AbstractRuntime 0.8.4__tar.gz → 0.8.5__tar.gz

{abstractruntime-0.8.4 → abstractruntime-0.8.5}/CHANGELOG.md

@@ -9,6 +9,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 Nothing yet.
 
+## [0.8.5] - 2026-10-03
+
+- Hosts can serve AbstractCore ASGI requests through `integrations.abstractcore.server_facade.serve_core_request`, with independent request-scoped authentication preserved throughout streaming. Requires AbstractCore 2.24.0 or newer.
+
 ## [0.8.4] - 2026-10-02
 
 - Automations accept `context.growing.max_tokens` at creation and revision, defaulting to 50,000 tokens. Whole-turn history and admitted retry inputs are preserved.

{abstractruntime-0.8.4 → abstractruntime-0.8.5}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: AbstractRuntime
-Version: 0.8.4
+Version: 0.8.5
 Summary: AbstractRuntime: a durable graph runner designed to pair with AbstractCore.
 Project-URL: AbstractCore (website), https://www.abstractcore.ai/
 Project-URL: AbstractRuntime (GitHub), https://github.com/lpalbou/abstractruntime
@@ -20,7 +20,7 @@ Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
 Classifier: Programming Language :: Python :: 3.13
 Requires-Python: >=3.10
-Requires-Dist: abstractcore>=2.20.2
+Requires-Dist: abstractcore>=2.24.0
 Requires-Dist: abstractmemory>=0.3.0
 Requires-Dist: abstractsemantics>=0.0.5
 Requires-Dist: anyio<5.0.0,>=4.12.1
@@ -35,14 +35,14 @@ Requires-Dist: reportlab<5.0.0,>=4.0.0
 Requires-Dist: restrictedpython>=7.0
 Requires-Dist: unstructured[docx,odt,pptx,rtf,xlsx]<0.19.0,>=0.18.32
 Provides-Extra: apple
-Requires-Dist: abstractcore[apple]>=2.20.2; extra == 'apple'
+Requires-Dist: abstractcore[apple]>=2.24.0; extra == 'apple'
 Requires-Dist: setuptools<82.0.0,>=80.10.2; extra == 'apple'
 Provides-Extra: docs
 Requires-Dist: mkdocs-material>=9.0.0; extra == 'docs'
 Requires-Dist: mkdocs>=1.6.0; extra == 'docs'
 Requires-Dist: pymdown-extensions>=10.0; extra == 'docs'
 Provides-Extra: gpu
-Requires-Dist: abstractcore[gpu]>=2.20.2; extra == 'gpu'
+Requires-Dist: abstractcore[gpu]>=2.24.0; extra == 'gpu'
 Requires-Dist: setuptools<82.0.0,>=77.0.3; extra == 'gpu'
 Provides-Extra: test
 Requires-Dist: aiosmtpd<2.0.0,>=1.4.4; extra == 'test'
@@ -83,7 +83,7 @@ Remote-light runtime:
 pip install abstractruntime
 ```
 
-The base install includes AbstractCore 2.20.2 or newer (its light install:
+The base install includes AbstractCore 2.24.0 or newer (its light install:
 remote providers, tools, vision, voice, audio, and music integration), plus the
 `abstractruntime-mcp-worker` entry point. It keeps inference remote/light by
 default: local engines such as MLX, vLLM, HuggingFace/Torch, Diffusers, and

{abstractruntime-0.8.4 → abstractruntime-0.8.5}/README.md

@@ -32,7 +32,7 @@ Remote-light runtime:
 pip install abstractruntime
 ```
 
-The base install includes AbstractCore 2.20.2 or newer (its light install:
+The base install includes AbstractCore 2.24.0 or newer (its light install:
 remote providers, tools, vision, voice, audio, and music integration), plus the
 `abstractruntime-mcp-worker` entry point. It keeps inference remote/light by
 default: local engines such as MLX, vLLM, HuggingFace/Torch, Diffusers, and

{abstractruntime-0.8.4 → abstractruntime-0.8.5}/docs/api.md

@@ -302,7 +302,7 @@ from Core route resolution and persisted from `LLM_CALL` results.
 
