samagotchi 0.115.0 → 0.116.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 1829b38f073eadf8af34d8b4955f4d69d0e6aa1983acdf5e26a99daef4b629a4
-  data.tar.gz: 19ee9838f04a908813a8dee016cea758acaa3ac78fb0df3902b0941ff222500a
+  metadata.gz: 2e86ef8d1890939908a44f84be426b6132992e9483af840e9438ad2d59829da9
+  data.tar.gz: adce5380c4f88f152c7aab62c26176d38b6ee6f1e268abe24b7d4b8850c1bb4e
 SHA512:
-  metadata.gz: 4d4e59ca58dc0dcfc0ebe16a033fee3e32f6eda731181ec093f554b53393f9fae2d4ca3bcf33c8b0ea9d0f204abaf4be22c416b3788c43d0eeb8b19730cb29bf
-  data.tar.gz: f26d79c70cb60d2febde92c114ade0cb01ef975c05b05602bf975779481147a13e0e8832bf46b8ec3730f6c12800d3ff4541669a925605b5b98372b106d4213b
+  metadata.gz: c794e9f67ee56a67ec85fa0ec801919d3d0917b62b477491b12ca6475d0678402833b1191d973f791edfb7345c0cbee16509ecb8dcf3be1a5345ead097dfeb0a
+  data.tar.gz: 7d3da8e7edf45917785b14bf521eaee4559a829c631570a0336a4fcce00953b62a46a7e8f28ae4ffcb8130bae6b42b944e0783b8dbde35f918489a4504937ee8

data/CHANGELOG.md

@@ -8,6 +8,57 @@ and commands may change between minor versions. How releases are made:
 
 ## [Unreleased]
 
+## [0.116.0] - 2026-10-25
+
+### Added
+
+- System 1's judgment now sees more of the ask it is given: its state carries up to five of the user's **earlier
+  answered asks** that look like this one (`SystemOne::Similar` — same rule and repository first, then the same rule,
+  then the ask whose logged call shares the most words with this one, ties newest first), and a `memory_write` ask
+  names the entry and its scope instead of only a path, with that entry's index description for a removal — the
+  `memory-remove` ask was scoring flat because the judge could not tell which memory was going. The judgments log is
+  read once per ask, shared by the examples and the record gate. See
+  [Guardrails](docs/guardrails.md#system-1-experimental).
+- `/guardrails wrong [N]` appends a `should_have_asked` label to this session's Nth newest unlabelled
+  System 1 auto-allow (default 1), so its rule asks again until its record is rebuilt.
+- `/guardrails` shows this session's recent System 1 auto-allows and each rule's record summary when System 1
+  is enabled or has judgments.
+- chi web's owner can flag an auto-allowed tool row as **should have asked**; the worker appends the label only
+  for a judgment belonging to that session, and participants cannot reach the route; a flagged row stays marked
+  after a reload.
+- System 1's auto-allowed calls are marked on their tool row in the terminal (` · auto-allowed (System 1, p=0.97)`) and
+  the web (an `auto-allowed · System 1` label, its rule and p on hover).
+- **System 1 (experimental)**: `Samagotchi::SystemOne` talks the TypeSafe judgment API (`POST <host>/v1/systemone`) for
+  the questions a guardrail ask would ask, with the new `guardrails.system_one.*` settings (`mode`, `host`, `model`,
+  `rules`, `threshold`, `min_record`, `timeout_ms`) and `script/system-one-probe HOST [MODEL]`, which prints each
+  question's probability and latency. In `audit` mode every approval a user is about to see is now judged
+  first and written, with the answer they gave, to `guardrails/judgments.jsonl` beside the approvals store. See
+  [Guardrails](docs/guardrails.md#system-1-experimental).
+- `chi guardrails replay [--dry-run] [--threshold T] [--model M]` runs System 1 over the approvals this machine's
+  sessions already answered — read from their `cards.json` sidecars — and writes each judgment and the user's answer
+  to `guardrails/judgments.jsonl`, so a rule's record starts with the asks the user really decided on. It prints a
+  per-rule table (asks, allowed, denied, auto at the threshold, false allows, no judgment) and skips unanswered
+  asks, relay cards and question ids a previous replay logged; a parent agent's answer is not the user's, so only
+  its deny is replayed, and only where the parent could have allowed. Exits 2 when `guardrails.system_one.mode`
+  is off or no host is set. See [Guardrails](docs/guardrails.md#seeding-the-record-chi-guardrails-replay).
+- **System 1 `on` mode answers for the user**: an ask is allowed once, without a question, when its rule is in
+  `guardrails.system_one.rules`, the judgment's probability is at `guardrails.system_one.threshold` (0.8 now, was
+  0.95), and that rule's record is clean — `guardrails.system_one.min_record` (5) asks at the threshold the user
+  allowed, and no false allow among its last 20 labelled asks. Calls that write chi's own config.yml, hooks,
+  installed bundles or the guardrails store are never auto-allowed, nor `chi-answer-piped`, `chi-answer-http` or
+  `chi-broadcast`; memory files are fair game. Nothing is stored in `approvals.json`, no card is opened and no
+  notification is sent, so the auto-allowed tool row is its only trace. See
+  [Guardrails](docs/guardrails.md#answering-for-the-user-on-mode).
+
+### Changed
+
+- chi web's composer grip hides the message box with a click as well as a drag: a click on the expanded grip folds it
+  250 ms after the press, so a second click inside that window is a double-click and resets the height instead (a
+  drag, Enter or Space still act at once). A fold no longer forgets the height the grip set (`chi_composer_floor`):
+  the box opens again at the height it had, and only a double-click forgets it. See [Sessions](docs/sessions.md).
+- chi's icon (the browser tab and the Home Screen app) is a deeper blue to purple, so the white χ stands out on any
+  wallpaper. On a phone, remove the Home Screen app and add it again to see it: iOS keeps the old icon.
+
 ## [0.115.0] - 2026-10-25
 
 ### Changed
@@ -4354,7 +4405,8 @@ and long-lived sessions.
 - A macOS desktop helper (`chi desktop install`): a "Send to chi" Service and a
   hotkey panel that send selected text or the clipboard to your sessions.
 
-[Unreleased]: https://github.com/dm1try/samagotchi/compare/v0.115.0...HEAD
+[Unreleased]: https://github.com/dm1try/samagotchi/compare/v0.116.0...HEAD
+[0.116.0]: https://github.com/dm1try/samagotchi/compare/v0.115.0...v0.116.0
 [0.115.0]: https://github.com/dm1try/samagotchi/compare/v0.114.0...v0.115.0
 [0.114.0]: https://github.com/dm1try/samagotchi/compare/v0.113.0...v0.114.0
 [0.113.0]: https://github.com/dm1try/samagotchi/compare/v0.112.0...v0.113.0

data/bin/chi

@@ -68,6 +68,8 @@ SUBCOMMANDS = {
   "memory" => ["samagotchi/memory_command", "MemoryCommand"],
   # install, upgrade, uninstall, status, diff, list, build (--scope, --force, …)
   "bundle" => ["samagotchi/bundle_command", "BundleCommand"],
+  # the System 1 record: replay the asks this machine's sessions already answered
+  "guardrails" => ["samagotchi/guardrails_command", "GuardrailsCommand"],
   # other machines' chi web, for chi --remote NAME (add, ls, rm)
   "remote" => ["samagotchi/remote_command", "RemoteCommand"]
 }.freeze

data/docs/cli.md

@@ -36,6 +36,8 @@
 - `chi update [--dry-run] [--no-gem] [--no-bundles] [--no-desktop]` — update an installed chi: the gem, the system bundle, the shipped bundles you installed and the desktop helper, in one table (see [Updating](#updating))
 - `chi bundle install|upgrade|uninstall|status|diff|list|build|trash|new|test|check` — manage memory bundles (see [Bundle hooks](hooks.md#bundle-hooks-unified-workflow-bundle)); `list` shows the installed ones and the ones shipped with chi, which `install <name>` installs; `core` and `dev` are profiles that install a set of them (see [Bundle profiles](memory.md#bundle-profiles-core-and-dev),  [Guardrails](guardrails.md), [Plugins](plugins.md#the-btw-bundle), [the mcp bundle](plugins.md#the-mcp-bundle) [the loop-guard bundle](plugins.md#the-loop-guard-bundle), [the check-in bundle](plugins.md#the-check-in-bundle) and [the skills bundle](plugins.md#the-skills-bundle)). `trash` lists and empties the bundle trash (moved files from uninstalls/upgrades). A usage error (an unknown subcommand or flag, a missing argument, a bad `build --scope`) exits 2, as for the other subcommands. Plain `chi` and `chi web` exit 1 on an unknown flag, a flag missing its value or a stray argument. `new`, `test` and `check` are for writing one: see [Writing a bundle](#writing-a-bundle-new-test-check)
 
+- `chi guardrails replay [--dry-run] [--threshold T] [--model M]` — seed System 1's record from the approvals this machine's sessions already answered: each ask is judged by the configured model and written to `guardrails/judgments.jsonl` with the answer the user gave, then a per-rule table prints (asks, allowed, denied, would-be auto-allows, false allows, asks with no judgment). A parent agent's answer is not the user's: only its deny is replayed, and only where the parent could have allowed. `--dry-run` judges without writing, `--threshold` overrides `guardrails.system_one.threshold` for the table, `--model` the configured model for this run. Exit 2 when `guardrails.system_one.mode` is off or no `host` is set; a usage error exits 2 (see [System 1](guardrails.md#system-1-experimental))
+
 - `chi bundle try PATH -p TEXT [options]` — install a bundle in a temporary, filtered sandbox, run one real model turn,
   and print its trace (see [Trying a bundle](#trying-a-bundle)).
 
@@ -1428,7 +1430,9 @@ In interactive assist mode, you can switch the request model without restarting:
 - `/model <name> --alias <alias>`: create alias for current effective model (alias value may be bare or `host:model`).
 - `/model`: show the effective model (and default when diverged: `runtime model: <effective> (default: <default>, profile=<name>, <source>)`, e.g. `profile=qwen36, server (chat_template)`). When the session's prompt carries model notes the line ends with `; notes: model_notes_deepseek (system, 612 chars)`; a switch's `runtime model set to …` names the new model's ([Memory](memory.md#model-notes)).
 - `/model clear` (or `default`/`none`/`off`): clear the session override, reverting to the configured default.
-- `/guardrails`: the guardrail rules (by source), what failed to load, and your stored approvals, numbered; `/guardrails revoke N` removes approval N (see [Guardrails](guardrails.md)).
+- `/guardrails`: the guardrail rules (by source), what failed to load, your stored approvals, and System 1's
+  recent auto-allows; `/guardrails revoke N` removes approval N and `/guardrails wrong [N]` flags an auto-allow
+  this session should have been asked about (see [Guardrails](guardrails.md)).
 - `/models`: list model ids aggregated across all `hosts:` (an alias shows next to its id: a bare alias on every host listing the id, a `host:model` one only under its host; grouped `host (host:port):` with per-host `unreachable` warnings, e.g. an unset `api_key_env`; lists cached 60s, 10 minutes for a remote host; lazy — no startup prefill). Ids the host declares under `hosts.<name>.models` come first, as `rr/x (config)`, and don't count toward the cap; an unreachable host keeps them, under its warning, as `rr/x (config, host down)`. At most 20 ids per host, then `… and N more`; `/models <text>` lists every id containing `<text>` (any case), e.g. `/models qwen` on OpenRouter.
 
 Notes:

data/docs/configuration.md

@@ -1886,6 +1886,13 @@ column says so, a `--kebab-name` flag. The maps (`hosts:`, `models:`,
 | `guardrails.mode` | `auto` | | Which rules vote: `auto` leaves out the rules tagged `modes: [strict]` (in the guardrails bundle: `git rebase`, writes and git outside the session's repo); `strict` runs them all. An unknown value warns and is `auto`. config.yml only. See [Guardrails](guardrails.md#modes). |
 | `guardrails.small_models` | `auto` | | Which models get the `models: small` rules: `auto` (32B or less by the size in the name, an MoE's active size), a list of globs, or `[]`. config.yml only. See [Guardrails](guardrails.md#rules-for-some-models). |
 | `guardrails.parent_answers` | `soft` | | Which options a parent agent (`chi answer`) may pick on a session's question, by their effect: `hard` (a deny, a Stop, a plain answer), `standard` (+ Continue and other spending options), `soft` (+ "Allow once"); never a wider scope or an allow on chi's own config. An invalid value warns and is `hard`. A session's own `parent_answers` (`chi --parent-answers`, `/parent-answers`) may only tighten it. Replaces `guardrails.parent_approvals` and `turn.parent_continue`. config.yml only: no environment variable (a parent can still pick the config dir with `XDG_CONFIG_HOME`). A convention for an honest parent, not a security boundary. See [Guardrails](guardrails.md#answers-from-a-parent-agent). |
+| `guardrails.system_one.mode` | `off` | | System 1, the cheap judgment that answers an ask before the user sees it: `off` (the default), `audit` (judge every ask, log it, never decide), `on` (also allowed to allow a call once, behind the gates in [System 1](guardrails.md#system-1)). An unknown value warns and is `off`. Experimental. config.yml only. See [Guardrails](guardrails.md#system-1). |
+| `guardrails.system_one.host` | none | | The `hosts:` entry serving `/v1/systemone` (a local Splash, or the hosted Jev API); unset: no judgment. config.yml only. |
+| `guardrails.system_one.model` | none | | The judgment model; unset uses the host's first model, and a host that names none has no judgment. config.yml only. |
+| `guardrails.system_one.rules` | none | | The rule ids System 1 may answer for in `on` mode: `"git-push|git-rebase"` or a YAML list, parsed like `guardrails.small_models`. Nothing is auto-allowed while it is unset; the `chi-answer-piped`, `chi-answer-http` and `chi-broadcast` rules never are, however they are listed. config.yml only. |
+| `guardrails.system_one.threshold` | `0.8` | | The probability an auto-allow needs. config.yml only. |
+| `guardrails.system_one.min_record` | `5` | | How many clean records a rule needs before System 1 is trusted for it: labelled asks of that rule at the threshold the user allowed. config.yml only. |
+| `guardrails.system_one.timeout_ms` | `2000` | | Milliseconds one judgment may take; a slower one is no judgment and the ask goes to the user. config.yml only. |
 | `log.file` | state dir | yes | See "Debug Log File". |
 | `log.disable` | `false` | yes | No file logging. |
 | `log.level` | `info` | yes | `debug`, `info`, `warn`, `error`. |

data/docs/guardrails.md

@@ -97,7 +97,12 @@ matches its exact folder.
 A stored approval only relaxes an ask; a deny rule is never approvable.
 A file that doesn't parse is moved aside to `approvals.json.corrupt-<UTC time>`
 with one warning, and chi starts with no stored approvals (more asks, nothing lost).
-`/guardrails` lists the rules and approvals; `/guardrails revoke N` removes one.
+`/guardrails` lists the rules and approvals; `/guardrails revoke N` removes
+approval N. When System 1 is enabled or has judgments, it also shows this
+session's recent auto-allows and each rule's record summary. In System 1 `on`
+mode, `/guardrails wrong [N]` flags the Nth newest auto-allowed call in this
+session as one System 1 should have asked about (default 1). The flag is
+appended to the judgments log; the rule asks again until its record is rebuilt.
 The file tools can't write the store.
 
 ### Answers from a parent agent
@@ -613,6 +618,188 @@ A rule in config.yml that uses a key this chi doesn't know yet (`modes:`,
 that doesn't parse denies every tool call (see Failing closed). Bundles say
 which chi they need (`requires_chi`), so their rules don't hit this.
 
+## System 1 (experimental)
+
+System 1 is a cheap classifier that judges an approval — "would the user
+allow this?" — before it reaches them, so the asks they always allow stop
+reaching them. With `mode: audit` every ask a person is about to see is
+judged and logged and **nothing about the ask changes**: the user is asked
+exactly as they would have been, and their answer is what settles the call.
+With `mode: on` an ask that passes every gate is allowed **once** without
+reaching them — see [Answering for the user](#answering-for-the-user-on-mode).
+
+`Samagotchi::SystemOne` (lib/samagotchi/system_one/) speaks the TypeSafe
+"System One" judgment API: `POST <host>/v1/systemone` with
+`{model, state, questions}` and answers of type `noul` (a probability),
+`choice` or `score`. The host is a `hosts:` entry with `api: openai` — a
+local Splash server, or the hosted Jev API — and its key is that host's own
+`api_key_env:`.
+
+```yaml
+guardrails:
+  system_one:
+    mode: off                # off (default) | audit (judge, log, never decide) | on
+    host: splash             # the hosts: entry serving /v1/systemone
+    model: Qwen3.8-Flash-Next-GSQ-RCO-GGUF:Q2_0   # else the host's first model
+    rules: [git-push, git-rebase]                  # the rule ids it may answer for
+    threshold: 0.8           # the probability an auto-allow needs
+    min_record: 5            # clean records a rule needs before it is trusted
+    timeout_ms: 2000         # a slower judgment is no judgment
+```
+
+`SystemOne::Client.from_config(host_registry: ...)` reads these on every
+call, so a config.yml change takes effect on the next ask. `mode: off` (the
+default) or no `host` means there is no client at all. Anything else is no
+judgment and one `Log.warn(:guardrails, "system_one_failed", …)`: an
+unreachable host, a host that isn't `api: openai`, a status other than 200,
+a body that isn't JSON, a question with no answer, a request longer than
+`timeout_ms`. A nil means "ask the user", which is what the caller would
+have done anyway.
+
+### What the audit writes
+
+With a client, `GuardrailWiring#request_approval` asks System 1 one `noul`
+question, `allow`, before the user is asked. Its instruction is a constant
+in code (`SystemOne::ApprovalQuestion::INSTRUCTIONS`), reviewed like a
+prompt; the state is the ask's own facts — the rule and its source, the
+reason, the tool, the command (or the paths) cut to 2000 characters, the
+edit's diff, the cwd, the repo and branch, and the session's title when it
+has one. A memory ask also names what it is about: the entry and its scope,
+and for a removal the description that entry's index line carries
+(`Targets#memory`, read into the card by `Guardrails::Approval`): a path
+alone tells the judge too little. The state then carries up to five of the
+user's **earlier asks they answered** (`SystemOne::Similar`) — this rule in
+this repository first, then this rule anywhere, then any answered ask, ranked
+by how many words the logged call shares with this one, ties going to the
+newest. Reading the log is best-effort, so a log that cannot be read simply
+offers no examples. A participant's review turn is never judged: there is no
+user there to ask. The judgment runs before the card appears, so an ask is
+slower by up to `timeout_ms` (2000 ms by default).
+
+Each judgment is a line in `judgments.jsonl`, beside `approvals.json` in
+`$XDG_STATE_HOME/samagotchi/guardrails/` (`SystemOne::Log`): 0600, appended
+under an exclusive `flock` (several workers write it), and rewritten —
+keeping the newest half of its lines — once it passes 5 MB. A line is never
+rewritten to add its label:
+
+```json
+{"kind":"judgment","id":"…","at":"…","session_id":"…","rule":"git-push","source":"config","tool":"execute","call":"git push origin main","call_digest":"<sha256 of the whole call>","repo_name":"samagotchi","p":0.97,"threshold":0.8,"model":"Qwen3.8-Flash","latency_ms":180,"decision":"audit","origin":"live"}
+{"kind":"label","id":"…","at":"…","answer":"allow_once"}
+```
+
+`decision` is what the judgment led to: `audit` (audit mode), `asked` (on
+mode, the user was asked), `auto` (on mode, System 1 answered for the user).
+A judgment that never arrived is logged too, with `p` null, so the failures
+count as well. The label line, keyed by the judgment's id, is what the user
+did: `allow_once`, `allow_wide` (any scope wider than once), `deny`, or
+`none` for an ask that was cancelled. **A parent agent's answer is not the
+user's: its allow labels nothing. Its deny is a label only where the parent
+could have allowed instead** — the ask is not `user_only` and the session's
+parent level permits a permit (`Guardrails::ParentPolicy`); a parent that was
+not allowed to allow says nothing about what the user would have done. An
+auto-allow has no label at all, since nobody was asked.
+`SystemOne::Log#entries` reads the file and returns the judgments joined with
+their last label.
+
+Everything about the log is best-effort: a write that fails is one
+`Log.warn(:guardrails, "system_one_log_failed", …)` and the approval goes on
+as if System 1 were not there.
+
+`ruby script/system-one-probe HOST [MODEL]` asks three fixed approval-like
+questions through the client and prints each probability and the latency of
+the call — how a host is checked before any of this is turned on.
+
+### Answering for the user: `on` mode
+
+In `on` mode an ask is allowed **once**, without reaching the user, when every
+gate below passes, in this order:
+
+1. the mode is `on` (in `audit` the judgment decides nothing);
+2. the ask's rule is in `guardrails.system_one.rules` — `"git-push|git-rebase"`
+   or a YAML list, read like `guardrails.small_models`. Nothing is auto-allowed
+   by default: the user names the rules they want;
+3. the rule is not one of the three that let an agent answer chi's own
+   questions — `chi-answer-piped`, `chi-answer-http`, `chi-broadcast` — which
+   are never auto-allowed, even when listed
+   (`SystemOne::SelfProtect::NEVER_AUTO`);
+4. the call does not change chi itself (`SystemOne::SelfProtect.refuse?`): no
+   edit or write whose paths include config.yml in chi's config dir, anything
+   under the hooks dir, the installed bundles dir or the guardrails store (where
+   `approvals.json` and `judgments.jsonl` live), and no `execute` or
+   `task_create` command naming any of them — the `~/.config/samagotchi`
+   spelling counts too. The memories dir is deliberately not one of these:
+   reading or appending a memory file can be auto-allowed. A protected rule
+   (`Verdict::PROTECTED_RULES`) may be listed by name and System 1 may answer
+   it, but a call that really writes config.yml or the hooks is refused here;
+5. the judgment's `p` is at least `guardrails.system_one.threshold` (0.8);
+6. the rule's record is clean (`SystemOne::Record`, read from the log once per
+   ask): at least `guardrails.system_one.min_record` (5) of its asks judged at
+   or above the threshold that the user allowed, and none of its **last 20
+   labelled** asks judged at the threshold that the user denied or later
+   flagged as one System 1 should have asked about. Asks with no label, no
+   probability, or a `none` label count for neither side.
+
+Then the judgment's `decision` is `auto`, the verdict settles as
+`settle!(:allow, decided_by: "system one")` with scope `once`, and nothing is
+written to `approvals.json` — the next call is judged again. **No question is
+opened, so no card appears, no `:question_asked` hook fires, and no
+notification is sent.** The verdict's activity carries
+`note: "auto-allowed by System 1 (p=0.97)"`, `judgment_id` and `p`; the line
+that shows it in the terminal and the web is P3b, and is not rendered yet, so
+today an auto-allowed call simply looks like a call that never needed
+approval. If the judgment line cannot be written to the log, the ask goes to
+the user.
+
+A delegate child answers from its own session's settings: its System 1 can
+auto-allow a call even when the child's `parent_answers: hard` bars a parent
+from allowing it — the record gate is about the rule, not about who answers.
+
+To correct an auto-allow after the fact, run `/guardrails` to see this
+session's recent unlabelled auto-allows, newest first, then
+`/guardrails wrong [N]` to label one. In chi web, the owner can instead click
+**should have asked** on that tool row; participants cannot use that route.
+The label is appended, not written over the judgment. `should_have_asked`
+makes the rule's record fail the false-allow check, so the rule asks again
+until enough later clean asks rebuild its record.
+
+### Seeding the record: `chi guardrails replay`
+
+A rule's record starts empty, so `chi guardrails replay` (this machine only)
+judges the asks the sessions here already answered and writes them to the same
+log, with the user's answer as the label:
+
+```sh
+chi guardrails replay [--dry-run] [--threshold T] [--model M]
+```
+
+It reads every session's sidecar, `$XDG_STATE_HOME/samagotchi/sessions/<id>/cards.json`
+(the file `Bridge::CardStore` saves), and takes the entries of type `question`
+whose `pending_question.approval` is there and that have an `answer` or were
+`cancelled`. A label is the scope the user took — `allow_once` for "Allow once",
+`allow_wide` for a wider one, `deny` for anything else, `none` for a cancelled
+ask. Skipped: a question no one answered, a relay card, which carries no
+approval of its own, and a question id a previous replay already logged — so
+running it twice adds nothing. A parent agent's answer is not the user's: its
+allow is skipped, and its deny is replayed only where the parent could have
+allowed (the card is not `user_only` and the session's parent level permits a
+permit). A cards file that doesn't parse is skipped with one warning line,
+never a failed run.
+
+Each ask is judged exactly as a live one is (`SystemOne::ApprovalQuestion`),
+and written as a `judgment` line with `decision` and `origin` both `replay`,
+its `question_id` and the card's `created_at` as `asked_at`, followed by its
+label. Then a table, one row per rule sorted by how many asks it had, and a
+total: the asks, how many the user allowed, denied, how many at the threshold
+System 1 would have auto-allowed, how many of those the user denied (the false
+allows), and how many got no judgment. `--threshold` overrides
+`guardrails.system_one.threshold` for the table; `--model` overrides the model
+for this run; `--dry-run` judges and prints without writing a line. Without a
+client (`mode: off`, or no `host`) it exits 2 saying what to set.
+
+Two limits on what the replay can see: `CardStore` keeps only the last 20
+questions per session, and a `--no-shared` REPL session never writes a
+`cards.json` at all, so its asks are not replayable.
+
 ## The guardrails bundle
 
 ```sh

data/docs/sessions.md

@@ -94,7 +94,7 @@ chi sessions clean --dry-run --days 7            # test sessions older than 7 da
 - Web notifications: when a session needs you while the tab is hidden or behind another window (a question or a guardrail approval, a plugin card with buttons during a turn such as check-in's, a failed turn, a turn done after 10 s or more; a delegated session only for its questions, a canceled turn never), the page title counts it, `(N) Chi`, until you come back to the tab. The bell at the right of the top bar also turns on OS notifications ("needs an answer", "needs approval", "needs you", "turn failed", "done in 42 s", under the session's first message; a click opens the session): its first click asks the browser for the permission, and the choice is kept per browser. Any session of the page's scope counts, not only the open one. What was already so when the page loaded never counts, and several chi tabs show one notification per event. A chi tab in front tells the others (a `BroadcastChannel`), so while you look at one, the ones behind neither notify nor count what it shows; coming back to a tab clears those events in the other tabs' titles too. The hub's `session` frames carry what this needs: `pending_question` (`{id, kind}`, kind `question` or `approval`), `pending_card` (`{id, bundle}`: the running turn's card with actions, from `pending_card.json` that the worker keeps in the session's folder while one is open; a card without actions, such as loop-guard's, never counts) and `last_turn` (`{outcome, ended_at, seconds, origin}`, saved in the session's JSON as the engine ends each turn).
 - The web frontend is a zero-build ES-module stack in `lib/samagotchi/web/public/`: `data.js` (retrieval, typed SSE `openStream` for a session and `openEvents` for the session list), `sessions_list.js` (the list as a pure reducer over `GET /api/events`: a snapshot replaces it, an upsert keeps a known card in place, a removal drops it; `families()` groups delegates under their parent), `families_view.js` (a parent's family chip, its rows and the strip's popover; the chip and rows as lit-html templates), `keep_focus.js` (lit reuses a list's nodes by position: a redraw keeps the focus on the same item by its `data-id` / `data-name`), `chains.js` (session chains: the links from `continues`, the cards folded into the latest link's, its `#N` chip and rows as lit-html templates, the info bar's ← → links, a refused continue, and the fresh-link rule), `notify.js` (which of those events needs the user, for the notifications), `app.js` (presentation/state; a session with no live stream gets one when its `session` event says `bridge_up`, after one re-read: `event_seq` starts over in each worker, so a dropped stream is never resumed with its old cursor), `bubbles.js` (the history's bubbles between the turns' rows: output chunks, end lines, every client's prompt bubbles by `enqueued_id` with their queued/steered badges, the idle recap, guardrail warnings, hooks' notices, plugins' steers, command and note bubbles; lit-html templates, put in the history with the sticky follow by `createBubbles`), `cards_place.js` (where plugin cards and a snapshot's notices go in the history: a card added or updated in place by its id, a running turn's into its step, a snapshot's each above the first turn after it, a finished turn's notice in its step's rows and its question resolved where it was asked; a card's action buttons), `format.js` (pure formatters such as `previewOf`), `plain_line.js` (markdown out of the plain one-line places: the stage headline, a closed step's title, an answered question card's kept-reply line), `prompt_history.js` (the composer's ↑/↓ over the shared prompt history), `commands.js` (session commands: which composer lines are commands, the page's own replies, a `command_ran`'s bubble, the page's command bubbles kept across a re-read), `composer.js` (where a composer line goes, `routeComposerLine`: /cut and /queue, the start page's own replies, a session command or `!cmd`, a typo hint, else a turn; and a session command sent from the composer or a chip), `delivery_line.js` (the composer's row above the text field in a session, always there so the composer keeps its height: the key hint while idle, and the delivery line while a turn runs: where a message typed now goes in, from the step's phase, clock and size, whether "cut in now" can land, and the queue link for a worker with the `delivery` feature, as a pure `deliveryLine`, its lit-html template and `createDeliveryControl`, which ticks it and keeps a choice armed from a link; see docs/cli.md, "Typing during a turn"), `restore.js` (a failed turn's prompt handed back into this tab's composer, before or after its `/turn` ack), `lists_view.js` (the session lists: the strip and its pill, all sessions with its search, count and select mode, their cards, the family and chain popovers; the cards, tile and pill as lit-html templates, drawn as new nodes each time, and the lists' orders as pure functions), `stream_handlers.js` (the open session's stream event handlers, by event type, over the page's views and hooks; a snapshot replays through them too), `stage_view.js` (the stage view: the running turn pinned above the composer, then handed off into the history; its pure rules and texts in `stage_model.js`, its live slots (headline, now row, trail, ticks) in `stage_slots.js`, its cap and held height in `stage_frame.js`, the in-use watch that times the hand-off in `stage_watch.js`), `info_bar.js` (the session bar's info line as a lit-html template over a plain model: id, status, model, chain links, chips, ctx, speed, clock, worker badge), `info_bar_model.js` (that model and the bar's buttons' states, built from the page's session state, its list and its in-flight continues and restarts as pure functions; `app.js`'s `updateInfoBar` applies them every second while a turn runs), `session_state.js` (what the page knows about the open session: its empty state, and `sessionStateFrom`, the fields a `GET /sessions/:id` payload sets), `refs.js` (refs: a kind and a target on the element, a plugin's ref data (label, http(s) URL actions) bound in a WeakMap by `bindRef`, the targets per kind, show in turn, one delegated set of click, key and hover listeners), `ref_menu.js` (a ref's `▾` and its menu), `ref_scan.js` (the `path:line` refs in an answer's or a step's text that name a file the session's rows touched), `answer_refs.js` (the refs a plugin attached to an answer, its `display_refs`: bound to the answer's bubble, paired with its links and text, bound with `bindRef`), `markdown_place.js` (where rendered markdown and its refs go: a text as markdown HTML, its `path:line` refs, a final answer's rendering), `images.js` (image chips in the composer: paste, drop and the image button, the upload before a turn, the thumbnails and the lightbox), `composer_grip.js` (the composer's grip and fold: the drag, tap and keys, the fold per visit), `strip_grip.js` (the latest-sessions strip's grip, the composer grip's twin: hides and shows the strip), `storage.js` (the page's per-browser choices in localStorage, guarded: a choice that can't be read or written is not remembered), `unqueue.js` (the × on a message queued for after the turn: takes it back, its text into an empty composer or a toast), `toasts.js` (the page's toast stack: a timer each, sticky ones until acted on, the same text reusing its item), `toast_place.js` (where the toast sits: above the composer card, the stage and an open model panel), `dock_reserve.js` (what floats over the history: the history's bottom reserve (`--dock-h`) at the composer card's and the showing stage's height, a reader at the end kept there, and the toast's place measured for `toast_place.js`), `notice_links.js` (a hook notice line's http(s) URLs as links), `start_page.js` (the start page's model picker and its LLM context and thinking chips, a choice for the next new session only; a fresh chain link's picker and its `/model`), `session_actions.js` (Continue, Archive and its Undo, Delete and Stop, and the start page when the open session is gone), `send_turn.js` (the composer's send: a new session first on the start page, the route, the echo, the image upload, the `/turn` ack, a fast failure's restore and each error's place). Unit-tested via `npm test` (`spec/web/public/*.test.js`).
 - Selecting a session in the web UI is read-only: `GET /api/sessions/:id` never spawns a worker (it reads a live worker's snapshot when one runs, else the session file). A prompt (`POST /turn`) or a command (`POST /command`) wakes the worker, and `/stream` briefly waits for a freshly-spawned bridge before answering. A caught-up SSE reconnect holds the stream open; `reset` markers are only sent for reconnects behind the ring window, or with a cursor from another worker (event ids are `<event_seq>-<epoch>`, one epoch per worker).
-- The web session page's message box folds away for room to read. Drag the grip on its top edge (the pill that shows on hover; always on a phone) down, past the box by 32 px: the pill turns accent while releasing would hide it, and on release the box folds and the info bar stays as the page's bottom edge. The grip stays as a handle on the info bar's top edge, drawn always: pull it up (8 px opens it, and the box follows the pointer in the same gesture), click or tap it (opens it and focuses the box), or just type on the page (the key lands in the box) to bring it back; Enter or Space on the focused grip folds or opens too. A draft (text or images, which folding never clears) colours the handle with the accent, a session waiting on you with the attention colour; its tooltip says so. Stop turn moves into the info bar while it is folded. The fold is remembered per browser (`chi_composer_collapsed`), an archived session opens folded for the visit, and opening it there, like the page opening it itself (a restored line, a quote, continue →'s opener), is for that visit only, and a fold forgets the height the grip set (`chi_composer_floor`): the box reopens at one line, or at its text's height. The start page's grip only resizes.
+- The web session page's message box folds away for room to read. Drag the grip on its top edge (the pill that shows on hover; always on a phone) down, past the box by 32 px: the pill turns accent while releasing would hide it, and on release the box folds and the info bar stays as the page's bottom edge. The grip stays as a handle on the info bar's top edge, drawn always: pull it up (8 px opens it, and the box follows the pointer in the same gesture), click or tap it (opens it and focuses the box), or just type on the page (the key lands in the box) to bring it back; Enter or Space on the focused grip folds or opens too. A draft (text or images, which folding never clears) colours the handle with the accent, a session waiting on you with the attention colour; its tooltip says so. Stop turn moves into the info bar while it is folded. The fold is remembered per browser (`chi_composer_collapsed`), an archived session opens folded for the visit, and opening it there, like the page opening it itself (a restored line, a quote, continue →'s opener), is for that visit only. The fold keeps the height the grip set (`chi_composer_floor`): the box opens again at the height it had, and only a double-click on the grip forgets it. A click on the expanded grip hides the box as well: it folds 250 ms after the press, so a second click inside that window is read as a double-click and resets the height instead (a drag, Enter or Space act at once, and a drag after a click takes the wait back). The start page's grip only resizes.
 
 **Test-session hygiene:**
 

data/lib/samagotchi/bridge/turn_accumulator.rb

@@ -192,6 +192,7 @@ module Samagotchi
         activity = { tool: part[:tool], status: part[:status], params: part[:params], **title }
         activity[:action] = part[:action] if part[:action]
         activity[:no_match] = true if part[:no_match]
+        activity[:guardrail] = part[:guardrail] if part[:guardrail]
         completed = { type: :tool_call_completed, **call, output: part[:output], output_truncated: !!part[:output_truncated],
                       activity: activity }
         completed[:duration_ms] = part[:duration_ms] unless part[:duration_ms].nil?
@@ -333,6 +334,9 @@ module Samagotchi
           capped = output.length > @max_output_chars
           tool[:status] = (event.dig(:activity, :status) || "ok").to_s
           tool[:no_match] = true if event.dig(:activity, :no_match)
+          # Only System 1's auto-allow is drawn on the row (the web's label).
+          guardrail = event.dig(:activity, :guardrail)
+          tool[:guardrail] = guardrail if guardrail.is_a?(Hash) && guardrail[:decided_by] == "system one"
           tool[:output] = capped ? ToolOutputCut.preview(output, cap: @max_output_chars, tool: event[:tool]) : output.dup
           tool[:output_truncated] = capped || !!event[:output_truncated]
           tool[:images] = event[:images] if event[:images]

data/lib/samagotchi/bridge.rb

@@ -19,6 +19,7 @@ require_relative "bridge/sse_writer"
 require_relative "bridge/turn_accumulator"
 require_relative "session"
 require_relative "engine"
+require_relative "system_one/log"
 require_relative "session_commands"
 require_relative "queued_command"
 require_relative "steer"
@@ -584,6 +585,7 @@ module Samagotchi
       %w[POST cancel] => :handle_cancel,
       %w[POST answer] => :handle_answer,
       %w[POST question/dismiss] => :handle_dismiss_question,
+      %w[POST guardrails/wrong] => :handle_system_one_wrong,
       %w[POST turn] => :handle_post_turn,
       %w[POST turn/dequeue] => :handle_dequeue_turn,
       %w[POST command] => :handle_command,
@@ -730,6 +732,30 @@ module Samagotchi
       end
     end
 
+    # POST /session/:id/guardrails/wrong {id}: append a false-allow label
+    # only for this session's System 1 auto-allow. Unknown ids are not
+    # distinguishable from judgments belonging to another session.
+    def handle_system_one_wrong(session_id, body)
+      parsed = parse_json(body)
+      return [{ "Allow" => "POST" }, 400, { error: "invalid_json" }] unless parsed.is_a?(Hash)
+
+      judgment_id = fetched(parsed, "id").to_s.strip
+      return [{ "Allow" => "POST" }, 400, { error: "missing_fields", detail: "id required" }] if judgment_id.empty?
+
+      log = SystemOne::Log.new(dir: Guardrails::Approvals.dir_for(@state_dir))
+      entry = log.entries.find do |judgment|
+        judgment["id"] == judgment_id &&
+          judgment["session_id"] == session_id &&
+          judgment["decision"] == "auto"
+      end
+      return [{}, 404, { error: "unknown_judgment" }] unless entry
+      return [{}, 200, { status: "labelled", id: judgment_id }] if entry["answer"] == "should_have_asked"
+      return [{}, 409, { error: "already_labelled" }] unless entry["answer"].nil?
+      return [{}, 500, { error: "label_failed", detail: "could not write the System 1 label" }] unless log.label(judgment_id, "should_have_asked")
+
+      [{}, 200, { status: "labelled", id: judgment_id }]
+    end
+
     # What a parent's relay may say about this session's approval
     # (BridgeClient#relay): opened and closed only change how the question
     # shows (QuestionDesk#annotate); answered makes this worker ask the

data/lib/samagotchi/bridge_client.rb

@@ -145,6 +145,13 @@ module Samagotchi
       post("question/dismiss", { id: id, deadline: deadline }, read_body: true)
     end
 
+    # POST /session/:id/guardrails/wrong: mark this session's System 1
+    # auto-allow as one it should have asked about; 404 when unknown.
+    # @return [Response]
+    def mark_system_one_wrong(judgment_id:)
+      post("guardrails/wrong", { id: judgment_id }, read_body: true)
+    end
+
     # POST /session/:id/turn/dequeue: take back a queued message (one that
     # waits for the running turn's end) before it runs. 200 {status:
     # "removed", enqueued_id, prompt}; 409 already_started (a turn took

data/lib/samagotchi/bundles/system/manifest.yml

@@ -1,6 +1,6 @@
 ---
 name: samagotchi-system
-version: 0.115.0
+version: 0.116.0
 scope: system
 description: Default system memories — identity, self map, config modification protocol, memory guide and the delegated-session rules
 files:

data/lib/samagotchi/config.rb

@@ -173,6 +173,21 @@ module Samagotchi
       # (Guardrails::ParentPolicy): hard = deny and plain answers; standard = + spend (Continue); soft = + permit (Allow
       # once). An invalid value is hard, the strictest.
       Entry.new(key: "guardrails.parent_answers", yaml_path: %w[guardrails parent_answers], type: :enum, default: "soft", expose: %i[config], enum_values: %w[hard standard soft], invalid: "hard", lifecycle: :next_tool_or_approval),
+      # System 1 (the cheap judgment model that answers the asks a user always allows). Client and settings; in `on`
+      # mode GuardrailWiring also reads rules, threshold and min_record for the auto-allow (docs/guardrails.md).
+      # off (the default) | audit (judge every ask, log it, never decide) | on. An unknown value warns and is off.
+      Entry.new(key: "guardrails.system_one.mode",       yaml_path: %w[guardrails system_one mode],      type: :enum,    default: "off",  expose: %i[config], enum_values: %w[off audit on], lifecycle: :next_tool_or_approval),
+      # The hosts: entry serving /v1/systemone (Splash, or the hosted Jev API); unset: no judgment.
+      Entry.new(key: "guardrails.system_one.host",       yaml_path: %w[guardrails system_one host],      type: :string,  default: nil,    expose: %i[config], lifecycle: :next_tool_or_approval),
+      # The judgment model; unset: the host's first model, and no judgment if it names none.
+      Entry.new(key: "guardrails.system_one.model",      yaml_path: %w[guardrails system_one model],     type: :string,  default: nil,    expose: %i[config], lifecycle: :next_tool_or_approval),
+      # The rule ids System 1 may answer for ("a|b", or a YAML list, parsed like guardrails.small_models).
+      Entry.new(key: "guardrails.system_one.rules",      yaml_path: %w[guardrails system_one rules],      type: :string,  default: nil,    expose: %i[config], lifecycle: :next_tool_or_approval),
+      # The probability an auto-allow needs, and how many clean records a rule needs before it is trusted.
+      Entry.new(key: "guardrails.system_one.threshold",  yaml_path: %w[guardrails system_one threshold],  type: :float,   default: 0.8,   expose: %i[config], lifecycle: :next_tool_or_approval),
+      Entry.new(key: "guardrails.system_one.min_record", yaml_path: %w[guardrails system_one min_record], type: :integer, default: 5,     expose: %i[config], lifecycle: :next_tool_or_approval),
+      # How long one judgment may take, in milliseconds; a judgment that doesn't arrive asks the user.
+      Entry.new(key: "guardrails.system_one.timeout_ms", yaml_path: %w[guardrails system_one timeout_ms], type: :integer, default: 2000,  expose: %i[config], lifecycle: :next_tool_or_approval),
 
       Entry.new(key: "log.file",                 yaml_path: %w[log file],                 type: :string, default: nil,              expose: %i[env config cli], lifecycle: :process_start),
       Entry.new(key: "log.disable",              yaml_path: %w[log disable],              type: :bool,   default: false,            expose: %i[env config cli], lifecycle: :process_start),

data/lib/samagotchi/engine.rb

@@ -401,7 +401,12 @@ module Samagotchi
         cancelled: -> { !!active_cancel_controller&.cancelled? },
         # An approval of the model's call: :question_asked first (QuestionAsked).
         ask: ->(fields) { open_question(question_asked(QuestionAsked::KIND_APPROVAL, fields)) },
-        notify: ->(message) { guardrail_notify(message) }
+        notify: ->(message) { guardrail_notify(message) },
+        # System 1 (experimental, audit phase): the judgment client is read
+        # from config on every ask, and the running turn's cancel controller
+        # closes a judgment that is no longer wanted.
+        system_one: -> { SystemOne::Client.from_config(host_registry: @host_registry) },
+        cancel_controller: -> { active_cancel_controller }
       )
     end
     private :build_guardrail_wiring