lean-runtime 2.9.0__tar.gz → 2.9.2__tar.gz

{lean_runtime-2.9.0 → lean_runtime-2.9.2}/CHANGELOG.md

@@ -2,6 +2,25 @@
 
 ## Unreleased
 
+## 2.9.2 - 2026-08-16
+
+- Keep one fail-closed publication authentication session from push preflight through
+  upload, propagate explicit publication timeouts to credential and registry I/O,
+  and report credential-provider failures without labeling them anonymous.
+- Use logical project names during atomic initialization, show compact TTY-only check
+  progress, cache Lean executable identities across invocations, and report check
+  command-preparation timing.
+- Track disposable execution and resolution workspaces with process-held leases;
+  include their footprint in storage reporting and reclaim abandoned workspaces with
+  `clean` while protecting active work.
+
+## 2.9.1 - 2026-08-15
+
+- Make GHCR credential discovery a single bounded GitHub CLI status read so a
+  transient identity lookup cannot silently downgrade an authenticated account
+  to anonymous; add a validated `lean-runtime.publication/v1` envelope behind
+  `publish environment --json`.
+
 ## 2.9.0 - 2026-08-15
 
 - Make environment publication fail closed: verify registry push access before

{lean_runtime-2.9.0/lean_runtime.egg-info → lean_runtime-2.9.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: lean-runtime
-Version: 2.9.0
+Version: 2.9.2
 Summary: Run Lean 4 proofs from Python or standalone files
 Author: Alejandro Radisic
 License-Expression: Apache-2.0

{lean_runtime-2.9.0 → lean_runtime-2.9.2}/docs/cli.md

@@ -78,6 +78,7 @@ lean-runtime copy save research-stack --output research-stack.lean-environment
 lean-runtime --home /tmp/fresh copy open research-stack.lean-environment --name research-stack
 lean-runtime publish environment environment.lock.json --publish-to ghcr.io/owner/lean-environments
 lean-runtime publish environment --publish-to ghcr.io/owner/lean-environments --check-access
+lean-runtime publish environment --publish-to ghcr.io/owner/lean-environments --check-access --json
 lean-runtime check research-stack Main.lean --json
 lean-runtime inspect research-stack --packages
 lean-runtime environments
@@ -214,6 +215,9 @@ lean-runtime check research-stack Main.lean --include Support/Defs.lean
 ```
 
 Resolution and materialization print structured lifecycle progress to stderr.
+One-shot checks show a compact in-place status on interactive terminals while Lean
+is working. Redirected output, `--json`, and `--quiet` remain free of human progress;
+`--timings` separates command preparation from Lean execution.
 Pass global `--quiet` before the subcommand to suppress it.
 
 Pass global `--timings` before the subcommand for stable phase timing output. Machine-readable

{lean_runtime-2.9.0 → lean_runtime-2.9.2}/docs/environments.md

@@ -93,6 +93,12 @@ Short-lived execution leases prevent deletion during cloning without
 serializing concurrent checks. Locks and source snapshots remain retained in
 the current store schema.
 
+Disposable execution and dependency-resolution workspaces carry their own
+process-held ownership leases. `storage` includes them under `Scratch`, and
+`clean` previews and reclaims abandoned workspaces while retaining every
+workspace with a live owner. Legacy scratch directories created before ownership
+metadata are removed only by an explicit `clean --execute` after the safety grace.
+
 Sparse downloads are stored once by artifact digest under the shared module
 CAS and hardlinked into environment projections when the filesystem permits.
 `lean-runtime storage` reports this category separately. Because it is shared,

{lean_runtime-2.9.0 → lean_runtime-2.9.2}/docs/portable-copies.md

@@ -121,6 +121,9 @@ lean-runtime publish environment \
   --check-access
 ```
 
