samagotchi 0.115.0 → 0.117.0

data/lib/samagotchi/bridge.rb

@@ -19,6 +19,7 @@ require_relative "bridge/sse_writer"
 require_relative "bridge/turn_accumulator"
 require_relative "session"
 require_relative "engine"
+require_relative "system_one/log"
 require_relative "session_commands"
 require_relative "queued_command"
 require_relative "steer"
@@ -86,21 +87,36 @@ module Samagotchi
     #   one, POST /command answers 501
     # @param on_exit_request [#call, nil] a client asks the worker to exit
     #   now: takes the client_id and delete: (the exit is to delete the
-    #   session, /exit --delete), returns nil when the worker will leave or
-    #   what keeps it up (a WorkerIdleExit::Hold: #reason, #tasks, #hint);
-    #   called with the event log held. Without one, POST /exit answers 501
+    #   session, /exit --delete) or stop: ("all": stop everything the user
+    #   can stop first), returns nil when the worker will leave or
+    #   what keeps it up (a WorkerIdleExit::Hold: #reason, #tasks, #hint,
+    #   #holds); called with the event log held. Without one, POST /exit
+    #   answers 501
     # @param exit_discards [#call, nil] after an exit the worker agreed to:
     #   whether it will delete the session as empty (the 200 says
     #   +discard+); without one the reply leaves the field out
+    # @param exit_stopped [#call, nil] after a stop-all exit: what it stopped
+    #   (a HoldStop::Stopped) for the 200's +stopped+; nil leaves it out
+    # @param on_holds [#call, nil] what the user could stop in this worker
+    #   right now (WorkerIdleExit#stoppable_holds) for GET /holds; without
+    #   one that route answers 501
+    # @param on_holds_stop [#call, nil] stop every one of them (HoldStop#stop_all)
+    #   without the worker exiting, for POST /holds/stop; returns the
+    #   HoldStop::Stopped the 200's +stopped+ carries; without one that route
+    #   answers 501
     def initialize(engine:, state_dir:, session_id:, bind: DEFAULT_BIND,
                    port: 0, ring_capacity: DEFAULT_RING_CAPACITY,
                    heartbeat_interval: DEFAULT_HEARTBEAT_INTERVAL, input_format: nil, on_input: nil,
-                   on_command: nil, on_exit_request: nil, exit_discards: nil)
+                   on_command: nil, on_exit_request: nil, exit_discards: nil, exit_stopped: nil,
+                   on_holds: nil, on_holds_stop: nil)
       @engine = engine
       @on_input = on_input
       @on_command = on_command
       @on_exit_request = on_exit_request
       @exit_discards = exit_discards
+      @exit_stopped = exit_stopped
+      @on_holds = on_holds
+      @on_holds_stop = on_holds_stop
       @input_format = input_format
       @state_dir = state_dir
       @session_id = session_id
@@ -584,10 +600,13 @@ module Samagotchi
       %w[POST cancel] => :handle_cancel,
       %w[POST answer] => :handle_answer,
       %w[POST question/dismiss] => :handle_dismiss_question,
+      %w[POST guardrails/wrong] => :handle_system_one_wrong,
       %w[POST turn] => :handle_post_turn,
       %w[POST turn/dequeue] => :handle_dequeue_turn,
       %w[POST command] => :handle_command,
       %w[POST exit] => :handle_exit_request,
+      %w[GET holds] => :handle_holds,
+      %w[POST holds/stop] => :handle_holds_stop,
       %w[POST recap] => :handle_recap,
       %w[POST relay] => :handle_relay,
       %w[POST relay/status] => :handle_relay_status,
@@ -730,6 +749,30 @@ module Samagotchi
       end
     end
 
