silas 0.1.7 → 0.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: ad5ce26e72a73ea83df134c187f8c8dedcfcc35a65f20493f3095abfbfaa7ed8
-  data.tar.gz: ab1989850b2b8c881da660824dcad3f71159cfffcd8648901ec2a06385d8c294
+  metadata.gz: 1f804f46eccb34c27515be306e2697345f3be7e0ad3479aeafb05f3ca9e5e54b
+  data.tar.gz: 63a99caaeebb60133423d0d73669eff7074232262743764ec0d9d7d38f7b2012
 SHA512:
-  metadata.gz: fb5da2cdb854533bf68a761582063e8c5b22c2e40fc02cab05240d4ea199554da317bb0509398c81923a312c7b43773834d354ffb6391be549a6254329e3b995
-  data.tar.gz: 57e53d9a3c5b438b941cd599ba805c2c210e303d6362599d757b58b907ea10b9401cbf918cd909d1c53590d8fee4cc9e0fef8a8fb5ccb422c26db5e0abaaf43a
+  metadata.gz: bb45b5ca774d80cdd2c584851114204eb123dd714a94264a851699ea24955fa8eefba4b1897e1924a91a484f64c9746bc625e007652fdc8a71e096425e7a9882
+  data.tar.gz: 707d7857de1f2fba1e4e9327e9c32f71e7282c4dd2cfe739cb6aea98904cc805634f0ce70fd4353c5d580ea9f521d79e9581621d8f9b321216e9e00c058ba3b8

data/CHANGELOG.md

@@ -1,5 +1,98 @@
 # Changelog
 
+## 0.2.0 (unreleased)
+
+- **Token streaming, end to end.** The engine seam's `&on_event` block — dead
+  code since 0.1.0 — is live: the `:ruby_llm` engine streams the model
+  response (`chat.complete` with a block; the assembled message is identical
+  to the sync path, so durability semantics are untouched), `StepRunner`
+  coalesces text deltas into ~10Hz `"silas.delta"` notifications
+  (`Silas::DeltaBuffer`) carrying the accumulated text, and two subscribers
+  render them: the inbox trace (synchronous Turbo `broadcast_update_to` into a
+  stable per-step target — crash-restream overwrites, never duplicates) and
+  the `silas:chat` REPL (tokens print as they arrive). Deltas are decoration
+  over the authoritative rows: never persisted, never fed to the model, and a
+  replayed step emits none. `around_model_call` hooks keep their existing
+  contract and can no longer swallow the stream.
+- **Onboarding fixes.** The generated `bin/ci` can now actually fail on app
+  tests (it silently swallowed them with `|| true`); the generated initializer
+  shows every option the next-steps mention (`inbox_auth`, `sandbox`,
+  `memory_approval`, `model_prices`, `eval_dir`, `approval_ttl`) and defaults
+  to `claude-sonnet-5` instead of handing a first run the most expensive model
+  with no budget set; the rescuer's `recurring.yml` entry is now **idempotent
+  and environment-aware** (injected under every deployable env block —
+  staging included — never blind-appended into whatever block ends the file,
+  never duplicated on a re-run); a missing provider API key is caught **at
+  boot** with the exact fix (warns in development, raises `BootGuardError` in
+  production); and the unsafe Async-adapter warning **raises in production**,
+  where running agents on it silently voids the durability contract.
+- **Model-call resilience: transient provider errors retry from the
+  checkpoint; nothing ever strands in `running`.** Previously a single
+  429/529/timeout failed the loop job permanently and invisibly — the turn sat
+  in `running` forever with no retry and no signal. Now:
+  `resume_errors_after_advancing = false` on the loop job (Active Job
+  Continuations otherwise swallow errors raised after a checkpoint and
+  self-resume unboundedly, bypassing `retry_on` — verified against activejob
+  8.1); transient classes (`RateLimitError`, `OverloadedError`,
+  `ServiceUnavailableError`, `ServerError`, Faraday timeouts) retry with
+  polynomial backoff + jitter and **resume from the last completed step**;
+  exhaustion and permanent rejections (`UnauthorizedError`,
+  `PaymentRequiredError`, …) expire pending approvals and fail the turn
+  loudly. The rescuer now also sweeps **stranded turns** — a loop job that
+  died with an error outside the retry list fails its turn
+  (`reason: "job_failed"`) instead of leaving it running forever. Stale
+  approval cards can no longer zombie-resume a failed turn (`approve!` /
+  `decline!` refuse; `resume_turn!` guards).
