samagotchi 0.141.0 → 0.142.0

data/lib/samagotchi/bundles/check-in/plugin.rb

@@ -26,6 +26,13 @@
 # when the session comes back (a worker's restart), before its first turn
 # or command. Another session starts from the settings.
 #
+# Each check-in also asks System 1 `check-in.progress` (docs/system-one.md),
+# off until the user sets a mode for it: the turn's prompt, the calls since
+# the last check-in and the count and elapsed time go, on a side thread, to
+# the cheap judgment model. Nothing is done with the answer: it is saved,
+# and what the user then did with the card is saved as a label on that run.
+# The card, the nudge and the notify are the same either way.
+#
 # Settings (config.yml, bundles: check-in:):
 #   after: 50          tool calls in one turn before the first check-in
 #   every: 50          then again every this many more
@@ -43,6 +50,15 @@ class Plugin
   DEFAULT_IGNORE = %w[task_wait task_get delegate_result].freeze
   LAST_TOOLS = 5
   USAGE = "usage: /checkin [on|off|<calls>|mode ask|nudge|notify|nudge|later|stop]"
+  # The audit judgment (docs/plugins.md, Judgments): one noul question per
+  # check-in, answered on a side thread and never acted on.
+  PROGRESS = "progress"
+  PROGRESS_QUESTION = "Is this turn still making progress toward what the user asked?"
+  # The calls since the last check-in, each cut as it is captured and kept
+  # together under about 4 KB (the oldest go first).
+  CALL_CHARS = 120
+  RESULT_CHARS = 200
+  CALLS_TOTAL = 4096
 
   def initialize(settings = {})
     @after = positive(settings["after"]) || 50
@@ -59,7 +75,14 @@ class Plugin
   end
 
   def register(chi)
-    chi.on(:before_turn) { |_event, ctx| before_turn(ctx) }
+    # An older chi has no judgments; the check-in itself is the same there.
+    @declared = chi.respond_to?(:judgment)
+    if @declared
+      chi.judgment PROGRESS, questions: { PROGRESS => { type: "noul", instructions: PROGRESS_QUESTION } },
+                             shared_host: :skip
+    end
+
+    chi.on(:before_turn) { |event, ctx| before_turn(event, ctx) }
     chi.on(:after_tool_call) { |event, ctx| after_tool_call(event, ctx) }
     chi.on(:after_turn) { |event, ctx| after_turn(event, ctx) }
     chi.command "/checkin", "check on a long turn: status, on|off, <calls>, mode ask|nudge|notify, nudge, later, stop",
@@ -82,13 +105,21 @@ class Plugin
     @nudge = nil    # the card's Nudge this turn: { text:, count: }
     @checked_in = nil # the count at this turn's latest check-in
     @nudged_for = nil # the check-in (its count, :none before one) nudged
+    @prompt = nil   # the owner's prompt, for the judgment
+    @calls_since = [] # the calls since the last check-in, for the judgment
+    @calls_bytes = 0
+    @run = nil      # the latest check-in's run, for its labels
   end
 
-  def before_turn(ctx)
+  def before_turn(event, ctx)
     close_card(ctx, "The turn ended after #{calls} tool calls.")
     @mutex.synchronize do
       load_session(ctx)
       reset
+      # A continue, a wake or a reminder has no prompt of its own, and a
+      # participant's turn says nothing about the owner's: the judgment gets
+      # none then.
+      @prompt = ctx.turn_author ? nil : event[:prompt]
     end
   end
 
@@ -100,13 +131,17 @@ class Plugin
       load_session(ctx)
       @count += 1
       @tools = (@tools + [tool]).last(LAST_TOOLS)
+      note_call(event)
       next nil unless @enabled && @count >= @next_at
 
       @next_at = @count + @every
       @checked_in = @count
       [@count, @mode]
     end
-    check_in(ctx, *due) if due
+    return unless due
+
+    check_in(ctx, *due)
+    ask_progress(ctx)
   end
 
   def check_in(ctx, count, mode)
@@ -128,7 +163,7 @@ class Plugin
   end
 
   def after_turn(event, ctx)
-    return if close_card(ctx, "The turn ended after #{calls} tool calls.")
+    label(ctx, "turn_stopped", by: "turn", strength: nil) if close_card(ctx, "The turn ended after #{calls} tool calls.")
 
     nudge_not_sent(event, ctx)
   end
@@ -191,6 +226,63 @@ class Plugin
     true
   end
 
