silas 0.1.1

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA256:
+  metadata.gz: '08d5115f914d3ff251c01f57b506951e3367717d777bfdd3d175a165169552f7'
+  data.tar.gz: 04e26fde565b7cf2d2a402316e095d6b0cf9f6a753b2d2444682890ec0ebe66f
+SHA512:
+  metadata.gz: 48d66589890f1c88e9ac8e1d476b131821907aea8c6e60d87300a42970e3e6a7bf52673020a94961f9bc32d2b3409cd6f735b6dfbb3d973ccaa86087298cb939
+  data.tar.gz: 9ddc0ddbba4ad607ecba6443b85492e94d72a058aab78f13ad256d62c2d0631f0a8d61cc0f37cd902d2701e821b4e5248aa7a1076321a2fe25f34fbf13c5a6c9

data/CHANGELOG.md

@@ -0,0 +1,41 @@
+# Changelog
+
+## 0.1.1
+
+- **Fix: parallel tool calls.** When the model emitted several tool_use blocks
+  in one turn, replay could send a tool_result with no matching tool_use (the
+  provider rejects it) and, under a non-serializing queue adapter, double-execute
+  the step. The replayed assistant message's tool_use blocks are now
+  reconstructed from the settled ledger invocations — every tool_result has a
+  matching tool_use by construction — and consecutive tool results are batched
+  into a single provider message. Regression test:
+  `spec/silas/parallel_tool_calls_spec.rb`.
+- **Boot guard: unsafe queue adapter.** Silas now warns at boot if ActiveJob is
+  using the in-process Async adapter, which runs continuation retries
+  concurrently and breaks exactly-once. Use Solid Queue (production) or `:inline`
+  (scripts/demos). See DEPLOY.md.
+
+## 0.1.0
+
+First release. A durable AI agent framework for Rails ("eve without the bill").
+
+- **Durable loop** on Active Job Continuations + Solid Queue — a turn survives
+  crash / deploy / `kill -9` and resumes from the last completed step.
+  Chaos-gated: 100/100 runs, zero duplicate side effects, byte-identical
+  transcripts, on SQLite and Postgres.
+- **Exactly-once tool execution** via a transactional ledger (at-most-once with
+  in-doubt→human resolution for external effects).
+- **Human-in-the-loop approvals** that park at zero compute, resumable from
+  Slack buttons, signed email links, or the inbox.
+- **`app/agent/` directory convention**: tools (signature = schema), skills
+  (progressive disclosure), instructions, schedules (cron → Solid Queue),
+  channels (Action Mailbox + Slack), subagents (isolated delegation),
+  connections (external MCP servers as tools).
+- **Two engines**: `:ruby_llm` (any provider) and `:agent_sdk` (a `claude -p`
+  subprocess; API-key auth).
+- **Mountable inbox** at `/silas/inbox`: live trace over Turbo Streams, approval
+  cards, per-session/agent cost. Deny-by-default.
+- **Evals as a deploy gate**: transcript assertions + opt-in LLM rubric, `bin/ci`.
+- **Budgets**: cost / token / time caps per turn.
+- **Sandbox seam** with a Docker adapter (interim) for untrusted/model code.
+- Deploys self-hosted with Kamal to one cheap VPS (see DEPLOY.md).

data/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Daniel St Paul
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

