AbstractRuntime 0.10.4__tar.gz → 0.10.6__tar.gz

{abstractruntime-0.10.4 → abstractruntime-0.10.6}/CHANGELOG.md

@@ -5,6 +5,27 @@ All notable changes to AbstractRuntime will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.10.6] - 2026-10-18
+
+### Added
+
+- `abstractruntime.conversation_search.ConversationSearch`: keyword search over a plane's conversations: each turn's question and answer (as the session replay builds them) and its media, the artifacts it generated (kind and generation prompt, attributed to the turn whose run made them) and the attachments it was sent with (kind and file name); read-aloud audio and internal artifacts are not media. A hit on an artifact names it (`artifact`: id, owning run, kind, content type), so a client can show it. Its own SQLite file per plane, an FTS5 `trigram` index over text lowercased and without accents: words and parts of words, every word required, words of one or two letters as whole words, and a fuzzy pass that keeps a turn holding at least 60% of each word's trigrams (a typo still finds it). One hit per session (its best turn, a snippet, the match positions, where it matched: question, artifact or answer). Tool usage, tool outputs and intermediate thinking are not indexed: [backlog 0849](docs/backlog/proposed/0849_conversation_search_tool_usage_outputs_and_thinking.md). `sync(budget_s=…)` indexes what changed since the last call, newest sessions first, and reports what is left. Works with the file and the SQLite run stores; without the `trigram` tokenizer (SQLite < 3.34) it indexes whole words with prefixes.
+
+- Automation definitions accept a named `policy.tool_policy` snapshot for per-tool Auto and Approve choices. The target tool ceiling remains authoritative; unspecified tools ask for approval. Messaging and untrusted-input restrictions remain enforced. See [Tool approval](docs/automations.md#tool-approval).
+- Streamed read-aloud recordings (`_finalize_tts_stream_artifact`, the streamed-voice path of the AbstractCore integration) are stored under the voice namespace: their artifact tags carry `purpose=voice_playback`, `artifact_space=voice`, a `filename` and a logical `path` of `voice/tts-<id>.wav`, so a host can list a user's generated documents and attachments without the playback audio while playback and replay keep the same artifact ref and provenance. Test: `tests/test_streamed_voice_namespace.py`.
+
+## [0.10.5] - 2026-10-18
+
+### Changed
+
+- The pooled client wires every client it builds in one place (`_adopt_client`): the residency core, the
+  Core execution context, the host's endpoint-profile resolver and the pool-wide token callback reach the
+  text clients, the per-call override clients and the media host through the same path, and a setting
+  applied later reaches all of them through `_owned_clients`. No behaviour change. Tests:
+  `tests/test_endpoint_profile_media_end_to_end.py` (an image spec on an `endpoint:<id>` profile reaches
+  that endpoint through the `LLM_CALL` handler, the pooled client and AbstractCore's capability host, with
+  and without a text provider on the call).
+
 ## [0.10.4] - 2026-10-18
 
 ### Fixed

{abstractruntime-0.10.4 → abstractruntime-0.10.6}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: AbstractRuntime
-Version: 0.10.4
+Version: 0.10.6
 Summary: AbstractRuntime: a durable graph runner designed to pair with AbstractCore.
 Project-URL: AbstractCore (website), https://www.abstractcore.ai/
 Project-URL: AbstractRuntime (GitHub), https://github.com/lpalbou/abstractruntime

{abstractruntime-0.10.4 → abstractruntime-0.10.6}/docs/README.md

@@ -32,6 +32,7 @@ In this repo, the AbstractCore wiring lives under `src/abstractruntime/integrati
 - `tool-approval.md` — tool risk tiers, the run-policy rank ceiling, and per-call refiners (the `send_email` recipient rule: self and pre-authorised recipients)
 - `api.md#workflowbundles-flow-and-visualflow-distribution` — VisualFlow compiler APIs, media nodes, and document nodes (`read_pdf` / `write_pdf` / `write_docx`)
 - `api.md#sessions-and-history` — session history replay: one window, the most recent 50,000 tokens of whole turns (`HISTORY_REPLAY_MAX_TOKENS`), returned as a `ReplayedHistory` whose `.report` records what was replayed and dropped
+- `api.md#conversation-search` — keyword search over a plane's conversations (`ConversationSearch`): questions, answers and the turn's artifacts, one SQLite FTS5 trigram index per plane, incremental `sync` with a time budget, exact then fuzzy matching
 - `api.md#run-history-bundle-export-portable-replay-artifact` — run history bundles, including `resolved_actions` summaries for cross-client capability replay
 
 ## Features (reference)

{abstractruntime-0.10.4 → abstractruntime-0.10.6}/docs/api.md

@@ -291,6 +291,16 @@ Implementation: `src/abstractruntime/session_turns.py`, `src/abstractruntime/ses
 
 History bundles (`export_run_history_bundle`) and session replay use the same turn selection, so automation occurrences appear as turns (kind `occurrence`, with `automation_id` and `occurrence_index`) in both.
 
+## Conversation search
+
+Implementation: `src/abstractruntime/conversation_search.py`.
+
+- `ConversationSearch(db_path, *, run_store, ledger_store, artifact_store=None, kinds=None)`: the keyword search index of one runtime plane. `db_path` is its own SQLite file in that plane's data folder (one index per plane, so a principal's search can only ever read the plane it was opened on; the file is disposable and is rebuilt when the schema changes). Each turn root (a question and its answer, as the session replay builds them) is one row, together with the turn's media: the artifacts its run generated (image, voice, video, music, by their generation prompt) and the attachments it was sent with (by their file name), each with its kind. Read-aloud audio, media saved without a prompt and internal artifacts are not indexed. `kinds` defaults to `INDEXED_KINDS` (`chat`, `discussion`): automation sessions are not indexed
+- `sync(*, budget_s=3.0) -> SyncReport`: indexes what changed since the last call (turn roots whose `updated_at` moved, re-read by session, newest sessions first) within the time budget. `SyncReport`: `{indexed_turns, reindexed_sessions, pending_sessions, total_turns, seconds, complete, errors}`; `complete` is `False` while older conversations are still waiting, so a first search on a large plane can say it is still indexing
+- `search(query, *, limit=20, sessions=None, exclude=None, session_kinds=None) -> list[SearchHit]`: one hit per session, best first. Text is indexed and queried lowercased and without accents (`normalize`) with the FTS5 `trigram` tokenizer: every query word of three or more characters must appear in the turn, as a word or part of one ("surviv" finds "overall survival"); words of one or two characters are matched as whole words; ranked by bm25, the question weighing more than the answer. When exact matches are fewer than `limit`, a fuzzy pass keeps turns holding at least `FUZZY_MIN` (60%) of each word's trigrams, so a typo still finds its turn (`fuzzy: true` on those hits). `sessions`, `exclude` and `session_kinds` filter inside the query, so a filter never empties a page that had matches further down. `limit` is clamped to 1–100
+- `SearchHit` (`as_dict()`): `session_id`, `run_id` (the best turn), `prompt`, `snippet` (around the first match), `matched_in` (`question`, `answer` or `artifact`), `highlights` (`[start, length]` pairs in the snippet), `score`, `created_at`, `updated_at`, `session_kind`, `fuzzy`, and `artifact` when the match is an artifact: `{artifact_id, run_id, kind, content_type, name, prompt}`, `run_id` being the run that owns it (a host's artifact content route is scoped to that run)
+- Without the `trigram` tokenizer (SQLite before 3.34) the index falls back to whole words with prefix matching. Tool usage, tool outputs and intermediate thinking are not indexed: [backlog 0849](backlog/proposed/0849_conversation_search_tool_usage_outputs_and_thinking.md)
+
 ## Run history bundle export (portable replay artifact)
 
 Implementation: `src/abstractruntime/history_bundle.py`.
@@ -352,11 +362,12 @@ Multimodal support:
 - remote and hybrid clients support AbstractCore Server chat media content arrays plus image generation, image edits, image upscaling, text-to-video, image-to-video, speech, music generation, and transcription endpoints; pass an output-specific `model` for remote media provider routing, otherwise the server endpoint can use its configured capability default
 - remote transcription requires one audio media item that resolves to a local file path or artifact-backed temporary file
 - generated image/video/voice/music/audio bytes require a runtime `ArtifactStore`; the result contains `artifact_id` / `artifact_ref` instead of inline bytes
+- streamed TTS playback artifacts carry `purpose=voice_playback`, `artifact_space=voice` and a logical `voice/tts-<id>.wav` path in their tags; hosts can separate read-aloud recordings from user attachments while retaining their artifact refs and provenance
 - with the pooled local client (`MultiLocalAbstractCoreLLMClient`), a request whose outputs are all non-text (image, video, voice, music, transcription) and that carries no tools never builds the text client: it runs on AbstractCore's capability host (`CapabilityHostProvider`, no text model), and so does streaming TTS. A text default that cannot be built (an engine not installed) therefore never blocks speech or image generation
 - media-only normalized results expose `runtime_provider` / `runtime_model` separately from `media_provider` / `media_model`
 - local image/video generation runs in a one-shot subprocess (`execution_mode="local_one_shot_subprocess"`) unless every requested media model is resident (explicitly loaded with `load_model_residency`), in which case it runs in-process on the loaded pipeline (`execution_mode="resident_in_process"`, `resident_load_ids`)
 - a media spec whose `provider` is an endpoint profile (`endpoint:<id>`) never uses the one-shot subprocess: it is an HTTP call to that endpoint, and the host's endpoint-profile resolver (`set_provider_endpoint_profile_resolver`) exists only in this process
-- the `LLM_CALL` handler resolves only the call's own `provider` (`endpoint:<id>` on the effect payload) into Core routing params (`_provider`, `base_url`, `provider_api_key`); an endpoint profile named on an output spec stays on the spec, and the media plugin resolves it through the resolver the host attached to the client. The pooled client attaches that resolver to its media host too
+- the `LLM_CALL` handler resolves only the call's own `provider` (`endpoint:<id>` on the effect payload) into Core routing params (`_provider`, `base_url`, `provider_api_key`); an endpoint profile named on an output spec stays on the spec, and the media plugin resolves it through the resolver the host attached to the client. Every client the pooled client builds carries that resolver: the text clients, the per-call override clients and the media host that serves media-only calls
 - optional local media residency failures complete with `status_hint="warning"` and `degraded=true`; local media warmup that no capability plugin can serve (`image_generation`, `image_upscale`, `video_generation`, `text_to_video`, `image_to_video`, `tts`, `stt`, `music_generation`) reports `requires_long_lived_server=true`, and image/video tasks also report `execution_mode="local_one_shot_subprocess"`
 - Gateway/hosts remain responsible for explicit Core server URLs, Core server auth headers, provider/model defaults, selected local-inference profiles, and translation of Gateway-owned env/config into explicit Runtime inputs; Runtime persists only JSON-safe routing metadata and artifact refs
 

{abstractruntime-0.10.4 → abstractruntime-0.10.6}/docs/automations.md

@@ -104,7 +104,7 @@ unknown fields are rejected at every level.
 | `target` | `{workflow_id, bundle_ref, flow_id, input_data}`: a concrete workflow; a host resolves `@default` before creating (`flow_id: "@default"` is refused) |
 | `trigger` | `{binding_id, source_id, source_version, config}`; the runtime creates `binding_id` |
 | `context` | `{mode: "independent" \| "growing", growing: {}}` |
-| `policy` | `{serial: true, misfire: "coalesce", failure: "continue", retry, tool_approval, email_allowed_recipients, untrusted_input_tools}` |
+| `policy` | `{serial: true, misfire: "coalesce", failure: "continue", retry, tool_approval, tool_policy?, email_allowed_recipients, untrusted_input_tools}` |
 | `notify` | `{channels: ["console"] \| ["console", "email"]}`: where attention items are delivered (default `["console"]`) |
 | `session_id` | `automation:<automation_id>` |
 | `workspace_root` | absolute path given to every occurrence |
@@ -457,7 +457,25 @@ returns the refusal message for a tool, or `None` when it is allowed.
 
 ## Tool approval
 
-`policy.tool_approval` decides whether the target's tools may run without asking.
+Optional `policy.tool_policy` stores a complete named snapshot:
+
+```json
+{"auto_approve_tools": ["read_file"], "require_approval_tools": ["execute_command"]}
+```
+
+When present it takes precedence over `tool_approval`. Require-approval wins if a tool
+appears in both lists; unmentioned candidate tools require approval. Tool availability
+still comes from `target.input_data.tools` and `_runtime.allowed_tools`; explicit `[]`
+denies all tools. The controller compiles this policy into the occurrence's runtime inputs
+at admission. Edits affect subsequent occurrences, preserving the current run's grant.
+
+Named Auto is individual consent for untrusted-input tools. For untrusted triggers,
+message-sending tools remain withheld and MCP tools remain unavailable. Trusted triggers
+retain their existing messaging and recipient restrictions. Source restrictions remain in force.
+Omit the field for legacy behavior, or revise it to `null` to restore that behavior.
+Older runtimes that lack this field reject it rather than silently discarding the policy.
+
+Without a named snapshot, `policy.tool_approval` decides whether the target's tools may run without asking.
 
 - **`"auto"` (default).** An automation runs unattended and cannot ask a person before every tool call, so creating
   the automation is the consent; client forms state that its tools run without asking and list them. At admission,

{abstractruntime-0.10.4 → abstractruntime-0.10.6}/docs/backlog/README.md

@@ -13,7 +13,7 @@ If you are new to the project, start with `../README.md` and `../architecture.md
 ## Counts
 
 - Planned: 29
-- Proposed: 12
+- Proposed: 13
 - Completed: 35
 - Deprecated: 13
 - Recurrent: 0
@@ -171,6 +171,7 @@ four-digit space rather than the completed records.
 | ID | Item |
 |----|------|
 | 0031 | `proposed/0031_runtime_tool_spec_adapters_for_gateway_and_mcp.md` |
+| 0849 | [Conversation search: tool usage, tool outputs and intermediate thinking](proposed/0849_conversation_search_tool_usage_outputs_and_thinking.md): proposed 2026-10-18; the sources left out of `ConversationSearch` on purpose, with costs and risks. |
 | 0036 | `proposed/0036_local_media_residency_bridge_to_core_residency.md` |
 | 0038 | `proposed/0038_core_server_pool_residency_affinity.md` |
 | 0056 | `proposed/runtime_systemic_reliability/0056_schema_version_and_quarantine_loading.md` |

abstractruntime-0.10.6/docs/backlog/proposed/0849_conversation_search_tool_usage_outputs_and_thinking.md

@@ -0,0 +1,40 @@
+# 0849 — Conversation search: tool usage, tool outputs and intermediate thinking
+
+- **Status**: PROPOSED 2026-10-18
+- **Owner**: runtime (`conversation_search.py`), surfaced by the gateway (`GET /api/gateway/sessions/search`)
+- **Origin**: operator, while building conversation search for the Apple Watch (2026-10-18): the
+  index holds each turn's question, answer and media (generated artifacts' kind and prompt,
+  attachments' kind and file name). These three sources were weighed and left out on purpose.
+
+## What is indexed today
+
+`ConversationSearch` keeps one row per turn root: the question and the answer as the session replay
+builds them, and the turn's media. An FTS5 `trigram` index over text lowercased and without accents;
+exact matches first, then a fuzzy pass; filters (archived, session purpose, kinds) inside the query.
+
+## Proposed sources
+
+1. **Tool usage per turn** — the tools a turn called and their key arguments: search terms, URLs,
+   file names, commands ("the conversation where it read the Apple support page"). Source: the
+   turn's agent run(s) `tool_calls` ledger records (`effect.payload.tool_calls[{name, arguments}]`),
+   read once when the turn is indexed (a turn's ledger does not change after it ends). Cost: one
+   ledger read per new turn; agent ledgers are 0.2–3 MB, mostly thinking records, so the read needs
+   a records-of-one-type path (or the compact ledger mode the watch's live activity also wants).
+   Index the arguments only (name + the argument values a person would recognise, cut at ~200
+   characters each), never the results.
+2. **Tool outputs** — what tools returned (pages read, command output, file contents). Large (30–90
+   KB per call), noisy (a web page matches most words), and sensitive (file contents, command
+   output, tokens printed by a command would become searchable from a search box). If ever
+   indexed: opt-in per account, outputs cut short, and a redaction pass for secrets.
+3. **Intermediate thinking** — the agent's own words between tool calls (`result.content` of its
+   thinking steps; the last one is the answer, already indexed). Small and often useful ("I'll
+   check the logs first"), but it is the model's working text, not what the person was told; mixed
+   into results it would surface claims the answer later corrected. If indexed: its own field,
+   weighted below the answer, shown as "while working".
+
+## Open questions
+
+- One ledger read per turn at index time vs. a runtime-maintained per-turn digest written when the
+  turn ends (cheaper reads, one more write path).
+- Whether the gateway's compact ledger mode (proposed for the watch's live activity) should be the
+  common source for both.

{abstractruntime-0.10.4 → abstractruntime-0.10.6}/llms-full.txt

@@ -1161,6 +1161,16 @@ Implementation: `src/abstractruntime/session_turns.py`, `src/abstractruntime/ses
 
 History bundles (`export_run_history_bundle`) and session replay use the same turn selection, so automation occurrences appear as turns (kind `occurrence`, with `automation_id` and `occurrence_index`) in both.
 
+## Conversation search
+
+Implementation: `src/abstractruntime/conversation_search.py`.
+
+- `ConversationSearch(db_path, *, run_store, ledger_store, artifact_store=None, kinds=None)`: the keyword search index of one runtime plane. `db_path` is its own SQLite file in that plane's data folder (one index per plane, so a principal's search can only ever read the plane it was opened on; the file is disposable and is rebuilt when the schema changes). Each turn root (a question and its answer, as the session replay builds them) is one row, together with the turn's media: the artifacts its run generated (image, voice, video, music, by their generation prompt) and the attachments it was sent with (by their file name), each with its kind. Read-aloud audio, media saved without a prompt and internal artifacts are not indexed. `kinds` defaults to `INDEXED_KINDS` (`chat`, `discussion`): automation sessions are not indexed
+- `sync(*, budget_s=3.0) -> SyncReport`: indexes what changed since the last call (turn roots whose `updated_at` moved, re-read by session, newest sessions first) within the time budget. `SyncReport`: `{indexed_turns, reindexed_sessions, pending_sessions, total_turns, seconds, complete, errors}`; `complete` is `False` while older conversations are still waiting, so a first search on a large plane can say it is still indexing
+- `search(query, *, limit=20, sessions=None, exclude=None, session_kinds=None) -> list[SearchHit]`: one hit per session, best first. Text is indexed and queried lowercased and without accents (`normalize`) with the FTS5 `trigram` tokenizer: every query word of three or more characters must appear in the turn, as a word or part of one ("surviv" finds "overall survival"); words of one or two characters are matched as whole words; ranked by bm25, the question weighing more than the answer. When exact matches are fewer than `limit`, a fuzzy pass keeps turns holding at least `FUZZY_MIN` (60%) of each word's trigrams, so a typo still finds its turn (`fuzzy: true` on those hits). `sessions`, `exclude` and `session_kinds` filter inside the query, so a filter never empties a page that had matches further down. `limit` is clamped to 1–100
+- `SearchHit` (`as_dict()`): `session_id`, `run_id` (the best turn), `prompt`, `snippet` (around the first match), `matched_in` (`question`, `answer` or `artifact`), `highlights` (`[start, length]` pairs in the snippet), `score`, `created_at`, `updated_at`, `session_kind`, `fuzzy`, and `artifact` when the match is an artifact: `{artifact_id, run_id, kind, content_type, name, prompt}`, `run_id` being the run that owns it (a host's artifact content route is scoped to that run)
+- Without the `trigram` tokenizer (SQLite before 3.34) the index falls back to whole words with prefix matching. Tool usage, tool outputs and intermediate thinking are not indexed: [backlog 0849](backlog/proposed/0849_conversation_search_tool_usage_outputs_and_thinking.md)
+
 ## Run history bundle export (portable replay artifact)
 
 Implementation: `src/abstractruntime/history_bundle.py`.
@@ -1222,11 +1232,12 @@ Multimodal support:
 - remote and hybrid clients support AbstractCore Server chat media content arrays plus image generation, image edits, image upscaling, text-to-video, image-to-video, speech, music generation, and transcription endpoints; pass an output-specific `model` for remote media provider routing, otherwise the server endpoint can use its configured capability default
 - remote transcription requires one audio media item that resolves to a local file path or artifact-backed temporary file
 - generated image/video/voice/music/audio bytes require a runtime `ArtifactStore`; the result contains `artifact_id` / `artifact_ref` instead of inline bytes
+- streamed TTS playback artifacts carry `purpose=voice_playback`, `artifact_space=voice` and a logical `voice/tts-<id>.wav` path in their tags; hosts can separate read-aloud recordings from user attachments while retaining their artifact refs and provenance
 - with the pooled local client (`MultiLocalAbstractCoreLLMClient`), a request whose outputs are all non-text (image, video, voice, music, transcription) and that carries no tools never builds the text client: it runs on AbstractCore's capability host (`CapabilityHostProvider`, no text model), and so does streaming TTS. A text default that cannot be built (an engine not installed) therefore never blocks speech or image generation
 - media-only normalized results expose `runtime_provider` / `runtime_model` separately from `media_provider` / `media_model`
 - local image/video generation runs in a one-shot subprocess (`execution_mode="local_one_shot_subprocess"`) unless every requested media model is resident (explicitly loaded with `load_model_residency`), in which case it runs in-process on the loaded pipeline (`execution_mode="resident_in_process"`, `resident_load_ids`)
 - a media spec whose `provider` is an endpoint profile (`endpoint:<id>`) never uses the one-shot subprocess: it is an HTTP call to that endpoint, and the host's endpoint-profile resolver (`set_provider_endpoint_profile_resolver`) exists only in this process
-- the `LLM_CALL` handler resolves only the call's own `provider` (`endpoint:<id>` on the effect payload) into Core routing params (`_provider`, `base_url`, `provider_api_key`); an endpoint profile named on an output spec stays on the spec, and the media plugin resolves it through the resolver the host attached to the client. The pooled client attaches that resolver to its media host too
+- the `LLM_CALL` handler resolves only the call's own `provider` (`endpoint:<id>` on the effect payload) into Core routing params (`_provider`, `base_url`, `provider_api_key`); an endpoint profile named on an output spec stays on the spec, and the media plugin resolves it through the resolver the host attached to the client. Every client the pooled client builds carries that resolver: the text clients, the per-call override clients and the media host that serves media-only calls
 - optional local media residency failures complete with `status_hint="warning"` and `degraded=true`; local media warmup that no capability plugin can serve (`image_generation`, `image_upscale`, `video_generation`, `text_to_video`, `image_to_video`, `tts`, `stt`, `music_generation`) reports `requires_long_lived_server=true`, and image/video tasks also report `execution_mode="local_one_shot_subprocess"`
 - Gateway/hosts remain responsible for explicit Core server URLs, Core server auth headers, provider/model defaults, selected local-inference profiles, and translation of Gateway-owned env/config into explicit Runtime inputs; Runtime persists only JSON-safe routing metadata and artifact refs
 
@@ -3686,7 +3697,7 @@ unknown fields are rejected at every level.
 | `target` | `{workflow_id, bundle_ref, flow_id, input_data}`: a concrete workflow; a host resolves `@default` before creating (`flow_id: "@default"` is refused) |
 | `trigger` | `{binding_id, source_id, source_version, config}`; the runtime creates `binding_id` |
 | `context` | `{mode: "independent" \| "growing", growing: {}}` |
-| `policy` | `{serial: true, misfire: "coalesce", failure: "continue", retry, tool_approval, email_allowed_recipients, untrusted_input_tools}` |
+| `policy` | `{serial: true, misfire: "coalesce", failure: "continue", retry, tool_approval, tool_policy?, email_allowed_recipients, untrusted_input_tools}` |
 | `notify` | `{channels: ["console"] \| ["console", "email"]}`: where attention items are delivered (default `["console"]`) |
 | `session_id` | `automation:<automation_id>` |
 | `workspace_root` | absolute path given to every occurrence |
@@ -4039,7 +4050,25 @@ returns the refusal message for a tool, or `None` when it is allowed.
 
 ## Tool approval
 
-`policy.tool_approval` decides whether the target's tools may run without asking.
+Optional `policy.tool_policy` stores a complete named snapshot:
+
+```json
+{"auto_approve_tools": ["read_file"], "require_approval_tools": ["execute_command"]}
+```
+
+When present it takes precedence over `tool_approval`. Require-approval wins if a tool
+appears in both lists; unmentioned candidate tools require approval. Tool availability
+still comes from `target.input_data.tools` and `_runtime.allowed_tools`; explicit `[]`
+denies all tools. The controller compiles this policy into the occurrence's runtime inputs
+at admission. Edits affect subsequent occurrences, preserving the current run's grant.
+
+Named Auto is individual consent for untrusted-input tools. For untrusted triggers,
+message-sending tools remain withheld and MCP tools remain unavailable. Trusted triggers
+retain their existing messaging and recipient restrictions. Source restrictions remain in force.
+Omit the field for legacy behavior, or revise it to `null` to restore that behavior.
+Older runtimes that lack this field reject it rather than silently discarding the policy.
+
+Without a named snapshot, `policy.tool_approval` decides whether the target's tools may run without asking.
 
 - **`"auto"` (default).** An automation runs unattended and cannot ask a person before every tool call, so creating
   the automation is the consent; client forms state that its tools run without asking and list them. At admission,
@@ -5928,6 +5957,7 @@ In this repo, the AbstractCore wiring lives under `src/abstractruntime/integrati
 - `tool-approval.md` — tool risk tiers, the run-policy rank ceiling, and per-call refiners (the `send_email` recipient rule: self and pre-authorised recipients)
 - `api.md#workflowbundles-flow-and-visualflow-distribution` — VisualFlow compiler APIs, media nodes, and document nodes (`read_pdf` / `write_pdf` / `write_docx`)
 - `api.md#sessions-and-history` — session history replay: one window, the most recent 50,000 tokens of whole turns (`HISTORY_REPLAY_MAX_TOKENS`), returned as a `ReplayedHistory` whose `.report` records what was replayed and dropped
+- `api.md#conversation-search` — keyword search over a plane's conversations (`ConversationSearch`): questions, answers and the turn's artifacts, one SQLite FTS5 trigram index per plane, incremental `sync` with a time budget, exact then fuzzy matching
 - `api.md#run-history-bundle-export-portable-replay-artifact` — run history bundles, including `resolved_actions` summaries for cross-client capability replay
 
 ## Features (reference)

{abstractruntime-0.10.4 → abstractruntime-0.10.6}/llms.txt

@@ -3,7 +3,7 @@
 > Durable workflow runtime (interrupt → checkpoint → resume) with an append-only execution ledger.
 
 - Python: 3.10+ (see `pyproject.toml`)
-- Version: 0.9.1
+- Version: 0.10.6
 - Ecosystem: [AbstractFramework](https://github.com/lpalbou/AbstractFramework) umbrella, integrates with [AbstractCore](https://github.com/lpalbou/abstractcore)
 - Hard invariant: `RunState.vars` must be JSON-serializable (`src/abstractruntime/core/models.py`)
 - Current AbstractCore baseline: base `abstractruntime` requires AbstractCore 2.24.0 or newer with its light install (remote providers, tools and the MCP worker, media routing); `abstractruntime[apple]` and `abstractruntime[gpu]` require AbstractCore's `apple` and `gpu` settings (`pyproject.toml`)
@@ -50,6 +50,7 @@
 - Host-local operator wrappers: the host facade exposes single-user email helpers (`list_email_accounts`, `list_emails`, `read_email`, `send_email`), `abstractruntime.integrations.abstractcore.email_facade` re-exports AbstractCore's mail library for multi-user hosts, and `abstractruntime.integrations.abstractcore.telegram_facade` exposes Telegram bootstrap/global-client/send wrappers without requiring hosts to import AbstractCore directly.
 - Durable outbound comms: when an email or Telegram send belongs to a run, use `get_abstractcore_run_facade(...).send_email(...)` or `send_telegram_message(...)` so Runtime records the request and outcome in a child run; replay should show the recorded result, not resend the message. If the child run waits for approval or passthrough execution, resume it through `resume_tool_calls(...)`.
 - [Artifacts](docs/artifacts.md): Runtime artifact identity, JSON-safe refs, canonical descriptors, generated-media provenance, tool-output offload thresholds, catalog search/stats, access counters, and Gateway/Observer retrieval boundaries.
+- [Conversation search](docs/api.md#conversation-search): `ConversationSearch(db_path, run_store=, ledger_store=, artifact_store=)` keeps one SQLite FTS5 trigram index per runtime plane over each turn's question, answer and media (generated artifacts by their prompt, attachments by their file name), lowercased and without accents; `sync(budget_s=)` indexes what changed within a time budget and reports what is left (`SyncReport`), `search(query, limit=, sessions=, exclude=, session_kinds=)` returns one `SearchHit` per session (its best turn, a snippet, highlight positions, `matched_in` question / answer / artifact, the matching `artifact`), exact matches first then a fuzzy pass that forgives a typo.
 - [Sessions and history](docs/api.md#sessions-and-history): `session_chat_messages(...)` replays a session's completed turns under one window, the most recent `HISTORY_REPLAY_MAX_TOKENS` (50,000) estimated tokens of whole messages, and returns a `ReplayedHistory` whose `.report` records replayed and dropped messages and tokens; `fold_history_window(...)` applies the same window to any turns, `window_transcript(...)` to a transcript you already hold, and `announce_dropped(...)` writes the window's `#TRUNCATION` notice.
 - [Artifacts API](docs/api.md#artifacts-store-by-reference): `ArtifactStore`, `ArtifactDescriptor`, `ArtifactAccessStats`, `search()`, `count()`, `facet_counts()`, and `stats()` for Runtime-owned catalog queries.
 - VisualFlow document/file nodes: `read_file`/`write_file` use workspace-scoped paths (`rel/path` or `mount_alias/rel/path` in Gateway-hosted runs), `read_pdf` extracts text/metadata with `pypdf`, `write_pdf` renders text or Markdown-style content to real PDF bytes with `reportlab`, `list_folder_files` enumerates workspace folders, `import_workspace_file` snapshots a server file into an artifact, `read_artifact` projects saved file content, and `export_artifact` writes a durable artifact back to a workspace path. Local Runtime-only runs without workspace scope still fall back to the process working directory for relative file-node paths.

{abstractruntime-0.10.4 → abstractruntime-0.10.6}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "AbstractRuntime"
-version = "0.10.4"
+version = "0.10.6"
 description = "AbstractRuntime: a durable graph runner designed to pair with AbstractCore."
 readme = "README.md"
 requires-python = ">=3.10"

abstractruntime-0.10.6/release-notes.md

@@ -0,0 +1,6 @@
+### Added
+
+- `abstractruntime.conversation_search.ConversationSearch`: keyword search over a plane's conversations: each turn's question and answer (as the session replay builds them) and its media, the artifacts it generated (kind and generation prompt, attributed to the turn whose run made them) and the attachments it was sent with (kind and file name); read-aloud audio and internal artifacts are not media. A hit on an artifact names it (`artifact`: id, owning run, kind, content type), so a client can show it. Its own SQLite file per plane, an FTS5 `trigram` index over text lowercased and without accents: words and parts of words, every word required, words of one or two letters as whole words, and a fuzzy pass that keeps a turn holding at least 60% of each word's trigrams (a typo still finds it). One hit per session (its best turn, a snippet, the match positions, where it matched: question, artifact or answer). Tool usage, tool outputs and intermediate thinking are not indexed: [backlog 0849](docs/backlog/proposed/0849_conversation_search_tool_usage_outputs_and_thinking.md). `sync(budget_s=…)` indexes what changed since the last call, newest sessions first, and reports what is left. Works with the file and the SQLite run stores; without the `trigram` tokenizer (SQLite < 3.34) it indexes whole words with prefixes.
+
+- Automation definitions accept a named `policy.tool_policy` snapshot for per-tool Auto and Approve choices. The target tool ceiling remains authoritative; unspecified tools ask for approval. Messaging and untrusted-input restrictions remain enforced. See [Tool approval](docs/automations.md#tool-approval).
+- Streamed read-aloud recordings (`_finalize_tts_stream_artifact`, the streamed-voice path of the AbstractCore integration) are stored under the voice namespace: their artifact tags carry `purpose=voice_playback`, `artifact_space=voice`, a `filename` and a logical `path` of `voice/tts-<id>.wav`, so a host can list a user's generated documents and attachments without the playback audio while playback and replay keep the same artifact ref and provenance. Test: `tests/test_streamed_voice_namespace.py`.

{abstractruntime-0.10.4 → abstractruntime-0.10.6}/src/abstractruntime/automations/controller.py

@@ -458,6 +458,28 @@ def grant_tool_approval(
     }
 
 
+def apply_named_tool_policy(input_data: Dict[str, Any], named_policy: Dict[str, Any], *, untrusted_input: bool = False) -> None:
+    """Compile an explicit named snapshot without weakening automation safeguards.
+
+    Unmentioned candidates require approval. Named Auto is individual consent for
+    untrusted-input tools. Existing messaging safeguards remain in force;
+    untrusted-input occurrences never receive MCP grants.
+    """
+    requested_auto = set(named_policy.get("auto_approve_tools", []))
+    requested_require = set(named_policy.get("require_approval_tools", []))
+    # The validated definition owns this policy, not a workflow-supplied grant.
+    runtime_ns = dict(input_data.get("_runtime") or {})
+    runtime_ns.pop("tool_policy", None)
+    input_data["_runtime"] = runtime_ns
+    grant_tool_approval(input_data, untrusted_input=untrusted_input,
+                        named_tools=sorted(requested_auto - requested_require), approval="ask" if untrusted_input else "auto")
+    policy = input_data["_runtime"]["tool_policy"]
+    candidates = set(policy["auto_approve_tools"]) | set(policy["withheld_tools"])
+    auto = set(policy["auto_approve_tools"]) & requested_auto - requested_require
+    policy["auto_approve_tools"] = sorted(auto)
+    policy["require_approval_tools"] = sorted(candidates - auto)
+
+
 # The flow input that makes an agent read `context.messages` (basic-agent's
 # `use_context` pin defaults to False; `include_context` is its alias, and
 # wins when present, so both are set).
@@ -540,7 +562,10 @@ def build_prepared(
     if isinstance(emails, list):
         resolve_vars = _freeze_email_inputs(turn, input_data, emails)
     approval = definition["policy"].get("tool_approval", "auto")
-    if approval == "auto" or untrusted:
+    named_policy = definition["policy"].get("tool_policy")
+    if isinstance(named_policy, dict):
+        apply_named_tool_policy(input_data, named_policy, untrusted_input=untrusted)
+    elif approval == "auto" or untrusted:
         # Untrusted input ALWAYS gets a per-run policy, under "ask" too: without one the
         # executor's static defaults decide, and they auto-run network and sending tools.
         grant_tool_approval(

{abstractruntime-0.10.4 → abstractruntime-0.10.6}/src/abstractruntime/automations/models.py

@@ -354,11 +354,25 @@ def validate_notify(value: Any) -> Dict[str, Any]:
     return result
 
 
+def validate_named_tool_policy(value: Any) -> Dict[str, Any]:
+    """Named approval snapshot; the target's allowed_tools remains the ceiling."""
+    policy = _require_mapping(value, "policy.tool_policy")
+    keys = ("auto_approve_tools", "require_approval_tools")
+    _reject_unknown(policy, keys, "policy.tool_policy")
+    result = {}
+    for key in keys:
+        names = policy.get(key, [])
+        if not isinstance(names, list) or any(not isinstance(n, str) or not n.strip() for n in names):
+            raise _invalid(f"policy.tool_policy.{key} must be a list of nonempty tool names", f"policy.tool_policy.{key}")
+        result[key] = sorted({n.strip() for n in names})
+    return result
+
+
 def validate_policy(value: Any) -> Dict[str, Any]:
     policy = _require_mapping(value if value is not None else {}, "policy")
     _reject_unknown(
         policy,
-        ("serial", "misfire", "failure", "retry", "tool_approval", "email_allowed_recipients", "untrusted_input_tools"),
+        ("serial", "misfire", "failure", "retry", "tool_approval", "email_allowed_recipients", "untrusted_input_tools", "tool_policy"),
         "policy",
     )
     tool_approval = policy.get("tool_approval", "auto")
@@ -389,6 +403,7 @@ def validate_policy(value: Any) -> Dict[str, Any]:
                 "max": _duration(backoff.get("max", DEFAULT_RETRY["backoff"]["max"]), "policy.retry.backoff.max"),
             },
         },
+        **({"tool_policy": validate_named_tool_policy(policy["tool_policy"])} if policy.get("tool_policy") is not None else {}),
         "tool_approval": tool_approval,
         "email_allowed_recipients": validate_email_allowed_recipients(
             policy.get("email_allowed_recipients", list(DEFAULT_EMAIL_ALLOWED_RECIPIENTS))