+    # POST /session/:id/guardrails/wrong {id}: append a false-allow label
+    # only for this session's System 1 auto-allow. Unknown ids are not
+    # distinguishable from judgments belonging to another session.
+    def handle_system_one_wrong(session_id, body)
+      parsed = parse_json(body)
+      return [{ "Allow" => "POST" }, 400, { error: "invalid_json" }] unless parsed.is_a?(Hash)
+
+      judgment_id = fetched(parsed, "id").to_s.strip
+      return [{ "Allow" => "POST" }, 400, { error: "missing_fields", detail: "id required" }] if judgment_id.empty?
+
+      log = SystemOne::Log.new(dir: Guardrails::Approvals.dir_for(@state_dir))
+      entry = log.entries.find do |judgment|
+        judgment["id"] == judgment_id &&
+          judgment["session_id"] == session_id &&
+          judgment["decision"] == "auto"
+      end
+      return [{}, 404, { error: "unknown_judgment" }] unless entry
+      return [{}, 200, { status: "labelled", id: judgment_id }] if entry["answer"] == "should_have_asked"
+      return [{}, 409, { error: "already_labelled" }] unless entry["answer"].nil?
+      return [{}, 500, { error: "label_failed", detail: "could not write the System 1 label" }] unless log.label(judgment_id, "should_have_asked")
+
+      [{}, 200, { status: "labelled", id: judgment_id }]
+    end
+
     # What a parent's relay may say about this session's approval
     # (BridgeClient#relay): opened and closed only change how the question
     # shows (QuestionDesk#annotate); answered makes this worker ask the
@@ -857,14 +900,21 @@ module Samagotchi
 
     # A client asks the worker to exit now (`/exit` in the attached TUI), or
     # with "restart": true to hand the session to a new worker on the newest
-    # chi installed (the "restart" feature). The worker decides with the
-    # event log held, so no POST /turn lands between its check and its
-    # answer; it leaves from its loop after this reply.
-    # 200 {status: "exiting", discard?: the session is empty and goes} ({status: "restarting"} for a restart), or 409
-    # {status: "held", reason:} naming what keeps it up (with tasks: [{id:,
-    # command:}] and a hint: how to stop them, for background_tasks). A past +deadline+
-    # (see #handle_post_turn), checked with the event log held: 408
-    # deadline_passed, the worker not asked (its client said it didn't stop).
+    # chi installed (the "restart" feature). "stop": "all" first stops every
+    # hold the user can stop; "ask": false leaves the delegate children out of
+    # the list (a UI that can't ask about them, as /archive). The worker
+    # decides with the event log held, so no POST /turn lands between its
+    # check and its answer; it leaves from its loop after this reply.
+    # 200 {status: "exiting", discard?: the session is empty and goes,
+    # stopped?: what a "stop": "all" exit stopped} ({status: "restarting"} for
+    # a restart), or 409 {status: "held", reason:} naming what keeps it up
+    # (with tasks: [{id:, command:, age_seconds:}] and a hint: how to stop
+    # them, for background_tasks). When every hold is one the user can stop,
+    # the 409 also carries holds: [{kind:, items: [{id:, label:, detail:}]}
+    # — reminders, running tasks, delegate children — for the terminal's ask.
+    # A past +deadline+ (see #handle_post_turn), checked with the event log
+    # held: 408 deadline_passed, the worker not asked (its client said it
+    # didn't stop).
     # Returns [headers, status, body].
     def handle_exit_request(session_id, body)
       return [{}, 501, { error: "exit_unavailable" }] unless @on_exit_request
@@ -875,7 +925,13 @@ module Samagotchi
       client_id = fetched(parsed, "client_id")
       delete = fetched(parsed, "delete") == true
       restart = fetched(parsed, "restart") == true
+      stop_all = fetched(parsed, "stop") == "all"
+      # A client that can ask about what still runs (an attached terminal's
+      # plain /exit) gets the delegates in the hold list; one that can't
+      # (/archive, and every worker's own last look) does not.
       options = restart ? { delete: delete, restart: true } : { delete: delete }
+      options[:stop] = true if stop_all && !restart
+      options[:ask] = false if fetched(parsed, "ask") == false
       deadline = fetched(parsed, "deadline")
       return BAD_DEADLINE unless deadline_valid?(deadline)
 
@@ -892,13 +948,57 @@ module Samagotchi
 
         body = { status: "exiting", session_id: @session_id }
         body[:discard] = @exit_discards.call == true if @exit_discards
+        stopped = @exit_stopped&.call
+        body[:stopped] = stopped.to_h if stopped
         return [{}, 200, body]
       end
 
