monkeybot 3.4.0__tar.gz → 3.6.0__tar.gz

{monkeybot-3.4.0 → monkeybot-3.6.0}/CHANGELOG.md

@@ -6,7 +6,59 @@ the project adheres to [Semantic Versioning](https://semver.org/).
 
 ## [Unreleased]
 
-### Browser MCP
+### CLI
+
+#### Added
+
+- `monkeybot chat` prompts for an `ask_user` question and posts the reply to the gateway.
+
+## [core v3.6.0] - 2026-09-21
+
+#### Added
+
+- `ask_user` asks the user a question, with an optional list of two to six choices, and waits for the posted answer before the tool returns.
+
+## [core v3.5.0] - 2026-09-20
+
+### Added
+
+- Native durable goals beside scheduled loops (`create_goal` / `update_goal`, plus `/goals` pause/resume/stop). Continuations are scheduled automatically until the goal completes or is stopped.
+- `FileBlock` SSE for generated documents (path/filename/mime — clients load from disk). Workspace open/export stays inside the workspace and still denies nested credential directories.
+- HTML (`text/html`) uploads for Files preview, and `text/plain` attachments inlined at resolve.
+- Promote a queued follow-up into the live turn (`POST /sessions/{id}/queue/{request_id}/steer`) or drop it (`DELETE`) so it never drains.
+- Verifier: request-scoped mailbox, sticky nudge until the tracker recovers, nudge armed on judge deposit, concurrent session-bound `ProviderJudge` jobs with scoped budgets and fencing, and staged reload so live workers stay intact.
+
+### Changed
+
+- `verifier.enabled: true` turns on omitted nested `ledger` / `tracker` flags. Omitted `judge.enabled` turns on only when the tracker is on. Explicit `enabled: false` still opts a nested section out.
+- Omitted `verifier.ledger.model` / `verifier.judge.model` inherit the agent model (`model.name` / `MODEL_NAME`, then `gemini-2.5-flash`). The live judge worker is session-bound `ProviderJudge`.
+
+### Fixed
+
+- Provider requests that exceed the multimodal byte budget drop media rather than sending an oversized body; remaining oversize fails closed. In-flight media is frozen on abort.
+- Promoted follow-ups no longer vanish if the turn ends before they inject — they restore to the front of the follow-up queue.
+
+### Notes
+
+- Existing configs that set only `verifier.enabled: true` (or `enabled: true` plus `ledger.enabled: true`) now also get the tracker, and the judge if the tracker stays on. Opt out with `tracker.enabled: false` / `judge.enabled: false`.
+
+## [cli v0.7.0] - 2026-09-20
+
+### Added
+
+- New agents install a packaged `skills/goal/SKILL.md` for explicit `/goal` invocations. `monkeybot refresh` adds it when missing.
+
+### Changed
+
+- Example YAML documents verifier nested enable-flag inheritance and optional model inherit.
+
+## [browser v0.7.2] - 2026-09-13
+
+#### Fixed
+
+- Reuse the focused `about:blank` tab when opening a URL so agent `Target.createTarget` does not stack a leftover New tab next to the first real page.
+
+## [browser v0.7.1] - 2026-09-12
 
 #### Fixed
 

{monkeybot-3.4.0 → monkeybot-3.6.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: monkeybot
-Version: 3.4.0
+Version: 3.6.0
 Summary: monkeybot agent harness — FastAPI SSE gateway, owned loop, SQLite, and MCP.
 License: MIT
 License-File: LICENSE
@@ -11,6 +11,7 @@ Requires-Dist: google-genai>=1.0.0
 Requires-Dist: httpx>=0.27.0
 Requires-Dist: mcp<2,>=1.27.1
 Requires-Dist: numpy<2.5,>=1.26.0
+Requires-Dist: pillow>=10.0.0
 Requires-Dist: pydantic>=2.10.0
 Requires-Dist: python-dotenv>=1.0.0
 Requires-Dist: python-ulid>=2.0.0

{monkeybot-3.4.0 → monkeybot-3.6.0}/cli/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "monkeybot-cli"
-version = "0.6.0"
+version = "0.7.0"
 description = "CLI to create, configure, validate, and chat with monkeybot agents."
 requires-python = ">=3.11"
 dependencies = [

