@plurnk/plurnk-service 1.5.0 → 1.6.0

package/.env.defaults

@@ -97,7 +97,7 @@ PLURNK_SERVICE_LOOP_TIMEOUT=86400000
 # Maximum characters retained from caught runtime diagnostics in a model-facing
 # Problem detail. Complete errors remain in daemon diagnostics.
 PLURNK_SERVICE_ERROR_DETAIL_LIMIT=512
-PLURNK_SERVICE_MAX_STRIKES=3
+PLURNK_SERVICE_MAX_STRIKES=6
 # Completed responses that do not form a valid PLAN...SEND turn are retried
 # beneath the same engine turn and against the identical packet.
 PLURNK_SERVICE_EMISSION_ATTEMPTS=3
@@ -131,13 +131,17 @@ PLURNK_SERVICE_GIT_ISO=0
 # optional in-process reader does not use this bound.
 PLURNK_SERVICE_GIT_OUTPUT_MAX_BYTES=67108864
 
-# Ordinary bounded OPEN-body projection. READ/FIND results render their selected
-# operation result complete; every other log body renders at most these
-# independent line and character bounds. A truncated body carries its canonical
-# log URI.
+# Ordinary bounded OPEN-body projection. READ/FIND results and PLAN working
+# memory render complete; prompt initialization uses its separate budget share.
+# Every remaining log body renders at most these independent line and character
+# bounds. A truncated body carries its canonical log URI.
 PLURNK_SERVICE_PREVIEW_LINES=16
 PLURNK_SERVICE_PREVIEW_CHARS=2560
 
+# Number of complete neighboring lines hashed on each side of a model-facing
+# line anchor. 0 authenticates only the addressed line.
+PLURNK_SERVICE_LINE_ANCHOR_CONTEXT_LINES=2
+
 # --- Reference docs (auto-READ at turn 0) ---
 # PLURNK_SERVICE_MD_<ALIAS>=<path> materializes <path>'s markdown as a
 # worker://plurnk/<ALIAS>.md
@@ -166,8 +170,8 @@ PLURNK_SERVICE_EDIT_RECEIPT_REVISION_CHARS=8
 # The durable batch retains complete commit ids; this is display-only.
 PLURNK_SERVICE_BRANCH_RECEIPT_REVISION_CHARS=8
 
-# Number of neighboring lines (or top-level JSON items) rendered on each side
-# of an EDIT's resulting range. The model can READ for arbitrary final content.
+# Number of surrounding and landed lines shown at each boundary of an EDIT
+# result. Overlapping windows coalesce; the model can READ omitted content.
 PLURNK_SERVICE_EDIT_RECEIPT_CONTEXT_LINES=2
 
 # Workspace-tier ceiling on CONCURRENT active runs (a run with a non-terminal loop)
@@ -177,16 +181,21 @@ PLURNK_SERVICE_EDIT_RECEIPT_CONTEXT_LINES=2
 PLURNK_SERVICE_WORKSPACE_WORKERS_MAX_ACTIVE=-1
 
 # --- Prompt budget and packing safety — PER ALIAS (#352) ---
-# Providers report physical context and response capacity. Core's natural prompt budget is the
-# remaining physical input room after the response envelope and SAFETY margin.
+# Providers report the effective total context envelope and generation capacity. Core's natural
+# prompt gauge is the remaining input room after the generation envelope and SAFETY margin.
 #
-# PROMPT_BUDGET is optional virtual pressure: it makes the model-facing gauge and grinder enforce
-# a smaller input budget without changing provider context or generation settings. Unset uses the
-# natural physical prompt budget; a set value can only tighten it. Both core knobs resolve per
+# PROMPT_BUDGET is optional virtual pressure: it tightens the model-facing gauge and grinder
+# without changing hard context admission or generation settings. Unset uses the natural prompt
+# gauge; a set value can only tighten it. Both core knobs resolve per
 # alias: _<alias> wins over bare.
 # The retired PLURNK_SERVICE_{CONTEXT_WINDOW,REASONING,COMPLETION} names FAIL HARD at boot naming
 # their successors — a stale .env never silently loses its envelope.
 # PLURNK_SERVICE_PROMPT_BUDGET=128000
+# Maximum aggregate share of the stable model-facing prompt gauge used by
+# automatic OPEN prompt bodies. The complete prompt remains stored and
+# READ/FIND-addressable; this controls projection, not prompt admission.
+# Alias-scoped overrides follow the ordinary _<alias> convention.
+PLURNK_SERVICE_PROMPT_PROJECTION=25%
 PLURNK_SERVICE_SAFETY=1024
 #
 # LOCAL aliases (llama-server): the window is PROBED and the reserves DERIVE from it in the

package/INSTALL.md

@@ -40,11 +40,14 @@ When a value is required, an unset or retired name fails boot naming the violate
 
 These are relationships *between* flags. Set them as a unit.
 
-- **Provider capacity and PLURNK pressure are separate.** Providers report
-  physical context and response capacity. Core derives the natural input
-  budget from those facts. Optional `PLURNK_SERVICE_PROMPT_BUDGET_<alias>`
+- **Hard capacity and PLURNK pressure are separate.** Providers report the
+  effective total context envelope and generation capacity. Core derives the
+  natural prompt gauge from those facts. Optional `PLURNK_SERVICE_PROMPT_BUDGET_<alias>`
   only tightens the model-facing gauge and grinder; it is never sent to the
-  provider and never changes generation settings.
+  provider and never changes hard admission or generation settings.
+  `PLURNK_SERVICE_PROMPT_PROJECTION_<alias>` assigns a stable percentage of
+  that gauge to automatic prompt bodies; it never limits stored prompt size
+  ({§prompt-projection}).
 - **Reasoning capacity is request-scoped on llama-server.**
   `PLURNK_PROVIDERS_REASONING_RESERVE_<alias>` is the adaptive cumulative
   response allowance. An explicit `PLURNK_PROVIDERS_REASONING_BUDGET_<alias>`
@@ -63,7 +66,7 @@ These are relationships *between* flags. Set them as a unit.
 
 ## Profiles (examples, not a decision tree — adapt to the real box)
 
-- **Local GPU (llama-server).** `PLURNK_MODEL_local="openai/<name>"`, `OPENAI_BASE_URL=http://127.0.0.1:<port>`, `PLURNK_MODEL=local`, `PLURNK_PROVIDERS_GBNF_local=plurnk.gbnf`. The provider detects llama-server, verifies its GBNF transport, and derives a request-scoped reasoning allowance from the detected window. Add `PLURNK_PROVIDERS_LLAMA_SERVER_local=1` only when the endpoint cannot be fingerprinted reliably.
+- **Local GPU (llama-server).** `PLURNK_MODEL_local="openai/<name>"`, `OPENAI_BASE_URL=http://127.0.0.1:<port>`, `PLURNK_MODEL=local`, `PLURNK_PROVIDERS_GBNF_local=plurnk.qwen.gbnf` for Qwen's template-prefilled `<think>` protocol (or `plurnk.gemma.gbnf` when Gemma generates a complete Harmony channel). The provider detects llama-server, verifies its GBNF transport, and derives a request-scoped reasoning allowance from the detected window. Add `PLURNK_PROVIDERS_LLAMA_SERVER_local=1` only when the endpoint cannot be fingerprinted reliably.
 - **Cloud, bring-your-own-key.** `PLURNK_MODEL_cloud="openrouter/<model>"`, `OPENROUTER_API_KEY=…`, `PLURNK_MODEL=cloud`. No local GBNF or `LLAMA_SERVER` pin.
 - **plurnk.ai endpoint.** `PLURNK_MODEL_plurnk="plurnk/plurnk"`, `PLURNK_API_KEY=…`, `PLURNK_MODEL=plurnk`.
 - **Headless / CI / constrained container.** A CPU-only box should NOT disable semantic search — it should point derivation at a real embedder: `PLURNK_MIMETYPES_EMBED_BASE_URL` (any OpenAI-compatible `/v1/embeddings` — a host GPU turns a CPU-hours corpus grind into seconds). Weak hardware is the target workload, not a reason to shed capability; `PLURNK_SERVICE_EMBED_DISABLE=1` exists for test lanes that deterministically assert non-semantic behavior, nothing else. Consider `PLURNK_SERVICE_MAX_TURNS=<n>` as a cost cap, `PLURNK_SERVICE_GIT_ALLOWED=0` to lock out git in a sandbox.
@@ -77,14 +80,15 @@ Each mirrors a `# --- section ---` in the floor; consult the floor for exact def
 - **Model aliases** — bare `PLURNK_MODEL` selects the active provider; `PLURNK_MODEL_<alias>` defines one; `PLURNK_BASEURL_<alias>` overrides its endpoint. Optional `PLURNK_MODEL_CHILD=<alias>` selects WORK/FORK descendants; unset inherits the spawning loop's provider. The front door — keep these bare and short.
 - **Loop control / engine rails** — `PLURNK_SERVICE_MAX_TURNS` (−1 = uncapped), `_MAX_COMMANDS`, `_MAX_STRIKES`, `_EMISSION_ATTEMPTS`, `_MIN_CYCLES`, `_MAX_CYCLE_PERIOD`, `_LOOP_TIMEOUT`, `_PROPOSAL_TIMEOUT_MS`, `_EXEC_HOLD`, `_OPTIMISTIC_WAIT_MS`, `_EXEC_POLL_SEC`/`_TURNS`, `_EXEC_KILL_GRACE_MS`, `_WORKSPACE_WORKERS_MAX_ACTIVE`.
 - **Git** — `PLURNK_SERVICE_GIT_ALLOWED` (0 = hard sandbox lockout), `_GIT_AUTO`.
-- **Packet / reference docs** — `PLURNK_SERVICE_FILES_ITEMS` (turn-0 shallow file-map cap), `_PREVIEW_LINES`/`_PREVIEW_CHARS`, `_EDIT_RECEIPT_REVISION_CHARS`/`_CONTEXT_LINES`, `_BRANCH_RECEIPT_REVISION_CHARS`, `_DOCS_EXCLUDE`, `_PACKET_INJECT` (operator markdown section), `_POLICY`/`_PROJECT` (policy overrides), `_REQUIREMENTS` (Recap-source override), `_MD_<alias>` (materialized reference entry).
+- **Packet / reference docs** — `PLURNK_SERVICE_FILES_ITEMS` (turn-0 shallow file-map cap), `_PREVIEW_LINES`/`_PREVIEW_CHARS`, `_LINE_ANCHOR_CONTEXT_LINES`, `_EDIT_RECEIPT_REVISION_CHARS`/`_CONTEXT_LINES`, `_BRANCH_RECEIPT_REVISION_CHARS`, `_DOCS_EXCLUDE`, `_PACKET_INJECT` (operator markdown section), `_POLICY`/`_PROJECT` (policy overrides), `_REQUIREMENTS` (Recap-source override), `_MD_<alias>` (materialized reference entry).
 - **Providers** — the portable provider knobs and defaults are defined by
   `@plurnk/plurnk-providers/.env.defaults`; any provider knob may take an alias
   suffix that wins over the bare fallback.
 - **Provider capacity and prompt budget** —
   `PLURNK_PROVIDERS_CONTEXT_WINDOW`/`_REASONING_RESERVE`/`_COMPLETION_RESERVE`
   describe provider capacity. `PLURNK_SERVICE_PROMPT_BUDGET` applies optional
-  virtual pressure; `PLURNK_SERVICE_SAFETY` is the packing margin.
+  virtual pressure; `PLURNK_SERVICE_PROMPT_PROJECTION` assigns the automatic
+  prompt-body share; `PLURNK_SERVICE_SAFETY` is the packing margin.
 - **Plugins** — bare `PLURNK_PLUGINS_TRUSTED_ONLY` (0/unset = load all installed; a value = `@plurnk/*` plus an allowlist).
 - **Semantic search** — `PLURNK_SERVICE_SEMANTIC_CHUNK_TOKENS`/`_CHUNK_OVERLAP` (service-side chunking), `PLURNK_SERVICE_EMBED_DISABLE` (FTS-only), `PLURNK_MIMETYPES_EMBED_WORKERS` (the embedder's pool — mimetypes-owned).
 - **Schemes: http** — `PLURNK_SCHEMES_HTTP_FETCH_TIMEOUT`, `_TTL_MS`, optional `# TAVILY_API_KEY=`, and `PLURNK_SCHEMES_HTTP_TAVILY_DEPTH`/`_TAVILY_TIMEOUT_MS`.