       # A hold may name what it waits for (tasks: the background tasks a
-      # finish wake watches).
+      # finish wake watches). When every hold is one the user can stop, +holds+
+      # lists them for the terminal's ask: [{kind:, items: [{id:, label:,
+      # detail:}]} (docs/cli.md, /exit).
       [{}, 409, { status: "held", reason: hold.reason.to_s, tasks: hold.tasks, hint: hold.hint,
-                  session_id: @session_id }.compact]
+                  holds: holds_json(hold.holds), session_id: @session_id }.compact]
+    end
+
+    # The exit ask's stoppable holds as JSON; nil when there are none, so an
+    # older client sees today's plain 409.
+    def holds_json(holds)
+      return nil if holds.nil? || holds.empty?
+
+      holds.map { |hold| { kind: hold.kind.to_s, items: hold.items.map { |item| item.to_h } } }
+    end
+
+    # GET /session/:id/holds: what the user could stop in this worker right
+    # now — the same holds the exit ask's 409 carries (reminders, the watched
+    # background tasks still running, the delegate children with a live
+    # worker), whatever else keeps the worker up: chi web's Stop asks about
+    # these before it TERMs the worker, and a Stop cancels a running turn
+    # anyway, so a turn is not a reason to hide them.
+    # 200 {session_id, holds: [{kind:, items: [...]}]} (no +holds+ when there
+    # are none); 501 holds_unavailable when this worker has no such step.
+    # Returns [headers, status, body].
+    def handle_holds(_session_id, _body = nil)
+      return [{}, 501, { error: "holds_unavailable" }] unless @on_holds
+
+      [{}, 200, { session_id: @session_id, holds: holds_json(@on_holds.call) }.compact]
+    end
+
+    # POST /session/:id/holds/stop: stop everything the user can stop (HoldStop#stop_all)
+    # without the worker leaving — the reminders cleared, the watched tasks
+    # killed as task_stop does, the delegate children stopped as
+    # `chi sessions stop` does. What the user can't stop (a turn running,
+    # another UI attached) is untouched. The web's Stop's "Stop all" runs
+    # this, then stops the worker.
+    # 200 {status: "stopped", session_id, stopped: {reminders:, tasks:,
+    # delegates:}}; 501 holds_unavailable when this worker has no such step.
+    # Returns [headers, status, body].
+    def handle_holds_stop(_session_id, _body = nil)
+      return [{}, 501, { error: "holds_unavailable" }] unless @on_holds_stop
+
+      Log.info(:bridge, "holds_stop")
+      stopped = @on_holds_stop.call
+      [{}, 200, { status: "stopped", session_id: @session_id, stopped: stopped.to_h }]
     end
 
     # Queue a turn for this session through its file IPC (the worker polls

data/lib/samagotchi/bridge_client.rb

@@ -145,6 +145,13 @@ module Samagotchi
       post("question/dismiss", { id: id, deadline: deadline }, read_body: true)
     end
 
+    # POST /session/:id/guardrails/wrong: mark this session's System 1
+    # auto-allow as one it should have asked about; 404 when unknown.
+    # @return [Response]
+    def mark_system_one_wrong(judgment_id:)
+      post("guardrails/wrong", { id: judgment_id }, read_body: true)
+    end
+
     # POST /session/:id/turn/dequeue: take back a queued message (one that
     # waits for the running turn's end) before it runs. 200 {status:
     # "removed", enqueued_id, prompt}; 409 already_started (a turn took
@@ -199,10 +206,12 @@ module Samagotchi
     # error "not_found" = a worker older than the route, 408 = too late.
     # @param client_id [String] the asking UI, whose own streams don't hold
     # @return [Response]
-    def request_exit(client_id:, delete: false, restart: false)
+    def request_exit(client_id:, delete: false, restart: false, stop: false, ask: true)
       body = { client_id: client_id }
       body[:delete] = true if delete
       body[:restart] = true if restart
+      body[:stop] = "all" if stop
+      body[:ask] = false unless ask
       body[:deadline] = deadline
       post("exit", body, read_body: true)
     end
@@ -229,6 +238,16 @@ module Samagotchi
       post("tasks/stop", { task_id: task_id }, read_body: true)
     end
 
