outerloop-science 0.1.0.dev0__py3-none-any.whl → 0.1.0.dev2__py3-none-any.whl

outerloop/__init__.py

@@ -2,17 +2,17 @@
 
 import os
 
-__version__ = "0.1.0.dev0"
+__version__ = "0.1.0.dev2"
 
 
 def _bridge_legacy_env() -> None:
-    """Accept the new `OUTERLOOP_*` names at the process boundary: copy each into
-    its `AUTORESEARCH_*` twin when the twin is unset, so the kernel's internals —
-    which still read `AUTORESEARCH_*` during the rename — see one name. The chain
-    scripts do the same in shell. Removed with the final internal flip."""
+    """Accept the pre-rename `AUTORESEARCH_*` names at the process boundary for
+    one release: copy each into its `OUTERLOOP_*` twin when the twin is unset,
+    so the kernel reads one name. The chain scripts do the same in shell.
+    Removed in the release after 0.1."""
     for key, value in list(os.environ.items()):
-        if key.startswith("OUTERLOOP_"):
-            os.environ.setdefault("AUTORESEARCH_" + key[len("OUTERLOOP_") :], value)
+        if key.startswith("AUTORESEARCH_"):
+            os.environ.setdefault("OUTERLOOP_" + key[len("AUTORESEARCH_") :], value)
 
 
 _bridge_legacy_env()

outerloop/appauth.py

@@ -3,7 +3,7 @@
 `AppInstallationTokenProvider` satisfies the `TokenProvider` protocol used
 throughout `github.py`. Role CLIs construct bot auth through
 `resolve_bot_auth`, which selects this provider when an App config file is
-given (`--github-app-file` / `AUTORESEARCH_GITHUB_APP_FILE`) and falls back
+given (`--github-app-file` / `OUTERLOOP_GITHUB_APP_FILE`) and falls back
 to the PAT file otherwise — the cutover flag, revertible by unsetting the
 env. Each `token()` mints a short-lived JWT (RS256, signed by the App
 private key), exchanges it for a ~1h installation token scoped to the
@@ -172,8 +172,8 @@ def signer_from_private_key(pem_path: Path) -> Signer:
         from cryptography.hazmat.primitives.asymmetric import padding, rsa
     except ImportError as exc:  # pragma: no cover - exercised only without the extra
         raise ImportError(
-            "GitHub App auth needs the 'app-auth' extra (cryptography); "
-            "install it before selecting the App token provider"
+            "GitHub App auth needs the cryptography package "
+            "(pip install cryptography), a base dependency since 0.1.0.dev2"
         ) from exc
 
     key = serialization.load_pem_private_key(pem_path.read_bytes(), password=None)

outerloop/appmanifest.py

@@ -14,7 +14,7 @@ and GitHub redirects back to that page with a one-time code the page displays.
 The adopter pastes the code here; we exchange it for the app id + key, write
 `github_app.<slug>.json` + the PEM (both 0600), help install the App, and capture
 the installation id. The written files are what `resolve_bot_auth` reads via
-`AUTORESEARCH_GITHUB_APP_FILE`, the same path `outerloop start` uses.
+`OUTERLOOP_GITHUB_APP_FILE`, the same path `outerloop start` uses.
 """
 
 from __future__ import annotations
@@ -25,12 +25,14 @@ import os
 import secrets
 import time
 import urllib.error
+import urllib.parse
 import urllib.request
 from collections.abc import Callable
 from pathlib import Path
 from typing import Any
 
 from outerloop.appauth import API, build_app_jwt, signer_from_private_key
+from outerloop.paths import write_private
 