+Add `--json` for the versioned `lean-runtime.publication/v1` success or failure
+envelope. The process exit code retains the classification below.
+
 For GHCR, credentials are selected in this order: the
 `LEAN_RUNTIME_REGISTRY_USERNAME` / `LEAN_RUNTIME_REGISTRY_PASSWORD` pair, an
 authenticated GitHub CLI session, then anonymous access. The access report names
@@ -132,6 +135,12 @@ run:
 gh auth refresh -s write:packages,read:packages
 ```
 
+Credential discovery is fail-closed: a configured provider that times out or
+returns an unusable token stops publication before any registry request. The same
+verified credential is retained from preflight through upload; it is not rediscovered
+after a long environment build. An explicitly supplied publication `--timeout`
+also applies to credential discovery and registry network operations.
+
 Publish the current platform after ensuring the lock:
 
 ```bash

{lean_runtime-2.9.0 → lean_runtime-2.9.2}/lean_runtime/cli.py

@@ -8,12 +8,13 @@ import os
 import re
 import sys
 import time
+from dataclasses import replace
 from datetime import datetime
 from importlib.metadata import version as distribution_version
 from pathlib import Path
 from typing import Any, cast
 
-from .console import styler_for
+from .console import ConsoleRenderer, styler_for
 from .environments import ExecutionCapture
 from .errors import (
     LeanRuntimeError,
@@ -55,6 +56,7 @@ def _schema_for(command: str) -> str:
         "matrix": "lean-runtime.matrix/v1",
         "clean": "lean-runtime.cleanup/v1",
         "inspect": "lean-runtime.inspect/v1",
+        "build-and-publish": "lean-runtime.publication/v1",
     }.get(command, "lean-runtime.execution/v1")
 
 
@@ -88,6 +90,7 @@ def _render_storage(status: StoreStatus) -> None:
         ("Project packages", status.project_packages, status.project_packages_bytes),
         ("Toolchains", None, status.toolchains_bytes),
         ("Executions", status.executions, status.executions_bytes),
+        ("Scratch", status.scratch_workspaces, status.scratch_bytes),
     )
     for label, count, bytes_used in rows:
         counted = f"{count:>5}" if count is not None else "     "
@@ -138,7 +141,11 @@ def _render_doctor(report: DoctorReport) -> None:
         print(f"{symbols[check.status]} {check.name}: {check.message}")
 
 
-def _render_cleanup(environments: CleanupReport, downloads: DownloadCleanupReport | None) -> None:
+def _render_cleanup(
+    environments: CleanupReport,
+    downloads: DownloadCleanupReport | None,
+    scratch: CleanupReport | None = None,
+) -> None:
     style = styler_for(sys.stdout)
     retained_note = style.dim(
         f"Retained {len(environments.retained)} environment(s) (named, recent, or in use)."
@@ -168,17 +175,36 @@ def _render_cleanup(environments: CleanupReport, downloads: DownloadCleanupRepor
                 )
             else:
                 print("No unreferenced cached downloads to remove.")
+        if scratch is not None:
+            if scratch.candidates:
+                anything = True
+                print(
+                    style.bold(
+                        f"Would remove {len(scratch.candidates)} abandoned workspace(s) · "
+                        f"{format_byte_size(scratch.candidate_bytes)}"
+                    )
+                )
+            else:
+                print("No abandoned workspaces to remove.")
         print(retained_note)
         if anything:
             print()
             print("This was a preview. Re-run with --execute to delete.")
         return
     reclaimed = environments.reclaimed_bytes + (downloads.reclaimed_bytes if downloads else 0)
-    removed = len(environments.removed) + (len(downloads.removed) if downloads else 0)
+    if scratch is not None:
+        reclaimed += scratch.reclaimed_bytes
+    removed = (
+        len(environments.removed)
+        + (len(downloads.removed) if downloads else 0)
+        + (len(scratch.removed) if scratch else 0)
+    )
     if removed:
         parts = [f"{len(environments.removed)} environment(s)"]
         if downloads is not None:
             parts.append(f"{len(downloads.removed)} cached download(s)")
+        if scratch is not None:
+            parts.append(f"{len(scratch.removed)} abandoned workspace(s)")
         print(
             style.green(f"Removed {' and '.join(parts)} · reclaimed {format_byte_size(reclaimed)}")
         )
@@ -289,11 +315,15 @@ def _print_publication_failure(exc: PublicationError) -> None:
         file=sys.stderr,
     )
     print(f"  {exc}", file=sys.stderr)
-    identity = exc.username or "anonymous"
-    print(
-        f"  Authentication: {identity} (source: {exc.credential_source})",
-        file=sys.stderr,
-    )
+    if exc.attempted_provider is not None:
+        print("  Authentication: unavailable (source: none)", file=sys.stderr)
+        print(f"  Attempted provider: {exc.attempted_provider}", file=sys.stderr)
+    else:
+        identity = exc.username or "anonymous"
+        print(
+            f"  Authentication: {identity} (source: {exc.credential_source})",
+            file=sys.stderr,
+        )
     if exc.partial:
         print(
             "  No verified final release was produced; immutable platform content may exist.",
@@ -435,11 +465,19 @@ Run `lean-runtime COMMAND --help` for examples and options.""",
     publish_environment.add_argument("--publish-to", required=True)
     publish_environment.add_argument("--tag", action="append", default=[])
     publish_environment.add_argument("--name")
-    publish_environment.add_argument("--timeout", type=float, default=1800)
+    publish_environment.add_argument(
+        "--timeout",
+        type=float,
+        default=None,
+        help="override timeouts for credential, registry, hydration, and build operations",
+    )
     publish_environment.add_argument("--platform-only", action="store_true")
     publish_environment.add_argument("--accelerate", action="store_true")
     publish_environment.add_argument("--sign", action="store_true")
     publish_environment.add_argument("--attest", action="store_true")
+    publish_environment.add_argument(
+        "--json", action="store_true", help="emit a versioned JSON envelope"
+    )
     publish_environment.add_argument(
         "--check-access",
         action="store_true",
@@ -507,8 +545,8 @@ Run `lean-runtime COMMAND --help` for examples and options.""",
     push.add_argument(
         "--timeout",
         type=float,
-        default=1800,
-        help="maximum seconds for each artifact hydration and the environment build",
+        default=None,
+        help="override timeouts for credential, registry, hydration, and build operations",
     )
     push.add_argument(
         "--platform-only",
@@ -526,6 +564,7 @@ Run `lean-runtime COMMAND --help` for examples and options.""",
     push.add_argument(
         "--attest", action="store_true", help="publish a signed source/probe attestation"
     )
+    push.add_argument("--json", action="store_true", help="emit a versioned JSON envelope")
     push.add_argument(
         "--check-access",
         action="store_true",
@@ -928,6 +967,10 @@ def main(argv: list[str] | None = None) -> int:
         args.mathlib = None if args.core else args.mathlib_version
     operation_started = time.monotonic()
     display_path: str | None = None
+    renderer = ConsoleRenderer(
+        mode="quiet" if args.quiet or getattr(args, "json", False) else None,
+        verbose=args.verbose,
+    )
     try:
         if args.command == "completion":
             print(_completion_script(args.shell), end="")
@@ -942,7 +985,7 @@ def main(argv: list[str] | None = None) -> int:
         )
         runtime = Runtime(
             home=args.home,
-            on_event=None if args.quiet else _progress,
+            on_event=renderer,
             availability=selected_availability,
             libraries=args.libraries,
             max_download_bytes=selected_download_limit,
@@ -1185,16 +1228,26 @@ def main(argv: list[str] | None = None) -> int:
             _json(environment.inspect().to_dict())
             return 0
         if args.command == "build-and-publish":
-            access = runtime.check_publication_access(args.publish_to)
+            timeout_override = args.timeout
+            publisher = runtime.begin_publication(
+                args.publish_to,
+                auth_timeout=timeout_override if timeout_override is not None else 10,
+                registry_timeout=timeout_override if timeout_override is not None else 30,
+            )
+            access = publisher.check_access()
             if args.check_access:
-                _json(access.to_dict())
+                _json(
+                    envelope(_schema_for(args.command), ok=True, data=access.to_dict())
+                    if args.json
+                    else access.to_dict()
+                )
                 return 0
             if args.lock is None:
                 raise ValueError("publish environment requires LOCK unless --check-access is used")
             environment = runtime.open_exact(
                 EnvironmentLock.load(args.lock),
                 name=args.name,
-                build_timeout=args.timeout,
+                build_timeout=timeout_override if timeout_override is not None else 1800,
                 accelerate=args.accelerate,
             )
             publication = runtime.publish_environment(
@@ -1204,11 +1257,16 @@ def main(argv: list[str] | None = None) -> int:
                 finalize=not args.platform_only,
                 sign=args.sign,
                 attest=args.attest,
+                publisher=publisher,
             ).to_dict()
             publication["consumer_command"] = (
                 f"lean-runtime --library {args.publish_to} download {args.lock}"
             )
-            _json(publication)
+            _json(
+                envelope(_schema_for(args.command), ok=True, data=publication)
+                if args.json
+                else publication
+            )
             return 0
         if args.command == "finalize-publication":
             descriptors = []
@@ -1474,10 +1532,15 @@ def main(argv: list[str] | None = None) -> int:
                 if args.include_downloads
                 else None
             )
+            gc_scratch = runtime.clean_scratch(
+                dry_run=not args.execute,
+                minimum_age_seconds=min(args.minimum_age_hours * 3600, 3600),
+            )
             if args.json:
                 gc_payload: dict[str, Any] = {
                     "environments": gc_report.to_dict(),
                     "downloaded_files": gc_downloads.to_dict() if gc_downloads else None,
+                    "scratch": gc_scratch.to_dict(),
                 }
                 _json(
                     envelope(
@@ -1487,7 +1550,7 @@ def main(argv: list[str] | None = None) -> int:
                     )
                 )
             else:
-                _render_cleanup(gc_report, gc_downloads)
+                _render_cleanup(gc_report, gc_downloads, gc_scratch)
             return 0
         if args.command == "check":
             if args.across is not None:
@@ -1577,6 +1640,14 @@ def main(argv: list[str] | None = None) -> int:
                         )
                         _emit_result(watched_result, False)
                     time.sleep(args.watch_interval)
+            check_subject = (
+                Path(args.inputs[-1]).name
+                if args.inputs and args.inputs[-1] != "-"
+                else "stdin"
+                if args.inputs
+                else Path(args.project or ".").resolve().name
+            )
+            runtime.events.emit("check.started", "Checking Lean input", subject=check_subject)
             if args.project is not None and args.package_refs:
                 raise ValueError("check cannot combine --project with --with")
             if not args.inputs:
@@ -1659,9 +1730,11 @@ def main(argv: list[str] | None = None) -> int:
                 shared=args.shared,
             )
     except KeyboardInterrupt:
+        renderer.close()
         print("lean-runtime: interrupted", file=sys.stderr)
         return 130
     except (ResolutionError, MaterializationError) as exc:
+        renderer.close()
         details = {
             "phase": exc.phase,
             "command": list(exc.command),
@@ -1681,12 +1754,13 @@ def main(argv: list[str] | None = None) -> int:
             _print_operation_failure(exc, verbose=args.verbose)
         return 2
     except PublicationError as exc:
+        renderer.close()
         if getattr(args, "json", False):
             _json(
                 envelope(
                     _schema_for(args.command),
                     ok=False,
-                    data={"publication": exc.to_dict()},
+                    data=exc.to_dict(),
                     errors=[error("publication_failed", str(exc), details=exc.to_dict())],
                 )
             )
@@ -1694,6 +1768,7 @@ def main(argv: list[str] | None = None) -> int:
             _print_publication_failure(exc)
         return exc.exit_code
     except (LeanRuntimeError, OSError, UnicodeError, ValueError, json.JSONDecodeError) as exc:
+        renderer.close()
         if getattr(args, "json", False):
             _json(
                 envelope(
@@ -1706,6 +1781,18 @@ def main(argv: list[str] | None = None) -> int:
         else:
             print(f"lean-runtime: {exc}", file=sys.stderr)
         return 2
+    if args.command in {"check", "check-file"}:
+        runtime.events.emit("check.completed", "Lean check completed", ok=result.ok)
+        total_ms = round((time.monotonic() - operation_started) * 1000)
+        accounted_ms = sum(timing.duration_ms for timing in result.timings)
+        result = replace(
+            result,
+            timings=(
+                PhaseTiming("command_preparation", max(0, total_ms - accounted_ms)),
+                *result.timings,
+            ),
+        )
+    renderer.close()
     _emit_result(result, args.json, display_path=display_path)
     if args.timings:
         print(render_timings(result.timings), file=sys.stderr)

{lean_runtime-2.9.0 → lean_runtime-2.9.2}/lean_runtime/console.py

@@ -215,6 +215,18 @@ class ConsoleRenderer:
     def _render_capability_required(self, event: RuntimeEvent) -> None:
         self._print(event.message)
 
+    def _render_check_started(self, event: RuntimeEvent) -> None:
+        if self.mode != "tty":
+            return
+        subject = str(event.data.get("subject") or "Lean input")
+        message = f"Checking {subject}…"
+        self.stream.write("\r" + self.style.cyan(message))
+        self.stream.flush()
+        self._line_length = len(message)
+
+    def _render_check_completed(self, _event: RuntimeEvent) -> None:
+        self._end_progress_line()
+
     # -- low-level output -----------------------------------------------
 
     def _verbose_line(self, event: RuntimeEvent) -> None:

{lean_runtime-2.9.0 → lean_runtime-2.9.2}/lean_runtime/environments.py

@@ -707,14 +707,11 @@ class Environment:
             },
         )
         job_parent = self.manager.store.jobs / execution_id
-        job_parent.mkdir(parents=True, exist_ok=True)
+        workspace_lease = self.manager.store.lease_workspace(job_parent, "interactive-environment")
         instance = job_parent / f"instance-{uuid.uuid4().hex}"
 
         def cleanup() -> None:
-            if instance.exists():
-                remove_tree(instance)
-            with suppress(OSError):
-                job_parent.rmdir()
+            workspace_lease.close()
 
         try:
             with self.manager.store.execution_lease(self.id):
@@ -844,7 +841,7 @@ class Environment:
             },
         )
         job_parent = self.manager.store.jobs / execution_id
-        job_parent.mkdir(parents=True, exist_ok=True)
+        workspace_lease = self.manager.store.lease_workspace(job_parent, f"environment-{operation}")
         instance = job_parent / f"instance-{uuid.uuid4().hex}"
         try:
             instance_started = time.monotonic()
@@ -994,10 +991,7 @@ class Environment:
             )
             return result
         finally:
-            if instance.exists():
-                remove_tree(instance)
-            with suppress(OSError):
-                job_parent.rmdir()
+            workspace_lease.close()
 
     def _result(
         self,

{lean_runtime-2.9.0 → lean_runtime-2.9.2}/lean_runtime/errors.py

@@ -81,6 +81,23 @@ class RegistryRequestError(DownloadUnavailable):
         self.retryable = retryable
 
 
+class CredentialAcquisitionError(EnvironmentError):
+    """A configured credential provider could not produce usable credentials."""
+
+    def __init__(
+        self,
+        message: str,
+        *,
+        provider: str,
+        failure_kind: str,
+        retryable: bool,
+    ) -> None:
+        super().__init__(message)
+        self.provider = provider
+        self.failure_kind = failure_kind
+        self.retryable = retryable
+
+
 class PublicationError(EnvironmentError):
     """A required publication did not reach a remotely verified terminal state."""
 
@@ -97,6 +114,8 @@ class PublicationError(EnvironmentError):
         credential_source: str = "anonymous",
         username: str | None = None,
         hint: str | None = None,
+        attempted_provider: str | None = None,
+        auth_failure_kind: str | None = None,
     ) -> None:
         super().__init__(message)
         self.phase = phase
@@ -108,11 +127,15 @@ class PublicationError(EnvironmentError):
         self.credential_source = credential_source
         self.username = username
         self.hint = hint
+        self.attempted_provider = attempted_provider
+        self.auth_failure_kind = auth_failure_kind
 
     @property
     def exit_code(self) -> int:
         if self.partial:
             return 5
+        if self.phase == "credential_acquisition":
+            return 4 if self.retryable else 3
         if self.status_code in {401, 403}:
             return 3
         if self.retryable:
@@ -130,6 +153,8 @@ class PublicationError(EnvironmentError):
             "credential_source": self.credential_source,
             "username": self.username,
             "hint": self.hint,
+            "attempted_provider": self.attempted_provider,
+            "auth_failure_kind": self.auth_failure_kind,
             "message": str(self),
         }
 

{lean_runtime-2.9.0 → lean_runtime-2.9.2}/lean_runtime/header_cache.py

@@ -50,11 +50,14 @@ class LeanHeaderCache:
         self.home = home / "header-snapshots"
         self.toolchains = toolchains
         self._support: dict[str, bool] = {}
+        self._toolchain_keys: dict[str, str] = {}
 
     def _toolchain_key(self, toolchain: str) -> str:
+        if toolchain in self._toolchain_keys:
+            return self._toolchain_keys[toolchain]
         digest = getattr(self.toolchains, "executable_digest", None)
         executable = str(digest(toolchain, "lean")) if callable(digest) else toolchain
-        return sha256_id(
+        key = sha256_id(
             "lean-header",
             {
                 "toolchain": toolchain,
@@ -62,6 +65,8 @@ class LeanHeaderCache:
                 "platform": platform_compatibility(),
             },
         ).removeprefix("lean-header-")
+        self._toolchain_keys[toolchain] = key
+        return key
 
     def supported(self, toolchain: str) -> bool:
         key = self._toolchain_key(toolchain)

{lean_runtime-2.9.0 → lean_runtime-2.9.2}/lean_runtime/health.py

@@ -86,6 +86,18 @@ def diagnose(toolchains: ToolchainManager, store: EnvironmentStore) -> DoctorRep
     status = "warning" if staging else "pass"
     message = f"{len(staging)} incomplete staging directories" if staging else "No stale builds"
     checks.append(DoctorCheck("staging", status, message))
+    scratch = store.clean_scratch(dry_run=True, minimum_age_seconds=3600)
+    if scratch.candidates:
+        checks.append(
+            DoctorCheck(
+                "scratch",
+                "warning",
+                f"{len(scratch.candidates)} abandoned workspaces use "
+                f"{scratch.candidate_bytes // (1024**2)} MiB",
+            )
+        )
+    else:
+        checks.append(DoctorCheck("scratch", "pass", "No abandoned workspaces"))
     store_status = store.status()
     cutoff = datetime.now(timezone.utc).timestamp() - 7 * 24 * 3600
     stale = tuple(
@@ -114,6 +126,7 @@ def repair(toolchains: ToolchainManager, store: EnvironmentStore) -> DoctorRepor
     """Apply the safe remedies represented by doctor checks, then diagnose again."""
     for staging in store.environments.glob(".staging-*"):
         remove_tree(staging)
+    store.clean_scratch(dry_run=False, minimum_age_seconds=3600, include_legacy=False)
     with suppress(ToolchainError):
         toolchains.elan_path(bootstrap=True)
     return diagnose(toolchains, store)

{lean_runtime-2.9.0 → lean_runtime-2.9.2}/lean_runtime/models.py

@@ -19,6 +19,7 @@ TimingPhase = Literal[
     "environment_open",
     "instance_creation",
     "input_staging",
+    "command_preparation",
     "execution",
     "result_collection",
     "result_publication",
@@ -38,6 +39,7 @@ TIMING_PHASES = frozenset(
         "environment_open",
         "instance_creation",
         "input_staging",
+        "command_preparation",
         "execution",
         "result_collection",
         "result_publication",