outerloop-science 0.1.0.dev3__py3-none-any.whl → 0.1.0.dev4__py3-none-any.whl

outerloop/__init__.py

@@ -2,7 +2,7 @@
 
 import os
 
-__version__ = "0.1.0.dev3"
+__version__ = "0.1.0.dev4"
 
 
 def _bridge_legacy_env() -> None:

outerloop/appauth.py

@@ -17,8 +17,10 @@ network; the production signer lives behind the `app-auth` extra.
 
 from __future__ import annotations
 
+import argparse
 import base64
 import json
+import os
 import time
 import urllib.error
 import urllib.parse
@@ -29,6 +31,7 @@ from pathlib import Path
 from typing import Any
 
 from outerloop.github import AUTH_SAFE_OPENER, FileTokenProvider, TokenProvider
+from outerloop.paths import CONFIG_DIR
 
 # RS256-sign the JWT signing input, returning the raw signature bytes.
 Signer = Callable[[bytes], bytes]
@@ -211,3 +214,17 @@ def resolve_bot_auth(pat_file: str | Path, app_file: str | Path = "") -> TokenPr
     if str(app_file).strip():
         return app_provider_from_file(Path(str(app_file)).expanduser())
     return FileTokenProvider(Path(str(pat_file)).expanduser())
+
+
+def add_credential_args(parser: argparse.ArgumentParser) -> None:
+    """Add the shared bot-auth options to a role parser: `--pat-file`, and
+    `--github-app-file`, which supplies installation tokens instead of the PAT
+    when set. `resolve_bot_auth` reads the pair. One owner so the defaults and
+    help cannot drift between attempt, followup, and steward."""
+    parser.add_argument("--pat-file", default=str(CONFIG_DIR / "bot_pat"))
+    parser.add_argument(
+        "--github-app-file",
+        default=os.environ.get("OUTERLOOP_GITHUB_APP_FILE", ""),
+        help="GitHub App config (JSON: app_id, installation_id, private_key); "
+        "when set, installation tokens replace the PAT",
+    )

outerloop/attempt.py

@@ -26,7 +26,7 @@ from functools import partial
 from pathlib import Path
 from typing import Any, cast
 
-from outerloop.appauth import resolve_bot_auth
+from outerloop.appauth import add_credential_args, resolve_bot_auth
 from outerloop.brief import BudgetState, distill_lessons
 from outerloop.compute import LocalCompute
 from outerloop.contract import Benchmark, Contract, contract_text_in_tree, load_contract
@@ -928,6 +928,22 @@ def _wake_author_sleep(
     if extra_update:
         # a submitted park's gate/panel feedback leads; launch results follow
         wake_text = f"{extra_update}\n\n{wake_text}"
+    # A research line whose base moved while it slept RE-PINS to the fresh base
+    # and is told to merge it: the agent does the merge (mirroring the in-review
+    # conflict wake, followup.py), the kernel only fetches and re-pins. Re-pinning
+    # base_sha to the fresh head is what makes the gate baseline and the scope
+    # base the CURRENT base (like followup's base_sha_at_fetch), so a sibling's
+    # merged work is never credited to this line and a forbidden conflict
+    # resolution (differing from the fresh base) is still scope-checked. Non-line
+    # runs and an unmoved base are untouched.
+    if _line_ref_for(bench, config.agent_id):
+        fresh_base = _line_base_advanced(ws, base_branch, base_sha)
+        if fresh_base:
+            digest = _reintegration_digest(ws, base_sha, fresh_base)
+            base_sha = fresh_base
+            wake_text = (
+                REINTEGRATE_PROMPT.format(base_branch=base_branch, digest=digest) + wake_text
+            )
     _best_effort(
         "budget refresh",
         lambda: write_budget(
@@ -1296,6 +1312,54 @@ def _line_ref_for(bench: Benchmark | None, agent_id: str) -> str:
     return f"agents/{agent_id}"
 
