agentic-runner 3.15.0__tar.gz → 3.16.0__tar.gz

{agentic_runner-3.15.0 → agentic_runner-3.16.0}/PKG-INFO

@@ -1,11 +1,11 @@
 Metadata-Version: 2.5
 Name: agentic-runner
-Version: 3.15.0
+Version: 3.16.0
 Summary: The Agentic OS Runner: an activity-only Temporal executor for workspaces, Agent Runtimes and verb seams
 License-Expression: AGPL-3.0-only
 License-File: LICENSE
 Requires-Python: >=3.12
-Requires-Dist: agentic-runner-contracts
+Requires-Dist: agentic-runner-contracts==3.16.0
 Requires-Dist: cryptography<51,>=50
 Requires-Dist: httpx<1.0,>=0.27
 Requires-Dist: pydantic-settings<3.0,>=2.0
@@ -33,9 +33,10 @@ no intake. That inertness, not obfuscation, is the boundary (ADR-0013 §5).
 
 ## Running it
 
-`agentic-runner run` is the process: it exchanges the Agent Token in
-`AGENTIC_AGENT_TOKEN` for a durable identity at `AGENTIC_CONTROL_PLANE_URL` (once,
-persisted under `AGENTIC_RUNNER_STATE_DIR`), heartbeats every 30 s, connects to the
+`agentic-runner run` is the process: it exchanges the Runner Registration Token in
+`AGENTIC_RUNNER_REGISTRATION_TOKEN` (or, deprecated, `AGENTIC_AGENT_TOKEN`) for a durable
+identity at `AGENTIC_CONTROL_PLANE_URL` (once, persisted under `AGENTIC_RUNNER_STATE_DIR`),
+heartbeats every 30 s, connects to the
 namespace it was handed with the Runner Token the heartbeat refreshes, and polls its own
 `runner.{runner_id}` queue. `AGENTIC_RUNNER_ISOLATION` is `contract_uid` (default: every
 Contract its own uid, needs `CAP_SETUID` — refused otherwise) or `none`. Readiness is

{agentic_runner-3.15.0 → agentic_runner-3.16.0}/README.md

@@ -14,9 +14,10 @@ no intake. That inertness, not obfuscation, is the boundary (ADR-0013 §5).
 
 ## Running it
 
-`agentic-runner run` is the process: it exchanges the Agent Token in
-`AGENTIC_AGENT_TOKEN` for a durable identity at `AGENTIC_CONTROL_PLANE_URL` (once,
-persisted under `AGENTIC_RUNNER_STATE_DIR`), heartbeats every 30 s, connects to the
+`agentic-runner run` is the process: it exchanges the Runner Registration Token in
+`AGENTIC_RUNNER_REGISTRATION_TOKEN` (or, deprecated, `AGENTIC_AGENT_TOKEN`) for a durable
+identity at `AGENTIC_CONTROL_PLANE_URL` (once, persisted under `AGENTIC_RUNNER_STATE_DIR`),
+heartbeats every 30 s, connects to the
 namespace it was handed with the Runner Token the heartbeat refreshes, and polls its own
 `runner.{runner_id}` queue. `AGENTIC_RUNNER_ISOLATION` is `contract_uid` (default: every
 Contract its own uid, needs `CAP_SETUID` — refused otherwise) or `none`. Readiness is

{agentic_runner-3.15.0 → agentic_runner-3.16.0}/pyproject.toml

@@ -7,7 +7,10 @@ license-files = ["LICENSE"]
 requires-python = ">=3.12"
 dynamic = ["version"]
 dependencies = [
-  "agentic-runner-contracts",
+  # Exactly this release's contracts: the two ship as one version, and an unpinned
+  # requirement let `uv tool upgrade` keep an older contracts wheel the Runner cannot
+  # import from (QTS-1473). `scripts/set-version.py` moves it with the version.
+  "agentic-runner-contracts==3.16.0",
   # Imported directly by `registration.py` (the Ed25519 identity that signs every
   # heartbeat); already present transitively through pyjwt[crypto], declared because
   # we import it.

{agentic_runner-3.15.0 → agentic_runner-3.16.0}/src/agentic_runner/__init__.py

@@ -7,6 +7,6 @@ stay on the platform; this package imports none of them, and a CI partition test
 (``tests/test_package_partition.py``) fails the build if that changes.
 """
 
-__version__ = "3.15.0"
+__version__ = "3.16.0"
 
 __all__ = ["__version__"]

{agentic_runner-3.15.0 → agentic_runner-3.16.0}/src/agentic_runner/activities.py

@@ -604,8 +604,8 @@ class _RuntimeContextState:
     # Which harness this Work Record runs, and so which per-Contract config root
     # (`{contract_id}/harness/{cli_kind}`) its Directives read (ADR-0015 §4).
     cli_kind: str = _DEFAULT_CLI_KIND
-    # PRD issue 31: what the Agent is configured to run, for pricing a Codex harness
-    # usage event that carries no model of its own.
+    # The Agent's model, which every Directive runs (ADR-0021); None for the Runner's
+    # default for `cli_kind`.
     model: str | None = None
     # The Agent Runtime Profile's per-process memory ceiling (map ticket 17 A7), carried
     # on the Profile's `command_policy` blob — the sandbox floor already lives there, and
@@ -1516,6 +1516,8 @@ def _codex_evidence_payload(
             codex_result.error, _RUNTIME_EVIDENCE_STREAM_LIMIT_BYTES, notes, "error"
         ),
         "command_hash": codex_result.command_hash,
+        # What ran, which the Agent's configuration alone does not prove (ADR-0021).
+        "model": codex_result.model or None,
         "workspace": asdict(codex_result.evidence),
         "persona_slug": persona_slug,
         "persona_instructions_hash": _persona_instructions_hash(persona_instructions),
@@ -2121,6 +2123,7 @@ class RunnerRalphActivities:
                     auth_mode=attempt.auth_mode,
                     permission_fallback=runtime_state.permission_fallback,
                     acp_command=runtime_state.acp_command,
+                    model=runtime_state.model or "",
                     prompt=attempt.skills_preamble
                     + _directive_prompt(
                         completion_criteria=runtime_state.completion_criteria,
@@ -5067,6 +5070,7 @@ class RunnerRalphActivities:
                     auth_mode=attempt.auth_mode,
                     permission_fallback=state.permission_fallback,
                     acp_command=state.acp_command,
+                    model=state.model or "",
                     prompt=attempt.skills_preamble
                     + _learning_prompt(
                         request,
@@ -5333,6 +5337,7 @@ class RunnerRalphActivities:
                     auth_mode=attempt.auth_mode,
                     permission_fallback=state.permission_fallback,
                     acp_command=state.acp_command,
+                    model=state.model or "",
                     prompt=attempt.skills_preamble + await kind.prompt(state, prompt_notes),
                     base_branch=request.base_ref,
                     work_branch=state.work_branch,
@@ -5602,16 +5607,17 @@ class RunnerRalphActivities:
             reports = [(usage_event, None)] if usage_event else []
         else:
             usage_event = extract_codex_turn_usage(result.stdout)
-            reports = [(usage_event, runtime_state.model or None)] if usage_event else []
+            reports = [(usage_event, result.model or None)] if usage_event else []
         for usage_event, model_name in reports:
             if runtime_state.cli_kind != "claude_code" and model_name is None:
                 # The backend 422s a Codex harness report with no model
                 # (`report_harness_usage` requires one to price it), and the `suppress`
-                # below swallows that -- an Agent with no model configured would otherwise
-                # lose this Usage Record with no trace.
+                # below swallows that -- a Directive that ran Codex's own default model,
+                # which its JSON stream never names, would otherwise lose this Usage
+                # Record with no trace.
                 activity.logger.warning(
-                    "harness usage unreported: Agent %s has no model configured for a Codex "
-                    "harness Directive (work record %s)",
+                    "harness usage unreported: Agent %s names no model, so its Codex "
+                    "harness Directive ran one the Runner cannot name (work record %s)",
                     runtime_state.agent_id,
                     work_record_id,
                 )

{agentic_runner-3.15.0 → agentic_runner-3.16.0}/src/agentic_runner/cli.py

@@ -5,8 +5,8 @@ contracts version is the compatibility floor the control plane checks before it
 Directive token (ADR-0013 §7). An operator debugging "why did this Runner stop getting
 Directives" needs both numbers from one command.
 
