agentic-runner 3.13.0__tar.gz → 3.15.0__tar.gz

{agentic_runner-3.13.0 → agentic_runner-3.15.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: agentic-runner
-Version: 3.13.0
+Version: 3.15.0
 Summary: The Agentic OS Runner: an activity-only Temporal executor for workspaces, Agent Runtimes and verb seams
 License-Expression: AGPL-3.0-only
 License-File: LICENSE

{agentic_runner-3.13.0 → agentic_runner-3.15.0}/src/agentic_runner/__init__.py

@@ -7,6 +7,6 @@ stay on the platform; this package imports none of them, and a CI partition test
 (``tests/test_package_partition.py``) fails the build if that changes.
 """
 
-__version__ = "3.13.0"
+__version__ = "3.15.0"
 
 __all__ = ["__version__"]

{agentic_runner-3.13.0 → agentic_runner-3.15.0}/src/agentic_runner/activities.py

@@ -137,7 +137,7 @@ from agentic_runner.workers.agent_runtime import (
     PermissionFallback,
     ResumableAgentRuntime,
 )
-from agentic_runner.workers.contract_device_login import login_file_counts
+from agentic_runner.workers.contract_device_login import holds_login, login_file_counts
 from agentic_runner.workers.contract_isolation import (
     NO_CONTRACT,
     ContractIsolation,
@@ -2995,20 +2995,29 @@ class RunnerRalphActivities:
         """This Directive's auth mode, or a non-retryable refusal with Evidence naming the
         rule (local-agents 04).
 
-        Decided from the host party this process was registered with and from whether a
-        key is present for the Contract -- never from the payload. A runtime that declares
-        no modes (a test double built before the port grew the field) reads as
-        ``api_key``-only, and a kind this Runner does not serve reads the same way; that
-        Directive fails closed in :meth:`_agent_runtime_for` regardless.
+        Decided from what this process can check -- the host party it was registered with,
+        whether a key is present for the Contract, whether the Contract runs under its own
+        uid here and whether its harness root holds a login (QTS-1450) -- never from the
+        payload. A runtime that declares no modes (a test double built before the port
+        grew the field) reads as ``api_key``-only, and a kind this Runner does not serve
+        reads the same way; that Directive fails closed in :meth:`_agent_runtime_for`
+        regardless.
         """
 
         runtime = self._agent_runtimes.get(state.cli_kind)
         host_party = self._routing_identity.host_party if self._routing_identity else None
+        contract_uid = self._runs_under_contract_uid(state)
         try:
             return choose_auth_mode(
                 host_party=host_party,
                 key_present=self._api_key_present(state, runtime),
                 runtime_modes=getattr(runtime, "auth_modes", frozenset({AuthMode.API_KEY})),
+                contract_uid=contract_uid,
+                harness_login=(
+                    contract_uid
+                    and self._contract_isolation is not None
+                    and holds_login(self._contract_isolation, state.contract_id, state.cli_kind)
+                ),
             )
         except AuthModeRefusedError as refusal:
             await _raise_recorded(
@@ -3026,6 +3035,16 @@ class RunnerRalphActivities:
                 },
             )
 
+    def _runs_under_contract_uid(self, state: _RuntimeContextState) -> bool:
+        """Whether this Directive spawns as its own Contract's uid. A Work Record with no
+        Contract shares the one no-Contract tree, so it never does."""
+
+        return (
+            self._contract_isolation is not None
+            and self._contract_isolation.can_separate_uids
+            and _optional_uuid(state.contract_id) is not None
+        )
+
     def _api_key_present(self, state: _RuntimeContextState, runtime: AgentRuntime | None) -> bool:
         """A delivered slot for the Contract (or its funder), or the host operator's key."""
 
@@ -3039,18 +3058,21 @@ class RunnerRalphActivities:
         )
 
     async def _report_login_residue(self, work_record_id: str, state: _RuntimeContextState) -> None:
-        """On a shared Runner, say once that a Contract's harness root holds a login.
+        """On a shared Runner that cannot run a subscription, say once that a Contract's
+        harness root holds a login.
 
         A count per harness, never a path or a byte of the file: the Runner does not open
-        it, a shared Runner never runs on it, and ``wipe_contract_residue`` removes it with
-        the Contract. Saying so is what turns a sign-in made before local-agents 03 (or by
-        hand) into something the Organisation can see and act on.
+        it, a shared Runner without Contract uids never runs on it (QTS-1450), and
+        ``wipe_contract_residue`` removes it with the Contract. Saying so is what turns a
+        sign-in made before local-agents 03 (or by hand) into something the Organisation
+        can see and act on.
         """
 
         host_party = self._routing_identity.host_party if self._routing_identity else None
         if (
             self._contract_isolation is None
             or not is_shared_runner(host_party)
+            or self._runs_under_contract_uid(state)
             or state.contract_id in self._residue_checked
         ):
             return

agentic_runner-3.15.0/src/agentic_runner/auth_mode.py

@@ -0,0 +1,126 @@
+"""Which auth mode one Directive runs in, decided on the Runner before spawn (local-agents 04).
+
+Subscriptions follow the person and the actual operator, not the host party (QTS-1349,
+QTS-1450). A harness runs on a subscription login where the Runner can verify that the
+login is the Contract's alone:
+
+* on the Contract person's own Runner -- host party ``user``, which routing has already
+  tied to the Contract's person (``assert_routed`` here, the platform's
+  ``_subscription_bound`` there);
+* on a shared Runner (``organisation`` or ``account``, e.g. a customer-operated cluster)
+  only when the Directive runs as its Contract's own uid and that Contract's harness root
+  holds a login. The uid is what keeps one Contract's login out of every other
+  Contract's reach on the same host; the login is what the person made there themselves.
+
+The platform decides who may use a subscription at the door (the Subscription Principal
+and the Organisation's opt-in, QTS-1350); this module is the backstop, so it decides from
+what the Runner itself can check and never from the payload.
+"""
+
+from __future__ import annotations
+
+from collections.abc import Collection
+from typing import Final
+
+from agentic_runner.workers.agent_runtime import AuthMode
+
+__all__ = [
+    "NO_RUNTIME_SUBSCRIPTION_RULE",
+    "SETUP_TOKEN_REFUSED_RULE",
+    "SHARED_HOST_PARTIES",
+    "SIGN_IN_NEEDS_CONTRACT_UID_RULE",
+    "SUBSCRIPTION_NEEDS_CONTRACT_UID_RULE",
+    "SUBSCRIPTION_NEEDS_HARNESS_LOGIN_RULE",
+    "AuthModeRefusedError",
+    "choose_auth_mode",
+    "is_setup_token",
+    "is_shared_runner",
+    "runs_subscriptions",
+]
+
+SHARED_HOST_PARTIES: Final[frozenset[str]] = frozenset({"organisation", "account"})
+
+# The rule names a refusal's Evidence carries, so a support read can say which line held.
+SUBSCRIPTION_NEEDS_CONTRACT_UID_RULE: Final[str] = "subscription_needs_contract_uid"
+SUBSCRIPTION_NEEDS_HARNESS_LOGIN_RULE: Final[str] = "subscription_needs_harness_login"
+NO_RUNTIME_SUBSCRIPTION_RULE: Final[str] = "runtime_has_no_subscription_mode"
+SIGN_IN_NEEDS_CONTRACT_UID_RULE: Final[str] = "sign_in_needs_contract_uid"
+SETUP_TOKEN_REFUSED_RULE: Final[str] = "setup_token_refused"
+# `claude setup-token` mints an OAuth bearer under this prefix; an Anthropic API key is
+# `sk-ant-api…`. The sealed wire carries no mode, so the value's own shape is what the
+# Runner can refuse on.
+_SETUP_TOKEN_PREFIX: Final[str] = "sk-ant-oat"
+
+
+class AuthModeRefusedError(RuntimeError):
+    """A Directive or sign-in this Runner will not run; ``rule`` is the stable code."""
+
+    def __init__(self, rule: str, message: str) -> None:
+        super().__init__(message)
+        self.rule = rule
+
+
+def is_shared_runner(host_party: str | None) -> bool:
+    return host_party in SHARED_HOST_PARTIES
+
+
+def runs_subscriptions(host_party: str | None, *, separates_contract_uids: bool) -> bool:
+    """Whether a subscription login made on this Runner could ever run a Directive.
+
+    What a sign-in is checked against: one made where no Directive could use it would
+    only leave a login lying in a harness root. An unregistered process (no host party)
+    makes no routing assertion, so it is nobody's own Runner and never qualifies.
+    """
+
+    return host_party == "user" or (is_shared_runner(host_party) and separates_contract_uids)
+
+
+def choose_auth_mode(
+    *,
+    host_party: str | None,
+    key_present: bool,
+    runtime_modes: Collection[AuthMode],
+    contract_uid: bool,
+    harness_login: bool,
+) -> AuthMode:
+    """``api_key`` whenever a key is present; otherwise ``subscription`` where the Runner
+    can verify the login is this Contract's, and a refusal on a shared Runner where it
+    cannot.
+
+    ``contract_uid`` says the Directive runs as its own Contract's uid (never the shared
+    no-Contract tree's); ``harness_login`` that this Contract's harness root for the
+    Directive's kind holds a login. A shared Runner with no key and either one missing has
+    nothing left that could authenticate the harness, so it refuses, naming the missing
+    one. An unregistered process (``host_party`` ``None``) never runs a subscription; it
+    runs on a key or fails at the proxy for want of one.
+    """
+
+    if key_present:
+        return AuthMode.API_KEY
+    if host_party == "user":
+        return AuthMode.SUBSCRIPTION if AuthMode.SUBSCRIPTION in runtime_modes else AuthMode.API_KEY
+    if not is_shared_runner(host_party):
+        return AuthMode.API_KEY
+    if not contract_uid:
+        raise AuthModeRefusedError(
+            SUBSCRIPTION_NEEDS_CONTRACT_UID_RULE,
+            f"this Runner is hosted by {host_party!r} and does not run this Contract under its "
+            "own uid, so it runs API keys only, and no API key is present for this Contract",
+        )
+    if not harness_login:
+        raise AuthModeRefusedError(
+            SUBSCRIPTION_NEEDS_HARNESS_LOGIN_RULE,
+            "no API key is present for this Contract and its harness root on this Runner holds "
+            "no login; sign it in on this Runner with `agentic-runner sign-in`",
+        )
+    if AuthMode.SUBSCRIPTION not in runtime_modes:
+        raise AuthModeRefusedError(
+            NO_RUNTIME_SUBSCRIPTION_RULE,
+            "no API key is present for this Contract and this Runner's runtime for its CLI "
+            "kind runs on API keys only",
+        )
+    return AuthMode.SUBSCRIPTION
+
+
+def is_setup_token(value: str) -> bool:
+    return value.strip().startswith(_SETUP_TOKEN_PREFIX)

{agentic_runner-3.13.0 → agentic_runner-3.15.0}/src/agentic_runner/cli.py

@@ -15,6 +15,10 @@ the Organisation's cap.
 Runner (PRD issue 47, ``workstation.py``): one login agent per Organisation, managed by
 the user who hosts it, with no ``sudo`` anywhere.
 
+``sign-in --contract <id>`` signs one Contract's Claude Code in with Anthropic's own flow,
+in this terminal, as that Contract's uid in its harness root (QTS-1448). No code or token
+passes through the control plane.
+
 ``skill install | print`` hands the setup skill to the person's own Claude Code or Codex
 (``skill.py``, console-v2 issue 21).
 
@@ -36,6 +40,7 @@ import os
 import sys
 from collections.abc import Sequence
 from pathlib import Path
+from uuid import UUID
 
 from agentic_runner import __version__ as runner_version
 from agentic_runner import service, skill, workstation
@@ -59,6 +64,7 @@ from agentic_runner.service import (
     TAGS_ENV,
     parse_tags,
 )
+from agentic_runner.workers.claude_sign_in import OAUTH_TOKEN, SIGN_IN_METHODS
 from agentic_runner_contracts import __version__ as contracts_version
 from agentic_runner_contracts.runner_registration import (
     HostAttestation,
@@ -198,6 +204,21 @@ def main(argv: Sequence[str] | None = None) -> int:
     status.add_argument("org", nargs="?", help="a workstation Organisation (issue 47)")
     status.add_argument("--root", default=None, type=Path)
 
+    sign_in = subcommands.add_parser(
+        "sign-in",
+        help="sign a Contract's Claude Code in with Anthropic's own flow, in this terminal",
+    )
+    sign_in.add_argument("--contract", required=True, help="the Contract's id")
+    sign_in.add_argument(
+        "--method",
+        default=OAUTH_TOKEN,
+        choices=SIGN_IN_METHODS,
+        help="oauth_token: a long-lived token (claude setup-token); claude_ai: a Claude.ai "
+        "login (claude auth login --claudeai)",
+    )
+    sign_in.add_argument("--org", default=None, help="a workstation Organisation (issue 47)")
+    sign_in.add_argument("--root", default=None, type=Path, help=argparse.SUPPRESS)
+
     annotate = subcommands.add_parser("annotate", help="attach an annotation to this Work Record")
     annotate.add_argument("--context", default="default")
     annotate.add_argument(
@@ -303,6 +324,8 @@ def main(argv: Sequence[str] | None = None) -> int:
         for line in lines:
             print(line)
         return 0
+    if arguments.command == "sign-in":
+        return _sign_in(arguments)
     if arguments.command == "skill":
         if arguments.action == "print":
             sys.stdout.write(skill.text())
@@ -366,6 +389,26 @@ def _image_attestation() -> HostAttestation:
     )
 
 
+def _sign_in(arguments: argparse.Namespace) -> int:
+    try:
+        contract_id = str(UUID(arguments.contract))
+    except ValueError:
+        print(f"--contract expects a Contract id, got {arguments.contract!r}", file=sys.stderr)
+        return 2
+    if not (os.isatty(0) and os.isatty(1)):
+        print(
+            "sign-in is interactive: run it in a terminal (`kubectl exec -it`, `docker exec -it`)",
+            file=sys.stderr,
+        )
+        return 2
+    if arguments.org:
+        paths = _org_paths(arguments)
+        os.environ.update(
+            workstation.run_environment(paths, workstation.WorkstationSettings.load(paths))
+        )
+    return asyncio.run(service.sign_in_claude(contract_id, method=arguments.method))
+
+
 def _install(arguments: argparse.Namespace, paths: workstation.OrgPaths) -> int:
     if not arguments.control_plane:
         print(f"--control-plane (or {CONTROL_PLANE_ENV}) is required", file=sys.stderr)

{agentic_runner-3.13.0 → agentic_runner-3.15.0}/src/agentic_runner/device_login_activities.py

@@ -13,8 +13,7 @@ from datetime import UTC, datetime
 from temporalio import activity
 from temporalio.exceptions import ApplicationError
 
-from agentic_runner.auth_mode import SHARED_RUNNER_SIGN_IN_RULE, is_shared_runner
-from agentic_runner.workers.claude_sign_in import OAUTH_TOKEN
+from agentic_runner.auth_mode import SIGN_IN_NEEDS_CONTRACT_UID_RULE, runs_subscriptions
 from agentic_runner.workers.contract_device_login import ContractDeviceLogin
 from agentic_runner.workers.contract_isolation import ContractIsolation
 from agentic_runner_contracts.activity_io import (
@@ -38,7 +37,8 @@ class ContractDeviceLoginActivities:
     ) -> None:
         self._contract_isolation = contract_isolation
         # The party this process was registered as hosted by. A shared Runner signs in only
-        # a Claude Code long-lived token (local-agents 04, amended by 21).
+        # where its Directives run as each Contract's own uid (QTS-1450); a person signs
+        # Claude Code in on the Runner itself (QTS-1448).
         self._host_party = host_party
         # Injectable for tests; None falls through to the real vendor CLIs.
         self._device_login = device_login or ContractDeviceLogin(contract_isolation)
@@ -53,12 +53,9 @@ class ContractDeviceLoginActivities:
     async def sign_in_contract_device_login(
         self, request: ContractDeviceLoginInput
     ) -> ContractDeviceLoginResult:
-        long_lived = request.runtime_kind == "claude_code" and (request.method or OAUTH_TOKEN) == (
-            OAUTH_TOKEN
-        )
-        self._refuse_on_shared_runner(allow=long_lived)
+        self._refuse_where_no_subscription_runs()
         prompt = await self._device_login.sign_in(
-            request.contract_id, runtime_kind=request.runtime_kind, method=request.method
+            request.contract_id, runtime_kind=request.runtime_kind
         )
         return ContractDeviceLoginResult(
             contract_id=prompt.contract_id,
@@ -66,7 +63,6 @@ class ContractDeviceLoginActivities:
             verification_uri=prompt.verification_uri,
             user_code=prompt.user_code,
             expires_at=prompt.expires_at.isoformat(),
-            sign_in_id=prompt.sign_in_id,
         )
 
     @activity.defn(name="check_contract_device_login_status")
@@ -74,7 +70,7 @@ class ContractDeviceLoginActivities:
         self, request: ContractDeviceLoginStatusInput
     ) -> ContractDeviceLoginStatusResult:
         if request.runtime_kind == "claude_code":
-            self._refuse_on_shared_runner(allow=True)
+            self._refuse_where_no_subscription_runs()
             status = await self._device_login.claude.status(request.contract_id)
             return ContractDeviceLoginStatusResult(
                 contract_id=request.contract_id,
@@ -84,7 +80,7 @@ class ContractDeviceLoginActivities:
                 auth_method=status.auth_method,
                 subscription_type=status.subscription_type,
             )
-        self._refuse_on_shared_runner()
+        self._refuse_where_no_subscription_runs()
         present = self._device_login.token_present(
             request.contract_id, runtime_kind=request.runtime_kind
         )
@@ -102,20 +98,22 @@ class ContractDeviceLoginActivities:
             delivered_at=delivered_at,
         )
 
-    def _refuse_on_shared_runner(self, *, allow: bool = False) -> None:
+    def _refuse_where_no_subscription_runs(self) -> None:
         """Non-retryable, and typed by the rule: there is no Work Record to write Evidence
         on here, so the failure the platform's sign-in workflow receives names it.
 
-        Only a Runner known to be the person's own signs in, except that a shared Runner
-        may make (``allow``) a Claude Code long-lived token (local-agents 21). One whose
-        state names no host party (registered before issue 42) is refused either way, as
-        `choose_auth_mode` never runs a subscription on it."""
+        A sign-in, or a read of one, only where a Directive could run on it
+        (``auth_mode.runs_subscriptions``): the person's own Runner, or a shared one that
+        runs each Contract as its own uid. One whose state names no host party (registered
+        before issue 42) is refused, as `choose_auth_mode` never runs a subscription on it.
+        """
 
-        if self._host_party != "user" and not (allow and is_shared_runner(self._host_party)):
+        if not runs_subscriptions(
+            self._host_party, separates_contract_uids=self._contract_isolation.can_separate_uids
+        ):
             raise ApplicationError(
-                f"this Runner is hosted by {self._host_party!r}; only a person's own Runner "
-                "signs in, a shared Runner runs API keys and Claude Code long-lived tokens "
-                "only",
-                type=SHARED_RUNNER_SIGN_IN_RULE,
+                f"this Runner is hosted by {self._host_party!r} and does not run each Contract "
+                "under its own uid, so no subscription runs on it and it signs nothing in",
+                type=SIGN_IN_NEEDS_CONTRACT_UID_RULE,
                 non_retryable=True,
             )

{agentic_runner-3.13.0 → agentic_runner-3.15.0}/src/agentic_runner/sealed_box.py

@@ -63,7 +63,6 @@ from agentic_runner_contracts.sealed_credential import (
     SEAL_DOMAIN,
     OpenedCredential,
     SealedCredential,
-    SealedSignInCode,
     delivery_binding,
     key_fingerprint,
 )
@@ -554,20 +553,10 @@ class SealedCredentialStream:
         if not self._awaiting:
             self._keys.retire_previous()
 
-    def open_sign_in_code(self, sealed: SealedSignInCode) -> str | None:
-        """A relayed sign-in code, or None when it does not open (local-agents 05).
-
-        Opened with the same Recipient Key as a slot, but never held: the caller types it
-        into the waiting CLI and drops it.
-        """
-
-        return self._open_with(sealed.recipient_key_id, sealed.binding(), sealed.ciphertext)
-
     def open_oauth_code(self, sealed: SealedOAuthCode) -> str | None:
         """A relayed OAuth code, or None when it does not open (console-v2 issue 30).
 
-        Never held, like a sign-in code: the caller spends it on the token endpoint and
-        drops it.
+        Never held: the caller spends it on the token endpoint and drops it.
         """
 
         return self._open_with(sealed.recipient_key_id, sealed.binding(), sealed.ciphertext)

{agentic_runner-3.13.0 → agentic_runner-3.15.0}/src/agentic_runner/service.py

@@ -24,6 +24,7 @@ import logging
 import os
 import shutil
 import signal
+import sys
 import tempfile
 import time
 from collections.abc import Awaitable, Callable, Mapping, Sequence
@@ -34,6 +35,7 @@ from typing import Any, Protocol
 from uuid import UUID
 
 import httpx
+from pydantic import ValidationError
 from temporalio import activity
 from temporalio.client import Client
 from temporalio.worker import (
@@ -46,6 +48,7 @@ from temporalio.worker import (
 from agentic_runner import __version__ as runner_version
 from agentic_runner.activities import RunnerRalphActivities
 from agentic_runner.attempts import AttemptRecords
+from agentic_runner.auth_mode import SIGN_IN_NEEDS_CONTRACT_UID_RULE, runs_subscriptions
 from agentic_runner.child_watcher import install_stop_tolerant_child_watcher
 from agentic_runner.config import RunnerConfig
 from agentic_runner.config import load as load_config
@@ -110,7 +113,7 @@ from agentic_runner.user_sources import ProxyTriage, UserSourcePoller
 from agentic_runner.workers.acp_runtime import ACP_BRIDGES, AcpRuntime, profile_acp_executables
 from agentic_runner.workers.agent_runtime import AgentRuntime
 from agentic_runner.workers.claude_runtime import ClaudeRuntime
-from agentic_runner.workers.claude_sign_in import ClaudeSignIns
+from agentic_runner.workers.claude_sign_in import ClaudeSignInError, ClaudeSignIns
 from agentic_runner.workers.codex_runtime import CodexRuntime
 from agentic_runner.workers.contract_device_login import ContractDeviceLogin
 from agentic_runner.workers.contract_isolation import UID_MAP_FILENAME, ContractIsolation
@@ -135,11 +138,7 @@ from agentic_runner_contracts.runner_registration import (
     ResourcePressure,
 )
 from agentic_runner_contracts.runtime_context import WorkerRuntimeContextResolver
-from agentic_runner_contracts.sealed_credential import (
-    SignInCodeOutcome,
-    SignInCodeRelay,
-    key_fingerprint,
-)
+from agentic_runner_contracts.sealed_credential import key_fingerprint
 
 __all__ = [
     "AGENT_TOKEN_ENV",
@@ -166,6 +165,7 @@ __all__ = [
     "run",
     "run_runner_lifecycle_hook",
     "run_worker_until_terminated",
+    "sign_in_claude",
     "with_profile_acp_cli_kinds",
 ]
 
@@ -657,13 +657,8 @@ class ControlPlaneStream:
     usage_windows: UsageWindows | None = None
     # Local-agents 04b: which delivered references fill the LLM proxy's slot, and where.
     llm_slots: Mapping[str, LlmProvider] = field(default_factory=lambda: dict(LLM_SLOT_REFERENCES))
-    # Local-agents 05: the Claude Code sign-ins a relayed code is typed into.
-    sign_ins: ClaudeSignIns | None = None
     # Console-v2 issue 30: the OAuth Connectors whose code, tokens and verifier stay here.
     oauth: OAuthConnectors | None = None
-    # Reported once, on the beat after the relay: a lost beat loses the outcome, and the
-    # console's own wait on the sign-in is what tells the person.
-    _sign_in_outcomes: list[SignInCodeRelay] = field(default_factory=list)
     _delivered: set[tuple[str, str]] = field(default_factory=set)
     _offered_to_proxy: dict[tuple[str, str], str] = field(default_factory=dict)
     _last_seen: tuple[float, datetime] | None = None
@@ -773,17 +768,14 @@ class ControlPlaneStream:
             clock_skew_seconds=self._clock_skew(now),
             source_status=self.sources.statuses() if self.sources is not None else [],
             tool_servers=self.tool_servers.latest() if self.tool_servers is not None else [],
-            sign_in_codes=self._sign_in_outcomes,
             oauth_authorizations=self.oauth.take_authorizations() if self.oauth else [],
             oauth_tokens=self.oauth.uploads() if self.oauth else [],
             oauth_outcomes=self.oauth.take_outcomes() if self.oauth else [],
         )
-        self._sign_in_outcomes = []
         ack = await self.client.heartbeat(self.state, envelope)
         if self.sources is not None:
             self.sources.assign(ack.user_sources)
         await self._deliver_transcripts(ack)
-        await self._relay_sign_in_codes(ack)
         if self.oauth is not None:
             # Before the sealed values are applied: a Disconnect revokes with the tokens
             # this Runner holds, and the same ack may already have withdrawn their ciphertext.
@@ -836,28 +828,6 @@ class ControlPlaneStream:
                     "transcript %s could not be delivered: %s", request.request_id, error
                 )
 
-    async def _relay_sign_in_codes(self, ack: HeartbeatAck) -> None:
-        """Type each relayed code into the sign-in it names (local-agents 05).
-
-        The code is opened, written to that sign-in's PTY and dropped here; nothing logs
-        it and only its outcome travels back.
-        """
-
-        for sealed in ack.sign_in_codes:
-            code = self.sealed.open_sign_in_code(sealed)
-            if code is None:
-                outcome = SignInCodeOutcome.UNOPENABLE
-            elif self.sign_ins is None:
-                outcome = SignInCodeOutcome.UNKNOWN
-            else:
-                outcome = await self.sign_ins.relay(
-                    str(sealed.contract_id), sealed.sign_in_id, code
-                )
-            del code
-            self._sign_in_outcomes.append(
-                SignInCodeRelay(sign_in_id=sealed.sign_in_id, outcome=outcome)
-            )
-
     def _sync_delivered(self) -> None:
         """The resolver holds exactly what the last ack let this installation open."""
 
@@ -1021,6 +991,69 @@ async def run(
         await readiness.close()
 
 
+async def sign_in_claude(contract_id: str, *, method: str) -> int:
+    """``agentic-runner sign-in``: Claude Code's own flow for one Contract, in this terminal.
+
+    Runs with the Runner's environment (``kubectl exec``, or ``--org`` on a workstation),
+    so the Contract gets the uid and the harness root its Directives already run under.
+    Nothing reaches the control plane: the console only reads the outcome back through
+    ``claude auth status`` (QTS-1448).
+
+    Refused up front where no Directive could run on the login (``runs_subscriptions``,
+    QTS-1450), and confirmed at a prompt for a Contract this Runner holds no harness root
+    for yet: a mistyped id would otherwise get a uid and a signed-in tree of its own.
+    """
+
+    mode = isolation_mode()
+    can = can_separate_uids()
+    try:
+        require_isolation_supported(mode, can_separate_uids=can)
+    except RunnerRegistrationError as error:
+        print(f"refusing to sign in ({error.reason}): {error}", file=sys.stderr)
+        return 1
+    control_plane = os.environ.get(CONTROL_PLANE_ENV, "").strip()
+    if control_plane:
+        os.environ.setdefault("INTERNAL_FASTAPI_BASE_URL", control_plane)
+    try:
+        settings = get_worker_settings()
+    except ValidationError:
+        print(
+            "refusing to sign in: run this with the Runner's environment "
+            "(`--org <org>` on a workstation, `kubectl exec` into the Runner's pod)",
+            file=sys.stderr,
+        )
+        return 2
+    state = load_state(load_config().state_dir)
+    host_party = (state.host_party if state is not None else "") or None
+    if not runs_subscriptions(host_party, separates_contract_uids=can):
+        runner = f"hosted by {host_party!r}" if host_party else "not registered"
+        print(
+            f"refusing to sign in ({SIGN_IN_NEEDS_CONTRACT_UID_RULE}): this Runner is {runner} "
+            "and does not run each Contract under its own uid, so no Directive would run on "
+            "the login",
+            file=sys.stderr,
+        )
+        return 1
+    sign_ins = ClaudeSignIns(build_contract_isolation(settings, can_separate_uids=can))
+    if not sign_ins.has_harness_root(contract_id) and not _confirm_new_contract(contract_id):
+        print("not signed in", file=sys.stderr)
+        return 1
+    try:
+        return await sign_ins.sign_in(contract_id, method=method)
+    except ClaudeSignInError as error:
+        print(f"sign-in failed: {error}", file=sys.stderr)
+        return 1
+
+
+def _confirm_new_contract(contract_id: str) -> bool:
+    answer = input(
+        f"This Runner holds no Claude Code harness root for Contract {contract_id} yet. Check "
+        "the id against the console: a mistyped one signs in a Contract no Directive runs as. "
+        "Sign it in? [y/N] "
+    )
+    return answer.strip().lower() in {"y", "yes"}
+
+
 async def _serve(
     *,
     config: RunnerConfig,
@@ -1157,7 +1190,6 @@ async def _serve_registered(
     messages = MessageStore(state_dir / MESSAGES_DIR)
     stream.messages = messages
     sign_ins = ClaudeSignIns(build_contract_isolation(settings, can_separate_uids=can_change_uid))
-    stream.sign_ins = sign_ins
     stream.oauth = OAuthConnectors(
         sealed=stream.sealed, provider=HttpOAuthProvider(), credentials=credentials
     )
@@ -1243,7 +1275,6 @@ async def _serve_registered(
                 task.cancel()
                 with contextlib.suppress(asyncio.CancelledError):
                     await task
-            await sign_ins.close()
             await run_runner_lifecycle_hook(hooks, HookName.RUNNER_SHUTDOWN)
             await _report_stop(link, lifecycle)
     return 1 if revoked.is_set() else 0
@@ -1346,13 +1377,12 @@ def build_usage_windows(
     isolation: ContractIsolation,
     in_flight: DirectivesInFlight,
 ) -> UsageWindows | None:
-    """A probe per served harness, or None off a user-hosted Runner (local-agents 10).
-
-    Subscriptions follow the person (local-agents 04): only a user-hosted Runner runs one,
-    so only there is a usage window anyone's to read.
+    """A probe per served harness, or None on a Runner that runs no subscription
+    (local-agents 10): only where one can run is there a usage window anyone's to read
+    (``auth_mode.runs_subscriptions``, QTS-1450).
     """
 
-    if host_party != "user":
+    if not runs_subscriptions(host_party, separates_contract_uids=isolation.can_separate_uids):
         return None
     probes: dict[str, UsageWindowProbe] = {
         "codex_cli": CodexRateLimitsProbe(),