agentic-runner 3.30.2__tar.gz → 3.30.4__tar.gz

{agentic_runner-3.30.2 → agentic_runner-3.30.4}/PKG-INFO

@@ -1,11 +1,11 @@
 Metadata-Version: 2.5
 Name: agentic-runner
-Version: 3.30.2
+Version: 3.30.4
 Summary: The Agentic OS Runner: an activity-only Temporal executor for workspaces, Agent Runtimes and verb seams
 License-Expression: AGPL-3.0-only
 License-File: LICENSE
 Requires-Python: >=3.12
-Requires-Dist: agentic-runner-contracts==3.30.2
+Requires-Dist: agentic-runner-contracts==3.30.4
 Requires-Dist: cryptography<51,>=50
 Requires-Dist: httpx<1.0,>=0.27
 Requires-Dist: pydantic-settings<3.0,>=2.0

{agentic_runner-3.30.2 → agentic_runner-3.30.4}/pyproject.toml

@@ -10,7 +10,7 @@ dependencies = [
   # Exactly this release's contracts: the two ship as one version, and an unpinned
   # requirement let `uv tool upgrade` keep an older contracts wheel the Runner cannot
   # import from (QTS-1473). `scripts/set-version.py` moves it with the version.
-  "agentic-runner-contracts==3.30.2",
+  "agentic-runner-contracts==3.30.4",
   # Imported directly by `registration.py` (the Ed25519 identity that signs every
   # heartbeat); already present transitively through pyjwt[crypto], declared because
   # we import it.

{agentic_runner-3.30.2 → agentic_runner-3.30.4}/src/agentic_runner/__init__.py

@@ -7,6 +7,6 @@ stay on the platform; this package imports none of them, and a CI partition test
 (``tests/test_package_partition.py``) fails the build if that changes.
 """
 
-__version__ = "3.30.2"
+__version__ = "3.30.4"
 
 __all__ = ["__version__"]

{agentic_runner-3.30.2 → agentic_runner-3.30.4}/src/agentic_runner/service.py

@@ -250,6 +250,10 @@ _VERIFIER_ACTIVITY_BUDGET_SECONDS = 20 * 60
 # returns before Kubernetes SIGKILLs the pod at terminationGracePeriodSeconds (the
 # chart's value and this must move together).
 _SHUTDOWN_HEADROOM_SECONDS = 60
+# What `run` exits with once the control plane revokes this Runner: non-zero, as the
+# conformance suite asks, and its own value so a workstation login agent can tell it from a
+# crash its service manager should restart (QTS-2207).
+REVOKED_EXIT_CODE = 3
 
 # What `agentic-runner status <name>` reads (PRD issue 47): the live pid, and a file the
 # process touches on every acknowledged heartbeat, whose mtime is the heartbeat age.
@@ -1692,7 +1696,7 @@ async def _serve_registered(
             raise
         except Exception as error:  # noqa: BLE001 - keep trying until the control plane answers
             if _revoked(error):
-                return 1
+                return REVOKED_EXIT_CODE
             _logger.warning("heartbeat failed before start: %s", error)
             await _before_stop(asyncio.sleep(interval), stop)
 
@@ -1767,7 +1771,7 @@ async def _serve_registered(
                     await task
             await run_runner_lifecycle_hook(hooks, HookName.RUNNER_SHUTDOWN)
             await _report_stop(link, lifecycle)
-    return 1 if revoked.is_set() else 0
+    return REVOKED_EXIT_CODE if revoked.is_set() else 0
 
 
 def _revoked(error: Exception) -> bool:

{agentic_runner-3.30.2 → agentic_runner-3.30.4}/src/agentic_runner/workstation.py

@@ -39,7 +39,7 @@ import sys
 import tempfile
 import time
 from collections.abc import Callable, Mapping, Sequence
-from dataclasses import dataclass
+from dataclasses import dataclass, field
 from datetime import UTC, datetime
 from pathlib import Path
 from typing import Any, Final, Literal
@@ -114,7 +114,8 @@ ROOT_ENV: Final = "AGENTIC_RUNNER_WORKSTATION_ROOT"
 _LABEL_PREFIX: Final = "agentic-runner"
 # The drain waits out an in-flight Directive (issue 02), as the chart's
 # terminationGracePeriodSeconds does. Without it the service manager SIGKILLs the drain:
-# systemd after 90 s, launchd after 20 s (QTS-2166).
+# systemd after 90 s, launchd after 20 s (QTS-2166), and launchd caps it at 60 s however
+# high ExitTimeOut is set (QTS-2178), so on macOS `stop` and `restart` drain first.
 DRAIN_TIMEOUT_SECONDS: Final = 2100
 
 Run = Callable[..., subprocess.CompletedProcess[str]]
@@ -463,6 +464,9 @@ class ServiceDefinition:
     start: list[list[str]]
     stop: list[list[str]]
     restart: list[list[str]]
+    # Sends SIGTERM outside the service manager's own stop, which `stop` and `restart` then
+    # run only once the process has drained. Empty where that stop already waits it out.
+    drain: list[list[str]] = field(default_factory=list)
 
 
 def runner_command(name: str, root: Path) -> list[str]:
@@ -527,6 +531,10 @@ def _launch_agent(
         # One call, not bootout then bootstrap: launchd refuses a bootstrap of a label it
         # still holds, and it holds it until the old process has drained.
         restart=[["launchctl", "kickstart", "-k", f"{domain}/{name}"]],
+        # launchd SIGKILLs a stop of its own after at most 60 s, whatever ExitTimeOut says,
+        # but leaves alone a process that exits on a signal it only forwarded (CI, QTS-2178).
+        # A clean exit is not restarted: KeepAlive above.
+        drain=[["launchctl", "kill", "SIGTERM", f"{domain}/{name}"]],
     )
 
 
@@ -879,7 +887,9 @@ def restart(
     """
 
     previous = process_id(paths)
-    _drive_service(paths, "restart", **driver)
+    _drive_service(paths, "restart", sleep=sleep, clock=clock, **driver)
+    # Taken after the call: the drain and then `kickstart -k`, or `systemctl restart`, return
+    # only once the old process has exited, so the drain spends none of it (QTS-2172).
     deadline = clock() + timeout
     while (pid := process_id(paths)) is None or pid == previous:
         if clock() >= deadline:
@@ -897,9 +907,17 @@ def _drive_service(
     platform: str = sys.platform,
     home: Path | None = None,
     run: Run = subprocess.run,
+    sleep: Callable[[float], None] = time.sleep,
+    clock: Callable[[], float] = time.monotonic,
 ) -> None:
     settings = WorkstationSettings.load(paths)
     definition = service_definition(paths, settings, platform=platform, home=home)
+    if verb != "start" and definition.drain and process_id(paths) is not None:
+        drive(definition.drain, run=run)
+        # Past the budget the service manager's stop below ends it, as systemd's would.
+        deadline = clock() + DRAIN_TIMEOUT_SECONDS
+        while process_id(paths) is not None and clock() < deadline:
+            sleep(1.0)
     drive(getattr(definition, verb), run=run)
 
 
@@ -925,4 +943,8 @@ def run_process(paths: RunnerPaths, *, login_agent: bool) -> int:
     # A workstation's hostname can name its person, so it is never reported (rev 3); the
     # name it was installed as is the person's choice, and the console lists it (QTS-1773).
     install = RunnerInstall(target=InstallTarget.WORKSTATION, name=paths.name)
-    return asyncio.run(service.run(host_store=store, attestation=attestation, install=install))
+    code = asyncio.run(service.run(host_store=store, attestation=attestation, install=install))
+    # launchd, systemd and the logon task all restart a non-zero exit, and a revocation is
+    # final: restarted, the Runner dialled a control plane that refused it every ~10 s until
+    # someone stopped it by hand (QTS-2207). A clean exit keeps it down until the next login.
+    return 0 if code == service.REVOKED_EXIT_CODE else code