+  # --- the progress judgment (audit) ---------------------------------------
+
+  # Every counted call since the last check-in, in the words System 1 sees:
+  # the tool, what it was asked for, what it said. Cut here, so the state
+  # stays near 4 KB whatever a tool returned (docs/system-one.md: this is
+  # tool output reaching System 1, which approvals and context never send).
+  def note_call(event)
+    entry = "#{event[:tool]} #{cut(call_args(event[:call]), CALL_CHARS)} -> #{cut(event[:result] || event[:output], RESULT_CHARS)}"
+    @calls_since << entry
+    @calls_bytes += entry.bytesize
+    @calls_bytes -= @calls_since.shift.bytesize while @calls_bytes > CALLS_TOTAL && @calls_since.size > 1
+  end
+
+  def call_args(call)
+    args = call.is_a?(Hash) ? (call[:arguments] || call["arguments"] || call) : call
+    return args if args.is_a?(String)
+
+    # The tool's name is already in the entry and nil fields say nothing:
+    # the cut should keep what the call asked for.
+    args = args.compact.except(:name, "name") if args.is_a?(Hash)
+    JSON.generate(args)
+  rescue StandardError
+    args.to_s
+  end
+
+  def cut(text, limit)
+    text = text.to_s
+    text.length > limit ? "#{text[0, limit]}…" : text
+  end
+
+  # The ask, on its own thread. Nothing reads the answer: the turn and the
+  # card are what they are with the judgment off. `shared_host: :skip` (the
+  # declaration) saves the run with `asked: false` when a turn is running on
+  # the same local System 1 host, so the ask never evicts that turn's cache.
+  def ask_progress(ctx)
+    return unless @declared
+
+    state = @mutex.synchronize do
+      state = { prompt: @prompt, calls: @count, elapsed_s: (monotonic - @started).round, tools: @calls_since.dup }
+      @calls_since = []
+      @calls_bytes = 0
+      state
+    end
+    run = ctx.judge_later(PROGRESS, state: state)
+    @mutex.synchronize { @run = run }
+  end
+
+  # What the user did with the card, saved on this turn's latest check-in's
+  # run: raw words, mapped only at analysis, since a Nudge asks for a status
+  # rather than a verdict and Keep going may be habit. A run that was never
+  # saved (the judgment off, no host) labels nothing.
+  def label(ctx, value, by: "card", strength: "weak")
+    return false unless @declared
+
+    ctx.judgments.label(@mutex.synchronize { @run }, value, by: by, strength: strength)
+  end
+
   # --- /checkin --------------------------------------------------------------
 
   def command(args, ctx)
@@ -262,6 +354,7 @@ class Plugin
     end
 
     @mutex.synchronize { @nudge = { text: text, count: count } }
+    label(ctx, "nudge") if card_open?
     close_card(ctx, "Nudged the model at #{count} tool calls.")
     nil
   end
@@ -270,12 +363,14 @@ class Plugin
     at = @mutex.synchronize { @next_at }
     return "check-in: no check-in open" unless close_card(ctx, "Kept going; the next check-in is at #{at} tool calls.")
 
+    label(ctx, "keep_going")
     nil
   end
 
   def stop(ctx)
     return "check-in: no turn running" unless ctx.stop_turn("stopped from check-in")
 
+    label(ctx, "stop") if card_open?
     close_card(ctx, "Stopped the turn at #{calls} tool calls.")
     nil
   end
@@ -326,6 +421,8 @@ class Plugin
 
   def calls = @mutex.synchronize { @count }
 
+  def card_open? = @mutex.synchronize { @card_open }
+
   def message(count) = @message.gsub("{calls}", count.to_s)
 
   def elapsed

data/lib/samagotchi/bundles/core/manifest.yml

@@ -1,11 +1,11 @@
 ---
 name: core
-version: 0.4.0
+version: 0.4.1
 scope: system
 description: "Recommended safety set"
 trust_level: reviewed
 # Its members' highest floor (work-cap's: ctx.usage, raised at the release)
-requires_chi: ">= 0.100.0"
+requires_chi: ">= 0.142.0"
 includes:
 - loop-guard
 - check-in

data/lib/samagotchi/bundles/system/config_modification_protocol.md

@@ -16,9 +16,9 @@ Single registry `Samagotchi::Config` (`Config::ENTRIES` in `lib/samagotchi/confi
 - **YAML**: `nested: { param: value }` → dotted `nested.param` (lower `snake_case`, leaf keeps `_`; kebab alias `base-url` also accepted and normalized)
 - **CLI**: `--nested-param` (kebab, `_` → `-` for both section+leaf; `--nested_param` is rejected as unknown by `chi` with a "did you mean" hint)
 
