outerloop-science 0.2.0rc2__tar.gz → 0.2.0rc4__tar.gz

{outerloop_science-0.2.0rc2 → outerloop_science-0.2.0rc4}/CHANGELOG.md

@@ -20,12 +20,29 @@ launch arrays in parallel. The board shows running GPU jobs. `OUTERLOOP_LOCAL_GP
 overrides GPU detection; `0` disables allocation. Submissions still wait for all
 tasks to finish.
 
+### Added
+
+- `outerloop init` installs a missing author CLI and records its path; `--no-install-harness` opts out. Claude has a pinned, SHA256-verified installer.
+
+- `OUTERLOOP_TICK_HOST=login` (or `--tick-host login`) runs a niced foreground tick loop against Slurm, with one tick lease per state root.
+- `OUTERLOOP_QOS` sets the QOS for every submitted Slurm job.
+- `OUTERLOOP_APPTAINER_BIN` selects the container executable on compute nodes.
+- `<root>/HOLD_LAUNCHES` holds fresh kernel launches while existing runs, wake delivery, and the tick chain continue; remove the file to resume.
+
 ### Removed
 
 - The pre-rename names are gone. The `AUTORESEARCH_*` environment names are no longer read by the package, the `.env` reader, the chain or the deploy step. `~/.config/autoresearch/`, `.autoresearch.yaml`, the `.autoresearch` channel directory, the `~/.autoresearch` local root default and `~/autoresearch-images` are no longer looked for. The `autoresearch-resident` and `autoresearch-tick` job names are no longer recognized. The `harness_key` file, the `*_HARNESS_KEY_FILE` setting and the `climb_job_id` record field are gone. Before upgrading, rename the `.env` keys, the config directory and the image directory. Cancel a resident or chain still queued under an old job name (`scancel --name autoresearch-resident`, or `scancel --name autoresearch-tick`) before running `outerloop start`: the guard against two loops on one root knows only the current name. Old `autoresearch:` comment markers are still recognized.
 
 ### Fixed
 
+- The measurer waits up to 90 seconds for the files of a finished evaluation job. A filesystem delay no longer ends a measured improvement as a negative result.
+- `outerloop start` refuses to run when the configured author's CLI is missing: it checks the recorded path, else PATH, else `~/.local/bin`, and names the install command and `outerloop init --force`.
+
+- Ending line snapshots push once, with the kernel's GitHub auth. Without auth nothing is pushed and the log says so. A refused push is retried only when the remote line moved.
+- PRs under `merge: auto` say why self-merge is waiting, and the publish records and logs the bless decision.
+
+- A timed-out local job could leave its GPUs reserved until the next submit; they are now released once its process group is gone.
+
 - The tick log says why a blessed PR is not merged yet (a message waits for the author, the run sleeps on jobs, the base moved, and so on), one line per sweep.
 - Runs retain their hypothesis through review. The status strip and sibling view carry it with the PR link, and the brief asks authors to check the view, refreshed at every wake, before choosing a direction and before submitting.
 

{outerloop_science-0.2.0rc2 → outerloop_science-0.2.0rc4}/CITATION.cff

@@ -13,5 +13,5 @@ authors:
 repository-code: "https://github.com/outerloop-science/outerloop"
 url: "https://outerloop.science"
 license: Apache-2.0
-version: 0.2.0rc2
-date-released: "2026-09-14"
+version: 0.2.0rc4
+date-released: "2026-09-15"

{outerloop_science-0.2.0rc2 → outerloop_science-0.2.0rc4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: outerloop-science
-Version: 0.2.0rc2
+Version: 0.2.0rc4
 Summary: Autonomous research agents that improve the benchmark you point them at, one verified pull request at a time
 Project-URL: Homepage, https://outerloop.science
 Project-URL: Repository, https://github.com/outerloop-science/outerloop

{outerloop_science-0.2.0rc2 → outerloop_science-0.2.0rc4}/docs/install.md

@@ -295,6 +295,35 @@ says so — rerun `outerloop init --force` online, or set the login in the
 
 ### 2c. Run the loop
 
+When the configured author's CLI is missing, `outerloop init` installs it from
+a pinned release and records its path. An existing executable is kept.
+Use `--no-install-harness` to skip this step. To install by hand from the
+outerloop checkout, run `bash scripts/install_claude.sh [target_path]` or
+`bash scripts/install_codex.sh [target_path]`, then rerun `outerloop init --force`.
+The default target is `$OUTERLOOP_<BACKEND>_BIN`, else `~/.local/bin/<backend>`.
+Claude 2.1.272 is pinned for Linux x64 (glibc/musl) and ARM64; other platforms
+are refused. Installation needs `curl`, `sha256sum`, and a writable target
+directory. Hermes remains a review backend, provisioned with
+`bash scripts/install_hermes.sh [target_dir]`.
+
+**Host prerequisites for model backends.** From the outerloop checkout:
+
+- Claude, as author or reviewer: the pinned Claude Code CLI; install with
+  `bash scripts/install_claude.sh`.
+- Codex, as author or reviewer: the pinned Codex CLI; install with
+  `bash scripts/install_codex.sh`.
+- Hermes, as reviewer only (not an author backend): the pinned hermes-agent
+  source checkout, run through `uv`; install with `bash scripts/install_hermes.sh`.
+
+`init` records the absolute Claude
+or Codex path found on PATH (or in `~/.local/bin`) as `OUTERLOOP_<BACKEND>_BIN`.
+`start` checks only the configured author's CLI: the recorded path takes
+precedence, otherwise it searches PATH, then `~/.local/bin`. A missing or non-executable CLI stops
+launch before any job runs. After installing or moving it, run
+`outerloop init --force` to record its path again. `--dry-run` prints the launch
+command without checking the CLI. For Hermes, set `REVIEW_HERMES_REPO` to the installed checkout (the installer
+defaults to `~/hermes-agent`); contained review sessions bind its source read-only.
+
 The quickest path is the guided setup:
 
 ```bash
@@ -321,7 +350,7 @@ that can reach GitHub and your LLM provider works.
   you start it again. On a headless machine start it under `nohup` or in a
   tmux window, or as a user service.
 
-**Updates.** A Slurm deployment runs from a checkout, and
+**Updates.** A resident Slurm deployment runs from a checkout, and
 `OUTERLOOP_AUTO_UPDATE` in `.env` says whether the deploy step moves it. `off`,
 the default, leaves the checkout alone: you upgrade when you choose, and the
 loop keeps running the code you validated. `release` moves it to the newest
@@ -334,6 +363,44 @@ the installed package, which has no such policy: run `outerloop upgrade` to move
 it to the newest release (add `--pre` to track pre-releases), then start it
 again. That is `pip install --upgrade outerloop-science` under one verb.
 
+#### Login-node loop
+
+Use this when no Slurm partition can start a resident tick within your cadence
+and the site permits a long-lived process on the login node. In
+`~/.config/outerloop/.env`, set:
+
+```bash
+OUTERLOOP_TICK_HOST=login
+OUTERLOOP_QOS=priority
+OUTERLOOP_APPTAINER_BIN=/cm/local/apps/apptainer/current/bin/apptainer
+```
+
+Run `outerloop start` from your checkout with the usual shared `OUTERLOOP_ROOT`.
+`--tick-host login` overrides the environment, which overrides `.env`.
+`resident` is the default on Slurm; local compute still runs locally.
+The login loop requires `sbatch` on PATH, runs in the foreground at nice +10,
+and submits compute to Slurm. QOS applies to all submitted jobs; the Apptainer
+path is used on compute nodes. The tick only checks the image file exists and
+does not run Apptainer on the login node. Empty QOS uses Slurm's default;
+an empty binary setting uses `apptainer`.
+
+Only one loop may own a state root. Every foreground loop, local or login,
+holds the root's `TICK` lease (holder `host:pid`, heartbeat and the holder's
+cadence written each tick); a file lock refuses a second loop while the owner
+runs. `outerloop start` refuses any loop while the lease is held, and a login
+loop while a resident chain is queued or running; a resident submission that
+finds the lease taken meanwhile withdraws its job, and a login loop that
+finds a resident queued after taking the lease stops. After a crash the next
+start on the same host takes the lease at once, and a start from another
+host once the heartbeat is three of the holder's cadences old (file locks may
+not reach across nodes); a loop whose record was overwritten from another
+node stops at its next heartbeat. Ctrl-C or SIGTERM releases the lease. Use
+tmux or a user service if the process should survive your terminal.
+
+The login loop does **not auto-update**, even with `OUTERLOOP_AUTO_UPDATE=main`.
+To restart or upgrade: stop the process, run `git pull`, run `uv sync`, then
+run `outerloop start` again. Settings from `.env` are exported only at launch.
+
 ### Upgrading
 
 1. Run `outerloop upgrade` (add `--pre` for pre-releases).
@@ -397,13 +464,20 @@ lesser of 10 minutes and half the cadence), and `OUTERLOOP_MAX_JOB_MINUTES` caps
 the walltime the tick requests for the climb and author-sleep wake jobs it sizes
 (clamped under a code ceiling).
 
-**Two operator switches.** `touch <root>/PAUSE` pauses the loop; `touch
-<root>/DISARM_WAKE` stops parked runs from being woken, by the sweep and by a
-wake job a park already queued, until the file is removed. Both are read at
-every tick and by every wake, no restart: the sentinel is the switch.
-(`OUTERLOOP_DISPATCH_WAKE=0` in the environment that starts the loop or the
-chain does the same; it is not read from `.env`.) Wakes are on by default: a
-loop that cannot wake strands every parked run without a word.
+**Three operator switches.** `touch <root>/PAUSE` stops tick work except the
+heartbeat; jobs already running continue. The resident chain drains on it (it
+cancels its successor and exits), so after `rm <root>/PAUSE` run `outerloop
+start` there; the per-tick chain and the local loop resume on their own at the
+next tick.
+`touch <root>/DISARM_WAKE` stops wake delivery by the sweep and by queued wake
+jobs until `rm <root>/DISARM_WAKE`, while fresh launches, ending records, and
+the chain keep running (the starting environment's `OUTERLOOP_DISPATCH_WAKE=0`
+also disarms wakes; it is not read from `.env`).
+`touch <root>/HOLD_LAUNCHES` stops fresh intake, self-initiated, and steward runs
+until `rm <root>/HOLD_LAUNCHES`, with no chain restart, while the sweep, wake and
+message delivery, GitHub polling, self-merge sweep, board, and ending records
+continue; existing runs keep spending, including their panels, author sessions,
+and the authors' own `launch` submissions.
 
 **Local mode without an image.** On a machine with no Apptainer image,
 `OUTERLOOP_COMPUTE=local` still runs. Sessions run under the harness's own

{outerloop_science-0.2.0rc2 → outerloop_science-0.2.0rc4}/pyproject.toml

@@ -59,6 +59,11 @@ path = "src/outerloop/__init__.py"
 [tool.hatch.build.targets.wheel]
 packages = ["src/outerloop"]
 
+[tool.hatch.build.targets.wheel.force-include]
+"scripts/install_claude.sh" = "outerloop/_installers/install_claude.sh"
+"scripts/install_codex.sh" = "outerloop/_installers/install_codex.sh"
+"scripts/install_hermes.sh" = "outerloop/_installers/install_hermes.sh"
+
 [tool.ruff]
 line-length = 100
 target-version = "py312"

{outerloop_science-0.2.0rc2 → outerloop_science-0.2.0rc4}/scripts/README.md

@@ -12,4 +12,4 @@ runs the local loop elsewhere, reading placement from `~/.config/outerloop/.env`
 | `tick_resident.sh` | The resident loop: deploy → one tick under a timeout → sleep to the slot, one `afterany:self` successor, pause exits clean, shim changes resubmit the successor. |
 | `requeue_moved_successors.sh` | Cancel pending same-name jobs that are no longer on the requested partition. The tick chain runs this before adding successors. |
 | `sweep_git_locks.sh` | Remove stale `.git/*.lock` files from a checkout (older than N minutes, no live git process); the chain runs it before each deploy. |
-| `install_codex.sh`, `install_hermes.sh` | Pin and install the non-claude author/judge backends on the tick host. |
+| `install_claude.sh`, `install_codex.sh`, `install_hermes.sh` | Pin and install author/judge backends on the host. |

outerloop_science-0.2.0rc4/scripts/install_claude.sh

@@ -0,0 +1,82 @@
+#!/bin/bash
+# Idempotent install of the harness-verified claude author binary.
+#
+# claude is a HOST prerequisite for the claude author backend (like uv, apptainer,
+# and the .sif image) — deliberately NOT baked into the image, so it updates by
+# swapping one host binary. Safe to run repeatedly: the fast path is a local
+# `claude --version`, so it only touches the network on a version mismatch or a
+# missing binary. Run at host setup, or best-effort from the tick chain.
+#
+# Usage: install_claude.sh [target_path]
+#   target_path  where to place the binary
+#                (default: $OUTERLOOP_CLAUDE_BIN, else ~/.local/bin/claude)
+set -euo pipefail
+
+# Pinned release and per-platform SHA256. To bump WANT, hash the new binaries
+# and update the pins together; downloaded bytes are verified before execution.
+WANT="2.1.272"
+TARGET="${1:-${OUTERLOOP_CLAUDE_BIN:-$HOME/.local/bin/claude}}"
+
+have="$("$TARGET" --version 2>/dev/null | grep -oE '[0-9]+\.[0-9]+\.[0-9]+' | head -1 || true)"
+if [ "$have" = "$WANT" ]; then
+    echo "install_claude: claude $WANT already at $TARGET"
+    exit 0
+fi
+
+platform="$(uname -s)-$(uname -m)"
+case "$platform" in
+    Linux-x86_64)
+        platform="linux-x64"
+        WANT_SHA256="d81396a668eb76fbddb49a2a5841f1b5d7af96b4c1f6500ced92f2c988f5bcd4"
+        if compgen -G '/lib/libc.musl-*' > /dev/null; then
+            platform="linux-x64-musl"
+            WANT_SHA256="e30bb3ac07c4f1c3f63b47312e9a73ba6875256b7768c4cdb784d2b179417489"
+        fi
+        ;;
+    Linux-aarch64|Linux-arm64)
+        platform="linux-arm64"
+        WANT_SHA256="214a90efdd16ee0ea81132ffecced588dba394d178cc494f285ba04b5288c8de"
+        ;;
+    *)
+        echo "install_claude: unsupported platform $platform (no sha256 pin)" >&2
+        exit 1
+        ;;
+esac
+for tool in curl sha256sum; do
+    command -v "$tool" >/dev/null || {
+        echo "install_claude: required tool $tool is missing" >&2
+        exit 1
+    }
+done
+echo "install_claude: installing claude $WANT -> $TARGET (have '${have:-none}')"
+url="https://downloads.claude.ai/claude-code-releases/$WANT/$platform/claude"
+tmp="$(mktemp -d)"
+staged="$TARGET.tmp.$$"
+# clean BOTH the work dir and any staged binary on every exit, so a failed
+# download/mv never leaves a stale temp next to the target
+trap 'rm -rf "$tmp" "$staged"' EXIT
+# bounded so a stalled download can't eat the tick's own walltime: this runs
+# INSIDE the ~15-min tick job, so cap the fetch well under it (single attempt —
+# a transient failure is retried by the next tick, since the install is idempotent)
+curl -fsSL --connect-timeout 15 --max-time 120 --retry 0 "$url" -o "$tmp/claude"
+# INTEGRITY GATE: verify the binary against the pin BEFORE installing or
+# executing anything from it.
+got_sha=$(sha256sum "$tmp/claude" | cut -d' ' -f1)
+if [ "$got_sha" != "$WANT_SHA256" ]; then
+    echo "install_claude: sha256 mismatch (got $got_sha, want $WANT_SHA256) — refusing" >&2
+    exit 1
+fi
+# the target dir must exist BEFORE staging into it (the staged temp lives beside
+# TARGET so the final mv is atomic on the same filesystem)
+mkdir -p "$(dirname "$TARGET")"
+install -m 0755 "$tmp/claude" "$staged"
+# secondary sanity (integrity is already the sha256 gate above, so this runs
+# VERIFIED bytes): the staged binary reports the pinned version before the mv
+got="$("$staged" --version 2>/dev/null | grep -oE '[0-9]+\.[0-9]+\.[0-9]+' | head -1 || true)"
+if [ "$got" != "$WANT" ]; then
+    echo "install_claude: downloaded claude reports '$got', wanted '$WANT' — not installing" >&2
+    exit 1
+fi
+# atomic replace on the same filesystem: never leave a half-written binary
+mv -f "$staged" "$TARGET"
+echo "install_claude: installed claude $got at $TARGET"

{outerloop_science-0.2.0rc2 → outerloop_science-0.2.0rc4}/scripts/tick_chain.sbatch

@@ -52,6 +52,8 @@ done
 # partition may be a comma-list like "a,b"), pass them through.
 acct_arg=""
 [ -n "${OUTERLOOP_ACCOUNT:-}" ] && acct_arg="--account=${OUTERLOOP_ACCOUNT}"
+qos_arg=""
+[ -n "${OUTERLOOP_QOS:-}" ] && qos_arg="--qos=${OUTERLOOP_QOS}"
 part_arg=""
 [ -n "${OUTERLOOP_PARTITION:-}" ] && part_arg="--partition=${OUTERLOOP_PARTITION}"
 
@@ -104,7 +106,7 @@ while [ "$i" -le "$need" ]; do
             || date -r "$begin_epoch" +%Y-%m-%dT%H:%M:%S)
     for attempt in 1 2 3; do
         if sbatch --dependency=singleton --begin="$begin" \
-                  ${acct_arg:+"$acct_arg"} ${part_arg:+"$part_arg"} \
+                  ${acct_arg:+"$acct_arg"} ${part_arg:+"$part_arg"} ${qos_arg:+"$qos_arg"} \
                   "${OUTERLOOP_HOME:-}/scripts/tick_chain.sbatch"; then
             break
         fi

{outerloop_science-0.2.0rc2 → outerloop_science-0.2.0rc4}/scripts/tick_deploy.sh

@@ -195,6 +195,7 @@ if [ -n "$ENV_TRUSTED" ]; then
                   OUTERLOOP_TARGET \
                   OUTERLOOP_GITHUB_APP_FILE OUTERLOOP_BOT_LOGIN OUTERLOOP_BOT_ALIASES \
                   OUTERLOOP_GPU_PARTITION OUTERLOOP_GPU_ACCOUNT \
+                  OUTERLOOP_QOS OUTERLOOP_APPTAINER_BIN \
                   OUTERLOOP_IMAGE \
                   OUTERLOOP_PANEL OUTERLOOP_PANEL_KEY_FILE \
                   OUTERLOOP_PANEL_CODEX_KEY_FILE \
@@ -212,6 +213,28 @@ if [ -n "$ENV_TRUSTED" ]; then
     done
 fi
 
+# The configured author's CLI is a host prerequisite (pinned installers under
+# scripts/); provision it when missing. Best-effort: a failure here must never
+# break the chain — start's preflight and the climb report a missing CLI.
+case "${OUTERLOOP_AUTHOR_BACKEND:-claude}" in
+    claude)
+        # a recorded path is the one the jobs will use, so it alone decides;
+        # otherwise an absolute PATH hit or the default install location counts
+        # (jobs ignore relative PATH entries, so the check does too)
+        if [ -n "${OUTERLOOP_CLAUDE_BIN:-}" ]; then
+            target="$OUTERLOOP_CLAUDE_BIN"; found=""
+            [ -x "$target" ] && found="$target"
+        else
+            target="$HOME/.local/bin/claude"
+            found="$(command -v claude 2>/dev/null || true)"
+            case "$found" in /*) ;; *) found="" ;; esac
+            [ -z "$found" ] && [ -x "$target" ] && found="$target"
+        fi
+        if [ -z "$found" ]; then
+            bash "$OUTERLOOP_HOME/scripts/install_claude.sh" "$target" || echo "deploy: claude install failed"
+        fi
+        ;;
+esac
 # The codex author binary is a host prerequisite; install it (idempotent, fast
 # path is a local version check) when ANY codex role is deployed — the fleet
 # author, or a codex panel lens (a claude-author/codex-panel rollout still

{outerloop_science-0.2.0rc2 → outerloop_science-0.2.0rc4}/scripts/tick_resident.sh

@@ -45,13 +45,15 @@ submit_successor() {
     # them only when set.
     local acct_arg=""
     [ -n "${OUTERLOOP_ACCOUNT:-}" ] && acct_arg="--account=${OUTERLOOP_ACCOUNT}"
+    local qos_arg=""
+    [ -n "${OUTERLOOP_QOS:-}" ] && qos_arg="--qos=${OUTERLOOP_QOS}"
     local part_arg=""
     [ -n "${OUTERLOOP_PARTITION:-}" ] && part_arg="--partition=${OUTERLOOP_PARTITION}"
     local out="" attempt
     for attempt in 1 2 3; do
         if out=$(sbatch --parsable --dependency="$dep" --time="$resident_minutes" \
                     --job-name="$RESIDENT_JOB_NAME" --export=ALL \
-                    ${acct_arg:+"$acct_arg"} ${part_arg:+"$part_arg"} \
+                    ${acct_arg:+"$acct_arg"} ${part_arg:+"$part_arg"} ${qos_arg:+"$qos_arg"} \
                     "$shim" 2>/dev/null); then
             printf '%s' "${out%%;*}"
             return 0

{outerloop_science-0.2.0rc2 → outerloop_science-0.2.0rc4}/src/outerloop/__init__.py

@@ -1,3 +1,3 @@
 """Outerloop: autonomous research agents that improve a benchmark on your own code."""
 
-__version__ = "0.2.0rc2"
+__version__ = "0.2.0rc4"