agentic-workspace 1.0.0rc3__py3-none-win_amd64.whl

agentic_workspace/__init__.py

@@ -0,0 +1,8 @@
+"""The installed Python projection of the native Agentic Workspace authority."""
+
+from importlib.metadata import version
+
+from ._binding import DecisionContractError, answer_carried, invoke, invoke_carried, resources, select_reference, start
+
+__version__ = version("agentic-workspace")
+__all__ = ["DecisionContractError", "answer_carried", "invoke", "invoke_carried", "resources", "select_reference", "start"]

agentic_workspace/_binding.py

@@ -0,0 +1,64 @@
+"""Private installed transport; ordinary meaning belongs to the paired Rust core."""
+from __future__ import annotations
+
+import json
+import subprocess
+from collections.abc import Mapping
+from typing import Any
+
+from .native_core import core_binary as native_core_binary
+
+
+class DecisionContractError(ValueError):
+    """Raised when the shared core rejects a source-decision request."""
+
+def resources(context: Mapping[str, Any]) -> dict[str, Any]:
+    """Bounded Rust-owned resource proposals and effects; no host policy reducer."""
+    return _request({"resources": context})
+
+def start(context: Mapping[str, Any]) -> dict[str, Any]:
+    """Consume repository sources through the native public owner boundary."""
+    return _request({"start": context})
+
+def invoke(context: Mapping[str, Any]) -> dict[str, Any]:
+    """Submit an exact public invocation to the same native owner boundary."""
+    return _request({"invoke": context})
+
+def select_reference(context: Mapping[str, Any], reference: str, **material: Any) -> dict[str, Any]:
+    """Forward an exact reference and optional bounded answer to Rust.
+
+    Context is copied, never retained as hidden session state. Rust alone
+    validates the answer and current owner identity.
+    """
+    if set(material) - {"answer"}:
+        raise TypeError("select_reference accepts only answer material")
+    return start({**context, "reference": reference, **material})
+
+def answer_carried(carriage: Mapping[str, Any], reference: str, answer: Any) -> dict[str, Any]:
+    """Carry exact owner material; Rust binds only the returned bounded answer."""
+    return _request({"start": {"request": carriage, "reference": reference, "answer": answer, "projection": "carried"}})
+
+def invoke_carried(carriage: Mapping[str, Any], reference: str) -> dict[str, Any]:
+    """Execute one exact carried action, with native execution-time admission."""
+    return _request({"invoke": {"invocation": carriage, "reference": reference, "projection": "carried"}})
+
+def _request(payload: Mapping[str, Any]) -> dict[str, Any]:
+    try:
+        binary = native_core_binary()
+    except (OSError, RuntimeError) as error:
+        raise DecisionContractError(str(error)) from error
+    completed = subprocess.run(
+        [str(binary)],
+        input=json.dumps(payload, separators=(",", ":")),
+        text=True,
+        encoding="utf-8",
+        capture_output=True,
+        check=False,
+    )
+    if completed.returncode != 0:
+        try:
+            message = json.loads(completed.stderr)["error"]["message"]
+        except (KeyError, TypeError, json.JSONDecodeError):
+            message = completed.stderr.strip() or f"shared core exited with status {completed.returncode}"
+        raise DecisionContractError(str(message))
+    return dict(json.loads(completed.stdout))

agentic_workspace/_native/artifact.json

@@ -0,0 +1 @@
+{"kind": "agentic-workspace/native-python-artifact/v1", "package_version": "1.0.0rc3", "rust_host": "x86_64-pc-windows-msvc", "rust_target": "x86_64-pc-windows-msvc", "rust_toolchain": {"channel": "1.98.1", "declaration_sha256": "887f9be066a15585a2c583578e84b0fcb541126d81546276bad3d2ff00d61167", "release": "1.98.1", "commit_hash": "48a229ceaefd4985c50990b14116b6d856af0985", "commit_date": "2026-09-01", "host": "x86_64-pc-windows-msvc", "llvm_version": "22.1.8"}, "source_head": "85272df02be42707f6abd21cb120e25fffcd85f7", "source_dirty": false, "sha256": "5c436e86923fb8947bee4e7f1c3dbe478b9257a834aab9e2a95248bb113fcf67", "cli_sha256": "4792983d514835db22b8beb8cf9c4162c92bd9ef5fa65ad70eed8a1aeb100be9"}

agentic_workspace/cli.py

@@ -0,0 +1,21 @@
+from __future__ import annotations
+
+import subprocess
+import sys
+
+from agentic_workspace.native_core import cli_binary
+
+
+def _run_cli(argv: list[str] | None = None) -> int:
+    """Optional Python entry point; the paired Rust executable owns the command."""
+    args = list(sys.argv[1:] if argv is None else argv)
+    try:
+        return subprocess.call([str(cli_binary()), *args])
+    except (OSError, RuntimeError) as exc:
+        print(str(exc), file=sys.stderr)
+        return 2
+
+
+main = _run_cli
+
+__all__ = ["main"]

