AbstractRuntime 0.8.2__tar.gz → 0.8.4__tar.gz

{abstractruntime-0.8.2 → abstractruntime-0.8.4}/.github/workflows/ci.yml

@@ -60,6 +60,7 @@ jobs:
             tests/test_abstractcore_comms_facade.py \
             tests/test_abstractcore_discovery_facade.py \
             tests/test_automation_definition.py \
+            tests/test_automation_email_results.py \
             tests/test_automation_tool_approval.py \
             tests/test_default_tools_comms_gating.py \
             tests/test_every_path_bearing_tool_is_walled.py \

{abstractruntime-0.8.2 → abstractruntime-0.8.4}/CHANGELOG.md

@@ -7,6 +7,28 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+Nothing yet.
+
+## [0.8.4] - 2026-10-02
+
+- Automations accept `context.growing.max_tokens` at creation and revision, defaulting to 50,000 tokens. Whole-turn history and admitted retry inputs are preserved.
+- Email-enabled automations produce a result notification for every completed occurrence, with the full answer and configurable `notify.recipients`.
+
+## [0.8.3] - 2026-10-01
+
+
+### Added
+
+- `integrations.abstractcore.mcp_facade`: opens a stdio or HTTP MCP client (a stdio server starts
+  with exactly the environment given), turns a server's tool into an `mcp::<server>::<tool>` spec
+  without its URL, and runs `tools/call` with the runtime's result mapping. The gateway calls
+  registered MCP servers through it.
+
+### Changed
+
+- An automation run started by an email from someone else (untrusted input) is never offered an MCP
+  tool: every `mcp::...` name leaves its tool lists and is never granted, even when named.
+
 ## [0.8.2] - 2026-10-01
 
 Pausing an automation also stops its retries. Requires AbstractCore 2.20.2 (unchanged).

{abstractruntime-0.8.2 → abstractruntime-0.8.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: AbstractRuntime
-Version: 0.8.2
+Version: 0.8.4
 Summary: AbstractRuntime: a durable graph runner designed to pair with AbstractCore.
 Project-URL: AbstractCore (website), https://www.abstractcore.ai/
 Project-URL: AbstractRuntime (GitHub), https://github.com/lpalbou/abstractruntime

{abstractruntime-0.8.2 → abstractruntime-0.8.4}/docs/automations.md

@@ -318,7 +318,7 @@ controller is woken with `max_steps=0`; the host (or `drive_automation`) then ti
 | | Independent (default) | Growing |
 |---|---|---|
 | Session | a new session per occurrence, named after its attempt-1 run id | the automation's session, `automation:<automation_id>` |
-| History given to the occurrence | none | the automation's previous turns as `input_data.context.messages`: the most recent 50,000 tokens of whole turns (the session history window) |
+| History given to the occurrence | none | the automation's previous turns as `input_data.context.messages`: the most recent whole turns within the configured token budget (50,000 tokens by default) (the session history window) |
 | `use_context` given to the target | `false` | `true` |
 | `_meta.occurrence.session_kind` | `occurrence` | `automation` |
 
@@ -514,7 +514,7 @@ Automations are **quiet by default**. An occurrence creates an attention item on
 - its output carries `notify: true`: the item's title is the automation title and its body is the answer, cut to 280
   characters;
 - its output carries `notify: {title, body}`: title at most 120 characters (the automation title when empty), body at
-  most 2,000 characters. A missing, `false` or empty `notify` stays quiet;
+  most 2,000 characters. A missing, `false` or empty `notify` stays quiet unless result email is enabled;
 - it **failed after its last retry**: the title is "<automation title> failed" and the body is the error. A failure
   that a retry fixed is quiet, and so is a cancelled occurrence.
 
@@ -523,7 +523,7 @@ with its end-node values or `{success, result}`. An output with `success: false`
 must flag a result adds `notify` next to its answer.
 
 Each notify or final failure creates exactly one attention item per occurrence. The item is carried by the The item's `channels` repeats the definition's `notify.channels`; a host that delivers notifications by email
-mails the owner when `email` is listed.
+emails every completed result when `email` is listed. `notify.recipients` selects delivery addresses (default `["self"]`); the full answer is retained for email while console previews stay bounded.
 occurrence's `automation.completed` record with a per-automation sequence number.
 
