agentic-dev-loop 1.0.0a9__tar.gz → 1.0.0a10__tar.gz

{agentic_dev_loop-1.0.0a9 → agentic_dev_loop-1.0.0a10}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: agentic-dev-loop
-Version: 1.0.0a9
+Version: 1.0.0a10
 Summary: Turn an LLM into a gated, sandboxed, resumable construction loop over your codebase.
 Author: Luke Wilson
 License-Expression: Apache-2.0
@@ -90,10 +90,27 @@ LLM timeout (agent runs are long).
 | LLM API key | The env var named by your pipeline's `api_key_env` (e.g. `OPENAI_API_KEY`) must be set — a missing key fails fast, naming it. |
 
 ```bash
-pip install "agentic-dev-loop==1.0.0a8"
+pip install "agentic-dev-loop==1.0.0a9"
 agentic-dev-loop --version
 ```
 
+The canonical consumer install is **pipx**, which puts the engine's venv
+*outside* the workspace — the sandbox mount set is exactly `{workspace}`, so an
+out-of-workspace install is unmounted and never agent-writable:
+
+```bash
+pipx install "agentic-dev-loop==1.0.0a9"
+```
+
+If you install with `uv` shortly after a release, pass `--refresh` — PyPI
+serves the package index with `Cache-Control: max-age=600`, and uv otherwise
+reuses a pre-upload snapshot of the index for up to 10 minutes, reporting
+"no version of agentic-dev-loop==X.Y.Z" for a version that is already live:
+
+```bash
+uv pip install --refresh "agentic-dev-loop==1.0.0a9"
+```
+
 On the first run the engine pulls the **digest-pinned** dev image
 (`ghcr.io/lukedawilson/agentic-dev-loop/dev`) and verifies its digest — the
 supply-chain check refuses to continue on a mismatch. If you're running
@@ -188,13 +205,14 @@ steps:
 
 | Key | Notes |
 | --- | --- |
-| `agent:` / `command:` / `action:` | Exactly one per step. Agents live in `agents_dir` as `<name>.agent.md`; commands run sandboxed (mechanical, never an LLM call); actions are registered host-side functions. |
+| `agent:` / `command:` / `action:` | Exactly one per step. Agents live in `agents_dir` as `<name>.agent.md`; commands run sandboxed (mechanical, never an LLM call). `commit` is the sole host-side built-in action; consumer actions are sandbox-executed, command-shaped scripts (see [Host boundary](#host-boundary-security-model)). |
 | `produces:` / `artifact:` + `verdicts:` | Hygiene-tracked outputs vs verdict-parsed routing. The **last** `VERDICT:` line wins; stale artifacts are deleted at each attempt start. |
 | `on_pass:` / `on_fail:` | A step name, terminal `success`/`failure`, or `{goto: X, retry: true}`. No loops happen unless you write them. |
 | `env:` / `setup:` / `network:` | `env:` declares step vars (fixed safe base + declared vars only); `setup:` provisions the sandbox (command steps, network ON, stamp-cached); `network: true` grants egress to a command or agent step (default off) — see [Per-stage networking](#per-stage-networking). |
 | `secrets:` (top-level) / step `secrets:` | Declares secret **refs only — never values**; each step opts in to the refs it needs. Resolved host-side and injected into that step's exec env only. See [Secrets](#secrets--refs-only-never-values). |
 | `isolation:` (optional) | Configures the sandbox — image override, resource caps, `allow_git_mutations`. It can never disable it. |
 | `state_dir` | Defaults to `~/.agentic-dev-loop/runs/<pipeline-hash>/` — artifacts and checkpoints live outside the sandbox mount. |
+| `extensions_dir` | Where consumer `extensions:` modules resolve — defaults to `~/.agentic-dev-loop/extensions`, **outside** the workspace. Workspace-resident extension/tool modules are refused at load. |
 
 ### Secrets (`secrets:`) — refs only, never values
 
@@ -253,28 +271,79 @@ steps:
   sandbox container (`--read-only`, `--cap-drop ALL`, single workspace mount)
   on the Docker bridge network — the default network-none container is always
   created too, so no infrastructure work happens mid-run.
-- **Command and agent steps** may declare it. Action steps are host-side and
-  never take it (a load-time error).
+- **Command, agent, and sandbox-action steps** may declare it. The host-side
+  built-in `commit` action never takes it (refused once the registry is known).
 - **Author opt-in is the control.** A networked step gives its agent raw
   egress for that stage; the default stays network-off everywhere. Reserve it
   for stages that need it (QA, integration). The residual risk is documented
   in [docs/setup.md](docs/setup.md).
 
