agentic-runner 3.16.1__tar.gz → 3.17.0__tar.gz

{agentic_runner-3.16.1 → agentic_runner-3.17.0}/PKG-INFO

@@ -1,11 +1,11 @@
 Metadata-Version: 2.5
 Name: agentic-runner
-Version: 3.16.1
+Version: 3.17.0
 Summary: The Agentic OS Runner: an activity-only Temporal executor for workspaces, Agent Runtimes and verb seams
 License-Expression: AGPL-3.0-only
 License-File: LICENSE
 Requires-Python: >=3.12
-Requires-Dist: agentic-runner-contracts==3.16.1
+Requires-Dist: agentic-runner-contracts==3.17.0
 Requires-Dist: cryptography<51,>=50
 Requires-Dist: httpx<1.0,>=0.27
 Requires-Dist: pydantic-settings<3.0,>=2.0

{agentic_runner-3.16.1 → agentic_runner-3.17.0}/pyproject.toml

@@ -10,7 +10,7 @@ dependencies = [
   # Exactly this release's contracts: the two ship as one version, and an unpinned
   # requirement let `uv tool upgrade` keep an older contracts wheel the Runner cannot
   # import from (QTS-1473). `scripts/set-version.py` moves it with the version.
-  "agentic-runner-contracts==3.16.1",
+  "agentic-runner-contracts==3.17.0",
   # Imported directly by `registration.py` (the Ed25519 identity that signs every
   # heartbeat); already present transitively through pyjwt[crypto], declared because
   # we import it.

{agentic_runner-3.16.1 → agentic_runner-3.17.0}/src/agentic_runner/__init__.py

@@ -7,6 +7,6 @@ stay on the platform; this package imports none of them, and a CI partition test
 (``tests/test_package_partition.py``) fails the build if that changes.
 """
 
-__version__ = "3.16.1"
+__version__ = "3.17.0"
 
 __all__ = ["__version__"]

{agentic_runner-3.16.1 → agentic_runner-3.17.0}/src/agentic_runner/activities.py

@@ -3888,7 +3888,7 @@ class RunnerRalphActivities:
                 "event": "directive.repository_refused",
                 "product_id": product_id,
                 "runner_id": str(self._routing_identity.runner_id),
-                "selector": dict(selector or {}),
+                "selector": [requirement.as_payload() for requirement in selector or ()],
             },
         )
 

{agentic_runner-3.16.1 → agentic_runner-3.17.0}/src/agentic_runner/registration.py

@@ -123,6 +123,9 @@ class RunnerState(BaseModel):
     # The control plane's cadence, as bootstrap told it (06 §4's 30 s by default); a
     # state file written before issue 47 carries none and keeps the default.
     heartbeat_interval_seconds: int = 30
+    # Where bootstrap said the namespace lives (ADR-0022 §4). Blank in a state file written
+    # before it, or from an older control plane: the process then uses `TEMPORAL_ADDRESS`.
+    temporal_address: str = ""
 
     def signer(self) -> Ed25519PrivateKey:
         key = serialization.load_pem_private_key(
@@ -279,6 +282,7 @@ class RunnerRegistrationClient:
             tags=dict(tags),
             max_concurrent_directives=max_concurrent_directives,
             heartbeat_interval_seconds=response.heartbeat_interval_seconds,
+            temporal_address=response.temporal_address,
         )
         return state, response
 

{agentic_runner-3.16.1 → agentic_runner-3.17.0}/src/agentic_runner/service.py

@@ -1112,6 +1112,14 @@ async def _serve(
         print(f"refusing to start ({error.reason}): {error}", flush=True)
         return 1
     print(outcome, flush=True)
+    temporal_address = state.temporal_address or settings.TEMPORAL_ADDRESS
+    if not temporal_address:
+        print(
+            "refusing to start (configuration_missing): the control plane gave no Temporal "
+            "address and TEMPORAL_ADDRESS is not set",
+            flush=True,
+        )
+        return 1
     interval = (
         heartbeat_interval if heartbeat_interval is not None else state.heartbeat_interval_seconds
     )
@@ -1125,6 +1133,7 @@ async def _serve(
             config=config,
             settings=settings,
             state=state,
+            temporal_address=temporal_address,
             mode=mode,
             can_change_uid=can_change_uid,
             control_plane=control_plane,
@@ -1148,6 +1157,7 @@ async def _serve_registered(
     config: RunnerConfig,
     settings: WorkerSettings,
     state: RunnerState,
+    temporal_address: str,
     mode: IsolationMode,
     can_change_uid: bool,
     control_plane: str,
@@ -1241,7 +1251,7 @@ async def _serve_registered(
             await asyncio.sleep(interval)
 
     client = await connect(
-        settings.TEMPORAL_ADDRESS,
+        temporal_address,
         namespace=state.temporal_namespace,
         api_key=stream.runner_token,
         tls=os.environ.get(TEMPORAL_TLS_ENV, "").strip().lower() in {"1", "true", "yes"},

{agentic_runner-3.16.1 → agentic_runner-3.17.0}/src/agentic_runner/testing/control_plane.py

@@ -167,6 +167,8 @@ class FakeControlPlane:
     contract_id: UUID = DEFAULT_CONTRACT_ID
     agent_id: UUID = DEFAULT_AGENT_ID
     cli_kind: str = "codex_cli"
+    # Blank answers as a control plane from before ADR-0022 §4 does: no address at all.
+    temporal_address: str = ""
 
     bootstraps: list[BootstrapRequest] = field(default_factory=list)
     runner_ids: list[UUID] = field(default_factory=list)
@@ -396,8 +398,14 @@ class FakeControlPlane:
             contracts_floor=self.contracts_floor,
             host_party=self.host_party,
             heartbeat_interval_seconds=self.heartbeat_interval_seconds,
+            temporal_address=self.temporal_address,
+        )
+        return _Answer(
+            200,
+            response.model_dump(
+                mode="json", exclude=None if self.temporal_address else {"temporal_address"}
+            ),
         )
-        return _Answer(200, response.model_dump(mode="json"))
 
     def _heartbeat(self, method: str, target: str, headers: dict[str, str], body: bytes) -> _Answer:
         runner_id, runner = self._signed(method, target, headers, body)

{agentic_runner-3.16.1 → agentic_runner-3.17.0}/src/agentic_runner/workers/claude_runtime.py

@@ -56,16 +56,18 @@ _SECRET_VALUE_PATTERNS: Final[tuple[re.Pattern[str], ...]] = (
 class ClaudeRuntime(ResumableAgentRuntime):
     """Worker-local Claude Code CLI runtime.
 
-    Authenticates with an API key (``ANTHROPIC_API_KEY``) rather than a device-login session,
-    so an unattended Persona can run without an expiring browser session (ADR-0006). Like the
-    Codex runtime it confines execution to the supplied workspace, refuses fail-closed unless the
-    autonomous-permission guard is configured, and returns bounded, redacted evidence safe for
-    control-plane storage — the API key never appears in returned text.
+    Runs against the attempt's LLM proxy endpoint rather than a device-login session, so an
+    unattended Persona can run without an expiring browser session (ADR-0006), and the
+    subprocess holds only the attempt's bearer, never a provider key (QTS-1520). Like the
+    Codex runtime it confines execution to the supplied workspace, refuses fail-closed unless
+    the autonomous-permission guard is configured or the proxy endpoint is missing, and
+    returns bounded, redacted evidence safe for control-plane storage.
     """
 
-    # Subscription mode for Claude Code is local-agents 07; until then a user-hosted Runner
-    # with no key runs it on the host operator's key, as before.
+    # Subscription mode for Claude Code is local-agents 07; until then a Contract with no
+    # delivered key has nothing this runtime may run on.
     auth_modes = frozenset({AuthMode.API_KEY})
+    host_api_key = False
 
     def __init__(
         self,
@@ -75,7 +77,6 @@ class ClaudeRuntime(ResumableAgentRuntime):
     ) -> None:
         self._settings = settings
         self._runner = runner or run_subprocess_exec
-        self.host_api_key = bool(settings.ANTHROPIC_API_KEY)
 
     def capabilities(self) -> RuntimeCapabilities:
         return RuntimeCapabilities(
@@ -102,6 +103,17 @@ class ClaudeRuntime(ResumableAgentRuntime):
                 work_branch=request.work_branch,
                 evidence_limit_bytes=self._settings.CLAUDE_CLI_OUTPUT_LIMIT_BYTES,
             )
+        if not dict(request.extra_env).get("ANTHROPIC_BASE_URL"):
+            # The proxy pair is the only credential this runtime hands the harness; without
+            # it the harness would fall back to whatever login or key it finds itself.
+            return _refused_result(
+                workspace_id=directive_workspace_id,
+                base_branch=request.base_branch,
+                work_branch=request.work_branch,
+                evidence_limit_bytes=self._settings.CLAUDE_CLI_OUTPUT_LIMIT_BYTES,
+                guard_mode="refused: api_key mode without an LLM proxy endpoint",
+                error="an api_key Claude Code Directive needs the attempt's LLM proxy endpoint",
+            )
 
         model = request.model or self._settings.CLAUDE_MODEL
         argv = _claude_argv(model)
@@ -140,7 +152,7 @@ class ClaudeRuntime(ResumableAgentRuntime):
             )
         # Per-Contract CLAUDE_CONFIG_DIR, never a fleet-wide one (ADR-0015 §4).
         sandbox = request.sandbox
-        env = {"ANTHROPIC_API_KEY": self._settings.ANTHROPIC_API_KEY}
+        env: dict[str, str] = {}
         if sandbox is not None:
             env["CLAUDE_CONFIG_DIR"] = str(sandbox.harness_config_dir)
             env["HOME"] = str(sandbox.home_dir)
@@ -207,7 +219,7 @@ class ClaudeRuntime(ResumableAgentRuntime):
 
 
 def _guard_mode(settings: WorkerSettings) -> str | None:
-    if settings.ANTHROPIC_API_KEY and settings.CLAUDE_DANGEROUSLY_SKIP_PERMISSIONS:
+    if settings.CLAUDE_DANGEROUSLY_SKIP_PERMISSIONS:
         return "auth=api-key; permission=skip-in-sandbox; output=json"
     return None
 
@@ -231,10 +243,9 @@ def _refused_result(
     base_branch: str,
     work_branch: str,
     evidence_limit_bytes: int,
-    guard_mode: str = "refused: missing API key or autonomous permission configuration",
+    guard_mode: str = "refused: missing autonomous permission configuration",
     error: str = (
-        "Claude Code API key and autonomous permission configuration are required "
-        "before worker-local execution"
+        "Claude Code autonomous permission configuration is required before worker-local execution"
     ),
 ) -> DirectiveResult:
     command_hash = hash_command(["claude", "refused"])

{agentic_runner-3.16.1 → agentic_runner-3.17.0}/src/agentic_runner/workers/settings.py

@@ -13,7 +13,13 @@ from agentic_runner_contracts.activity_io import DEFAULT_BUDGET, Budget
 class WorkerSettings(BaseSettings):
     """Runtime configuration for worker-only processes."""
 
-    TEMPORAL_ADDRESS: str = Field(..., description="Temporal server address in host:port format")
+    TEMPORAL_ADDRESS: str = Field(
+        default="",
+        description=(
+            "Temporal server address in host:port format. Only a fallback: the Runner uses "
+            "the address its registration response carries (ADR-0022 §4)."
+        ),
+    )
     TEMPORAL_NAMESPACE: str = Field(default="default", description="Temporal namespace name")
     PLATFORM_WORKER_SHARD_INDEX: int = Field(
         default=0,
@@ -115,10 +121,6 @@ class WorkerSettings(BaseSettings):
         default=False,
         description="Worker assertion that Codex policy hook or permission profile is configured",
     )
-    ANTHROPIC_API_KEY: str = Field(
-        default="",
-        description="Claude Code runtime API key (api_key auth model; redacted from evidence)",
-    )
     CLAUDE_MODEL: str = Field(
         default="claude-opus-4-8",
         description="Model id the Claude Code runtime runs with",
@@ -220,6 +222,8 @@ class WorkerSettings(BaseSettings):
         """Validate host:port shape for Temporal server address."""
 
         stripped_value = value.strip()
+        if not stripped_value:
+            return stripped_value
         if stripped_value.count(":") < 1:
             raise ValueError("TEMPORAL_ADDRESS must follow host:port")