samagotchi 0.105.0 → 0.106.0

data/docs/internals/participants.md

@@ -2,8 +2,9 @@
 
 A session's owner can invite **participants** to review it: people, or agents, who reach that one session through
 chi web with a link of their own. This page is the identity layer (the shared-sessions plan's P2): grants, the gate,
-the routes a participant reaches, and what is written where. A participant can't send a turn yet (P3), and their page
-shows only the session's title and status until the full participant UI lands (P4). The code and docs say
+the routes a participant reaches, and what is written where; and their **review turns** (P3b): queued, read-only,
+limited and capped; and what they **see** (P4a): their page and its reads, all through one filter. Participants are
+experimental. An agent participant waits on its own turns' replies through the API. The code and docs say
 "participants" and "review", never "shared": `session.shared` already means "attached by default".
 
 Until `web.public_url` lands, participants are a **LAN** feature (`web.host: lan`): a loopback peer is always the
@@ -18,12 +19,12 @@ participant** and **one role**, until it expires or is revoked.
   look up only participant tokens, and a leaked one is recognisable. It is shown **once**, in the link chi share or
   `POST …/participants` prints; chi keeps only its **SHA-256 digest**. Lookup digests the presented token and
   compares it with every grant's digest (`Rack::Utils.secure_compare`).
-- **Participant.** The grant's `id`, `p_<8 hex>`, names the participant: a turn they send will be authored
-  `"p:<id>"` (`Grant#author`, `Principal#author`; P3). `kind` is `human` or `agent` (D11: an agent uses the same
+- **Participant.** The grant's `id`, `p_<8 hex>`, names the participant: a turn they send is authored
+  `"p:<id>"` (`Grant#author`, `Principal#author`). `kind` is `human` or `agent` (D11: an agent uses the same
   token, as a Bearer header; there is no agent UI). `role` is `reviewer`, the only one in v1. `name` is cleaned to
-  one line of at most 64 characters with no brackets (`Grants.clean_name`), so it can't forge P3's
+  one line of at most 64 characters with no brackets (`Grants.clean_name`), so it can't forge the
   `[Review contribution from …]` header.
-- **Lifetime (D8).** 7 days by default (`chi share --expires Nh|Nd`, 1 hour to 30 days). Revoked by the owner
+- **Lifetime (D8).** 7 days by default (`web.participants.expires`; `chi share --expires Nh|Nd`, 1 hour to 30 days). Revoked by the owner
   (`chi share revoke`, `DELETE …/participants`), and by an **archive** (the session and its delegates) or a
   **delete** (`SessionManager.archive_session` / `delete_session` → `Participants.end_sessions`). A session pruned by
   retention, or archived or deleted by a process that didn't revoke, is caught by the gate: a live grant whose session
@@ -64,21 +65,160 @@ Then `#route`, for each matching `ROUTES` row:
 `spec/web/participant_gate_spec.rb` walks `ROUTES`: every `:owner` row answers a participant 403, and every session
 row answers another session's id 404, so a new route is covered without a new example.
 
-## What a participant reaches (P2)
+## What a participant reaches
 
 | Route | Permission | A participant gets |
 |---|---|---|
-| `GET /` | participant | the participant page (server-rendered, no script): "Alex's review", the session's title and status, "Comments open soon", the participants' names. Never the owner's page, where every route would refuse them. |
+| `POST /api/sessions/:id/turn` | participant | a queued review turn of their own ([Turns](#turns)) |
+| `POST /api/sessions/:id/turn/:eid/dequeue` | participant | their own queued turn back; another's (the owner's included) is 403 `not_permitted` |
+| `GET /api/sessions/resolve?id=` | participant | their session for its id or a prefix of it; anything else 404 as no session (never an ambiguity listing others) |
+| `POST /api/sessions/:id/wait/prepare`, `…/wait` | participant | only for a turn of theirs (`turn`: the enqueued id `POST …/turn` answered; else 403); the answer trimmed to `{status, text, turn_id, cancel_reason}`; a question or approval their turn raised, or their turn held by the owner's step-limit Continue offer ([Turns](#turns)), is `{status: "waiting_for_owner", detail: "waiting for the session's owner"}` with nothing of it |
+| `GET /` | participant | the participant page's shell (`participant.html`, its body's `data-session` and `data-name` the grant's; `participant.js` reads the rest through the two routes below). Never the owner's page, where every route would refuse them. |
+| `GET /api/sessions/:id/review` | participant | the page's data, filtered ([What a participant sees](#what-a-participant-sees)): `{viewer, session: {id, title, status}, participants, messages, current_turn, waiting_for_owner, queued: {mine, others}, last_event_id}` |
+| `GET /api/sessions/:id/stream` | participant | the session's stream through `ParticipantStreamFilter` (only `from_seq` and `snapshot` reach the Bridge); it ends within a poll of a revoke or the expiry |
 | `GET /api/info` | participant | `{app, version, features}` (what `SessionAccess::Remote`'s check needs); not `pid`, `cwd`, `lan`, `installed` |
 | `GET /api/sessions/:id` | participant | their session only, whatever the query (`brief`, `cards`, `tail`, `timing`): `{session: {id, title, status, participants: [{id, name, kind, role}]}}` (the active ones). `title` is the session's own title, or "an untitled session": never `display_title`'s fallback, the first prompt's opening words |
 