-Sections forbid `_`/`-` (`SECTION_RE` `/\A[a-z0-9]+\z/`); leaves keep `snake_case` in YAML (`base_url`) and become kebab in CLI (`base-url`) via registry derivation — no generic string split, registry lookup avoids flat vs nested collision.
+Sections forbid `_`/`-` (`SECTION_RE` `/\A[a-z0-9]+\z/`), since an env or CLI name is derived from them; a config-only section (`system_one`: `expose: [:config]`, no derived name) may carry `_`. Leaves keep `snake_case` in YAML (`base_url`) and become kebab in CLI (`base-url`) via registry derivation — no generic string split, registry lookup avoids flat vs nested collision.
 
-**Universal entries** (`expose: [:env,:config,:cli]`): `default.model`, `server.host/port/open_timeout/read_timeout`, `server.first_token_timeout` (env and config only), `recap.model/base_url/host_ref/inactivity/timeout/min_user_turns/sentences`, `session.retention_days/max_count/keep_status/sweep_interval_hours/idle_exit_minutes`, `session.shared/keep_empty/max_children` (env and config only), `log.file/disable`, `status.line`, `context.status/window_tokens/chars_per_token/status_thresholds`, `memory.index_warn_tokens`, `default.max_tokens`, `max_tool_output_chars`, `retry.max/base_delay/max_delay`, `read.*`, `execute.*`, `web.port/host`, `no_interrupt`, `no_default_input` etc. (`Config::ENTRIES`; `expose` says which of env/config/cli each takes). Precedence is `CLI > ENV > file > default`.
+**Universal entries** (`expose: [:env,:config,:cli]`): `default.model`, `server.host/port/open_timeout/read_timeout`, `server.first_token_timeout` (env and config only), `recap.model/base_url/host_ref/inactivity/timeout/min_user_turns/sentences`, `session.retention_days/max_count/keep_status/sweep_interval_hours/idle_exit_minutes`, `session.shared/keep_empty/max_children` (env and config only), `log.file/disable`, `status.line`, `context.status/window_tokens/chars_per_token/status_thresholds`, `memory.index_warn_tokens/entry_warn_tokens/read_max_chars`, `default.max_tokens`, `max_tool_output_chars`, `retry.max/base_delay/max_delay`, `read.*`, `execute.*`, `web.port/host`, `no_interrupt`, `no_default_input` etc. (`Config::ENTRIES`; `expose` says which of env/config/cli each takes). Precedence is `CLI > ENV > file > default`.
 
 Example `config.yml` (new nested form, preferred):
 

data/lib/samagotchi/bundles/system/manifest.yml

@@ -1,11 +1,11 @@
 ---
 name: samagotchi-system
-version: 0.141.0
+version: 0.142.0
 scope: system
 description: Default system memories — identity, self map, config modification protocol, memory guide and the delegated-session rules
 files:
   identity.md: sha256:29c2f7df9f6c5acbc5ec17000a4490741e55e426af15ca0d81c8706edd9bd027
-  self_map.md: sha256:3253cb9ae7f09821d8fe1fed5154dd2b5e33fe0e9f096eee2af981d7d7d66f16
-  config_modification_protocol.md: sha256:ff4efccf2bdde453fc4e6741df8c18f78da78e353f6b1a5a64d0e7a631aea258
-  memory_guide.md: sha256:3b9ff779ee962f1307d56937c826d5e581923114f3f39455b779ca618b363cd7
+  self_map.md: sha256:b97087aff3621127e8519a22987a625798f88308d71c6184b68409b7f6f20570
+  config_modification_protocol.md: sha256:e6b55d8703ccce866047b412837c33ee23f34f894cd7a5b65421eee93ee844aa
+  memory_guide.md: sha256:64c3fa0703a3bdd8ae33b9e7cb341caa88a205c289d767f4877b38dfa6629fda
   delegated.md: sha256:a0d6ddcd4a8be06526d964898611775fd251cfd9d145a9d16afaccaa503597bd

data/lib/samagotchi/bundles/system/memory_guide.md

@@ -41,7 +41,7 @@ This memory teaches you (the agent) how to use Samagotchi memories — persisten
 
 **When to write:**
 - After learning a durable preference (e.g. commit style, test command, coding guideline) that the user confirmed or you observed repeatedly — ask before overwriting existing entries where appropriate.
-- Keep entries small and focused (one topic per file). Use clear filenames: `commit_preferences`, `testing_guide`, `project_conventions`.
+- Keep entries compact: `memory_read` returns a memory whole and every read pays its size. A write that takes one over `memory.entry_warn_tokens` (5000 tokens) ends with a note: tighten it when you next have a moment, but never remove or merge memories unless the user asks. Keep entries small and focused (one topic per file). Use clear filenames: `commit_preferences`, `testing_guide`, `project_conventions`.
 - Never store secrets, tokens, or transient state. Memories are shared via bundles. One exception: a skill may keep a working handoff memory (its steps say so) whose status is its description, removed when the work is done.
 