agentic_workspace/codex_provider.py

@@ -0,0 +1,483 @@
+"""Codex protocol I/O only; no Assignment policy, packet admission or repository semantics."""
+
+from __future__ import annotations
+
+import hashlib
+import json
+import os
+import queue
+import shutil
+import signal
+import subprocess
+import tempfile
+import threading
+import time
+from contextlib import contextmanager
+from contextvars import ContextVar
+from pathlib import Path
+from typing import Any, Callable, Iterator
+
+_discovery_scope: ContextVar[dict[tuple[str, str], dict[str, Any]] | None] = ContextVar("native-discovery-scope", default=None)
+
+
+@contextmanager
+def discovery_scope() -> Iterator[None]:
+    """Share one current snapshot within a bounded source-owner evaluation."""
+    token = _discovery_scope.set({})
+    try:
+        yield
+    finally:
+        _discovery_scope.reset(token)
+
+
+def digest(value: Any) -> str:
+    return "sha256:" + hashlib.sha256(json.dumps(value, sort_keys=True, separators=(",", ":")).encode()).hexdigest()
+
+
+def _write(path: Path, value: Any) -> None:
+    path.parent.mkdir(parents=True, exist_ok=True)
+    temporary = path.with_name(f".{path.name}.{os.getpid()}.tmp")
+    temporary.write_text(json.dumps(value, sort_keys=True), encoding="utf-8")
+    temporary.replace(path)
+
+
+class ProviderError(ValueError):
+    def __init__(self, message: str, *, metrics: dict[str, Any] | None = None):
+        super().__init__(message)
+        self.metrics = metrics or {}
+
+
+class CodexConnection:
+    """One provider process. Only the provider owns conversation persistence."""
+
+    def __init__(self, executable: str, *, timeout: float = 30, environment: dict[str, str] | None = None):
+        self.timeout = timeout
+        self.process = subprocess.Popen(
+            [executable, "app-server", "--stdio"],
+            stdin=subprocess.PIPE,
+            stdout=subprocess.PIPE,
+            stderr=subprocess.DEVNULL,
+            text=True,
+            encoding="utf-8",
+            env={**os.environ, **environment} if environment is not None else None,
+            start_new_session=os.name != "nt",
+            creationflags=subprocess.CREATE_NO_WINDOW if os.name == "nt" else 0,
+        )
+        self.messages: queue.Queue[dict[str, Any]] = queue.Queue()
+        self.number = 0
+        self.events: list[dict[str, Any]] = []
+        threading.Thread(target=self._read, daemon=True).start()
+        try:
+            self.call("initialize", {"clientInfo": {"name": "aw-native-transport", "version": "1"}})
+            self.send({"method": "initialized"})
+        except Exception:
+            self.close()
+            raise
+
+    def _read(self) -> None:
+        assert self.process.stdout is not None
+        for line in self.process.stdout:
+            try:
+                value = json.loads(line)
+            except ValueError:
+                continue
+            # Drop reasoning, deltas, commands and history at the adapter ingress.
+            if "id" in value or value.get("method") in {"item/completed", "turn/completed", "thread/tokenUsage/updated", "error"}:
+                if value.get("method") == "item/completed" and value.get("params", {}).get("item", {}).get("type") != "agentMessage":
+                    continue
+                self.messages.put(value)
+        self.messages.put({"adapter_closed": True})
+
+    def send(self, payload: dict[str, Any]) -> None:
+        assert self.process.stdin is not None
+        self.process.stdin.write(json.dumps(payload) + "\n")
+        self.process.stdin.flush()
+
+    def next(self, timeout: float | None = None) -> dict[str, Any]:
+        try:
+            item = self.messages.get(timeout=self.timeout if timeout is None else timeout)
+        except queue.Empty as error:
+            raise ProviderError("provider-response-timeout") from error
+        if item.get("adapter_closed"):
+            raise ProviderError("provider-process-closed")
+        # This adapter does not admit interactive approvals or tool execution
+        # outside its fixed read-only sandbox. Deny provider requests explicitly.
+        if "id" in item and "method" in item:
+            self.send({"id": item["id"], "error": {"code": -32601, "message": "Unsupported by bounded read-only adapter"}})
+            return self.next(timeout)
+        return item
+
+    def call(self, method: str, params: dict[str, Any]) -> dict[str, Any]:
+        self.number += 1
+        number = self.number
+        self.send({"id": number, "method": method, "params": params})
+        deadline = time.monotonic() + self.timeout
+        while time.monotonic() < deadline:
+            message = self.next(max(0.01, deadline - time.monotonic()))
+            if message.get("id") == number:
+                if "error" in message:
+                    if (
+                        method == "thread/archive"
+                        and message["error"].get("message") == f"no rollout found for thread id {params.get('threadId')}"
+                    ):
+                        raise ProviderError("native-active-thread-unavailable")
+                    if (
+                        method in {"thread/resume", "thread/fork"}
+                        and message["error"].get("message") == f"no rollout found for thread id {params.get('threadId')}"
+                    ):
+                        raise ProviderError("native-continuation-unavailable")
+                    # No prompt or provider payload is retained in an error.
+                    raise ProviderError(f"provider-operation-rejected:{method}:{message['error'].get('code')}")
+                return message["result"]
+            self.events.append(message)
+        raise ProviderError("provider-response-timeout")
+
+    def close(self) -> None:
+        if self.process.stdin is not None and not self.process.stdin.closed:
+            self.process.stdin.close()
+        try:
+            self.process.wait(timeout=5)
+        except subprocess.TimeoutExpired:
+            if os.name == "nt":
+                # The installed CLI may be a cmd/node launcher. Terminating
+                # only that wrapper does not prove its worker has stopped.
+                killed = subprocess.run(
+                    ["taskkill", "/PID", str(self.process.pid), "/T", "/F"],
+                    capture_output=True,
+                    timeout=10,
+                    creationflags=subprocess.CREATE_NO_WINDOW,
+                    check=False,
+                )
+                if killed.returncode != 0:
+                    raise ProviderError("native-process-tree-release-unconfirmed")
+                self.process.wait(timeout=5)
+            else:
+                try:
+                    os.killpg(self.process.pid, signal.SIGKILL)
+                except ProcessLookupError:
+                    pass
+                self.process.wait(timeout=5)
+
+
+def discover(
+    root: Path, *, executable: str = "codex", refresh: bool = False, now: float | None = None, persist: bool = True
+) -> dict[str, Any]:
+    """Local version signal plus bounded remote/account capability refresh."""
+    clock = time.time() if now is None else now
+    scope = _discovery_scope.get()
+    key = (str(root.resolve()), executable)
+    scoped = scope.get(key, {}) if scope is not None else {}
+    if not refresh and clock < scoped.get("expires_at", 0) and not scoped.get("invalidated"):
+        return scoped
+    resolved = shutil.which(executable)
+    if not resolved:
+        raise ProviderError("native-adapter-executable-unavailable")
+    version = subprocess.run([resolved, "--version"], capture_output=True, text=True, timeout=10, check=True).stdout.strip()
+    adapter_revision = hashlib.sha256(Path(__file__).read_bytes()).hexdigest()
+    identity = digest({"adapter": "codex-app-server/v1", "implementation": adapter_revision, "executable": resolved, "version": version})
+    path = root / ".agentic-workspace/local/transport-capabilities" / f"{identity[7:]}.json"
+    try:
+        cached = json.loads(path.read_text(encoding="utf-8"))
+    except (OSError, ValueError):
+        cached = {}
+    if not refresh and cached.get("identity") == identity and clock < cached.get("expires_at", 0) and not cached.get("invalidated"):
+        if scope is not None:
+            scope[key] = cached
+        return cached
+    # Discover actual installed protocol properties. In particular excludeTurns
+    # is required: AW never requests the provider's persisted conversation.
+    with tempfile.TemporaryDirectory(prefix="aw-provider-schema-") as directory:
+        subprocess.run([resolved, "app-server", "generate-json-schema", "--out", directory], capture_output=True, timeout=20, check=True)
+        schemas = {}
+        for name in (
+            "ThreadStartParams",
+            "ThreadResumeParams",
+            "ThreadForkParams",
+            "TurnStartParams",
+            "ThreadArchiveParams",
+            "ConfigReadParams",
+        ):
+            schema_path = Path(directory) / "v2" / f"{name}.json"
+            if schema_path.is_file():
+                schemas[name] = json.loads(schema_path.read_text())["properties"]
+    turn_supported = {"threadId", "input", "outputSchema", "model", "approvalPolicy"} <= schemas.get("TurnStartParams", {}).keys()
+    thread_fields = {"cwd", "model", "sandbox", "approvalPolicy"}
+    modes = ["fresh"] if turn_supported and thread_fields <= schemas.get("ThreadStartParams", {}).keys() else []
+    for mode, name in (("resume", "ThreadResumeParams"), ("fork", "ThreadForkParams")):
+        if turn_supported and (thread_fields | {"excludeTurns", "threadId"}) <= schemas.get(name, {}).keys():
+            modes.append(mode)
+    if "resume" in modes:
+        modes.append("restart")
+    connection = CodexConnection(resolved)
+    try:
+        result = connection.call("model/list", {"limit": 100})
+        effective_effort = None
+        effective_settings_known = {"cwd", "includeLayers"} <= schemas.get("ConfigReadParams", {}).keys()
+        if effective_settings_known:
+            effective = connection.call("config/read", {"includeLayers": False, "cwd": str(root)})
+            effective_effort = effective.get("config", {}).get("model_reasoning_effort")
+    finally:
+        connection.close()
+    if result.get("nextCursor"):
+        raise ProviderError("provider-catalog-exceeds-bounded-discovery")
+    catalog = [
+        {
+            "model": m["model"],
+            "reasoning_efforts": [item["reasoningEffort"] for item in m.get("supportedReasoningEfforts", [])],
+            "default_reasoning_effort": m.get("defaultReasoningEffort"),
+        }
+        for m in result["data"]
+        if not m.get("hidden")
+    ]
+    facts = {
+        "adapter": "codex-app-server/v1",
+        "implementation_revision": adapter_revision,
+        "executable": resolved,
+        "version": version,
+        "modes": modes,
+        "models": catalog,
+        "effective_reasoning_effort": effective_effort,
+        "effective_settings_known": effective_settings_known,
+        "protocol_revision": digest(schemas),
+        "parameters": ["model", "timeout_seconds"]
+        + (["reasoning_effort"] if "effort" in schemas.get("TurnStartParams", {}) else [])
+        + (["ephemeral"] if "ephemeral" in schemas.get("ThreadStartParams", {}) else []),
+        "ephemeral_modes": [
+            mode
+            for mode, name in (("fresh", "ThreadStartParams"), ("fork", "ThreadForkParams"))
+            if mode in modes and "ephemeral" in schemas.get(name, {})
+        ],
+        "archive_supported": "threadId" in schemas.get("ThreadArchiveParams", {}),
+    }
+    snapshot = {
+        **facts,
+        "identity": identity,
+        "revision": digest(facts),
+        "observed_at": clock,
+        "expires_at": clock + 900,
+        "live_worker_continuity": False,
+        "exclusive_writer": True,
+        "process_lifetime": "one-dispatch",
+        "conversation_lifetime": "provider-owned",
+        "source": "installed-protocol-and-model-list",
+    }
+    if persist:
+        _write(path, snapshot)
+    if scope is not None:
+        scope[key] = snapshot
+    return snapshot
+
+
+def validate_selection(snapshot: dict[str, Any], selection: dict[str, Any], *, now: float | None = None) -> None:
+    clock = time.time() if now is None else now
+    if snapshot.get("invalidated") or clock >= snapshot["expires_at"] or selection.get("capability_revision") != snapshot["revision"]:
+        raise ProviderError("native-capability-not-current")
+    if set(selection) - {"capability_revision", "mode", "reference", "parameters", "semantic_scope", "lineage_revision"}:
+        raise ProviderError("unsupported-native-selection-field")
+    mode = selection.get("mode")
+    if mode not in snapshot["modes"]:
+        raise ProviderError("native-continuity-unavailable")
+    if mode != "fresh" and not selection.get("reference"):
+        raise ProviderError("native-continuation-reference-required")
+    if mode == "fresh" and selection.get("reference"):
+        raise ProviderError("fresh-cannot-inherit-reference")
+    validate_parameters(snapshot, mode, selection.get("parameters", {}))
+
+
+def validate_parameters(snapshot: dict[str, Any], mode: str, parameters: dict[str, Any]) -> None:
+    if set(parameters) - set(snapshot.get("parameters", ["model"])):
+        raise ProviderError("native-parameter-unsupported")
+    if "ephemeral" in parameters and not isinstance(parameters["ephemeral"], bool):
+        raise ProviderError("native-parameter-unsupported")
+    if parameters.get("ephemeral") and mode not in snapshot.get("ephemeral_modes", []):
+        raise ProviderError("native-ephemeral-continuity-unavailable")
+    model = next((m for m in snapshot["models"] if m["model"] == parameters.get("model")), None)
+    if model is None:
+        raise ProviderError("native-model-unavailable")
+    if "reasoning_effort" in parameters and parameters["reasoning_effort"] not in model["reasoning_efforts"]:
+        raise ProviderError("native-parameter-unsupported")
+    if "timeout_seconds" in parameters:
+        timeout = parameters["timeout_seconds"]
+        if not isinstance(timeout, int) or isinstance(timeout, bool) or not 1 <= timeout <= 1800:
+            raise ProviderError("native-parameter-unsupported")
+
+
+@contextmanager
+def exclusive_lineage(reference: str) -> Iterator[None]:
+    """Cross-worktree OS lock; released on process death, never guessed from TTL."""
+    directory = Path(tempfile.gettempdir()) / "agentic-workspace-provider-locks"
+    directory.mkdir(parents=True, exist_ok=True)
+    path = directory / (hashlib.sha256(("codex:" + reference).encode()).hexdigest() + ".lock")
+    with path.open("a+b") as lock:
+        try:
+            if path.stat().st_size == 0:
+                lock.write(b"0")
+                lock.flush()
+            lock.seek(0)
+            if os.name == "nt":
+                import msvcrt
+
+                msvcrt.locking(lock.fileno(), msvcrt.LK_NBLCK, 1)
+            else:
+                import fcntl
+
+                fcntl.flock(lock.fileno(), fcntl.LOCK_EX | fcntl.LOCK_NB)
+        except OSError as error:
+            raise ProviderError("native-lineage-exclusive-writer-busy") from error
+        try:
+            yield
+        finally:
+            lock.seek(0)
+            if os.name == "nt":
+                import msvcrt
+
+                msvcrt.locking(lock.fileno(), msvcrt.LK_UNLCK, 1)
+            else:
+                import fcntl
+
+                fcntl.flock(lock.fileno(), fcntl.LOCK_UN)
+
+
+def execute(
+    root: Path,
+    snapshot: dict[str, Any],
+    selection: dict[str, Any],
+    prompt: str,
+    schema: dict[str, Any],
+    *,
+    timeout: int = 1800,
+    on_thread: Callable[[str], None] | None = None,
+    worker_environment: dict[str, str] | None = None,
+    on_closed: Callable[[], None] | None = None,
+    on_history: Callable[[bool], None] | None = None,
+) -> dict[str, Any]:
+    """Run an exact native topology; missing provider state never becomes fresh."""
+    validate_selection(snapshot, selection)
+    reference = selection.get("reference")
+    mode = selection["mode"]
+    started = time.monotonic()
+    metrics: dict[str, Any] = {"kind": "agentic-workspace/assignment-transport-metrics/v1"}
+    usage_current = True
+    deadline = None
+    with exclusive_lineage(reference or "fresh:" + os.urandom(16).hex()):
+        connection = (
+            CodexConnection(snapshot["executable"], environment=worker_environment)
+            if worker_environment is not None
+            else CodexConnection(snapshot["executable"])
+        )
+        try:
+            method = {"fresh": "thread/start", "resume": "thread/resume", "restart": "thread/resume", "fork": "thread/fork"}[mode]
+            params = {"cwd": str(root), "model": selection["parameters"]["model"], "sandbox": "read-only", "approvalPolicy": "never"}
+            ephemeral = selection["parameters"].get("ephemeral", False)
+            if mode in {"fresh", "fork"} and "ephemeral" in selection["parameters"]:
+                params["ephemeral"] = ephemeral
+            if reference:
+                params.update({"threadId": reference, "excludeTurns": True})
+            result = connection.call(method, params)
+            thread = result["thread"]
+            actual = thread["id"]
+            if mode in {"resume", "restart"} and actual != reference:
+                raise ProviderError("provider-continuation-identity-mismatch")
+            if mode == "fork" and actual == reference:
+                raise ProviderError("provider-fork-lineage-not-independent")
+            if on_thread is not None:
+                on_thread(actual)
+            if on_history is not None and isinstance(thread.get("ephemeral"), bool):
+                on_history(thread["ephemeral"])
+            if ephemeral and thread.get("ephemeral") is not True:
+                raise ProviderError("provider-ephemeral-guarantee-not-enforced")
+            if not ephemeral and thread.get("ephemeral") is True:
+                raise ProviderError("provider-persistence-guarantee-not-enforced")
+            if "ephemeral" in selection["parameters"] and thread.get("ephemeral") is not ephemeral:
+                raise ProviderError("provider-history-guarantee-unconfirmed")
+            turn_params = {
+                "threadId": actual,
+                "input": [{"type": "text", "text": prompt}],
+                "outputSchema": schema,
+                "model": selection["parameters"]["model"],
+                "approvalPolicy": "never",
+            }
+            if selection["parameters"].get("reasoning_effort"):
+                turn_params["effort"] = selection["parameters"]["reasoning_effort"]
+            turn = connection.call("turn/start", turn_params)["turn"]["id"]
+            output = ""
+            deadline = time.monotonic() + timeout
+            while time.monotonic() < deadline:
+                event = connection.events.pop(0) if connection.events else connection.next(max(0.01, deadline - time.monotonic()))
+                payload = event.get("params", {})
+                if payload.get("threadId") != actual:
+                    continue
+                if event.get("method") == "thread/tokenUsage/updated" and payload.get("turnId") == turn and mode == "fresh":
+                    # `last` covers one model response, not the entire tool loop.
+                    # Fresh has a known zero lineage baseline. Reused contexts
+                    # lack a proven pre-turn baseline, so their total is unknown.
+                    usage = payload.get("tokenUsage", {}).get("total", {})
+                    observed: dict[str, int] = {}
+                    for source, target in (
+                        ("inputTokens", "effective_input_tokens"),
+                        ("cachedInputTokens", "cached_input_tokens"),
+                        ("outputTokens", "output_tokens"),
+                    ):
+                        value = usage.get(source)
+                        if isinstance(value, int) and not isinstance(value, bool) and value >= 0:
+                            observed[target] = value
+                    fields = ("effective_input_tokens", "cached_input_tokens", "output_tokens")
+                    if (
+                        len(observed) != len(fields)
+                        or any(observed.get(field, -1) < metrics.get(field, 0) for field in fields)
+                        or observed.get("cached_input_tokens", 0) > observed.get("effective_input_tokens", 0)
+                    ):
+                        usage_current = False
+                    if usage_current:
+                        metrics.update(observed)
+                    else:
+                        # A provider counter reset/estimate is not a cheaper run.
+                        for field in fields:
+                            metrics.pop(field, None)
+                if payload.get("turnId") == turn and event.get("method") == "item/completed":
+                    output = payload["item"].get("text", "")
+                if event.get("method") == "turn/completed" and payload.get("turn", {}).get("id") == turn:
+                    if payload["turn"].get("status") != "completed":
+                        raise ProviderError("provider-turn-failed")
+                    return {
+                        "returned_work": json.loads(output),
+                        "metrics": metrics,
+                        "elapsed_ms": round((time.monotonic() - started) * 1000),
+                        "continuation": {
+                            "reference": actual,
+                            "mode": mode,
+                            "capability_revision": snapshot["revision"],
+                            "parameters": selection["parameters"],
+                            "live": False,
+                            "exclusive": True,
+                            "ephemeral": ephemeral,
+                        },
+                        "raw_transcript_stored": False,
+                    }
+            raise ProviderError("provider-turn-timeout")
+        except (ProviderError, ValueError, OSError) as error:
+            reason = str(error) if isinstance(error, ProviderError) else "native-return-or-control-failed"
+            if reason == "provider-response-timeout" and deadline is not None and time.monotonic() >= deadline:
+                reason = "provider-turn-timeout"
+            raise ProviderError(reason, metrics=metrics) from error
+        finally:
+            connection.close()
+            if on_closed is not None:
+                on_closed()
+
+
+def archive_reference(snapshot: dict[str, Any], reference: str) -> str:
+    """Reversible cleanup of a caller-owned terminal worker; never delete state."""
+    if not snapshot.get("archive_supported"):
+        raise ProviderError("native-archive-unavailable")
+    connection = CodexConnection(snapshot["executable"])
+    try:
+        try:
+            connection.call("thread/archive", {"threadId": reference})
+        except ProviderError as error:
+            if str(error) != "native-active-thread-unavailable":
+                raise
+            return "already-absent"
+        return "archived"
+    finally:
+        connection.close()

agentic_workspace/native_core.py

@@ -0,0 +1,63 @@
+"""Resolve verified package artifacts, a prepared source checkout, or an explicit core."""
+
+from __future__ import annotations
+
+import hashlib
+import json
+import os
+from importlib.metadata import version
+from pathlib import Path
+
+
+def _verify(path: Path, key: str) -> None:
+    packaged = Path(__file__).with_name("_native")
+    manifest_path = packaged / "artifact.json"
+    if packaged.is_dir():
+        if not manifest_path.is_file():
+            raise RuntimeError("packaged native artifact manifest missing")
+        manifest = json.loads(manifest_path.read_text(encoding="utf-8"))
+        if manifest["package_version"] != version("agentic-workspace"):
+            raise RuntimeError("packaged native artifact version mismatch")
+        if hashlib.sha256(path.read_bytes()).hexdigest() != manifest[key]:
+            raise RuntimeError("packaged native artifact digest mismatch")
+
+
+def core_binary() -> Path:
+    name = "agentic-workspace-core.exe" if os.name == "nt" else "agentic-workspace-core"
+    configured = os.environ.get("AGENTIC_WORKSPACE_CORE_BINARY")
+    packaged = Path(__file__).with_name("_native")
+    path = Path(configured) if configured else packaged / name
+    # Only this module's source tree can supply an implicit development build.
+    # Never search cwd/PATH or fall back from a present packaged distribution.
+    root = Path(__file__).resolve().parents[2]
+    if (
+        not configured
+        and not packaged.exists()
+        and Path(__file__).resolve().parent.parent == root / "src"
+        and (root / "Cargo.lock").is_file()
+        and (root / "crates/agentic-workspace-core/Cargo.toml").is_file()
+        and (root / "crates/agentic-workspace-cli/Cargo.toml").is_file()
+    ):
+        directory = root / "target/debug"
+        path = directory / name
+        cli = directory / ("agentic-workspace.exe" if os.name == "nt" else "agentic-workspace")
+        if not path.is_file() or not cli.is_file():
+            raise RuntimeError(
+                f"source-checkout native binary pair is unavailable at {directory}; "
+                "run cargo build --locked --workspace --bins from this checkout; "
+                "for a custom target directory explicitly set AGENTIC_WORKSPACE_CORE_BINARY to its paired core"
+            )
+    if not path.is_file():
+        raise RuntimeError(
+            "shared Agentic Workspace core is unavailable; install the native package or explicitly set AGENTIC_WORKSPACE_CORE_BINARY for development"
+        )
+    _verify(path, "sha256")
+    return path
+
+
+def cli_binary() -> Path:
+    path = core_binary().with_name("agentic-workspace.exe" if os.name == "nt" else "agentic-workspace")
+    if not path.is_file():
+        raise RuntimeError("paired native Agentic Workspace CLI is unavailable")
+    _verify(path, "cli_sha256")
+    return path

agentic_workspace/sealed_codex_transport.py

@@ -0,0 +1,113 @@
+"""Thin Codex app-server bridge for the native owner's sealed worker protocol.
+
+Core owns packet validation, return identity, attempts and integration. This
+adapter owns only provider discovery and one fresh read-only host turn.
+"""
+
+from __future__ import annotations
+
+import hashlib
+import json
+import subprocess
+import sys
+from pathlib import Path
+from typing import Any
+
+from agentic_workspace import codex_provider as native_transport
+from agentic_workspace.native_core import core_binary
+
+
+def assignment_packet(context: dict[str, Any]) -> dict[str, Any]:
+    """Forward packet admission to the paired core; never interpret it in Python."""
+    result = subprocess.run(
+        [str(core_binary())],
+        input=json.dumps({"assignment_packet": context}),
+        text=True,
+        encoding="utf-8",
+        capture_output=True,
+        check=False,
+    )
+    if result.returncode:
+        raise ValueError(result.stderr.strip())
+    return json.loads(result.stdout)
+
+
+def capability(root: Path, parameters: dict[str, Any]) -> dict[str, Any]:
+    """Fresh adapter facts only: no worker turn, session or retained observation."""
+    facts: dict[str, Any] = {
+        "kind": "agentic-workspace/host-transport-capability/v1",
+        "parameters": parameters,
+        "adapter_revision": hashlib.sha256(Path(__file__).read_bytes()).hexdigest(),
+    }
+    try:
+        snapshot = native_transport.discover(root, refresh=True, persist=False)
+        facts["provider_revision"] = snapshot["revision"]
+        native_transport.validate_selection(
+            snapshot, {"mode": "fresh", "parameters": parameters, "capability_revision": snapshot["revision"]}
+        )
+        facts.update(status="available", reason="current-protocol-and-model", result_classes=["read-only", "unapplied-patch"])
+    except native_transport.ProviderError as error:
+        reason = str(error)
+        # Only settled adapter facts establish unavailability. Discovery errors,
+        # quota, timeouts and unknown protocol remain unresolved, never local fit.
+        unavailable = reason in {
+            "native-adapter-executable-unavailable",
+            "native-model-unavailable",
+            "native-continuity-unavailable",
+            "native-parameter-unsupported",
+            "native-ephemeral-continuity-unavailable",
+        }
+        facts.update(status="unavailable" if unavailable else "unknown", reason=reason, result_classes=[])
+    except (OSError, ValueError, KeyError, subprocess.SubprocessError):
+        facts.update(status="unknown", reason="host-capability-discovery-failed", result_classes=[])
+    facts["revision"] = native_transport.digest(facts)
+    return facts
+
+
+def dispatch(root: Path, packet: dict[str, Any]) -> dict[str, Any]:
+    entry = assignment_packet({"action": "entry", "packet": packet})
+    configuration = packet["assignment_identity"]["current_assignment"]["selected"]["configuration"]
+    adapter = configuration["execution"]["adapter"]
+    if adapter.get("adapter") != "codex-app-server/v1":
+        raise ValueError("unsupported sealed host adapter")
+    parameters = adapter["parameters"]
+    if configuration["execution"].get("host_capability") != capability(root, parameters):
+        raise ValueError("host capability changed; resolve current Assignment before dispatch")
+    snapshot = native_transport.discover(root, refresh=True)
+    if snapshot["revision"] != configuration["execution"]["host_capability"]["provider_revision"]:
+        raise ValueError("host capability changed; resolve current Assignment before dispatch")
+    selection = {"mode": "fresh", "parameters": parameters, "capability_revision": snapshot["revision"]}
+    native_transport.validate_selection(snapshot, selection)
+    # Expand the bounded captured capsule mechanically, never from the filesystem.
+    prompt = json.dumps({"worker": entry, "captured_inputs": packet["assignment_identity"]["input_capsule"]})
+    schema = {
+        "type": "object",
+        "additionalProperties": False,
+        "properties": {
+            "summary": {"type": "string"},
+            "changed_paths": {"type": "array", "items": {"type": "string"}},
+            "patch": {"type": "string"},
+            "stop_conditions_hit": {"type": "array", "items": {"type": "string"}},
+            "result_delivery": {"const": "unapplied-patch"},
+        },
+        "required": ["summary", "changed_paths", "patch", "stop_conditions_hit", "result_delivery"],
+    }
+    result = native_transport.execute(root, snapshot, selection, prompt, schema, timeout=adapter["timeout_seconds"])
+    returned = assignment_packet({"action": "return", "packet": packet, "material": result["returned_work"]})
+    return next(
+        request["arguments"]["returned"]
+        for request in returned["reentry"]["request"]
+        if request["request_kind"] in {"assignment/observe-readonly-return/v1", "assignment/observe-patch-return/v1"}
+    )
+
+
+def main() -> None:
+    if sys.argv[1:] == ["--aw-capability"]:
+        print(json.dumps(capability(Path.cwd(), json.load(sys.stdin))))
+        return
+    packet = json.load(sys.stdin)
+    print(json.dumps(dispatch(Path.cwd(), packet)))
+
+
+if __name__ == "__main__":
+    main()

agentic_workspace-1.0.0rc3.dist-info/METADATA

@@ -0,0 +1,211 @@
+Metadata-Version: 2.5
+Name: agentic-workspace
+Version: 1.0.0rc3
+Summary: Repo-native continuity and execution layer for agents, combining workspace routing, active planning, and durable memory.
+Project-URL: Homepage, https://github.com/rickardvh/agentic-workspace
+Project-URL: Repository, https://github.com/rickardvh/agentic-workspace
+Project-URL: Issues, https://github.com/rickardvh/agentic-workspace/issues
+Project-URL: Support, https://github.com/rickardvh/agentic-workspace/issues
+Project-URL: Documentation, https://github.com/rickardvh/agentic-workspace/blob/master/docs/agentic-workspace-install.md
+Author: Rickard von Haugwitz
+Maintainer: Rickard von Haugwitz
+License-Expression: MIT
+License-File: LICENSE
+Keywords: agents,developer-tools,memory,planning,repository,workflow
+Classifier: Development Status :: 3 - Alpha
+Classifier: Intended Audience :: Developers
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3.14
+Classifier: Topic :: Software Development :: Build Tools
+Requires-Python: >=3.11
+Description-Content-Type: text/markdown
+
+# Agentic Workspace
+
+**Persistent operating context and dynamic control for coding agents.**
+
+Agentic Workspace (AW) helps coding agents enter a repository with the right guidance, continue unfinished work across sessions, and preserve useful lessons without turning every task into a workflow.
+
+It builds on repository instructions and skills with persistent, source-owned context and a small Rust-backed tool surface for exact current information and bounded operations. Keep your existing agent, editor, source tree, tests, and review process; AW connects them to the operating context that matters for the task at hand.
+
+[Get started](#get-started) · [Everyday use](docs/everyday-use.md) · [Documentation](docs/index.md) · [Releases](https://github.com/rickardvh/agentic-workspace/releases)
+
+## Why AW?
+
+A repository instruction file can explain how to work in a project. By itself, it cannot tell a new session where a multi-step task stopped, which retained lesson is relevant now, whether earlier verification still supports a claim, or which deeper procedure is worth loading for this change.
+
+As work spans sessions and agents, that context has to come from somewhere. Without a deliberate home, it tends to disappear into chat, duplicate into prose, or be reconstructed from source, issues, and history.
+
+AW keeps only the operating context whose availability can materially change agent behavior, then makes the relevant part cheap to reach:
+
+| Need | What AW provides |
+| --- | --- |
+| Find the right guidance | Task-relevant instructions, source references, and reusable skills. |
+| Continue interrupted work | Retained outcomes, constraints, accepted progress, blockers, and next actions. |
+| Know what to verify | Relevant checking procedures, recorded evidence, and visible gaps. |
+| Hand work to another agent | Bounded assignments with explicit context, constraints, and return expectations. |
+| Avoid repeated rediscovery | Useful lessons and corrections retained with the appropriate owner. |
+
+The goal is less repeated explanation, searching, handoff reconstruction, and repair—not a larger prompt or a new workflow to manage.
+
+**Small tasks stay small.** A typo fix does not need Planning, Memory, Verification, delegation, or another artifact merely because those capabilities are available.
+
+## What using it looks like
+
+Imagine an API change that spans two sessions:
+
+> Add pagination to the users API without breaking existing clients.
+
+In a repository with API guidance and verification procedures configured, the agent can use AW to find the relevant contract, load a useful implementation procedure, and identify the checks expected for the change. It still reads the source, reasons about the design, and implements with its ordinary tools.
+
+If work stops partway through, Planning can preserve the intended outcome, accepted progress, unresolved questions, and next action.
+
+In a later session:
+
+> Continue the pagination work.
+
+The next agent can recover that continuation rather than reconstructing the previous conversation. Changed assumptions and missing evidence remain things to check; a recorded result is not automatically fresh proof.
+
+The same principle applies to a handoff: preserve enough for the receiving agent to do bounded work without copying the entire parent session. Returned work still needs appropriate integration and verification.
+
+[See everyday examples →](docs/everyday-use.md)
+
+## How it works
+
+**Skills teach procedure. Repository instructions and configuration set policy. Domain owners hold current state and evidence. Tools provide exact current information and controlled operations. The agent supplies judgment.**
+
+A small repository entry point leads the agent to AW's canonical `workspace-startup` skill. That skill explains how to reach relevant sources, ask the runtime for current facts when they matter, and load specialized procedures only when useful.
+
+The underlying model is deliberately small:
+
+```text
+Find the relevant context → Do the work → Update what matters
+```
+
+Internally, AW resolves a compact operating contract, exposes supported actions, and reconciles their consequences afterward. That machinery is a substrate for the agent, not a phase machine the user has to operate around every task.
+
+Source code, documentation, tests, decisions, and other canonical repository material remain in their existing homes. AW routes to those sources rather than importing the repository into a second knowledge system.
+
+[Product model](docs/package/overview.md) · [Architecture](docs/architecture.md)
+
+## Get started
+
+Use the [installation and adoption guide](docs/agentic-workspace-install.md) for the release class you intend to run. Stable support, release candidates, and previews have different evidence and support boundaries; exact install commands and platform claims belong to the selected release and its receipts rather than this README.
+
+For support-bearing installs, follow the [generated install projection](docs/reference/support-bearing-install.md) to the selected release's `distribution-install-readiness.json` receipt and its exact installation command.
+
+### Adopt a repository
+
+Installing the runtime and adopting a repository are separate operations. After installing the selected artifact, run ordinary `start` against the target Git repository:
+
+```bash
+agentic-workspace start --target . \
+  --task "Inspect this repository" \
+  --format json
+```
+
+If the repository is not yet adopted and the selected artifact includes the current adoption owner, Configuration returns the exact repository-adoption request. Follow that request and execute only the returned authorized action. Adoption establishes the small package-owned host footprint and managed `AGENTS.md` fence; it does **not** invent repository policy, choose optional modules, or create Planning, Memory, or Verification state.
+
+Historical `init`/setup command families are not the v1 adoption model.
+
+### In an adopted repository
+
+The repository's small entry point leads to the canonical `workspace-startup` skill. Agent hosts with supported native skill discovery can expose the same skill directly.
+
+For an initial check, ask your agent:
+
+> Use this repository's Agentic Workspace setup to identify the guidance and checks relevant to an API change. Do not modify anything yet.
+
+For direct inspection, use the same `start` boundary with the actual task. After adoption, continue giving your agent ordinary work; the canonical skill teaches it when AW is useful, so you should not need to run a manual command sequence around every change.
+
+[Installation and adoption](docs/agentic-workspace-install.md) · [Everyday use](docs/everyday-use.md) · [CLI reference](docs/reference/cli-catalogue.md)
+
+## Your repository, your rules
+
+AW is designed to fit around the project rather than reorganize it.
+
+A simplified host repository looks like this:
+
+```text
+your-repository/
+├── AGENTS.md              # Small managed entry point inside a repo-owned file
+├── src/, docs/, tests/    # Existing project contents
+└── .agentic-workspace/    # Package integration plus optional owner state
+```
+
+The current public adoption footprint is Configuration-owned and deliberately small. Package-managed skills, ownership/read-profile metadata, provenance, and adoption identity stay distinct from repo-owned configuration, module-owned state, local data, and promoted output.
+
+You can express a repository-wide correction in ordinary language:
+
+> For this repository, read the API contract before changing public response fields.
+
+Or make the scope explicitly local:
+
+> Only on this machine, use this executable path when invoking AW.
+
+The agent can route the change to the appropriate instruction or configuration owner and verify whether it was retained. A promise in chat is not a saved rule, and a local preference should not silently become shared repository policy.
+
+Reusable methods belong in skills. Binding rules belong in instructions or configuration. Current work and evidence stay with the capabilities responsible for them.
+
+The same Configuration-owned footprint is used for adoption, refresh, and removal. De-adoption removes only authenticated package-owned integration, preserves repo-owned configuration and domain state, and refuses to erase edited or unowned content merely because it sits under an AW path.
+
+[Configuration reference](docs/reference/workspace-config.md) · [Repository footprint](docs/reference/installed-surface-catalogue.md)
+
+## Add structure where it helps
+
+AW includes optional first-party capabilities for recurring coordination costs:
+
+**Planning** preserves execution continuity: intended outcome, constraints, progress, blockers, and next action.
+
+**Memory** retains useful observations and lessons that would otherwise be expensive to rediscover. Advice can be reconsidered when its dependencies change; a note is not automatically policy.
+
+**Verification** makes checking procedures, evidence, and known gaps reusable. Passing a check supports the claim it actually tests, not every claim about the finished work.
+
+These are peer capabilities, not mandatory workflow stages. Repositories can use what repays its cost and leave unrelated capabilities out of the current task's context.
+
+Repository-specific rules and procedures do not require a new module. Modules are for independently reusable capabilities with their own domain state or operations.
+
+[Modules and extensions →](docs/package/modules.md)
+
+## Works with agents rather than replacing them
+
+Agentic Workspace is not an autonomous coding agent. It gives the agent already working in the repository better operating context and safer repository-native control.
+
+An agent with runtime access can query current owner state and use supported operations. A repository-only reviewer can follow the same canonical skill and generated read profile to recover relevant recorded intent, constraints, progress, and advice, while live machine state, fresh proof, and effect permission remain unknown.
+
+The ordinary deterministic product semantics live in a shared Rust core. Native, Python, TypeScript, and JSON-facing surfaces project or bind that authority rather than defining separate workflow behavior. The host project's implementation language does not need to match AW's runtime implementation.
+
+Host integrations still differ. Provider independence does not mean every agent host discovers skills identically or every model follows repository guidance perfectly; current support and evidence remain release- and environment-bound.
+
+[Evidence and support →](docs/evidence-and-support.md)
+
+## Trust and support
+
+**AW is not a sandbox.** Repository-configured commands run with the caller's filesystem and credential authority. Review the repository and its execution routes before allowing them to run. Credentials belong in the host or environment's credential facilities, not checked-in AW state.
+
+AW's operation boundaries and verification support do not replace human judgment, independent review, or existing security controls.
+
+Exact package identities, installation commands, runtime versions, operating-system support, and prerelease/stable status are deliberately kept in release-bound or generated owners instead of copied into this landing page.
+
+[Installation and adoption](docs/agentic-workspace-install.md) · [Threat model](docs/security/threat-model.md) · [Evidence and support](docs/evidence-and-support.md)
+
+## Learn more
+
+**Use AW:** [Installation and adoption](docs/agentic-workspace-install.md) · [Everyday use](docs/everyday-use.md) · [Configuration](docs/reference/workspace-config.md)
+
+**Understand AW:** [Product overview](docs/package/overview.md) · [Architecture](docs/architecture.md) · [Design principles](docs/design-principles.md) · [Modules](docs/package/modules.md)
+
+**Look up details:** [CLI reference](docs/reference/cli-catalogue.md) · [Installed surfaces](docs/reference/installed-surface-catalogue.md) · [Full documentation](docs/index.md)
+
+## Contributing
+
+For changes to Agentic Workspace itself, start with the [contributor playbook](docs/maintainer/contributor-playbook.md). Use the repository's [issue templates](https://github.com/rickardvh/agentic-workspace/issues/new/choose) to report a problem or propose a change.
+
+Contributions should make useful work easier to complete, continue, or verify while keeping unnecessary context, framework surface, and repository residue low.
+
+## License
+
+[MIT](LICENSE).

agentic_workspace-1.0.0rc3.dist-info/RECORD

@@ -0,0 +1,14 @@
+agentic_workspace/cli.py,sha256=Cv-6qEhAGBdAqapqhCVvaJprnKMHWO7o69qPzLP08w4,520
+agentic_workspace/codex_provider.py,sha256=RiP5C1yHkoaXqz_e1UL66sN1oVqrAzxAsR6vmGd_l8I,23003
+agentic_workspace/native_core.py,sha256=bvOZGQOdXDqMI4814WESC0dn9EPzdOzGnC01D8onpDI,2815
+agentic_workspace/sealed_codex_transport.py,sha256=n8rs15OXA4-3MTQtq3hnb7XETZosCPPzjUTKWaHMVBM,5192
+agentic_workspace/__init__.py,sha256=REtU4aBp-goYOOX9z8_QroPiDO7S86rfInsibeSUNs8,410
+agentic_workspace/_binding.py,sha256=gfyyjByLQHKoksg04FcH5w7iSCEBMb4gUCqdQaTFTOQ,2797
+agentic_workspace/_native/agentic-workspace-core.exe,sha256=XENuhpI_uJR77k5_HD2-R4uSV6g0qrniqVJIuxE_z2c,18485760
+agentic_workspace/_native/agentic-workspace.exe,sha256=R5KYPVFINdsiuL64z5xBYskr2e9fplrXDu2KGusQC-k,501248
+agentic_workspace/_native/artifact.json,sha256=jvQ0JFr2mnmnvXfUfo-RvX9k1ADiLU1-tcGECcaLB4M,708
+agentic_workspace-1.0.0rc3.dist-info/METADATA,sha256=m1wGW__UD5ZusXiPG9IA7sASXGb4JP9zASxF3GNkJYQ,13793
+agentic_workspace-1.0.0rc3.dist-info/WHEEL,sha256=OA-gEgWbLnh0Tf6JrLOMFR4vOWY4QbBMSZuN6osy-Q0,94
+agentic_workspace-1.0.0rc3.dist-info/entry_points.txt,sha256=3M_M5tF8MeVr98DcZBMvXFmOmXyrBrpKvdibWQ_lY6g,65
+agentic_workspace-1.0.0rc3.dist-info/licenses/LICENSE,sha256=PE4wqbGPdD5Z1Y158xpSdRFzpEXdacvSzwJf7AD7PTQ,1077
+agentic_workspace-1.0.0rc3.dist-info/RECORD,,

agentic_workspace-1.0.0rc3.dist-info/WHEEL

@@ -0,0 +1,4 @@
+Wheel-Version: 1.0
+Generator: hatchling 1.32.0
+Root-Is-Purelib: false
+Tag: py3-none-win_amd64

agentic_workspace-1.0.0rc3.dist-info/entry_points.txt

@@ -0,0 +1,2 @@
+[console_scripts]
+agentic-workspace = agentic_workspace.cli:main

agentic_workspace-1.0.0rc3.dist-info/licenses/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Rickard von Haugwitz
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.