+- **The inbox now shows the audit trail it exists to provide.** Tool
+  `arguments` render for every settled invocation (not just parked ones), a
+  failed tool shows its recorded `error` instead of a bare red pill, and
+  `approved_by` / `decline_reason` render on settled approvals — who held the
+  lever, and why it moved. Active turns gain a **Cancel** button (running
+  turns flag for a step-boundary cancel, parked turns cancel immediately),
+  and the "N awaiting approval" badge is now a link filtering the session
+  list to what needs you (`?pending=1`).
+- **Web chat in the inbox.** The session page gains a composer (`POST
+  .../sessions/:id/turns`) and the index a start-a-session form (with a named
+  agent picker) — the browser is now a first-class conversational surface, not
+  just approve/decline. Writes ride `authenticate_write!` exactly like
+  approvals; a turn-in-progress renders as an inline alert; web-chat sessions
+  stay `channel: nil` ("direct"), so no outbound delivery jobs are enqueued.
+
+- **`approval :once` is now scoped to (tool, arguments), not tool name alone.**
+  Name-only matching was a footgun: approving a £5 refund silently
+  auto-approved a £5,000 refund later in the same session. Identical repeat
+  calls still skip re-approval; different arguments park again. Graded gates
+  belong in an approval lambda.
+- **The ledger's checkpoint guard moved to `IsolatedExecutionState`** (from
+  `Thread.current[]`, which is fiber-local) — it now follows the app's
+  configured isolation level exactly like agent scopes, surviving into
+  internally-created fibers where the old flag silently vanished. Nested
+  ledger transactions now save/restore the guard instead of clearing it (the
+  old `ensure` opened a checkpoint-guard hole for the rest of the outer
+  transaction).
+- **Removed the `:agent_sdk` engine** (the `claude -p` subprocess integration).
+  Its differentiating rationale — running on a Claude subscription plan instead
+  of API credits — was structurally unreachable: `--bare` was hardcoded and the
+  engine raised without `ANTHROPIC_API_KEY` regardless of `config.auth`, so the
+  OAuth path could never execute a turn. What remained was a second engine with
+  weaker guarantees on every axis (exactly-once only *within* a run,
+  `approval :never` tools only, fail-closed on any mid-subprocess kill) that
+  made the durability contract conditional. One production path now:
+  `:ruby_llm`.
+  - `config.engine = :agent_sdk` raises a clear `BootGuardError` at configure
+    time. `config.auth` and the `agent_sdk_*` options are warning no-ops for
+    this release (hard removal in 0.3) — an existing initializer won't crash.
+  - The in-process MCP server (`Silas::Mcp::Server`/`Handler`) **survives the
+    cut** — it is the seam for a planned "mount your agent's tools as an MCP
+    server" feature — with its own integration spec. Its bind host moved from
+    `config.agent_sdk_mcp_host` to `config.mcp_server_host`.
+  - New migration drops `silas_turns.cli_session_id` and
+    `silas_turns.mcp_token` (the latter was write-only; tokens are minted and
+    compared in memory). Run `bin/rails silas:install:migrations db:migrate`.
+  - `Silas::Engines::Base.loop_ownership` is gone — every engine executes one
+    model call per step under the framework-owned loop. Custom engines that
+    merely inherited it are unaffected.
+
 ## 0.1.7
 
 - **Memory — graph-shaped, not a graph database.** New `silas_memories` table:

data/README.md

@@ -88,6 +88,13 @@ hundreds of times per release (results in `chaos_host/results/`):
 - **Approvals park at zero compute** — the job exits; approving enqueues a fresh
   one that replays completed work from rows, never re-calling the model or
   re-running tools. Parks expire (default 7 days) rather than ghosting forever.
+- **Transient model errors retry from the checkpoint.** A rate limit,
+  overload, or timeout backs off and retries the job — and the continuation
+  resumes from the last completed step, never re-running completed work.
