nithin031-noema-1-2

-rw-r--r-- 1 root root    592 Nov  6 19:53 CONTRIBUTING.md
-rw-r--r-- 1 root root  16726 Nov  6 19:53 LICENSE.txt
-rw-r--r-- 1 root root   1980 Nov  6 19:53 PRIVACY.md
-rw-r--r-- 1 root root  16597 Nov  6 19:53 README.md
-rw-r--r-- 1 root root   1050 Nov  6 19:53 SECURITY.md
-rw-r--r-- 1 root roo
…[319 chars omitted]…
xr-xr-x 1 root root   4096 Nov  6 19:53 web
./.env.example
./.git/COMMIT_EDITMSG
./.git/config
./.git/description
./.git/HEAD
./.git/index
./.gitattributes
./.gitignore
./.tool-versions
./CHANGELOG.md
./CITATION.cff
./CODE_OF_CONDUCT.md
./CONTRIBUTING.md
./LICENSE.txt
./poetry.lock
./PRIVACY.md
./pyproject.toml
./README.md
./rerun_inference.py
./SECURITY.md
./tests/conftest.py
./THIRD_PARTY_NOTICES.md

src/noema/application/realtime/__init__.py
src/noema/application/realtime/detector.py
src/noema/application/realtime/features.py
src/noema/application/realtime/records.py
src/noema/application/realtime/verifier.py
src/noema/cli/__init__.py
src/noema/cli/benchmark.py
src/noema/cli/daemon.py
src/noema/cli/telemetry.py
src/noema/config/__init__.py
src/noema/config/config.example.json
src/noema/config/settings.py
src/noema/docs/FEATURES.md
src/noema/docs/ROADMAP.md
src/noema/docs/architecture/ove
…[4484 chars omitted]…
/test_chunk_aggregation.py
tests/unit/test_embeddings.py
tests/unit/test_intent.py
tests/unit/test_intervention.py
tests/unit/test_intervention_policy.py
tests/unit/test_meaningful_sessions.py
tests/unit/test_meme.py
tests/unit/test_native_collectors.py
tests/unit/test_outcome.py
tests/unit/test_presence.py
tests/unit/test_privacy_database.py
tests/unit/test_sessionizer.py
tests/unit/test_telemetry.py

src/noema/runtime/daemon.py:962:        local_start = now.astimezone(ZoneInfo(self.config.timezone_name)).replace(
src/noema/runtime/daemon.py:1136:        observations = self.service.evaluate_stored_behavior(

from io import BytesIO
from typing import Any, Callable, Dict, List, Optional
from urllib.parse import parse_qs
from zoneinfo import ZoneInfo
from wsgiref.simple_server import WSGIServer, WSGIRequestHandler, make_server
from socketserver import ThreadingMixIn

from noema.application.pipeline import NoemaService
from noema.domain.normalization import application_identity
from noema.domain.activity import coerce_timestamp
from noema.infrastructure.sync import SyncEnvelope
from noema.infrastructure.browser.websocket import serve_websocket


def _json_bytes(payload: Any) -> bytes:
    return json.dumps(payload
…[6835 chars omitted]…
0.0, float(e.get("duration", 0) or 0)) for e in apps_raw if isinstance(e, dict)
            )
            top_apps = []
            for e in apps_raw[:15]:
                if not isinstance(e, dict):
                    continue
                data = e.get("data", {}) or {}
                raw_name = str(data.get("app") or "Other")
                application_id, name = application_identity(raw_name)

446: 
…[8630 chars omitted]…
       "quota": bundle["quota"],
                    "cost": bundle["cost"],
                    "realtime": {
                        "evaluations": bundle["realtime"]["evaluations"],
                        "candidates": bundle["realtime"]["candidates"],
                        "verifications": bundle["realtime"]["verifications"],
                        "confirmed": bundle["realtime"]["confirmed"],

            daily["top_applications"] = applications[:10]
        return daily

    def _classification_status(self) -> Dict[str, Any]:
        """Single scheduler-truth payload for the Command Center.

        Combines daemon worker state (last/next run, in-progress count),
        stored coverage counts (classified/pending/failed over meaningful
        sessions), the provider/model that actually se
…[8628 chars omitted]…
host, port, create_app(service, daemon=daemon), server_class=ThreadingWSGIServer,
        handler_class=WSGIRequestHandler,
    ) as server:
        if daemon is not None and hasattr(daemon, "add_shutdown_callback"):
            daemon.add_shutdown_callback(server.shutdown)
        try:
            server.serve_forever()
        finally:
            if daemon is not None:
                daemon.stop()

            "quota": quota,
        }

    @staticmethod
    def _dashboard_window(query: Dict[str, List[str]]) -> tuple[datetime, datetime, str, str]:
        timezone_name = query.get("timezone", ["Asia/Kolkata"])[0] or "As
…[6365 chars omitted]…
 status, _ = call_app(app, "/api/metrics/summary")
tests/regression/test_daemon.py:70:def call_app(app, method, path, body=b""):
tests/regression/test_daemon.py:111:    status, payload = call_app(app, "GET", "/api/daemon/health")
tests/unit/test_presence.py:28:def call_app(app, method, path, body=b""):
tests/unit/test_presence.py:496:    status, presence = call_app(app, "GET", "/api/presence/current")

    ActivityWatchAdapter,
    ActivityWatchClient,
)
from noema.infrastructure.database import SQLiteStore


def call_app(app, method, path, body=b""):
    result = {}

    def start_response(status, headers):
        re
…[3199 chars omitted]…
del = "test-model"

    def __init__(self, payload=None, error=None):
        self.payload = payload
        self.error = error
        self.calls = 0
        self.prompts = []

    def generate_json(self, prompt):
        self.calls += 1
        self.prompts.append(prompt)
        if self.error:
            raise self.error
        return dict(self.payload)


def valid_payload(category="productive"):

        self._emit_invocation(
            request_id=tele.get("request_id"), timestamp_iso=utcnow_iso(),
            timestamp_ms=int(started * 1000),
            provider_name=getattr(target, "name", "escalation"),
            model=getattr(target, "model", None),
            purpose=tele.get("purpose"), pipeline=tele.g
…[8629 chars omitted]…
elf._last_failure_kind = "parse"
                else:
                    self._classification_cache[cache_key] = result
            else:
                result = self.classify(session, context, tele)
            results[session.id] = result
            attempted_calls += int(self._last_call_attempted)
            if result.classification_status == "classified":
                successful_calls += 1

        def classify(self, session, prompt):
            raise ProviderError("offline")

    result = Classifier(provider=OfflineProvider()).classify(
        make_session("Chrome", "Unclear page", "example.com")
    )

    assert result.category == "neutral"
    assert result.confidence == 0.0
    assert result.source == "pending"
    assert result.classification_status == "pending"
    assert result.signal == "Ollama classification unavailable"


def test_cache_key_contains_page_evidence_
…[7790 chars omitted]…
 or _INVALID_SIGNAL,
                prompt_version=PROMPT_VERSION,
            )

    def _pending_result(self, session: Any, error: Optional[str] = None) -> Classification:
        return Classification(
            session_id=session.id,
            category="neutral",
            subcategory="pending",
            activity="Pending semantic analysis",
            signal=_OLLAMA_UNAVAILABLE_SIGNAL,

                "subcategory": "ambiguous",
                "activity": "Browsing an unclear page",
                "signal": "The page purpose is not established by the available evidence.",
                "confidence": 0.4,
            }

    provider = CountingProvider()
    classifier = Classifier(provider=provider)
    first = make_session("Chrome", "Unclear page", "example.com")
    second = make_session("Chrome", "Different page", "other.example")

    classifier.classify(first)
    classifier.classify(first)
    classifier.classify(second)

    assert 
…[7300 chars omitted]…

        )
        return hashlib.sha256(identity.encode("utf-8")).hexdigest()

    def to_dict(self) -> Dict[str, Any]:
        return {
            "id": self.id,
            "start_time": self.start_time.isoformat().replace("+00:00", "Z"),
            "end_time": self.end_time.isoformat().replace("+00:00", "Z"),
            "duration": self.duration,
            "device_set": list(self.device_set),

    def consume(self, kind: str, model: Any, tokens: int, requests: int = 1) -> Dict[str, int]:
        """Record usage and persist. Always records; callers check first."""
        with self._lock:
            self._rollover_locked()
            key = self._key(kind, model)
            entry = self._counts.get(k
…[5975 chars omitted]…
t_count": self._timeout_count,
                "last_latency_ms": self._last_latency_ms,
                "last_error": self._last_error,
            }

    def count_tokens(self, prompt: str) -> int:
        counter = getattr(self.client, "count_tokens", None)
        if not callable(counter):
            raise AttributeError("configured Ollama client has no tokenizer")
        return counter(prompt)

src/noema/observability/metrics.py:361:            "requests_today": used_day,

    openrouter_title: str = "Noema"
    # Local final fallback. False removes Ollama from the chain entirely.
    ollama_enabled: bool = True
    db_path: str = _default_db_path()
    lock_path: Optional[str] = None
    config_path: Optional[str] = None
    host: str = "127.0.0.1"
…[8630 chars omitted]…
 tzinfo=timezone.utc)
tests/unit/test_outcome.py:1:from datetime import datetime, timezone
tests/unit/test_outcome.py:14:        created_at=datetime(2026, 9, 4, 10, tzinfo=timezone.utc),
tests/unit/test_presence.py:9:from datetime import datetime, timedelta, timezone
tests/unit/test_presence.py:46:    moment = datetime.now(timezone.utc).replace(second=0, microsecond=0) - timedelta(minutes=minutes_ago)

        if self.classification_max_per_r
…[8629 chars omitted]…
eError:
        pass
    else:
        raise AssertionError("expected ValueError for bad timezone")


def test_daily_report_dedup_survives_restart():
    from noema.api import NoemaService
    from noema.infrastructure.activity_sources.activitywatch import ActivityWatchAdapter
    from noema.runtime import NoemaDaemon
    from noema.infrastructure.database import SQLiteStore

    store = SQLiteStore()

tests/realtime/test_realtime_config.py:125:    assert DaemonConfig().to_dict()["timezone_name"] == "Asia/Kolkata"
tests/regression/test_classifier_runtime.py:119:    ist = ZoneInfo("Asia/Kolkata")

        self.calls = 0

    def classify(self, session, prompt):
        self.calls += 1
        if self.error:
            raise self.error
        return self.payload

    def count_tokens(self, prompt):
        return self.tokens


def payload(category="neutral"):
    return {
        "category": category,
        "productivity": "neutral",
        "activity": "Observed activity",
        "signal": "Observed evidence supports this result.",
    }


def test_per_model_limits_come_from_the_quota_table():
    chain = Provide
…[8629 chars omitted]…
lf.store.query(start=effective_start, end=end, limit=100000)
        # AFK-watcher rows are presence telemetry, never activity: split them
        # out for the presence timeline (PART 9 timeline intersection).
        afk_events = [item.event for item in events if is_presence_event(item.event)]
        detector = self.presence_detector or PresenceDetector()
        presence = detector.build_timeline(

        )

    def query_alignments(self, *args: Any, **kwargs: Any) -> list:
        return self.store.query_alignments(*args, **kwargs)

    def evaluate_behavior(
  
…[8629 chars omitted]…
ntent, raw_classification_map.get(session.id))
src/noema/application/pipeline.py:2745:        classification_map = {item.session_id: item for item in classifications}
src/noema/application/pipeline.py:2750:                    session, intent, classification_map.get(session.id)
src/noema/application/pipeline.py:2754:        observations = self.evaluate_behavior(sessions, classification_map, alignments)

            service=row["service"],
            intent_signal=row["intent_signal"],
            retry_count=int(row["retry_count"] or 0),
            last_error=row["last_error"],
            next_retry_at=row["next_retry_at"],
            classifier_version=row["classifier_version"] or "1",
            prompt_version=(row["prompt_version"] if "prompt_version" in row.keys() and row["prompt_ver
…[8629 chars omitted]…
on_score=0.0, actionable=False, reason="no sessions",
        )
        recommendation = self.autonomous_agent.recommend(
            latest, intent, self.personalization_profile(), self.store.query_memories(limit=100000),
            self.store.query_outcomes(limit=100000),
        )
        return AutonomousCycle(ingested, tuple(sessions), tuple(classifications), tuple(observations), recommendation)

            ordered = sorted(
                (item for item in recent_outcomes
                 if getattr(item, "intervention_time", None) is not None),
                key=lambda item: item.intervention_time,
                reverse=True,
            )
        except TypeError:
            return 0
        cutoff = now - timedelta(seconds=float(self.policy.ineffective_lookback_seconds))
        streak = 0
        for outcome in ordered:
           
…[5785 chars omitted]…
n = planned.action.to_dict()
    assert action["intervention_id"] == planned.id
    assert action["type"] == "MEME"
    assert action["target"] == {
        "device": "laptop", "browser": "firefox", "window_id": "17", "tab_id": "42"
    }
    assert action["meme"]["top"] == "Implement PPO reward shaping"
    assert "LOCK_IN" in action["actions"]
    assert planned.to_dict()["target"]["tab_id"] == "42"

176:            target=payload.get("target", {}),
180:            actions=tuple(payload.get("actions", ())),
181:            expires_in=payload.get("expires_in", 5000),
187:        payload = dict(self.payload)
188:        merged = dict(paylo
…[8629 chars omitted]…
   session_id=observation.session_id,
            mode=mode,
            status=InterventionStatus.PLANNED,
            reason=(
                "actionable distraction detected (de-escalated from MEME "
                "after repeated ineffective memes)"
                if degraded else "actionable distraction detected"
            ),
            payload=payload,
            created_at=now,
        )

            status_holder["status"] = status
            return start_response(status, headers, exc_info) if exc_info is not None else start_response(status, headers)

        try:
            return self._dispatch(environ, tracking_start_response)
        except Exception as exc:
            error = "{}: {}".format(type(exc).__name__, str(
…[844 chars omitted]…
.upper()
        path = environ.get("PATH_INFO", "/")
        query = parse_qs(environ.get("QUERY_STRING", ""), keep_blank_values=False)
"""Service and local HTTP API for the Noema foundation."""

from noema.api.server import NoemaApp, create_app, serve
from noema.application.pipeline import NoemaService, IngestionResult

__all__ = ["NoemaApp", "NoemaService", "IngestionResult", "create_app", "serve"]

        return [item.to_dict() for item in self.store.query_detections(
            session_id=session_id, limit=limit)]

    def realtime_status(self) -> dict:
        """Detector state + last detection + fast-path wiring (display only)."""
        try:
            saved = self.store.get_state("realtime.tracker")
        except (AttributeError, OSError, TypeError, ValueError):

                day = ledger.day
                day_timezone = getattr(ledger, "day_timezone", day_timezone)
            except (AttributeError, OSError, ValueError):
                pass
        if not isinstance(states, dict) or not states:
            return {
                "day": day,
                "provider": getattr(provider, "name", None),
 
…[6200 chars omitted]…
 the quotas payload vocabulary."""
    name = str(provider_name or "").strip().lower()
    if name == "openrouter":
        return "shared-openrouter-guards"
    if name == "ollama":
        return "local"
    if name == "gemini":
        return "model-specific"
    return None


def assemble_invocation(
    *,
    request_id: str,
    timestamp_iso: str,
    timestamp_ms: int,
    provider_name: Any,

…[4621 chars omitted]…
S_OPENROUTER_TIMEOUT_SECONDS": "openrouter_timeout_seconds",
            "query_limit": self.query_limit,
            "execute_interventions": self.execute_interventions,
            "retry_base_seconds": self.retry_base_seconds,
            "retry_max_seconds": self.retry_max_seconds,
            "metrics_retention_days": self.metrics_retention_days,
            "log_level": self.log_level,
        }

        ActivityEvent(
            timestamp="2026-09-05T18:30:30Z", duration=60,
            device="laptop", app="Firefox", domain="instagram.com", title="Instagram",
            bucket_id="window", source_event_id="today-2",
        ),
    ]
    service.ingest_events(events)
    sessions = service.sessionize_stored_events()
    
…[1653 chars omitted]…
          "failedCount", "classifiedCount", "totalEligibleCount", "coveragePercent",
                    "latestClassificationAt", "provider", "model", "quota"):
            assert key in payload, key
        assert payload["enabled"] is True
        assert payload["intervalMinutes"] == 20
        assert payload["status"] in {"idle", "running", "disabled", "error"}
    finally:
        store.close()

[tool.poetry.dependencies]
python = "^3.9"
google-genai = "*"

[tool.poetry.group.dev.dependencies]
mypy = "*"
pytest = "*"
pytest-cov = "*"
pytest-benchmark = "*"
psutil = "*"
pywin32-ctypes = {version = "*", platform = "win32"}
pefile = {version = "*", platform = "win32"}

pyinstaller = {version = "*", python = "^3.9,<3.14"}
# releases are very infrequent, so good idea to use the master branch
# we need this unreleased commit: https://github.com/pyinstaller/pyinstaller-hooks-contrib/commit/0f40dc6e74086e5472aee75070b9077b4c17ab18
pyinstaller-hooks-contrib = {git = "https://github.com/pyinstaller/pyinstaller-hooks-contrib.git", branch="master"}

# PyInstaller still imports pkg_resources, which setuptools removed in 81+.
setuptools = ">=78.1.1,<81"

[build-system]
requires = ["poetry-core"]
build-backend = "poetry.core.masonry.api"

src/noema/runtime/daemon.py:834:        ).astimezone(timezone.utc)
src/noema/runtime/daemon.py:867:                now.astimezone(ZoneInfo(self.config.timezone_name)).date().isoformat(),
src/noema/runtime/daemon.py:962:        local_start = now.astimezone(ZoneInfo(self.config.timezone_name)).replace(
src/noema/runtime/daemon.py:964:        ).astimezone(timezone.utc)

    assert len(sessions) == 2
    service.classifier = Classifier(client=CountingClient(payload=valid_payload()))
    service.classify_sessions([sessions[0]])
    summary = service.daily_summary(
        datetime(2026, 9, 6, tzinfo=timezone.utc), datetime(2026, 9, 7, tzinfo=timezone.utc))

    assert summary["total_time"] == 120.0
    assert summary["productive_time"] == 60.0
    assert s
…[1279 chars omitted]…
ning:free"]
    assert fast["quota_scope"] == "shared-openrouter-guards"
    assert fast["role"] == "fast" and fast["fast_path"] is True
    assert fast["context_window"] == 256000 and fast["max_output"] == 65536
    assert fast["priority"] == 1 and fast["enabled"] is True
    gemini = rows["gemini-3.7-flash"]
    assert gemini["quota_scope"] == "model-specific"
    assert gemini["role"] == "fallback"

    ``path=None`` the ledger is memory-only (tests, throwaway processes).
    All methods are thread-safe.
    """

    def __init__(self, path: Optional[Any] = None, day_timezone: str = "Asia/Kolkata"):
        self.path = str(Path(path).expanduser()) if path is not None else None
        try:
            self.
…[2895 chars omitted]…
` for one entry."""
        with self._lock:
            self._rollover_locked()
            entry = self._counts.get(self._key(kind, model), {})
            return {"requests": int(entry.get("requests", 0)), "tokens": int(entry.get("tokens", 0))}

    def check(self, kind: str, model: Any, tokens: int, rpd_limit: int) -> bool:
        """True if one more call of ``tokens`` tokens stays within RPD."""

import threading
import time
import os
from collections.abc import Callable, Mapping
from dataclasses import dataclass, field
from datetime import datetime, timezone
from pathlib import Path

try:
    from zoneinfo import ZoneInfo
except ImportError:  # pragma: no cover - very old interpreters
    ZoneInfo = None  # type: ignore[assignment]
from typing import Any, Dict, List, Optional, Protocol
from urllib.error import HTTPError, URLError
from urllib.parse import quote
from urllib.request import Request, urlopen

from noema.infrastructure.ollama import OllamaC
…[769 chars omitted]…
    return "429" in text or "resource_exhausted" in text.casefold()


def _http_status(error: BaseException) -> Optional[int]:
    """Extract an HTTP status code from a provider error message, if present."""
    match = re.search(r"HTTP (\d{3})", str(error))
    if match:
        try:
            return int(match.group(1))
        except (TypeError, ValueError):
            return None
    return None

    openrouter = _openrouter_providers(config)
    # Persisted quota ledger lives next to the database so daily
    # request/token counts survive daemon restarts.
    usage_path = str(Path(config.db_path).expanduser().with_suffix(".usage.json"))
    if config.provider == "gemini":
        # Hosted-only mode: the local model is never consulted, so every
        # served classification in the UI carries hosted provenance and
        # failures stay pending instead of falling back.
        provider = ProviderChain(hosted=h
…[5515 chars omitted]…
rror("daily summary requires an aware, positive time window")
        # Dashboard calendar metrics describe the selected ActivityWatch day.
        # A manual pipeline reset must not hide earlier telemetry from the
        # real-time Today view; reset state only controls processing cursors.
        effective_start = start
        events = self.store.query(start=effective_start, end=end, limit=100000)

@@ -12,7 +12,7 @@ from pathlib import Path
 from http import HTTPStatus
 from io import BytesIO
 from typing import Any, Callable, Dict, List, Optional
-from urllib.parse import parse_qs
+from urllib.parse import parse_qs, urlsplit
 from zoneinfo import ZoneInfo
 from wsgiref.simple_server import WSGIServer, WSGIRequestHandler, make_serve
…[8629 chars omitted]…
ests_this_minute = self.tokens_this_minute = 0
             self.attempts_this_minute = 0
@@ -405,6 +416,7 @@ class QuotaState:
         if current - self.day_window_start >= 86400:
             self.requests_today = 0
             self.attempts_today = 0
+            self.day_window_date = today
             self.day_window_start = current
         return (
             current >= self.cooldown_until

ons, classifications, alignments, persist=persist)

    def query_behavior(self, *args: Any, **kwargs: Any) -> list:
        return self.store.query_behavior_observations(*args, **kwargs)

    def consider_intervention(
        self,
        session_id: str,
        intent_id: Optional[str] = None,
        execute: bool = False,
        handler: Optional[Any] = None,
        now: Optional[Any] = None,

        def tracking_start_response(status: str, headers: Any, exc_info: Any = None) -> None:
            status_holder["status"] = status
            cors_origin = _cors_origin(environ)
            adjusted = [
                (name, value) for name, value in list(headers or [])
                if str(name).casefold() != "access-control-allow-origin"
            ]
            adjusted.append(("Access-Control-A
…[4227 chars omitted]…

            self.day_window_start = current
        return (
            current >= self.cooldown_until
            and self.attempts_this_minute < self.rpm_limit
            and self.tokens_this_minute + tokens <= self.tpm_limit
            and self.requests_today < self.rpd_limit
        )

    def record_attempt(self) -> None:
        self.attempts_this_minute += 1
        self.attempts_today += 1

        return ActivitySession(
            start=row["start"],
            end=row["end"],
            device=row["device"],
            app=row["app"],
            title=row["title"],
            domain=row["domain"],
            url=row["url"],
            browser=row["browser"],
            bro
…[8158 chars omitted]…
_tab_id=row["browser_tab_id"],
            source=row["source"],
            bucket_id=row["bucket_id"],
            source_event_id=row["source_event_id"],
            metadata=metadata,
        )
        return StoredActivityEvent(id=int(row["id"]), event=event)

    def query(
        self,
        start: Optional[Any] = None,
        end: Optional[Any] = None,
        device: Optional[str] = None,

        today_stamp = (ist_midnight + timedelta(hours=12)).isoformat().replace("+00:00", "Z")
        old_stamp = (ist_midnight - timedelta(hours=13)).isoformat().replace("+00:00", "Z")
     
…[3131 chars omitted]…
   ^
E         + 2026-09-05
E         ?          ^

tests/integration/test_service_api.py:220: AssertionError
=========================== short test summary info ============================
FAILED tests/regression/test_classifier_runtime.py::test_today_and_recent_activity_are_session_scoped
FAILED tests/integration/test_service_api.py::test_daily_summary_filters_calendar_day_and_deduplicates_overlaps

session = ActivitySession(start=datetime.datetime(2026, 9, 4, 10, 0, tzinfo=datetime.timezone.utc), end=datetime.datetime(2026, ...t_count': 1, 'sources': ['activitywatch']}, session_id=None, browser=None, browser_window_id=None, browser_tab_id=None)
prompt = 'prompt'

    def classify(
…[2650 chars omitted]…
test summary info ============================
FAILED tests/providers/test_openrouter.py::test_gemini_thinking_level_flows_to_sdk_and_retries_ambiguous
FAILED tests/providers/test_openrouter.py::test_gemini_keeps_first_verdict_when_medium_retry_fails
FAILED tests/realtime/test_realtime_config.py::test_timezone_name_defaults_validates_and_round_trips
3 failed, 334 passed, 2 skipped, 1 warning in 53.43s

elemetry.py:102:def test_quota_scope_vocabulary():
tests/unit/test_telemetry.py:103:    assert quota_scope_for("openrouter") == "shared-openrouter-guards"
tests/unit/test_telemetry.py:104:    assert quota_scope_for("ollama") == "local"
tests/unit/test_telemetry.py:105:    assert quota_scope_for("gemini") == "model-specific"
tests/unit/test_telemetry.py:106:    assert quota_scope_for("mystery") is None

 from socketserver import ThreadingMixIn
@@ -28,6 +28,37 @@ def _json_bytes(payload: Any) -> bytes:
     return json.dumps(payload, ensure_ascii=False).encode("utf-8")
 
 
+_LOOPBACK_CORS_ORIGIN = "http://127.0.0.1"
+
+
+def _cors_origin(environ: Dict[str, Any]) -> str:
+    """Echo local/extension origins; use a loopback default otherwise.
+
+    The daemon is a local service, so only loopback and 
…[8629 chars omitted]…
ests_this_minute = self.tokens_this_minute = 0
             self.attempts_this_minute = 0
@@ -405,6 +416,7 @@ class QuotaState:
         if current - self.day_window_start >= 86400:
             self.requests_today = 0
             self.attempts_today = 0
+            self.day_window_date = today
             self.day_window_start = current
         return (
             current >= self.cooldown_until

             "app": getattr(session, "app", None),
             "title": getattr(session, "title", None),
             "domain": getattr(session, "domain", None),
diff --git a/src/noema/application/pipeline.py b/src/noema/application
…[1209 chars omitted]…
ery_classification_map(session_ids)
         alignments = {
             item.session_id: item
             for item in self.store.query_alignments(intent_id=intent_id, limit=limit)
 M src/noema/api/server.py
 M src/noema/application/classification.py
 M src/noema/application/pipeline.py
 M src/noema/config/settings.py
 M src/noema/domain/intervention/engine.py
 M src/noema/infrastructure/providers.py

                    break
        application_id, appli
…[2485 chars omitted]…
     try:
                day = ledger.day
                day_timezone = getattr(ledger, "day_timezone", day_timezone)
            except (AttributeError, OSError, ValueError):
                pass
        if not isinstance(states, dict) or not states:
            return {
                "day": day,
                "provider": getattr(provider, "name", None),
                "ollama_fallback": None,

ESCALATION_MIN_DURATION_SECONDS = 120.0
# Google RPD accounting resets on Pacific time; the local ledger keeps the
# product calendar day instead. Both are reported explicitly so the two are
# never silently mixed.
PROV
…[1679 chars omitted]…
,
            "rpd_policy": "local-success-count; provider state unavailable",
            "models": models,
            "embeddings": embeddings,
        }

    def classifier_debug(self, now: Optional[Any] = None) -> dict:
        """Expose classifier provenance and bounded-job diagnostics."""

        payload = self.classifier.debug_telemetry() if hasattr(self.classifier, "debug_telemetry") else {}

*.swp

# Python
*venv*
__pycache__
.python-version

# Misc
.*cache
.DS_Store
.env

# Noema local runtime artifacts
logs/
*.sqlite3

# Dependencies (reinstallable; never commit)
node_modules/

# Noema docs ship with the repo (negate the broad legacy `docs` entry above)
!src/noema/docs/
 M src/noema/api/server.py
 M src/noema/application/classification.py
 M src/noema/application/pipeline.py
 M src/noema/config/settings.py
 M src/noema/domain/intervention/engine.py
 M src/noema/infrastructure/providers.py

  stack traces or secret leakage (`tests/api/test_error_mapping.py`).
- `PRIVACY.md`, `CHANGELOG.md`, Noema `SECURITY.md`, and public CI
  (`.github/workflows/test.yml`) using mocks only (no keys, no
  ActivityWatch, no Ollama).

### Fixed

- Stale `FocusForge` / `ai_activity_os` / `AI Activity OS` branding in
  user-visible strings, notifications, scheduler metadata, default DB
  path (`%LOCALAPPDATA%\Noema`), docs, and package authors.
  `AI_ACTIVITY_OS_*` environment names remain accepted as deprecated
  aliases (canonical `NOEMA_*` w
…[261 chars omitted]…
er / Gemini / Ollama (generate + embeddings) verified;
  chain fallback (OpenRouter → Gemini → Ollama → honest pending)
  verified under transient 503s.
- 50k-event realistic benchmark: bulk ingest ~2.3–3.7s, sessionize
  ~2.0s, meaningful ~0.15s — no regression vs reference.
- 38-route API sweep: empty-state 200s, daemon-gated 503s, param-gated
  400s, unknown 404s, no stacks or secrets in responses.

cooldowns, and a daily ledger (`noema.usage.json`) that survives restarts.
Default deployment is Gemini-only (six ranked Flash models); the OpenRouter
free tier and local Ollama paths exist in code and are config-gated.

**Guarantees.** Unknown quota/token values are reported as unknown, never
zero. Secrets live only in environment variables and never
…[622 chars omitted]…
nterventionPolicy` enforce per-mode
cooldowns, repeated-ineffective de-escalation (meme → notification), AFK
veto, and recovery detection. `consider_intervention` only fires on an
actionable observation with no already-handled intervention for the session.
`OutcomeTracker` measures recovery afterwards. Modes: notification, meme
(SVG renderer + meme intelligence), browser holdout, exact-tab actions via

-rw-r--r-- 1 root root   3212 Nov  4 04:33 CODE_OF_CONDUCT.md
-rw-r--r-- 1 root root    592 Nov  4 04:33 CONTRIBUTING.md
-rw-r--r-- 1 root root  16726 Nov  4 04:33 LICENSE.txt
-rw-r--r-- 1 root root   1980 Nov  4 04:33 PRIVACY.md
-rw-r--r-- 1 root root  16597 Nov  4 04:33 README.md
-rw-r--r-- 1 root root   1050 Nov  4 04:33 SECURITY.md
-rw-r--r-- 1 ro
…[325 chars omitted]…
xr-xr-x 1 root root   4096 Nov  4 04:33 web
./.env.example
./.git/COMMIT_EDITMSG
./.git/HEAD
./.git/config
./.git/description
./.git/index
./.gitattributes
./.gitignore
./.tool-versions
./CHANGELOG.md
./CITATION.cff
./CODE_OF_CONDUCT.md
./CONTRIBUTING.md
./LICENSE.txt
./PRIVACY.md
./README.md
./SECURITY.md
./THIRD_PARTY_NOTICES.md
./poetry.lock
./pyproject.toml
./rerun_inference.py
./tests/conftest.py

src/noema/application/realtime/__init__.py
src/noema/application/realtime/detector.py
src/noema/application/realtime/features.py
src/noema/application/realtime/records.py
src/noema/application/realtime/verifier.py
src/noema/cli/__init__.py
src/noema/cli/benchmark.py
src/noema/cli/daemon.py
src/noema/cli/telemetry.py
src/noema/config/__init__.py
src/noema/config/config.example.json
src/noema/config/settings.py
src/noema/docs/FEATURES.md
src/noema/docs/ROADMAP.md
src/noema/docs/architecture/ove
…[4484 chars omitted]…
/test_chunk_aggregation.py
tests/unit/test_embeddings.py
tests/unit/test_intent.py
tests/unit/test_intervention.py
tests/unit/test_intervention_policy.py
tests/unit/test_meaningful_sessions.py
tests/unit/test_meme.py
tests/unit/test_native_collectors.py
tests/unit/test_outcome.py
tests/unit/test_presence.py
tests/unit/test_privacy_database.py
tests/unit/test_sessionizer.py
tests/unit/test_telemetry.py

from typing import Any, Dict, Iterable, List, Mapping, Optional

from noema.domain.activity import coerce_timestamp
from noema.domain.policy import assess_policy
from noema.infrastructure.ollama import OllamaClient, OllamaError
from noema.domain.session_context import is_meaningful_session
from noema.domain.sessions import ActivitySession

from noema.infrastructure.providers import (
    ProviderChain, ModelProvider, OllamaProvider, ProviderError,
    WORKHORSE_MODEL, ESCALATION_MODEL, ESCALATION_MAX_PER_DAY,
    ESCALATION_MAX_CONFIDENCE, ESCALATION_MIN_DURATION_SECONDS,
    OUTPUT_TOKEN_RESERVE,
)
from noema.observability.models i
…[8630 chars omitted]…
 3
                ),
                "meaningful_union_minus_dashboard": round(
                    self._union_seconds(meaningful_observed_intervals, start, end) - dashboard_seconds, 3
                ),
                "aw_union_minus_dashboard": round(
                    self._union_seconds(raw_intervals, start, end) - dashboard_seconds, 3
                ),
            },
            "cursor": {

                continue
            try:
                status = RecoveryStatus(getattr(outcome, "recovery_status"))
            except (AttributeError, TypeError, ValueError):
                break
            if status == RecoveryStatus.NOT_RECOVERED:
                streak += 1
            else:
                break
        return streak

    
…[1225 chars omitted]…
d,
            executed_at=executed_at.astimezone(timezone.utc),
        )
src/noema/application/pipeline.py:2359:            intervention = self.intervention_engine.execute(intervention, handler=handler)
tests/unit/test_intervention.py:66:        executed = engine.execute(planned, now=now)
tests/unit/test_intervention.py:79:    executed = engine.execute(planned, handler=handler_calls.append, now=now)

    # Sessionizer merge thresholds, measured against live telemetry
    # (median event ~1s, ~70% under 5s, ~85% under 15s). Short events merge
    # into surrounding active runs; they are nev
…[8629 chars omitted]…
n = planned.action.to_dict()
    assert action["intervention_id"] == planned.id
    assert action["type"] == "MEME"
    assert action["target"] == {
        "device": "laptop", "browser": "firefox", "window_id": "17", "tab_id": "42"
    }
    assert action["meme"]["top"] == "Implement PPO reward shaping"
    assert "LOCK_IN" in action["actions"]
    assert planned.to_dict()["target"]["tab_id"] == "42"

        except ValueError as exc:
            raise ValueError("{} must be an integer".format(name)) from exc
        if value < 1:
            raise ValueError("{} must be positive".format(name))
        return value

    def __call__(self, environ: Dict[str, Any], start_response: Callable):
        """Time every request into telemetry, then dispatch unchanged."""
        method = environ.get("REQUEST_MET
…[8629 chars omitted]…
e them into one verdict. "
    "Reason per session in this order: (1) application/container, (2) actual session title, "
    "(3) special application policy, (4) duration and continuity, (5) neighboring activity, "
    "(6) semantic activity, (7) evidence quality, (8) productive/distractive/neutral, "
src/noema/infrastructure/providers.py:1181:            self.rate_limits[provider.model] = QuotaState(

tests/regression/test_daemon.py:21:from noema.api import NoemaService, create_app
tests/regression/test_daemon.py:110:    app = create_app(service, daemon=daemon)
tests/unit/test_presence.py:12:from noema.api import NoemaService, create_app
tests/unit/test_presence.py:494:    app = create_app(service)

for candidate in candidates:
    text = str(candidate)
    if text not in sys.path:
        sys.path.insert(0, text)


@pytest.fixture(autouse=True)
def _hermetic_native_telemetry(request, monkeypatch):
    """Keep pre-existing tests hermetic from live OS collectors.

    The daemon enables native collectors by default in production, but
    tests that script their own ActivityWatch fixtures must not observe
    the real desktop. Tests under ``test_native_*`` files exercise the
    live factory and are exempt; they inject script
…[5654 chars omitted]…
   app="Firefox", title="Docs", domain="docs.python.org",
            bucket_id="window", source_event_id="in-24h",
        ),
    ])
    app = create_app(service)

    status, payload = call_app(app, "/api/dashboard/recent-activity?range=24h&limit=50")

    assert status.startswith("200")
    assert payload["range"] == "24h"
    assert isinstance(payload["activities"], list)
    service.store.close()

…[6124 chars omitted]…
alid IANA timezone") from exc
367:    def from_mapping(cls, values: Mapping[str, Any], base: Optional["DaemonConfig"] = None) -> "DaemonConfig":
384:    def from_file(cls, path: Any, base: Optional["DaemonConfig"] = None) -> "DaemonConfig":
436:            "AI_ACTIVITY_OS_TIMEZONE": "timezone_name",
494:            "NOEMA_TIMEZONE": "timezone_name",
552:            "timezone_name": self.timezone_name,

                end = coerce_timestamp(query.get("end", [datetime.now(zone).isoformat()])[0])
                return self._response(
                    start_response,
                    HTTPStatus.OK,
                    self.service.reconciliation_report(requested_application, start, end),
                )

le[Mapping[str, Any]]] = None) -> str:
src/noema/application/classification.py:969:        cache_key = self._cache_key(session, recent_context)
src/noema/application/classification.py:1076:                    if self._cache_key(session, session_contexts[session.id]) not in self._classification_cache]
src/noema/application/classification.py:1097:            cache_key = self._cache_key(session, context)

        object.__setattr__(self, "confidence", min(1.0, max(0.0, float(self.confidence))))
        object.__setattr__(self, "evidence", tuple(dict.fromkeys(str(item) for item in self.evidence)))
        object.__setattr__(self, "evidence_quality",
…[2439 chars omitted]…
   "phases": [phase.to_dict() for phase in self.phases],
            "browser": self.browser,
            "browser_window_id": self.browser_window_id,
            "browser_tab_id": self.browser_tab_id,
        }
src/noema/domain/sessions/models.py:15:class ActivitySession:
src/noema/domain/sessions/models.py:95:    def id(self) -> str:
src/noema/domain/meaningful/models.py:166:    def id(self) -> str:

            "timestamp": event.timestamp.isoformat().replace("+00:00", "Z"),
            "end": event.end_timestamp.isoformat().replace("+00:00", "Z"),
            "device": event.device,
            "browser": event.browser,
            "window_id": event.browser_window_
…[7672 chars omitted]…
er": getattr(provider, "name", None),
            "ollama_fallback": bool(getattr(provider, "include_ollama", False)),
            "openrouter_configured": bool(
                openrouter_key_env and _os.environ.get(openrouter_key_env, "").strip()
            ),
            # Canonical registry: roles/purposes/windows live in
            # OPENROUTER_MODEL_REGISTRY; the free tier shares account-level

def quota_scope_for(provider_name: Any) -> Optional[str]:
    """Quota scope label matching the quotas payload vocabulary."""
    name = str(provider_name or "").strip().lower()
    if name == "openrouter":
        return "shared-openrouter-guards"
    if name == "ollama":
        return "local"
    if name == "gemini":
        return "model-specific"
    return None


def assemble_invocation(
    *,
 
…[4137 chars omitted]…
tion_cache[cache_key]
1004:            self._classification_cache[cache_key] = result
1076:                    if self._cache_key(session, session_contexts[session.id]) not in self._classification_cache]
1098:            if cache_key in self._classification_cache:
1099:                result = self._classification_cache[cache_key]
1114:                    self._classification_cache[cache_key] = result

    @staticmethod
    def _fit_prompt(context: Dict[str, Any]) -> Dict[str, Any]:
        return dict(context)

    @staticmethod
    def build_evidence(session: Any, recent_context: Optional[Iterable[Mapping[str, Any]]] = None) -> Dict[str, Any]:
        """Build the evidence payload without the system prompt.

        Batch classification sends one shared instruction header plus one
        evidence o
…[8630 chars omitted]…
 context)] = escalated
        return escalated

    def _emit_invocation(self, **fields: Any) -> bool:
        observer = self.observer
        if observer is None:
            return False
        try:
            recorder = getattr(observer, "record_invocation", None)
            if not callable(recorder):
                return False
            return bool(recorder(assemble_invocation(**fields)))

def _openrouter_providers(config: DaemonConfig) -> list:
    """Build the OpenRouter tier, or nothing when it cannot serve.

    A missing API key disables the tier quietly (TEST 14): the chain falls
    through to Gemini/Ollama and the application keeps working. The key
    itself is only ever read from the environment at request time.
    """
    if not config.openrouter_enabled:
        return []
    if not os.environ.get(config.openrouter_api_key_env, "").strip():
        return []
    ret
…[7602 chars omitted]…
         self._rollover_locked()
            return self._day

    def _blank(self) -> None:
        self._day = self._today()
        self._counts = {}
tests/integration/test_autonomous_pipeline.py:425:    summary = service.daily_summary(
tests/integration/test_service_api.py:218:    summary = service.daily_summary(start.astimezone(ZoneInfo("UTC")), (start.replace(day=7)).astimezone(ZoneInfo("UTC")))

from io import BytesIO
from typing import Any, Callable, Dict, List, Optional
from urllib.parse import parse_qs, urlsplit
from zoneinfo import ZoneInfo
from wsgiref.simple_server import WSGIServer, WSGIRequestHandler, make_server
from socketserver import ThreadingMixIn

from noema.application.pipeline import NoemaService
from noema.domain.normalization import application_identity
from noema.domain.activity import coerce_timestamp
from noema.infrastructure.sync import SyncEnvelope
from noema.infrastructure.browser.websocket import serve_websocket


def _json_bytes(payload: Any) -> bytes:
    return json.dum
…[8628 chars omitted]…
ders: Any, exc_info: Any = None) -> None:
            status_holder["status"] = status
            response_headers = []
            vary_seen = False
411:        timezone_name = query.get("timezone", ["Asia/Kolkata"])[0] or "UTC"
488:            response_headers.append(("Access-Control-Allow-Origin", cors_origin))
630:                timezone_name = query.get("timezone", ["Asia/Kolkata"])[0] or "UTC"

r item in ordered])
2263:            classifications = self.store.query_classification_map(session_ids)
2275:            for item in self.store.query_classifications(limit=limit)
2570:        classifications = {item.session_id: item for item in self.store.query_classifications(limit=limit)}
2669:        classifications = {item.session_id: item for item in self.store.query_classifications(limit=limit)}

        device: Optional[str] = None,
        domain: Optional[str] = None,
        limit: int = 1000,
        persist: bool = True,
    ) -> list:
        """Sessionize the AI database's normalized event view.

        Presence is derived from the same window's afk-status rows, so AFK
        spans split sessions and AFK telemetry never becomes activity.
        Windows without any afk data behave exactly as before.
        """

        with self._observe_db("session_rebuild") as state:
            stored = self.st
…[2192 chars omitted]…
nts(
        self,
        start: Optional[Any] = None,
        end: Optional[Any] = None,
        limit: int = 100000,
    ) -> list:
        """Presence telemetry rows (AFK-watcher status), never activity."""

        stored = self.store.query(start, end, None, None, limit)
        return [item.event for item in stored if is_presence_event(item.event)]

    def build_presence_timeline(
        self,

        if meaningful:
            session_ids = {session.id for session in meaningful}
            classifications = self.store.query_classification_map(session_ids)
            alignments = {
                item.session_id: item
                for item in self.store.query_alignments(intent_id=intent_id, limit=limit)
                if item.session_id in session_ids
            }
            return self.evaluate_behavior(meaningful,
…[899 chars omitted]…
= None,
    ) -> Intervention:
        observations = [item for item in self.store.query_behavior_observations(limit=100000) if item.session_id == session_id]
        sessions = [item for item in self.store.query_meaningful_sessions(limit=100000) if item.id == session_id]
        if not sessions:
            sessions = [item for item in self.store.query_sessions(limit=100000) if item.id == session_id]

python = "^3.9"
google-genai = "*"

[tool.poetry.group.dev.dependencies]
mypy = "*"
pytest = "*"
pytest-cov = "*"
pytest-benchmark = "*"
psutil = "*"
pywin32-ctypes = {version = "*", platform = "win32"}
pefile = {version = "*", platform = "win32"}

pyinstaller = {version = "*", python = "^3.9,<3.14"}
# releases are very infrequent, so good idea to use the master branch
# we need this unreleased commit: https://github.com/pyinstaller/pyinstaller-hooks-contrib/commit/0f40dc6e74086e5472aee75070b9077b4c17ab18
pyinstaller-hooks-contrib = {git = "https://github.com
…[8629 chars omitted]…
ny] = None, include_ollama: bool = False,
-                 day_timezone: str = "Asia/Kolkata", openrouter: Optional[list] = None,
+                 day_timezone: str = "UTC", openrouter: Optional[list] = None,
                  observer: Optional[Any] = None):
         self.providers = list(openrouter or []) + list(
             hosted or [GeminiProvider(model=model) for model in self.HOSTED_MODELS])

            [
                ("Content-Type", "application/json; charset=utf-8"),
                ("Content-Length", str(len(body))),
                ("Access-Control-Allow-Headers", "Content-Type"),
                ("Access-Control-Allow-Methods", "GET, POST, OPTIONS"),
            ],
        )
        return [body]

    def _static_response(self, start_response: Callable, filename: str, content_type: str):
        """Serve the bundled l
…[3369 chars omitted]…
3]
                    recorder.record_operation(
                        "api_request", "{} {}".format(method, path),
                        duration_ms=round((time.perf_counter() - started) * 1000, 1),
                        success=error is None and code.startswith("2"),
                        error=error or (None if code.startswith("2") else "HTTP {}".format(code or "?")),
                    )

        else:
            status = "idle"
        interval_minutes = round(config.classification_interval_seconds / 60.0, 1)
        next_run_at = None
        if running and due != float("inf"):
            wait = max(0.0, due - time.monotonic())
            next_run_at = (datetime.now(timezone.utc) + timedelta(seconds=wait)).isoforma
…[7575 chars omitted]…
ig.py:122:    assert DaemonConfig().timezone_name == "Asia/Kolkata"
tests/realtime/test_realtime_config.py:125:    assert DaemonConfig().to_dict()["timezone_name"] == "Asia/Kolkata"
tests/providers/test_usage_limits.py:77:    ledger = QuotaLedger(usage)
tests/providers/test_usage_limits.py:95:    ledger = QuotaLedger(usage)
tests/providers/test_usage_limits.py:105:    first.ledger = QuotaLedger(usage)

'http://127.0.0.2' -> http://127.0.0.1
'http://localhost.evil:80' -> http://127.0.0.1
'http://localhost:65536' -> http://127.0.0.1
'http://localhost:abc' -> http://127.0.0.1
'null' -> http://127.0.0.1
None -> http://127.0.0.1

tests/realtime/test_realtime_config.py:122: AssertionError
=========================== short test summary info ============================
FAILED tests/realtime/test_realtime_config.py::test_timezone_name_defaults_validates_and_round_trips
1 failed, 49 passed in 9.66s

        """
        if not isinstance(origin, str) or not origin:
            return cls._DEFAULT_CORS_ORIGIN
        if any(ord(char) <= 0x20 or ord(char) == 0x7F for char in origin):
            return cls._DEFAULT_CORS_ORIGIN

        try:
            parsed = urlsplit(origin)
        except ValueError:
            return cls._DEFAULT_CORS_ORIGIN
        if (not parsed.netloc or parsed.path or parsed.query or parsed.fragment
…[7052 chars omitted]…
se)
        except Exception as exc:
            error = "{}: {}".format(type(exc).__name__, str(exc)[:200])
            raise
        finally:
            try:
                recorder = getattr(getattr(self, "service", None), "telemetry", None)
                if recorder is not None:
                    code = str(status_holder.get("status") or "")[:3]
                    recorder.record_operation(

 from socketserver import ThreadingMixIn
@@ -38,6 +38,52 @@ class NoemaApp:
     * ``POST /api/ingest/activitywatch`` with a bucket or list of buckets
     """
 
+    _DEFAULT_CORS_ORIGIN = "http://127.0.0.1"
+
+    @classmethod
+    def _cors_origin(cls, origin: Any) -> str:
+        """Return an allowed browser origin, or a non-wildcard loopback default.
+
+        The API is a local daemon, so on
…[8629 chars omitted]…
ny] = None, include_ollama: bool = False,
-                 day_timezone: str = "Asia/Kolkata", openrouter: Optional[list] = None,
+                 day_timezone: str = "UTC", openrouter: Optional[list] = None,
                  observer: Optional[Any] = None):
         self.providers = list(openrouter or []) + list(
             hosted or [GeminiProvider(model=model) for model in self.HOSTED_MODELS])

             ("Content-Length", str(len(body))), ("Cache-Control", "no-cache"),
],
        )
        return [body]

    def _aw_query(self, query_lines: List[str], start: datetime, end: datetime) -> Any:
    # audible/media_playing metadata. No audio detector is built.
    afk_media_exception: bool = False
    
…[5669 chars omitted]…
ted_at = now or datetime.now(timezone.utc)
         if executed_at.tzinfo is None:
@@ -398,6 +396,8 @@ class InterventionEngine:
         payload = dict(intervention.payload)
         if self.policy.dry_run:
             payload["dry_run"] = True
+        else:
+            payload.pop("dry_run", None)
         return replace(
             intervention,
             status=InterventionStatus.EXECUTED,

1981-                        json.dumps(list(session.activities)),
1982-                        session.dominant_category,
1983-                        session.dominant_activity_type,
1984-                        session.intent_id,
1985-                        session.alignment_score,
1986-                        session.focus_score,
1987-                        session.distraction_score,

        Fill order is chronological (synthesis weighs recency). Item sizes
        come from text length first (chars//4, one accurate-ish estimate),
        then each assembled group is measured EXACTLY once with the model's
        real tokenizer; overs
…[8629 chars omitted]…
 True

    def usage(self) -> Dict[str, Dict[str, int]]:
        """Today's persisted usage table (llm:* and embedding:* rows)."""
        return self.ledger.snapshot()

    def count_tokens(self, prompt: str) -> int:
        """Count against the highest-priority usable model before sending."""
        for provider in self._chain():
            try:
                return provider.count_tokens(prompt)

2249-    def evaluate_stored_behavior(
2250-        self,
2251-        intent_id: Optional[str] = None,
2252-        start: Optional[Any] = None,
2253-        end: Optional[Any] = None,
2254-        device: Optional[str] = None,
2255-        limit: int = 1000,
2256-        persist: bool = True,
2257-    ) -> list:
2258-        meaningful = self.store.query_meaningful_sessions(start, end, limit=limit)
2259
…[7055 chars omitted]…
on if alignment else "session is not aligned with the active intent"
135-        if state == BehaviorState.RECOVERING:
136-            return "productive aligned session followed a distracted or drifting state"
137-        if state == BehaviorState.FOCUSED:
138-            return "productive session aligned with the active intent"
139-        return "active session without decisive alignment evidence"

class BehaviorEngine:
    """Convert semantic/alignment evidence into inspectable behavior states.

    Models may supply classifications, but this state machine owns the
    transition and actionability rules. No intervention is triggered here.
    """

    def __init__(self, min_actionable_distraction_seconds: float = 300.0):
        if min_actionable_distraction_seconds < 0:
            raise ValueError("minimum actionable distraction cannot be 
…[8629 chars omitted]…
, "QUEUED"} else "suppressed",
                state="RECEIVED" if delivery.status == "DELIVERED" else delivery.status,
                target=intervention.action.target,
                metadata=delivery.to_dict(),
            )
            if delivery.status == "NO_EXACT_TARGET" and intervention.mode != InterventionMode.HOLDOUT:
                fallback = self.notification_handler.send(intervention)

    rate_limited_count: int = 0
    last_rate_limited_at: Optional[str] = None
    minute_window_start: float = field(default_factory=time.monotonic)
    day_window_start: float = field(default_factory=time.monotonic)
    cooldown_until: float = 0.0
    consecutive_failures: int = 0
    last_error: Optional[str] = None
    last_success: Optional[str] = None
   
…[923 chars omitted]…
            and self.requests_today < self.rpd_limit
        )

src/noema/infrastructure/providers.py:398:    day_window_date: str = field(
src/noema/infrastructure/providers.py:405:        if self.day_window_date != today_utc:
src/noema/infrastructure/providers.py:408:            self.day_window_date = today_utc
grep: src/noema/infrastructure/__pycache__/providers.cpython-312.pyc: binary file matches

def is_meaningful_session(session: Any) -> bool:
    return hasattr(session, "activity_session_ids") and hasattr(session, "primary_topic")


def search_values(session: Any) -> List[str]:
    """Return observable text fields suitable for matching or model context."""

    if is_meaningful_session(session):
        values: Iterable[Any] = (
            session.primary_project,
            session.primary_task,
            session.primary_topic,
            session.dominant_category,
            session.dominant
…[8630 chars omitted]…
ality or "").strip().lower()
396-        if not quality:
397-            session_quality = getattr(session, "evidence_quality", None)
398-            quality = str(getattr(session_quality, "value", session_quality) or "").strip().lower()
399-        if quality not in {"weak", "absent"}:
400-            return False
401-        try:
402-            duration = float(getattr(session, "duration", 0) or 0)

        if eq_score is not None:
            eq_score = min(1.0, max(0.0, eq_score))
        object.__setattr__(self, "evidence_quality_score", eq_score)
        signal = str(self.signal or _INVALID_SIGNAL).strip()
        if signal.casefold() in {self.category.casefold(), self.productivity.
…[6482 chars omitted]…
D ".join(clauses) if clauses else ""
2076-        query = "SELECT * FROM meaningful_sessions{} ORDER BY start_time ASC, id ASC LIMIT ?".format(where)
2077-        parameters.append(limit)
2078-        with self._lock:
2079-            rows = self._connection.execute(query, parameters).fetchall()
2080-        return [self._row_to_meaningful_session(row) for row in rows]
479:    def close(self) -> None:

170-    productivity: str = "neutral"
171-    confidence: float = 0.0
172-    provider: str = "ollama"
173-    model: Optional[str] = None
174-    subcategory: str = "other"
175-    activity: str = "Ambiguous activity"
176-    signal: str = "Evidence was insufficient to determine the activity."
177-    source: str = "pending"
178-    classification_status: str = "pending"
179-    classified_at: Optional[datetime] = None
180-    service: Optional[str] = None
181-    # Evidence never comes from the model trus
…[3272 chars omitted]…
r provider, not both")
327-        self.provider = provider or OllamaProvider(client=client)
1074:    def _row_to_classification(row: sqlite3.Row) -> Classification:
1075-        # Schema migrations in __init__ guarantee these columns exist.
1076-        return Classification(
1077-            session_id=row["session_id"],
1078-            category=row["category"],
1079-            topic=row["topic"],

from noema.domain.behavior import BehaviorObservation, BehaviorState
from noema.application.classification import Classification
from noema.domain.intent import Intent
from noema.domain.session_context import browser_target, session_label
from noema.domain.sessions import ActivitySession


class InterventionMode(str, Enum):
    HOLDOUT = "HOLDOUT"
    NOTIFICATION = "NOTIFICATION"
    MEME = "MEME"


class InterventionStatus(str, Enum):
    PLANNED = "PLANNED"
    EXECUTED = "EXECUTED"
    SKIPPED = "SKIPPED"



…[6490 chars omitted]…
"GET" and path == "/dashboard.js":
532-                return self._static_response(start_response, "dashboard.js", "application/javascript; charset=utf-8")
533-
534-            if method == "GET" and path == "/health":
535-                return self._response(start_response, HTTPStatus.OK, {"status": "ok"})
536-
537-            if method == "GET" and path in {"/api/daemon/health", "/daemon/health"}:

            ActivityEvent(
                timestamp="2026-09-05T18:20:00Z", duration=120,
                device="laptop", app="Firefox", domain=
…[7587 chars omitted]…
filters_calendar_day_and_deduplicates_overlaps
FAILED tests/providers/test_openrouter.py::test_gemini_thinking_level_flows_to_sdk_and_retries_ambiguous
FAILED tests/providers/test_openrouter.py::test_gemini_keeps_first_verdict_when_medium_retry_fails
FAILED tests/realtime/test_realtime_config.py::test_timezone_name_defaults_validates_and_round_trips
4 failed, 333 passed, 2 skipped, 1 warning in 55.54s

        ]
        session_id_to_observed = {
            session.id: [
                event_intervals[event_key]
                for event_key in session.event_keys
                if event_key in event_intervals
            ]
            for session in sessions
        }
        meaningful_observed_intervals 
…[3693 chars omitted]…
ve + totals["distractive"] + totals["neutral"]
        return {
            "date": start.astimezone(ZoneInfo(timezone_name)).date().isoformat(),
            "timezone": timezone_name,
            "start": start.isoformat(),
            "end": end.isoformat(),
            "total_time": round(total, 1),
            "total_tracked_seconds": round(total, 1),
            "screen_on_time": round(total, 1),

  "gemini_api_key_env": "GEMINI_API_KEY",
  "gemini_timeout_seconds": 15,
  "gemini_models": ["gemini-3.7-flash", "gemini-3.6-flash", "gemini-3.5-flash", "gemini-3.5-flash-lite", "gemini-3.1-flash-lite", "gemini-3.8-flash"],
  "openrouter_enabled": true,
  "openrouter_api_key_env": "OPENROUTER_API_KEY",
  "openrouter_base_url": "https://openrouter.ai/api/v1",
  "openrouter_free_models": ["nvidia/nemotron-3-nano-omni-30b-a3b-reasoning:free"],
  "openrouter_timeout_seconds
…[2756 chars omitted]…
regression/test_concurrency.py:68:    raw = b"".join(app(environ, start_response))
tests/regression/test_daemon.py:73:    def start_response(status, headers):
tests/regression/test_daemon.py:83:    response = b"".join(app(environ, start_response))
tests/unit/test_presence.py:31:    def start_response(status, headers):
tests/unit/test_presence.py:41:    response = b"".join(app(environ, start_response))

        """
        state = self.rate_limits.get(provider.model)
        if state is None:
            return 0
        try:
            prompt_tokens = self._estimate_tokens(provider, prompt)
        except (ProviderError, OSError, TimeoutError, ConnectionError):
            return -1
        billable = prompt_tokens + OUTPUT_TOKEN_RE
…[5457 chars omitted]…
    len(group) > 1
                    and (self._looks_like_length_error(exc) or (
                        self._looks_like_quota_error(exc)
                        and self._can_serve_smaller(billable)))
                )
                if splittable:
                    # Packing overshot what the serving tier accepts, or the
                    # tier throttled a group a smaller model could take.

        start_response(
            "200 OK",
            [("Content-Type", content_type + ("; charset=utf-8" if content_type.startswith(("text/", "application/javascript")) else "")),
             ("Content-Length", str(len(body))), ("Cache-Control", "no-cache")],
        )
        return [body]

    def _aw_query(self, query_lines: List[str], start: datetime, end: 
…[225 chars omitted]…
.py            |  6 +--
 src/noema/domain/intervention/engine.py |  6 +--
 src/noema/infrastructure/providers.py   | 21 +++++---
 6 files changed, 108 insertions(+), 36 deletions(-)
 M src/noema/api/server.py
 M src/noema/application/classification.py
 M src/noema/application/pipeline.py
 M src/noema/config/settings.py
 M src/noema/domain/intervention/engine.py
 M src/noema/infrastructure/providers.py

        scheme = parsed.scheme.casefold()
        if scheme in {"http", "https"}:
            try:
                hostname = parsed.hostname
                # Accessing .port validates the syntax and range, including
                # arbitrarily long attacker-controlled port strings.
                parsed.port
            except ValueError:
          
…[513 chars omitted]…
      and "\\" not in parsed.netloc):
                return origin
        return cls._DEFAULT_CORS_ORIGIN

    def __init__(self, service: NoemaService, daemon: Any = None):
        self.service = service
        self.daemon = daemon
        self._source_today_cache = None
        self._source_today_cached_at = 0.0

    def _response(self, start_response: Callable, status: HTTPStatus, payload: Any):

            ),
            ActivityEvent(
                timestamp="2026-09-05T18:30:00Z", duration=60,
                device="laptop", app="Firefox", domain="instagram.com", title="Instagram",
                bucket_id="wi
…[7232 chars omitted]…
service_api.py::test_daily_summary_filters_calendar_day_and_deduplicates_overlaps
FAILED tests/realtime/test_realtime_config.py::test_timezone_name_defaults_validates_and_round_trips
FAILED tests/providers/test_openrouter.py::test_gemini_thinking_level_flows_to_sdk_and_retries_ambiguous
FAILED tests/providers/test_openrouter.py::test_gemini_keeps_first_verdict_when_medium_retry_fails
4 failed in 2.13s

from noema.infrastructure.database import SQLiteStore
from noema.application.classification import Classification, Classifier
from noema.infrastructure.providers import ProviderChain, ProviderError
from noema.domain.meaningful import MeaningfulSession
from noema.infrastructure.ollama import OllamaError


def _test_path(name):
    path = Path.cwd() / "tests" / "noema" / name
    path.unlink(missing_ok=True)
    return path


def call_app(app, method, path, body=b""):
   
…[1823 chars omitted]…
id": "auto-event",
            "timestamp": "2026-09-06T10:00:00Z",
            "duration": 120,
            "data": {"app": "VS Code", "title": "reward.py"},
        }]


def test_failed_attempt_records_retry_error_and_backoff():
"""Restart-safe continuous orchestration for Noema."""

from __future__ import annotations

import atexit
import hashlib
import logging
import os
import signal
import shutil

331-        worker = daemon._workers.get("semantics")
332-        last_result = dict(getattr(worker, "last_result", None) or {})
333-        due = daemon._next_due.get("semantics", float("inf"))
334-        running = daemon.running and config.background_ai_enabled
335-        if not config.back
…[8629 chars omitted]…
414-        return (
415-            current >= self.cooldown_until
416-            and self.attempts_this_minute < self.rpm_limit
417-            and self.tokens_this_minute + tokens <= self.tpm_limit
418-            and self.requests_today < self.rpd_limit
419-        )
420-
421-    def record_attempt(self) -> None:
422-        self.attempts_this_minute += 1
423-        self.attempts_today += 1
424-

        activities=("implementation", "research"),
        dominant_category="development",
        dominant_ac
…[1013 chars omitted]…
tate == BehaviorState.NORMAL

    store = SQLiteStore()
    store.insert_meaningful_session(canonical)
    store.insert_classification(classification)
    store.insert_alignment(alignment)
    service = NoemaService(ActivityWatchAdapter(), store)
    stored_observations = service.evaluate_stored_behavior()
    assert [item.session_id for item in stored_observations] == [canonical.id]
    store.close()

 from http import HTTPStatus
 from io import BytesIO
 from typing import Any, Callable, Dict, List, Optional
-from urllib.parse import parse_qs
+from urllib.parse import parse_qs, urlsplit
 from zoneinfo import ZoneInfo
 from wsgiref.simple_server import WSGIServer, WSGIRequestHandler, make_server
 from sock
…[7504 chars omitted]…
-                timezone_name = query.get("timezone", ["Asia/Kolkata"])[0] or "Asia/Kolkata"
+                timezone_name = query.get("timezone", ["UTC"])[0] or "UTC"
                 zone = ZoneInfo(timezone_name)
                 selected = datetime.now(zone).replace(hour=0, minute=0, second=0, microsecond=0)
                 start = coerce_timestamp(query.get("start", [selected.isoformat()])[0])

    ???
<frozen importlib._bootstrap>:1331: in _find_and_load_unlocked
    ???
<frozen importlib._bootstrap>:935: in _load_unlocked
    ???
/usr/local/lib/python3.12/site-packages/_pytest/assertion/
…[8629 chars omitted]…
s/test_batch_classification.py
ERROR tests/providers/test_classification_batches.py
ERROR tests/providers/test_classification_contract.py
ERROR tests/providers/test_escalation.py
ERROR tests/providers/test_failure_matrix.py
ERROR tests/providers/test_usage_limits.py
ERROR tests/unit/test_intervention.py
!!!!!!!!!!!!!!!!!!!!!!!!!! stopping after 10 failures !!!!!!!!!!!!!!!!!!!!!!!!!!
10 errors in 2.09s

            "context": list(recent_context or []),
        }
        # Evidence matching is case-insensitive, but session identities are
        # opaque and may be case-sensitive. Keep the ID outside that
        # normalization so separate sessions can never share a cache entry.
        session_id = json.dumps(getattr(session, "id", None), ensure_ascii=False, default=str)
        normalized_evidence = json.dumps(
            evidence, ensure_ascii=False, sort_keys=True, default=str
        ).casefold()
        return session_id + ":" + normalized_evidence

    @staticmethod
    def _truncate_text(value: Any, limit: int = MAX_TEXT_FIELD_CHARS) -> Any:

 from socketserver import ThreadingMixIn
@@ -38,6 +38,52 @@ class NoemaApp:
     * ``POST /api/ingest/activitywatch`` with a bucket or list of buckets
     """
 
+    _DEFAULT_CORS_ORIGIN = "http://127.0.0.1"
+
+    @classmethod
+    def _cors_origin(cls, origin: Any) -> str:
+        """Return an allowed browser origin, or a non-wildcard loopback default.
+
+        The API is a local daemon, so on
…[8629 chars omitted]…
      observer: Optional[Any] = None):
         self.providers = list(openrouter or []) + list(
             hosted or [GeminiProvider(model=model) for model in self.HOSTED_MODELS])
 M src/noema/api/server.py
 M src/noema/application/classification.py
 M src/noema/application/pipeline.py
 M src/noema/config/settings.py
 M src/noema/domain/intervention/engine.py
 M src/noema/infrastructure/providers.py

            ActivityEvent(
                timestamp="2026-09-05T18:20:00Z", duration=120,
                device="laptop", app="Firefox", domain=
…[7587 chars omitted]…
filters_calendar_day_and_deduplicates_overlaps
FAILED tests/providers/test_openrouter.py::test_gemini_thinking_level_flows_to_sdk_and_retries_ambiguous
FAILED tests/providers/test_openrouter.py::test_gemini_keeps_first_verdict_when_medium_retry_fails
FAILED tests/realtime/test_realtime_config.py::test_timezone_name_defaults_validates_and_round_trips
4 failed, 333 passed, 2 skipped, 1 warning in 52.44s

+        session_id = json.dumps(getattr(session, "id", None), ensure_ascii=False, default=str)
+        normalized_evidence = json.dumps(
+            evidence, ensure_ascii=False, sort_keys=Tr
…[7480 chars omitted]…
ny] = None, include_ollama: bool = False,
-                 day_timezone: str = "Asia/Kolkata", openrouter: Optional[list] = None,
+                 day_timezone: str = "UTC", openrouter: Optional[list] = None,
                  observer: Optional[Any] = None):
         self.providers = list(openrouter or []) + list(
             hosted or [GeminiProvider(model=model) for model in self.HOSTED_MODELS])

 6 files changed, 115 insertions(+), 37 deletions(-)

-rw-r--r-- 1 root root    592 Nov  1 22:12 CONTRIBUTING.md
-rw-r--r-- 1 root root  16726 Nov  1 22:12 LICENSE.txt
-rw-r--r-- 1 root root   1980 Nov  1 22:12 PRIVACY.md
-rw-r--r-- 1 root root  16597 Nov  1 22:12 README.md
-rw-r--r-- 1 root root   1050 Nov  1 22:12 SECURITY.md
-rw-r--r-- 1 root roo
…[319 chars omitted]…
xr-xr-x 1 root root   4096 Nov  1 22:12 web
./.env.example
./.git/COMMIT_EDITMSG
./.git/config
./.git/description
./.git/HEAD
./.git/index
./.gitattributes
./.gitignore
./.tool-versions
./CHANGELOG.md
./CITATION.cff
./CODE_OF_CONDUCT.md
./CONTRIBUTING.md
./LICENSE.txt
./poetry.lock
./PRIVACY.md
./pyproject.toml
./README.md
./rerun_inference.py
./SECURITY.md
./tests/conftest.py
./THIRD_PARTY_NOTICES.md

src/noema/application/realtime/__init__.py
src/noema/application/realtime/detector.py
src/noema/application/realtime/features.py
src/noema/application/realtime/records.py
src/noema/application/realtime/verifier.py
src/noema/cli/__init__.py
src/noema/cli/benchmark.py
src/noema/cli/daemon.py
src/noema/cli/telemetry.py
src/noema/config/__init__.py
src/noema/config/config.example.json
src/noema/config/settings.py
src/noema/docs/FEATURES.md
src/noema/docs/ROADMAP.md
src/noema/docs/architecture/ove
…[4484 chars omitted]…
/test_chunk_aggregation.py
tests/unit/test_embeddings.py
tests/unit/test_intent.py
tests/unit/test_intervention.py
tests/unit/test_intervention_policy.py
tests/unit/test_meaningful_sessions.py
tests/unit/test_meme.py
tests/unit/test_native_collectors.py
tests/unit/test_outcome.py
tests/unit/test_presence.py
tests/unit/test_privacy_database.py
tests/unit/test_sessionizer.py
tests/unit/test_telemetry.py

src/noema/runtime/daemon.py:867:                now.astimezone(ZoneInfo(self.config.timezone_name)).date().isoformat(),
src/noema/runtime/daemon.py:962:        local_start = now.astimezone(ZoneInfo(self.config.timezone_name)).replace(
src/noema/runtime/daemon.py:1136:        observations = self.service.evaluate_stored_behavior(

    @staticmethod
    def _skipped(session_id: str, reason: str, now: datetime) -> Intervention:
        return Intervention(
            session_id=session_id,
            mode=None,
            status=InterventionStatus.SKIPPED,
            reason=reason,
            created_at=now,
        )

    def execute(
        self,
        intervention: Intervention,
        handler: Optional[Callable[[Intervention], Any]] = None,
        
…[462 chars omitted]…
uted_at.tzinfo is None:
            executed_at = executed_at.replace(tzinfo=timezone.utc)
        payload = dict(intervention.payload)
        if self.policy.dry_run:
            payload["dry_run"] = True
        return replace(
            intervention,
            status=InterventionStatus.EXECUTED,
            payload=payload,
            executed_at=executed_at.astimezone(timezone.utc),
        )

    dominant_activity_type: Optional[str] = None
    intent_id: Optional[str] = None
    alignment_score: float = 0.0
    focus_score: float = 0.0
    distraction_score: float = 0.0
    context_switch_count: int = 0
    active_duration_seconds: float = 0.0
    afk_duration_seconds: float = 0.0
    status: MeaningfulSessionStatus = MeaningfulSessionStatus.CLOSED
    confidence: float = 0.0
    summary: Any = None
    outcome: MeaningfulSessionOutcome = Meaningf
…[4435 chars omitted]…
xt, tele)
1041:    def classify_many(
1074:        batcher = getattr(self.provider, "classify_batch", None)
1076:                    if self._cache_key(session, session_contexts[session.id]) not in self._classification_cache]
1097:            cache_key = self._cache_key(session, context)
1116:                result = self.classify(session, context, tele)
1172:            "classify_job", provider_name,

            afk_duration = 0.0
        object.__setattr__(self, "active_duration_seconds", round(max(0.0, active_duration), 3))
        object.__se
…[8629 chars omitted]…
calls += 1
                if self._last_failure_kind == "timeout":
                    timeout_count += 1
                if self._last_failure_kind == "parse":
                    parse_failures += 1
            elif result.source == "pending" and self._last_failure_kind:
                failed_calls += 1
                if self._last_failure_kind == "timeout":
                    timeout_count += 1

418:            return start_response(status, headers, exc_info) if exc_info is not None else start_response(status, headers)
446:              
…[6268 chars omitted]…
sponse, HTTPStatus.NOT_FOUND, {"error": "not_found"})
1089:            return self._response(start_response, HTTPStatus.BAD_REQUEST, {"error": str(exc)[:200]})
1093:            return self._response(
1097:            return self._response(
1102:            return self._response(
1107:def create_app(service: NoemaService, daemon: Any = None) -> NoemaApp:
1108:    return NoemaApp(service, daemon=daemon)

        except ValueError as exc:
            raise ValueError("{} must be an integer".format(name)) from exc
        if value < 1:
            raise ValueError("{} must be positive".format(name))
        return value

    def __call__(self, environ: Dict[str, Any], start_response: Callable):
        """Time every request into telemetry, then dispatch unchanged."""
        method = environ.get("REQUEST_MET
…[2805 chars omitted]…
host, port, create_app(service, daemon=daemon), server_class=ThreadingWSGIServer,
        handler_class=WSGIRequestHandler,
    ) as server:
        if daemon is not None and hasattr(daemon, "add_shutdown_callback"):
            daemon.add_shutdown_callback(server.shutdown)
        try:
            server.serve_forever()
        finally:
            if daemon is not None:
                daemon.stop()

                row["priority"] = int(registry_entry["priority"])
                row["quota_scope"] = "shared-openrouter-
…[5527 chars omitted]…
elemetry.py:102:def test_quota_scope_vocabulary():
tests/unit/test_telemetry.py:103:    assert quota_scope_for("openrouter") == "shared-openrouter-guards"
tests/unit/test_telemetry.py:104:    assert quota_scope_for("ollama") == "local"
tests/unit/test_telemetry.py:105:    assert quota_scope_for("gemini") == "model-specific"
tests/unit/test_telemetry.py:106:    assert quota_scope_for("mystery") is None

tests/unit/test_behavior.py:76:    assert pending.classification_status == "pending"
tests/unit/test_behavior.py:87:        classification_status="classification_failed",
tests/unit/test_presence.py:439:    assert all(item.classification_status == "classified" for item in results)
tests/unit/test_presence.py:492:        classification_status="classified",

    assert again["semantics"]["classifications"] == 0
    assert client.calls == calls_after_first
    rows = store.query_classifications(limit=100000)
    assert len(rows) == 1
    assert rows[0].retry_count == 1
    assert rows[0].last_error
    store.close()


…[3568 chars omitted]…
/api/realtime/evaluate", body=b"{}")
tests/api/test_realtime_api.py:25:def call_app(app, method, path, body=b""):
tests/api/test_realtime_api.py:55:    status, payload = call_app(app, "GET", "/api/realtime/status")
tests/api/test_realtime_api.py:68:    status, payload = call_app(app, "GET", "/api/detections")
tests/api/test_realtime_api.py:75:    status, empty = call_app(app, "GET", "/api/detections")

        config = getattr(daemon, "config", None)
        return str(getattr(config, "timezone_name", None) or "Asia/Kolkata")

    def _source_today(self) -> Dict[str, Any]:
        """Use the source query API with AFK intersection for exact live view.

        This matches the source's own Summary page by filtering window
        events against not-afk periods, eliminating double-counting
…[1339 chars omitted]…
application/pipeline.py:914:        day_timezone = "Asia/Kolkata"
src/noema/api/server.py:131:        return str(getattr(config, "timezone_name", None) or "Asia/Kolkata")
src/noema/api/server.py:357:        timezone_name = query.get("timezone", ["Asia/Kolkata"])[0] or "Asia/Kolkata"
src/noema/api/server.py:555:                timezone_name = query.get("timezone", ["Asia/Kolkata"])[0] or "Asia/Kolkata"

tests/unit/test_outcome.py:14:        created_at=datetime(2026, 9, 4, 10, tzinfo=timezone.utc),
tests/unit/test_presence.py:9:from datetime import datetime, timedelta, timezone
tests/unit/test_presence.py:46:    moment = datetime.now(timezone.utc).replace(second=0, microsecond=0) - timedelta(minutes=minutes_ago)

    from zoneinfo import ZoneInfo

    usage = tmp_path / "usage.json"
    zone = ZoneInfo("Asia/Kolkata")
    yesterday = (datetime.now(zone) - timedelta(days=1)).date().isoformat()
    usage.write_text(json.dumps({
        "day": yesterday,
        "counts": {"llm:gemini-2.5-flash": {"requests": 20, "tokens": 999}},
    }))
    ledger = QuotaLedger(usage)
    assert ledger.day != yesterday
    assert ledger.usage("llm", "gemini-2.5-flash") == {"requests": 0, "tokens": 0}
    assert led
…[2618 chars omitted]…
dnight - timedelta(hours=13)).isoformat().replace("+00:00", "Z")
    store = SQLiteStore()
    service = NoemaService(ActivityWatchAdapter(), store)
    service.ingest_events([
        ActivityEvent(
            timestamp=old_stamp, duration=30, device="laptop",
            app="Firefox", title="Old GitHub project", domain="github.com",
            bucket_id="window", source_event_id="old",
        ),

from noema.domain.sessions import ActivitySession


def context():
    session = ActivitySession(
        start="2026-09-04T10:00:00Z",
        end="2026-09-04T10:10:00Z",
        device="laptop",
        app="Chrome",
        domain="reddit.com",
        event_keys=("distraction",),
        browser="firefox",
        browser_window_id="17",
        browser_tab_id="42",
    )
    observation = BehaviorObservation(
        session_id=session.id,
        state=BehaviorState.DISTRACTED,
        s
…[3166 chars omitted]…
IN" in action["actions"]
    assert planned.to_dict()["target"]["tab_id"] == "42"
tests/regression/test_concurrency.py:128:    integrity = store._connection.execute("PRAGMA integrity_check").fetchone()[0]
tests/unit/test_intervention.py:66:        executed = engine.execute(planned, now=now)
tests/unit/test_intervention.py:79:    executed = engine.execute(planned, handler=handler_calls.append, now=now)

from noema.application.realtime import FastModelVerifier

from test_realtime_pipeline import (
    NOW,
    ConfirmLeg,
    classify_all,
    distracting_payload,
    make_service,
    make_sessions,
)


def call_app(app, method, path, body=b""):
    result = {}

    def start_response(status, headers):
        result["status"] = status

    environ = {
        "REQUEST_METHOD": method,
        "PATH_INFO": path,
        "QUERY_STRING": "",
        "CONTENT_LENGTH": str(len
…[616 chars omitted]…
n path else "",
        "CONTENT_LENGTH": str(len(body)),
        "wsgi.input": io.BytesIO(body),
    }
    raw = b"".join(app(environ, start_response))
    return result["status"], json.loads(raw.decode("utf-8"))


def _service():
    store = SQLiteStore()
    adapter = ActivityWatchAdapter(ActivityWatchClient("http://127.0.0.1:9"))
    service = NoemaService(adapter, store)
    return store, service

quotas, logs, or the browser. API: `GET /api/debug/quotas`,
`GET /api/classification/status`.

## 6. Behavior engine

**What.** Episodes + verdicts roll up into `FOCUSED / DISTRACTED / IDLE`
observations with focus and distraction scores.

**How.** `BehaviorEngine.evaluate`
…[743 chars omitted]…
fox bridge.

**Guarantees.** Classification alone can never trigger an action. AFK never
counts as recovery. API: `GET /api/interventions`, `GET /api/outcomes`.

./src/noema/api/server.py:312:        quota = {"model": last_model, "requestsUsed": None, "requestsLimit": None, "requestsRemaining": None}
./src/noema/api/server.py:320:                "requestsRemaining": (row.get("rpd") or {}).get("left"),

        self.last_model = None
        self.attempts = []
        self.model_latency_ms: Dict[str, float] = {}
        # Packing diagnostics for the latest classify_bat
…[2152 chars omitted]…
 is None:
            return False
        try:
            record = assemble_invocation(**fields)
            recorder = getattr(observer, "record_invocation", None)
            if not callable(recorder):
                return False
            return bool(recorder(record))
        except Exception:
src/noema/infrastructure/providers.py:1181:            self.rate_limits[provider.model] = QuotaState(

import threading
import time
import os
from collections.abc import Callable, Mapping
from dataclasses import dataclass, field
from datetime import datetime, timezone
from pathlib import Path

try:
    from zoneinfo import ZoneInfo
except ImportError:  # pragma: no cover - very old interpreters
    ZoneInfo = None  # type: ignore[assignment]
from typing import Any, Dict, List, Optional, Protocol
from urllib.error import HTTPError, URLError
from urllib.parse import quote
from urllib.request import Request, urlopen

from noema.infrastructure.ollama import OllamaC
…[1086 chars omitted]…
Info is not None else timezone.utc
262:        self.day_timezone = str(day_timezone)
328:    def _rollover_locked(self) -> None:
405:        if current - self.day_window_start >= 86400:
408:            self.day_window_start = current
1158:                 day_timezone: str = "Asia/Kolkata", openrouter: Optional[list] = None,
1185:        self.ledger = QuotaLedger(usage_path, day_timezone=day_timezone)

        self.calls = 0

    def classify(self, session, prompt):
        self.calls += 1
        if self.error:
            raise self.error
        return self.payload

    def count_tokens(self, prompt):
        return self.tokens


def payload(category="neutral"):
    return {
        "category": category,
        "productivity": "neutral",
        "activity": "Observed activity",
        "signal": "Observed evidence supports this result.",
    }


def test_per_model_limits_come_from_the_quota_table():
    chain = Provide
…[4753 chars omitted]…

        if self._day != self._today():
            self._blank()
            self._save_locked()

    @staticmethod
    def _key(kind: str, model: Any) -> str:
        return "{}:{}".format(kind, model)

    def usage(self, kind: str, model: Any) -> Dict[str, int]:
        """Return today's ``{"requests": n, "tokens": m}`` for one entry."""
        with self._lock:
            self._rollover_locked()

        self,
        start: datetime,
        end: datetime,
        timezone_name: str = "
…[395 chars omitted]…
 hide earlier telemetry from the
        # real-time Today view; reset state only controls processing cursors.
        effective_start = start
        events = self.store.query(start=effective_start, end=end, limit=100000)
src/noema/cli/daemon.py:190:        provider = ProviderChain(hosted=hosted, ollama=ollama,
src/noema/cli/daemon.py:197:        provider = ProviderChain(hosted=hosted, ollama=ollama,

 from socketserver import ThreadingMixIn
@@ -24,6 +24,32 @@ from noema.infrastructure.sync import SyncEnvelope
 from noema.infrastructure.browser.websocket import serve_websocket
 
 
+DEFAULT_CORS_ORIGIN = "http://127.0.0.1"
+
+
+def _cors_origin(origin: Any) -> str:
+    """Return the response origin for a request, never a wildcard.
+
+    Only local dashboard origins and browser extensions may be 
…[3757 chars omitted]…
   worker_error = getattr(worker, "last_error", None)
@@ -410,6 +450,7 @@ class NoemaApp:
         method = environ.get("REQUEST_METHOD", "GET").upper()
         path = environ.get("PATH_INFO", "/")
         started = time.perf_counter()
+        self._request_local.cors_origin = _cors_origin(environ.get("HTTP_ORIGIN"))
         status_holder: Dict[str, Any] = {}
         error: Optional[str] = None

    "Intervention",
    "InterventionActionPayload",
    "InterventionEngine",
    "InterventionMode",
    "InterventionPolicy",
    "InterventionStatus",
]
"""Policy-gated interventions driven by behavior observations."""

from __future__ import annotations

import hashlib
import json
from dataclasses import dataclass, field, replace
from datetime import datetime, timedelta, timezone
from enum import Enum
from typing import Any, Callable, Dict, Iterable, Mapping, Optional, Tuple

from noema.domain.activity import coerce_timestamp
from noema.domain.behavior import BehaviorObservation, BehaviorState
from noema.application.classification import Clas
…[1857 chars omitted]…
  return {
            "intervention_id": self.intervention_id,
            "type": self.type,
            "severity": self.severity,
            "target": dict(self.target),
            "message": dict(self.message),
            "meme": dict(self.meme) if self.meme else None,
            "svg": self.svg,
            "actions": list(self.actions),
            "expires_in": self.expires_in,
        }

=========================== short test summary info ============================
FAILED tests/realtime/test_realtime_config.py::test_timezone_name_defaults_validates_and_round_trips
1 failed, 58 passed in 10.08s

        def tracking_start_response(status: str, headers: Any, exc_info: Any = None) -> None:
            status_holder["status"] = status
            return start_response(status, headers, exc_info) if exc_info is not None else start_response(status, headers)

        try:
            return self._dispatch(environ, tracking_start_response)
        ex
…[95 chars omitted]…
            raise
 src/noema/api/server.py                 | 52 +++++++++++++++++++++++++++++----
 src/noema/application/classification.py |  1 +
 src/noema/application/pipeline.py       | 12 ++------
 src/noema/config/settings.py            |  4 +--
 src/noema/domain/intervention/engine.py |  6 ++--
 src/noema/infrastructure/providers.py   |  6 +++-
 6 files changed, 60 insertions(+), 21 deletions(-)

                pass

    def _dispatch(self, environ: Dict[str, Any], start_response: Callable):
        method = environ.get("REQUEST_METHOD", "GET").upper()
        path = environ.get("PATH_INFO", "/")
        query = parse_qs(environ.get("QUERY_STRING", ""), keep_blank_values=False)
        self._request_local.cors_origin = _cors_origin(environ.get("HTTP_ORIGIN"))

        self.openrouter_base_url = str(self.openrouter_base_url).rstrip("/")
        self.openrouter_timeout_seconds = _positive(
            "openrouter_timeout
…[1357 chars omitted]…
econds
        )
        self.severe_classification_interval_seconds = _positive(
            "severe_classification_interval_seconds", self.severe_classification_interval_seconds
        )
        self.outcome_interval_seconds = _positive("outcome_interval_seconds", self.outcome_interval_seconds)
        self.report_interval_seconds = _positive("report_interval_seconds", self.report_interval_seconds)

tests/providers/test_openrouter.py:361: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

self = <noema.infrastructure.providers.GeminiProvider object at 0x7b70c2d0c140>
session = ActivitySession(start=datetime.datetime(2026, 9, 4, 10, 0, tzinfo=datetime.timezone.utc), end=datetime.datetime(2026, ...t_count': 1, 'sources': ['activitywatch']}, session_id=None, browser=None, browser_window_id=None, browser_tab_id=None)
prompt = 'prompt'

    def classify(self
…[3526 chars omitted]…
test summary info ============================
FAILED tests/providers/test_openrouter.py::test_gemini_thinking_level_flows_to_sdk_and_retries_ambiguous
FAILED tests/providers/test_openrouter.py::test_gemini_keeps_first_verdict_when_medium_retry_fails
FAILED tests/realtime/test_realtime_config.py::test_timezone_name_defaults_validates_and_round_trips
3 failed, 334 passed, 2 skipped, 1 warning in 53.59s

 from socketserver import ThreadingMixIn
@@ -24,6 +24,32 @@ from noema.infrastructure.sync import SyncEnvelope
 from noema.infrastructure.browser.websocket import serve_websocket
 
 
+DEFAULT_CORS_ORIGIN = "http://127.0.0.1"
+
+
+def _cors_origin(origin: Any) -> str:
+    """Return the response origin for a request, never a wildcard.
+
+    Only local dashboard origins and browser extensions may be 
…[8629 chars omitted]…
indow_start = current
-        if current - self.day_window_start >= 86400:
+        today = datetime.now(timezone.utc).date().isoformat()
+        if self.day_window_date != today:
             self.requests_today = 0
             self.attempts_today = 0
+            self.day_window_date = today
             self.day_window_start = current
         return (
             current >= self.cooldown_until