[alecantu7]

Why

Web turns run on anton's built-in limits (25 steps, 3 auto-continues, 1.25M tokens), whatever the tenant set in Settings, because the pod never receives the tenant's settings (ENG-3444). Desktop doesn't have this problem: cowork-server overlays the settings onto anton for an in-process turn.

What changed

• TurnRequestV1 reads an optional limits block: max_tool_rounds, max_continuations, max_turn_tokens.
• build_cloud_chat_session applies each one present in place of anton's default.
• Each value is checked on its own: a known name, an integer (not a bool), at or above its minimum. A bad value is dropped and that limit keeps its default; the turn doesn't fail. A token limit of 0, which anton reads as "no limit", is refused so a producer bug can't turn the ceiling off.
• No block (an older controller or cowork-server) keeps today's behaviour.
• Each dropped limit is logged as a warning with its name, the reason (unknown limit, not an integer, below its minimum) and the conversation id, as an unparsable started_at is. Values are never logged. A block that isn't an object is logged too; an absent block logs nothing.

Validation

• uv run --group dev pytest tests/ --ignore=tests/e2e: 5,282 passed, 237 skipped on the first commit. On the logging commit, 5,276 passed and 9 subprocess tests failed (test_cloud_turn_process.py, test_chat_scratchpad.py) identically with the change stashed: locally the venv's .pth files carry the macOS hidden flag, which Python 3.12.12 skips, so a child process can't import anton. Environmental; CI on Linux decides.
• Logging tests: each drop is logged once, by name and reason, with the conversation id and never the value; a non-object block is logged; no block logs nothing. Each was checked to fail with its part reverted, including logging the value.
• New tests build a real ChatSession from a request line and check its step, auto-continue and token caps; without a block it keeps CoreSettings defaults; one limit replaces only its own default. Contract tests cover a missing or non-object block, unknown names, strings, floats, negatives, bools, a 0 token limit, and 0 auto-continues (a real value).
• Each of these was checked to fail with the matching line reverted: not applying the block, not parsing it, accepting 0 tokens, accepting bools.
• The wire test sends 7 / 2 / 4,000,000, unlike both anton's old (25 / 3 / 1.25M) and anton#576's new (250 / 10 / 25M) defaults, so it can't pass by accident once both merge. It fails with the loop that applies the block removed.
• Rebased onto staging on 2026-10-21: uv run --group dev pytest tests/ --ignore=tests/e2e: 7,749 passed, 267 skipped (run from a checkout outside ~/Documents, where the macOS hidden-.pth problem doesn't occur).

Limitations

• Reaches web pods automatically: their image is rebuilt from anton on every push to staging and every release. On its own that changes nothing, because nothing sends limits until cowork-server#694.
• The web time limit and its "Keep going" card are not here; that work comes next under ENG-3444 (scratchpad-controller#73, which it builds on, has merged).

Merge order (ENG-3442)

1. ENG-3443: Default the turn limits to the safety limits cowork-server#693: the new defaults for desktop and self-hosted.
2. ENG-3445: Let users opt into task limits; run to the defaults until they do cowork-server#695, then ENG-3445: Add the limits switch to Advanced Settings cowork#1213: the limits switch, server first, then Settings.
3. Web plumbing, in any order. On their own they change nothing a user sees: ENG-3444: Apply the tenant's per-task limits to web turns #577, mindsdb/scratchpad-controller#89, mindsdb/scratchpad-controller#90, ENG-3444: Pin that controller liveness keeps a quiet web turn alive, and describe it cowork-server#696.
4. Held until the web 60-minute limit (the rest of ENG-3444) lands:
   • ENG-3443: Raise the built-in turn limits to safety limits #576. The web pod image follows a moving tag that anton's CI rebuilds on every push to staging and on every release (minds-anton-scratchpad:staging / :production, pulled with Always), so merging ENG-3443: Raise the built-in turn limits to safety limits #576 is itself the web rollout of its higher defaults, with nothing on the wire. Today a long web task stops at 25 steps with a summary; at 250 it runs on until the controller's 600 s hard timeout ends it with "This turn took too long and was stopped", and the user loses the summary.
   • ENG-3444: Send the tenant's per-task limits to web turns cowork-server#694, which sends each tenant's limits to web turns (after #693 and #695), with the same effect.

mindsdb/cowork_evals#35 can merge at any time.

The wire is skew-safe in any order. An older controller drops the block (_build_request is an allowlist) and params accepts any key. An older pod ignores an unknown request key. A pod with no block keeps anton's defaults.

🤖 Generated with Claude Code