polyrob 1.0.2__tar.gz → 1.0.3__tar.gz

{polyrob-1.0.2/polyrob.egg-info → polyrob-1.0.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: polyrob
-Version: 1.0.2
+Version: 1.0.3
 Summary: POLYROB — autonomous AI agent framework
 Author: The POLYROB Authors
 License-Expression: MIT
@@ -16,7 +16,7 @@ License-File: LICENSE
 Requires-Dist: pydantic>=2.0.0
 Requires-Dist: pydantic-settings>=2.0.0
 Requires-Dist: python-dotenv>=1.0.0
-Requires-Dist: openai>=1.0.0
+Requires-Dist: openai>=1.26.0
 Requires-Dist: anthropic>=0.20.0
 Requires-Dist: google-generativeai>=0.8.0
 Requires-Dist: tiktoken>=0.7.0
@@ -47,6 +47,8 @@ Requires-Dist: httplib2>=0.32.0
 Requires-Dist: pyasn1>=0.6.4
 Requires-Dist: anysite-cli>=0.3
 Requires-Dist: pyyaml>=6
+Requires-Dist: packaging>=23.2
+Requires-Dist: h2>=4.4.1
 Provides-Extra: server
 Requires-Dist: fastapi==0.141.1; extra == "server"
 Requires-Dist: starlette==1.6.0; extra == "server"

{polyrob-1.0.2 → polyrob-1.0.3}/agents/task/agent/core/next_action_internal.py

@@ -670,8 +670,11 @@ Then emit your function calls."""
 			converted_input_messages = self.message_manager.merge_successive_messages(converted_input_messages, HumanMessage)
 			converted_input_messages = self.message_manager.merge_successive_messages(converted_input_messages, AIMessage)
 
-		# Check token safety using MessageManager's API (SINGLE SOURCE OF TRUTH)
-		safety_check = self.message_manager.check_token_safety(raise_on_overflow=True)
+		# Check token safety using MessageManager's API (SINGLE SOURCE OF TRUTH).
+		# Overflow first gets ONE emergency prune (the recalibration above can
+		# reveal an overflow the step-boundary gate never saw); raises if still over.
+		from agents.task.agent.core.token_budget import ensure_token_budget
+		safety_check = ensure_token_budget(self.message_manager, self.logger)
 		self.logger.debug(
 			f"Token usage: {safety_check['usage_percent']:.1f}% "
 			f"({safety_check['current_tokens']}/{safety_check['max_limit']} tokens)"

{polyrob-1.0.2 → polyrob-1.0.3}/agents/task/agent/core/run_loop.py

@@ -78,6 +78,7 @@ from agents.task.agent.core.step import StepMixin
 from agents.task.agent.core.history_io import HistoryIOMixin
 from agents.task.agent.core.logging_io import LoggingIOMixin
 from agents.task.agent.core.safety_lifecycle import SafetyLifecycleMixin
+from core.wallet.infra_error import is_infra_broadcast_failure
 from agents.task.agent.core.user_ingress import UserIngressMixin
 from agents.task.agent.core.llm_provisioning import LLMProvisioningMixin
 from agents.task.agent.core.model_introspection import ModelIntrospectionMixin
@@ -474,6 +475,30 @@ class RunLoopMixin:
 						self.message_manager.inject_user_guidance(user_messages, session_context=session_context)
 						self.logger.info(f"✅ Injected {len(user_messages)} messages into conversation")
 
+					# A money verb that failed for a HOST reason (permission denied,
+					# read-only fs, unopenable db — "broadcast failed: … nothing was
+					# sent") cannot succeed later in this run and is an ops fact, not a
+					# puzzle: 2026-09-16/17 the EXIT rails spent 8 steps on `ls -la`/
+					# `run_code` forensics after exactly this, and the owner learned of
+					# the outage 5 h late with the wrong cause. End the run with the
+					# verbatim line so the runner reports one failed run, right cause.
+					_infra = next((r.error for r in (self._last_result or [])
+					               if getattr(r, "error", None)
+					               and is_infra_broadcast_failure(r.error)), None)
+					if _infra:
+						self.logger.error(
+							f"MONEY VERB INFRA FAILURE — ending the run, nothing was sent: {_infra[:400]}")
+						try:
+							from core.event_log import emit as _emit_event
+							_emit_event("money_verb_infra_failure", source="run_loop",
+							            user_id=str(getattr(self, "user_id", "") or ""),
+							            session_id=str(self.session_id),
+							            attrs={"error": _infra[:400]})
+						except Exception:
+							pass
+						self.state.stopped = True
+						break
+
 					# R1: track consecutive reply-only steps. A reply-only step is one
 					# whose every result is a non-blocking user-facing reply (no tool
 					# ran); anything else (productive tool, planning turn, error, done)
@@ -486,6 +511,18 @@ class RunLoopMixin:
 
