outerloop-science 0.1.0.dev0__py3-none-any.whl → 0.1.0.dev1__py3-none-any.whl

outerloop/init.py

@@ -1,8 +1,9 @@
 """`outerloop init` — the guided setup.
 
-Collects placement (Slurm or local), the target repo, and bot auth, then writes
-`~/.config/outerloop/.env` (plus the credential files), so a new adopter never
-hand-edits config or reasons about which `OUTERLOOP_*` keys to set. Flags fill
+Collects placement (Slurm or local), the target repo, bot auth, and the
+author's model key, then writes `~/.config/outerloop/.env` (plus the credential
+files), so a new adopter never hand-edits config or reasons about which
+`OUTERLOOP_*` keys to set. Flags fill
 answers non-interactively; anything left out is prompted for (a secret via
 getpass, never echoed). Auth is the adopter's own GitHub App by default —
 `--github-app`, one click via the manifest flow in `appmanifest.py` — with a PAT
@@ -18,13 +19,17 @@ from __future__ import annotations
 import argparse
 import getpass
 import json
+import os
 import sys
+import time
 import urllib.error
 import urllib.request
 from dataclasses import dataclass
 from pathlib import Path
+from typing import Any
 
 from outerloop.cli import ENV_FILE
+from outerloop.paths import write_private
 
 CONFIG_DIR = ENV_FILE.parent
 DEFAULT_PAT_FILE = CONFIG_DIR / "bot_pat"
@@ -42,9 +47,12 @@ class InitAnswers:
     partition: str = ""  # Slurm partition (optional; unset -> Slurm default)
     author_backend: str = ""  # optional: the climbing author's harness
     author_model: str = ""  # optional
+    author_key_file: str = ""  # the author's model key file, when known
 
 
-def render_env(a: InitAnswers, pat_file: str = "", *, app_file: str = "") -> str:
+def render_env(
+    a: InitAnswers, pat_file: str = "", *, app_file: str = "", bot_login: str = ""
+) -> str:
     """The `.env` body for these answers — only the keys that have a value, so
     the file stays minimal and every line means something. Ordered placement →
     target → auth → author to read top-to-bottom like the setup itself. Auth is
@@ -60,13 +68,39 @@ def render_env(a: InitAnswers, pat_file: str = "", *, app_file: str = "") -> str
         lines.append(f"OUTERLOOP_GITHUB_APP_FILE={app_file}")
     elif pat_file:
         lines.append(f"OUTERLOOP_PAT_FILE={pat_file}")
+    if bot_login:
+        # every own-comment filter and own-PR scan keys on this login; without
+        # it the kernel assumes a default that is not this adopter's identity
+        lines.append(f"OUTERLOOP_BOT_LOGIN={bot_login}")
     if a.author_backend:
         lines.append(f"OUTERLOOP_AUTHOR_BACKEND={a.author_backend}")
     if a.author_model:
         lines.append(f"OUTERLOOP_AUTHOR_MODEL={a.author_model}")
+    if a.author_key_file:
+        lines.append(f"{author_key_env(a.author_backend)}={a.author_key_file}")
     return "\n".join(lines) + "\n"
 
 
+def author_key_env(backend: str) -> str:
+    """The `.env` key naming `backend`'s model-key file: one rule for every
+    backend (`OUTERLOOP_CLAUDE_KEY_FILE`, `OUTERLOOP_CODEX_KEY_FILE`)."""
+    return f"OUTERLOOP_{(backend or AUTHOR_BACKENDS[0]).upper()}_KEY_FILE"
+
+
+def author_key_path(backend: str, *, config_dir: Path = CONFIG_DIR) -> Path:
+    """Where `backend`'s model key lives by default: `<config dir>/<backend>_key`,
+    the same rule `attempt.resolve_author_key_file` reads."""
+    return config_dir / f"{backend or AUTHOR_BACKENDS[0]}_key"
+
+
+def write_author_key(backend: str, key: str, *, config_dir: Path = CONFIG_DIR) -> Path:
+    """Write a pasted model key to its default file, owner-only (0600), no
+    trailing newline. Returns the path."""
+    path = author_key_path(backend, config_dir=config_dir)
+    write_private(path, key)
+    return path
+
+
 def write_config(
     a: InitAnswers, token: str, pat_file: str, *, config_dir: Path = CONFIG_DIR
 ) -> tuple[Path, Path | None]:
@@ -79,13 +113,11 @@ def write_config(
         pat_path = config_dir / DEFAULT_PAT_FILE.name
         # printf-style: no trailing newline — the deploy `cat`s this file into
         # the git credential, and a trailing newline rides along and breaks auth.
-        pat_path.write_text(token)
-        pat_path.chmod(0o600)
+        write_private(pat_path, token)
         written_pat = pat_path
         pat_file = str(pat_path)
     env_path = config_dir / ENV_FILE.name
-    env_path.write_text(render_env(a, pat_file))
-    env_path.chmod(0o600)
+    write_private(env_path, render_env(a, pat_file))
     return env_path, written_pat
 
 
@@ -111,6 +143,55 @@ def _check_repo_access(token: str, target: str) -> str:
         return f"could not reach GitHub: {exc.reason}"
 
 
+def _check_app_access(provider: Any, target: str) -> str:
+    """Can this App write the target repo? "" on success, else a short reason.
+
+    An installation token does not populate a repository's `permissions`
+    object, so the PAT check above reads all-false for an App that can push.
+    The App is asked the two questions that decide it: is the target among
+    the repositories its installation covers, and does the installation carry
+    write on contents and pull requests. Never raises."""
+    from outerloop.appauth import build_app_jwt
+
+    headers = {"Accept": "application/vnd.github+json", "X-GitHub-Api-Version": "2022-11-28"}
+    try:
+        # Asked as the App itself: GitHub answers with the installation that
+        # covers this repository, permissions included, or 404. A public
+        # repository would answer a plain read for any token, and the
+        # installation's repository list paginates, so neither is asked.
+        jwt = build_app_jwt(provider.app_id, time.time(), provider._sign)
+        req = urllib.request.Request(
+            f"{API}/repos/{target}/installation",
+            headers={**headers, "Authorization": f"Bearer {jwt}"},
+        )
+        try:
+            with urllib.request.urlopen(req, timeout=15) as resp:
+                installation = json.loads(resp.read())
+        except urllib.error.HTTPError as exc:
+            if exc.code == 404:
+                return f"the App is not installed on {target}; install it there"
+            raise
+        if int(installation.get("id", 0)) != int(provider.installation_id):
+            return (
+                f"the App is installed on {target} under installation "
+                f"{installation.get('id')}, but the App file records {provider.installation_id}"
+            )
+        perms = installation.get("permissions") or {}
+        missing = [k for k in ("contents", "issues", "pull_requests") if perms.get(k) != "write"]
+        if missing:
+            return (
+                f"the App lacks write on {', '.join(missing)} "
+                "(it pushes branches, opens PRs, and files and closes issues)"
+            )
+        return ""
+    except urllib.error.HTTPError as exc:
+        return f"GitHub returned {exc.code} while checking the App"
+    except urllib.error.URLError as exc:
+        return f"could not reach GitHub: {exc.reason}"
+    except Exception as exc:  # a check failure is a warning, never fails setup
+        return f"could not check the App: {exc}"
+
+
 def validate_pat(pat_file: str, target: str) -> str:
     """Best-effort: can the PAT in `pat_file` write the target repo?"""
     try:
@@ -170,6 +251,26 @@ def _collect(args: argparse.Namespace, interactive: bool) -> tuple[InitAnswers,
     return answers, (args.pat_file or "")
 
 
+ORG_PROMPT = (
+    "Create the App under which account? (the repository's owner is the only one "
+    "the App can then be installed on; Enter to accept)"
+)
+
+
+def _owner_type(owner: str) -> str:
+    """ "User" or "Organization" for a GitHub account, or "" when the lookup
+    fails. GitHub creates Apps at different pages for the two, and a wrong
+    guess sends the adopter to a page that cannot create the App."""
+    req = urllib.request.Request(
+        f"{API}/users/{owner}", headers={"Accept": "application/vnd.github+json"}
+    )
+    try:
+        with urllib.request.urlopen(req, timeout=15) as resp:
+            return str(json.loads(resp.read()).get("type", ""))
+    except Exception:
+        return ""
+
+
 def _github_app_setup(answers: InitAnswers, app_name: str, org: str) -> int:
     """The `--github-app` path: create the adopter's own App via the manifest
     flow, write its creds, help install it, then point the .env at the App file.
@@ -190,10 +291,26 @@ def _github_app_setup(answers: InitAnswers, app_name: str, org: str) -> int:
         print(f"outerloop init: {exc}", file=sys.stderr)
         return 1
     pem_path, app_json = appmanifest.save_app_creds(conversion, CONFIG_DIR)
-    print(f"created App '{conversion['slug']}' — wrote {app_json} and {pem_path} (0600)")
-    print(f"install it on {answers.target}: {appmanifest.install_url(conversion)}")
-    input("press Enter once you've installed the App… ")
+    repo = answers.target.split("/", 1)[-1]
+    print(f"  created App '{conversion['slug']}'; credentials in {app_json} and {pem_path} (0600)")
+    print()
+    print(f"Step 2 of 3: install the App on {answers.target}.")
+    print(f"  Open {appmanifest.install_url(conversion)}")
+    print(f"  choose 'Only select repositories', pick '{repo}', and click 'Install'.")
+    input("Press Enter here once GitHub shows the App as installed… ")
+    print()
+    print(f"Step 3 of 3: checking that the App can write {answers.target}.")
     iid = appmanifest.capture_installation_id(int(conversion["id"]), pem_path, owner)
+    for _ in range(2):
+        if iid:
+            break
+        # not installed yet: a rerun of init would stop at the existing config,
+        # so ask again here rather than sending the adopter around the loop
+        print(
+            f"  no installation found yet. Install the App at {appmanifest.install_url(conversion)}"
+        )
+        input("Press Enter once GitHub shows the App as installed… ")
+        iid = appmanifest.capture_installation_id(int(conversion["id"]), pem_path, owner)
     if iid:
         appmanifest.set_installation_id(app_json, iid)
         print(f"  installation id {iid} recorded")
@@ -202,19 +319,23 @@ def _github_app_setup(answers: InitAnswers, app_name: str, org: str) -> int:
         from outerloop.appauth import app_provider_from_file
 
         try:
-            token = app_provider_from_file(app_json).token()
-            problem = _check_repo_access(token, answers.target)
-            print(f"  auth check: {'ok' if not problem else 'WARNING — ' + problem}")
+            problem = _check_app_access(app_provider_from_file(app_json), answers.target)
         except Exception as exc:  # a check failure is a warning, never fails setup
-            print(f"  auth check: WARNING — could not mint a token: {exc}")
+            problem = f"could not read the App credentials: {exc}"
+        print(f"  auth check: {'ok' if not problem else 'WARNING — ' + problem}")
     else:
         print(
-            f"  no installation found yet — install the App, then set installation_id in {app_json}"
+            f"  still no installation. When it is installed, put its id into {app_json} as "
+            f"installation_id (GitHub shows it in the URL of the App's page under "
+            f"Settings > Installations), then run outerloop start."
         )
     env_path = CONFIG_DIR / ENV_FILE.name
-    env_path.write_text(render_env(answers, app_file=str(app_json)))
-    env_path.chmod(0o600)
+    write_private(
+        env_path,
+        render_env(answers, app_file=str(app_json), bot_login=f"{conversion['slug']}[bot]"),
+    )
     print(f"wrote {env_path}")
+    _author_key_hint(answers)
     print("next: outerloop start")
     return 0
 
@@ -243,6 +364,11 @@ def main(argv: list[str] | None = None) -> int:
     parser.add_argument("--org", help="create the App under this org (default: your account)")
     parser.add_argument("--author-backend", dest="author_backend", help="climbing author's backend")
     parser.add_argument("--author-model", dest="author_model", help="climbing author's model")
+    parser.add_argument(
+        "--author-key-file",
+        dest="author_key_file",
+        help="path to an existing file holding the author's model API key",
+    )
     parser.add_argument(
         "--yes", "-y", action="store_true", help="non-interactive: use flags, do not prompt"
     )
@@ -280,6 +406,30 @@ def main(argv: list[str] | None = None) -> int:
             )
             return 1
 
