agentic-runner 2.6.0__tar.gz → 2.7.0__tar.gz

{agentic_runner-2.6.0 → agentic_runner-2.7.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: agentic-runner
-Version: 2.6.0
+Version: 2.7.0
 Summary: The Agentic OS Runner: an activity-only Temporal executor for workspaces, Agent Runtimes and verb seams
 License-Expression: AGPL-3.0-only
 License-File: LICENSE

{agentic_runner-2.6.0 → agentic_runner-2.7.0}/src/agentic_runner/__init__.py

@@ -7,6 +7,6 @@ stay on the platform; this package imports none of them, and a CI partition test
 (``tests/test_package_partition.py``) fails the build if that changes.
 """
 
-__version__ = "2.6.0"
+__version__ = "2.7.0"
 
 __all__ = ["__version__"]

{agentic_runner-2.6.0 → agentic_runner-2.7.0}/src/agentic_runner/activities.py

@@ -38,6 +38,7 @@ from uuid import UUID
 from temporalio import activity
 from temporalio.exceptions import ApplicationError
 
+from agentic_runner.attempts import AttemptRecords, PriorAttemptAliveError, fence_work_record
 from agentic_runner.callback import (
     CALLBACK_TOKEN_ENV,
     AnnotateRequest,
@@ -128,6 +129,14 @@ from agentic_runner.workers.fastapi_client import (
 )
 from agentic_runner.workers.harness_usage import extract_claude_result, extract_codex_turn_usage
 from agentic_runner.workers.mcp_config import McpServerEntry
+from agentic_runner.workers.skills import (
+    SkillDelivery,
+    delivery_for,
+    first_digest_mismatch,
+    remove_skills,
+    skills_preamble,
+    write_skills,
+)
 from agentic_runner_contracts.activity_io import (
     LEARNER_CHILDREN_BUDGET_BYTES,
     LEARNING_FAILED,
@@ -237,6 +246,7 @@ from agentic_runner_contracts.routing import (
 from agentic_runner_contracts.runtime_context import (
     EGRESS_ALLOW_LIST_KEY,
     McpServerSpec,
+    SkillVersionSpec,
     WorkerRuntimeContext,
     WorkerRuntimeContextResolver,
     work_branch_name,
@@ -490,6 +500,8 @@ class _RuntimeContextState:
     experience: str = ""
     experience_lesson_ids: tuple[str, ...] = ()
     experience_truncated: bool = False
+    # Console-v2 issue 28: the Skill versions attached to the Agent.
+    skills: tuple[SkillVersionSpec, ...] = ()
     workspace_path: Path | None = None
     branch_head_sha: str | None = None
     # The Autonomy Policy's tier source (PRD issue 14) -- see WorkerRuntimeContext for
@@ -532,6 +544,9 @@ class _DirectiveAttempt:
     # PRD issue 58: what config assembly wrote for the CLI, and where it may reach.
     mcp_servers: tuple[McpServerEntry, ...] | None = None
     egress_allow_list: tuple[str, ...] = ()
+    # Console-v2 issue 28: the attached Skills, for a runtime with no skills directory to
+    # write them into. Prefixed to the Directive prompt; empty when there is none.
+    skills_preamble: str = ""
 
     async def run_environment_hook(self) -> None:
         self.extra_env.update(await self.hooks.environment())
@@ -1321,8 +1336,10 @@ def wipe_contract_residue(
 
 # Where a Runner-side routing refusal lands in the trail (PRD issue 42, 17 A11).
 _ROUTING_EVIDENCE_SOURCE = "runner.routing"
+PRIOR_ATTEMPT_ALIVE_EVIDENCE_SOURCE = "runner.prior_attempt_alive"
 DIRECTIVE_TOKEN_EVIDENCE_SOURCE = "runner.directive_token"
 AGENT_RUNTIME_EVIDENCE_SOURCE = "runner.agent_runtime"
+SKILLS_EVIDENCE_SOURCE = "runner.skills"
 
 
 class _EvidenceWriter(Protocol):
@@ -1435,6 +1452,7 @@ class RunnerRalphActivities:
         mcp_spawner: Spawner | None = None,
         egress_resolver: Resolver | None = None,
         tool_server_health: ToolServerHealthLog | None = None,
+        attempt_records: AttemptRecords | None = None,
     ) -> None:
         self._fastapi_client = fastapi_client
         # Wall-clock source for per-Directive runtime, accrued against the Budget's
@@ -1494,6 +1512,9 @@ class RunnerRalphActivities:
         self._mcp_spawner = mcp_spawner
         self._egress_resolver = egress_resolver
         self._tool_server_health = tool_server_health
+        # The retry fence (runner-repo 05). None fences nothing: a process that never
+        # registered has no state directory to keep the records in.
+        self._attempt_records = attempt_records
 
     def activity_callables(self) -> list[Callable[..., Any]]:
         """Return decorated activity callables for Temporal worker registration."""
@@ -1561,6 +1582,37 @@ class RunnerRalphActivities:
             else "runner"
         )
 
+    @contextlib.asynccontextmanager
+    async def _fenced(self, work_record_id: str) -> AsyncIterator[None]:
+        """Refuse this attempt's spawns while an earlier attempt's group lives (RR-05).
+
+        The refusal is retryable on purpose: the earlier attempt either finishes or is
+        killed, and the next retry then finds the Workspace free.
+        """
+
+        if self._attempt_records is None:
+            yield
+            return
+        attempt = activity.info().attempt if activity.in_activity() else 1
+        try:
+            with fence_work_record(self._attempt_records, work_record_id, attempt=attempt):
+                yield
+        except PriorAttemptAliveError as refusal:
+            await _raise_recorded(
+                refusal,
+                self._fastapi_client,
+                work_record_id,
+                source=PRIOR_ATTEMPT_ALIVE_EVIDENCE_SOURCE,
+                actor=self._actor(),
+                payload={
+                    "event": "directive.prior_attempt_alive",
+                    "work_record_id": work_record_id,
+                    "attempt": attempt,
+                    "prior_attempt": refusal.prior.attempt,
+                    "prior_pgid": refusal.prior.pgid,
+                },
+            )
+
     @activity.defn(name="create_or_update_branch_pr")
     async def create_or_update_branch_pr(
         self,
@@ -1570,7 +1622,9 @@ class RunnerRalphActivities:
         await self._assert_routed(request)
         asked: list[QuestionAsked] = []
         try:
-            return _with_question(await self._run_branch_pr_directive(request, asked), asked)
+            async with self._fenced(request.work_record_id):
+                ran = await self._run_branch_pr_directive(request, asked)
+            return _with_question(ran, asked)
         except HookRefusedError:
             # A Runner Hook at or before `pre_runtime` exited non-zero, `pre_directive`
             # being the reject gate (PRD issue 45). Refusing the Directive is the point,
@@ -1754,7 +1808,8 @@ class RunnerRalphActivities:
                     extra_env=attempt.env,
                     mcp_servers=attempt.mcp_servers,
                     egress_allow_list=attempt.egress_allow_list,
-                    prompt=_directive_prompt(
+                    prompt=attempt.skills_preamble
+                    + _directive_prompt(
                         completion_criteria=runtime_state.completion_criteria,
                         pr_body=request.pr_body,
                         persona_preamble=_persona_prompt_preamble(
@@ -2219,6 +2274,7 @@ class RunnerRalphActivities:
                 work_record_id, source=source, payload=dict(payload)
             )
 
+        await self._refuse_skill_digest_mismatch(work_record_id, state)
         credentials = await self._resolve_credentials(work_record_id, state)
         if credentials is not None:
             # Names only, at the moment they resolved (22 A1's Evidence): a support read
@@ -2282,6 +2338,13 @@ class RunnerRalphActivities:
                 credentials=credentials,
                 env=callback_env,
             )
+            delivered_preamble = await self._deliver_skills(
+                stack,
+                work_record_id=work_record_id,
+                state=state,
+                sandbox=sandbox,
+                directive_number=directive_number,
+            )
             session = await stack.enter_async_context(
                 DirectiveHookSession(
                     hooks=self._hooks,
@@ -2303,8 +2366,85 @@ class RunnerRalphActivities:
                 credentials=credentials,
                 mcp_servers=mcp_servers,
                 egress_allow_list=egress_allow_list,
+                skills_preamble=delivered_preamble,
             )
 
+    async def _refuse_skill_digest_mismatch(
+        self, work_record_id: str, state: _RuntimeContextState
+    ) -> None:
+        """A Skill whose body is not the version that was published fails the Directive
+        non-retryably (console-v2 issue 28): a retry would fetch the same body, and
+        running on it would hand the Agent prompt material no person reviewed."""
+
+        mismatch = first_digest_mismatch(state.skills)
+        if mismatch is None:
+            return
+        await _raise_recorded(
+            ApplicationError(
+                f"Skill {mismatch.slug} version {mismatch.version} does not match its sha256",
+                non_retryable=True,
+            ),
+            self._fastapi_client,
+            work_record_id,
+            source=SKILLS_EVIDENCE_SOURCE,
+            actor=self._actor(),
+            payload={
+                "event": "skills.digest_mismatch",
+                "agent_id": state.agent_id,
+                "slug": mismatch.slug,
+                "version": mismatch.version,
+                "sha256": mismatch.sha256,
+            },
+        )
+
+    async def _deliver_skills(
+        self,
+        stack: contextlib.AsyncExitStack,
+        *,
+        work_record_id: str,
+        state: _RuntimeContextState,
+        sandbox: DirectiveSandbox | None,
+        directive_number: int,
+    ) -> str:
+        """Put the attached Skills where this runtime reads them; return any preamble.
+
+        Written files are removed on the attempt's exit, success or failure. A Runner
+        with no Contract sandbox has no harness root it owns, so it falls back to the
+        preamble rather than writing into a shared ``CODEX_HOME``.
+        """
+
+        if not state.skills:
+            return ""
+        delivery = delivery_for(state.cli_kind)
+        if delivery is SkillDelivery.DIRECTORY and sandbox is None:
+            delivery = SkillDelivery.PROMPT_PREAMBLE
+        preamble = ""
+        if delivery is SkillDelivery.DIRECTORY:
+            assert sandbox is not None
+            # Registered before the write, so a write that fails half-way is cleaned too.
+            stack.push_async_callback(
+                remove_skills, sandbox.harness_config_dir, state.skills, uid=sandbox.uid
+            )
+            await write_skills(sandbox.harness_config_dir, state.skills, uid=sandbox.uid)
+        else:
+            preamble = skills_preamble(state.skills)
+        await self._fastapi_client.append_evidence(
+            work_record_id,
+            source=SKILLS_EVIDENCE_SOURCE,
+            payload={
+                "event": "skills.delivered",
+                "directive_number": directive_number,
+                "agent_id": state.agent_id,
+                "cli_kind": state.cli_kind,
+                "delivery": delivery.value,
+                "skills": [
+                    {"slug": skill.slug, "version": skill.version, "sha256": skill.sha256}
+                    for skill in state.skills
+                ],
+            },
+        )
+        return preamble
+
     async def _plan_mcp(
         self,
         work_record_id: str,
@@ -2956,6 +3096,7 @@ class RunnerRalphActivities:
             experience=runtime_context.experience,
             experience_lesson_ids=tuple(runtime_context.experience_lesson_ids),
             experience_truncated=runtime_context.experience_truncated,
+            skills=tuple(runtime_context.skills),
             workspace_path=resolved_workspace,
             branch_head_sha=branch_head_sha,
             product_id=runtime_context.product_id,
@@ -3811,7 +3952,7 @@ class RunnerRalphActivities:
     async def run_verifier(self, request: VerifierRunInput) -> VerifierRunOutput:
         """Run product-owned verifier config and record bounded redacted evidence."""
         await self._assert_routed(request)
-        async with _liveness_heartbeats():
+        async with _liveness_heartbeats(), self._fenced(request.work_record_id):
             if self._runtime_dependencies_ready():
                 state = await self._runtime_state(
                     request.work_record_id, workspace_path=request.workspace_path
@@ -3909,7 +4050,7 @@ class RunnerRalphActivities:
                     sandbox=verifier_sandbox,
                 )
                 try:
-                    # Run in a thread: subprocess.run inline would block the worker
+                    # Run in a thread: waiting on the verifier inline would block the worker
                     # event loop for up to the verifier timeout, starving the liveness
                     # heartbeats above (and every other activity on this pod).
                     result = await asyncio.to_thread(
@@ -3981,7 +4122,8 @@ class RunnerRalphActivities:
         repair a verifier failure, then re-push. Exactly one runtime turn (ADR-0007)."""
         await self._assert_routed(request)
         try:
-            return await self._run_fix_directive(request)
+            async with self._fenced(request.work_record_id):
+                return await self._run_fix_directive(request)
         except HookRefusedError as refusal:
             # Same posture as the first Directive: a hook refusal ends the loop
             # attributably instead of raising into an endless retry (PRD issue 45).
@@ -4071,25 +4213,26 @@ class RunnerRalphActivities:
             )
 
         try:
-            ran = await self._run_in_place_directive(
-                request,
-                _InPlaceDirective(
-                    lifecycle_source="ralph.execute_member_directive",
-                    run_source="ralph.member_directive.codex_run",
-                    push_source="ralph.member_directive.git_commit_push",
-                    commit_message=(
-                        f"feat(task): directive {request.directive_number} by Agent "
-                        f"{request.agent_id} for work record {request.work_record_id}"
-                    ),
-                    push_summary=(
-                        f"Push Directive {request.directive_number} ({request.role or 'member'}"
-                        f", woken by {request.wake_reason or 'pending messages'}) to "
-                        f"{request.repository}."
+            async with self._fenced(request.work_record_id):
+                ran = await self._run_in_place_directive(
+                    request,
+                    _InPlaceDirective(
+                        lifecycle_source="ralph.execute_member_directive",
+                        run_source="ralph.member_directive.codex_run",
+                        push_source="ralph.member_directive.git_commit_push",
+                        commit_message=(
+                            f"feat(task): directive {request.directive_number} by Agent "
+                            f"{request.agent_id} for work record {request.work_record_id}"
+                        ),
+                        push_summary=(
+                            f"Push Directive {request.directive_number} ({request.role or 'member'}"
+                            f", woken by {request.wake_reason or 'pending messages'}) to "
+                            f"{request.repository}."
+                        ),
+                        prompt=prompt,
+                        push_when_clean=False,
                     ),
-                    prompt=prompt,
-                    push_when_clean=False,
-                ),
-            )
+                )
         except HookRefusedError as refusal:
             return MemberDirectiveOutput(
                 work_record_id=request.work_record_id,
@@ -4163,7 +4306,8 @@ class RunnerRalphActivities:
                 summary="directive unavailable: runtime dependencies missing",
             )
         try:
-            return await self._run_learning_directive(request)
+            async with self._fenced(request.work_record_id):
+                return await self._run_learning_directive(request)
         except HookRefusedError as refusal:
             return self._learning_output(
                 request,
@@ -4211,7 +4355,8 @@ class RunnerRalphActivities:
                     extra_env=attempt.env,
                     mcp_servers=attempt.mcp_servers,
                     egress_allow_list=attempt.egress_allow_list,
-                    prompt=_learning_prompt(
+                    prompt=attempt.skills_preamble
+                    + _learning_prompt(
                         request,
                         base_branch=state.base_branch or request.base_ref,
                         transcript=self._learner_transcript(state, request.work_record_id),
@@ -4446,7 +4591,7 @@ class RunnerRalphActivities:
                     extra_env=attempt.env,
                     mcp_servers=attempt.mcp_servers,
                     egress_allow_list=attempt.egress_allow_list,
-                    prompt=await kind.prompt(state, prompt_notes),
+                    prompt=attempt.skills_preamble + await kind.prompt(state, prompt_notes),
                     base_branch=request.base_ref,
                     work_branch=state.work_branch,
                 )

agentic_runner-2.7.0/src/agentic_runner/attempts.py

@@ -0,0 +1,258 @@
+"""One live process group per Work Record, fenced across activity attempts (runner-repo 05).
+
+A lost heartbeat makes Temporal schedule a retry while the first attempt's coroutine,
+and the harness it spawned, may still be running in this same process. Both would then
+write one Workspace, which ADR-0015 §2 and ADR-0012 assume never happens. So every process
+group a Work Record's Directive, verifier run or Runner Hook spawns is recorded as
+``{pgid, start_time, attempt}`` under the Runner's state directory, and the next spawn
+for that Work Record is refused while the recorded group's leader is still alive.
+
+Liveness is pid *plus* start time, as Paperclip fences its restarts: a pid alone is
+recycled, and a record naming a recycled pid must not block a Work Record forever. The
+record lives in the state directory, never the Workspace, because the Agent writes the
+Workspace and could forge or delete its own fence there.
+
+The binding is a context variable rather than a parameter: the spawn sites sit behind
+the Agent Runtime port, the Runner Hook runner and the verifier's command runner, and
+none of them knows which Work Record it serves. ``asyncio.to_thread`` copies the
+context, so the verifier's thread sees the activity's binding too.
+"""
+
+from __future__ import annotations
+
+import contextlib
+import json
+import os
+import re
+import subprocess
+import sys
+from collections.abc import Iterator
+from contextvars import ContextVar
+from dataclasses import asdict, dataclass
+from pathlib import Path
+from typing import Final
+
+__all__ = [
+    "ATTEMPTS_DIR",
+    "AttemptRecord",
+    "AttemptRecords",
+    "PriorAttemptAliveError",
+    "fence_work_record",
+    "process_start_time",
+    "recorded_group",
+    "refuse_if_prior_attempt_alive",
+]
+
+ATTEMPTS_DIR: Final[str] = "attempts"
+_DIR_MODE: Final[int] = 0o700
+_FILE_MODE: Final[int] = 0o600
+# A Work Record id names a file here, so it must not be able to name one anywhere else.
+_SAFE_ID: Final[re.Pattern[str]] = re.compile(r"[A-Za-z0-9_-][A-Za-z0-9._-]*")
+
+
+@dataclass(frozen=True, slots=True)
+class AttemptRecord:
+    pgid: int
+    start_time: str
+    attempt: int
+
+
+class PriorAttemptAliveError(Exception):
+    """A spawn was refused: an earlier attempt's process group for this Work Record lives."""
+
+    def __init__(self, work_record_id: str, prior: AttemptRecord) -> None:
+        super().__init__(
+            f"work record {work_record_id}: attempt {prior.attempt} still runs "
+            f"(process group {prior.pgid})"
+        )
+        self.work_record_id = work_record_id
+        self.prior = prior
+
+
+def process_start_time(pid: int) -> str | None:
+    """When ``pid`` started, in the platform's own units, or None if no such process.
+
+    Only ever compared for equality with an earlier reading of the same pid on the same
+    host, so the units need not agree across platforms: clock ticks since boot on Linux,
+    the ``lstart`` text on macOS (one-second resolution, which a pid recycled within the
+    same second would defeat -- not a case a harness spawn produces).
+    """
+
+    if sys.platform == "linux":
+        return _linux_start_time(pid)
+    return _ps_start_time(pid)
+
+
+def _linux_start_time(pid: int) -> str | None:
+    try:
+        stat = Path(f"/proc/{pid}/stat").read_text(encoding="utf-8", errors="replace")
+    except (FileNotFoundError, ProcessLookupError):
+        return None
+    # Field 2 is the command name in parentheses and may itself hold spaces or ')', so
+    # the fields are counted from after its *last* ')': field 3 is index 0, 22 is 19.
+    return stat[stat.rindex(")") + 2 :].split()[19]
+
+
+def _ps_start_time(pid: int) -> str | None:
+    completed = subprocess.run(
+        ["ps", "-o", "lstart=", "-p", str(pid)],
+        capture_output=True,
+        text=True,
+        check=False,
+    )
+    started = completed.stdout.strip()
+    return started if completed.returncode == 0 and started else None
+
+
+class AttemptRecords:
+    """The ``attempts/`` directory of one Runner's state directory."""
+
+    def __init__(self, state_dir: Path, *, workspace_root: Path) -> None:
+        self._dir = state_dir / ATTEMPTS_DIR
+        if self._dir.resolve().is_relative_to(workspace_root.resolve()):
+            raise ValueError(
+                f"attempt records at {self._dir} would sit under the workspace root "
+                f"{workspace_root}, where an Agent could forge them"
+            )
+
+    def path(self, work_record_id: str) -> Path:
+        if not _SAFE_ID.fullmatch(work_record_id):
+            raise ValueError(f"work record id is not a file name: {work_record_id!r}")
+        return self._dir / f"{work_record_id}.json"
+
+    def refuse_if_alive(self, work_record_id: str) -> None:
+        """Raise if a recorded group for this Work Record lives; clear a stale record."""
+
+        path = self.path(work_record_id)
+        record = _read(path)
+        if record is None:
+            return
+        if _alive(record):
+            raise PriorAttemptAliveError(work_record_id, record)
+        _unlink_if(path, record)
+
+    def record(self, work_record_id: str, *, pgid: int, attempt: int) -> AttemptRecord | None:
+        """Claim the Work Record for a just-spawned group; None if it already exited.
+
+        Exclusive create, so two attempts that both passed the pre-spawn check in the
+        same instant cannot both hold the claim: the second finds the first's record
+        and is refused.
+        """
+
+        start_time = process_start_time(pgid)
+        if start_time is None:
+            return None
+        record = AttemptRecord(pgid=pgid, start_time=start_time, attempt=attempt)
+        path = self.path(work_record_id)
+        self._dir.mkdir(mode=_DIR_MODE, parents=True, exist_ok=True)
+        while True:
+            try:
+                fd = os.open(path, os.O_WRONLY | os.O_CREAT | os.O_EXCL, _FILE_MODE)
+            except FileExistsError:
+                self.refuse_if_alive(work_record_id)
+                continue
+            with os.fdopen(fd, "w", encoding="utf-8") as handle:
+                json.dump(asdict(record), handle)
+            return record
+
+    def release(self, work_record_id: str, record: AttemptRecord) -> None:
+        """Remove our own record once its group leader has exited.
+
+        Kept while the leader lives -- a cancel whose kill did not land -- so the next
+        attempt is still refused rather than let in beside it.
+        """
+
+        if not _alive(record):
+            _unlink_if(self.path(work_record_id), record)
+
+    def sweep(self) -> None:
+        """At Runner start: drop records whose process is gone, keep the live ones.
+
+        A workstation Runner restarted without its children leaves them running in the
+        Workspace; their records stay so the check still refuses until they exit.
+        """
+
+        if not self._dir.is_dir():
+            return
+        for path in self._dir.glob("*.json"):
+            record = _read(path)
+            if record is None or not _alive(record):
+                path.unlink(missing_ok=True)
+
+
+def _read(path: Path) -> AttemptRecord | None:
+    try:
+        payload = json.loads(path.read_text(encoding="utf-8"))
+        return AttemptRecord(
+            pgid=int(payload["pgid"]),
+            start_time=str(payload["start_time"]),
+            attempt=int(payload["attempt"]),
+        )
+    except FileNotFoundError:
+        return None
+    except (ValueError, KeyError, TypeError):
+        # Half-written by a Runner that died mid-write: it fences nothing it can name.
+        return AttemptRecord(pgid=0, start_time="", attempt=0)
+
+
+def _alive(record: AttemptRecord) -> bool:
+    return record.pgid > 0 and process_start_time(record.pgid) == record.start_time
+
+
+def _unlink_if(path: Path, record: AttemptRecord) -> None:
+    # Another attempt may have replaced a stale record between our read and this unlink;
+    # only the record we judged is ours to remove.
+    if _read(path) == record:
+        path.unlink(missing_ok=True)
+
+
+@dataclass(frozen=True, slots=True)
+class _Fence:
+    records: AttemptRecords
+    work_record_id: str
+    attempt: int
+
+
+_FENCE: ContextVar[_Fence | None] = ContextVar("agentic_runner_attempt_fence", default=None)
+
+
+@contextlib.contextmanager
+def fence_work_record(
+    records: AttemptRecords, work_record_id: str, *, attempt: int
+) -> Iterator[None]:
+    """Fence every process group spawned inside this block to ``work_record_id``."""
+
+    token = _FENCE.set(_Fence(records=records, work_record_id=work_record_id, attempt=attempt))
+    try:
+        yield
+    finally:
+        _FENCE.reset(token)
+
+
+def refuse_if_prior_attempt_alive() -> None:
+    """Called before a spawn; a no-op outside a fenced block."""
+
+    fence = _FENCE.get()
+    if fence is not None:
+        fence.records.refuse_if_alive(fence.work_record_id)
+
+
+@contextlib.contextmanager
+def recorded_group(pgid: int) -> Iterator[None]:
+    """Hold the Work Record's record for a spawned group while the block waits on it.
+
+    Raises :class:`PriorAttemptAliveError` on entry if another attempt claimed the Work
+    Record since the pre-spawn check; the caller kills the group it just spawned.
+    """
+
+    fence = _FENCE.get()
+    record = (
+        None
+        if fence is None
+        else fence.records.record(fence.work_record_id, pgid=pgid, attempt=fence.attempt)
+    )
+    try:
+        yield
+    finally:
+        if fence is not None and record is not None:
+            fence.records.release(fence.work_record_id, record)

{agentic_runner-2.6.0 → agentic_runner-2.7.0}/src/agentic_runner/runtime/verifier_command.py

@@ -1,9 +1,11 @@
 from __future__ import annotations
 
+import contextlib
 import hashlib
 import json
 import os
 import re
+import signal
 import subprocess
 import time
 from collections.abc import Callable, Mapping
@@ -11,6 +13,11 @@ from dataclasses import dataclass
 from pathlib import Path
 from typing import Protocol
 
+from agentic_runner.attempts import (
+    PriorAttemptAliveError,
+    recorded_group,
+    refuse_if_prior_attempt_alive,
+)
 from agentic_runner_contracts.redaction import redact_secret_like_text
 
 DEFAULT_OUTPUT_LIMIT_BYTES = 16_384
@@ -91,21 +98,44 @@ def _subprocess_runner(
     that cannot separate uids still verifies, and they arrive together from
     ``DirectiveSandbox.spawn_kwargs`` — the uid drop in subprocess's own C fork-exec path,
     only the rlimits in the Python hook.
+
+    Its own session, killed as a group on timeout, like a Directive: the test suite
+    forks workers into the Workspace, and the attempt fence (``attempts.py``) records
+    the group by its pgid.
     """
 
-    return subprocess.run(
+    refuse_if_prior_attempt_alive()
+    with subprocess.Popen(
         list(argv),
         cwd=cwd,
         env=env,
-        timeout=timeout_seconds,
-        check=False,
-        capture_output=True,
+        stdout=subprocess.PIPE,
+        stderr=subprocess.PIPE,
         text=True,
+        start_new_session=True,
         preexec_fn=preexec_fn,
         user=user,
         group=group,
         extra_groups=extra_groups,
-    )
+    ) as process:
+        try:
+            with recorded_group(process.pid):
+                try:
+                    stdout, stderr = process.communicate(timeout=timeout_seconds)
+                except subprocess.TimeoutExpired:
+                    _kill_group(process)
+                    raise
+        except PriorAttemptAliveError:
+            _kill_group(process)
+            raise
+    return subprocess.CompletedProcess(process.args, process.returncode, stdout, stderr)
+
+
+def _kill_group(process: subprocess.Popen[str]) -> None:
+    with contextlib.suppress(ProcessLookupError, PermissionError):
+        os.killpg(process.pid, signal.SIGKILL)
+    process.kill()
+    process.communicate()
 
 
 def run(

{agentic_runner-2.6.0 → agentic_runner-2.7.0}/src/agentic_runner/service.py

@@ -44,6 +44,7 @@ from temporalio.worker import (
 
 from agentic_runner import __version__ as runner_version
 from agentic_runner.activities import RunnerRalphActivities
+from agentic_runner.attempts import AttemptRecords
 from agentic_runner.child_watcher import install_stop_tolerant_child_watcher
 from agentic_runner.config import RunnerConfig
 from agentic_runner.config import load as load_config
@@ -1021,6 +1022,10 @@ def _activities(
     )
     static_git_token = os.getenv("AGENTIC_OS_GIT_TOKEN") or None
     isolation = build_contract_isolation(settings, can_separate_uids=can_change_uid)
+    attempt_records = AttemptRecords(config.state_dir, workspace_root=settings.WORKSPACE_ROOT)
+    # Only the dead go: a live record is a harness this process lost on restart, still
+    # writing its Workspace, and the next attempt must keep being refused (RR-05).
+    attempt_records.sweep()
     ralph = RunnerRalphActivities(
         fastapi,
         runtime_context_resolver=WorkerRuntimeContextResolver(fastapi),
@@ -1056,6 +1061,7 @@ def _activities(
         message_store=messages,
         workflow_signaller=signaller,
         tool_server_health=tool_servers,
+        attempt_records=attempt_records,
     )
     return [
         *ralph.activity_callables(),

{agentic_runner-2.6.0 → agentic_runner-2.7.0}/src/agentic_runner/workers/_runtime_support.py

@@ -19,6 +19,11 @@ from dataclasses import dataclass
 from pathlib import Path
 from typing import Final
 
+from agentic_runner.attempts import (
+    PriorAttemptAliveError,
+    recorded_group,
+    refuse_if_prior_attempt_alive,
+)
 from agentic_runner.callback import CALLBACK_SOCKET_ENV, CALLBACK_TOKEN_ENV
 from agentic_runner.egress import EGRESS_ENV_NAMES
 from agentic_runner.llm_proxy import PROXY_ENV_NAMES
@@ -110,6 +115,7 @@ async def run_subprocess_exec(
     output_limit_bytes: int,
     sandbox: DirectiveSandbox | None = None,
 ) -> SubprocessResult:
+    refuse_if_prior_attempt_alive()
     process = await asyncio.create_subprocess_exec(
         *argv,
         cwd=cwd,
@@ -121,14 +127,23 @@ async def run_subprocess_exec(
         **({} if sandbox is None else sandbox.spawn_kwargs()),
     )
     try:
-        stdout_bytes, stderr_bytes, stdout_truncated, stderr_truncated = await asyncio.wait_for(
-            _collect_process_output(process, stdin=stdin, output_limit_bytes=output_limit_bytes),
-            timeout=timeout_seconds,
-        )
-    except TimeoutError:
-        await _terminate_process_tree(process)
-        raise
-    except asyncio.CancelledError:
+        with recorded_group(process.pid):
+            try:
+                (
+                    stdout_bytes,
+                    stderr_bytes,
+                    stdout_truncated,
+                    stderr_truncated,
+                ) = await asyncio.wait_for(
+                    _collect_process_output(
+                        process, stdin=stdin, output_limit_bytes=output_limit_bytes
+                    ),
+                    timeout=timeout_seconds,
+                )
+            except (TimeoutError, asyncio.CancelledError):
+                await _terminate_process_tree(process)
+                raise
+    except PriorAttemptAliveError:
         await _terminate_process_tree(process)
         raise
 

agentic_runner-2.7.0/src/agentic_runner/workers/skills.py

@@ -0,0 +1,164 @@
+"""The Agent's attached Skills, delivered to its Agent Runtime for one Directive.
+
+Console-v2 issue 28, ADR-0017 §1. Where each runtime reads a Skill was measured against the
+Runner's own argv, not assumed (local-agents 02 asked the same question over ACP):
+
+- **Codex** (codex-cli 0.159.2): ``$CODEX_HOME/skills/<slug>/SKILL.md`` is advertised to the
+  model under ``codex exec``, with and without ``--ignore-user-config``. The Runner writes
+  there, in the Contract's harness root, and removes it after the Directive.
+- **Claude Code** (2.1.292): the Runner runs ``claude --print --bare``, and ``--bare`` drops
+  the Skill tool. ``$CLAUDE_CONFIG_DIR/skills/<slug>/SKILL.md`` is then neither advertised
+  nor resolved by ``/<slug>``, and ``--tools …,Skill`` does not bring the tool back. Claude
+  Code therefore gets the bodies as a prompt preamble. Dropping ``--bare`` would also
+  re-enable the Workspace's hooks and ``CLAUDE.md``, which is not this module's call.
+
+The harness root is per Contract, not per Directive, so two concurrent Directives of one
+Contract share its ``skills`` directory.
+"""
+
+from __future__ import annotations
+
+import asyncio
+import hashlib
+import json
+import sys
+from collections.abc import Sequence
+from enum import StrEnum
+from pathlib import Path
+from typing import Final
+
+from agentic_runner_contracts.runtime_context import SkillVersionSpec
+
+__all__ = [
+    "SKILLS_DIR",
+    "SkillDelivery",
+    "SkillDeliveryError",
+    "delivery_for",
+    "first_digest_mismatch",
+    "remove_skills",
+    "skills_preamble",
+    "write_skills",
+]
+
+SKILLS_DIR: Final[str] = "skills"
+
+
+class SkillDelivery(StrEnum):
+    DIRECTORY = "directory"
+    PROMPT_PREAMBLE = "prompt_preamble"
+
+
+_DELIVERY_BY_CLI_KIND: Final[dict[str, SkillDelivery]] = {
+    "codex_cli": SkillDelivery.DIRECTORY,
+    "claude_code": SkillDelivery.PROMPT_PREAMBLE,
+}
+
+
+class SkillDeliveryError(RuntimeError):
+    """Raised when the Skills could not be written into, or removed from, the harness root."""
+
+
+def delivery_for(cli_kind: str) -> SkillDelivery:
+    return _DELIVERY_BY_CLI_KIND.get(cli_kind, SkillDelivery.PROMPT_PREAMBLE)
+
+
+def first_digest_mismatch(skills: Sequence[SkillVersionSpec]) -> SkillVersionSpec | None:
+    for skill in skills:
+        if hashlib.sha256(skill.body.encode("utf-8")).hexdigest() != skill.sha256:
+            return skill
+    return None
+
+
+def skills_preamble(skills: Sequence[SkillVersionSpec]) -> str:
+    """The bodies, for a runtime with no skills directory. Empty Skills, empty preamble,
+    so a Directive without Skills keeps a byte-identical prompt."""
+
+    if not skills:
+        return ""
+    sections = "".join(
+        f"Skill {skill.slug} (version {skill.version}):\n{skill.body.strip()}\n\n"
+        for skill in skills
+    )
+    return (
+        "The Skills below are attached to you. Follow each one where it applies.\n\n"
+        f"{sections}"
+        "The pipeline rules take precedence over the Skills above: edit files only, do not "
+        "run git commit or git push, and do not open a pull request — the pipeline commits, "
+        "pushes, and manages the PR.\n\n"
+    )
+
+
+# Both run as the Contract's uid, never the Runner's. The Contract owns its harness root, so
+# an Agent could have left a symlink there; a write or an rmtree by the Runner -- with
+# CAP_CHOWN and CAP_DAC_OVERRIDE -- would follow it out of the tree. As the Contract's uid
+# it can only reach what the Contract already could.
+_WRITE_SCRIPT: Final[str] = """
+import json, os, sys
+root, skills = json.load(sys.stdin)
+os.makedirs(root, mode=0o700, exist_ok=True)
+for slug, body in skills:
+    directory = os.path.join(root, slug)
+    os.makedirs(directory, mode=0o700, exist_ok=True)
+    path = os.path.join(directory, "SKILL.md")
+    flags = os.O_WRONLY | os.O_CREAT | os.O_TRUNC | os.O_NOFOLLOW
+    with os.fdopen(os.open(path, flags, 0o600), "w", encoding="utf-8") as handle:
+        handle.write(body)
+"""
+
+_REMOVE_SCRIPT: Final[str] = """
+import json, os, shutil, sys
+root, slugs = json.load(sys.stdin)
+for slug in slugs:
+    shutil.rmtree(os.path.join(root, slug), ignore_errors=True)
+left = [slug for slug in slugs if os.path.lexists(os.path.join(root, slug))]
+if left:
+    sys.exit("not removed: " + ", ".join(left))
+"""
+
+
+def _skills_root(harness_config_dir: Path) -> str:
+    return str(harness_config_dir / SKILLS_DIR)
+
+
+async def write_skills(
+    harness_config_dir: Path, skills: Sequence[SkillVersionSpec], *, uid: int | None
+) -> None:
+    """Write each Skill as ``<harness>/skills/<slug>/SKILL.md``, as the Contract's uid."""
+
+    await _run_as(
+        uid,
+        _WRITE_SCRIPT,
+        [_skills_root(harness_config_dir), [[skill.slug, skill.body] for skill in skills]],
+    )
+
+
+async def remove_skills(
+    harness_config_dir: Path, skills: Sequence[SkillVersionSpec], *, uid: int | None
+) -> None:
+    """Remove what :func:`write_skills` wrote. The ``skills`` directory itself stays:
+    Codex keeps its own ``.system`` Skills there."""
+
+    await _run_as(
+        uid,
+        _REMOVE_SCRIPT,
+        [_skills_root(harness_config_dir), [skill.slug for skill in skills]],
+    )
+
+
+async def _run_as(uid: int | None, script: str, payload: object) -> None:
+    identity: dict[str, object] = (
+        {} if uid is None else {"user": uid, "group": uid, "extra_groups": []}
+    )
+    process = await asyncio.create_subprocess_exec(
+        sys.executable,
+        "-I",
+        "-c",
+        script,
+        stdin=asyncio.subprocess.PIPE,
+        stdout=asyncio.subprocess.DEVNULL,
+        stderr=asyncio.subprocess.PIPE,
+        **identity,  # type: ignore[arg-type]
+    )
+    _, stderr = await process.communicate(json.dumps(payload).encode("utf-8"))
+    if process.returncode != 0:
+        raise SkillDeliveryError(stderr.decode("utf-8", errors="replace").strip()[-500:])