+    # POST /session/:id/holds/stop: stop everything this worker's user can
+    # stop (its reminders, the background tasks a finish wake watches that
+    # still run, its delegate children) without the worker exiting
+    # (Bridge#handle_holds_stop). 200 {status: "stopped", stopped:
+    # {reminders:, tasks:, delegates:}}; 501 for a worker without the route.
+    # @return [Response]
+    def stop_holds
+      post("holds/stop", {}, read_body: true)
+    end
+
     # How long the approval relay's calls wait for a reply: a parent's Stop
     # isn't held for READ_TIMEOUT by a child that doesn't answer.
     RELAY_TIMEOUT = 5

data/lib/samagotchi/bundles/system/manifest.yml

@@ -1,6 +1,6 @@
 ---
 name: samagotchi-system
-version: 0.115.0
+version: 0.117.0
 scope: system
 description: Default system memories — identity, self map, config modification protocol, memory guide and the delegated-session rules
 files:

data/lib/samagotchi/config.rb

@@ -173,6 +173,21 @@ module Samagotchi
       # (Guardrails::ParentPolicy): hard = deny and plain answers; standard = + spend (Continue); soft = + permit (Allow
       # once). An invalid value is hard, the strictest.
       Entry.new(key: "guardrails.parent_answers", yaml_path: %w[guardrails parent_answers], type: :enum, default: "soft", expose: %i[config], enum_values: %w[hard standard soft], invalid: "hard", lifecycle: :next_tool_or_approval),
+      # System 1 (the cheap judgment model that answers the asks a user always allows). Client and settings; in `on`
+      # mode GuardrailWiring also reads rules, threshold and min_record for the auto-allow (docs/guardrails.md).
+      # off (the default) | audit (judge every ask, log it, never decide) | on. An unknown value warns and is off.
+      Entry.new(key: "guardrails.system_one.mode",       yaml_path: %w[guardrails system_one mode],      type: :enum,    default: "off",  expose: %i[config], enum_values: %w[off audit on], lifecycle: :next_tool_or_approval),
+      # The hosts: entry serving /v1/systemone (Splash, or the hosted Jev API); unset: no judgment.
+      Entry.new(key: "guardrails.system_one.host",       yaml_path: %w[guardrails system_one host],      type: :string,  default: nil,    expose: %i[config], lifecycle: :next_tool_or_approval),
+      # The judgment model; unset: the host's first model, and no judgment if it names none.
+      Entry.new(key: "guardrails.system_one.model",      yaml_path: %w[guardrails system_one model],     type: :string,  default: nil,    expose: %i[config], lifecycle: :next_tool_or_approval),
+      # The rule ids System 1 may answer for ("a|b", or a YAML list, parsed like guardrails.small_models).
+      Entry.new(key: "guardrails.system_one.rules",      yaml_path: %w[guardrails system_one rules],      type: :string,  default: nil,    expose: %i[config], lifecycle: :next_tool_or_approval),
+      # The probability an auto-allow needs, and how many clean records a rule needs before it is trusted.
+      Entry.new(key: "guardrails.system_one.threshold",  yaml_path: %w[guardrails system_one threshold],  type: :float,   default: 0.8,   expose: %i[config], lifecycle: :next_tool_or_approval),
+      Entry.new(key: "guardrails.system_one.min_record", yaml_path: %w[guardrails system_one min_record], type: :integer, default: 5,     expose: %i[config], lifecycle: :next_tool_or_approval),
+      # How long one judgment may take, in milliseconds; a judgment that doesn't arrive asks the user.
+      Entry.new(key: "guardrails.system_one.timeout_ms", yaml_path: %w[guardrails system_one timeout_ms], type: :integer, default: 2000,  expose: %i[config], lifecycle: :next_tool_or_approval),
 
       Entry.new(key: "log.file",                 yaml_path: %w[log file],                 type: :string, default: nil,              expose: %i[env config cli], lifecycle: :process_start),
       Entry.new(key: "log.disable",              yaml_path: %w[log disable],              type: :bool,   default: false,            expose: %i[env config cli], lifecycle: :process_start),
@@ -355,6 +370,8 @@ module Samagotchi
     # What a :bool value reads as (Config.coerce!), YAML 1.1's words and 1/0.
     BOOL_WORDS = { "1" => true, "true" => true, "yes" => true, "on" => true,
                    "0" => false, "false" => false, "no" => false, "off" => false }.freeze
+    # The word an :enum takes for a boolean (an unquoted on/off is one in YAML 1.1).
+    BOOL_ENUM_WORDS = { true => "on", false => "off" }.freeze
 