 `list_attention(ledger_store, automation_id, *, after_seq=0, cursor=None, limit=50)` returns
@@ -685,7 +685,7 @@ receives its result directly.
   event source yet.
 - Occurrences run one at a time (`serial`), missed ticks coalesce, and a failed occurrence never stops the
   automation (`failure: "continue"`). These policies cannot be changed.
-- Growing history is the most recent 50,000 tokens of whole turns and is not summarized automatically; older turns
+- Growing history is the most recent whole turns within the configured token budget (50,000 tokens by default) and is not summarized automatically; older turns
   drop out of the replay (they stay in the store).
 - Tools outside `TOOL_EFFECT_CLASSES`, such as third-party MCP tools, still ask for approval under `auto`.
 - Retries repeat external effects.
@@ -701,3 +701,14 @@ receives its result directly.
 - [email.md](email.md): email accounts, the `email.received@1` trigger and the send-email action
 - [faq.md](faq.md): common questions
 - [troubleshooting.md](troubleshooting.md#an-automation-does-not-fire): symptom-oriented fixes
+
+## Growing context limit
+
+Choose **Growing** to set **Max growing context (tokens)** when creating or editing an
+automation. The default is 50,000; enter `30000` for a 30,000-token history budget.
+The limit is hidden for **Independent** runs. Changing it affects subsequent occurrences;
+already admitted occurrences retain their history for retries. History retains whole turns,
+including the newest turn even when that turn alone exceeds the budget.
+
+The API field is `context.growing.max_tokens`, a positive integer. Existing definitions
+that omit it retain the 50,000-token default.

{abstractruntime-0.8.2 → abstractruntime-0.8.4}/llms-full.txt

@@ -3839,7 +3839,7 @@ controller is woken with `max_steps=0`; the host (or `drive_automation`) then ti
 | | Independent (default) | Growing |
 |---|---|---|
 | Session | a new session per occurrence, named after its attempt-1 run id | the automation's session, `automation:<automation_id>` |
-| History given to the occurrence | none | the automation's previous turns as `input_data.context.messages`: the most recent 50,000 tokens of whole turns (the session history window) |
+| History given to the occurrence | none | the automation's previous turns as `input_data.context.messages`: the most recent whole turns within the configured token budget (50,000 tokens by default) (the session history window) |
 | `use_context` given to the target | `false` | `true` |
 | `_meta.occurrence.session_kind` | `occurrence` | `automation` |
 
@@ -4035,7 +4035,7 @@ Automations are **quiet by default**. An occurrence creates an attention item on
 - its output carries `notify: true`: the item's title is the automation title and its body is the answer, cut to 280
   characters;
 - its output carries `notify: {title, body}`: title at most 120 characters (the automation title when empty), body at
-  most 2,000 characters. A missing, `false` or empty `notify` stays quiet;
+  most 2,000 characters. A missing, `false` or empty `notify` stays quiet unless result email is enabled;
 - it **failed after its last retry**: the title is "<automation title> failed" and the body is the error. A failure
   that a retry fixed is quiet, and so is a cancelled occurrence.
 
@@ -4044,7 +4044,7 @@ with its end-node values or `{success, result}`. An output with `success: false`
 must flag a result adds `notify` next to its answer.
 
 Each notify or final failure creates exactly one attention item per occurrence. The item is carried by the The item's `channels` repeats the definition's `notify.channels`; a host that delivers notifications by email
-mails the owner when `email` is listed.
+emails every completed result when `email` is listed. `notify.recipients` selects delivery addresses (default `["self"]`); the full answer is retained for email while console previews stay bounded.
 occurrence's `automation.completed` record with a per-automation sequence number.
 
 `list_attention(ledger_store, automation_id, *, after_seq=0, cursor=None, limit=50)` returns
@@ -4206,7 +4206,7 @@ receives its result directly.
   event source yet.
 - Occurrences run one at a time (`serial`), missed ticks coalesce, and a failed occurrence never stops the
   automation (`failure: "continue"`). These policies cannot be changed.
-- Growing history is the most recent 50,000 tokens of whole turns and is not summarized automatically; older turns
+- Growing history is the most recent whole turns within the configured token budget (50,000 tokens by default) and is not summarized automatically; older turns
   drop out of the replay (they stay in the store).
 - Tools outside `TOOL_EFFECT_CLASSES`, such as third-party MCP tools, still ask for approval under `auto`.
 - Retries repeat external effects.
@@ -4223,6 +4223,17 @@ receives its result directly.
 - [faq.md](faq.md): common questions
 - [troubleshooting.md](troubleshooting.md#an-automation-does-not-fire): symptom-oriented fixes
 
+## Growing context limit
+
+Choose **Growing** to set **Max growing context (tokens)** when creating or editing an
+automation. The default is 50,000; enter `30000` for a 30,000-token history budget.
+The limit is hidden for **Independent** runs. Changing it affects subsequent occurrences;
+already admitted occurrences retain their history for retries. History retains whole turns,
+including the newest turn even when that turn alone exceeds the budget.
+
+The API field is `context.growing.max_tokens`, a positive integer. Existing definitions
+that omit it retain the 50,000-token default.
+
 
 ==============================================================================
 # FILE: docs/tool-approval.md

{abstractruntime-0.8.2 → abstractruntime-0.8.4}/llms.txt

@@ -57,7 +57,7 @@
 - [MCP worker](docs/mcp-worker.md): `abstractruntime-mcp-worker` CLI (stdio/HTTP)
 - [Comms toolset](docs/tools-comms.md): email enabled by the host (`email_enabled=True`, no env flag); WhatsApp/Telegram env gating
 - [Email](docs/email.md): one user, one runtime, one mailbox: `_runtime.email_account` binding resolved at call time through `Runtime.set_email_context_resolver` (credentials never in vars, ledger or results), `send_email_recipient@v2` (unattended only to self or to the definition's `policy.email_allowed_recipients`), the resolver's `use` (`agent_tool` / `action`) so a host's agent-tools switch gates agent tools only, large structured tool outputs offloaded to attachments, durable event inbox (`JsonFileEventInbox`, retention 90 days / 10,000 events via `prune_email_inbox`) filled by `EmailInboxFeeder.poll` (read-only, per-message cursor, UIDVALIDITY resync, typed failures with backoff), the `email.received@1` trigger (typed filters, batches every `every`, each message once, untrusted input: messages and framed prompt stored as artifacts (refs only in the controller's records), frame markers with a per-occurrence random boundary, and "allow all tools" granting by kind only (no network egress beyond configured services, no execution, no messaging, no writes outside the workspace (the memory-writing tools included), no delegation; anything else only when named in `policy.untrusted_input_tools`, sending tools never; under "ask" nothing runs unasked but the named tools, and the executor's static defaults never decide for an untrusted run or its children)) and the send-email action (fixed-placeholder templates)
-- [Automations](docs/automations.md): an automation is a durable controller run that starts its target as deterministic child runs (occurrences) on `schedule@1` (fixed UTC intervals, coalesced missed ticks) or `manual@1`; `create_automation`, `apply_automation_command` (pause, resume, run_now, revise, stop_current, archive; idempotent per `command_id`), independent or growing context, `start_discussion` (fork at any occurrence N, seeded with the timeline 1..N, own writable workspace, the automation's workspace mounted read-only via `_runtime.workspace_read_only_paths`: file writes refused inside, reads and commands allowed), `policy.tool_approval` (`auto` or `ask`), `policy.email_allowed_recipients`, `notify.channels`, the `email.received@1` trigger, typed `pending_waits`, `notify` attention items and retries; storage guarantees: `create_if_absent`, `run_mutation_lock`, turn roots and `session_kind` in the run index, one writer process per store, `Runtime.start` refusing session starts it cannot attribute
+- [Automations](docs/automations.md): configurable growing-context budgets and result email; an automation is a durable controller run that starts its target as deterministic child runs (occurrences) on `schedule@1` (fixed UTC intervals, coalesced missed ticks) or `manual@1`; `create_automation`, `apply_automation_command` (pause, resume, run_now, revise, stop_current, archive; idempotent per `command_id`), independent or growing context, `start_discussion` (fork at any occurrence N, seeded with the timeline 1..N, own writable workspace, the automation's workspace mounted read-only via `_runtime.workspace_read_only_paths`: file writes refused inside, reads and commands allowed), `policy.tool_approval` (`auto` or `ask`), `policy.email_allowed_recipients`, `notify.channels`, the `email.received@1` trigger, typed `pending_waits`, `notify` attention items and retries; storage guarantees: `create_if_absent`, `run_mutation_lock`, turn roots and `session_kind` in the run index, one writer process per store, `Runtime.start` refusing session starts it cannot attribute
 - [Tool approval](docs/tool-approval.md): tool risk tiers, the run-policy rank ceiling, and per-call refiners
 - [Entity runtime](docs/entity-runtime.md): per-entity runtimes, homes, the one-writer lease, act-only diary privacy, and durable visit waits
 - [Models, engines and host jobs](docs/integrations/abstractcore.md#models-engines-and-host-jobs-config-facade): `config_facade` passthroughs for hosts; `host_job_cancel(job_id, *, by="api", user=None)` records who cancelled a job

{abstractruntime-0.8.2 → abstractruntime-0.8.4}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "AbstractRuntime"
-version = "0.8.2"
+version = "0.8.4"
 description = "AbstractRuntime: a durable graph runner designed to pair with AbstractCore."
 readme = "README.md"
 requires-python = ">=3.10"

abstractruntime-0.8.4/release-notes.md

@@ -0,0 +1,2 @@
+- Automations accept `context.growing.max_tokens` at creation and revision, defaulting to 50,000 tokens. Whole-turn history and admitted retry inputs are preserved.
+- Email-enabled automations produce a result notification for every completed occurrence, with the full answer and configurable `notify.recipients`.

{abstractruntime-0.8.2 → abstractruntime-0.8.4}/src/abstractruntime/automation_queries.py

@@ -23,6 +23,7 @@ from .automations.controller import current_occurrence as _current_occurrence
 from .automations.controller import next_fire_at as _next_fire_at
 from .automations.models import AUTOMATION_STATUSES, automation_status
 from .core.models import RunState, RunStatus, WaitReason
+from .session_history import HISTORY_REPLAY_MAX_TOKENS
 
 # Upper bound for one automation's index scan (occurrence rows, controllers).
 # Rows are column-only and cheap; a bound keeps a runaway store from turning a
@@ -116,6 +117,7 @@ def automation_summary(controller: RunState) -> Dict[str, Any]:
         "revision": definition.get("revision"),
         "trigger": definition.get("trigger"),
         "context_mode": context.get("mode", "independent"),
+        "growing_max_tokens": context.get("growing", {}).get("max_tokens", HISTORY_REPLAY_MAX_TOKENS),
         "target": definition.get("target"),
         "session_id": controller.session_id,
         "workspace_root": definition.get("workspace_root"),

{abstractruntime-0.8.2 → abstractruntime-0.8.4}/src/abstractruntime/automations/attention.py

@@ -289,6 +289,9 @@ def list_attention(
             item["body"] = att["body"]
         # Delivery channels (definition schema v2 `notify.channels`; absent on older records).
         item["channels"] = list(att.get("channels") or ["console"])
+        if "email_result" in att:
+            item["email_result"] = att["email_result"]
+            item["recipients"] = list(att.get("recipients") or ["self"])
         items.append(item)
     items.sort(key=lambda it: it["seq"])
     page = items[:limit]

{abstractruntime-0.8.2 → abstractruntime-0.8.4}/src/abstractruntime/automations/controller.py

@@ -320,7 +320,17 @@ def _never_granted(name: str) -> bool:
     `send` network reach (`agora_post_message`, `agora_send_dm`, which have no core row)."""
     from ..integrations.abstractcore.tool_effects import sends_messages
 
-    return _grant_excludes(name) or sends_messages(name)
+    return _grant_excludes(name) or sends_messages(name) or _is_mcp_tool(name)
+
+
+# Tools of registered MCP servers (`mcp::<server>::<tool>`, AbstractCore's naming): external
+# programs whose effects no fact table here describes. A run that reads text written by other
+# people is never offered one and never granted one, named or not.
+_MCP_TOOL_PREFIX = "mcp::"
+
+
+def _is_mcp_tool(name: Any) -> bool:
+    return str(name or "").strip().startswith(_MCP_TOOL_PREFIX)
 
 
 # `_runtime.untrusted_input = True`: the run reads text written by other people (an inbound
@@ -368,12 +378,13 @@ def grant_tool_approval(
     beyond configured services, no code or command execution, no messaging, no
     writes outside the run's workspace, no delegation). Every other tool
     (`fetch_url`, `skim_url`, `web_search`, `execute_command`, `shell_exec`,
-    `execute_python`, `delegate_agent`, `channel_fs_write`, MCP tools...) is
+    `execute_python`, `delegate_agent`, `channel_fs_write`...) is
     granted only when the user NAMED it individually in the definition
     (`policy.untrusted_input_tools`, passed as `named_tools`), and only within
     the target's tool ceiling. Message-sending tools (`send_email`,
     `reply_email`, `agora_post_message`, `agora_send_dm`, ...) are never
-    granted, named or not. A withheld call asks a person. Schedule and manual
+    granted, named or not. MCP tools (`mcp::<server>::<tool>`) leave the run's tool lists
+    and are never granted. A withheld call asks a person. Schedule and manual
     automations keep the full grant (decision recorded in 0992).
 
     Untrusted input under `approval="ask"` (framework backlog 0992 re-gate): the
@@ -397,6 +408,15 @@ def grant_tool_approval(
         if not untrusted_input:
             return
         replaced_target_policy = True
+    mcp_withheld: list = []
+    if untrusted_input:
+        # Untrusted input: every MCP tool leaves the run's tool lists (the agent's `tools` input and
+        # the `_runtime.allowed_tools` ceiling), so the model is never offered one.
+        for holder, key in ((input_data, "tools"), (runtime_ns, "allowed_tools")):
+            raw = holder.get(key)
+            if isinstance(raw, list) and any(_is_mcp_tool(t) for t in raw):
+                mcp_withheld += [str(t).strip() for t in raw if _is_mcp_tool(t)]
+                holder[key] = [t for t in raw if not _is_mcp_tool(t)]
     allowed = runtime_ns.get("allowed_tools")
     names = allowed if isinstance(allowed, list) else list(TOOL_EFFECT_CLASSES)
     candidates = sorted({n.strip() for n in names if isinstance(n, str) and n.strip()})
@@ -413,6 +433,7 @@ def grant_tool_approval(
     else:
         withheld = [n for n in candidates if _grant_excludes(n)]
     tools = [n for n in candidates if n not in withheld]
+    withheld = withheld + sorted(set(mcp_withheld) - set(withheld))
     policy: Dict[str, Any] = {"auto_approve_tools": tools, "withheld_tools": withheld, "source": AUTOMATION_GRANT_SOURCE}
     if untrusted_input:
         policy.update(
@@ -516,7 +537,7 @@ def build_prepared(
         )
     apply_context_mode(input_data, mode=definition["context"]["mode"])
     if definition["context"]["mode"] == "growing":
-        from ..session_history import session_chat_messages
+        from ..session_history import HISTORY_REPLAY_MAX_TOKENS, session_chat_messages
 