 **Placeholders:**

data/lib/samagotchi/bundles/system/self_map.md

@@ -53,7 +53,7 @@
   approvals (I see only how each was answered); see `docs/sessions.md` "Delegating".
 - Bundles extend me: memories, `hooks/*.rb`, `guardrails/*.yml`, and a `plugin.rb` that adds slash
   commands (`anytime:` ones run mid-turn), model tools (they can return images I see), hooks,
-  cards, side answers (`ask_model`), HTTP calls (`ctx.http`),
+  cards, side answers (`ask_model`), System 1 judgments (`chi.judgment`, `ctx.judge`), HTTP calls (`ctx.http`),
   child sessions and services (e.g. MCP server processes). Shipped: `btw` (`/btw` side question),
   `mcp` (MCP server tools, searched with find_tools and called with call_tool; a screenshot comes as a picture; a toolkit's undeclared built-ins too, as chi/<tool>), `guardrails` (rules), `known-names` (typo guard), `source-links`
   (turns source refs like JIRA-123 in an answer into links in the web, and a one-line note), `loop-guard`

data/lib/samagotchi/config.rb

@@ -179,17 +179,21 @@ module Samagotchi
       # mode GuardrailWiring also reads rules, threshold and min_record for the auto-allow (docs/guardrails.md).
       # off (the default) | audit (judge every ask, log it, never decide) | on. An unknown value warns and is off.
       Entry.new(key: "guardrails.system_one.mode",       yaml_path: %w[guardrails system_one mode],      type: :enum,    default: "off",  expose: %i[config], enum_values: %w[off audit on], lifecycle: :next_tool_or_approval),
-      # The hosts: entry serving /v1/systemone (Splash, or the hosted Jev API); unset: no judgment.
-      Entry.new(key: "guardrails.system_one.host",       yaml_path: %w[guardrails system_one host],      type: :string,  default: nil,    expose: %i[config], lifecycle: :next_tool_or_approval),
-      # The judgment model; unset: the host's first model, and no judgment if it names none.
-      Entry.new(key: "guardrails.system_one.model",      yaml_path: %w[guardrails system_one model],     type: :string,  default: nil,    expose: %i[config], lifecycle: :next_tool_or_approval),
       # The rule ids System 1 may answer for ("a|b", or a YAML list, parsed like guardrails.small_models).
       Entry.new(key: "guardrails.system_one.rules",      yaml_path: %w[guardrails system_one rules],      type: :string,  default: nil,    expose: %i[config], lifecycle: :next_tool_or_approval),
       # The probability an auto-allow needs, and how many clean records a rule needs before it is trusted.
       Entry.new(key: "guardrails.system_one.threshold",  yaml_path: %w[guardrails system_one threshold],  type: :float,   default: 0.8,   expose: %i[config], lifecycle: :next_tool_or_approval),
       Entry.new(key: "guardrails.system_one.min_record", yaml_path: %w[guardrails system_one min_record], type: :integer, default: 5,     expose: %i[config], lifecycle: :next_tool_or_approval),
-      # How long one judgment may take, in milliseconds; a judgment that doesn't arrive asks the user.
-      Entry.new(key: "guardrails.system_one.timeout_ms", yaml_path: %w[guardrails system_one timeout_ms], type: :integer, default: 2000,  expose: %i[config], lifecycle: :next_tool_or_approval),
+
+      # What every use of System 1 shares: approvals, toolkit suggestions, context candidates and bundles' judgments.
+      # The hosts: entry serving /v1/systemone (Splash, or the hosted Jev API); unset: no judgment, so nothing auto-allows.
+      Entry.new(key: "system_one.host",       yaml_path: %w[system_one host],       type: :string,  default: nil,  expose: %i[config], lifecycle: :next_tool_or_approval),
+      # The judgment model; unset: the host's first model, and no judgment if it names none.
+      Entry.new(key: "system_one.model",      yaml_path: %w[system_one model],      type: :string,  default: nil,  expose: %i[config], lifecycle: :next_tool_or_approval),
+      # How long one judgment may take, in milliseconds; a judgment that doesn't arrive is no judgment.
+      Entry.new(key: "system_one.timeout_ms", yaml_path: %w[system_one timeout_ms], type: :integer, default: 2000, expose: %i[config], lifecycle: :next_tool_or_approval),
+      # Save each System 1 ask and what came of it (docs/system-one.md): on (the default) | off.
+      Entry.new(key: "system_one.runs", yaml_path: %w[system_one runs], type: :enum, default: "on", expose: %i[config], enum_values: %w[on off], lifecycle: :next_tool_or_approval),
 
       Entry.new(key: "log.file",                 yaml_path: %w[log file],                 type: :string, default: nil,              expose: %i[env config cli], lifecycle: :process_start),
       Entry.new(key: "log.disable",              yaml_path: %w[log disable],              type: :bool,   default: false,            expose: %i[env config cli], lifecycle: :process_start),
@@ -204,6 +208,12 @@ module Samagotchi
       # The tokens one scope's memory index (sent with every prompt) may hold before a write that crosses it gets a note
       # (MemoryBundle::IndexSize); 0: no note. `memory:` is its own section, not the `memories:` preload list.
       Entry.new(key: "memory.index_warn_tokens", yaml_path: %w[memory index_warn_tokens], type: :integer, default: 2500,            expose: %i[env config cli], lifecycle: :next_matching_turn_display_poll_write),
+      # The most characters one memory_read result holds (ToolOutputCut cuts it with a line naming the memory file); 0: no
+      # fixed cap. memory_read is not cut by max_tool_output_chars (ToolRunner).
+      Entry.new(key: "memory.read_max_chars",    yaml_path: %w[memory read_max_chars],    type: :integer, default: 0,               expose: %i[env config cli], lifecycle: :next_matching_use),
+      # The tokens one memory may hold (each read of it pays them) before a write that crosses it gets a note
+      # (MemoryBundle::EntrySize); 0: no note.
+      Entry.new(key: "memory.entry_warn_tokens", yaml_path: %w[memory entry_warn_tokens], type: :integer, default: 5000,            expose: %i[env config cli], lifecycle: :next_matching_turn_display_poll_write),
       Entry.new(key: "context.status_thresholds", yaml_path: %w[context status_thresholds], type: :string, default: "20,40,60,80",    expose: %i[env config cli], lifecycle: :next_matching_turn_display_poll_write),
       # Attached context (ContextSources): how often a source's command runs when it names no --every (seconds; less
       # than 30 counts as 30).
@@ -219,7 +229,7 @@ module Samagotchi
       Entry.new(key: "context.peer_turns",       yaml_path: %w[context peer_turns],       type: :integer, default: 3,               expose: %i[env config cli], lifecycle: :next_matching_turn_display_poll_write),
       # The candidate judge (ContextJudge): off (no conversation text goes to a System 1 host); audit (asks and logs
       # context_candidates.jsonl, attaches nothing); on (ContextCandidateChoice: p ≥ threshold attaches quietly,
-      # offer_threshold ≤ p < threshold shows one card). Its host and model are guardrails.system_one.host/model.
+      # offer_threshold ≤ p < threshold shows one card). Its host and model are system_one.host and .model.
       # reask_after_turns: the owner prompts after a judged ask before its one re-ask.
       Entry.new(key: "context.candidates.mode",  yaml_path: %w[context candidates mode],  type: :enum,   default: "off", expose: %i[config], enum_values: %w[off audit on], lifecycle: :next_matching_turn_display_poll_write),
       Entry.new(key: "context.candidates.threshold", yaml_path: %w[context candidates threshold], type: :float, default: 0.8, expose: %i[config], lifecycle: :next_matching_turn_display_poll_write),
@@ -260,7 +270,7 @@ module Samagotchi
       Entry.new(key: "toolkit.default",          yaml_path: %w[toolkit default],          type: :string, default: nil,              expose: %i[env config], lifecycle: :session_creation),
       Entry.new(key: "toolkit.child",            yaml_path: %w[toolkit child],            type: :string, default: nil,              expose: %i[env config], lifecycle: :session_creation),
       # Toolkit suggestion (ToolkitSuggest): off; audit (logs, never blocks or changes a session); on (the first eligible
-      # turn waits up to guardrails.system_one.timeout_ms and may start on the suggested kit).
+      # turn waits up to system_one.timeout_ms and may start on the suggested kit).
       Entry.new(key: "toolkit.suggest.mode",     yaml_path: %w[toolkit suggest mode],     type: :enum,   default: "off", expose: %i[config], enum_values: %w[off audit on], lifecycle: :worker_start),
       Entry.new(key: "toolkit.suggest.threshold", yaml_path: %w[toolkit suggest threshold], type: :float, default: 0.5, expose: %i[config], lifecycle: :worker_start),
       Entry.new(key: "toolkit.suggest.defer_turns", yaml_path: %w[toolkit suggest defer_turns], type: :integer, default: 3, expose: %i[config], lifecycle: :worker_start),
@@ -390,8 +400,18 @@ module Samagotchi
     # The keys a hosts.<name>.models entry may hold (HostModel.parse_map).
     HOST_MODEL_KEYS = %w[price served].freeze
     # Section keys beyond the registry's: guardrails' YAML rules (Engine#guardrail_rules).
-    # And toolkit's kits (Toolkit.kits).
-    SECTION_EXTRA_KEYS = { "guardrails" => %w[rules disable].freeze, "toolkit" => %w[kits].freeze }.freeze
+    # And toolkit's kits (Toolkit.kits), and bundles' judgments' settings (SystemOne::JudgmentSettings).
+    SECTION_EXTRA_KEYS = { "guardrails" => %w[rules disable].freeze, "toolkit" => %w[kits].freeze, "system_one" => %w[judgments].freeze }.freeze
+
+    # guardrails.system_one's keys that moved to system_one (SystemOne::Client.from_config).
+    SYSTEM_ONE_MOVED_KEYS = %w[host model timeout_ms].freeze
+    # What a system_one.judgments entry may hold. Core's judgments take none (RESERVED_JUDGMENTS).
+    JUDGMENT_ENTRY_KEYS = %w[mode host model].freeze
+    JUDGMENT_MODES = %w[off audit on].freeze
+    # Names core keeps, as a judgment's first word: a bundle can't declare one and
+    # system_one.judgments can't set one (Record and Similar are model-blind, so a
+    # swapped model would inherit a clean record and could auto-allow).
+    RESERVED_JUDGMENTS = %w[approvals context guardrails toolkit].freeze
 