data/README.md

@@ -0,0 +1,135 @@
+# Your Rails app is already an agent runtime.
+
+**Silas** turns the Rails app you already run into a durable AI-agent runtime.
+Active Job Continuations, Solid Queue, and one Postgres ledger table make every
+turn survive `kill -9` and resume from the last completed step — with a live
+operator inbox at `/silas/inbox` and park-at-zero human-in-the-loop approvals
+holding the big levers. No new service, no managed platform, no per-run meter:
+the durable stack is already booted inside your app. The only new surface is the
+`app/agent/` directory below.
+
+Honestly early and honestly narrow: **v0.1, one maintainer, zero external
+users**, durability proven by an in-repo `kill -9` chaos harness (100/100, zero
+duplicate effects, byte-identical replay), and scoped to **trusted code you write
+yourself** (the sandbox is an interim Docker seam, not a microVM). The full pitch
+and the honest caveats: [Why Silas](docs/why-silas.md) ·
+[Silas vs eve](docs/vs-eve.md).
+
+```
+app/agent/
+  instructions.md   # the persona (ERB, snapshotted once per turn)
+  agent.yml         # data-only config: model, limits
+  tools/            # one file per tool; identity = filename
+    issue_refund.rb #   keyword signature = the schema the model sees
+  skills/           # markdown playbooks, loaded on demand
+    triage.md       #   description: frontmatter is the routing hint
+```
+
+## Quickstart
+
+```sh
+bundle add silas
+bin/rails generate silas:install
+bin/rails db:migrate
+```
+
+```ruby
+class Agent::Tools::IssueRefund < Silas::Tool
+  description "Refund an order."
+  param :amount, :integer, desc: "Pence"
+  approval :always      # parks the run; a human approves from your app
+  transactional!        # DB-only side effects -> exactly-once, guaranteed
+
+  def call(order_id:, amount:)
+    Refund.create!(order_id:, amount:)
+    { refunded: order_id }
+  end
+end
+```
+
+```ruby
+session = Silas.agent.start(input: "Refund order 42, £12.50")
+session.pending_approvals.first.approve!(by: "daniel")
+session.continue(input: "Now email the customer.")
+```
+
+## The durability contract (what's actually guaranteed)
+
+Verified by `chaos_host/bin/chaos` — the harness that kill -9s a live agent
+hundreds of times per release (results in `chaos_host/results/`):
+
+- **A turn survives hard process death** (worker kill -9, whole-tree kill -9,
+  SIGTERM deploys) and resumes from the last completed step: 100% completion,
+  byte-identical transcripts, on SQLite and Postgres.
+- **`transactional!` tools execute exactly once.** The tool's DB writes and the
+  ledger row commit or roll back together. Zero duplicates across every chaos run.
+- **Other tools are at-least-once within one step** — and when a crash makes an
+  execution ambiguous, the default `at_most_once!` policy **parks the run for a
+  human verdict** instead of guessing (`idempotent!` opts into automatic re-runs).
+- **Approvals park at zero compute** — the job exits; approving enqueues a fresh
+  one that replays completed work from rows, never re-calling the model or
+  re-running tools. Parks expire (default 7 days) rather than ghosting forever.
+- **The rescuer is part of the contract.** Solid Queue marks a dead worker's
+  jobs failed and nothing retries them; the installer wires
+  `Silas::DeadJobRescuerJob` as a recurring task (every 30s). Recovery time ≈
+  `SolidQueue.process_alive_threshold` + that cadence. Do not remove it.
+- **Deploys can't corrupt a run**: instructions are snapshotted per turn, and a
+  deploy that changes tools/skills mid-turn fails the turn loudly
+  (`NondeterminismError`) instead of resuming into a different agent.
+
+## Engines
+
+Inference is one pluggable seam (`config.engine`):
+
+- `:ruby_llm` — API-key auth via [RubyLLM](https://rubyllm.com); any provider it
+  supports. Canonical, production mode. Compose resilience via
+  `config.around_model_call`.
+- `:agent_sdk` — a `claude -p` subprocess runs the whole turn, calling back into
+  your tools over an in-worker HTTP MCP endpoint whose `tools/call` goes through
+  the same Ledger. Always `--bare` (API-key auth only; the boot guard raises if
+  OAuth is configured with `ANTHROPIC_API_KEY` present, and if the key is missing
+  in api_key mode). v1 is honestly weaker than `:ruby_llm`: exactly-once *within*
+  a run, `approval :never` tools only, and fail-closed on a mid-subprocess kill.
+
+## Triggers
+
+An agent is reached by more than a method call:
+
+- **`schedules/`** — `app/agent/schedules/*.md` (cron frontmatter, body = the turn
+  input) or `*.rb` handlers. `bin/rails silas:schedules` compiles them into
+  Solid Queue recurring tasks. A scheduled run is a normal durable turn.
+- **`channels/`** — `app/agent/channels/*.rb` bind email (Action Mailbox) and
+  Slack to the loop. A new thread starts a session, a reply continues it, and
+  approvals render as Slack buttons / signed email links that call the same
+  `approve!`/`decline!`. Outbound delivery is idempotent and off the durable loop.
+
+## The inbox
+
+Mount the engine (the generator does this) and a live inbox appears at
+`/silas/inbox`: a session list, a live step-trace that streams over Turbo
+Streams as the agent runs, approval cards whose Approve/Decline buttons call the
+exact same `approve!`/`decline!` as Slack and email, and per-session token/cost
+accounting. It's **deny-by-default** — invisible until you wire auth:
+
+```ruby
+Silas.configure do |c|
+  # Devise-compatible: the lambda DENIES by rendering; passes by not rendering.
+  c.inbox_auth = ->(controller) { controller.head :not_found unless controller.current_user&.admin? }
+  # c.inbox_public_read = true   # public read-only demo; approve/decline stay gated
+  # c.model_prices["your-model"] = { in: 300, out: 1500 }  # microcents / 1k tokens
+end
+```
+
+Turbo streaming activates automatically when the host has `turbo-rails` (every
+default Rails app does); without it the trace falls back to a polling refresh.
+The gem itself takes no turbo dependency.
+
+## Requirements
+
+Rails >= 8.1 (Active Job Continuations) and Solid Queue >= 1.2 for the
+durability contract. macOS dev note: Solid Queue forks + pg need
+`PGGSSENCMODE=disable OBJC_DISABLE_INITIALIZE_FORK_SAFETY=YES`.
+
+## License
+
+MIT.

