outerloop-science 0.1.0.dev1__tar.gz → 0.1.0.dev2__tar.gz

{outerloop_science-0.1.0.dev1 → outerloop_science-0.1.0.dev2}/CHANGELOG.md

@@ -21,6 +21,25 @@ Versions follow [SemVer](https://semver.org).
   before the rename. The focused `--github-app` run still asks nothing about
   the author. Every secret `init` writes (keys, PAT, App PEM and JSON, `.env`)
   is now created 0600 in one step rather than written and then tightened.
+- The agent image is published: `containers/agent-py312.def` is its recipe
+  (Ubuntu 24.04, Python 3.12, uv, git, build tools), the `build-image` workflow
+  builds and uploads it with a checksum to huggingface.co/outerloop-science/
+  agent-image on every recipe change, and `outerloop init` downloads it on
+  Linux when Apptainer is installed, so local mode runs contained by default
+  (`--image` names your own, `--no-image` opts out).
+- `outerloop init` checks that Apptainer can actually run a container before
+  downloading the image (on Ubuntu 24.04 a hand-installed Apptainer is on PATH
+  but cannot create user namespaces), and when it cannot, prints the install
+  steps for the machine's distribution and continues uncontained. The image
+  download shows a progress bar with size, speed and ETA on a terminal, one
+  line per 10% otherwise, and confirms the checksum. `docs/install.md` gains
+  an "Installing Apptainer" section.
+- Launch admission: with `OUTERLOOP_MAX_LAUNCH_GPUS` set to the per-user GPU
+  cap, author launches are submitted held and the tick releases them
+  oldest-first while the user's GPU jobs fit under the cap, cancels held
+  launches of runs that have ended, and stops releasing when Slurm parks a
+  released launch on a per-user reason. `squeue` rows on the board carry the
+  pending reason and GRES. Unset, launches queue as before.
 
 ### Changed
 
@@ -43,6 +62,25 @@ Versions follow [SemVer](https://semver.org).
   (a `-m` in `addopts` disables testmon), and a `serial` tier holds the tests
   that inspect the process table: skipped while workers run, and `pytest -m
   serial` turns workers off, so the tier always runs alone (CI's second step).
+- The kernel reads `OUTERLOOP_*` everywhere: every internal read, log line,
+  chain script and test now uses the public names. The pre-rename
+  `AUTORESEARCH_*` names are still accepted for one release, bridged at the
+  process boundary, the `.env` file and the chain scripts, and will be
+  dropped in the release after 0.1. The review footer names `outerloop`, and
+  `outerloop --version` exists; `start`, `tick` and `init` describe themselves
+  and every flag in `--help`.
+- The on-disk and queue names follow the rename: the resident tick job is
+  `outerloop-resident` (the per-cadence chain `outerloop-tick`), the local
+  state root defaults to `~/.outerloop`, the default image path is
+  `~/outerloop-images/agent-py312.sif`. `outerloop start` refuses while a
+  pre-rename `autoresearch-resident` is queued or running, since Slurm's
+  singleton serializes by name; cancel it first. An existing `~/.autoresearch`
+  or `~/autoresearch-images/` is used while the new path does not exist. A
+  chain-mode deployment (manual `tick_chain.sbatch`) must be stopped with
+  `scancel --name autoresearch-tick` before deploying this version. Every
+  honored pre-rename name (`~/.config/autoresearch/`, `.autoresearch.yaml`, the
+  `.autoresearch` channel dir, the old root, image and job names) is dropped in
+  the release after 0.1; the comment marker keeps recognizing old comments.
 
 ### Changed
 
@@ -128,6 +166,35 @@ Versions follow [SemVer](https://semver.org).
 - `outerloop init` no longer overwrites an existing `~/.config/autoresearch/.env`
   silently: interactively it asks; with `--yes` it refuses unless `--force` is
   passed. The check runs before any GitHub App is created.
+- Slurm account and partition are both optional (#300). `outerloop start`
+  no longer requires an account, `outerloop init` no longer insists on one,
+  the tick's in-review servicing and the attempt's resume and dispatch gates
+  need only the image, and every sbatch the kernel builds passes `--account`
+  and `--partition` only when set, so Slurm bills the caller's default
+  association and picks its default partition.
+- A launch still queued past its deadline is no longer cancelled and woken as
+  "unschedulable" when Slurm's pending reason is a wait: a busy queue
+  (Priority, Resources), a reservation or dependency, or the account's own
+  per-user/per-account/group cap (`QOSMaxGRESPerUser` and kin). The sweep
+  extends the deadline by one slack window and logs the reasons; a queued job
+  keeps its priority age, where a re-launch would start over at the back.
+  Reasons that never clear (a dependency that cannot be satisfied, per-job
+  limits, an invalid account or QOS, a held job) still cancel and wake.
+- `outerloop init` stops with exit 1 when the credential cannot open pull
+  requests on the target (401, 403, 404, or no write access) instead of
+  printing a warning and `next: outerloop start` (#285); a network failure stays
+  a warning. The PAT path records the token's login as `OUTERLOOP_BOT_LOGIN`,
+  and the tick warns when the login is unset and the lab default applies (#298).
+- `init` locates the author's CLI (`claude`/`codex`) on PATH or in
+  `~/.local/bin`, records it as `OUTERLOOP_CLAUDE_BIN`/`OUTERLOOP_CODEX_BIN`, and
+  says how to install it when absent; `attempt --claude-bin` honors that
+  setting; `start` refuses to launch when a recorded binary is missing; a
+  `spawn-error` names the binary and the OS error (#294).
+- Local jobs keep their combined stdout/stderr in `local_jobs/<id>.out` beside
+  the state file, and the log line names it when the job did not complete (#295).
+- `cryptography` is a base dependency, so the GitHub App identity works from a
+  plain `pip install`; the `app-auth` extra is now a no-op (#293). The `tick`
+  subcommand's help no longer uses lab-internal vocabulary (#286).
 
 ### Added
 

{outerloop_science-0.1.0.dev1 → outerloop_science-0.1.0.dev2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: outerloop-science
-Version: 0.1.0.dev1
+Version: 0.1.0.dev2
 Summary: Autonomous research agents that improve the benchmark you point them at, one verified pull request at a time
 Project-URL: Homepage, https://outerloop.science
 Project-URL: Repository, https://github.com/outerloop-science/outerloop
@@ -11,10 +11,10 @@ License-Expression: Apache-2.0
 License-File: LICENSE
 License-File: NOTICE
 Requires-Python: >=3.12
+Requires-Dist: cryptography>=42
 Requires-Dist: pydantic>=2
 Requires-Dist: pyyaml>=6
 Provides-Extra: app-auth
-Requires-Dist: cryptography>=42; extra == 'app-auth'
 Description-Content-Type: text/markdown
 
 <picture>

outerloop_science-0.1.0.dev2/containers/README.md

@@ -0,0 +1,8 @@
+# containers
+
+`agent-py312.def` is the Apptainer recipe for the image the kernel runs sessions and
+evaluations in. The `build-image` workflow builds it on every change to this directory and
+on manual dispatch, and publishes the result to
+[huggingface.co/outerloop-science/agent-image](https://huggingface.co/outerloop-science/agent-image)
+with a checksum. `outerloop init` downloads it on Linux when Apptainer is installed; the
+tick reads `~/outerloop-images/agent-py312.sif` unless `OUTERLOOP_IMAGE` says otherwise.

outerloop_science-0.1.0.dev2/containers/agent-py312.def

@@ -0,0 +1,43 @@
+# The Outerloop agent image: what a contained session and a dispatched
+# evaluation see. The kernel binds the workspace, a per-run home and the
+# harness binary (claude/codex) into it; --nv adds the host's GPU driver for
+# GPU benchmarks. So the image only has to provide the base a target's own
+# `uv run ...` needs: Python 3.12, uv, git and a compiler.
+#
+# Built by .github/workflows/build-image.yml and published to
+# https://huggingface.co/outerloop-science/agent-image; `outerloop init` pulls
+# it on Linux. Build by hand: apptainer build agent-py312.sif containers/agent-py312.def
+
+Bootstrap: docker
+From: ubuntu:24.04
+
+%post
+    set -eu
+    export DEBIAN_FRONTEND=noninteractive
+    apt-get update
+    apt-get install -y --no-install-recommends \
+        ca-certificates curl git git-lfs openssh-client \
+        build-essential pkg-config \
+        python3 python3-venv python3-dev \
+        libgomp1 libglib2.0-0 procps less unzip zip jq ripgrep
+    rm -rf /var/lib/apt/lists/*
+    # uv installs its own Pythons when a target pins one; the system 3.12 is the default
+    curl -LsSf https://astral.sh/uv/install.sh | env UV_INSTALL_DIR=/usr/local/bin INSTALLER_NO_MODIFY_PATH=1 sh
+    ln -sf /usr/bin/python3 /usr/local/bin/python
+    git lfs install --system
+    python3 --version && uv --version && git --version
+
+%environment
+    export LC_ALL=C.UTF-8
+    export LANG=C.UTF-8
+    export PATH=/usr/local/bin:/usr/local/sbin:/usr/sbin:/usr/bin:/sbin:/bin
+
+%labels
+    org.opencontainers.image.title outerloop agent image
+    org.opencontainers.image.source https://github.com/outerloop-science/outerloop
+    outerloop.recipe containers/agent-py312.def
+
+%help
+    Outerloop agent image: Ubuntu 24.04, Python 3.12, uv, git, build tools.
+    The kernel runs sessions and evaluations in it with --containall --cleanenv,
+    binding only the workspace, a per-run home and the harness binary.

{outerloop_science-0.1.0.dev1 → outerloop_science-0.1.0.dev2}/docs/design/architecture.md

@@ -371,8 +371,12 @@ failure can strand a run:
    `deadline = submit_time + walltime + slack` (recomputed from `start_time`
    once the job starts, so late scheduling never truncates a healthy run).
    Past the deadline the sweep consults `sacct` and acts on what it finds:
-   still PENDING → the experiment is unschedulable in practice; cancel it and
-   wake the run with that fact. No record on a *successful* query → the job
+   still PENDING → ask squeue why: a wait (Priority/Resources, a reservation
+   or dependency, the account's own per-user/group cap such as
+   `QOSMaxGRESPerUser`) moves the deadline out by one slack window, since a
+   queued job keeps its priority age and a re-launch would start over; any
+   other reason means unschedulable in practice — cancel it and wake the
+   run with that fact. No record on a *successful* query → the job
    vanished; wake with that fact. Query failed or timed out → that is
    "Slurm unknown", never "job gone" — defer to the next tick, and only a
    sustained outage (its own alert via the watchdog) escalates. A fail-safe

{outerloop_science-0.1.0.dev1 → outerloop_science-0.1.0.dev2}/docs/design/dispatcher.md

@@ -66,7 +66,7 @@ orchestrator chooses per eval site, not per repo.
 launches alike: the JobSpec requests `--gpus=N`, and the jail adds `--nv` so
 the allocation is visible inside the container; nothing else about the
 containment changes. GPU jobs need their own lane, so the deployment names
-one — `AUTORESEARCH_GPU_PARTITION`, optionally `AUTORESEARCH_GPU_ACCOUNT`
+one — `OUTERLOOP_GPU_PARTITION`, optionally `OUTERLOOP_GPU_ACCOUNT`
 (default: the CPU account) — and a benchmark with `gpus > 0` on a deployment
 without a lane is REFUSED at launch (both attempt lanes), never queued into
 evals that can never run. GPUs exist only on DISPATCHED jobs: the contract
@@ -76,6 +76,18 @@ benchmarks outright for now — a stewardship validates its rewrite in-job.
 The first target in this shape is the speedrun (`gpt-speedrun`: one H200
 per eval, ~3.5h).
 
+**Launch admission.** A per-user GPU cap (a QOS's `MaxTRESPerUser`, 16 on
+Torch) means the fleet can run only so many launches at once, whatever the
+agent count: six 8-GPU launches queued against a 16-GPU cap left four pending
+for a day on `QOSMaxGRESPerUser`. With `OUTERLOOP_MAX_LAUNCH_GPUS` set to that
+cap, author launches are submitted HELD, and every tick `service_admission`
+releases them oldest-first while the user's eligible GPU jobs (evals and
+launches alike) fit under the cap; held launches whose run has since ended
+are cancelled. A released launch that Slurm parks on a per-user reason means
+the cap is set too high, and nothing more is released that tick. The wake's
+`afterany` dependency is unchanged (held jobs are pending), and the sweep
+treats the kernel's hold as a wait. Unset, launches queue as submitted.
+
 **Who decides the eval walltime.** The gate measures steps, not time, so
 walltime should bound only SPEND — and the attempt already has a spend
 budget. The contract's `eval_minutes` is the DEFAULT; the author may declare
@@ -234,7 +246,9 @@ dies -> the `eval-error` outcome at wake (ending `aborted`, exactly as the
 in-job eval failure maps today); a LOST wake -> the sweep's primary backup,
 which wakes any run whose job reads terminal after the grace period —
 plus GONE past the deadline (vanished) and PENDING past the deadline
-(cancel, then wake as unschedulable); a still-RUNNING job is deliberately
+(when Slurm's reason is a wait — a busy queue, a reservation or dependency,
+the account's own per-user/group cap — the deadline moves out by one slack
+window; otherwise cancel, then wake as unschedulable); a still-RUNNING job is deliberately
 left alone, bounded by its own walltime; wakes that fire without producing
 progress -> `stuck` at MAX_WAKE_ATTEMPTS (a landed re-measure has its own
 allowance of MAX_WAKE_ATTEMPTS finishing follow-ups, counted on the stage). A moved base during the wait is
@@ -287,7 +301,7 @@ GPU benchmarks and portfolio climbs both multiply eval load; both were
 designed against this seam. Portfolio's N concurrent climbs become N
 waiting records with independent wakes — the serialization question stays
 in the picker, not the dispatcher. The tick's job-partition knobs
-(`AUTORESEARCH_JOB_PARTITION`) already route work jobs; per-benchmark
+(`OUTERLOOP_JOB_PARTITION`) already route work jobs; per-benchmark
 partition/GPU allocation fields are a phase-3 contract-schema change
 (`Benchmark` rejects unknown fields today, deliberately), validated and
 clamped by operator ceilings like every other budget.

{outerloop_science-0.1.0.dev1 → outerloop_science-0.1.0.dev2}/docs/design/github-app-auth.md

@@ -108,7 +108,7 @@ Swapping the live fleet's identity mid-campaign is an ops event:
 
 ## The flag
 
-`AUTORESEARCH_GITHUB_APP_FILE` names a JSON config —
+`OUTERLOOP_GITHUB_APP_FILE` names a JSON config —
 
 ```json
 {"app_id": 1234, "installation_id": 5678,
@@ -117,13 +117,13 @@ Swapping the live fleet's identity mid-campaign is an ops event:
 
 — and rides the rails the PAT already rides: role CLIs default their
 `--github-app-file` from it (jobs inherit the tick's environment, the same
-way `AUTORESEARCH_AUTHOR_*` reaches them), and every bot-auth construction
+way `OUTERLOOP_AUTHOR_*` reaches them), and every bot-auth construction
 goes through one factory, `appauth.resolve_bot_auth(pat_file, app_file)`:
 App provider when the config is set, PAT otherwise. Revert = unset the env
 var. The ids are not secrets; the key path inside keeps PAT-file custody
 (600, never committed).
 
-The identity flips WITH the credential: `AUTORESEARCH_BOT_LOGIN` names the
+The identity flips WITH the credential: `OUTERLOOP_BOT_LOGIN` names the
 login the kernel now posts as (`<app-slug>[bot]`, e.g.
 `outerloop-autoresearch[bot]`), read by every role through one
 `github.bot_login_from_env()` default. Every own-comment filter, alarm-issue
@@ -135,10 +135,10 @@ Everything the kernel created BEFORE the flip carries the old login — the
 research-log issue, contract alarms, intake claims, its PRs. Recognition is
 keyed on login on purpose (the markers are public strings anyone can paste),
 so a flip must widen the set of our logins, not loosen the check:
-`AUTORESEARCH_BOT_ALIASES=agentic-learning-bot` names the former identity,
+`OUTERLOOP_BOT_ALIASES=agentic-learning-bot` names the former identity,
 and every "is this ours" gate goes through `github.is_own_login`. The
 reusable review and verify workflows take the same value as a `bot_aliases`
-input (exported as `AUTORESEARCH_BOT_ALIASES`; the verifier's author gate
+input (exported as `OUTERLOOP_BOT_ALIASES`; the verifier's author gate
 accepts an alias too), so a target repo passes `bot_login` = the App login and
 `bot_aliases` = the former account. Live lesson: without it, the first tick
 under the App claimed the kernel's own research-log issue as a research order.

{outerloop_science-0.1.0.dev1 → outerloop_science-0.1.0.dev2}/docs/design/headline.md

@@ -61,7 +61,7 @@ monitoring agent + ~100 interventions; AIDE: in-process tree search). Ours is
 **decentralized on Slurm**: no resident daemon — a self-perpetuating chain of
 ~16 s stateless ticks; all state in typed records on the shared FS; every
 role (author session, eval, panel judge, wake) its own Slurm job — wake
-dispatch sits behind an operator flag (`AUTORESEARCH_DISPATCH_WAKE`, on in
+dispatch sits behind an operator flag (`OUTERLOOP_DISPATCH_WAKE`, on in
 our deployment since 2026-08-20; retiring the dark-launch flag to
 default-on is a listed cleanup); crash or preemption anywhere heals
 through the sweep into honest endings.

{outerloop_science-0.1.0.dev1 → outerloop_science-0.1.0.dev2}/docs/design/resident-tick.md

@@ -1,7 +1,7 @@
 # The resident tick
 
 *Design note, 2026-09-02. Status: built as the opt-in mode
-(`AUTORESEARCH_RESIDENT=1`, `scripts/tick_resident.sh`); the chain restarts of
+(`OUTERLOOP_RESIDENT=1`, `scripts/tick_resident.sh`); the chain restarts of
 2026-09-02 are the evidence.*
 
 ## The problem
@@ -91,16 +91,16 @@ covers it.
 
 ## Rollout
 
-1. Opt-in mode in `scripts/tick_chain.sbatch`: `AUTORESEARCH_RESIDENT=1` in
+1. Opt-in mode in `scripts/tick_chain.sbatch`: `OUTERLOOP_RESIDENT=1` in
    the chain's environment selects the loop; unset keeps the per-cadence
    chain. The walltime is fixed by Slurm before the script runs, so the
    resident chain is STARTED with an explicit walltime and its own job name:
 
    ```
-   sbatch --time=360 --job-name=autoresearch-resident --dependency=singleton \
+   sbatch --time=360 --job-name=outerloop-resident --dependency=singleton \
      --account=… --partition=cpu_short \
-     --export=ALL,AUTORESEARCH_RESIDENT=1,AUTORESEARCH_HOME=…,AUTORESEARCH_ROOT=…,\
-   AUTORESEARCH_ACCOUNT=…,AUTORESEARCH_PARTITION=cpu_short,AUTORESEARCH_PAT_FILE=… \
+     --export=ALL,OUTERLOOP_RESIDENT=1,OUTERLOOP_HOME=…,OUTERLOOP_ROOT=…,\
+   OUTERLOOP_ACCOUNT=…,OUTERLOOP_PARTITION=cpu_short,OUTERLOOP_PAT_FILE=… \
      scripts/tick_chain.sbatch
    ```
 

{outerloop_science-0.1.0.dev1 → outerloop_science-0.1.0.dev2}/docs/design/role-cli.md

@@ -40,7 +40,7 @@ The invariants, proven on #132/#133 and non-negotiable everywhere:
    in the same PR — never two ways to say the same thing.
 4. **Verbs are RoleSpec-gated.** The RoleSpec already caps each role's
    tools/scope/key; the CLI's live verbs are part of that cap. It is ONE tool
-   (`.autoresearch/syscall`) whose verbs the brief exposes per role — an author
+   (`.outerloop/syscall`) whose verbs the brief exposes per role — an author
    uses `launch`/`sleep`, a judge uses `finding`/`conclude` — and a syscall is
    TYPED, so the kernel dispatches by type (a sleep parks + wakes; a verdict is
    read back). Every role runs the tool the same way: a shell in the jail. Roles
@@ -49,7 +49,7 @@ The invariants, proven on #132/#133 and non-negotiable everywhere:
 
 ## End-state
 
-One `.autoresearch/syscall` tool, its live verbs gated per role by RoleSpec:
+One `.outerloop/syscall` tool, its live verbs gated per role by RoleSpec:
 
 | Role | Verbs | Win | Installed where |
 | --- | --- | --- | --- |
@@ -70,7 +70,7 @@ lands with tests, and deletes what it replaces.
 ### Phase 0 — finish Phase A (in flight, prerequisite)
 
 The wake for `author-sleep` parks: gather each launch's results from the run
-dir, deliver declared artifacts into `.autoresearch/results/<name>/`, resume
+dir, deliver declared artifacts into `.outerloop/results/<name>/`, resume
 the **same session** through the climb's resume-entry (#129) with the results
 data-fenced, update the budget file. (The transitional `AUTHOR_SLEEP_WAKE_READY`
 constant and env-flag arming have since retired: enablement is contract-driven.) Plus
@@ -95,7 +95,7 @@ findings drafts the PR for a human. A submit costs the sleep it rides on.
 
 A verdict is not a second tool — it is a syscall TYPE on the one surface.
 Reviewer/verifier/panel stop emitting one schema-constrained final message.
-Instead: `python .autoresearch/syscall finding --file --line --confidence
+Instead: `python .outerloop/syscall finding --file --line --confidence
 --summary --detail [--blocking] [--kind] [--category]` per finding, then
 `... conclude --notes ...` to commit — each call validated on the spot, the
 verdict assembled kernel-side (`type: "verdict"`), well-formed by construction.

{outerloop_science-0.1.0.dev1 → outerloop_science-0.1.0.dev2}/docs/install.md

@@ -214,14 +214,19 @@ backend; the interface is small (submit a job, poll for completion), so a CI
 runner, a cloud backend, or a hardware rig plugs in the same way.
 
 The deployment is configured by environment (`OUTERLOOP_*`; the pre-rename
-`AUTORESEARCH_*` names are still accepted everywhere). Placement and paths are set
+`AUTORESEARCH_*` names are still accepted for one release). Placement and paths are set
 when the chain is started: `OUTERLOOP_ACCOUNT`/`OUTERLOOP_PARTITION`
-place the CPU jobs (ticks, author sessions), `OUTERLOOP_HOME`/
+place the CPU jobs (ticks, author sessions; both are optional, unset lets
+Slurm bill the default association and pick the default partition),
+`OUTERLOOP_HOME`/
 `OUTERLOOP_ROOT` locate the checkout and the state, `OUTERLOOP_IMAGE`
 the container. The rest is re-read from `~/.config/outerloop/.env` each
 tick, so changes take effect at the next cadence: `OUTERLOOP_TARGET`
 names the repo being climbed; `OUTERLOOP_GPU_PARTITION` (optionally
-`OUTERLOOP_GPU_ACCOUNT`) is the lane for GPU evals and launches — a
+`OUTERLOOP_GPU_ACCOUNT`) is the lane for GPU evals and launches;
+`OUTERLOOP_MAX_LAUNCH_GPUS` is the per-user GPU cap (your QOS's
+`MaxTRESPerUser`) under which the tick admits author launches, unset = queue
+them as submitted — a
 comma-separated partition list lets Slurm start each job wherever it fits
 first; `OUTERLOOP_PANEL` names the verify/review lenses (with
 `OUTERLOOP_PANEL_*_KEY_FILE` for their keys); the author backend is
@@ -232,7 +237,7 @@ first; `OUTERLOOP_PANEL` names the verify/review lenses (with
 still read). A Codex author always runs contained, so it also needs the image
 (`OUTERLOOP_IMAGE`) and a Codex model in `OUTERLOOP_AUTHOR_MODEL`. On a
 cluster, evals run inside the Apptainer image at `OUTERLOOP_IMAGE` (default
-`~/autoresearch-images/agent-py312.sif`) in a jail that binds only the
+`~/outerloop-images/agent-py312.sif`) in a jail that binds only the
 checked-out tree — an eval that needs data must fetch it into the tree, and
 GPU jobs are requested per node (`--gpus-per-node`).
 
@@ -243,8 +248,56 @@ environment, both on your machine with your keys, and the loop says so once
 at start. The verification panel is off in this mode unless you set
 `OUTERLOOP_PANEL_UNCONTAINED=1`, because an uncontained judge holds a shell
 next to its own key file; a pull request opened without a panel says so. A
-Codex author needs the image in every mode. Contained local mode, the
-default on Linux once the image is published, needs Apptainer and the image.
+Codex author needs the image in every mode. Contained local mode needs
+Apptainer and the image: the published one lives at
+[huggingface.co/outerloop-science/agent-image](https://huggingface.co/outerloop-science/agent-image),
+built from `containers/agent-py312.def`. On Linux with Apptainer installed,
+`outerloop init` downloads it to `~/outerloop-images/` (about 200 MB, with a
+progress bar), verifies its published checksum and records it; `--image` points at
+your own, `--no-image` keeps runs uncontained even when an image is already on disk
+(it writes `OUTERLOOP_IMAGE=`, the off-switch). When Apptainer is missing or cannot
+run containers, init says so, prints the install steps for your system, and
+continues uncontained; run `outerloop init --force` after installing it.
+
+**Installing Apptainer (Linux, one time, needs root or an admin).** Apptainer runs
+sessions and evaluations in containers. Check for it
+with `apptainer exec docker://alpine:3.20 cat /etc/alpine-release`; a version number
+means it works.
+
+- *Ubuntu.* Install from the project's PPA, which builds for amd64 and arm64. The
+  package carries the AppArmor profile Ubuntu 23.10 and later require; the
+  unprivileged installer does not, and fails at run time with
+  `Could not write info to setgroups`.
+
+  ```bash
+  sudo add-apt-repository -y ppa:apptainer/ppa
+  sudo apt-get update && sudo apt-get install -y apptainer
+  ```
+
+- *Debian (x86-64).* Install the release package from
+  [github.com/apptainer/apptainer/releases](https://github.com/apptainer/apptainer/releases)
+  (`apptainer_<version>_amd64.deb`, not the `-suid` one):
+
+  ```bash
+  curl -fsSLO https://github.com/apptainer/apptainer/releases/download/v1.5.3/apptainer_1.5.3_amd64.deb
+  sudo apt-get install -y ./apptainer_1.5.3_amd64.deb
+  ```
+
+  The release has no package for other architectures; on ARM Debian, build from
+  source or use the unprivileged installer below.
+
+- *Fedora.* `sudo dnf install -y apptainer`.
+- *RHEL, Rocky, Alma.* `sudo dnf install -y epel-release`, then `sudo dnf install -y apptainer`.
+- *No root.* The project's unprivileged installer works on most other systems. It is
+  pinned to the release tag; download it, read it, then run it:
+
+  ```bash
+  curl -fsSLO https://raw.githubusercontent.com/apptainer/apptainer/v1.5.3/tools/install-unprivileged.sh
+  less install-unprivileged.sh && bash install-unprivileged.sh ~/apptainer
+  export PATH=$HOME/apptainer/bin:$PATH
+  ```
+- *Slurm clusters.* Ask the administrators; most already provide it.
+- *macOS.* No Apptainer; runs stay uncontained (a macOS containment is on the roadmap).
 
 ---
 

{outerloop_science-0.1.0.dev1 → outerloop_science-0.1.0.dev2}/docs/roadmap.md

@@ -238,7 +238,7 @@ Research findings sync through GitHub; job state never leaves its cluster.
       re-measured and re-gated); capped-out blocking opens a DRAFT PR and
       never arms auto-merge; the transcript rides in the PR body. DEPLOYED
       in code: the tick passes --panel verify,review to every climb job by
-      default (off-switch AUTORESEARCH_PANEL=""). Cluster prerequisite: the
+      default (off-switch OUTERLOOP_PANEL=""). Cluster prerequisite: the
       verifier key file at ~/.config/outerloop/verifier_key on the tick
       account — a missing key fails climbs LOUDLY by design. GitHub-side
       verify.yml thins per target after the pilot runs clean

{outerloop_science-0.1.0.dev1 → outerloop_science-0.1.0.dev2}/docs/validation/author-syscalls.md

@@ -4,7 +4,7 @@
 > milestones green — the codex author launched + slept unprompted, the same
 > session resumed with its launch's post-hibernation results, and the run
 > reached an honest negative terminal. The `--author-syscalls` /
-> `AUTORESEARCH_AUTHOR_SYSCALLS` arming described by the original runbook has
+> `OUTERLOOP_AUTHOR_SYSCALLS` arming described by the original runbook has
 > since RETIRED: enablement is contract-driven (dispatch coords + a resumable
 > backend + `depth_k > 0`; `depth_k: 0` is a benchmark's opt-out). The steps
 > below are kept for re-validation after substrate changes.
@@ -36,17 +36,17 @@ the brief only when armed).
 
 The lifecycle to confirm, in order:
 
-1. **Tool installed:** `<run_dir>/ws/.autoresearch/syscall` exists, and
-   `.autoresearch/budget.json` shows `depth_k` / `sleep_k`.
+1. **Tool installed:** `<run_dir>/ws/.outerloop/syscall` exists, and
+   `.outerloop/budget.json` shows `depth_k` / `sleep_k`.
 2. **Author sleeps:** the session ends having written
-   `.autoresearch/syscall.json` (`type: "sleep"`, one+ launches).
+   `.outerloop/syscall.json` (`type: "sleep"`, one+ launches).
 3. **Park:** the run record is `waiting`, `stage.phase == "author-sleep"`, with
    `stage.afterany` naming the submitted launch job(s), `syscall_launches`, and
    `launches_used` / `sleeps_used` counts.
 4. **Launch job runs:** `<run_dir>/eval-launch-<name>/` fills with `exit-code`,
    `stdout`, `stderr`, and `artifacts/` (the declared files, copied out).
 5. **Wake:** the tick wakes the parked run; `gather_results` delivers artifacts
-   into `<ws>/.autoresearch/results/<name>/`, and the SAME session resumes
+   into `<ws>/.outerloop/results/<name>/`, and the SAME session resumes
    (`resume_session_id` unchanged) with the results data-fenced + the author's
    note echoed back.
 6. **Terminate:** the woken author either sleeps again (a fresh author-sleep

{outerloop_science-0.1.0.dev1 → outerloop_science-0.1.0.dev2}/pyproject.toml

@@ -12,6 +12,7 @@ license-files = ["LICENSE", "NOTICE"]
 requires-python = ">=3.12"
 authors = [{ name = "Agentic Learning AI Lab, New York University" }]
 dependencies = [
+    "cryptography>=42",  # GitHub App auth (RS256 JWTs), the recommended identity
     "pydantic>=2",
     "pyyaml>=6",
 ]
@@ -24,9 +25,10 @@ dependencies = [
 outerloop = "outerloop.cli:main"
 
 [project.optional-dependencies]
-# GitHub App auth: RS256 signing for App JWTs (docs/design/github-app-auth.md).
-# Install where AUTORESEARCH_GITHUB_APP_FILE is set; the PAT path needs nothing.
-app-auth = ["cryptography>=42"]
+# `cryptography` is a base dependency since 0.1.0.dev2 (the App identity init
+# recommends must work from a plain install, #293); the extra stays as a no-op so
+# `pip install "outerloop-science[app-auth]"` keeps working.
+app-auth = []
 
 [dependency-groups]
 dev = [
@@ -75,6 +77,7 @@ testpaths = ["tests"]
 # the tests affected by your edits.
 addopts = "-ra --strict-markers -n auto"
 markers = [
+    "real_locate_harness: exercises the real harness lookup (test_init fixture skips its patch)",
     "slow: long-running; nightly/manual only",
     "llm: calls a paid LLM API; manual only, never CI",
     "slurm: needs a Slurm cluster; manual only, never CI",

{outerloop_science-0.1.0.dev1 → outerloop_science-0.1.0.dev2}/scripts/README.md

@@ -7,7 +7,7 @@ runs the local loop elsewhere, reading placement from `~/.config/outerloop/.env`
 | Script | Purpose |
 | --- | --- |
 | `setup_branch_protection.sh` | Apply/refresh branch protection on `main`. Solo-phase default: 0 approvals, checks required, admins enforced. Re-run with `1` once a second code owner joins. |
-| `tick_chain.sbatch` | The Slurm tick entry: per-cadence chain (deploy, one tick, schedule the next) or, with `AUTORESEARCH_RESIDENT=1`, the resident loop (`docs/design/resident-tick.md`). |
+| `tick_chain.sbatch` | The Slurm tick entry: per-cadence chain (deploy, one tick, schedule the next) or, with `OUTERLOOP_RESIDENT=1`, the resident loop (`docs/design/resident-tick.md`). |
 | `tick_deploy.sh` | The deploy step both modes source: stale-lock sweep, pull `main`, sync deps, read the operator's `.env` knobs, install backends. |
 | `tick_resident.sh` | The resident loop: deploy → one tick under a timeout → sleep to the slot, one `afterany:self` successor, pause exits clean, shim changes resubmit the successor. |
 | `requeue_moved_successors.sh` | Cancel pending same-name jobs that are no longer on the requested partition. The tick chain runs this before adding successors. |

{outerloop_science-0.1.0.dev1 → outerloop_science-0.1.0.dev2}/scripts/install_codex.sh

@@ -9,7 +9,7 @@
 #
 # Usage: install_codex.sh [target_path]
 #   target_path  where to place the binary
-#                (default: $AUTORESEARCH_CODEX_BIN, else ~/.local/bin/codex)
+#                (default: $OUTERLOOP_CODEX_BIN, else ~/.local/bin/codex)
 set -euo pipefail
 
 # Pinned: 0.130.0 is harness-verified — it needs neither the code-mode-host helper
@@ -20,7 +20,7 @@ WANT="0.130.0"
 # release asset can never execute on the host (integrity, not self-reported
 # version). To bump WANT: fetch the new asset and `sha256sum` it, then update both.
 WANT_SHA256="16779e7b7857508a768a36d7d4e084eec336ec23946ed70a9b09489b8f861190"
-TARGET="${1:-${AUTORESEARCH_CODEX_BIN:-$HOME/.local/bin/codex}}"
+TARGET="${1:-${OUTERLOOP_CODEX_BIN:-$HOME/.local/bin/codex}}"
 
 have="$("$TARGET" --version 2>/dev/null | grep -oE '[0-9]+\.[0-9]+\.[0-9]+' | head -1 || true)"
 if [ "$have" = "$WANT" ]; then