 ### AbstractCore (LLM + tools)
 
-Requires: `pip install abstractruntime` (AbstractCore 2.20.2 or newer is part of the base install).
+Requires: `pip install abstractruntime` (AbstractCore 2.24.0 or newer is part of the base install).
 
 Implementation: `src/abstractruntime/integrations/abstractcore/*`.
 
@@ -391,3 +391,7 @@ This provides handlers for `MEMORY_KG_*` effects (opt-in wiring layer).
 - `architecture.md` — component map + durability invariants
 - `faq.md` — common questions and gotchas
 - `integrations/abstractcore.md` — `LLM_CALL` / `TOOL_CALLS` wiring
+
+### Host ASGI serving
+
+`abstractruntime.integrations.abstractcore.server_facade.serve_core_request(scope, receive, send, *, token: str, allow_unauthenticated: bool = False)` delegates host-admitted ASGI requests with request-scoped Core authentication. See [host-managed serving](integrations/abstractcore.md#host-managed-serving) for network and credential responsibilities.

{abstractruntime-0.8.4 → abstractruntime-0.8.5}/docs/getting-started.md

@@ -12,7 +12,7 @@ Remote-light runtime:
 pip install abstractruntime
 ```
 
-This installs AbstractCore 2.20.2 or newer with remote provider, vision,
+This installs AbstractCore 2.24.0 or newer with remote provider, vision,
 voice, audio, music, tool, and MCP-worker support. The base install is
 remote-light: it can route multimodal workflows to hosted or OpenAI-compatible
 endpoints, but it does not select local inferencer stacks such as MLX, vLLM,

{abstractruntime-0.8.4 → abstractruntime-0.8.5}/docs/integrations/abstractcore.md

@@ -16,7 +16,7 @@ Implementation pointers (this repo):
 pip install abstractruntime
 ```
 
-The base install includes AbstractCore 2.20.0 or newer. That is the supported baseline for the current server auth split (`Authorization` for server auth, `X-AbstractCore-Provider-API-Key` for provider overrides), generated-media contracts, image upscaling, capability catalog, prompt-cache control-plane endpoints (including session attribution via `/acore/prompt_cache/key_meta`), host memory snapshots, the host-wide loaded-model sweep used by residency listings, the process-wide MLX residency report and eject used by model unload, durable bloc prompt-cache helpers, bindings and lifecycle operations, task-aware model residency for text/image/video/TTS/STT, current tool catalog, AbstractCore's public output-selector contract, async/sync text-generation output-selector parity, video generation endpoints, the public local vision-cache catalog helper used by Runtime discovery, vision adapter discovery plus batch/LoRA media controls, and the released shared workspace/file-filter utility surface used by Runtime packaging and integration checks.
+The base install includes AbstractCore 2.24.0 or newer. That is the supported baseline for the current server auth split (`Authorization` for server auth, `X-AbstractCore-Provider-API-Key` for provider overrides), generated-media contracts, image upscaling, capability catalog, prompt-cache control-plane endpoints (including session attribution via `/acore/prompt_cache/key_meta`), host memory snapshots, the host-wide loaded-model sweep used by residency listings, the process-wide MLX residency report and eject used by model unload, durable bloc prompt-cache helpers, bindings and lifecycle operations, task-aware model residency for text/image/video/TTS/STT, current tool catalog, AbstractCore's public output-selector contract, async/sync text-generation output-selector parity, video generation endpoints, the public local vision-cache catalog helper used by Runtime discovery, vision adapter discovery plus batch/LoRA media controls, and the released shared workspace/file-filter utility surface used by Runtime packaging and integration checks.
 
 The base install also includes the remote-light media/capability plugins needed
 for AbstractCore's multimodal `generate(..., output=...)` path. Local
@@ -1168,3 +1168,19 @@ This is useful when building a `MappingToolExecutor` quickly.
 - `../architecture.md` — effect handler boundaries and durability invariants
 - `../tools-comms.md` — enabling email/WhatsApp/Telegram tools
 - `../adr/0002_execution_modes_local_remote_hybrid.md` — rationale for local/remote/hybrid
+
+## Host-managed serving
+
+Hosts that expose AbstractCore serving routes use
+`abstractruntime.integrations.abstractcore.server_facade.serve_core_request(scope, receive, send, *, token, allow_unauthenticated=False)`.
+The facade lazily loads the Core ASGI application and keeps the host's independent
+inbound authentication policy scoped to the entire response, including streamed
+bodies. Concurrent requests retain separate policies; cancellation and exceptions
+restore the previous policy.
+
+The host owns route admission, network exposure, origin checks, and token storage.
+Provide a nonempty token even for open access: absent Authorization is allowed when
+`allow_unauthenticated=True`, while any supplied Authorization must validate.
+Anonymous callers cannot use server-held cloud credentials; explicit provider
+keys use `X-AbstractCore-Provider-API-Key`. This serving facade does not create
+durable Runtime runs. The AbstractCore server dependencies must be installed.

{abstractruntime-0.8.4 → abstractruntime-0.8.5}/llms-full.txt

@@ -81,7 +81,7 @@ Remote-light runtime:
 pip install abstractruntime
 ```
 
-The base install includes AbstractCore 2.20.2 or newer (its light install:
+The base install includes AbstractCore 2.24.0 or newer (its light install:
 remote providers, tools, vision, voice, audio, and music integration), plus the
 `abstractruntime-mcp-worker` entry point. It keeps inference remote/light by
 default: local engines such as MLX, vLLM, HuggingFace/Torch, Diffusers, and
@@ -287,7 +287,7 @@ Remote-light runtime:
 pip install abstractruntime
 ```
 
-This installs AbstractCore 2.20.2 or newer with remote provider, vision,
+This installs AbstractCore 2.24.0 or newer with remote provider, vision,
 voice, audio, music, tool, and MCP-worker support. The base install is
 remote-light: it can route multimodal workflows to hosted or OpenAI-compatible
 endpoints, but it does not select local inferencer stacks such as MLX, vLLM,
@@ -1167,7 +1167,7 @@ from Core route resolution and persisted from `LLM_CALL` results.
 
 ### AbstractCore (LLM + tools)
 
-Requires: `pip install abstractruntime` (AbstractCore 2.20.2 or newer is part of the base install).
+Requires: `pip install abstractruntime` (AbstractCore 2.24.0 or newer is part of the base install).
 
 Implementation: `src/abstractruntime/integrations/abstractcore/*`.
 
@@ -1257,6 +1257,10 @@ This provides handlers for `MEMORY_KG_*` effects (opt-in wiring layer).
 - `faq.md` — common questions and gotchas
 - `integrations/abstractcore.md` — `LLM_CALL` / `TOOL_CALLS` wiring
 
+### Host ASGI serving
+
+`abstractruntime.integrations.abstractcore.server_facade.serve_core_request(scope, receive, send, *, token: str, allow_unauthenticated: bool = False)` delegates host-admitted ASGI requests with request-scoped Core authentication. See [host-managed serving](integrations/abstractcore.md#host-managed-serving) for network and credential responsibilities.
+
 
 ==============================================================================
 # FILE: docs/faq.md
@@ -1978,7 +1982,7 @@ Implementation pointers (this repo):
 pip install abstractruntime
 ```
 
-The base install includes AbstractCore 2.20.0 or newer. That is the supported baseline for the current server auth split (`Authorization` for server auth, `X-AbstractCore-Provider-API-Key` for provider overrides), generated-media contracts, image upscaling, capability catalog, prompt-cache control-plane endpoints (including session attribution via `/acore/prompt_cache/key_meta`), host memory snapshots, the host-wide loaded-model sweep used by residency listings, the process-wide MLX residency report and eject used by model unload, durable bloc prompt-cache helpers, bindings and lifecycle operations, task-aware model residency for text/image/video/TTS/STT, current tool catalog, AbstractCore's public output-selector contract, async/sync text-generation output-selector parity, video generation endpoints, the public local vision-cache catalog helper used by Runtime discovery, vision adapter discovery plus batch/LoRA media controls, and the released shared workspace/file-filter utility surface used by Runtime packaging and integration checks.
+The base install includes AbstractCore 2.24.0 or newer. That is the supported baseline for the current server auth split (`Authorization` for server auth, `X-AbstractCore-Provider-API-Key` for provider overrides), generated-media contracts, image upscaling, capability catalog, prompt-cache control-plane endpoints (including session attribution via `/acore/prompt_cache/key_meta`), host memory snapshots, the host-wide loaded-model sweep used by residency listings, the process-wide MLX residency report and eject used by model unload, durable bloc prompt-cache helpers, bindings and lifecycle operations, task-aware model residency for text/image/video/TTS/STT, current tool catalog, AbstractCore's public output-selector contract, async/sync text-generation output-selector parity, video generation endpoints, the public local vision-cache catalog helper used by Runtime discovery, vision adapter discovery plus batch/LoRA media controls, and the released shared workspace/file-filter utility surface used by Runtime packaging and integration checks.
 
 The base install also includes the remote-light media/capability plugins needed
 for AbstractCore's multimodal `generate(..., output=...)` path. Local
@@ -3131,6 +3135,22 @@ This is useful when building a `MappingToolExecutor` quickly.
 - `../tools-comms.md` — enabling email/WhatsApp/Telegram tools
 - `../adr/0002_execution_modes_local_remote_hybrid.md` — rationale for local/remote/hybrid
 
+## Host-managed serving
+
+Hosts that expose AbstractCore serving routes use
+`abstractruntime.integrations.abstractcore.server_facade.serve_core_request(scope, receive, send, *, token, allow_unauthenticated=False)`.
+The facade lazily loads the Core ASGI application and keeps the host's independent
+inbound authentication policy scoped to the entire response, including streamed
+bodies. Concurrent requests retain separate policies; cancellation and exceptions
+restore the previous policy.
+
+The host owns route admission, network exposure, origin checks, and token storage.
+Provide a nonempty token even for open access: absent Authorization is allowed when
+`allow_unauthenticated=True`, while any supplied Authorization must validate.
+Anonymous callers cannot use server-held cloud credentials; explicit provider
+keys use `X-AbstractCore-Provider-API-Key`. This serving facade does not create
+durable Runtime runs. The AbstractCore server dependencies must be installed.
+
 
 ==============================================================================
 # FILE: docs/proposal.md

{abstractruntime-0.8.4 → abstractruntime-0.8.5}/llms.txt

@@ -3,10 +3,10 @@
 > Durable workflow runtime (interrupt → checkpoint → resume) with an append-only execution ledger.
 
 - Python: 3.10+ (see `pyproject.toml`)
-- Version: 0.8.2
+- Version: 0.8.5
 - Ecosystem: [AbstractFramework](https://github.com/lpalbou/AbstractFramework) umbrella, integrates with [AbstractCore](https://github.com/lpalbou/abstractcore)
 - Hard invariant: `RunState.vars` must be JSON-serializable (`src/abstractruntime/core/models.py`)
