agentic-runner 3.25.0__tar.gz → 3.25.1__tar.gz

{agentic_runner-3.25.0 → agentic_runner-3.25.1}/PKG-INFO

@@ -1,11 +1,11 @@
 Metadata-Version: 2.5
 Name: agentic-runner
-Version: 3.25.0
+Version: 3.25.1
 Summary: The Agentic OS Runner: an activity-only Temporal executor for workspaces, Agent Runtimes and verb seams
 License-Expression: AGPL-3.0-only
 License-File: LICENSE
 Requires-Python: >=3.12
-Requires-Dist: agentic-runner-contracts==3.25.0
+Requires-Dist: agentic-runner-contracts==3.25.1
 Requires-Dist: cryptography<51,>=50
 Requires-Dist: httpx<1.0,>=0.27
 Requires-Dist: pydantic-settings<3.0,>=2.0

{agentic_runner-3.25.0 → agentic_runner-3.25.1}/pyproject.toml

@@ -10,7 +10,7 @@ dependencies = [
   # Exactly this release's contracts: the two ship as one version, and an unpinned
   # requirement let `uv tool upgrade` keep an older contracts wheel the Runner cannot
   # import from (QTS-1473). `scripts/set-version.py` moves it with the version.
-  "agentic-runner-contracts==3.25.0",
+  "agentic-runner-contracts==3.25.1",
   # Imported directly by `registration.py` (the Ed25519 identity that signs every
   # heartbeat); already present transitively through pyjwt[crypto], declared because
   # we import it.

{agentic_runner-3.25.0 → agentic_runner-3.25.1}/src/agentic_runner/__init__.py

@@ -7,6 +7,6 @@ stay on the platform; this package imports none of them, and a CI partition test
 (``tests/test_package_partition.py``) fails the build if that changes.
 """
 
-__version__ = "3.25.0"
+__version__ = "3.25.1"
 
 __all__ = ["__version__"]

{agentic_runner-3.25.0 → agentic_runner-3.25.1}/src/agentic_runner/activities.py

@@ -292,7 +292,11 @@ from agentic_runner_contracts.routing import (
     assert_routed,
     selector_satisfied,
 )
-from agentic_runner_contracts.runner_registration import SubscriptionState
+from agentic_runner_contracts.runner_registration import (
+    ContractLlmTerms,
+    SubscriptionRight,
+    SubscriptionState,
+)
 from agentic_runner_contracts.runtime_context import (
     EGRESS_ALLOW_LIST_KEY,
     McpServerSpec,
@@ -1720,6 +1724,7 @@ class RunnerRalphActivities:
         directives_in_flight: DirectivesInFlight | None = None,
         usage_windows: UsageWindows | None = None,
         runner_limit: AppliedRunnerLimit | None = None,
+        llm_contracts: Callable[[], Sequence[ContractLlmTerms] | None] | None = None,
     ) -> None:
         self._fastapi_client = fastapi_client
         # What this Runner's host denies every Agent on it, checked at start (ADR-0022
@@ -1794,6 +1799,9 @@ class RunnerRalphActivities:
         # The retry fence (runner-repo 05). None fences nothing: a process that never
         # registered has no state directory to keep the records in.
         self._attempt_records = attempt_records
+        # The Contracts the last heartbeat ack named, read at each Directive (QTS-1751).
+        # None, or a callable answering None, before any ack from a 3.25 control plane.
+        self._llm_contracts = llm_contracts
 
     def activity_callables(self) -> list[Callable[..., Any]]:
         """Return decorated activity callables for Temporal worker registration."""
@@ -3148,6 +3156,7 @@ class RunnerRalphActivities:
                     host_party=host_party,
                     host_key_held=self._host_key_held(state),
                     subscription=self._subscription_state(state),
+                    subscription_right=self._subscription_right(state),
                     runtime_modes=getattr(runtime, "auth_modes", frozenset({AuthMode.API_KEY})),
                 )
             return choose_auth_mode(
@@ -3219,6 +3228,19 @@ class RunnerRalphActivities:
             and self._llm_proxy.slots.holds_host(provider.value)
         )
 
+    def _subscription_right(self, state: _RuntimeContextState) -> SubscriptionRight | None:
+        """What the last ack said of this Contract's own subscription; ``no_right`` for a
+        Contract it did not name, since nothing then allowed one here."""
+
+        terms = self._llm_contracts() if self._llm_contracts is not None else None
+        if terms is None:
+            return None
+        contract_id = _optional_uuid(state.contract_id)
+        return next(
+            (term.subscription for term in terms if term.contract_id == contract_id),
+            SubscriptionRight.NO_RIGHT,
+        )
+
     def _subscription_state(self, state: _RuntimeContextState) -> SubscriptionState:
         if self._contract_isolation is None or not state.contract_id:
             return SubscriptionState.NONE

{agentic_runner-3.25.0 → agentic_runner-3.25.1}/src/agentic_runner/auth_mode.py

@@ -30,7 +30,7 @@ from typing import Final
 
 from agentic_runner.workers.agent_runtime import AuthMode
 from agentic_runner_contracts.llm_access import LlmAccess, LlmAccessKind
-from agentic_runner_contracts.runner_registration import SubscriptionState
+from agentic_runner_contracts.runner_registration import SubscriptionRight, SubscriptionState
 
 __all__ = [
     "NO_RUNTIME_SUBSCRIPTION_RULE",
@@ -38,7 +38,9 @@ __all__ = [
     "LLM_ACCESS_UNKNOWN_RULE",
     "LLM_KEY_UNSUPPORTED_RULE",
     "SETUP_TOKEN_REFUSED_RULE",
+    "SUBSCRIPTION_NOT_ACKNOWLEDGED_RULE",
     "SUBSCRIPTION_NOT_SIGNED_IN_RULE",
+    "SUBSCRIPTION_NO_RIGHT_RULE",
     "SUBSCRIPTION_OFF_PERSONAL_RUNNER_RULE",
     "SHARED_HOST_PARTIES",
     "SIGN_IN_NEEDS_CONTRACT_UID_RULE",
@@ -64,6 +66,8 @@ SETUP_TOKEN_REFUSED_RULE: Final[str] = "setup_token_refused"
 HOST_KEY_NOT_HELD_RULE: Final[str] = "host_key_not_held"
 SUBSCRIPTION_NOT_SIGNED_IN_RULE: Final[str] = "subscription_not_signed_in"
 SUBSCRIPTION_OFF_PERSONAL_RUNNER_RULE: Final[str] = "subscription_off_personal_runner"
+SUBSCRIPTION_NO_RIGHT_RULE: Final[str] = "subscription_no_right"
+SUBSCRIPTION_NOT_ACKNOWLEDGED_RULE: Final[str] = "subscription_not_acknowledged"
 LLM_KEY_UNSUPPORTED_RULE: Final[str] = "llm_key_unsupported"
 LLM_ACCESS_UNKNOWN_RULE: Final[str] = "llm_access_unknown"
 # `claude setup-token` mints an OAuth bearer under this prefix; an Anthropic API key is
@@ -148,6 +152,7 @@ def require_named_access(
     host_party: str | None,
     host_key_held: bool,
     subscription: SubscriptionState,
+    subscription_right: SubscriptionRight | None,
     runtime_modes: Collection[AuthMode],
 ) -> AuthMode:
     """The mode the named access runs in, or a refusal naming what is missing.
@@ -156,6 +161,12 @@ def require_named_access(
     proxy; ``subscription`` the Contract's harness root for the Directive's kind. A
     subscription runs only on its person's own Runner (rev 3: never on a pool Runner),
     and only while it is signed in, unexpired and not at its usage limit.
+
+    ``subscription_right`` is what the last heartbeat ack said of the Contract's own
+    subscription (``llm_contracts``), so a misrouted Directive is refused here as well as
+    at the platform's routing (QTS-1349 controls 4 and 7, QTS-1751). ``None`` while no ack
+    has named the Contracts -- a control plane below 3.25 -- which leaves routing the only
+    check, as before.
     """
 
     if access.kind == LlmAccessKind.HOST_KEY:
@@ -173,6 +184,19 @@ def require_named_access(
                 f"this Runner is hosted by {host_party!r}; a subscription runs only on its "
                 "person's own Runner",
             )
+        if subscription_right == SubscriptionRight.NO_RIGHT:
+            raise AuthModeRefusedError(
+                SUBSCRIPTION_NO_RIGHT_RULE,
+                "this Directive was routed to the person's subscription, and the control plane "
+                "last told this Runner that the Contract does not allow one",
+            )
+        if subscription_right == SubscriptionRight.NOT_ACKNOWLEDGED:
+            raise AuthModeRefusedError(
+                SUBSCRIPTION_NOT_ACKNOWLEDGED_RULE,
+                "this Directive was routed to the person's subscription, and the control plane "
+                "last told this Runner that the person has not acknowledged the subscription "
+                "terms",
+            )
         if AuthMode.SUBSCRIPTION not in runtime_modes:
             raise AuthModeRefusedError(
                 NO_RUNTIME_SUBSCRIPTION_RULE,

{agentic_runner-3.25.0 → agentic_runner-3.25.1}/src/agentic_runner/service.py

@@ -1092,6 +1092,10 @@ class ControlPlaneStream:
             self.credentials.drop(contract_id, slot)
         self._delivered = set(plaintext)
 
+    @property
+    def llm_contracts(self) -> list[ContractLlmTerms] | None:
+        return None if self._llm_contracts is None else list(self._llm_contracts)
+
     def _take_llm_contracts(self, terms: list[ContractLlmTerms] | None) -> None:
         """Keep the ack's Contract terms, and the copy ``sign-in`` reads when they change.
         An ack without them (a control plane below 3.25) leaves what is held."""
@@ -1626,6 +1630,7 @@ async def _serve_registered(
                 tool_servers=tool_servers,
                 usage_windows=usage_windows,
                 runner_limit=runner_limit,
+                llm_contracts=lambda: stream.llm_contracts,
                 # The wake signal rides the connection this process polls with: one
                 # namespace, the Organisation's own (PRD issue 52, map ticket 15 §2).
                 signaller=TemporalWorkflowSignaller(client),
@@ -1823,6 +1828,7 @@ def _activities(
     tool_servers: ToolServerHealthLog | None = None,
     usage_windows: UsageWindows | None = None,
     runner_limit: AppliedRunnerLimit | None = None,
+    llm_contracts: Callable[[], list[ContractLlmTerms] | None] | None = None,
 ) -> list[Callable[..., Any]]:
     github_client = GitHubAppClient(
         app_id=os.getenv("GITHUB_APP_ID"),
@@ -1872,6 +1878,7 @@ def _activities(
         directives_in_flight=directives_in_flight,
         usage_windows=usage_windows,
         runner_limit=runner_limit,
+        llm_contracts=llm_contracts,
     )
     return [
         *ralph.activity_callables(),
@@ -1879,5 +1886,7 @@ def _activities(
             proxy=proxy,
             model=settings.TRIAGE_MODEL,
             timeout_seconds=settings.TRIAGE_DIRECTIVE_TIMEOUT_SECONDS,
+            host_party=state.host_party,
+            llm_contracts=llm_contracts,
         ).activity_callables(),
     ]

{agentic_runner-3.25.0 → agentic_runner-3.25.1}/src/agentic_runner/triage_activities.py

@@ -9,7 +9,7 @@ the same turn in-process (``user_sources.ProxyTriage``).
 
 from __future__ import annotations
 
-from collections.abc import Callable
+from collections.abc import Callable, Sequence
 from uuid import UUID
 
 import httpx
@@ -17,6 +17,7 @@ from temporalio import activity
 
 from agentic_runner.llm_proxy import LlmProxy
 from agentic_runner_contracts.activity_io import TriageTurnInput, TriageTurnOutput
+from agentic_runner_contracts.runner_registration import ContractLlmTerms
 
 
 async def run_triage_turn(
@@ -29,13 +30,15 @@ async def run_triage_turn(
     contract_id: UUID | None,
     agent_id: UUID | None,
     reserve_max_tokens: int | None = None,
+    delivered_only: bool = False,
     client: httpx.AsyncClient | None = None,
 ) -> str | None:
     """One completion through this Runner's proxy, metered like any Directive.
 
     ``None`` on anything that keeps the answer from being trusted -- a hang, a ceiling or
     Reserve refusal, a missing slot, a malformed body: the caller's fallback is the
-    keyword classifier, never an Incident (PRD issue 29).
+    keyword classifier, never an Incident (PRD issue 29). ``delivered_only`` keeps the
+    turn off this Runner's store key (``LlmProxy.attempt``).
     """
 
     http = client or httpx.AsyncClient()
@@ -45,6 +48,7 @@ async def run_triage_turn(
             contract_id=contract_id,
             agent_id=agent_id,
             reserve_max_tokens=reserve_max_tokens,
+            delivered_only=delivered_only,
         ) as handle:
             response = await http.post(
                 f"{handle.base_url}/chat/completions",
@@ -80,11 +84,15 @@ class RunnerTriageActivities:
         proxy: LlmProxy,
         model: str,
         timeout_seconds: float,
+        host_party: str | None = None,
+        llm_contracts: Callable[[], Sequence[ContractLlmTerms] | None] | None = None,
         client: httpx.AsyncClient | None = None,
     ) -> None:
         self._proxy = proxy
         self._model = model
         self._timeout_seconds = timeout_seconds
+        self._host_party = host_party
+        self._llm_contracts = llm_contracts
         self._client = client
 
     def activity_callables(self) -> list[Callable[..., object]]:
@@ -101,10 +109,19 @@ class RunnerTriageActivities:
             contract_id=_optional_uuid(request.intake_lead_contract_id),
             agent_id=_optional_uuid(request.intake_lead_agent_id),
             reserve_max_tokens=request.reserve_max_tokens,
+            delivered_only=self._pool_runner_before_named_access(),
             client=self._client,
         )
         return TriageTurnOutput(raw_text=raw_text)
 
+    def _pool_runner_before_named_access(self) -> bool:
+        """A pool Runner's store key stays out of the turn until an ack names the
+        Contracts: a control plane below 3.25 caps none of that spend, the rule a
+        Directive that names no access follows (QTS-1736, QTS-1751)."""
+
+        named = self._llm_contracts() if self._llm_contracts is not None else None
+        return self._host_party != "user" and named is None
+
 
 def _optional_uuid(value: str) -> UUID | None:
     try: