agentic-runner 3.18.3__tar.gz → 3.20.0__tar.gz

{agentic_runner-3.18.3 → agentic_runner-3.20.0}/PKG-INFO

@@ -1,11 +1,11 @@
 Metadata-Version: 2.5
 Name: agentic-runner
-Version: 3.18.3
+Version: 3.20.0
 Summary: The Agentic OS Runner: an activity-only Temporal executor for workspaces, Agent Runtimes and verb seams
 License-Expression: AGPL-3.0-only
 License-File: LICENSE
 Requires-Python: >=3.12
-Requires-Dist: agentic-runner-contracts==3.18.3
+Requires-Dist: agentic-runner-contracts==3.20.0
 Requires-Dist: cryptography<51,>=50
 Requires-Dist: httpx<1.0,>=0.27
 Requires-Dist: pydantic-settings<3.0,>=2.0

{agentic_runner-3.18.3 → agentic_runner-3.20.0}/pyproject.toml

@@ -10,7 +10,7 @@ dependencies = [
   # Exactly this release's contracts: the two ship as one version, and an unpinned
   # requirement let `uv tool upgrade` keep an older contracts wheel the Runner cannot
   # import from (QTS-1473). `scripts/set-version.py` moves it with the version.
-  "agentic-runner-contracts==3.18.3",
+  "agentic-runner-contracts==3.20.0",
   # Imported directly by `registration.py` (the Ed25519 identity that signs every
   # heartbeat); already present transitively through pyjwt[crypto], declared because
   # we import it.

{agentic_runner-3.18.3 → agentic_runner-3.20.0}/src/agentic_runner/__init__.py

@@ -7,6 +7,6 @@ stay on the platform; this package imports none of them, and a CI partition test
 (``tests/test_package_partition.py``) fails the build if that changes.
 """
 
-__version__ = "3.18.3"
+__version__ = "3.20.0"
 
 __all__ = ["__version__"]

{agentic_runner-3.18.3 → agentic_runner-3.20.0}/src/agentic_runner/activities.py

@@ -267,6 +267,7 @@ from agentic_runner_contracts.grants.seam import VerbDecision, decide_verb
 from agentic_runner_contracts.questions import WORK_ASK_VERB
 from agentic_runner_contracts.redaction import redact_secret_like_text
 from agentic_runner_contracts.routing import (
+    DirectiveRouting,
     RoutingRefusedError,
     RunnerRoutingIdentity,
     assert_routed,
@@ -1709,8 +1710,9 @@ class RunnerRalphActivities:
         self._workspace_root = workspace_root
         self._contract_isolation = contract_isolation
         # What this process is, as the control plane registered it (PRD issue 42): its
-        # Runner id, its host party and its config-declared Tags. Every activity payload
-        # is checked against it before the body runs, so a stolen or misrouted task costs
+        # Runner id, its host party and its config-declared Tags, which the last heartbeat
+        # ack's Tags replace (`_current_routing_identity`). Every activity payload is
+        # checked against it before the body runs, so a stolen or misrouted task costs
         # no verb. ``None`` in a process that never registered -- it polls no
         # ``runner.{runner_id}`` queue, so nothing routes to it and there is nothing to
         # assert against; the fail-closed check is on every Runner the router can pick.
@@ -1790,10 +1792,11 @@ class RunnerRalphActivities:
         poller into a visible intra-Organisation incident rather than silence (17 A11).
         """
 
-        if self._routing_identity is not None:
+        identity = self._current_routing_identity()
+        if identity is not None:
             routing = getattr(request, "routing", None)
             try:
-                assert_routed(routing, self._routing_identity)
+                assert_routed(routing, identity)
             except RoutingRefusedError as refusal:
                 work_record_id = getattr(request, "work_record_id", "")
                 if not work_record_id:
@@ -1803,11 +1806,11 @@ class RunnerRalphActivities:
                     self._fastapi_client,
                     str(work_record_id),
                     source=_ROUTING_EVIDENCE_SOURCE,
-                    actor=f"runner:{self._routing_identity.runner_id}",
+                    actor=f"runner:{identity.runner_id}",
                     payload={
                         "event": "directive.routing_refused",
                         "reason": refusal.reason,
-                        "runner_id": self._routing_identity.runner_id,
+                        "runner_id": identity.runner_id,
                         "routed_runner_id": None if routing is None else routing.runner_id,
                         "detail": str(refusal),
                     },
@@ -1817,6 +1820,19 @@ class RunnerRalphActivities:
                 self._token_source, self._fastapi_client, request, actor=self._actor()
             )
 
+    def _current_routing_identity(self) -> RunnerRoutingIdentity | None:
+        """The registered identity, with the Tags the last heartbeat ack carried.
+
+        The console edits a Runner's Tags after registration and the control plane routes
+        on the edit at once (ADR-0022 §13); checking the bootstrap set instead would
+        refuse work routed on an added Tag on every retry.
+        """
+
+        acked = self._heartbeat_link.tags if self._heartbeat_link is not None else None
+        if self._routing_identity is None or acked is None:
+            return self._routing_identity
+        return replace(self._routing_identity, tags=acked)
+
     def _actor(self) -> str:
         return (
             f"runner:{self._routing_identity.runner_id}"
@@ -2028,6 +2044,7 @@ class RunnerRalphActivities:
                     state=runtime_state,
                     workspace_path=workspace_path,
                     directive_number=request.directive_number,
+                    routing=request.routing,
                     sandbox=self._contract_sandbox(runtime_state),
                     mcp_plan=mcp_plan,
                     asked=asked,
@@ -2595,6 +2612,7 @@ class RunnerRalphActivities:
         mcp_plan: McpPlan | None = None,
         asked: list[QuestionAsked] | None = None,
         bound: list[ProductBinding] | None = None,
+        routing: DirectiveRouting | None = None,
     ) -> AsyncIterator[_DirectiveAttempt]:
         """Open one attempt's hook lifecycle and its callback socket (PRD issue 45).
 
@@ -2623,7 +2641,9 @@ class RunnerRalphActivities:
             )
 
         await self._refuse_skill_digest_mismatch(work_record_id, state)
-        credentials = await self._resolve_credentials(work_record_id, state)
+        credentials = await self._resolve_credentials(
+            work_record_id, state, funding_party=routing.funding_party if routing else None
+        )
         if credentials is not None:
             # Names only, at the moment they resolved (22 A1's Evidence): a support read
             # of "which credentials did this Directive have" must not be answerable by
@@ -2969,7 +2989,11 @@ class RunnerRalphActivities:
         return (tuple(entries) if state.mcp_servers else None), allow_list
 
     async def _resolve_credentials(
-        self, work_record_id: str, state: _RuntimeContextState
+        self,
+        work_record_id: str,
+        state: _RuntimeContextState,
+        *,
+        funding_party: str | None = None,
     ) -> DirectiveCredentials | None:
         """Resolve this Contract's Credential References, or fail the Directive closed.
 
@@ -2985,7 +3009,9 @@ class RunnerRalphActivities:
         resolver = self._credentials or CredentialResolver(store=EmptyCredentialStore())
         try:
             return resolver.resolve(
-                contract_id=state.contract_id, manifest=state.credential_references
+                contract_id=state.contract_id,
+                manifest=state.credential_references,
+                funding_party=funding_party,
             )
         except UnresolvableCredentialReferenceError as error:
             await self._fastapi_client.append_evidence(
@@ -3876,10 +3902,11 @@ class RunnerRalphActivities:
                     "remedy": "work.open",
                 },
             )
-        if state.repository or self._routing_identity is None:
+        identity = self._current_routing_identity()
+        if state.repository or identity is None:
             return None
         selector = snapshot.runner_selector_of(product_id)
-        if selector is not None and selector_satisfied(selector, self._routing_identity.tags):
+        if selector is not None and selector_satisfied(selector, identity.tags):
             return None
         return (
             f"this Runner's tags do not satisfy the Runner selector of Product {product_id}, "
@@ -3887,7 +3914,7 @@ class RunnerRalphActivities:
             {
                 "event": "directive.repository_refused",
                 "product_id": product_id,
-                "runner_id": str(self._routing_identity.runner_id),
+                "runner_id": str(identity.runner_id),
                 "selector": [requirement.as_payload() for requirement in selector or ()],
             },
         )
@@ -5055,6 +5082,7 @@ class RunnerRalphActivities:
                     state=state,
                     workspace_path=workspace,
                     directive_number=request.directive_number,
+                    routing=request.routing,
                     sandbox=self._contract_sandbox(state),
                     reserve_max_tokens=request.reserve_max_tokens or None,
                     mcp_plan=learning_plan,
@@ -5301,6 +5329,7 @@ class RunnerRalphActivities:
                     state=state,
                     workspace_path=state.workspace_path,
                     directive_number=request.directive_number,
+                    routing=request.routing,
                     sandbox=self._contract_sandbox(state),
                     mcp_plan=mcp_plan,
                     asked=asked,

{agentic_runner-3.18.3 → agentic_runner-3.20.0}/src/agentic_runner/credentials.py