+    # The author's model key: an existing file by flag, or (on the full
+    # interactive run, never the focused --github-app one) a hidden paste written
+    # to <config>/<backend>_key. Collected after the overwrite check so a
+    # declined run never asks for a secret.
+    if args.author_key_file:
+        key_file = Path(args.author_key_file).expanduser()
+        if not key_file.is_file() or not os.access(key_file, os.R_OK):
+            print(
+                f"outerloop init: --author-key-file {key_file} is not a readable file",
+                file=sys.stderr,
+            )
+            return 2
+        # absolute: climb jobs read the key from their own flight directory
+        answers.author_key_file = str(key_file.absolute())
+    if not answers.author_key_file and interactive and not args.github_app:
+        pasted = getpass.getpass(
+            f"API key for the {answers.author_backend or AUTHOR_BACKENDS[0]} author "
+            "(hidden; blank to set later): "
+        ).strip()
+        if pasted:
+            key_path = write_author_key(answers.author_backend, pasted, config_dir=CONFIG_DIR)
+            answers.author_key_file = str(key_path)
+            print(f"wrote {key_path} (0600)")
+
     # The App is the recommended credential (scoped, revocable, no plaintext
     # token); the PAT is the fallback. Offer it first when interactive.
     if not args.github_app and not pat_file and interactive:
@@ -290,7 +440,20 @@ def main(argv: list[str] | None = None) -> int:
         if choice.startswith("a"):
             args.github_app = True
     if args.github_app:
-        return _github_app_setup(answers, args.app_name or "", args.org or "")
+        org = args.org or ""
+        if not org and interactive:
+            # a private App installs only on the account that created it, so
+            # the target's owner is the only default that can work
+            owner = answers.target.split("/")[0]
+            org = _ask(ORG_PROMPT, owner).strip()
+        if org:
+            kind = _owner_type(org)
+            if not kind and interactive:
+                answer = _ask(f"Is '{org}' an organization or a user account? [org/user]", "org")
+                kind = "User" if answer.strip().lower().startswith("u") else "Organization"
+            if kind == "User":
+                org = ""  # a user account: GitHub's personal App page, not an org page
+        return _github_app_setup(answers, args.app_name or "", org)
 
     token = ""
     if not pat_file and interactive:
@@ -309,5 +472,15 @@ def main(argv: list[str] | None = None) -> int:
         print(f"  auth check: {'ok' if not problem else 'WARNING — ' + problem}")
     else:
         print("  no PAT set — add OUTERLOOP_PAT_FILE before the agents can open PRs")
+    _author_key_hint(answers)
     print("next: outerloop start")
     return 0
+
+
+def _author_key_hint(answers: InitAnswers) -> None:
+    if not answers.author_key_file:
+        print(
+            "  no author key set — put it in "
+            f"{author_key_path(answers.author_backend, config_dir=CONFIG_DIR)} "
+            "before the first climb"
+        )

outerloop/paths.py

@@ -9,6 +9,7 @@ dir if it exists, else the legacy dir if it exists, else the new dir.
 
 from __future__ import annotations
 
+import os
 from pathlib import Path
 
 CONFIG_DIR_NAMES: tuple[str, ...] = ("outerloop", "autoresearch")  # new first
@@ -25,3 +26,14 @@ def config_dir(home: Path | None = None) -> Path:
 
 CONFIG_DIR = config_dir()
 ENV_FILE = CONFIG_DIR / ".env"
+
+
+def write_private(path: Path, text: str) -> None:
+    """Write `text` to `path` so no other user can read it at any moment: the
+    file is created (or truncated) with mode 0600 in the same call, and a file
+    that already existed has its mode forced to 0600 before the write."""
+    path.parent.mkdir(parents=True, exist_ok=True)
+    fd = os.open(path, os.O_WRONLY | os.O_CREAT | os.O_TRUNC, 0o600)
+    with os.fdopen(fd, "w") as fh:
+        os.fchmod(fd, 0o600)
+        fh.write(text)

outerloop/tick.py

@@ -21,6 +21,7 @@ import os
 import re
 import socket
 import subprocess
+import sys
 from collections.abc import Sequence
 from dataclasses import asdict, dataclass, field, replace
 from pathlib import Path
@@ -234,6 +235,10 @@ def flight_checkout(home: Path, name: str, now: float) -> Path:
     uncommitted hand-edits in the shared checkout do not fly — only
     deployed code does. Failures fall back to the shared checkout — a
     snapshot must never ground the fleet."""
+    if not (home / ".git").exists():
+        # not a checkout (the local loop on an installed package): nothing to
+        # pin, the job runs from the home directory itself
+        return home
     flights = home.parent / "flights"
     try:
         flights.mkdir(parents=True, exist_ok=True)
@@ -286,6 +291,25 @@ def _gpu_lane_error(contract: Any, benchmark: str, spec: FollowupSpec) -> str:
     return ""
 
 
+_UNCONTAINED_WARNED = False  # the local-mode warning is said once per process
+
+
+def _containment(image: str) -> list[str]:
+    """The job's containment flags: the image when there is one, else the
+    explicit uncontained flag every entry point requires in its absence."""
+    return ["--image", image] if image else ["--uncontained"]
+
+
+def _interpreter(home: Path) -> list[str]:
+    """How a job runs Python. From a source checkout, `uv run python` resolves
+    the project's own environment, as the cluster's flights do. From a plain
+    home directory (the local loop on an installed package) the job runs the
+    interpreter this tick runs under, which is where the package is."""
+    if (home / "pyproject.toml").is_file():
+        return ["uv", "run", "python"]
+    return [sys.executable]
+
+
 def _flight_command(home: Path, job_name: str, now: float, argv: list[str]) -> str:
     """The job's shell command, cd'ing into a fresh flight snapshot.
 
@@ -682,8 +706,29 @@ def service_in_review(
                 except SlurmQueryError:
                     continue  # unknown — do not stack another job
             # the wake-attempt counter caps follow-up retries too: a responder
-            # that cannot advance its cursors must not burn a session per tick
-            if record.wake_attempts >= MAX_WAKE_ATTEMPTS:
+            # that cannot advance its cursors must not burn a session per tick.
+            # A LANDED re-measure gets its own allowance: the sessions that
+            # synced the base and dispatched it were progress, and capping the
+            # follow-up that pushes the sealed number parks the result forever
+            # (speedrun agent-03, 2026-09-04: three syncs spent the cap, the
+            # measure completed, and the run idled for two days on this
+            # branch). The allowance is counted on the stage itself, so a
+            # finishing session that reverts and leaves the stage intact is
+            # retried MAX_WAKE_ATTEMPTS times, not once per tick; a stage that
+            # finishes is cleared, and with it the count.
+            finish_attempts = (
+                int(record.followup_stage.get("finish_attempts", 0) or 0)  # type: ignore[call-overload]
+                if measure_ready
+                else 0
+            )
+            if measure_ready and finish_attempts >= MAX_WAKE_ATTEMPTS:
+                log.warning(
+                    "run %s: %d follow-ups failed to finish the landed re-measure; parked",
+                    record.run_id,
+                    finish_attempts,
+                )
+                continue
+            if record.wake_attempts >= MAX_WAKE_ATTEMPTS and not measure_ready:
                 log.warning(
                     "run %s: %d follow-up attempts without progress; not resubmitting",
                     record.run_id,
@@ -725,17 +770,14 @@ def service_in_review(
             if panel_argv:
                 panel_argv = [*panel_argv, "--panel-minutes", str(job_minutes - author_minutes)]
             argv = [
-                "uv",
-                "run",
-                "python",
+                *_interpreter(spec.home),
                 "-m",
                 "outerloop.followup",
                 "--run-root",
                 str(spec.run_root),
                 "--run-id",
                 record.run_id,
-                "--image",
-                spec.image,
+                *_containment(spec.image),
                 "--bot-login",
                 spec.bot_login,
                 "--job-minutes",
@@ -777,11 +819,16 @@ def service_in_review(
             # read-modify-write on the FRESH record: the submitted job may
             # already be saving its own fields
             latest = load_record(root, record.run_id)
+            stage = latest.followup_stage
+            if measure_ready and stage:
+                # one finishing attempt billed against this landed measure
+                stage = {**stage, "finish_attempts": finish_attempts + 1}
             save_record(
                 root,
                 replace(
                     latest,
                     followup_job_id=job_id,
+                    followup_stage=stage,
                     wake_attempts=latest.wake_attempts + 1,
                 ),
                 now,
@@ -1790,7 +1837,7 @@ def tick(
                 log.warning("self-initiated selection failed: %s", exc)
         # AFTER the launch block: a run started this tick is on the strip
         # this tick, not the next one
-        service_boards(root, github, spec.target, contract, now)
+        service_boards(root, github, spec.target, contract, now, compute)
         report = replace_report(
             report,
             ended,
@@ -1844,10 +1891,13 @@ def service_syncs(root: Path, spec: Any, now: float) -> None:
             log.warning("sync failed for %s: %s", record.run_id, exc)
 
