agentic-runner 3.24.0__tar.gz → 3.25.1__tar.gz

{agentic_runner-3.24.0 → agentic_runner-3.25.1}/PKG-INFO

@@ -1,11 +1,11 @@
 Metadata-Version: 2.5
 Name: agentic-runner
-Version: 3.24.0
+Version: 3.25.1
 Summary: The Agentic OS Runner: an activity-only Temporal executor for workspaces, Agent Runtimes and verb seams
 License-Expression: AGPL-3.0-only
 License-File: LICENSE
 Requires-Python: >=3.12
-Requires-Dist: agentic-runner-contracts==3.24.0
+Requires-Dist: agentic-runner-contracts==3.25.1
 Requires-Dist: cryptography<51,>=50
 Requires-Dist: httpx<1.0,>=0.27
 Requires-Dist: pydantic-settings<3.0,>=2.0

{agentic_runner-3.24.0 → agentic_runner-3.25.1}/pyproject.toml

@@ -10,7 +10,7 @@ dependencies = [
   # Exactly this release's contracts: the two ship as one version, and an unpinned
   # requirement let `uv tool upgrade` keep an older contracts wheel the Runner cannot
   # import from (QTS-1473). `scripts/set-version.py` moves it with the version.
-  "agentic-runner-contracts==3.24.0",
+  "agentic-runner-contracts==3.25.1",
   # Imported directly by `registration.py` (the Ed25519 identity that signs every
   # heartbeat); already present transitively through pyjwt[crypto], declared because
   # we import it.

{agentic_runner-3.24.0 → agentic_runner-3.25.1}/src/agentic_runner/__init__.py

@@ -7,6 +7,6 @@ stay on the platform; this package imports none of them, and a CI partition test
 (``tests/test_package_partition.py``) fails the build if that changes.
 """
 
-__version__ = "3.24.0"
+__version__ = "3.25.1"
 
 __all__ = ["__version__"]

{agentic_runner-3.24.0 → agentic_runner-3.25.1}/src/agentic_runner/activities.py

@@ -49,6 +49,7 @@ from agentic_runner.auth_mode import (
     AuthModeRefusedError,
     choose_auth_mode,
     is_shared_runner,
+    require_named_access,
 )
 from agentic_runner.callback import (
     CALLBACK_TOKEN_ENV,
@@ -149,7 +150,6 @@ from agentic_runner.workers.agent_runtime import (
     PermissionFallback,
     ResumableAgentRuntime,
 )
-from agentic_runner.workers.contract_device_login import holds_login, login_file_counts
 from agentic_runner.workers.contract_isolation import (
     NO_CONTRACT,
     ContractIsolation,
@@ -161,6 +161,11 @@ from agentic_runner.workers.fastapi_client import (
     WorkerFastApiClientError,
     directive_token,
 )
+from agentic_runner.workers.harness_logins import (
+    holds_login,
+    login_file_counts,
+    subscription_report,
+)
 from agentic_runner.workers.harness_outcome import classify_harness_outcome
 from agentic_runner.workers.harness_usage import extract_claude_result, extract_codex_turn_usage
 from agentic_runner.workers.mcp_config import McpServerEntry
@@ -277,6 +282,7 @@ from agentic_runner_contracts.grants import (
     GrantSnapshot,
 )
 from agentic_runner_contracts.grants.seam import VerbDecision, decide_verb
+from agentic_runner_contracts.llm_access import LlmAccess, LlmAccessKind, provider_for
 from agentic_runner_contracts.questions import WORK_ASK_VERB
 from agentic_runner_contracts.redaction import redact_secret_like_text
 from agentic_runner_contracts.routing import (
@@ -286,6 +292,11 @@ from agentic_runner_contracts.routing import (
     assert_routed,
     selector_satisfied,
 )
+from agentic_runner_contracts.runner_registration import (
+    ContractLlmTerms,
+    SubscriptionRight,
+    SubscriptionState,
+)
 from agentic_runner_contracts.runtime_context import (
     EGRESS_ALLOW_LIST_KEY,
     McpServerSpec,
@@ -1713,6 +1724,7 @@ class RunnerRalphActivities:
         directives_in_flight: DirectivesInFlight | None = None,
         usage_windows: UsageWindows | None = None,
         runner_limit: AppliedRunnerLimit | None = None,
+        llm_contracts: Callable[[], Sequence[ContractLlmTerms] | None] | None = None,
     ) -> None:
         self._fastapi_client = fastapi_client
         # What this Runner's host denies every Agent on it, checked at start (ADR-0022
@@ -1787,6 +1799,9 @@ class RunnerRalphActivities:
         # The retry fence (runner-repo 05). None fences nothing: a process that never
         # registered has no state directory to keep the records in.
         self._attempt_records = attempt_records
+        # The Contracts the last heartbeat ack named, read at each Directive (QTS-1751).
+        # None, or a callable answering None, before any ack from a 3.25 control plane.
+        self._llm_contracts = llm_contracts
 
     def activity_callables(self) -> list[Callable[..., Any]]:
         """Return decorated activity callables for Temporal worker registration."""
@@ -2650,7 +2665,8 @@ class RunnerRalphActivities:
         the bearer defensible under ADR-0011 §9.
         """
 
-        auth_mode = await self._directive_auth_mode(work_record_id, state)
+        access = routing.llm_access if routing is not None else None
+        auth_mode = await self._directive_auth_mode(work_record_id, state, access)
         await self._report_login_residue(work_record_id, state)
         facts = AttemptFacts(
             work_record_id=work_record_id,
@@ -2669,9 +2685,7 @@ class RunnerRalphActivities:
             )
 
         await self._refuse_skill_digest_mismatch(work_record_id, state)
-        credentials = await self._resolve_credentials(
-            work_record_id, state, funding_party=routing.funding_party if routing else None
-        )
+        credentials = await self._resolve_credentials(work_record_id, state)
         if credentials is not None:
             # Names only, at the moment they resolved (22 A1's Evidence): a support read
             # of "which credentials did this Directive have" must not be answerable by
@@ -2716,7 +2730,8 @@ class RunnerRalphActivities:
             if self._llm_proxy is not None and auth_mode == AuthMode.API_KEY:
                 # API-key mode only (issue 43): a subscription Directive never has a slot
                 # to resolve, and issue 31 meters it from the harness's own output. One
-                # bearer serves the callback socket and the proxy alike.
+                # bearer serves the callback socket and the proxy alike. The attempt spends
+                # its own provider's slot, and a `host_key` Directive the store's alone.
                 proxy_attempt = await stack.enter_async_context(
                     self._llm_proxy.attempt(
                         directive_id=facts.directive_id,
@@ -2725,6 +2740,11 @@ class RunnerRalphActivities:
                         work_record_id=_optional_uuid(work_record_id),
                         token=callback_env.get(CALLBACK_TOKEN_ENV),
                         reserve_max_tokens=reserve_max_tokens,
+                        provider=provider_for(state.cli_kind),
+                        host_key_only=(
+                            access is not None and access.kind == LlmAccessKind.HOST_KEY
+                        ),
+                        delivered_only=access is None and not self._personal_runner(),
                     )
                 )
                 callback_env.update(proxy_attempt.env(state.cli_kind))
@@ -3081,8 +3101,6 @@ class RunnerRalphActivities:
         self,
         work_record_id: str,
         state: _RuntimeContextState,
-        *,
-        funding_party: str | None = None,
     ) -> DirectiveCredentials | None:
         """Resolve this Contract's Credential References, or fail the Directive closed.
 
@@ -3100,7 +3118,6 @@ class RunnerRalphActivities:
             return resolver.resolve(
                 contract_id=state.contract_id,
                 manifest=state.credential_references,
-                funding_party=funding_party,
             )
         except UnresolvableCredentialReferenceError as error:
             await self._fastapi_client.append_evidence(
@@ -3111,11 +3128,15 @@ class RunnerRalphActivities:
             raise
 
     async def _directive_auth_mode(
-        self, work_record_id: str, state: _RuntimeContextState
+        self, work_record_id: str, state: _RuntimeContextState, access: LlmAccess | None = None
     ) -> AuthMode:
         """This Directive's auth mode, or a non-retryable refusal with Evidence naming the
         rule (local-agents 04).
 
+        ``access`` is the LLM access the control plane routed the Directive with (rev 3):
+        the Runner runs on exactly that, or refuses and never falls back to other access.
+        None, from a control plane below contracts 3.25, keeps the Runner's own choice.
+
         Decided from what this process can check -- the host party it was registered with,
         whether a key is present for the Contract, whether the Contract runs under its own
         uid here and whether its harness root holds a login (QTS-1450) -- never from the
@@ -3129,6 +3150,15 @@ class RunnerRalphActivities:
         host_party = self._routing_identity.host_party if self._routing_identity else None
         contract_uid = self._runs_under_contract_uid(state)
         try:
+            if access is not None:
+                return require_named_access(
+                    access,
+                    host_party=host_party,
+                    host_key_held=self._host_key_held(state),
+                    subscription=self._subscription_state(state),
+                    subscription_right=self._subscription_right(state),
+                    runtime_modes=getattr(runtime, "auth_modes", frozenset({AuthMode.API_KEY})),
+                )
             return choose_auth_mode(
                 host_party=host_party,
                 key_present=self._api_key_present(state, runtime),
@@ -3148,11 +3178,16 @@ class RunnerRalphActivities:
                 source=AGENT_RUNTIME_EVIDENCE_SOURCE,
                 actor=self._actor(),
                 payload={
-                    "event": "directive.auth_mode_refused",
+                    "event": (
+                        "directive.auth_mode_refused"
+                        if access is None
+                        else "directive.llm_access_refused"
+                    ),
                     "rule": refusal.rule,
                     "cli_kind": state.cli_kind,
                     "host_party": host_party,
                     "contract_id": state.contract_id,
+                    **({} if access is None else {"llm_access": access.kind}),
                 },
             )
 
@@ -3167,16 +3202,60 @@ class RunnerRalphActivities:
         )
 
     def _api_key_present(self, state: _RuntimeContextState, runtime: AgentRuntime | None) -> bool:
-        """A delivered slot for the Contract (or its funder), or the host operator's key."""
+        """A slot the attempt's provider would resolve: delivered for the Contract, or the
+        host store's key (rev 3); or a key the host configured on the runtime itself."""
 
         if bool(getattr(runtime, "host_api_key", False)):
             return True
-        contract_id = _optional_uuid(state.contract_id)
+        return self._llm_proxy is not None and self._llm_proxy.slots.holds(
+            _optional_uuid(state.contract_id),
+            provider_for(state.cli_kind),
+            delivered_only=not self._personal_runner(),
+        )
+
+    def _personal_runner(self) -> bool:
+        """Hosted by its person. Only such a Runner spends its store's key on a Directive
+        that names no access (a control plane below 3.25): a pool Runner's key never
+        reached the proxy before, and that control plane caps none of its spend."""
+
+        return self._routing_identity is not None and self._routing_identity.host_party == "user"
+
+    def _host_key_held(self, state: _RuntimeContextState) -> bool:
+        provider = provider_for(state.cli_kind)
         return (
             self._llm_proxy is not None
-            and contract_id is not None
-            and self._llm_proxy.slots.holds(contract_id)
+            and provider is not None
+            and self._llm_proxy.slots.holds_host(provider.value)
+        )
+
+    def _subscription_right(self, state: _RuntimeContextState) -> SubscriptionRight | None:
+        """What the last ack said of this Contract's own subscription; ``no_right`` for a
+        Contract it did not name, since nothing then allowed one here."""
+
+        terms = self._llm_contracts() if self._llm_contracts is not None else None
+        if terms is None:
+            return None
+        contract_id = _optional_uuid(state.contract_id)
+        return next(
+            (term.subscription for term in terms if term.contract_id == contract_id),
+            SubscriptionRight.NO_RIGHT,
+        )
+
+    def _subscription_state(self, state: _RuntimeContextState) -> SubscriptionState:
+        if self._contract_isolation is None or not state.contract_id:
+            return SubscriptionState.NONE
+        windows = (
+            self._usage_windows.windows(state.contract_id, state.cli_kind)
+            if self._usage_windows is not None
+            else None
         )
+        return subscription_report(
+            self._contract_isolation,
+            state.contract_id,
+            state.cli_kind,
+            windows=windows,
+            now=datetime.now(UTC),
+        ).state
 
     async def _report_login_residue(self, work_record_id: str, state: _RuntimeContextState) -> None:
         """On a shared Runner that cannot run a subscription, say once that a Contract's

{agentic_runner-3.24.0 → agentic_runner-3.25.1}/src/agentic_runner/auth_mode.py

@@ -15,6 +15,12 @@ login is the Contract's alone:
 The platform decides who may use a subscription at the door (the Subscription Principal
 and the Organisation's opt-in, QTS-1350); this module is the backstop, so it decides from
 what the Runner itself can check and never from the payload.
+
+From contracts 3.25 the platform names the access in the Directive's routing
+(``DirectiveRouting.llm_access``, Spec: Runners rev 3). :func:`require_named_access` then
+replaces the choice: the Runner runs on exactly the named access or refuses, and never
+falls back to another. A Directive without it, from a control plane on an older pin, keeps
+:func:`choose_auth_mode`.
 """
 
 from __future__ import annotations
@@ -23,16 +29,26 @@ from collections.abc import Collection
 from typing import Final
 
 from agentic_runner.workers.agent_runtime import AuthMode
+from agentic_runner_contracts.llm_access import LlmAccess, LlmAccessKind
+from agentic_runner_contracts.runner_registration import SubscriptionRight, SubscriptionState
 
 __all__ = [
     "NO_RUNTIME_SUBSCRIPTION_RULE",
+    "HOST_KEY_NOT_HELD_RULE",
+    "LLM_ACCESS_UNKNOWN_RULE",
+    "LLM_KEY_UNSUPPORTED_RULE",
     "SETUP_TOKEN_REFUSED_RULE",
+    "SUBSCRIPTION_NOT_ACKNOWLEDGED_RULE",
+    "SUBSCRIPTION_NOT_SIGNED_IN_RULE",
+    "SUBSCRIPTION_NO_RIGHT_RULE",
+    "SUBSCRIPTION_OFF_PERSONAL_RUNNER_RULE",
     "SHARED_HOST_PARTIES",
     "SIGN_IN_NEEDS_CONTRACT_UID_RULE",
     "SUBSCRIPTION_NEEDS_CONTRACT_UID_RULE",
     "SUBSCRIPTION_NEEDS_HARNESS_LOGIN_RULE",
     "AuthModeRefusedError",
     "choose_auth_mode",
+    "require_named_access",
     "is_setup_token",
     "is_shared_runner",
     "runs_subscriptions",
@@ -46,6 +62,14 @@ SUBSCRIPTION_NEEDS_HARNESS_LOGIN_RULE: Final[str] = "subscription_needs_harness_
 NO_RUNTIME_SUBSCRIPTION_RULE: Final[str] = "runtime_has_no_subscription_mode"
 SIGN_IN_NEEDS_CONTRACT_UID_RULE: Final[str] = "sign_in_needs_contract_uid"
 SETUP_TOKEN_REFUSED_RULE: Final[str] = "setup_token_refused"
+# A Directive whose named `llm_access` this Runner no longer holds (rev 3).
+HOST_KEY_NOT_HELD_RULE: Final[str] = "host_key_not_held"
+SUBSCRIPTION_NOT_SIGNED_IN_RULE: Final[str] = "subscription_not_signed_in"
+SUBSCRIPTION_OFF_PERSONAL_RUNNER_RULE: Final[str] = "subscription_off_personal_runner"
+SUBSCRIPTION_NO_RIGHT_RULE: Final[str] = "subscription_no_right"
+SUBSCRIPTION_NOT_ACKNOWLEDGED_RULE: Final[str] = "subscription_not_acknowledged"
+LLM_KEY_UNSUPPORTED_RULE: Final[str] = "llm_key_unsupported"
+LLM_ACCESS_UNKNOWN_RULE: Final[str] = "llm_access_unknown"
 # `claude setup-token` mints an OAuth bearer under this prefix; an Anthropic API key is
 # `sk-ant-api…`. The sealed wire carries no mode, so the value's own shape is what the
 # Runner can refuse on.
@@ -122,5 +146,79 @@ def choose_auth_mode(
     return AuthMode.SUBSCRIPTION
 
 
+def require_named_access(
+    access: LlmAccess,
+    *,
+    host_party: str | None,
+    host_key_held: bool,
+    subscription: SubscriptionState,
+    subscription_right: SubscriptionRight | None,
+    runtime_modes: Collection[AuthMode],
+) -> AuthMode:
+    """The mode the named access runs in, or a refusal naming what is missing.
+
+    ``host_key_held`` is the provider's key in this Runner's own store, serving in the
+    proxy; ``subscription`` the Contract's harness root for the Directive's kind. A
+    subscription runs only on its person's own Runner (rev 3: never on a pool Runner),
+    and only while it is signed in, unexpired and not at its usage limit.
+
+    ``subscription_right`` is what the last heartbeat ack said of the Contract's own
+    subscription (``llm_contracts``), so a misrouted Directive is refused here as well as
+    at the platform's routing (QTS-1349 controls 4 and 7, QTS-1751). ``None`` while no ack
+    has named the Contracts -- a control plane below 3.25 -- which leaves routing the only
+    check, as before.
+    """
+
+    if access.kind == LlmAccessKind.HOST_KEY:
+        if not host_key_held:
+            raise AuthModeRefusedError(
+                HOST_KEY_NOT_HELD_RULE,
+                "this Directive was routed to the provider's key in this Runner's own store, "
+                "and the store no longer holds a key the provider accepts",
+            )
+        return AuthMode.API_KEY
+    if access.kind == LlmAccessKind.SUBSCRIPTION:
+        if host_party != "user":
+            raise AuthModeRefusedError(
+                SUBSCRIPTION_OFF_PERSONAL_RUNNER_RULE,
+                f"this Runner is hosted by {host_party!r}; a subscription runs only on its "
+                "person's own Runner",
+            )
+        if subscription_right == SubscriptionRight.NO_RIGHT:
+            raise AuthModeRefusedError(
+                SUBSCRIPTION_NO_RIGHT_RULE,
+                "this Directive was routed to the person's subscription, and the control plane "
+                "last told this Runner that the Contract does not allow one",
+            )
+        if subscription_right == SubscriptionRight.NOT_ACKNOWLEDGED:
+            raise AuthModeRefusedError(
+                SUBSCRIPTION_NOT_ACKNOWLEDGED_RULE,
+                "this Directive was routed to the person's subscription, and the control plane "
+                "last told this Runner that the person has not acknowledged the subscription "
+                "terms",
+            )
+        if AuthMode.SUBSCRIPTION not in runtime_modes:
+            raise AuthModeRefusedError(
+                NO_RUNTIME_SUBSCRIPTION_RULE,
+                "this Runner's runtime for the Directive's CLI kind runs on API keys only",
+            )
+        if subscription != SubscriptionState.SIGNED_IN:
+            raise AuthModeRefusedError(
+                SUBSCRIPTION_NOT_SIGNED_IN_RULE,
+                f"this Directive was routed to the person's subscription, and its sign-in on "
+                f"this Runner is {subscription.value}; run `agentic-runner sign-in` here",
+            )
+        return AuthMode.SUBSCRIPTION
+    if access.kind == LlmAccessKind.LLM_KEY:
+        raise AuthModeRefusedError(
+            LLM_KEY_UNSUPPORTED_RULE,
+            "this Directive was routed to one of the pool's LLM Keys, which this Runner "
+            "release cannot open; update the Runner",
+        )
+    raise AuthModeRefusedError(
+        LLM_ACCESS_UNKNOWN_RULE, f"this Runner does not know the LLM access {access.kind!r}"
+    )
+
+
 def is_setup_token(value: str) -> bool:
     return value.strip().startswith(_SETUP_TOKEN_PREFIX)

{agentic_runner-3.24.0 → agentic_runner-3.25.1}/src/agentic_runner/cli.py

@@ -15,9 +15,10 @@ the Organisation's cap.
 Runner (PRD issue 47, ``workstation.py``): one login agent per Organisation, managed by
 the user who hosts it, with no ``sudo`` anywhere.
 
-``sign-in --contract <id>`` signs one Contract's Claude Code in with Anthropic's own flow,
-in this terminal, as that Contract's uid in its harness root (QTS-1448). No code or token
-passes through the control plane.
+``sign-in [claude|codex]`` gives a person's own Runner their LLM access: their subscription,
+through the vendor's own sign-in in this terminal, or an API key stored in the Runner's
+own store (``sign_in.py``, Spec: Runners rev 3). No ids, and no code or token passes
+through the control plane.
 
 ``skill install | print`` hands the setup skill to the person's own Claude Code or Codex
 (``skill.py``, console-v2 issue 21).
@@ -37,10 +38,11 @@ import asyncio
 import getpass
 import json
 import os
+import re
+import socket
 import sys
 from collections.abc import Sequence
 from pathlib import Path
-from uuid import UUID
 
 from agentic_runner import __version__ as runner_version
 from agentic_runner import service, skill, workstation
@@ -66,11 +68,14 @@ from agentic_runner.service import (
     parse_tags,
     registration_token_from_env,
 )
+from agentic_runner.sign_in import AGENT_RUNTIMES, KeyStore
 from agentic_runner.workers.claude_sign_in import OAUTH_TOKEN, SIGN_IN_METHODS
 from agentic_runner_contracts import __version__ as contracts_version
 from agentic_runner_contracts.runner_registration import (
     HostAttestation,
     InstallChannel,
+    InstallTarget,
+    RunnerInstall,
     SessionKind,
     StoreKind,
 )
@@ -212,17 +217,26 @@ def main(argv: Sequence[str] | None = None) -> int:
 
     sign_in = subcommands.add_parser(
         "sign-in",
-        help="sign a Contract's Claude Code in with Anthropic's own flow, in this terminal",
+        help="give your own Runner your subscription or an API key, for Claude Code or Codex",
+    )
+    sign_in.add_argument(
+        "runtime",
+        nargs="?",
+        choices=tuple(AGENT_RUNTIMES),
+        help="one Agent Runtime; omitted asks about each one this Runner serves",
     )
-    sign_in.add_argument("--contract", required=True, help="the Contract's id")
     sign_in.add_argument(
         "--method",
         default=OAUTH_TOKEN,
         choices=SIGN_IN_METHODS,
-        help="oauth_token: a long-lived token (claude setup-token); claude_ai: a Claude.ai "
-        "login (claude auth login --claudeai)",
+        help="Claude subscriptions only. oauth_token: a long-lived token (claude setup-token); "
+        "claude_ai: a Claude.ai login (claude auth login --claudeai)",
+    )
+    sign_in.add_argument(
+        "--org",
+        default=None,
+        help="the workstation Organisation, when this workstation runs more than one",
     )
-    sign_in.add_argument("--org", default=None, help="a workstation Organisation (issue 47)")
     sign_in.add_argument("--root", default=None, type=Path, help=argparse.SUPPRESS)
 
