@caupulican/pi-adaptative 0.80.85 → 0.80.88

package/CHANGELOG.md

@@ -1,4 +1,163 @@
-## [Unreleased]
+## [0.80.88] - 2026-07-02
+
+## [0.80.87] - 2026-07-02
+
+### Added
+
+- Added an opt-in Context / Prompt Policy setting that stubs stale, artifact-backed grep/find tool output
+  in the model-visible prompt only (never the transcript) once configured retention-window and character
+  thresholds are exceeded. Configurable via the Context / Prompt Policy settings submenu; default disabled.
+- Added an opt-in Context / Memory Retrieval setting that searches local Pi OKF memory documents each turn
+  and can optionally surface a bounded, source-labeled evidence block in the model prompt (never the
+  transcript). Configurable via the Context / Memory Retrieval settings submenu, including a separate
+  "Include in prompt" toggle; both default disabled, and retrieval only ever queries the local provider.
+- Extended `context_audit` with a compact Memory retrieval / Prompt inclusion diagnostic section reporting
+  status and counts for the two settings above, without exposing any memory content, query text, or file
+  paths.
+- Added a `goal` tool that records the durable goal ledger (goal, requirements, evidence, and
+  progress/stall events) as session-persisted snapshots. This is the producer that drives the bounded
+  goal continuation loop and `/goal-continue`; without it the continuation runtime always read empty
+  state and could not continue. The tool is active by default and maps to the `memory_write` capability.
+- Added `/autonomy diagnostics`, an effectiveness dashboard summarizing recent model-router decisions,
+  current/spawned/daily cost totals, and, when present, the latest research, worker-delegation,
+  learning, and goal activity. It is additive to `/autonomy [status|off|safe|balanced|full]`.
+- Added the autonomous research lane runtime: an opt-in, read-only background research pass that runs
+  when the session goes idle with an active goal that has open requirements, executes one bounded
+  isolated completion through the (unwired-until-now) research capability/budget gate, and persists a
+  provenance-tagged evidence bundle plus a terminal lane record. Budgets cover cost per pass,
+  wall-clock time, findings/sources caps, and idle runs per session; failures/skips are recorded with
+  reason codes and never block or prompt the foreground. Research spend reports through spawned-usage
+  accounting with an idempotent per-lane report id. Configurable via the new Research Lane settings
+  submenu (default disabled; also requires autonomy mode on); `/autonomy research` triggers an
+  explicit pass. Live lanes now feed the previously-unset `activeLaneCount` in `/autonomy status`
+  snapshots, and `/autonomy diagnostics` shows research lane records, all evidence bundles, and the
+  last skip reason.
+- Added the bounded worker-delegation runtime piloting read-only scout workers: a new `delegate`
+  tool (active by default, mapped to the `delegate` capability, refusing with a reason until the
+  Worker Delegation setting is enabled) lets the foreground model hand one self-contained analysis
+  task to a worker running as a bounded isolated completion on a cheap model lane under a stripped
+  read-only envelope. Every result is validated through the existing `validateWorkerResult` parent
+  gate before acceptance, persisted as a worker-result snapshot plus a terminal lane record, marked
+  untrusted in the tool output, and cost-reported through spawned-usage accounting with an
+  idempotent per-lane report id. Budgets cover cost per worker and wall-clock time; delegation
+  lanes appear in `/autonomy diagnostics` and count toward the live `activeLaneCount`.
+- Added the learning apply/audit/rollback policy runtime: reflection-sourced durable writes now
+  route through the (previously unwired) learning gate, persist a `LearningDecision` snapshot per
+  write, and leave an audit record with a concrete rollback plan for every applied or proposed
+  change. With the new Learning Policy settings disabled (default) the legacy direct-apply
+  behavior is preserved — now fully audited; when enabled, single-session reflection cues become
+  proposals unless the configured confidence/observation thresholds and allowed layers
+  (memory-only by default) permit auto-apply. `/autonomy rollback <auditId>` (and
+  `AgentSession.rollbackLearningWrite`) executes the inverse memory operation or archives a
+  promoted skill, exactly once per change, and records a linked rollback audit. Audit records
+  appear in the `/autonomy diagnostics` learning family.
+- Added model-capability auto-detection so small open models (including sub-1B local models) stay
+  usable for chat: the harness derives a capability class from the model's own `contextWindow`
+  metadata — full (≥32k, unchanged), lean (≥16k, background-autonomy tools like `delegate` and
+  `context_audit` blocked), minimal (≥8k, tools reduced to read/bash/edit/write, background lanes
+  disabled), and chat (<8k, no tools at all). Filtering happens in `setActiveToolsByName`, so the
+  system prompt sheds the blocked tools' schemas and guidelines too; the unfiltered request is
+  remembered and restored when switching back to a larger model, with a visible notice on
+  downgrade. Idle goal auto-continuation and the research lane are gated off below 16k
+  (`model_context_too_small` in diagnostics), and lane output-token budgets scale to the lane
+  model's window. Metadata-first with defaults only when info is missing (unknown window keeps
+  full behavior); configurable via `modelCapability.mode` (`auto` default, `off`, or a forced
+  class).
+- Changed background-lane model resolution to inherit the session model the lane was shipped
+  from unless a lane-specific model is explicitly configured (the router's `cheapModel` no longer
+  implicitly redirects lanes) — single-model setups, e.g. one local open model, now run research
+  and scout workers on that same model.
+- Changed active resource profiles to strict least-privilege grants: when one or more profiles are
+  active, any authority-bearing resource kind (extensions, skills, prompts, tools, agents) that no
+  active profile explicitly mentions is denied outright — a defaults profile no longer loads the
+  full extension/tool surface. Grant-all must be explicit via `allow: ["*"]`; explicitly written
+  block-framed filters keep meaning "all except the listed"; themes are exempt; behavior without
+  an active profile is unchanged.
+- Changed profile denial to gate the disk reads themselves: skill files and prompt templates a
+  profile denies are never read from disk (extensions were already path-filtered before loading).
+  While a restrictive profile is active, denied skills/prompts consequently no longer appear in
+  resource listings; edit profiles with no restrictive profile active to see everything.
+- Added profile-shipped subagents: research and worker lanes accept a `profile` setting whose
+  model MUST be obeyed when set (unresolvable is a visible `no_lane_profile_model` skip, never a
+  fallback), whose soul and thinking level ship with the lane, and whose tool grants are recorded
+  on the lane's capability envelope. Generic lanes keep inheriting the session model.
+- Added a level-0 subagent system-prompt core (<300 tokens of non-negotiable rules) that survives
+  ANY prompt customization: lane settings (`systemPrompt`) and the delegate tool's new
+  `systemPrompt` input can erase and replace everything above it — so a big session model can
+  hand a small open model a minimal purpose-built prompt without shedding the safety floor.
+- Added `run_toolkit_script` (active by default, mapped to the `run_shell` capability): the
+  user's blessed daily-ops script registry (`settings.toolkit.scripts` — name, description,
+  aliases, uv/powershell/bash runner, danger flag) executed with a structural reliability
+  contract. Finding is a conservative registry lookup that NEVER guesses between near-neighbors
+  ("prepare db" vs "update-db" returns a shortlist instead of executing); the harness owns
+  invocation (fixed argv, no shell strings) and always returns exit code, stdout, and stderr —
+  a failed script is an error result by construction and can never look like success; scripts
+  flagged `danger` never run without an explicit `confirm: true`.
+- Added the `model_fitness` probe (tool + `/autonomy fitness <model> [trials]`): runs the real
+  research-lane, scout-worker, and routing-judge runners plus two heavy-lifter surfaces
+  (search-plan formulation, tool-call emission) against any registered model — local Ollama
+  models included — reporting parse/success rates, judge discrimination, mean latency,
+  tokens-per-second, and probe cost. Probe spend is cost-accounted; the tool is registered but
+  not default-active. An opt-in size-class bench (`PI_LOCAL_MODEL_BENCH=1`) asserts per-class
+  minimum bars for locally installed models.