data/app/controllers/silas/channels/approvals_controller.rb

@@ -0,0 +1,34 @@
+module Silas
+  module Channels
+    # Email approve/decline links land here. The signed token carries the
+    # invocation id + action (no session state in the URL); a GET shows a
+    # confirm page, a POST performs the action via the existing approve!/decline!.
+    class ApprovalsController < BaseController
+      def show
+        @claim = Silas::Channel.verify_token(params[:token])
+        return render(:error, status: :unprocessable_entity) unless @claim
+
+        @invocation = Silas::ToolInvocation.find_by(id: @claim["id"])
+        @action = @claim["action"]
+        render :show
+      end
+
+      def update
+        claim = Silas::Channel.verify_token(params[:token])
+        return render(:error, status: :unprocessable_entity) unless claim
+
+        invocation = Silas::ToolInvocation.find(claim["id"])
+        if claim["action"] == "approve"
+          invocation.approve!(by: "email")
+        else
+          invocation.decline!(reason: "declined by email", by: "email")
+        end
+        @action = claim["action"]
+        render :done
+      rescue Silas::Error => e
+        @message = e.message
+        render :error, status: :unprocessable_entity
+      end
+    end
+  end
+end

data/app/controllers/silas/channels/base_controller.rb

@@ -0,0 +1,22 @@
+module Silas
+  module Channels
+    class BaseController < ActionController::Base
+      skip_forgery_protection # webhooks are authenticated by signature/token, not CSRF
+
+      private
+
+      # Reject anything not genuinely signed by Slack (or with a stale timestamp).
+      def verify_slack!
+        secret = Silas.config.slack_signing_secret
+        ok = Silas::Slack.verify_signature(
+          signing_secret: secret,
+          timestamp: request.headers["X-Slack-Request-Timestamp"],
+          body: request.raw_post,
+          signature: request.headers["X-Slack-Signature"]
+        )
+        head(:unauthorized) unless ok
+        ok
+      end
+    end
+  end
+end

data/app/controllers/silas/channels/slack_controller.rb

@@ -0,0 +1,58 @@
+module Silas
+  module Channels
+    # Slack transport webhooks. Inbound messages start/continue a session;
+    # interactive button clicks map to the existing invocation.approve!/decline!.
+    # Requires app/agent/channels/slack.rb (Agent::Channels::Slack) to exist.
+    class SlackController < BaseController
+      # POST /channels/slack/events
+      def events
+        return unless verify_slack!
+        return render(json: { challenge: params[:challenge] }) if params[:type] == "url_verification"
+        # Slack retries deliver at-least-once; ignore retries (continuation-token
+        # uniqueness + single-active-turn are the real dedup).
+        return head(:ok) if request.headers["X-Slack-Retry-Num"].present?
+
+        event = params[:event]
+        if event && event[:type] == "message" && event[:bot_id].blank? && event[:subtype].blank?
+          thread_key = "#{params[:team_id]}:#{event[:channel]}:#{event[:thread_ts] || event[:ts]}"
+          channel_class.dispatch(
+            thread_key: thread_key, input: event[:text].to_s,
+            metadata: { "slack" => { "channel" => event[:channel],
+                                     "thread_ts" => event[:thread_ts] || event[:ts],
+                                     "user" => event[:user] } }
+          )
+        end
+        head :ok
+      rescue Silas::TurnInProgressError
+        head :ok # single-active-turn: a reply mid-turn is dropped (v1 policy)
+      end
+
+      # POST /channels/slack/actions
+      def actions
+        return unless verify_slack!
+
+        payload = JSON.parse(params[:payload])
+        action = payload.fetch("actions").first
+        invocation = Silas::ToolInvocation.find(action["value"])
+        who = "slack:#{payload.dig('user', 'username') || payload.dig('user', 'id')}"
+
+        if action["action_id"] == "silas_approve"
+          invocation.approve!(by: who)
+          render json: { replace_original: true, text: ":white_check_mark: Approved by @#{who}" }
+        else
+          invocation.decline!(reason: "declined in Slack", by: who)
+          render json: { replace_original: true, text: ":x: Declined by @#{who}" }
+        end
+      rescue Silas::Error => e
+        render json: { replace_original: false, text: "Could not record: #{e.message}" }
+      end
+
+      private
+
+      def channel_class
+        Silas.config.channel_resolver&.call("slack") or
+          raise Silas::Error, "no app/agent/channels/slack.rb (Agent::Channels::Slack) defined"
+      end
+    end
+  end
+end

data/app/controllers/silas/inbox/base_controller.rb

@@ -0,0 +1,37 @@
+module Silas
+  module Inbox
+    # Deny-by-default (lifted from ruby_llm-resilience's dashboard_auth): the
+    # host's inbox_auth lambda renders/head-404s to DENY and passes by NOT
+    # rendering. A fresh mount is invisible until the host opts in.
+    class BaseController < ActionController::Base
+      protect_from_forgery with: :exception
+      layout "silas/inbox"
+
+      before_action :authenticate_read!
+
+      helper Silas::Inbox::TraceHelper
+
+      private
+
+      # Reads: allowed in public-read mode, else the host lambda must pass.
+      def authenticate_read!
+        return if Silas.config.inbox_public_read
+
+        deny_unless_authed!
+      end
+
+      # Writes (approve/decline): ALWAYS the host lambda, even in public-read.
+      def authenticate_write!
+        deny_unless_authed!
+      end
+
+      def deny_unless_authed!
+        Silas.config.inbox_auth.call(self)
+      end
+
+      def current_actor
+        Silas.config.inbox_actor.call(self)
+      end
+    end
+  end
+end

data/app/controllers/silas/inbox/invocations_controller.rb

@@ -0,0 +1,44 @@
+module Silas
+  module Inbox
+    # Approve/decline from the UI — the SAME code path as the Slack buttons and
+    # email links (invocation.approve!/decline!). Writes always require real
+    # auth, even when reads are public.
+    class InvocationsController < BaseController
+      before_action :authenticate_write!
+      before_action :set_invocation
+
+      def approve
+        @invocation.approve!(by: current_actor)
+        respond_resolved
+      rescue Silas::Error => e
+        respond_error(e)
+      end
+
+      def decline
+        # decline-with-note: the textarea's reason becomes {denied: reason},
+        # which the model sees as the tool result.
+        reason = params[:reason].presence || "declined from inbox"
+        @invocation.decline!(reason: reason, by: current_actor)
+        respond_resolved
+      rescue Silas::Error => e
+        respond_error(e)
+      end
+
+      private
+
+      def set_invocation
+        @invocation = Silas::ToolInvocation.find(params[:id])
+      end
+
+      def respond_resolved
+        # The model's own after_commit broadcast fans the update to every open
+        # trace; this response just returns the caller to the session.
+        redirect_to inbox_session_path(@invocation.turn.session_id)
+      end
+
+      def respond_error(error)
+        redirect_to inbox_session_path(@invocation.turn.session_id), alert: error.message
+      end
+    end
+  end
+end

data/app/controllers/silas/inbox/sessions_controller.rb

@@ -0,0 +1,16 @@
+module Silas
+  module Inbox
+    class SessionsController < BaseController
+      def index
+        @sessions = Silas::Session.order(created_at: :desc).limit(100)
+        @pending_total = Silas::ToolInvocation.where(approval_state: "required").count
+      end
+
+      def show
+        @session = Silas::Session.find(params[:id])
+        @turns = @session.turns.includes(steps: :tool_invocations)
+        @cost = Silas::Inbox::Cost.for_session(@session)
+      end
+    end
+  end
+end

