Release: v1.0.0

.env.example

@@ -50,6 +50,10 @@ ADMIN_PASSWORD=
 # password blank: no admin exists until the first person to open the instance
 # creates one at /setup (ent#580). Anyone who reaches it first can — see
 # docs/DEPLOYMENT.md -> Security Recommendations. Leave unset otherwise.
+# The AWS image sets ADMIN_PASSWORD_SOURCE=instance-id instead: /setup also asks
+# for the EC2 instance ID, which provisioning stores in
+# ${TRINITY_DATA_PATH}/setup-claim (0600, deleted once the admin exists), and
+# email becomes optional (#3004).
 # ADMIN_PASSWORD_SOURCE=
 
 # Anthropic API Key - Required for agents to use Claude
@@ -172,6 +176,13 @@ SLACK_SIGNING_SECRET=
 # malformed values fall back to the default (2).
 SLACK_SOCKET_CONNECTION_COUNT=2
 
+# Telegram group conversation context (ent#600) — how much of a group's recent
+# conversation a tagged turn carries: the newest N messages within a rolling
+# window of H hours. Empty, non-integer or non-positive values fall back to the
+# defaults (40 messages, 24 hours). Per-group on/off lives in the Telegram panel.
+TELEGRAM_GROUP_CONTEXT_MAX_MESSAGES=
+TELEGRAM_GROUP_CONTEXT_MAX_AGE_HOURS=
+
 # GitHub OAuth (for GitHub MCP)
 # Get from: https://github.com/settings/developers
 GITHUB_CLIENT_ID=
@@ -263,6 +274,28 @@ VOIP_ENABLED=false
 # sanitiser can stop a transformed secret. An admin can flip this at runtime
 # (system_settings wins over this variable, no restart needed).
 A2A_OUTBOUND_ENABLED=false
+# AAuth agent identity (trinity-enterprise#623, graduated by #862). Every key
+# resolves system_settings → env → default, and Settings → AAuth edits the first
+# two, so an admin can flip them at runtime.
+# AAUTH_ENABLED=                — agents on this instance sign their calls to other
+#                                 instances, and verified callers from instances an
+#                                 agent lists are accepted. Off until set or switched
+#                                 on in Settings; left unset here on purpose.
+# AAUTH_PROTOTYPE_ENABLED=false — the person-token and resource-calling prototypes
+#                                 (also need AAUTH_ENABLED).
+# AAUTH_ISSUER=                 — this instance's AAuth server identifier (https://<host>).
+# AAUTH_PERSON_SERVER=          — the person server agents bind through (e.g.
+#                                 https://person.hello.coop); unset → person-token
+#                                 requests fail closed with person_server_unconfigured.
+# AAUTH_RESOURCE_ALLOWLIST=     — the AAuth resources agents may call (JSON list or
+#                                 comma-separated https origins, e.g.
+#                                 https://senzing.aauth.dev); empty/malformed → NO
+#                                 resource is callable (fail closed). Setting key:
+#                                 aauth_resource_allowlist.
+AAUTH_PROTOTYPE_ENABLED=false
+AAUTH_ISSUER=
+AAUTH_PERSON_SERVER=
+AAUTH_RESOURCE_ALLOWLIST=
 # PSTN abuse / spend controls (sane defaults — tune for your Twilio plan).
 VOIP_MAX_CALL_DURATION=600        # hard per-call cap (seconds)
 VOIP_DEFAULT_DAILY_CALL_CAP=50    # per-agent calls/day (overridable per binding)
@@ -274,6 +307,28 @@ VOIP_INTENT_TTL_SECONDS=180       # staged Gemini-session intent TTL
 # Agent structured reports (#918)
 REPORT_RATE_LIMIT=30              # max reports an agent may create per 60s window
 
+# --- Declared business metrics (trinity-enterprise#478) ---------------------
+# Bootstrap values for the two metric knobs. Both are a FALLBACK, not an
+# override: a value saved through Settings (PUT /api/settings/ops/config) wins,
+# and while no such row exists these stay live — change one here and the next
+# read honours it. GET /api/settings/retention reports which tier answered.
+# Left COMMENTED on purpose (ent#671): a set variable is reported as the value's
+# source and makes its Settings → Retention row read-only, so set one only to
+# pin the value from the environment. Unset, the built-in default applies and
+# the row stays editable.
+METRICS_RATE_LIMIT=60             # max record_metrics calls per agent per 60s window
+# METRICS_RETENTION_DAYS=365      # how long recorded points are kept (0 = keep forever)
+# METRICS_DAILY_POINT_CAP=100000  # points one agent may record per UTC day (0 = unlimited)
+METRICS_READ_RATE_LIMIT=240       # max GET /metrics reads per agent per 60s window (tiles, dashboard binds, get_metrics)
+OBJECTIVES_READ_RATE_LIMIT=60      # max objective reads per agent per 60s window — GET /objectives and the Workspace role card share it (each one fans out into the agent container)
+
+# Inter-agent chain depth (#2806). How many agent-to-agent hops one call chain
+# may take (1-32); a hop past it is refused with 403 inter_agent_depth_exceeded.
+# A FALLBACK like the metric knobs above: a value saved via
+# PUT /api/settings/ops/config wins. Commented for the same reason (ent#671):
+# a set variable is reported as the value's source; unset, the default 8 applies.
+# INTER_AGENT_MAX_CHAIN_DEPTH=8
+
 # Agent canvases (ent#438/ent#553)
 CANVAS_MAX_PER_AGENT=100          # canvases an agent may hold before writes are refused
 
@@ -302,7 +357,7 @@ SKILLS_FLEET_INJECT_CONCURRENCY=5 # agents re-injected in parallel during a flee
 # Pinned to a tag we bump, never a branch head — the catalog takes public PRs and
 # skills carry executables. Set the URL to "" to disable the seed entirely.
 # TRINITY_DEFAULT_SKILL_SOURCE=github.com/abilityai/trinity-skills
-# TRINITY_DEFAULT_SKILL_SOURCE_REF=v0.2.0
+# TRINITY_DEFAULT_SKILL_SOURCE_REF=v0.5.0
 
 # ===========================================
 # INSTALL PROVENANCE (#2380)
@@ -316,7 +371,8 @@ SKILLS_FLEET_INJECT_CONCURRENCY=5 # agents re-injected in parallel during a flee
 # nothing: provenance is a fact about an installation event, not a setting. The
 # API refuses to write or clear it for the same reason.
 #
-# Valid values: do-marketplace | vultr-marketplace | script | unknown
+# Valid values: do-marketplace | vultr-marketplace | aws-marketplace | do-script |
+#               aws-script | script | unknown
 # Case and surrounding whitespace are normalised, so `DO-Marketplace` is fine.
 # Anything else is ignored with a warning and provenance reads as `unknown`
 # (a typo is never recorded, so a corrected marker still lands on next boot).
@@ -349,15 +405,25 @@ OPERATOR_QUEUE_CREATE_RATE_WINDOW=60          # rate-limit window (seconds)
 OPERATOR_QUEUE_FLEET_CREATE_RATE_LIMIT=300    # fleet-wide create rate / window
 OPERATOR_QUEUE_MAX_SCAN_PER_CYCLE=500         # max requests scanned per agent per 5s cycle
 OPERATOR_QUEUE_MAX_FILE_BYTES=2097152         # skip an operator-queue.json larger than this (bytes)
-OPERATOR_QUEUE_TITLE_MAX=300                  # title char cap (truncate-with-marker)
+OPERATOR_QUEUE_TITLE_MAX=300                  # title char cap (truncate-with-marker belt; agent titles are refused/held at OPERATOR_QUEUE_ASK_TITLE_MAX_CHARS first)
 OPERATOR_QUEUE_QUESTION_MAX=4000              # question char cap (truncate-with-marker)
 OPERATOR_QUEUE_CONTEXT_MAX_BYTES=8192         # context serialized-byte cap (marker over)
 OPERATOR_QUEUE_OPTIONS_MAX_BYTES=4096         # options serialized-byte cap (dropped-marker over)
+OPERATOR_QUEUE_MAX_OPTIONS=5                  # #3243: options per agent ask, (something else) not counted (refused/held over; floor 2)
+OPERATOR_QUEUE_OPTION_MAX_CHARS=60            # #3243: characters per option (refused/held over; floor 16)
+OPERATOR_QUEUE_ASK_TITLE_MAX_CHARS=120        # #3243: title of an agent-raised ask (refused/held over; floor 40)
+OPERATOR_QUEUE_PROPOSAL_MAX_BYTES=8192        # proposal serialized-byte cap (native asks; refused with 422 over)
 OPERATOR_QUEUE_ID_MAX=256                     # max agent-supplied id length
 OPERATOR_QUEUE_EXECUTION_ID_MAX=128           # max execution_id preserved in a context marker
 OPERATOR_QUEUE_EMAIL_MAX=320                  # ent#364: addressee email length clamp (RFC 5321)
 OPERATOR_QUEUE_FLOOD_ALERT_COOLDOWN_SECONDS=300  # one flood alert per agent per this window
 OPERATOR_ALERT_MAX_PENDING_PER_TYPE=5         # per-(agent, type) pending budget for agent-influenceable platform alerts (#1677)
+# #3246: a platform alert is one row per condition — it expires this many days after
+# its LAST reading (bad value → default + WARNING) …
+OPERATOR_PLATFORM_ALERT_LIFETIME_DAYS=14
+# … and after a person ends one, the same reading files nothing for this many days
+# unless its priority rises or a material field changes.
+OPERATOR_PLATFORM_ALERT_SNOOZE_DAYS=7
 
