silas 0.1.6 → 0.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: e82a0a643fc11af7860df4d2633f6bf22b5f07626eecc2a572b6304924b20a9c
-  data.tar.gz: 1464c694a8c8813c0d700d151a482d1c72c901e3f6690464fcf30fc0e3185e01
+  metadata.gz: 1f804f46eccb34c27515be306e2697345f3be7e0ad3479aeafb05f3ca9e5e54b
+  data.tar.gz: 63a99caaeebb60133423d0d73669eff7074232262743764ec0d9d7d38f7b2012
 SHA512:
-  metadata.gz: 91d82c9f1fa784eb28cdffa635d8d04b97582d6b7201170bfc1052fcb036c43b89eab47462c6c931ca409e51595254f38cb56e336e74674bb30e3de69206e89e
-  data.tar.gz: c90cb14c3fd89d6bf8b605b0ec3a68e4d25255b6e82ea48a5d5f190cb6b59316182cc9228353aa71d4564c94c5871b022fea6be0035986fbf04e98c3696e3cf4
+  metadata.gz: bb45b5ca774d80cdd2c584851114204eb123dd714a94264a851699ea24955fa8eefba4b1897e1924a91a484f64c9746bc625e007652fdc8a71e096425e7a9882
+  data.tar.gz: 707d7857de1f2fba1e4e9327e9c32f71e7282c4dd2cfe739cb6aea98904cc805634f0ce70fd4353c5d580ea9f521d79e9581621d8f9b321216e9e00c058ba3b8

data/CHANGELOG.md

@@ -1,5 +1,123 @@
 # Changelog
 
+## 0.2.0 (unreleased)
+
+- **Token streaming, end to end.** The engine seam's `&on_event` block — dead
+  code since 0.1.0 — is live: the `:ruby_llm` engine streams the model
+  response (`chat.complete` with a block; the assembled message is identical
+  to the sync path, so durability semantics are untouched), `StepRunner`
+  coalesces text deltas into ~10Hz `"silas.delta"` notifications
+  (`Silas::DeltaBuffer`) carrying the accumulated text, and two subscribers
+  render them: the inbox trace (synchronous Turbo `broadcast_update_to` into a
+  stable per-step target — crash-restream overwrites, never duplicates) and
+  the `silas:chat` REPL (tokens print as they arrive). Deltas are decoration
+  over the authoritative rows: never persisted, never fed to the model, and a
+  replayed step emits none. `around_model_call` hooks keep their existing
+  contract and can no longer swallow the stream.
+- **Onboarding fixes.** The generated `bin/ci` can now actually fail on app
+  tests (it silently swallowed them with `|| true`); the generated initializer
+  shows every option the next-steps mention (`inbox_auth`, `sandbox`,
+  `memory_approval`, `model_prices`, `eval_dir`, `approval_ttl`) and defaults
+  to `claude-sonnet-5` instead of handing a first run the most expensive model
+  with no budget set; the rescuer's `recurring.yml` entry is now **idempotent
+  and environment-aware** (injected under every deployable env block —
+  staging included — never blind-appended into whatever block ends the file,
+  never duplicated on a re-run); a missing provider API key is caught **at
+  boot** with the exact fix (warns in development, raises `BootGuardError` in
+  production); and the unsafe Async-adapter warning **raises in production**,
+  where running agents on it silently voids the durability contract.
+- **Model-call resilience: transient provider errors retry from the
+  checkpoint; nothing ever strands in `running`.** Previously a single
+  429/529/timeout failed the loop job permanently and invisibly — the turn sat
+  in `running` forever with no retry and no signal. Now:
+  `resume_errors_after_advancing = false` on the loop job (Active Job
+  Continuations otherwise swallow errors raised after a checkpoint and
+  self-resume unboundedly, bypassing `retry_on` — verified against activejob
+  8.1); transient classes (`RateLimitError`, `OverloadedError`,
+  `ServiceUnavailableError`, `ServerError`, Faraday timeouts) retry with
+  polynomial backoff + jitter and **resume from the last completed step**;
+  exhaustion and permanent rejections (`UnauthorizedError`,
+  `PaymentRequiredError`, …) expire pending approvals and fail the turn
+  loudly. The rescuer now also sweeps **stranded turns** — a loop job that
+  died with an error outside the retry list fails its turn
+  (`reason: "job_failed"`) instead of leaving it running forever. Stale
+  approval cards can no longer zombie-resume a failed turn (`approve!` /
+  `decline!` refuse; `resume_turn!` guards).
+- **The inbox now shows the audit trail it exists to provide.** Tool
+  `arguments` render for every settled invocation (not just parked ones), a
+  failed tool shows its recorded `error` instead of a bare red pill, and
+  `approved_by` / `decline_reason` render on settled approvals — who held the
+  lever, and why it moved. Active turns gain a **Cancel** button (running
+  turns flag for a step-boundary cancel, parked turns cancel immediately),
+  and the "N awaiting approval" badge is now a link filtering the session
+  list to what needs you (`?pending=1`).
+- **Web chat in the inbox.** The session page gains a composer (`POST
+  .../sessions/:id/turns`) and the index a start-a-session form (with a named
+  agent picker) — the browser is now a first-class conversational surface, not
+  just approve/decline. Writes ride `authenticate_write!` exactly like
+  approvals; a turn-in-progress renders as an inline alert; web-chat sessions
+  stay `channel: nil` ("direct"), so no outbound delivery jobs are enqueued.
+
+- **`approval :once` is now scoped to (tool, arguments), not tool name alone.**
+  Name-only matching was a footgun: approving a £5 refund silently
+  auto-approved a £5,000 refund later in the same session. Identical repeat
+  calls still skip re-approval; different arguments park again. Graded gates
+  belong in an approval lambda.
+- **The ledger's checkpoint guard moved to `IsolatedExecutionState`** (from
+  `Thread.current[]`, which is fiber-local) — it now follows the app's
+  configured isolation level exactly like agent scopes, surviving into
+  internally-created fibers where the old flag silently vanished. Nested
+  ledger transactions now save/restore the guard instead of clearing it (the
+  old `ensure` opened a checkpoint-guard hole for the rest of the outer
+  transaction).
+- **Removed the `:agent_sdk` engine** (the `claude -p` subprocess integration).
+  Its differentiating rationale — running on a Claude subscription plan instead
+  of API credits — was structurally unreachable: `--bare` was hardcoded and the
+  engine raised without `ANTHROPIC_API_KEY` regardless of `config.auth`, so the
+  OAuth path could never execute a turn. What remained was a second engine with
+  weaker guarantees on every axis (exactly-once only *within* a run,
+  `approval :never` tools only, fail-closed on any mid-subprocess kill) that
+  made the durability contract conditional. One production path now:
+  `:ruby_llm`.
+  - `config.engine = :agent_sdk` raises a clear `BootGuardError` at configure
+    time. `config.auth` and the `agent_sdk_*` options are warning no-ops for
+    this release (hard removal in 0.3) — an existing initializer won't crash.
+  - The in-process MCP server (`Silas::Mcp::Server`/`Handler`) **survives the
+    cut** — it is the seam for a planned "mount your agent's tools as an MCP
+    server" feature — with its own integration spec. Its bind host moved from
+    `config.agent_sdk_mcp_host` to `config.mcp_server_host`.
+  - New migration drops `silas_turns.cli_session_id` and
+    `silas_turns.mcp_token` (the latter was write-only; tokens are minted and
+    compared in memory). Run `bin/rails silas:install:migrations db:migrate`.
+  - `Silas::Engines::Base.loop_ownership` is gone — every engine executes one
+    model call per step under the framework-owned loop. Custom engines that
+    merely inherited it are unaffected.
+
+## 0.1.7
+
+- **Memory — graph-shaped, not a graph database.** New `silas_memories` table:
+  entity-attributed facts (`subject · attribute · content`) with provenance
+  (session/turn) and **supersession** — a new fact about the same
+  subject+attribute retires the old one. Two built-ins: `remember`
+  (`transactional!`, **approval-gated by default** — the memory card parks in
+  your inbox; `config.memory_approval = :never` opts out) and `recall`
+  (on-demand subject lookup). Recent memories inject into the instructions
+  snapshot (bounded by `config.memory_injection_limit`). Scopes: private
+  per-agent or `shared: true` app-wide. Domain memory stays where it belongs —
+  your own tables; this is for the fuzzy residue with no natural home. Edges
+  are a deliberate not-yet. Upgrade-safe: tools only advertise when the
+  migration has run.
+- **Handoffs — staff composition without agent chatter.** New `handoff`
+  built-in (advertised when `app/agents/` exists): file a self-contained brief
+  that starts another named agent's linked session (`parent_session_id`),
+  async by default, `await: true` for run-now-and-return-answer.
+  `at_most_once!` through the ledger; refuses self-handoffs, unknown targets,
+  cycles, and chains deeper than 3. Free-form agent-to-agent conversation
+  remains deliberately unblessed.
+- `Session#continue(enqueue: false)` for callers that drive the turn
+  themselves. New migration: run `bin/rails silas:install:migrations
+  db:migrate` on upgrade.
+
 ## 0.1.6
 
 - **Named agents — the staff pattern.** An app can now employ several

data/README.md

@@ -88,6 +88,13 @@ hundreds of times per release (results in `chaos_host/results/`):
 - **Approvals park at zero compute** — the job exits; approving enqueues a fresh
   one that replays completed work from rows, never re-calling the model or
   re-running tools. Parks expire (default 7 days) rather than ghosting forever.
+- **Transient model errors retry from the checkpoint.** A rate limit,
+  overload, or timeout backs off and retries the job — and the continuation
+  resumes from the last completed step, never re-running completed work.
+  Exhausted retries and permanent rejections (bad key, bad request) expire
+  pending approvals and fail the turn loudly. **A turn can never sit in
+  `running` forever**: the rescuer also fails turns stranded by a loop job
+  that died outside the retry list.
 - **The rescuer is part of the contract.** Solid Queue marks a dead worker's
   jobs failed and nothing retries them; the installer wires
   `Silas::DeadJobRescuerJob` as a recurring task (every 30s). Recovery time ≈
@@ -96,19 +103,19 @@ hundreds of times per release (results in `chaos_host/results/`):
   deploy that changes tools/skills mid-turn fails the turn loudly
   (`NondeterminismError`) instead of resuming into a different agent.
 
-## Engines
+## Engine
 
-Inference is one pluggable seam (`config.engine`):
+Inference is one pluggable seam (`config.engine`): `:ruby_llm` — API-key auth
+via [RubyLLM](https://rubyllm.com), any provider it supports — is the default
+and the production path. Compose resilience via `config.around_model_call`, or
+swap in any object responding to `#execute_step` (the eval harness and the
+chaos tests do exactly that).
 
-- `:ruby_llm` — API-key auth via [RubyLLM](https://rubyllm.com); any provider it
-  supports. Canonical, production mode. Compose resilience via
-  `config.around_model_call`.
-- `:agent_sdk` — a `claude -p` subprocess runs the whole turn, calling back into
-  your tools over an in-worker HTTP MCP endpoint whose `tools/call` goes through
-  the same Ledger. Always `--bare` (API-key auth only; the boot guard raises if
-  OAuth is configured with `ANTHROPIC_API_KEY` present, and if the key is missing
-  in api_key mode). v1 is honestly weaker than `:ruby_llm`: exactly-once *within*
-  a run, `approval :never` tools only, and fail-closed on a mid-subprocess kill.
+> The experimental `:agent_sdk` engine (a `claude -p` subprocess) was removed
+> in 0.2: its subscription-auth rationale was structurally unreachable, and it
+> carried weaker guarantees than `:ruby_llm` on every axis. Its in-process MCP
+> server survives and returns as a first-class *mount your tools as MCP*
+> feature.
 
 ## Sandbox: run untrusted code with hermetic
 
@@ -160,6 +167,24 @@ default agent, unchanged. (Subagents stay a root-agent delegation feature;
 scope switching is execution-isolated, so concurrent jobs running different
 agents never cross wires.)
 
+## Memory & handoffs
+
+Silas memory is **graph-shaped, not a graph database**: facts as
+`subject · attribute · content` triples with provenance and supersession
+("author:jane · report_format: prefers CSV" — a new value retires the old).
+The `remember` tool is **approval-gated by default** — the memory card parks
+in your inbox before anything persists; `recall` digs deeper than the few
+recent memories injected into each turn. Private per agent, or `shared: true`
+for the whole staff. Your *domain* data does not belong here — it belongs in
+your own tables, which your tools already read; memory is for the fuzzy
+residue with no natural home.
+
+Staff compose through **handoffs, not conversations**: `handoff` files a
+self-contained brief that starts a linked session for another named agent
+(async, or `await: true` for an answer), exactly-once-guarded, cycle-checked.
+Two models chatting freely is a cost and audit hazard — deliberately
+unblessed.
+
 ## Triggers
 
 An agent is reached by more than a method call:
@@ -172,12 +197,28 @@ An agent is reached by more than a method call:
   approvals render as Slack buttons / signed email links that call the same
   `approve!`/`decline!`. Outbound delivery is idempotent and off the durable loop.
 