data/app/helpers/silas/inbox/trace_helper.rb

@@ -0,0 +1,42 @@
+module Silas
+  module Inbox
+    module TraceHelper
+      STATUS_CLASS = {
+        "queued" => "pill-grey", "running" => "pill-blue pill-pulse",
+        "waiting" => "pill-amber", "in_doubt" => "pill-amber",
+        "completed" => "pill-green", "failed" => "pill-red", "canceled" => "pill-red",
+        # tool-invocation statuses
+        "pending" => "pill-grey", "started" => "pill-blue", "declined" => "pill-red",
+        "approved" => "pill-green", "required" => "pill-amber", "expired" => "pill-red"
+      }.freeze
+
+      def status_pill(status)
+        tag.span(status.to_s.tr("_", " "), class: "pill #{STATUS_CLASS[status.to_s] || 'pill-grey'}")
+      end
+
+      def step_text(step)
+        Array(step.response_blocks).select { |b| b["type"] == "text" }.map { |b| b["text"] }.join.presence
+      end
+
+      def pretty_args(hash)
+        JSON.pretty_generate(hash || {})
+      end
+
+      def cost_label(cost)
+        tokens = "#{number_with_delimiter(cost[:input_tokens])} in / #{number_with_delimiter(cost[:output_tokens])} out"
+        money = Silas::Inbox::Cost.format(cost[:microcents])
+        if cost[:unpriced] || money.nil?
+          "#{tokens} · cost unavailable"
+        else
+          "#{tokens} · #{money}"
+        end
+      end
+
+      def relative_time(time)
+        return "" unless time
+
+        "#{time_ago_in_words(time)} ago"
+      end
+    end
+  end
+end

data/app/jobs/silas/agent_loop_job.rb

@@ -0,0 +1,95 @@
+module Silas
+  # One durable turn. Step-name sequence: :prepare, :step_0, :step_1, …,
+  # :finalize. Every between-step loop-control read hits write-once persisted
+  # state (Step#terminal, invocation approval state at-or-after the cursor), so
+  # a resumed continuation regenerates the IDENTICAL sequence — the spike's
+  # hard-won determinism constraint, owned by the framework so users can't
+  # violate it.
+  #
+  # Parking (approval / in-doubt) is a NORMAL job exit at zero compute; resume
+  # is a fresh job enqueued by approve!/decline!, replaying completed steps
+  # from rows (no model calls, no re-effects — StepRunner's replay path).
+  class AgentLoopJob < ActiveJob::Base
+    include ActiveJob::Continuable
+
+    self.resume_options = { wait: 0 } # spike: default 5s wait makes turns crawl
+
+    queue_as { Silas.config.queue_name }
+
+    def perform(turn_id)
+      turn = Turn.find(turn_id)
+      return if turn.completed? || %w[failed canceled].include?(turn.status)
+
+      if Silas.resolved_engine.class.loop_ownership == :engine
+        perform_engine_owned(turn)
+      else
+        perform_framework_owned(turn)
+      end
+    end
+
+    private
+
+    # :ruby_llm — the framework drives the loop, one model call per step, tools
+    # executed through the Ledger. The determinism constraints live here.
+    def perform_framework_owned(turn)
+      step :prepare, isolated: isolate? do
+        Ledger.assert_no_checkpoint!
+        turn.update!(status: "running", job_id: job_id, started_at: turn.started_at || Time.current)
+        Instructions.snapshot!(turn)
+      end
+
+      index = 0
+      loop do
+        step :"step_#{index}", isolated: isolate? do
+          Ledger.assert_no_checkpoint!
+          StepRunner.call(turn, index)
+        end
+
+        # Loop control reads persisted, effectively-immutable state only.
+        row = Step.find_by!(turn: turn, index: index)
+        return if row.parked?
+        break if row.terminal?
+
+        # Budget caps (cost/tokens/time) — checked between steps, never inside one.
+        if (reason = Budget.exceeded_reason(turn))
+          turn.finish!(:failed, reason: reason)
+          return
+        end
+
+        index += 1
+        if index >= Silas.agent.max_steps
+          turn.finish!(:failed, reason: "max_steps")
+          return
+        end
+      end
+
+      step :finalize do
+        turn.finish!(:completed)
+      end
+    end
+
+    # :agent_sdk — Claude Code owns the loop; one isolated :run step wraps the
+    # whole subprocess (one Continuation checkpoint per invocation). Same
+    # durable shell, same queue/rescuer/single-active-turn invariants.
+    def perform_engine_owned(turn)
+      step :prepare, isolated: isolate? do
+        Ledger.assert_no_checkpoint!
+        turn.update!(status: "running", job_id: job_id, started_at: turn.started_at || Time.current)
+        Instructions.snapshot!(turn)
+        Step.find_or_create_by!(turn: turn, index: 0) # anchor step exists before the MCP thread needs it
+      end
+
+      outcome = nil
+      step :run, isolated: isolate? do
+        Ledger.assert_no_checkpoint!
+        outcome = SubprocessRunner.call(turn)
+      end
+
+      step :finalize do
+        turn.finish!(:completed) if outcome == :terminal
+      end
+    end
+
+    def isolate? = Silas.config.isolate_steps
+  end
+end

data/app/jobs/silas/channel_delivery_job.rb

@@ -0,0 +1,62 @@
+module Silas
+  # Outbound delivery, decoupled from the durable loop. Triggered by after_commit
+  # callbacks on Turn/ToolInvocation; idempotent via a CAS claim on the marker
+  # column (notified_at/answered_at), released if the send raises so a retry can
+  # re-attempt. Duplicate pings are the worst failure — never a ledger violation
+  # (approve!/decline! are idempotent).
+  class ChannelDeliveryJob < ActiveJob::Base
+    queue_as { Silas.config.queue_name }
+
+    def perform(kind, id)
+      case kind
+      when "approval" then deliver_approval(id)
+      when "answer"   then deliver_answer(id)
+      end
+    end
+
+    private
+
+    def deliver_approval(id)
+      invocation = ToolInvocation.find_by(id: id)
+      return unless invocation&.approval_state == "required"
+      return unless claim!(ToolInvocation, invocation.id, :notified_at)
+
+      channel = Channel.for_session(invocation.turn.session)
+      return release!(ToolInvocation, invocation.id, :notified_at) unless channel
+
+      with_release(ToolInvocation, invocation.id, :notified_at) do
+        channel.deliver_approval(session: invocation.turn.session, invocation: invocation)
+      end
+    end
+
+    def deliver_answer(id)
+      turn = Turn.find_by(id: id)
+      return unless turn && (turn.completed? || turn.status == "failed")
+      return unless claim!(Turn, turn.id, :answered_at)
+
+      channel = Channel.for_session(turn.session)
+      return release!(Turn, turn.id, :answered_at) unless channel
+
+      with_release(Turn, turn.id, :answered_at) do
+        channel.deliver_answer(session: turn.session, text: turn.answer_text)
+      end
+    end
+
+    # Compare-and-swap: only the execution that flips NULL -> now proceeds.
+    def claim!(model, id, column)
+      model.where(id: id, column => nil).update_all(column => Time.current) == 1
+    end
+
+    def release!(model, id, column)
+      model.where(id: id).update_all(column => nil)
+      false
+    end
+
+    def with_release(model, id, column)
+      yield
+    rescue StandardError
+      release!(model, id, column) # send failed — free the claim for a retry
+      raise
+    end
+  end
+end

data/app/jobs/silas/dead_job_rescuer_job.rb

@@ -0,0 +1,31 @@
+module Silas
+  # Mandatory durability infrastructure (proven in the Phase 0 spike): Solid
+  # Queue FAILS a dead worker's claimed jobs (ProcessExitError on supervisor
+  # reap, ProcessPrunedError on heartbeat prune) and nothing retries them —
+  # retry_on can't see queue-level errors. This job, run as a recurring task,
+  # is the recovery path; recovery latency ≈ alive_threshold + its cadence.
+  #
+  # It also sweeps expired approvals while it's here.
+  class DeadJobRescuerJob < ActiveJob::Base
+    DEAD_PROCESS_ERRORS = %w[
+      SolidQueue::Processes::ProcessExitError
+      SolidQueue::Processes::ProcessPrunedError
+    ].freeze
+
+    queue_as { Silas.config.queue_name }
+
+    def perform
+      ToolInvocation.expire_stale!
+      return 0 unless defined?(SolidQueue)
+
+      rescued = 0
+      SolidQueue::FailedExecution.includes(:job).find_each do |failed|
+        next unless DEAD_PROCESS_ERRORS.include?(failed.error&.dig("exception_class"))
+
+        failed.retry
+        rescued += 1
+      end
+      rescued
+    end
+  end
+end