agentic-runner 3.3.0__tar.gz → 3.4.0__tar.gz

{agentic_runner-3.3.0 → agentic_runner-3.4.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: agentic-runner
-Version: 3.3.0
+Version: 3.4.0
 Summary: The Agentic OS Runner: an activity-only Temporal executor for workspaces, Agent Runtimes and verb seams
 License-Expression: AGPL-3.0-only
 License-File: LICENSE

{agentic_runner-3.3.0 → agentic_runner-3.4.0}/src/agentic_runner/__init__.py

@@ -7,6 +7,6 @@ stay on the platform; this package imports none of them, and a CI partition test
 (``tests/test_package_partition.py``) fails the build if that changes.
 """
 
-__version__ = "3.3.0"
+__version__ = "3.4.0"
 
 __all__ = ["__version__"]

{agentic_runner-3.3.0 → agentic_runner-3.4.0}/src/agentic_runner/activities.py

@@ -31,6 +31,7 @@ import tempfile
 import time
 from collections.abc import AsyncIterator, Awaitable, Callable, Mapping
 from dataclasses import asdict, dataclass, field, fields, replace
+from datetime import UTC, datetime
 from pathlib import Path
 from typing import Any, NoReturn, Protocol
 from uuid import UUID
@@ -75,6 +76,7 @@ from agentic_runner.credentials import (
     UnresolvableCredentialReferenceError,
 )
 from agentic_runner.egress import EGRESS_REFUSED_SOURCE, EgressProxy, Resolver, host_of
+from agentic_runner.harness_self_test import DirectivesInFlight
 from agentic_runner.heartbeat_link import HeartbeatLink, SeamUnavailableError
 from agentic_runner.hooks import (
     HOOK_EVIDENCE_SOURCE,
@@ -140,6 +142,7 @@ from agentic_runner.workers.fastapi_client import (
     WorkerFastApiClientError,
     directive_token,
 )
+from agentic_runner.workers.harness_outcome import classify_harness_outcome
 from agentic_runner.workers.harness_usage import extract_claude_result, extract_codex_turn_usage
 from agentic_runner.workers.mcp_config import McpServerEntry
 from agentic_runner.workers.skills import (
@@ -168,6 +171,7 @@ from agentic_runner_contracts.activity_io import (
     FixDirectiveOutput,
     GitHubCallError,
     GitHubCallFailure,
+    HarnessHold,
     LearningDirectiveInput,
     LearningDirectiveOutput,
     MemberDirectiveInput,
@@ -1442,6 +1446,7 @@ DIRECTIVE_TOKEN_EVIDENCE_SOURCE = "runner.directive_token"
 AGENT_RUNTIME_EVIDENCE_SOURCE = "runner.agent_runtime"
 SKILLS_EVIDENCE_SOURCE = "runner.skills"
 HARNESS_LOGIN_RESIDUE_SOURCE = "runner.harness_login_residue"
+HARNESS_HOLD_SOURCE = "runner.harness_hold"
 
 
 class _EvidenceWriter(Protocol):
@@ -1555,8 +1560,11 @@ class RunnerRalphActivities:
         egress_resolver: Resolver | None = None,
         tool_server_health: ToolServerHealthLog | None = None,
         attempt_records: AttemptRecords | None = None,
+        directives_in_flight: DirectivesInFlight | None = None,
     ) -> None:
         self._fastapi_client = fastapi_client
+        # Read by the harness self-test, which never runs beside a Contract's Directive.
+        self._directives_in_flight = directives_in_flight or DirectivesInFlight()
         # Wall-clock source for per-Directive runtime, accrued against the Budget's
         # wall-clock dimension (ADR-0007). Activities run outside the Temporal sandbox,
         # so a real monotonic clock is allowed here (it must never be used in the
@@ -2018,6 +2026,31 @@ class RunnerRalphActivities:
                 auth_mode=attempt.auth_mode,
             )
             plan = _take_plan(checkout_workspace)
+            harness_hold = await self._harness_hold(
+                runtime_state=runtime_state,
+                work_record_id=request.work_record_id,
+                directive_number=request.directive_number,
+                result=codex_result,
+                auth_mode=attempt.auth_mode,
+            )
+            if harness_hold is not None:
+                return BranchPullRequestOutput(
+                    repository=request.repository,
+                    branch_name=request.branch_name,
+                    base_ref=request.base_ref,
+                    pr_number=0,
+                    pr_url="",
+                    branch_created=branch.created,
+                    pr_created=False,
+                    duration_seconds=self._monotonic() - directive_started,
+                    usage=await self._directive_usage(
+                        work_record_id=request.work_record_id,
+                        directive_number=request.directive_number,
+                    ),
+                    workspace_path=str(workspace_path),
+                    grant_snapshot=dict(request.grant_snapshot),
+                    harness_hold=harness_hold,
+                )
             if codex_result.exit_code != 0:
                 if _is_guard_mode_refusal(codex_result):
                     # The runtime refused this Directive (guard-mode). Return a flagged
@@ -2475,6 +2508,7 @@ class RunnerRalphActivities:
         scratch_root = sandbox.tmp_dir if sandbox is not None else Path(tempfile.gettempdir())
         attempt_dir = prepare_attempt_dir(scratch_root / f"attempt-{key}", uid)
         async with contextlib.AsyncExitStack() as stack:
+            stack.enter_context(self._directives_in_flight.running(facts.contract_id))
             stack.callback(shutil.rmtree, attempt_dir, ignore_errors=True)
             callback_env: dict[str, str] = {}
             if self._socket_dir is not None:
@@ -4484,7 +4518,13 @@ class RunnerRalphActivities:
                 guard_mode_refused=True,
                 workspace_path=request.workspace_path,
             )
-        if consumed and self._message_store is not None and not ran.guard_mode_refused:
+        if (
+            consumed
+            and self._message_store is not None
+            and not ran.guard_mode_refused
+            # A held turn never read its Messages; the wake after the hold must see them.
+            and ran.harness_hold is None
+        ):
             self._message_store.mark_consumed(
                 contract_id=contract[0],
                 work_record_id=request.work_record_id,
@@ -4616,6 +4656,13 @@ class RunnerRalphActivities:
                 result=result,
                 auth_mode=attempt.auth_mode,
             )
+            harness_hold = await self._harness_hold(
+                runtime_state=state,
+                work_record_id=request.work_record_id,
+                directive_number=request.directive_number,
+                result=result,
+                auth_mode=attempt.auth_mode,
+            )
             usage = await self._directive_usage(
                 work_record_id=request.work_record_id,
                 directive_number=request.directive_number,
@@ -4652,6 +4699,7 @@ class RunnerRalphActivities:
                 usage=usage,
                 outcome=LEARNING_FAILED,
                 summary=f"the Learner's runtime exited {result.exit_code}",
+                harness_hold=harness_hold,
             )
         return self._learning_output(
             request,
@@ -4668,6 +4716,7 @@ class RunnerRalphActivities:
         usage: DirectiveUsage | None = None,
         outcome: str = LEARNING_PROPOSED,
         summary: str = "",
+        harness_hold: HarnessHold | None = None,
     ) -> LearningDirectiveOutput:
         return LearningDirectiveOutput(
             work_record_id=request.work_record_id,
@@ -4676,6 +4725,7 @@ class RunnerRalphActivities:
             usage=usage or DirectiveUsage(),
             outcome=outcome,
             summary=summary,
+            harness_hold=harness_hold,
         )
 