     # What a :bool value reads as (Config.coerce!), YAML 1.1's words and 1/0.
     BOOL_WORDS = { "1" => true, "true" => true, "yes" => true, "on" => true,
@@ -464,6 +484,14 @@ module Samagotchi
         word && entry.enum_values.include?(word) ? word : nil
       end
 
+      # A system_one.judgments entry's mode as written, nil for one it can't
+      # be: an unquoted on/off is a boolean there too.
+      # @return [String, nil]
+      def judgment_mode(raw)
+        word = BOOL_ENUM_WORDS.fetch(raw) { raw.to_s.strip.downcase }
+        word if JUDGMENT_MODES.include?(word)
+      end
+
       # What +entry+'s type takes, as a refusal names it.
       def takes(entry)
         case entry.type
@@ -692,6 +720,8 @@ module Samagotchi
       # A section's leaf: a key the registry knows, or a mapping of a
       # third level (web.participants.cap) whose keys it knows.
       def leaf_problems(path, value)
+        return judgment_problems(value) if path == "system_one.judgments"
+
         if value.is_a?(Hash) && ENTRIES.any? { |e| e.key.start_with?("#{path}.") }
           value.keys.filter_map { |leaf| key_problem("#{path}.#{leaf}") }
         else
@@ -699,6 +729,29 @@ module Samagotchi
         end
       end
 
+      # system_one.judgments' entries: a map entry bypasses the registry, so
+      # its keys and mode are checked here (an unquoted on/off is a boolean).
+      # An undeclared name can only be told once the plugins have loaded
+      # (SystemOne::Judgments#warn_undeclared).
+      def judgment_problems(value)
+        return value.nil? ? [] : ["config: 'system_one.judgments' must be a mapping of judgments; ignored"] unless value.is_a?(Hash)
+
+        value.flat_map do |name, entry|
+          where = "system_one.judgments.#{name}"
+          if RESERVED_JUDGMENTS.include?(name.to_s.split(".").first)
+            next ["config: #{where}: core's judgments take no settings of their own; ignored (see docs/system-one.md)"]
+          end
+          next ["config: #{where} must be a mapping of #{JUDGMENT_ENTRY_KEYS.join(", ")}; ignored"] unless entry.is_a?(Hash)
+
+          unknown = (entry.keys.map(&:to_s) - JUDGMENT_ENTRY_KEYS).map do |k|
+            unknown_key_message("#{where}.#{k}", k, JUDGMENT_ENTRY_KEYS, prefix: "#{where}.")
+          end
+          mode = entry.key?("mode") && judgment_mode(entry["mode"]).nil? ? ["config: #{where}.mode must be off, audit or on; it is off"] : []
+          text = %w[host model].reject { |k| entry[k].nil? || entry[k].is_a?(String) }.map { |k| "config: #{where}.#{k} must be text" }
+          unknown + mode + text
+        end
+      end
+
       # What a model ref in config.yml won't do as written: an alias whose
       # target is another alias (aliases apply once, ModelRef), a ref that
       # starts with "<host>/" (only ':' names a host).
@@ -752,10 +805,17 @@ module Samagotchi
         @known_sections ||= known_config_keys.filter_map { |k| k.split(".").first if k.include?(".") }.to_set.freeze
       end
 
-      # Keys replaced by another: the warning names the new one (no alias).
+      # Keys replaced by another, and what the warning adds: it names the new
+      # one (no alias).
+      PARENT_ANSWERS_HINT = "hard, standard or soft; see docs/guardrails.md"
+      SYSTEM_ONE_MOVED_HINT = "it has moved: until all of host, model and timeout_ms have, nothing is judged or " \
+                              "auto-allowed, and every ask goes to you; see docs/configuration.md"
       REPLACED_KEYS = {
-        "guardrails.parent_approvals" => "guardrails.parent_answers",
-        "turn.parent_continue" => "guardrails.parent_answers"
+        "guardrails.parent_approvals" => ["guardrails.parent_answers", PARENT_ANSWERS_HINT],
+        "turn.parent_continue" => ["guardrails.parent_answers", PARENT_ANSWERS_HINT],
+        "guardrails.system_one.host" => ["system_one.host", SYSTEM_ONE_MOVED_HINT],
+        "guardrails.system_one.model" => ["system_one.model", SYSTEM_ONE_MOVED_HINT],
+        "guardrails.system_one.timeout_ms" => ["system_one.timeout_ms", SYSTEM_ONE_MOVED_HINT]
       }.freeze
 
       # nil when +dotted+ is a key the file may hold.
@@ -763,7 +823,7 @@ module Samagotchi
         return nil if known_config_keys.include?(dotted)
         return "config: #{ConfigFile.removed_transport_problem("'#{dotted}'")}" if dotted == "server.transport"
         if (replaced = REPLACED_KEYS[dotted])
-          return "config: unknown key '#{dotted}': replaced by '#{replaced}' (hard, standard or soft; see docs/guardrails.md)"
+          return "config: unknown key '#{dotted}': replaced by '#{replaced.first}' (#{replaced.last})"
         end
 
         entry = find_by_key(dotted)

data/lib/samagotchi/context_candidate_choice.rb

@@ -133,12 +133,19 @@ module Samagotchi
       own.add(ContextCandidates.source_for(candidate, why: CHOSEN_WHY))
       Log.info(:context, "candidate_attached", name: candidate.name, trigger: "command")
       ContextCandidatesLog.event("attached", session_id: session.id, name: candidate.name, state_dir: state_dir, by: "command")
+      label_run(session, candidate, "attached", state_dir)
       show_card.call(**closed_card(candidate, "Attached."))
       [:ok, "attached #{candidate.name}: its text comes with your next message"]
     rescue ContextSources::Invalid, ContextProviders::Invalid => e
       [:error, "#{candidate.name} not attached: #{e.message}"]
     end
 
+    # /context attach|decline (the card's buttons), on the latest ask's run.
+    def label_run(session, candidate, value, state_dir)
+      records = ContextCandidatesLog.records_for(ContextCandidatesLog.log_for(state_dir), session.id)
+      ContextCandidatesLog.label_run(records, candidate.name, value, by: "command", sessions_dir: state_dir)
+    end
+
     def decline(candidate, status, session, state_dir, show_card)
       if status == "attached"
         return [:error, "#{candidate.name} is attached; chi context rm #{candidate.name} removes it"]
@@ -147,6 +154,7 @@ module Samagotchi
 
       ContextSources.session_location(session.id, state_dir: state_dir).decline(candidate.name, candidate.url.to_s)
       ContextCandidatesLog.event("declined", session_id: session.id, name: candidate.name, state_dir: state_dir, by: "command")
+      label_run(session, candidate, "declined", state_dir)
       show_card.call(**closed_card(candidate, "Not attached here."))
       [:ok, "declined #{candidate.name}: not proposed again in this session"]
     end

data/lib/samagotchi/context_candidates_log.rb

@@ -3,6 +3,7 @@
 require_relative "log"
 require_relative "session"
 require_relative "side_judgments"
+require_relative "system_one/runs"
 
 module Samagotchi
   # The candidates' record, `context_candidates.jsonl` in the state dir
@@ -15,7 +16,8 @@ module Samagotchi
   # Kinds (every line has session_id, name and at):
   # - proposed: a plugin's ctx.context.propose recorded it (title, by)
   # - mentioned: an owner prompt named it and it was attached (mention)
-  # - judged: System 1's ask (ContextJudge.ask: p, task_p, stated, would, …)
+  # - judged: System 1's ask (ContextJudge.ask: run_id, p, task_p, stated,
+  #   would, …)
   # - judge_attached: on mode attached it (p ≥ threshold; p)
   # - carded: on mode showed its card (the middle band; p): once per
   #   candidate, read back by ContextCandidateChoice.carded?
@@ -34,6 +36,10 @@ module Samagotchi
     STATUS_OF = { "proposed" => "proposed", "mentioned" => "attached", "judge_attached" => "attached", "attached" => "attached",
                   "declined" => "declined", "detached" => "proposed", "withdrawn" => nil }.freeze
 
+    # The kinds #look sees that are a removal: a chip's ×, chi context rm. One
+    # removed after the session's last turn is never seen.
+    REMOVED = %w[declined detached].freeze
+
     module_function
 
     # @param state_dir [String, nil] the sessions folder (Session.default_state_dir)
@@ -77,10 +83,28 @@ module Samagotchi
 
         kind = status == "proposed" ? "detached" : status
         event(kind, session_id: session_id, name: candidate.name, log: log, by: "user")
+        label_run(records, candidate.name, kind, by: "user", root: log.dir) if REMOVED.include?(kind)
         kind
       end
     end
 
+    # The user's say on a candidate, as a label on the latest ask about it
+    # (the judged line's run, question "about"). No ask with a run: nothing.
+    # Never raises.
+    # @param records [Array<Hash>] the session's lines (#records_for)
+    # @param root [String, nil] the state dir; nil: from +sessions_dir+
+    # @return [Boolean] whether a label was written
+    def label_run(records, name, value, by:, sessions_dir: nil, root: nil)
+      judged = records.reverse_each.find { |line| line["kind"] == "judged" && line["name"] == name && line["run_id"] }
+      return false if judged.nil?
+
+      runs = SystemOne::Runs.in(root || File.dirname(sessions_dir || Session.default_state_dir))
+      runs.label(judged["run_id"], value, by: by, question: "about")
+    rescue StandardError => e
+      Log.warn(:context, "context_candidates_log_failed", error: e.class.name, msg: e.message.to_s[0, 200])
+      false
+    end
+
     # +text+ as a log line keeps it: one line, at most PROMPT_MAX chars.
     def short(text)
       line = text.to_s.gsub(/\s+/, " ").strip

data/lib/samagotchi/context_judge.rb

@@ -4,6 +4,7 @@ require_relative "config"
 require_relative "context_candidates_log"
 require_relative "log"
 require_relative "system_one/question"
+require_relative "system_one/runs"
 
 module Samagotchi
   # System 1's judgment of a session's candidate context
@@ -26,6 +27,8 @@ module Samagotchi
   # (attach, card, or nothing); audit only logs.
   module ContextJudge
     MODES = %w[off audit on].freeze
+    # Its saved asks' name (SystemOne::Runs).
+    JUDGMENT = "context.candidate"
     ABOUT_ID = "about"
     TASK_ID = "task"
     # The bound on each prompt in the state.
@@ -168,14 +171,15 @@ module Samagotchi
     # candidate is asked again at the next owner prompt.
     # @return [Hash, nil] the line's fields
     def ask(client:, job:, log:, settings:, cancel_controller: nil)
+      run_id = SystemOne::Runs.new_id(JUDGMENT)
       answers = client.ask(state: state(job), questions: questions(child: !job.parent_attached.nil?),
-                           cancel_controller: cancel_controller)
+                           cancel_controller: cancel_controller, run_id: run_id)
       about = answers&.dig(ABOUT_ID)&.noul
       task = answers&.dig(TASK_ID)&.noul
       return nil if about.nil? || task.nil?
 
       stated = task >= TASK_MIN
-      fields = { "title" => job.title, "phase" => job.phase, "owner_prompts" => job.owner_prompts,
+      fields = { "run_id" => run_id, "title" => job.title, "phase" => job.phase, "owner_prompts" => job.owner_prompts,
                  "p" => about.round(4), "task_p" => task.round(4), "stated" => stated,
                  "would" => stated ? would(about, settings) : nil, "mode" => settings.mode,
                  "threshold" => settings.threshold, "offer_threshold" => settings.offer_threshold,