+  Exhausted retries and permanent rejections (bad key, bad request) expire
+  pending approvals and fail the turn loudly. **A turn can never sit in
+  `running` forever**: the rescuer also fails turns stranded by a loop job
+  that died outside the retry list.
 - **The rescuer is part of the contract.** Solid Queue marks a dead worker's
   jobs failed and nothing retries them; the installer wires
   `Silas::DeadJobRescuerJob` as a recurring task (every 30s). Recovery time ≈
@@ -96,19 +103,19 @@ hundreds of times per release (results in `chaos_host/results/`):
   deploy that changes tools/skills mid-turn fails the turn loudly
   (`NondeterminismError`) instead of resuming into a different agent.
 
-## Engines
+## Engine
 
-Inference is one pluggable seam (`config.engine`):
+Inference is one pluggable seam (`config.engine`): `:ruby_llm` — API-key auth
+via [RubyLLM](https://rubyllm.com), any provider it supports — is the default
+and the production path. Compose resilience via `config.around_model_call`, or
+swap in any object responding to `#execute_step` (the eval harness and the
+chaos tests do exactly that).
 
-- `:ruby_llm` — API-key auth via [RubyLLM](https://rubyllm.com); any provider it
-  supports. Canonical, production mode. Compose resilience via
-  `config.around_model_call`.
-- `:agent_sdk` — a `claude -p` subprocess runs the whole turn, calling back into
-  your tools over an in-worker HTTP MCP endpoint whose `tools/call` goes through
-  the same Ledger. Always `--bare` (API-key auth only; the boot guard raises if
-  OAuth is configured with `ANTHROPIC_API_KEY` present, and if the key is missing
-  in api_key mode). v1 is honestly weaker than `:ruby_llm`: exactly-once *within*
-  a run, `approval :never` tools only, and fail-closed on a mid-subprocess kill.
+> The experimental `:agent_sdk` engine (a `claude -p` subprocess) was removed
+> in 0.2: its subscription-auth rationale was structurally unreachable, and it
+> carried weaker guarantees than `:ruby_llm` on every axis. Its in-process MCP
+> server survives and returns as a first-class *mount your tools as MCP*
+> feature.
 
 ## Sandbox: run untrusted code with hermetic
 
@@ -190,12 +197,28 @@ An agent is reached by more than a method call:
   approvals render as Slack buttons / signed email links that call the same
   `approve!`/`decline!`. Outbound delivery is idempotent and off the durable loop.
 
+## Streaming
+
+Turns stream. The `:ruby_llm` engine emits text deltas as the model responds:
+`bin/rails silas:chat` prints tokens as they arrive, and the inbox trace
+renders them live over Turbo (coalesced to ~10Hz). Deltas are decoration over
+the durable rows — never persisted, never fed back to the model, and a
+replayed step renders from its row with no deltas at all, so streaming adds
+zero risk to the durability contract. Custom sinks subscribe to the
+`"silas.delta"` notification (`{ session_id:, turn_id:, step_id:, step_index:,
+text: }`, where `text` is the accumulated string so far — filter by ids;
+notifications are process-global).
+
 ## The inbox
 
 Mount the engine (the generator does this) and a live inbox appears at
-`/silas/inbox`: a session list, a live step-trace that streams over Turbo
-Streams as the agent runs, approval cards whose Approve/Decline buttons call the
-exact same `approve!`/`decline!` as Slack and email, and per-session token/cost
+`/silas/inbox`: a session list, **web chat** (start a session or reply from
+the browser — same durable loop, no separate surface), a live step-trace that
+streams tokens over Turbo Streams as the agent runs, approval cards whose
+Approve/Decline buttons call the exact same `approve!`/`decline!` as Slack and
+email, a full **audit trail** (every tool call's arguments and its result or
+recorded error; who approved; who declined and why), **cancel** on active
+turns (honored at the next step boundary), and per-session token/cost
 accounting. It's **deny-by-default** — invisible until you wire auth:
 
 ```ruby

data/app/controllers/silas/inbox/sessions_controller.rb

@@ -1,9 +1,20 @@
 module Silas
   module Inbox
     class SessionsController < BaseController
+      before_action :authenticate_write!, only: :create
+
       def index
         @sessions = Silas::Session.order(created_at: :desc).limit(100)
         @sessions = @sessions.where(agent_name: params[:agent]) if params[:agent].present?
+        if params[:pending].present? # the "N awaiting approval" badge drills into this
+          # Subquery, not joins+distinct: DISTINCT over silas_sessions.* trips
+          # on the json metadata column (PG json has no equality operator).
+          @sessions = @sessions.where(
+            id: Silas::Turn.joins(:tool_invocations)
+                           .where(silas_tool_invocations: { approval_state: "required" })
+                           .select(:session_id)
+          )
+        end
         @agent_names = Silas::Session.distinct.pluck(:agent_name).sort
         @pending_total = Silas::ToolInvocation.where(approval_state: "required").count
       end
@@ -13,6 +24,19 @@ module Silas
         @turns = @session.turns.includes(steps: :tool_invocations)
         @cost = Silas::Inbox::Cost.for_session(@session)
       end
+
+      # Start a session from the browser. channel stays nil ("direct") — web
+      # chat is read live on the session page, not delivered outbound.
+      def create
+        input = params[:input].to_s.strip
+        return redirect_to inbox_sessions_path, alert: "Type a message first." if input.empty?
+
+        handle = params[:agent].present? ? Silas.agent(params[:agent]) : Silas.agent
+        started = handle.start(input: input)
+        redirect_to inbox_session_path(started)
+      rescue Silas::Error => e
+        redirect_to inbox_sessions_path, alert: e.message
+      end
     end
   end
 end

data/app/controllers/silas/inbox/turns_controller.rb

@@ -0,0 +1,32 @@
+module Silas
+  module Inbox
+    # The web composer: append a turn to an existing session. Same write-auth
+    # gate as approve/decline. Deliberately thin — the turn runs on the durable
+    # loop and the model's after_commit broadcasts render it live, so this
+    # controller only enqueues and redirects.
+    class TurnsController < BaseController
+      before_action :authenticate_write!
+
+      def create
+        agent_session = Silas::Session.find(params[:session_id])
+        input = params[:input].to_s.strip
+        return redirect_to inbox_session_path(agent_session), alert: "Type a message first." if input.empty?
+
+        agent_session.continue(input: input)
+        redirect_to inbox_session_path(agent_session)
+      rescue Silas::TurnInProgressError
+        redirect_to inbox_session_path(agent_session), alert: "A turn is already running — wait for it to settle."
+      end
+
+      # Cancel from the trace. Running turns are flagged and honored at the
+      # next step boundary (the same safe point as budgets); parked/queued
+      # turns cancel immediately.
+      def cancel
+        turn = Silas::Turn.find(params[:id])
+        outcome = turn.cancel!(reason: "canceled from inbox by #{current_actor}")
+        notice = outcome == :cancel_requested ? "Cancel requested — honored at the next step boundary." : "Turn canceled."
+        redirect_to inbox_session_path(turn.session_id), notice: notice
+      end
+    end
+  end
+end

data/app/jobs/silas/agent_loop_job.rb

@@ -12,10 +12,51 @@ module Silas
   class AgentLoopJob < ActiveJob::Base
     include ActiveJob::Continuable
 
+    # Errors must reach retry_on. By default Continuable swallows any
+    # StandardError raised after a checkpoint and silently self-resumes —
+    # unbounded invisible retries that bypass attempts/wait/jitter entirely
+    # (verified against activejob 8.1: the around_perform rescue runs before
+    # rescue_with_handler). Checkpoints still survive retry_on's re-enqueues —
+    # continuation state rides the job payload — so a retried execution skips
+    # completed steps. Isolation interrupts are rescued separately and are
+    # unaffected by this flag. Do NOT reach for max_resumptions as an error
+    # bound: with isolate_steps on, every isolated step consumes one
+    # resumption by design.
+    self.resume_errors_after_advancing = false
+
     self.resume_options = { wait: 0 } # spike: default 5s wait makes turns crawl
 
     queue_as { Silas.config.queue_name }
 
+    # Transient provider trouble: back off and retry; the continuation resumes
+    # from the last completed step. Exhaustion fails the turn LOUDLY — a turn
+    # must never strand in "running". (Never retry_on StandardError: it would
+    # catch Continuation::Error subclasses and retry a structurally broken job
+    # forever.)