+## Streaming
+
+Turns stream. The `:ruby_llm` engine emits text deltas as the model responds:
+`bin/rails silas:chat` prints tokens as they arrive, and the inbox trace
+renders them live over Turbo (coalesced to ~10Hz). Deltas are decoration over
+the durable rows — never persisted, never fed back to the model, and a
+replayed step renders from its row with no deltas at all, so streaming adds
+zero risk to the durability contract. Custom sinks subscribe to the
+`"silas.delta"` notification (`{ session_id:, turn_id:, step_id:, step_index:,
+text: }`, where `text` is the accumulated string so far — filter by ids;
+notifications are process-global).
+
 ## The inbox
 
 Mount the engine (the generator does this) and a live inbox appears at
-`/silas/inbox`: a session list, a live step-trace that streams over Turbo
-Streams as the agent runs, approval cards whose Approve/Decline buttons call the
-exact same `approve!`/`decline!` as Slack and email, and per-session token/cost
+`/silas/inbox`: a session list, **web chat** (start a session or reply from
+the browser — same durable loop, no separate surface), a live step-trace that
+streams tokens over Turbo Streams as the agent runs, approval cards whose
+Approve/Decline buttons call the exact same `approve!`/`decline!` as Slack and
+email, a full **audit trail** (every tool call's arguments and its result or
+recorded error; who approved; who declined and why), **cancel** on active
+turns (honored at the next step boundary), and per-session token/cost
 accounting. It's **deny-by-default** — invisible until you wire auth:
 
 ```ruby

data/app/controllers/silas/inbox/sessions_controller.rb

@@ -1,9 +1,20 @@
 module Silas
   module Inbox
     class SessionsController < BaseController
+      before_action :authenticate_write!, only: :create
+
       def index
         @sessions = Silas::Session.order(created_at: :desc).limit(100)
         @sessions = @sessions.where(agent_name: params[:agent]) if params[:agent].present?
+        if params[:pending].present? # the "N awaiting approval" badge drills into this
+          # Subquery, not joins+distinct: DISTINCT over silas_sessions.* trips
+          # on the json metadata column (PG json has no equality operator).
+          @sessions = @sessions.where(
+            id: Silas::Turn.joins(:tool_invocations)
+                           .where(silas_tool_invocations: { approval_state: "required" })
+                           .select(:session_id)
+          )
+        end
         @agent_names = Silas::Session.distinct.pluck(:agent_name).sort
         @pending_total = Silas::ToolInvocation.where(approval_state: "required").count
       end
@@ -13,6 +24,19 @@ module Silas
         @turns = @session.turns.includes(steps: :tool_invocations)
         @cost = Silas::Inbox::Cost.for_session(@session)
       end
+
+      # Start a session from the browser. channel stays nil ("direct") — web
+      # chat is read live on the session page, not delivered outbound.
+      def create
+        input = params[:input].to_s.strip
+        return redirect_to inbox_sessions_path, alert: "Type a message first." if input.empty?
+
+        handle = params[:agent].present? ? Silas.agent(params[:agent]) : Silas.agent
+        started = handle.start(input: input)
+        redirect_to inbox_session_path(started)
+      rescue Silas::Error => e
+        redirect_to inbox_sessions_path, alert: e.message
+      end
     end
   end
 end

data/app/controllers/silas/inbox/turns_controller.rb

@@ -0,0 +1,32 @@
+module Silas
+  module Inbox
+    # The web composer: append a turn to an existing session. Same write-auth
+    # gate as approve/decline. Deliberately thin — the turn runs on the durable
+    # loop and the model's after_commit broadcasts render it live, so this
+    # controller only enqueues and redirects.
+    class TurnsController < BaseController
+      before_action :authenticate_write!
+
+      def create
+        agent_session = Silas::Session.find(params[:session_id])
+        input = params[:input].to_s.strip
+        return redirect_to inbox_session_path(agent_session), alert: "Type a message first." if input.empty?
+
+        agent_session.continue(input: input)
+        redirect_to inbox_session_path(agent_session)
+      rescue Silas::TurnInProgressError
+        redirect_to inbox_session_path(agent_session), alert: "A turn is already running — wait for it to settle."
+      end
+
+      # Cancel from the trace. Running turns are flagged and honored at the
+      # next step boundary (the same safe point as budgets); parked/queued
+      # turns cancel immediately.
+      def cancel
+        turn = Silas::Turn.find(params[:id])
+        outcome = turn.cancel!(reason: "canceled from inbox by #{current_actor}")
+        notice = outcome == :cancel_requested ? "Cancel requested — honored at the next step boundary." : "Turn canceled."
+        redirect_to inbox_session_path(turn.session_id), notice: notice
+      end
+    end
+  end
+end

data/app/jobs/silas/agent_loop_job.rb

@@ -12,10 +12,51 @@ module Silas
   class AgentLoopJob < ActiveJob::Base
     include ActiveJob::Continuable
 
+    # Errors must reach retry_on. By default Continuable swallows any
+    # StandardError raised after a checkpoint and silently self-resumes —
+    # unbounded invisible retries that bypass attempts/wait/jitter entirely
+    # (verified against activejob 8.1: the around_perform rescue runs before
+    # rescue_with_handler). Checkpoints still survive retry_on's re-enqueues —
+    # continuation state rides the job payload — so a retried execution skips
+    # completed steps. Isolation interrupts are rescued separately and are
+    # unaffected by this flag. Do NOT reach for max_resumptions as an error
+    # bound: with isolate_steps on, every isolated step consumes one
+    # resumption by design.
+    self.resume_errors_after_advancing = false
+
     self.resume_options = { wait: 0 } # spike: default 5s wait makes turns crawl
 
     queue_as { Silas.config.queue_name }
 
+    # Transient provider trouble: back off and retry; the continuation resumes
+    # from the last completed step. Exhaustion fails the turn LOUDLY — a turn
+    # must never strand in "running". (Never retry_on StandardError: it would
+    # catch Continuation::Error subclasses and retry a structurally broken job
+    # forever.)
+    retry_on ::RubyLLM::RateLimitError, ::RubyLLM::OverloadedError,
+             ::RubyLLM::ServiceUnavailableError, ::RubyLLM::ServerError,
+             ::Faraday::TimeoutError, ::Faraday::ConnectionFailed,
+             wait: :polynomially_longer, attempts: 5, jitter: 0.15 do |job, error|
+      fail_turn(job, error)
+    end
+
+    # Permanent provider rejections: retrying cannot help. Fail the turn now.
+    discard_on ::RubyLLM::UnauthorizedError, ::RubyLLM::PaymentRequiredError,
+               ::RubyLLM::ForbiddenError, ::RubyLLM::BadRequestError do |job, error|
+      fail_turn(job, error)
+    end
+
+    # The force-fail path: expire approvals FIRST so no stale card can
+    # zombie-resume the failed turn, then finish loudly.
+    def self.fail_turn(job, error)
+      turn = Turn.find_by(id: job.arguments.first)
+      return unless turn&.active?
+
+      turn.expire_pending_approvals!("turn failed: model error")
+      turn.finish!(:failed, reason: "model_error")
+      Rails.logger&.error("[silas] turn #{turn.id} failed on #{error.class}: #{error.message}")
+    end
+
     def perform(turn_id)
       turn = Turn.find(turn_id)
       return if turn.completed? || %w[failed canceled].include?(turn.status)
@@ -26,26 +67,17 @@ module Silas
       # staff member never wakes up holding the root agent's tools.
       scope = Silas.scope_for_session(turn.session)
       if scope
-        Silas.with_agent_scope(scope) { drive(turn) }
+        Silas.with_agent_scope(scope) { run_turn(turn) }
       else
-        drive(turn)
+        run_turn(turn)
       end
     end
 
     private
 
-    def drive(turn)
-      if Silas.resolved_engine.class.loop_ownership == :engine
-        perform_engine_owned(turn)
-      else
-        perform_framework_owned(turn)
-      end
-    end
-
-
-    # :ruby_llm — the framework drives the loop, one model call per step, tools
-    # executed through the Ledger. The determinism constraints live here.
-    def perform_framework_owned(turn)
+    # The framework drives the loop: one model call per step, tools executed
+    # through the Ledger. The determinism constraints live here.
+    def run_turn(turn)
       step :prepare, isolated: isolate? do
         Ledger.assert_no_checkpoint!
         turn.update!(status: "running", job_id: job_id, started_at: turn.started_at || Time.current)
@@ -95,35 +127,6 @@ module Silas
       end
     end
 
-    # :agent_sdk — Claude Code owns the loop; one isolated :run step wraps the
-    # whole subprocess (one Continuation checkpoint per invocation). Same
-    # durable shell, same queue/rescuer/single-active-turn invariants.
-    def perform_engine_owned(turn)
-      step :prepare, isolated: isolate? do
-        Ledger.assert_no_checkpoint!
-        turn.update!(status: "running", job_id: job_id, started_at: turn.started_at || Time.current)
-        Instructions.snapshot!(turn)
-        Step.find_or_create_by!(turn: turn, index: 0) # anchor step exists before the MCP thread needs it
-      end
-
-      # Cancellation for engine-owned turns is honored only BEFORE the
-      # subprocess starts — a running claude -p is not aborted mid-flight (v1).
-      if turn.reload.cancel_requested_at
-        turn.finish!(:canceled, reason: "canceled")
-        return
-      end
-
-      outcome = nil
-      step :run, isolated: isolate? do
-        Ledger.assert_no_checkpoint!
-        outcome = SubprocessRunner.call(turn)
-      end
-
-      step :finalize do
-        turn.finish!(:completed) if outcome == :terminal
-      end
-    end
-
     def isolate? = Silas.config.isolate_steps
   end
 end

data/app/jobs/silas/dead_job_rescuer_job.rb

@@ -20,12 +20,33 @@ module Silas
 
       rescued = 0
       SolidQueue::FailedExecution.includes(:job).find_each do |failed|
-        next unless DEAD_PROCESS_ERRORS.include?(failed.error&.dig("exception_class"))
-
-        failed.retry
-        rescued += 1
+        if DEAD_PROCESS_ERRORS.include?(failed.error&.dig("exception_class"))
+          failed.retry
+          rescued += 1
+        elsif failed.job&.class_name == "Silas::AgentLoopJob"
+          fail_stranded_turn(failed)
+        end
       end
       rescued
     end
+
+    private
+
+    # A loop job that failed with a NON-dead-process error (something outside
+    # AgentLoopJob's retry list — a NoMethodError in a tool, an AR blip) will
+    # never be retried by anyone. Without this sweep its turn sits in
+    # "running" forever: not failed, not parked, invisible as broken. The
+    # failed execution stays in Solid Queue for forensics; the TURN is failed
+    # loudly with its approvals expired.
+    def fail_stranded_turn(failed)
+      turn = Turn.find_by(id: failed.job.arguments&.dig("arguments", 0))
+      return unless turn&.active?
+
+      exception = failed.error&.dig("exception_class")
+      turn.expire_pending_approvals!("turn failed: #{exception}")
+      turn.finish!(:failed, reason: "job_failed")
+      Rails.logger&.error("[silas] turn #{turn.id} failed: its loop job died with " \
+                          "#{exception} — #{failed.error&.dig('message')}")
+    end
   end
 end

data/app/models/silas/memory.rb

@@ -0,0 +1,51 @@
+module Silas
+  # One remembered fact. Triple-ish (subject · attribute · content) with
+  # provenance (which turn wrote it) and supersession: a new fact about the
+  # same (agent, scope, subject, attribute) retires the old one — temporal
+  # versioning without a temporal store. Edges between memories are a
+  # deliberate not-yet: add them when a real agent needs multi-hop.
+  class Memory < ApplicationRecord
+    self.table_name = "silas_memories"
+
+    SCOPES = %w[agent app].freeze
+    validates :scope, inclusion: { in: SCOPES }
+    validates :agent_name, :subject, :content, presence: true
+
+    scope :active, -> { where(status: "active") }
+
+    # Write-through with supersession. attribute nil = free-form note about the
+    # subject (accumulates); attribute present = the triple's slot (supersedes).
+    def self.remember!(agent_name:, subject:, content:, attribute: nil, scope: "agent", turn: nil)
+      transaction do
+        record = create!(agent_name:, scope:, subject: subject.to_s.strip.downcase,
+                         attribute_name: attribute.presence&.strip&.downcase, content:,
+                         session_id: turn&.session_id, turn_id: turn&.id)
+        if record.attribute_name
+          active.where(agent_name:, scope:, subject: record.subject, attribute_name: record.attribute_name)
+                .where.not(id: record.id)
+                .update_all(status: "superseded", superseded_by_id: record.id, updated_at: Time.current)
+        end
+        record
+      end
+    end
+
+    # What an agent can see: its own memories + app-shared ones. Subject-matched
+    # first (when subjects given), then most recent.
+    def self.recall(agent_name:, subjects: [], limit: 10)
+      visible = active.where("agent_name = :a OR scope = 'app'", a: agent_name)
+      if subjects.any?
+        keys = subjects.map { |s| s.to_s.strip.downcase }
+        matched = visible.where(subject: keys).order(created_at: :desc).limit(limit).to_a
+        rest = visible.where.not(subject: keys).order(created_at: :desc).limit(limit - matched.size)
+        matched + rest
+      else
+        visible.order(created_at: :desc).limit(limit).to_a
+      end
+    end
+
+    def to_line
+      head = attribute_name ? "#{subject} · #{attribute_name}: " : "#{subject}: "
+      head + content
+    end
+  end
+end

data/app/models/silas/session.rb

@@ -19,15 +19,17 @@ module Silas
     end
 
     # Enqueue the next turn. One active turn per session — the partial unique
-    # index is the backstop; this is the friendly front door.
-    def continue(input:)
+    # index is the backstop; this is the friendly front door. enqueue: false
+    # creates the turn without scheduling it (callers that drive it themselves,
+    # e.g. an awaited handoff running the loop inline).
+    def continue(input:, enqueue: true)
       if active_turn
         raise TurnInProgressError, "session #{id} already has an active turn (##{active_turn.index})"
       end
 
       next_index = (turns.maximum(:index) || -1) + 1
       turn = turns.create!(index: next_index, input: input)
-      AgentLoopJob.perform_later(turn.id)
+      AgentLoopJob.perform_later(turn.id) if enqueue
       turn
     rescue ActiveRecord::RecordNotUnique
       raise TurnInProgressError, "session #{id} already has an active turn"

data/app/models/silas/tool_invocation.rb

@@ -35,6 +35,7 @@ module Silas
     # in-doubt invocation, approval means "it did not run — re-execute".
     def approve!(by: nil)
       assert_parked!
+      assert_turn_resumable!
       update!(status: "pending", approval_state: "approved", approved_by: by)
       resume_turn!
     end
@@ -45,6 +46,7 @@ module Silas
     # abandon" — the operator-supplied reason becomes the recorded outcome.
     def decline!(reason:, by: nil)
       assert_parked!
+      assert_turn_resumable!
       update!(status: "failed", approval_state: "declined", approved_by: by,
               decline_reason: reason, result: { "denied" => reason })
       resume_turn!
@@ -68,8 +70,18 @@ module Silas
       raise Error, "invocation #{id} is not awaiting approval (state: #{approval_state.inspect})"
     end
 
+    # A failed turn must never be zombie-resumed by a stale approval card:
+    # force-fail paths expire approvals first, but a card already rendered in
+    # someone's browser can still POST — the verdict must land on a live turn.
+    def assert_turn_resumable!
+      return unless turn.reload.failed?
+
+      raise Error, "turn #{turn.id} already failed (#{turn.failure_reason}) — " \
+                   "this approval can no longer resume it"
+    end
+
     def resume_turn!
-      return if turn.reload.canceled? # a canceled turn never zombie-resumes
+      return if turn.reload.canceled? || turn.failed? # settled turns never zombie-resume
       return if turn.tool_invocations.where(approval_state: "required").exists?
 
       turn.update!(status: "queued")

data/app/models/silas/turn.rb

@@ -17,6 +17,7 @@ module Silas
 
     ACTIVE_STATUSES.each { |s| define_method(:"#{s}?") { status == s } }
     def completed? = status == "completed"
+    def failed?    = status == "failed"
     def active?    = ACTIVE_STATUSES.include?(status)
     def parked?    = status == "waiting" || status == "in_doubt"
 

data/app/views/layouts/silas/inbox.html.erb

@@ -58,6 +58,7 @@
     .step::before { content: ""; position: absolute; left: -5px; top: 6px; width: 8px; height: 8px;
       border-radius: 50%; background: var(--accent); }
     .step-text { margin: 2px 0; }
+    .step-live { white-space: pre-wrap; }
     .tool { background: var(--grey-bg); border-radius: 10px; padding: 8px 10px; margin: 6px 0; font-size: 13px; }
     .tool code { font-family: var(--mono); }
     pre { font-family: var(--mono); font-size: 12px; background: var(--grey-bg); border-radius: 8px;
@@ -73,7 +74,19 @@
       padding: 8px; margin: 8px 0; font: inherit; background: var(--panel); color: var(--ink); resize: vertical; }
     form.inline { display: inline; }
     .cost { font-family: var(--mono); font-size: 12px; color: var(--muted); }
+    .composer textarea { width: 100%; border: 1px solid var(--line); border-radius: 10px;
+      padding: 10px 12px; font: inherit; background: var(--panel); color: var(--ink); resize: vertical; }
+    .composer textarea:focus { outline: 2px solid var(--accent); outline-offset: -1px; }
+    .composer-row { display: flex; align-items: center; justify-content: space-between; gap: 8px; margin-top: 8px; }
+    .btn.send { background: var(--accent); color: #fff; }
+    select.composer-agent { border: 1px solid var(--line); border-radius: 8px; padding: 6px 8px;
+      font: inherit; background: var(--panel); color: var(--ink); margin-bottom: 8px; }
     .flash { background: var(--red-bg); color: var(--red); padding: 10px 12px; border-radius: 10px; margin-bottom: 12px; }
+    .flash-notice { background: var(--green-bg); color: var(--green); }
+    .btn-cancel { border: 1px solid var(--red); background: transparent; color: var(--red);
+      border-radius: 8px; padding: 2px 10px; font-size: 12px; font-weight: 600; cursor: pointer; margin-left: auto; }
+    pre.error { background: var(--red-bg); color: var(--red); }
+    pre.args { opacity: 0.85; }
     .empty { text-align: center; color: var(--muted); padding: 48px 0; }
     .agent-filter { display: flex; gap: 6px; flex-wrap: wrap; margin-bottom: 14px; }
     .agent-filter .chip { font-size: 12px; padding: 3px 10px; border: 1px solid #d9dce1;
@@ -89,6 +102,7 @@
       <% if content_for?(:header_extra) %><%= yield :header_extra %><% end %>
     </header>
     <% if flash[:alert] %><div class="flash"><%= flash[:alert] %></div><% end %>
+    <% if flash[:notice] %><div class="flash flash-notice"><%= flash[:notice] %></div><% end %>
     <%= yield %>
   </div>
 </body>

data/app/views/silas/inbox/invocations/_invocation.html.erb

@@ -2,10 +2,26 @@
   <div>
     <code><%= invocation.tool_name %></code>
     <%= status_pill(invocation.awaiting_approval? ? "required" : invocation.status) %>
+    <%# The audit line — who held the lever, and why it moved. %>
+    <% if invocation.approval_state == "approved" && invocation.approved_by.present? %>
+      <span class="muted">approved by <%= invocation.approved_by %></span>
+    <% elsif invocation.approval_state == "declined" %>
+      <span class="muted">declined<%= " by #{invocation.approved_by}" if invocation.approved_by.present? %><%= " — “#{invocation.decline_reason}”" if invocation.decline_reason.present? %></span>
+    <% elsif invocation.approval_state == "expired" %>
+      <span class="muted">approval expired unanswered</span>
+    <% end %>
   </div>
   <% if invocation.awaiting_approval? %>
     <%= render "silas/inbox/invocations/approval_card", invocation: invocation %>
-  <% elsif invocation.result.present? %>
-    <pre><%= pretty_args(invocation.result) %></pre>
+  <% else %>
+    <%# What the agent passed — the question an audit surface must answer. %>
+    <% if invocation.arguments.present? %>
+      <pre class="args"><%= pretty_args(invocation.arguments) %></pre>
+    <% end %>
+    <% if invocation.error.present? %>
+      <pre class="error"><%= invocation.error %></pre>
+    <% elsif invocation.result.present? %>
+      <pre><%= pretty_args(invocation.result) %></pre>
+    <% end %>
   <% end %>
 </div>