     def _learner_transcript(self, state: _RuntimeContextState, work_record_id: str) -> str:
@@ -4875,6 +4925,30 @@ class RunnerRalphActivities:
             )
             # Taken before the commit below so it never lands on the branch (PRD 59).
             plan = _take_plan(state.workspace_path)
+            harness_hold = await self._harness_hold(
+                runtime_state=state,
+                work_record_id=request.work_record_id,
+                directive_number=request.directive_number,
+                result=codex_result,
+                auth_mode=attempt.auth_mode,
+            )
+            if harness_hold is not None:
+                return FixDirectiveOutput(
+                    work_record_id=request.work_record_id,
+                    repository=request.repository,
+                    pr_number=request.pr_number,
+                    directive_number=request.directive_number,
+                    branch_head_sha="",
+                    summary=f"held: the harness reported {harness_hold.kind.value}",
+                    duration_seconds=self._monotonic() - directive_started,
+                    usage=await self._directive_usage(
+                        work_record_id=request.work_record_id,
+                        directive_number=request.directive_number,
+                    ),
+                    workspace_path=str(state.workspace_path),
+                    grant_snapshot=state.grant_snapshot_payload,
+                    harness_hold=harness_hold,
+                )
             if codex_result.exit_code != 0:
                 if _is_guard_mode_refusal(codex_result):
                     return FixDirectiveOutput(
@@ -5114,6 +5188,46 @@ class RunnerRalphActivities:
                 }
             )
 
+    async def _harness_hold(
+        self,
+        *,
+        runtime_state: _RuntimeContextState,
+        work_record_id: str,
+        directive_number: int,
+        result: DirectiveResult,
+        auth_mode: AuthMode,
+    ) -> HarnessHold | None:
+        """A subscription harness that stopped on its usage limit or sign-in, recorded
+        once (local-agents 08). An ``api_key`` Directive's limits are the proxy's, so it is
+        never classified. The Evidence names the kind and the reset, never the output."""
+
+        if auth_mode != AuthMode.SUBSCRIPTION:
+            return None
+        hold = classify_harness_outcome(
+            runtime_state.cli_kind,
+            exit_code=result.exit_code,
+            stdout=result.stdout,
+            stderr=result.stderr,
+            error=result.error,
+            now=datetime.now(UTC),
+        )
+        if hold is None:
+            return None
+        await self._fastapi_client.append_evidence(
+            work_record_id,
+            source=HARNESS_HOLD_SOURCE,
+            payload={
+                "event": "directive.harness_hold",
+                "kind": hold.kind.value,
+                "cli_kind": runtime_state.cli_kind,
+                "retry_not_before": hold.retry_not_before,
+                "directive_number": directive_number,
+                "agent_id": runtime_state.agent_id,
+                "contract_id": runtime_state.contract_id,
+            },
+        )
+        return hold
+
     @activity.defn(name="wipe_contract_residue")
     async def wipe_contract_residue(self, request: ContractResidueInput) -> ContractResidueOutput:
         """Delete everything one Contract left on this Runner and retire its uid (17 A6).

agentic_runner-3.4.0/src/agentic_runner/cli_floor.py

@@ -0,0 +1,33 @@
+"""Which executable each Agent Runtime CLI is, and the version floor it must clear."""
+
+from __future__ import annotations
+
+import re
+from collections.abc import Mapping
+from typing import Final
+
+__all__ = ["CLI_FLOORS", "CLI_NAMES", "meets_floor", "parse_cli_version"]
+
+# What the Profile's `cli_kind` runs, by executable name on PATH.
+CLI_NAMES: Final[Mapping[str, str]] = {"codex_cli": "codex", "claude_code": "claude"}
+# The versions the Runner image is built and tested against (Dockerfile.runner's
+# CODEX_CLI_VERSION / CLAUDE_CODE_VERSION; a test holds the two together). Below the
+# floor is *reported*, not refused: the user's own CLI is the user's to upgrade.
+CLI_FLOORS: Final[Mapping[str, str]] = {"codex": "0.141.0", "claude": "2.1.280"}
+
+_VERSION = re.compile(r"(\d+\.\d+\.\d+[0-9A-Za-z.+-]{0,40})")
+
+
+def parse_cli_version(output: str) -> str | None:
+    match = _VERSION.search(output)
+    return None if match is None else match.group(1)
+
+
+def meets_floor(name: str, version: str) -> bool:
+    """Whether ``version`` of the executable ``name`` clears the Runner's floor for it."""
+
+    return _version_tuple(version) >= _version_tuple(CLI_FLOORS[name])
+
+
+def _version_tuple(version: str) -> tuple[int, ...]:
+    return tuple(int(part) for part in re.findall(r"\d+", version)[:3])

agentic_runner-3.4.0/src/agentic_runner/harness_self_test.py

@@ -0,0 +1,162 @@
+"""A harness's ``--version``, run as each Contract would run it (local-agents 17).
+
+What the heartbeat's ``cli`` attestation says is that the Runner's own uid can start a
+CLI. Whether a Contract can is a different fact: its uid, its harness root and its
+sandbox floor all stand between the two. So the self-test spawns exactly what a
+Directive spawns, minus the prompt, and keeps only the verdict -- never the output, which
+on a harness root can carry an account name.
+
+At most once per interval per Contract and never while that Contract has a Directive
+running: the harness root is the Directive's while it runs, and a concurrent spawn
+under the same rlimit floor would count against the Directive's process ceiling.
+"""
+
+from __future__ import annotations
+
+import os
+import subprocess
+from collections import Counter
+from collections.abc import Awaitable, Callable, Collection, Iterator, Sequence
+from contextlib import contextmanager
+from datetime import UTC, datetime
+from typing import Final
+from uuid import UUID
+
+from agentic_runner.cli_floor import CLI_NAMES, meets_floor, parse_cli_version
+from agentic_runner.workers._runtime_support import SubprocessResult, run_subprocess_exec
+from agentic_runner.workers.contract_isolation import ContractIsolationError, DirectiveSandbox
+from agentic_runner_contracts.runner_registration import HarnessSelfTest, SelfTestFailure
+
+__all__ = [
+    "SELF_TEST_INTERVAL_SECONDS",
+    "DirectivesInFlight",
+    "HarnessSelfTests",
+]
+
+SELF_TEST_INTERVAL_SECONDS: Final = 15 * 60
+_TIMEOUT_SECONDS: Final = 10
+_OUTPUT_LIMIT_BYTES: Final = 4096
+
+# Where each harness reads its config root from; the same variable its runtime sets.
+_HARNESS_ROOT_ENV: Final = {"codex_cli": "CODEX_HOME", "claude_code": "CLAUDE_CONFIG_DIR"}
+
+SandboxFor = Callable[[str, str], DirectiveSandbox | None]
+
+
+class DirectivesInFlight:
+    """Which Contracts have a Directive running in this process right now."""
+
+    def __init__(self) -> None:
+        self._running: Counter[str] = Counter()
+
+    @contextmanager
+    def running(self, contract_id: str | None) -> Iterator[None]:
+        key = contract_id or ""
+        self._running[key] += 1
+        try:
+            yield
+        finally:
+            self._running[key] -= 1
+            if self._running[key] <= 0:
+                del self._running[key]
+
+    def busy(self, contract_id: str) -> bool:
+        return self._running[contract_id] > 0
+
+
+class HarnessSelfTests:
+    """The latest self-test per ``(contract_id, cli_kind)``, and when the next one is due."""
+
+    def __init__(
+        self,
+        *,
+        sandbox_for: SandboxFor,
+        in_flight: DirectivesInFlight,
+        served: Collection[str],
+        run: Callable[..., Awaitable[SubprocessResult]] = run_subprocess_exec,
+        monotonic: Callable[[], float],
+        clock: Callable[[], datetime] = lambda: datetime.now(UTC),
+        interval_seconds: float = SELF_TEST_INTERVAL_SECONDS,
+    ) -> None:
+        self._sandbox_for = sandbox_for
+        self._in_flight = in_flight
+        self._served = frozenset(served)
+        self._run = run
+        self._monotonic = monotonic
+        self._clock = clock
+        self._interval = interval_seconds
+        self._results: dict[tuple[str, str], HarnessSelfTest] = {}
+        self._last_run: dict[tuple[str, str], float] = {}
+
+    def result(self, contract_id: UUID | str, cli_kind: str) -> HarnessSelfTest | None:
+        return self._results.get((str(contract_id), cli_kind))
+
+    async def run_due(self, targets: Sequence[tuple[str, str]]) -> None:
+        for gone in (self._results.keys() | self._last_run.keys()) - set(targets):
+            self._forget(gone)
+        for contract_id, cli_kind in targets:
+            key = (contract_id, cli_kind)
+            last = self._last_run.get(key)
+            if last is not None and self._monotonic() - last < self._interval:
+                continue
+            # Checked before the spawn only: a Directive that starts during the (at most
+            # _TIMEOUT_SECONDS) spawn overlaps it. Accepted -- `--version` neither reads
+            # nor writes the harness root's state and holds one process slot briefly.
+            if self._in_flight.busy(contract_id):
+                # Not stamped: it runs on the first sweep after the Directive ends.
+                continue
+            result = await self._self_test(contract_id, cli_kind)
+            if result is None:
+                self._forget(key)
+                continue
+            self._results[key] = result
+            self._last_run[key] = self._monotonic()
+
+    def _forget(self, key: tuple[str, str]) -> None:
+        self._results.pop(key, None)
+        self._last_run.pop(key, None)
+
+    async def _self_test(self, contract_id: str, cli_kind: str) -> HarnessSelfTest | None:
+        """``None`` when the harness root is gone, wiped since the sweep listed it."""
+
+        name = CLI_NAMES.get(cli_kind)
+        if name is None or cli_kind not in self._served:
+            return self._failed(SelfTestFailure.NOT_FOUND)
+        try:
+            sandbox = self._sandbox_for(contract_id, cli_kind)
+        except (ContractIsolationError, OSError):
+            return self._failed(SelfTestFailure.SPAWN_FAILED)
+        if sandbox is None:
+            return None
+        env = {
+            "PATH": os.environ.get("PATH") or os.defpath,
+            "HOME": str(sandbox.home_dir),
+            "TMPDIR": str(sandbox.tmp_dir),
+            _HARNESS_ROOT_ENV[cli_kind]: str(sandbox.harness_config_dir),
+        }
+        try:
+            answer = await self._run(
+                argv=[name, "--version"],
+                cwd=sandbox.home_dir,
+                env=env,
+                stdin=None,
+                timeout_seconds=_TIMEOUT_SECONDS,
+                output_limit_bytes=_OUTPUT_LIMIT_BYTES,
+                sandbox=sandbox,
+            )
+        except TimeoutError:
+            return self._failed(SelfTestFailure.TIMEOUT)
+        except FileNotFoundError:
+            return self._failed(SelfTestFailure.NOT_FOUND)
+        except (OSError, subprocess.SubprocessError):
+            # SubprocessError: the sandbox floor's own preexec hook refused the spawn.
+            return self._failed(SelfTestFailure.SPAWN_FAILED)
+        version = parse_cli_version(answer.stdout or answer.stderr)
+        if answer.exit_code != 0 or version is None:
+            return self._failed(SelfTestFailure.SPAWN_FAILED)
+        if not meets_floor(name, version):
+            return self._failed(SelfTestFailure.BELOW_FLOOR)
+        return HarnessSelfTest(ok=True, at=self._clock())
+
+    def _failed(self, reason: SelfTestFailure) -> HarnessSelfTest:
+        return HarnessSelfTest(ok=False, at=self._clock(), reason=reason)

{agentic_runner-3.3.0 → agentic_runner-3.4.0}/src/agentic_runner/service.py

@@ -56,6 +56,7 @@ from agentic_runner.credentials import (
     HostCredentialStore,
 )
 from agentic_runner.device_login_activities import ContractDeviceLoginActivities
+from agentic_runner.harness_self_test import DirectivesInFlight, HarnessSelfTests
 from agentic_runner.heartbeat_link import WAKE_DIVERGENCE, HeartbeatLink
 from agentic_runner.hooks import AttemptFacts, HookName, HookRunner
 from agentic_runner.integrations.git.workspace import LocalGitWorkspace
@@ -168,6 +169,8 @@ TEMPORAL_TLS_ENV = "AGENTIC_TEMPORAL_TLS"
 # glances at their inbox; anything tighter spends IMAP logins, not attention.
 SOURCE_POLL_SECONDS_ENV = "AGENTIC_RUNNER_SOURCE_POLL_SECONDS"
 DEFAULT_SOURCE_POLL_SECONDS = 60.0
+# How often due harness self-tests are looked for; each is due every 15 minutes at most.
+SELF_TEST_SWEEP_SECONDS = 60.0
 # The Recipient Key is normally *generated here*, once per installation, and kept in the
 # state directory (PRD issue 48, 22 A4). These two exist for an installer that mints it
 # outside this process and are read only when both are set; the Helm chart takes the
@@ -558,6 +561,11 @@ class ControlPlaneStream:
     messages: MessageStore | None = None
     # Console-v2 issue 29: the latest start of each Runner-hosted Tool Server.
     tool_servers: ToolServerHealthLog | None = None
+    # Local-agents 17: each runtime's descriptor, the harness roots on disk and the last
+    # self-test under each.
+    runtimes: Mapping[str, AgentRuntime] = field(default_factory=dict)
+    contracts: ContractIsolation | None = None
+    self_tests: HarnessSelfTests | None = None
     # Local-agents 04b: which delivered references fill the LLM proxy's slot, and where.
     llm_slots: Mapping[str, LlmProvider] = field(default_factory=lambda: dict(LLM_SLOT_REFERENCES))
     _delivered: set[tuple[str, str]] = field(default_factory=set)
@@ -589,21 +597,44 @@ class ControlPlaneStream:
     def _harnesses(self) -> list[HarnessVersion]:
         """Per Contract: the CLI's version and whether it runs on a delivered key (22 A8)
         or on the login its funder created in the harness root -- read off the slot, never
-        off the root, which the Runner does not open."""
+        off the root, which the Runner does not open. A Contract with a harness root and no
+        slot is listed too, so a login-only Contract gets its descriptor (local-agents 17).
+        """
 
         if self.attestation is None:
             return []
         versions = {cli.cli_kind: cli.version for cli in self.attestation.clis}
+        slots = {
+            (str(slot.contract_id), slot.runtime_kind): slot.present
+            for slot in self.proxy.slots.statuses()
+        }
+        roots = self.contracts.harness_roots() if self.contracts is not None else []
         return [
-            HarnessVersion(
-                contract_id=slot.contract_id,
-                cli_kind=slot.runtime_kind,
-                version=versions.get(slot.runtime_kind, "unknown"),
-                auth_mode="api_key" if slot.present else "login",
+            self._harness(
+                contract_id, cli_kind, versions, delivered=slots.get((contract_id, cli_kind), False)
             )
-            for slot in self.proxy.slots.statuses()
+            for contract_id, cli_kind in sorted(set(slots) | set(roots))
         ]
 
+    def _harness(
+        self, contract_id: str, cli_kind: str, versions: Mapping[str, str], *, delivered: bool
+    ) -> HarnessVersion:
+        runtime = self.runtimes.get(cli_kind)
+        capabilities = runtime.capabilities() if runtime is not None else None
+        return HarnessVersion(
+            contract_id=UUID(contract_id),
+            cli_kind=cli_kind,
+            version=versions.get(cli_kind, "unknown"),
+            auth_mode="api_key" if delivered else "login",
+            auth_modes=(sorted(capabilities.auth_modes) if capabilities is not None else None),
+            permission_mode=capabilities.permission_mode if capabilities is not None else None,
+            self_test=(
+                self.self_tests.result(contract_id, cli_kind)
+                if self.self_tests is not None
+                else None
+            ),
+        )
+
     async def directive_token(self, directive_id: str) -> str:
         """One activity execution's control-plane token, by Directive id (PRD issue 63)."""
 
@@ -929,6 +960,17 @@ async def _serve_registered(
     load = _LoadInterceptor()
     proxy = LlmProxy(slots=SlotStore(), ceilings=CeilingStore(), outbox=UsageOutbox())
     credentials = build_credential_resolver(config, host_store=host_store)
+    isolation = build_contract_isolation(settings, can_separate_uids=can_change_uid)
+    runtimes = build_agent_runtimes(settings, attestation.clis if attestation is not None else [])
+    in_flight = DirectivesInFlight()
+    self_tests = HarnessSelfTests(
+        sandbox_for=lambda contract_id, cli_kind: isolation.existing_sandbox(
+            contract_id, runtime_kind=cli_kind
+        ),
+        in_flight=in_flight,
+        served=runtimes,
+        monotonic=time.monotonic,
+    )
     stream = ControlPlaneStream(
         client=RunnerRegistrationClient(base_url=control_plane, client=http_client),
         state=state,
@@ -953,6 +995,9 @@ async def _serve_registered(
         attestation=attestation,
         lifecycle=lifecycle,
         heartbeat_stamp=state_dir / HEARTBEAT_STAMP_NAME,
+        runtimes=runtimes,
+        contracts=isolation,
+        self_tests=self_tests,
     )
     stream.sources = UserSourcePoller(
         stream=SignedIntakeStream(stream.client, state),
@@ -1001,12 +1046,13 @@ async def _serve_registered(
                 settings=settings,
                 config=config,
                 state=state,
-                can_change_uid=can_change_uid,
+                isolation=isolation,
+                agent_runtimes=runtimes,
+                directives_in_flight=in_flight,
                 hooks=hooks,
                 proxy=proxy,
                 credentials=credentials,
                 link=link,
-                attestation=attestation,
                 token_source=stream,
                 messages=messages,
                 tool_servers=tool_servers,
@@ -1024,13 +1070,16 @@ async def _serve_registered(
             _heartbeat_forever(link, stream, client, interval, stop=stop, revoked=revoked)
         )
         poll = asyncio.create_task(_poll_sources_forever(stream.sources, _source_poll_seconds()))
+        self_test = asyncio.create_task(
+            _self_test_forever(self_tests, isolation, SELF_TEST_SWEEP_SECONDS)
+        )
         readiness.ready = True
         await run_runner_lifecycle_hook(hooks, HookName.RUNNER_STARTUP)
         try:
             await run_worker_until_terminated(worker, stop=stop)
         finally:
             readiness.ready = False
-            for task in (beat, poll):
+            for task in (beat, poll, self_test):
                 task.cancel()
                 with contextlib.suppress(asyncio.CancelledError):
                     await task
@@ -1112,18 +1161,36 @@ async def _poll_sources_forever(poller: UserSourcePoller, interval: float) -> No
         await poller.poll()
 
 
+async def _self_test_forever(
+    self_tests: HarnessSelfTests, isolation: ContractIsolation, interval: float
+) -> None:
+    """Each harness root's self-test at start, then whenever it falls due (local-agents 17).
+
+    Only roots already on disk: a Contract's uid is allocated by its first Directive,
+    which records the allocation, and a self-test must not be the call that does it.
+    """
+
+    while True:
+        try:
+            await self_tests.run_due(isolation.harness_roots())
+        except Exception as error:  # noqa: BLE001 - a lost sweep is retried on the next one
+            _logger.warning("harness self-test sweep failed: %s", error)
+        await asyncio.sleep(interval)
+
+
 def _activities(
     fastapi: RunnerFastApiClient,
     *,
     settings: WorkerSettings,
     config: RunnerConfig,
     state: RunnerState,
-    can_change_uid: bool,
+    isolation: ContractIsolation,
+    agent_runtimes: Mapping[str, AgentRuntime],
+    directives_in_flight: DirectivesInFlight,
     hooks: HookRunner,
     proxy: LlmProxy,
     credentials: CredentialResolver,
     link: HeartbeatLink,
-    attestation: HostAttestation | None,
     token_source: DirectiveTokenSource | None = None,
     messages: MessageStore | None = None,
     signaller: TemporalWorkflowSignaller | None = None,
@@ -1136,7 +1203,6 @@ def _activities(
         api_base_url=os.getenv("GITHUB_API_BASE_URL", "https://api.github.com"),
     )
     static_git_token = os.getenv("AGENTIC_OS_GIT_TOKEN") or None
-    isolation = build_contract_isolation(settings, can_separate_uids=can_change_uid)
     attempt_records = AttemptRecords(config.state_dir, workspace_root=settings.WORKSPACE_ROOT)
     # Only the dead go: a live record is a harness this process lost on restart, still
     # writing its Workspace, and the next attempt must keep being refused (RR-05).
@@ -1144,9 +1210,7 @@ def _activities(
     ralph = RunnerRalphActivities(
         fastapi,
         runtime_context_resolver=WorkerRuntimeContextResolver(fastapi),
-        agent_runtimes=build_agent_runtimes(
-            settings, attestation.clis if attestation is not None else []
-        ),
+        agent_runtimes=agent_runtimes,
         git_workspace=LocalGitWorkspace(
             git_token=static_git_token,
             git_token_provider=(
@@ -1177,6 +1241,7 @@ def _activities(
         workflow_signaller=signaller,
         tool_server_health=tool_servers,
         attempt_records=attempt_records,
+        directives_in_flight=directives_in_flight,
     )
     return [
         *ralph.activity_callables(),

{agentic_runner-3.3.0 → agentic_runner-3.4.0}/src/agentic_runner/workers/agent_runtime.py

@@ -101,6 +101,24 @@ class DirectiveResult:
     evidence: DirectiveEvidence
 
 
+# The permission mode of a runtime whose guard configuration is incomplete: it refuses
+# every Directive, so there is no mode it passes.
+REFUSED_PERMISSION_MODE = "refused"
+
+
+@dataclass(frozen=True, slots=True)
+class RuntimeCapabilities:
+    """What a runtime declares about itself on the heartbeat (local-agents 17).
+
+    ``permission_mode`` is the fixed permission and approval mode the runtime passes its
+    harness, as a short patterned string. It is reported, never the gate: the Runner's
+    own floor is (ADR-0011 §12).
+    """
+
+    auth_modes: frozenset[AuthMode]
+    permission_mode: str
+
+
 @runtime_checkable
 class AgentRuntime(Protocol):
     """The pluggable engine an Agent uses to execute one Directive per step."""
@@ -111,6 +129,8 @@ class AgentRuntime(Protocol):
     # counts as "an API key is present" when the Runner chooses the mode.
     host_api_key: bool
 
+    def capabilities(self) -> RuntimeCapabilities: ...
+
     async def execute_directive(self, request: DirectiveRequest) -> DirectiveResult: ...
 
 

{agentic_runner-3.3.0 → agentic_runner-3.4.0}/src/agentic_runner/workers/claude_runtime.py

@@ -19,11 +19,13 @@ from agentic_runner.workers._runtime_support import (
     workspace_id,
 )
 from agentic_runner.workers.agent_runtime import (
+    REFUSED_PERMISSION_MODE,
     AuthMode,
     DirectiveEvidence,
     DirectiveRequest,
     DirectiveResult,
     ResumableAgentRuntime,
+    RuntimeCapabilities,
 )
 from agentic_runner.workers.contract_isolation import DirectiveSandbox
 from agentic_runner.workers.mcp_config import claude_mcp_config
@@ -75,6 +77,16 @@ class ClaudeRuntime(ResumableAgentRuntime):
         self._runner = runner or run_subprocess_exec
         self.host_api_key = bool(settings.ANTHROPIC_API_KEY)
 
+    def capabilities(self) -> RuntimeCapabilities:
+        return RuntimeCapabilities(
+            auth_modes=self.auth_modes,
+            permission_mode=(
+                "permission=skip;output=json"
+                if _guard_mode(self._settings) is not None
+                else REFUSED_PERMISSION_MODE
+            ),
+        )
+
     async def execute_directive(self, request: DirectiveRequest) -> DirectiveResult:
         workspace_path = request.workspace_path.resolve(strict=False)
         workspace_root = self._settings.WORKSPACE_ROOT.resolve(strict=False)

{agentic_runner-3.3.0 → agentic_runner-3.4.0}/src/agentic_runner/workers/codex_runtime.py

@@ -23,11 +23,13 @@ from agentic_runner.workers._runtime_support import (
     workspace_id,
 )
 from agentic_runner.workers.agent_runtime import (
+    REFUSED_PERMISSION_MODE,
     AuthMode,
     DirectiveEvidence,
     DirectiveRequest,
     DirectiveResult,
     ResumableAgentRuntime,
+    RuntimeCapabilities,
 )
 from agentic_runner.workers.command_policy import CODEX_EPHEMERAL_CREDENTIALS_OVERRIDE
 from agentic_runner.workers.contract_isolation import DirectiveSandbox
@@ -109,6 +111,20 @@ class CodexRuntime(ResumableAgentRuntime):
         self._settings = settings
         self._runner = runner or run_subprocess_exec
 
+    def capabilities(self) -> RuntimeCapabilities:
+        # Only the guarded configurations are named: anything else refuses every Directive,
+        # and a free-form setting would not fit the heartbeat's pattern.
+        guarded = _guard_mode(self._settings) is not None
+        return RuntimeCapabilities(
+            auth_modes=self.auth_modes,
+            permission_mode=(
+                f"sandbox={self._settings.CODEX_SANDBOX_MODE};"
+                f"approval={self._settings.CODEX_ASK_FOR_APPROVAL}"
+                if guarded
+                else REFUSED_PERMISSION_MODE
+            ),
+        )
+
     async def execute_directive(self, request: DirectiveRequest) -> DirectiveResult:
         workspace_path = request.workspace_path.resolve(strict=False)
         workspace_root = self._settings.WORKSPACE_ROOT.resolve(strict=False)

{agentic_runner-3.3.0 → agentic_runner-3.4.0}/src/agentic_runner/workers/contract_isolation.py

@@ -311,6 +311,23 @@ class ContractIsolation:
             gid=uid,
         )
 
+    def existing_sandbox(
+        self, contract_id: str | None, *, runtime_kind: str
+    ) -> DirectiveSandbox | None:
+        """``sandbox`` only for a harness root already on disk, else ``None``.
+
+        For a caller that must never be the one to create a Contract's tree or allocate
+        its uid -- a terminated Contract's wipe may have just retired both. Synchronous
+        on purpose: no await may fall between the check and ``sandbox``, or a wipe on the
+        same event loop could land in between.
+        """
+
+        if not self.harness_config_dir(contract_id, runtime_kind).is_dir():
+            return None
+        if self._can_separate_uids and not self.has_uid(contract_id):
+            return None
+        return self.sandbox(contract_id, runtime_kind=runtime_kind)
+
     def prepare_workspace(self, contract_id: str | None, work_record_id: str) -> Path:
         """Create ``{contract_id}/{work_record_id}`` 0700, owned by the Contract's uid."""
 
@@ -431,6 +448,21 @@ class ContractIsolation:
                     held.append((contract_dir.name, entry.name))
         return held
 
+    def harness_roots(self) -> list[tuple[str, str]]:
+        """Every ``(contract_id, runtime_kind)`` harness root already on this Runner."""
+
+        if not self._workspace_root.is_dir():
+            return []
+        roots: list[tuple[str, str]] = []
+        for contract_dir in sorted(self._workspace_root.iterdir()):
+            harness_dir = contract_dir / _HARNESS_DIR
+            if not _is_uuid(contract_dir.name) or not harness_dir.is_dir():
+                continue
+            for entry in sorted(harness_dir.iterdir()):
+                if entry.is_dir() and _RUNTIME_KIND_RE.fullmatch(entry.name):
+                    roots.append((contract_dir.name, entry.name))
+        return roots
+
     def remove_workspace(self, contract_id: str | None, work_record_id: str) -> bool:
         """Delete one Work Record's Workspace, leaving the Contract's tree standing."""
 

agentic_runner-3.4.0/src/agentic_runner/workers/harness_outcome.py

@@ -0,0 +1,213 @@
+"""Recognise a subscription harness that stopped on its person's account (local-agents 08).
+
+A usage limit or an expired sign-in is not something a fix Directive can repair, so the
+Runner names it on the Directive's output (``HarnessHold``) and issue 09 holds instead of
+failing. Pure text parsing, no I/O, re-implemented from the behaviour Paperclip's
+``claude-local`` and ``codex-local`` adapters classify (research 01 §1, at ``6bc830b``) and
+from the ACP spike's captures (local-agents 02: ``xLIM``, ``xEXP``, ``cEXP``).
+
+A miss costs what it cost before this module -- a generic failure and a fix Directive --
+while a false match holds a Contract that could have run. So every matcher is narrow: it
+reads a failed turn only, and only the harness's structured error fields and stderr,
+never the model's own messages, which may well talk about usage limits or sign-ins.
+"""
+
+from __future__ import annotations
+
+import json
+import re
+from datetime import UTC, datetime, timedelta, tzinfo
+from typing import Any, Final
+from zoneinfo import ZoneInfo, ZoneInfoNotFoundError
+
+from agentic_runner.workers.harness_usage import extract_claude_result
+from agentic_runner_contracts.activity_io import HarnessHold, HarnessHoldKind
+
+__all__ = ["classify_harness_outcome"]
+
+_CLAUDE_CODE: Final[str] = "claude_code"
+_CODEX_CLI: Final[str] = "codex_cli"
+
+# The ACP runtime raises a bridge's JSON-RPC error as ``ACP error <code>: <message>
+# <data as sorted JSON>`` into ``DirectiveResult.error`` (local-agents 12). ``-32000`` is
+# ACP's "authentication required", which both bridges answer for an expired or absent
+# sign-in (``xEXP``, ``cEXP``); codex-acp marks a usage limit as ``-32603`` with
+# ``codexErrorInfo: usageLimitExceeded`` and no reset time (``xLIM``).
+_ACP_ERROR_RE: Final = re.compile(r"ACP error (-?\d+):")
+_ACP_AUTH_REQUIRED: Final[int] = -32000
+_ACP_INTERNAL_ERROR: Final[int] = -32603
+_CODEX_USAGE_LIMIT_INFO_RE: Final = re.compile(r'"codexErrorInfo":\s*"usageLimitExceeded"')
+
+_APOSTROPHE: Final[str] = "['’]"
+
+_CODEX_USAGE_LIMIT_RE: Final = re.compile(
+    rf"you{_APOSTROPHE}ve hit your usage limit|usage limit (?:reached|exceeded)",
+    re.IGNORECASE,
+)
+_CODEX_SIGN_IN_RE: Final = re.compile(
+    r"refresh[_\s-]?token[_\s-]?(?:reused|expired|invalidated|revoked)"
+    r"|refresh token (?:has )?(?:already been used|expired|been invalidated|been revoked)"
+    r"|\binvalid_grant\b"
+    r"|(?:oauth|refresh|access[_\s-]?token|bearer).{0,80}(?:\b401\b|unauthori[sz]ed)"
+    r"|(?:\b401\b|unauthori[sz]ed).{0,80}(?:oauth|refresh|access[_\s-]?token|bearer)",
+    re.IGNORECASE,
+)
+_CODEX_RESET_RE: Final = re.compile(r"try again at\s+(?P<clock>[^.!\n]+)", re.IGNORECASE)
+
+_CLAUDE_USAGE_LIMIT_RE: Final = re.compile(
+    rf"you{_APOSTROPHE}ve hit your (?:\w+ )?limit"
+    rf"|you{_APOSTROPHE}re out of extra usage"
+    r"|session limit (?:reached|exceeded)"
+    r"|(?:5[-\s]?hour|weekly|claude usage|usage) limit reached",
+    re.IGNORECASE,
+)
+_CLAUDE_SIGN_IN_RE: Final = re.compile(
+    r"not logged in|please log in|please run (?:`?claude login`?|/login)"
+    r"|login required|authentication required"
+    r"|invalid api key.{0,120}(?:/login|claude login|log in)"
+    r"|authentication[_\s-](?:failed|error)|failed to authenticate"
+    r"|invalid bearer token"
+    r"|(?:invalid|expired|revoked).{0,40}(?:bearer|oauth|access) token"
+    r"|(?:bearer|oauth|access) token.{0,40}(?:invalid|expired|revoked)",
+    re.IGNORECASE,
+)
+_CLAUDE_RESET_RE: Final = re.compile(r"\bresets?\s+(?:at\s+)?(?P<clock>[^\n]+)", re.IGNORECASE)
+
+# ``4pm``, ``11:31 PM``, ``3:15 AM (UTC)``, ``4:30 PM (America/Chicago)``.
+_CLOCK_RE: Final = re.compile(
+    r"^(?P<hour>\d{1,2})(?::(?P<minute>\d{2}))?\s*(?P<half>[ap])\.?\s*m\.?"
+    r"(?:\s*\((?P<zone>[^)]+)\))?",
+    re.IGNORECASE,
+)
+
+
+def classify_harness_outcome(
+    cli_kind: str,
+    *,
+    exit_code: int,
+    stdout: str,
+    stderr: str,
+    error: str = "",
+    now: datetime,
+) -> HarnessHold | None:
+    """``usage_limit`` (with ``retry_not_before`` when the harness named a reset),
+    ``sign_in_required``, or None for every other outcome, a successful turn included.
+
+    ``now`` is when the turn ended, timezone-aware: a reset is printed as a wall-clock
+    time, so it is the next such time after ``now`` -- in the zone the harness named, or
+    the Runner host's own, where the harness that printed it ran.
+    """
+
+    if exit_code == 0:
+        return None
+    acp_hold = _acp_hold(error)
+    if acp_hold is not None:
+        return acp_hold
+    if cli_kind == _CLAUDE_CODE:
+        text = _joined(error, stderr, *_claude_error_fields(stdout))
+        usage_limit, sign_in, reset = _CLAUDE_USAGE_LIMIT_RE, _CLAUDE_SIGN_IN_RE, _CLAUDE_RESET_RE
+    elif cli_kind == _CODEX_CLI:
+        text = _joined(error, stderr, *_codex_error_events(stdout))
+        usage_limit, sign_in, reset = _CODEX_USAGE_LIMIT_RE, _CODEX_SIGN_IN_RE, _CODEX_RESET_RE
+    else:
+        return None
+    # A sign-in is checked first: a harness that cannot authenticate never reached the
+    # account whose limit it might also mention.
+    if sign_in.search(text):
+        return HarnessHold(kind=HarnessHoldKind.SIGN_IN_REQUIRED)
+    limit = usage_limit.search(text)
+    if limit is None:
+        return None
+    clock = reset.search(text, limit.end())
+    return HarnessHold(
+        kind=HarnessHoldKind.USAGE_LIMIT,
+        retry_not_before=_next_wall_clock(clock.group("clock"), now) if clock else None,
+    )
+
+
+def _acp_hold(error: str) -> HarnessHold | None:
+    match = _ACP_ERROR_RE.search(error)
+    if match is None:
+        return None
+    code = int(match.group(1))
+    if code == _ACP_AUTH_REQUIRED:
+        return HarnessHold(kind=HarnessHoldKind.SIGN_IN_REQUIRED)
+    if code == _ACP_INTERNAL_ERROR and _CODEX_USAGE_LIMIT_INFO_RE.search(error):
+        return HarnessHold(kind=HarnessHoldKind.USAGE_LIMIT)
+    return None
+
+
+def _codex_error_events(stdout: str) -> list[str]:
+    """The messages of ``codex exec --json``'s ``error`` and ``turn.failed`` events."""
+
+    messages: list[str] = []
+    for event in _json_lines(stdout):
+        if event.get("type") == "error":
+            messages.append(str(event.get("message") or ""))
+        elif event.get("type") == "turn.failed":
+            failure = event.get("error")
+            if isinstance(failure, dict):
+                messages.append(str(failure.get("message") or ""))
+    return messages
+
+
+def _claude_error_fields(stdout: str) -> list[str]:
+    """A failed ``result`` message's text, ``error`` and ``errors`` -- never an assistant
+    message, which is the model talking."""
+
+    result = extract_claude_result(stdout)
+    if result is None or not result.get("is_error"):
+        return []
+    fields = [str(result.get("result") or ""), str(result.get("error") or "")]
+    errors = result.get("errors")
+    if isinstance(errors, list):
+        for entry in errors:
+            if isinstance(entry, dict):
+                fields.append(str(entry.get("message") or entry.get("error") or ""))
+            else:
+                fields.append(str(entry))
+    return fields
+
+
+def _json_lines(stdout: str) -> list[dict[str, Any]]:
+    events: list[dict[str, Any]] = []
+    for line in stdout.splitlines():
+        try:
+            event = json.loads(line)
+        except ValueError:
+            continue
+        if isinstance(event, dict):
+            events.append(event)
+    return events
+
+
+def _joined(*parts: str) -> str:
+    return "\n".join(part.strip() for part in parts if part and part.strip())
+
+
+def _next_wall_clock(text: str, now: datetime) -> str | None:
+    match = _CLOCK_RE.match(text.strip())
+    if match is None:
+        return None
+    hour, minute = int(match.group("hour")), int(match.group("minute") or 0)
+    if not 1 <= hour <= 12 or not 0 <= minute <= 59:
+        return None
+    hour = hour % 12 + (12 if match.group("half").lower() == "p" else 0)
+    local_now = now.astimezone(_zone(match.group("zone")))
+    candidate = local_now.replace(hour=hour, minute=minute, second=0, microsecond=0)
+    if candidate <= local_now:
+        candidate += timedelta(days=1)
+    return candidate.astimezone(UTC).isoformat()
+
+
+def _zone(name: str | None) -> tzinfo | None:
+    """The zone the harness named, or None -- ``astimezone``'s "this host's own"."""
+
+    if not name:
+        return None
+    if name.strip().upper() in {"UTC", "GMT"}:
+        return UTC
+    try:
+        return ZoneInfo(name.strip())
+    except (ZoneInfoNotFoundError, ValueError):
+        return None

{agentic_runner-3.3.0 → agentic_runner-3.4.0}/src/agentic_runner/workstation.py

@@ -45,6 +45,7 @@ from pydantic import BaseModel, ConfigDict
 
 from agentic_runner import service
 from agentic_runner.build import build_id
+from agentic_runner.cli_floor import CLI_FLOORS, CLI_NAMES, meets_floor, parse_cli_version
 from agentic_runner.host_store import open_workstation_store
 from agentic_runner.lifecycle import LifecycleOutbox
 from agentic_runner.registration import load_state
@@ -86,15 +87,7 @@ __all__ = [
 
 ROOT_ENV: Final = "AGENTIC_RUNNER_WORKSTATION_ROOT"
 
-# What the Profile's `cli_kind` runs, by executable name on PATH.
-CLI_NAMES: Final[Mapping[str, str]] = {"codex_cli": "codex", "claude_code": "claude"}
-# The versions the Runner image is built and tested against (Dockerfile.runner's
-# CODEX_CLI_VERSION / CLAUDE_CODE_VERSION; a test holds the two together). Below the
-# floor is *reported*, not refused: the user's own CLI is the user's to upgrade.
-CLI_FLOORS: Final[Mapping[str, str]] = {"codex": "0.141.0", "claude": "2.1.280"}
-
 _ORG = re.compile(r"^[a-z0-9][a-z0-9-]{0,31}$")
-_VERSION = re.compile(r"(\d+\.\d+\.\d+[0-9A-Za-z.+-]{0,40})")
 _LABEL_PREFIX: Final = "agentic-runner"
 
 Run = Callable[..., subprocess.CompletedProcess[str]]
@@ -293,10 +286,6 @@ def require_any_cli(path: str) -> dict[str, str]:
     return found
 
 
-def _version_tuple(version: str) -> tuple[int, ...]:
-    return tuple(int(part) for part in re.findall(r"\d+", version)[:3])
-
-
 def cli_versions(found: Mapping[str, str], *, run: Run = subprocess.run) -> list[CliVersion]:
     """Each CLI's ``--version``, the only thing the Runner asks a CLI about itself.
 
@@ -315,16 +304,11 @@ def cli_versions(found: Mapping[str, str], *, run: Run = subprocess.run) -> list
             )
         except (OSError, subprocess.TimeoutExpired):
             continue
-        match = _VERSION.search(answer.stdout or answer.stderr)
-        if match is None:
+        version = parse_cli_version(answer.stdout or answer.stderr)
+        if version is None:
             continue
-        version = match.group(1)
         versions.append(
-            CliVersion(
-                cli_kind=cli_kind,
-                version=version,
-                meets_floor=_version_tuple(version) >= _version_tuple(CLI_FLOORS[name]),
-            )
+            CliVersion(cli_kind=cli_kind, version=version, meets_floor=meets_floor(name, version))
         )
     return versions