-``register`` is first boot (PRD issue 41): it presents the Agent Token from the
-environment, persists the durable identity the exchange hands back, and prints the
+``register`` is first boot (PRD issue 41): it presents the Runner Registration Token from
+the environment, persists the durable identity the exchange hands back, and prints the
 namespace and queue this process was assigned. It is idempotent by state file -- a
 restart re-reads what is already there rather than registering a second Runner against
 the Organisation's cap.
@@ -61,8 +61,10 @@ from agentic_runner.service import (
     ISOLATION_ENV,
     RECIPIENT_KEY_ID_ENV,
     RECIPIENT_PUBLIC_KEY_ENV,
+    REGISTRATION_TOKEN_ENV,
     TAGS_ENV,
     parse_tags,
+    registration_token_from_env,
 )
 from agentic_runner.workers.claude_sign_in import OAUTH_TOKEN, SIGN_IN_METHODS
 from agentic_runner_contracts import __version__ as contracts_version
@@ -80,6 +82,7 @@ __all__ = [
     "ISOLATION_ENV",
     "RECIPIENT_KEY_ID_ENV",
     "RECIPIENT_PUBLIC_KEY_ENV",
+    "REGISTRATION_TOKEN_ENV",
     "STATE_DIR_ENV",
     "TAGS_ENV",
     "main",
@@ -144,7 +147,8 @@ def main(argv: Sequence[str] | None = None) -> int:
     subcommands = parser.add_subparsers(dest="command")
 
     subcommands.add_parser(
-        "register", help="exchange the Agent Token for this process's durable identity"
+        "register",
+        help="exchange the Runner Registration Token for this process's durable identity",
     )
 
     run = subcommands.add_parser("run", help="register if needed, then heartbeat and poll for work")
@@ -419,9 +423,9 @@ def _install(arguments: argparse.Namespace, paths: workstation.OrgPaths) -> int:
         print(str(error), file=sys.stderr)
         return 2
     # Pasted, never a flag: a flag is in the process table for every uid on the box.
-    token = os.environ.get(AGENT_TOKEN_ENV, "").strip() or getpass.getpass(
-        "Agent Token (yours from /me/runners, or the Organisation Admin's for an "
-        "Organisation Runner): "
+    token = registration_token_from_env() or getpass.getpass(
+        "Runner Registration Token (yours from /me/runners, or the Organisation Admin's for "
+        "an Organisation Runner): "
     )
     settings = workstation.WorkstationSettings(
         org=paths.org,
@@ -435,7 +439,7 @@ def _install(arguments: argparse.Namespace, paths: workstation.OrgPaths) -> int:
     try:
         lines = asyncio.run(
             workstation.install(
-                paths, settings, agent_token=token, start_service=not arguments.no_start
+                paths, settings, registration_token=token, start_service=not arguments.no_start
             )
         )
     except (workstation.CliMissingError, RunnerRegistrationError, RuntimeError) as error:

{agentic_runner-3.15.0 → agentic_runner-3.16.0}/src/agentic_runner/mcp.py

@@ -56,7 +56,7 @@ MCP_PATH: Final[str] = "/mcp"
 
 # What a Runner-hosted server inherits from the Runner besides its credential. A
 # credential-bearing child must not also inherit the Runner's own environment (its
-# Agent Token, a git token): only what a program needs to start.
+# Runner Registration Token, a git token): only what a program needs to start.
 _HOSTED_ENV_ALLOWLIST: Final[tuple[str, ...]] = ("PATH", "HOME", "LANG", "TZ")
 _DEFAULT_CALL_TIMEOUT_SECONDS: Final[float] = 300.0
 # The heartbeat's own bound on `tool_servers`.

{agentic_runner-3.15.0 → agentic_runner-3.16.0}/src/agentic_runner/registration.py

@@ -1,8 +1,8 @@
 """The Runner's half of registration and heartbeat (PRD issue 41, ADR-0013 §8).
 
-Outbound-only: this process dials the control plane, presents its Agent Token once, keeps
-what comes back in its own state directory, and then says what it is every 30 s. Nothing
-listens on a port here, which is also why revocation is entirely the control plane's --
+Outbound-only: this process dials the control plane, presents its Runner Registration Token
+once, keeps what comes back in its own state directory, and then says what it is every 30 s.
+Nothing listens on a port here, which is also why revocation is entirely the control plane's --
 the lever it pulls is the refused heartbeat.
 
 Two things fail closed on this side, and both fail *before* anything registers:
@@ -70,6 +70,13 @@ INTAKE_IGNORED_PATH = "/api/runner/v1/runners/intake/ignored"
 # heartbeat). The one reason this process stops on rather than retries.
 RUNNER_REVOKED_REASON = "runner_revoked"
 CONTROL_PLANE_OLDER_REASON = "control_plane_older"
+# The bootstrap refusals that mean "this Runner Registration Token will never work": unknown,
+# revoked, expired. A control plane before ADR-0021 names them `agent_token_*`.
+_REGISTRATION_TOKEN_REASON_PREFIXES = ("registration_token_", "agent_token_")
+REGISTRATION_TOKEN_REFUSED_HINT = (
+    "the Runner Registration Token is unknown, revoked or expired: mint a new one on the "
+    "Runners page and register with that"
+)
 
 # What the state directory holds after a successful bootstrap. One file, mode 0600: the
 # private key is in it, and a Runner that loses it re-bootstraps rather than recovering.
@@ -83,6 +90,12 @@ class RunnerRegistrationError(RuntimeError):
         super().__init__(message)
         self.reason = reason
 
+    @property
+    def refuses_registration_token(self) -> bool:
+        """Whether retrying with the same Runner Registration Token can never succeed."""
+
+        return self.reason.startswith(_REGISTRATION_TOKEN_REASON_PREFIXES)
+
 
 class RunnerState(BaseModel):
     """What this process is, once registered. Persisted; reread on every restart.
@@ -236,18 +249,18 @@ class RunnerRegistrationClient:
     async def bootstrap(
         self,
         *,
-        agent_token: str,
+        registration_token: str,
         tags: dict[str, str],
         isolation_mode: IsolationMode,
         recipient_key: RecipientKey,
         max_concurrent_directives: int = 1,
         can_separate_uids: bool,
     ) -> tuple[RunnerState, BootstrapResponse]:
-        """Exchange the Agent Token for this process's durable identity."""
+        """Exchange the Runner Registration Token for this process's durable identity."""
 
         require_isolation_supported(isolation_mode, can_separate_uids=can_separate_uids)
         request = BootstrapRequest(
-            agent_token=agent_token,
+            registration_token=registration_token,
             tags=tags,
             isolation_mode=isolation_mode,
             contracts_version=contracts_version,

{agentic_runner-3.15.0 → agentic_runner-3.16.0}/src/agentic_runner/service.py

@@ -85,6 +85,7 @@ from agentic_runner.private_state import (
     require_private_files,
 )
 from agentic_runner.registration import (
+    REGISTRATION_TOKEN_REFUSED_HINT,
     RUNNER_REVOKED_REASON,
     STATE_FILENAME,
     RunnerRegistrationClient,
@@ -148,6 +149,7 @@ __all__ = [
     "READINESS_PORT_ENV",
     "RECIPIENT_KEY_ID_ENV",
     "RECIPIENT_PUBLIC_KEY_ENV",
+    "REGISTRATION_TOKEN_ENV",
     "TAGS_ENV",
     "TEMPORAL_TLS_ENV",
     "ControlPlaneStream",
@@ -172,8 +174,10 @@ __all__ = [
 _logger = logging.getLogger(__name__)
 
 # The Helm values and the workstation installer both land here as environment (ADR-0013
-# §8). The Agent Token is read from the environment and never from a flag: a flag would
-# put it in the process table for every other uid on the host to read.
+# §8). The Runner Registration Token is read from the environment and never from a flag: a
+# flag would put it in the process table for every other uid on the host to read.
+REGISTRATION_TOKEN_ENV = "AGENTIC_RUNNER_REGISTRATION_TOKEN"
+# Its name before ADR-0021, still read so an installed Runner upgrades without an edit.
 AGENT_TOKEN_ENV = "AGENTIC_AGENT_TOKEN"
 CONTROL_PLANE_ENV = "AGENTIC_CONTROL_PLANE_URL"
 TAGS_ENV = "AGENTIC_RUNNER_TAGS"
@@ -272,6 +276,24 @@ def _require_env(name: str) -> str:
     return value
 
 
+def registration_token_from_env() -> str:
+    """``AGENTIC_RUNNER_REGISTRATION_TOKEN``, else the deprecated ``AGENTIC_AGENT_TOKEN``.
+
+    An empty string when neither is set, so a caller that can ask for it still asks.
+    """
+
+    if token := os.environ.get(REGISTRATION_TOKEN_ENV, "").strip():
+        return token
+    if token := os.environ.get(AGENT_TOKEN_ENV, "").strip():
+        print(
+            f"warning: {AGENT_TOKEN_ENV} is deprecated; set {REGISTRATION_TOKEN_ENV} instead",
+            file=sys.stderr,
+            flush=True,
+        )
+        return token
+    return ""
+
+
 def _max_concurrent_directives() -> int:
     return int(os.environ.get(MAX_CONCURRENT_DIRECTIVES_ENV, "").strip() or 1)
 
@@ -282,15 +304,16 @@ async def register(
     can_separate_uids: bool,
     client: httpx.AsyncClient | None = None,
     control_plane: str | None = None,
-    agent_token: str | None = None,
+    registration_token: str | None = None,
     isolation: IsolationMode | None = None,
 ) -> tuple[RunnerState, str]:
-    """First boot (PRD issue 41): exchange the Agent Token for this process's identity.
+    """First boot (PRD issue 41): exchange the Runner Registration Token for this
+    process's identity.
 
     Idempotent by state file -- a restart re-reads what is already there rather than
     registering a second Runner against the Organisation's cap (21 A7). The keyword
-    overrides are the workstation ``install`` (issue 47), which takes the Agent Token
-    pasted at a prompt rather than from a Helm-set environment.
+    overrides are the workstation ``install`` (issue 47), which takes the Runner
+    Registration Token pasted at a prompt rather than from a Helm-set environment.
     """
 
     existing = load_state(state_dir)
@@ -300,8 +323,13 @@ async def register(
     registration = RunnerRegistrationClient(
         base_url=control_plane or _require_env(CONTROL_PLANE_ENV), client=client
     )
+    token = registration_token or registration_token_from_env()
+    if not token:
+        raise RunnerRegistrationError(
+            "configuration_missing", f"{REGISTRATION_TOKEN_ENV} is not set"
+        )
     state, response = await registration.bootstrap(
-        agent_token=agent_token or _require_env(AGENT_TOKEN_ENV),
+        registration_token=token,
         tags=parse_tags(os.environ.get(TAGS_ENV, "")),
         isolation_mode=isolation or isolation_mode(),
         recipient_key=recipient,
@@ -1077,6 +1105,8 @@ async def _serve(
         )
     except RunnerRegistrationError as error:
         print(f"registration refused ({error.reason}): {error}", flush=True)
+        if error.refuses_registration_token:
+            print(REGISTRATION_TOKEN_REFUSED_HINT, flush=True)
         return 1
     except UnsafeStateError as error:
         print(f"refusing to start ({error.reason}): {error}", flush=True)

{agentic_runner-3.15.0 → agentic_runner-3.16.0}/src/agentic_runner/skills/agentic-runner-setup/SKILL.md

@@ -24,7 +24,7 @@ The prompt they pasted from the console holds these. Ask for any that is missing
   pass to the Runner. Never call it or any other control plane address yourself.
 - **Temporal address**: `host:port`, from the same page.
 
-The **Agent Token** is not one of them. It is the reusable credential a Runner registers
+The **Runner Registration Token** is not one of them. It is the reusable credential a Runner registers
 with, and the person types it only where the Runner reads it, never into this
 conversation.
 