     annotate = subcommands.add_parser("annotate", help="attach an annotation to this Work Record")
@@ -313,7 +327,7 @@ def main(argv: Sequence[str] | None = None) -> int:
     if arguments.command == "run":
         if arguments.org:
             return workstation.run_process(_org_paths(arguments), login_agent=arguments.login_agent)
-        return asyncio.run(service.run(attestation=_image_attestation()))
+        return asyncio.run(service.run(attestation=_image_attestation(), install=_run_install()))
     if arguments.command in {"install", "start", "stop", "credential"}:
         return _workstation(arguments)
     if arguments.command == "recipient-key":
@@ -390,29 +404,89 @@ def _image_attestation() -> HostAttestation:
             else InstallChannel.MANUAL
         ),
         session=SessionKind.CONTAINER,
-        store=StoreKind.FILE if load_config().credential_store is not None else StoreKind.NONE,
+        # Always a store: the state directory's own, where `sign-in` keeps a key, read
+        # before any mounted Secret (`service.build_credential_resolver`).
+        store=StoreKind.FILE,
         path=os.environ.get("PATH", ""),
     )
 
 
-def _sign_in(arguments: argparse.Namespace) -> int:
+def _run_install() -> RunnerInstall:
+    """Where a command reaches this ``run``: Helm with the pod name, Docker with the
+    container id, and anything else as a workstation, whose hostname can name its person
+    and is never reported (rev 3).
+
+    Docker's hostname is sent only in the container-id shape Docker gives it: with
+    ``--network host`` it is the machine's own name, and with ``--hostname`` whatever the
+    operator chose. A name the schema refuses is sent as none rather than stop the start.
+    """
+
+    if os.environ.get("KUBERNETES_SERVICE_HOST"):
+        target, hostname = InstallTarget.HELM, socket.gethostname()
+    elif _in_docker():
+        target, hostname = InstallTarget.DOCKER, socket.gethostname()
+        if not _CONTAINER_ID.fullmatch(hostname):
+            hostname = ""
+    else:
+        return RunnerInstall(target=InstallTarget.WORKSTATION)
     try:
-        contract_id = str(UUID(arguments.contract))
+        return RunnerInstall(target=target, hostname=hostname or None)
     except ValueError:
-        print(f"--contract expects a Contract id, got {arguments.contract!r}", file=sys.stderr)
-        return 2
+        return RunnerInstall(target=target)
+
+
+_CONTAINER_ID = re.compile(r"[0-9a-f]{12}")
+
+
+def _in_docker() -> bool:
+    return Path("/.dockerenv").exists()
+
+
+def _in_container() -> bool:
+    return bool(os.environ.get("KUBERNETES_SERVICE_HOST")) or _in_docker()
+
+
+def _sign_in(arguments: argparse.Namespace) -> int:
     if not (os.isatty(0) and os.isatty(1)):
         print(
             "sign-in is interactive: run it in a terminal (`kubectl exec -it`, `docker exec -it`)",
             file=sys.stderr,
         )
         return 2
-    if arguments.org:
-        paths = _org_paths(arguments)
+    store: KeyStore
+    if arguments.org or not _in_container():
+        try:
+            paths = _sign_in_org(arguments)
+        except ValueError as error:
+            print(error, file=sys.stderr)
+            return 2
         os.environ.update(
             workstation.run_environment(paths, workstation.WorkstationSettings.load(paths))
         )
-    return asyncio.run(service.sign_in_claude(contract_id, method=arguments.method))
+        store = open_workstation_store(paths.org, fallback=paths.credentials)
+    else:
+        store = service.own_store(load_config())
+    return asyncio.run(service.sign_in(arguments.runtime, store=store, method=arguments.method))
+
+
+def _sign_in_org(arguments: argparse.Namespace) -> workstation.OrgPaths:
+    """``--org``, or the one Organisation this workstation runs -- no id to type."""
+
+    if arguments.org:
+        return _org_paths(arguments)
+    root = arguments.root or workstation.default_root()
+    installed = (
+        sorted(path.name for path in root.iterdir() if (path / "workstation.json").is_file())
+        if root.is_dir()
+        else []
+    )
+    if len(installed) != 1:
+        raise ValueError(
+            "no workstation Runner is installed here"
+            if not installed
+            else f"this workstation runs {', '.join(installed)}: name one with --org"
+        )
+    return workstation.OrgPaths(root=root, org=installed[0])
 
 
 def _install(arguments: argparse.Namespace, paths: workstation.OrgPaths) -> int: