332.9" font-family="sans-Serif" font-size="11.00" fill="#0f172a">IV &#160;OPERATOR APPROVAL</text>
-<text xml:space="preserve" text-anchor="middle" x="767" y="-319.4" font-family="sans-Serif" font-size="11.00" fill="#0f172a">Explicit live policy target</text>
-<text xml:space="preserve" text-anchor="middle" x="767" y="-305.9" font-family="sans-Serif" font-size="11.00" fill="#0f172a">Approval + stopped writers required</text>
-<text xml:space="preserve" text-anchor="middle" x="767" y="-292.4" font-family="sans-Serif" font-size="11.00" fill="#0f172a">Replace routing policy, not model weights</text>
+<path fill="#6ee7b7" stroke="#334155" stroke-width="1.3" d="M933.8,-354.87C933.8,-354.87 684.2,-354.87 684.2,-354.87 678.2,-354.87 672.2,-348.87 672.2,-342.87 672.2,-342.87 672.2,-289.83 672.2,-289.83 672.2,-283.83 678.2,-277.83 684.2,-277.83 684.2,-277.83 933.8,-277.83 933.8,-277.83 939.8,-277.83 945.8,-283.83 945.8,-289.83 945.8,-289.83 945.8,-342.87 945.8,-342.87 945.8,-348.87 939.8,-354.87 933.8,-354.87"/>
+<text xml:space="preserve" text-anchor="middle" x="809" y="-332.9" font-family="sans-Serif" font-size="11.00" fill="#0f172a">IV &#160;OPERATOR APPROVAL</text>
+<text xml:space="preserve" text-anchor="middle" x="809" y="-319.4" font-family="sans-Serif" font-size="11.00" fill="#0f172a">Explicit live policy target</text>
+<text xml:space="preserve" text-anchor="middle" x="809" y="-305.9" font-family="sans-Serif" font-size="11.00" fill="#0f172a">Approval + stopped writers required</text>
+<text xml:space="preserve" text-anchor="middle" x="809" y="-292.4" font-family="sans-Serif" font-size="11.00" fill="#0f172a">Replace routing policy, not model weights</text>
 </g>
 <!-- Gate&#45;&gt;Approve -->
 <g id="edge12" class="edge">
 <title>Gate&#45;&gt;Approve</title>
-<path fill="none" stroke="#94a3b8" stroke-width="1.3" d="M767,-398.28C767,-387.48 767,-375.91 767,-364.98"/>
-<polygon fill="#94a3b8" stroke="#94a3b8" stroke-width="1.3" points="769.8,-365.14 767,-357.14 764.2,-365.14 769.8,-365.14"/>
+<path fill="none" stroke="#94a3b8" stroke-width="1.3" d="M809,-398.28C809,-387.48 809,-375.91 809,-364.98"/>
+<polygon fill="#94a3b8" stroke="#94a3b8" stroke-width="1.3" points="811.8,-365.14 809,-357.14 806.2,-365.14 811.8,-365.14"/>
 </g>
 <!-- Receipt -->
 <g id="node17" class="node">
 <title>Receipt</title>
-<path fill="#fcd34d" stroke="#334155" stroke-width="1.3" d="M891.8,-227.33C891.8,-227.33 642.2,-227.33 642.2,-227.33 636.2,-227.33 630.2,-221.33 630.2,-215.33 630.2,-215.33 630.2,-162.29 630.2,-162.29 630.2,-156.29 636.2,-150.29 642.2,-150.29 642.2,-150.29 891.8,-150.29 891.8,-150.29 897.8,-150.29 903.8,-156.29 903.8,-162.29 903.8,-162.29 903.8,-215.33 903.8,-215.33 903.8,-221.33 897.8,-227.33 891.8,-227.33"/>
-<text xml:space="preserve" text-anchor="middle" x="767" y="-205.36" font-family="sans-Serif" font-size="11.00" fill="#0f172a">V &#160;RETAIN RECEIPT / ROLLBACK</text>
-<text xml:space="preserve" text-anchor="middle" x="767" y="-191.86" font-family="sans-Serif" font-size="11.00" fill="#0f172a">Versioned receipt v1 + byte digests</text>
-<text xml:space="preserve" text-anchor="middle" x="767" y="-178.36" font-family="sans-Serif" font-size="11.00" fill="#0f172a">Rollback refuses intervening live writes</text>
-<text xml:space="preserve" text-anchor="middle" x="767" y="-164.86" font-family="sans-Serif" font-size="11.00" fill="#0f172a">No silent overwrite of newer policy state</text>
+<path fill="#fcd34d" stroke="#334155" stroke-width="1.3" d="M933.8,-227.33C933.8,-227.33 684.2,-227.33 684.2,-227.33 678.2,-227.33 672.2,-221.33 672.2,-215.33 672.2,-215.33 672.2,-162.29 672.2,-162.29 672.2,-156.29 678.2,-150.29 684.2,-150.29 684.2,-150.29 933.8,-150.29 933.8,-150.29 939.8,-150.29 945.8,-156.29 945.8,-162.29 945.8,-162.29 945.8,-215.33 945.8,-215.33 945.8,-221.33 939.8,-227.33 933.8,-227.33"/>
+<text xml:space="preserve" text-anchor="middle" x="809" y="-205.36" font-family="sans-Serif" font-size="11.00" fill="#0f172a">V &#160;RETAIN RECEIPT / ROLLBACK</text>
+<text xml:space="preserve" text-anchor="middle" x="809" y="-191.86" font-family="sans-Serif" font-size="11.00" fill="#0f172a">Versioned receipt v1 + byte digests</text>
+<text xml:space="preserve" text-anchor="middle" x="809" y="-178.36" font-family="sans-Serif" font-size="11.00" fill="#0f172a">Rollback refuses intervening live writes</text>
+<text xml:space="preserve" text-anchor="middle" x="809" y="-164.86" font-family="sans-Serif" font-size="11.00" fill="#0f172a">No silent overwrite of newer policy state</text>
 </g>
 <!-- Approve&#45;&gt;Receipt -->
 <g id="edge13" class="edge">
 <title>Approve&#45;&gt;Receipt</title>
-<path fill="none" stroke="#94a3b8" stroke-width="1.3" d="M767,-277.34C767,-264.81 767,-250.7 767,-237.53"/>
-<polygon fill="#94a3b8" stroke="#94a3b8" stroke-width="1.3" points="769.8,-237.66 767,-229.66 764.2,-237.66 769.8,-237.66"/>
+<path fill="none" stroke="#94a3b8" stroke-width="1.3" d="M809,-277.34C809,-264.81 809,-250.7 809,-237.53"/>
+<polygon fill="#94a3b8" stroke="#94a3b8" stroke-width="1.3" points="811.8,-237.66 809,-229.66 806.2,-237.66 811.8,-237.66"/>
 </g>
 </g>
 </svg>

data/documentation/pwn-ai-Agent.md

@@ -5,6 +5,9 @@ the goal; the agent plans a sequence of tool calls (`pwn_eval`, `shell`,
 `memory_*`, `skill_*`, `mistakes_*`, `reward_*`, `curriculum_*`, `extro_*`,
 `agent_*`, ...), executes them against the live process, observes the results,
 and checks completion against the original request and available host evidence.
+Unspecified tool writes go to `~/.pwn/workspaces/runtime`. A path outside that
+directory is allowed only when the original request names it. See
+[Operability](Operability.md).
 Learning records failures and corrections; it cannot guarantee nonrecurrence.
 
 ## Two ways to run it
@@ -336,7 +339,9 @@ anthropic` opens that nested mapping, and `/vault edit ai anthropic model`
 opens a scalar. Tokens identify one nested key path, never filenames or multiple
 disjoint scopes. The target and decryptor are the same `driver_opts.pwn_env_path`
 and `driver_opts.pwn_dec_path` used by `pwn-vault`, defaulting to
-`~/.pwn/pwn.yaml` and its existing `.decryptor` sidecar. Unknown paths are rejected; edit the parent mapping
+`~/.pwn/pwn.yaml` and its existing legacy `.decryptor` sidecar. Hardware-backed
+[YubiKey vaults](YubiKey-Vaults.md) are detected without requiring a sidecar.
+Unknown paths are rejected; edit the parent mapping
 to add a new key. Arrays are edited as a whole, not by numeric path indices.
 Existing non-null types must be retained; an existing null may remain null or
 be replaced by a YAML value. The root must retain an `ai` mapping, a supported
@@ -355,8 +360,9 @@ only shipped schema key names, never reads/decrypts the vault, and never offers
 configuration values; existing custom keys can be typed explicitly.
 
 Plaintext is decrypted/edited in memory. Only encrypted bytes enter the private
-temporary file, which is atomically renamed over the vault using the same
-AES-256-CBC format/key/IV as `pwn-vault`; the decryptor is not regenerated.
+temporary file, which is atomically renamed over the vault using its existing
+backend: legacy AES-256-CBC key/IV or a fresh authenticated YubiKey envelope.
+The device is never provisioned and the legacy decryptor is not regenerated.
 Save re-reads the current document, preserves changes outside the selected scope,
 and refuses a changed selected scope (the whole document for unscoped edits).
 Editor instances serialize saves with a directory lock; a final ciphertext check
@@ -642,7 +648,7 @@ After the reply, `Learning.auto_introspect` calls `rsi_tick`. That tick reads ES
 
 ## What the agent can call
 
-16 toolsets · **150 tools** - full table at
+16 toolsets · **152 tools** - full table at
 [Agent Tool Registry](Agent-Tool-Registry.md).
 
 The two that matter most:

data/etc/default_cron/session_cleanup.rb

@@ -20,7 +20,7 @@ module PWN
       'learning' => %w[learning.jsonl learning lessons.json memory.json memory.archive.json memory.idx mistakes.json policy policy.json policy_traj.jsonl curriculum curriculum_kpi.jsonl extrospection.json finetune preferences.jsonl reward_sentinel.json skill_review.jsonl operator-learning-review.jsonl],
       'artifacts' => %w[artifacts exports findings.jsonl engagements corpora binws redb ghidra sandbox_snapshots],
       'state' => %w[swarm cron agents.yml open_goal.json jobs missions runs metrics metrics.json capabilities.json],
-      'logs' => %w[logs], 'cache' => %w[cache], 'tmp' => %w[tmp],
+      'logs' => %w[logs], 'cache' => %w[cache], 'tmp' => %w[workspaces/runtime],
       'maintenance' => %w[maintenance session_cleanup_archive],
       'backups' => %w[backup]
     }.freeze
@@ -38,16 +38,17 @@ module PWN
         raise IOError, 'Symlinked maintenance policy' if File.symlink?(path)
 
         publish(path, JSON.pretty_generate(POLICY)) unless File.exist?(path)
-        %w[cache tmp].each { |name| private_directory(File.join(root, name)) unless File.exist?(File.join(root, name)) }
+        private_directory(File.join(root, 'cache')) unless File.exist?(File.join(root, 'cache'))
+        private_directory(File.join(root, 'workspaces', 'runtime')) unless File.exist?(File.join(root, 'workspaces', 'runtime'))
         layout = File.join(directory, 'layout.json')
         raise IOError, 'Unsafe maintenance inventory' if File.symlink?(layout)
 
         previous = File.file?(layout) ? JSON.parse(File.binread(layout)) : nil
-        raise IOError, 'Unknown maintenance inventory version' if previous && ![1, 2].include?(previous['version'])
+        raise IOError, 'Unknown maintenance inventory version' if previous && ![1, 2, 3].include?(previous['version'])
 