 # The hosted helper page: it auto-POSTs the manifest to GitHub, then displays the
 # returned code. It is also the manifest's redirect_url, so GitHub sends the code
@@ -90,10 +92,15 @@ def request_manifest_code(
     state = secrets.token_urlsafe(16)
     manifest = build_manifest(name, homepage_url)
     url = build_setup_url(manifest, state, org)
-    print_fn("Create your GitHub App — open this URL in a browser (any machine):")
+    where = f"the {org} organization" if org else "your account"
+    print_fn("Step 1 of 3: create the GitHub App.")
+    print_fn("  Open this link in a browser where you are signed in to GitHub (any machine):")
     print_fn(f"\n  {url}\n")
-    print_fn("Click 'Create GitHub App', then copy the code the page shows.")
-    return input_fn("Paste the code here: ").strip()
+    print_fn(f"  GitHub shows a page titled 'Create GitHub App' under {where}. Click the")
+    host = urllib.parse.urlsplit(SETUP_URL).netloc or SETUP_URL
+    print_fn("  green 'Create GitHub App' button. GitHub then sends you to")
+    print_fn(f"  {host}, which shows a one-time code.")
+    return input_fn("Paste that code here: ").strip()
 
 
 def _default_transport(request: urllib.request.Request) -> Any:
@@ -136,10 +143,10 @@ def save_app_creds(
     config_dir.mkdir(parents=True, exist_ok=True)
     slug = str(conversion["slug"])
     pem_path = config_dir / f"{slug}-app.pem"
-    pem_path.write_text(str(conversion["pem"]))
-    pem_path.chmod(0o600)
+    write_private(pem_path, str(conversion["pem"]))
     app_json = config_dir / f"github_app.{slug}.json"
-    app_json.write_text(
+    write_private(
+        app_json,
         json.dumps(
             {
                 "app_id": int(conversion["id"]),
@@ -148,9 +155,8 @@ def save_app_creds(
             },
             indent=2,
         )
-        + "\n"
+        + "\n",
     )
-    app_json.chmod(0o600)
     return pem_path, app_json
 
 
@@ -194,5 +200,4 @@ def set_installation_id(app_json: Path, installation_id: int) -> None:
     """Fill the installation id into an already-written github_app.<slug>.json."""
     data = json.loads(app_json.read_text())
     data["installation_id"] = int(installation_id)
-    app_json.write_text(json.dumps(data, indent=2) + "\n")
-    app_json.chmod(0o600)
+    write_private(app_json, json.dumps(data, indent=2) + "\n")

outerloop/attempt.py

@@ -44,7 +44,7 @@ from outerloop.github import (
     contract_at,
     ensure_regular_git_dir,
 )
-from outerloop.harness import Harness, SessionResult, redact
+from outerloop.harness import Harness, SessionResult, default_binary, redact
 from outerloop.markers import has_marker
 from outerloop.measure import DispatchedMeasurer, DispatchSettings
 from outerloop.orchestrator import (
@@ -97,8 +97,11 @@ log = logging.getLogger(__name__)
 # tick preflights the panel key (and compares it against the author key —
 # role separation) before claiming/submitting.
 PANEL_KEY_DEFAULT = str(CONFIG_DIR / "verifier_key")
-HARNESS_KEY_DEFAULT = str(CONFIG_DIR / "harness_key")  # the claude author key
-CODEX_KEY_DEFAULT = str(CONFIG_DIR / "codex_key")  # the codex author key
+# One rule for author keys: ~/.config/outerloop/<backend>_key. `harness_key` is
+# the pre-rename name of the claude key; it is still read, never written.
+CLAUDE_KEY_DEFAULT = str(CONFIG_DIR / "claude_key")
+HARNESS_KEY_DEFAULT = str(CONFIG_DIR / "harness_key")  # legacy claude key
+CODEX_KEY_DEFAULT = str(CONFIG_DIR / "codex_key")
 
 
 def resolve_author_key_file(backend: str, explicit: str = "") -> str:
@@ -106,14 +109,28 @@ def resolve_author_key_file(backend: str, explicit: str = "") -> str:
     codex's both on disk), selected by backend — so the author backend is a
     config choice, not a key swap, and an in-flight run of either backend can
     still be woken/serviced after a fleet flip. An explicit path always wins;
-    otherwise the per-backend env var, then the packaged default path. The result
-    is always ~-expanded, so every caller gets a real path (an env value like
-    "~/.config/..." must not reach the token provider verbatim)."""
+    otherwise the per-backend env var, then the default path. For claude the
+    legacy spellings (`AUTORESEARCH_HARNESS_KEY_FILE`, read through its bridged
+    `OUTERLOOP_` twin, and `harness_key`) are still
+    honored, so a machine set up before the rename keeps working; the new name
+    wins when both exist. The result is always ~-expanded, so every caller gets
+    a real path (an env value like "~/.config/..." must not reach the token
+    provider verbatim)."""
     if not explicit:
         if backend == "codex":
-            explicit = os.environ.get("AUTORESEARCH_CODEX_KEY_FILE") or CODEX_KEY_DEFAULT
+            explicit = os.environ.get("OUTERLOOP_CODEX_KEY_FILE") or CODEX_KEY_DEFAULT
         else:
-            explicit = os.environ.get("AUTORESEARCH_HARNESS_KEY_FILE") or HARNESS_KEY_DEFAULT
+            explicit = (
+                os.environ.get("OUTERLOOP_CLAUDE_KEY_FILE")
+                or os.environ.get("OUTERLOOP_HARNESS_KEY_FILE")
+                or ""
+            )
+            if not explicit:
+                explicit = CLAUDE_KEY_DEFAULT
+                if not os.path.exists(os.path.expanduser(explicit)) and os.path.exists(
+                    os.path.expanduser(HARNESS_KEY_DEFAULT)
+                ):
+                    explicit = HARNESS_KEY_DEFAULT
     return os.path.expanduser(explicit)
 
 
@@ -124,14 +141,14 @@ def codex_author_config_error(backend: str, model: str, image: str) -> str:
     a unit and never a fleet backend against a run's model. codex writes+executes,
     so it must be contained (--image) and needs a non-claude model."""
     if backend not in ("claude", "codex"):
-        # a typo'd AUTORESEARCH_AUTHOR_BACKEND passes the env DEFAULT silently
+        # a typo'd OUTERLOOP_AUTHOR_BACKEND passes the env DEFAULT silently
         # (argparse validates the flag, not its default) and the climb rejects it
         # at build_harness — catch it on the tick host so a claimed intake
         # issue never strands on it
         return f"unknown author backend {backend!r} (expected 'claude' or 'codex')"
     if backend == "claude":
         # symmetric to the codex check: a claude harness 404s on a non-claude
-        # model (e.g. AUTORESEARCH_AUTHOR_MODEL left on a codex id while the
+        # model (e.g. OUTERLOOP_AUTHOR_MODEL left on a codex id while the
         # backend is claude) — catch that misconfig before spend
         if model and not model.startswith("claude"):
             return f"author-backend claude needs a claude model (got {model!r})"
@@ -588,8 +605,15 @@ def _make_launcher(
     partially-submitted batch is reaped rather than orphaned. `gpus` is the
     benchmark's: an author's experiments run on the same lane as its evals."""
     account, partition = dispatch.placement(gpus)
+    # under launch admission a GPU launch enters the queue held; the tick
+    # releases it when the user's GPUs fit under the cap (tick.service_admission)
+    from outerloop.tick import max_launch_gpus_from_env
+
+    hold = gpus > 0 and not local_mode() and max_launch_gpus_from_env() > 0
 
     def launcher(sha: str, request: SyscallRequest) -> str:
+        from dataclasses import replace as _replace
+
         from outerloop.dispatch import eval_job_spec, write_eval_job
         from outerloop.syscall import launch_jobs
 
@@ -611,18 +635,15 @@ def _make_launcher(
                         artifact_max_bytes=MAX_ARTIFACT_BYTES,
                         gpus=gpus,
                     )
-                    ids.append(
-                        dispatch.compute.submit(
-                            eval_job_spec(
-                                script,
-                                job_name=f"{run_id}-launch-{job_name}",
-                                account=account,
-                                partition=partition,
-                                eval_minutes=launch.minutes,
-                                gpus=gpus,
-                            )
-                        )
+                    spec = eval_job_spec(
+                        script,
+                        job_name=f"{run_id}-launch-{job_name}",
+                        account=account,
+                        partition=partition,
+                        eval_minutes=launch.minutes,
+                        gpus=gpus,
                     )
+                    ids.append(dispatch.compute.submit(_replace(spec, hold=hold)))
         except Exception:
             # a partial batch must not orphan: no park record was written yet,
             # so nothing would ever wake or cancel the jobs that DID submit —
@@ -2155,7 +2176,7 @@ def _panel_lenses_from_args(args: Any) -> tuple[tuple[PanelLens, ...], tuple[str
         if backend == "codex":
             lens_key = _judge_lens_key(
                 backend="codex",
-                key_file_env="AUTORESEARCH_PANEL_CODEX_KEY_FILE",
+                key_file_env="OUTERLOOP_PANEL_CODEX_KEY_FILE",
                 author_backend="codex",
                 claude_panel_path=claude_panel_path,
                 image=args.image,
@@ -2169,7 +2190,7 @@ def _panel_lenses_from_args(args: Any) -> tuple[tuple[PanelLens, ...], tuple[str
             # separate against the codex author key.
             lens_key = _judge_lens_key(
                 backend="hermes",
-                key_file_env="AUTORESEARCH_PANEL_HERMES_KEY_FILE",
+                key_file_env="OUTERLOOP_PANEL_HERMES_KEY_FILE",
                 author_backend="codex",
                 claude_panel_path=claude_panel_path,
                 image=args.image,
@@ -2179,6 +2200,12 @@ def _panel_lenses_from_args(args: Any) -> tuple[tuple[PanelLens, ...], tuple[str
         else:
             lens_key = panel_key
         try:
+            if not args.image:
+                log.warning(
+                    "panel lens %s runs uncontained (local mode, no image): the judge "
+                    "shares this machine with the operator's keys",
+                    backend,
+                )
             judge = build_harness(
                 lens_key,
                 reviewer_spec(),
@@ -3121,45 +3148,48 @@ def main() -> int:
     )
     parser.add_argument("--base-branch", default="main")
     # All three default from the chain env the tick sets on the climb job, so
-    # a contained run with AUTORESEARCH_{IMAGE,ACCOUNT,PARTITION} set selects
-    # dispatched measurement without extra flags. The image also containers the
-    # session + inline eval; absent any of the three, measurement stays inline
-    # regardless of the benchmark's eval hint.
+    # a contained run with OUTERLOOP_{IMAGE,ACCOUNT,PARTITION} set selects
+    # dispatched measurement without extra flags. Only the image is required
+    # for dispatch (it also contains the session + inline eval); without it,
+    # measurement stays inline regardless of the benchmark's eval hint. Empty
+    # account/partition use Slurm's defaults.
     parser.add_argument(
         "--image",
-        default=os.environ.get("AUTORESEARCH_IMAGE", ""),
+        default=os.environ.get("OUTERLOOP_IMAGE", ""),
         help="apptainer image for session+eval",
     )
-    parser.add_argument("--account", default=os.environ.get("AUTORESEARCH_ACCOUNT", ""))
-    parser.add_argument("--partition", default=os.environ.get("AUTORESEARCH_PARTITION", ""))
+    parser.add_argument("--account", default=os.environ.get("OUTERLOOP_ACCOUNT", ""))
+    parser.add_argument("--partition", default=os.environ.get("OUTERLOOP_PARTITION", ""))
     # the GPU lane for benchmarks with `gpus > 0` (evals + author launches);
     # empty = this deployment cannot place GPU jobs
-    parser.add_argument("--gpu-partition", default=os.environ.get("AUTORESEARCH_GPU_PARTITION", ""))
-    parser.add_argument("--gpu-account", default=os.environ.get("AUTORESEARCH_GPU_ACCOUNT", ""))
+    parser.add_argument("--gpu-partition", default=os.environ.get("OUTERLOOP_GPU_PARTITION", ""))
+    parser.add_argument("--gpu-account", default=os.environ.get("OUTERLOOP_GPU_ACCOUNT", ""))
     parser.add_argument(
         "--uncontained",
         action="store_true",
         help="run WITHOUT a container (dev only: sessions can then read "
         "same-user files, including credential files)",
     )
-    parser.add_argument("--claude-bin", default=os.path.expanduser("~/.local/bin/claude"))
+    parser.add_argument(
+        "--claude-bin",
+        default=default_binary("claude"),
+        help="host claude binary for the claude author (OUTERLOOP_CLAUDE_BIN, which init records)",
+    )
     parser.add_argument(
         "--codex-bin",
-        default=os.path.expanduser(
-            os.environ.get("AUTORESEARCH_CODEX_BIN") or "~/.local/bin/codex"
-        ),
+        default=default_binary("codex"),
         help="host codex binary for the codex author; bind-mounted into apptainer "
         "(must be an absolute path).",
     )
     parser.add_argument(
-        "--model", default=os.environ.get("AUTORESEARCH_AUTHOR_MODEL") or "claude-opus-5"
+        "--model", default=os.environ.get("OUTERLOOP_AUTHOR_MODEL") or "claude-opus-5"
     )
     parser.add_argument(
         "--author-backend",
         choices=("claude", "codex"),
-        default=os.environ.get("AUTORESEARCH_AUTHOR_BACKEND") or "claude",
+        default=os.environ.get("OUTERLOOP_AUTHOR_BACKEND") or "claude",
         help="agent backend for the author/editor role (config-driven: default "
-        "from AUTORESEARCH_AUTHOR_BACKEND). codex runs contained (apptainer + "
+        "from OUTERLOOP_AUTHOR_BACKEND). codex runs contained (apptainer + "
         "--sandbox danger-full-access) and REQUIRES --image and a codex/openai "
         "--model (e.g. gpt-5.6-terra).",
     )
@@ -3203,7 +3233,7 @@ def main() -> int:
     parser.add_argument("--pat-file", default=str(CONFIG_DIR / "bot_pat"))
     parser.add_argument(
         "--github-app-file",
-        default=os.environ.get("AUTORESEARCH_GITHUB_APP_FILE", ""),
+        default=os.environ.get("OUTERLOOP_GITHUB_APP_FILE", ""),
         help="GitHub App config (JSON: app_id, installation_id, private_key); "
         "when set, installation tokens replace the PAT",
     )
@@ -3211,7 +3241,7 @@ def main() -> int:
         "--key-file",
         default="",
         help="author key file; default resolves per backend (config-driven): "
-        "AUTORESEARCH_HARNESS_KEY_FILE for claude, AUTORESEARCH_CODEX_KEY_FILE for codex",
+        "OUTERLOOP_CLAUDE_KEY_FILE for claude, OUTERLOOP_CODEX_KEY_FILE for codex",
     )
     parser.add_argument("--issue", type=int, default=0)
     parser.add_argument(
@@ -3240,12 +3270,11 @@ def main() -> int:
     # and re-enter the decision. The wake job the WakeDispatcher submits runs
     # exactly this.
     if args.resume:
-        placed = bool(args.account and args.partition) or local_mode()
-        if not (placed and args.image and Path(args.image).is_file()):
+        if not (args.image and Path(args.image).is_file()):
             parser.error(
-                "--resume needs the cluster triple (--account/--partition/--image) "
-                "to rebuild the dispatched measurer (local compute waives the "
-                "account/partition pair, never the image)"
+                "--resume needs --image to rebuild the dispatched measurer "
+                "(account and partition are optional: empty ones use Slurm's "
+                "defaults, and local compute has no placement)"
             )
         from outerloop.runstate import load_record
 
@@ -3410,13 +3439,12 @@ def main() -> int:
     except ValueError as exc:
         parser.error(str(exc))
 
-    # Dispatched measurement needs the full cluster triple AND a real image
-    # file to bind against; missing any, the climb measures inline (the tick
-    # sets these on the climb job's env, a bare CLI run leaves them empty).
+    # Dispatched measurement needs a real image file to bind against; without
+    # one the climb measures inline. Account and partition are optional: empty
+    # ones use Slurm's defaults (the tick sets them on the climb job's env from
+    # the chain's), and local compute has no placement.
     dispatch: DispatchSettings | None = None
-    if (bool(args.account and args.partition) or local_mode()) and (
-        args.image and Path(args.image).is_file()
-    ):
+    if args.image and Path(args.image).is_file():
         dispatch = _dispatch_settings(args)
     try:
         try: