flashruntime 0.4.2__tar.gz → 0.4.3__tar.gz

{flashruntime-0.4.2 → flashruntime-0.4.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: flashruntime
-Version: 0.4.2
+Version: 0.4.3
 Summary: Open fault-tolerant distributed ML runtime: strategy planning, job protocol, leases, checkpointing, and recovery across heterogeneous compute.
 Author: Zolli Labs
 License-Expression: Apache-2.0

{flashruntime-0.4.2 → flashruntime-0.4.3}/flashml_workloads/fedavg_driver.py

@@ -142,7 +142,8 @@ class Coordinator(Protocol):
 
 def _round_body(round_idx: int, num_shards: int, worker_params: dict,
                 weights_uri: str | None, lease_seconds: float,
-                image: str, isolation_tier: str, allow_fallback: bool) -> dict:
+                image: str, isolation_tier: str, allow_fallback: bool,
+                pool: str | None = None) -> dict:
     params: dict[str, Any] = dict(worker_params)
     params.update({"round": round_idx, "num_shards": num_shards,
                    "lease_seconds": lease_seconds})
@@ -153,7 +154,7 @@ def _round_body(round_idx: int, num_shards: int, worker_params: dict,
         raise ValueError(
             f"image must be 'repository:tag' with a pinned tag, got {image!r}"
         )
-    return {
+    body = {
         "apiVersion": "flashml.dev/v1alpha1", "kind": "Job",
         "metadata": {"name": f"fedavg-r{round_idx:03d}"},
         "spec": {
@@ -163,6 +164,17 @@ def _round_body(round_idx: int, num_shards: int, worker_params: dict,
             "workload": {"type": "federated_averaging", "parameters": params},
         },
     }
+    if pool is not None and pool != "any":
+        # Same rule as the four expander stamps in recipes/command.py and
+        # service/modea.py: absent stays absent, and "any" is never stamped
+        # explicitly — the pool placement gate treats a stamped "any" as an
+        # ordinary pool id, which would make the round's tasks unplaceable
+        # everywhere rather than placeable anywhere. `None` (the caller made
+        # no pool statement) and the literal `"any"` (the caller stated the
+        # public queue explicitly) both mean "leave `placement` absent" —
+        # the default `PlacementSpec.pool` picks up "any" on its own.
+        body["spec"]["placement"] = {"pool": pool}
+    return body
 
 
 def _default_task_ids(num_shards: int) -> list[str]:
@@ -433,6 +445,7 @@ def run_fedavg(
     image: str = DEFAULT_IMAGE,
     isolation_tier: str = "standard",
     allow_fallback: bool = False,
+    pool: str | None = None,
     poll_attempts: int = 4,
     poll_backoff_s: float = 0.5,
     prior_job_ids: Sequence[tuple[int, str]] | None = None,
@@ -448,6 +461,17 @@ def run_fedavg(
     the same "two places, each correct in isolation" shape as the task-module
     allowlist drift that already caused an outage here.
 
+    `pool` is caller-settable for the same reason: the cloud control plane
+    owns pool ids, not this driver, so it must be free to say which pool (or
+    none) each round belongs to. `None` means the public queue, exactly as
+    before this parameter existed — every round of every run before pools
+    landed built a `placement`-less body, and that must stay byte-identical.
+    Round 0 and every later round go through the same `_round_body` call
+    inside this loop, so a pool named for round 0 travels to round 1, 2, …
+    without the caller repeating itself — the whole point being that pool
+    confinement must survive the round boundary, not just the round the job
+    was first submitted for.
+
     `build_round` replaces how a round becomes a job. The default builds the
     built-in `federated_averaging` body, whose tasks run
     `flashml_workloads.fedavg_worker`. A caller that wants the *user's own*
@@ -457,9 +481,9 @@ def run_fedavg(
     resume) is unchanged, because none of it depends on what ran inside the
     round, only on the task ids it produced and the `metrics.json` /
     `delta.json` pair each one committed. `worker_params`, `image`,
-    `isolation_tier`, `allow_fallback` and `lease_seconds` are inputs to the
-    *default* builder and are ignored when `build_round` is supplied — the
-    builder already knows all of it.
+    `isolation_tier`, `allow_fallback`, `pool` and `lease_seconds` are
+    inputs to the *default* builder and are ignored when `build_round` is
+    supplied — the builder already knows all of it.
 
