AbstractRuntime v0.4.32

This release also contains everything listed under 0.4.31, which was never
published on its own.

Added

• Stop reaches the running effect. Runtime.cancel_run(...) now signals the
  effect that is executing for the run (and for its in-flight descendants), not
  only the stored status. The LLM_CALL handler passes the signal to
  AbstractCore as cancel_event=, so a local provider stops within one token,
  and the remote client closes its request to the AbstractCore server, which
  treats the disconnect as a cancel. The stopped attempt is recorded as
  cancelled (new StepStatus.CANCELLED, EffectOutcome.cancelled) with
  cancelled_by, reason and timing fields, is never retried, and nothing
  after it runs. Remaining calls of a tool batch are reported as not started.
  cancel_run(..., cancelled_by=...) is a new keyword (default "api").
• core/effect_cancellation.py: inflight_effects() lists executing effects;
  request_model_effects_cancel(provider, model) stops the effects using a
  model; kill_inflight_effect(step_id, killed_by=...) is an in-process hard
  stop for a call that ignores its cancel event.
• Model eject stops its calls first. Local unload_model_residency
  cancels the effects using the unloaded model before unloading it, and the
  ledger records cancelled_by: "model_eject" with the model named.
• Speculation (MTP) controls. LLM_CALL.params.speculation (False,
  True, or a Core speculation object) and boolean or string thinking are
  forwarded by local and remote clients. _runtime.speculation sets a
  run-wide preference inherited by subworkflows, Agent loops, delegated
  children and structured-output follow-up calls; an explicit False stays
  Off across every boundary. VisualFlow LLM Call and Agent nodes accept a
  speculation input. Scoped AbstractCore defaults reach provider
  construction, and config_facade.normalize_speculation_control() validates
  host values with Core's vocabulary.
• Native MLX execution controls. Local clients admit concurrent calls only
  when the loaded MLX instance advertises safe scheduling; other instances
  stay serialized through streamed completion. Remote results expose Core's
  execution, speculation, performance and prompt_cache metadata.
  New get_execution_capabilities(model_name=None, provider=None) on the
  clients and the discovery facade asks the actual execution host without
  loading a model.
• Text phase progress. Every LLM_CALL is offered the durable progress
  channel. Providers that report prefill/generation phases produce
  abstract.progress ledger events with kind: "llm" (phase,
  prompt_tokens, cached_tokens, fed_tokens, generated_tokens,
  ttft_s, tokens_per_second). The callback travels beside the effect
  (core/progress_channel.py), so effect.payload stays JSON-serializable.
• Run-tree tool ceiling. An explicit allowed_tools list in _runtime, in
  a child run, or in a tool payload is intersected across the run tree
  (core/tool_scope.py). Approval policy can remove a prompt but never grant
  a tool outside the ceiling; malformed lists and broken ancestry fail closed.
• Runtime.tick(..., step_gate=callable) lets a host pause a run at the next
  step boundary; the run stays RUNNING and a later tick continues.
• Runtime.set_default_provider_model(...) and the pooled client's
  set_default_provider_model(...) / set_capability_defaults(...) re-point
  the default provider/model without a restart.
• abstractruntime.turn_grounding: stamp_user_turn_grounding() writes the
  grounding envelope once into the stored user turn, so each turn's prompt is
  a byte prefix of the next one and provider prompt caches survive across
  turns. Session replay returns the stored bytes.
• JsonFileRunStore.list_event_waiters(...) / list_event_waiters_by_prefix(...)
  (optional EventWaiterQueryableRunStore protocol, also forwarded by
  OffloadingRunStore). emit_event uses this index instead of scanning
  every run file.
• The model receives a description of its workspace scope (default directory,
  access mode, extra roots and exclusions), and out-of-scope path errors list
  the authorized roots.
• VisualFlow: inline pin expressions (node.data.pinExpressions, sandboxed
  with RestrictedPython), continueOnError on effect nodes, a write_chart
  node, a write_docx node, image embedding and branded exports in PDF/DOCX
  renderers, and shq / text_of sandbox helpers.
• abstractruntime.__version__.
• The configured reasoning effort on AbstractCore's text capability route is
  applied when a call names no thinking.
• config_facade.read_email_settings() and read_maintenance_settings().
• LLM results carry route (the provider, model and base_url that actually
  served the call, with a mismatch flag).
• In-process on_token streaming callbacks (set_on_token) on local and
  pooled clients; read_idle_timeout_s for LLM calls.
• WAIT_EVENT accepts a deadline; _runtime.wait_until_streak counts
  consecutive WAIT_UNTIL parks.
• RuntimeHealth counters, bounded run-vars growth for long-running runs,
  an indexed idempotency lookup, fair scheduling across several run stores
  (scheduler/multi_store.py), a steer sidecar store, and durable session
  conversation replay.
• history_bundle: a detail="replay" profile and in-band warnings[] when a
  bundle cannot be complete.
• Entity runtime (abstractruntime.identity): the per-entity home runtime,
  chat driver, visit workflow, life loop, diary and memory effects
  (MEMORY_CONSOLIDATE, MEMORY_PROBE, MEMORY_TEND, LIFE_QUERY,
  ENTITY_TOOLS_QUERY, ENTITY_TOOLS_EXECUTE), phase graph and entity tools.
  See docs/entity-runtime.md.
• Tool surfaces: browser_probe in the web toolset (asks for approval by
  default), a camera toolset registered when abstractcamera is installed,
  a git_read_only@v1 approval refiner, and agora hub tools.

Changed

• Dependency floors: abstractcore[remote,tools,vision,voice,audio,music]>=2.13.41,
  abstractcore[all-apple]>=2.13.41 (apple extra),
  abstractcore[all-gpu]>=2.13.41 (gpu extra), AbstractMemory>=0.3.0,
  abstractsemantics>=0.0.5. RestrictedPython>=7.0 and pyyaml>=6.0 are
  declared dependencies.
• The gpu extra's setuptools floor is >=77.0.3 (was >=80.10.2), which
  vLLM's setuptools<80 requirement can satisfy.
• Migration: with RestrictedPython installed, VisualFlow Code nodes always run
  under its policy. Augmented assignment on subscripts (d["k"] += 1) is
  refused; rewrite it as read, modify, write.
• The default iteration budget (RuntimeConfig.max_iterations and the
  Agent-node fallback) is 20. Workflow-declared values still win.
• LLM calls default to read_idle_timeout_s=300: a stream that delivers
  nothing for 5 minutes is aborted. Pass read_idle_timeout_s: None in
  llm_kwargs to disable it.
• Tool approval waits use a unique, replay-stable key per approval
  (tool_approval:{run_id}:{node_id}:{effect_identity}). Runs already
  waiting on an older key can still be approved.
• A connected VisualFlow node of an unknown type fails compilation with
  UnknownNodeTypeError instead of running as a no-op.
• Terminal ledger records are slimmer, the offloading ledger store is used by
  the durable factories, and hot-path store reads avoid full-document parses.
• Deterministic LLM client errors and prompt-cache binding failures are not
  retried.

Fixed

• A per-call provider pin reaches the provider it names: pooled clients no
  longer hand the default endpoint's base_url / api_key to other providers.
• Catalog discovery works when the default text client cannot be built.
• A fresh install with no provider configured constructs its runtime; calls
  without a provider fail with a message naming what to configure.
• The session prompt-cache prefix is prepared with the thinking value the
  call generates with, and prompt-only calls under a runtime-derived key no
  longer append to their own cache.
• The remote client forwards thinking; streamed reasoning keeps the complete
  final text.
• Effect-only paths into a VisualFlow End node no longer copy runtime
  bookkeeping into the result.
• Visual llm_call nodes forward provider and model independently.
• Native tool calls are kept by the chat driver.
• JsonlCommandStore.append fsyncs before returning.
• Run-output offload reduces the largest children first, so a small answer
  stays inline next to a large scratchpad.
• The JSON run store cache is LRU-bounded; hash-chained ledgers no longer fork
  under concurrent handles.
• Entity-lane execute_command kills its whole process tree on timeout.
• PDF export renders scientific and typographic glyphs.