engineering-platform 2.3.101__tar.gz → 2.3.102__tar.gz

{engineering_platform-2.3.101 → engineering_platform-2.3.102}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: engineering-platform
-Version: 2.3.101
+Version: 2.3.102
 Summary: Local-first Engineering Platform execution operations runtime
 Author: Peter van Tol
 License: MIT

{engineering_platform-2.3.101 → engineering_platform-2.3.102}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "engineering-platform"
-version = "2.3.101"
+version = "2.3.102"
 description = "Local-first Engineering Platform execution operations runtime"
 readme = "README.md"
 requires-python = ">=3.14,<3.15"
@@ -20,6 +20,7 @@ engineering-platform = "engineering_platform.submission_cli:main"
 engineering-project-agent = "engineering_platform.project_agent:main"
 engineering-reconciliation-adopt = "engineering_platform.reconciliation_adoption:main"
 engineering-platform-maintenance = "engineering_platform.central_operational_reset:main"
+engineering-platform-system-provisioner = "engineering_platform.system_instance_provisioner:main"
 
 [tool.setuptools]
 package-dir = {"" = "src"}

{engineering_platform-2.3.101 → engineering_platform-2.3.102}/src/engineering_platform/ENGINEERING_PLATFORM_CONFIG.json

@@ -3,7 +3,7 @@
   "platform": {
     "id": "engineering-platform",
     "name": "Engineering Platform",
-    "version": "2.3.101",
+    "version": "2.3.102",
     "generation": 2,
     "documentation_namespace": "engineering-platform",
     "capability_registry_version": 1

{engineering_platform-2.3.101 → engineering_platform-2.3.102}/src/engineering_platform/ENGINEERING_PLATFORM_VERSION.json

@@ -1,15 +1,15 @@
 {
   "bootstrap_contract": "2026.12",
   "checkpoint_format": 1,
-  "dashboard_version": "2.3.101",
+  "dashboard_version": "2.3.102",
   "handoff_protocol": 1,
   "memory_format": 2,
   "minimum_codex_cli": "0.146.0",
   "inbox_protocol": 1,
-  "platform_version": "2.3.101",
+  "platform_version": "2.3.102",
   "report_format": 2,
-  "runner_version": "2.3.101",
+  "runner_version": "2.3.102",
   "status_model": 1,
   "storage_schema": 45,
-  "watcher_version": "2.3.101"
+  "watcher_version": "2.3.102"
 }

{engineering_platform-2.3.101 → engineering_platform-2.3.102}/src/engineering_platform/installation_update_admission.py

@@ -13,6 +13,7 @@ import json
 from pathlib import Path
 import subprocess
 from typing import Mapping
+from typing import Callable
 
 from . import (
     installation_update_activation,
@@ -39,6 +40,9 @@ class InstallationUpdateAdmissionError(ValueError):
     """The exact prepared candidate cannot enter EP pre-cleanup execution."""
 
 
+ServiceInterpreterResolver = Callable[[Path], Path | None]
+
+
 @dataclass(frozen=True)
 class ExecutionAdmission:
     """Durable, token-free proof for exactly one non-operational candidate."""
@@ -208,10 +212,15 @@ def _require_activated_service(
     candidate: PreparedUpdateCandidate,
     *,
     service_home: Path | None = None,
+    service_interpreter: ServiceInterpreterResolver | None = None,
 ) -> None:
     """Keep cleanup bound to the exact activated service and data root."""
     try:
-        selected = server_service.configured_interpreter(Path(plan.data_root), home=service_home)
+        selected = (
+            service_interpreter(Path(plan.data_root))
+            if service_interpreter is not None
+            else server_service.configured_interpreter(Path(plan.data_root), home=service_home)
+        )
     except server_service.ServerServiceError as error:
         raise InstallationUpdateAdmissionError(
             "activated service does not bind the admitted candidate"
@@ -338,6 +347,7 @@ def admitted_candidate(
     *,
     runner: object = subprocess.run,
     service_home: Path | None = None,
+    service_interpreter: ServiceInterpreterResolver | None = None,
 ) -> PreparedUpdateCandidate:
     """Reopen the one candidate already admitted for a resumable update.
 
@@ -397,7 +407,10 @@ def admitted_candidate(
         raise InstallationUpdateAdmissionError("execution admission does not bind the exact prepared candidate")
     if state in {"VERIFIED", "CLEANUP_PENDING", "COMPLETE"}:
         _require_retained_candidate_package(candidate, runner=runner)
-        _require_activated_service(plan, candidate, service_home=service_home)
+        _require_activated_service(
+            plan, candidate, service_home=service_home,
+            service_interpreter=service_interpreter,
+        )
     if admission.schema_version == 3:
         if plan.legacy_adoption is None:
             raise InstallationUpdateAdmissionError("execution admission legacy baseline is unavailable")
@@ -426,17 +439,26 @@ def admitted_candidate(
                 _require_pre_activation_provenance(plan, admission, snapshot)
             elif record != expected:
                 raise InstallationUpdateAdmissionError("activated installation does not bind the admitted legacy candidate")
-            elif server_service.configured_interpreter(Path(plan.data_root), home=service_home) != Path(candidate.interpreter):
+            elif (
+                service_interpreter(Path(plan.data_root)) if service_interpreter is not None
+                else server_service.configured_interpreter(Path(plan.data_root), home=service_home)
+            ) != Path(candidate.interpreter):
                 raise InstallationUpdateAdmissionError("activated service does not bind the admitted legacy candidate")
         elif state == "ACTIVATED":
             if record != expected:
                 raise InstallationUpdateAdmissionError("activated installation does not bind the admitted legacy candidate")
-            if server_service.configured_interpreter(Path(plan.data_root), home=service_home) != Path(candidate.interpreter):
+            if (
+                service_interpreter(Path(plan.data_root)) if service_interpreter is not None
+                else server_service.configured_interpreter(Path(plan.data_root), home=service_home)
+            ) != Path(candidate.interpreter):
                 raise InstallationUpdateAdmissionError("activated service does not bind the admitted legacy candidate")
         elif state in {"VERIFIED", "CLEANUP_PENDING", "COMPLETE"}:
             if record != expected and not _finalized_replacement(record, expected):
                 raise InstallationUpdateAdmissionError("activated installation does not bind the admitted legacy candidate")
-            if server_service.configured_interpreter(Path(plan.data_root), home=service_home) != Path(candidate.interpreter):
+            if (
+                service_interpreter(Path(plan.data_root)) if service_interpreter is not None
+                else server_service.configured_interpreter(Path(plan.data_root), home=service_home)
+            ) != Path(candidate.interpreter):
                 raise InstallationUpdateAdmissionError("activated service does not bind the admitted legacy candidate")
         else:
             raise InstallationUpdateAdmissionError("execution admission operation is invalid")

{engineering_platform-2.3.101 → engineering_platform-2.3.102}/src/engineering_platform/installation_update_composition.py

@@ -32,6 +32,10 @@ from .installation_update_plan import InstallationUpdatePlan
 
 
 MigrationRunner = Callable[..., subprocess.CompletedProcess[str]]
+ActivationAction = Callable[
+    [InstallationUpdatePlan, Path, Mapping[str, object] | None],
+    Mapping[str, object],
+]
 
 
 class InstallationUpdateCompositionError(ValueError):
@@ -52,6 +56,8 @@ class InstallationUpdateOperationalActions:
     quiesce: EvidenceAction
     verify: EvidenceAction
     quiesce_preflight: EvidenceAction | None = None
+    activate: ActivationAction | None = None
+    service_interpreter: Callable[[Path], Path | None] | None = None
 
