AbstractRuntime 0.18.0__tar.gz → 0.18.1__tar.gz

{abstractruntime-0.18.0 → abstractruntime-0.18.1}/CHANGELOG.md

@@ -10,6 +10,17 @@ Unreleased changes live in [`changelog.d/`](changelog.d/README.md), one file per
 
 ## [Unreleased]
 
+## [0.18.1] - 2026-11-04
+
+### Added
+
+- **A public update names the identity its run started with** (`replay/view.py`, ADR 0052, framework backlog 1119).
+  The replay view copies the run's `vars._runtime.identity_ref` (`{"of", "rev"}`, stamped by the gateway on visit,
+  summon, meet and session runs) onto each of that run's `public_update` messages as `identity_ref`, so a host serves
+  cached views with the ref already in place. A run without a ref, or with a malformed one, gives no field, never an
+  invented one; a snapshot read after the updates were folded stamps them then; the ref is part of the snapshot
+  digest, so the cursor token (an ETag) changes with it, and a run without a ref keeps the token it had.
+
 ## [0.18.0] - 2026-11-04
 
 ### Added

{abstractruntime-0.18.0 → abstractruntime-0.18.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: AbstractRuntime
-Version: 0.18.0
+Version: 0.18.1
 Summary: AbstractRuntime: a durable graph runner designed to pair with AbstractCore.
 Project-URL: AbstractCore (website), https://www.abstractcore.ai/
 Project-URL: AbstractRuntime (GitHub), https://github.com/lpalbou/abstractruntime
@@ -55,10 +55,15 @@ Description-Content-Type: text/markdown
 
 It is designed for long-running workflows that must survive restarts and explicitly model blocking (human input, timers, external events, subworkflows) without keeping Python stacks alive.
 
-**Version:** 0.18.0 • **Python:** 3.10+
+**Version:** 0.18.1 • **Python:** 3.10+
 
 **Status:** pre-1.0 (API may evolve). For production use, pin versions and follow `CHANGELOG.md`.
 
+## What's new in 0.18.1
+
+- **A public update names the identity its run started with**: the replay view copies the run's `identity_ref` onto
+  its public updates, so a host serving cached views shows who spoke; a run without one gets no field.
+
 ## What's new in 0.18.0
 
 - **Models unload after being idle**: a host sets how long a local model may sit unused (`set_model_idle_unload`,

{abstractruntime-0.18.0 → abstractruntime-0.18.1}/README.md

@@ -4,10 +4,15 @@
 
 It is designed for long-running workflows that must survive restarts and explicitly model blocking (human input, timers, external events, subworkflows) without keeping Python stacks alive.
 
-**Version:** 0.18.0 • **Python:** 3.10+
+**Version:** 0.18.1 • **Python:** 3.10+
 
 **Status:** pre-1.0 (API may evolve). For production use, pin versions and follow `CHANGELOG.md`.
 
+## What's new in 0.18.1
+
+- **A public update names the identity its run started with**: the replay view copies the run's `identity_ref` onto
+  its public updates, so a host serving cached views shows who spoke; a run without one gets no field.
+
 ## What's new in 0.18.0
 
 - **Models unload after being idle**: a host sets how long a local model may sit unused (`set_model_idle_unload`,

{abstractruntime-0.18.0 → abstractruntime-0.18.1}/docs/digital-identity.md

@@ -134,7 +134,8 @@ parse_identity_ref("session:sess_9f2a#1")  # a regular agent's identity rides it
 `{"of", "rev"}`, beside the signed entity stamp (`vars["_runtime"]["entity"]`) and never inside
 it: presentation is not authority. `stamp_run_identity_ref(vars, ref)` puts it there;
 `read_run_identity_ref(vars)` returns it, or `None` when the run carries none (a reference is never
-made up). An old rev resolves through `identity_at_rev`.
+made up). An old rev resolves through `identity_at_rev`. The replay view copies it onto the run's public
+updates (`identity_ref`, see [replay.md](replay.md#public-conversation-messages)).
 
 ## The fingerprint
 

{abstractruntime-0.18.0 → abstractruntime-0.18.1}/docs/replay.md

@@ -28,7 +28,11 @@ Explicit completed `public_update` events become assistant messages with
 `iteration`, `source_call_ids`, `update_kind`, and normal ledger provenance. `update_kind` is
 the producer's type for the update: `"finding"` (a fact or piece of evidence the actor
 established) or `"progress"` (what it is doing); an event without a `kind` of `"finding"`
-replays as `"progress"`. Replay copies the type and never infers it from the text. Replay does not turn reasoning,
+replays as `"progress"`. Replay copies the type and never infers it from the text. When the run's snapshot
+carries `vars["_runtime"]["identity_ref"]` (the gateway stamps it on visit, summon, meet and session runs),
+each of that run's public updates carries it as `identity_ref` (`{"of", "rev"}`); a run without one, or with
+a malformed one, gives no field, never an invented one. A snapshot read after the updates were folded stamps
+them then, and the ref is part of the snapshot digest, so the cursor token changes with it. Replay does not turn reasoning,
 raw tool output or a marker inside model text into public speech. Diary/thinking fences
 are excluded. These are actor-authored updates; their wording alone is not proof of a fact
 or of completed work.

{abstractruntime-0.18.0 → abstractruntime-0.18.1}/llms-full.txt

@@ -57,10 +57,15 @@ See llms.txt for the linked index.
 
 It is designed for long-running workflows that must survive restarts and explicitly model blocking (human input, timers, external events, subworkflows) without keeping Python stacks alive.
 
-**Version:** 0.18.0 • **Python:** 3.10+
+**Version:** 0.18.1 • **Python:** 3.10+
 
 **Status:** pre-1.0 (API may evolve). For production use, pin versions and follow `CHANGELOG.md`.
 
+## What's new in 0.18.1
+
+- **A public update names the identity its run started with**: the replay view copies the run's `identity_ref` onto
+  its public updates, so a host serving cached views shows who spoke; a run without one gets no field.
+
 ## What's new in 0.18.0
 
 - **Models unload after being idle**: a host sets how long a local model may sit unused (`set_model_idle_unload`,
@@ -6621,7 +6626,8 @@ parse_identity_ref("session:sess_9f2a#1")  # a regular agent's identity rides it
 `{"of", "rev"}`, beside the signed entity stamp (`vars["_runtime"]["entity"]`) and never inside
 it: presentation is not authority. `stamp_run_identity_ref(vars, ref)` puts it there;
 `read_run_identity_ref(vars)` returns it, or `None` when the run carries none (a reference is never
-made up). An old rev resolves through `identity_at_rev`.
+made up). An old rev resolves through `identity_at_rev`. The replay view copies it onto the run's public
+updates (`identity_ref`, see [replay.md](replay.md#public-conversation-messages)).
 
 ## The fingerprint
 
@@ -6990,7 +6996,11 @@ Explicit completed `public_update` events become assistant messages with
 `iteration`, `source_call_ids`, `update_kind`, and normal ledger provenance. `update_kind` is
 the producer's type for the update: `"finding"` (a fact or piece of evidence the actor
 established) or `"progress"` (what it is doing); an event without a `kind` of `"finding"`
-replays as `"progress"`. Replay copies the type and never infers it from the text. Replay does not turn reasoning,
+replays as `"progress"`. Replay copies the type and never infers it from the text. When the run's snapshot
+carries `vars["_runtime"]["identity_ref"]` (the gateway stamps it on visit, summon, meet and session runs),
+each of that run's public updates carries it as `identity_ref` (`{"of", "rev"}`); a run without one, or with
+a malformed one, gives no field, never an invented one. A snapshot read after the updates were folded stamps
+them then, and the ref is part of the snapshot digest, so the cursor token changes with it. Replay does not turn reasoning,
 raw tool output or a marker inside model text into public speech. Diary/thinking fences
 are excluded. These are actor-authored updates; their wording alone is not proof of a fact
 or of completed work.

{abstractruntime-0.18.0 → abstractruntime-0.18.1}/llms.txt

@@ -3,7 +3,7 @@
 > Durable workflow runtime (interrupt → checkpoint → resume) with an append-only execution ledger.
 
 - Python: 3.10+ (see `pyproject.toml`)
-- Version: 0.18.0
+- Version: 0.18.1
 - Ecosystem: [AbstractFramework](https://github.com/lpalbou/AbstractFramework) umbrella, integrates with [AbstractCore](https://github.com/lpalbou/abstractcore)
 - Hard invariant: `RunState.vars` must be JSON-serializable (`src/abstractruntime/core/models.py`)
 - Current AbstractCore baseline: base `abstractruntime` requires AbstractCore 2.34.0 or newer with its light install (remote providers, tools and the MCP worker, media routing, the `decision` output modality); `abstractruntime[apple]` and `abstractruntime[gpu]` require AbstractCore's `apple` and `gpu` settings (`pyproject.toml`)

{abstractruntime-0.18.0 → abstractruntime-0.18.1}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "AbstractRuntime"
-version = "0.18.0"
+version = "0.18.1"
 description = "AbstractRuntime: a durable graph runner designed to pair with AbstractCore."
 readme = "README.md"
 requires-python = ">=3.10"

abstractruntime-0.18.1/release-notes.md

@@ -0,0 +1,8 @@
+### Added
+
+- **A public update names the identity its run started with** (`replay/view.py`, ADR 0052, framework backlog 1119).
+  The replay view copies the run's `vars._runtime.identity_ref` (`{"of", "rev"}`, stamped by the gateway on visit,
+  summon, meet and session runs) onto each of that run's `public_update` messages as `identity_ref`, so a host serves
+  cached views with the ref already in place. A run without a ref, or with a malformed one, gives no field, never an
+  invented one; a snapshot read after the updates were folded stamps them then; the ref is part of the snapshot
+  digest, so the cursor token (an ETag) changes with it, and a run without a ref keeps the token it had.

{abstractruntime-0.18.0 → abstractruntime-0.18.1}/skills/abstractruntime/SKILL.md

@@ -4,7 +4,7 @@ description: Operate AbstractRuntime through durable Python workflows, effect re
 license: MIT
 compatibility: Python 3.10+. Model execution needs a configured AbstractCore provider or server; local engines need the apple or gpu install profile. This skill uses the Python API rather than a Gateway HTTP API.
 metadata:
-  package-version: "0.18.0"
+  package-version: "0.18.1"
 ---
 
 # AbstractRuntime
@@ -22,7 +22,7 @@ folder when state must survive a restart.
 Install the version this skill describes (or newer):
 
 ```bash
-python -m pip install "abstractruntime>=0.18.0"
+python -m pip install "abstractruntime>=0.18.1"
 ```
 
 The base profile includes remote-light AbstractCore integration and the MCP

{abstractruntime-0.18.0 → abstractruntime-0.18.1}/src/abstractruntime/replay/view.py

@@ -49,6 +49,7 @@ from typing import Any, Dict, Iterable, List, Mapping, Optional, Set, Tuple
 from ..automations.attention import ANSWER_PAYLOADS
 from ..core.vars import is_paused_vars
 from ..history_bundle import _extract_usage_from_ledger_record, _extract_user_prompt_from_input
+from ..identity.digital_identity import read_run_identity_ref
 from ..storage.ledger_slim import is_slim_marker, resolve_slim_value
 from .delta import token_run_names
 from .executions import ExecutionTracker, is_completion_record, is_progress_record
@@ -152,6 +153,18 @@ def _artifact_refs(value: Any, path: str = "", depth: int = 0) -> List[Tuple[str
     return out
 
 
+def _run_identity_ref(run_vars: Any) -> Optional[Dict[str, Any]]:
+    """The `{of, rev}` identity ref the host stamped on the run (`vars._runtime.identity_ref`), or None:
+    absent or malformed, the view carries no ref rather than an invented one."""
+    if not isinstance(run_vars, Mapping):
+        return None
+    try:
+        ref = read_run_identity_ref(run_vars)
+    except (TypeError, ValueError):
+        return None
+    return ref.to_dict() if ref is not None else None
+
+
 def _snapshot(run: Any) -> Dict[str, Any]:
     """A run snapshot (RunState or its dict) as the plain fields the view reads."""
     if run is None:
@@ -173,7 +186,7 @@ def _snapshot(run: Any) -> Dict[str, Any]:
     prompt = _extract_user_prompt_from_input(source)[0] if isinstance(source, dict) else ""
     out = d.get("output")
     # Only what the view reads is kept (a snapshot's vars can be conversation-sized).
-    return {
+    snap = {
         "run_id": _s(d.get("run_id")),
         "workflow_id": _s(d.get("workflow_id")),
         "status": _enum(d.get("status")),
@@ -187,6 +200,11 @@ def _snapshot(run: Any) -> Dict[str, Any]:
         "updated_at": _s(d.get("updated_at")),
         "paused": bool(is_paused_vars(d.get("vars"))),
     }
+    # Only when the host stamped one: a run without a ref keeps the same snapshot digest (cursor token).
+    ref = _run_identity_ref(d.get("vars"))
+    if ref is not None:
+        snap["identity_ref"] = ref
+    return snap
 
 
 def _snapshot_digest(snap: Dict[str, Any]) -> str:
@@ -522,9 +540,12 @@ class ReplayView:
             return
         r = self._run(rid)
         if r.snapshot != snap:
+            ref_changed = r.snapshot.get("identity_ref") != snap.get("identity_ref")
             r.snapshot = snap
             r.snap_digest = _snapshot_digest(snap)
             self._dirty["runs"].add(rid)
+            if ref_changed:
+                self._stamp_identity_ref(rid)
         if snap.get("workflow_id") and r.workflow_id != snap["workflow_id"]:
             r.workflow_id = snap["workflow_id"]
             self._dirty["runs"].add(rid)
@@ -1027,7 +1048,11 @@ class ReplayView:
                               extra={"update_kind": "finding" if b.get("kind") == "finding" else "progress",
                                      "source_call_ids": [c for c in calls if isinstance(c, str)]
                                      if isinstance(calls, list) else [], "iteration": b.get("iteration"),
-                                     "session_id": _s(b.get("session_id")) or None})
+                                     "session_id": _s(b.get("session_id")) or None,
+                                     # The identity the host stamped on this run (visit, summon, meet,
+                                     # session), as `{of, rev}`; none when the run carries none.
+                                     "identity_ref": dict(r.snapshot["identity_ref"])
+                                     if r.snapshot.get("identity_ref") else None})
             return
         question_receipt = (_s(rec.get("node_id")) == "__host_question__"
                             and _s(rec.get("idempotency_key")).startswith("system:question:"))
@@ -1147,6 +1172,21 @@ class ReplayView:
 
     # ----------------------------------------------------------------- messages, artifacts
 
+    def _stamp_identity_ref(self, run_id: str) -> None:
+        """Put the run's identity ref on its public updates already folded (a snapshot read after
+        its records), or take it off when the snapshot no longer carries one."""
+        ref = self._runs[run_id].snapshot.get("identity_ref")
+        for mid, msg in self._messages.items():
+            if msg.get("run_id") != run_id or msg.get("kind") != "public_update" or msg.get("identity_ref") == ref:
+                continue
+            msg = dict(msg)
+            if ref is None:
+                msg.pop("identity_ref", None)
+            else:
+                msg["identity_ref"] = dict(ref)
+            self._messages[mid] = msg
+            self._dirty["messages"].add(mid)
+
     def _message(self, mid: str, *, role: str, kind: str, text: str, run_id: str, step_id: str, seq: int, ts: str,
                  source: str, artifact_ids: Optional[List[str]] = None, extra: Optional[Dict[str, Any]] = None) -> None:
         msg = {

abstractruntime-0.18.1/tests/test_replay_public_update_identity_ref.py

@@ -0,0 +1,97 @@
+"""A public update names the identity its run started with (gateway lane ask, ADR 0052): the replay
+view folds and caches public updates by version, so the host cannot stamp them at serve time. The view
+copies the run's `vars._runtime.identity_ref` (`{of, rev}`, set by the gateway on visit, summon, meet and
+session runs) onto that run's public updates; a run without one gets no field, never an invented one."""
+import pytest
+
+from abstractruntime.identity.digital_identity import identity_ref, stamp_run_identity_ref
+from abstractruntime.replay import ReplayView, replay
+
+pytestmark = pytest.mark.basic
+
+
+def event(run, seq):
+    return {"run_id": run, "seq": seq, "step_id": f"s{seq}", "node_id": "parse", "status": "completed",
+            "started_at": f"2027-01-01T12:00:{seq:02d}+00:00",
+            "effect": {"type": "emit_event", "payload": {"name": "public_update", "payload": {
+                "id": f"{run}:public_update:{seq}", "run_id": run, "text": "The shorter route has stairs."}}},
+            "result": {"emitted": True}}
+
+
+def snapshot(run, ref=None, **runtime):
+    run_vars = {"_runtime": dict(runtime)}
+    if ref is not None:
+        stamp_run_identity_ref(run_vars, ref)
+    return {"run_id": run, "workflow_id": "visit", "status": "running", "vars": run_vars}
+
+
+def guidance(run, seq):
+    """The host's receipt of a person's words: a `guidance` message of the same run, not a public update."""
+    return {"run_id": run, "seq": seq, "step_id": f"s{seq}", "node_id": "__host_user_guidance__", "status": "completed",
+            "idempotency_key": "system:user_guidance:1", "started_at": f"2027-01-01T12:00:{seq:02d}+00:00",
+            "effect": {"type": "emit_event", "payload": {"name": "user_guidance", "payload": {
+                "seq": 1, "status": "accepted", "id": f"{run}:guidance:1", "run_id": run, "text": "No stairs."}}},
+            "result": {"emitted": True}}
+
+
+def updates(view):
+    return [m for m in view.to_json()["messages"] if m["kind"] == "public_update"]
+
+
+def test_the_run_s_identity_ref_is_copied_onto_its_public_updates():
+    view = replay({"R": [event("R", 1), event("R", 2)]}, {"R": snapshot("R", identity_ref("entity:castor", 3))},
+                  root_run_id="R")
+    assert [m["identity_ref"] for m in updates(view)] == [{"of": "entity:castor", "rev": 3}] * 2
+
+
+def test_a_child_run_s_update_names_the_child_s_ref_not_the_parent_s():
+    parent = {"run_id": "R", "seq": 1, "step_id": "spawn", "node_id": "agent", "status": "waiting",
+              "effect": {"type": "start_subworkflow", "payload": {"workflow_id": "agent"}},
+              "result": {"wait": {"reason": "subworkflow", "wait_key": "subworkflow:C"}}}
+    view = replay({"R": [parent], "C": [event("C", 1)]},
+                  {"R": snapshot("R", identity_ref("entity:castor", 3)),
+                   "C": dict(snapshot("C", identity_ref("session:s1", 1)), parent_run_id="R")}, root_run_id="R")
+    assert [m["identity_ref"] for m in updates(view)] == [{"of": "session:s1", "rev": 1}]
+
+
+def test_a_snapshot_read_after_the_records_stamps_the_updates_already_folded():
+    view = ReplayView("R")
+    view.apply([event("R", 1), guidance("R", 2)])
+    assert "identity_ref" not in updates(view)[0]
+    delta = view.apply(runs_by_id={"R": snapshot("R", identity_ref("entity:castor", 3))})
+    assert updates(view)[0]["identity_ref"] == {"of": "entity:castor", "rev": 3}
+    # Only public updates carry it: the person's words in the same run are not the entity's.
+    words = [m for m in view.to_json()["messages"] if m["kind"] == "guidance"]
+    assert len(words) == 1 and "identity_ref" not in words[0]
+    assert "R:public_update:1" in str(delta)  # the stamped message travels in the delta
+    fresh = replay({"R": [event("R", 1), guidance("R", 2)]}, {"R": snapshot("R", identity_ref("entity:castor", 3))},
+                   root_run_id="R")
+    assert view.to_json()["messages"] == fresh.to_json()["messages"]
+
+
+@pytest.mark.parametrize("run_snapshot", [
+    None,                                                      # no snapshot read at all
+    snapshot("R"),                                             # a run without a ref
+    snapshot("R", identity_ref={"of": "entity:castor"}),       # malformed: no rev
+    snapshot("R", identity_ref={"of": "castor", "rev": 3}),    # malformed: subject without a namespace
+    snapshot("R", identity_ref="entity:castor#3"),             # malformed: text, not {of, rev}
+])
+def test_no_ref_on_the_run_means_no_field_never_a_fake(run_snapshot):
+    view = replay({"R": [event("R", 1)]}, {"R": run_snapshot} if run_snapshot else None, root_run_id="R")
+    assert "identity_ref" not in updates(view)[0]
+
+
+def test_the_cursor_changes_with_the_ref_and_not_for_a_run_without_one():
+    records = {"R": [event("R", 1)]}
+    without = replay(records, {"R": snapshot("R")}, root_run_id="R").cursor["token"]
+    with_ref = replay(records, {"R": snapshot("R", identity_ref("entity:castor", 3))}, root_run_id="R").cursor["token"]
+    next_rev = replay(records, {"R": snapshot("R", identity_ref("entity:castor", 4))}, root_run_id="R").cursor["token"]
+    assert len({without, with_ref, next_rev}) == 3
+    # A run without a ref folds exactly the snapshot it folded before refs existed: its token (an ETag
+    # a client holds) does not change with this release.
+    from abstractruntime.replay.view import _snapshot
+    assert "identity_ref" not in _snapshot(snapshot("R"))
+    # A run whose ref is withdrawn loses it from its updates (the view never keeps a stale one).
+    view = replay(records, {"R": snapshot("R", identity_ref("entity:castor", 3))}, root_run_id="R")
+    view.apply(runs_by_id={"R": snapshot("R")})
+    assert "identity_ref" not in updates(view)[0] and view.cursor["token"] == without

abstractruntime-0.18.0/release-notes.md

@@ -1,86 +0,0 @@
-### Added
-
-- **Acquaintances of an entity or a session** (`identity/acquaintances.py`, framework backlog 1119):
-  `entity_acquaintances(home_dir, run_store)` and `session_acquaintances(session_id, run_store)` answer two
-  lists, the other entities and the humans it interacted with, each with first and last seen, the number of
-  interactions and the task kinds. Computed from existing records, never stored: the participants the
-  gateway stamps on visit, summon and meet runs, the person who started a run (`_meta.origin`), and who left
-  a task in the task inbox. Identifiers only; interactions with no usable identifier (an `agent:` participant,
-  a participant without a namespace, a person-started run without an actor) are listed under `not_counted`,
-  never guessed. See `docs/track-record.md#acquaintances`.
-- **An entity's digital identity: its look and its voice, one record in its home**
-  (`abstractruntime.identity.digital_identity`, framework ADR 0052 draft, backlog 1119; `docs/digital-identity.md`).
-  `<home>/identity.json` holds the avatar design, its colour and the voice (`schema_version` 1). `write_identity` checks
-  every bound (`IdentityInvalid` names the field), runs the gateway's `check` hook, appends an `identity_changed` row to
-  `state_history.jsonl` (the `phase_changed` field names) before the file is replaced atomically, and never gives a
-  `rev` twice: one write at a time per home (`<home>/.identity.lock`, held from the read to the file replace). A
-  file it cannot read in full raises `IdentityUnreadable` on read and on write, never "no identity".
-  `default_identity` is the recorded default anyone can recompute (SHA-256 of the entity id, eight engraved Watch
-  designs, an HSL colour, the gateway's default voice as a value); `record_default_identity` writes it once and never
-  overwrites. `identity_at_rev` answers an old rev from the biography. The reference `entity:castor#3` rides
-  `vars._runtime.identity_ref` beside the signed entity stamp (`stamp_run_identity_ref`, `read_run_identity_ref`,
-  `parse_identity_ref`). `identity_fingerprint` derives the individual's `actor_id` from the manifest, with the diary's
-  chain head. Homes without `identity.json` are untouched.
-- **The summon tells the entity when its look or voice changed**: one sentence ("Your voice changed on 4 November (by
-  laurent): now fr-male-rene.") in the summon prelude, after the identity core, when the change is newer than the
-  previous summon (`render_summon_prelude(home_dir=, identity_since=)`, `ChatSession(identity_since=)`,
-  `build_visit_workflow(identity_since=)` or `_visit.identity_since` seeded by the door).
-- **The idle unload reaches the host: `set_model_idle_unload(seconds)`** (host facade, `LocalAbstractCoreLLMClient`,
-  `MultiLocalAbstractCoreLLMClient`; framework backlog 1115). It relays AbstractCore's process-wide idle-unload time
-  (ADR 0012, default 60 minutes): a model no call has used for that long is unloaded, a locked model never is, and a
-  running call is never interrupted. `None` or `0` turns it off; a refused value answers `ok: false`. Local residency
-  rows of in-process text models carry `idle_unload_s`, `last_used_at` and `idle_unload_at`, and pass through Core's
-  `in_use` and `locked_by`, so a host can show a model that is in use, or kept loaded by another account.
-- **`set_model_residency_locks(locks)`**: the locked models become exactly the listed ones (resident ones locked,
-  missing ones loaded then locked, the others unlocked), each pair with its own outcome. A lock names a provider and a
-  model; the `base_url` of a configured endpoint is not part of the key. A host stores its "Keep loaded" set and
-  replays it at start; as a `set_` name it is replayed when the gateway's model host rebuilds a client.
-- **Track record and reputation of an entity or a session** (`identity/track_record.py`, ADR 0052 §5-§6,
-  framework backlog 1119). `entity_track_record(home_dir, run_store, ledger_store, *, book_head)` and
-  `session_track_record(session_id, run_store, ledger_store)` answer sessions, runs, successes, failures,
-  cancelled, in progress and tokens (input, output, total), per task kind (`<phase or role>/<workflow_id>`,
-  from ids only) and overall; `compute_reputation(record)` gives trust per task kind,
-  `(successes + 1) / (successes + failures + 2)` with its support, the support-weighted overall, and the
-  last 20 outcomes as evidence ("no experience yet" when there is none). Everything is computed from
-  existing records; nothing is stored. Only work from outside counts: turn roots a person or a trigger
-  started and automation occurrences (once each, however many attempts); sub-runs, controllers, the
-  session memory run and runs another run or the system started never do. Outcomes come from the run
-  status, the occurrence's `automation.completed` decision, an entity task marked `done`, and the work
-  order verdicts (`done:` / `blocked:`). Feedback from people and agents (`feedback_user`,
-  `feedback_agent`) is typed but has no source yet, so every answer says `basis: "completion-rate only"`.
-  Each answer names its subject's `identity_ref` and, for an entity, its `identity_fingerprint`.
-  See `docs/track-record.md`.
-- **`metrics_many` also returns `tokens_input` and `tokens_output`** (SQLite ledger): `usage.input_tokens`
-  (else `prompt_tokens`) and `output_tokens` (else `completion_tokens`) of completed `llm_call` records.
-  Existing keys are unchanged.
-- **`identity.life.read_work_order_verdicts(home_dir)`**: the verdicts the work lane archived in
-  `work_order.done.md`, oldest first.
-
-### Changed
-
-- **AbstractCore 2.34.0 or newer** (base install, `apple` and `gpu` settings): the idle unload and its residency rows
-  come from it.
-- **A load with `ttl_s` or `keep_alive` on an in-process model** still lists them under `unsupported_options`; its
-  warning now names the idle unload that applies instead ("the idle unload setting applies (60 min unused, never while
-  it is kept loaded)"), or says it is off.
-
-### Fixed
-
-- **A run store whose index cannot attribute a session is refused, never started as a plain chat**
-  (`core/run_attribution.py`, framework backlog 0938). A third-party store with `list_run_index` but no `session_kind`
-  in its rows (an index written before automations v1) used to report "no kinds" and let a `discussion-session:` start
-  through as an ordinary chat, skipping the discussion's read-only anchor. It now raises `SessionAttributionError`
-  naming the missing column; a store with no index at all names both methods it lacks. Built-in stores are unchanged.
-  Upgrading a custom store: add `session_kind` and `role` to its index rows, or implement `session_kinds(session_id)`
-  (see `docs/automations.md`, "Storage guarantees").
-- **A tool that reports its failure as a JSON object keeps its explanation** (`integrations/abstractcore/tool_executor.py`,
-  framework backlog 1005). A failed result's `output` used to be emptied when the tool returned its failure as a JSON
-  string, so the agent and the run ledger saw only the error line (for a web search: "No results found", never the
-  backends tried, the bot-challenge status or the hint). The parsed object is now the result's `output`, as for a tool
-  that returns a dict; a plain text error (`Error: ...`) still keeps an empty output and its message in `error`.
-- **The visual-flow Agent node shows the model that explanation** (`visualflow_compiler/compiler.py`). A failed call
-  whose `output` is an object is rendered as its error line followed by the object (`[web_search]: Error: No results
-  found` then the JSON), under the same `agent_observation_max_chars` limit; a plain text failure still shows its error
-  line alone.
-- Failure payloads are now recorded in the run ledger and the history bundle like success payloads: whatever a tool puts
-  in its failure JSON (its parameters included) is stored with the run.