-        publish(layout, JSON.generate(version: 2, categories: STORAGE)) unless previous && previous['version'] == 2
+        publish(layout, JSON.generate(version: 3, categories: STORAGE)) unless previous && previous['version'] == 3
       end
-      { version: 2, root: directory }
+      { version: 3, root: directory }
     end
 
     # Startup performs only fixed-path checks and one coalesced request write.
@@ -368,7 +369,7 @@ module PWN
     def self.register_disposable(path:, category:, expires_at: nil)
       raise ArgumentError, 'Not a disposable category' unless %w[cache tmp logs].include?(category)
 
-      root = File.join(Dir.home, '.pwn', category)
+      root = disposable_directory(category)
       path = File.expand_path(path)
       raise IOError, 'Disposable path escapes its category' unless path.start_with?("#{root}/") && File.realpath(path) == path
       raise IOError, 'Disposable must be an owned regular file' unless File.file?(path) && File.stat(path).uid == Process.uid
@@ -421,7 +422,7 @@ module PWN
     # Known disposable input producer. The permanent lease covers publication,
     # consumption and unlink; a killed consumer leaves a registered exact file.
     def self.temporary(bytes:)
-      directory = private_directory(File.join(Dir.home, '.pwn', 'tmp'))
+      directory = private_directory(disposable_directory('tmp'))
       path = File.join(directory, "input-#{SecureRandom.hex(12)}.txt")
       File.open("#{path}.lease", File::RDWR | File::CREAT | File::NOFOLLOW, 0o600) do |lease|
         lease.flock(File::LOCK_EX)
@@ -465,6 +466,14 @@ module PWN
       path
     end
 
+    # Disposable category tmp lives in the runtime workspace, not ~/.pwn/tmp.
+    def self.disposable_directory(category)
+      raise ArgumentError, 'Not a disposable category' unless %w[cache tmp logs].include?(category)
+
+      base = File.join(Dir.home, '.pwn')
+      category == 'tmp' ? File.join(base, 'workspaces', 'runtime') : File.join(base, category)
+    end
+
     def self.private_directory(path)
       ancestor = File.expand_path(path)
       loop do
@@ -499,7 +508,7 @@ module PWN
       return 'unknown_schema' unless row.is_a?(Hash) && row['version'] == 1 && %w[cache tmp logs].include?(row['category']) && row['expires_at'].is_a?(Integer)
 
       path = row['path']
-      root = File.join(Dir.home, '.pwn', row['category'])
+      root = disposable_directory(row['category'])
       return 'unsafe_path' unless path.is_a?(String) && path.start_with?("#{root}/") && File.expand_path(path) == path
       return 'missing' unless File.exist?(path)
       return 'unsafe_path' unless File.realpath(path) == path && File.file?(path) && File.stat(path).uid == Process.uid
@@ -574,7 +583,7 @@ module PWN
             next if dry_run
 
             unless result[:ledger]
-              directory = private_directory(File.join(root, 'quarantine', SecureRandom.hex(12)))
+              directory = PWN::Backups.directory(label: 'disposable')
               result[:ledger] = File.join(directory, 'ledger.json')
             end
             backup_path = File.join(File.dirname(result[:ledger]), "#{Digest::SHA256.hexdigest(path)}.bin")
@@ -788,11 +797,14 @@ module PWN
     # children. Restoring a ledger alone never undoes deletion or migration.
     def self.recovery_status(ledger:)
       root = File.join(Dir.home, '.pwn')
-      prefixes = %w[maintenance session_cleanup_archive learning/migrations].map { |name| "#{File.join(root, name)}/" }
+      prefixes = %w[backup maintenance session_cleanup_archive learning/migrations].map { |name| "#{File.join(root, name)}/" }
       raise IOError, 'Unsafe recovery ledger' unless prefixes.any? { |prefix| ledger.start_with?(prefix) } && File.realpath(ledger) == ledger
 
       data = JSON.parse(File.binread(ledger))
       operation = data['operation']
+      operation = 'session_cleanup' if ledger.include?('/backup/') && data['records'].is_a?(Array) && data['deleted_ids'].is_a?(Array)
+      operation = 'continuation_retirement' if ledger.include?('/backup/') && data['backup'] == File.join(File.dirname(ledger), 'personas.json')
+      operation = 'session_layout' if ledger.include?('/backup/') && File.basename(ledger) == 'layout.json'
       operation = 'session_layout' if File.basename(ledger) == 'layout.json' && ledger.start_with?("#{File.join(root, 'session_cleanup_archive')}/") && data['records'].is_a?(Array)
       operation = 'learning_migration' if ledger.start_with?("#{File.join(root, 'learning', 'migrations')}/") && data['version'] == 1 && data['before_sha256'] == File.basename(ledger, '.json')
       operation = 'session_cleanup' if ledger.start_with?("#{File.join(root, 'session_cleanup_archive')}/") && data['dry_run'] == false && data['records'].is_a?(Array) && data['deleted_ids'].is_a?(Array)
@@ -841,7 +853,7 @@ module PWN
         end
       end
       root = File.join(Dir.home, '.pwn', 'maintenance', 'quarantine')
-      raise IOError, 'Unsafe recovery ledger' unless ledger.start_with?("#{root}/") && File.realpath(ledger) == ledger
+      raise IOError, 'Unsafe recovery ledger' unless [root, File.join(Dir.home, '.pwn', 'backup')].any? { |base| ledger.start_with?("#{base}/") } && File.realpath(ledger) == ledger
 
       data = JSON.parse(File.binread(ledger))
       raise IOError, 'Unknown recovery ledger' unless data['operation'] == 'routine' && data['records'].is_a?(Array)
@@ -851,7 +863,7 @@ module PWN
         data['records'].each do |row|
           path = row.fetch('path')
           category = row.fetch('category')
-          target_root = File.join(Dir.home, '.pwn', category)
+          target_root = disposable_directory(category)
           backup_path = row.fetch('backup')
           raise IOError, 'Unsafe recovery path' unless %w[cache tmp logs].include?(category) && path.start_with?("#{target_root}/") && File.expand_path(path) == path && File.realpath(File.dirname(path)) == File.dirname(path)
           raise IOError, 'Unsafe recovery backup' unless File.dirname(backup_path) == File.dirname(ledger) && File.realpath(backup_path) == backup_path && Digest::SHA256.file(backup_path).hexdigest == row['sha256']
@@ -1021,7 +1033,7 @@ module PWN
           File.open(PWN::Sessions.support_path(kind: :lease, session_id: id), File::RDWR | File::CREAT | File::NOFOLLOW, 0o600) do |lease|
             raise IOError, 'Swarm continuation active' unless lease.flock(File::LOCK_EX | File::LOCK_NB)
 
-            directory = private_directory(File.join(Dir.home, '.pwn', 'maintenance', 'retirements', SecureRandom.hex(12)))
+            directory = PWN::Backups.directory(label: 'continuation')
             backup_path = File.join(directory, 'personas.json')
             publish(backup_path, bytes)
             raise IOError, 'Continuation backup mismatch' unless File.binread(backup_path) == bytes
@@ -1141,7 +1153,7 @@ module PWN
     def self.publish(path, bytes)
       temporary = "#{path}.#{SecureRandom.hex(8)}.tmp"
       root = File.join(Dir.home, '.pwn')
-      category = %w[cache tmp].find { |name| path.start_with?("#{File.join(root, name)}/") }
+      category = %w[cache tmp].find { |name| path.start_with?("#{disposable_directory(name)}/") }
       if category
         directory = private_directory(File.join(root, 'maintenance', 'atomic'))
         journal = File.join(directory, "#{SecureRandom.hex(12)}.json")
@@ -1183,7 +1195,7 @@ module PWN
           next if days.nil? || (expired_only && row.fetch('created_at') > Time.now.to_i - (days * 86_400))
 
           path, target = row.values_at('path', 'target')
-          base = "#{File.join(root, row['category'])}/"
+          base = "#{disposable_directory(row['category'])}/"
           raise IOError, 'Unsafe atomic path' unless [path, target].all? { |name| name.is_a?(String) && name.start_with?(base) && File.expand_path(name) == name } && File.dirname(path) == File.dirname(target) && path.match?(/\A#{Regexp.escape(target)}\.[a-f0-9]{16}\.tmp\z/)
           next unless File.exist?(path) || File.symlink?(path)
           raise IOError, 'Changed atomic bytes' unless verified_backup?(path, row['sha256']) && File.stat(path).ino == row['inode'] && File.stat(path).dev == row['device']
@@ -1210,16 +1222,7 @@ module PWN
     end
 
     def self.backup(path, expected, result)
-      unless result[:archive_dir]
-        base = File.join(Dir.home, '.pwn', 'session_cleanup_archive')
-        raise 'Unsafe archive directory' if File.symlink?(base)
-
-        FileUtils.mkdir_p(base, mode: 0o700)
-        raise 'Unsafe archive permissions' unless File.stat(base).uid == Process.uid && (File.stat(base).mode & 0o777) == 0o700
-
-        result[:archive_dir] = File.join(base, "#{Time.now.utc.strftime('%Y%m%dT%H%M%S')}-#{SecureRandom.hex(8)}")
-        Dir.mkdir(result[:archive_dir], 0o700)
-      end
+      result[:archive_dir] ||= PWN::Backups.directory(label: 'session-cleanup')
       expected.each do |name, record|
         next unless record
 
@@ -1273,6 +1276,9 @@ module PWN
       locks = []
       begin
         paths.each do |path|
+          owner = Thread.current[:pwn_learning_write_lock]
+          next if File.basename(path) == '.learning-write.lock' && owner && owner[:pid] == Process.pid && owner[:thread] == Thread.current
+
           lock = File.open(path, File::RDWR | File::CREAT | File::NOFOLLOW, 0o600) # rubocop:disable Style/FileOpen -- closed together in ensure
           locks << lock
           raise 'Dependency writer active' unless lock.flock(File::LOCK_EX | File::LOCK_NB)
@@ -1327,7 +1333,7 @@ module PWN
     # Legacy writers block all mutations, including evidence migration.
     # One permanent inode serializes CLI, curses and cron maintenance writers.
     # Read-only previews never acquire a writer lock or create lock files.
-    def self.with_maintenance_lock(dry_run:)
+    def self.with_maintenance_lock(dry_run:, &block)
       return yield if dry_run
 
       root = PWN::Sessions.sessions_dir
@@ -1342,8 +1348,16 @@ module PWN
 
         begin
           Thread.current[:pwn_session_maintenance_lock] = { pid: Process.pid, thread: Thread.current, path: path, file: file }
-          yield
+          learning = PWN::AI::Agent::Learning.send(:learning_lock, nonblocking: true)
+          if learning == :busy
+            Thread.current[:pwn_backup_learning_busy] = true
+            yield
+          else
+            PWN::Backups.transaction(&block)
+          end
         ensure
+          PWN::AI::Agent::Learning.send(:learning_unlock, lock: learning) unless learning == :busy
+          Thread.current[:pwn_backup_learning_busy] = nil
           Thread.current[:pwn_session_maintenance_lock] = owner
         end
       end
@@ -1452,6 +1466,8 @@ module PWN
 
     def self.maintenance_transaction(dry_run:, current_session_id:, proc_root:)
       preflight = sweep(dry_run: true, current_session_id: current_session_id, proc_root: proc_root)
+      return preflight.merge(apply_blocked: true, evidence_migration: { deferred: 'learning_writer_active', migrated_rows: 0 }) if Thread.current[:pwn_backup_learning_busy] && !dry_run
+
       blocked = stopping? || !preflight[:legacy_owners].empty? || Array(preflight[:unresolved_store_remediation]).any?
       unless dry_run || blocked
         # Private metadata-only preflight survives an interrupted migration.