-- Current AbstractCore baseline: base `abstractruntime` requires AbstractCore 2.20.2 or newer with its light install (remote providers, tools and the MCP worker, media routing); `abstractruntime[apple]` and `abstractruntime[gpu]` require AbstractCore's `apple` and `gpu` settings (`pyproject.toml`)
+- Current AbstractCore baseline: base `abstractruntime` requires AbstractCore 2.24.0 or newer with its light install (remote providers, tools and the MCP worker, media routing); `abstractruntime[apple]` and `abstractruntime[gpu]` require AbstractCore's `apple` and `gpu` settings (`pyproject.toml`)
 - Install profiles: base `abstractruntime` is remote-light with MCP, generated media routing, and Runtime-owned permissive PDF read/write nodes; `abstractruntime[apple]` and `abstractruntime[gpu]` add local inferencer stacks.
 - Config boundary: Runtime does not read `ABSTRACTGATEWAY_*`; Gateway-owned config should be translated into explicit Runtime inputs or Runtime-owned env names. Hosts can attach `resolve_provider_endpoint_profile(provider_id)` to the LLM client; Runtime treats it as an optional resolver hook, injects transient provider/base URL/key params for the call, and redacts secret-like params from persisted observability.
 

{abstractruntime-0.8.4 → abstractruntime-0.8.5}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "AbstractRuntime"
-version = "0.8.4"
+version = "0.8.5"
 description = "AbstractRuntime: a durable graph runner designed to pair with AbstractCore."
 readme = "README.md"
 requires-python = ">=3.10"
@@ -53,7 +53,7 @@ dependencies = [
   # plugins) without selecting local inference engines. 2.19.2 floors
   # abstractvision>=0.3.33, whose resident loads report `loaded_new` and whose
   # unload frees the pipeline (the resident media path relies on both).
-  "abstractcore>=2.20.2",
+  "abstractcore>=2.24.0",
   "openai<3.0.0,>=1.109.1",
   "httpx<1.0.0,>=0.28.1",
   "anyio<5.0.0,>=4.12.1",
@@ -70,12 +70,12 @@ dependencies = [
 
 [project.optional-dependencies]
 apple = [
-  "abstractcore[apple]>=2.20.2",
+  "abstractcore[apple]>=2.24.0",
   "setuptools<82.0.0,>=80.10.2",
 ]
 
 gpu = [
-  "abstractcore[gpu]>=2.20.2",
+  "abstractcore[gpu]>=2.24.0",
   # vLLM 0.9-0.19 caps setuptools below 80; 77.0.3 is still a modern floor.
   "setuptools<82.0.0,>=77.0.3",
 ]

abstractruntime-0.8.5/release-notes.md

@@ -0,0 +1 @@
+- Hosts can serve AbstractCore ASGI requests through `integrations.abstractcore.server_facade.serve_core_request`, with independent request-scoped authentication preserved throughout streaming. Requires AbstractCore 2.24.0 or newer.

abstractruntime-0.8.5/src/abstractruntime/integrations/abstractcore/server_facade.py

@@ -0,0 +1,32 @@
+"""Host-facing ASGI delegation to AbstractCore's serving application.
+
+Hosts own route admission, network policy, and token storage. This facade keeps
+Core imports behind Runtime's integration boundary and scopes authentication to
+one complete ASGI response, including streamed bodies.
+"""
+from __future__ import annotations
+
+import asyncio
+import importlib
+from typing import Any, Awaitable, Callable, MutableMapping
+
+
+async def serve_core_request(
+    scope: MutableMapping[str, Any],
+    receive: Callable[[], Awaitable[dict[str, Any]]],
+    send: Callable[[dict[str, Any]], Awaitable[None]],
+    *,
+    token: str,
+    allow_unauthenticated: bool = False,
+) -> None:
+    """Serve a host-admitted request using an independent inbound auth policy.
+
+    Requires the AbstractCore server dependencies. Importing this module does
+    not load Core or its application. The host must provide a nonempty token,
+    even when allowing anonymous requests; supplied credentials still validate.
+    """
+    module = await asyncio.to_thread(importlib.import_module, "abstractcore.server.app")
+    from abstractcore.server.auth_policy import ServerAuthPolicy, use_server_auth_policy
+
+    with use_server_auth_policy(ServerAuthPolicy(token, allow_unauthenticated)):
+        await module.app(scope, receive, send)

abstractruntime-0.8.5/tests/test_abstractcore_server_facade.py

@@ -0,0 +1,72 @@
+"""The host facade preserves ASGI streaming and request-local auth."""
+import asyncio
+import importlib
+import threading
+from types import SimpleNamespace
+
+import pytest
+
+from abstractruntime.integrations.abstractcore import server_facade
+from abstractcore.server.auth_policy import current_server_auth_policy
+
+pytestmark = pytest.mark.basic
+
+
+def test_concurrent_streams_keep_separate_auth_and_import_off_loop(monkeypatch):
+    main_thread = threading.get_ident()
+    imports = []
+    barrier = None
+    seen = []
+
+    async def app(scope, receive, send):
+        policy = current_server_auth_policy()
+        assert policy.token == scope["token"]
+        await send({"type": "http.response.start", "status": 200, "headers": []})
+        await send({"type": "http.response.body", "body": b"first", "more_body": True})
+        await barrier.wait()
+        assert current_server_auth_policy() is policy
+        seen.append((policy.token, policy.allow_unauthenticated))
+        await send({"type": "http.response.body", "body": b"last"})
+
+    def load(name):
+        imports.append((name, threading.get_ident()))
+        return SimpleNamespace(app=app)
+
+    monkeypatch.setattr(server_facade.importlib, "import_module", load)
+
+    async def run():
+        nonlocal barrier
+        barrier = asyncio.Event()
+        bodies = {"one": [], "two": []}
+        async def receive():
+            return {"type": "http.disconnect"}
+        async def invoke(token, anonymous):
+            async def send(message):
+                bodies[token].append(message)
+                if all(any(m.get("more_body") for m in messages) for messages in bodies.values()):
+                    barrier.set()
+            await server_facade.serve_core_request({"token": token}, receive, send, token=token, allow_unauthenticated=anonymous)
+            assert current_server_auth_policy() is None
+        await asyncio.gather(invoke("one", False), invoke("two", True))
+        assert all(messages[-1]["body"] == b"last" for messages in bodies.values())
+    asyncio.run(run())
+    assert sorted(seen) == [("one", False), ("two", True)]
+    assert all(name == "abstractcore.server.app" and thread != main_thread for name, thread in imports)
+
+
+@pytest.mark.parametrize("error", [RuntimeError("stream failed"), asyncio.CancelledError()])
+def test_policy_resets_on_failure_or_cancellation(monkeypatch, error):
+    async def app(scope, receive, send):
+        assert current_server_auth_policy().token == "managed"
+        await asyncio.sleep(0)
+        raise error
+    monkeypatch.setattr(server_facade.importlib, "import_module", lambda name: SimpleNamespace(app=app))
+    async def run():
+        async def receive():
+            return {"type": "http.disconnect"}
+        async def send(message):
+            pass
+        with pytest.raises(type(error)):
+            await server_facade.serve_core_request({}, receive, send, token="managed")
+        assert current_server_auth_policy() is None
+    asyncio.run(run())

{abstractruntime-0.8.4 → abstractruntime-0.8.5}/tests/test_packaging_extras.py

@@ -52,7 +52,7 @@ def test_runtime_base_is_remote_light_with_multimodal_and_mcp_support() -> None:
     assert "abstractcore = [" not in text
     assert "multimodal = [" not in text
     assert "mcp-worker = [" not in text
-    assert '"abstractcore>=2.20.2"' in text
+    assert '"abstractcore>=2.24.0"' in text
     # Only AbstractCore's three install settings: light (no extra), apple, gpu.
     assert re.findall(r'"abstractcore\[([^\]]*)\]', text) == ["apple", "gpu"]
     assert '"openai<3.0.0,>=1.109.1"' in text
@@ -89,8 +89,8 @@ def test_runtime_exposes_only_apple_and_gpu_user_install_profiles() -> None:
     apple_block = _extract_optional_dependency_block(text, key="apple")
     gpu_block = _extract_optional_dependency_block(text, key="gpu")
 
-    assert '"abstractcore[apple]>=2.20.2"' in apple_block
-    assert '"abstractcore[gpu]>=2.20.2"' in gpu_block
+    assert '"abstractcore[apple]>=2.24.0"' in apple_block
+    assert '"abstractcore[gpu]>=2.24.0"' in gpu_block
     assert '"setuptools<82.0.0,>=80.10.2"' in apple_block
     assert '"setuptools<82.0.0,>=77.0.3"' in gpu_block
     assert "pymupdf" not in apple_block.lower()

abstractruntime-0.8.4/release-notes.md

@@ -1,2 +0,0 @@
-- Automations accept `context.growing.max_tokens` at creation and revision, defaulting to 50,000 tokens. Whole-turn history and admitted retry inputs are preserved.
-- Email-enabled automations produce a result notification for every completed occurrence, with the full answer and configurable `notify.recipients`.