 
 def _evidence(value: Mapping[str, object], step: str) -> dict[str, object]:
@@ -72,11 +78,13 @@ def _admitted_target(
     admission: ExecutionAdmission,
     runner: MigrationRunner,
     service_home: Path | None = None,
+    service_interpreter: Callable[[Path], Path | None] | None = None,
 ) -> Path:
     """Resolve only the durable OI-4c candidate launcher for this operation."""
     try:
         candidate = installation_update_admission.admitted_candidate(
             plan, admission, runner=runner, service_home=service_home,
+            service_interpreter=service_interpreter,
         )
     except installation_update_admission.InstallationUpdateAdmissionError as error:
         raise InstallationUpdateCompositionError("installation update execution admission is invalid") from error
@@ -158,9 +166,13 @@ def _bound_target(
     admission: ExecutionAdmission,
     runner: MigrationRunner,
     service_home: Path | None = None,
+    service_interpreter: Callable[[Path], Path | None] | None = None,
 ) -> Path:
     """Require a recovery attempt to keep the target proven at inventory."""
-    target = _admitted_target(plan, admission=admission, runner=runner, service_home=service_home)
+    target = _admitted_target(
+        plan, admission=admission, runner=runner, service_home=service_home,
+        service_interpreter=service_interpreter,
+    )
     try:
         events = status(Path(plan.data_root), plan.operation_id)["events"]
     except InstallationUpdateOperationError as error:
@@ -184,10 +196,12 @@ def _verify(
     action: EvidenceAction,
     runner: MigrationRunner,
     service_home: Path | None = None,
+    service_interpreter: Callable[[Path], Path | None] | None = None,
 ) -> Mapping[str, object]:
     """Keep verification bound to the runtime activated from the inventoried path."""
     expected = _bound_target(
         plan, admission=admission, runner=runner, service_home=service_home,
+        service_interpreter=service_interpreter,
     )
     try:
         record = operational_installation_record.load(Path(plan.data_root))
@@ -226,6 +240,7 @@ def compose(plan: InstallationUpdatePlan, *, admission: ExecutionAdmission,
     # repeats the same durable lookup while that executor owns the lock.
     admitted_target = _admitted_target(
         plan, admission=admission, runner=migration_runner, service_home=activation_home,
+        service_interpreter=actions.service_interpreter,
     )
     pre_activation_record = _admitted_pre_activation_record(admission)
     try:
@@ -246,6 +261,7 @@ def compose(plan: InstallationUpdatePlan, *, admission: ExecutionAdmission,
             _admitted_target(
                 bound_plan, admission=admission, runner=migration_runner,
                 service_home=activation_home,
+                service_interpreter=actions.service_interpreter,
             )
             return action(bound_plan)
         return invoke
@@ -255,6 +271,7 @@ def compose(plan: InstallationUpdatePlan, *, admission: ExecutionAdmission,
             _admitted_target(
                 bound_plan, admission=admission, runner=migration_runner,
                 service_home=activation_home,
+                service_interpreter=actions.service_interpreter,
             )
             _evidence(actions.quiesce(bound_plan), "retained quiescence")
             return action(bound_plan)
@@ -264,6 +281,7 @@ def compose(plan: InstallationUpdatePlan, *, admission: ExecutionAdmission,
         target = _bound_target(
             bound_plan, admission=admission, runner=migration_runner,
             service_home=activation_home,
+            service_interpreter=actions.service_interpreter,
         )
         _evidence(actions.quiesce(bound_plan), "retained quiescence")
         return installation_update_migration.migrate(
@@ -276,6 +294,7 @@ def compose(plan: InstallationUpdatePlan, *, admission: ExecutionAdmission,
             target=_admitted_target(
                 bound_plan, admission=admission, runner=migration_runner,
                 service_home=activation_home,
+                service_interpreter=actions.service_interpreter,
             ),
             admission=admission,
             action=actions.inventory,
@@ -284,16 +303,29 @@ def compose(plan: InstallationUpdatePlan, *, admission: ExecutionAdmission,
         quiesce=guarded(actions.quiesce),
         backup=after_quiescence(installation_update_backup.backup),
         migrate=migrate,
-        activate=lambda bound_plan: installation_update_activation.activate(
-            bound_plan,
-            interpreter=_bound_target(
-                bound_plan, admission=admission, runner=migration_runner,
-                service_home=activation_home,
-            ),
-            pre_activation_record=pre_activation_record,
-            home=activation_home,
-            runner=activation_runner,
-            package_runner=migration_runner,
+        activate=lambda bound_plan: (
+            actions.activate(
+                bound_plan,
+                _bound_target(
+                    bound_plan, admission=admission, runner=migration_runner,
+                    service_home=activation_home,
+                    service_interpreter=actions.service_interpreter,
+                ),
+                pre_activation_record,
+            )
+            if actions.activate is not None
+            else installation_update_activation.activate(
+                bound_plan,
+                interpreter=_bound_target(
+                    bound_plan, admission=admission, runner=migration_runner,
+                    service_home=activation_home,
+                    service_interpreter=actions.service_interpreter,
+                ),
+                pre_activation_record=pre_activation_record,
+                home=activation_home,
+                runner=activation_runner,
+                package_runner=migration_runner,
+            )
         ),
         verify=lambda bound_plan: _verify(
             bound_plan,
@@ -301,6 +333,7 @@ def compose(plan: InstallationUpdatePlan, *, admission: ExecutionAdmission,
             action=actions.verify,
             runner=migration_runner,
             service_home=activation_home,
+            service_interpreter=actions.service_interpreter,
         ),
         expected_activation=expected_activation,
         quiesce_preflight=(

{engineering_platform-2.3.101 → engineering_platform-2.3.102}/src/engineering_platform/installation_update_plan.py

@@ -33,6 +33,7 @@ class InstallationUpdatePlan:
     cleanup_targets: tuple[str, ...]
     steps: tuple[str, ...]
     legacy_adoption: dict[str, object] | None = None
+    target_runtime_venv: str | None = None
 
     def payload(self) -> dict[str, object]:
         value = asdict(self)
@@ -41,6 +42,8 @@ class InstallationUpdatePlan:
         # non-empty legacy evidence is always explicit and immutable.
         if value["legacy_adoption"] is None:
             del value["legacy_adoption"]
+        if value["target_runtime_venv"] is None:
+            del value["target_runtime_venv"]
         return value
 
 
@@ -72,7 +75,8 @@ def verify_exact_artifact(plan: InstallationUpdatePlan) -> dict[str, str]:
 
 
 def prepare(data_root: Path, *, operation_id: str, artifact: Path, target_version: str,
-            target_digest: str, target_source_revision: str) -> InstallationUpdatePlan:
+            target_digest: str, target_source_revision: str,
+            target_runtime_venv: Path | None = None) -> InstallationUpdatePlan:
     """Bind an update to one record and wheel without changing the machine.
 
     Callers must execute this returned, exact plan under the EP installation
@@ -121,6 +125,19 @@ def prepare(data_root: Path, *, operation_id: str, artifact: Path, target_versio
     if _digest(exact_artifact) != target_digest:
         raise InstallationUpdatePlanError("target artifact does not match the requested digest")
     operation_root = root / "operations" / operation_id
+    runtime_venv: str | None = None
+    if target_runtime_venv is not None:
+        candidate = Path(target_runtime_venv).expanduser()
+        slot = "sha256-" + target_digest.removeprefix("sha256:")
+        if (
+            not candidate.is_absolute()
+            or candidate.name != "venv"
+            or candidate.parent.name != slot
+            or candidate.parent.parent.name != "slots"
+            or candidate.parent.parent.parent.name != "runtimes"
+        ):
+            raise InstallationUpdatePlanError("target runtime slot is invalid")
+        runtime_venv = str(candidate.absolute())
     cleanup = tuple(str(path) for path in (
         operation_root / "build", operation_root / "download", operation_root / "pip-cache",
     ))
@@ -133,4 +150,5 @@ def prepare(data_root: Path, *, operation_id: str, artifact: Path, target_versio
         steps=("INSTALLATION_LOCK", "INVENTORY_AND_COMPATIBILITY", "EXACT_ARTIFACT",
                "QUIESCE", "BACKUP_AND_MIGRATION", "ACTIVATE", "VERIFY", "CLEANUP"),
         legacy_adoption=legacy,
+        target_runtime_venv=runtime_venv,
     )

{engineering_platform-2.3.101 → engineering_platform-2.3.102}/src/engineering_platform/installation_update_preparation.py

@@ -130,7 +130,11 @@ def _paths(plan: InstallationUpdatePlan) -> _OperationPaths:
     # the staged filename itself PEP 427-compatible so isolated ``pip`` can
     # install it without relying on an original temporary filename.
     staged = download / f"engineering_platform-{plan.target_version}-py3-none-any.whl"
-    candidate = operation / _CANDIDATE_DIRECTORY
+    candidate = (
+        Path(plan.target_runtime_venv).expanduser().absolute()
+        if plan.target_runtime_venv is not None
+        else operation / _CANDIDATE_DIRECTORY
+    )
     paths = _OperationPaths(
         root=root,
         operation=operation,
@@ -145,11 +149,12 @@ def _paths(plan: InstallationUpdatePlan) -> _OperationPaths:
         ("update operation", paths.operation),
         ("operation download directory", paths.download),
         ("staged operation artifact", paths.staged_artifact),
-        ("candidate runtime", paths.candidate),
         ("operation pip cache", paths.pip_cache),
         ("candidate runtime marker", paths.marker),
     ):
         _contained(root, path, label)
+    if plan.target_runtime_venv is None:
+        _contained(root, paths.candidate, "candidate runtime")
     return paths
 
 
@@ -250,13 +255,53 @@ def _ensure_marker(plan: InstallationUpdatePlan, paths: _OperationPaths, staged:
         _read_marker(plan, paths, staged)
         return
     if paths.candidate.exists() or paths.candidate.is_symlink():
-        raise InstallationUpdatePreparationError("candidate runtime exists without operation identity")
+        if plan.target_runtime_venv is None:
+            raise InstallationUpdatePreparationError("candidate runtime exists without operation identity")
+        _read_runtime_slot_receipt(plan, paths)
     try:
         _write_marker(paths.marker, expected)
     except OSError as error:
         raise InstallationUpdatePreparationError("candidate runtime marker could not be retained") from error
 
 
+def _runtime_slot_receipt(plan: InstallationUpdatePlan, paths: _OperationPaths) -> dict[str, object]:
+    return {
+        "schema_version": 1,
+        "version": plan.target_version,
+        "artifact_digest": plan.target_digest,
+        "source_revision": plan.target_source_revision,
+        "venv": str(paths.candidate),
+    }
+
+
+def _runtime_slot_receipt_path(paths: _OperationPaths) -> Path:
+    return paths.candidate.parent / "runtime-slot.json"
+
+
+def _read_runtime_slot_receipt(plan: InstallationUpdatePlan, paths: _OperationPaths) -> None:
+    path = _runtime_slot_receipt_path(paths)
+    if path.is_symlink() or not path.is_file():
+        raise InstallationUpdatePreparationError("shared runtime slot lacks exact artifact identity")
+    try:
+        observed = json.loads(path.read_text(encoding="utf-8"))
+    except (OSError, json.JSONDecodeError) as error:
+        raise InstallationUpdatePreparationError("shared runtime slot identity is unreadable") from error
+    if observed != _runtime_slot_receipt(plan, paths):
+        raise InstallationUpdatePreparationError("shared runtime slot identity mismatch")
+
+
+def _ensure_runtime_slot_receipt(plan: InstallationUpdatePlan, paths: _OperationPaths) -> None:
+    if plan.target_runtime_venv is None:
+        return
+    path = _runtime_slot_receipt_path(paths)
+    expected = _runtime_slot_receipt(plan, paths)
+    if path.exists() or path.is_symlink():
+        _read_runtime_slot_receipt(plan, paths)
+        return
+    _write_marker(path, expected)
+    _read_runtime_slot_receipt(plan, paths)
+
+
 def _verified_candidate(
     plan: InstallationUpdatePlan,
     paths: _OperationPaths,
@@ -345,6 +390,10 @@ def staged_execution_plan(
             target_version=plan.target_version,
             target_digest=plan.target_digest,
             target_source_revision=plan.target_source_revision,
+            target_runtime_venv=(
+                None if plan.target_runtime_venv is None
+                else Path(plan.target_runtime_venv)
+            ),
         )
     except installation_update_plan.InstallationUpdatePlanError as error:
         raise InstallationUpdatePreparationError("staged candidate cannot be rebound to the registered installation") from error
@@ -352,6 +401,7 @@ def staged_execution_plan(
         "operation_id", "installation_id", "data_root", "current_version",
         "current_digest", "target_version", "target_digest",
         "target_source_revision", "cleanup_targets", "steps", "legacy_adoption",
+        "target_runtime_venv",
     )
     if any(getattr(rebound, field) != getattr(plan, field) for field in unchanged):
         raise InstallationUpdatePreparationError("registered installation changed before staged candidate binding")
@@ -517,6 +567,7 @@ def prepare_candidate(
         _ensure_marker(plan, paths, staged)
         _create_or_recover_venv(paths, builder=builder, runner=runner)
         package = _install_or_verify_candidate(plan, paths, staged=staged, runner=runner)
+        _ensure_runtime_slot_receipt(plan, paths)
         return PreparedUpdateCandidate(
             operation_id=plan.operation_id,
             installation_id=plan.installation_id,

{engineering_platform-2.3.101 → engineering_platform-2.3.102}/src/engineering_platform/platform_version.py

@@ -12,7 +12,7 @@ from .storage import ENGINEERING_STORAGE_SCHEMA_VERSION
 
 SEMVER = re.compile(r"^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)$")
 CONTRACT = re.compile(r"^(\d{4})\.(0[1-9]|1[0-2])$")
-CURRENT_PLATFORM_VERSION = "2.3.101"
+CURRENT_PLATFORM_VERSION = "2.3.102"
 MANIFEST_FIELDS = frozenset(
     {
         "platform_version",

{engineering_platform-2.3.101 → engineering_platform-2.3.102}/src/engineering_platform/provider_readiness.py

@@ -6,18 +6,29 @@ retries authentication on behalf of an execution.
 """
 from __future__ import annotations
 
+import os
 from pathlib import Path
 import re
 import shutil
 import subprocess
 
-from .providers import CodexCliProvider, LocalProcessProvider, codex_cli_executable
+from .providers import (
+    CodexCliProvider, LocalProcessProvider, codex_cli_executable,
+    github_cli_executable, MANAGED_GITHUB_CLI_EXECUTABLE_ENVIRONMENT,
+)
 
 
 _VERSION = re.compile(r"\b\d+(?:\.\d+)+(?:[-+][0-9A-Za-z.]+)?\b")
 CODEX_READINESS_TIMEOUT_SECONDS = 2
 
 
+def _github_executable() -> str | None:
+    """Keep the legacy PATH observer while honoring a pinned system context."""
+    if MANAGED_GITHUB_CLI_EXECUTABLE_ENVIRONMENT in os.environ:
+        return github_cli_executable()
+    return shutil.which("gh")
+
+
 def _classify(result: subprocess.CompletedProcess[str] | None) -> str:
     if result is None:
         return "CHECK_FAILED"
@@ -58,7 +69,7 @@ def runtime_details(root: Path) -> dict[str, dict[str, str]]:
         codex_version = _version(CodexCliProvider().command("--version", timeout=CODEX_READINESS_TIMEOUT_SECONDS)) if codex_path else ""
     except (OSError, subprocess.TimeoutExpired):
         codex_version = ""
-    github_path = shutil.which("gh") or ""
+    github_path = _github_executable() or ""
     try:
         github_version = _version(LocalProcessProvider().execute(root, (github_path, "--version"))) if github_path else ""
     except OSError:
@@ -98,7 +109,7 @@ def host_status(root: Path, *, require_github: bool = True) -> dict[str, dict[st
     }
     if not require_github:
         return result
-    github_path = shutil.which("gh")
+    github_path = _github_executable()
     if github_path is None:
         result["github"] = {"provider": "GITHUB", "state": "UNAVAILABLE"}
         return result
@@ -117,11 +128,12 @@ def status(root: Path, *, require_github: bool = True) -> dict[str, dict[str, st
     result = host_status(root, require_github=False)
     if not require_github:
         return result
-    if shutil.which("gh") is None:
+    github_path = _github_executable()
+    if github_path is None:
         result["github"] = {"provider": "GITHUB", "state": "UNAVAILABLE"}
         return result
     try:
-        github_result = LocalProcessProvider().execute(root, ("gh", "auth", "status", "--hostname", "github.com"))
+        github_result = LocalProcessProvider().execute(root, (github_path, "auth", "status", "--hostname", "github.com"))
     except OSError:
         github_result = None
     github_state = _classify(github_result)
@@ -130,8 +142,13 @@ def status(root: Path, *, require_github: bool = True) -> dict[str, dict[str, st
             # `gh repo view --json` uses GitHub's GraphQL quota. Readiness only
             # needs a cheap repository-access proof, so use the REST endpoint
             # and avoid turning an exhausted GraphQL quota into a login repair.
+            repository_executable = (
+                github_path
+                if MANAGED_GITHUB_CLI_EXECUTABLE_ENVIRONMENT in os.environ
+                else "gh"
+            )
             repository_result = LocalProcessProvider().execute(
-                root, ("gh", "api", "repos/{owner}/{repo}", "--jq", ".full_name")
+                root, (repository_executable, "api", "repos/{owner}/{repo}", "--jq", ".full_name")
             )
         except OSError:
             repository_result = None

{engineering_platform-2.3.101 → engineering_platform-2.3.102}/src/engineering_platform/providers.py

@@ -347,6 +347,7 @@ class PrivateRemoteAccessProvider(Protocol):
 
 
 MANAGED_CODEX_CLI_PREFIX_ENVIRONMENT = "EP_MANAGED_CODEX_CLI_PREFIX"
+MANAGED_GITHUB_CLI_EXECUTABLE_ENVIRONMENT = "EP_GITHUB_CLI_EXECUTABLE"
 
 
 def default_engineering_platform_codex_cli_prefix() -> Path:
@@ -380,6 +381,23 @@ def codex_cli_executable() -> str | None:
     return None
 
 
+def github_cli_executable() -> str | None:
+    """Select an instance-owned gh executable when the service pins one.
+
+    User-owned Project Agents retain their ordinary user/PATH behavior.  A
+    system Server LaunchDaemon always receives the environment variable and
+    therefore fails closed instead of falling back when its owned executable
+    is missing or substituted.
+    """
+    configured = os.environ.get(MANAGED_GITHUB_CLI_EXECUTABLE_ENVIRONMENT)
+    if configured is not None:
+        candidate = Path(configured).expanduser()
+        if candidate.is_absolute() and candidate.is_file() and os.access(candidate, os.X_OK):
+            return str(candidate.absolute())
+        return None
+    return shutil.which("gh")
+
+
 class ProviderOutputLimitExceeded(RuntimeError):
     """An advisory provider invocation exceeded its retained output budget."""
 
@@ -576,7 +594,10 @@ class GitHubProvider:
         return ProviderStatus("github", "configured", qualified, remote.stdout.strip() if qualified else "GitHub origin unavailable")
 
     def github(self, *args: str) -> str:
-        completed = subprocess.run(("gh", *args), text=True, capture_output=True, check=False)
+        executable = github_cli_executable()
+        if executable is None:
+            raise RuntimeError("Engineering Platform GitHub CLI is unavailable")
+        completed = subprocess.run((executable, *args), text=True, capture_output=True, check=False)
         if completed.returncode:
             raise RuntimeError(completed.stderr.strip() or "GitHub provider command failed")
         return completed.stdout.strip()