@@ -34,10 +34,10 @@ conversation.
   it does, in one line.
 - **Stop on the first failure.** Show the exact error, link the doc section below that
   covers it, and stop. Do not retry with other flags, do not work around it.
-- **Never ask for the Agent Token or any credential value in this conversation.** Anything
-  said here reaches the model vendor and stays in this CLI's history. Every command that
-  reads a credential is one the person runs in their own terminal, and the person types the
-  value there. If the person pastes a token or a key here anyway, do not use it: tell them
+- **Never ask for the Runner Registration Token or any credential value in this
+  conversation.** Anything said here reaches the model vendor and stays in this CLI's
+  history. Every command that reads a credential is one the person runs in their own
+  terminal, and the person types the value there. If the person pastes a token or a key here anyway, do not use it: tell them
   to revoke it in the console and mint or create a new one.
 - You use only the `agentic-runner` command, the standard tools named in the docs (`uv`,
   `docker`, `kubectl`, `helm`) and read-only checks such as `command -v`.
@@ -77,7 +77,7 @@ missing.
 **This machine.** Follow
 https://github.com/qtsone/agentic-runner/blob/main/docs/workstation.md#install. Install the
 Runner, then show the person the command that registers it for the Organisation and ask
-them to run it in their own terminal. The Runner asks them for the Agent Token there,
+them to run it in their own terminal. The Runner asks them for the Runner Registration Token there,
 without showing it:
 
 ```sh

{agentic_runner-3.15.0 → agentic_runner-3.16.0}/src/agentic_runner/testing/plugin.py

@@ -33,7 +33,7 @@ from agentic_runner.testing.control_plane import DEFAULT_NAMESPACE, FakeControlP
 
 # A conformance Runner never runs a Directive that needs isolation or a credential, so it
 # runs `none`, unprivileged, with every path under the test's own directory.
-AGENT_TOKEN = "conformance-agent-token-0123456789"
+REGISTRATION_TOKEN = "conformance-registration-token-0123"
 _RUN = "import sys; from agentic_runner.cli import main; sys.exit(main(['run']))"
 
 
@@ -90,7 +90,7 @@ class RunnerLauncher:
         environment = {
             **os.environ,
             "AGENTIC_CONTROL_PLANE_URL": control_plane_url,
-            "AGENTIC_AGENT_TOKEN": AGENT_TOKEN,
+            "AGENTIC_RUNNER_REGISTRATION_TOKEN": REGISTRATION_TOKEN,
             "AGENTIC_RUNNER_ISOLATION": "none",
             "AGENTIC_RUNNER_STATE_DIR": str(state),
             "AGENTIC_RUNNER_WORKSPACE_ROOT": str(self.root / "workspaces"),

{agentic_runner-3.15.0 → agentic_runner-3.16.0}/src/agentic_runner/workers/acp_runtime.py

@@ -65,6 +65,7 @@ from __future__ import annotations
 import asyncio
 import contextlib
 import json
+import logging
 import os
 import re
 import shlex
@@ -114,6 +115,8 @@ from agentic_runner_contracts.runner_registration import UsageWindow
 
 __all__ = ["ACP_BRIDGES", "AcpBridge", "AcpRuntime", "profile_acp_executables"]
 
+_logger = logging.getLogger(__name__)
+
 
 @dataclass(frozen=True, slots=True)
 class AcpBridge:
@@ -320,6 +323,7 @@ class AcpRuntime:
         # Tests drive a fake ACP agent through this; production runs the pinned bridge.
         self._bridge_argv = list(bridge_argv) if bridge_argv is not None else None
         self._ask = ask
+        self._logged_model_ignored = False
 
     @property
     def _is_codex(self) -> bool:
@@ -329,6 +333,15 @@ class AcpRuntime:
     def _is_claude(self) -> bool:
         return self._cli_kind == "claude_code"
 
+    def _model(self, request: DirectiveRequest) -> str:
+        """The model this turn runs, blank where the harness chooses its own."""
+
+        if self._is_claude:
+            return request.model or self._settings.CLAUDE_MODEL
+        if self._is_codex:
+            return request.model
+        return ""
+
     @property
     def _executable(self) -> str:
         return self._bridge.executable if self._bridge is not None else self._cli_kind
@@ -450,6 +463,17 @@ class AcpRuntime:
         turn = _Turn()
         if self._bridge is None:
             turn.notes.append(f"profile ACP command: {redact_secret_like_text(shlex.join(argv))}")
+            if request.model:
+                # The Runner knows no way to name a model to a harness it does not know,
+                # so the turn runs on that harness's own choice rather than not at all.
+                turn.notes.append(f"model ignored: {self._cli_kind} takes no model from the Runner")
+                if not self._logged_model_ignored:
+                    self._logged_model_ignored = True
+                    _logger.warning(
+                        "%s takes no model from the Runner; its Directives run the harness's "
+                        "own model",
+                        self._cli_kind,
+                    )
         timed_out = False
         async with contextlib.AsyncExitStack() as stack:
             env = self._env(request, harness_root)
@@ -621,11 +645,18 @@ class AcpRuntime:
             if self._is_claude:
                 session_params["_meta"] = {
                     "claudeCode": {
-                        "options": {**_CLAUDE_SESSION_OPTIONS, "model": self._settings.CLAUDE_MODEL}
+                        "options": {**_CLAUDE_SESSION_OPTIONS, "model": self._model(request)}
                     }
                 }
             session = await connection.request("session/new", session_params)
             session_id = turn.session_id = str(session.get("sessionId") or "")
+            if self._is_codex and request.model:
+                # codex-acp starts a session on the harness root's model; this outranks it
+                # for the turn, and an unknown model is an ACP error that fails the turn.
+                await connection.request(
+                    "session/set_config_option",
+                    {"sessionId": session_id, "configId": "model", "value": request.model},
+                )
             if self._is_claude and _offers_mode(session, _CLAUDE_MODE):
                 await connection.request(
                     "session/set_mode", {"sessionId": session_id, "modeId": _CLAUDE_MODE}
@@ -746,6 +777,7 @@ class AcpRuntime:
             ),
             model_usage=model_usage,
             usage_windows=turn.usage_windows,
+            model=self._model(request),
         )
 
     def _evidence(

{agentic_runner-3.15.0 → agentic_runner-3.16.0}/src/agentic_runner/workers/agent_runtime.py

@@ -106,6 +106,9 @@ class DirectiveRequest:
     # The Profile-named ACP command (local-agents 18). Read only by the ACP runtime, and
     # only for a `cli_kind` it pins no bridge for.
     acp_command: tuple[str, ...] = ()
+    # The Agent's model, from its runtime context (ADR-0021). Blank runs the Runner's
+    # default for this `cli_kind`: `CLAUDE_MODEL` for Claude Code, Codex's own config.
+    model: str = ""
 
 
 @dataclass(frozen=True, slots=True)
@@ -138,6 +141,9 @@ class DirectiveResult:
     # The subscription usage windows the harness's own stream last reported, where it
     # carries them (claude-agent-acp's rate-limit events, local-agents 10).
     usage_windows: tuple[UsageWindow, ...] = ()
+    # The model the harness was told to run, for Evidence and usage. Blank when the
+    # harness chose its own: Codex on its config's default, a Profile-named ACP harness.
+    model: str = ""
 
 
 # The permission mode of a runtime whose guard configuration is incomplete: it refuses

{agentic_runner-3.15.0 → agentic_runner-3.16.0}/src/agentic_runner/workers/claude_runtime.py

@@ -103,7 +103,8 @@ class ClaudeRuntime(ResumableAgentRuntime):
                 evidence_limit_bytes=self._settings.CLAUDE_CLI_OUTPUT_LIMIT_BYTES,
             )
 
-        argv = _claude_argv(self._settings)
+        model = request.model or self._settings.CLAUDE_MODEL
+        argv = _claude_argv(model)
         if request.mcp_servers is not None:
             # Only what the Grant let through: `--strict-mcp-config` ignores every other
             # MCP source, so nothing in the harness root can add an ungranted server.
@@ -193,6 +194,7 @@ class ClaudeRuntime(ResumableAgentRuntime):
             error=redacted_error,
             command_hash=command_hash,
             evidence=evidence,
+            model=model,
         )
 
     def has_session(self, session_id: str, sandbox: DirectiveSandbox | None) -> bool:
@@ -210,7 +212,7 @@ def _guard_mode(settings: WorkerSettings) -> str | None:
     return None
 
 
-def _claude_argv(settings: WorkerSettings) -> list[str]:
+def _claude_argv(model: str) -> list[str]:
     return [
         "claude",
         "--print",
@@ -218,7 +220,7 @@ def _claude_argv(settings: WorkerSettings) -> list[str]:
         "--output-format",
         "json",
         "--model",
-        settings.CLAUDE_MODEL,
+        model,
         "--dangerously-skip-permissions",
     ]
 

{agentic_runner-3.15.0 → agentic_runner-3.16.0}/src/agentic_runner/workers/codex_runtime.py

@@ -142,7 +142,7 @@ class CodexRuntime(ResumableAgentRuntime):
                 evidence_limit_bytes=self._settings.CODEX_CLI_OUTPUT_LIMIT_BYTES,
             )
 
-        argv = _codex_argv(self._settings, allowlisted=allowlisted)
+        argv = _codex_argv(self._settings, allowlisted=allowlisted, model=request.model)
         # Locked with no server bound too: otherwise a `[mcp_servers.*]` table in the
         # Workspace or harness-root config.toml starts a process before any model turn (LA-19b).
         argv[-1:-1] = codex_mcp_argv(request.mcp_servers or (), workspace_path)
@@ -267,6 +267,7 @@ class CodexRuntime(ResumableAgentRuntime):
             error=redacted_error,
             command_hash=command_hash,
             evidence=evidence,
+            model=request.model,
         )
 
     def has_session(self, session_id: str, sandbox: DirectiveSandbox | None) -> bool:
@@ -320,7 +321,9 @@ def _guard_mode(settings: WorkerSettings, *, allowlisted: bool = False) -> str |
     return None
 
 
-def _codex_argv(settings: WorkerSettings, *, allowlisted: bool = False) -> list[str]:
+def _codex_argv(
+    settings: WorkerSettings, *, allowlisted: bool = False, model: str = ""
+) -> list[str]:
     argv = [
         "codex",
         "exec",
@@ -340,6 +343,10 @@ def _codex_argv(settings: WorkerSettings, *, allowlisted: bool = False) -> list[
     if settings.CODEX_SANDBOX_MODE == "workspace-write":
         network_access = "true" if allowlisted else "false"
         argv += ["--config", f"sandbox_workspace_write.network_access={network_access}"]
+    if model:
+        # Outranks the harness root's `config.toml`; without it Codex runs that file's
+        # model, which is the Runner's default for `codex_cli`.
+        argv += ["--model", model]
     argv.append("-")
     return argv
 

{agentic_runner-3.15.0 → agentic_runner-3.16.0}/src/agentic_runner/workstation.py

@@ -624,7 +624,7 @@ async def install(
     paths: OrgPaths,
     settings: WorkstationSettings,
     *,
-    agent_token: str,
+    registration_token: str,
     platform: str = sys.platform,
     home: Path | None = None,
     start_service: bool = True,
@@ -633,11 +633,11 @@ async def install(
 ) -> list[str]:
     """Register this Organisation's process and install its login agent.
 
-    Registration happens here, once, with the Agent Token this user minted on /me/runners
-    or the Organisation's Admin issued them (12 A6, QTS-1304) -- pasted at the prompt,
-    never stored: the identity bootstrap hands back is what every later start uses, and a
-    lost state directory means a reinstall and a re-delivery of any sealed value (22 A4),
-    by design.
+    Registration happens here, once, with the Runner Registration Token this user minted
+    on /me/runners or the Organisation's Admin issued them (12 A6, QTS-1304) -- pasted at the
+    prompt, never stored: the identity bootstrap hands back is what every later start uses,
+    and a lost state directory means a reinstall and a re-delivery of any sealed value
+    (22 A4), by design.
     """
 
     require_any_cli(settings.path)
@@ -649,7 +649,7 @@ async def install(
         can_separate_uids=False,
         client=http_client,
         control_plane=settings.control_plane_url,
-        agent_token=agent_token,
+        registration_token=registration_token,
         isolation=IsolationMode.NONE,
     )
     LifecycleOutbox(paths.state_dir).add(LifecycleKind.INSTALL, datetime.now(UTC))