+    retry_on ::RubyLLM::RateLimitError, ::RubyLLM::OverloadedError,
+             ::RubyLLM::ServiceUnavailableError, ::RubyLLM::ServerError,
+             ::Faraday::TimeoutError, ::Faraday::ConnectionFailed,
+             wait: :polynomially_longer, attempts: 5, jitter: 0.15 do |job, error|
+      fail_turn(job, error)
+    end
+
+    # Permanent provider rejections: retrying cannot help. Fail the turn now.
+    discard_on ::RubyLLM::UnauthorizedError, ::RubyLLM::PaymentRequiredError,
+               ::RubyLLM::ForbiddenError, ::RubyLLM::BadRequestError do |job, error|
+      fail_turn(job, error)
+    end
+
+    # The force-fail path: expire approvals FIRST so no stale card can
+    # zombie-resume the failed turn, then finish loudly.
+    def self.fail_turn(job, error)
+      turn = Turn.find_by(id: job.arguments.first)
+      return unless turn&.active?
+
+      turn.expire_pending_approvals!("turn failed: model error")
+      turn.finish!(:failed, reason: "model_error")
+      Rails.logger&.error("[silas] turn #{turn.id} failed on #{error.class}: #{error.message}")
+    end
+
     def perform(turn_id)
       turn = Turn.find(turn_id)
       return if turn.completed? || %w[failed canceled].include?(turn.status)
@@ -26,26 +67,17 @@ module Silas
       # staff member never wakes up holding the root agent's tools.
       scope = Silas.scope_for_session(turn.session)
       if scope
-        Silas.with_agent_scope(scope) { drive(turn) }
+        Silas.with_agent_scope(scope) { run_turn(turn) }
       else
-        drive(turn)
+        run_turn(turn)
       end
     end
 
     private
 
-    def drive(turn)
-      if Silas.resolved_engine.class.loop_ownership == :engine
-        perform_engine_owned(turn)
-      else
-        perform_framework_owned(turn)
-      end
-    end
-
-
-    # :ruby_llm — the framework drives the loop, one model call per step, tools
-    # executed through the Ledger. The determinism constraints live here.
-    def perform_framework_owned(turn)
+    # The framework drives the loop: one model call per step, tools executed
+    # through the Ledger. The determinism constraints live here.
+    def run_turn(turn)
       step :prepare, isolated: isolate? do
         Ledger.assert_no_checkpoint!
         turn.update!(status: "running", job_id: job_id, started_at: turn.started_at || Time.current)
@@ -95,35 +127,6 @@ module Silas
       end
     end
 
-    # :agent_sdk — Claude Code owns the loop; one isolated :run step wraps the
-    # whole subprocess (one Continuation checkpoint per invocation). Same
-    # durable shell, same queue/rescuer/single-active-turn invariants.
-    def perform_engine_owned(turn)
-      step :prepare, isolated: isolate? do
-        Ledger.assert_no_checkpoint!
-        turn.update!(status: "running", job_id: job_id, started_at: turn.started_at || Time.current)
-        Instructions.snapshot!(turn)
-        Step.find_or_create_by!(turn: turn, index: 0) # anchor step exists before the MCP thread needs it
-      end
-
-      # Cancellation for engine-owned turns is honored only BEFORE the
-      # subprocess starts — a running claude -p is not aborted mid-flight (v1).
-      if turn.reload.cancel_requested_at
-        turn.finish!(:canceled, reason: "canceled")
-        return
-      end
-
-      outcome = nil
-      step :run, isolated: isolate? do
-        Ledger.assert_no_checkpoint!
