flashnode 0.3.2__tar.gz → 0.3.4__tar.gz

{flashnode-0.3.2 → flashnode-0.3.4}/PKG-INFO

@@ -1,13 +1,13 @@
 Metadata-Version: 2.4
 Name: flashnode
-Version: 0.3.2
+Version: 0.3.4
 Summary: Open host agent for the FlashML fragmented-compute network: join, benchmark, execute sandboxed ML tasks, earn contribution credits.
 License: Apache-2.0
 Project-URL: Homepage, https://github.com/Zolli-Labs/flashnode
 Requires-Python: >=3.10
 Description-Content-Type: text/markdown
 License-File: LICENSE
-Requires-Dist: flashruntime<0.5,>=0.4.1
+Requires-Dist: flashruntime<0.5,>=0.4.3
 Requires-Dist: psutil>=5.9
 Requires-Dist: websockets>=12
 Requires-Dist: cryptography>=42

{flashnode-0.3.2 → flashnode-0.3.4}/flashnode/agent/cli.py

@@ -174,9 +174,10 @@ def _work(args: list[str]) -> int:
     )
     parser.add_argument(
         "--runner",
-        choices=["subprocess", "docker", "argv"],
+        choices=["subprocess", "docker", "argv", "trusted"],
         default=os.environ.get("FLASHNODE_RUNNER", "subprocess"),
-        help="task execution tier (docker/argv need the docker CLI on PATH)",
+        help="task execution tier (docker/argv need the docker CLI on PATH; "
+             "trusted runs pool jobs unsandboxed — opt-in only)",
     )
     parser.add_argument("--max-tasks", type=int, default=None)
     parser.add_argument("--poll-seconds", type=float, default=1.0)
@@ -260,6 +261,19 @@ def _work(args: list[str]) -> int:
                     os.environ.get("FLASHNODE_MAX_OUTPUT_BYTES", str(2 * 1024**3))
                 ),
             )
+    elif opts.runner == "trusted":
+        # Deliberately OUTSIDE the ("docker", "argv") branch above: this
+        # tier has no container and no docker CLI dependency, so the docker
+        # doctor gate has nothing to check — same as subprocess. The only
+        # gate here is the operator typing --runner trusted at all.
+        from flashnode.executor.trusted_runner import TrustedArgvRunner
+
+        print(
+            "trusted runner: pool jobs from your team run UNSANDBOXED on this\n"
+            "machine — no container, no network isolation. Only continue if\n"
+            "every member of your pool is someone you trust to run code here."
+        )
+        runner = TrustedArgvRunner()
 
     workdir_base = os.environ.get("FLASHNODE_WORKDIR") or None
 
@@ -280,6 +294,11 @@ def _work(args: list[str]) -> int:
         # tasks burn every attempt against ArgvDockerRunner's payload
         # rejection before the job ever fails for real.
         module_capable=(opts.runner != "argv"),
+        # Set true ONLY by the explicit --runner trusted opt-in, never
+        # inferred — the scheduler's placement gate treats this field as
+        # fail-closed (flashruntime.scheduler), so a node that merely has a
+        # shell available must not advertise it.
+        unsandboxed_argv_capable=(opts.runner == "trusted"),
     )
     client.register(registration)
     from flashnode.doctor import NON_BLOCKING_STATUSES, run_checks

{flashnode-0.3.2 → flashnode-0.3.4}/flashnode/executor/argv_runner.py

@@ -20,6 +20,7 @@ import re
 import subprocess
 from pathlib import Path
 
+from flashnode.executor.evidence import image_digest
 from flashnode.executor.hardening import container_name, harden_args
 from flashnode.executor.images import DEFAULT_ALLOWED_IMAGE_PREFIXES, image_is_allowed
 from flashnode.executor.runner import TaskExecutionError
@@ -43,8 +44,14 @@ class ArgvDockerRunner:
         self.memory_gb = memory_gb
         self.timeout_seconds = timeout_seconds
         self.max_output_bytes = max_output_bytes
+        # What the LAST run measured, read by ExecutorLoop for
+        # ExecutionEvidence — see SubprocessRunner for why both reset below.
+        self.last_exit_code: int | None = None
+        self.last_image_digest: str = ""
 
     def run(self, payload: dict, workdir: Path, inputs: dict[str, Path]) -> Path:
+        self.last_exit_code = None
+        self.last_image_digest = ""
         argv = payload.get("argv")
         if not argv or not isinstance(argv, list) or not all(isinstance(t, str) for t in argv):
             raise TaskExecutionError("payload 'argv' must be a non-empty list of strings")
@@ -105,9 +112,12 @@ class ArgvDockerRunner:
             # (a subclass of OSError). Degrade to a failed task, not a dead
             # agent — execute_one only catches TaskExecutionError/LeaseLost.
             raise TaskExecutionError(f"docker is unavailable: {exc}") from exc
+        self.last_exit_code = proc.returncode
         if proc.returncode != 0:
             tail = proc.stderr.decode(errors="replace")[-800:]
             raise TaskExecutionError(f"task exited {proc.returncode}: {tail}")
+        # Asked of the daemon, not read off the payload — see DockerRunner.
+        self.last_image_digest = image_digest(image)
 
         # metrics.json is load-bearing, not a preference: CommandRecipe sets
         # commit_key to <prefix>/metrics.json and the coordinator validates

{flashnode-0.3.2 → flashnode-0.3.4}/flashnode/executor/client.py

@@ -19,7 +19,12 @@ import urllib.error
 import urllib.request
 from pathlib import Path
 
-from flashruntime.protocol.v1alpha1 import Lease, NodeHeartbeat, NodeRegistration
+from flashruntime.protocol.v1alpha1 import (
+    ExecutionEvidence,
+    Lease,
+    NodeHeartbeat,
+    NodeRegistration,
+)
 
 
 class LeaseLost(Exception):
@@ -122,11 +127,25 @@ class CoordinatorClient:
         if status != 200:
             raise RuntimeError(f"attempt heartbeat failed ({status}): {body}")
 
-    def complete(self, lease_id: str, output_sha256: str) -> bool:
+    def complete(
+        self,
+        lease_id: str,
+        output_sha256: str,
+        evidence: ExecutionEvidence | None = None,
+    ) -> bool:
+        """Commit this attempt, optionally saying what the run looked like.
+
+        `evidence` is a keyword with a default so every existing caller keeps
+        working, and the body is byte-for-byte the one previous releases sent
+        when there is nothing to report — this agent may be talking to a
+        coordinator that predates the field, and an empty block is not the
+        same statement as no block.
+        """
+        payload: dict = {"output_sha256": output_sha256}
+        if evidence is not None:
+            payload["evidence"] = evidence.model_dump(mode="json")
         status, body = self._json(
-            "POST",
-            f"/v1alpha1/attempts/{lease_id}/complete",
-            {"output_sha256": output_sha256},
+            "POST", f"/v1alpha1/attempts/{lease_id}/complete", payload
         )
         if status != 200:
             raise RuntimeError(f"complete failed ({status}): {body}")

{flashnode-0.3.2 → flashnode-0.3.4}/flashnode/executor/docker_runner.py

@@ -19,6 +19,7 @@ import json
 import subprocess
 from pathlib import Path
 
+from flashnode.executor.evidence import image_digest
 from flashnode.executor.hardening import CONTAINER_WORKDIR, container_name, harden_args
 from flashnode.executor.images import DEFAULT_ALLOWED_IMAGE_PREFIXES, image_is_allowed
 from flashnode.executor.runner import DEFAULT_ALLOWED_MODULES, TaskExecutionError
@@ -44,8 +45,14 @@ class DockerRunner:
         self.cpus = cpus
         self.memory_gb = memory_gb
         self.timeout_seconds = timeout_seconds
+        # What the LAST run measured, read by ExecutorLoop for
+        # ExecutionEvidence — see SubprocessRunner for why both reset below.
+        self.last_exit_code: int | None = None
+        self.last_image_digest: str = ""
 
     def run(self, payload: dict, workdir: Path, inputs: dict[str, Path]) -> Path:
+        self.last_exit_code = None
+        self.last_image_digest = ""
         module = payload.get("module", "")
         if module not in self.allowed_modules:
             raise TaskExecutionError(f"module {module!r} is not allowlisted — refusing to run")
@@ -110,9 +117,14 @@ class DockerRunner:
             # (a subclass of OSError). Degrade to a failed task, not a dead
             # agent — execute_one only catches TaskExecutionError/LeaseLost.
             raise TaskExecutionError(f"docker is unavailable: {exc}") from exc
+        self.last_exit_code = proc.returncode
         if proc.returncode != 0:
             tail = proc.stderr.decode(errors="replace")[-800:]
             raise TaskExecutionError(f"task exited {proc.returncode}: {tail}")
+        # Asked of the daemon, not read off the payload: the point of the
+        # field is which bytes ran here, and the payload only says which
+        # bytes were asked for. "" when the daemon will not say.
+        self.last_image_digest = image_digest(image)
         if not (outdir / "metrics.json").is_file():
             raise TaskExecutionError("task produced no metrics.json — nothing to commit")
         return outdir

flashnode-0.3.4/flashnode/executor/evidence.py

@@ -0,0 +1,258 @@
+"""What this agent can honestly say about a run it just finished.
+
+Fills `flashruntime.protocol.v1alpha1.ExecutionEvidence`, the optional block
+the executor attaches to `complete`. Three sources, all best-effort:
+
+- **wall clock** — measured by the loop around the runner, always available.
+- **CPU / GPU utilisation** — sampled on a background thread while the task
+  runs (`ResourceSampler`), averaged at the end.
+- **image digest** — asked of the local docker daemon after the container
+  exits (`image_digest`).
+
+THE ONE RULE. A value that could not be measured is reported as `None` (or
+`""` for the digest), never as `0`. The temptation runs entirely one way:
+`sum([]) / max(len([]), 1)` is 0.0, `psutil.cpu_percent()`'s first call in a
+process is 0.0, an unparsed `docker` error string is truthy. Each of those is
+a fabricated measurement that a verifier downstream cannot tell from a real
+one — and "0% CPU on a completed task" is not a missing field, it is an
+accusation. Every path below that could produce a zero by accident is written
+so it produces absence instead, and each has a test.
+
+NO NEW DEPENDENCIES. `psutil` is already an agent dependency (inventory/);
+GPU utilisation goes through the same `nvidia-smi` subprocess as the
+registration probe. This code runs on strangers' machines and every
+dependency is attack surface (AGENTS.md).
+
+Every probe takes its subprocess/sampler as a PARAMETER, resolved at call
+time, so the whole test suite runs with no NVIDIA driver and no docker
+daemon — the shape `inventory/gpu.py` and `doctor.py` established.
+"""
+
+from __future__ import annotations
+
+import math
+import re
+import subprocess
+import threading
+import time
+from typing import Callable
+
+from flashnode.inventory.gpu import probe_gpu_utilisation
+
+__all__ = ["ResourceSampler", "default_cpu_probe", "image_digest"]
+
+#: A probe answers "what is it now?" — a percentage, or None for "could not
+#: read it". Never raises for the caller; the sampler defends anyway.
+Probe = Callable[[], "float | None"]
+
+CommandRunner = Callable[..., subprocess.CompletedProcess]
+
+#: `docker image inspect` reads metadata the daemon already holds. Short on
+#: purpose: this runs on the commit path, and a wedged daemon must cost the
+#: field, not the task's result.
+DIGEST_TIMEOUT_S = 10
+
+#: What a content-addressable image identity looks like. Anything else the
+#: daemon prints — a prose error, `<no value>` from a template miss, an empty
+#: line — is NOT a digest and must not be forwarded as one.
+_DIGEST_RE = re.compile(r"^[a-z0-9]+:[0-9a-f]{32,}$")
+
+
+def _text(raw: object) -> str:
+    """Subprocess output as a string, or `""` for anything that is not one.
+
+    Total on purpose, and not quite the shape `inventory/gpu.py` uses: the
+    runner is a parameter, so `stdout` is whatever a caller's stub put there.
+    A duck-typed object with a `.decode` that returns another object would
+    otherwise walk a non-string all the way to the regex below and raise
+    TypeError from inside a best-effort probe.
+    """
+    if isinstance(raw, str):
+        return raw
+    if isinstance(raw, (bytes, bytearray)):
+        return bytes(raw).decode(errors="replace")
+    return ""
+
+
+def _reading(value: object) -> float | None:
+    """One probe answer as a number the mean can survive, or None.
+
+    NaN is the reason this exists: a single NaN sample turns a whole run's
+    mean into NaN, which serialises to something no verifier can read. `bool`
+    is excluded explicitly — it is a subclass of `int`, so `True` would
+    otherwise average in as 1.0%.
+    """
+    if isinstance(value, bool) or not isinstance(value, (int, float)):
+        return None
+    number = float(value)
+    return number if math.isfinite(number) else None
+
+
+def _mean(values: list[float]) -> float | None:
+    """The average, or None for no samples at all.
+
+    NOT 0.0. This one line is the whole honesty contract of this module: an
+    empty list means nothing was measured, and a verifier reading 0.0 would
+    see a machine that did nothing on a task it completed.
+    """
+    if not values:
+        return None
+    return sum(values) / len(values)
+
+
+def default_cpu_probe() -> Probe:
+    """A host-wide CPU probe, with psutil's meaningless first reading burned.
+
+    `psutil.cpu_percent(interval=None)` reports usage since the LAST call, so
+    its first answer in a process is 0.0 by construction — a fabricated zero
+    that looks exactly like an idle machine. That call happens here, at
+    construction, before the task starts; every reading the sampler takes
+    afterwards covers a real window.
+
+    Host-wide, not task-scoped: a volunteer's machine has other things
+    running on it. That makes a HIGH reading weak evidence and a LOW one the
+    interesting direction — a completed training task on a machine that never
+    got busy. `ExecutionEvidence` says so in the field's own docstring.
+
+    No psutil (a stripped install) ⇒ a probe that always says None.
+    """
+    try:
+        import psutil
+    except Exception:  # noqa: BLE001 - an optional field must never break the run
+        return lambda: None
+
+    try:
+        psutil.cpu_percent(interval=None)  # prime; the answer is meaningless
+    except Exception:  # noqa: BLE001
+        return lambda: None
+
+    def probe() -> float | None:
+        return psutil.cpu_percent(interval=None)
+
+    return probe
+
+
+class ResourceSampler(threading.Thread):
+    """Averages utilisation across one task's run.
+
+    Daemon thread, like `_AttemptHeartbeat` and `_CheckpointRelay`: telemetry
+    must never be the reason an agent will not exit. Started before the
+    runner and stopped after it; `stop()` returns
+    `(cpu_percent_mean, gpu_util_percent_mean)`, either of which may be None.
+
+    Two cadences, because the two probes cost wildly different amounts.
+    Reading CPU is a memory access; reading GPU utilisation spawns
+    `nvidia-smi`. Sampling both at one interval means either a useless CPU
+    trace or thousands of subprocesses over a long job on a machine somebody
+    lent us.
+    """
+
+    def __init__(
+        self,
+        cpu_probe: Probe | None = None,
+        gpu_probe: Probe | None = None,
+        cpu_interval_s: float = 1.0,
+        gpu_interval_s: float = 5.0,
+    ):
+        super().__init__(daemon=True)
+        # Built now, not on the thread: `default_cpu_probe` burns psutil's
+        # priming reading, and that has to happen before the run starts.
+        self._cpu_probe = cpu_probe if cpu_probe is not None else default_cpu_probe()
+        self._gpu_probe = gpu_probe if gpu_probe is not None else probe_gpu_utilisation
+        self._cpu_interval_s = cpu_interval_s
+        self._gpu_interval_s = gpu_interval_s
+        self._halt = threading.Event()
+        self._cpu: list[float] = []
+        self._gpu: list[float] = []
+        #: Set False the first time the GPU probe answers "nothing here", so
+        #: a host with no driver — the overwhelmingly common case — is asked
+        #: once instead of every few seconds for the length of the job.
+        self._gpu_worth_asking = True
+
+    def run(self) -> None:
+        next_gpu = 0.0  # sample the GPU on the first tick
+        while not self._halt.wait(self._cpu_interval_s):
+            self._sample_cpu()
+            now = time.monotonic()
+            if now >= next_gpu:
+                self._sample_gpu()
+                next_gpu = now + self._gpu_interval_s
+
+    def stop(self) -> tuple[float | None, float | None]:
+        """Halt, take one last reading, and report the means.
+
+        The final reading is not a courtesy: a task shorter than one tick
+        would otherwise produce zero samples, and "no samples" on every fast
+        task is how a fabricated default gets added later. It measures the
+        window that genuinely just elapsed.
+        """
+        self._halt.set()
+        if self.is_alive():
+            self.join(timeout=self._cpu_interval_s + 5.0)
+        self._sample_cpu()
+        if not self._gpu:  # only to rescue a run too short for a single tick
+            self._sample_gpu()
+        return _mean(self._cpu), _mean(self._gpu)
+
+    # -- sampling ------------------------------------------------------------
+
+    def _ask(self, probe: Probe) -> float | None:
+        """One probe call that cannot take the task down with it."""
+        try:
+            return _reading(probe())
+        except Exception:  # noqa: BLE001 - a field is never worth a run
+            return None
+
+    def _sample_cpu(self) -> None:
+        value = self._ask(self._cpu_probe)
+        if value is not None:
+            self._cpu.append(value)
+
+    def _sample_gpu(self) -> None:
+        if not self._gpu_worth_asking:
+            return
+        value = self._ask(self._gpu_probe)
+        if value is None:
+            # Only give up when nothing has EVER been read. Once a reading has
+            # succeeded the driver demonstrably exists, and one blip must not
+            # cost the rest of the run's GPU evidence.
+            if not self._gpu:
+                self._gpu_worth_asking = False
+            return
+        self._gpu.append(value)
+
+
+def image_digest(reference: str, run: CommandRunner | None = None) -> str:
+    """Which image bytes actually executed, as this host resolved them.
+
+    `docker image inspect --format {{.Id}}` — the sha256 of the image config,
+    i.e. the local content-addressable identity of the thing that ran.
+
+    NOT `RepoDigests[0]`, the registry manifest digest, though that reads like
+    the more obvious answer. A locally built or `docker load`-ed image has no
+    `RepoDigests` entry at all, so that field is empty on exactly the hosts
+    most worth checking. `.Id` is always present and is what two honest nodes
+    running the same pinned tag on the same architecture agree on, which is
+    the comparison the verifier actually wants to make.
+
+    `""` means unknown: no daemon, an image it will not describe, or output
+    that is not a digest. Never the payload's image reference — echoing back
+    what the coordinator already told us is not evidence, it is a rumour with
+    a hash-shaped name.
+    """
+    if not reference or not isinstance(reference, str):
+        return ""
+    run = run or subprocess.run
+    try:
+        proc = run(
+            ["docker", "image", "inspect", reference, "--format", "{{.Id}}"],
+            capture_output=True,
+            timeout=DIGEST_TIMEOUT_S,
+            check=False,
+        )
+        if getattr(proc, "returncode", 1) != 0:
+            return ""
+        value = _text(getattr(proc, "stdout", None)).strip()
+    except Exception:  # noqa: BLE001 - best effort, like every field here
+        return ""
+    return value if _DIGEST_RE.match(value) else ""

{flashnode-0.3.2 → flashnode-0.3.4}/flashnode/executor/loop.py

@@ -29,7 +29,7 @@ import threading
 import time
 from pathlib import Path
 
-from flashruntime.protocol.v1alpha1 import Lease
+from flashruntime.protocol.v1alpha1 import ExecutionEvidence, Lease
 
 from flashnode.executor.archives import (
     DEFAULT_MAX_BYTES,
@@ -38,6 +38,7 @@ from flashnode.executor.archives import (
     extract_archive_safely,
 )
 from flashnode.executor.client import CoordinatorClient, LeaseLost
+from flashnode.executor.evidence import ResourceSampler
 from flashnode.executor.runner import SubprocessRunner, TaskExecutionError
 
 log = logging.getLogger("flashnode.executor")
@@ -143,6 +144,7 @@ class ExecutorLoop:
         max_unpacked_members: int = DEFAULT_MAX_MEMBERS,
         health_check=None,
         max_consecutive_failures: int = 0,
+        sampler_factory=None,
     ):
         self.client = client
         self.node_id = node_id
@@ -185,6 +187,11 @@ class ExecutorLoop:
         # on their third unlucky job.
         self.health_check = health_check
         self.max_consecutive_failures = max_consecutive_failures
+        # Builds the per-task utilisation sampler. A factory, not an
+        # instance: a Thread runs once, so each task needs its own — and a
+        # factory is the seam that lets the suite drive the probes instead of
+        # the host's real psutil and nvidia-smi.
+        self.sampler_factory = sampler_factory or ResourceSampler
 
     # -- inputs --------------------------------------------------------------
 
@@ -336,9 +343,21 @@ class ExecutorLoop:
                     relay = _CheckpointRelay(self.client, lease, workdir / "out" / "ckpt", prefix)
                     relay.start()
 
+                # Execution evidence is measured around the RUNNER and
+                # nothing else. Folding the artifact upload into the wall
+                # clock would inflate every reading by however slow the
+                # coordinator was that minute — and inflation is the
+                # direction a liar wants, since the coordinator's own
+                # claim-to-commit elapsed is the number this is cross-checked
+                # against.
+                sampler = self.sampler_factory()
+                sampler.start()
+                started = time.monotonic()
                 try:
                     outdir = self.runner.run(payload, workdir, inputs)
                 finally:
+                    wall_seconds = time.monotonic() - started
+                    cpu_mean, gpu_mean = sampler.stop()
                     if relay is not None:
                         relay.finish()  # ship the dying attempt's last checkpoint too
 
@@ -363,7 +382,21 @@ class ExecutorLoop:
                         # nested in a subdirectory.
                         if rel == Path("metrics.json"):
                             metrics_sha = sha
-                accepted = self.client.complete(lease.lease_id, metrics_sha or "0" * 64)
+                # Read off the runner rather than inferred: only the runner
+                # knows whether a container ran at all. `getattr` with an
+                # absent default because a runner is an interface anyone may
+                # implement — one that measures nothing reports absence, and
+                # absence is a fine answer. Guessing would not be.
+                evidence = ExecutionEvidence(
+                    wall_seconds=wall_seconds,
+                    cpu_percent_mean=cpu_mean,
+                    gpu_util_percent_mean=gpu_mean,
+                    image_digest=getattr(self.runner, "last_image_digest", "") or "",
+                    exit_code=getattr(self.runner, "last_exit_code", None),
+                )
+                accepted = self.client.complete(
+                    lease.lease_id, metrics_sha or "0" * 64, evidence=evidence
+                )
                 if accepted:
                     self.tasks_accepted += 1
                 log.info(_jlog("task finished", task=lease.task_id,

{flashnode-0.3.2 → flashnode-0.3.4}/flashnode/executor/runner.py

@@ -54,6 +54,17 @@ class SubprocessRunner:
     ):
         self.allowed_modules = allowed_modules
         self.timeout_seconds = timeout_seconds
+        # What the LAST run measured, read by ExecutorLoop for
+        # ExecutionEvidence. Reset at the top of every run(): a value left
+        # over from the previous task is a real measurement of a DIFFERENT
+        # run wearing this one's name, which is fabricated evidence by
+        # another route. A runner that sets neither reports absence, which
+        # is the honest answer for a tier that measures nothing.
+        self.last_exit_code: int | None = None
+        #: Always "" here — tier 1 runs `python -m` on the host, so no image
+        #: bytes executed. Echoing the payload's image reference would claim
+        #: a container ran when none did.
+        self.last_image_digest: str = ""
 
     def run(self, payload: dict, workdir: Path, inputs: dict[str, Path]) -> Path:
         """Execute one task payload; return the output directory.
@@ -63,6 +74,8 @@ class SubprocessRunner:
           argv       ← python -m <module> --spec spec.json --out out/
           outputs    → files written under out/ (metrics.json required)
         """
+        self.last_exit_code = None
+        self.last_image_digest = ""
         # Tier 1 has no isolation, so it must never execute a caller-supplied
         # command line. Argv workloads are container-only (ArgvDockerRunner);
         # refusing here keeps a misrouted payload from silently running
@@ -100,7 +113,11 @@ class SubprocessRunner:
                 env=task_env(),
             )
         except subprocess.TimeoutExpired:
+            # Deliberately leaves last_exit_code as None: a killed process has
+            # no exit status we observed, and 0 or -9 here would both be a
+            # guess dressed as a reading.
             raise TaskExecutionError(f"task exceeded {self.timeout_seconds}s wall clock")
+        self.last_exit_code = proc.returncode
         if proc.returncode != 0:
             tail = proc.stderr.decode(errors="replace")[-800:]
             raise TaskExecutionError(f"task exited {proc.returncode}: {tail}")

flashnode-0.3.4/flashnode/executor/trusted_runner.py

@@ -0,0 +1,83 @@
+"""Trusted-pool argv execution: no container, no sandbox, by explicit
+operator opt-in only.
+
+This runner exists for hosts that CANNOT run Docker — Colab notebooks and
+provider pods are themselves containers — inside a team pool whose members
+chose to trust each other. It is not a security boundary and never claims
+to be: the placement contract (pool + allowFallback + the operator's
+--runner trusted opt-in) is what keeps strangers' code away from it.
+
+Same interface as SubprocessRunner/ArgvDockerRunner:
+run(payload, workdir, inputs) -> outdir.
+"""
+
+from __future__ import annotations
+
+import subprocess
+from pathlib import Path
+
+from flashnode.executor.runner import TaskExecutionError, task_env
+
+_CONTAINER_WORKDIR = "/work"
+
+
+class TrustedArgvRunner:
+    def __init__(self, timeout_seconds: float = 600.0):
+        self.timeout_seconds = timeout_seconds
+        # Evidence attributes, same contract and same reset rule as
+        # SubprocessRunner: a stale value is a measurement of a DIFFERENT
+        # run wearing this one's name.
+        self.last_exit_code: int | None = None
+        #: Always "" — no image bytes executed; echoing the payload's image
+        #: reference would claim a container ran when none did.
+        self.last_image_digest: str = ""
+
+    def run(self, payload: dict, workdir: Path, inputs: dict[str, Path]) -> Path:
+        self.last_exit_code = None
+        workdir = Path(workdir)
+        argv = payload.get("argv")
+        if not isinstance(argv, list) or not argv or not all(
+            isinstance(a, str) for a in argv
+        ):
+            raise TaskExecutionError(
+                "trusted runner requires a payload with a string-list 'argv'"
+            )
+        # Rewrite /work-prefixed TOKENS onto the real workdir. Token-wise,
+        # never substring: an argument that merely contains "/work" belongs
+        # to the submitter. The compiled argv uses /work because the docker
+        # runners bind the workdir there; this runner has no container, so
+        # /work is a naming convention to honour, not a mount to make.
+        rewritten = [
+            str(workdir) + a[len(_CONTAINER_WORKDIR):]
+            if a == _CONTAINER_WORKDIR or a.startswith(_CONTAINER_WORKDIR + "/")
+            else a
+            for a in argv
+        ]
+        outdir = workdir / "out"
+        outdir.mkdir(parents=True, exist_ok=True)
+        try:
+            proc = subprocess.run(
+                rewritten,
+                cwd=workdir,
+                env=task_env(),
+                timeout=self.timeout_seconds,
+                capture_output=True,
+            )
+        except subprocess.TimeoutExpired as exc:
+            raise TaskExecutionError(
+                f"task exceeded {self.timeout_seconds}s"
+            ) from exc
+        except OSError as exc:
+            raise TaskExecutionError(f"could not start task: {exc}") from exc
+        self.last_exit_code = proc.returncode
+        if proc.returncode != 0:
+            tail = proc.stderr.decode(errors="replace")[-2000:]
+            raise TaskExecutionError(
+                f"task exited {proc.returncode}: {tail}"
+            )
+        if not (outdir / "metrics.json").is_file():
+            # Same rule as both sibling runners: an exit-0 workload that
+            # wrote no metrics is a task failure HERE, attributably — not a
+            # mysterious commit rejection three hops later.
+            raise TaskExecutionError("task produced no metrics.json — nothing to commit")
+        return outdir

{flashnode-0.3.2 → flashnode-0.3.4}/flashnode/inventory/capabilities.py

@@ -62,7 +62,8 @@ def _parse_k8s_memory(value: str) -> int:
 def discover(node_id: str, kubernetes_node: str,
              node_meta: dict | None = None,
              argv_capable: bool = False,
-             module_capable: bool = True) -> NodeRegistration:
+             module_capable: bool = True,
+             unsandboxed_argv_capable: bool = False) -> NodeRegistration:
     """Build the registration payload. `node_meta` is the Kubernetes Node
     object (status/metadata) when the agent has API access; None degrades to
     host-level probes only."""
@@ -127,6 +128,8 @@ def discover(node_id: str, kubernetes_node: str,
         # coordinator's module gate is fail-open (unlike argv_capable), so
         # the default here matches every caller that doesn't pass it.
         module_capable=module_capable,
+        # Set by the agent only for `--runner trusted` — never inferred.
+        unsandboxed_argv_capable=unsandboxed_argv_capable,
         # The LABELS of the datasets this host owner lends to tasks
         # (FLASHNODE_LOCAL_DATA) — never the paths. The coordinator needs the
         # names to place a job that requires `patients` on a machine that has