+- Added a host-keyed fitness store (`<agentDir>/state/model-fitness.json`): every probe persists
+  its report under a hardware fingerprint (CPU/cores/RAM), because fitness is a property of a
+  model ON a host — role assignments stay per-machine and synced settings cannot carry one
+  machine's speed numbers onto another. `AgentSession.getStoredFitnessReports()` exposes the
+  current host's measured evidence for profile/role decisions.
+- Added the routing judge: with the model router enabled, a bounded routing-only completion on the
+  judge lane (`modelRouter.judgeModel`, else `mediumModel`; ≤128 output tokens, 10s wall clock,
+  static cached prompt) decides the final cheap/medium/expensive tier over the regex baseline —
+  never the learning tier. Core rule: planning/design prompts are never cheap unless the judge
+  explicitly deems them trivial; the regex classifier now also floors prospective planning prompts
+  at medium (`planning_min_medium`) while plain lookups like "show me the architecture" stay
+  cheap. Judge failures fall back to the baseline with visible reasons, judge spend reports
+  through spawned-usage accounting, and `modelRouter.judgeEnabled: false` restores byte-identical
+  router behavior.
+
+### Changed
+
+- Changed bounded goal continuation to default to 20 turns and auto-inject continuation prompts after a
+  prompt settles idle while an active goal remains open, with internal recursion suppression for
+  continuation prompts. It now also respects new settings for wall-clock budget, idle delay, and turn limits,
+  which can be configured via the Autonomy submenu in the settings TUI.
+- Added a third positional argument `[maxMinutes]` to the `/goal-continue` command to support bounded wall-clock loop termination.
+
+## [0.80.86] - 2026-06-29
+
+### Added
+
+- Added dynamic token estimation checks for model context windows, warning the user if the base configuration (system prompt and tools) uses more than 70% of the context window.
+
+### Fixed
+
+- Fixed adaptive scaling of compaction parameters (`reserveTokens` and `keepRecentTokens`) for models with small context windows to avoid immediate auto-compaction loops.
+- Fixed a scope redeclaration issue with `activeProfileNames` in the resource loader.
+- Fixed the semantic-memory context GC never packing the recall pages the bundled default memory
+  provider emits: active providers' page markers are now merged into the GC marker list at runtime
+  (and the generic `<memory_context` marker joined the settings default), so stale cross-session
+  recall pages no longer accumulate raw — and re-bill — for the life of the session.
+- Fixed internal tool-registry refreshes (extension `refreshTools`, memory init, `/reload`,
+  live extension load/unload) permanently shrinking the restorable tool set: they re-derived from
+  the capability/profile-filtered ACTIVE tools instead of the pre-filter request, so switching back
+  to a larger model restored only the reduced set.
+- Fixed the model router judge being consulted on internally generated continuation turns (one
+  judge call per loop iteration) and enforced the planning floor in code: a cheap downgrade of a
+  non-cheap baseline now requires the judge's explicit `trivial` verdict.
+- Fixed `model_fitness` probes: per-surface calls are now wall-clock bounded (a hung local model
+  can no longer hang the probe), tokens/sec is measured in the shipped session path, and an empty
+  judge prompt set no longer yields NaN latency.
+- Fixed reflection learning-audit ids colliding after no-op decisions (the rollback key now counts
+  only stored snapshots), which could block or misdirect `learning rollback`.
+- Fixed the lane tracker growing without bound in long sessions (terminal lanes beyond 100 are
+  evicted from memory; the session log keeps full history) and lane ids being reused after resume.
+- Fixed toolkit script execution discarding spawn-failure diagnostics: a missing runner
+  (ENOENT/EACCES) now surfaces the real cause in stderr instead of an empty `exited null`, and an
+  output-overflow kill is no longer mislabeled as a timeout. Repeated words in a request no longer
+  multiply the Level-0 matcher score into a false confident match.
+- Fixed NaN/invalid model `contextWindow` metadata leaking into capability profiles and lane
+  budgets in `off`/forced modes.
+
 
 ## [0.80.85] - 2026-06-29