+## Host boundary (security model)
+
+The orchestrator, tool layer, and the `commit` action run in the **host
+process** — they hold your credentials and your full user account, so the
+engine keeps anything agent-writable out of that process:
+
+- **Consumer actions are sandbox-executed.** An action you register via an
+  extension is a command-shaped script (`script + params`), run through the
+  same sandbox path as command steps — the exit code is the verdict, and the
+  code never runs in the host. Only the engine's trusted built-ins (`commit`,
+  document loaders) run host-side.
+- **Extensions load from outside the workspace.** `extensions_dir` defaults to
+  `~/.agentic-dev-loop/extensions`; at load time any extension or tool module
+  whose file resolves under the workspace is refused *before import*, naming
+  the file.
+- **The engine installs outside the workspace.** Install with pipx so the venv
+  is unmounted from the sandbox; a startup self-check refuses to run if
+  `agentic_dev_loop` resolves under the workspace (an editable install bypasses
+  everything).
+- **Tooling is read-only by the loop.** At run start the pipeline file,
+  `agents_dir`, `additional_files`, `aidlc-docs/`, and `tools/` must be
+  git-clean relative to HEAD — otherwise the run refuses, naming the dirty
+  files. The `commit` action excludes those paths from its sweep, so the loop
+  never commits its own tooling.
+- **`commit` stays host-side, deliberately.** It holds push credentials; moving
+  it into the sandbox would trade host-exec-of-trusted-code for
+  credential-in-sandbox. It runs argv-style with a scrubbed child env and
+  `-c core.hooksPath=~/.agentic-dev-loop/state/hooks` so repo hooks never
+  execute.
+
+Net: the host executes nothing from the workspace, reads only git-clean
+control files, and the only agent-writable host-consumed thing left is the code
+the loop is building.
+
+### Consumer migration notes
+
+- **Actions** — replace a host-side `fn` registration with
+  `registry.add_sandbox_action(name, script)`. `script` is a command string
+  rendered with the step's `params:` plus `{subject}`; the exit code is the
+  verdict. `add_action` (host-side) is now engine-built-in-only and is refused
+  from extensions.
+- **Extensions** — move workspace-resident extension modules (e.g.
+  `extensions/*.py`) into `~/.agentic-dev-loop/extensions/` (or whatever
+  `extensions_dir:` names), and reinstall the engine via pipx so it is not
+  editable/in-workspace.
+- **Tooling** — commit the pipeline, agent defs, shared `additional_files`,
+  `aidlc-docs/`, and `tools/` before running: the run refuses dirty tooling,
+  and `commit` never commits it.
+
 ## Development environment
 
 ```bash
 git clone git@github.com:lukedawilson/agentic-dev-loop.git
 cd agentic-dev-loop
-./setup-venv.sh                       # idempotent .venv setup (never touches bare pip)
+pipx install "agentic-dev-loop==1.0.0a9"   # engine venv OUTSIDE the workspace (self-check)
 export OPENAI_API_KEY=...           # set your LLM key in the host env (no .env in the repo)
-python -m pytest tests/ -q            # fast suite
+python -m pytest tests/ -q            # fast suite (in-repo .venv is for tests only)
 python -m pytest tests/ -q -m "not docker"   # skip engine-dependent tests
-./trigger-agentic-dev-loop.sh --dry-run      # run the shipped pipeline against this repo
+agentic-dev-loop agentic-dev-loop/pipeline.yaml --dry-run   # run the shipped pipeline
 ./run-demo.sh                         # viz demo — scripted run replay, no pipeline needed
 ```
 
-- `setup-venv.sh` is safe to re-run and picks the right interpreter even on
-  machines with exotic Python installations.
+- `setup-venv.sh` builds the throwaway `.venv` for local `pytest` runs (the
+  pipeline's `test` step provisions its own `.venv-sandbox` inside the
+  sandbox). The loop itself must run from the pipx install — never an
+  in-workspace `.venv`, which the startup self-check refuses.
 - Docker-marked integration tests need a local daemon; CI runs them on Linux.
 - The shipped pipeline (`agentic-dev-loop/pipeline.yaml`) **dogfoods the tool on
   its own repo** — dev → test → review → qa → commit, with the engine's own