@@ -204,6 +204,13 @@ class CredentialResolver:
     in memory only. It is consulted before the host store because a funder who delivered a
     value is stating it is theirs to state; the host's own install is the fallback, which
     is exactly the hand-over default.
+
+    The fallback is a loan of the host's own values, so it is made only to work the host
+    pays for (ADR-0022 §36): an Organisation or Account Runner lends its store to a
+    Contract whose ``funding_party`` is its own ``host_party``, and a contractor-funded
+    Contract in that pool brings sealed values or finds the reference unusable. A
+    personal Runner lends to every Contract it runs, because it runs only its person's
+    own (§2, §42). A blank ``host_party`` -- a Runner not yet registered -- lends nothing.
     """
 
     def __init__(
@@ -211,9 +218,14 @@ class CredentialResolver:
         *,
         store: HostCredentialStore,
         delivered: Mapping[tuple[str, str], str] | None = None,
+        host_party: str | None = None,
     ) -> None:
         self._store = store
         self._delivered = dict(delivered or {})
+        self._host_party = host_party
+        # The funding party the last ack named per Contract, for the readers that have no
+        # Directive to carry one: the heartbeat's report and an OAuth Connector's secret.
+        self._funding: dict[str, str] = {}
 
     @property
     def host_store(self) -> HostCredentialStore:
@@ -231,22 +243,55 @@ class CredentialResolver:
 
         self._delivered.pop((str(contract_id), slot), None)
 
-    def resolve(self, *, contract_id: str | None, manifest: Iterable[str]) -> DirectiveCredentials:
+    def fund(self, funding: Mapping[str, str]) -> None:
+        """Replace the per-Contract funding parties with the last ack's (ADR-0022 §7)."""
+
+        self._funding = dict(funding)
+
+    def resolve(
+        self,
+        *,
+        contract_id: str | None,
+        manifest: Iterable[str],
+        funding_party: str | None = None,
+    ) -> DirectiveCredentials:
         """Every reference the Contract declares, or the first failure, named.
 
+        ``funding_party`` is the Directive's own (``DirectiveRouting.funding_party``); a
+        reader without a Directive leaves it out and the last ack's word for the Contract
+        stands in, and with neither the host store is not lent.
+
         Fails on the *first* unresolvable reference rather than collecting them: a
         Directive that cannot have one of its credentials is not going to run, and a
         partial resolution left lying around is a value held for no reason.
         """
 
+        lends = self._lends_host_store(contract_id, funding_party)
         values: dict[str, str] = {}
         for reference in manifest:
-            value = self._delivered.get((str(contract_id), reference))
-            if value is None:
-                value = self._store.get(reference)
+            value = self._value(contract_id, reference, lends=lends)
             if value is None:
                 raise UnresolvableCredentialReferenceError(
                     reference, contract_id=contract_id, reason="not_installed"
                 )
             values[reference] = value
         return DirectiveCredentials(contract_id=contract_id, _values=values)
+
+    def usable(self, contract_id: str, reference: str) -> bool:
+        """Whether a Directive of this Contract would resolve ``reference`` now (§7)."""
+
+        lends = self._lends_host_store(contract_id, None)
+        return self._value(contract_id, reference, lends=lends) is not None
+
+    def _value(self, contract_id: str | None, reference: str, *, lends: bool) -> str | None:
+        value = self._delivered.get((str(contract_id), reference))
+        if value is None and lends:
+            value = self._store.get(reference)
+        return value
+
+    def _lends_host_store(self, contract_id: str | None, funding_party: str | None) -> bool:
+        if self._host_party == "user":
+            return True
+        if funding_party is None:
+            funding_party = self._funding.get(str(contract_id), "")
+        return bool(self._host_party) and funding_party == self._host_party

{agentic_runner-3.18.3 → agentic_runner-3.20.0}/src/agentic_runner/heartbeat_link.py

@@ -121,6 +121,7 @@ class HeartbeatLink:
         # finished is never read again, while one under a running Directive is read at
         # every verb -- and `max_concurrent_directives` is itself bounded by this number.
         self._held: OrderedDict[str, _Held] = OrderedDict()
+        self._tags: dict[str, str] | None = None
         self._last_ack: float | None = None
         self._seen_monotonic, self._seen_wall = self._clock()
         self._woke = False
@@ -147,6 +148,16 @@ class HeartbeatLink:
             self._held.move_to_end(agent_id)
         return held
 
+    @property
+    def tags(self) -> dict[str, str] | None:
+        """This Runner's Tags as the last ack carried them (ADR-0022 §13).
+
+        ``None`` until an ack carries them, from a control plane below contracts 3.20 or
+        before the first beat: routing then checks the Tags this Runner bootstrapped with.
+        """
+
+        return None if self._tags is None else dict(self._tags)
+
     def applied(self) -> list[AppliedSnapshot]:
         return [
             AppliedSnapshot(agent_id=UUID(agent_id), version=held.version)
@@ -154,13 +165,15 @@ class HeartbeatLink:
         ]
 
     def apply(self, ack: HeartbeatAck) -> None:
-        """Apply one ack's pushes: snapshots per Agent, ceilings per Contract.
+        """Apply one ack's pushes: snapshots per Agent, ceilings per Contract, the Tags.
 
         Replacement, never a merge. A narrowed Grant that merged into what it narrowed
         would leave the wider entry standing, which is the one mistake this whole layer
         exists to prevent.
         """
 
+        if ack.tags is not None:
+            self._tags = dict(ack.tags)
         for push in ack.grant_pushes:
             agent_id = str(push.agent_id)
             self._held[agent_id] = _Held(

{agentic_runner-3.18.3 → agentic_runner-3.20.0}/src/agentic_runner/service.py

@@ -127,6 +127,8 @@ from agentic_runner_contracts.runner_registration import (
     RECENT_OUTCOMES_MAX,
     AcpBridgeVersion,
     CliVersion,
+    CredentialManifest,
+    CredentialValidity,
     DirectiveOutcome,
     EgressPosture,
     HarnessVersion,
@@ -379,7 +381,10 @@ def build_hook_runner(config: RunnerConfig) -> HookRunner:
 
 
 def build_credential_resolver(
-    config: RunnerConfig, *, host_store: HostCredentialStore | None = None
+    config: RunnerConfig,
+    *,
+    host_store: HostCredentialStore | None = None,
+    host_party: str | None = None,
 ) -> CredentialResolver:
     """The host store a Directive resolves its Credential References from (22 A1).
 
@@ -393,7 +398,7 @@ def build_credential_resolver(
         if config.credential_store is not None
         else EmptyCredentialStore()
     )
-    return CredentialResolver(store=store)
+    return CredentialResolver(store=store, host_party=host_party)
 
 
 def build_socket_dir(config: RunnerConfig) -> Path:
@@ -731,6 +736,8 @@ class ControlPlaneStream:
     # Console-v2 issue 30: the OAuth Connectors whose code, tokens and verifier stay here.
     oauth: OAuthConnectors | None = None
     _delivered: set[tuple[str, str]] = field(default_factory=set)
+    # ADR-0022 §7: the Contracts the last ack asked this Runner to report references for.
+    _manifests: list[CredentialManifest] = field(default_factory=list)
     _offered_to_proxy: dict[tuple[str, str], str] = field(default_factory=dict)
     _last_seen: tuple[float, datetime] | None = None
 
@@ -802,6 +809,23 @@ class ControlPlaneStream:
             ),
         )
 
+    def _credential_report(self) -> list[CredentialValidity]:
+        """Per Contract the last ack named, whether each reference would resolve (§7).
+
+        Asked of the same resolver a Directive resolves through, so the report and the
+        Directive cannot disagree on what a funder sealed or what the host lends (§36).
+        """
+
+        return [
+            CredentialValidity(
+                contract_id=manifest.contract_id,
+                reference=reference,
+                valid=self.credentials.usable(str(manifest.contract_id), reference),
+            )
+            for manifest in self._manifests
+            for reference in manifest.references
+        ]
+
     async def directive_token(self, directive_id: str) -> str:
         """One activity execution's control-plane token, by Directive id (PRD issue 63)."""
 
@@ -821,6 +845,7 @@ class ControlPlaneStream:
             max_concurrent_directives=self.state.max_concurrent_directives,
             current_load=self.load.in_flight,
             recent_outcomes=list(self.load.outcomes),
+            credentials=self._credential_report(),
             slots=self.proxy.slots.statuses(),
             usage=self.proxy.outbox.pending(),
             egress_posture=self.egress_posture,
@@ -865,6 +890,10 @@ class ControlPlaneStream:
                 refused.slot,
             )
         self._sync_delivered()
+        self._manifests = list(ack.credential_manifests)
+        self.credentials.fund(
+            {str(manifest.contract_id): manifest.funding_party for manifest in self._manifests}
+        )
         await self._sync_llm_slots()
         if ack.runner_token is not None:
             self.runner_token = ack.runner_token
@@ -1261,7 +1290,9 @@ async def _serve_registered(
 ) -> int:
     load = _LoadInterceptor()
     proxy = LlmProxy(slots=SlotStore(), ceilings=CeilingStore(), outbox=UsageOutbox())
-    credentials = build_credential_resolver(config, host_store=host_store)
+    credentials = build_credential_resolver(
+        config, host_store=host_store, host_party=state.host_party
+    )
     isolation = build_contract_isolation(settings, can_separate_uids=can_change_uid)
     runtimes = build_agent_runtimes(settings, attestation.clis if attestation is not None else [])
     in_flight = DirectivesInFlight()