{monkeybot-3.4.0 → monkeybot-3.6.0}/cli/src/monkeybot_cli/chat_session.py

@@ -16,6 +16,7 @@ from typing import Any, Literal
 import httpx
 from monkeybot.core.runtime.events import (
     ActionRequiredEvent,
+    AskUserRequestEvent,
     AssistantDelta,
     ContextSummarized,
     ContextSummarizing,
@@ -41,7 +42,12 @@ HitlReaderFn = Callable[["HitlRequest"], Any]  # async (HitlRequest) -> HitlAnsw
 
 HitlKind = Literal["confirm", "elicit", "frontend_unsupported"]
 
-_HITL_TYPES = (ToolConfirmationRequestEvent, ActionRequiredEvent, FrontendToolRequestEvent)
+_HITL_TYPES = (
+    ToolConfirmationRequestEvent,
+    AskUserRequestEvent,
+    ActionRequiredEvent,
+    FrontendToolRequestEvent,
+)
 
 _RECONNECT_INITIAL_DELAY = 0.5
 _RECONNECT_MAX_DELAY = 15.0
@@ -717,6 +723,9 @@ class ChatSessionController:
         if isinstance(evt, ToolConfirmationRequestEvent):
             await self._handle_tool_confirm(evt)
             return
+        if isinstance(evt, AskUserRequestEvent):
+            await self._handle_ask_user(evt)
+            return
         if isinstance(evt, ActionRequiredEvent):
             await self._handle_elicit(evt)
 
@@ -753,6 +762,32 @@ class ChatSessionController:
         if answer.cancelled or not ok:
             self._turn_abort.set()
 
+    async def _handle_ask_user(self, evt: AskUserRequestEvent) -> None:
+        assert self.session_id is not None
+        choices = "\n".join(f"- {choice}" for choice in evt.choices)
+        prompt = evt.question or "The agent asked a question."
+        if choices:
+            prompt = f"{prompt}\n{choices}"
+        answer = await self._await_hitl(
+            HitlRequest(
+                kind="elicit",
+                prompt=prompt,
+                tool_call_id=evt.tool_call_id,
+                tool_name="ask_user",
+            )
+        )
+        text = "" if answer.cancelled else answer.text.strip()
+        if not text:
+            self.abort_turn()
+            return
+        ok = await self._post_hitl(
+            f"{self.base}/sessions/{self.session_id}/ask-user/{evt.tool_call_id}",
+            {"answer": text},
+            label="Ask user",
+        )
+        if not ok:
+            self.abort_turn()
+
     async def _handle_elicit(self, evt: ActionRequiredEvent) -> None:
         assert self.session_id is not None
         payload = dict(evt.payload) if evt.payload else {}

{monkeybot-3.4.0 → monkeybot-3.6.0}/cli/src/monkeybot_cli/scaffold.py

@@ -176,6 +176,13 @@ def install_loop_skill(dest: Path, *, force: bool) -> str:
     return _install_file(target, resources.files(_DEFAULTS_PKG) / "loop" / "SKILL.md", force=force)
 
 
+def install_goal_skill(dest: Path, *, force: bool) -> str:
+    """Install the bundled native-goal procedure into ``skills/goal``."""
+    target = dest / "skills" / "goal" / "SKILL.md"
+    target.parent.mkdir(parents=True, exist_ok=True)
+    return _install_file(target, resources.files(_DEFAULTS_PKG) / "goal" / "SKILL.md", force=force)
+
+
 def install_env_example(dest: Path, *, force: bool) -> str:
     env_example = dest / ".env.example"
     if env_example.exists() and not force:
@@ -399,6 +406,7 @@ def run_refresh(*, dest: Path) -> list[str]:
     report.append(refresh_permissions_if_default(cfg_dir))
     report.append(refresh_monkeybot_yaml(cfg_dir))
     report.extend(ensure_memory(dest, force=False))
+    report.append(f"  skills/goal/SKILL.md: {install_goal_skill(dest, force=False)}")
     return report
 
 
@@ -412,11 +420,12 @@ def run_new(
 ) -> list[str]:
     """Full scaffold: config bundle, empty skills root, writable state, and image files.
 
-    Capability skills (``browser``, ``image-generator``, ``loop``) are packaged
+    Optional capability skills (``browser``, ``image-generator``, ``loop``) are packaged
     under ``scaffold_defaults`` but not installed into new agents for now —
     the Mac Main Agent loads them from ``~/.monkeybot/.internal/skills``
     instead. Re-enable via ``install_*_skill`` when custom agents should get
-    them again.
+    them again. The ``goal`` skill is installed because native goal tools are
+    intentionally exposed only for explicit ``/goal`` invocations.
     """
     cfg_dir = dest / "monkeybot_config"
     report = install_config_bundle(cfg_dir, force=force)
@@ -426,7 +435,7 @@ def run_new(
     )
     report.extend(ensure_memory(dest, force=force))
     report.extend(ensure_workspace(dest, force=force))
-    report.append("  skills/: ensured (empty — capability skills deferred)")
+    report.append(f"  skills/goal/SKILL.md: {install_goal_skill(dest, force=force)}")
     report.append(f"  .env.example: {install_env_example(dest, force=force)}")
     report.extend(install_container_files(dest, force=force))
     report.append(

monkeybot-3.6.0/cli/src/monkeybot_cli/scaffold_defaults/goal/SKILL.md

@@ -0,0 +1,31 @@
+---
+name: goal
+description: Create one durable objective that continues across scheduled turns until completed.
+---
+
+# Goal
+
+Use this skill only when the user explicitly invokes `/goal` with an objective
+that may require multiple turns.
+
+## Start
+
+1. Preserve the user's complete objective without narrowing its scope.
+2. Call `create_goal` exactly once with that objective.
+3. Do the first concrete increment of work in the same turn.
+4. Keep the returned goal id; every `update_goal` call must include it.
+
+## Continue
+
+- Goal continuations are scheduled automatically.
+- Treat the stored objective as authoritative.
+- Make measurable progress and verify results before declaring completion.
+- Temporary session-busy deferrals are normal and are not goal failures.
+- Persistent execution failures stop the goal after the retry limit so it
+  cannot consume resources indefinitely.
+
+## Complete
+
+Call `update_goal` with the returned `goal_id` and `status="complete"` only
+after evidence proves every requirement is satisfied. Otherwise leave the goal
+active. Use the `/goals` control plane to pause, resume, or stop it manually.

{monkeybot-3.4.0 → monkeybot-3.6.0}/cli/src/monkeybot_cli/scaffold_defaults/monkeybot.example.yaml

@@ -253,6 +253,17 @@ scheduler:
   # Env override: MONKEYBOT_SCHEDULER_ENABLED (1 | true | yes | on).
   enabled: false
 
+# Background verifier (YAML-only). Off by default: ledger costs one model call
+# per human message. `enabled: true` turns on omitted ledger/tracker flags;
+# omitted judge.enabled turns on only when the tracker is on. Explicit
+# `enabled: false` still opts a nested section out. Omitted ledger.model /
+# judge.model inherit model.name (same fallback as the agent). The live
+# worker is session-bound ProviderJudge. Realtime loops ignore this block.
+# verifier:
+#   enabled: true
+#   escalation:
+#     max_severity: nudge
+
 # Optional JSON for model.provider: fake tests (env: MONKEYBOT_FAKE_PROVIDER_EVENTS)
 # fake_provider:
 #   events_json: '[[]]'

{monkeybot-3.4.0 → monkeybot-3.6.0}/cli/tests/test_scaffold.py

@@ -34,6 +34,7 @@ def test_run_new_creates_bundle(tmp_path: Path) -> None:
     assert not (tmp_path / "skills" / "browser").exists()
     assert not (tmp_path / "skills" / "image-generator").exists()
     assert not (tmp_path / "skills" / "loop").exists()
+    assert (tmp_path / "skills" / "goal" / "SKILL.md").is_file()
     assert (tmp_path / "workspace" / ".gitkeep").is_file()
     assert (tmp_path / "workspace" / "browser" / "playbooks").is_dir()
     assert (tmp_path / "workspace" / "generated-media" / "images").is_dir()
@@ -153,6 +154,8 @@ def test_run_refresh_adds_template_commands_and_keeps_extras(tmp_path: Path) ->
     doc = yaml.safe_load(yaml_path.read_text(encoding="utf-8")) or {}
     doc.pop("memory", None)
     yaml_path.write_text(yaml.safe_dump(doc, sort_keys=False), encoding="utf-8")
+    goal_skill = tmp_path / "skills" / "goal" / "SKILL.md"
+    goal_skill.unlink()
 
     report = run_refresh(dest=tmp_path)
     text = allow.read_text(encoding="utf-8")
@@ -166,6 +169,7 @@ def test_run_refresh_adds_template_commands_and_keeps_extras(tmp_path: Path) ->
     refreshed_yaml = yaml_path.read_text(encoding="utf-8")
     assert "enabled: true" in refreshed_yaml
     assert "custom persona" not in refreshed_yaml
+    assert goal_skill.is_file()
     joined = "\n".join(report)
     assert "command_allowlist.yaml: updated" in joined
     assert "monkeybot.yaml: updated" in joined
@@ -174,7 +178,10 @@ def test_run_refresh_adds_template_commands_and_keeps_extras(tmp_path: Path) ->
 def test_run_refresh_skips_custom_permissions_and_model(tmp_path: Path) -> None:
     run_new(dest=tmp_path, force=False, provider="nvidia", model="keep-me")
     perms = tmp_path / "monkeybot_config" / "permissions.yaml"
-    perms.write_text("default: deny\nrules:\n  - tool: '*'\n    pattern: '*'\n    effect: deny\n", encoding="utf-8")
+    perms.write_text(
+        "default: deny\nrules:\n  - tool: '*'\n    pattern: '*'\n    effect: deny\n",
+        encoding="utf-8",
+    )
     yaml_path = tmp_path / "monkeybot_config" / "monkeybot.yaml"
     before = yaml_path.read_text(encoding="utf-8")
 

{monkeybot-3.4.0 → monkeybot-3.6.0}/docs/features.md

@@ -97,8 +97,10 @@ One **user message** may span multiple **inner turns** (model → tools → mode
 | Reply | `POST /sessions/{id}/reply` | Session idle | Starts a turn immediately (`SESSION_BUSY` if busy) |
 | Steer | `POST /sessions/{id}/steer` | Session busy | Injected after current tool batch / before next provider call |
 | Follow-up | `POST /sessions/{id}/queue` | Busy → enqueue; idle → start | FIFO drain after `TurnComplete` / lock release |
+| Promote | `POST /sessions/{id}/queue/{request_id}/steer` | A turn is live and the item is still queued. 409 `SESSION_IDLE` otherwise — promote is not meaningful between turns (including while a follow-up is waiting on the lock-retry path); those items drain automatically. | Atomic move from follow-up → steer; injected at the next inner-turn boundary. If the turn ends first, the item is restored to the front of the follow-up FIFO and starts its own turn. `QueuedInputAccepted.request_id` is the in-flight turn (same as `POST /steer`); the follow-up id is `UserSteered.queued_request_id`. |
+| Drop | `DELETE /sessions/{id}/queue/{request_id}` | Item still in the follow-up queue (or popped by drain but not yet started) | Removes it so it will not drain or promote |
 
-Do **not** conflate with HITL `ToolConfirmationRequest`. Cancel clears pending steer; follow-ups survive. Caps: `MONKEYBOT_STEER_QUEUE_MAX` (default 8), `MONKEYBOT_FOLLOW_UP_QUEUE_MAX` (default 16).
+Do **not** conflate with HITL `ToolConfirmationRequest`. Cancel clears pending steer; follow-ups survive (including follow-ups that had been promoted and not yet injected). Caps: `MONKEYBOT_STEER_QUEUE_MAX` (default 8), `MONKEYBOT_FOLLOW_UP_QUEUE_MAX` (default 16). `UserSteered.request_id` is always the in-flight turn; `queued_request_id` is set when the injected steer came from a promoted follow-up.
 
 **Process-local only:** steer/follow-up queues live on the in-process `SessionBus` (same constraint as the SSE registry). Multi-replica gateways do not share admission queues across instances — pin sticky sessions to one replica, or treat `/queue` as best-effort for single-process deployments. If drain cannot acquire the durable turn lock (another replica / stale claim), the item is requeued and retried on an interval (`MONKEYBOT_FOLLOW_UP_LOCK_RETRY_S`, default 1s) until the lock frees or the wait budget expires (`MONKEYBOT_FOLLOW_UP_LOCK_WAIT_MS`, default = session-turn stale window), after which that follow-up is dropped so the queue cannot wedge forever.
 
@@ -657,7 +659,7 @@ Before spawning the gateway, the CLI probes that interpreter for MonkeyBot `>=3.
 
 **How it works:**
 - Off by default, macOS-only: `computer.enabled: true` in `monkeybot.yaml` → `MONKEYBOT_COMPUTER_TOOLS` env, combined with a hard `sys.platform == "darwin"` check (`should_enable_computer_tools()`). The desktop app sets the env var when it spawns a gateway with the feature turned on in Settings; no other deployment should ever set it.
-- **Hard security boundary lives in the tool bodies, not in `permissions.yaml`** (`safety.py`): every path is resolved and validated against the user's home directory after following symlinks; a fixed denylist blocks credential directories (`.ssh`, `.aws`, keychains, browser profiles, the app's own config) both at their canonical location *and* by directory-name anywhere in the tree; filenames matching credential patterns (`.env`, `*.pem`, `id_rsa*`, …) are always refused; `computer_open` refuses any path/app that would make `open` execute code (`.command`, `.app`, `.sh`, Terminal, script editors, …); trash never hard-deletes. `permissions.yaml` is fail-open (a broken file silently disables it), so none of this can depend on it. `_denied_dirs()` also always includes `MONKEYBOT_WORKSPACE_ROOT` (not only under `MONKEYBOT_APP_HOME`, which only the desktop app sets) — a CLI-scaffolded agent's workspace can sit anywhere under `$HOME` the user chose, and `computer_move`/`computer_trash` must not be able to relocate a file straight into or out of it, one click away from smuggling exactly what the workspace boundary (§4) exists to prevent. `computer_move`'s own description now says so, so the model doesn't reach for it as a `read_file`/`run_command` workaround.
+- **Hard security boundary lives in the tool bodies, not in `permissions.yaml`** (`safety.py`): every path is resolved and validated against the user's home directory after following symlinks; a fixed denylist blocks credential directories (`.ssh`, `.aws`, keychains, browser profiles, the app's own config) both at their canonical location *and* by directory-name anywhere in the tree; filenames matching credential patterns (`.env`, `*.pem`, `id_rsa*`, …) are always refused; `computer_open` refuses any path/app that would make `open` execute code (`.command`, `.app`, `.sh`, Terminal, script editors, …); trash never hard-deletes. `permissions.yaml` is fail-open (a broken file silently disables it), so none of this can depend on it. `_denied_dirs()` also always includes `MONKEYBOT_WORKSPACE_ROOT` (not only under `MONKEYBOT_APP_HOME`, which only the desktop app sets) — a CLI-scaffolded agent's workspace can sit anywhere under `$HOME` the user chose. Destinations and `computer_trash` still cannot write into it. A workspace *source* may be copied (not moved) out only when it is a generated document (PDF, images, office files); `computer_open` of workspace exec surfaces (`.terminal`, `.webloc`, `.fileloc`, …) is denied. `computer_move`'s own description now says so, so the model doesn't reach for it as a `read_file`/`run_command` workaround.
 - **Every `computer_*` call asks by default**, via a built-in baseline rule (`COMPUTER_BASELINE_RULES` in `permissions.py`) — not a line in `permissions.yaml`, so it can't be silently defeated by a missing/broken config file. `ComputerAwarePermissionInspector` layers, last-match-wins: baseline `ask` < durable approvals overlay `allow` < the user's `permissions.yaml` (highest authority — a hand-written `deny` always wins).
 - **"Always allow" is durable and narrow**: `monkeybot_config/approvals.json` (machine-written, JSON — deliberately *not* appended into `permissions.yaml`, which is a comment-heavy file the app's Advanced settings save wholesale) stores one exact `(tool, resource)` pair per rule. Mutating tools (`computer_move`, `computer_trash`) are excluded from `ALWAYS_SCOPE` — their resource is the *source* path only, so an "always" rule would cover any destination — every call to them asks. The inspector re-`stat`s the overlay file on every check and reloads on change; on a genuine change it also clears the session-level approval cache, so a revoke in the app's Settings takes effect immediately rather than waiting for a gateway restart.
 - Registered via the standard `extra_tools` extension point in both the SSE (`gateway/sse/app.py`) and realtime (`gateway/realtime/routes.py`) gateways — same mechanism as `web_search`/`todo_list`. Never registered for subagents (`subagent_worker.py` builds its own `extra_tools` independently and never imports this package).

{monkeybot-3.4.0 → monkeybot-3.6.0}/docs/sse-gateway-ui.md

@@ -104,7 +104,8 @@ Common types you will handle in a chat UI:
 | `ToolCallStarted` / `ToolCallResult` | Tool name, args, result text / error. |
 | `TurnComplete` | Turn finished; includes `usage` (`input_tokens`, `output_tokens`, `cached_tokens`, `cost_usd`, `duration_ms`, `estimated_prompt_tokens` — see [Session usage endpoint](#session-usage-endpoint)). |
 | `Error` | Recoverable stream error string in `error`. |
-| `ImageBlock` | Inline image (`mime_type`, base64 `data`). |
+| `ImageBlock` | Inline image (`mime_type`, workspace `path`, or base64 `data` when no path). |
+| `FileBlock` | Generated document (`mime_type`, workspace `path`, `filename`, `file_id`). Path-only — clients load from disk; raw PDF bytes are never sent on the wire. |
 | `ThinkingBlockDelta` / `ThinkingBlockComplete` / `RedactedThinkingBlock` | Extended thinking blocks where the model exposes them. |
 | `ToolConfirmationRequest` | User must approve/deny; POST to `tool-confirmations` with `tool_call_id`. Carries `tool_name`, `arguments` (the tool's raw call args — e.g. `path`/`url`/`app` for `computer_*` tools, useful for showing *what* is being approved), and an optional human-readable `prompt`. The reference Textual client can auto-answer these client-side in `auto-approve`/`deny-confirms` mode (`Shift+Tab` in `monkeybot chat`) — this is purely a UI convenience, no gateway change; `ActionRequiredEvent` elicitations are never auto-answered. |
 | `ActionRequiredEvent` | e.g. `action_type: "elicitation"` with `id` and `payload`; POST to `elicitations/{id}`. |

{monkeybot-3.4.0 → monkeybot-3.6.0}/docs/verifier-agent-design.md

@@ -70,8 +70,9 @@ A new session should read this section, then Part 8. Phases 0–6 are in the tre
 - `NudgeActuator` on `PRE_TOOL`; drain caps severity and stashes one nudge.
 - `tail_grace_s` on the turn-tail drain only, and only while the judge has a call in flight
   (`mailbox.pending`) — an idle turn never pays the grace.
-- Nudge/replan notes are request-scoped (`put_nudge`/`take_nudge` take a `request_id`): a note
-  whose request has already finished is dropped, not applied to the next user message.
+- Sticky nudges (`activate_nudge`/`peek_nudge`) and replan notes (`put_replan`/`take_replan`)
+  are request-scoped: a note whose request has already finished is dropped, not applied to
+  the next user message.
 - Judge rate limits are charged at `enqueue` and refunded when no verdict lands, so a slow port
   cannot slip past `max_verdicts_per_message` while a call is in flight.
 - Tests: `tests/core/test_progress_tracker.py` (`test_nudge_reaches_next_system_message_once`), `tests/evals/test_verifier_port.py`.
@@ -725,16 +726,16 @@ New `verifier:` block in `monkeybot.yaml`, defaulted off. The section is **YAML-
 verifier:
   enabled: false               # master switch; when false, NOTHING below runs
   ledger:
-    enabled: false             # one classifier call per human input when on
-    model: gemini-2.5-flash    # classifier; see Open decision 2
+    enabled: false             # omitted → follows verifier.enabled
+    # model:                   # omitted / null → inherit model.name (then gemini-2.5-flash)
     max_entries_per_thread: 64
   tracker:
-    enabled: false             # requires ledger.enabled for constraint signals
+    enabled: false             # omitted → follows verifier.enabled
     suspicion_threshold: 3
     min_turn_before_verdict: 3
   judge:
-    enabled: false             # requires tracker.enabled
-    model: gemini-2.5-flash    # small + fast; not the main agent's model
+    enabled: false             # omitted → on only when parent and tracker are on
+    # model:                   # reserved; SignalJudge ignores it today
     max_verdicts_per_message: 3
     min_turns_between_verdicts: 2
     max_spend_ratio: 0.25      # of main-agent tokens for this message
@@ -743,16 +744,18 @@ verifier:
     max_severity: nudge        # nudge | replan | steer | block
 ```
 
-**Gating is explicit and hierarchical.** Precedence, highest first:
+**Gating is hierarchical.** Precedence, highest first:
 
 1. **`verifier.enabled` is the master switch.** When `false`, nothing below runs — not the ledger, not the tracker, not the judge, and not actuation — regardless of child `enabled` flags or `escalation.max_severity`. That is the one switch an operator needs to turn the whole feature off.
-2. **Child `enabled` flags** (`ledger`, `tracker`, `judge`) only apply when the master switch is on. A child set `true` while the master is `false` is a no-op, not an override.
-3. **`judge` requires `tracker`.** `tracker` without `ledger` runs only the ledger-independent signals (`error_streak`, `no_progress`, `write_without_read`, `budget_burn`, `rewrite_churn`). `ledger` can run alone (Phase 1 ships this way).
+2. **When the master is on, omitted child `enabled` flags inherit on** for `ledger` and `tracker`. Omitted `judge.enabled` inherits on only if the tracker is on. Explicit `enabled: false` still opts a nested section out. A child set `true` while the master is `false` is a no-op, not an override.
+3. **`judge` requires `tracker` at runtime.** `build_verifier` skips an explicit `judge.enabled: true` when the tracker is off and logs that skip. `tracker` without `ledger` runs only the ledger-independent signals (`error_streak`, `no_progress`, `write_without_read`, `budget_burn`, `rewrite_churn`). `ledger` can run alone (Phase 1 ships this way).
 4. **`escalation.max_severity` caps actuation, it does not enable anything.** `enabled: true` plus `max_severity: none` is "on but muted": observe/record verdicts at `none`, never nudge/replan/steer/block. Raising the cap cannot turn on a disabled child. The smoke fixture `evals/smoke_agent/monkeybot_config/monkeybot.verifier-on.yaml` uses this shape on purpose.
 
 The parser does not rewrite child flags when the master is off; readers must check `verifier.enabled` first. `max_severity` values are `none | nudge | replan | steer | block` in that rank order (`VERIFIER_SEVERITY_ORDER` in `core/config/settings.py`). `steer` is reserved for a later optional phase; Phases 4–6 ship nudge/replan/block.
 
-The ledger's default is `false` because it is the only sub-feature with a per-message model cost even when nothing is being verified.
+The dataclass default for every nested `enabled` is still `false` so an absent `verifier:` section stays off. The inheritance rule above is the upgrade hazard: an existing file that set only `verifier.enabled: true` plus `ledger.enabled: true` now also gets the tracker (and the judge if the tracker stays on). Opt out with `tracker.enabled: false` / `judge.enabled: false`.
+
+Omitted `ledger.model` / `judge.model` resolve through `effective_verifier_model` — the same `model.name` / `MODEL_NAME` / `gemini-2.5-flash` chain as `get_provider_config`. `judge.model` is reserved; today's worker is the deterministic `SignalJudge`.
 
 **Plumbing is a typed snapshot field, not an env map.** Mirror `subagents:`:
 

{monkeybot-3.4.0 → monkeybot-3.6.0}/integrations/browser-mcp/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "monkeybot-browser-mcp"
-version = "0.7.0"
+version = "0.7.2"
 description = "monkeybot MCP server wrapping browser-harness for real-browser control and site playbooks."
 requires-python = ">=3.11"
 dependencies = [

{monkeybot-3.4.0 → monkeybot-3.6.0}/integrations/browser-mcp/src/browser_mcp/tab_ops.py

@@ -76,8 +76,30 @@ def _close_target(helpers: Any, target_id: str) -> None:
     raise tabs.SingleTabBackendError()
 
 
+def _blank_target_id(helpers: Any) -> str | None:
+    """Reuse the focused about:blank tab instead of stacking a New tab."""
+    if not callable(getattr(helpers, "current_tab", None)):
+        return None
+    try:
+        row = helpers.current_tab()
+    except Exception:
+        logger.debug("current_tab failed while looking for a blank tab", exc_info=True)
+        return None
+    if not isinstance(row, dict):
+        return None
+    if not actions._is_blank_url(str(row.get("url") or "")):
+        return None
+    tid = row.get("targetId") or row.get("target_id")
+    return str(tid) if tid else None
+
+
 def _create_blank_target(helpers: Any, *, focus: bool, url: str = "about:blank") -> bool:
     """Create a tab. Returns True if ``url`` was already loaded by the helper."""
+    existing = _blank_target_id(helpers)
+    if existing:
+        if focus:
+            helpers.switch_tab(existing)
+        return actions._is_blank_url(url)
     if callable(getattr(helpers, "cdp", None)):
         try:
             result = helpers.cdp(

{monkeybot-3.4.0 → monkeybot-3.6.0}/integrations/browser-mcp/tests/test_tabs.py

@@ -149,6 +149,27 @@ def test_user_opened_untouched_tabs_do_not_count_toward_cap(
     )
 
 
+def test_open_tab_reuses_focused_blank_instead_of_creating() -> None:
+    helpers = _helpers(tabs_list=[_tab("blank", "about:blank")], focused="blank")
+    helpers.cdp = MagicMock()
+
+    def goto_url(url: str, **_k: object) -> str:
+        helpers.current_tab.return_value = _tab("blank", url)
+        helpers.page_info.return_value = {"url": url, "title": "t", "w": 800, "h": 600}
+        return url
+
+    helpers.goto_url.side_effect = goto_url
+    with _patch_harness(helpers):
+        json.loads(server.browser_tabs())
+        result = json.loads(server.browser_open_tab("https://ex.test/new"))
+    assert result["ok"] is True
+    assert result["url"] == "https://ex.test/new"
+    assert all(
+        not (c.args and c.args[0] == "Target.createTarget")
+        for c in helpers.cdp.call_args_list
+    )
+
+
 def test_close_tab_then_retry_succeeds(monkeypatch: pytest.MonkeyPatch) -> None:
     monkeypatch.setenv("BROWSER_MCP_MAX_TABS", "1")
     user = _tab("user", "https://user.test/")

{monkeybot-3.4.0 → monkeybot-3.6.0}/integrations/browser-mcp/uv.lock

@@ -484,7 +484,7 @@ wheels = [
 
 [[package]]
 name = "monkeybot-browser-mcp"
-version = "0.7.0"
+version = "0.7.1"
 source = { editable = "." }
 dependencies = [
     { name = "browser-harness" },

{monkeybot-3.4.0 → monkeybot-3.6.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "monkeybot"
-version = "3.4.0"
+version = "3.6.0"
 description = "monkeybot agent harness — FastAPI SSE gateway, owned loop, SQLite, and MCP."
 requires-python = ">=3.11"
 readme = "README.md"
@@ -23,6 +23,7 @@ dependencies = [
     # <2.5: newer numpy stub files use PEP 695 `type` statements that mypy
     # cannot parse while this project's [tool.mypy] targets python_version 3.11.
     "numpy>=1.26.0,<2.5",
+    "pillow>=10.0.0",
 ]
 
 [project.optional-dependencies]
@@ -98,6 +99,8 @@ dev = [
     "monkeybot[knowledge-media]",
     # MemPalace is an optional extra; tests still exercise the adapter.
     "monkeybot[memory]",
+    # Native goal persistence tests hit a real Postgres via asyncpg.
+    "monkeybot[postgres]",
 ]
 
 [tool.uv]