@plurnk/plurnk-service 2.0.0 → 3.0.0

package/.env.defaults

@@ -35,18 +35,11 @@ PLURNK_SERVICE_SQLITE_READERS=0
 
 # --- Permissions and membership ---
 # CapabilityPolicy JSON: deny removes matching demands; only admits only matches.
-# Workspace, Worker, and loop policies may narrow this ceiling, never widen it.
+# Workspace policy may narrow this ceiling, never widen it.
 PLURNK_SERVICE_CAPABILITIES={}
-# What a loop does with a proposal when its creator did not say: review holds it for a
-# client's answer; accept applies it and reject refuses it inside the loop.
+# Proposal settlement: review asks the worker's owner; accept or reject settles in core.
+# Review without a capable owner rejects. Disconnect alone never removes that capability.
 PLURNK_SERVICE_PROPOSALS=review
-# Whether anyone is attending a loop when its creator did not say: 1 = someone can answer;
-# 0 = unattended, so no human-in-the-loop surface is offered and a wait nobody could end concludes.
-PLURNK_SERVICE_ATTENDED=1
-# What an unattended loop does with a proposal when its creator did not say: accept | reject.
-# Nobody is present to review, so review is not a choice here. Rejecting is the honest default: an
-# effect nobody approved does not run. A harness that means to run unattended states accept.
-PLURNK_SERVICE_UNATTENDED_PROPOSALS=reject
 # New filesystem files: none | root | namespace (also outside root). Existing-member writes unchanged.
 PLURNK_SERVICE_FILE_CREATE_SCOPE=root
 # Model-added membership: none | root | namespace. Workspaces may narrow it.
@@ -57,6 +50,8 @@ PLURNK_MEMBERS_ENABLED=1
 # PLURNK_MEMBERS_docs=docs/**
 # PLURNK_MEMBERS_no_locks=!**/*.lock
 # PLURNK_MEMBERS_docs_ENABLED=0
+# Any alias: its glob, and its own _ENABLED control.
+# PLURNK_MEMBERS_<alias>=<glob>
 # Matched paths a members definition lists as its sample; the rest are counted.
 PLURNK_SERVICE_MEMBERS_SAMPLE=20
 # Git membership, status, and branch integration: 1 = permitted; 0 = denied service-wide.
@@ -71,11 +66,12 @@ PLURNK_SERVICE_FILE_MATERIALIZE_MAX_BYTES=104857600
 # --- Loop limits and recovery ---
 # Default child model: alias or provider/model. Unset = inherit the spawning loop's model.
 # PLURNK_MODEL_CHILD=fast
-# Model calls across the worker tree, including BARE and resumes; -1 = unlimited. Clients may tighten it.
+# Opt-in model-call ceiling shared by the worker tree, including BARE and resumes; -1 = uncapped.
+# Runtime (_plurnk) ancestry supplies no ceiling. Clients may tighten the model tree's limit.
 PLURNK_SERVICE_MAX_TURNS=-1
 # Actions per emission; -1 = unlimited. Final disposition remains; excess actions report an error.
 PLURNK_SERVICE_MAX_COMMANDS=-1
-# Concurrent nonterminal runs per workspace; -1 = unlimited. Excess spawns return 508, not a queue.
+# Concurrent live workers per workspace; -1 = unlimited. Excess spawns return 508, not a queue.
 PLURNK_SERVICE_WORKSPACE_WORKERS_MAX_ACTIVE=-1
 # Active execution allowance per task, positive ms; WAIT pauses it, wakes retain it. Exhaustion: 504.
 PLURNK_SERVICE_LOOP_TIMEOUT=86400000
@@ -83,8 +79,8 @@ PLURNK_SERVICE_LOOP_TIMEOUT=86400000
 PLURNK_SERVICE_LIVE_TIMEOUT=600000
 # End-to-end shutdown budget, positive ms; includes database and listener cleanup.
 PLURNK_SERVICE_STOP_TIMEOUT_MS=30000
-# Provider recovery window, ms; 0 = no reissue. Expiry parks attended loops until a prompt/wake;
-# unattended loops conclude and BARE returns the provider failure.
+# Provider recovery window, ms; 0 = no reissue. Expiry parks workers with a reviewer;
+# without one the loop concludes. BARE returns the provider failure.
 PLURNK_SERVICE_PROVIDER_RECOVERY=900000
 # First recovery delay, ms; doubles on failure up to PROVIDER_RECOVERY_BACKOFF_MAX below.
 PLURNK_SERVICE_PROVIDER_RECOVERY_BACKOFF=5000
@@ -215,7 +211,7 @@ PLURNK_SERVICE_DERIVE_PROGRESS_HEARTBEAT_MS=15000
 # Packet compositions kept per loop, newest first; -1 = every packet, forever.
 PLURNK_SERVICE_RETAIN_PACKET_TURNS=-1
 # Packet compositions kept by age, ms since the turn completed; -1 = no age limit. Thirty days:
-# no session reads its own packets back that late, and a daemon left running for months stops growing.
+# no worker reads its own packets back that late, and a daemon left running for months stops growing.
 PLURNK_SERVICE_RETAIN_PACKET_MS=2592000000
 # Model response bodies kept per loop, newest first; -1 = every body, forever. The call's
 # evidence, admission and accounting always stay.

package/INSTALL.md

@@ -33,8 +33,9 @@ or enables the unit.
 | Plurnk-only MCP servers | `$XDG_CONFIG_HOME/plurnk/mcp.json` |
 
 Use `plurnk-service config` for paths and precedence, `config edit` to edit the
-user file, and `config check` to validate it. An old `~/.plurnk` is not read
-implicitly; `plurnk-service paths migrate` relocates it with the daemon stopped.
+user file, and `config check` to validate it. A `PLURNK_*` key that file sets and
+no installed package declares is named at startup and by `config check`, which
+still passes; `config defaults` lists every declared key.
 
 Invalid optional configuration stays visible without removing the repair environment.
 `config check` is strict; ordinary startup keeps unrelated capabilities and client

package/README.md

@@ -47,8 +47,7 @@ Configuration follows XDG at `$XDG_CONFIG_HOME/plurnk` (normally
 `plurnk-service config defaults` for
 the complete installed option catalog and `plurnk-service config check` to
 validate without contacting a provider. **[`INSTALL.md`](./INSTALL.md) is the
-configuration guide.** A legacy mixed `~/.plurnk` is moved only by the explicit
-`plurnk-service paths migrate` command.
+configuration guide.**
 
 Protect durable history with a [consistent database backup](./INSTALL.md#backup-and-restore).
 The `share` command exports diagnostic reports, not a restorable database.