pantheon-opencode 1.5.2 → 1.6.0-beta.10

package/src/instructions/zeus-memory-operations.instructions.md

@@ -0,0 +1,26 @@
+---
+description: "Zeus-only council memory procedures"
+name: "Zeus Memory Operations"
+agents: [zeus]
+fallback: shared
+---
+
+# Zeus Memory Operations
+
+## Routing
+
+Reuse relevant memory already present in the request or task context. If prior project history matters and no result is present, Zeus may do one targeted search and pass useful hits with the delegation. Do not search on every turn or add KV/cache calls to ordinary dispatches.
+
+## Council Decisions
+
+Before a council, search separately from the task-level lookup only when a past council decision could affect the recommendation:
+`memory_search(query=question, top_k=2, namespace="council_decisions")`.
+Use a recent, directly matching decision only after checking current context;
+otherwise treat it as background, never as authority to skip a needed review.
+
+Persist only reusable, material decisions. Use
+`key="council:<yyyy-mm-dd>:<slug>"`; JSON-stringify both `value` and
+`metadata` for `memory_store(namespace="council_decisions", ...)`. Keep the
+record concise: question, recommendation, specialists, confidence, unresolved
+trade-off, and timestamp. Do not store routine subtask summaries or status
+updates. Use the memory bank for ADRs only when explicitly requested.

package/src/instructions/zeus-timeout-retry.instructions.md

@@ -1,7 +1,8 @@
 ---
 description: "Timeout enforcement, retry policies, subtask dispatch, and timeout tracking for Zeus"
 name: "Zeus Timeout & Retry"
-applyTo: "agents/zeus.agent.md"
+agents: [zeus]
+fallback: shared
 ---
 
 # ⏱️ TIMEOUT & RETRY ENFORCEMENT
@@ -10,123 +11,75 @@ When a delegated agent does not respond in time, enforce the timeout policy from
 
 ## Timeout Behavior by Agent Role
 
-| Agent Role | Timeout | Retry Policy | Fallback Chain | Partial Results OK? | Reasoning Effort |
-|------------|---------|-------------|----------|---------------------|------------------|
-| Explorer (@apollo) | 60s | 2 retries, exp backoff | @athena (plan) → @hermes (impl) | ✅ Yes | low |
-| Implementer (@hermes, @aphrodite, @demeter) | 180s | 3 retries, exp backoff | @talos (hotfix) → @athena (replan) | ❌ No | medium |
-| Reviewer (@themis) | 120s | 3 retries, exp backoff | @zeus (escalate) → user | ❌ No | high |
-| Infrastructure (@prometheus) | 300s | 3 retries, exp backoff | @hermes (config) → @zeus (escalate) | ❌ No | medium |
-| Hotfix (@talos) | 30s | 2 retries, no backoff | @hermes (full fix) | ✅ Yes | low |
-| Remote Sensing (@gaia) | 120s | 2 retries, exp backoff | @hermes (generic) | ✅ Yes | high |
+| Agent Role | Timeout | Retry Policy | Partial Results OK? | Reasoning Effort |
+|------------|---------|--------------|---------------------|------------------|
+| Explorer (@apollo) | 60s | 1 retry | ✅ Yes | low |
+| Implementer (@hermes, @aphrodite, @demeter) | 180s | 1 retry | ❌ No | medium |
+| Reviewer (@themis) | 120s | 1 retry | ❌ No | high |
+| Infrastructure (@prometheus) | 300s | 1 retry | ❌ No | medium |
+| Hotfix (@talos) | 30s | 1 retry | ✅ Yes | low |
+| Remote Sensing (@gaia) | 120s | 1 retry | ✅ Yes | high |
 
 ## Retry Flow
 
 ```
-Task dispatch → timeout elapsed → log timeout
-  ├─ retry_count > 0 → retry with exponential backoff → decrement retry_count
-  │    └─ still failing? → retry again (up to retry_count limit)
-  │
-  ├─ retries exhausted → FALLBACK CHAIN:
-  │    ├─ fallback[0] exists? → dispatch to fallback agent
-  │    │    └─ keep original task spec + context; add error context
-  │    ├─ fallback[1] exists? → dispatch to second fallback
-  │    └─ all fallbacks failed? → ESCALATE
-  │
-  ├─ no fallbacks defined → return TIMEOUT error to user
-  │
-  └─ ESCALATE: "Agent X failed after N retries. Fallbacks Y, Z also failed.
-                 Options: (a) try different agent, (b) simplify scope, (c) manual"
+Initial attempt → timeout/failure → log it → make at most one retry
+  └─ retry fails → try fallback agents left-to-right with original task/context
+       └─ all fallbacks fail (or none exist) → report the chain and escalate
 ```
+`background_delegation.retry_count: 1` means one retry after the initial attempt, not one total attempt. Never restart an exhausted chain automatically.
 
-
+Apply the retry only to a transient dispatch failure (timeout, crash, or empty response). A failed test, validation, or migration is a result to diagnose, not a reason to repeat the same command or agent blindly. Track agents already tried: each agent may be retried at most once and each listed fallback may be tried at most once. For auth/security/data/schema work, a fallback must preserve specialist competence, Themis review, and human approval; otherwise stop and escalate. Never let full-auto bypass these gates.
+An agent refusal or scope-boundary response is not a transient failure: do not retry it with a rephrased prompt. Correct the route once if the right specialist is clear; otherwise stop and ask.
 
 ## Fallback Chain Definitions
 
-Each fallback chain is evaluated left-to-right: if the first fallback fails, try the second, etc.
-
-| Agent | Fallback[0] | Fallback[1] | Escalate To |
-|-------|------------|------------|-------------|
-| @apollo | @athena (plan scoped task) | @hermes (implement search) | @zeus |
-| @hermes | @talos (minimal fix) | @athena (replan + simplify) | @zeus |
-| @aphrodite | @talos (CSS/UX fix) | @hermes (generic fallback) | @zeus |
-| @demeter | @hermes (generic backend) | @athena (replan schema) | @zeus |
-| @themis | @zeus (direct escalation) | — | user |
-| @prometheus | @hermes (config/deploy) | @zeus | user |
-| @talos | @hermes (full implementation) | — | @zeus |
-| @hephaestus | @nyx (observability debug) | @hermes (generic) | @zeus |
-| @nyx | @hermes (generic) | — | @zeus |
-| @iris | @zeus (manual override) | — | user |
-| @mnemosyne | @zeus (manual) | — | user |
+`routing.yml` → `fallback_chains` is the canonical agent-by-agent mapping. Evaluate
+the configured chain left-to-right; if an agent has no configured chain, stop
+and escalate rather than guessing a fallback. Each listed fallback may be tried
+at most once, and an exhausted chain is never restarted automatically.
 
-### Escalation Protocol
-When ALL fallbacks fail:
-1. Log the full failure chain: which agents were tried, what error each returned
-2. Report to user: "Task [X] failed. Tried: [agent list]. Error: [summary]."
-3. Offer options: (a) try different approach, (b) simplify scope, (c) manual fix
-4. NEVER retry the same chain automatically — break the cycle
+### Refusal Is a Routing Error
 
-### Session Reuse Check
-Before dispatching a task, check if a reusable session exists:
+For a domain/scope refusal, do not retry with a rephrased prompt. Correct the
+route once only when the right specialist is clear; otherwise stop and ask.
+Record one `DelegationCacheDecision` telemetry item for the corrected route,
+including `reroute_from`, `reroute_to`, and `delegation_id` when available.
 
-```
-@hermes — continuing from previous session.
-Files already explored: backend/routers/auth.py, backend/services/auth_service.py.
-New task: add refresh token rotation.
-```
+### Escalation Protocol
+When all fallbacks fail, report the tried agents and errors, offer a different approach/simpler scope/manual fix, and stop. Never retry the same chain automatically.
 
-Use `session_max` from routing.yml to determine how many sessions to keep per agent.
+### Session Reuse Check
+Check for a reusable session before dispatch and obey `session_max` in `routing.yml`.
 
 ---
 
 # 📦 SUBTASK DISPATCH (Lightweight Delegation)
 
-Subtask is a bounded, low-risk delegation mode that **skips** the standard artifact lifecycle. Use it for focused work that doesn't need Themis review.
+Subtask is a bounded, low-risk delegation mode that **skips** the standard artifact lifecycle. Choose it by risk and need for review, not by a fixed file/line count.
 
 ## When to Use Subtask vs Full Task
 
-> **REGRA DE OURO:** Quando em dúvida, use full task. Subtask é para o que você tem 100% de certeza que é seguro pular revisão.
+Use the lightest path that safely meets the request. A multi-file but bounded low-risk change does not automatically need a plan/artifact phase.
 
 ### Subtask Decision Tree (run BEFORE every delegation)
 
 ```
-□ Scope: ≤2 files AND ≤10 lines changed?         [YES→continue | NO→full task]
-□ Risk: No schema change, no security impact?      [YES→continue | NO→full task]
-□ Auth: No authentication/authorization logic?      [YES→continue | NO→full task]
-□ Data: No data loss risk, no migration?            [YES→continue | NO→full task]
-□ Review: Output does NOT feed into Themis review?  [YES→continue | NO→full task]
-
-ALL YES → subtask (skip artifact + Themis)
-ANY NO  → full task (IMPL artifact + Themis review mandatory)
-```
-
-### Comparison Table
+□ Is the scope clear, bounded, and reversible?                 [YES→continue | NO→clarify/plan]
+□ Does it avoid auth/security, data/schema, and destructive risk? [YES→continue | NO→full review/gates]
+□ Is there no required Themis/audit handoff for this change?     [YES→continue | NO→preserve that review]
 
-| Aspect | Subtask | Full Task |
-|--------|---------|-----------|
-| Scope | Single file, <10 lines, read-only | Feature, multi-file, schema change |
-| Risk | Low (no security/data implications) | Any risk level |
-| Artifact | ❌ No IMPL artifact | ✅ IMPL artifact required |
-| Themis review | ❌ None | ✅ Mandatory |
-| Use case | Apollo discovery, Talos hotfix, bounded fix | Feature implementation, migration, API change |
-
-### Concrete Examples
-
-| Task | Scope | Risk | Subtask? | Why |
-|------|-------|------|----------|-----|
-| Fix typo in CSS class | 1 file, 1 line | None | ✅ | Bounded, no security impact |
-| Add error handling to existing endpoint | 1 file, 5 lines | Low | ✅ | No schema change |
-| Implement login endpoint | 2+ files, 50+ lines | High (auth) | ❌ | Security-critical, needs Themis |
-| Database migration | 1 file, 15 lines | High (data) | ❌ | Data loss risk, needs rollback |
-| Apollo codebase search | 0 files | None | ✅ | Read-only investigation |
-| Update README | 1 file, 3 lines | None | ✅ | Documentation only |
+ALL YES → direct/lightweight execution; no routine plan or artifact
+ANY NO  → add only the planning, artifact, specialist review, and approval gates the risk requires
+```
 
 ### Safety Rules
-1. **Bounded scope** — single file or read-only investigation
+1. **Bounded scope** — can be a small multi-file change or a read-only investigation
 2. **Low risk** — no security implications, no data loss, no breaking changes
-3. **No Themis dependency** — output doesn't feed into a phase that requires review
+3. **No required Themis dependency** — sensitive/material output retains its review gate
 
 ## Subtask Return Format
-Return the standard `## subtask_summary` defined in `## Agent Return Format` (files_changed, summary, tests, coverage, tokens, status, blockers).
+Return the required `## subtask_summary` fields defined in `## Agent Return Format`; include `memory_context` when memory was used.
 
 ## Timeout Parcial (Partial Results)
 

package/src/mcp/{code_mode_server.py → code_mode.py}

@@ -5,12 +5,12 @@ Provides a confined execution environment for orchestration scripts
 via MCP tools and resources.
 
 Usage:
-    python scripts/code_mode_server.py
+    python scripts/code_mode.py
 
 Or via MCP client (stdio transport):
     pantheon-code-mode:
         command: python
-        args: ["scripts/code_mode_server.py"]
+        args: ["scripts/code_mode.py"]
 """
 
 from __future__ import annotations
@@ -20,6 +20,11 @@ import hashlib
 import json
 import logging
 import os
+
+try:
+    import resource
+except (ImportError, OSError, ValueError):  # pragma: no cover - platform-specific
+    resource = None  # type: ignore[assignment]
 import shutil
 import signal
 import stat
@@ -31,7 +36,7 @@ from typing import Any
 
 import yaml
 from _pantheon_paths import pantheon_home, pantheon_project
-from mcp.server.fastmcp import FastMCP
+from fastmcp import FastMCP
 
 # ── Constants ─────────────────────────────────────────────────────────────────
 ALLOWED_EXTENSIONS: frozenset[str] = frozenset({".sh", ".py"})
@@ -125,6 +130,88 @@ def _build_script_env(
     return env
 
 
+# Additional tasks a sandboxed script may create beyond the UID's current
+# count. RLIMIT_NPROC is a per-real-UID limit on the *total* number of
+# processes AND threads, so the sandbox floor must clear everything the host
+# already owns before a script can fork at all. This headroom is the actual
+# anti-fork-bomb budget: the script still cannot exceed current + headroom.
+NPROC_HEADROOM: int = 64
+
+
+def _uid_task_count() -> int | None:
+    """Count the tasks (processes + threads) this real UID already owns.
+
+    The kernel compares the post-fork total against RLIMIT_NPROC, so this is
+    the number the sandbox limit has to exceed. Returns *None* when the count
+    cannot be established (no readable ``/proc``), which makes the caller
+    fail open on ``--nproc`` rather than pin a value that may be too low and
+    break every script.
+
+    The tally is one too high per process: ``/proc/<pid>/task`` already lists
+    the thread-group leader, so the extra ``1`` counts it twice. That bias
+    only widens the derived limit (the fail-open direction), so it is left in
+    place deliberately.
+    """
+    uid = os.getuid()
+    count = 0
+    try:
+        pids = os.listdir("/proc")
+    except OSError:
+        return None
+    for pid in pids:
+        if not pid.isdigit():
+            continue
+        proc_dir = f"/proc/{pid}"
+        try:
+            if os.stat(proc_dir).st_uid != uid:
+                continue
+            # ``/proc/<pid>/task`` already includes the thread-group leader,
+            # so the extra 1 counts it twice (over-count by one per process).
+            count += 1 + len(os.listdir(f"{proc_dir}/task"))
+        except OSError:
+            # Process exited between listdir and stat, or is not ours to read.
+            continue
+    return count
+
+
+def _sandbox_nproc() -> str | None:
+    """Return the ``--nproc`` value for a sandboxed script, or *None*.
+
+    Derived from the host rather than hardcoded: the value is the UID's
+    current task count plus ``NPROC_HEADROOM``, clamped to the hard limit
+    (``prlimit`` fails with EPERM above it, and an unprivileged process cannot
+    raise its soft limit past the hard one).
+
+    Returns *None* when the count or the limit cannot be read, in which case
+    the caller omits ``--nproc``. ``--as`` and ``--cpu`` still apply, so the
+    sandbox keeps its memory and CPU boundaries.
+    """
+    current = _uid_task_count()
+    if current is None:
+        _log.warning(
+            "code-mode: cannot count this UID's tasks; omitting --nproc, so "
+            "the sandboxed script's fork budget is unbounded"
+        )
+        return None
+    if resource is None:
+        _log.warning(
+            "code-mode: cannot read RLIMIT_NPROC; omitting --nproc, so the "
+            "sandboxed script's fork budget is unbounded"
+        )
+        return None
+    try:
+        _soft, hard = resource.getrlimit(resource.RLIMIT_NPROC)
+    except (OSError, ValueError):
+        _log.warning(
+            "code-mode: cannot read RLIMIT_NPROC; omitting --nproc, so the "
+            "sandboxed script's fork budget is unbounded"
+        )
+        return None
+    if hard == getattr(resource, "RLIM_INFINITY", -1):
+        return str(current + NPROC_HEADROOM)
+    return str(max(1, min(current + NPROC_HEADROOM, hard)))
+
+
 def _prlimit_prefix(
     prlimit_path: str | None,
     timeout_s: int = SCRIPT_TIMEOUT,
@@ -132,21 +219,34 @@ def _prlimit_prefix(
     """Return a ``prlimit`` command prefix to wrap a subprocess, or *None*.
 
     On Linux with ``prlimit`` available the prefix adds:
-      --nproc=512  --as=1073741824  --cpu=<timeout_s + 5>
-
-    On non-Linux or when *prlimit_path* is falsy, returns *None* (fail-open).
+      --nproc=<uid task count + NPROC_HEADROOM>  --as=1073741824
+      --cpu=<timeout_s + 5>
+
+    ``--nproc`` is derived per invocation by :func:`_sandbox_nproc` rather
+    than hardcoded. RLIMIT_NPROC is a per-real-UID total across processes AND
+    threads, so a fixed value below the host's current usage makes the very
+    first ``fork()`` inside the sandbox fail with EAGAIN — which is exactly
+    what a hardcoded ``--nproc=512`` did on a host already running more than
+    512 tasks. The isolation property is unchanged: a script still cannot
+    create more than ``NPROC_HEADROOM`` additional tasks.
+
+    On non-Linux, when *prlimit_path* is falsy, or when the nproc limit cannot
+    be derived, the flag is omitted (fail-open); ``--as``/``--cpu`` remain.
     """
     if not prlimit_path:
         return None
 
     cpu_limit = timeout_s + 5
-    return [
-        prlimit_path,
-        "--nproc=512",
+    prefix = [prlimit_path]
+    nproc = _sandbox_nproc()
+    if nproc is not None:
+        prefix.append(f"--nproc={nproc}")
+    prefix += [
         "--as=1073741824",  # 1 GiB in bytes
         f"--cpu={cpu_limit}",
         "--",
     ]
+    return prefix
 
 
 def _detect_prlimit() -> str | None:
@@ -226,7 +326,9 @@ def _packaged_scripts_dir() -> Path | None:
     return None
 
 
-def _resolve_scripts_dir(candidates: list[Path], *, allow_packaged: bool = True) -> Path | None:
+def _resolve_scripts_dir(
+    candidates: list[Path], *, allow_packaged: bool = True
+) -> Path | None:
     """Select the first usable candidate, optionally trying the package copy."""
     for candidate in candidates:
         if _has_usable_scripts(candidate):
@@ -377,9 +479,7 @@ def _load_manifest(scripts_dir: Path | None = None) -> dict[str, str]:
         ) from None
 
     if not isinstance(data, dict):
-        raise ManifestError(
-            "CORRUPT_DATA", "Code-mode manifest must be a JSON object."
-        )
+        raise ManifestError("CORRUPT_DATA", "Code-mode manifest must be a JSON object.")
 
     if data.get("version") != 1:
         raise ManifestError(
@@ -527,7 +627,6 @@ def _contract_result(
     return f"[{status}] {message}"
 
 
-
 def _format_output(
     stdout: str,
     stderr: str,
@@ -818,22 +917,15 @@ async def execute_code_script(
                 timeout_s=timeout_s,
                 status="TIMEOUT",
             )
-    except FileNotFoundError:
-        return _build_result(
-            "",
-            f"Script '{script_name}' not found or interpreter missing.",
-            -1,
-            timed_out=False,
-            duration_ms=0,
-            metadata=metadata,
-            json_output=json_output,
-            timeout_s=timeout_s,
-            status="UNAVAILABLE",
-        )
     except OSError as e:
+        error = (
+            f"Script '{script_name}' not found or interpreter missing."
+            if isinstance(e, FileNotFoundError)
+            else f"Failed to execute script: {e}"
+        )
         return _build_result(
             "",
-            f"Failed to execute script: {e}",
+            error,
             -1,
             timed_out=False,
             duration_ms=0,

package/src/mcp/eval_store.py

@@ -2,7 +2,7 @@
 """Plugin eval certification storage — ``plugin_eval`` memory namespace.
 
 Thin stdlib-only wrapper around the memory SQLite DB (same schema as
-``src/mcp/memory_mcp_server.py``) for plugin-eval certification results.
+``src/mcp/memory_mcp.py``) for plugin-eval certification results.
 
 Namespace: ``plugin_eval``
 Key format: ``eval:<name>:<date>``  (e.g. ``eval:tdd-with-agents:2026-08-21``)
@@ -30,7 +30,7 @@ from typing import Any
 
 NAMESPACE = "plugin_eval"
 
-# Minimal schema — matches memory_mcp_server.SCHEMA_SQL for the memories
+# Minimal schema — matches memory_mcp.SCHEMA_SQL for the memories
 # table (vec/FTS tables are initialized by the memory MCP server on first
 # run; eval entries remain readable via list/recall regardless).
 _SCHEMA_SQL = """