-        outcome = SubprocessRunner.call(turn)
-      end
-
-      step :finalize do
-        turn.finish!(:completed) if outcome == :terminal
-      end
-    end
-
     def isolate? = Silas.config.isolate_steps
   end
 end

data/app/jobs/silas/dead_job_rescuer_job.rb

@@ -20,12 +20,33 @@ module Silas
 
       rescued = 0
       SolidQueue::FailedExecution.includes(:job).find_each do |failed|
-        next unless DEAD_PROCESS_ERRORS.include?(failed.error&.dig("exception_class"))
-
-        failed.retry
-        rescued += 1
+        if DEAD_PROCESS_ERRORS.include?(failed.error&.dig("exception_class"))
+          failed.retry
+          rescued += 1
+        elsif failed.job&.class_name == "Silas::AgentLoopJob"
+          fail_stranded_turn(failed)
+        end
       end
       rescued
     end
+
+    private
+
+    # A loop job that failed with a NON-dead-process error (something outside
+    # AgentLoopJob's retry list — a NoMethodError in a tool, an AR blip) will
+    # never be retried by anyone. Without this sweep its turn sits in
+    # "running" forever: not failed, not parked, invisible as broken. The
+    # failed execution stays in Solid Queue for forensics; the TURN is failed
+    # loudly with its approvals expired.
+    def fail_stranded_turn(failed)
+      turn = Turn.find_by(id: failed.job.arguments&.dig("arguments", 0))
+      return unless turn&.active?
+
+      exception = failed.error&.dig("exception_class")
+      turn.expire_pending_approvals!("turn failed: #{exception}")
+      turn.finish!(:failed, reason: "job_failed")
+      Rails.logger&.error("[silas] turn #{turn.id} failed: its loop job died with " \
+                          "#{exception} — #{failed.error&.dig('message')}")
+    end
   end
 end

data/app/models/silas/tool_invocation.rb

@@ -35,6 +35,7 @@ module Silas
     # in-doubt invocation, approval means "it did not run — re-execute".
     def approve!(by: nil)
       assert_parked!
+      assert_turn_resumable!
       update!(status: "pending", approval_state: "approved", approved_by: by)
       resume_turn!
     end
@@ -45,6 +46,7 @@ module Silas
     # abandon" — the operator-supplied reason becomes the recorded outcome.
     def decline!(reason:, by: nil)
       assert_parked!
+      assert_turn_resumable!
       update!(status: "failed", approval_state: "declined", approved_by: by,
               decline_reason: reason, result: { "denied" => reason })
       resume_turn!
@@ -68,8 +70,18 @@ module Silas
       raise Error, "invocation #{id} is not awaiting approval (state: #{approval_state.inspect})"
     end
 
+    # A failed turn must never be zombie-resumed by a stale approval card:
+    # force-fail paths expire approvals first, but a card already rendered in
+    # someone's browser can still POST — the verdict must land on a live turn.
+    def assert_turn_resumable!
+      return unless turn.reload.failed?
+
+      raise Error, "turn #{turn.id} already failed (#{turn.failure_reason}) — " \
+                   "this approval can no longer resume it"
+    end
+
     def resume_turn!
-      return if turn.reload.canceled? # a canceled turn never zombie-resumes
+      return if turn.reload.canceled? || turn.failed? # settled turns never zombie-resume
       return if turn.tool_invocations.where(approval_state: "required").exists?
 
       turn.update!(status: "queued")

data/app/models/silas/turn.rb

@@ -17,6 +17,7 @@ module Silas
 
     ACTIVE_STATUSES.each { |s| define_method(:"#{s}?") { status == s } }
     def completed? = status == "completed"
+    def failed?    = status == "failed"
     def active?    = ACTIVE_STATUSES.include?(status)
     def parked?    = status == "waiting" || status == "in_doubt"
 

data/app/views/layouts/silas/inbox.html.erb

@@ -58,6 +58,7 @@
     .step::before { content: ""; position: absolute; left: -5px; top: 6px; width: 8px; height: 8px;
       border-radius: 50%; background: var(--accent); }
     .step-text { margin: 2px 0; }
+    .step-live { white-space: pre-wrap; }
     .tool { background: var(--grey-bg); border-radius: 10px; padding: 8px 10px; margin: 6px 0; font-size: 13px; }
     .tool code { font-family: var(--mono); }
     pre { font-family: var(--mono); font-size: 12px; background: var(--grey-bg); border-radius: 8px;
@@ -73,7 +74,19 @@
       padding: 8px; margin: 8px 0; font: inherit; background: var(--panel); color: var(--ink); resize: vertical; }
     form.inline { display: inline; }
     .cost { font-family: var(--mono); font-size: 12px; color: var(--muted); }
+    .composer textarea { width: 100%; border: 1px solid var(--line); border-radius: 10px;
+      padding: 10px 12px; font: inherit; background: var(--panel); color: var(--ink); resize: vertical; }
+    .composer textarea:focus { outline: 2px solid var(--accent); outline-offset: -1px; }
+    .composer-row { display: flex; align-items: center; justify-content: space-between; gap: 8px; margin-top: 8px; }
+    .btn.send { background: var(--accent); color: #fff; }
+    select.composer-agent { border: 1px solid var(--line); border-radius: 8px; padding: 6px 8px;
+      font: inherit; background: var(--panel); color: var(--ink); margin-bottom: 8px; }
     .flash { background: var(--red-bg); color: var(--red); padding: 10px 12px; border-radius: 10px; margin-bottom: 12px; }
+    .flash-notice { background: var(--green-bg); color: var(--green); }
+    .btn-cancel { border: 1px solid var(--red); background: transparent; color: var(--red);
+      border-radius: 8px; padding: 2px 10px; font-size: 12px; font-weight: 600; cursor: pointer; margin-left: auto; }
+    pre.error { background: var(--red-bg); color: var(--red); }
+    pre.args { opacity: 0.85; }
     .empty { text-align: center; color: var(--muted); padding: 48px 0; }
     .agent-filter { display: flex; gap: 6px; flex-wrap: wrap; margin-bottom: 14px; }
     .agent-filter .chip { font-size: 12px; padding: 3px 10px; border: 1px solid #d9dce1;
@@ -89,6 +102,7 @@
       <% if content_for?(:header_extra) %><%= yield :header_extra %><% end %>
     </header>
     <% if flash[:alert] %><div class="flash"><%= flash[:alert] %></div><% end %>
+    <% if flash[:notice] %><div class="flash flash-notice"><%= flash[:notice] %></div><% end %>
     <%= yield %>
   </div>
 </body>

data/app/views/silas/inbox/invocations/_invocation.html.erb

@@ -2,10 +2,26 @@
   <div>
     <code><%= invocation.tool_name %></code>
     <%= status_pill(invocation.awaiting_approval? ? "required" : invocation.status) %>
+    <%# The audit line — who held the lever, and why it moved. %>
+    <% if invocation.approval_state == "approved" && invocation.approved_by.present? %>
+      <span class="muted">approved by <%= invocation.approved_by %></span>
+    <% elsif invocation.approval_state == "declined" %>
+      <span class="muted">declined<%= " by #{invocation.approved_by}" if invocation.approved_by.present? %><%= " — “#{invocation.decline_reason}”" if invocation.decline_reason.present? %></span>
+    <% elsif invocation.approval_state == "expired" %>
+      <span class="muted">approval expired unanswered</span>
+    <% end %>
   </div>
   <% if invocation.awaiting_approval? %>
     <%= render "silas/inbox/invocations/approval_card", invocation: invocation %>
-  <% elsif invocation.result.present? %>
-    <pre><%= pretty_args(invocation.result) %></pre>
+  <% else %>
+    <%# What the agent passed — the question an audit surface must answer. %>
+    <% if invocation.arguments.present? %>
+      <pre class="args"><%= pretty_args(invocation.arguments) %></pre>
+    <% end %>
+    <% if invocation.error.present? %>
+      <pre class="error"><%= invocation.error %></pre>
+    <% elsif invocation.result.present? %>
+      <pre><%= pretty_args(invocation.result) %></pre>
+    <% end %>
   <% end %>
 </div>

data/app/views/silas/inbox/sessions/index.html.erb

@@ -1,5 +1,7 @@
 <% content_for :header_extra do %>
-  <% if @pending_total.positive? %><span class="badge"><%= @pending_total %> awaiting approval</span><% end %>
+  <% if @pending_total.positive? %>
+    <%= link_to "#{@pending_total} awaiting approval", inbox_sessions_path(pending: 1), class: "badge" %>