 # ===========================================
 # SERVICE URLS (Usually no need to change)
@@ -540,12 +606,22 @@ SSH_HOST=
 #   3. Set DATABASE_URL (uncomment) and restart the backend.
 # Leave DATABASE_URL unset for the default SQLite behavior.
 #
+# HOSTED installs (docker-compose.hosted.yml, `start.sh --hosted`, every
+# one-click image) default to the bundled PostgreSQL instead (#3159):
+#   - POSTGRES_PASSWORD is REQUIRED there (the file does not render without it);
+#     start.sh --hosted generates it.
+#   - DATABASE_URL unset → the bundled server. `DATABASE_URL=` (empty) → SQLite,
+#     which start.sh --hosted writes for an install that already has trinity.db.
+#   Keep the DATABASE_URL line below commented: start.sh reads an uncommented
+#   one, even empty, as a choice already made.
+#
 # DATABASE_URL=postgresql://trinity:your-postgres-password@postgres:5432/trinity
 # DB_POOL_SIZE=10        # PostgreSQL connection pool size (ignored for SQLite)
 # DB_MAX_OVERFLOW=20     # PostgreSQL pool overflow (ignored for SQLite)
 #
-# Credentials for the optional bundled postgres service (compose --profile postgres).
-# POSTGRES_PASSWORD is required only when that profile is enabled.
+# Credentials for the bundled postgres service. Dev compose: only with
+# --profile postgres. Hosted compose: always, with POSTGRES_DB/POSTGRES_USER
+# fixed at `trinity`.
 # POSTGRES_DB=trinity
 # POSTGRES_USER=trinity
 # POSTGRES_PASSWORD=
@@ -628,6 +704,17 @@ AGENT_IDLE_FINALIZE_S=
 # Default: false
 MCP_AGENT_CHAT_PULL_ENABLED=false
 
+# Delegation report-back kill switch (#3232, default ON). An agent that hands
+# work off with chat_with_agent(..., parallel=true, async=true) from a Slack,
+# Telegram or Workspace turn has the delegated run post its outcome back into
+# that conversation by default (parallel=true sync calls opt in with
+# execution_id; a plain sequential call never reports back). Set to
+# false, 0, no or off (any case) to stop the MCP server sending any
+# parent_execution_id — default and typed alike — without reverting the image.
+# Any other value, empty included, leaves it on. Read by the mcp-server only.
+# Default: true
+MCP_REPORT_BACK_ENABLED=true
+
 # MCP inline email auth (#848, default OFF). When true, an MCP request arriving
 # with NO Authorization header opens a keyless "anonymous" session that may call
 # request_login / verify_login to sign in with a 6-digit email code, and then
@@ -893,3 +980,20 @@ TRINITY_DEFAULT_SYSTEM_MANIFEST=
 # than an error, so mounting the directory is required as well — setting this
 # alone silently lists nothing.
 TRINITY_MANIFESTS_DIR=
+
+# ============================================================
+# NEVERMINED x402 FACILITATOR CONCURRENCY (Optional)
+# ============================================================
+# Every payment verify and settle is an outbound call to the Nevermined
+# facilitator that runs on the default thread executor, so a slow facilitator
+# would otherwise hold backend threads for the whole fleet — and a priced
+# agent's public URL needs no credential to make the backend dial out, so
+# per-IP rate limiting alone cannot bound it (the bound has to hold across IPs).
+# These two knobs are that bound: a fleet-wide ceiling on concurrent facilitator
+# calls, and how long a call waits for a free slot before answering "busy,
+# retry" rather than queueing without limit. Fleet-wide, not per agent — the
+# thread pool is a platform resource. A refused call burns nothing.
+# Defaults below are the code defaults; leave them unless the facilitator is
+# demonstrably keeping up with more.
+NEVERMINED_MAX_INFLIGHT=8
+NEVERMINED_FACILITATOR_WAIT_SECONDS=5.0

.github/dependabot.yml

@@ -60,6 +60,23 @@ updates:
           - patch
           - minor
 
+  # Agent image (#3106): the exact pins in agent-image-requirements.txt only
+  # move by a deliberate bump, so this is their only bump channel — without it
+  # they would go stale past security releases with no signal.
+  - package-ecosystem: pip
+    directory: /docker/base-image
+    target-branch: dev
+    schedule:
+      interval: weekly
+    labels:
+      - dependencies
+      - docker
+    groups:
+      patch-and-minor:
+        update-types:
+          - patch
+          - minor
+
   # MCP server (TypeScript).
   - package-ecosystem: npm
     directory: /src/mcp-server
@@ -115,10 +132,18 @@ updates:
     # needing `pg_config`, which `-slim` does not carry. Ecosystem readiness is
     # the thing to check first, and that is issue work, not PR review.
     # Patch/minor still flow (that is where the CVE fixes are).
+    #
+    # Python's own 3.x step is semver-MINOR to Dependabot, so the rule above
+    # never caught it: #2477 and #3092 were the same 3.13 -> 3.14 migration
+    # arriving as a "minor" base-image bump. Other images' minors still flow;
+    # the Python minor moves only by deliberate issue work.
     ignore:
       - dependency-name: "*"
         update-types:
           - version-update:semver-major
+      - dependency-name: "python"
+        update-types:
+          - version-update:semver-minor
     groups:
       docker-base-images:
         patterns: