AbstractRuntime 0.8.1__tar.gz → 0.8.3__tar.gz

{abstractruntime-0.8.1 → abstractruntime-0.8.3}/CHANGELOG.md

@@ -7,6 +7,37 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+Nothing yet.
+
+## [0.8.3] - 2026-10-01
+
+
+### Added
+
+- `integrations.abstractcore.mcp_facade`: opens a stdio or HTTP MCP client (a stdio server starts
+  with exactly the environment given), turns a server's tool into an `mcp::<server>::<tool>` spec
+  without its URL, and runs `tools/call` with the runtime's result mapping. The gateway calls
+  registered MCP servers through it.
+
+### Changed
+
+- An automation run started by an email from someone else (untrusted input) is never offered an MCP
+  tool: every `mcp::...` name leaves its tool lists and is never granted, even when named.
+
+## [0.8.2] - 2026-10-01
+
+Pausing an automation also stops its retries. Requires AbstractCore 2.20.2 (unchanged).
+
+### Changed
+- `automation.pause` also stops retries: an occurrence waiting in retry backoff is cancelled
+  (quietly, like `stop_current`), and a scheduled attempt that fails while the automation is paused
+  completes `failed` without a retry. An attempt already running still finishes, and a manual run
+  (`run_now`, allowed while paused) keeps its retries.
+
+### Notes
+- A retry that is waiting in backoff when you pause an automation is cancelled instead of starting
+  after its backoff. Resume the automation, or use `run_now`, to run it again.
+
 ## [0.8.1] - 2026-09-30
 
 Email automations never trigger themselves, speech and images work without a buildable text model,

{abstractruntime-0.8.1 → abstractruntime-0.8.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: AbstractRuntime
-Version: 0.8.1
+Version: 0.8.3
 Summary: AbstractRuntime: a durable graph runner designed to pair with AbstractCore.
 Project-URL: AbstractCore (website), https://www.abstractcore.ai/
 Project-URL: AbstractRuntime (GitHub), https://github.com/lpalbou/abstractruntime
@@ -55,7 +55,7 @@ Description-Content-Type: text/markdown
 
 It is designed for long-running workflows that must survive restarts and explicitly model blocking (human input, timers, external events, subworkflows) without keeping Python stacks alive.
 
-**Version:** 0.8.1 • **Python:** 3.10+
+**Version:** 0.8.2 • **Python:** 3.10+
 
 **Status:** pre-1.0 (API may evolve). For production use, pin versions and follow `CHANGELOG.md`.
 
@@ -147,7 +147,7 @@ state = rt.resume(
 assert state.status.value == "completed"
 ```
 
-## What’s included (v0.8.1)
+## What’s included (v0.8.2)
 
 Kernel (import-light):
 - workflow graphs: `WorkflowSpec` (`src/abstractruntime/core/spec.py`)

{abstractruntime-0.8.1 → abstractruntime-0.8.3}/README.md

@@ -4,7 +4,7 @@
 
 It is designed for long-running workflows that must survive restarts and explicitly model blocking (human input, timers, external events, subworkflows) without keeping Python stacks alive.
 
-**Version:** 0.8.1 • **Python:** 3.10+
+**Version:** 0.8.2 • **Python:** 3.10+
 
 **Status:** pre-1.0 (API may evolve). For production use, pin versions and follow `CHANGELOG.md`.
 
@@ -96,7 +96,7 @@ state = rt.resume(
 assert state.status.value == "completed"
 ```
 
-## What’s included (v0.8.1)
+## What’s included (v0.8.2)
 
 Kernel (import-light):
 - workflow graphs: `WorkflowSpec` (`src/abstractruntime/core/spec.py`)

{abstractruntime-0.8.1 → abstractruntime-0.8.3}/docs/architecture.md

@@ -1,7 +1,7 @@
 # AbstractRuntime — Architecture
 
-> Updated: 2026-09-29
-> Version: 0.8.1
+> Updated: 2026-10-01
+> Version: 0.8.2
 > Scope: this describes **what is implemented in this repository**.
 
 AbstractRuntime is a **durable workflow runtime**: it executes workflow graphs as a persisted state machine with explicit waits (user, time, events, jobs, subworkflows). A run can pause for hours/days and resume **without** keeping Python stacks/coroutines alive.

{abstractruntime-0.8.1 → abstractruntime-0.8.3}/docs/automations.md

@@ -286,7 +286,7 @@ expected_revision=None, now=None)` is the only way to change an automation. It r
 
 | Type | Effect | Rejected with |
 |---|---|---|
-| `automation.pause` | Stops **scheduled** admissions. The current occurrence and its retries finish, and `run_now` still works. This is separate from the runtime's own pause. | `invalid_state` when archived or finished |
+| `automation.pause` | Stops **scheduled** admissions. An attempt already running finishes, but no retry follows: an occurrence waiting in retry backoff is cancelled (quietly), and a scheduled attempt that fails while paused completes `failed` without a retry. `run_now` still works (a manual run keeps its retries). This is separate from the runtime's own pause. | `invalid_state` when archived or finished |
 | `automation.resume` | Re-arms the schedule at the first tick after now. It never fires on resume and never catches up the paused time. Resuming an automation that is not paused is an applied no-op. | `invalid_state` when archived or finished |
 | `automation.run_now` | Runs one occurrence at the controller's next step, even while paused (the automation stays paused). There is no queue. | `automation_busy` while an occurrence or a manual run is pending; `invalid_state` when archived, finished or exhausted |
 | `automation.revise` | `payload.changes = {title?, target?, trigger?, context?, policy?}` (at least one). `title`, `target`, `trigger` and `context` are replaced whole; `policy` fields are merged, so a field you do not send keeps its value. The next revision applies from the controller's next step. A changed trigger gets a new binding and is re-armed after now, so no past tick fires; an unchanged trigger keeps its binding. | `invalid_state` when archived or finished; the definition's own reason codes for invalid changes |

{abstractruntime-0.8.1 → abstractruntime-0.8.3}/llms-full.txt

@@ -53,7 +53,7 @@ See llms.txt for the linked index.
 
 It is designed for long-running workflows that must survive restarts and explicitly model blocking (human input, timers, external events, subworkflows) without keeping Python stacks alive.
 
-**Version:** 0.8.1 • **Python:** 3.10+
+**Version:** 0.8.2 • **Python:** 3.10+
 
 **Status:** pre-1.0 (API may evolve). For production use, pin versions and follow `CHANGELOG.md`.
 
@@ -145,7 +145,7 @@ state = rt.resume(
 assert state.status.value == "completed"
 ```
 
-## What’s included (v0.8.1)
+## What’s included (v0.8.2)
 
 Kernel (import-light):
 - workflow graphs: `WorkflowSpec` (`src/abstractruntime/core/spec.py`)
@@ -431,8 +431,8 @@ rt = create_local_runtime(provider="ollama", model="qwen3:4b")
 
 # AbstractRuntime — Architecture
 
-> Updated: 2026-09-29
-> Version: 0.8.1
+> Updated: 2026-10-01
+> Version: 0.8.2
 > Scope: this describes **what is implemented in this repository**.
 
 AbstractRuntime is a **durable workflow runtime**: it executes workflow graphs as a persisted state machine with explicit waits (user, time, events, jobs, subworkflows). A run can pause for hours/days and resume **without** keeping Python stacks/coroutines alive.
@@ -3807,7 +3807,7 @@ expected_revision=None, now=None)` is the only way to change an automation. It r
 
 | Type | Effect | Rejected with |
 |---|---|---|
-| `automation.pause` | Stops **scheduled** admissions. The current occurrence and its retries finish, and `run_now` still works. This is separate from the runtime's own pause. | `invalid_state` when archived or finished |
+| `automation.pause` | Stops **scheduled** admissions. An attempt already running finishes, but no retry follows: an occurrence waiting in retry backoff is cancelled (quietly), and a scheduled attempt that fails while paused completes `failed` without a retry. `run_now` still works (a manual run keeps its retries). This is separate from the runtime's own pause. | `invalid_state` when archived or finished |
 | `automation.resume` | Re-arms the schedule at the first tick after now. It never fires on resume and never catches up the paused time. Resuming an automation that is not paused is an applied no-op. | `invalid_state` when archived or finished |
 | `automation.run_now` | Runs one occurrence at the controller's next step, even while paused (the automation stays paused). There is no queue. | `automation_busy` while an occurrence or a manual run is pending; `invalid_state` when archived, finished or exhausted |
 | `automation.revise` | `payload.changes = {title?, target?, trigger?, context?, policy?}` (at least one). `title`, `target`, `trigger` and `context` are replaced whole; `policy` fields are merged, so a field you do not send keeps its value. The next revision applies from the controller's next step. A changed trigger gets a new binding and is re-armed after now, so no past tick fires; an unchanged trigger keeps its binding. | `invalid_state` when archived or finished; the definition's own reason codes for invalid changes |

{abstractruntime-0.8.1 → abstractruntime-0.8.3}/llms.txt

@@ -3,7 +3,7 @@
 > Durable workflow runtime (interrupt → checkpoint → resume) with an append-only execution ledger.
 
 - Python: 3.10+ (see `pyproject.toml`)
-- Version: 0.8.1
+- Version: 0.8.2
 - Ecosystem: [AbstractFramework](https://github.com/lpalbou/AbstractFramework) umbrella, integrates with [AbstractCore](https://github.com/lpalbou/abstractcore)
 - Hard invariant: `RunState.vars` must be JSON-serializable (`src/abstractruntime/core/models.py`)
 - Current AbstractCore baseline: base `abstractruntime` requires AbstractCore 2.20.2 or newer with its light install (remote providers, tools and the MCP worker, media routing); `abstractruntime[apple]` and `abstractruntime[gpu]` require AbstractCore's `apple` and `gpu` settings (`pyproject.toml`)

{abstractruntime-0.8.1 → abstractruntime-0.8.3}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "AbstractRuntime"
-version = "0.8.1"
+version = "0.8.3"
 description = "AbstractRuntime: a durable graph runner designed to pair with AbstractCore."
 readme = "README.md"
 requires-python = ">=3.10"

abstractruntime-0.8.3/release-notes.md

@@ -0,0 +1,11 @@
+### Added
+
+- `integrations.abstractcore.mcp_facade`: opens a stdio or HTTP MCP client (a stdio server starts
+  with exactly the environment given), turns a server's tool into an `mcp::<server>::<tool>` spec
+  without its URL, and runs `tools/call` with the runtime's result mapping. The gateway calls
+  registered MCP servers through it.
+
+### Changed
+
+- An automation run started by an email from someone else (untrusted input) is never offered an MCP
+  tool: every `mcp::...` name leaves its tool lists and is never granted, even when named.

{abstractruntime-0.8.1 → abstractruntime-0.8.3}/src/abstractruntime/automations/commands.py

@@ -13,8 +13,11 @@ record, controller wake, child cancellation), so a crash after the decision
 never loses them. Domain rejections are returned, never raised.
 
 Semantics:
-- pause: gates SCHEDULED admission only (never the runtime pause gate); the
-  current occurrence, including its retries, finishes; run_now stays allowed.
+- pause: gates SCHEDULED admission (never the runtime pause gate); an attempt
+  already running finishes, but no retry follows while paused: an occurrence
+  waiting in retry backoff is cancelled (quiet), and a scheduled attempt that
+  fails while paused completes `failed` without a retry. run_now stays allowed
+  (a manual occurrence started while paused keeps its retries).
 - resume: re-arms the trigger at the first tick after now; never fires.
 - run_now: records `manual_pending` (admitted at the controller's next
   boundary); rejected `automation_busy` while an occurrence or a manual run is
@@ -91,7 +94,13 @@ def _decide(
     if command_type == "automation.pause":
         if archived or terminal:
             return _reject("invalid_state", "An archived or finished automation cannot be paused.")
-        return {"delta": {"state": {"paused": True}}}
+        pause_state: Dict[str, Any] = {"paused": True}
+        pending = state.get("pending_occurrence")
+        if not state.get("paused") and isinstance(pending, dict) and pending.get("phase") == "backoff":
+            # A retry only waiting for its backoff never starts after a pause (N3): the
+            # occurrence is cancelled at the controller's next boundary, like stop_current.
+            pause_state["pending_occurrence"] = {**pending, "stop_requested": True}
+        return {"delta": {"state": pause_state}}
 
     if command_type == "automation.resume":
         if archived or terminal:

{abstractruntime-0.8.1 → abstractruntime-0.8.3}/src/abstractruntime/automations/controller.py

@@ -320,7 +320,17 @@ def _never_granted(name: str) -> bool:
     `send` network reach (`agora_post_message`, `agora_send_dm`, which have no core row)."""
     from ..integrations.abstractcore.tool_effects import sends_messages
 
-    return _grant_excludes(name) or sends_messages(name)
+    return _grant_excludes(name) or sends_messages(name) or _is_mcp_tool(name)
+
+
+# Tools of registered MCP servers (`mcp::<server>::<tool>`, AbstractCore's naming): external
+# programs whose effects no fact table here describes. A run that reads text written by other
+# people is never offered one and never granted one, named or not.
+_MCP_TOOL_PREFIX = "mcp::"
+
+
+def _is_mcp_tool(name: Any) -> bool:
+    return str(name or "").strip().startswith(_MCP_TOOL_PREFIX)
 
 
 # `_runtime.untrusted_input = True`: the run reads text written by other people (an inbound
@@ -368,12 +378,13 @@ def grant_tool_approval(
     beyond configured services, no code or command execution, no messaging, no
     writes outside the run's workspace, no delegation). Every other tool
     (`fetch_url`, `skim_url`, `web_search`, `execute_command`, `shell_exec`,
-    `execute_python`, `delegate_agent`, `channel_fs_write`, MCP tools...) is
+    `execute_python`, `delegate_agent`, `channel_fs_write`...) is
     granted only when the user NAMED it individually in the definition
     (`policy.untrusted_input_tools`, passed as `named_tools`), and only within
     the target's tool ceiling. Message-sending tools (`send_email`,
     `reply_email`, `agora_post_message`, `agora_send_dm`, ...) are never
-    granted, named or not. A withheld call asks a person. Schedule and manual
+    granted, named or not. MCP tools (`mcp::<server>::<tool>`) leave the run's tool lists
+    and are never granted. A withheld call asks a person. Schedule and manual
     automations keep the full grant (decision recorded in 0992).
 
     Untrusted input under `approval="ask"` (framework backlog 0992 re-gate): the
@@ -397,6 +408,15 @@ def grant_tool_approval(
         if not untrusted_input:
             return
         replaced_target_policy = True
+    mcp_withheld: list = []
+    if untrusted_input:
+        # Untrusted input: every MCP tool leaves the run's tool lists (the agent's `tools` input and
+        # the `_runtime.allowed_tools` ceiling), so the model is never offered one.
+        for holder, key in ((input_data, "tools"), (runtime_ns, "allowed_tools")):
+            raw = holder.get(key)
+            if isinstance(raw, list) and any(_is_mcp_tool(t) for t in raw):
+                mcp_withheld += [str(t).strip() for t in raw if _is_mcp_tool(t)]
+                holder[key] = [t for t in raw if not _is_mcp_tool(t)]
     allowed = runtime_ns.get("allowed_tools")
     names = allowed if isinstance(allowed, list) else list(TOOL_EFFECT_CLASSES)
     candidates = sorted({n.strip() for n in names if isinstance(n, str) and n.strip()})
@@ -413,6 +433,7 @@ def grant_tool_approval(
     else:
         withheld = [n for n in candidates if _grant_excludes(n)]
     tools = [n for n in candidates if n not in withheld]
+    withheld = withheld + sorted(set(mcp_withheld) - set(withheld))
     policy: Dict[str, Any] = {"auto_approve_tools": tools, "withheld_tools": withheld, "source": AUTOMATION_GRANT_SOURCE}
     if untrusted_input:
         policy.update(
@@ -856,7 +877,10 @@ def record_outcome(turn: Turn) -> str:
         return "next"
     retry = pending.get("retry") or {"max_attempts": 1}
     attempt = int(pending["attempt"])
-    if attempt < int(retry["max_attempts"]):
+    # Paused: a SCHEDULED occurrence gets no further attempt (N3); a manual one (run_now,
+    # allowed while paused, `command_id` set) keeps its retries.
+    retry_blocked = bool(state.get("paused")) and pending.get("command_id") is None
+    if attempt < int(retry["max_attempts"]) and not retry_blocked:
         retry_at = add_delay(turn.now, backoff_delay({"retry": retry}, attempt))
         turn.decide(
             "automation.retry_scheduled",

abstractruntime-0.8.3/src/abstractruntime/integrations/abstractcore/mcp_facade.py

@@ -0,0 +1,120 @@
+"""AbstractCore's MCP clients, reached through AbstractRuntime (the gateway's import boundary).
+
+The gateway may not import `abstractcore` directly (tests/test_gateway_import_boundary.py). Everything
+it needs to test a registered MCP server and to call that server's tools from a run lives here:
+
+- `open_mcp_client`: a connected-on-demand client for one server (stdio or Streamable HTTP). A stdio
+  server starts with exactly the environment given (`inherit_env=False`), so no gateway secret leaks
+  into a third-party process.
+- `mcp_tool_spec`: one server tool as the spec agents see, named `mcp::<server>::<tool>`.
+- `call_mcp_tool`: one `tools/call`, mapped to the runtime's tool result convention
+  `(success, output, error)` (the same mapping `McpToolExecutor` uses).
+- the client error classes, for callers that turn failures into sentences.
+
+Requires the AbstractCore MCP clients with `initialize()` and `inherit_env` (abstractcore round 3).
+"""
+from __future__ import annotations
+
+from typing import Any, Dict, Mapping, Optional, Sequence, Tuple
+
+from abstractcore.mcp import (  # noqa: F401 - re-exported names
+    MCP_TOOL_PREFIX,
+    McpClient,
+    McpServerInfo,
+    McpStdioClient,
+    mcp_tool_to_abstractcore_tool_spec,
+    namespaced_tool_name,
+    parse_namespaced_tool_name,
+)
+from abstractcore.mcp.client import McpError, McpHttpError, McpProtocolError, McpRpcError  # noqa: F401
+
+
+def is_mcp_tool_name(name: Any) -> bool:
+    """True for a namespaced MCP tool name (`mcp::<server>::<tool>`)."""
+    return parse_namespaced_tool_name(str(name or "")) is not None
+
+
+def open_mcp_client(
+    *,
+    transport: str,
+    command: str = "",
+    args: Sequence[str] = (),
+    cwd: Optional[str] = None,
+    env: Optional[Mapping[str, str]] = None,
+    url: str = "",
+    headers: Optional[Mapping[str, str]] = None,
+    timeout_s: Optional[float] = 30.0,
+    client_name: str = "abstractgateway",
+) -> Any:
+    """A client for one MCP server. stdio starts the process now (raises FileNotFoundError and
+    friends when it cannot start); http connects on the first request. Call `initialize()` first."""
+    if transport == "stdio":
+        if not str(command or "").strip():
+            raise ValueError("a stdio MCP server needs a command")
+        return McpStdioClient(
+            command=[str(command)] + [str(a) for a in args],
+            cwd=cwd or None,
+            env=dict(env or {}),
+            inherit_env=False,
+            timeout_s=timeout_s,
+            client_name=client_name,
+        )
+    if transport == "http":
+        if not str(url or "").strip():
+            raise ValueError("an http MCP server needs a URL")
+        return McpClient(url=str(url), headers=dict(headers or {}), timeout_s=timeout_s, client_name=client_name)
+    raise ValueError(f"unknown MCP transport {transport!r} (stdio or http)")
+
+
+def close_mcp_client(client: Any) -> None:
+    """Close the client; a stdio server still running afterwards is killed."""
+    try:
+        client.close()
+    except Exception:  # noqa: BLE001
+        pass
+    proc = getattr(client, "_proc", None)
+    if proc is not None and proc.poll() is None:
+        try:
+            proc.kill()
+            proc.wait(timeout=2)
+        except Exception:  # noqa: BLE001
+            pass
+
+
+def mcp_tool_spec(*, server_id: str, tool: Dict[str, Any], transport: str) -> Dict[str, Any]:
+    """The agent-facing spec of one MCP tool ({name: mcp::<server>::<tool>, description, parameters,
+    tags, origin}). `tool` is a tools/list entry ({name, description, inputSchema}). The origin carries
+    the server id and transport only — never a URL, header or command."""
+    server = McpServerInfo(server_id=server_id, url=f"{transport}://{server_id}", transport=transport)
+    spec = mcp_tool_to_abstractcore_tool_spec(tool, server=server)
+    origin = dict(spec.get("origin") or {})
+    origin.pop("url", None)
+    spec["origin"] = origin
+    return spec
+
+
+def call_mcp_tool(client: Any, *, tool_name: str, arguments: Optional[Dict[str, Any]] = None) -> Tuple[bool, Any, Optional[str]]:
+    """One tools/call → (success, output, error). Raises the client's errors (the caller words them)."""
+    from .tool_executor import _mcp_result_to_error, _mcp_result_to_output
+
+    result = client.call_tool(name=tool_name, arguments=dict(arguments or {}))
+    err = _mcp_result_to_error(result)
+    if err is not None:
+        return False, None, err
+    return True, _mcp_result_to_output(result), None
+
+
+__all__ = [
+    "MCP_TOOL_PREFIX",
+    "McpError",
+    "McpHttpError",
+    "McpProtocolError",
+    "McpRpcError",
+    "call_mcp_tool",
+    "close_mcp_client",
+    "is_mcp_tool_name",
+    "mcp_tool_spec",
+    "namespaced_tool_name",
+    "open_mcp_client",
+    "parse_namespaced_tool_name",
+]

{abstractruntime-0.8.1 → abstractruntime-0.8.3}/tests/test_automation_commands.py

@@ -234,6 +234,72 @@ def test_stop_current_during_backoff_cancels_the_retry(env):
     assert [d["status"] for d in done] == ["cancelled"]
 
 
+@pytest.mark.parametrize("env", STORES, indirect=True)
+def test_pause_during_backoff_cancels_the_retry(env):
+    """N3: a pause lands while the occurrence only waits for its retry: no attempt 2."""
+    runtime, clock = env
+    aid = create(runtime, clock, workflow_id="flaky", input_data={"prompt": "p", "fail_until": 99}, trigger=HOURLY)
+    drive(runtime, aid)
+    assert automation_state(runtime, aid)["pending_occurrence"]["phase"] == "backoff"
+    clock.set("2026-01-01T00:00:05+00:00")
+    assert cmd(runtime, aid, "p", "pause", "2026-01-01T00:00:05+00:00")["status"] == "applied"
+    drive(runtime, aid)
+    at(runtime, clock, aid, "2026-01-01T00:00:31+00:00")  # past the retry time
+    assert len(children(runtime, aid)) == 1  # attempt 2 never started
+    done = [r["payload"] for r in automation_records(runtime.ledger_store, aid, "automation.completed")]
+    assert [(d["status"], d["attention"]) for d in done] == [("cancelled", None)]
+    st = automation_state(runtime, aid)
+    assert st["paused"] is True and st["pending_occurrence"] is None
+    assert get_automation(runtime.run_store, aid)["status"] == "paused"
+
+
+@pytest.mark.parametrize("env", STORES, indirect=True)
+def test_an_attempt_failing_while_paused_is_not_retried(env):
+    """N3: the attempt running when the pause lands finishes; its failure schedules no retry."""
+    from abstractruntime.automations.bundle import controller_workflow_spec
+
+    runtime, clock = env
+    aid = create(runtime, clock, workflow_id="ask", trigger=HOURLY)
+    drive(runtime, aid)
+    child = children(runtime, aid)[0]
+    assert child.status == RunStatus.WAITING
+    assert cmd(runtime, aid, "p", "pause", "2026-01-01T00:01:00+00:00")["status"] == "applied"
+    assert runtime.get_state(child.run_id).status == RunStatus.WAITING  # a running attempt is not stopped
+    failed = runtime.run_store.load(child.run_id)
+    failed.status = RunStatus.FAILED
+    failed.error = "boom while paused"
+    failed.waiting = None
+    runtime.run_store.save(failed)
+    ctl = runtime.get_state(aid)
+    runtime.resume(workflow=controller_workflow_spec(), run_id=aid, wait_key=ctl.waiting.wait_key,
+                   payload={"sub_run_id": child.run_id, "output": {"success": False, "error": "boom while paused"}}, max_steps=0)
+    drive(runtime, aid)
+    at(runtime, clock, aid, "2026-01-01T00:10:00+00:00")  # well past a 30 s backoff
+    assert len(children(runtime, aid)) == 1
+    assert list(automation_records(runtime.ledger_store, aid, "automation.retry_scheduled")) == []
+    done = [r["payload"] for r in automation_records(runtime.ledger_store, aid, "automation.completed")]
+    assert [(d["status"], d["attempts"]) for d in done] == [("failed", 1)]
+    assert automation_state(runtime, aid)["paused"] is True
+
+
+@pytest.mark.parametrize("env", STORES, indirect=True)
+def test_a_manual_run_while_paused_keeps_its_retries(env):
+    runtime, clock = env
+    aid = create(runtime, clock, workflow_id="flaky", input_data={"prompt": "p", "fail_until": 2}, trigger=HOURLY)
+    drive(runtime, aid)  # the 00:00 occurrence: attempt 1 fails, backoff
+    at(runtime, clock, aid, "2026-01-01T00:00:30+00:00")  # attempt 2 succeeds
+    cmd(runtime, aid, "p", "pause", "2026-01-01T00:05:00+00:00")
+    drive(runtime, aid)
+    clock.set("2026-01-01T00:06:00+00:00")
+    assert cmd(runtime, aid, "run-1", "run_now", "2026-01-01T00:06:00+00:00")["status"] == "applied"
+    drive(runtime, aid)
+    pending = automation_state(runtime, aid)["pending_occurrence"]
+    assert pending["phase"] == "backoff" and pending["attempt"] == 2 and pending["command_id"] == "run-1"
+    at(runtime, clock, aid, "2026-01-01T00:06:30+00:00")
+    done = [r["payload"] for r in automation_records(runtime.ledger_store, aid, "automation.completed")]
+    assert [(d["status"], d["attempts"]) for d in done] == [("completed", 2), ("completed", 2)]
+
+
 @pytest.mark.parametrize("env", STORES, indirect=True)
 def test_archive_lets_the_current_occurrence_finish_then_ends(env):
     runtime, clock = env

abstractruntime-0.8.3/tests/test_mcp_runs_untrusted_and_facade.py

@@ -0,0 +1,119 @@
+"""MCP tools in runs (round 3, lane mcp-runs): untrusted input never offers nor grants an MCP tool,
+and the facade the gateway calls MCP servers through (stdio, exact env, mcp::<server>::<tool>)."""
+from __future__ import annotations
+
+import sys
+import textwrap
+
+import pytest
+
+from abstractruntime.automations.controller import grant_tool_approval
+from abstractruntime.core.models import RunState, RunStatus
+from abstractruntime.integrations.abstractcore import mcp_facade
+from abstractruntime.integrations.abstractcore.effect_handlers import _execute_with_run_policy
+from abstractruntime.integrations.abstractcore.tool_executor import (
+    ApprovalToolExecutor,
+    MappingToolExecutor,
+    ToolApprovalPolicy,
+)
+
+MCP = "mcp::fake::echo"
+EXECUTED: list = []
+
+
+def _executor() -> ApprovalToolExecutor:
+    def _echo(**kw):
+        EXECUTED.append(MCP)
+        return kw
+
+    def _read(**kw):
+        EXECUTED.append("read_file")
+        return "x"
+
+    return ApprovalToolExecutor(delegate=MappingToolExecutor({MCP: _echo, "read_file": _read}), policy=ToolApprovalPolicy())
+
+
+def _run(runtime_ns) -> RunState:
+    return RunState(run_id="r", workflow_id="w", status=RunStatus.RUNNING, current_node="n", vars={"_runtime": runtime_ns})
+
+
+@pytest.fixture(autouse=True)
+def _clear():
+    EXECUTED.clear()
+
+
+@pytest.mark.parametrize("approval", ["auto", "ask"])
+def test_untrusted_occurrence_removes_every_mcp_tool_from_its_tool_lists(approval):
+    data = {"tools": ["read_file", MCP, "mcp::other::x"], "_runtime": {"allowed_tools": ["read_file", MCP]}}
+    grant_tool_approval(data, untrusted_input=True, named_tools=[MCP], approval=approval)
+    assert data["tools"] == ["read_file"]
+    assert data["_runtime"]["allowed_tools"] == ["read_file"]
+    pol = data["_runtime"]["tool_policy"]
+    assert MCP in pol["withheld_tools"] and "mcp::other::x" in pol["withheld_tools"]
+    assert MCP not in pol["auto_approve_tools"]
+
+
+def test_trusted_occurrence_keeps_mcp_tools():
+    """Control: a schedule/manual automation keeps them (and allow-all grants them)."""
+    data = {"tools": ["read_file", MCP], "_runtime": {"allowed_tools": ["read_file", MCP]}}
+    grant_tool_approval(data, untrusted_input=False, approval="auto")
+    assert data["tools"] == ["read_file", MCP]
+    assert MCP in data["_runtime"]["tool_policy"]["auto_approve_tools"]
+
+
+def test_untrusted_run_never_auto_runs_an_mcp_tool_even_named():
+    pol = {"auto_approve_tools": [MCP, "read_file"], "untrusted_input": True, "approval": "auto",
+           "untrusted_input_tools": [MCP, "read_file"]}
+    out = _execute_with_run_policy(_executor(), [{"name": MCP, "arguments": {}, "call_id": "1"}], _run({"tool_policy": pol}))
+    assert out["mode"] == "approval_required" and EXECUTED == []
+    # Control: the named non-MCP tool runs.
+    out = _execute_with_run_policy(_executor(), [{"name": "read_file", "arguments": {}, "call_id": "1"}], _run({"tool_policy": pol}))
+    assert out["mode"] == "executed" and EXECUTED == ["read_file"]
+
+
+def test_static_policy_asks_for_an_mcp_tool_and_allow_all_runs_it():
+    out = _execute_with_run_policy(_executor(), [{"name": MCP, "arguments": {}, "call_id": "1"}], _run({}))
+    assert out["mode"] == "approval_required" and EXECUTED == []
+    out = _execute_with_run_policy(_executor(), [{"name": MCP, "arguments": {}, "call_id": "1"}],
+                                   _run({"tool_policy": {"auto_approve_max_risk_rank": 4}}))
+    assert out["mode"] == "executed" and EXECUTED == [MCP]
+
+
+FAKE = textwrap.dedent(
+    """
+    import json, os, sys
+    for line in sys.stdin:
+        req = json.loads(line)
+        rid, m = req.get("id"), req.get("method")
+        if rid is None:
+            continue
+        if m == "initialize":
+            res = {"protocolVersion": "2025-06-18", "capabilities": {"tools": {}}, "serverInfo": {"name": "fake", "version": "1"}}
+        elif m == "tools/call":
+            a = req["params"]["arguments"]
+            res = {"content": [{"type": "text", "text": json.dumps({"echo": a.get("text"), "secret_env": os.environ.get("GW_SECRET")})}]}
+        else:
+            res = {"tools": [{"name": "echo", "description": "Echo text.", "inputSchema": {"type": "object", "properties": {"text": {"type": "string"}}, "required": ["text"]}}]}
+        sys.stdout.write(json.dumps({"jsonrpc": "2.0", "id": rid, "result": res}) + "\\n"); sys.stdout.flush()
+    """
+)
+
+
+def test_facade_calls_a_stdio_server_with_exactly_the_given_env(tmp_path, monkeypatch):
+    script = tmp_path / "fake.py"
+    script.write_text(FAKE)
+    monkeypatch.setenv("GW_SECRET", "must-not-leak")
+    client = mcp_facade.open_mcp_client(transport="stdio", command=sys.executable, args=[str(script)], cwd=str(tmp_path),
+                                        env={"PATH": "/usr/bin:/bin"}, timeout_s=10)
+    try:
+        client.initialize()
+        tools = client.list_tools()
+        ok, output, err = mcp_facade.call_mcp_tool(client, tool_name="echo", arguments={"text": "hi"})
+    finally:
+        mcp_facade.close_mcp_client(client)
+    assert (ok, err) == (True, None)
+    assert output == {"echo": "hi", "secret_env": None}
+    spec = mcp_facade.mcp_tool_spec(server_id="fake", tool=tools[0], transport="stdio")
+    assert spec["name"] == MCP and "text" in spec["parameters"]
+    assert "url" not in spec["origin"] and spec["origin"]["server_id"] == "fake"
+    assert mcp_facade.is_mcp_tool_name(MCP) and not mcp_facade.is_mcp_tool_name("read_file")

abstractruntime-0.8.1/release-notes.md

@@ -1,33 +0,0 @@
-Email automations never trigger themselves, speech and images work without a buildable text model,
-and a chat's mail to its owner runs without asking. Requires AbstractCore 2.20.2.
-
-### Added
-- Mail sent by an automation run (controller, occurrence, any run it starts, the send-email action)
-  is automatic mail: the run's `EmailContext` gets `automation_marker =
-  "automation:<automation id>/run:<run id>"`, so every send carries `Auto-Submitted` and
-  `X-AbstractFramework-Automation`. `automation_marker_for(vars, run_id)` is exported from
-  `abstractruntime.email.binding`. Chats and discussions send ordinary mail.
-- `email.received@1` config `auto_submitted`: `"skip"` (default) never admits a message whose
-  `Auto-Submitted` header is present and not `no`; `"admit"` lets it reach the filters. Stored
-  configs without the key behave like `"skip"`.
-- `EmailInboxFeeder(..., is_own_sent=callable)` and `PollReport.own_automatic`: the account's own
-  automatic mail (the framework marker from its own address, or a Message-ID the host recorded as
-  sent) never enters the event inbox.
-- `abstractruntime.integrations.abstractcore.run_facade.inline_run_active(run_id)`: true while the
-  run facade executes a child run in this process; host runners skip such runs.
-- `ToolApprovalPolicy.default_require_approval_tools`: the names on the require list only because
-  no list was given (the default caution list).
-
-### Changed
-- The pooled local client runs media-only requests (image, video, voice, music, transcription, no
-  tools) and streaming TTS on AbstractCore's capability host instead of building the default text
-  client: text-to-speech no longer fails when the text default cannot be built (for example an
-  MLX route on an install without MLX), and no text model is loaded for a media request.
-- Without a per-run tool policy, the `send_email_recipient@v2` refiner now also lowers a name that
-  is on the executor's default caution list (`send_email` under `ToolApprovalPolicy()`): a chat
-  run's send to its owner's own address runs without an approval wait. An explicitly passed
-  require list and a per-run policy's still win; email-triggered runs under `approval: "ask"` are
-  unchanged.
-
-### Dependencies
-- `abstractcore>=2.20.2` (also `[apple]` and `[gpu]`).