{agentic_dev_loop-1.0.0a9 → agentic_dev_loop-1.0.0a10}/README.md

@@ -51,10 +51,27 @@ LLM timeout (agent runs are long).
 | LLM API key | The env var named by your pipeline's `api_key_env` (e.g. `OPENAI_API_KEY`) must be set — a missing key fails fast, naming it. |
 
 ```bash
-pip install "agentic-dev-loop==1.0.0a8"
+pip install "agentic-dev-loop==1.0.0a9"
 agentic-dev-loop --version
 ```
 
+The canonical consumer install is **pipx**, which puts the engine's venv
+*outside* the workspace — the sandbox mount set is exactly `{workspace}`, so an
+out-of-workspace install is unmounted and never agent-writable:
+
+```bash
+pipx install "agentic-dev-loop==1.0.0a9"
+```
+
+If you install with `uv` shortly after a release, pass `--refresh` — PyPI
+serves the package index with `Cache-Control: max-age=600`, and uv otherwise
+reuses a pre-upload snapshot of the index for up to 10 minutes, reporting
+"no version of agentic-dev-loop==X.Y.Z" for a version that is already live:
+
+```bash
+uv pip install --refresh "agentic-dev-loop==1.0.0a9"
+```
+
 On the first run the engine pulls the **digest-pinned** dev image
 (`ghcr.io/lukedawilson/agentic-dev-loop/dev`) and verifies its digest — the
 supply-chain check refuses to continue on a mismatch. If you're running
@@ -149,13 +166,14 @@ steps:
 
 | Key | Notes |
 | --- | --- |
-| `agent:` / `command:` / `action:` | Exactly one per step. Agents live in `agents_dir` as `<name>.agent.md`; commands run sandboxed (mechanical, never an LLM call); actions are registered host-side functions. |
+| `agent:` / `command:` / `action:` | Exactly one per step. Agents live in `agents_dir` as `<name>.agent.md`; commands run sandboxed (mechanical, never an LLM call). `commit` is the sole host-side built-in action; consumer actions are sandbox-executed, command-shaped scripts (see [Host boundary](#host-boundary-security-model)). |
 | `produces:` / `artifact:` + `verdicts:` | Hygiene-tracked outputs vs verdict-parsed routing. The **last** `VERDICT:` line wins; stale artifacts are deleted at each attempt start. |
 | `on_pass:` / `on_fail:` | A step name, terminal `success`/`failure`, or `{goto: X, retry: true}`. No loops happen unless you write them. |
 | `env:` / `setup:` / `network:` | `env:` declares step vars (fixed safe base + declared vars only); `setup:` provisions the sandbox (command steps, network ON, stamp-cached); `network: true` grants egress to a command or agent step (default off) — see [Per-stage networking](#per-stage-networking). |
 | `secrets:` (top-level) / step `secrets:` | Declares secret **refs only — never values**; each step opts in to the refs it needs. Resolved host-side and injected into that step's exec env only. See [Secrets](#secrets--refs-only-never-values). |
 | `isolation:` (optional) | Configures the sandbox — image override, resource caps, `allow_git_mutations`. It can never disable it. |
 | `state_dir` | Defaults to `~/.agentic-dev-loop/runs/<pipeline-hash>/` — artifacts and checkpoints live outside the sandbox mount. |
+| `extensions_dir` | Where consumer `extensions:` modules resolve — defaults to `~/.agentic-dev-loop/extensions`, **outside** the workspace. Workspace-resident extension/tool modules are refused at load. |
 
 ### Secrets (`secrets:`) — refs only, never values
 
@@ -214,28 +232,79 @@ steps:
   sandbox container (`--read-only`, `--cap-drop ALL`, single workspace mount)
   on the Docker bridge network — the default network-none container is always
   created too, so no infrastructure work happens mid-run.
-- **Command and agent steps** may declare it. Action steps are host-side and
-  never take it (a load-time error).
+- **Command, agent, and sandbox-action steps** may declare it. The host-side
+  built-in `commit` action never takes it (refused once the registry is known).
 - **Author opt-in is the control.** A networked step gives its agent raw
   egress for that stage; the default stays network-off everywhere. Reserve it
   for stages that need it (QA, integration). The residual risk is documented
   in [docs/setup.md](docs/setup.md).
 
+## Host boundary (security model)
+
+The orchestrator, tool layer, and the `commit` action run in the **host
+process** — they hold your credentials and your full user account, so the
+engine keeps anything agent-writable out of that process:
+
+- **Consumer actions are sandbox-executed.** An action you register via an
+  extension is a command-shaped script (`script + params`), run through the
+  same sandbox path as command steps — the exit code is the verdict, and the
+  code never runs in the host. Only the engine's trusted built-ins (`commit`,
+  document loaders) run host-side.
+- **Extensions load from outside the workspace.** `extensions_dir` defaults to
+  `~/.agentic-dev-loop/extensions`; at load time any extension or tool module
+  whose file resolves under the workspace is refused *before import*, naming
+  the file.
+- **The engine installs outside the workspace.** Install with pipx so the venv
+  is unmounted from the sandbox; a startup self-check refuses to run if
+  `agentic_dev_loop` resolves under the workspace (an editable install bypasses
+  everything).
+- **Tooling is read-only by the loop.** At run start the pipeline file,
+  `agents_dir`, `additional_files`, `aidlc-docs/`, and `tools/` must be
+  git-clean relative to HEAD — otherwise the run refuses, naming the dirty
+  files. The `commit` action excludes those paths from its sweep, so the loop
+  never commits its own tooling.
+- **`commit` stays host-side, deliberately.** It holds push credentials; moving
+  it into the sandbox would trade host-exec-of-trusted-code for
+  credential-in-sandbox. It runs argv-style with a scrubbed child env and
+  `-c core.hooksPath=~/.agentic-dev-loop/state/hooks` so repo hooks never
+  execute.
+
+Net: the host executes nothing from the workspace, reads only git-clean
+control files, and the only agent-writable host-consumed thing left is the code
+the loop is building.
+
+### Consumer migration notes
+
+- **Actions** — replace a host-side `fn` registration with
+  `registry.add_sandbox_action(name, script)`. `script` is a command string
+  rendered with the step's `params:` plus `{subject}`; the exit code is the
+  verdict. `add_action` (host-side) is now engine-built-in-only and is refused
+  from extensions.
+- **Extensions** — move workspace-resident extension modules (e.g.
+  `extensions/*.py`) into `~/.agentic-dev-loop/extensions/` (or whatever
+  `extensions_dir:` names), and reinstall the engine via pipx so it is not
+  editable/in-workspace.
+- **Tooling** — commit the pipeline, agent defs, shared `additional_files`,
+  `aidlc-docs/`, and `tools/` before running: the run refuses dirty tooling,
+  and `commit` never commits it.
+
 ## Development environment
 
 ```bash
 git clone git@github.com:lukedawilson/agentic-dev-loop.git
 cd agentic-dev-loop
-./setup-venv.sh                       # idempotent .venv setup (never touches bare pip)
+pipx install "agentic-dev-loop==1.0.0a9"   # engine venv OUTSIDE the workspace (self-check)
 export OPENAI_API_KEY=...           # set your LLM key in the host env (no .env in the repo)
-python -m pytest tests/ -q            # fast suite
+python -m pytest tests/ -q            # fast suite (in-repo .venv is for tests only)
 python -m pytest tests/ -q -m "not docker"   # skip engine-dependent tests
-./trigger-agentic-dev-loop.sh --dry-run      # run the shipped pipeline against this repo
+agentic-dev-loop agentic-dev-loop/pipeline.yaml --dry-run   # run the shipped pipeline
 ./run-demo.sh                         # viz demo — scripted run replay, no pipeline needed
 ```
 
-- `setup-venv.sh` is safe to re-run and picks the right interpreter even on
-  machines with exotic Python installations.
+- `setup-venv.sh` builds the throwaway `.venv` for local `pytest` runs (the
+  pipeline's `test` step provisions its own `.venv-sandbox` inside the
+  sandbox). The loop itself must run from the pipx install — never an
+  in-workspace `.venv`, which the startup self-check refuses.
 - Docker-marked integration tests need a local daemon; CI runs them on Linux.
 - The shipped pipeline (`agentic-dev-loop/pipeline.yaml`) **dogfoods the tool on
   its own repo** — dev → test → review → qa → commit, with the engine's own

{agentic_dev_loop-1.0.0a9 → agentic_dev_loop-1.0.0a10}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "agentic-dev-loop"
-version = "1.0.0a9"
+version = "1.0.0a10"
 description = "Turn an LLM into a gated, sandboxed, resumable construction loop over your codebase."
 readme = "README.md"
 requires-python = ">=3.12"

{agentic_dev_loop-1.0.0a9 → agentic_dev_loop-1.0.0a10}/src/agentic_dev_loop/core/config.py

@@ -114,7 +114,7 @@ class StepConfig(BaseModel):
     timeout: float | None = Field(default=None, gt=0)  # seconds, command steps only
     env: dict[str, str | None] | None = None  # NFR-1: null = inherit host value
     setup: str | None = None  # BR-13: command steps only
-    network: bool = False  # per-stage egress (command + agent steps; action steps reject)
+    network: bool = False  # per-stage egress (command/agent + sandbox actions; host-side actions reject at registry time)
     secrets: list[str] = []  # declared ref names; action steps reject
     on_pass: RouteTarget | None = None
     on_fail: RouteTarget | None = None
@@ -173,11 +173,11 @@ class StepConfig(BaseModel):
             raise ValueError(
                 f"step {self.name!r}: 'setup' is only allowed on 'command' steps"
             )
-        if self.network and self.action is not None:
-            raise ValueError(
-                f"step {self.name!r}: 'network' is only allowed on 'agent' or "
-                "'command' steps"
-            )
+        # `network` is NOT rejected here: the schema can't tell a host-side
+        # built-in action (e.g. `commit`, which must never take egress) from
+        # a sandbox-executed consumer action (which may, like a command step).
+        # That distinction is enforced once the registry is known — see
+        # `validate_action_network` (020).
         if self.secrets and self.action is not None:
             raise ValueError(
                 f"step {self.name!r}: 'secrets' is only allowed on 'agent' or "
@@ -201,6 +201,11 @@ class PipelineConfig(BaseModel):
     name: str
     extensions: list[str] = []
     additional_files: list[str] = []
+    # Where consumer `extensions:` modules resolve (work item 020). Must live
+    # OUTSIDE the workspace — the host refuses workspace-resident extension and
+    # tool-handler modules, so agent-writable files are never imported by the
+    # host process.
+    extensions_dir: str = "~/.agentic-dev-loop/extensions"
     env_allowlist: list[str] = []
     llm: LlmConfig
     isolation: IsolationConfig | None = None  # None = always-on defaults

{agentic_dev_loop-1.0.0a9 → agentic_dev_loop-1.0.0a10}/src/agentic_dev_loop/engine/actions.py

@@ -186,6 +186,23 @@ def checkpoint_exclude_pathspec(state_dir: str | None, cwd: Path) -> str | None:
     return f":(exclude){rel}/*.sqlite*"
 
 
+def tooling_exclude_pathspec(tooling_paths: list[str] | None) -> list[str]:
+    """git pathspecs excluding tooling paths from ``git add -A`` (020).
+
+    The loop must never commit its own tooling (pipeline, agent defs,
+    additional files, aidlc-docs, tools): the run-start integrity check
+    requires those paths to be clean relative to HEAD, so the auto-commit
+    must sweep everything *except* them. Empty when there is nothing to
+    exclude."""
+    specs = []
+    for rel in (tooling_paths or []):
+        rel = rel.replace(os.sep, "/")
+        if rel in ("", ".", ".."):
+            continue
+        specs.append(f":(exclude){rel}")
+    return specs
+
+
 def commit(state: dict, params: dict) -> dict:
     """The pipeline's only commit point. Skipped loudly when the worktree was
     dirty at run start, so the auto-commit can never swallow pre-existing
@@ -205,9 +222,13 @@ def commit(state: dict, params: dict) -> dict:
     cwd = Path.cwd()
     hooks = _trusted_hooks_dir()
     add_argv = ["-c", f"core.hooksPath={hooks}", "add", "-A"]
-    exclude = checkpoint_exclude_pathspec(state.get("state_dir"), cwd)
-    if exclude:
-        add_argv += ["--", exclude]
+    excludes = []
+    checkpoint_exclude = checkpoint_exclude_pathspec(state.get("state_dir"), cwd)
+    if checkpoint_exclude:
+        excludes.append(checkpoint_exclude)
+    excludes.extend(tooling_exclude_pathspec(state.get("tooling_paths")))
+    if excludes:
+        add_argv += ["--", *excludes]
     added = _git(add_argv, cwd=cwd)
     if added.returncode != 0:
         # The add is the step that touches the most files (a locked DB, a

{agentic_dev_loop-1.0.0a9 → agentic_dev_loop-1.0.0a10}/src/agentic_dev_loop/engine/cli.py

@@ -71,7 +71,8 @@ def _registry_for(cfg_path: Path) -> tuple[Registry, PipelineConfig]:
     run path instead of being rebuilt."""
     cfg = load_config(cfg_path)
     registry = default_registry()
-    load_extensions(cfg.extensions, registry)
+    load_extensions(cfg.extensions, registry,
+                    extensions_dir=cfg.extensions_dir, workspace=Path.cwd())
     return registry, cfg
 
 

{agentic_dev_loop-1.0.0a9 → agentic_dev_loop-1.0.0a10}/src/agentic_dev_loop/engine/dryrun.py

@@ -13,10 +13,12 @@ from __future__ import annotations
 from pathlib import Path
 
 from agentic_dev_loop.core.config import PipelineConfig, StepConfig, load_config
+from .hostboundary import check_orchestrator_install, check_tooling_integrity
 from .loaders import resolve_docs
 from .isolation import (isolation_state_dir, resolve_effective_profile,
                         resolve_image_ref)
-from .registry import Registry, default_registry, load_extensions
+from .registry import (Registry, default_registry, load_extensions,
+                       validate_action_network)
 from .secrets import scan_env_files
 
 
@@ -32,12 +34,18 @@ def _validate_agents(cfg: PipelineConfig, agents_dir: Path) -> None:
 
 def _validate_actions(cfg: PipelineConfig, registry: Registry) -> None:
     """Unknown action names fail at graph build time; catch them here so a
-    dry run is a true load pass."""
+    dry run is a true load pass. Host-side built-in actions cannot take
+    ``network`` (020) — deferred here because the config schema can't
+    distinguish host-side from sandbox actions."""
+    known = set(registry.actions) | set(registry.sandbox_actions)
     for step in cfg.steps:
-        if step.action is not None and step.action not in registry.actions:
+        if step.action is None:
+            continue
+        if step.action not in known:
             raise ValueError(
                 f"step {step.name!r}: unknown action {step.action!r} "
-                f"(registered: {sorted(registry.actions)})")
+                f"(registered: {sorted(known)})")
+        validate_action_network(step.name, step.action, step.network, registry)
 
 
 def _resolved_image(cfg: PipelineConfig) -> tuple[str, str, float]:
@@ -114,11 +122,15 @@ def dry_run(cfg_path, args, registry: Registry | None = None) -> int:
     cfg_path = Path(cfg_path)
     cfg = load_config(cfg_path)
     base = cfg_path.resolve().parent
+    check_orchestrator_install(Path.cwd())
     scan_env_files(Path.cwd())
+    check_tooling_integrity(cfg, cfg_path, base, Path.cwd())
 
     if registry is None:
         registry = default_registry()
-        load_extensions(cfg.extensions, registry)
+        load_extensions(cfg.extensions, registry,
+                        extensions_dir=cfg.extensions_dir,
+                        workspace=Path.cwd())
 
     _validate_agents(cfg, base / cfg.agents_dir)
     _validate_actions(cfg, registry)

{agentic_dev_loop-1.0.0a9 → agentic_dev_loop-1.0.0a10}/src/agentic_dev_loop/engine/graph.py

@@ -19,11 +19,14 @@ from langgraph.graph import END, START, StateGraph
 from agentic_dev_loop import viz
 from .actions import git_worktree_clean, kill_listeners_on_port
 from agentic_dev_loop.core.config import load_config
+from .hostboundary import (check_orchestrator_install,
+                           check_tooling_integrity, tooling_rel_paths)
 from .isolation import startup_sandbox
 from .llm import build_llm
 from .loaders import resolve_docs
 from .secrets import resolve_secrets, scan_env_files
-from .registry import Registry, default_registry, load_extensions
+from .registry import (Registry, default_registry, load_extensions,
+                       validate_action_network)
 from .stages import (Runtime, build_context, clear_attempt_artifacts,
                      make_action_node, make_agent_node, make_bump_node,
                      make_command_node, make_router, success_node)
@@ -46,6 +49,7 @@ class LoopState(TypedDict):
     outcome: str | None                # "success" once routed to the success terminal
     commit_allowed: bool               # worktree was clean at run start
     state_dir: str                     # resolved pipeline state dir (for the commit action)
+    tooling_paths: list[str]          # workspace-relative paths the commit never sweeps
     step_verdicts: dict[str, str | None]  # per-step pass/fail/None(unclear)
     retry_target: str | None           # where the bump node loops back to
     thread_id: str
@@ -55,11 +59,17 @@ def build_graph(runtime: Runtime, checkpointer=None):
     """Compile the pipeline's state graph: one node per step (agent, command,
     or action), plus the bump retry node and the success terminal. Unknown
     action names fail here, at build time, not mid-run."""
+    known_actions = (set(runtime.registry.actions)
+                     | set(runtime.registry.sandbox_actions))
     for step in runtime.cfg.steps:
-        if step.action is not None and step.action not in runtime.registry.actions:
+        if step.action is None:
+            continue
+        if step.action not in known_actions:
             raise ValueError(
                 f"step {step.name!r}: unknown action {step.action!r} "
-                f"(registered: {sorted(runtime.registry.actions)})")
+                f"(registered: {sorted(known_actions)})")
+        validate_action_network(step.name, step.action, step.network,
+                                runtime.registry)
     graph = StateGraph(LoopState)
     for step in runtime.cfg.steps:
         if step.kind == "agent":
@@ -108,14 +118,20 @@ def run_pipeline(cfg_path, args, *, viz_bus=None,
     base = cfg_path.resolve().parent
     max_attempts = getattr(args, "max_attempts", None) or cfg.max_attempts
 
-    # 019: refuse secret-bearing workspace files and resolve declared secret
-    # refs host-side BEFORE any sandbox/LLM work — fail fast, loudly.
+    # 020: the host must execute nothing from the workspace — refuse an
+    # in-workspace engine install, then the 019 env-file ban, before any
+    # sandbox/LLM work. Tooling integrity is checked once the config is known.
+    check_orchestrator_install(Path.cwd())
     scan_env_files(Path.cwd())
     resolved_secrets = resolve_secrets(cfg)
+    check_tooling_integrity(cfg, cfg_path, base, Path.cwd())
+    tooling_paths = tooling_rel_paths(cfg, cfg_path, base, Path.cwd())
 
     if registry is None:
         registry = default_registry()
-        load_extensions(cfg.extensions, registry)
+        load_extensions(cfg.extensions, registry,
+                        extensions_dir=cfg.extensions_dir,
+                        workspace=Path.cwd())
 
     state_dir = Path(cfg.state_dir).expanduser()
     if not state_dir.is_absolute():
@@ -128,13 +144,14 @@ def run_pipeline(cfg_path, args, *, viz_bus=None,
                                refresh=getattr(args, "refresh", False))
     try:
         return _run_pipeline(cfg, base, registry, state_dir, max_attempts,
-                             args, viz_bus, sandbox, resolved_secrets)
+                             args, viz_bus, sandbox, resolved_secrets,
+                             tooling_paths)
     finally:
         sandbox.close()
 
 
 def _run_pipeline(cfg, base, registry, state_dir, max_attempts, args, viz_bus,
-                  sandbox, resolved_secrets) -> tuple[bool, int]:
+                  sandbox, resolved_secrets, tooling_paths) -> tuple[bool, int]:
     runtime = Runtime(cfg=cfg, registry=registry, llm=build_llm(cfg.llm),
                       agents_dir=base / cfg.agents_dir, state_dir=state_dir,
                       workspace=Path.cwd(), sandbox=sandbox,
@@ -170,6 +187,7 @@ def _run_pipeline(cfg, base, registry, state_dir, max_attempts, args, viz_bus,
             # itself dirty the worktree.
             "commit_allowed": git_worktree_clean(Path.cwd()),
             "state_dir": str(state_dir),
+            "tooling_paths": tooling_paths,
             "step_verdicts": {},
             "retry_target": None,
             "thread_id": thread_id,

agentic_dev_loop-1.0.0a10/src/agentic_dev_loop/engine/hostboundary.py

@@ -0,0 +1,137 @@
+"""Host-side boundary checks (020): the host must execute nothing from the
+workspace and read only git-clean control files.
+
+Two fail-fast guards run before any sandbox/LLM work:
+
+- ``check_orchestrator_install`` — refuses to run when the engine package
+  itself resolves under the workspace (an in-workspace or editable install
+  means the sandbox can rewrite the code the host is about to run).
+- ``check_tooling_integrity`` — refuses when tooling paths (pipeline, agent
+  defs, additional files, aidlc-docs, tools) are dirty relative to HEAD,
+  closing the self-modifying loop and the self-gate (an agent-writable,
+  network-on gate script).
+
+``tooling_rel_paths`` is the single source of the tooling path set, shared by
+the integrity check and the commit action's exclusion pathspec so the two can
+never disagree.
+"""
+
+from __future__ import annotations
+
+import shutil
+import subprocess
+from pathlib import Path
+from typing import TYPE_CHECKING
+
+from .proc import child_env
+
+if TYPE_CHECKING:
+    from agentic_dev_loop.core.config import PipelineConfig
+
+# Tooling directories are workspace-root-relative fixed names (the same layout
+# the dogfood pipeline and yosk use); the other tooling paths are config- or
+# pipeline-file-relative.
+TOOLING_DIR_NAMES = ("aidlc-docs", "tools")
+
+
+class HostBoundaryError(RuntimeError):
+    """A loud fail-fast host-boundary failure; the message names the problem
+    and points at the remedy."""
+
+
+def check_orchestrator_install(workspace: str | Path,
+                               engine_file: str | Path | None = None) -> None:
+    """Refuse to run when the engine resolves under the workspace (020).
+
+    The sandbox mount set is exactly {workspace}, so an in-workspace (or
+    editable) install is agent-writable — the next run would execute
+    agent-modified engine code in the host process. ``engine_file`` is an
+    injectable seam for tests; production uses ``agentic_dev_loop.__file__``.
+    """
+    if engine_file is None:
+        import agentic_dev_loop
+        engine_file = agentic_dev_loop.__file__
+    resolved = Path(engine_file).resolve()
+    ws = Path(workspace).resolve()
+    if resolved.is_relative_to(ws):
+        raise HostBoundaryError(
+            f"agentic_dev_loop resolves to {resolved}, inside the workspace "
+            f"{ws} — the engine must be installed outside the workspace "
+            "(e.g. `pipx install agentic-dev-loop`); refusing to run")
+
+
+def tooling_rel_paths(cfg: "PipelineConfig", pipeline_path: str | Path,
+                      base: str | Path, workspace: str | Path) -> list[str]:
+    """Workspace-relative tooling paths for one pipeline, deduplicated and
+    sorted. Only paths inside the workspace are included — anything outside
+    the workspace is already outside the sandbox mount and therefore not
+    agent-writable."""
+    ws = Path(workspace).resolve()
+    base = Path(base).resolve()
+    candidates = [
+        Path(pipeline_path).resolve(),
+        (base / cfg.agents_dir).resolve(),
+        *((base / rel).resolve() for rel in cfg.additional_files),
+        *(ws / name for name in TOOLING_DIR_NAMES),
+    ]
+    rels = {p.relative_to(ws).as_posix() for p in candidates
+            if p.is_relative_to(ws)}
+    return sorted(rels)
+
+
+def _git_status(paths: list[str], workspace: Path) -> tuple[int, str, str]:
+    git = shutil.which("git")
+    if git is None:
+        raise HostBoundaryError(
+            "git is not on PATH — the tooling integrity check cannot run")
+    result = subprocess.run(
+        [git, "status", "--porcelain", "--untracked-files=all", "--", *paths],
+        cwd=workspace, capture_output=True, text=True, check=False,
+        shell=False, env=child_env())
+    return result.returncode, result.stdout, result.stderr
+
+
+def _status_paths(output: str) -> list[str]:
+    """The path column of ``git status --porcelain`` lines, with the two
+    status characters stripped (``XY path`` or ``XY path -> path``)."""
+    paths = []
+    for line in output.splitlines():
+        if not line:
+            continue
+        rest = line[3:] if len(line) > 3 else ""
+        if " -> " in rest:
+            rest = rest.split(" -> ", 1)[1]
+        if rest.strip():
+            paths.append(rest)
+    return paths
+
+
+def check_tooling_integrity(cfg: "PipelineConfig", pipeline_path: str | Path,
+                            base: str | Path, workspace: str | Path) -> None:
+    """Refuse when any tooling path is dirty relative to HEAD (020).
+
+    The run reads these paths host-side (pipeline, agent defs, shared
+    additional files, the AI-DLC docs, and the ``tools/`` scripts). An agent
+    that can rewrite them for the next run — or a gate script the agent can
+    edit — must not be trusted. Dirty files are named; the commit action
+    excludes the same paths so the loop never commits tooling changes.
+    """
+    rels = tooling_rel_paths(cfg, pipeline_path, base, workspace)
+    if not rels:
+        return
+    code, output, err = _git_status(rels, Path(workspace))
+    if code != 0:
+        # No git repository → no HEAD baseline to be clean relative to; the
+        # commit gate is already disabled for the same reason. Every other git
+        # failure is loud.
+        if "not a git repository" in err:
+            return
+        raise HostBoundaryError(
+            "tooling integrity check failed — git could not inspect the "
+            f"tooling paths: {err.strip() or output.strip()}")
+    dirty = _status_paths(output)
+    if dirty:
+        raise HostBoundaryError(
+            "tooling file(s) modified relative to HEAD: " + ", ".join(dirty)
+            + " — tooling changes must be committed (or reverted) before the "
+            "loop runs; the loop never commits them itself")