agentic-runner 3.1.0__tar.gz → 3.2.0__tar.gz

{agentic_runner-3.1.0 → agentic_runner-3.2.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: agentic-runner
-Version: 3.1.0
+Version: 3.2.0
 Summary: The Agentic OS Runner: an activity-only Temporal executor for workspaces, Agent Runtimes and verb seams
 License-Expression: AGPL-3.0-only
 License-File: LICENSE

{agentic_runner-3.1.0 → agentic_runner-3.2.0}/src/agentic_runner/__init__.py

@@ -7,6 +7,6 @@ stay on the platform; this package imports none of them, and a CI partition test
 (``tests/test_package_partition.py``) fails the build if that changes.
 """
 
-__version__ = "3.1.0"
+__version__ = "3.2.0"
 
 __all__ = ["__version__"]

{agentic_runner-3.1.0 → agentic_runner-3.2.0}/src/agentic_runner/build.py

@@ -23,7 +23,7 @@ def build_id(package: Path = _PACKAGE) -> str:
 
     Self-reported build identity (12 B7), not a signature: the consoles say
     "self-reported" beside it. Only ``.py`` files count, so a wheel, the image and a
-    Homebrew install of one release give the same value whatever bytecode each compiled.
+    ``uv tool install`` of one release give the same value whatever bytecode each compiled.
     """
 
     digest = sha256()

{agentic_runner-3.1.0 → agentic_runner-3.2.0}/src/agentic_runner/cli.py

@@ -333,7 +333,8 @@ def _install(arguments: argparse.Namespace, paths: workstation.OrgPaths) -> int:
         return 2
     # Pasted, never a flag: a flag is in the process table for every uid on the box.
     token = os.environ.get(AGENT_TOKEN_ENV, "").strip() or getpass.getpass(
-        "Agent Token (issued to you by the Organisation's Admin): "
+        "Agent Token (yours from /me/runners, or the Organisation Admin's for an "
+        "Organisation Runner): "
     )
     settings = workstation.WorkstationSettings(
         org=paths.org,

{agentic_runner-3.1.0 → agentic_runner-3.2.0}/src/agentic_runner/registration.py

@@ -69,6 +69,7 @@ INTAKE_IGNORED_PATH = "/api/runner/v1/runners/intake/ignored"
 # The refusal a revoked Runner's heartbeat earns (06 §2: revocation *is* the refused
 # heartbeat). The one reason this process stops on rather than retries.
 RUNNER_REVOKED_REASON = "runner_revoked"
+CONTROL_PLANE_OLDER_REASON = "control_plane_older"
 
 # What the state directory holds after a successful bootstrap. One file, mode 0600: the
 # private key is in it, and a Runner that loses it re-bootstraps rather than recovering.
@@ -346,9 +347,29 @@ def _refusal(response: httpx.Response) -> tuple[str, str]:
         detail = None
     if isinstance(detail, dict) and "reason" in detail:
         return str(detail["reason"]), str(detail.get("detail", detail["reason"]))
+    if unknown := _fields_the_control_plane_does_not_know(response.status_code, detail):
+        return CONTROL_PLANE_OLDER_REASON, (
+            f"the control plane is older than this Runner (agentic-runner {runner_version}, "
+            f"agentic-runner-contracts {contracts_version}): it does not know "
+            f"{', '.join(unknown)}. Install the agentic-runner release that matches the "
+            "control plane, or ask your Organisation's Admin to upgrade it."
+        )
     return "refused", f"{response.status_code}: {response.text[:200]}"
 
 
+def _fields_the_control_plane_does_not_know(status_code: int, detail: Any) -> list[str]:
+    # A strict request model (extra="forbid") answering 422 with nothing but
+    # `extra_forbidden` errors is version skew, not a bad token: this Runner's contracts
+    # added fields the control plane's pinned contracts have not caught up to (RR-13).
+    if status_code != 422 or not isinstance(detail, list) or not detail:
+        return []
+    if not all(
+        isinstance(error, dict) and error.get("type") == "extra_forbidden" for error in detail
+    ):
+        return []
+    return [str(error.get("loc", ["?"])[-1]) for error in detail]
+
+
 class SignedIntakeStream:
     """:class:`agentic_runner.user_sources.IntakeStream` over the signed outbound stream."""
 

{agentic_runner-3.1.0 → agentic_runner-3.2.0}/src/agentic_runner/workstation.py

@@ -570,7 +570,7 @@ def status_lines(paths: OrgPaths, *, now: datetime | None = None) -> list[str]:
     pid = process_id(paths)
     state = load_state(paths.state_dir)
     age = heartbeat_age(paths, now=now)
-    return [
+    lines = [
         f"organisation   {paths.org} ({paths.state_dir})",
         f"process        {'running, pid ' + str(pid) if pid else 'not running'}",
         (
@@ -580,6 +580,30 @@ def status_lines(paths: OrgPaths, *, now: datetime | None = None) -> list[str]:
         ),
         f"heartbeat      {'never' if age is None else f'{age:.0f}s ago'}",
     ]
+    if pid and state is not None:
+        lines.extend(next_step_lines(state.host_party))
+    return lines
+
+
+def next_step_lines(host_party: str) -> list[str]:
+    """Where to go once the Runner is live (QTS-1314): the dogfood install ended at
+    ``started`` and left the person with no idea what the console wanted next.
+
+    Paths, not URLs: the Runner knows its control plane, not the console, and the two need
+    not share a domain (QTS-1300) -- the person minted the token on that console anyway.
+    """
+
+    if host_party == "user":
+        return [
+            "next           open /me/runners in the console to see this Runner, then "
+            "/me/work/new and pick a Contract that says it runs on a Runner you host"
+        ]
+    if host_party:
+        return [
+            "next           this Runner takes the work of Contracts whose Runner is hosted by "
+            f"the {host_party}; it shows on the Organisation Console's Runners page"
+        ]
+    return []
 
 
 # ------------------------------------------------------------------ the verbs
@@ -598,15 +622,17 @@ async def install(
 ) -> list[str]:
     """Register this Organisation's process and install its login agent.
 
-    Registration happens here, once, with the Agent Token the Organisation's Admin issued
-    to this user (12 A6) -- pasted at the prompt, never stored: the identity bootstrap
-    hands back is what every later start uses, and a lost state directory means a
-    reinstall and a re-delivery of any sealed value (22 A4), by design.
+    Registration happens here, once, with the Agent Token this user minted on /me/runners
+    or the Organisation's Admin issued them (12 A6, QTS-1304) -- pasted at the prompt,
+    never stored: the identity bootstrap hands back is what every later start uses, and a
+    lost state directory means a reinstall and a re-delivery of any sealed value (22 A4),
+    by design.
     """
 
     require_any_cli(settings.path)
     paths.create()
     settings.save(paths)
+    already_registered = load_state(paths.state_dir) is not None
     state, outcome = await service.register(
         state_dir=paths.state_dir,
         can_separate_uids=False,
@@ -619,10 +645,20 @@ async def install(
     definition = service_definition(paths, settings, platform=platform, home=home)
     definition.path.parent.mkdir(parents=True, exist_ok=True)
     definition.path.write_bytes(definition.content)
-    lines = [outcome, f"login agent    {definition.path}"]
+    lines = [outcome]
+    if already_registered:
+        # QTS-1314: the dogfood reinstall kept an Organisation-hosted identity while the
+        # person believed the user-hosted token they had just pasted had taken effect.
+        lines.append(
+            f"token          not used: {paths.state_dir} already holds Runner "
+            f"{state.runner_id}; to register a new one, stop it and move that directory "
+            "aside (docs/workstation.md, Switch to a new token)"
+        )
+    lines.append(f"login agent    {definition.path}")
     if start_service:
         drive(definition.install + definition.start, run=run)
         lines.append(f"started        {state.runner_id}")
+        lines.extend(next_step_lines(state.host_party))
     return lines