+  <% end %>
 <% end %>
 
 <% if @agent_names && @agent_names.size > 1 %>
@@ -12,8 +14,24 @@
   </div>
 <% end %>
 
+<div class="card composer">
+  <%= form_with url: inbox_sessions_path do |f| %>
+    <% roster = Silas.named_agent_scopes.keys.sort %>
+    <% if roster.any? %>
+      <%= f.select :agent, [ [ "agent (root)", "" ] ] + roster.map { |a| [ a, a ] },
+            {}, class: "composer-agent" %>
+    <% end %>
+    <%= f.text_area :input, rows: 2, required: true, class: "composer-input",
+          placeholder: "Start a new session…" %>
+    <div class="composer-row">
+      <span></span>
+      <%= f.submit "Start session", class: "btn send" %>
+    </div>
+  <% end %>
+</div>
+
 <% if @sessions.empty? %>
-  <div class="empty">No agent sessions yet.</div>
+  <div class="empty">No agent sessions yet — start one above.</div>
 <% else %>
   <% @sessions.each do |session| %>
     <%= link_to inbox_session_path(session), class: "card session-row" do %>

data/app/views/silas/inbox/sessions/show.html.erb

@@ -18,3 +18,14 @@
 <div id="silas-turns">
   <%= render partial: "silas/inbox/turns/turn", collection: @turns, as: :turn %>
 </div>
+
+<div class="card composer">
+  <%= form_with url: inbox_session_turns_path(@session) do |f| %>
+    <%= f.text_area :input, rows: 2, required: true, class: "composer-input",
+          placeholder: "Message #{@session.agent_name}…" %>
+    <div class="composer-row">
+      <span class="muted"><%= "a turn is running — sending will queue behind it" if @session.active_turn %></span>
+      <%= f.submit "Send", class: "btn send" %>
+    </div>
+  <% end %>
+</div>

data/app/views/silas/inbox/steps/_step.html.erb

@@ -1,6 +1,11 @@
 <div class="step" id="<%= dom_id(step) %>">
+  <%# The text container is unconditional: silas-step-<id>-text is the live
+      delta target. While the step runs, deltas replace its innerHTML; the
+      completed row render (this partial, re-broadcast) supersedes them. %>
   <% if (text = step_text(step)) %>
-    <div class="step-text"><%= simple_format(text) %></div>
+    <div class="step-text" id="silas-step-<%= step.id %>-text"><%= simple_format(text) %></div>
+  <% else %>
+    <div class="step-text step-live" id="silas-step-<%= step.id %>-text"></div>
   <% end %>
   <div id="silas-step-<%= step.id %>-tools">
     <%= render partial: "silas/inbox/invocations/invocation", collection: step.tool_invocations, as: :invocation %>

data/app/views/silas/inbox/turns/_header.html.erb

@@ -1,6 +1,13 @@
 <div class="turn-head">
   <span class="turn-input"><%= truncate(turn.input, length: 90) %></span>
   <%= status_pill(turn.status) %>
+  <% if turn.active? && !turn.cancel_requested_at %>
+    <%= form_with url: cancel_inbox_turn_path(turn), method: :post, class: "inline" do %>
+      <button class="btn-cancel" title="Honored at the next step boundary">Cancel</button>
+    <% end %>
+  <% elsif turn.cancel_requested_at && turn.active? %>
+    <span class="muted">cancel requested…</span>
+  <% end %>
 </div>
 <% if turn.failure_reason.present? %>
   <div class="muted">failed: <%= turn.failure_reason %></div>

data/config/routes.rb

@@ -8,7 +8,12 @@ Silas::Engine.routes.draw do
 
   namespace :inbox do
     root to: "sessions#index"
-    resources :sessions, only: %i[index show]
+    resources :sessions, only: %i[index show create] do
+      resources :turns, only: :create
+    end
+    resources :turns, only: [] do
+      member { post :cancel }
+    end
     resources :invocations, only: [] do
       member do
         post :approve

data/db/migrate/20260724000001_drop_agent_sdk_columns_from_silas_turns.rb

@@ -0,0 +1,9 @@
+class DropAgentSdkColumnsFromSilasTurns < ActiveRecord::Migration[8.1]
+  # The :agent_sdk engine was removed in 0.2. cli_session_id was its fail-closed
+  # resume marker; mcp_token was written by Mcp::Server but read by nothing (the
+  # token is minted and compared in memory).
+  def change
+    remove_column :silas_turns, :cli_session_id, :string
+    remove_column :silas_turns, :mcp_token, :string
+  end
+end