 
+# The base moved under a line while it slept: rather than the kernel doing a
+# git merge (which mishandles the agent's in-flight tree, its conflicts, and
+# the scope gate), the wake mirrors the in-review conflict wake — fetch the
+# fresh base into the workspace and TELL THE AGENT to merge it. The agent has
+# git and already resolves the run-start merge as its first task; only the
+# credential-bearing fetch/push are the kernel's. No commit text goes in the
+# prompt (no cross-agent prompt-injection surface); the agent reads what
+# landed from git itself.
+REINTEGRATE_PROMPT = (
+    "# The base moved while you were asleep\n"
+    "`origin/{base_branch}` advanced since your last run and is fetched into "
+    "your workspace. What landed:\n{digest}\n"
+    "Merge it into your line and resolve any conflicts honestly, then decide "
+    "what to re-run given what landed — if a sibling took your direction "
+    "further, pivot or say so plainly rather than pushing on. Your change is "
+    "measured against the current base.\n\n"
+)
+
+
+def _reintegration_digest(ws: Workspace, base_sha: str, fresh_head: str) -> str:
+    """A short 'what landed' list: the subjects of the commits merged into the
+    base since this line's base, newest first, capped. These are MERGED commits
+    — vetted by the human-merge gate — so they are context, not untrusted input;
+    the agent also has them in git to read in full."""
+    try:
+        out = ws.git("log", "--no-merges", "--format=%s", f"{base_sha}..{fresh_head}")
+    except Exception:
+        return "  (recent changes on the base; see `git log`)"
+    subjects = [ln.strip() for ln in out.splitlines() if ln.strip()][:12]
+    return "\n".join(f"  - {s}" for s in subjects) or "  (a merge on the base; see `git log`)"
+
+
+def _line_base_advanced(ws: Workspace, base_branch: str, base_sha: str) -> str:
+    """Fetch `origin/<base_branch>` and return its head when it has advanced
+    past the line's pinned base, else "". The fetch doubles as making the
+    fresh base available for the agent to merge and refreshes the origin refs
+    the scope/measure path pairs against. Best-effort: any git failure returns
+    "" and the wake proceeds exactly as today."""
+    try:
+        ws.fetch_origin()
+        new = ws.git("rev-parse", f"refs/remotes/origin/{base_branch}").strip()
+        merge_base = ws.git("merge-base", new, base_sha).strip()
+        return new if new and merge_base != new else ""
+    except Exception as exc:
+        log.warning("base-moved check failed (%s); wake proceeds unchanged", type(exc).__name__)
+        return ""
+
+
 def _push_line_snapshot(
     ws: Workspace,
     line_ref: str,
@@ -3447,13 +3511,7 @@ def main() -> int:
         default=120.0,
         help="how long before the walltime the self-deadline fires (floor 60)",
     )
-    parser.add_argument("--pat-file", default=str(CONFIG_DIR / "bot_pat"))
-    parser.add_argument(
-        "--github-app-file",
-        default=os.environ.get("OUTERLOOP_GITHUB_APP_FILE", ""),
-        help="GitHub App config (JSON: app_id, installation_id, private_key); "
-        "when set, installation tokens replace the PAT",
-    )
+    add_credential_args(parser)
     parser.add_argument(
         "--key-file",
         default="",

outerloop/cli.py

@@ -499,6 +499,55 @@ def start(args: argparse.Namespace) -> int:
     return 0
 
 
+DIST = "outerloop-science"  # the PyPI distribution; imported as `outerloop`
+
+
+def _installed_version(python: str) -> str:
+    """The installed version of the distribution, read from a fresh interpreter
+    so it reflects what pip just wrote rather than this process's imported copy."""
+    proc = subprocess.run(
+        [python, "-c", f"import importlib.metadata as m; print(m.version({DIST!r}))"],
+        capture_output=True,
+        text=True,
+        check=False,
+    )
+    return proc.stdout.strip() or "unknown"
+
+
+def upgrade(args: argparse.Namespace) -> int:
+    """Upgrade the installed package in place, the local adopter's one verb.
+
+    On Slurm the resident tick self-updates through OUTERLOOP_AUTO_UPDATE; a local
+    install has no such loop, so this is the equivalent: `pip install --upgrade`,
+    then you restart the loop to pick the new code up. Pip already picks the newest
+    release and only falls back to a pre-release when that is all that is published;
+    --pre forces pre-releases even once a stable exists."""
+    cmd = [sys.executable, "-m", "pip", "install", "--upgrade", DIST]
+    if args.pre:
+        cmd.append("--pre")
+    if args.dry_run:
+        print(shlex.join(cmd))
+        return 0
+    before = _installed_version(sys.executable)
+    proc = subprocess.run(cmd, check=False)
+    if proc.returncode != 0:
+        print(
+            f"upgrade failed (pip exited {proc.returncode}). If this environment has no "
+            f"pip, upgrade through its installer instead, e.g. `uv pip install --upgrade {DIST}`.",
+            file=sys.stderr,
+        )
+        return proc.returncode
+    after = _installed_version(sys.executable)
+    if before == after:
+        print(f"already up to date: outerloop {after}.")
+    else:
+        print(
+            f"upgraded outerloop {before} -> {after}. Restart the loop to pick it up: "
+            f"stop the running tick, then `outerloop start`."
+        )
+    return 0
+
+
 def main(argv: list[str] | None = None) -> int:
     from outerloop import __version__
 
@@ -539,6 +588,17 @@ def main(argv: list[str] | None = None) -> int:
         help="guided setup: write ~/.config/outerloop/.env and the PAT file",
         add_help=False,
     )
+    up = sub.add_parser(
+        "upgrade",
+        help="upgrade the installed package, then restart the loop to pick it up",
+        description="Upgrade outerloop-science in this environment with pip. On Slurm the "
+        "resident tick self-updates through OUTERLOOP_AUTO_UPDATE; this is the equivalent "
+        "for a local install. Restart the loop afterwards to run the new code.",
+    )
+    up.add_argument(
+        "--pre", action="store_true", help="include pre-releases even once a stable exists"
+    )
+    up.add_argument("--dry-run", action="store_true", help="print the command and exit")
     argv = sys.argv[1:] if argv is None else list(argv)
     if argv[:1] == ["tick"]:
         # the tick entry owns its own parser; hand it the rest untouched
@@ -551,7 +611,10 @@ def main(argv: list[str] | None = None) -> int:
         from outerloop import init
 
         return init.main(argv[1:])
-    return start(parser.parse_args(argv))
+    args = parser.parse_args(argv)
+    if args.command == "upgrade":
+        return upgrade(args)
+    return start(args)
 
 
 if __name__ == "__main__":

outerloop/climbboard.py

@@ -29,7 +29,7 @@ from pathlib import Path
 from typing import Any
 
 from outerloop.markers import marker
-from outerloop.runstate import ENDED, list_runs, run_dir
+from outerloop.runstate import ENDED, RunRecord, list_runs, run_dir
 
 log = logging.getLogger("outerloop.climbboard")
 
@@ -169,12 +169,19 @@ def _curve_from_eval(run_directory: Path) -> list[list[float]]:
     return best
 
 
-def collect_rows(root: Path, target: str) -> dict[str, list[ClimbRow]]:
-    """Terminal attempts of `target` with a report, grouped by benchmark."""
+def collect_rows(
+    root: Path, target: str, records: list[RunRecord] | None = None
+) -> dict[str, list[ClimbRow]]:
+    """Terminal attempts of `target` with a report, grouped by benchmark.
+
+    `records` is one tick-wide snapshot the board threads to every collector;
+    absent, the rows are read fresh (direct callers, tests)."""
     from datetime import UTC, datetime
 
+    if records is None:
+        records = list_runs(root)
     out: dict[str, list[ClimbRow]] = {}
-    for record in list_runs(root):
+    for record in records:
         # only ENDED runs: an in-review run's outcome is not known yet (its
         # PR may be rejected), and a published row is never rewritten
         if record.target != target or record.state != ENDED:
@@ -872,13 +879,19 @@ def is_fixed_kernel_job(name: str) -> bool:
     return any(p.match(name) for p in FIXED_JOB_PATTERNS)
 
 
-def run_job_names(root: Path, target: str) -> dict[str, tuple[str, str, bool]]:
+def run_job_names(
+    root: Path, target: str, records: list[RunRecord] | None = None
+) -> dict[str, tuple[str, str, bool]]:
     """Expected per-run job names for `target`: name -> (run_id, agent,
     is_prefix). Exact for wake and followup; a prefix for launches, whose
     names end in the experiment's own label. Every run of the target counts,
-    ended ones too: a finishing job can outlive its record's state."""
+    ended ones too: a finishing job can outlive its record's state.
+
+    `records` shares the board's one snapshot; absent, it reads fresh."""
+    if records is None:
+        records = list_runs(root)
     out: dict[str, tuple[str, str, bool]] = {}
-    for record in list_runs(root):
+    for record in records:
         if record.target != target:
             continue
         rid, agent = record.run_id, record.agent_id
@@ -897,13 +910,19 @@ def run_job_names(root: Path, target: str) -> dict[str, tuple[str, str, bool]]:
     return out
 
 
-def eval_job_owners(root: Path, target: str) -> dict[str, tuple[str, str]]:
+def eval_job_owners(
+    root: Path, target: str, records: list[RunRecord] | None = None
+) -> dict[str, tuple[str, str]]:
     """Slurm job id -> (run_id, agent) for every eval a live run of `target`
     has dispatched: the measurer leaves the id in eval-*/submitted. Eval job
     names are liveness hashes with no agent in them, so this is how the queue
-    view knows whose eval is whose."""
+    view knows whose eval is whose.
+
+    `records` shares the board's one snapshot; absent, it reads fresh."""
+    if records is None:
+        records = list_runs(root)
     out: dict[str, tuple[str, str]] = {}
-    for record in list_runs(root):
+    for record in records:
         if record.target != target or record.state == ENDED:
             continue
         for submitted in run_dir(root, record.run_id).glob("eval-*/submitted"):
@@ -916,12 +935,20 @@ def eval_job_owners(root: Path, target: str) -> dict[str, tuple[str, str]]:
     return out
 
 
-def queue_rows(root: Path, target: str, snapshot: list[dict[str, str]]) -> list[dict[str, str]]:
+def queue_rows(
+    root: Path,
+    target: str,
+    snapshot: list[dict[str, str]],
+    records: list[RunRecord] | None = None,
+) -> list[dict[str, str]]:
     """The published queue: kernel jobs from a `Compute.queue_snapshot()`,
     each attributed to an agent (by eval marker, else by the agent id every
-    other kernel job carries in its name)."""
-    owners = eval_job_owners(root, target)
-    expected = run_job_names(root, target)
+    other kernel job carries in its name).
+
+    `records` shares the board's one snapshot across both owner maps; absent,
+    each reads fresh (watcher, tests)."""
+    owners = eval_job_owners(root, target, records)
+    expected = run_job_names(root, target, records)
     rows: list[dict[str, str]] = []
     for job in snapshot:
         name = str(job.get("name", ""))
@@ -1001,19 +1028,25 @@ def collect_status(
     now: float,
     contract: Any = None,
     queue: list[dict[str, str]] | None = None,
+    records: list[RunRecord] | None = None,
 ) -> dict[str, Any]:
     """The fleet's live picture for `target`: one entry per non-terminal run.
     Timestamps, not durations — the page computes elapsed time client-side,
-    so the strip feels live between pushes."""
+    so the strip feels live between pushes.
+
+    `records` shares the board's one snapshot (the runs list and the queue's
+    owner maps read the same records); absent, it reads fresh."""
     from outerloop.dispatch import effective_eval_minutes
 
+    if records is None:
+        records = list_runs(root)
     budgets = {
         b.name: (b.depth_k, b.sleep_k, getattr(b, "eval_minutes", 0) or 0)
         for b in getattr(contract, "benchmarks", ())
     }
     gpu_budget = getattr(getattr(contract, "budgets", None), "gpu_hours_per_run", None)
     runs = []
-    for record in list_runs(root):
+    for record in records:
         if record.target != target or record.state not in _LIVE_STATES:
             continue
         stage = record.stage or {}
@@ -1058,7 +1091,7 @@ def collect_status(
     runs.sort(key=lambda r: str(r.get("run_id")))
     status: dict[str, Any] = {"target": target, "published": now, "runs": runs}
     if queue is not None:  # a snapshot was taken (Slurm); the local loop has no queue
-        status["queue"] = queue_rows(root, target, queue)
+        status["queue"] = queue_rows(root, target, queue, records)
     return status
 
 
@@ -1069,12 +1102,15 @@ def service_status(
     now: float,
     contract: Any = None,
     queue: list[dict[str, str]] | None = None,
+    records: list[RunRecord] | None = None,
 ) -> bool:
     """Publish the strip when the fleet's SHAPE changed — a run appearing,
     leaving, or changing state/phase — never on every tick: the page shows
     elapsed time client-side, so timestamp-only drift is not worth a commit.
-    Advisory like the board; True when a write happened."""
-    status = collect_status(root, target, now, contract, queue)
+    Advisory like the board; True when a write happened.
+
+    `records` shares the board's one snapshot; absent, it reads fresh."""
+    status = collect_status(root, target, now, contract, queue, records)
     try:
         existing_raw: str | None = github.get_file(target, STATUS_PATH, BOARD_BRANCH)
     except Exception as exc:
@@ -1247,7 +1283,11 @@ def _read_index(github: Any, target: str) -> dict[str, str] | None:
 
 
 def service_climb_board(
-    root: Path, github: Any, target: str, directions: dict[str, str] | None = None
+    root: Path,
+    github: Any,
+    target: str,
+    directions: dict[str, str] | None = None,
+    records: list[RunRecord] | None = None,
 ) -> int:
     """Publish the board for `target`. Returns how many files changed.
 
@@ -1255,8 +1295,10 @@ def service_climb_board(
     as ONE commit (`put_files`) — data, curves, and the views are atomic,
     so the page can never point at data that is not on the branch, and a
     board pass costs at most one commit of research-log history. A failed
-    batch changes nothing; the whole pass retries next tick."""
-    local = collect_rows(root, target)
+    batch changes nothing; the whole pass retries next tick.
+
+    `records` shares the board's one snapshot; absent, it reads fresh."""
+    local = collect_rows(root, target, records)
     # snapshot BEFORE any branch read: put_files refuses if the head moves
     # mid-pass, so a concurrent write is never buried under stale content.
     # "" = branch missing (nothing to protect); None = outage — writing

outerloop/followup.py

@@ -49,7 +49,6 @@ from outerloop.orchestrator import (
     steward_out_of_scope,
 )
 from outerloop.orchestrator import improved as orch_improved
-from outerloop.paths import CONFIG_DIR
 from outerloop.progress import (
     PROGRESS_PATHS,
     fmt_metric,
@@ -1970,7 +1969,7 @@ def main() -> int:
     import os
     import time
 
-    from outerloop.appauth import resolve_bot_auth
+    from outerloop.appauth import add_credential_args, resolve_bot_auth
     from outerloop.harness import DEFAULT_MAX_TURNS
     from outerloop.orchestrator import SubprocessEvaluator
 
@@ -2013,13 +2012,7 @@ def main() -> int:
         default=0,
         help="this job's Slurm walltime; arms the self-deadline (0 = off)",
     )
-    parser.add_argument("--pat-file", default=str(CONFIG_DIR / "bot_pat"))
-    parser.add_argument(
-        "--github-app-file",
-        default=os.environ.get("OUTERLOOP_GITHUB_APP_FILE", ""),
-        help="GitHub App config (JSON: app_id, installation_id, private_key); "
-        "when set, installation tokens replace the PAT",
-    )
+    add_credential_args(parser)
     parser.add_argument(
         "--key-file",
         default="",

outerloop/github.py

@@ -503,10 +503,20 @@ class GitHubClient:
         return True
 
     def disable_auto_merge(self, repo: str, number: int) -> bool:
-        """Disarm GitHub auto-merge (GraphQL). The follow-up lane calls this
-        before pushing new commits to an auto-mode PR: an armed PR would
-        merge the NEW head on green CI without a fresh gate/suite/panel
-        (terra #171). Returns False when nothing was armed or on error."""
+        """Ensure GitHub auto-merge will not fire on this PR, and report whether
+        that is confirmed. The follow-up lane calls this before pushing new
+        commits to an auto-mode PR: an armed PR would merge the NEW head on green
+        CI without a fresh gate/suite/panel (terra #171).
+
+        The property to confirm is "auto-merge is not armed". We always run the
+        disarm mutation — never skipping it on a prior read, which would let
+        another actor arm auto-merge between the read and the push. When nothing
+        is armed the mutation errors, and its text varies by the repo's "Allow
+        auto-merge" setting and the token type (App vs PAT), so we confirm by
+        RE-READING the PR's `auto_merge` state rather than matching a string: if
+        auto-merge is off afterward, the safety property holds and pushing is
+        safe. Returns False only when auto-merge is still armed and could not be
+        disarmed."""
         if self.dry_run:
             log.info("[dry-run] disarm auto-merge on %s#%d", repo, number)
             return True
@@ -519,12 +529,18 @@ class GitHubClient:
                 " disablePullRequestAutoMerge(input: {pullRequestId: $pr})"
                 " { pullRequest { number } } }"
             )
-            self._graphql(mutation, {"pr": str(node_id)})
-            return True
-        except GitHubError as exc:
-            if "not enabled" in str(exc).casefold():
-                # nothing was armed — the state we wanted; pushing is safe
+            try:
+                self._graphql(mutation, {"pr": str(node_id)})
                 return True
+            except GitHubError as exc:
+                # Disarming a PR with nothing armed errors; the message is not a
+                # reliable signal (merge:manual repo, "Allow auto-merge" off, or
+                # App-token phrasing), so confirm by state: off now = safe.
+                if not self.get_pull_request(repo, number).get("auto_merge"):
+                    return True
+                log.warning("auto-merge disarm on %s#%s failed: %s", repo, number, exc)
+                return False
+        except GitHubError as exc:
             log.warning("auto-merge disarm on %s#%s failed: %s", repo, number, exc)
             return False
 
@@ -768,15 +784,19 @@ class GitHubClient:
         )
         return int(data.get("number", 0)) if isinstance(data, dict) else 0
 
-    def update_issue(self, repo: str, number: int, body: str) -> None:
-        """Replace an issue's body (the rolling maintenance digest)."""
+    def update_issue(self, repo: str, number: int, body: str, *, title: str | None = None) -> None:
+        """Replace an issue's body (the rolling maintenance digest), and its
+        title when one is given (the digest carries the scan date there)."""
         if self.dry_run:
             log.info("[dry-run] update issue %s#%s (%d chars)", repo, number, len(body))
             return
+        payload: dict[str, str] = {"body": body}
+        if title is not None:
+            payload["title"] = title
         self._request(
             "PATCH",
             f"/repos/{urllib.parse.quote(repo)}/issues/{number}",
-            {"body": body},
+            payload,
         )
 
     def close_issue(self, repo: str, number: int) -> None:

outerloop/harness.py

@@ -460,6 +460,24 @@ def _int(value: Any, default: int = 0) -> int:
         return default
 
 
+def _kill_and_drain(process: subprocess.Popen[str]) -> str:
+    """Kill a timed-out session's whole process group, then drain its pipe within
+    a bound so `run()` always returns — a descendant that left the group (setsid)
+    can hold the pipe open past the kill. Returns whatever stdout drained (may be
+    empty). Shared by every backend's timeout path; keep the sequence in one place
+    so the safety-sensitive termination cannot drift between them."""
+    with contextlib.suppress(ProcessLookupError, PermissionError):
+        os.killpg(process.pid, signal.SIGKILL)
+    try:
+        stdout, _ = process.communicate(timeout=10)
+    except subprocess.TimeoutExpired:
+        process.kill()
+        stdout = ""
+        with contextlib.suppress(subprocess.TimeoutExpired):
+            stdout, _ = process.communicate(timeout=5)
+    return stdout or ""
+
+
 @dataclass
 class ClaudeCodeHarness:
     """Headless Claude Code (`claude -p`): the JSON output carries cost,
@@ -625,17 +643,7 @@ class ClaudeCodeHarness:
         try:
             stdout, stderr = process.communicate(input=brief_text, timeout=self.timeout_s)
         except subprocess.TimeoutExpired:
-            with contextlib.suppress(ProcessLookupError, PermissionError):
-                os.killpg(process.pid, signal.SIGKILL)
-            # Bounded drain: a descendant that left the process group (setsid)
-            # can hold the pipe open past the kill; run() must still return.
-            try:
-                stdout, _ = process.communicate(timeout=10)
-            except subprocess.TimeoutExpired:
-                process.kill()
-                stdout = ""
-                with contextlib.suppress(subprocess.TimeoutExpired):
-                    stdout, _ = process.communicate(timeout=5)
+            stdout = _kill_and_drain(process)
             path = _write_private(
                 workspace.parent, transcript_stem, ".json", redact(stdout or "", (self.api_key,))
             )
@@ -1077,15 +1085,7 @@ class CodexHarness:
         try:
             stdout, stderr = process.communicate(input=brief_text, timeout=self.timeout_s)
         except subprocess.TimeoutExpired:
-            with contextlib.suppress(ProcessLookupError, PermissionError):
-                os.killpg(process.pid, signal.SIGKILL)
-            try:
-                stdout, _ = process.communicate(timeout=10)
-            except subprocess.TimeoutExpired:
-                process.kill()
-                stdout = ""
-                with contextlib.suppress(subprocess.TimeoutExpired):
-                    stdout, _ = process.communicate(timeout=5)
+            stdout = _kill_and_drain(process)
             path = _write_private(
                 workspace.parent, transcript_stem, ".jsonl", redact(stdout or "", (self.api_key,))
             )
@@ -1402,15 +1402,7 @@ class HermesHarness:
         try:
             stdout, _ = process.communicate(timeout=self.timeout_s)
         except subprocess.TimeoutExpired:
-            with contextlib.suppress(ProcessLookupError, PermissionError):
-                os.killpg(process.pid, signal.SIGKILL)
-            try:
-                stdout, _ = process.communicate(timeout=10)
-            except subprocess.TimeoutExpired:
-                process.kill()
-                stdout = ""
-                with contextlib.suppress(subprocess.TimeoutExpired):
-                    stdout, _ = process.communicate(timeout=5)
+            stdout = _kill_and_drain(process)
             path = _write_private(
                 workspace.parent, transcript_stem, ".log", redact(stdout or "", (self.api_key,))
             )

outerloop/init.py

@@ -367,6 +367,26 @@ def _owner_type(owner: str) -> str:
         return ""
 
 
+def _app_owner_mismatch_note(conversion: dict[str, Any], expected_owner: str, target: str) -> str:
+    """When the App landed under a different account than intended — GitHub's
+    fallback when someone who is not an org owner tries to create an org-owned
+    App — explain the path that still works, since a personal App does not
+    install on an org repo by default. Empty when the App landed as intended."""
+    actual = str((conversion.get("owner") or {}).get("login", "")).strip()
+    if not actual or actual.casefold() == expected_owner.casefold():
+        return ""
+    org = target.split("/")[0]
+    return (
+        f"  note: the App was created under '{actual}', not '{expected_owner}'. Creating an\n"
+        f"  App owned by an organization needs org-owner rights, so GitHub made a personal\n"
+        f"  one — which will not install on {target} by default. To use it there anyway:\n"
+        f"  make the App public (its Settings > 'Make public'), request its installation on\n"
+        f"  {target}, and have an owner of {org} approve it; then rerun\n"
+        f"  `outerloop init --force --github-app`. For lab ownership, you can later transfer\n"
+        f"  the App to {org} from its Advanced settings — the key keeps working."
+    )
+
+
 def _app_failure(answers: InitAnswers, slug: str, problem: str) -> int:
     """The App cannot write the target: say so, keep the credentials, and point
     at the fix and the re-check. Never `start` — the check just failed."""
@@ -376,7 +396,9 @@ def _app_failure(answers: InitAnswers, slug: str, problem: str) -> int:
         f"  https://github.com/apps/{slug}/installations/new (or the App's page under\n"
         "  Settings > Installations > Configure) install it on that repository and accept\n"
         "  contents, issues and pull-request write access, then run\n"
-        "  `outerloop init --force --github-app` to re-check with these credentials.",
+        "  `outerloop init --force --github-app` to re-check with these credentials.\n"
+        "  If the App is under your personal account and the repository belongs to an\n"
+        "  organization, make the App public first and have an org owner approve the install.",
         file=sys.stderr,
     )
     return 1
@@ -449,6 +471,9 @@ def _github_app_setup(
     pem_path, app_json = appmanifest.save_app_creds(conversion, CONFIG_DIR)
     repo = answers.target.split("/", 1)[-1]
     print(f"  created App '{conversion['slug']}'; credentials in {app_json} and {pem_path} (0600)")
+    mismatch = _app_owner_mismatch_note(conversion, owner, answers.target)
+    if mismatch:
+        print(mismatch, file=sys.stderr)
     print()
     print(f"Step 2 of 3: install the App on {answers.target}.")
     print(f"  Open {appmanifest.install_url(conversion)}")