-Everything else is `:owner`, `POST …/turn` included (P3 opens it). Static assets (`/app.js`, …) are served to any
-principal past the gate: they are the public frontend.
-
-**Streams.** No stream route is a participant's yet (`App#stream_filter` raises for one, until P4's filter). The
-seam for ending them is in place: `App#stream_running(principal)` is the proxy's running check (asked every
-`BridgeClient::STREAM_POLL`), and for a participant it is false once the grant is revoked or expired, so P4's
-participant streams close within a poll of a revoke, including one made by `chi share revoke` in another process.
+Everything else is `:owner`: `/answer`, `/command`, `/images` (an image a prompt carried is "[image]" on their page),
+`/output` (the raw replies), the hub's `/api/events`, the cap route. Static assets (`/app.js`, …) are served to any principal past the gate: they are the public frontend.
+
+## Turns
+
+A participant's `POST /api/sessions/:id/turn` (`ParticipantAccess#handle_participant_turn`) takes only the body's
+`prompt`. Three layers keep it a review turn.
+
+**chi web.** The author is the grant's (`p:<id>`) and the client id `review:<id>` (`ClientId.review`: a human's
+input, origin `review`, source `participant`, labelled `review`); the body's `client_id`, `author`, `delivery`,
+`no_interrupt` and `images` never count. Refused before delivery, each audited:
+
+- a line starting `!` or `/` (after leading spaces): 403 `not_permitted`, so no shell line, session command or
+  plugin command (v1);
+- images: 403 `not_permitted` (D10);
+- the grant's cap: 429 `cap_reached`, from the session's saved analytics (`SessionMetrics.saved_spend`).
+
+It goes out as `delivery: queue` (D6) with `pending_limit` = the grant's queue limit + 1 (the running one), never
+into the owner's prompt history. The Bridge counts the author's running and queued turns under its event lock and
+answers 429 `too_many_turns` past it; with no worker, their waiting input files are counted. The ack is 202 with
+`delivery: "queue"`; chi web keeps enqueued id → grant (the last 1000), which `dequeue` and `wait` check, falling
+back to a waiting file's author after a restart.
+
+**The worker.** A participant's input file waits for its own turn whatever its delivery says
+(`SessionInbox.waits_for_turn_end?`), so a drain never merges it into another author's turn; the Bridge queues their
+`POST /turn` whatever it asks and never cuts for it; a participant's `/word` or `!line` is refused by the Bridge (403)
+and dropped from the worker's file path. A participant's turn goes only to a worker that names the `review_turns`
+feature (409 `review_unavailable` otherwise: it has no boundary; restart it), and never as a file while a worker
+that may be older holds the session (504 `worker_timeout`: send again). Before a queued participant turn starts, the
+worker checks their link (`participants.json`: revoked, expired) and their cap again: either way the turn is
+dequeued (`:turn_dequeued`) and audited (`revoked`, `cap_reached`) instead of run, so a revoke also stops what they
+had queued. A step-limit Continue of a participant's turn (the owner answers it) continues as theirs: its origin keeps
+their author (`ContinueOffer#run_continue_turn`), so it runs inside the boundary and on their spend; it isn't
+continued once their link ended or their cap is reached. The step-limit Continue offer of the owner's turn is the
+owner's to answer: while one stands, the worker **holds** a participant's input file (`Worker#run_input_files`,
+`SessionInbox.participant_input?`; an unreadable file counts) instead of running it, which would drop the offer. It
+stays in the inbox: still queued on the Bridge (counted against their queue limit, `turn/dequeue` takes it back),
+and it doesn't hold back a command written after it (`#ready_command?`: that may be the owner's `/continue`). Once
+the owner continues, stops or sends a turn of their own (which drops the offer, as any owner prompt does), the held
+turns run in the order they came, each through the link and cap check above as it starts; a reminder turn drops the
+offer too and so releases them. A held file isn't queued input for the idle-exit policy (`Worker#input_pending?`): `/exit`
+and `chi sessions restart` name what waits, the offer (`continue_offered`), not a queued prompt. The offer lives in
+the worker: a worker that restarts has none, and runs them.
+Their `wait` always waits as for a queued turn of theirs, never for the next reply past a cursor (which could be
+anyone's); on a held turn it answers `waiting_for_owner` (`ReplyWait::Poll#held`), the offer asked before the wait
+began too. A chi client gets it through `--remote` with a participant's token in `remotes.yml`: `chi --remote NAME
+send --wait --turn T ID` reaches only participant routes (resolve, `wait/prepare` and `wait` on their turn), and
+`ParentReport` reads `waiting_for_owner` as its own status, exit 3 like a question, its detail
+`ParentReport::WAITING_FOR_OWNER` (the route's words too) and the command that waits again. With a
+participant's token (`chp_`, `SessionAccess::Remote#participant?`) `chi send -m` prints the queued turn's id and the
+command that waits for it, and `send --wait -m` skips the owner's busy check (its turn is queued, so a running turn
+doesn't refuse it; that check's `wait/prepare` without a turn would be 403 `not_permitted`) and waits on the turn it
+queued, as `--turn T` does.
+
+**The tool calls.** `Guardrails::ReviewBoundary` denies a participant's turn everything but reads of the project
+([guardrails](../guardrails.md#a-participants-review-boundary)). Approvals and questions are owner-only: the boundary
+denies the model's own question, and `/answer` is an owner route.
+
+**Hooks and plugins** run on a participant's turn with the owner's power; every event of the turn carries `author:`
+and `ctx.turn_author` names it ([hooks](../hooks.md#participants-turns)).
+
+### Limits and the cap
+
+- **Queue.** One running turn plus the grant's `queue` (default 3, `web.participants.queue`, 0 to 20) waiting.
+- **Cap (D7).** The owner pays. A grant's `cap` is dollars (default $2, `web.participants.cap`; `chi share --cap`,
+  `chi share cap ID P DOLLARS`, `POST /api/sessions/:id/participants/:p/cap {cap}`). Spend is counted by author:
+  each turn's reported and estimated cost (the analytics turn record's `author`), and the side requests the
+  participant caused (their turn's `ctx.ask_model`, the idle recap after their turn; `SideTotals#by_author`). An
+  owner command's side request is the owner's. `/stats` shows each participant's spend by name. At the cap the
+  participant's next turn is 429 `cap_reached`, and the owner gets one notice per participant and cap: "Alex reached
+  their $2.00 review cap: their comments are refused until you raise it (chi share cap ID p_… AMOUNT)." A running
+  turn's spend counts from its end, so a turn can finish past the cap; the session-wide `cost-cap` bundle still
+  applies, and its question in a participant's turn goes to the owner.
+
+**Streams.** A participant's stream is filtered ([below](#what-a-participant-sees)), and it ends with their link:
+`App#stream_running(principal)` is the proxy's running check (asked every `BridgeClient::STREAM_POLL`), false for a
+participant once the grant is revoked or expired, so their stream closes within a poll of a revoke, including one
+made by `chi share revoke` in another process; the page then reads a 401 and shows the ended-link page.
+
+## What a participant sees
+
+D5 (a): prompts and replies with their authors, one-line tool rows, turn boundaries, the queue and waiting states.
+Not tool output or arguments, thinking, approvals' and questions' content, memories (text or names), context notes,
+plugin steers, automatic and delegate input, cards, command output, the working set (the user decided: not), cost,
+timing, host paths or the owner's prompt history. Every read a participant reaches goes through one module,
+`Web::ParticipantView` (`lib/samagotchi/web/participant_view.rb`), whose every answer is a new hash built from named
+fields: a field added to an event later reaches nobody until it is named there.
+
+- **Events** (`.event`, the stream). `EVENTS` names the types a participant gets, each rebuilt by its own method:
+  `turn_started` (turn id, the author and name, `mine` for their own, the prompt only when a person sent the turn:
+  `ClientId.human?`, else `automatic`; `continue`), the turn's end (`turn_completed`, `turn_canceled`, `turn_failed`:
+  type and turn id), `generation_chunk` (its visible `text` only; a thinking-only chunk is dropped),
+  `generation_retrying` (`restarted`), `tool_call_started` (the tool's name, and for a file tool the path relative to
+  the session's folder when it is inside it; never when that folder is home or `/`), `tool_call_completed` (its status word), and bare markers (the type
+  alone) for the queue (`turn_enqueued`, `turn_dequeued`, `input_merged`), the owner's question, approval or Continue
+  offer and their answers, and `snapshot` / `reset`: the page re-reads its review data at each. Every other type,
+  known (`DROPPED`) or new, is dropped. `spec/web/participant_view_spec.rb` scans every `type: :name` chi emits and
+  every handler of the web's stream, and fails until a new one is named in `EVENTS` or `DROPPED`.
+- **The frames** (`Web::ParticipantStreamFilter`). The Bridge's chunks are cut into frames (`\r?\n\r?\n`, a partial
+  one kept for the next chunk, one over 1 MiB dropped to its end); each frame's JSON goes through `.event` and is
+  written again (`id:` the Bridge's cursor when it looks like one, `event:` the filtered type); a comment is a
+  `: ping`; anything that doesn't parse is dropped. The reply's text goes out by whole lines, so a secret the model
+  streams over two chunks is redacted as one, and a private key block is withheld from its BEGIN line to its END
+  line; the rest of a line waits for its end, a tool call, the turn's end or the owner's question (or 400
+  characters). The owner's stream never goes through it (a byte pipe).
+- **The conversation** (`.messages`, over `App#messages_for_display(parts: true)`): a user message only when it is a
+  turn's prompt (it has the turn's id) or a person's merged line, and never one from a source that isn't a person's;
+  so the owner's `!` line and its output, a delegate's report (a wake turn's too), and the notes chi adds (a declined
+  Continue) never show. A turn no person sent (its record's `automatic`, `SessionMetrics`: a task's or a plugin's,
+  read from analytics.json and the live worker's records; the running turn's by its start; a delegate child's first
+  turn, its parent's task) shows as an automatic turn without its prompt, as the stream does. A raw loop's saved
+  reply is cut before the display reads it (`.visible_raw`): what came before a bare `</think>` and everything from
+  an unclosed thought or tool call on, which the display would only untag. Each
+  prompt carries its author and an image count; replies their text and their step's tool rows. Notes, steers and
+  empty-answer markers are dropped. The reply's
+  `html` is rendered from the filtered text. The turn in progress (`.current_turn`, over the Bridge snapshot's) gives
+  its start's fields, the text so far, its tool rows (with `running`) and `waiting_for_owner`.
+- **The queue.** Their own queued turns (enqueued id and text, for Take back) and how many others wait.
+- **Redaction** (`ParticipantView::Redact`, on every string that goes out): secret shapes (`sk-…`, `ghp_…`,
+  `github_pat_…`, `AKIA…`, `xox…-`, `chp_…`, `AIza…`, `rk_live_…`, JWTs, Slack webhooks, private key blocks, an
+  `Authorization:` header's value, any `…token` / `…api_key` / `…secret` / `…password` value, `=` or `:`, quoted or
+  not, and a URL's password), the owner's web token, the session's folder (shown as relative paths) and the home
+  folder (`~`). Defence in depth only: the allowlist is the control; a reply that paraphrases a secret isn't caught.
+- **Errors.** A participant's 404 and 500 carry fixed words, never an exception's (which may name a path).
+- **The owner's participant view.** The owner reaches the same reads: `/?as=participant#s=<id>` serves the participant
+  page, `GET …/review` is always the filtered view, and `…/stream?as=participant` goes through the same filter, with
+  no participant of their own (nothing `mine`, no composer). It is the server's filter, never a page imitating it.
+
+The red-team spec (`spec/participant_red_team_spec.rb`) reads the stream, the review, every show variant, `/output`
+and an image as a participant, with an approval, a question, a tool's call and output, thinking, a memory, a steer,
+a delegate report, an unknown event and host paths in the session, and finds none of them.
+
+## The owner's controls
+
+The info bar's participants chip (`participants_panel.js`) reads `GET …/participants` (which adds each one's `spend`
+and `turns` from the saved analytics, `SessionMetrics.saved_by_author`) when the session opens, when the panel opens,
+at a participant's turn end and on `participants_changed`. The panel invites (`POST …/participants`, whose answer
+carries `qr_svg`, the link's QR, `Web::QR.svg`), revokes and sets caps through the owner routes below. A participant's
+prompt carries their name and colour (`--author-1…6` in `tokens.css`, by id, the same on both pages), from the saved
+message's `author_name`, `turn_started`'s, or the panel's list (`participant_names.js`).
 
 ## The owner's routes
 
@@ -89,9 +229,11 @@ participant streams close within a poll of a revoke, including one made by `chi
 | `POST /api/sessions/:id/participants` | `name`, `kind` (`human`/`agent`), `ttl` (seconds) | 201 `{participant: grant, token, link, lan}`: the token and the link once; `link` names this chi web's LAN address (`http://IP:PORT/?token=…#s=<id>`), `lan` false when it has none | 400 `invalid_participant` (name, kind, ttl, an archived session); 404 |
 | `DELETE /api/sessions/:id/participants[?id=p_…]` | | 200 `{revoked: [grant]}`: one participant, or the session's | 400 `invalid_participant` |
 | `DELETE /api/participants` | | 200 `{revoked: [grant]}`: every session's | |
+| `POST /api/sessions/:id/participants/:p/cap` | `cap` (dollars, 0 to 1000) | 200 `{participant: grant}`: their cap from their next turn on | 400 `invalid_participant` (the cap, no such active participant) |
 
 A grant here is `Grant#public_h`: `id, session_id, kind, name, role, created_at, expires_at, revoked_at, revoked_by,
-last_used_at, state` (`active | revoked | expired`). Never the token or its digest.
+last_used_at, state` (`active | revoked | expired`), `cap` (dollars) and `queue`. Never the token or its digest.
+`POST …/participants` also takes `cap`. A grant from before caps takes the config's.
 
 `chi share` (docs/cli.md) uses them through `--remote`, and `SessionAccess::Local`'s same-named operations here
 (`participants`, `invite`, `revoke_participants`; `ParticipantView`, `Invitation`). A local invite's link names
@@ -105,16 +247,19 @@ neither is copied to a continue, a fork or a delegate (a continue starts with no
 invited to has neither: its files stay byte for byte as they were.
 
 - **`participants.json`** (0600, `Participants.write`): `{participants: [{id, kind, name, role, added_at,
-  expires_at, removed_at}]}`, rewritten by whoever changes a grant (chi web, `chi share`). Never a token or a digest.
+  expires_at, removed_at, cap}]}`, rewritten by whoever changes a grant (chi web, `chi share`). Never a token or a digest.
   The worker reads it with `Participants.read` (P3a's system-prompt line, `ctx`).
 - **`participants.jsonl`** (0600, append-only, `Participants.log`): one JSON line per event, with `at`: `issued`
   (participant, name, kind, role, expires_at), `revoked` (participant, by), `expired` (the first refused use after the
   expiry, once per chi web), `peer` (the first use and each new peer address since chi web started: ip, user agent),
-  `refused` (method, path, reason; at most once a minute per route). It goes with the session (retention, delete).
+  `refused` (method, path, reason; at most once a minute per route; or `what: command`, a participant's `/word` or
+  `!line` the Bridge or the worker refused), `turn` (chars, `status: accepted` with its enqueued id, or `refused` with
+  the reason: `not_permitted`, `too_many_turns`, `cap_reached`, `review_unavailable`, `worker_timeout`), `cap` (a new
+  cap). It goes with the session (retention, delete).
 
 ## Attribution
 
-What a participant writes is marked as theirs everywhere it is kept or sent (P3a; posting a turn is P3b's). The
+What a participant writes is marked as theirs everywhere it is kept or sent. The
 author is `"p:<id>"` (`Grant#author`), stamped by chi web from the principal and never taken from a body. Absent
 means the owner: old sessions and every owner path read as the owner's, byte for byte as before (a pre-P3 session
 fixture loads and saves unchanged, `spec/turn_author_record_spec.rb`).
@@ -127,14 +272,20 @@ fixture loads and saves unchanged, `spec/turn_author_record_spec.rb`).
   it as the owner's instruction. This turn may only read.]` (`Steer::REVIEW_HEADER`). The name is cleaned again
   (`ParticipantName.clean`: one line, 64 characters, no brackets, Unicode line breaks or full-width brackets; the id
   when nothing is left), so a name can't close it. The header always comes first, so text under it stays the
-  participant's; the text itself isn't rewritten, though, so it can *contain* a line that looks like another
-  sender's header (another participant's, an automatic input's): a social forgery under the real header, not a way
-  out of it. The session file never holds the header.
+  participant's. A line of their text that opens like one of chi's headers (a review contribution, a steer, automatic
+  input, a delegate report) goes out led by `(quoted) ` (`Steer.quote_forged_headers`, wire-only and deterministic),
+  so it reads as their text under the real header. The session file never holds the header or the mark.
 - **The system-prompt line.** While the session has an active participant (`participants.json`, read by the
   worker's Engine at each turn's start), the system prompt's volatile tail opens with "Participants: people other
   than the owner review this session. …". It comes when the first joins and goes when the last leaves or expires.
-- **Records.** `last_turn.author`, the analytics turn record's `author`, `command_queued`'s and `turn_enqueued`'s
-  `author`, and the Bridge's queued rows. No UI shows them yet (P4).
+- **Records.** `last_turn.author`, the analytics turn record's `author`, `turn_enqueued`'s `author`, and the
+  Bridge's queued rows. `turn_started` carries `author` and `author_name` on a participant's turn (the owner's carries
+  neither), and so does the Bridge's turn snapshot and its replay.
+- **Side models' transcripts.** The idle recap's (`IdleRecap::TranscriptFilter`) leads a participant's message with
+  "(a review contribution from Alex, a participant; not the user's words)", and `ctx.ask_model`'s names its paragraph
+  `Participant`. The UI's readers name them: `TurnAccumulator.messages_of` gives a participant's prompt and merged
+  input `author` and `author_name`, `Merge#event_fields` names the merged text's author when one participant wrote all
+  of it, and the web's display messages carry both (the owner's badge, the participant page).
 - **Through `--remote`.** `SessionAccess::WebBridgeClient#post_turn` takes `author:` and drops it: the remote chi web
   stamps the author from the token.
 