         messages = session_chat_messages(
             run_store=turn.run_store,
@@ -524,6 +545,7 @@ def build_prepared(
             artifact_store=turn.artifact_store,
             session_id=definition["session_id"],
             automation_id=turn.automation_id,
+            max_tokens=definition["context"].get("growing", {}).get("max_tokens", HISTORY_REPLAY_MAX_TOKENS),
             strict=True,
         )
         context = input_data.get("context") if isinstance(input_data.get("context"), dict) else {}
@@ -788,8 +810,10 @@ def complete_occurrence(turn: Turn, *, status: str, outcome: Optional[Dict[str,
     attention = None
     notify = None
     seq = int(state.get("attention_seq") or 0)
+    delivery = definition_notify(definition)
+    email_result = "email" in delivery["channels"] and status == "completed"
     if status == "completed" and outcome is not None:
-        notify = notify_payload(outcome.get("notify"), title=definition["title"], answer=outcome.get("answer") or "")
+        notify = notify_payload(True if email_result else outcome.get("notify"), title=definition["title"], answer=outcome.get("answer") or "")
         if notify is not None:
             seq += 1
             attention = {"kind": "notify", "seq": seq, **notify}
@@ -800,7 +824,10 @@ def complete_occurrence(turn: Turn, *, status: str, outcome: Optional[Dict[str,
     if attention is not None:
         # Where the item is delivered (schema v2 `notify.channels`): "email" asks the host's
         # notification dispatcher to mail the owner (framework backlog 0992 B5/C5).
-        attention["channels"] = list(definition_notify(definition)["channels"])
+        attention["channels"] = list(delivery["channels"])
+        if email_result:
+            attention["email_result"] = str((outcome or {}).get("answer") or "")
+            attention["recipients"] = list(delivery.get("recipients", ["self"]))
     last_outcome = {
         "run_id": pending["run_id"],
         "index": int(pending["index"]),

{abstractruntime-0.8.2 → abstractruntime-0.8.4}/src/abstractruntime/automations/models.py

@@ -254,14 +254,18 @@ def validate_context(value: Any) -> Dict[str, Any]:
     if mode not in CONTEXT_MODES:
         raise _invalid(f"context.mode must be one of {list(CONTEXT_MODES)}", "context.mode")
     growing = _require_mapping(ctx.get("growing", {}), "context.growing")
-    _reject_unknown(growing, ("summary",), "context.growing")
+    _reject_unknown(growing, ("summary", "max_tokens"), "context.growing")
     if "summary" in growing:
         raise _invalid(
             "automatic growing-mode summaries are not supported in v1",
             "context.growing.summary",
             reason_code="unsupported_feature",
         )
-    return {"mode": mode, "growing": {}}
+    if "max_tokens" in growing:
+        limit = growing["max_tokens"]
+        if isinstance(limit, bool) or not isinstance(limit, int) or limit <= 0:
+            raise _invalid("Max growing context must be a positive whole number of tokens", "context.growing.max_tokens")
+    return {"mode": mode, "growing": dict(growing)}
 
 
 def _duration(value: Any, field: str) -> str:
@@ -272,13 +276,12 @@ def _duration(value: Any, field: str) -> str:
     return value
 
 
-def validate_email_allowed_recipients(value: Any) -> list:
+def validate_email_allowed_recipients(value: Any, *, field: str = "policy.email_allowed_recipients") -> list:
     """`["self" | "name@example.test", ...]`, lower-cased and de-duplicated (order kept).
 
     Exact addresses only: no display names, groups, domains or patterns (a pre-authorisation
     must name the person). Empty list = nobody, not even self, runs unattended.
     """
-    field = "policy.email_allowed_recipients"
     if not isinstance(value, list):
         raise _invalid(f"{field} must be a list of 'self' or email addresses", field)
     if len(value) > MAX_EMAIL_ALLOWED_RECIPIENTS:
@@ -332,7 +335,7 @@ def validate_notify(value: Any) -> Dict[str, Any]:
     dispatcher mails the owner's registered address).
     """
     notify = _require_mapping(value if value is not None else {}, "notify")
-    _reject_unknown(notify, ("channels",), "notify")
+    _reject_unknown(notify, ("channels", "recipients"), "notify")
     channels = notify.get("channels", DEFAULT_NOTIFY["channels"])
     if not isinstance(channels, list) or not channels:
         raise _invalid(f"notify.channels must be a non-empty list of {list(NOTIFY_CHANNELS)}", "notify.channels")
@@ -342,7 +345,13 @@ def validate_notify(value: Any) -> Dict[str, Any]:
             raise _invalid(f"notify.channels[{i}] must be one of {list(NOTIFY_CHANNELS)}", f"notify.channels[{i}]")
         if ch not in out:
             out.append(ch)
-    return {"channels": [c for c in NOTIFY_CHANNELS if c in out]}
+    result = {"channels": [c for c in NOTIFY_CHANNELS if c in out]}
+    if "recipients" in notify:
+        recipients = validate_email_allowed_recipients(notify["recipients"], field="notify.recipients")
+        if not recipients:
+            raise _invalid("Choose at least one result recipient", "notify.recipients")
+        result["recipients"] = recipients
+    return result
 
 
 def validate_policy(value: Any) -> Dict[str, Any]:

abstractruntime-0.8.4/src/abstractruntime/integrations/abstractcore/mcp_facade.py

@@ -0,0 +1,120 @@
+"""AbstractCore's MCP clients, reached through AbstractRuntime (the gateway's import boundary).
+
+The gateway may not import `abstractcore` directly (tests/test_gateway_import_boundary.py). Everything
+it needs to test a registered MCP server and to call that server's tools from a run lives here:
+
+- `open_mcp_client`: a connected-on-demand client for one server (stdio or Streamable HTTP). A stdio
+  server starts with exactly the environment given (`inherit_env=False`), so no gateway secret leaks
+  into a third-party process.
+- `mcp_tool_spec`: one server tool as the spec agents see, named `mcp::<server>::<tool>`.
+- `call_mcp_tool`: one `tools/call`, mapped to the runtime's tool result convention
+  `(success, output, error)` (the same mapping `McpToolExecutor` uses).
+- the client error classes, for callers that turn failures into sentences.
+
+Requires the AbstractCore MCP clients with `initialize()` and `inherit_env` (abstractcore round 3).
+"""
+from __future__ import annotations
+
+from typing import Any, Dict, Mapping, Optional, Sequence, Tuple
+
+from abstractcore.mcp import (  # noqa: F401 - re-exported names
+    MCP_TOOL_PREFIX,
+    McpClient,
+    McpServerInfo,
+    McpStdioClient,
+    mcp_tool_to_abstractcore_tool_spec,
+    namespaced_tool_name,
+    parse_namespaced_tool_name,
+)
+from abstractcore.mcp.client import McpError, McpHttpError, McpProtocolError, McpRpcError  # noqa: F401
+
+
+def is_mcp_tool_name(name: Any) -> bool:
+    """True for a namespaced MCP tool name (`mcp::<server>::<tool>`)."""
+    return parse_namespaced_tool_name(str(name or "")) is not None
+
+
+def open_mcp_client(
+    *,
+    transport: str,
+    command: str = "",
+    args: Sequence[str] = (),
+    cwd: Optional[str] = None,
+    env: Optional[Mapping[str, str]] = None,
+    url: str = "",
+    headers: Optional[Mapping[str, str]] = None,
+    timeout_s: Optional[float] = 30.0,
+    client_name: str = "abstractgateway",
+) -> Any:
+    """A client for one MCP server. stdio starts the process now (raises FileNotFoundError and
+    friends when it cannot start); http connects on the first request. Call `initialize()` first."""
+    if transport == "stdio":
+        if not str(command or "").strip():
+            raise ValueError("a stdio MCP server needs a command")
+        return McpStdioClient(
+            command=[str(command)] + [str(a) for a in args],
+            cwd=cwd or None,
+            env=dict(env or {}),
+            inherit_env=False,
+            timeout_s=timeout_s,
+            client_name=client_name,
+        )
+    if transport == "http":
+        if not str(url or "").strip():
+            raise ValueError("an http MCP server needs a URL")
+        return McpClient(url=str(url), headers=dict(headers or {}), timeout_s=timeout_s, client_name=client_name)
+    raise ValueError(f"unknown MCP transport {transport!r} (stdio or http)")
+
+
+def close_mcp_client(client: Any) -> None:
+    """Close the client; a stdio server still running afterwards is killed."""
+    try:
+        client.close()
+    except Exception:  # noqa: BLE001
+        pass
+    proc = getattr(client, "_proc", None)
+    if proc is not None and proc.poll() is None:
+        try:
+            proc.kill()
+            proc.wait(timeout=2)
+        except Exception:  # noqa: BLE001
+            pass
+
+
+def mcp_tool_spec(*, server_id: str, tool: Dict[str, Any], transport: str) -> Dict[str, Any]:
+    """The agent-facing spec of one MCP tool ({name: mcp::<server>::<tool>, description, parameters,
+    tags, origin}). `tool` is a tools/list entry ({name, description, inputSchema}). The origin carries
+    the server id and transport only — never a URL, header or command."""
+    server = McpServerInfo(server_id=server_id, url=f"{transport}://{server_id}", transport=transport)
+    spec = mcp_tool_to_abstractcore_tool_spec(tool, server=server)
+    origin = dict(spec.get("origin") or {})
+    origin.pop("url", None)
+    spec["origin"] = origin
+    return spec
+
+
+def call_mcp_tool(client: Any, *, tool_name: str, arguments: Optional[Dict[str, Any]] = None) -> Tuple[bool, Any, Optional[str]]:
+    """One tools/call → (success, output, error). Raises the client's errors (the caller words them)."""
+    from .tool_executor import _mcp_result_to_error, _mcp_result_to_output
+
+    result = client.call_tool(name=tool_name, arguments=dict(arguments or {}))
+    err = _mcp_result_to_error(result)
+    if err is not None:
+        return False, None, err
+    return True, _mcp_result_to_output(result), None
+
+
+__all__ = [
+    "MCP_TOOL_PREFIX",
+    "McpError",
+    "McpHttpError",
+    "McpProtocolError",
+    "McpRpcError",
+    "call_mcp_tool",
+    "close_mcp_client",
+    "is_mcp_tool_name",
+    "mcp_tool_spec",
+    "namespaced_tool_name",
+    "open_mcp_client",
+    "parse_namespaced_tool_name",
+]

{abstractruntime-0.8.2 → abstractruntime-0.8.4}/tests/test_automation_definition.py

@@ -166,3 +166,16 @@ def test_the_longest_accepted_interval_runs():
     binding = {"binding_id": "b", "source_id": "schedule", "source_version": 1, "config": cfg}
     state = a.admit(binding, state=a.initial_state(cfg), now=NOW)["state"]
     assert a.prepare(binding, state=state, now=NOW)["until"] == "2027-01-02T00:00:00+00:00"
+
+
+@pytest.mark.parametrize("limit", [0, -1, True, False, 1.5, "30000", None])
+def test_growing_context_rejects_invalid_token_limit(limit):
+    with pytest.raises(AutomationError) as exc:
+        _build(context={"mode": "growing", "growing": {"max_tokens": limit}})
+    assert exc.value.field == "context.growing.max_tokens"
+
+
+def test_growing_context_keeps_custom_token_limit():
+    assert _build(context={"mode": "growing", "growing": {"max_tokens": 30_000}})["context"] == {
+        "mode": "growing", "growing": {"max_tokens": 30_000},
+    }

abstractruntime-0.8.4/tests/test_automation_email_results.py

@@ -0,0 +1,59 @@
+"""Email result is a user delivery choice, independent of model notifications."""
+
+import pytest
+
+from automation_harness import Clock, at, children, drive, make_runtime, make_stores, request
+from abstractruntime.automations import apply_automation_command, create_automation, get_automation
+from abstractruntime.automations.attention import list_attention
+from abstractruntime.automations.models import AutomationError, validate_notify
+
+
+@pytest.mark.parametrize("store", ["json", "sqlite"])
+@pytest.mark.parametrize("model_notify", [None, False, {"title": "Short notice", "body": "Only a summary"}])
+def test_email_result_delivers_full_answer_and_revised_recipients(tmp_path, monkeypatch, store, model_notify):
+    runtime = make_runtime(*make_stores(store, tmp_path))
+    clock = Clock(monkeypatch)
+    req = request(input_data={"prompt": "Full result " * 1000, "notify": model_notify})
+    req["notify"] = {"channels": ["console", "email"], "recipients": ["self", "FIRST@example.test"]}
+    aid, _ = create_automation(runtime, req, now=clock.now)
+    drive(runtime, aid)
+    first = children(runtime, aid)[0]
+    [item] = list_attention(runtime.ledger_store, aid)["items"]
+    assert item["email_result"] == first.output["response"]
+    assert len(item["email_result"]) > 2000
+    assert item["recipients"] == ["self", "first@example.test"]
+    # Choosing result recipients never grants model tools permission to email them.
+    assert first.vars["_runtime"]["email_allowed_recipients"] == ["self"]
+    revised = apply_automation_command(runtime, automation_id=aid, command_id="change-recipient",
+        type="automation.revise", now=clock.now,
+        payload={"changes": {"notify": {"channels": ["console", "email"], "recipients": ["second@example.test"]}}})
+    assert revised["status"] == "applied"
+    at(runtime, clock, aid, "2026-01-01T00:02:00+00:00")
+    items = list_attention(runtime.ledger_store, aid)["items"]
+    assert [i["recipients"] for i in items] == [["self", "first@example.test"], ["second@example.test"]]
+    assert get_automation(runtime.run_store, aid)["definition"]["policy"]["email_allowed_recipients"] == ["self"]
+    disabled = apply_automation_command(runtime, automation_id=aid, command_id="disable-email-result",
+        type="automation.revise", now=clock.now,
+        payload={"changes": {"notify": {"channels": ["console"]}}})
+    assert disabled["status"] == "applied"
+    at(runtime, clock, aid, "2026-01-01T00:04:00+00:00")
+    assert len(children(runtime, aid)) == 3
+    final_items = list_attention(runtime.ledger_store, aid)["items"]
+    # A model-authored notice may remain, but opt-out never carries an email result.
+    assert [i["index"] for i in final_items if "email_result" in i] == [1, 2]
+
+
+@pytest.mark.parametrize("store", ["json", "sqlite"])
+def test_console_only_quiet_run_stays_quiet(tmp_path, monkeypatch, store):
+    runtime = make_runtime(*make_stores(store, tmp_path))
+    clock = Clock(monkeypatch)
+    aid, _ = create_automation(runtime, request(input_data={"prompt": "Quiet", "notify": False}), now=clock.now)
+    drive(runtime, aid)
+    assert list_attention(runtime.ledger_store, aid)["items"] == []
+
+
+@pytest.mark.parametrize("recipients", [[], "self", ["bad"], ["Name <a@example.test>"], [True]])
+def test_result_recipient_validation_reports_notify_field(recipients):
+    with pytest.raises(AutomationError) as exc:
+        validate_notify({"channels": ["email"], "recipients": recipients})
+    assert exc.value.field.startswith("notify.recipients")

{abstractruntime-0.8.2 → abstractruntime-0.8.4}/tests/test_automation_growing_context.py

@@ -159,3 +159,42 @@ def test_the_context_mode_decides_use_context_not_a_stale_target_input(env, tmp_
     fork = runtime.get_state(started["run_id"])
     assert fork.vars["use_context"] is True
     assert fork.vars["_runtime"]["automation_context"] == {"mode": "discussion", "use_context": True, "target_use_context": False}
+
+
+@pytest.mark.parametrize("env", STORES, indirect=True)
+def test_custom_growing_budget_is_persisted_and_revised_for_future_runs(env):
+    from automation_harness import request
+    from abstractruntime.automations import create_automation, get_automation, apply_automation_command
+    from abstractruntime.core.models import RunState
+
+    runtime, clock = env
+    req = request(mode="growing")
+    req["context"]["growing"] = {"max_tokens": 30_000}
+    aid, _ = create_automation(runtime, req, now=clock.now)
+    # Enough complete turns to exceed both windows, without an oversized turn.
+    for i in range(30):
+        ts = f"2025-12-31T23:{i:02d}:00+00:00"
+        runtime.run_store.save(RunState(
+            run_id=f"budget-prior-{i}", workflow_id="echo", status=RunStatus.COMPLETED, current_node="done",
+            vars={"prompt": f"question {i}"}, output={"response": "word " * 3000},
+            created_at=ts, updated_at=ts, session_id=f"automation:{aid}", actor_id="t",
+        ))
+    drive(runtime, aid)
+    first = children(runtime, aid)[0]
+    receipt = first.vars["_runtime"]["session_history"]
+    assert receipt["max_tokens"] == 30_000
+    assert 0 < receipt["replayed_tokens"] <= 30_000 and receipt["dropped_messages"] > 0
+    result = apply_automation_command(runtime, automation_id=aid, command_id="budget-revise",
+        type="automation.revise", now=clock.now,
+        payload={"changes": {"context": {"mode": "growing", "growing": {"max_tokens": 10_000}}}})
+    assert result["status"] == "applied"
+    detail = get_automation(runtime.run_store, aid)
+    assert detail["definition"]["context"]["growing"]["max_tokens"] == 10_000
+    from abstractruntime.automation_queries import automation_summary
+    assert automation_summary(runtime.get_state(aid))["growing_max_tokens"] == 10_000
+    at(runtime, clock, aid, "2026-01-01T00:02:00+00:00")
+    second = children(runtime, aid)[1]
+    assert second.vars["_runtime"]["session_history"]["max_tokens"] == 10_000
+    assert second.vars["_runtime"]["session_history"]["replayed_tokens"] <= 10_000
+    assert len(second.vars["context"]["messages"]) < len(first.vars["context"]["messages"])
+    assert runtime.get_state(first.run_id).vars["_runtime"]["session_history"]["max_tokens"] == 30_000