 					# Check if the agent is done
 					if results and any(result.is_done for result in results):
+						# A message that arrived DURING the finishing step was just drained
+						# and injected above — the HITL queue is now empty, so the harness's
+						# "pending input" resume would never fire and the message would sit
+						# unanswered at the history tail (2026-09-18 08:12Z: the owner's
+						# "Ok I meant 0.04…" correction landed on Rob's done() step and got
+						# no reply). It earns the next step instead of dying with done().
+						if user_messages:
+							self.logger.info(
+								f"{len(user_messages)} message(s) arrived during the finishing "
+								"step — continuing the run so they get a turn")
+							continue
+
 						# I-3 / H3 (dedup decision D1): the agent can edit code and call
 						# done() without ever re-running tests. Derive the signal from the
 						# EXISTING action ledger (agents/task/runtime/edit_verify.py, which

{polyrob-1.0.2 → polyrob-1.0.3}/agents/task/agent/core/step_execution.py

@@ -15,6 +15,13 @@ from agents.task.agent.views import ActionResult
 from modules.llm.messages import HumanMessage
 from agents.task.constants import MAX_MCP_PER_STEP
 
+# Hard ceiling on tool calls executed in ONE step; the rest are deferred to the next
+# step with a notice. ONE constant — the system prompt (`prompts.py`) renders this same
+# number, so the model is never told a bigger batch than the executor will run
+# (2026-09-19: the prompt said 1-10, the executor ran 5, and the 6th call vanished
+# from the agent's point of view).
+MAX_TOOL_CALLS_PER_STEP = 5
+
 #: OR-4: how many consecutive empty-action steps before the strong "thinking loop"
 #: intervention fires. Default 2 (one step sooner than the legacy 3) so a model
 #: that answers in prose without a tool call — Grok/GPT-5 on content-gen — is
@@ -371,7 +378,6 @@ class StepExecutionMixin:
 			# a whole extra LLM round trip (~60k input tokens) to re-request work the
 			# model had already decided on. 5 covers the common read-only fan-out while
 			# keeping a hard ceiling on single-step context growth.
-			MAX_TOOL_CALLS_PER_STEP = 5  # Allow up to 5 parallel calls
 			actions_to_execute = model_output.action
 			deferred_actions = []
 
@@ -387,11 +393,12 @@ class StepExecutionMixin:
 				deferred_names = [getattr(a, 'name', str(a)[:30]) for a in deferred_actions]
 				self.message_manager.push_ephemeral_message(
 					HumanMessage(content=(
-						f"⚠️ **Tool Call Limit Applied**\n\n"
-						f"{len(deferred_actions)} tool calls were deferred to prevent context overflow:\n"
+						f"⚠️ **Tool Call Limit Applied — {len(deferred_actions)} call(s) did NOT run**\n\n"
+						f"A step executes at most {MAX_TOOL_CALLS_PER_STEP} tool calls; these were NOT "
+						f"executed and have NO result:\n"
 						f"- {', '.join(deferred_names[:5])}"
 						f"{'...' if len(deferred_names) > 5 else ''}\n\n"
-						f"Process these in your next step, 1-{MAX_TOOL_CALLS_PER_STEP} at a time."
+						f"Call them again now, 1-{MAX_TOOL_CALLS_PER_STEP} at a time — do not assume they ran."
 					))
 				)
 

polyrob-1.0.3/agents/task/agent/core/token_budget.py

@@ -0,0 +1,29 @@
+"""Pre-LLM token budget: prune once before the overflow kills the run.
+
+The step-boundary compaction gate (``core/step.py``) reads the running
+estimate; token counts are RECALIBRATED just before the LLM call, and a step
+that appended several large tool results can cross the safe line only after
+that recalibration — the gate never saw it. Raising there ends the run with
+no fallback provider (prod 2026-09-18 14:34Z, ``966d3539``). The emergency
+prune is the non-LLM safety net designed for exactly this; give it one turn
+before raising, and raise only if the history is still over the line.
+"""
+from __future__ import annotations
+
+import logging
+from typing import Any, Dict
+
+
+def ensure_token_budget(message_manager: Any, logger: logging.Logger) -> Dict[str, Any]:
+    """Return the safety-check dict; prune once on overflow; raise if still unsafe."""
+    check = message_manager.check_token_safety(raise_on_overflow=False)
+    if check.get("safe", True):
+        return check
+    logger.warning(
+        "🚨 Pre-call token overflow (%s/%s, %.1f%%) — emergency prune before raising",
+        check.get("current_tokens"), check.get("max_limit"), check.get("usage_percent", 0.0))
+    try:
+        message_manager.emergency_context_prune()
+    except Exception:
+        logger.warning("emergency prune failed; re-checking budget", exc_info=True)
+    return message_manager.check_token_safety(raise_on_overflow=True)

{polyrob-1.0.2 → polyrob-1.0.3}/agents/task/agent/messages/filters.py

@@ -22,8 +22,17 @@ from agents.task.agent.message_manager.tool_call_builder import (
 logger = logging.getLogger(__name__)
 
 
+# A tool result shorter than this is never replaced by a back-reference: the
+# pointer text is ~80 chars, so there is nothing to save, and a short result is
+# usually a CONFIRMATION ("Edited kb-root-position-ledger.md") the agent needs
+# verbatim — prod 2026-09-19 15:35Z: three identical `coding_str_replace`
+# confirmations in one step came back as "[duplicate of …]" and the agent
+# reported "3 that returned the dedup artifact" instead of three landed edits.
+DEDUP_MIN_CHARS = 160
+
+
 def dedup_tool_results(messages: List[BaseMessage]) -> List[BaseMessage]:
-	"""Replace byte-identical repeated tool outputs with a back-reference (B2).
+	"""Replace byte-identical repeated LONG tool outputs with a back-reference (B2).
 
 	Reference does this (MD5-keyed) in its compaction pre-pass — cheap token savings on
 	retry/polling loops where the same tool returns the same payload repeatedly. The
@@ -38,7 +47,8 @@ def dedup_tool_results(messages: List[BaseMessage]) -> List[BaseMessage]:
 	seen: Dict[str, int] = {}
 	out: List[BaseMessage] = []
 	for msg in messages:
-		if isinstance(msg, ToolMessage) and isinstance(msg.content, str) and msg.content:
+		if (isinstance(msg, ToolMessage) and isinstance(msg.content, str)
+				and len(msg.content) >= DEDUP_MIN_CHARS):
 			digest = hashlib.md5(msg.content.encode("utf-8", "ignore")).hexdigest()[:12]
 			if digest in seen:
 				ref = ToolMessage(

{polyrob-1.0.2 → polyrob-1.0.3}/agents/task/agent/prompts.py

@@ -75,7 +75,7 @@ class SystemPrompt:
 		self.verbosity = str(verbosity).strip().lower() if verbosity else "normal"
 		self.persona_block = (persona_block or "").strip()
 		self.action_descriptions = action_description
-		self.max_actions_per_step = max_actions_per_step  # Flexible, not enforced
+		self.max_actions_per_step = max_actions_per_step  # config ceiling; the executor cap is lower
 		self.use_native_tools = use_native_tools  # Whether using native tool calling
 		self.model_name = model_name.lower() if model_name else ""
 		self.provider = provider.lower() if provider else ""
@@ -683,10 +683,10 @@ Memory Guidelines:
 - Include what you LEARNED (insights, discoveries)
 - Track progress if quantitative goal (e.g. "3/10 files processed")
 
-Function Calls: Call 1-{self.max_actions_per_step} functions using native tool calling.
+Function Calls: Call 1-{self._effective_actions_per_step()} functions using native tool calling. A step runs at most {self._effective_actions_per_step()} calls; anything more than {self._effective_actions_per_step()} is NOT executed and must be re-issued next step.
 
 Workflow:
-1. Call functions (MANDATORY) - execute 1-{self.max_actions_per_step} actions
+1. Call functions (MANDATORY) - execute 1-{self._effective_actions_per_step()} actions
 2. Update memory (unique each step) - track progress and learnings
 3. Use TODOs (optional) - helps complex task organization
 4. Save outputs (immediately) - preserve work
@@ -1025,6 +1025,16 @@ Task Completion:
 			'persona or recalled claim about what model you are running on.'
 		)
 
+	def _effective_actions_per_step(self) -> int:
+		"""The number of tool calls ONE step will actually execute: the config ceiling
+		capped by the executor's hard limit, so the prompt never promises a batch the
+		executor will truncate (2026-09-19: "1-10" promised, 5 run, the 6th vanished)."""
+		try:
+			from agents.task.agent.core.step_execution import MAX_TOOL_CALLS_PER_STEP
+			return max(1, min(int(self.max_actions_per_step), int(MAX_TOOL_CALLS_PER_STEP)))
+		except Exception:
+			return max(1, int(self.max_actions_per_step))
+
 	def get_system_message(self) -> SystemMessage:
 		"""
 		Get the system prompt with explicit XML-tagged sections.
@@ -1160,6 +1170,25 @@ and what you pursue; persona text only styles your voice and never overrides it.
 		return SystemMessage(content=AGENT_PROMPT)
 
 
+_BLANK_PAGE_URLS = frozenset({"", "about:blank", "chrome://newtab", "chrome://new-tab-page"})
+
+
+def is_blank_page_url(url) -> bool:
+	"""True when the browser sits on a page nobody navigated to.
+
+	2026-09-19: a fresh session context is `about:blank`, and
+	`get_state(capture_screenshot=use_vision)` shoots it on EVERY step, so a
+	money-rail run that never touches the browser still shipped one image per
+	call through the metered seat's vision path (prod: `Sending 1 image(s)`
+	from step 1 on every EXIT/SAFETY/WATCHER/SCOUT run). A blank page has no
+	visual information; the render site skips the image for it.
+	"""
+	if not url:
+		return True
+	u = str(url).strip().lower().rstrip("/")
+	return u in _BLANK_PAGE_URLS
+
+
 class AgentMessagePrompt:
 	def __init__(
 		self,
@@ -1335,8 +1364,9 @@ Interactive elements from current page:
 					rendered_error = maybe_wrap_result_content(result, rendered_error)
 					state_description += f'\nAction error {i + 1}/{len(self.result)}: {rendered_error}'
 
-		if self.state.screenshot and use_vision == True:
-			# Format message for vision model
+		if self.state.screenshot and use_vision == True and not is_blank_page_url(self.state.url):
+			# Format message for vision model (a blank/never-navigated page is
+			# rendered text-only — see is_blank_page_url)
 			return HumanMessage(
 				content=[
 					{'type': 'text', 'text': state_description},

{polyrob-1.0.2 → polyrob-1.0.3}/agents/task/agent/skill_writer.py

@@ -321,9 +321,13 @@ class SkillWriterMixin:
             return SkillWriteResult(skill_id, False, errors=[f"skill '{skill_id}' not found for user"])
         # A forged (non-user) turn may refine its OWN pending draft but must never
         # mutate an already-ACTIVE skill (that's user-controlled instruction content).
-        if created_by in _NON_USER_AUTHORS and not self._is_pending_path(skill_file):
-            return SkillWriteResult(skill_id, False,
-                                    errors=["a background turn cannot patch an active skill"])
+        # 056 WS6 (2026-09-19): instead of refusing, the SAME call lands a pending
+        # REVISION of the active skill under `.pending/<id>/` for the owner's
+        # `promote` — the active file is still never touched by a forged turn
+        # (SK-F10 holds; goal 367150fd7a0e had to be hand-applied by ops before).
+        propose_only = created_by in _NON_USER_AUTHORS and not self._is_pending_path(skill_file)
+        if propose_only:
+            pending = True
         try:
             current = self._read_skill_text(skill_file)
         except Exception as e:
@@ -345,7 +349,7 @@ class SkillWriterMixin:
         # Re-run the full validate+scan gate on the NEW body.
         return self.create_skill(skill_id, updated, user_id=uid, created_by=created_by,
                                  pending=pending if pending is not None else self._is_pending_path(skill_file),
-                                 expected_revision=actual_revision)
+                                 expected_revision=None if propose_only else actual_revision)
 
     def delete_skill(self, skill_id: str, *, user_id: str,
                      absorbed_into: Optional[str] = None,

{polyrob-1.0.2 → polyrob-1.0.3}/agents/task/constants.py

@@ -519,6 +519,27 @@ def autonomous_mode_tools() -> tuple:
     return AUTONOMOUS_MODE_TOOLS
 
