foundry-implementation-actor 0.5.1__tar.gz → 0.7.0__tar.gz

{foundry_implementation_actor-0.5.1 → foundry_implementation_actor-0.7.0}/CLAUDE.md

@@ -29,7 +29,7 @@ There is no separate lint/format command configured in this repo.
 
 ## Architecture
 
-Seven modules under `src/foundry_implementation_actor/`:
+Eight modules under `src/foundry_implementation_actor/`:
 
 - **`config.py`** — `CapabilityConfig`. The heart. Loads the sidecar and derives **every**
   rendering of the capability id from two declared fields (`capability`, `source_repo`). Also
@@ -48,6 +48,10 @@ Seven modules under `src/foundry_implementation_actor/`:
   the derived wire contract only (door ids, each door's request/completion schema and engine).
   Prose and `actor.yaml`'s `name:` are deliberately not compared — a use should name its own
   capability. `lint` runs it beside the sidecar gate.
+- **`settings.py`** — `Settings`. How much a session may spend: turns and seconds, per door, as
+  one `field → environment variable` table with a `from_env` that refuses a value it cannot read.
+  `serve` fills the engine from it (ADR-FIA-0007). The defaults live here, not in `engine.py`,
+  because `engine.py` names the variable when a budget runs out.
 - **`cli.py`** — argparse wiring only, no logic of its own.
 
 Beside them, two folders of committed contract, both shipped in the wheel:
@@ -93,6 +97,10 @@ Beside them, two folders of committed contract, both shipped in the wheel:
   authenticate (ADR-FIA-0006). `release.yml` `docker tag`s one build into both so they hold one
   digest — never add a second `docker build`, and never hardcode a registry: the product names
   itself in `vars.PRODUCT_IMAGE`, the same reason `src/` names no capability.
+- **A budget is an environment setting, and a door that runs out says what to change.** Turns and
+  timeouts are `Settings` fields with an `ENV` entry each, not constructor defaults `serve` never
+  passes (ADR-FIA-0007). Never add a knob without an entry in `ENV` and `ENGINE_KWARGS` — and never
+  put one in the sidecar: a capability declares what it is, not how long its actor may think.
 - **Never set `ANTHROPIC_API_KEY` in a container running this.** In `claude -p` non-interactive
   mode an API key in the environment is always preferred over `CLAUDE_CODE_OAUTH_TOKEN`, silently
   routing every session through metered billing. There is no warning; the only symptom is the bill.

{foundry_implementation_actor-0.5.1 → foundry_implementation_actor-0.7.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: foundry-implementation-actor
-Version: 0.5.1
+Version: 0.7.0
 Summary: Runs a headless Claude Code implementation session against one capability's own repo — a papeete-actor for one use, with the capability supplied by a sidecar.
 Project-URL: Homepage, https://github.com/papeete-hub/foundry-implementation-actor
 Author-email: Papeete Consulting <yoann.remy@outlook.com>
@@ -287,6 +287,31 @@ Publishing additionally needs `IMAGE_REGISTRY` and `BUILDKIT_HOST`. There is no
 no docker socket anywhere in this design — `buildctl` is a client, which is why an actor running
 this can be an ordinary Pod.
 
+## What a session may spend
+
+Environment, read once at boot by `serve`; constructor keywords on `Settings` for an embedder. The
+budget is **not** a sidecar field: a capability declares what it is, not how long its actor may
+think (ADR-FIA-0007).
+
+| variable | default | what it costs to raise |
+|---|---|---|
+| `MAX_TURNS` | `60` | `implement-task`'s turns. A turn is a model call plus a tool call; raising it buys a slower-to-navigate repo more room, and buys a session that has lost the plot more room to keep losing it |
+| `SESSION_TIMEOUT_S` | `1800` | `implement-task`'s wall clock. The caller's own door timeout has to exceed it, or a slow success arrives as "did not answer" |
+| `ASSESS_MAX_TURNS` | `15` | `assess-task`'s turns. It reads and answers; it cannot write |
+| `ASSESS_TIMEOUT_S` | `600` | `assess-task`'s wall clock. Round 0 blocks on it, before anything is built |
+| `CLONE_TIMEOUT_S` | `120` | the full clone, per door call |
+| `FETCH_TIMEOUT_S` | `120` | each `ground_in` fetch, per door call |
+
+**The defaults have not moved** since these became reachable; they are what every use was already
+running. A value that is not a positive integer is refused at boot, naming itself, rather than
+silently falling back — so a raised budget that was misspelt crash-loops with the reason on stdout
+instead of changing nothing. The four session knobs are on the `actor-started` record too, so a run
+that ran out of budget can be read against the budget it actually had.
+
+A door that runs out says so in those terms: `implement-task ran out of turns (max_turns=60) and
+was stopped mid-work, so nothing it produced is kept — raise MAX_TURNS on this actor's Deployment,
+or narrow the task.`
+
 ## CLI
 
 ```bash

{foundry_implementation_actor-0.5.1 → foundry_implementation_actor-0.7.0}/README.md

@@ -264,6 +264,31 @@ Publishing additionally needs `IMAGE_REGISTRY` and `BUILDKIT_HOST`. There is no
 no docker socket anywhere in this design — `buildctl` is a client, which is why an actor running
 this can be an ordinary Pod.
 
+## What a session may spend
+
+Environment, read once at boot by `serve`; constructor keywords on `Settings` for an embedder. The
+budget is **not** a sidecar field: a capability declares what it is, not how long its actor may
+think (ADR-FIA-0007).
+
+| variable | default | what it costs to raise |
+|---|---|---|
+| `MAX_TURNS` | `60` | `implement-task`'s turns. A turn is a model call plus a tool call; raising it buys a slower-to-navigate repo more room, and buys a session that has lost the plot more room to keep losing it |
+| `SESSION_TIMEOUT_S` | `1800` | `implement-task`'s wall clock. The caller's own door timeout has to exceed it, or a slow success arrives as "did not answer" |
+| `ASSESS_MAX_TURNS` | `15` | `assess-task`'s turns. It reads and answers; it cannot write |
+| `ASSESS_TIMEOUT_S` | `600` | `assess-task`'s wall clock. Round 0 blocks on it, before anything is built |
+| `CLONE_TIMEOUT_S` | `120` | the full clone, per door call |
+| `FETCH_TIMEOUT_S` | `120` | each `ground_in` fetch, per door call |
+
+**The defaults have not moved** since these became reachable; they are what every use was already
+running. A value that is not a positive integer is refused at boot, naming itself, rather than
+silently falling back — so a raised budget that was misspelt crash-loops with the reason on stdout
+instead of changing nothing. The four session knobs are on the `actor-started` record too, so a run
+that ran out of budget can be read against the budget it actually had.
+
+A door that runs out says so in those terms: `implement-task ran out of turns (max_turns=60) and
+was stopped mid-work, so nothing it produced is kept — raise MAX_TURNS on this actor's Deployment,
+or narrow the task.`
+
 ## CLI
 
 ```bash

foundry_implementation_actor-0.7.0/adr/ADR-FIA-0007-a-sessions-budget-is-an-environment-setting.md

@@ -0,0 +1,105 @@
+---
+id: ADR-FIA-0007
+title: "A session's budget is an environment setting — and a door that runs out says what to change"
+status: Accepted
+date: 2026-09-16
+supersedes: []
+references:
+  - src/foundry_implementation_actor/settings.py
+  - src/foundry_implementation_actor/serve.py
+  - src/foundry_implementation_actor/engine.py
+---
+
+# ADR-FIA-0007 — A session's budget is an environment setting
+
+## Context
+
+`ClaudeCodeEngine` has always taken its budget as constructor keywords: `max_turns`,
+`session_timeout`, `assess_max_turns`, `assess_timeout`, plus `clone_timeout` and `fetch_timeout`.
+`serve.py` constructed it as `ClaudeCodeEngine(config)` and passed none of them.
+
+So for every actor running from the image this package publishes — which is every actor, since
+ADR-FIA-0005 made a use one sidecar and no Python — the budget was whatever `engine.py` said, and
+the only way to move it was to edit and re-release the package. The keywords were reachable in
+principle and unreachable in practice.
+
+A live end-to-end run on 2026-09-15 turned that into a real cost. An `implement-task` session hit
+`--max-turns 60` after 470s of a 1800s timeout. It had made the actual fix by turn 14, then spent
+turns 18–60 building a unit test nobody had asked for, and was killed with the work uncommitted.
+The repo in question is a .NET solution that restores packages on many of its turns, so 60 turns
+buys it materially less reading than it buys a Python one — exactly the case an operator should be
+able to answer from a Deployment.
+
+The failure said none of this:
+
+```
+EngineError: claude session failed (subtype=error_max_turns):
+```
+
+Not what the limit was, not which of the two doors hit it, not what to change. The only way to
+learn any of it was to read the CLI's own transcript out of the Pod's `/tmp/.claude/projects`
+before the Pod went away.
+
+`foundry-task-orchestration-actor` had already answered the first half of this for its own knobs: a
+`settings.py` holding one `field name → environment variable` table, a `from_env` that reads it,
+and a `serve` that passes the result.
+
+## Decision
+
+1. **The budget is an environment setting, not a sidecar field.** A new `settings.py`, modelled on
+   the orchestration actor's: a frozen `Settings` dataclass, one `ENV` table, `from_env(environ)`,
+   and a `SettingsError` for a value that cannot be read. Six variables — `MAX_TURNS`,
+   `SESSION_TIMEOUT_S`, `ASSESS_MAX_TURNS`, `ASSESS_TIMEOUT_S`, `CLONE_TIMEOUT_S`,
+   `FETCH_TIMEOUT_S`. `serve` reads it at boot and splats `settings.engine_kwargs()` into the
+   engine; an embedder passes its own `Settings` and never touches the environment.
+2. **A value that is not a positive integer is refused at boot**, naming the variable and what it
+   was set to. A misspelt budget crash-loops with the reason on stdout rather than silently
+   running under the default it was raised from.
+3. **The `actor-started` record carries the four session knobs**, so a run that ran out is
+   readable against the budget it actually had.
+4. **A door that runs out of budget names the budget, the door and the variable.** Both the
+   out-of-turns and the timeout paths, keyed off `ENV` so the remedy cannot drift from what
+   `from_env` reads.
+5. **The defaults do not move.** 60/1800 to implement, 15/600 to assess — unchanged.
+
+## Rationale
+
+**Why not the sidecar.** The sidecar declares facts about a capability: its id, its repo, its
+components, what it grounds itself in. How many turns its actor may take is not one of them. The
+same capability deployed twice may want two answers; two capabilities of identical shape in
+different languages want different ones for the same task. ADR-FIA-0002 drew this line already when
+it took `components[].tests` out of the sidecar — a component declares what is built, not how it is
+verified — and this is the same line one field over: a capability declares what it is, not how long
+its actor may think.
+
+**Why not raise the default instead.** Raising 60 to 90 would have made this particular run pass
+and taught nothing. The run that failed was not short of turns in general; it was short of turns
+*for that repository*, and it also spent two thirds of its budget on work outside its task. Those
+are two different problems with two different owners, and a default that hides the first also hides
+the second. Making the budget reachable lets the one use that needs more say so, in its own
+Deployment, where the reason can be written next to the number.
+
+**Why the failure matters as much as the setting.** A knob nobody can find is not much better than
+a knob that does not exist. The evidence for this decision is an incident whose diagnosis required
+`kubectl exec` into a Pod; the failure message is what makes the next one diagnosable from the log
+line alone.
+
+**Why `engine.py` imports the defaults from `settings.py` rather than the reverse.** The engine's
+own failure message names the environment variable, so it needs `ENV`. One table, in one direction,
+is what keeps the message, `from_env` and the README from disagreeing.
+
+## Consequences
+
+- `serve.py` is no longer the place that decides a budget. An operator raises one on a Deployment.
+- `DEFAULT_MAX_TURNS` and its four siblings moved from `engine.py` to `settings.py`. They are
+  still importable, under a new module — an embedder that imported them from `engine` must follow.
+- The engine's constructor signature is unchanged, so an embedder that passed keywords is
+  untouched.
+- `tests/test_settings.py` pins the defaults, every variable, the refusals, and that `ENV`,
+  `ENGINE_KWARGS` and the dataclass's own fields name the same set — a field added without a
+  variable cannot go quiet.
+- **Follow-up: `foundry-testing-actor` carries the same shape** — `DEFAULT_MAX_TURNS = 60`, a
+  `propose_max_turns` beside it, and a `serve` that passes neither. It deserves the identical
+  change, as its own pass and its own release; its doors are not the ones that failed here.
+- Not addressed: a session that spends its budget on work outside its task. That is a prompt
+  question, and turning it into a budget question is what this ADR declines to do.

{foundry_implementation_actor-0.5.1 → foundry_implementation_actor-0.7.0}/adr/README.md

@@ -17,6 +17,7 @@ are named or placed (`ADR-ECO-*` in
 | [ADR-FIA-0004](./ADR-FIA-0004-the-three-amigos-round.md) | The three amigos round — the tester proposes, this actor answers, a human breaks the tie | Accepted |
 | [ADR-FIA-0005](./ADR-FIA-0005-the-actor-ships-an-image.md) | The actor ships an image, and renders its own cards into it — a use is one sidecar | Proposed |
 | [ADR-FIA-0006](./ADR-FIA-0006-the-image-is-published-to-two-registries.md) | The image is published to two registries, and names neither in its source | Proposed |
+| [ADR-FIA-0007](./ADR-FIA-0007-a-sessions-budget-is-an-environment-setting.md) | A session's budget is an environment setting — and a door that runs out says what to change | Accepted |
 
 ## Authoring
 

{foundry_implementation_actor-0.5.1 → foundry_implementation_actor-0.7.0}/docker/Dockerfile

@@ -97,6 +97,12 @@ ENV HOME=/home/actor \
 #   BUILDKIT_HOST, IMAGE_REGISTRY, DOCKER_CONFIG   where images are built, pushed, and the
 #                           credential buildctl resolves CLIENT-side before handing it to the
 #                           daemon (the daemon does not authenticate on a client's behalf).
+#
+# And, optionally, how much a session may spend: MAX_TURNS / SESSION_TIMEOUT_S (implement-task),
+# ASSESS_MAX_TURNS / ASSESS_TIMEOUT_S (assess-task), CLONE_TIMEOUT_S, FETCH_TIMEOUT_S. Deliberately
+# NOT given defaults here: `settings.py` holds them, so a use reads one number in one place, and an
+# ENV line in this image would be a second copy to keep in step (ADR-FIA-0007). A value that is not
+# a positive integer is refused at boot, naming itself.
 EXPOSE 8080
 
 # `serve`, not a copied-in app.py. Sixty lines of observability wiring used to live in every use's

{foundry_implementation_actor-0.5.1 → foundry_implementation_actor-0.7.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "foundry-implementation-actor"
-version = "0.5.1"
+version = "0.7.0"
 description = "Runs a headless Claude Code implementation session against one capability's own repo — a papeete-actor for one use, with the capability supplied by a sidecar."
 readme = "README.md"
 requires-python = ">=3.11"

{foundry_implementation_actor-0.5.1 → foundry_implementation_actor-0.7.0}/src/foundry_implementation_actor/__init__.py

@@ -15,6 +15,10 @@ Wiring one up is four lines:
                             engines={config.engine: ClaudeCodeEngine(config)},
                             actions={"implement-task": make_implement_task(config)})
 
+`Settings` carries how much a session may spend — turns and seconds, per door. `serve` reads it
+from the environment; the four lines above take the defaults, and an embedder passes
+`**Settings(...).engine_kwargs()` to choose its own (ADR-FIA-0007).
+
 `correlation` is exported too — an entrypoint installs its filter on the root logger's handlers
 after configuring observability, so every record the process emits carries this request's ids.
 
@@ -28,6 +32,7 @@ from .engine import ClaudeCodeEngine
 from .handler import HandlerError, make_implement_task
 from .instance import render_cards
 from .serve import ServeError, serve
+from .settings import Settings, SettingsError
 from . import conformance, correlation, grounding, instance
 
 __all__ = [
@@ -48,5 +53,7 @@ __all__ = [
     "render_cards",
     "serve",
     "ServeError",
+    "Settings",
+    "SettingsError",
     "version",
 ]

{foundry_implementation_actor-0.5.1 → foundry_implementation_actor-0.7.0}/src/foundry_implementation_actor/cli.py

@@ -22,6 +22,7 @@ from . import conformance
 from .config import CapabilityConfig, ConfigError, lint, version
 from .instance import render_cards
 from .serve import DEFAULT_PORT, ServeError, serve
+from .settings import SettingsError
 
 _REGISTRY_PLACEHOLDER = "<registry>"
 
@@ -115,9 +116,13 @@ def _cmd_serve(args: argparse.Namespace) -> int:
     # No try/except around the boot itself. A misconfigured actor that starts anyway and refuses
     # every caller at the door is strictly worse than a pod that crash-loops with the reason on
     # stdout, which is what an uncaught ConfigError produces here.
+    #
+    # `SettingsError` is the same kind of thing one env var over — `MAX_TURNS=ninety` is a
+    # misconfiguration an operator has just made and is watching for, and one line naming the
+    # variable reads better in `kubectl logs` than the traceback under it.
     try:
         serve(Path(args.folder), port=args.port)
-    except (ConfigError, ServeError) as e:
+    except (ConfigError, ServeError, SettingsError) as e:
         print(f"  FAIL {e}", file=sys.stderr)
         return 2
     return 0

{foundry_implementation_actor-0.5.1 → foundry_implementation_actor-0.7.0}/src/foundry_implementation_actor/config.py

@@ -12,7 +12,7 @@ They are now derivations of two fields. Nothing in this package spells a capabil
     capability   ACME.PARTS.CAP.SUP.007.WID                   ← the only id anyone writes
     source_repo  <owner>/ACME.PARTS.CAP.SUP.007.WID-impl       ← and the only repo
 
-    actor_name         <repo half of source_repo>
+    actor_name         {capability}-implementation
     actor_slug         same, lowercased, dots to hyphens
     git_author_name    actor_name
     git_author_email   {actor_slug}@users.noreply.github.com
@@ -21,6 +21,15 @@ They are now derivations of two fields. Nothing in this package spells a capabil
     image_name(c)      {capability lowercased}-{c}
     image_ref(r, c, v) {r}/{capability_path}/{c}:{v}
 
+IDENTITY IS `capability` + ROLE, NOT THE REPO HALF. `actor_name` used to be whatever came after
+the `/` in `source_repo`, which reads as a derivation but is really an assumption: that one
+repository holds exactly one actor. Every sidecar in existence satisfies
+`source_repo == "<owner>/" + capability + "-" + ROLE`, so deriving the name from the two facts it
+was always shorthand for produces the identical string — and it keeps producing the right one when
+a capability's three actors come to share a repository, where the repo half would name all three
+the same thing. `source_repo` is unchanged and still required: it is where this actor clones from
+and pushes to, which is a different question from who it is.
+
 THE IMAGE REF IS A THREE-WAY CONTRACT. The testing actor recomputes the identical string and the
 orchestration actor parses it back apart. `image_ref` must therefore stay byte-identical to what
 those two agree on; it is derivation output or nothing, and no tag scheme is invented here.
@@ -53,6 +62,10 @@ _CARDS_PATH = Path(__file__).resolve().parent / "cards"
 # segments rather than concatenated.
 _CAPABILITY_SEGMENT = "cap"
 
+# The role this package plays for the capability it serves. Half of this actor's identity — see
+# `CapabilityConfig.actor_name` — and the half that is a property of the package, not of the use.
+ROLE = "implementation"
+
 # What an unsubstituted placeholder looks like: a bare lowercase word in braces, and nothing else.
 # Narrow on purpose — see `CapabilityConfig.expand`.
 _PLACEHOLDER = re.compile(r"\{([a-z_]+)\}")
@@ -187,9 +200,17 @@ class CapabilityConfig:
         ground_in = tuple(_grounding(entry, source, i)
                           for i, entry in enumerate(raw["ground_in"] or ()))
 
+        source_repo = str(raw["source_repo"])
+        owner, _, repo = source_repo.partition("/")
+        if not owner or not repo:
+            # `actor_name` used to be the repo half and validated this shape on the way past. It
+            # is derived from `capability` now, so the field every clone and push URL is built
+            # from needs checking in its own right rather than by a side effect.
+            raise ConfigError(f"{source}: source_repo '{source_repo}' is not '<owner>/<repo>'")
+
         config = cls(
             capability=str(raw["capability"]),
-            source_repo=str(raw["source_repo"]),
+            source_repo=source_repo,
             registry_repo=str(raw["registry_repo"]),
             engine=str(raw["engine"]),
             components=components,
@@ -204,13 +225,13 @@ class CapabilityConfig:
 
     @property
     def actor_name(self) -> str:
-        """The repo half of `source_repo` — this actor's own name, and its git author name."""
-        owner, _, repo = self.source_repo.partition("/")
-        if not owner or not repo:
-            raise ConfigError(
-                f"source_repo '{self.source_repo}' is not '<owner>/<repo>'"
-            )
-        return repo
+        """`{capability}-{ROLE}` — this actor's own name, and its git author name.
+
+        Not the repo half of `source_repo`, which is the same string for every sidecar that
+        exists but stops being this actor's name alone the moment a capability's actors share a
+        repository. See this module's own docstring.
+        """
+        return f"{self.capability}-{ROLE}"
 
     @property
     def actor_slug(self) -> str:

{foundry_implementation_actor-0.5.1 → foundry_implementation_actor-0.7.0}/src/foundry_implementation_actor/engine.py

@@ -48,16 +48,9 @@ from papeete_actor_synchronous_messaging.engine import EngineError
 
 from . import correlation, grounding
 from .config import CapabilityConfig
-
-DEFAULT_CLONE_TIMEOUT_S = 120
-DEFAULT_SESSION_TIMEOUT_S = 1800
-DEFAULT_MAX_TURNS = 60
-
-# The assess door reads and answers; it never writes. Its budget is smaller than the implement
-# door's on every axis, and its tool list is the enforcement — a door that CANNOT write beats one
-# asked not to. See ADR-FIA-0004.
-DEFAULT_ASSESS_TIMEOUT_S = 600
-DEFAULT_ASSESS_MAX_TURNS = 15
+from .settings import (DEFAULT_ASSESS_MAX_TURNS, DEFAULT_ASSESS_TIMEOUT_S,
+                       DEFAULT_CLONE_TIMEOUT_S, DEFAULT_MAX_TURNS,
+                       DEFAULT_SESSION_TIMEOUT_S, ENV)
 
 IMPLEMENT_TOOLS = "Bash,Read,Edit,Write,Glob,Grep"
 ASSESS_TOOLS = "Read,Glob,Grep"
@@ -67,6 +60,13 @@ ASSESS_TOOLS = "Read,Glob,Grep"
 IMPLEMENT_DOOR = "implement-task"
 ASSESS_DOOR = "assess-task"
 
+# Which environment variable moves each door's budget. Keyed off `ENV` rather than spelled again,
+# so a run that says "raise MAX_TURNS" is naming the variable `Settings.from_env` actually reads.
+BUDGET_VARS = {
+    IMPLEMENT_DOOR: (ENV["max_turns"], ENV["session_timeout_s"]),
+    ASSESS_DOOR: (ENV["assess_max_turns"], ENV["assess_timeout_s"]),
+}
+
 
 # ── stream-json projection: keeping every emitted log line inside Loki's max_line_size ────────
 #
@@ -275,7 +275,9 @@ class ClaudeCodeEngine:
         self.session_timeout = session_timeout
         self.max_turns = max_turns
         # Constructor kwargs, not sidecar fields: how long this actor's own doors may think is
-        # operational tuning, not something a capability declares about itself (ADR-FIA-0002).
+        # operational tuning, not something a capability declares about itself (ADR-FIA-0007).
+        # `serve` fills every one of them from the environment through `Settings.from_env()`; an
+        # embedder passes its own and never touches the environment.
         self.assess_timeout = assess_timeout
         self.assess_max_turns = assess_max_turns
         self._configure_git_credentials()
@@ -326,7 +328,8 @@ class ClaudeCodeEngine:
             situational_prompt = self._situational_prompt(payload)
             with correlation.stage("claude-session", branch=branch,
                                    max_turns=self.max_turns, timeout_s=self.session_timeout):
-                summary = self._invoke_claude(clone_dir, system, situational_prompt)
+                summary = self._invoke_claude(clone_dir, system, situational_prompt,
+                                              door=IMPLEMENT_DOOR)
         except BaseException:
             # Every failure path removes the clone. Success does not: the clone is handed off
             # live, and `handler.py` is what removes it once it has committed and pushed — or
@@ -368,8 +371,8 @@ class ClaudeCodeEngine:
                                    timeout_s=self.assess_timeout):
                 answer = self._invoke_claude(
                     clone_dir, self._assess_system(), self._assessment_prompt(payload, schema),
-                    allowed_tools=ASSESS_TOOLS, max_turns=self.assess_max_turns,
-                    timeout=self.assess_timeout,
+                    door=ASSESS_DOOR, allowed_tools=ASSESS_TOOLS,
+                    max_turns=self.assess_max_turns, timeout=self.assess_timeout,
                 )
         finally:
             _rmtree(clone_dir)
@@ -587,6 +590,7 @@ class ClaudeCodeEngine:
     # ── the judgement itself: a claude -p session against the checked-out clone ────────────
 
     def _invoke_claude(self, clone_dir: Path, system: str, situational_prompt: str, *,
+                       door: str = IMPLEMENT_DOOR,
                        allowed_tools: str = IMPLEMENT_TOOLS,
                        max_turns: int | None = None,
                        timeout: int | None = None) -> str:
@@ -603,6 +607,7 @@ class ClaudeCodeEngine:
         """
         max_turns = self.max_turns if max_turns is None else max_turns
         timeout = self.session_timeout if timeout is None else timeout
+        turns_var, timeout_var = BUDGET_VARS.get(door, BUDGET_VARS[IMPLEMENT_DOOR])
         cmd = [
             self.claude_bin, "--print", "--output-format", "stream-json", "--verbose",
             "--append-system-prompt", system,
@@ -669,7 +674,8 @@ class ClaudeCodeEngine:
 
             if timed_out.is_set():
                 raise EngineError(
-                    f"claude session for this task exceeded {timeout}s"
+                    f"{door} exceeded its {timeout}s session budget and was killed mid-work — "
+                    f"raise {timeout_var} on this actor's Deployment, or narrow the task"
                 )
             errfile.seek(0)
             stderr = errfile.read()
@@ -678,6 +684,21 @@ class ClaudeCodeEngine:
             raise EngineError(
                 f"claude (rc={proc.returncode}) produced no result event: {stderr[-2000:]}"
             )
+        if final.get("subtype") == "error_max_turns":
+            # The one failure an operator can actually act on, and the one that used to say
+            # least: a session cut off with the work half-done leaves a clone that is about to be
+            # removed and a transcript nobody is looking at, and `subtype=error_max_turns` named
+            # neither the budget, nor the door that hit it, nor the variable that moves it.
+            #
+            # `result` is usually empty here — the session was stopped, not finished — so it is
+            # quoted only when there is something in it.
+            said = (final.get("result") or "")[:2000]
+            raise EngineError(
+                f"{door} ran out of turns (max_turns={max_turns}) and was stopped mid-work, so "
+                f"nothing it produced is kept — raise {turns_var} on this actor's Deployment, or "
+                f"narrow the task."
+                + (f" Its last words: {said}" if said else "")
+            )
         if final.get("is_error") or proc.returncode != 0:
             raise EngineError(
                 f"claude session failed (subtype={final.get('subtype')}): "

{foundry_implementation_actor-0.5.1 → foundry_implementation_actor-0.7.0}/src/foundry_implementation_actor/schemas/agentic-context.schema.yaml

@@ -76,7 +76,8 @@ fields:
     type: string
     doc: >-
       `<owner>/<repo>` of the repository this actor clones, writes to, and pushes a branch to.
-      The actor's own name and its git commit identity are derived from the repo half.
+      Where it works, not who it is: the actor's own name and its git commit identity are
+      `<capability>-implementation`, derived from `capability` and this package's own role.
 
   registry_repo:
     type: string

{foundry_implementation_actor-0.5.1 → foundry_implementation_actor-0.7.0}/src/foundry_implementation_actor/serve.py

@@ -26,6 +26,7 @@ from .config import CapabilityConfig
 from .engine import ClaudeCodeEngine
 from .handler import make_implement_task
 from .instance import CARD_FILES, render_cards
+from .settings import Settings
 
 DEFAULT_PORT = 8080
 
@@ -104,6 +105,9 @@ def serve(folder: str | Path = ".", port: int | None = None) -> None:
     folder = Path(folder)
     # The sidecar is the only thing in that folder this package did not put there.
     config = CapabilityConfig.load(folder)
+    # Read before the mailbox is built: a misspelt budget is a crash-loop with the reason on
+    # stdout, not a surprise at the first door call.
+    settings = Settings.from_env()
     cards = _cards_for(config, folder)
 
     # PORT, not a hardcoded default: an env var is how an environment moves it without editing an
@@ -116,7 +120,9 @@ def serve(folder: str | Path = ".", port: int | None = None) -> None:
         # One engine instance serves every door that names one: `Actor.judge()` hands it the door
         # id and it dispatches on that. The key comes from the sidecar rather than a literal here,
         # so a use whose sidecar names another engine is caught by its own card.
-        engines={config.engine: ClaudeCodeEngine(config)},
+        # ...constructed with the budget the environment set, so `serve` is no longer the place
+        # that decides how long a session may think (ADR-FIA-0007).
+        engines={config.engine: ClaudeCodeEngine(config, **settings.engine_kwargs())},
         # `assess-task` needs no entry: it is a query with an engine and no handler, so the
         # engine's own judgement is the reply and there is no deterministic half to contain.
         actions={"implement-task": make_implement_task(config)},
@@ -124,6 +130,13 @@ def serve(folder: str | Path = ".", port: int | None = None) -> None:
     # An `event` record rather than a `print`: a restart in the middle of a run is one of the most
     # explanatory things a pipeline panel can show, and `print` reaches only the container's own
     # stdout — never the OTLP handler, so never the log backend.
+    # The budget is on this record because a run that ran out of it has to be diagnosable from
+    # the log alone: "60 turns" in the failure means nothing unless the boot line says whether 60
+    # was what this Deployment asked for.
     correlation.event("actor-started", actor=actor.name, port=port, capability=config.capability,
-                      cards=str(cards))
+                      cards=str(cards),
+                      max_turns=settings.max_turns,
+                      session_timeout_s=settings.session_timeout_s,
+                      assess_max_turns=settings.assess_max_turns,
+                      assess_timeout_s=settings.assess_timeout_s)
     mailbox.serve_forever()

foundry_implementation_actor-0.7.0/src/foundry_implementation_actor/settings.py

@@ -0,0 +1,102 @@
+"""`Settings` — how much a session may spend, as opposed to which capability it serves.
+
+WHY THIS IS NOT THE SIDECAR. The sidecar declares facts about a capability: its id, its repo, its
+components, what it grounds itself in. How many turns a door may take and how long it may take
+them are facts about an ENVIRONMENT — a capability whose code is slow to navigate (a solution that
+restores packages on every build, a monorepo whose grep is expensive) needs a larger budget for
+exactly the same task definition, and the same capability deployed twice may want two answers.
+A capability declares what it is, not how long its actor may think (ADR-FIA-0007; ADR-FIA-0002
+drew the same line when it took testing out of the sidecar).
+
+WHY NOT CONSTRUCTOR KEYWORDS ALONE. They were exactly that, and `serve` constructed the engine
+with none of them — so the budget of every actor running from the published image was whatever
+this file says, and an operator facing an out-of-turns failure had no way to move it short of
+editing the package. They are still constructor keywords, for an embedder; `from_env` is how
+`serve` fills them from the Pod spec, which is where an operator can actually reach.
+
+WHERE THE DEFAULTS LIVE. Here, not in `engine.py`, because `engine.py` names `ENV` when it
+reports a budget that ran out — and one table is what keeps the failure message, `from_env` and
+the README from disagreeing about what an operator should set.
+"""
+from __future__ import annotations
+
+import os
+from dataclasses import dataclass, fields, replace
+
+from .grounding import DEFAULT_FETCH_TIMEOUT_S
+
+DEFAULT_CLONE_TIMEOUT_S = 120
+DEFAULT_SESSION_TIMEOUT_S = 1800
+DEFAULT_MAX_TURNS = 60
+
+# The assess door reads and answers; it never writes. Its budget is smaller than the implement
+# door's on every axis, and its tool list is the enforcement — a door that CANNOT write beats one
+# asked not to. See ADR-FIA-0004.
+DEFAULT_ASSESS_TIMEOUT_S = 600
+DEFAULT_ASSESS_MAX_TURNS = 15
+
+
+class SettingsError(ValueError):
+    """An environment variable was set to something this actor cannot use."""
+
+
+# field name → environment variable. One table, so `from_env`, the engine's own out-of-budget
+# message and the README cannot disagree about what to set.
+ENV = {
+    "max_turns": "MAX_TURNS",
+    "session_timeout_s": "SESSION_TIMEOUT_S",
+    "assess_max_turns": "ASSESS_MAX_TURNS",
+    "assess_timeout_s": "ASSESS_TIMEOUT_S",
+    "clone_timeout_s": "CLONE_TIMEOUT_S",
+    "fetch_timeout_s": "FETCH_TIMEOUT_S",
+}
+
+# Settings field → the `ClaudeCodeEngine` constructor keyword it fills. The two spellings differ
+# on purpose: `_s` says "seconds" to whoever reads a Deployment, and the engine's keywords are
+# already published API.
+ENGINE_KWARGS = {
+    "max_turns": "max_turns",
+    "session_timeout_s": "session_timeout",
+    "assess_max_turns": "assess_max_turns",
+    "assess_timeout_s": "assess_timeout",
+    "clone_timeout_s": "clone_timeout",
+    "fetch_timeout_s": "fetch_timeout",
+}
+
+
+@dataclass(frozen=True)
+class Settings:
+    max_turns: int = DEFAULT_MAX_TURNS
+    session_timeout_s: int = DEFAULT_SESSION_TIMEOUT_S
+    assess_max_turns: int = DEFAULT_ASSESS_MAX_TURNS
+    assess_timeout_s: int = DEFAULT_ASSESS_TIMEOUT_S
+    clone_timeout_s: int = DEFAULT_CLONE_TIMEOUT_S
+    fetch_timeout_s: int = DEFAULT_FETCH_TIMEOUT_S
+
+    @classmethod
+    def from_env(cls, environ: dict | None = None) -> Settings:
+        """Defaults, overridden by whichever of `ENV`'s variables are set and non-empty.
+
+        A typo raises `SettingsError` — at boot, where it is a crash-loop with the reason on
+        stdout, rather than silently falling back to the default and leaving an operator who
+        raised a budget wondering why nothing changed.
+        """
+        environ = os.environ if environ is None else environ
+        values: dict = {}
+        for field in fields(cls):
+            variable = ENV[field.name]
+            raw = environ.get(variable)
+            if raw is None or raw == "":
+                continue
+            try:
+                value = int(raw)
+            except ValueError as e:
+                raise SettingsError(f"{variable}={raw!r} is not an integer") from e
+            if value < 1:
+                raise SettingsError(f"{variable}={raw!r} must be at least 1")
+            values[field.name] = value
+        return replace(cls(), **values)
+
+    def engine_kwargs(self) -> dict:
+        """What `serve` splats into `ClaudeCodeEngine(config, **...)`."""
+        return {keyword: getattr(self, field) for field, keyword in ENGINE_KWARGS.items()}

{foundry_implementation_actor-0.5.1 → foundry_implementation_actor-0.7.0}/tests/test_cli.py

@@ -48,6 +48,24 @@ def test_show_expands_the_fetch_argv(config, tmp_path, capsys):
     assert "{capability}" not in out
 
 
+def test_serve_refuses_a_budget_it_cannot_read(config, tmp_path, monkeypatch, capsys):
+    """A misspelt budget is a misconfiguration an operator has just made and is watching for. One
+    line naming the variable reads better in a pod's log than the traceback under it."""
+    import importlib
+    # `foundry_implementation_actor.serve` is the FUNCTION on the package — the module is only
+    # reachable by name.
+    serve_module = importlib.import_module("foundry_implementation_actor.serve")
+    # The wire half is an extra this suite does not install, and it is imported before anything
+    # this test is about. Stand it down; the boot then reaches the budget, which is the point.
+    monkeypatch.setattr(serve_module, "_imports",
+                        lambda: (object(), object(), lambda: None))
+    monkeypatch.setenv("MAX_TURNS", "ninety")
+    assert cli.main(["serve", str(tmp_path)]) == 2
+    err = capsys.readouterr().err
+    assert "FAIL" in err
+    assert "MAX_TURNS" in err and "ninety" in err
+
+
 def test_the_cli_needs_a_subcommand(capsys):
     with pytest.raises(SystemExit):
         cli.main([])

{foundry_implementation_actor-0.5.1 → foundry_implementation_actor-0.7.0}/tests/test_config.py

@@ -205,3 +205,45 @@ def test_components_may_not_be_empty(sidecar_dict, write_sidecar):
     sidecar_dict["components"] = []
     with pytest.raises(ConfigError, match="empty"):
         CapabilityConfig.load(write_sidecar(sidecar_dict))
+
+
+# ── identity: capability + role, not the repo half ──────────────────────────────────────────
+
+def test_the_actor_name_is_exactly_what_the_repo_half_used_to_be(config):
+    """The no-op half of the change, pinned.
+
+    `actor_name` was `source_repo.partition("/")[2]`. It is `{capability}-{ROLE}` now. Every
+    sidecar that exists satisfies `source_repo == "<owner>/" + capability + "-" + ROLE`, so the
+    two derivations agree on all of them — which is what makes this releasable on its own, ahead
+    of any repository moving.
+    """
+    assert config.source_repo == f"acme-lab/{config.capability}-implementation"
+    assert config.actor_name == config.source_repo.partition("/")[2]
+    assert config.actor_name == "ACME.PARTS.CAP.SUP.007.WID-implementation"
+
+
+def test_the_actor_name_no_longer_follows_the_repository(sidecar_dict, write_sidecar):
+    """The point of the change: three actors in one repository still have three names.
+
+    A consolidated capability repository is named for the capability alone, with no role suffix,
+    because all three of its actors live in it. Under the old derivation this actor would have
+    been called `ACME.PARTS.CAP.SUP.007.WID` — and so would both of its siblings.
+    """
+    sidecar_dict["source_repo"] = "acme-lab/ACME.PARTS.CAP.SUP.007.WID"
+    config = CapabilityConfig.load(write_sidecar(sidecar_dict))
+    assert config.actor_name == "ACME.PARTS.CAP.SUP.007.WID-implementation"
+    assert config.git_author_name == config.actor_name
+    assert config.actor_slug == "acme-parts-cap-sup-007-wid-implementation"
+    assert config.clone_prefix("TASK-042") == \
+        "acme-parts-cap-sup-007-wid-implementation-TASK-042-"
+
+
+def test_a_malformed_source_repo_is_still_refused(sidecar_dict, write_sidecar):
+    """`actor_name` used to validate this shape on its way past, and nothing else did.
+
+    `source_repo` is still what every clone and push URL is built from, so a `source_repo` that
+    is not `<owner>/<repo>` has to keep failing at load rather than at the first push.
+    """
+    sidecar_dict["source_repo"] = "just-a-name"
+    with pytest.raises(ConfigError, match="<owner>/<repo>"):
+        CapabilityConfig.load(write_sidecar(sidecar_dict))

{foundry_implementation_actor-0.5.1 → foundry_implementation_actor-0.7.0}/tests/test_engine.py

@@ -14,8 +14,8 @@ import pytest
 from papeete_actor_synchronous_messaging.engine import Engine, EngineError
 
 from foundry_implementation_actor.engine import (
-    ASSESS_TOOLS, IMPLEMENT_TOOLS, LINE_BUDGET, ClaudeCodeEngine, _door_from_prompt,
-    _extract_json, _line, _payload_from_prompt, _project,
+    ASSESS_DOOR, ASSESS_TOOLS, IMPLEMENT_DOOR, IMPLEMENT_TOOLS, LINE_BUDGET, ClaudeCodeEngine,
+    _door_from_prompt, _extract_json, _line, _payload_from_prompt, _project,
 )
 
 PAYLOAD = {
@@ -308,6 +308,92 @@ def test_the_tool_list_removes_tools_rather_than_only_approving_some(config, tmp
     assert argv[argv.index("--tools") + 2].startswith("--")
 
 
+# ── a budget that ran out says what to change ───────────────────────────────────────────────
+
+# `--max-turns` was reached: the CLI still emits a result event, with this subtype and no result
+# text worth reading. The whole point of the branch under test is that the failure has to say
+# something the event itself does not.
+FAKE_OUT_OF_TURNS = """
+import json, sys
+print(json.dumps({"type": "result", "subtype": "error_max_turns", "is_error": True,
+                  "result": "", "num_turns": 60}))
+sys.exit(1)
+"""
+
+FAKE_HANGS = """
+import time
+time.sleep(30)
+"""
+
+
+def _fake_claude(tmp_path, body):
+    script = tmp_path / "claude"
+    script.write_text(f"#!{sys.executable}\n{body}")
+    script.chmod(0o755)
+    return script
+
+
+@pytest.fixture
+def budget_engine(config, tmp_path, monkeypatch):
+    monkeypatch.setenv("GIT_CONFIG_GLOBAL", str(tmp_path / "gitconfig"))
+
+    def _build(body):
+        return ClaudeCodeEngine(config, github_token="ghs_fake",
+                                claude_bin=str(_fake_claude(tmp_path, body)))
+    return _build
+
+
+def test_running_out_of_turns_names_the_limit_the_door_and_the_variable(budget_engine, tmp_path):
+    """The failure this whole change exists for. A live run died at `error_max_turns` with the fix
+    written but not committed, and `claude session failed (subtype=error_max_turns):` said neither
+    what the limit was, nor which door hit it, nor what an operator could do about it."""
+    engine = budget_engine(FAKE_OUT_OF_TURNS)
+    with pytest.raises(EngineError) as excinfo:
+        engine._invoke_claude(tmp_path, "system", "prompt", door=IMPLEMENT_DOOR)
+    message = str(excinfo.value)
+    assert "implement-task" in message
+    assert f"max_turns={engine.max_turns}" in message
+    assert "MAX_TURNS" in message
+    # ...and it says what was lost, because the clone is removed on this path.
+    assert "nothing it produced is kept" in message
+    # `result` is empty on this subtype, and an empty quotation is noise.
+    assert "last words" not in message
+
+
+def test_the_assess_door_names_its_own_variable_not_the_implement_one(budget_engine, tmp_path):
+    """Two doors, two budgets. An operator told to raise `MAX_TURNS` for an assess session that
+    ran out would move the wrong number and see no change."""
+    engine = budget_engine(FAKE_OUT_OF_TURNS)
+    with pytest.raises(EngineError) as excinfo:
+        engine._invoke_claude(tmp_path, "system", "prompt", door=ASSESS_DOOR,
+                              allowed_tools=ASSESS_TOOLS, max_turns=engine.assess_max_turns,
+                              timeout=engine.assess_timeout)
+    message = str(excinfo.value)
+    assert "assess-task" in message
+    assert f"max_turns={engine.assess_max_turns}" in message
+    assert "raise ASSESS_MAX_TURNS" in message
+    # ...and not the implement door's, which is a substring of it — hence the whole remedy phrase.
+    assert "raise MAX_TURNS" not in message
+
+
+def test_a_timeout_names_its_own_variable_too(budget_engine, tmp_path):
+    engine = budget_engine(FAKE_HANGS)
+    with pytest.raises(EngineError) as excinfo:
+        engine._invoke_claude(tmp_path, "system", "prompt", door=IMPLEMENT_DOOR, timeout=1)
+    message = str(excinfo.value)
+    assert "implement-task" in message
+    assert "1s" in message
+    assert "SESSION_TIMEOUT_S" in message
+
+
+def test_another_session_failure_is_left_alone(budget_engine, tmp_path):
+    """Only the out-of-budget paths gained a remedy. A session that failed for its own reasons
+    still reports the subtype and what it said — inventing a remedy for those would be worse."""
+    engine = budget_engine(FAKE_OUT_OF_TURNS.replace("error_max_turns", "error_during_execution"))
+    with pytest.raises(EngineError, match="error_during_execution"):
+        engine._invoke_claude(tmp_path, "system", "prompt")
+
+
 def test_the_assess_session_gets_a_smaller_budget(assessed, engine):
     _, seen = assessed('```json\n{"feasible": true}\n```')
     assert seen["max_turns"] == engine.assess_max_turns < engine.max_turns

foundry_implementation_actor-0.7.0/tests/test_settings.py

@@ -0,0 +1,107 @@
+"""The session budget, as something an environment can move.
+
+It used to be six constructor keywords that `serve` passed none of, so the only budget any actor
+running from the published image could have was the one written here. These tests pin the three
+things that makes true: the defaults did not change, every one of them has a variable, and a typo
+is refused at boot rather than silently ignored.
+"""
+from __future__ import annotations
+
+import pytest
+
+from foundry_implementation_actor.engine import BUDGET_VARS, ClaudeCodeEngine
+from foundry_implementation_actor.grounding import DEFAULT_FETCH_TIMEOUT_S
+from foundry_implementation_actor.settings import ENGINE_KWARGS, ENV, Settings, SettingsError
+
+
+# ── the defaults, which this pass deliberately did not retune ───────────────────────────────
+
+def test_an_empty_environment_is_the_documented_default():
+    """60 turns / 1800s to implement, 15 / 600 to assess. Making the budget movable is not the
+    same act as moving it, and these are the numbers every live use is already running."""
+    settings = Settings.from_env({})
+    assert (settings.max_turns, settings.session_timeout_s) == (60, 1800)
+    assert (settings.assess_max_turns, settings.assess_timeout_s) == (15, 600)
+    assert settings.clone_timeout_s == 120
+    assert settings.fetch_timeout_s == DEFAULT_FETCH_TIMEOUT_S
+
+
+def test_the_assess_door_is_the_smaller_budget_by_default():
+    """It reads and answers; it never writes. Smaller on every axis — see ADR-FIA-0004."""
+    settings = Settings.from_env({})
+    assert settings.assess_max_turns < settings.max_turns
+    assert settings.assess_timeout_s < settings.session_timeout_s
+
+
+# ── every field has a variable, and every variable moves its field ──────────────────────────
+
+def test_every_field_is_reachable_from_the_environment():
+    """`ENV` is the one table. A field added without an entry would raise inside `from_env`
+    rather than quietly becoming unreachable, which is the failure this whole change exists to
+    remove — so it is asserted here too."""
+    from dataclasses import fields
+    assert {f.name for f in fields(Settings)} == set(ENV) == set(ENGINE_KWARGS)
+
+
+@pytest.mark.parametrize("field,variable", sorted(ENV.items()))
+def test_each_variable_overrides_its_own_field(field, variable):
+    settings = Settings.from_env({variable: "97"})
+    assert getattr(settings, field) == 97
+    # ...and nothing else moved with it.
+    others = {f: getattr(settings, f) for f in ENV if f != field}
+    assert others == {f: getattr(Settings(), f) for f in ENV if f != field}
+
+
+def test_an_unset_or_empty_variable_leaves_the_default():
+    """An empty string is what a Deployment leaves behind when someone blanks a value rather than
+    deleting the `env:` entry. It means "unset", not "zero"."""
+    assert Settings.from_env({"MAX_TURNS": ""}).max_turns == 60
+
+
+# ── a typo fails at boot, naming itself ─────────────────────────────────────────────────────
+
+def test_a_non_integer_is_refused_and_names_the_variable():
+    with pytest.raises(SettingsError) as excinfo:
+        Settings.from_env({"MAX_TURNS": "ninety"})
+    assert "MAX_TURNS" in str(excinfo.value)
+    assert "ninety" in str(excinfo.value)
+
+
+def test_zero_and_negative_are_refused():
+    """A budget of zero is not a budget; it is a door that cannot answer. Refuse it where the
+    reason reaches an operator, not at the first request."""
+    for value in ("0", "-1"):
+        with pytest.raises(SettingsError, match="ASSESS_MAX_TURNS"):
+            Settings.from_env({"ASSESS_MAX_TURNS": value})
+
+
+def test_the_refusal_names_the_variable_that_was_wrong_not_the_first_one():
+    with pytest.raises(SettingsError) as excinfo:
+        Settings.from_env({"MAX_TURNS": "90", "ASSESS_TIMEOUT_S": "10 minutes"})
+    assert "ASSESS_TIMEOUT_S" in str(excinfo.value)
+    assert "MAX_TURNS" not in str(excinfo.value)
+
+
+# ── what `serve` splats into the engine ─────────────────────────────────────────────────────
+
+def test_engine_kwargs_are_the_engines_own_keywords(config, tmp_path, monkeypatch):
+    """The two spellings differ — `session_timeout_s` in a Deployment, `session_timeout` in the
+    constructor — so this checks the mapping against the real signature rather than a copy."""
+    monkeypatch.setenv("GIT_CONFIG_GLOBAL", str(tmp_path / "gitconfig"))
+    settings = Settings.from_env({"MAX_TURNS": "90", "ASSESS_TIMEOUT_S": "300"})
+    engine = ClaudeCodeEngine(config, github_token="ghs_fake", **settings.engine_kwargs())
+    assert engine.max_turns == 90
+    assert engine.assess_timeout == 300
+    assert engine.session_timeout == 1800
+    assert engine.clone_timeout == 120
+
+
+# ── the failure message and the table cannot drift apart ────────────────────────────────────
+
+def test_both_doors_name_variables_that_actually_exist():
+    """`BUDGET_VARS` is what an out-of-budget failure tells an operator to set. It is keyed off
+    `ENV`, and this is what keeps that true."""
+    named = {name for pair in BUDGET_VARS.values() for name in pair}
+    assert named <= set(ENV.values())
+    assert BUDGET_VARS["implement-task"] == ("MAX_TURNS", "SESSION_TIMEOUT_S")
+    assert BUDGET_VARS["assess-task"] == ("ASSESS_MAX_TURNS", "ASSESS_TIMEOUT_S")

{foundry_implementation_actor-0.5.1 → foundry_implementation_actor-0.7.0}/uv.lock

@@ -18,7 +18,7 @@ wheels = [
 
 [[package]]
 name = "foundry-implementation-actor"
-version = "0.5.1"
+version = "0.7.0"
 source = { editable = "." }
 dependencies = [
     { name = "papeete-actor-synchronous-messaging" },