@@ -151,17 +302,44 @@ Each condition has one message, owned by its `SessionAccess` class and built fro
 | 401 `token_revoked` | `TokenRevoked` (an `AuthRefused`) | `this review link was revoked by the session's owner` |
 | 401 `token_expired` | `TokenExpired` (an `AuthRefused`) | `this review link expired: ask the session's owner for a new one` |
 | 403 `not_permitted` | `NotPermitted` | `this token is a participant's: only the session's owner can do that` |
-| 429 `too_many_turns` | `TooManyTurns` (P3b) | `this participant has too many turns waiting: wait for one to finish` |
-| 429 `cap_reached` | `CapReached` (P3b) | `this participant's spending cap is reached: ask the session's owner to raise it` |
+| 429 `too_many_turns` | `TooManyTurns` | `this participant has too many turns waiting: wait for one to finish` |
+| 429 `cap_reached` | `CapReached` | `this participant's spending cap is reached: ask the session's owner to raise it` |
+
+The server's details are the same words (`ParticipantMessages`), with no label.
 
 A 401 `unauthorized` stays `AuthRefused`'s "the token was refused".
 
+## The owner's terminal
+
+The attached TUI (`TerminalUI::AttachedLoop`, local or through `--remote`) is the owner's only; there is no
+participant TUI in v1.
+
+- **Who is in the review.** The worker's `ParticipantsWatch` reads `participants.json` again when its mtime moves and
+  measures each grant's expiry at every look. On its idle tick (between turns, `Worker::FALLBACK_TICK_SECONDS`) the
+  worker announces `:participants_changed` (`Engine#announce_participants`: `{participants: [{id, name, kind}],
+  joined: […], left: [{…, reason: revoked | expired}]}`) to every UI; its start announces nobody. "Joined" means
+  invited: participants have no presence of their own yet. `session_state_snapshot`'s `participants` names who is in
+  the review now, so a UI that joins has them. Owner frames only: no participant stream carries them (P4a's filter).
+- **Lines.** A participant's prompt (`turn_enqueued`'s `author`, an origin's, a queued row's, a saved message's
+  `author` / `author_name`) is led by their name (`Formatting#participant_prefix`: `Alex ▸ review>`, cleaned by
+  `ParticipantName`, the id when the TUI knows no name), in a colour picked from their id. Each change is one line per
+  participant; the status row counts who is in.
+- **Commands.** `/share`, `/participants` (`TerminalUI::ParticipantCommands`) run `ShareCommand` for the attached
+  session through the link's `SessionAccess` (`AttachLink#session_access`: `Local`, or the remote's), so their words
+  and refusals are `chi share`'s, led by the command as typed. The REPL answers them with a note.
+
 ## Invariants
 
 - The owner is a loopback peer or the owner's token; nothing else. A participant token never widens to the owner.
 - A participant reaches one session, through the `:participant` rows only; another session is a 404.
 - No token is written anywhere: the grants store has digests, the sidecar and the audit trail have neither.
 - Owner sessions are unchanged: no sidecar, no audit file, no key in the session JSON until a grant exists.
-- P2 lets no participant reach `POST …/turn`, `/command`, `/answer` or a stream. P3 adds the turn, with the author
-  stamped from the principal (never the body), and the worker's review boundary.
+- No participant reaches `/command`, `/answer`, `/output` or an image. Their turn's author and client id are stamped
+  from the principal, never the body.
+- Everything a participant reads (their stream, the review, the show) is built by `ParticipantView` from named fields;
+  an event type it doesn't name is dropped. The owner's participant view reads through the same filter.
+- A participant's turn is always a queued turn of its own (chi web, the Bridge, the inbox), never a command or a
+  shell line (chi web, the Bridge, the worker), and runs only on a worker with the review boundary, which denies
+  everything but reads of the project.
 - A participant's message is never sent without its review header, and never merged into the owner's message.
+- A participant's turn never answers or drops the owner's Continue offer: it waits until the owner has.

data/docs/internals/prompt-caching.md

@@ -122,7 +122,8 @@ right-hand column happens.
   and on a Messages host). The participants line opens the system prompt's volatile tail, after breakpoint #1:
   a new session's cache is untouched. The Engine checks the sidecar at each turn's start and rebuilds (`reset!`)
   only when the first participant joins and when the last leaves or expires: one history re-read each, then stable.
-  Under D3(a) the declared tools stay the session's, so an author switch costs nothing.
+  Under D3(a) the declared tools stay the session's, so an author switch costs nothing: the review boundary is a
+  gate on the calls, not a toolkit switch. The forged-header mark (`(quoted) `) is a pure function of the text too.
 - Side requests (idle recap, `/btw`) go through `IdleClient` with their own short system prompt. On a current
   llama.cpp they don't evict the session (see the server settings below); chi never pins them to a slot.
 

data/docs/internals/working-set.md

@@ -106,7 +106,7 @@ pending: [Steering: add and unadd](#steering-add-and-unadd)) (`Engine#emit_worki
 - once in `Engine#end_turn`, after `replace_session_messages` and before the end event, from the kept messages (the
   turn-end apply has run by then);
 - between turns, from `Engine#announce_working_set` (the session's messages, under the event lock; after a
-  `/working-set` op, and after an `/llm-context` change: the states are the next turn's strategy's): announced
+  `/working-set` op, after a `rollback_to`, and after an `/llm-context` change: the states are the next turn's strategy's): announced
   (`working_set_updated` is in `ANNOUNCEABLE_EVENTS`; held after a command's `command_ran` inside
   `holding_announcements`), under the *next* turn's strategy (`SessionModelSettings#turn_llm_context`, as the
   turn-end warm-up reads it; `TurnSettings` keeps the last turn's, stale after `/llm-context` or `/model`). While a
@@ -115,7 +115,9 @@ pending: [Steering: add and unadd](#steering-add-and-unadd)) (`Engine#emit_worki
 It is emitted only when the set (its items and adds) differs from the last one emitted for the session (kept per
 session id), and never while the set is empty (no items, no adds), so a tool-free turn on a fresh session emits nothing. One exception: when the last one had
 items and the set is empty now (a rollback removed the tool calls), one empty event goes out, so the page drops the
-stale items; it is remembered, so the next empty request sends none. It goes out whatever the web's flag;
+stale items; it is remembered, so the next empty request sends none. `Engine#rollback_to` between turns (`!rollback`,
+a canceled continue's restore, a failed turn's) announces the set at once (`announce_working_set`), so an emptied or
+smaller set reaches the page then, not at the next request. It goes out whatever the web's flag;
 the Bridge (`ClientEvent.project`) passes it on unchanged, and the attached TUI ignores it.
 
 **The route.** `GET /api/sessions/:id/working_set` (`Web::App#handle_working_set`) answers the snapshot's `to_h`
@@ -288,3 +290,7 @@ at `opacity: .5`. A group shows `✂n` for its forgotten members. It is struck o
 forgotten, and faded when all are stale or forgotten (`groupState`). The list's ops text says `stale` or `forgotten`
 in words (colour is never alone) and shows `~1.2k` tokens per row (`tokensText`). A footprint adds `n stale` (plain; a file the turn's
 end found changed shows there, the rail is gone by then) and `n forgotten`, struck. Titles add `(stale)` or `(forgotten)` per member.
+The secondary text and the rail's rule read through their own tokens, a step brighter on the dark palette and the
+base tokens on the light one: `--ws-faint` (the counts, the ops text, step tags; `--text-muted` on dark, `--text-faint`
+on light), `--ws-muted` (the rail's head, the list's `files · n` rows, the drop/pin buttons; `--text-3` / `--text-muted`),
+`--ws-rule` (the rail's left rule; `--border-strong` / `--border`) and `--ws-act-border` (the buttons' border).

data/docs/plugins.md

@@ -752,6 +752,7 @@ full label, `plugin.rb (bundle my-bundle)`.
 | `ctx.model_key` | that model's memory overlay key (`<name>.<key>.md`, what `memory_write current_model_only` writes) |
 | `ctx.cost` | the session's spend so far, read now, as a frozen value: `total` (USD, reported + estimated, side requests included; 0.0 before any), `reported` (by providers, `usage.cost`), `estimated` (from `hosts.<name>.models` prices; a generation is one or the other, never both), `side` (recap, `/btw`, `ask_model`: their share of `total`) and `known?` (false while generations or side requests ran but none was reported or priced, so a limit on it can't be enforced; a session with some priced generations reads known, the unpriced ones counting 0). It includes the running turn's finished generations and what earlier workers of the session spent. Use its methods, not its class. Needs chi 0.83.0 |
 | `ctx.usage` | the session's work so far, read now, as a frozen value: `turns` (finished ones and the running one), `tool_calls` and `tool_calls_by_tool` (every call, running ones included; canonical names: an alias counts under its tool, a `call_tool` call under the inner tool), `steps` (the loop rounds that dispatched tools, `/stats`' iterations) and `active_ms` (`active_minutes` too): work time, the generations' time plus the finished tool calls' time, never the waits between them (a question, an approval, the user's answer to `ask_user_question`), with `tool_ms_by_tool` its tool part by tool, so a waiting tool's time (`task_wait`) can be left out. Its counts are the ones `/stats` and `chi sessions stats` show, earlier workers' included. Use its methods, not its class. Needs chi 0.100.0 (guard it with `ctx.respond_to?(:usage)`) |
+| `ctx.turn_author` | who wrote the running turn when it isn't the session's owner: a participant's `"p:<id>"` (`chi share`); nil for the owner's turns and between turns. Every hook event of such a turn carries the same as `author:`. The handler runs with the owner's power whatever the author ([hooks](hooks.md#participants-turns)). Needs chi 0.105.0 (guard it with `ctx.respond_to?(:turn_author)`) |
 | `ctx.settings` | the bundle's settings, frozen: config.yml's `bundles: <bundle>:` with the session's own `--set` values laid over it ([Per-session settings](#per-session-settings)); the config alone until the session is bound (in `register` and `chi.ctx`) |
 | `ctx.data_dir` | `$XDG_STATE_HOME/samagotchi/plugins/<bundle>/`, created on first use. A session's own state goes in `sessions/<id>.json` or `sessions/<id>/` there: chi removes it when the session is deleted, discarded or pruned |
 | `ctx.log` | `ctx.log.info(:event, key: value)`: debug-log records tagged `plugins`, with `bundle=<bundle>` |
@@ -1192,6 +1193,7 @@ bundle.http.stub(:post, "http://127.0.0.1:9000/classify", json: { label: "safe"
 bundle.set(running: false)                               # the session's values: cwd:, messages:, cancelled: …
 bundle.set(cost: 2.5)                                    # ctx.cost: reported USD, or { reported:, estimated:, side:, known: }
 bundle.set(usage: { tool_calls: 40, active_ms: 600_000 }) # ctx.usage: { turns:, tool_calls:, tool_calls_by_tool:, steps:, active_ms:, tool_ms_by_tool: }
+bundle.set(turn_author: "p:p_0123abcd")                  # a participant's turn: ctx.turn_author, and author: on every event
 bundle.set(session_settings: { "cap" => 1 })             # the session's --set values (Bundle.load takes session_settings: too)
 bundle.tool_loads.last.names                             # ctx.load_tools calls; set(load_tools_staged: [...]) limits what they stage
 bundle.shutdown

data/docs/testing.md

@@ -138,7 +138,9 @@ When `parallel_rspec` fails in CI's `rspec` or `rspec-macos` job, the next step
 only the failed examples, once, with plain `rspec`. It reads their ids from `tmp/parallel_failures.log`
 (`.rspec_parallel`'s `FailuresLogger`) and writes the job summary: **Flaky: passed on rerun** or **Failed twice**,
 with the example ids, the Ruby version and the job. It skips the rerun when no ids were logged (a load error) or more
-than 20 failed (a real breakage). The job fails either way: a flake is a bug to fix, not a pass.
+than 20 failed (a real breakage). The job fails either way: a flake is a bug to fix, not a pass. The `bundles` job
+does the same after `rake bundles:specs`: that run writes rspec's `--format json` report to
+`tmp/bundle_failures.json` (the failed examples' ids and full descriptions, as the main suite's summary has), and the rerun (`--rspec`) runs on the bundle test kit alone, as the specs ran.
 
 Every flake is classified into one of the four patterns, each with its own fix:
 

data/lib/samagotchi/bridge/turn_accumulator.rb

@@ -86,7 +86,7 @@ module Samagotchi
           text.clear
         end
         unless turn[:prompt].nil?
-          prompt = { role: "user", content: turn[:prompt].to_s }
+          prompt = { role: "user", content: turn[:prompt].to_s, **author_of(turn) }
           prompt[:images] = turn[:images] if turn[:images]
           messages << prompt
         end
@@ -95,7 +95,7 @@ module Samagotchi
           when "text" then text << part[:text].to_s
           when "input"
             flush.call
-            messages << { role: "user", content: part[:text].to_s }
+            messages << { role: "user", content: part[:text].to_s, **author_of(part) }
           when "steer"
             flush.call
             messages << Steer.message(text: part[:text], source: part[:source])
@@ -105,6 +105,12 @@ module Samagotchi
         messages
       end
 
+      # A turn's or an input part's author fields (author:, author_name:),
+      # {} for the owner's: the same keys a saved message carries.
+      def self.author_of(item)
+        Steer.author_fields(item[:author], item[:author_name])
+      end
+
       # The turn in progress (#current_turn's shape, symbol keys) as the live
       # events that would have drawn it, in order, as turn_events.js
       # snapshotEvents replays it for the web (spec/shared/turn_snapshot.json
@@ -125,6 +131,7 @@ module Samagotchi
         started = { type: :turn_started, prompt: turn[:prompt], origin: turn[:origin], continue: !!turn[:continue] }
         started[:resumed] = true if turn[:resumed]
         started[:started_at] = started_at if started_at
+        started.merge!(author_of(turn))
         events = [with_images(started, turn[:images])]
         text_iteration = nil # a text part is open for this iteration
         close_text = lambda do
@@ -265,6 +272,7 @@ module Samagotchi
           @working_set = nil
           @turn[:images] = event[:images] if event[:images]
           @turn[:cut_after] = event[:cut_after] if event[:cut_after]
+          Steer::AUTHOR_KEYS.each { |key| @turn[key] = event[key] if event[key] }
         when :input_merged
           @merged_origins = Array(event[:origins])
           dequeue(@merged_origins)
@@ -330,7 +338,9 @@ module Samagotchi
           # A steer-only merge (count 0) has no user part: the origins stay
           # for the user lines' own merge.
           unless event[:content].nil?
-            parts << { kind: "input", iteration: event[:iteration], text: event[:content].to_s.dup, origins: @merged_origins }
+            input = { kind: "input", iteration: event[:iteration], text: event[:content].to_s.dup, origins: @merged_origins }
+            Steer::AUTHOR_KEYS.each { |key| input[key] = event[key] if event[key] }
+            parts << input
             @merged_origins = []
           end
           Array(event[:steers]).each do |steer|

data/lib/samagotchi/bridge.rb

@@ -22,6 +22,7 @@ require_relative "engine"
 require_relative "session_commands"
 require_relative "queued_command"
 require_relative "steer"
+require_relative "participants"
 require_relative "image_store"
 require_relative "log"
 require_relative "version"
@@ -543,8 +544,11 @@ module Samagotchi
     # Stop's last_turn carry the turn's enqueued_id (ReplyWait.own_turn).
     # unqueue: POST turn/dequeue (#handle_dequeue_turn) takes a queued
     # message back before it runs.
+    # review_turns: a participant's turn runs as its own, inside the review
+    # boundary (Guardrails::ReviewBoundary); a worker without it has none,
+    # so chi web sends it no participant's turn (Delivery::REVIEW_FEATURE).
     FEATURES = ["restart", "task_stop", "reparent", Delivery::QUEUE_FEATURE, ReplyWait::TURN_IDS_FEATURE,
-                SessionInbox::UNQUEUE_FEATURE].freeze
+                SessionInbox::UNQUEUE_FEATURE, Delivery::REVIEW_FEATURE].freeze
 
     # The routes, by method and what follows /session/:id/: a handler takes
     # the session id and the request body and returns [headers, status, body].
@@ -916,6 +920,19 @@ module Samagotchi
       end
 
       delivery = Delivery.parse(raw_delivery)
+      # How many of a participant's turns may be running or waiting
+      # (chi web's, from their grant: its queue limit plus the running one).
+      pending_limit = nil
+      if Steer.participant_author?(author)
+        # A participant's message is a turn of its own, whatever the body
+        # asks (D6), and never a command or a shell line: chi web refuses
+        # those first, and this is the worker's own layer.
+        return participant_refused(sid, author, "command") if command_registry.command?(prompt.to_s)
+
+        delivery = Delivery::QUEUE
+        pending_limit = fetched(parsed, "pending_limit")
+        pending_limit = nil unless pending_limit.is_a?(Integer) && pending_limit.positive?
+      end
 
       # A session command sent as a message (chi send -m "/model x", chi -p,
       # a UI whose command list lags) runs as the command, as typed in a
@@ -938,6 +955,7 @@ module Samagotchi
       enqueued = @engine.synchronize_events do
         raise IntakeClosed if stopped?
         next :expired if expired?("turn_expired", deadline, sid: sid, client_id: client_id)
+        next :too_many if pending_limit && pending_turns(author) >= pending_limit
 
         queued_behind_turn = Delivery.queue?(delivery) && !@accumulator.current_turn.nil?
         enqueue_turn(prompt: prompt, client_id: client_id, enqueued_id: enqueued_id,
@@ -953,6 +971,7 @@ module Samagotchi
         end
       end
       return deadline_passed("turn") if enqueued == :expired
+      return [{}, 429, { error: "too_many_turns", detail: ParticipantMessages::TOO_MANY_TURNS }] if enqueued == :too_many
       return [{}, 500, { error: "enqueue_failed", detail: "could not write turn input" }] unless enqueued
 
       # Queued (outside the event lock): a message sent as +cut+ cuts a
@@ -1006,6 +1025,21 @@ module Samagotchi
       dequeue_reply(taken, id, input)
     end
 
+    # +author+'s turns running or waiting: the running turn when it is
+    # theirs, and their queued ones. Read with the event log held.
+    def pending_turns(author)
+      running = Steer.sender_author(@accumulator.current_turn&.dig(:origin, :author)) == author ? 1 : 0
+      running + @accumulator.queued.count { |row| row[:author] == author }
+    end
+
+    # 403 not_permitted for a participant's +what+ (a command, a shell
+    # line), with its audit line.
+    def participant_refused(sid, author, what)
+      Participants.log(sid, :refused, state_dir: File.dirname(session_dir), participant: author.delete_prefix("p:"), what: what,
+                                      reason: "not_permitted")
+      [{}, 403, { error: "not_permitted", detail: Participants::NOT_PERMITTED }]
+    end
+
     def dequeue_reply(taken, id, input)
       case taken
       when :removed then [{}, 200, { status: "removed", enqueued_id: id, prompt: input.prompt.to_s, session_id: @session_id }]

data/lib/samagotchi/bridge_client.rb

@@ -167,10 +167,13 @@ module Samagotchi
     #   the session's images/
     # @param author [String, nil] who wrote it when it isn't the session's
     #   owner; sent only when given (SessionManager.deliver_turn)
-    def post_turn(prompt:, client_id: nil, no_interrupt: false, images: nil, delivery: nil, author: nil)
+    # @param pending_limit [Integer, nil] with a participant's +author+: how
+    #   many of their turns may be running or waiting (429 too_many_turns past it)
+    def post_turn(prompt:, client_id: nil, no_interrupt: false, images: nil, delivery: nil, author: nil, pending_limit: nil)
       body = { session_id: @session_id, prompt: prompt, client_id: client_id }
       body[:no_interrupt] = true if no_interrupt
       body[:author] = author if author
+      body[:pending_limit] = pending_limit if author && pending_limit
       body[:images] = images if images && !images.empty?
       body[:delivery] = delivery unless delivery.nil? || Delivery.next_step?(delivery)
       body[:deadline] = deadline

data/lib/samagotchi/bundles/system/manifest.yml

@@ -1,6 +1,6 @@
 ---
 name: samagotchi-system
-version: 0.105.0
+version: 0.106.0
 scope: system
 description: Default system memories — identity, self map, config modification protocol, memory guide and the delegated-session rules
 files:

data/lib/samagotchi/client_id.rb

@@ -34,12 +34,16 @@ module Samagotchi
     PLUGIN = "plugin"
     # A relayed answer (RelayVerifier): relay:<parent8>.
     RELAY_PREFIX = "relay:"
+    # A participant's review turn: review:<participant id> (chi web stamps
+    # it from the participant's token, never from the request's body).
+    REVIEW_PREFIX = "review:"
 
-    # Input a human typed: a web tab, a chi TUI, chi send, and nil (a
-    # worker's initial prompt; a web client may send none). An allowlist:
-    # delegates, plugins, reminders, context changes and any id chi doesn't
-    # know are not.
-    HUMAN_PREFIXES = [WEB_PREFIX, TUI_PREFIX].freeze
+    # Input a human typed: a web tab, a chi TUI, chi send, a participant
+    # (review:, a person or an agent they run: never automatic input), and
+    # nil (a worker's initial prompt; a web client may send none). An
+    # allowlist: delegates, plugins, reminders, context changes and any id
+    # chi doesn't know are not.
+    HUMAN_PREFIXES = [WEB_PREFIX, TUI_PREFIX, REVIEW_PREFIX].freeze
     HUMAN_IDS = [CLI_SEND].freeze
 
     # A person at a screen that shows a command's reply and can answer it
@@ -47,16 +51,17 @@ module Samagotchi
     INTERACTIVE_PREFIXES = [WEB_PREFIX, TUI_PREFIX].freeze
 
     # A turn's origin by its sender (#origin, LastTurn#origin): the ids chi
-    # runs turns for on its own, by prefix; system:reminder is "reminder",
-    # anything else "client".
+    # runs turns for on its own, by prefix, and a participant's ("review");
+    # system:reminder is "reminder", anything else "client".
     ORIGIN_PREFIXES = { DELEGATE_PREFIX => "delegate", CHILD_PREFIX => "delegate_report",
-                        CONTEXT_PREFIX => "context", TASK_PREFIX => "task" }.freeze
+                        CONTEXT_PREFIX => "context", TASK_PREFIX => "task", REVIEW_PREFIX => "review" }.freeze
 
     module_function
 
     # What sent a turn: "delegate" (a delegating parent), "delegate_report"
     # (a child's report), "context" (a context wake), "task" (a task finish
-    # wake), "reminder", else "client" (a person, chi send, a plugin, nil).
+    # wake), "review" (a participant), "reminder", else "client" (the
+    # owner, chi send, a plugin, nil).
     # @return [String]
     def origin(client_id)
       id = client_id.to_s
@@ -81,5 +86,12 @@ module Samagotchi
       id = client_id.to_s
       HUMAN_IDS.include?(id) || HUMAN_PREFIXES.any? { |prefix| id.start_with?(prefix) }
     end
+
+    # The client id a participant's turn carries (chi web's, from their
+    # grant): review:<participant id>.
+    def review(participant_id) = "#{REVIEW_PREFIX}#{participant_id}"
+
+    # Whether +client_id+ is a participant's (review:).
+    def review?(client_id) = client_id.to_s.start_with?(REVIEW_PREFIX)
   end
 end