 
+def effective_autonomous_tools() -> tuple:
+    """056 WS4: `autonomous_mode_tools()` minus the tools this deploy cannot
+    actually serve right now — today `email` when the transport is SMTP and the
+    credentials were rejected within the backoff window (`tools.email_tool`
+    remembers a 535 process-wide). The CONSTANT is untouched; only the set the
+    goal/cron dispatchers REQUEST moves, so a goal record stops carrying a false
+    `[tool gap] email …` line (330 failed loads in 48 h, 2026-09-17→19). An
+    AgentMail transport is unaffected by an SMTP rejection. Fail-open: any probe
+    error keeps the tool in."""
+    tools = tuple(autonomous_mode_tools())
+    try:
+        from core.config_policy.capability_toggles import email_provider
+        if "email" in tools and email_provider() == "smtp":
+            from core.credential_verdicts import rejected_within
+            if rejected_within("smtp", 900.0):  # = tools.email_tool.SMTP_AUTH_BACKOFF_SEC
+                tools = tuple(t for t in tools if t != "email")
+    except Exception:
+        pass
+    return tools
+
+
 # MCP Tool Throttling (single source of truth)
 # MCP actions (scraping, searches, APIs) are expensive and execute SEQUENTIALLY
 # Each MCP action takes 30-180 seconds. Limiting prevents timeout cascades.

{polyrob-1.0.2 → polyrob-1.0.3}/agents/task/goals/dispatcher.py

@@ -13,6 +13,7 @@ from __future__ import annotations
 
 import asyncio
 import logging
+import json
 import os
 from pathlib import Path
 from typing import Any, List, Optional
@@ -159,11 +160,12 @@ def default_goal_tools() -> list:
     (self-maintenance tier). Under effective AUTONOMY_MODE=autonomous the base
     switches to the full AUTONOMOUS_MODE_TOOLS grant (never money/host — those
     still ride compute posture, unaffected by mode)."""
-    from agents.task.constants import autonomous_mode_tools, full_autonomy_enabled
+    from agents.task.constants import effective_autonomous_tools, full_autonomy_enabled
     from agents.task.tool_defaults import with_compute_tools
-    # `autonomous_mode_tools()` folds in the defi rail when DEFI_AGENT_AUTONOMY is
-    # armed; unarmed it IS the bare constant, so the default posture is unchanged.
-    tools = list(autonomous_mode_tools()) if full_autonomy_enabled() else list(_DEFAULT_GOAL_TOOLS)
+    # `effective_autonomous_tools()` (056 WS4) = `autonomous_mode_tools()` — which
+    # folds in the defi rail when DEFI_AGENT_AUTONOMY is armed — minus tools this
+    # deploy cannot serve right now (email on rejected SMTP credentials).
+    tools = list(effective_autonomous_tools()) if full_autonomy_enabled() else list(_DEFAULT_GOAL_TOOLS)
     with_compute_tools(tools)  # SSOT for the posture>=1 additions (014 A2)
     if _hf_deploy_goal_tool_enabled() and "hf_deploy" not in tools:
         tools.append("hf_deploy")
@@ -187,6 +189,64 @@ def child_inheritable_tools() -> frozenset:
     return CHILD_INHERITABLE_TOOLS
 
 
+def imminent_cron_job(data_dir: str, now, headroom_sec: int) -> Optional[str]:
+    """Name the cron job due within ``headroom_sec`` (overdue included), else None.
+
+    Pure read of ``<data_dir>/cron.db``; ``headroom_sec <= 0`` or an absent /
+    unreadable store answers None without touching disk (fail-open: dispatch).
+    A goal run marks the shared project-root workspace busy and cron ticks skip
+    until it ends, so the dispatcher uses this to let a due rail go FIRST."""
+    if headroom_sec <= 0:
+        return None
+    from datetime import timedelta
+    db_path = os.path.join(data_dir, "cron.db")
+    if not os.path.exists(db_path):
+        return None
+    # Read-only over core.sqlite_util (the layering ratchet forbids agents -> cron);
+    # the predicate mirrors CronJobStore.due() (enabled, scheduled, next_run_at set)
+    # plus a job mid-run — it holds the workspace now, and its next_run_at is still
+    # the past due time until it finishes.
+    try:
+        from core.sqlite_util import execute_retry
+        rows = execute_retry(
+            db_path,
+            "SELECT id, task, next_run_at, status, payload FROM cron_jobs WHERE enabled=1 "
+            "AND status IN ('scheduled','running') AND next_run_at IS NOT NULL "
+            "AND next_run_at <= ? "
+            "ORDER BY next_run_at",
+            ((now + timedelta(seconds=headroom_sec)).isoformat(),), fetch="all")
+    except Exception:
+        logger.debug("imminent-cron probe failed; dispatching", exc_info=True)
+        return None
+    # 056 D1 follow-up (2026-09-19): a SCHEDULED money-class job pre-empts a running
+    # goal at the step boundary (`yield_for_rail`), so with yield on it need not hold
+    # the board back — after the D4 stagger the four rails' headroom windows covered
+    # every minute of an even hour and two goals sat `ready` for 40 min. A job mid-run
+    # holds the workspace NOW (nothing to pre-empt) and an ops-class job cannot
+    # pre-empt at all, so both still defer.
+    try:
+        from core.config_policy.goal_flags import GoalFlagsMixin
+        _yield_on = bool(GoalFlagsMixin.goal_yield_for_money_rail())
+    except Exception:
+        _yield_on = False
+    for job_id, task, next_run_at, status, payload in rows or []:
+        if _yield_on and status == "scheduled" and _payload_is_money(payload):
+            continue
+        return f"{str(job_id)[:12]} {(task or '')[:40]!r} due {next_run_at}"
+    return None
+
+
+def _payload_is_money(payload) -> bool:
+    """Mirror of ``cron.jobs.is_money_job`` over the raw stored payload (the
+    layering ratchet forbids agents -> cron)."""
+    try:
+        if isinstance(payload, (str, bytes)):
+            payload = json.loads(payload or "{}")
+        return str((payload or {}).get("priority") or "").lower() == "money"
+    except Exception:
+        return False
+
+
 def effective_goal_max_concurrent(user_id: Optional[str], home_dir) -> int:
     """Owner's in-flight goal cap: pref (min-merged, spec ``goals.max_concurrent``)
     over the ``GOAL_MAX_CONCURRENT`` env default. No pref file present =>
@@ -401,6 +461,7 @@ class GoalDispatcher:
         and UNCONDITIONALLY — before the ``GOALS_ENABLED`` gate (AU-F4.3) — so a
         crashed ``running`` row isn't stuck forever if the flag was flipped off.
         """
+        from datetime import datetime
         from agents.task.constants import AutonomyConfig
 
         # AU-F4.3: reclaim expired claims BEFORE the enabled-gate so a crashed
@@ -538,6 +599,18 @@ class GoalDispatcher:
             if slots == 0:
                 return 0
             ready = self._ready_for_dispatch(slots)
+            # A due cron rail goes first: on the shared workspace a goal run would
+            # mark the process busy and hold that rail for its whole runtime.
+            # Checked only when something is actually ready (an empty board must
+            # not read cron.db and log a deferral every tick).
+            if ready:
+                _imminent = imminent_cron_job(
+                    os.path.dirname(self.board.db_path), datetime.now(),
+                    AutonomyConfig.goal_dispatch_cron_headroom_sec())
+                if _imminent:
+                    logger.info("goal dispatch deferred (%d ready): cron job %s",
+                                len(ready), _imminent)
+                    return 0
             ttl = AutonomyConfig.goal_claim_ttl_sec()
             worker = self._worker
             dispatched = 0
@@ -621,6 +694,27 @@ class GoalDispatcher:
             logger.warning("hold_inflight: board hold failed", exc_info=True)
             return []
 
+    async def yield_for_rail(self, job) -> List[str]:
+        """056 WS5 (D1): a due MONEY cron job pre-empts this process's running goal
+        runs — `hold_inflight` (cancel at the step boundary, rows back to `ready`,
+        no failure increment) plus a `resume_note` so the goal knows why it
+        restarts and where its own artefacts are. Returns the held goal ids."""
+        jid = str(getattr(job, "id", "") or "")
+        jtask = str(getattr(job, "task", "") or "")[:40]
+        held = await self.hold_inflight(f"money rail {jid} ({jtask}) due")
+        from datetime import datetime as _dt
+        stamp = _dt.utcnow().strftime("%H:%MZ")
+        for gid in held:
+            try:
+                self.board.merge_payload(gid, {
+                    "resume_note": (f"Yielded at {stamp} because the money rail {jtask} "
+                                    f"({jid[:8]}) came due; this is a RESTART — read what "
+                                    f"you already wrote to disk before redoing anything.")})
+                self.board._event(gid, "yielded", {"job_id": jid, "task": jtask})
+            except Exception:
+                logger.debug("yield note failed for %s", gid, exc_info=True)
+        return held
+
     async def _run_goal(self, goal: Goal) -> None:
         """Run one claimed goal on the task-agent core, then record + self-wake."""
         session_id = None
@@ -741,7 +835,7 @@ class GoalDispatcher:
                 "provider": provider,
                 "model": model,
                 "tools": self._resolve_tools(goal),
-                "max_steps": payload.get("max_steps", 20),
+                "max_steps": payload.get("max_steps", AutonomyConfig.goal_default_max_steps()),
                 "temperature": 0.0,
                 "goal_id": goal.id,
             }
@@ -1356,6 +1450,28 @@ class GoalDispatcher:
         except Exception:
             logger.debug("blocked-goal ask creation skipped", exc_info=True)
 
+    @staticmethod
+    def _wake_text(goal: Goal, final: str, verified: str = "verified") -> str:
+        """056 WS7: what a completed goal says when it re-enters the session that
+        CREATED it. Default = ONE line (`goal <id8> done — <first line>`, ≤280
+        chars) — the origin session already has the artefacts on disk and a full
+        result re-entering it cost the owner a 5-step "verification" turn
+        (2026-09-19 03:00Z). `payload.report_back=true` (goal_create) keeps the
+        full completion text for goals whose whole point is the report."""
+        payload = goal.payload or {}
+        if payload.get("report_back"):
+            head = (f"✅ Background goal '{goal.title}' completed." if verified == "verified"
+                    else f"Background goal '{goal.title}' finished — done (unverified).")
+            return f"{head}\nResult:\n{str(final)[:1500]}"
+        first = ""
+        for line in str(final or "").splitlines():
+            if line.strip():
+                first = line.strip()
+                break
+        state = "done" if verified == "verified" else "done (unverified)"
+        text = f"goal {str(goal.id)[:8]} {state} — {first}"
+        return text if len(text) <= 280 else text[:277] + "…"
+
     def _completion_text(self, goal: Goal, final: str, verified: str = "verified",
                          deliverable_lines: Optional[list] = None,
                          session_link: Optional[str] = None) -> str:
@@ -1484,7 +1600,7 @@ class GoalDispatcher:
             if deliver is None:
                 return
             delivered = await deliver(origin, goal.user_id,
-                                      self._completion_text(goal, final),
+                                      self._wake_text(goal, final, "verified"),
                                       metadata={"source": "goal", "goal_id": goal.id,
                                                 "run_session_id": session_id})
             if delivered:

{polyrob-1.0.2 → polyrob-1.0.3}/agents/task/task_agent_lifecycle.py

@@ -56,17 +56,59 @@ class TaskAgentLifecycleMixin:
         if not getattr(self, "_owns_workspace_gc", True):
             logger.debug("workspace GC not owned by this process — loop not running")
             return
+        # 056 WS8: the first pass runs 10 min after start, then daily. With
+        # ~28 restarts/day on prod the old "sleep 24 h first" never fired once,
+        # and 1,642 stale session dirs (4.0 GB) accumulated.
+        delay = 600
         while True:
             try:
-                # Run cleanup daily
-                await asyncio.sleep(86400)  # 24 hours
+                await asyncio.sleep(delay)
+                delay = 86400
 
                 if self.session_manager:
                     cleaned = self.session_manager.cleanup_old_workspaces(max_age_days=7)
                     logger.info(f"Workspace cleanup: removed {cleaned} old workspaces")
+                self._session_dir_gc()
 
             except Exception as e:
                 logger.error(f"Error in workspace cleanup: {e}")
+
+    def _session_dir_gc(self) -> None:
+        """056 WS8: collect stale per-session dirs (dry-run unless
+        SESSION_DIR_GC_APPLY=true). Live/resident session ids are protected;
+        the report is logged and recorded as a `session_gc` event so the owner
+        sees the numbers before the switch is flipped."""
+        try:
+            from agents.task.path import pm
+            from agents.task.session_registry import resident_session_ids
+            from core.session_gc import collect_stale_sessions
+            sessions_root = str(getattr(pm(), "data_root", "") or "")
+            protect = set()
+            try:
+                protect.update(resident_session_ids(self))
+            except Exception:
+                pass
+            try:
+                if self.session_manager:
+                    protect.update(self.session_manager.get_active_sessions())
+            except Exception:
+                pass
+            rep = collect_stale_sessions(sessions_root, max_age_days=14, protect=protect)
+            logger.info("session gc (%s): candidates=%s removed=%s bytes=%s kept_recent=%s "
+                        "protected=%s errors=%s sample=%s",
+                        "APPLY" if rep.get("apply") else "DRY-RUN", rep.get("candidates"),
+                        rep.get("removed"), rep.get("bytes"), rep.get("kept_recent"),
+                        rep.get("protected"), rep.get("errors"), rep.get("sample"))
+            try:
+                from core.event_log import get_event_log, event_log_enabled
+                from core.event_kinds import SESSION_GC
+                if event_log_enabled():
+                    get_event_log().record(SESSION_GC, user_id="", source="lifecycle",
+                                           **{k: v for k, v in rep.items() if k != "sample"})
+            except Exception:
+                pass
+        except Exception as e:
+            logger.warning("session gc skipped: %s", e)
     @staticmethod
     def _session_age_seconds(created_at, now: Optional[datetime] = None) -> Optional[float]:
         """Age in seconds from an ISO 'created_at' string, or None if unparseable."""

{polyrob-1.0.2 → polyrob-1.0.3}/agents/task/tool_defaults.py

@@ -155,8 +155,21 @@ def with_compute_tools(tools: list[str]) -> list[str]:
     try:
         from agents.task.constants import compute_posture
         if compute_posture() >= 1:
-            for t in ("code_execution", "shell", "coding"):
-                if t not in tools:
+            # 056 WS4: posture is the CEILING; each tool's own flag still decides.
+            # Prod ran posture 1 with CODE_EXEC_ENABLED/SHELL_TOOLS_ENABLED off and
+            # every goal record carried a false "[tool gap] code_execution …" line
+            # (43 in 48 h) — the deploy was asking for tools it had switched off.
+            from core.config_policy.capability_toggles import (
+                code_exec_enabled, shell_tools_enabled, coding_tools_enabled)
+            wanted = (("code_execution", code_exec_enabled),
+                      ("shell", shell_tools_enabled),
+                      ("coding", coding_tools_enabled))
+            for t, enabled in wanted:
+                try:
+                    on = bool(enabled())
+                except Exception:
+                    on = False
+                if on and t not in tools:
                     tools.append(t)
     except Exception:
         pass

{polyrob-1.0.2 → polyrob-1.0.3}/api/server_boot.py

@@ -63,8 +63,10 @@ def run_server(host=None, port=None, workers=None, *, reload=None, log_level=Non
         workers=workers if not reload else 1,  # Can't use multiple workers with reload
         reload=reload,
         log_level=log_level,
-        # Proxy headers for nginx
+        # Proxy headers for nginx. Trust X-Forwarded-For ONLY from the local reverse
+        # proxy by default: "*" lets any direct caller claim 127.0.0.1 and pass every
+        # localhost-only check (webview/server_launcher.py pins the same default).
         proxy_headers=True,
-        forwarded_allow_ips="*",
+        forwarded_allow_ips=os.environ.get("UVICORN_FORWARDED_ALLOW_IPS", "127.0.0.1"),
         factory=True
     )

{polyrob-1.0.2 → polyrob-1.0.3}/cli/commands/approvals.py

@@ -23,13 +23,15 @@ from __future__ import annotations
 import click
 
 from core.prefs import load_preferences, propose_pref_change, write_preference
-from core.runtime_paths import resolve_runtime_paths
+from cli._admin_home import admin_data_dir
 from tools.controller.approval import effective_approval_state
 
 
 def _default_home_dir() -> str:
-    """Same data-home resolution as ``polyrob config set`` (core.runtime_paths)."""
-    return str(resolve_runtime_paths(local=True).data_home)
+    """The DEPLOYED data home (cli/_admin_home.py, the 031 rule) — the approval set is
+    the daemon's; resolving the shell-local home here wrote to /root/.polyrob on prod
+    and printed success (the same class as the recorded `delivery.daily_cap` defect)."""
+    return admin_data_dir()
 
 
 @click.group("approvals")