agentic-runner 3.3.0__tar.gz → 3.4.1__tar.gz

{agentic_runner-3.3.0 → agentic_runner-3.4.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: agentic-runner
-Version: 3.3.0
+Version: 3.4.1
 Summary: The Agentic OS Runner: an activity-only Temporal executor for workspaces, Agent Runtimes and verb seams
 License-Expression: AGPL-3.0-only
 License-File: LICENSE

{agentic_runner-3.3.0 → agentic_runner-3.4.1}/src/agentic_runner/__init__.py

@@ -7,6 +7,6 @@ stay on the platform; this package imports none of them, and a CI partition test
 (``tests/test_package_partition.py``) fails the build if that changes.
 """
 
-__version__ = "3.3.0"
+__version__ = "3.4.1"
 
 __all__ = ["__version__"]

{agentic_runner-3.3.0 → agentic_runner-3.4.1}/src/agentic_runner/activities.py

@@ -31,6 +31,7 @@ import tempfile
 import time
 from collections.abc import AsyncIterator, Awaitable, Callable, Mapping
 from dataclasses import asdict, dataclass, field, fields, replace
+from datetime import UTC, datetime
 from pathlib import Path
 from typing import Any, NoReturn, Protocol
 from uuid import UUID
@@ -75,6 +76,7 @@ from agentic_runner.credentials import (
     UnresolvableCredentialReferenceError,
 )
 from agentic_runner.egress import EGRESS_REFUSED_SOURCE, EgressProxy, Resolver, host_of
+from agentic_runner.harness_self_test import DirectivesInFlight
 from agentic_runner.heartbeat_link import HeartbeatLink, SeamUnavailableError
 from agentic_runner.hooks import (
     HOOK_EVIDENCE_SOURCE,
@@ -140,6 +142,7 @@ from agentic_runner.workers.fastapi_client import (
     WorkerFastApiClientError,
     directive_token,
 )
+from agentic_runner.workers.harness_outcome import classify_harness_outcome
 from agentic_runner.workers.harness_usage import extract_claude_result, extract_codex_turn_usage
 from agentic_runner.workers.mcp_config import McpServerEntry
 from agentic_runner.workers.skills import (
@@ -168,6 +171,7 @@ from agentic_runner_contracts.activity_io import (
     FixDirectiveOutput,
     GitHubCallError,
     GitHubCallFailure,
+    HarnessHold,
     LearningDirectiveInput,
     LearningDirectiveOutput,
     MemberDirectiveInput,
@@ -1442,6 +1446,7 @@ DIRECTIVE_TOKEN_EVIDENCE_SOURCE = "runner.directive_token"
 AGENT_RUNTIME_EVIDENCE_SOURCE = "runner.agent_runtime"
 SKILLS_EVIDENCE_SOURCE = "runner.skills"
 HARNESS_LOGIN_RESIDUE_SOURCE = "runner.harness_login_residue"
+HARNESS_HOLD_SOURCE = "runner.harness_hold"
 
 
 class _EvidenceWriter(Protocol):
@@ -1555,8 +1560,11 @@ class RunnerRalphActivities:
         egress_resolver: Resolver | None = None,
         tool_server_health: ToolServerHealthLog | None = None,
         attempt_records: AttemptRecords | None = None,
+        directives_in_flight: DirectivesInFlight | None = None,
     ) -> None:
         self._fastapi_client = fastapi_client
+        # Read by the harness self-test, which never runs beside a Contract's Directive.
+        self._directives_in_flight = directives_in_flight or DirectivesInFlight()
         # Wall-clock source for per-Directive runtime, accrued against the Budget's
         # wall-clock dimension (ADR-0007). Activities run outside the Temporal sandbox,
         # so a real monotonic clock is allowed here (it must never be used in the
@@ -2018,6 +2026,31 @@ class RunnerRalphActivities:
                 auth_mode=attempt.auth_mode,
             )
             plan = _take_plan(checkout_workspace)
+            harness_hold = await self._harness_hold(
+                runtime_state=runtime_state,
+                work_record_id=request.work_record_id,
+                directive_number=request.directive_number,
+                result=codex_result,
+                auth_mode=attempt.auth_mode,
+            )
+            if harness_hold is not None:
+                return BranchPullRequestOutput(
+                    repository=request.repository,
+                    branch_name=request.branch_name,
+                    base_ref=request.base_ref,
+                    pr_number=0,
+                    pr_url="",
+                    branch_created=branch.created,
+                    pr_created=False,
+                    duration_seconds=self._monotonic() - directive_started,
+                    usage=await self._directive_usage(
+                        work_record_id=request.work_record_id,
+                        directive_number=request.directive_number,
+                    ),
+                    workspace_path=str(workspace_path),
+                    grant_snapshot=dict(request.grant_snapshot),
+                    harness_hold=harness_hold,
+                )
             if codex_result.exit_code != 0:
                 if _is_guard_mode_refusal(codex_result):
                     # The runtime refused this Directive (guard-mode). Return a flagged
@@ -2475,6 +2508,7 @@ class RunnerRalphActivities:
         scratch_root = sandbox.tmp_dir if sandbox is not None else Path(tempfile.gettempdir())
         attempt_dir = prepare_attempt_dir(scratch_root / f"attempt-{key}", uid)
         async with contextlib.AsyncExitStack() as stack:
+            stack.enter_context(self._directives_in_flight.running(facts.contract_id))
             stack.callback(shutil.rmtree, attempt_dir, ignore_errors=True)
             callback_env: dict[str, str] = {}
             if self._socket_dir is not None:
@@ -4484,7 +4518,13 @@ class RunnerRalphActivities:
                 guard_mode_refused=True,
                 workspace_path=request.workspace_path,
             )
-        if consumed and self._message_store is not None and not ran.guard_mode_refused:
+        if (
+            consumed
+            and self._message_store is not None
+            and not ran.guard_mode_refused
+            # A held turn never read its Messages; the wake after the hold must see them.
+            and ran.harness_hold is None
+        ):
             self._message_store.mark_consumed(
                 contract_id=contract[0],
                 work_record_id=request.work_record_id,
@@ -4616,6 +4656,13 @@ class RunnerRalphActivities:
                 result=result,
                 auth_mode=attempt.auth_mode,
             )
+            harness_hold = await self._harness_hold(
+                runtime_state=state,
+                work_record_id=request.work_record_id,
+                directive_number=request.directive_number,
+                result=result,
+                auth_mode=attempt.auth_mode,
+            )
             usage = await self._directive_usage(
                 work_record_id=request.work_record_id,
                 directive_number=request.directive_number,
@@ -4652,6 +4699,7 @@ class RunnerRalphActivities:
                 usage=usage,
                 outcome=LEARNING_FAILED,
                 summary=f"the Learner's runtime exited {result.exit_code}",
+                harness_hold=harness_hold,
             )
         return self._learning_output(
             request,
@@ -4668,6 +4716,7 @@ class RunnerRalphActivities:
         usage: DirectiveUsage | None = None,
         outcome: str = LEARNING_PROPOSED,
         summary: str = "",
+        harness_hold: HarnessHold | None = None,
     ) -> LearningDirectiveOutput:
         return LearningDirectiveOutput(
             work_record_id=request.work_record_id,
@@ -4676,6 +4725,7 @@ class RunnerRalphActivities:
             usage=usage or DirectiveUsage(),
             outcome=outcome,
             summary=summary,
+            harness_hold=harness_hold,
         )
 
     def _learner_transcript(self, state: _RuntimeContextState, work_record_id: str) -> str:
@@ -4875,6 +4925,30 @@ class RunnerRalphActivities:
             )
             # Taken before the commit below so it never lands on the branch (PRD 59).
             plan = _take_plan(state.workspace_path)
+            harness_hold = await self._harness_hold(
+                runtime_state=state,
+                work_record_id=request.work_record_id,
+                directive_number=request.directive_number,
+                result=codex_result,
+                auth_mode=attempt.auth_mode,
+            )
+            if harness_hold is not None:
+                return FixDirectiveOutput(
+                    work_record_id=request.work_record_id,
+                    repository=request.repository,
+                    pr_number=request.pr_number,
+                    directive_number=request.directive_number,
+                    branch_head_sha="",
+                    summary=f"held: the harness reported {harness_hold.kind.value}",
+                    duration_seconds=self._monotonic() - directive_started,
+                    usage=await self._directive_usage(
+                        work_record_id=request.work_record_id,
+                        directive_number=request.directive_number,
+                    ),
+                    workspace_path=str(state.workspace_path),
+                    grant_snapshot=state.grant_snapshot_payload,
+                    harness_hold=harness_hold,
+                )
             if codex_result.exit_code != 0:
                 if _is_guard_mode_refusal(codex_result):
                     return FixDirectiveOutput(
@@ -5114,6 +5188,46 @@ class RunnerRalphActivities:
                 }
             )
 
+    async def _harness_hold(
+        self,
+        *,
+        runtime_state: _RuntimeContextState,
+        work_record_id: str,
+        directive_number: int,
+        result: DirectiveResult,
+        auth_mode: AuthMode,
+    ) -> HarnessHold | None:
+        """A subscription harness that stopped on its usage limit or sign-in, recorded
+        once (local-agents 08). An ``api_key`` Directive's limits are the proxy's, so it is
+        never classified. The Evidence names the kind and the reset, never the output."""
+
+        if auth_mode != AuthMode.SUBSCRIPTION:
+            return None
+        hold = classify_harness_outcome(
+            runtime_state.cli_kind,
+            exit_code=result.exit_code,
+            stdout=result.stdout,
+            stderr=result.stderr,
+            error=result.error,
+            now=datetime.now(UTC),
+        )
+        if hold is None:
+            return None
+        await self._fastapi_client.append_evidence(
+            work_record_id,
+            source=HARNESS_HOLD_SOURCE,
+            payload={
+                "event": "directive.harness_hold",
+                "kind": hold.kind.value,
+                "cli_kind": runtime_state.cli_kind,
+                "retry_not_before": hold.retry_not_before,
+                "directive_number": directive_number,
+                "agent_id": runtime_state.agent_id,
+                "contract_id": runtime_state.contract_id,
+            },
+        )
+        return hold
+
     @activity.defn(name="wipe_contract_residue")
     async def wipe_contract_residue(self, request: ContractResidueInput) -> ContractResidueOutput:
         """Delete everything one Contract left on this Runner and retire its uid (17 A6).

agentic_runner-3.4.1/src/agentic_runner/cli_floor.py

@@ -0,0 +1,33 @@
+"""Which executable each Agent Runtime CLI is, and the version floor it must clear."""
+
+from __future__ import annotations
+
+import re
+from collections.abc import Mapping
+from typing import Final
+
+__all__ = ["CLI_FLOORS", "CLI_NAMES", "meets_floor", "parse_cli_version"]
+
+# What the Profile's `cli_kind` runs, by executable name on PATH.
+CLI_NAMES: Final[Mapping[str, str]] = {"codex_cli": "codex", "claude_code": "claude"}
+# The versions the Runner image is built and tested against (Dockerfile.runner's
+# CODEX_CLI_VERSION / CLAUDE_CODE_VERSION; a test holds the two together). Below the
+# floor is *reported*, not refused: the user's own CLI is the user's to upgrade.
+CLI_FLOORS: Final[Mapping[str, str]] = {"codex": "0.141.0", "claude": "2.1.280"}
+
+_VERSION = re.compile(r"(\d+\.\d+\.\d+[0-9A-Za-z.+-]{0,40})")
+
+
+def parse_cli_version(output: str) -> str | None:
+    match = _VERSION.search(output)
+    return None if match is None else match.group(1)
+
+
+def meets_floor(name: str, version: str) -> bool:
+    """Whether ``version`` of the executable ``name`` clears the Runner's floor for it."""
+
+    return _version_tuple(version) >= _version_tuple(CLI_FLOORS[name])
+
+
+def _version_tuple(version: str) -> tuple[int, ...]:
+    return tuple(int(part) for part in re.findall(r"\d+", version)[:3])

agentic_runner-3.4.1/src/agentic_runner/harness_self_test.py

@@ -0,0 +1,162 @@
+"""A harness's ``--version``, run as each Contract would run it (local-agents 17).
+
+What the heartbeat's ``cli`` attestation says is that the Runner's own uid can start a
+CLI. Whether a Contract can is a different fact: its uid, its harness root and its
+sandbox floor all stand between the two. So the self-test spawns exactly what a
+Directive spawns, minus the prompt, and keeps only the verdict -- never the output, which
+on a harness root can carry an account name.
+
+At most once per interval per Contract and never while that Contract has a Directive
+running: the harness root is the Directive's while it runs, and a concurrent spawn
+under the same rlimit floor would count against the Directive's process ceiling.
+"""
+
+from __future__ import annotations
+
+import os
+import subprocess
+from collections import Counter
+from collections.abc import Awaitable, Callable, Collection, Iterator, Sequence
+from contextlib import contextmanager
+from datetime import UTC, datetime
+from typing import Final
+from uuid import UUID
+
+from agentic_runner.cli_floor import CLI_NAMES, meets_floor, parse_cli_version
+from agentic_runner.workers._runtime_support import SubprocessResult, run_subprocess_exec
+from agentic_runner.workers.contract_isolation import ContractIsolationError, DirectiveSandbox
+from agentic_runner_contracts.runner_registration import HarnessSelfTest, SelfTestFailure
+
+__all__ = [
+    "SELF_TEST_INTERVAL_SECONDS",
+    "DirectivesInFlight",
+    "HarnessSelfTests",
+]
+
+SELF_TEST_INTERVAL_SECONDS: Final = 15 * 60
+_TIMEOUT_SECONDS: Final = 10
+_OUTPUT_LIMIT_BYTES: Final = 4096
+
+# Where each harness reads its config root from; the same variable its runtime sets.
+_HARNESS_ROOT_ENV: Final = {"codex_cli": "CODEX_HOME", "claude_code": "CLAUDE_CONFIG_DIR"}
+
+SandboxFor = Callable[[str, str], DirectiveSandbox | None]
+
+
+class DirectivesInFlight:
+    """Which Contracts have a Directive running in this process right now."""
+
+    def __init__(self) -> None:
+        self._running: Counter[str] = Counter()
+
+    @contextmanager
+    def running(self, contract_id: str | None) -> Iterator[None]:
+        key = contract_id or ""
+        self._running[key] += 1
+        try:
+            yield
+        finally:
+            self._running[key] -= 1
+            if self._running[key] <= 0:
+                del self._running[key]
+
+    def busy(self, contract_id: str) -> bool:
+        return self._running[contract_id] > 0
+
+
+class HarnessSelfTests:
+    """The latest self-test per ``(contract_id, cli_kind)``, and when the next one is due."""
+
+    def __init__(
+        self,
+        *,
+        sandbox_for: SandboxFor,
+        in_flight: DirectivesInFlight,
+        served: Collection[str],
+        run: Callable[..., Awaitable[SubprocessResult]] = run_subprocess_exec,
+        monotonic: Callable[[], float],
+        clock: Callable[[], datetime] = lambda: datetime.now(UTC),
+        interval_seconds: float = SELF_TEST_INTERVAL_SECONDS,
+    ) -> None:
+        self._sandbox_for = sandbox_for
+        self._in_flight = in_flight
+        self._served = frozenset(served)
+        self._run = run
+        self._monotonic = monotonic
+        self._clock = clock
+        self._interval = interval_seconds
+        self._results: dict[tuple[str, str], HarnessSelfTest] = {}
+        self._last_run: dict[tuple[str, str], float] = {}
+
+    def result(self, contract_id: UUID | str, cli_kind: str) -> HarnessSelfTest | None:
+        return self._results.get((str(contract_id), cli_kind))
+
+    async def run_due(self, targets: Sequence[tuple[str, str]]) -> None:
+        for gone in (self._results.keys() | self._last_run.keys()) - set(targets):
+            self._forget(gone)
+        for contract_id, cli_kind in targets:
+            key = (contract_id, cli_kind)
+            last = self._last_run.get(key)
+            if last is not None and self._monotonic() - last < self._interval:
+                continue
+            # Checked before the spawn only: a Directive that starts during the (at most
+            # _TIMEOUT_SECONDS) spawn overlaps it. Accepted -- `--version` neither reads
+            # nor writes the harness root's state and holds one process slot briefly.
+            if self._in_flight.busy(contract_id):
+                # Not stamped: it runs on the first sweep after the Directive ends.
+                continue
+            result = await self._self_test(contract_id, cli_kind)
+            if result is None:
+                self._forget(key)
+                continue
+            self._results[key] = result
+            self._last_run[key] = self._monotonic()
+
+    def _forget(self, key: tuple[str, str]) -> None:
+        self._results.pop(key, None)
+        self._last_run.pop(key, None)
+
+    async def _self_test(self, contract_id: str, cli_kind: str) -> HarnessSelfTest | None:
+        """``None`` when the harness root is gone, wiped since the sweep listed it."""
+
+        name = CLI_NAMES.get(cli_kind)
+        if name is None or cli_kind not in self._served:
+            return self._failed(SelfTestFailure.NOT_FOUND)
+        try:
+            sandbox = self._sandbox_for(contract_id, cli_kind)
+        except (ContractIsolationError, OSError):
+            return self._failed(SelfTestFailure.SPAWN_FAILED)
+        if sandbox is None:
+            return None
+        env = {
+            "PATH": os.environ.get("PATH") or os.defpath,
+            "HOME": str(sandbox.home_dir),
+            "TMPDIR": str(sandbox.tmp_dir),
+            _HARNESS_ROOT_ENV[cli_kind]: str(sandbox.harness_config_dir),
+        }
+        try:
+            answer = await self._run(
+                argv=[name, "--version"],
+                cwd=sandbox.home_dir,
+                env=env,
+                stdin=None,
+                timeout_seconds=_TIMEOUT_SECONDS,
+                output_limit_bytes=_OUTPUT_LIMIT_BYTES,
+                sandbox=sandbox,
+            )
+        except TimeoutError:
+            return self._failed(SelfTestFailure.TIMEOUT)
+        except FileNotFoundError:
+            return self._failed(SelfTestFailure.NOT_FOUND)
+        except (OSError, subprocess.SubprocessError):
+            # SubprocessError: the sandbox floor's own preexec hook refused the spawn.
+            return self._failed(SelfTestFailure.SPAWN_FAILED)
+        version = parse_cli_version(answer.stdout or answer.stderr)
+        if answer.exit_code != 0 or version is None:
+            return self._failed(SelfTestFailure.SPAWN_FAILED)
+        if not meets_floor(name, version):
+            return self._failed(SelfTestFailure.BELOW_FLOOR)
+        return HarnessSelfTest(ok=True, at=self._clock())
+
+    def _failed(self, reason: SelfTestFailure) -> HarnessSelfTest:
+        return HarnessSelfTest(ok=False, at=self._clock(), reason=reason)

{agentic_runner-3.3.0 → agentic_runner-3.4.1}/src/agentic_runner/service.py

@@ -56,6 +56,7 @@ from agentic_runner.credentials import (
     HostCredentialStore,
 )
 from agentic_runner.device_login_activities import ContractDeviceLoginActivities
+from agentic_runner.harness_self_test import DirectivesInFlight, HarnessSelfTests
 from agentic_runner.heartbeat_link import WAKE_DIVERGENCE, HeartbeatLink
 from agentic_runner.hooks import AttemptFacts, HookName, HookRunner
 from agentic_runner.integrations.git.workspace import LocalGitWorkspace
@@ -168,6 +169,8 @@ TEMPORAL_TLS_ENV = "AGENTIC_TEMPORAL_TLS"
 # glances at their inbox; anything tighter spends IMAP logins, not attention.
 SOURCE_POLL_SECONDS_ENV = "AGENTIC_RUNNER_SOURCE_POLL_SECONDS"
 DEFAULT_SOURCE_POLL_SECONDS = 60.0
+# How often due harness self-tests are looked for; each is due every 15 minutes at most.
+SELF_TEST_SWEEP_SECONDS = 60.0
 # The Recipient Key is normally *generated here*, once per installation, and kept in the
 # state directory (PRD issue 48, 22 A4). These two exist for an installer that mints it
 # outside this process and are read only when both are set; the Helm chart takes the
@@ -558,6 +561,11 @@ class ControlPlaneStream:
     messages: MessageStore | None = None
     # Console-v2 issue 29: the latest start of each Runner-hosted Tool Server.
     tool_servers: ToolServerHealthLog | None = None
+    # Local-agents 17: each runtime's descriptor, the harness roots on disk and the last
+    # self-test under each.
+    runtimes: Mapping[str, AgentRuntime] = field(default_factory=dict)
+    contracts: ContractIsolation | None = None
+    self_tests: HarnessSelfTests | None = None
     # Local-agents 04b: which delivered references fill the LLM proxy's slot, and where.
     llm_slots: Mapping[str, LlmProvider] = field(default_factory=lambda: dict(LLM_SLOT_REFERENCES))
     _delivered: set[tuple[str, str]] = field(default_factory=set)
@@ -589,21 +597,44 @@ class ControlPlaneStream:
     def _harnesses(self) -> list[HarnessVersion]:
         """Per Contract: the CLI's version and whether it runs on a delivered key (22 A8)
         or on the login its funder created in the harness root -- read off the slot, never
-        off the root, which the Runner does not open."""
+        off the root, which the Runner does not open. A Contract with a harness root and no
+        slot is listed too, so a login-only Contract gets its descriptor (local-agents 17).
+        """
 
         if self.attestation is None:
             return []
         versions = {cli.cli_kind: cli.version for cli in self.attestation.clis}
+        slots = {
+            (str(slot.contract_id), slot.runtime_kind): slot.present
+            for slot in self.proxy.slots.statuses()
+        }
+        roots = self.contracts.harness_roots() if self.contracts is not None else []
         return [
-            HarnessVersion(
-                contract_id=slot.contract_id,
-                cli_kind=slot.runtime_kind,
-                version=versions.get(slot.runtime_kind, "unknown"),
-                auth_mode="api_key" if slot.present else "login",
+            self._harness(
+                contract_id, cli_kind, versions, delivered=slots.get((contract_id, cli_kind), False)
             )
-            for slot in self.proxy.slots.statuses()
+            for contract_id, cli_kind in sorted(set(slots) | set(roots))
         ]
 
+    def _harness(
+        self, contract_id: str, cli_kind: str, versions: Mapping[str, str], *, delivered: bool
+    ) -> HarnessVersion:
+        runtime = self.runtimes.get(cli_kind)
+        capabilities = runtime.capabilities() if runtime is not None else None
+        return HarnessVersion(
+            contract_id=UUID(contract_id),
+            cli_kind=cli_kind,
+            version=versions.get(cli_kind, "unknown"),
+            auth_mode="api_key" if delivered else "login",
+            auth_modes=(sorted(capabilities.auth_modes) if capabilities is not None else None),
+            permission_mode=capabilities.permission_mode if capabilities is not None else None,
+            self_test=(
+                self.self_tests.result(contract_id, cli_kind)
+                if self.self_tests is not None
+                else None
+            ),
+        )
+
     async def directive_token(self, directive_id: str) -> str:
         """One activity execution's control-plane token, by Directive id (PRD issue 63)."""
 
@@ -929,6 +960,17 @@ async def _serve_registered(
     load = _LoadInterceptor()
     proxy = LlmProxy(slots=SlotStore(), ceilings=CeilingStore(), outbox=UsageOutbox())
     credentials = build_credential_resolver(config, host_store=host_store)
+    isolation = build_contract_isolation(settings, can_separate_uids=can_change_uid)
+    runtimes = build_agent_runtimes(settings, attestation.clis if attestation is not None else [])
+    in_flight = DirectivesInFlight()
+    self_tests = HarnessSelfTests(
+        sandbox_for=lambda contract_id, cli_kind: isolation.existing_sandbox(
+            contract_id, runtime_kind=cli_kind
+        ),
+        in_flight=in_flight,
+        served=runtimes,
+        monotonic=time.monotonic,
+    )
     stream = ControlPlaneStream(
         client=RunnerRegistrationClient(base_url=control_plane, client=http_client),
         state=state,
@@ -953,6 +995,9 @@ async def _serve_registered(
         attestation=attestation,
         lifecycle=lifecycle,
         heartbeat_stamp=state_dir / HEARTBEAT_STAMP_NAME,
+        runtimes=runtimes,
+        contracts=isolation,
+        self_tests=self_tests,
     )
     stream.sources = UserSourcePoller(
         stream=SignedIntakeStream(stream.client, state),
@@ -1001,12 +1046,13 @@ async def _serve_registered(
                 settings=settings,
                 config=config,
                 state=state,
-                can_change_uid=can_change_uid,
+                isolation=isolation,
+                agent_runtimes=runtimes,
+                directives_in_flight=in_flight,
                 hooks=hooks,
                 proxy=proxy,
                 credentials=credentials,
                 link=link,
-                attestation=attestation,
                 token_source=stream,
                 messages=messages,
                 tool_servers=tool_servers,
@@ -1024,13 +1070,16 @@ async def _serve_registered(
             _heartbeat_forever(link, stream, client, interval, stop=stop, revoked=revoked)
         )
         poll = asyncio.create_task(_poll_sources_forever(stream.sources, _source_poll_seconds()))
+        self_test = asyncio.create_task(
+            _self_test_forever(self_tests, isolation, SELF_TEST_SWEEP_SECONDS)
+        )
         readiness.ready = True
         await run_runner_lifecycle_hook(hooks, HookName.RUNNER_STARTUP)
         try:
             await run_worker_until_terminated(worker, stop=stop)
         finally:
             readiness.ready = False
-            for task in (beat, poll):
+            for task in (beat, poll, self_test):
                 task.cancel()
                 with contextlib.suppress(asyncio.CancelledError):
                     await task
@@ -1112,18 +1161,36 @@ async def _poll_sources_forever(poller: UserSourcePoller, interval: float) -> No
         await poller.poll()
 
 
+async def _self_test_forever(
+    self_tests: HarnessSelfTests, isolation: ContractIsolation, interval: float
+) -> None:
+    """Each harness root's self-test at start, then whenever it falls due (local-agents 17).
+
+    Only roots already on disk: a Contract's uid is allocated by its first Directive,
+    which records the allocation, and a self-test must not be the call that does it.
+    """
+
+    while True:
+        try:
+            await self_tests.run_due(isolation.harness_roots())
+        except Exception as error:  # noqa: BLE001 - a lost sweep is retried on the next one
+            _logger.warning("harness self-test sweep failed: %s", error)
+        await asyncio.sleep(interval)
+
+
 def _activities(
     fastapi: RunnerFastApiClient,
     *,
     settings: WorkerSettings,
     config: RunnerConfig,
     state: RunnerState,
-    can_change_uid: bool,
+    isolation: ContractIsolation,
+    agent_runtimes: Mapping[str, AgentRuntime],
+    directives_in_flight: DirectivesInFlight,
     hooks: HookRunner,
     proxy: LlmProxy,
     credentials: CredentialResolver,
     link: HeartbeatLink,
-    attestation: HostAttestation | None,
     token_source: DirectiveTokenSource | None = None,
     messages: MessageStore | None = None,
     signaller: TemporalWorkflowSignaller | None = None,
@@ -1136,7 +1203,6 @@ def _activities(
         api_base_url=os.getenv("GITHUB_API_BASE_URL", "https://api.github.com"),
     )
     static_git_token = os.getenv("AGENTIC_OS_GIT_TOKEN") or None
-    isolation = build_contract_isolation(settings, can_separate_uids=can_change_uid)
     attempt_records = AttemptRecords(config.state_dir, workspace_root=settings.WORKSPACE_ROOT)
     # Only the dead go: a live record is a harness this process lost on restart, still
     # writing its Workspace, and the next attempt must keep being refused (RR-05).
@@ -1144,9 +1210,7 @@ def _activities(
     ralph = RunnerRalphActivities(
         fastapi,
         runtime_context_resolver=WorkerRuntimeContextResolver(fastapi),
-        agent_runtimes=build_agent_runtimes(
-            settings, attestation.clis if attestation is not None else []
-        ),
+        agent_runtimes=agent_runtimes,
         git_workspace=LocalGitWorkspace(
             git_token=static_git_token,
             git_token_provider=(
@@ -1177,6 +1241,7 @@ def _activities(
         workflow_signaller=signaller,
         tool_server_health=tool_servers,
         attempt_records=attempt_records,
+        directives_in_flight=directives_in_flight,
     )
     return [
         *ralph.activity_callables(),

{agentic_runner-3.3.0 → agentic_runner-3.4.1}/src/agentic_runner/workers/agent_runtime.py

@@ -101,6 +101,24 @@ class DirectiveResult:
     evidence: DirectiveEvidence
 
 
+# The permission mode of a runtime whose guard configuration is incomplete: it refuses
+# every Directive, so there is no mode it passes.
+REFUSED_PERMISSION_MODE = "refused"
+
+
+@dataclass(frozen=True, slots=True)
+class RuntimeCapabilities:
+    """What a runtime declares about itself on the heartbeat (local-agents 17).
+
+    ``permission_mode`` is the fixed permission and approval mode the runtime passes its
+    harness, as a short patterned string. It is reported, never the gate: the Runner's
+    own floor is (ADR-0011 §12).
+    """
+
+    auth_modes: frozenset[AuthMode]
+    permission_mode: str
+
+
 @runtime_checkable
 class AgentRuntime(Protocol):
     """The pluggable engine an Agent uses to execute one Directive per step."""
@@ -111,6 +129,8 @@ class AgentRuntime(Protocol):
     # counts as "an API key is present" when the Runner chooses the mode.
     host_api_key: bool
 
+    def capabilities(self) -> RuntimeCapabilities: ...
+
     async def execute_directive(self, request: DirectiveRequest) -> DirectiveResult: ...