phase-loop-runtime 0.7.20__tar.gz → 0.7.22__tar.gz

{phase_loop_runtime-0.7.20/src/phase_loop_runtime.egg-info → phase_loop_runtime-0.7.22}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: phase-loop-runtime
-Version: 0.7.20
+Version: 0.7.22
 Summary: Harness-neutral phase-loop orchestration runtime and CLI
 Author-email: ViperJuice <viperjuice@users.noreply.github.com>
 License-Expression: Apache-2.0
@@ -49,7 +49,7 @@ To install just this runtime package directly:
 
 ```sh
 pip install phase-loop-runtime              # latest compatible release
-pip install phase-loop-runtime==0.7.20      # …or pin an exact version
+pip install phase-loop-runtime==0.7.22      # …or pin an exact version
 ```
 
 To pin a specific tag from source instead, substitute a tag from
@@ -288,6 +288,12 @@ closeout, the persisted `terminal-summary.json` reflects the runner's blocking v
 (the child's self-reported `complete`/`passed` is not overlaid back), preventing a
 stale "complete" summary from reconcile-skipping the work on the next run.
 
+The `phase-loop-closeout-audit --repo .` command grades **ignored** paths by producer. It
+accepts harness handoffs that carry the handoff contract, and a project's declared build
+outputs backed by a recorded producer run. Declare those outputs in a committed
+`.phase-loop-generated-outputs.json`; anything else still blocks. See
+`docs/phase-loop/closeout-generated-outputs.md` (agent-harness#1139).
+
 ## Conformance library (one library, two roles)
 
 `phase_loop_runtime.conformance` is the named, stable, importable surface for the

{phase_loop_runtime-0.7.20 → phase_loop_runtime-0.7.22}/README.md

@@ -19,7 +19,7 @@ To install just this runtime package directly:
 
 ```sh
 pip install phase-loop-runtime              # latest compatible release
-pip install phase-loop-runtime==0.7.20      # …or pin an exact version
+pip install phase-loop-runtime==0.7.22      # …or pin an exact version
 ```
 
 To pin a specific tag from source instead, substitute a tag from
@@ -258,6 +258,12 @@ closeout, the persisted `terminal-summary.json` reflects the runner's blocking v
 (the child's self-reported `complete`/`passed` is not overlaid back), preventing a
 stale "complete" summary from reconcile-skipping the work on the next run.
 
+The `phase-loop-closeout-audit --repo .` command grades **ignored** paths by producer. It
+accepts harness handoffs that carry the handoff contract, and a project's declared build
+outputs backed by a recorded producer run. Declare those outputs in a committed
+`.phase-loop-generated-outputs.json`; anything else still blocks. See
+`docs/phase-loop/closeout-generated-outputs.md` (agent-harness#1139).
+
 ## Conformance library (one library, two roles)
 
 `phase_loop_runtime.conformance` is the named, stable, importable surface for the

{phase_loop_runtime-0.7.20 → phase_loop_runtime-0.7.22}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "phase-loop-runtime"  # PyPI dist name; NOT "agent-harness" (an unrelated third-party PyPI project)
-version = "0.7.20"
+version = "0.7.22"
 description = "Harness-neutral phase-loop orchestration runtime and CLI"
 readme = "README.md"
 requires-python = ">=3.10"

{phase_loop_runtime-0.7.20 → phase_loop_runtime-0.7.22}/src/phase_loop_runtime/__init__.py

@@ -18,4 +18,4 @@ __all__ = [
     "state_ops",
 ]
 
-__version__ = "0.7.20"
+__version__ = "0.7.22"

{phase_loop_runtime-0.7.20 → phase_loop_runtime-0.7.22}/src/phase_loop_runtime/advisor_board/CONTRACTS.md

@@ -551,7 +551,7 @@ never through — the review operation `public_board_review.v1`. Frozen falsifie
 - **Rung routes** (`president_adapter.build_president_invoke(..., monitoring_policy=)`).
   Unseated rung → typed `president_unavailable` (descend). `sol` / `grok` → the brokered
   `_exec_leg` in a throwaway directory, whose only launch is `launch_provider`. `gemini` →
-  the broker's acknowledged agy stream with the PRESIDENT's own final instruction (a ruling,
+  the broker's agy stream with the PRESIDENT's own final instruction (a ruling,
   not a review verdict), launched through `_run_leg_with_liveness` → `launch_provider` and
   decoded by `_broker_gemini_stream_result`; with the agy subscription credential it runs in
   the broker's agy profile, without one in an empty private HOME (no credential of any kind),
@@ -672,7 +672,60 @@ The TUI timestamp is refreshed by novel output lines, review-file growth and
 transcript growth — a startup banner is novel output and refreshes it; only
 repeated cosmetic repaints do not, once the existing novelty detector has seen
 their text. The CPU-tick heartbeat never refreshes it.
-Neither state is a health attestation or permission to terminate. Frozen
+Neither state is a health attestation or permission to terminate.
+The record also carries a progress notice (agent-harness#1176). When no genuine
+progress has been seen for `stall_notice_s` (default 3600 s; override with
+`PHASE_LOOP_REVIEW_STALL_NOTICE_S`), and no progress at all counts from seat
+start, `progress_notice` is `seat_progress_stalled`, `progress_notice_count`
+counts crossings, and one operator warning with only that code and numbers is
+logged. Resumed progress and a terminal observation clear the active notice;
+`last_progress_notice` and the count stay as history. The notice never ends the
+seat. The record reaches the board: `advisor-board --json` legs carry it as
+`review_monitoring`, the text summary prints a `[seat_progress_stalled]` line
+per affected seat on stderr, each streamed per-leg verdict file carries it, and
+the governed record adds a `seat_progress_stalled` warn finding per seat.
+The exact brokered Claude transcript is classified once per change, by
+`_claude_transcript_outcome`, into one outcome; the answer parser and the
+give-up detector are views of it, so they cannot disagree:
+- `answer`: the route's answer parser (the agent-harness#1002/#1077/#1017
+  rules; the president route fails closed on any error record in the turn)
+  returns text. An accepted answer always wins, whatever follows it. An
+  `isApiErrorMessage` record is never answer text. Every record of the answer
+  must be a member of the current request (defined below; a sidechain sighting
+  counts), so a record that is not evidence for the request never answers it
+  either. If the text is not an
+  accepted verdict, the leg is handed it back as
+  `claude_tui_broker_terminal_nonconforming` instead of waiting.
+- `gave_up`: no answer, and the last live record after the current request is
+  an `isApiErrorMessage` give-up. The leg ends at once as DEGRADED with
+  `claude_seat_output_budget_exhausted` (`error: max_output_tokens`),
+  `claude_seat_usage_limited` (`error: rate_limit` with
+  `quotaLimits.status: rejected`, a subscription cap, followed by
+  `: usage_limit (resets HH:MM, Mon D YYYY)` rendered in UTC from
+  `quotaLimits.resetsAt` when present), `claude_seat_rate_limited` (any other
+  `rate_limit`) or `claude_seat_provider_api_error`.
+- `rejected`: no answer, and the turn ended in a completed (`end_turn` /
+  `stop_sequence`) answer carrying a text block that the route's parser refuses.
+  The leg ends at once as DEGRADED with `claude_seat_transcript_rejected`.
+- `pending`: anything else (an open or capped message, the CLI's resume prompt,
+  a newer request, a writer mid-append). A `max_tokens` stop is never terminal.
+The "last live record" is decided in APPEND order among the current request's
+records, chosen by membership, not position. The current request is the last
+user record that is not `isMeta`, carries no tool_result and is not a replay (its
+uuid and content recurring, whatever its completion metadata, as in the answer
+parser). A record is evidence for it only when it is a new version first seen in
+it: its uuid was first seen after the request (a record of an earlier request is
+never evidence, wherever it is appended, except an `isApiErrorMessage` record
+appended in the current request, which always is); it is not an exact replay of a
+version already seen (same uuid, content, `stop_reason` presence and value, and
+error flag) nor a stale open copy of a stopped record whose content is unchanged;
+and it is not a sidechain record (`isSidechain`), which the answer parser drops
+too. An open record first seen in the current request, even a changed version
+after its own stop, is still streaming and reads `pending`. An `isApiErrorMessage`
+record is terminal event evidence and is never collapsed into an earlier
+version of its uuid. Replays and rewritten metadata are not progress. `provider_terminal_state` records the code that
+ended the leg. `isApiErrorMessage` matches JSON `true` or the string `"true"`,
+on the record or the message. Frozen
 broker request/response keys, status literals, and observer envelopes are unchanged.
 
 When staging requires egress isolation, acquisition follows staged-tree and operation
@@ -687,8 +740,10 @@ review text and the exception in detail; sandbox facts describe actual enforceme
 
 The Linux x64 subscription `agy` entry image must match one member of the closed
 set `gemini_heartbeat.QUALIFIED_IMAGES`: 1.2.11 SHA256
-`ec7cf797ecb0e1d91ddf3b6d9d6c1d616bb89f78a5b0e43536b72a7fce695f56` or 1.2.12 SHA256
-`ce6fdd9e7621ee9ac6eedaa337731ca1f235e412ff57cf9eabcd2aa23b3576ca`. Each member
+`ec7cf797ecb0e1d91ddf3b6d9d6c1d616bb89f78a5b0e43536b72a7fce695f56`, 1.2.12 SHA256
+`ce6fdd9e7621ee9ac6eedaa337731ca1f235e412ff57cf9eabcd2aa23b3576ca`, 1.2.14 SHA256
+`0d0d3eba22daf29504dd290151c7ed9a4d33b0c6aa0acfc5da27bc3b01d2f029` or 1.2.15 SHA256
+`5f9c16b286895f8f7fdecd423883ca256a85077b8acf9a6bc1111761d34df164`. Each member
 carries its measured help digest and has its own qualification record; the
 evidence catalog and the runtime set must name exactly the same members.
 The running Python/kernel must support sealed memfds, pidfds and pidfd signaling;
@@ -710,7 +765,8 @@ HOME fallback truthfully if HOME is absent. Legitimate refresh writes survive.
 The real qualification driver requires an explicit HOME and checks target
 presence before and after, without reading its contents.
 
-The broker transports same-session acknowledged input over stdin, with no tree
+The broker transports same-session input over stdin (one event when the sealed prompt fits
+one chunk, acknowledged chunks otherwise; agent-harness#1175), with no tree
 attachment, `--add-dir`, permission bypass, retry or native thinking timer. Empty,
 rejected and nonzero-exit streams remain non-votes with fixed diagnostics;
 provider stdout/stderr and arbitrary exception strings are not substituted for
@@ -735,3 +791,174 @@ root, rejecting failures, omissions and terminal/admission mismatches. Preserve
 failed series; diagnose a changed candidate before another attempt. Validation
 uses that host's measured helper images. These receipts do not replace the
 historical bounded-success evidence verifier.
+
+The driver lives in the package, `phase_loop_runtime.agy_qualification`; the script
+is a shim over it, so an installed runtime can run it too (agent-harness#1076).
+
+### First-use self-qualification (agent-harness#1076)
+
+A non-release `agy` image is admitted only by verifying it, never by trusting it.
+
+- **Admission classes.** Every Gemini heartbeat leg carries exactly one class in
+  its profile evidence (`provider_admission_class`): `release_qualified` (digest in
+  `QUALIFIED_IMAGES`), `locally_qualified` (a verified local record), or
+  `qualification_candidate` (only inside a qualification run; never counted, never
+  persisted). The evidence's `provider_image_sha256` is the admitted image's own digest.
+- **VerifiedImage.** `PATH` is resolved once (a versioned-install symlink to its final
+  target), the target is opened once (`O_NOFOLLOW`, regular file, size cap) and read
+  into memory; that buffer is hashed and fills a sealed memfd, which is re-hashed.
+  Help measurement, the three live operations, board legs and the president execute
+  that memfd (an independent, re-hashed read of it per profile) and never open the path
+  again.
+- **Admission order.** (1) A release-qualified digest is admitted before any config,
+  store or network access. (2) If the user config sets `[agy] self_qualification = false`
+  (the repository config cannot), today's `gemini_heartbeat_capability_unavailable`
+  refusal is returned and nothing else is read. (3) A `failed` entry refuses
+  (`gemini_heartbeat_self_qualification_failed`) with no execution. (4) Help is measured
+  from the memfd only after a `provenance` entry verifies against the live key; the
+  `qualified` entry is then verified against the full live key, including that help
+  digest. (5) Otherwise the image is absent: legs and the president refuse; only the
+  whole-board preflight (`_preflight_gemini_heartbeat`) and `phase-loop
+  agy-qualification run` go on to first use. Legs re-admit by lookup rather than
+  receiving the preflight's Admission object; any future cross-process hand-off of an
+  image memfd must reuse the worker's seal check.
+- **Provenance** (coordinator process, nothing executes). Host platform from the running
+  host (D4: `linux-{x64,arm64}[-musl]`); the newest `agy_provenance.RECENCY_WINDOW`
+  stable releases (no prerelease, no draft); the exact platform asset; its URL equal to
+  `https://github.com/google-antigravity/antigravity-cli/releases/download/<tag>/<asset>`;
+  a strict `sha256:<hex>` asset digest equal to the streamed archive digest; exactly one
+  regular-file `antigravity` member (duplicates and links refuse), stream-hashed and
+  never extracted, equal to the image digest. The transport sends no credentials, has
+  no proxy support, uses the interpreter's compiled-in OpenSSL trust store (not
+  `SSL_CERT_FILE`/`SSL_CERT_DIR`), and follows at most three https redirects within
+  GitHub's download hosts. Fetch failure refuses `gemini_heartbeat_provenance_unavailable`;
+  no match refuses `gemini_heartbeat_provenance_unverified`.
+- **Behaviour.** Only after the provenance entry is written: help, then the three live
+  operations through the packaged driver and the release path's own validators. All
+  passing writes the `qualified` entry. Any observed isolation or identity violation (an
+  executable outside the helper policy, an unqualified provider image, a writable image
+  mount, an unverified network policy, a surviving process, a rejected record) writes a
+  `failed` entry at whatever stage it was seen (until `agy-qualification clear`). Only a
+  provider that was never observed running, a completion the provider did not answer
+  (HTTP 5xx, quota, auth), and our own local failure are transient, and cancellation writes
+  nothing. Transients are counted per key; the third consecutive one writes a `failed`
+  entry, success resets the count, and `agy-qualification clear` removes it. A lock waiter
+  that finds a transient recorded while it waited refuses without running or counting.
+- **Worker gate.** The qualification worker receives the image as an inherited fd and,
+  before hashing, requires a regular-file memfd with `F_SEAL_WRITE`, `F_SEAL_GROW`,
+  `F_SEAL_SHRINK` and `F_SEAL_SEAL` (`F_SEAL_FUTURE_WRITE` alone is refused). It admits
+  the fd as a candidate only if its digest is a release constant (the manual shim and the
+  upstream watch's prepared tree) or has a provenance entry for the current runtime
+  identity. It sets `PR_SET_PDEATHSIG`, so a killed coordinator leaves no worker.
+- **Store.** `$XDG_STATE_HOME/phase-loop/agy-qualification/hosts/<machine>/`, per user,
+  namespaced by machine-id. Directories 0700 and files 0600, owned by the euid, opened
+  `O_NOFOLLOW`; otherwise the store is absent to lookups and first use refuses
+  (`gemini_heartbeat_self_qualification_store_unsafe`). Every entry is HMAC-SHA256'd under
+  a per-host key over its type, the euid, the machine-id and a context recomputed from the
+  live key. The qualification entries (`provenance`, `qualified`, `failed`, `member_cache`,
+  `transient`) bind the image digest, platform and runtime identity, plus the asset name,
+  profile id or help digest as the type requires. The watch's `watch_push` entry binds the
+  branch, the version and the route-core base.
+  Without a readable machine-id, self-qualification refuses; the release path is unaffected.
+- **Lock.** One `flock` per host namespace; waiters are cancellable and heartbeat (the board
+  preflight writes a content-free `agy-qualification.json` progress record into the
+  board's stream directory and a line on stderr, throttled per phase), and re-check the
+  store after acquiring. Qualification happens once per key per user per host.
+- **Runtime identity (D2).** `__version__` plus the digests of the installed
+  `agy_qualification.ROUTE_CORE` files (`gemini_heartbeat.py`, `agy_qualification.py`,
+  `agy_provenance.py`), the same tuple `verify_qualified_agy_image.py --route-core` checks.
+- **Counting (D1).** At `governed_review`'s gate (the rule itself is
+  `agy_qualification.counts_toward_landing`), a usable heartbeat Gemini leg is a vote at every
+  tier only if its recorded class is `release_qualified` or `locally_qualified`. A
+  candidate leg, or a leg with no class (including legs from boards run before the class
+  existed: re-run the board), cannot approve; a blocking verdict from it still blocks. The
+  president's input builder applies the same rule (`agy_qualification.president_input_items`):
+  an uncounted non-blocking leg contributes a `not counted` item instead of its review, and an
+  uncounted `DISAGREE` keeps its objections. A leg is an agy leg by name or by the
+  coordinator's profile evidence. A
+  Gemini leg whose admitted digest appears in the reviewed artifact is flagged
+  (`gemini_seat_reviews_its_own_pin`, non-gating). Boards admit with the installed base
+  runtime, never the reviewed tree.
+- **Upstream watch.** `phase-loop agy-qualification watch` (a host timer on a subscribed
+  host; see `docs/ops/agy-upstream-watch.md`) proposes only the Linux x64 glibc release
+  route, from a fresh checkout of `main`, and opens a draft PR; it never merges. Each tick
+  makes exactly one ref write (a fresh `agy-watch/<version>-<utc>-<random>` branch, pushed
+  with an empty-expected-value lease and accepted only when `--porcelain` reports that exact
+  ref as newly created) and one object create (the PR). It never updates, force-pushes,
+  adopts, closes, edits or deletes anything that existed before the tick; the new PR body
+  names the own older PRs it supersedes for a maintainer to close. It requires `origin` to
+  have exactly one push URL, pushes to the remote NAME `origin` (never to the printed URL,
+  which git would resolve again). It compares no URL strings; a `--dry-run` pre-flight
+  must print exactly one `To` block, and the real push exactly one `To` block and one `*` row
+  for exactly the new ref. Both pushes carry `--no-verify`; the bot host's git/ssh
+  configuration is trusted. It pre-flights its store, records the
+  verified pushed oid in its own `watch_push` entry, and reads both the record and the
+  created PR back (the PR body's copy is display-only). "Up to date" requires that local record, `headRefOid` and `ls-remote` to
+  agree. It refuses when it cannot prove its open-PR listing complete.
+
+## ABDFALSIFY — Executable review findings (IF-0-EXECFIND-1)
+
+An optional `falsifier` attachment names one `FindingFalsifier` with
+`finding_id`, `new_test_path`, `expected_nodeid`, and a unified `diff` creating
+only `phase-loop-runtime/tests/test_finding_<finding_id>.py`. A
+`FindingFalsifierAttachment` contains a tuple of these entries with unique
+finding IDs. The attachment is a non-field property on `PanelLegResult`; it
+does not change the serialized leg or board schema. The seat supplies text,
+never an executable command or a claimed test outcome.
+
+`run_finding_falsifier` accepts one attached falsifier, board `seat_key`, canonical
+repository, positive wall-clock/output bounds, and a single-use
+`FalsifierIsolationAuthorization` bound to the exact 40-character `reviewed_sha`.
+Its identity is `public_board_falsifier.v1`; its child has no credentials,
+network egress, or live-tree mount. The source must be clean at that SHA.
+Before applying the diff, the staged materialized path set, bytes, symlink
+targets, and executable bits must equal the reviewed Git tree, including no
+ignored extra files. Only the named pytest node runs in the staged clone.
+
+Each run stages its own tree from the canonical repository at the head under
+test, never from a seat's tree, and copies installed dependency files into a
+per-run import root (copies, never links; uv's `--link-mode=copy` equivalent).
+Those two trees are the run's protected objects: every regular file in them,
+`.git` included, must have a link count of exactly one before the node starts
+and after it exits, or the run is `error` (agent-harness#1134). The shared system
+interpreter is read-only to the run and is not a protected object. The runner
+resolves `/usr/bin/python3` once and launches exactly that file. Falsifier runs
+execute without site processing (`-S`): no `.pth`, `sitecustomize` or
+`usercustomize` runs and no host site directory is on `sys.path`, so the
+interpreter's inputs are its standard-library entries plus the run's explicit
+staged paths. Every dependency, pytest included, comes from the per-run staged
+dependency root (a distribution without a RECORD is staged from its declared
+top-level modules); a host site directory on the falsifier path is refused as
+`falsifier_host_site_packages_refused`. The measured set is the launched
+interpreter's own `sys.path` under the same flags and environment, so the
+inventory and the launch are identical by construction. Every entry is
+digested before and after the run: archive entries and `.pth`, archive and
+customize files by content, directories by an lstat manifest (mode, size,
+device, inode, mtime, ctime), and every symlink target outside the set followed
+and hashed by content. An entry the runner cannot digest fails closed, and a
+changed scope or digest is `error`.
+Before staging, the canonical repository must not be reachable through any
+system-root mount (compared by device and in-filesystem path, not by pathname),
+and a repository that contains any mount point is refused as
+`falsifier_repository_submount_refused`. The record schema is unchanged; the reason
+stays in the result's `detail`.
+
+The frozen outcome tuple is `red_on_head`, `green_on_head`, `apply_failed`,
+`node_missing`, `error`. Pytest emits JUnit, but the recorded outcome comes from
+the wrapper's reported call-phase result; the test-writable XML is not read as
+authority. Seat-authored and reviewed-tree Python (including conftest) run
+in the wrapper's process and can forge
+the reported status, including a parent-keyed frame. RED and GREEN are therefore
+observed, untrusted results: neither binds nor dismisses a finding. Drift,
+expiry, unavailable isolation, and incomplete evidence are `error`; every
+valid attached result remains a blocking `finding_receipt` pending a president
+ruling. The metadata-only
+`finding_falsifier.v1` record has exactly `schema`,
+`authorization_identity`, `seat_key`, `reviewed_sha`, `finding_id`, `nodeid`,
+`outcome`, `red_output_digest`, `diff_digest`, `wall_clock_bound_s`, and
+`output_cap_bytes`. `diff_digest` hashes the offered UTF-8 diff bytes;
+`red_output_digest` hashes separately captured stdout followed by stderr
+and is null unless RED. The caller binds the record with SHA-256 over
+canonical JSON (`sort_keys=True`, compact separators, `ensure_ascii=False`).
+The full freeze and golden values live in
+`tests/data/execfind_falsifier_attachment_v1.golden.json`.

{phase_loop_runtime-0.7.20 → phase_loop_runtime-0.7.22}/src/phase_loop_runtime/advisor_board/backing.py

@@ -857,6 +857,22 @@ class ReviewIsolationAuthorization:
     staged_tree_sha256: str | None = None
 
 
+@dataclass(frozen=True)
+class FalsifierIsolationAuthorization:
+    """Single-use authority to run one attached test against a reviewed commit."""
+
+    operation: str
+    reviewed_sha: str
+    canonical_repo_sha256: str
+    child_credentialless: bool
+    child_network_egress: bool
+    live_tree_exposed: bool
+    issued_monotonic_ns: int
+    _seal: object
+    routes: tuple[tuple[str, str], ...] = ()
+    monitoring_policy: str = "bounded"
+
+
 def _staged_tree_digest(canonical_repo_authority: Path | str | None) -> str | None:
     """Digest of the reviewed tree a seat will be allowed to read.
 
@@ -903,6 +919,7 @@ def _canonical_repo_digest(canonical_repo_authority: Path | str | None) -> str:
             text=True,
             stderr=subprocess.DEVNULL,
             timeout=3,
+            env={key: value for key, value in os.environ.items() if not key.startswith("GIT_")},
         ).strip()
     except (OSError, subprocess.SubprocessError):
         raise ValueError("HARDEN review has no canonical repository authority") from None
@@ -1211,6 +1228,83 @@ def close_review_isolation_authorization(
         lease.cancel_event.set()
 
 
+def prepare_falsifier_isolation_authorization(
+    *, repo: Path, reviewed_sha: str,
+) -> FalsifierIsolationAuthorization:
+    """Mint one credentialless, no-egress staged-test operation."""
+    if platform.system() != "Linux" or len(reviewed_sha) != 40 or any(
+        character not in "0123456789abcdef" for character in reviewed_sha
+    ):
+        raise ValueError("invalid falsifier repository or reviewed SHA")
+    authorization = FalsifierIsolationAuthorization(
+        operation="public_board_falsifier.v1",
+        reviewed_sha=reviewed_sha,
+        canonical_repo_sha256=_canonical_repo_digest(repo),
+        child_credentialless=True,
+        child_network_egress=False,
+        live_tree_exposed=False,
+        issued_monotonic_ns=time.monotonic_ns(),
+        _seal=_AUTHORIZATION_SEAL,
+    )
+    _remember_lease(authorization)  # type: ignore[arg-type]
+    return authorization
+
+
+def _falsifier_authorization_lease(
+    authorization: FalsifierIsolationAuthorization | None,
+) -> _ReviewInvocationLease:
+    if (
+        not isinstance(authorization, FalsifierIsolationAuthorization)
+        or authorization._seal is not _AUTHORIZATION_SEAL
+        or authorization.operation != "public_board_falsifier.v1"
+        or not authorization.child_credentialless
+        or authorization.child_network_egress
+        or authorization.live_tree_exposed
+    ):
+        raise ValueError("missing, forged, or mismatched falsifier authorization")
+    return _lease_for(authorization)  # type: ignore[arg-type]
+
+
+def revalidate_falsifier_isolation_authorization(
+    authorization: FalsifierIsolationAuthorization | None, *, repo: Path,
+) -> None:
+    lease = _falsifier_authorization_lease(authorization)
+    if authorization.canonical_repo_sha256 != _canonical_repo_digest(repo):
+        raise ValueError("falsifier authorization repository drifted")
+    with lease.lock:
+        if lease.closed or (
+            not lease.active
+            and time.monotonic_ns() - lease.prepared_monotonic_ns > _PRE_ACTIVATION_FRESHNESS_NS
+        ):
+            raise ValueError("falsifier authorization is closed or expired")
+
+
+def activate_falsifier_isolation_authorization(
+    authorization: FalsifierIsolationAuthorization, *, repo: Path,
+) -> None:
+    revalidate_falsifier_isolation_authorization(authorization, repo=repo)
+    lease = _lease_for(authorization)  # type: ignore[arg-type]
+    with lease.lock:
+        if lease.closed or lease.active:
+            raise ValueError("falsifier authorization already consumed")
+        lease.active = True
+
+
+def close_falsifier_isolation_authorization(
+    authorization: FalsifierIsolationAuthorization | None,
+) -> None:
+    if not isinstance(authorization, FalsifierIsolationAuthorization):
+        return
+    try:
+        lease = _lease_for(authorization)  # type: ignore[arg-type]
+    except ValueError:
+        return
+    with lease.lock:
+        lease.active = False
+        lease.closed = True
+        lease.cancel_event.set()
+
+
 def derive_review_leg_authorization(
     authorization: ReviewIsolationAuthorization | None,
     artifact: str,
@@ -1667,10 +1761,15 @@ __all__ = [
     "harden_subscription_model",
     "harden_subscription_review_board",
     "ReviewIsolationAuthorization",
+    "FalsifierIsolationAuthorization",
     "ReviewCompositionAuthorization",
     "ReviewLegAuthorization",
     "ParentUnixBroker",
     "prepare_review_isolation_authorization",
+    "prepare_falsifier_isolation_authorization",
+    "revalidate_falsifier_isolation_authorization",
+    "activate_falsifier_isolation_authorization",
+    "close_falsifier_isolation_authorization",
     "prepare_review_composition_authorization",
     "current_review_composition_authorization",
     "clear_review_composition_authorization",

{phase_loop_runtime-0.7.20 → phase_loop_runtime-0.7.22}/src/phase_loop_runtime/advisor_board/config.py

@@ -51,11 +51,14 @@ from .schema import (
 )
 
 # Recognised keys — anything else is a hard error (no silent drop).
-_KNOWN_TOP_KEYS: frozenset[str] = frozenset({"default_board", "boards", "president"})
+_KNOWN_TOP_KEYS: frozenset[str] = frozenset({"default_board", "boards", "president", "agy"})
 # A repository file configures the president ladder only: repo-level boards are not a
 # feature, so a ``[[boards]]`` there is refused rather than silently ignored.
 _KNOWN_REPO_TOP_KEYS: frozenset[str] = frozenset({"president"})
 _KNOWN_PRESIDENT_KEYS: frozenset[str] = frozenset({"ladder"})
+# agent-harness#1076 D3: the USER file's ``[agy] self_qualification = false`` restores the
+# hard refusal of a non-release agy image. A repository file cannot carry it.
+_KNOWN_AGY_KEYS: frozenset[str] = frozenset({"self_qualification"})
 # Repository-level config, relative to the repository root.
 REPO_CONFIG_RELATIVE_PATH = ".agent-harness/advisor-boards.toml"
 _KNOWN_BOARD_KEYS: frozenset[str] = frozenset(
@@ -212,6 +215,31 @@ def _parse_president(data: Mapping[str, Any], where: str) -> tuple[str, ...] | N
         raise BoardConfigError(f"{where} [president] ladder: {exc}") from exc
 
 
+def _parse_agy(data: Mapping[str, Any], where: str) -> bool:
+    """The user file's ``[agy] self_qualification`` (default ``True``), validated."""
+    raw = data.get("agy")
+    if raw is None:
+        return True
+    if not isinstance(raw, Mapping):
+        raise BoardConfigError(f"{where}: 'agy' must be a table")
+    _reject_unknown(raw.keys(), _KNOWN_AGY_KEYS, f"{where} [agy]")
+    return _require_bool(raw, "self_qualification", True, f"{where} [agy]")
+
+
+def load_agy_self_qualification(*, path: Path | None = None) -> bool:
+    """D3 (agent-harness#1076): whether first-use self-qualification is enabled.
+
+    Reads the user file only (this process's ``board_config_path()``). A malformed file
+    raises; the admission caller treats any error as opted out (today's refusal).
+    """
+    user_path = path if path is not None else board_config_path(None)
+    user = _load_toml(user_path)
+    if user is None:
+        return True
+    _reject_unknown(user.keys(), _KNOWN_TOP_KEYS, str(user_path))
+    return _parse_agy(user, str(user_path))
+
+
 def _user_config_path(env: Mapping[str, str] | None) -> Path | None:
     """The user file for ``env``: resolved from the GIVEN environment only.
 
@@ -343,6 +371,7 @@ def load_boards(
                 raise BoardConfigError(f"{cfg_path} is not valid TOML: {exc}") from exc
         _reject_unknown(data.keys(), _KNOWN_TOP_KEYS, str(cfg_path))
         _parse_president(data, str(cfg_path))  # a bad [president] fails at load too
+        _parse_agy(data, str(cfg_path))  # and a bad [agy] (agent-harness#1076)
         raw_boards = data.get("boards", [])
         if not isinstance(raw_boards, list):
             raise BoardConfigError(f"{cfg_path}: 'boards' must be an array of tables")

{phase_loop_runtime-0.7.20 → phase_loop_runtime-0.7.22}/src/phase_loop_runtime/advisor_board/fixtures/advisor-boards.example.toml

@@ -12,6 +12,12 @@
 # Optional: the board a bare `advisor-board` invocation resolves to.
 default_board = "default"
 
+# Optional (agent-harness#1076, user file only): first-use self-qualification of a genuine
+# upstream agy release whose digest is not release-qualified. On by default; `false`
+# restores the hard refusal (`gemini_heartbeat_capability_unavailable`).
+# [agy]
+# self_qualification = false
+
 # The default board reproduces today's 3-leg panel (byte-for-byte back-compat).
 # Its three seats, in panel-leg order, render to today's exact CLI invocations:
 #   codex  gpt-6-astra          effort=max  -> -c model_reasoning_effort=xhigh

{phase_loop_runtime-0.7.20 → phase_loop_runtime-0.7.22}/src/phase_loop_runtime/advisor_board/fixtures.py

@@ -76,7 +76,12 @@ CANONICAL_VALID_PAIRS: tuple[tuple[str, str], ...] = (
     ("gpt-6-astra", "codex"),
     ("gpt-6-astra", "opencode"),
     ("gpt-5.6-sol", "codex"),  # legacy default id remains expressible
+    ("gpt-6-sol", "codex"),  # explicit seat on user/ad-hoc boards (not a governed grok stand-in)
+    ("gpt-6-sol", "opencode"),  # same family; matches the production registry's runnable_by
+    ("gpt-6.1-sol", "codex"),  # explicit seat, selected by board config (not a default)
+    ("gpt-6.1-sol", "opencode"),  # same family; registered by vendor family, not launch-verified
     ("claude-sonnet-5", "claude"),
+    ("claude-sonnet-5-5", "claude"),  # explicit seat, selected by board config (not a default)
     ("claude-opus-5-5", "claude"),
     ("claude-fable-5-1", "claude"),
     ("Gemini 3.1 Pro", "gemini"),

{phase_loop_runtime-0.7.20 → phase_loop_runtime-0.7.22}/src/phase_loop_runtime/advisor_board/registries.py

@@ -256,7 +256,10 @@ class DefaultHarnessRegistry:
 _MODEL_DEFS: tuple[tuple[str, str, str], ...] = (
     ("gpt-6-astra", "codex", "max"),
     ("gpt-5.6-sol", "codex", "max"),  # explicit legacy seat (fleet default before 2026-09-04)
+    ("gpt-6-sol", "codex", "max"),  # explicit seat (codex's own default model); not a board default
+    ("gpt-6.1-sol", "codex", "max"),  # explicit seat, selected by board config; not a board default
     ("claude-sonnet-5", "claude", "max"),
+    ("claude-sonnet-5-5", "claude", "max"),  # explicit seat, selected by board config; not a board default
     ("claude-opus-4-8", "claude", "max"),
     # design-model-tier-taxonomy.md: claude-opus-5 is the new Claude heavy model.
     # opus-4-8 is retained above — still referenced by tests (advisor_board_schema) —