     `initial_weights` may be `{}`, and that is not the same as "start from
     zeros": it means the driver holds no weights yet, so round 0's reduced
@@ -497,7 +521,7 @@ def run_fedavg(
             plan: RoundPlan = {
                 "body": _round_body(r, num_shards, worker_params, weights_uri,
                                     lease_seconds, image, isolation_tier,
-                                    allow_fallback),
+                                    allow_fallback, pool),
                 "task_ids": _default_task_ids(num_shards),
             }
         else:

{flashruntime-0.4.2 → flashruntime-0.4.3}/flashruntime/protocol/v1alpha1.py

@@ -96,7 +96,13 @@ class ResourcesSpec(BaseModel):
 
 
 class PlacementSpec(BaseModel):
-    pool: Literal["any", "local", "edge", "standard-cloud", "secure-cloud"] = "any"
+    #: "any" (the default, and every pre-pools job) or a team-pool id minted
+    #: by the control plane. Until 0.4.3 this was a closed Literal of
+    #: infrastructure pool names that nothing ever read; widened when it
+    #: gained its first reader. Non-"any" makes every task of the job carry
+    #: payload["pool"] (recipes stamp it) and place only on nodes listing
+    #: that id in capabilities.pools.
+    pool: str = "any"
     architectures: list[Literal["amd64", "arm64"]] = Field(default_factory=lambda: ["amd64"])
 
 
@@ -309,6 +315,15 @@ class NodeCapabilities(BaseModel):
     #: this runtime cannot parse — never a guess. Placement reads the LENGTH
     #: of this list and nothing else in v1.
     gpus: list[GpuInfo] = Field(default_factory=list)
+    #: Team pools this node serves, as pool ids minted by the cloud control
+    #: plane. Stamped SERVER-SIDE by the cloud API's agent proxy from the
+    #: machine owner's memberships — an agent's self-reported value is
+    #: overwritten there, so the field is only as trustworthy as the
+    #: operator fronting registration. Empty means "serves no pool", and the
+    #: seventh placement gate refuses pool-scoped work (fail closed). NOT
+    #: the same thing as NodeRegistration.pool (singular), a deployment
+    #: profile label that predates teams; the two never interact.
+    pools: list[str] = Field(default_factory=list)
     os: str = ""
     architecture: str = ""
 
@@ -325,6 +340,14 @@ class NodeRegistration(BaseModel):
     #: every already-deployed agent is excluded from argv work until it is
     #: upgraded and explicitly opted in (security fields fail closed).
     argv_capable: bool = False
+    #: The operator explicitly opted this host into executing POOL-SCOPED
+    #: argv payloads without a container (`flashnode work --runner trusted`).
+    #: Defaults False so every existing agent is excluded until its owner
+    #: opts in (security fields fail closed). Distinct from argv_capable,
+    #: which asserts the CONTAINERISED argv contract — this asserts the
+    #: opposite: no sandbox, trusted-pool work only. The scheduler requires
+    #: pool + allowFallback + this flag together; any one alone places nothing.
+    unsandboxed_argv_capable: bool = False
     #: This node can run "module" (python -m <allowlisted module>) tasks.
     #: Defaults True — unlike argv_capable this is an AVAILABILITY gate, not
     #: a safety one: a module task placed on an incapable node just wastes
@@ -354,6 +377,12 @@ class NodeHeartbeat(BaseModel):
     node_id: str
     timestamp: datetime = Field(default_factory=utcnow)
     status: Literal["online", "draining", "terminating"] = "online"
+    #: Optional pool-membership refresh, stamped by the cloud API on the
+    #: heartbeat proxy so joining or leaving a pool reaches placement
+    #: without an agent restart. None means "no statement" — the
+    #: coordinator keeps whatever registration said. A list (even empty)
+    #: replaces `capabilities.pools` wholesale. Agents never set this.
+    pools: list[str] | None = None
 
 
 class NodeStatusView(BaseModel):

{flashruntime-0.4.2 → flashruntime-0.4.3}/flashruntime/recipes/command.py

@@ -82,13 +82,16 @@ class CommandRecipe(WorkloadRecipe):
 
     def expand(self, job_id: str, spec: JobSpec) -> list[TaskSpec]:
         isolation_spec = spec.spec.isolation
-        if isolation_spec.allowFallback:
-            # allowFallback waives the sandbox capability requirement at
-            # placement time. Honouring it for argv would let a submitter
-            # place arbitrary code on an unsandboxed node.
+        pool = spec.spec.placement.pool
+        if isolation_spec.allowFallback and pool == "any":
+            # The waiver is only acceptable INSIDE a pool: members chose to
+            # trust each other, and the seventh gate confines the task to
+            # them. Without a pool it would let a submitter place arbitrary
+            # code on any opted-in host — the exact thing the original
+            # unconditional refusal existed to prevent.
             raise ValueError(
-                "command jobs may not set isolation.allowFallback — "
-                "argv execution is container-only"
+                "command jobs may not set isolation.allowFallback without "
+                "placement.pool — unsandboxed argv is confined to team pools"
             )
         if isolation_spec.tier != "sandboxed":
             # Coordinator-side opt-in only: the operator running the pool
@@ -180,6 +183,12 @@ class CommandRecipe(WorkloadRecipe):
                 # exercising the key-missing branch, as unpack_inputs and
                 # local_inputs do.
                 payload["gpus"] = int(gpus)
+            if pool != "any":
+                # Same hop, same warning as local_inputs/gpus above: dropping
+                # this does NOT fail closed — the seventh gate would see a
+                # task requiring nothing and place it anywhere, carrying the
+                # waiver with it. Absent stays absent for "any".
+                payload["pool"] = pool
             tasks.append(
                 TaskSpec(
                     task_id=task_id,

{flashruntime-0.4.2 → flashruntime-0.4.3}/flashruntime/scheduler/__init__.py

@@ -113,11 +113,36 @@ class IsolationAwarePlacement(PlacementPolicy):
 
     A second, independent gate applies to tasks carrying an `argv` payload
     (arbitrary user command lines): the claiming node must advertise
-    `argv_capable is True`. This is checked BEFORE the isolation block's
-    `allowFallback` waiver below, and the waiver does not apply to it — a
-    submitter setting `allowFallback: true` waives the sandbox-tier
-    requirement only, never the argv-runner requirement, or arbitrary argv
-    could land on a node with no argv runner at all.
+    `argv_capable is True` — the containerised argv contract, always
+    acceptable. This is checked BEFORE the isolation block's `allowFallback`
+    waiver below, and the waiver does not apply to it directly — a submitter
+    setting `allowFallback: true` waives the sandbox-tier requirement only,
+    never the argv-runner requirement on its own, or arbitrary argv could
+    land on a node with no argv runner at all.
+
+    A node lacking `argv_capable` has exactly one alternative: trusted-pool
+    placement, for a host whose OPERATOR opted it into running pool argv
+    work unsandboxed (`flashnode work --runner trusted`,
+    `NodeRegistration.unsandboxed_argv_capable`). Three legs, ALL required,
+    each `is`-checked, each fails closed — any one alone places nothing:
+
+    - The task is pool-scoped: `payload["pool"]` is a non-empty `str`.
+    - Its submitter waived the tier: `payload["isolation"]` is a `dict` and
+      its `allowFallback` is exactly `True` — the same waiver the isolation
+      block reads below, checked again here rather than assumed, because
+      this gate must not depend on evaluation order elsewhere.
+    - The node opted in: `unsandboxed_argv_capable is True` on the node view
+      — a truthy stand-in (`1`, `"true"`) does NOT count, matching every
+      other boolean capability in this class.
+
+    The pool leg here is a guard, not the boundary: the seventh gate below
+    independently confines the task to pool members regardless of this one.
+    This leg exists so that a waiver which somehow reached placement without
+    a pool — `CommandRecipe` now accepts `allowFallback` only when
+    `placement.pool` is set, coupling the waiver to a pool at submission
+    time, so nothing upstream should ever produce one without a pool — still
+    unlocks nothing here either. The gate does not trust another layer to
+    have already enforced the rule it is itself stating.
 
     A third gate applies to tasks carrying a `module` payload (the
     "python -m <allowlisted module>" tier): the claiming node must not be
@@ -254,14 +279,80 @@ class IsolationAwarePlacement(PlacementPolicy):
     already holds the other half of a verification pair — and the point of
     the pair is that the node cannot tell it is in one.
 
+    A seventh gate applies to tasks whose payload names a `pool`: the
+    claiming node's `capabilities.pools` must list it. It takes the
+    argv/local-data/gpu/exclude_nodes polarity — **fail closed** — and for
+    the sharpest reason of the seven: pool jobs are precisely the ones that
+    CARRY `allowFallback`, so a task that slipped this gate would not just
+    misplace, it would run UNSANDBOXED on a machine outside the trust
+    boundary the waiver assumed. Checked before the isolation block for the
+    same reason the gates above are — but here the ordering is load-bearing
+    twice over, since this gate and the waiver interact directly rather than
+    merely sharing a payload:
+
+    - The requirement must be a non-empty `str`. `None` means no pool was
+      asked for and the task places like any pre-pools job; anything else
+      typed (an `int`, a `list`, `True`, or the empty string) is a
+      type-confused requirement and makes the task ineligible everywhere,
+      exactly as a non-`int` `gpus` or a non-list `exclude_nodes` does.
+    - `capabilities` may be absent or type-confused; read as membership in
+      no pool rather than allowed to raise, via `isinstance`, not
+      `capabilities.get(...) or {}` — a string `capabilities` value has no
+      `.get` and must fail closed rather than crash the predicate, the same
+      pattern the gpu gate uses for the same reason.
+    - The advertisement must be a genuine *list* of names. Absent, `None`, a
+      bare string, a dict, or a bare `int` all count as serving no pool. A
+      bare string deserves the same suspicion `local_datasets` earns:
+      substring membership would let one node's advertisement quietly match
+      a pool it never joined.
+    - Every member must be a `str`. A `None`, an `int`, or a nested object
+      means the stamp was built wrong, and the pool it meant to serve is
+      exactly the one a plain membership test would then get wrong — the
+      same shape of failure `exclude_nodes` refuses for the same reason.
+      The whole node is refused rather than the one bad member ignored.
+
+    `allowFallback` does not waive this gate, and this is the one case in
+    the class where saying so is not enough — the test that pins it
+    (`test_allow_fallback_does_not_waive_the_pool_gate`) is the argument
+    itself, not a restatement of it. Every other gate's waiver-immunity is
+    "the waiver covers the sandbox tier and nothing else, so it has nothing
+    to say here." This gate's is stronger: pool-scoped jobs are the ones
+    that set `allowFallback: true` in the first place, trading the
+    sandboxed-container guarantee for a trusted-pool machine that runs their
+    argv directly. If this gate waived on `allowFallback`, the exact tasks
+    carrying that trade would be the ones allowed to escape the pool
+    boundary that made the trade acceptable, and they would land unsandboxed
+    on a stranger's machine — the design's worst failure mode, reached by
+    reading the one waiver already present on every task this gate exists to
+    confine.
+
     Everything genuinely standard keeps the fail-open placement default."""
 
     def eligible(self, task: TaskSpec, node: NodeView) -> bool:
         # Checked before the allowFallback waiver below: the waiver relaxes
         # the sandbox-tier requirement, and must never be readable as
         # permission to run argv on a node with no argv runner.
-        if "argv" in task.payload and node.get("argv_capable") is not True:
-            return False
+        if "argv" in task.payload:
+            if node.get("argv_capable") is True:
+                pass  # the containerised argv contract — always acceptable
+            else:
+                # Trusted-pool alternative: the host OPERATOR opted into
+                # unsandboxed pool argv (`flashnode work --runner trusted`).
+                # Three legs, each `is`-checked, each fails closed. The pool
+                # leg here is a guard, not the boundary — the seventh gate
+                # independently confines the task to pool members; this leg
+                # exists so a waiver that somehow escaped compile/recipe
+                # coupling still unlocks nothing outside a pool.
+                task_pool = task.payload.get("pool")
+                isolation_payload = task.payload.get("isolation")
+                if not (
+                    isinstance(task_pool, str)
+                    and task_pool
+                    and isinstance(isolation_payload, dict)
+                    and isolation_payload.get("allowFallback") is True
+                    and node.get("unsandboxed_argv_capable") is True
+                ):
+                    return False
         # Availability gate, mirrored polarity from the argv gate above —
         # see the class docstring. An argv-only volunteer poisons every
         # module job in the pool otherwise: it claims, ArgvDockerRunner
@@ -322,6 +413,30 @@ class IsolationAwarePlacement(PlacementPolicy):
                     return False  # cannot answer "is this you?" ⇒ do not risk it
                 if node_id in excluded:
                     return False
+        # Fail-closed like every gate above, and checked before the
+        # allowFallback waiver below for the sharpest reason yet: pool jobs
+        # are exactly the ones that CARRY the waiver, so a pool task that
+        # slipped this gate would run unsandboxed on a machine outside the
+        # trust boundary that made the waiver acceptable.
+        required_pool = task.payload.get("pool")
+        if required_pool is not None:
+            if not isinstance(required_pool, str) or not required_pool:
+                return False  # type-confused requirement ⇒ fail closed, no crash
+            capabilities = node.get("capabilities")
+            # isinstance, not `or {}` — a string capabilities value has no
+            # `.get` and must fail closed rather than crash the predicate.
+            advertised = (
+                capabilities.get("pools") if isinstance(capabilities, dict) else None
+            )
+            if not isinstance(advertised, list):
+                return False  # absent/type-confused ⇒ serves no pool
+            if not all(isinstance(p, str) for p in advertised):
+                # A non-name member means the stamp was built wrong; the pool
+                # it meant to serve is precisely what a membership test would
+                # now get wrong. Refuse the node, not the one member.
+                return False
+            if required_pool not in advertised:
+                return False
         isolation = task.payload.get("isolation")
         if isolation is None:
             return True  # no isolation payload ⇒ standard, runs anywhere

{flashruntime-0.4.2 → flashruntime-0.4.3}/flashruntime/service/modea.py

@@ -171,6 +171,8 @@ def expand_tasks(job_id: str, spec: JobSpec) -> list[TaskSpec]:
         }
         if checkpoint is not None:
             payload["checkpoint"] = checkpoint
+        if spec.spec.placement.pool != "any":
+            payload["pool"] = spec.spec.placement.pool
         tasks.append(
             TaskSpec(
                 task_id=task_id,
@@ -208,6 +210,17 @@ def _expand_kmeans(job_id: str, spec: JobSpec) -> list[TaskSpec]:
     tasks = []
     for i, shard_uri in enumerate(shards):
         task_id = f"it{iteration:02d}-shard-{i:03d}"
+        payload = {
+            "module": "flashml_workloads.kmeans_shard",
+            "params": {"centroids": centroids},
+            "inputs": {"shard": shard_uri},
+            "output_prefix": f"jobs/{job_id}/{task_id}/",
+            "task_id": task_id,
+            "image": spec.spec.image.reference,
+            "isolation": isolation,
+        }
+        if spec.spec.placement.pool != "any":
+            payload["pool"] = spec.spec.placement.pool
         tasks.append(
             TaskSpec(
                 task_id=task_id,
@@ -215,15 +228,7 @@ def _expand_kmeans(job_id: str, spec: JobSpec) -> list[TaskSpec]:
                 commit_key=f"jobs/{job_id}/{task_id}/metrics.json",
                 max_attempts=spec.spec.retryPolicy.maxTaskAttempts,
                 lease_seconds=_lease_seconds(p, 60.0),
-                payload={
-                    "module": "flashml_workloads.kmeans_shard",
-                    "params": {"centroids": centroids},
-                    "inputs": {"shard": shard_uri},
-                    "output_prefix": f"jobs/{job_id}/{task_id}/",
-                    "task_id": task_id,
-                    "image": spec.spec.image.reference,
-                    "isolation": isolation,
-                },
+                payload=payload,
             )
         )
     return tasks
@@ -273,6 +278,17 @@ def _expand_fedavg(job_id: str, spec: JobSpec) -> list[TaskSpec]:
         params = {k: p[k] for k in worker_keys}
         params.update({"round": int(p.get("round", 0)),
                        "shard": shard, "num_shards": num_shards})
+        payload = {
+            "module": "flashml_workloads.fedavg_worker",
+            "params": params,
+            "inputs": inputs,
+            "output_prefix": f"jobs/{job_id}/{task_id}/",
+            "task_id": task_id,
+            "image": spec.spec.image.reference,
+            "isolation": isolation,
+        }
+        if spec.spec.placement.pool != "any":
+            payload["pool"] = spec.spec.placement.pool
         tasks.append(
             TaskSpec(
                 task_id=task_id,
@@ -280,15 +296,7 @@ def _expand_fedavg(job_id: str, spec: JobSpec) -> list[TaskSpec]:
                 commit_key=f"jobs/{job_id}/{task_id}/metrics.json",
                 max_attempts=spec.spec.retryPolicy.maxTaskAttempts,
                 lease_seconds=_lease_seconds(p, 120.0),
-                payload={
-                    "module": "flashml_workloads.fedavg_worker",
-                    "params": params,
-                    "inputs": inputs,
-                    "output_prefix": f"jobs/{job_id}/{task_id}/",
-                    "task_id": task_id,
-                    "image": spec.spec.image.reference,
-                    "isolation": isolation,
-                },
+                payload=payload,
             )
         )
     return tasks
@@ -633,6 +641,19 @@ def build_router(state: ModeAState) -> APIRouter:
         if entry is None:
             raise HTTPException(status_code=404, detail=f"unknown node {node_id} — register first")
         entry.last_heartbeat = hb.timestamp
+        if hb.pools is not None:
+            # Server-stamped membership refresh (cloud proxy). A list, even
+            # empty, replaces the registration's pools wholesale; None means
+            # no statement. Replace the capabilities object rather than
+            # mutating it in place so the registration model stays the
+            # single source the claim node view dumps from.
+            entry.registration = entry.registration.model_copy(
+                update={
+                    "capabilities": entry.registration.capabilities.model_copy(
+                        update={"pools": list(hb.pools)}
+                    )
+                }
+            )
         return {"status": "ok"}
 
     @router.get("/nodes")
@@ -657,6 +678,7 @@ def build_router(state: ModeAState) -> APIRouter:
             "node_id": req.node_id,
             "sandbox_capable": entry.registration.sandbox_capable,
             "argv_capable": entry.registration.argv_capable,
+            "unsandboxed_argv_capable": entry.registration.unsandboxed_argv_capable,
             "module_capable": entry.registration.module_capable,
             # Names only — the host paths behind them never reach us, and the
             # placement gate needs the names to place local-data work at all.

{flashruntime-0.4.2 → flashruntime-0.4.3}/flashruntime.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: flashruntime
-Version: 0.4.2
+Version: 0.4.3
 Summary: Open fault-tolerant distributed ML runtime: strategy planning, job protocol, leases, checkpointing, and recovery across heterogeneous compute.
 Author: Zolli Labs
 License-Expression: Apache-2.0

{flashruntime-0.4.2 → flashruntime-0.4.3}/flashruntime.egg-info/SOURCES.txt

@@ -121,13 +121,17 @@ tests/test_monitor_sampler.py
 tests/test_placement_exclusion.py
 tests/test_placement_gpu.py
 tests/test_placement_local_data.py
+tests/test_placement_pool.py
+tests/test_placement_trusted_argv.py
 tests/test_planner.py
 tests/test_protocol_evidence.py
 tests/test_protocol_gpu.py
 tests/test_protocol_local_datasets.py
+tests/test_protocol_pools.py
 tests/test_protocol_v1alpha1.py
 tests/test_recipe_gpu.py
 tests/test_recipe_local_inputs.py
+tests/test_recipe_pool.py
 tests/test_recipes_command.py
 tests/test_recovery.py
 tests/test_run_json.py

{flashruntime-0.4.2 → flashruntime-0.4.3}/pyproject.toml

@@ -5,6 +5,18 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "flashruntime"
+# 0.4.3 adds team pools: NodeCapabilities.pools + NodeHeartbeat.pools
+# (stamped server-side by the cloud proxy, never by agents),
+# NodeRegistration.unsandboxed_argv_capable (operator opt-in, fail closed),
+# PlacementSpec.pool widened from a dead closed Literal to str, the seventh
+# placement gate, and the trusted-pool argv alternative. Fedavg round bodies
+# carry placement.pool so pool confinement survives round boundaries.
+# Additive and optional on the wire, so the compatibility range does not
+# move — the bump is 0.4.1's rule again: bump on any wire-visible change,
+# even additive.
+# Agents need nothing from this release unless they opt into
+# `--runner trusted` (flashnode 0.3.4, whose floor moves to >=0.4.3).
+#
 # 0.4.2 adds ExecutionEvidence and CompleteRequest.evidence — the agent's
 # self-report at commit time. Additive and OPTIONAL on the wire, so the
 # compatibility range does not move and an agent that predates it keeps
@@ -34,7 +46,7 @@ name = "flashruntime"
 # must pin a range that includes it. (0.3.0 was the first published release;
 # 0.1.0 and 0.2.0 were declared here but never reached PyPI.) Released from
 # the Zolli-Labs/flashml monorepo by pushing a `flashruntime-vX.Y.Z` tag.
-version = "0.4.2"
+version = "0.4.3"
 description = "Open fault-tolerant distributed ML runtime: strategy planning, job protocol, leases, checkpointing, and recovery across heterogeneous compute."
 readme = "README.md"
 # PEP 639 SPDX expression (string form) — replaces the deprecated

{flashruntime-0.4.2 → flashruntime-0.4.3}/tests/test_fedavg_driver.py

@@ -558,6 +558,53 @@ def test_image_and_isolation_tier_are_settable_by_the_caller():
     assert spec["isolation"]["tier"] == "sandboxed"
 
 
+def test_pool_travels_through_round_bodies_to_task_payloads():
+    """Pool confinement must survive the round boundary.
+
+    The cloud API calls `run_fedavg` directly to drive every round of a
+    federated job — round 1+ bodies are built here, by `_round_body`, never
+    by `CommandRecipe.expand`. Without this stamp a pool-scoped job would
+    revert to `pool: "any"` on round 1, exactly the "unstamped hop" bug the
+    four expander stamps in recipes/command.py and service/modea.py exist to
+    prevent (tests/test_recipe_pool.py) — this is that same bug's fifth
+    hop, one `run_fedavg` alone can produce."""
+    from flashruntime.protocol.v1alpha1 import JobSpec
+    from flashruntime.service.modea import expand_tasks
+
+    fake = FakeCoordinator({0: [(0, 1.0, 10), (1, 1.0, 10)]})
+    run_fedavg(fake, rounds=1, num_shards=2, min_participants=2,
+               worker_params=_params(), pool="p-1",
+               initial_weights={"w": {"shape": [1], "data": [0.0]}})
+    body = fake.submitted[0][1]
+    assert body["spec"]["placement"]["pool"] == "p-1"
+
+    # The full round-boundary hop: what the driver submits is what the
+    # service actually expands, not a hand-built intermediate.
+    spec = JobSpec.model_validate(body)
+    tasks = expand_tasks("job-x", spec)
+    assert tasks, "expected at least one task"
+    assert all(t.payload["pool"] == "p-1" for t in tasks)
+
+
+def test_no_pool_leaves_placement_absent_byte_compatible_with_today():
+    """`pool=None` (the default) must reproduce exactly today's body — no
+    `placement` key at all, and no `pool` in any task payload."""
+    from flashruntime.protocol.v1alpha1 import JobSpec
+    from flashruntime.service.modea import expand_tasks
+
+    fake = FakeCoordinator({0: [(0, 1.0, 10), (1, 1.0, 10)]})
+    run_fedavg(fake, rounds=1, num_shards=2, min_participants=2,
+               worker_params=_params(),
+               initial_weights={"w": {"shape": [1], "data": [0.0]}})
+    body = fake.submitted[0][1]
+    assert "placement" not in body["spec"]
+
+    spec = JobSpec.model_validate(body)
+    tasks = expand_tasks("job-x", spec)
+    assert tasks, "expected at least one task"
+    assert all("pool" not in t.payload for t in tasks)
+
+
 def test_an_image_without_a_tag_is_rejected():
     fake = FakeCoordinator({0: [(0, 1.0, 10)]})
     with pytest.raises(ValueError, match="repository:tag"):