 
-def service_boards(root: Path, github: Any, target: str, contract: Any, now: float) -> None:
+def service_boards(
+    root: Path, github: Any, target: str, contract: Any, now: float, compute: Any = None
+) -> None:
     """The climb board and the live strip, together and advisory: the views
     publish from the first tick (before any run ends), and a failure never
-    stops the tick."""
+    stops the tick. With a compute backend, the strip also carries the
+    kernel's queue (its own Slurm jobs, attributed to agents)."""
     try:
         from outerloop.climbboard import contract_directions, service_climb_board
 
@@ -1857,7 +1907,13 @@ def service_boards(root: Path, github: Any, target: str, contract: Any, now: flo
     try:
         from outerloop.climbboard import service_status
 
-        service_status(root, github, target, now, contract)
+        queue = None
+        if compute is not None:
+            try:
+                queue = compute.queue_snapshot()
+            except Exception as exc:  # blind this tick: the strip publishes without a queue
+                log.warning("queue snapshot failed: %s", exc)
+        service_status(root, github, target, now, contract, queue=queue)
     except Exception as exc:  # each is advisory ALONE: one failing never mutes the other
         log.warning("status strip service failed: %s", exc)
 
@@ -2436,9 +2492,7 @@ def service_self_initiated(
             return (benchmark, "dry-run")
         job_minutes = _attempt_job_minutes(spec, limits)
         argv = [
-            "uv",
-            "run",
-            "python",
+            *_interpreter(spec.home),
             "-m",
             "outerloop.attempt",
             "--target",
@@ -2447,8 +2501,7 @@ def service_self_initiated(
             benchmark,
             "--run-root",
             str(spec.run_root),
-            "--image",
-            spec.image,
+            *_containment(spec.image),
             "--agent-id",
             slot_agent,
             *_climb_limit_argv(limits, job_minutes),
@@ -2565,9 +2618,7 @@ def service_steward(
 
         work_order_b64 = _b64.b64encode(issue_hypothesis(task).encode()).decode()
         argv = [
-            "uv",
-            "run",
-            "python",
+            *_interpreter(spec.home),
             "-m",
             "outerloop.steward",
             "--target",
@@ -2576,8 +2627,7 @@ def service_steward(
             task.benchmark,
             "--run-root",
             str(spec.run_root),
-            "--image",
-            spec.image,
+            *_containment(spec.image),
             "--issue",
             str(task.number),
             "--work-order-b64",
@@ -2707,9 +2757,7 @@ def service_intake(
 
         hypothesis_b64 = _b64.b64encode(issue_hypothesis(task).encode()).decode()
         argv = [
-            "uv",
-            "run",
-            "python",
+            *_interpreter(spec.home),
             "-m",
             "outerloop.attempt",
             "--target",
@@ -2718,8 +2766,7 @@ def service_intake(
             task.benchmark,
             "--run-root",
             str(spec.run_root),
-            "--image",
-            spec.image,
+            *_containment(spec.image),
             "--issue",
             str(task.number),
             "--hypothesis-b64",
@@ -2791,17 +2838,14 @@ class JobWakeDispatcher:
 
     def dispatch(self, record: RunRecord, reason: str) -> str:
         argv = [
-            "uv",
-            "run",
-            "python",
+            *_interpreter(self.spec.home),
             "-m",
             "outerloop.attempt",
             "--resume",
             record.run_id,
             "--run-root",
             str(self.spec.run_root),
-            "--image",
-            self.spec.image,
+            *_containment(self.spec.image),
             "--account",
             self.spec.account,
             "--partition",
@@ -2994,7 +3038,34 @@ def _followup_spec_from_env(root: Path) -> tuple[Any, FollowupSpec | None]:
     # Local compute runs jobs as subprocesses: Slurm placement is meaningless
     # there, so account/partition are only required when a cluster is in play.
     placed = bool(account and partition) or local_mode()
-    if (pat_file or app_file) and placed and home and Path(image).is_file():
+    target = os.environ.get("AUTORESEARCH_TARGET", "")
+    image_ok = Path(image).is_file()
+    panel = os.environ.get("AUTORESEARCH_PANEL", "verify,review")
+    if not image_ok and local_mode():
+        # The local loop on a machine with no container: sessions run under
+        # the harness's own sandbox and evaluations run bare, on the
+        # operator's own machine with the operator's own keys. The panel is
+        # off unless the operator opts in, because an uncontained judge holds
+        # a shell next to its own key file. Said once per process. Contained
+        # local mode needs apptainer and the image (docs/install.md).
+        global _UNCONTAINED_WARNED
+        if not _UNCONTAINED_WARNED:
+            _UNCONTAINED_WARNED = True
+            log.warning(
+                "local mode: no container image at %s; sessions run under the harness "
+                "sandbox and evaluations run bare on this machine; the panel is %s; a "
+                "codex author needs the image (docs/install.md, local mode)",
+                image,
+                "on by AUTORESEARCH_PANEL_UNCONTAINED=1"
+                if os.environ.get("AUTORESEARCH_PANEL_UNCONTAINED") == "1"
+                else "off (AUTORESEARCH_PANEL_UNCONTAINED=1 turns it on)",
+            )
+        if os.environ.get("AUTORESEARCH_PANEL_UNCONTAINED") != "1":
+            panel = ""
+        # the jobs must not inherit a path to an image that is not there
+        os.environ.pop("AUTORESEARCH_IMAGE", None)
+        image, image_ok = "", True
+    if (pat_file or app_file) and placed and home and target and image_ok:
         from outerloop.appauth import resolve_bot_auth
         from outerloop.github import GitHubClient
 
@@ -3008,11 +3079,9 @@ def _followup_spec_from_env(root: Path) -> tuple[Any, FollowupSpec | None]:
                 home=Path(home),
                 pat_file=pat_file,
                 github_app_file=app_file,
-                target=os.environ.get(
-                    "AUTORESEARCH_TARGET", "agentic-learning-ai-lab/autoresearch-pilot"
-                ),
+                target=target,
                 steward_key_file=os.environ.get("AUTORESEARCH_STEWARD_KEY_FILE", ""),
-                panel=os.environ.get("AUTORESEARCH_PANEL", "verify,review"),
+                panel=panel,
                 panel_key_file=os.environ.get("AUTORESEARCH_PANEL_KEY_FILE", ""),
                 job_partition=os.environ.get("AUTORESEARCH_JOB_PARTITION", ""),
                 gpu_partition=os.environ.get("AUTORESEARCH_GPU_PARTITION", ""),
@@ -3030,10 +3099,11 @@ def _followup_spec_from_env(root: Path) -> tuple[Any, FollowupSpec | None]:
             ("AUTORESEARCH_ACCOUNT", account or ("-" if local_mode() else "")),
             ("AUTORESEARCH_PARTITION", partition or ("-" if local_mode() else "")),
             ("AUTORESEARCH_HOME", home),
+            ("AUTORESEARCH_TARGET", target),
         ]
         if not value
     ]
-    if not Path(image).is_file():
+    if not image_ok:
         absent.append(f"image:{image}")
     log.info("in-review servicing disabled (missing: %s)", ", ".join(absent))
     return None, None