     # Fast lookup maps
     BY_KEY = ENTRIES.each_with_object({}) { |e, h| h[e.key] = e }.freeze
@@ -382,8 +399,10 @@ module Samagotchi
       # +raw+ as +entry+'s type, strictly: a value of another shape raises.
       # :string as given (a YAML list joined with |), :integer, :float,
       # :bool (true/yes/on/1, false/no/off/0/""), :enum in its canonical
-      # case; nil for nil, and for a blank value of any other type than
-      # :string and :bool. #coerce is its lenient twin (config.yml, env).
+      # case (an unquoted on/off, which YAML 1.1 reads as a boolean, is the
+      # word when the entry has it); nil for nil, and for a blank value of any
+      # other type than :string and :bool. #coerce is its lenient twin
+      # (config.yml, env).
       # @raise [SessionConfig::Error] "KEY takes WHAT, not RAW"
       def coerce!(entry, raw)
         return nil if raw.nil?
@@ -399,7 +418,7 @@ module Samagotchi
                 when :integer then Integer(str, exception: false)
                 when :float then Float(str, exception: false)
                 when :bool then BOOL_WORDS[str.downcase]
-                when :enum then entry.enum_values.find { |v| v.downcase == str.downcase }
+                when :enum then enum_word(entry, raw, str)
                 else str
                 end
         raise SessionConfig::Error, "#{entry.key} takes #{takes(entry)}, not #{raw.to_s.inspect}" if value.nil?
@@ -407,6 +426,18 @@ module Samagotchi
         value
       end
 
+      # A value of +entry+'s enum, as written. YAML 1.1 reads an unquoted
+      # on/off/yes/no as a boolean, so `mode: on` reaches the enum branch as
+      # true: it is the entry's "on"/"off" when the entry has that word, and
+      # still invalid when it doesn't.
+      def enum_word(entry, raw, str)
+        found = entry.enum_values.find { |v| v.downcase == str.downcase }
+        return found if found
+
+        word = BOOL_ENUM_WORDS[raw]
+        word && entry.enum_values.include?(word) ? word : nil
+      end
+
       # What +entry+'s type takes, as a refusal names it.
       def takes(entry)
         case entry.type

data/lib/samagotchi/engine.rb

@@ -401,7 +401,12 @@ module Samagotchi
         cancelled: -> { !!active_cancel_controller&.cancelled? },
         # An approval of the model's call: :question_asked first (QuestionAsked).
         ask: ->(fields) { open_question(question_asked(QuestionAsked::KIND_APPROVAL, fields)) },
-        notify: ->(message) { guardrail_notify(message) }
+        notify: ->(message) { guardrail_notify(message) },
+        # System 1 (experimental, audit phase): the judgment client is read
+        # from config on every ask, and the running turn's cancel controller
+        # closes a judgment that is no longer wanted.
+        system_one: -> { SystemOne::Client.from_config(host_registry: @host_registry) },
+        cancel_controller: -> { active_cancel_controller }
       )
     end
     private :build_guardrail_wiring

data/lib/samagotchi/guardrail_wiring.rb

@@ -6,10 +6,13 @@ require_relative "config"
 require_relative "log"
 require_relative "guardrails"
 require_relative "guardrails/parent_approvals"
+require_relative "guardrails/parent_policy"
+require_relative "model_match"
 require_relative "memory_bundle/manifest"
 require_relative "version"
 require_relative "hooks"
 require_relative "edit_preview"
+require_relative "system_one"
 require_relative "tool_activity"
 require_relative "turn_origin"
 
@@ -38,8 +41,11 @@ module Samagotchi
     # @param ask       [#call] (fields) → the answer; the Engine's question flow
     # @param notify    [#call] (message) → shows a guardrails line in every UI
     #   (a bundle's rules kept because it needs a newer chi)
+    # @param system_one [#call] → SystemOne::Client or nil: the judgment client
+    #   (nil while `guardrails.system_one.mode` is off or no host is set)
+    # @param cancel_controller [#call] → the running turn's CancellationController, nil
     def initialize(scratch:, hooks:, tools:, session:, model_key:, cancelled:, ask:, model_name: -> {},
-                   notify: ->(_message) {})
+                   notify: ->(_message) {}, system_one: -> {}, cancel_controller: -> {})
       @scratch = scratch
       @hooks_lookup = hooks
       @tools_lookup = tools
@@ -49,6 +55,8 @@ module Samagotchi
       @cancelled_lookup = cancelled
       @ask = ask
       @notify = notify
+      @system_one = system_one
+      @cancel_controller = cancel_controller
       # Bundle name → the rules last loaded from it whole, kept while the
       # installed version needs a newer chi; [name, version] said so once.
       @loaded_bundle_rules = {}
@@ -82,6 +90,7 @@ module Samagotchi
     def state_dir=(state_dir)
       @approvals = Guardrails::Approvals.new(dir: Guardrails::Approvals.dir_for(state_dir))
       @approvals = Guardrails::Approvals::InMemory.new(@approvals) if @scratch
+      @system_one_log = nil
       @protected = nil
     end
 
@@ -259,11 +268,166 @@ module Samagotchi
       # A call on chi's own config, hooks or guardrails is the user's to
       # allow, never a parent agent's (Guardrails::ParentPolicy).
       payload[:user_only] = Guardrails::ParentApprovals.protected_facts?(payload[:approval])
-      Guardrails::Approval.settle(verdict, @ask.call(payload), payload[:approval][:scopes])
+      # System 1: the ask is judged before the user sees it, and in `on` mode
+      # one that passes every gate is allowed once without reaching them
+      # (docs/guardrails.md, "System 1").
+      judgment = system_one_judge(payload)
+      if judgment && judgment[:auto]
+        verdict.judgment = { id: judgment[:id], p: judgment[:p] }
+        verdict.settle!(:allow, decided_by: "system one")
+        verdict.scope = "once"
+        return verdict
+      end
+
+      answer = @ask.call(payload)
+      system_one_label(judgment, answer, payload)
+      Guardrails::Approval.settle(verdict, answer, payload[:approval][:scopes])
     end
 
     private
 
+    # The judgments log (SystemOne::Log), beside the approvals store; nil
+    # while there is no store dir.
+    def system_one_log
+      return nil if @approvals.nil?
+
+      @system_one_log ||= SystemOne::Log.new(dir: File.dirname(@approvals.path))
+    end
+
+    # System 1's judgment of an ask, written to the log before the user is
+    # asked, with the decision it led to: "auto" (it answered for the user),
+    # "asked" (on mode, the user decides) or "audit" (audit mode). A
+    # participant's review turn is never judged, and no client (mode off, no
+    # host) means no line at all. A judgment that fails is logged with p nil,
+    # so the failures are in the log too.
+    # @return [Hash, nil] {id:, p:, auto:}, nil when nothing was written
+    def system_one_judge(payload)
+      return nil if Steer.participant_author?(turn_author)
+
+      client = @system_one.call
+      log = system_one_log
+      return nil if client.nil? || log.nil?
+
+      approval = payload[:approval]
+      # The judgments log is read once for this ask: the state's examples and
+      # the record gate both use these entries. The judgment of the ask being
+      # judged is written after it, so the examples are always earlier asks.
+      entries = log.entries
+      started = Process.clock_gettime(Process::CLOCK_MONOTONIC)
+      answers = begin
+        client.ask(state: SystemOne::ApprovalQuestion.state(approval, session_title: @session_lookup.call&.title,
+                                                            entries: entries),
+                   questions: { SystemOne::ApprovalQuestion::ID => SystemOne::ApprovalQuestion.question },
+                   cancel_controller: @cancel_controller.call)
+      rescue StandardError => e
+        # The client already turns every failure it knows into a nil; this is
+        # the unexpected one. Either way the ask goes to the user.
+        Samagotchi::Log.warn(:guardrails, "system_one_ask_failed", error: "#{e.class}: #{e.message}")
+        nil
+      end
+      latency_ms = ((Process.clock_gettime(Process::CLOCK_MONOTONIC) - started) * 1000).round
+      p = answers && answers[SystemOne::ApprovalQuestion::ID]&.noul
+      auto = system_one_auto_allow?(client, approval, p, entries)
+      decision = system_one_decision(client, auto)
+
+      id = log.judgment(session_id: @session_lookup.call&.id,
+                        rule: approval[:rule], source: approval[:source], tool: approval[:tool],
+                        **SystemOne::ApprovalQuestion.call_fields(approval),
+                        repo_name: approval[:repo_name],
+                        p: p, threshold: Config.get("guardrails.system_one.threshold"), model: client.model,
+                        latency_ms: latency_ms, decision: decision, origin: "live")
+      # A judgment the log cannot hold is no judgment: the user is asked.
+      { id: id, p: p, auto: auto && !id.nil? }
+    rescue StandardError => e
+      # The approval never fails because of System 1.
+      Samagotchi::Log.warn(:guardrails, "system_one_judgment_failed", error: "#{e.class}: #{e.message}")
+      nil
+    end
+
+    # What the judgment line says it did: "auto" (System 1 answered for the
+    # user), "asked" (on mode, the user decides), "audit" (nothing decided).
+    def system_one_decision(client, auto)
+      return "auto" if auto
+
+      client.mode == "on" ? "asked" : "audit"
+    end
+
+    # Every gate an auto-allow must pass, in order: the mode, the rule the
+    # user opted in, the never-list and chi's own files, the probability, and
+    # the rule's record. Any one that fails leaves the ask to the user. The
+    # entries are the judgment log read once for this ask.
+    # @param entries [Array<Hash>] SystemOne::Log#entries
+    def system_one_auto_allow?(client, approval, p, entries)
+      return false unless client.mode == "on"
+
+      rule = approval[:rule].to_s
+      return false if rule.empty?
+      return false unless system_one_rules.include?(rule)
+      return false if SystemOne::SelfProtect.refuse?(approval)
+
+      threshold = Config.get("guardrails.system_one.threshold").to_f
+      return false if p.nil? || p.to_f < threshold
+
+      min_record = Config.get("guardrails.system_one.min_record").to_i
+      SystemOne::Record.new(entries, rule: rule).qualifies?(threshold: threshold, min_record: min_record)
+    rescue StandardError => e
+      Samagotchi::Log.warn(:guardrails, "system_one_gate_failed", error: "#{e.class}: #{e.message}")
+      false
+    end
+
+    # guardrails.system_one.rules: a "|"-separated string or a YAML list,
+    # read with the same grammar as guardrails.small_models.
+    def system_one_rules
+      ModelMatch.parse(Config.get("guardrails.system_one.rules"))
+    rescue StandardError
+      []
+    end
+
+    # The user's answer to that ask, as a label on the judgment: the scope
+    # they took, a denial, or none for an ask that was cancelled. A parent
+    # agent's answer is not the user's: its allow labels nothing, and its
+    # deny is a label only where the parent could have allowed — a parent
+    # that was not allowed to permit says nothing about what the user would
+    # have done (docs/guardrails.md, "System 1").
+    def system_one_label(judgment, answer, payload)
+      id = judgment && judgment[:id]
+      return nil if id.nil?
+
+      scopes = Array(payload[:approval][:scopes])
+      if !answer.is_a?(Samagotchi::QuestionAnswer)
+        label = "none"
+      elsif answer.parent_agent?
+        return nil if parent_allowed?(answer, scopes) || !parent_may_permit?(payload)
+
+        label = "deny"
+      else
+        index = answer.selected_indices.first
+        label = if index && index < scopes.size
+                  scopes[index] == "once" ? "allow_once" : "allow_wide"
+                else
+                  "deny"
+                end
+      end
+      system_one_log.label(id, label)
+    rescue StandardError => e
+      Samagotchi::Log.warn(:guardrails, "system_one_label_failed", error: "#{e.class}: #{e.message}")
+      nil
+    end
+
+    # Whether a parent's answer picked one of the offered scopes.
+    def parent_allowed?(answer, scopes)
+      index = answer.selected_indices.first
+      !index.nil? && index < scopes.size
+    end
+
+    # Whether this session's parent level lets a parent allow a call at all,
+    # and the ask is not one only the user may answer.
+    def parent_may_permit?(payload)
+      return false if payload[:user_only]
+
+      Guardrails::ParentPolicy.for_session(@session_lookup.call).allow?("permit")
+    end
+
     # The work tree top of the session's working_directory (the folder
     # itself outside a repo, or when it's gone); never Dir.pwd, which is
     # the waker's cwd for a worker whose folder is gone.

data/lib/samagotchi/guardrails/approval.rb

@@ -51,6 +51,9 @@ module Samagotchi
             paths: targets && !targets.paths.empty? ? targets.paths : nil,
             # No command or path (an MCP tool): its arguments, as the question.
             args: args_for_card(targets),
+            # A memory_write ask, in words: the entry, its scope, and for a
+            # removal the description its index line carries.
+            memory: memory_for_card(targets),
             cwd: targets&.cwd,
             repo_root: targets&.repo_root,
             # The repository's name (a worktree's main checkout's folder).
@@ -78,6 +81,23 @@ module Samagotchi
         text.empty? ? nil : text
       end
 
+      # A memory_write ask names an entry, not a file: which one, and in which
+      # scope. For a removal the ask also carries that entry's description from
+      # its scoped index line, which is what System 1 otherwise cannot see
+      # (docs/guardrails.md, "System 1"). nil for every other tool.
+      def memory_for_card(targets)
+        entry = targets&.memory
+        return nil if entry.nil?
+
+        facts = { name: entry[:name], scope: entry[:scope] }
+        if targets.memory_remove?
+          require_relative "../memory_bundle/index_updater"
+          description = MemoryBundle::IndexUpdater.description_for(entry[:scope], entry[:name])
+          facts[:description] = description unless description.to_s.strip.empty?
+        end
+        facts
+      end
+
       # Settle +verdict+ from open_question's result.
       # @param answer [QuestionAnswer, Hash, String] the answer, or {error:} (anything else is a cancel)
       # @param scopes [Array<String>] the offered scopes, in option order

data/lib/samagotchi/guardrails/targets.rb

@@ -74,6 +74,12 @@ module Samagotchi
       attr_reader :memory_overlay
       alias memory_overlay? memory_overlay
 
+      # @return [Hash, nil] a memory_write call's entry and its scope,
+      #   {name:, scope:}: which memory the ask is about, in words rather than
+      #   as the file it names (#paths); nil for another tool or a call the
+      #   tool would refuse
+      attr_reader :memory
+
       # @param call [Hash] the parsed tool call
       # @param context [Context]
       # @param model_key [String, nil] for a memory_write model overlay, and
@@ -114,9 +120,10 @@ module Samagotchi
         end
         memory_remove = tool == "memory_write" && call[:remove].to_s.strip.downcase == "true"
         memory_overlay = tool == "memory_write" && !memory_remove && call[:current_model_only].to_s.strip.downcase == "true"
+        memory = tool == "memory_write" ? memory_facts(call) : nil
         new(tool: tool, command: command, paths: paths.compact, cwd: cwd, repo_root: context.repo_root(cwd),
             repo: context.repo(cwd), args: args, acts_as: acts_as, label: label, memory_remove: memory_remove,
-            memory_overlay: memory_overlay,
+            memory_overlay: memory_overlay, memory: memory,
             model_name: model_name, model_key: model_key, session_root: context.repo_root(base) || base,
             chi_dirs: -> { chi_dirs(context, base) })
       end
@@ -224,14 +231,28 @@ module Samagotchi
         nil
       end
 
+      # The memory a memory_write call is about, in the words the ask needs:
+      # the entry and its scope, not its file; nil for a call the tool would
+      # refuse (no entry, no scope, a scope chi has no folder for).
+      def self.memory_facts(call)
+        entry = call[:path].to_s.strip
+        scope = Tools::MemoryRead.normalize_scope(call[:scope])
+        return nil if entry.empty? || scope.nil?
+
+        { name: entry, scope: scope }
+      rescue StandardError
+        nil
+      end
+
       # @param chi_dirs [#call, nil] → the dirs touches_chi? looks for
       def initialize(tool:, command:, paths:, cwd:, repo_root:, repo: nil, args: nil, acts_as: nil, label: nil,
                      model_name: nil, model_key: nil, session_root: nil, chi_dirs: nil, memory_remove: false,
-                     memory_overlay: false)
+                     memory_overlay: false, memory: nil)
         @acts_as = acts_as
         @label = label
         @memory_remove = memory_remove
         @memory_overlay = memory_overlay
+        @memory = memory
         @repo = repo
         @chi_dirs = chi_dirs
         @session_root = session_root || repo_root || cwd