@plurnk/plurnk-service 1.5.0 → 1.6.1

package/.env.defaults

@@ -45,7 +45,7 @@ PLURNK_PORT=3044
 # Optional default child-provider alias. Unset = each WORK/FORK child inherits
 # its spawning loop's provider. Clients may override this per top-level loop.
 # PLURNK_MODEL_CHILD=fast
-# Operator turn ceiling. -1 (default) = no cap (loops end via SEND, budget,
+# Operator turn ceiling. -1 (default) = no cap (loops end via SEND, provider capacity,
 # strikes, or cycle detection). A positive value is an inviolable hard cap a
 # CoreSeam runLoop({maxTurns}) request cannot exceed (min wins).
 PLURNK_SERVICE_MAX_TURNS=-1
@@ -97,7 +97,7 @@ PLURNK_SERVICE_LOOP_TIMEOUT=86400000
 # Maximum characters retained from caught runtime diagnostics in a model-facing
 # Problem detail. Complete errors remain in daemon diagnostics.
 PLURNK_SERVICE_ERROR_DETAIL_LIMIT=512
-PLURNK_SERVICE_MAX_STRIKES=3
+PLURNK_SERVICE_MAX_STRIKES=6
 # Completed responses that do not form a valid PLAN...SEND turn are retried
 # beneath the same engine turn and against the identical packet.
 PLURNK_SERVICE_EMISSION_ATTEMPTS=3
@@ -131,13 +131,17 @@ PLURNK_SERVICE_GIT_ISO=0
 # optional in-process reader does not use this bound.
 PLURNK_SERVICE_GIT_OUTPUT_MAX_BYTES=67108864
 
-# Ordinary bounded OPEN-body projection. READ/FIND results render their selected
-# operation result complete; every other log body renders at most these
-# independent line and character bounds. A truncated body carries its canonical
-# log URI.
+# Ordinary bounded OPEN-body projection. READ/FIND results and PLAN working
+# memory render complete; prompt initialization uses its separate budget share.
+# Every remaining log body renders at most these independent line and character
+# bounds. A truncated body carries its canonical log URI.
 PLURNK_SERVICE_PREVIEW_LINES=16
 PLURNK_SERVICE_PREVIEW_CHARS=2560
 
+# Number of complete neighboring lines hashed on each side of a model-facing
+# line anchor. 0 authenticates only the addressed line.
+PLURNK_SERVICE_LINE_ANCHOR_CONTEXT_LINES=2
+
 # --- Reference docs (auto-READ at turn 0) ---
 # PLURNK_SERVICE_MD_<ALIAS>=<path> materializes <path>'s markdown as a
 # worker://plurnk/<ALIAS>.md
@@ -166,8 +170,8 @@ PLURNK_SERVICE_EDIT_RECEIPT_REVISION_CHARS=8
 # The durable batch retains complete commit ids; this is display-only.
 PLURNK_SERVICE_BRANCH_RECEIPT_REVISION_CHARS=8
 
-# Number of neighboring lines (or top-level JSON items) rendered on each side
-# of an EDIT's resulting range. The model can READ for arbitrary final content.
+# Number of surrounding and landed lines shown at each boundary of an EDIT
+# result. Overlapping windows coalesce; the model can READ omitted content.
 PLURNK_SERVICE_EDIT_RECEIPT_CONTEXT_LINES=2
 
 # Workspace-tier ceiling on CONCURRENT active runs (a run with a non-terminal loop)
@@ -176,25 +180,16 @@ PLURNK_SERVICE_EDIT_RECEIPT_CONTEXT_LINES=2
 # the ceiling fails hard (508 — no queue, no retry); the acting run counts itself.
 PLURNK_SERVICE_WORKSPACE_WORKERS_MAX_ACTIVE=-1
 
-# --- Prompt budget and packing safety — PER ALIAS (#352) ---
-# Providers report physical context and response capacity. Core's natural prompt budget is the
-# remaining physical input room after the response envelope and SAFETY margin.
-#
-# PROMPT_BUDGET is optional virtual pressure: it makes the model-facing gauge and grinder enforce
-# a smaller input budget without changing provider context or generation settings. Unset uses the
-# natural physical prompt budget; a set value can only tighten it. Both core knobs resolve per
-# alias: _<alias> wins over bare.
-# The retired PLURNK_SERVICE_{CONTEXT_WINDOW,REASONING,COMPLETION} names FAIL HARD at boot naming
-# their successors — a stale .env never silently loses its envelope.
-# PLURNK_SERVICE_PROMPT_BUDGET=128000
-PLURNK_SERVICE_SAFETY=1024
-#
-# LOCAL aliases (llama-server): the window is PROBED and the reserves DERIVE from it in the
-# provider tier (percent defaults) — zero-config. Absolute pins, when wanted, are provider-tier:
-# PLURNK_PROVIDERS_{REASONING,COMPLETION}_RESERVE_<alias> (see plurnk-providers/.env.defaults).
-# The provider sends the resolved reasoning allowance per request; no llama-server launch-flag
-# synchronization is required. Pinned absolutes exceeding the detected window fail HARD at build
-# time, naming the provider-tier knobs.
+# --- Prompt projection — PER ALIAS ---
+# Providers derive physical input capacity from model limits and the total output envelope.
+# Core projects that number into its model-facing curation gauge; no second service-side token
+# budget or packing margin exists. The retired PLURNK_SERVICE_{PROMPT_BUDGET,SAFETY,
+# CONTEXT_WINDOW,REASONING,COMPLETION} names fail hard at boot.
+# Maximum aggregate share of the model-facing curation budget used by
+# automatic OPEN prompt bodies. The complete prompt remains stored and
+# READ/FIND-addressable; this controls projection, not prompt admission.
+# Alias-scoped overrides follow the ordinary _<alias> convention.
+PLURNK_SERVICE_PROMPT_PROJECTION=25%
 
 # --- Plugins (third-party trust) ---
 # (PLURNK_PLUGINS_TRUSTED_ONLY lives in @plurnk/plurnk-meta — reader-declares: the

package/INSTALL.md

@@ -4,7 +4,7 @@ Operator guide. Put machine-specific choices in `~/.plurnk/.env`. Each installed
 
 ## Install
 
-```
+```sh
 npm install -g @plurnk/plurnk-service
 plurnk-service migrate        # apply the disposable version-1 schema baseline
 plurnk-service start
@@ -40,16 +40,20 @@ When a value is required, an unset or retired name fails boot naming the violate
 
 These are relationships *between* flags. Set them as a unit.
 
-- **Provider capacity and PLURNK pressure are separate.** Providers report
-  physical context and response capacity. Core derives the natural input
-  budget from those facts. Optional `PLURNK_SERVICE_PROMPT_BUDGET_<alias>`
-  only tightens the model-facing gauge and grinder; it is never sent to the
-  provider and never changes generation settings.
-- **Reasoning capacity is request-scoped on llama-server.**
-  `PLURNK_PROVIDERS_REASONING_RESERVE_<alias>` is the adaptive cumulative
-  response allowance. An explicit `PLURNK_PROVIDERS_REASONING_BUDGET_<alias>`
-  may tighten but cannot exceed it. The provider sends the allowance on every
-  request; no serving-box flag synchronization is required.
+- **One generation envelope derives input capacity.** The provider resolves
+  model input/output limits, the effective context window, one total output
+  budget, and an optional reasoning subset. Its resulting input capacity drives
+  both physical request admission and Core's model-independent curation gauge;
+  Core has no second token budget or packing margin. Request-shaped token
+  evidence remains provider-owned ({§tokenomics-window-partition}).
+  `PLURNK_SERVICE_PROMPT_PROJECTION_<alias>` assigns a stable percentage of
+  that gauge to automatic prompt bodies; it never limits stored prompt size
+  ({§prompt-projection}).
+- **Reasoning is part of output.** `PLURNK_PROVIDERS_OUTPUT_BUDGET_<alias>` is
+  the complete response ceiling, including hidden reasoning. Optional
+  `PLURNK_PROVIDERS_REASONING_BUDGET_<alias>` is a strict subset; unset leaves
+  depth provider-adaptive. Activation remains the independent
+  `PLURNK_PROVIDERS_REASONING_<alias>` contract.
 - **Local GBNF is optional.** The PLURNK language is always parsed normally.
   Local llama-server users may set `PLURNK_PROVIDERS_GBNF_<alias>`; transport
   and enforcement are verified at boot. Cloud and endpoint-managed aliases
@@ -63,7 +67,7 @@ These are relationships *between* flags. Set them as a unit.
 
 ## Profiles (examples, not a decision tree — adapt to the real box)
 
-- **Local GPU (llama-server).** `PLURNK_MODEL_local="openai/<name>"`, `OPENAI_BASE_URL=http://127.0.0.1:<port>`, `PLURNK_MODEL=local`, `PLURNK_PROVIDERS_GBNF_local=plurnk.gbnf`. The provider detects llama-server, verifies its GBNF transport, and derives a request-scoped reasoning allowance from the detected window. Add `PLURNK_PROVIDERS_LLAMA_SERVER_local=1` only when the endpoint cannot be fingerprinted reliably.
+- **Local GPU (llama-server).** `PLURNK_MODEL_local="openai/<name>"`, `OPENAI_BASE_URL=http://127.0.0.1:<port>`, `PLURNK_MODEL=local`, `PLURNK_PROVIDERS_GBNF_local=plurnk.qwen.gbnf` for Qwen's template-prefilled `<think>` protocol (or `plurnk.gemma.gbnf` when Gemma generates a complete Harmony channel). The provider detects llama-server, verifies its GBNF transport, and derives input capacity from the detected window and configured output envelope. Add `PLURNK_PROVIDERS_LLAMA_SERVER_local=1` only when the endpoint cannot be fingerprinted reliably.
 - **Cloud, bring-your-own-key.** `PLURNK_MODEL_cloud="openrouter/<model>"`, `OPENROUTER_API_KEY=…`, `PLURNK_MODEL=cloud`. No local GBNF or `LLAMA_SERVER` pin.
 - **plurnk.ai endpoint.** `PLURNK_MODEL_plurnk="plurnk/plurnk"`, `PLURNK_API_KEY=…`, `PLURNK_MODEL=plurnk`.
 - **Headless / CI / constrained container.** A CPU-only box should NOT disable semantic search — it should point derivation at a real embedder: `PLURNK_MIMETYPES_EMBED_BASE_URL` (any OpenAI-compatible `/v1/embeddings` — a host GPU turns a CPU-hours corpus grind into seconds). Weak hardware is the target workload, not a reason to shed capability; `PLURNK_SERVICE_EMBED_DISABLE=1` exists for test lanes that deterministically assert non-semantic behavior, nothing else. Consider `PLURNK_SERVICE_MAX_TURNS=<n>` as a cost cap, `PLURNK_SERVICE_GIT_ALLOWED=0` to lock out git in a sandbox.
@@ -77,14 +81,15 @@ Each mirrors a `# --- section ---` in the floor; consult the floor for exact def
 - **Model aliases** — bare `PLURNK_MODEL` selects the active provider; `PLURNK_MODEL_<alias>` defines one; `PLURNK_BASEURL_<alias>` overrides its endpoint. Optional `PLURNK_MODEL_CHILD=<alias>` selects WORK/FORK descendants; unset inherits the spawning loop's provider. The front door — keep these bare and short.
 - **Loop control / engine rails** — `PLURNK_SERVICE_MAX_TURNS` (−1 = uncapped), `_MAX_COMMANDS`, `_MAX_STRIKES`, `_EMISSION_ATTEMPTS`, `_MIN_CYCLES`, `_MAX_CYCLE_PERIOD`, `_LOOP_TIMEOUT`, `_PROPOSAL_TIMEOUT_MS`, `_EXEC_HOLD`, `_OPTIMISTIC_WAIT_MS`, `_EXEC_POLL_SEC`/`_TURNS`, `_EXEC_KILL_GRACE_MS`, `_WORKSPACE_WORKERS_MAX_ACTIVE`.
 - **Git** — `PLURNK_SERVICE_GIT_ALLOWED` (0 = hard sandbox lockout), `_GIT_AUTO`.
-- **Packet / reference docs** — `PLURNK_SERVICE_FILES_ITEMS` (turn-0 shallow file-map cap), `_PREVIEW_LINES`/`_PREVIEW_CHARS`, `_EDIT_RECEIPT_REVISION_CHARS`/`_CONTEXT_LINES`, `_BRANCH_RECEIPT_REVISION_CHARS`, `_DOCS_EXCLUDE`, `_PACKET_INJECT` (operator markdown section), `_POLICY`/`_PROJECT` (policy overrides), `_REQUIREMENTS` (Recap-source override), `_MD_<alias>` (materialized reference entry).
+- **Packet / reference docs** — `PLURNK_SERVICE_FILES_ITEMS` (turn-0 shallow file-map cap), `_PREVIEW_LINES`/`_PREVIEW_CHARS`, `_LINE_ANCHOR_CONTEXT_LINES`, `_EDIT_RECEIPT_REVISION_CHARS`/`_CONTEXT_LINES`, `_BRANCH_RECEIPT_REVISION_CHARS`, `_DOCS_EXCLUDE`, `_PACKET_INJECT` (operator markdown section), `_POLICY`/`_PROJECT` (policy overrides), `_REQUIREMENTS` (Recap-source override), `_MD_<alias>` (materialized reference entry).
 - **Providers** — the portable provider knobs and defaults are defined by
   `@plurnk/plurnk-providers/.env.defaults`; any provider knob may take an alias
   suffix that wins over the bare fallback.
-- **Provider capacity and prompt budget** —
-  `PLURNK_PROVIDERS_CONTEXT_WINDOW`/`_REASONING_RESERVE`/`_COMPLETION_RESERVE`
-  describe provider capacity. `PLURNK_SERVICE_PROMPT_BUDGET` applies optional
-  virtual pressure; `PLURNK_SERVICE_SAFETY` is the packing margin.
+- **Provider envelope and prompt projection** —
+  `PLURNK_PROVIDERS_CONTEXT_WINDOW`/`_OUTPUT_BUDGET` and optional
+  `_REASONING_BUDGET` derive physical input capacity.
+  `PLURNK_SERVICE_PROMPT_PROJECTION` assigns the automatic prompt-body share
+  of that provider-derived curation gauge.
 - **Plugins** — bare `PLURNK_PLUGINS_TRUSTED_ONLY` (0/unset = load all installed; a value = `@plurnk/*` plus an allowlist).
 - **Semantic search** — `PLURNK_SERVICE_SEMANTIC_CHUNK_TOKENS`/`_CHUNK_OVERLAP` (service-side chunking), `PLURNK_SERVICE_EMBED_DISABLE` (FTS-only), `PLURNK_MIMETYPES_EMBED_WORKERS` (the embedder's pool — mimetypes-owned).
 - **Schemes: http** — `PLURNK_SCHEMES_HTTP_FETCH_TIMEOUT`, `_TTL_MS`, optional `# TAVILY_API_KEY=`, and `PLURNK_SCHEMES_HTTP_TAVILY_DEPTH`/`_TAVILY_TIMEOUT_MS`.

package/README.md

@@ -28,7 +28,7 @@ a second client transport.
 
 ## Start
 
-```
+```sh
 npm install -g @plurnk/plurnk-service
 plurnk-service migrate    # apply the disposable version-1 schema baseline
 plurnk-service start      # daemon