agentic-runner 4.0.0__tar.gz → 4.1.0__tar.gz

{agentic_runner-4.0.0 → agentic_runner-4.1.0}/PKG-INFO

@@ -1,11 +1,11 @@
 Metadata-Version: 2.5
 Name: agentic-runner
-Version: 4.0.0
+Version: 4.1.0
 Summary: The Agentic OS Runner: an activity-only Temporal executor for workspaces, Agent Runtimes and verb seams
 License-Expression: AGPL-3.0-only
 License-File: LICENSE
 Requires-Python: >=3.12
-Requires-Dist: agentic-runner-contracts==4.0.0
+Requires-Dist: agentic-runner-contracts==4.1.0
 Requires-Dist: cryptography<51,>=50
 Requires-Dist: google-re2<2.0,>=1.1
 Requires-Dist: httpx<1.0,>=0.27

{agentic_runner-4.0.0 → agentic_runner-4.1.0}/pyproject.toml

@@ -10,7 +10,7 @@ dependencies = [
   # Exactly this release's contracts: the two ship as one version, and an unpinned
   # requirement let `uv tool upgrade` keep an older contracts wheel the Runner cannot
   # import from (QTS-1473). `scripts/set-version.py` moves it with the version.
-  "agentic-runner-contracts==4.0.0",
+  "agentic-runner-contracts==4.1.0",
   # Imported directly by `registration.py` (the Ed25519 identity that signs every
   # heartbeat); already present transitively through pyjwt[crypto], declared because
   # we import it.

{agentic_runner-4.0.0 → agentic_runner-4.1.0}/src/agentic_runner/__init__.py

@@ -7,6 +7,6 @@ stay on the platform; this package imports none of them, and a CI partition test
 (``tests/test_package_partition.py``) fails the build if that changes.
 """
 
-__version__ = "4.0.0"
+__version__ = "4.1.0"
 
 __all__ = ["__version__"]

{agentic_runner-4.0.0 → agentic_runner-4.1.0}/src/agentic_runner/activities.py

@@ -310,6 +310,7 @@ from agentic_runner_contracts.runtime_context import (
     WorkerRuntimeContext,
     WorkerRuntimeContextResolver,
 )
+from agentic_runner_contracts.secret import SecretRelease, SecretReleaseRequest
 from agentic_runner_contracts.swarm import ROLE_LEAD
 
 _GIT_EVIDENCE_LIMIT_BYTES = 32_768
@@ -566,6 +567,11 @@ class RunnerRalphFastApiClient(Protocol):
     ) -> dict[str, Any]:
         """The sealed shares of the pool's LLM Key a Directive was routed to (rev 3)."""
 
+    async def release_secrets(
+        self, work_record_id: str, payload: Mapping[str, Any]
+    ) -> dict[str, Any]:
+        """The sealed shares of the Secrets a Directive needs (Agent Guardrails rev 7)."""
+
     async def report_harness_usage(self, payload: Mapping[str, Any]) -> list[dict[str, Any]]:
         """One Usage Record per model off a harness's own JSON (PRD issue 31, 17 A9)."""
 
@@ -2759,7 +2765,7 @@ class RunnerRalphActivities:
             )
 
         await self._refuse_skill_digest_mismatch(work_record_id, state)
-        credentials = await self._resolve_credentials(work_record_id, state)
+        credentials = await self._resolve_credentials(work_record_id, state, attempt_directive_id)
         if credentials is not None:
             # Names only, at the moment they resolved (22 A1's Evidence): a support read
             # of "which credentials did this Directive have" must not be answerable by
@@ -3190,23 +3196,29 @@ class RunnerRalphActivities:
         self,
         work_record_id: str,
         state: _RuntimeContextState,
+        attempt_directive_id: str,
     ) -> DirectiveCredentials | None:
         """Resolve this Contract's Credential References, or fail the Directive closed.
 
         22 A1: the Runner resolves a reference at Directive time from its host store and
-        hands the value only to verb seams and Runner-hosted MCP servers. An unresolvable
-        one is not degraded into "run without it" -- the Directive would then do the work
-        wrong and the Evidence would not say why -- so it raises, naming the reference,
-        after appending the Evidence that names it.
+        hands the value only to verb seams and Runner-hosted MCP servers. A reference the
+        host does not hold is asked of the control plane as a Secret (Agent Guardrails rev
+        7, S4). An unresolvable one is not degraded into "run without it" -- the Directive
+        would then do the work wrong and the Evidence would not say why -- so it raises,
+        naming the reference, after appending the Evidence that names it.
         """
 
         if not state.credential_references:
             return None
         resolver = self._credentials or CredentialResolver(store=EmptyCredentialStore())
         try:
+            released = await self._release_secrets(
+                work_record_id, state, resolver, attempt_directive_id
+            )
             return resolver.resolve(
                 contract_id=state.contract_id,
                 manifest=state.credential_references,
+                released=released,
             )
         except UnresolvableCredentialReferenceError as error:
             await self._fastapi_client.append_evidence(
@@ -3216,6 +3228,50 @@ class RunnerRalphActivities:
             )
             raise
 
+    async def _release_secrets(
+        self,
+        work_record_id: str,
+        state: _RuntimeContextState,
+        resolver: CredentialResolver,
+        attempt_directive_id: str,
+    ) -> dict[str, str]:
+        """The Secrets this Directive needs and the host does not hold, opened in memory.
+
+        Asked only by a Runner holding the Organisation Key, the one holder key a Secret is
+        sealed to in this release; any other leaves the names to fail as not installed. The
+        values live in the Directive's credentials and nowhere else, and go with it.
+        """
+
+        missing = [
+            reference
+            for reference in state.credential_references
+            if not resolver.usable(str(state.contract_id), reference)
+        ]
+        fingerprint = self._llm_keys.fingerprint if self._llm_keys is not None else None
+        if not missing or self._llm_keys is None or fingerprint is None:
+            return {}
+        try:
+            payload = await self._fastapi_client.release_secrets(
+                work_record_id,
+                SecretReleaseRequest(
+                    directive_id=attempt_directive_id,
+                    names=missing,
+                    holder_fingerprints=[fingerprint],
+                ).model_dump(mode="json"),
+            )
+        except WorkerFastApiClientRejectionError as error:
+            raise UnresolvableCredentialReferenceError(
+                missing[0],
+                contract_id=state.contract_id,
+                reason=f"secret_release_refused:{error.status_code}",
+            ) from error
+        try:
+            return self._llm_keys.open_secrets(SecretRelease.model_validate(payload), names=missing)
+        except (ValidationError, LlmKeyUnopenableError) as error:
+            raise UnresolvableCredentialReferenceError(
+                missing[0], contract_id=state.contract_id, reason="secret_unopenable"
+            ) from error
+
     async def _directive_auth_mode(
         self, work_record_id: str, state: _RuntimeContextState, access: LlmAccess | None = None
     ) -> AuthMode:

{agentic_runner-4.0.0 → agentic_runner-4.1.0}/src/agentic_runner/credentials.py

@@ -260,9 +260,14 @@ class CredentialResolver:
         *,
         contract_id: str | None,
         manifest: Iterable[str],
+        released: Mapping[str, str] | None = None,
     ) -> DirectiveCredentials:
         """Every reference the Contract declares, or the first failure, named.
 
+        ``released`` holds the Secrets the control plane released for this Directive
+        (Spec: Agent Guardrails rev 7, S4). They come last: a value this Runner's host
+        installed under the same name still counts, and wins (A2).
+
         Fails on the *first* unresolvable reference rather than collecting them: a
         Directive that cannot have one of its credentials is not going to run, and a
         partial resolution left lying around is a value held for no reason.
@@ -271,6 +276,8 @@ class CredentialResolver:
         values: dict[str, str] = {}
         for reference in manifest:
             value = self._value(contract_id, reference)
+            if value is None and released is not None:
+                value = released.get(reference)
             if value is None:
                 raise UnresolvableCredentialReferenceError(
                     reference, contract_id=contract_id, reason="not_installed"

{agentic_runner-4.0.0 → agentic_runner-4.1.0}/src/agentic_runner/pool_key.py

@@ -1,4 +1,5 @@
-"""The pool's Pool Key on this Runner, and the LLM Keys it opens (Spec: Runners rev 3).
+"""The pool's Pool Key on this Runner, and the LLM Keys and Secrets it opens (Spec: Runners
+rev 3; Spec: Agent Guardrails rev 7, S3-S4, where it is called the Organisation Key).
 
 An Organisation's Admin creates the Pool Key in the console, which shows its private half
 once, and gives it to every Runner of the pool at install: one chart Secret for all
@@ -15,7 +16,7 @@ from __future__ import annotations
 import base64
 import binascii
 import os
-from collections.abc import Mapping, MutableMapping
+from collections.abc import Mapping, MutableMapping, Sequence
 from dataclasses import dataclass, field
 from pathlib import Path
 from typing import Final
@@ -28,6 +29,7 @@ from agentic_runner.sealed_box import RecipientKeyStore, SealedCredentialError,
 from agentic_runner_contracts.llm_access import PROVIDER_KEY_NAMES
 from agentic_runner_contracts.llm_key import LlmKeyRelease, join_llm_key
 from agentic_runner_contracts.sealed_credential import key_fingerprint
+from agentic_runner_contracts.secret import HolderKind, SecretRelease, join_secret
 
 __all__ = [
     "POOL_KEY_ENV",
@@ -166,6 +168,42 @@ class LlmKeyOpener:
             reference=key_name, key_id=release.llm_key_id, value=value
         )
 
+    def open_secrets(self, release: SecretRelease, *, names: Sequence[str]) -> dict[str, str]:
+        """Every asked-for Secret's value, by name, held by the caller for one Directive.
+
+        The release must carry exactly ``names``, each sealed to this Runner's Pool Key:
+        a Secret the Directive did not ask for is not one it may hold. One error for every
+        way it fails, for :meth:`open`'s reason.
+        """
+
+        unopenable = "the released Secrets do not open with this Runner's keys"
+        if self._pool_key is None or sorted(secret.name for secret in release.secrets) != sorted(
+            names
+        ):
+            raise LlmKeyUnopenableError(unopenable)
+        values: dict[str, str] = {}
+        try:
+            for secret in release.secrets:
+                if (
+                    secret.holder_kind != HolderKind.ORGANISATION_KEY
+                    or secret.holder_fingerprint != self._pool_key.fingerprint
+                ):
+                    raise SealedCredentialError("sealed to another holder key")
+                holder_share = open_sealed(
+                    private_key=self._pool_key.private_key,
+                    binding=release.holder_share_binding(secret),
+                    ciphertext=secret.holder_share,
+                )
+                platform_share = open_sealed(
+                    private_key=self._recipient_private_key(release.recipient_key_id),
+                    binding=release.platform_share_binding(secret),
+                    ciphertext=secret.platform_share,
+                )
+                values[secret.name] = join_secret(holder_share, platform_share)
+        except (SealedCredentialError, ValueError) as error:
+            raise LlmKeyUnopenableError(unopenable) from error
+        return values
+
     def _recipient_private_key(self, recipient_key_id: str) -> str:
         # The previous key too: the control plane may have sealed its share just before a
         # renewal.

{agentic_runner-4.0.0 → agentic_runner-4.1.0}/src/agentic_runner/workers/fastapi_client.py

@@ -190,6 +190,19 @@ class RunnerFastApiClient:
             payload,
         )
 
+    async def release_secrets(
+        self, work_record_id: str, payload: Mapping[str, Any]
+    ) -> dict[str, Any]:
+        """The sealed shares of the Secrets a Directive needs and this Runner's host does
+        not hold (Spec: Agent Guardrails rev 7, S4). ``payload`` is
+        ``SecretReleaseRequest``'s shape; the Directive token says which Runner and
+        Directive ask."""
+
+        return await self._post(
+            f"{self._prefix}/work-records/{_path_segment(work_record_id)}/secrets/release",
+            payload,
+        )
+
     async def append_evidence(
         self,
         work_record_id: str,