phase-loop-runtime 0.7.25__tar.gz → 0.7.26__tar.gz

{phase_loop_runtime-0.7.25/src/phase_loop_runtime.egg-info → phase_loop_runtime-0.7.26}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: phase-loop-runtime
-Version: 0.7.25
+Version: 0.7.26
 Summary: Harness-neutral phase-loop orchestration runtime and CLI
 Author-email: ViperJuice <viperjuice@users.noreply.github.com>
 License-Expression: Apache-2.0
@@ -22,10 +22,13 @@ Requires-Dist: pydantic<3,>=2
 Requires-Dist: PyYAML<7,>=6
 Requires-Dist: consiliency-contract<0.7,>=0.6.5
 Requires-Dist: jsonschema<5,>=4
+Requires-Dist: pytest<9,>=8
+Requires-Dist: exceptiongroup>=1
+Requires-Dist: typing-extensions>=4.6
 Requires-Dist: packaging>=21
 Requires-Dist: websockets<16,>=12
 Requires-Dist: rfc8785<0.2,>=0.1.4
-Requires-Dist: tomli<3,>=2; python_version < "3.11"
+Requires-Dist: tomli<3,>=2
 Provides-Extra: visual
 Requires-Dist: Pillow<13,>=10; extra == "visual"
 
@@ -50,7 +53,7 @@ To install just this runtime package directly:
 
 ```sh
 pip install phase-loop-runtime              # latest compatible release
-pip install phase-loop-runtime==0.7.25      # …or pin an exact version
+pip install phase-loop-runtime==0.7.26      # …or pin an exact version
 ```
 
 To pin a specific tag from source instead, substitute a tag from

{phase_loop_runtime-0.7.25 → phase_loop_runtime-0.7.26}/README.md

@@ -19,7 +19,7 @@ To install just this runtime package directly:
 
 ```sh
 pip install phase-loop-runtime              # latest compatible release
-pip install phase-loop-runtime==0.7.25      # …or pin an exact version
+pip install phase-loop-runtime==0.7.26      # …or pin an exact version
 ```
 
 To pin a specific tag from source instead, substitute a tag from

{phase_loop_runtime-0.7.25 → phase_loop_runtime-0.7.26}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "phase-loop-runtime"  # PyPI dist name; NOT "agent-harness" (an unrelated third-party PyPI project)
-version = "0.7.25"
+version = "0.7.26"
 description = "Harness-neutral phase-loop orchestration runtime and CLI"
 readme = "README.md"
 requires-python = ">=3.10"
@@ -46,6 +46,19 @@ dependencies = [
     # guarantees the contract-owned vocabulary (incl. governance_contracts) is live.
     "consiliency-contract>=0.6.5,<0.7",
     "jsonschema>=4,<5",
+    # agent-harness#1357 (maintainer ruling): the seat jail's qualification runs a real falsifier
+    # run whose wrapper imports pytest, and the run copies its dependencies from the runtime's own
+    # environment. A host installed from the published package had no pytest anywhere, so the
+    # jail could not qualify. >=8 is the line the suite and Gate A are tested on; <9 keeps the
+    # hookwrapper API the wrapper uses inside the tested range -- widen it with a test run.
+    "pytest>=8,<9",
+    # The falsifier run's interpreter is /usr/bin/python3, whose minor can be older than the
+    # runtime's, and pytest's backports (exceptiongroup, tomli; exceptiongroup's typing-extensions)
+    # are selected by markers evaluated for the runtime's interpreter. A 3.11+ runtime over a 3.10
+    # system interpreter got neither, and the run could not import pytest. Declare them with no
+    # marker so the snapshot can always stage them (agent-harness#1361).
+    "exceptiongroup>=1",
+    "typing-extensions>=4.6",
     # `phase-loop doctor` (IF-0-AHADOPT-2) compares consumer pins to registry
     # latest with PEP 440 version ordering. Declared so the BOM produces real
     # stale|current verdicts on the isolated `uv tool install` path (where pip —
@@ -57,9 +70,11 @@ dependencies = [
     "websockets>=12,<16",
     "rfc8785>=0.1.4,<0.2",
     # Advisor Board config loader (ABDREG) parses advisor-boards.toml. tomllib is
-    # stdlib on 3.11+; on the 3.10 requires-python floor it is absent, so pull in
-    # the tomli backport there (import shim in advisor_board/config.py).
-    "tomli>=2,<3; python_version < '3.11'",
+    # stdlib on 3.11+; on the 3.10 requires-python floor it is absent, so the
+    # tomli backport is the fallback (import shim in advisor_board/config.py).
+    # Unconditional: pytest also needs it when the falsifier run's interpreter,
+    # /usr/bin/python3, is older than 3.11, whatever the runtime's own minor is.
+    "tomli>=2,<3",
 ]
 
 [project.optional-dependencies]
@@ -76,7 +91,8 @@ visual = ["Pillow>=10,<13"]
 [dependency-groups]
 # Keep build aligned with hosted pytest and Dagger _base. Gate A's inner
 # test environment intentionally installs unpinned tools.
-test = ["pytest>=8,<9", "build==1.6.1", "setuptools>=70.1", "pip"]
+# pytest is a runtime dependency now (see [project].dependencies), so it is not repeated here.
+test = ["build==1.6.1", "setuptools>=70.1", "pip"]
 
 [project.urls]
 Homepage = "https://github.com/Consiliency/agent-harness"
@@ -133,6 +149,7 @@ where = ["src"]
 [tool.setuptools.package-data]
 phase_loop_runtime = [
     "py.typed",
+    "rule_enforcement.json",
     "baml_src/*.baml",
     "route_policy/fixtures/*.json",
     "schemas/*.json",

{phase_loop_runtime-0.7.25 → phase_loop_runtime-0.7.26}/src/phase_loop_runtime/__init__.py

@@ -18,4 +18,4 @@ __all__ = [
     "state_ops",
 ]
 
-__version__ = "0.7.25"
+__version__ = "0.7.26"

{phase_loop_runtime-0.7.25 → phase_loop_runtime-0.7.26}/src/phase_loop_runtime/agy_canary_evidence.py

@@ -134,9 +134,14 @@ def _seat_parent_descriptor(root_fd: int, relative: str) -> tuple[int, str]:
     if not parts or any(part in ("", ".", "..") for part in parts):
         raise AgyCanaryEvidenceError("seat path is not relative and normalized")
     directory = os.dup(root_fd)
+    # Intermediate hops are O_PATH (search permission only), so a search-only ancestor
+    # such as a team host's 0711 workspace dir does not refuse the walk; the parent
+    # handed back stays O_RDONLY for callers that read it (agent-harness#1317).
+    hop = getattr(os, "O_PATH", os.O_RDONLY)
     try:
-        for part in parts[:-1]:
-            child = os.open(part, os.O_RDONLY | os.O_DIRECTORY | os.O_NOFOLLOW | os.O_CLOEXEC,
+        for index, part in enumerate(parts[:-1]):
+            access = os.O_RDONLY if index == len(parts) - 2 else hop
+            child = os.open(part, access | os.O_DIRECTORY | os.O_NOFOLLOW | os.O_CLOEXEC,
                             dir_fd=directory)
             os.close(directory)
             directory = child

phase_loop_runtime-0.7.26/src/phase_loop_runtime/agy_integrity.py

@@ -0,0 +1,129 @@
+"""Admission of qualified provider entry images.
+
+Release-qualified images are admitted statically, by digest. With the caller's env,
+``check`` also admits a locally self-qualified image through
+``agy_qualification.lookup``, which may run ``agy --help`` from a sealed memfd to
+measure the help digest (agent-harness#1331). It never qualifies an image."""
+
+from hashlib import sha256
+from contextlib import contextmanager
+import os
+from pathlib import Path
+import stat
+import shutil
+
+from . import gemini_heartbeat
+
+_PROVIDER_SEARCH_PATH = os.environ.get("PATH", os.defpath)
+
+
+class AgyImageUnqualified(RuntimeError):
+    pass
+
+
+def _locally_qualified(data, source, env):
+    """The image's local self-qualification admission (agent-harness#1076), else refuse.
+
+    Same lookup as ``gemini_heartbeat.admit`` step 2: opt-out, failed entry, provenance,
+    then the qualified entry for this host and runtime. Lookup only; it never qualifies."""
+    from . import agy_qualification
+    from .panel_invoker import ProviderProcessGroupQuiescenceError
+    from .sandbox_egress import EgressUnavailable
+    from .seat_jail import SeatSandboxRefused
+    try:
+        return agy_qualification.lookup(dict(env), data, str(source)).image
+    except gemini_heartbeat.AdmissionMiss as miss:
+        miss.image.close()
+        raise AgyImageUnqualified("agy_image_unqualified") from None
+    except (EgressUnavailable, gemini_heartbeat.GeminiQuiescenceError,
+            ProviderProcessGroupQuiescenceError, SeatSandboxRefused):
+        # The help measurement's own typed outcomes keep their type, so each reaches its
+        # handler: a seat refusal its code (agent-harness#1333 PR1), a quiescence failure the
+        # leg's quiescence path, a jail refusal its notice (agent-harness#1350 president).
+        # This precedes the broad mapping below, so the AgyCanaryEvidenceError BASE (a real
+        # memfd seal failure) is still the typed refusal.
+        raise
+    except (OSError, ValueError, RuntimeError) as exc:
+        # Opt-out, a failed record, an unsafe store, an unreadable image or a seal failure.
+        raise AgyImageUnqualified("agy_image_unqualified") from exc
+
+
+def check(path, env=None):
+    """Admit a release-qualified agy image. With ``env``, also admit a locally
+    self-qualified one, so the seat probe and launch honour the same admission as the
+    heartbeat route (agent-harness#1331). Without ``env`` (canary evidence) only
+    release-qualified images are admitted."""
+    descriptor = None
+    try:
+        source = Path(path).resolve(strict=True)
+        descriptor = os.open(source, os.O_RDONLY | os.O_NOFOLLOW | os.O_NONBLOCK | os.O_CLOEXEC)
+        info = os.fstat(descriptor)
+        if not stat.S_ISREG(info.st_mode) or info.st_size > 300_000_000:
+            raise AgyImageUnqualified("agy_image_unqualified")
+        chunks, size = [], 0
+        while size <= 300_000_000:
+            chunk = os.read(descriptor, min(1024 * 1024, 300_000_001 - size))
+            if not chunk:
+                break
+            size += len(chunk)
+            chunks.append(chunk)
+        data = b"".join(chunks)
+        if size > 300_000_000:
+            raise AgyImageUnqualified("agy_image_unqualified")
+        if sha256(data).hexdigest() not in gemini_heartbeat.QUALIFIED_IMAGES:
+            if env is None:
+                raise AgyImageUnqualified("agy_image_unqualified")
+            return _locally_qualified(data, source, env)
+        return gemini_heartbeat.VerifiedImage.from_bytes(data, source)
+    except (OSError, ValueError) as exc:
+        raise AgyImageUnqualified("agy_image_unqualified") from exc
+    finally:
+        if descriptor is not None:
+            os.close(descriptor)
+
+
+def admit_for_seat(path, env):
+    """Admission for the two owned review-seat sites only (agent-harness#1333 PR1).
+
+    ``check`` with the seat's env, from one read: a release member is admitted offline
+    before any config or store read, otherwise a ``locally_qualified`` image through
+    ``agy_qualification.lookup`` (agent-harness#1331); what runs is the sealed memfd of
+    those bytes, never the path. On the local-qualification path (an image that is not a
+    release member), a miss, the opt-out, a failed record, an unsafe store, an unreadable
+    image or a memfd-seal failure is the typed refusal. What the help measurement raises with
+    its own type passes through unchanged, and on the brokered review route the leg keeps its
+    code and notice: a typed seat refusal
+    (``EgressUnavailable`` and its subclasses, e.g. ``seat_filtered_egress_unavailable``), a
+    quiescence failure (``GeminiQuiescenceError``, ``ProviderProcessGroupQuiescenceError``)
+    and a jail refusal (``SeatSandboxRefused``). The executor and canary callers call ``check``
+    without an env and stay release-only.
+    """
+    return check(path, env)
+
+
+def trusted_command(argv, env):
+    if not argv or Path(argv[0]).name not in {"agy", "gemini"}:
+        return argv
+    source = shutil.which(argv[0], path=_PROVIDER_SEARCH_PATH)
+    if source is None:
+        raise AgyImageUnqualified("agy_image_unqualified")
+    image = check(source)
+    try:
+        return [str(image.path), *argv[1:]]
+    finally:
+        image.close()
+
+
+@contextmanager
+def admitted_command(argv):
+    if not argv or Path(argv[0]).name not in {"agy", "gemini"}:
+        yield argv, ()
+        return
+    source = shutil.which(argv[0], path=_PROVIDER_SEARCH_PATH)
+    if source is None:
+        raise AgyImageUnqualified("agy_image_unqualified")
+    image = check(source)
+    try:
+        yield [f"/proc/self/fd/{image.fd}", *argv[1:]], (image.fd,)
+    finally:
+        image.close()

{phase_loop_runtime-0.7.25 → phase_loop_runtime-0.7.26}/src/phase_loop_runtime/cli.py

@@ -2690,6 +2690,10 @@ def _seat_sandbox_command(args: argparse.Namespace) -> int:
                 return seat_jail_qualification.main([])
         except seat_jail_qualification.QualificationError as exc:
             print(f"seat-sandbox qualify: cannot run: {exc}", file=sys.stderr)
+            if seat_jail_autoqualify.classify_failure(exc) == "prerequisite_missing":
+                # agent-harness#1357: a missing prerequisite names the literal fix.
+                print("seat-sandbox qualify: fix: "
+                      f"{seat_jail_autoqualify.fix_for('prerequisite_missing')}", file=sys.stderr)
             return 1
         except TimeoutError:
             print("seat-sandbox qualify: cannot run: another qualification holds the lock",

{phase_loop_runtime-0.7.25 → phase_loop_runtime-0.7.26}/src/phase_loop_runtime/closeout_classifier.py

@@ -388,13 +388,57 @@ def audit_ignored_outputs(repo: Path, phase: str | None = None) -> dict:
     return buckets
 
 
+# The required closeout action for each exit, printed by `main` as its last line.
+# The execute-phase skills carry the same mapping only as a fallback for a pinned
+# runtime that predates this line (agent-harness#1303).
+CLOSEOUT_ACTIONS = {
+    0: "action: exit 0 (no unknown ignored outputs) -> ignored paths do not block "
+       "closeout; the dirty-path classification still decides the terminal status",
+    1: "action: exit 1 (unknown ignored outputs) -> BLOCKS: stop with "
+       "terminal_status=blocked and blocker_class=dirty_worktree_conflict; never "
+       "report complete",
+    2: "action: exit 2 (probe failed) -> BLOCKS: stop with "
+       "terminal_status=blocked and blocker_class=dirty_worktree_conflict; inability "
+       "to measure is never evidence of a clean tree",
+}
+# Printed when the audit raises instead of returning. The exception still propagates,
+# so the process exits 1 with its traceback; this line names no exit number for that reason.
+CRASH_ACTION = (
+    "action: exit non-zero (the closeout audit failed to run) -> BLOCKS: stop with "
+    "terminal_status=blocked and blocker_class=dirty_worktree_conflict; inability to "
+    "measure is never evidence of a clean tree"
+)
+
+
+def _exit(code: int) -> int:
+    print(CLOSEOUT_ACTIONS[code])
+    return code
+
+
 def main(argv: list[str]) -> int:
+    """``python -m phase_loop_runtime.closeout_classifier --repo .``; see ``_main``.
+
+    An exception still ends with exactly one blocking action line, then propagates.
+    """
+
+    try:
+        return _main(argv)
+    except (Exception, KeyboardInterrupt):
+        print(CRASH_ACTION, flush=True)
+        raise
+
+
+def _main(argv: list[str]) -> int:
     """``python -m phase_loop_runtime.closeout_classifier --repo .``
 
     Exit 0 = no unknown ignored outputs, so ignored dirt is NOT a closeout
     blocker. Exit 1 = unknown ignored outputs present, which still blocks.
     Exit 2 = the probe itself failed (including an invalid committed
-    generated-outputs declaration).
+    generated-outputs declaration). Every exit the audit returns or raises from
+    prints exactly one action line last (``CLOSEOUT_ACTIONS``, or ``CRASH_ACTION``
+    for an exception), so the executor reads the required terminal action from the
+    tool instead of re-deriving it from skill prose (agent-harness#1303). A process
+    killed by a signal prints none, and the skills' exit-code list governs.
 
     ``--record-outputs`` (agent-harness#1139) first runs, one at a time and under
     observation, every producer the committed ``.phase-loop-generated-outputs.json``
@@ -415,11 +459,11 @@ def main(argv: list[str]) -> int:
             generated_outputs.run_declared_producers(repo, phase=phase)
         except (generated_outputs.DeclarationError, generated_outputs.PhaseIdentityError) as exc:
             print(f"closeout-ignored-audit: CANNOT RECORD — {exc}")
-            return 2
+            return _exit(2)
     result = audit_ignored_outputs(repo, phase)
     if result["probe_failed"]:
         print(f"closeout-ignored-audit: CANNOT EVALUATE — {result['reason']}")
-        return 2
+        return _exit(2)
     reasons = result.get("unknown_reasons", {})
     for bucket in _BUCKETS:
         paths = result[bucket]
@@ -429,7 +473,7 @@ def main(argv: list[str]) -> int:
                 suffix = f"  -- {reasons[p]}" if p in reasons else ""
                 print(f"    {p}{suffix}")
     print(f"\nverdict: {result['reason']}")
-    return 1 if result["blocks"] else 0
+    return _exit(1 if result["blocks"] else 0)
 
 
 def console_main() -> int:

{phase_loop_runtime-0.7.25 → phase_loop_runtime-0.7.26}/src/phase_loop_runtime/doctor.py

@@ -31,6 +31,7 @@ from pathlib import Path
 from typing import Any, Callable, Optional
 
 from . import repo_validation
+from . import seat_jail_prerequisites
 from .install_status import _assert_redacted, build_install_status
 
 SCHEMA_ID = "phase-loop-doctor.v1"
@@ -501,6 +502,9 @@ def build_doctor_report(
         "bom": bom,
         # PUSHFLOW: ahead-of-origin divergence aggregate (counts only, no paths).
         "worktree_divergence": build_worktree_divergence(root),
+        # agent-harness#1357: what the seat jail's qualification needs from the runtime's own
+        # environment (today: pytest). Status only, with the literal fix when missing.
+        "seat_jail_prerequisites": seat_jail_prerequisites.check(),
     }
     # Metadata-only guarantee: no absolute paths, no secrets. Reuses the same
     # redaction contract as phase-loop-install-status.v1.
@@ -551,6 +555,14 @@ def _print_doctor(report: dict[str, Any]) -> None:
             f"  [{entry['verdict']:<7}] {entry['target']:<32} "
             f"pinned={entry['pinned']} latest={entry['latest']} ({entry['ecosystem']}, {gate})"
         )
+    prerequisites = report.get("seat_jail_prerequisites")
+    if prerequisites:
+        print("")
+        print("Seat jail prerequisites (needed to qualify jailed review seats):")
+        for item in prerequisites:
+            print(f"  {item['name']:<10} {item['status']}   → {item['unlocks']}")
+            if item.get("fix"):
+                print(f"    fix: {item['fix']}")
     div = report.get("worktree_divergence")
     if div:
         print("")

{phase_loop_runtime-0.7.25 → phase_loop_runtime-0.7.26}/src/phase_loop_runtime/maintenance.py

@@ -16,6 +16,7 @@ from .observability import operator_halt_metadata, run_artifacts, stop_requested
 from .profiles import resolve_profile
 from .prompts import build_skill_maintenance_prompt
 from .provenance import roadmap_sha256, snapshot_provenance
+from . import reflection_corpus
 from .reconcile import reconcile
 from .runtime_paths import ensure_phase_loop_excluded, phase_loop_dir
 from .skill_inventory import (
@@ -41,23 +42,28 @@ class SyncSkillsOptions:
     apply: bool = False
 
 
-def collect_reflection_inventory(repo: Path) -> dict[str, object]:
-    roots = (
-        Path.home() / ".codex" / "skills",
-        repo / "codex-config" / "skills",
-    )
-    by_root: list[dict[str, object]] = []
-    total = 0
-    for root in roots:
-        count = 0
-        if root.exists():
-            for reflections in root.glob("codex-*/reflections"):
-                for path in reflections.rglob("*"):
-                    if path.is_file() and "archive" not in path.parts:
-                        count += 1
-        total += count
-        by_root.append({"root": str(root), "count": count})
-    return {"total": total, "roots": by_root}
+def collect_reflection_inventory(repo: Path, min_reflections: int = 2) -> dict[str, object]:
+    """Per-skill reflection counts across every harness root, gated on ``min_reflections``.
+
+    ``due`` is the threshold trigger: ``maintain-skills`` launches the planner only
+    when at least one skill has ``min_reflections`` admitted reflections.
+    """
+    corpus, _ = reflection_corpus.collect(min_reflections=min_reflections)
+    return reflection_corpus.inventory(corpus)
+
+
+def prepare_reflection_corpus(repo: Path, min_reflections: int) -> tuple[dict[str, object], Path | None]:
+    """Collect, filter and write the planner's input under ``.phase-loop/``."""
+    corpus, boilerplate = reflection_corpus.collect(min_reflections=min_reflections)
+    inventory = reflection_corpus.inventory(corpus)
+    if not corpus.due:
+        return inventory, None
+    ensure_phase_loop_excluded(repo)
+    stamp = utc_now().replace(":", "").replace("-", "")
+    out_dir = phase_loop_dir(repo) / "skill-maintenance" / f"corpus-{stamp}"
+    reflection_corpus.write_corpus(corpus, boilerplate, out_dir)
+    inventory["corpus_dir"] = str(out_dir)
+    return inventory, out_dir
 
 
 def validate_maintenance_options(options: MaintenanceOptions) -> Blocker | None:
@@ -171,8 +177,12 @@ def run_maintenance(
 ) -> tuple[StateSnapshot, list[LaunchResult]]:
     phases = reconcile(repo, roadmap).phases
     selection = resolve_profile(model_profile or "skill-maintenance", model=model, effort=effort)
-    inventory = collect_reflection_inventory(repo)
     blocker = validate_maintenance_options(options) or active_loop_blocker(repo, desired_mode="skill-maintenance")
+    corpus_dir: Path | None = None
+    if blocker or options.apply_skill_edits:
+        inventory = collect_reflection_inventory(repo, options.min_reflections)
+    else:
+        inventory, corpus_dir = prepare_reflection_corpus(repo, options.min_reflections)
     if blocker:
         snapshot = StateSnapshot(
             timestamp=utc_now(),
@@ -195,7 +205,26 @@ def run_maintenance(
         append_event(repo, _maintenance_event(repo, roadmap, "blocked", selection, inventory, blocker=blocker))
         return snapshot, []
 
-    prompt = build_skill_maintenance_prompt(options)
+    if not options.apply_skill_edits and corpus_dir is None:
+        # Threshold not met: launching the planner would aggregate noise (or nothing).
+        snapshot = StateSnapshot(
+            timestamp=utc_now(),
+            repo=str(repo),
+            roadmap=str(roadmap),
+            phases=phases,
+            current_phase=next((phase for phase, status in phases.items() if status != "complete"), None),
+            last_action="maintain-skills",
+            model=selection.model,
+            reasoning_effort=selection.effort,
+            source=selection.source,
+            override_reason=selection.override_reason,
+            **snapshot_provenance(roadmap),
+        )
+        _write_state_and_handoff(repo, roadmap, snapshot, results=[])
+        append_event(repo, _maintenance_event(repo, roadmap, "plan_skipped", selection, inventory))
+        return snapshot, []
+
+    prompt = build_skill_maintenance_prompt(options, corpus_dir=corpus_dir)
     command = build_codex_command(repo, selection, prompt, json_output=json_output, bypass_approvals=bypass_approvals)
     if stop_requested(repo):
         metadata = operator_halt_metadata(repo)

{phase_loop_runtime-0.7.25 → phase_loop_runtime-0.7.26}/src/phase_loop_runtime/panel_invoker.py

@@ -271,12 +271,15 @@ def _trusted_host_path(path) -> str:
 
 def _seat_bind_source(path, *, output=False) -> str:
     path = _trusted_host_path(path)
-    directory = os.open("/", os.O_RDONLY | os.O_DIRECTORY | os.O_NOFOLLOW)
+    # O_PATH needs only search permission, so a bind source below a search-only
+    # ancestor (a team host's root-owned 0711 workspace dirs) is reachable; with
+    # O_DIRECTORY, O_NOFOLLOW still refuses a link component (agent-harness#1317).
+    walk = getattr(os, "O_PATH", os.O_RDONLY) | os.O_DIRECTORY | os.O_NOFOLLOW
+    directory = os.open("/", walk)
     try:
         parts = Path(path).parts[1:]
         for part in parts[:-1]:
-            child = os.open(part, os.O_RDONLY | os.O_DIRECTORY | os.O_NOFOLLOW,
-                            dir_fd=directory)
+            child = os.open(part, walk, dir_fd=directory)
             os.close(directory)
             directory = child
         info = os.stat(parts[-1], dir_fd=directory, follow_symlinks=False)
@@ -2008,7 +2011,7 @@ def _seat_launch_modes(
             _what, why, _fix = _seat_jail.NOTICES[refusal]
             modes.append(sp.SeatMode(key, leg, sp.MODE_DEGRADED, refusal,
                                      f"{why}; reason: {reason}",
-                                     _seat_jail_autoqualify.REASON_FIXES[reason], None, position))
+                                     _seat_jail_autoqualify.fix_for(reason), None, position))
         elif refusal is not None:
             modes.append(_coded(sp.MODE_DEGRADED, refusal))
         elif not route.jailed:
@@ -4551,6 +4554,50 @@ def _seat_secret_values(value):
             yield from _seat_secret_values(item)
 
 
+_SHELL_WRAPPER_EXPORT = re.compile(r'export [A-Z_][A-Z0-9_]*=(?:[A-Za-z0-9._/:@+-]|"\$PATH")*')
+# Only `-c key=value` config pairs may sit between the target and "$@": an interpreter
+# line (`exec /usr/bin/env node cli.js "$@"`) or any other flag is not followed.
+_SHELL_WRAPPER_EXEC = re.compile(
+    r'exec (/[A-Za-z0-9._@+/-]+)(?: -c [A-Za-z0-9._-]+=[A-Za-z0-9._/:@+-]+)* "\$@"')
+
+
+def _shell_wrapper_target(path: Path, provider: str | None = None) -> Path | None:
+    """The absolute ``exec`` target of a trusted launcher wrapper, else ``None``.
+
+    Team-host tooling ships each CLI as ``#!/bin/sh`` + ``export`` lines + one
+    ``exec /abs/path [-c k=v ...] "$@"`` (agent-harness#1318). The seat binds only the
+    provider itself, so the wrapper's target would be missing from the view. Only a regular
+    file owned by root or the operator, writable by no one else, read through one no-follow,
+    non-blocking descriptor, of exactly that shape, whose target is named ``provider``
+    (when given), is followed."""
+    try:
+        descriptor = os.open(path, os.O_RDONLY | os.O_NOFOLLOW | os.O_NONBLOCK | os.O_CLOEXEC)
+    except OSError:
+        return None
+    try:
+        info = os.fstat(descriptor)
+        if (not stat.S_ISREG(info.st_mode) or info.st_uid not in {0, os.getuid()}
+                or info.st_mode & 0o022 or info.st_size > 4096):
+            return None
+        text = os.read(descriptor, 4097).decode("utf-8")
+    except (OSError, UnicodeDecodeError):
+        return None
+    finally:
+        os.close(descriptor)
+    lines = [line.strip() for line in text.splitlines() if line.strip()]
+    if len(lines) < 2 or lines[0] != "#!/bin/sh":
+        return None
+    if not all(_SHELL_WRAPPER_EXPORT.fullmatch(line) for line in lines[1:-1]):
+        return None
+    match = _SHELL_WRAPPER_EXEC.fullmatch(lines[-1])
+    if not match:
+        return None
+    target = Path(match.group(1))
+    if provider is not None and target.name.lower() != provider:
+        return None
+    return target
+
+
 def _seat_provider_source(command, env):
     name = Path(command).name.lower()
     harness = {"agy": "gemini", "gemini": "gemini", "codex.js": "codex",
@@ -4559,6 +4606,11 @@ def _seat_provider_source(command, env):
     if source is None:
         raise FileNotFoundError("seat_provider_unavailable")
     source = Path(source).resolve(strict=True)
+    for _hop in range(4):
+        target = _shell_wrapper_target(source, Path(command).name.lower())
+        if target is None:
+            break
+        source = target.resolve(strict=True)
     if harness == "codex" and source.suffix == ".js":
         package = source.parent.parent
         machine = os.uname().machine
@@ -4567,7 +4619,9 @@ def _seat_provider_source(command, env):
         if suffix is None:
             raise _sandbox_egress.SeatIdentityUnverified("seat_provider_unavailable")
         candidates = (package / "node_modules/@openai" / ("codex-linux-" + suffix) / "vendor" / triple / "bin/codex",
-                      package / "vendor" / triple / "bin/codex")
+                      package / "vendor" / triple / "bin/codex",
+                      # npm hoists the platform package beside @openai/codex.
+                      package.parent / ("codex-linux-" + suffix) / "vendor" / triple / "bin/codex")
         source = next((path for path in candidates if path.is_file()), None)
         if source is None:
             raise _sandbox_egress.SeatIdentityUnverified("seat_provider_unavailable")
@@ -4676,7 +4730,7 @@ def seat_profile(*, harness, executable, env, cwd, readonly_paths=(), outputs=()
                 stack.callback(refresh_image.close)
             else:
                 from . import agy_integrity
-                refresh_image = agy_integrity.check(executable)
+                refresh_image = agy_integrity.admit_for_seat(executable, env)
                 stack.callback(refresh_image.close)
             _refresh_gemini_credential(home, refresh_image)
         def directory(path):
@@ -4771,7 +4825,7 @@ def seat_profile(*, harness, executable, env, cwd, readonly_paths=(), outputs=()
             gemini_profile.evidence["provider_agy_subscription_reference"] = "private_access_token_copy"
         elif harness == "gemini":
             from . import agy_integrity
-            image = agy_integrity.check(executable)
+            image = agy_integrity.admit_for_seat(executable, env)
             stack.callback(image.close)
             descriptor = image.reopen()
             stack.callback(os.close, descriptor)
@@ -11695,8 +11749,15 @@ def _default_spawn(
                     except Exception as exc:
                         if leg != "gemini":
                             raise
+                        # A typed seat refusal (admission, jail, egress) keeps its code and
+                        # notice here exactly as off the broker (the outer handler below).
+                        failure = _exception_failure(exc)
+                        typed = isinstance(failure, str) and failure in _seat_jail.NOTICE_CODES
+                        if typed:
+                            seat_notices.append(failure)
                         gemini_detail = (
                             "review_monitoring_write_failed" if review_monitor is not None and review_monitor.write_failed
+                            else failure if typed
                             else str(exc) if str(exc) in _GEMINI_BROKER_DETAILS
                             else "Gemini broker local provider failure"
                         )

{phase_loop_runtime-0.7.25 → phase_loop_runtime-0.7.26}/src/phase_loop_runtime/prompts.py

@@ -225,9 +225,10 @@ def _build_prompt_route(
     )
 
 
-def build_skill_maintenance_prompt(options) -> str:
+def build_skill_maintenance_prompt(options, corpus_dir: Path | None = None) -> str:
     if not options.apply_skill_edits:
-        return f"codex-skill-improvement-planner --min-reflections {options.min_reflections}"
+        prompt = f"codex-skill-improvement-planner --min-reflections {options.min_reflections}"
+        return f"{prompt} --corpus {corpus_dir}" if corpus_dir is not None else prompt
     parts = ["codex-skill-editor", "--improvement-plan", str(options.improvement_plan)]
     for skill in options.allow_skills:
         parts.extend(["--allow-skill", skill])