puremethod 0.1.0__py3-none-any.whl

app/bundled.py

@@ -0,0 +1,521 @@
+"""The bundled local PureScholar (08-app.md §5 step 12, INV-8; KB-025, KB-031).
+
+Per tenant: a private Docker network, a pgvector container with no published port and a
+named volume (the corpus survives restarts), and the PureScholar backend in headless mode,
+published on 127.0.0.1 only. `app` reaches it only through Docker: readiness is the container's
+health check, and the API key reaches PureScholar only as its SHA-256. The `purescholar`
+adapter is the only HTTP client (SYS-INV-5).
+
+`status_for` and `url` read the state the start task recorded and confirm the backend is still
+healthy (a dead container never hands out its old port); they never decrypt. `Starter` is
+the literature-service task (a worker process): it decrypts only the LLM credentials
+PureScholar uses and the keys of enabled literature sources (§5 step 3, KB-039). State
+changes are compare-and-set, so a start never overwrites a newer request or a stop made while
+it ran; a start that loses removes what it created.
+Secrets reach `docker run` through the subprocess environment (`-e NAME` without a value),
+never on a command line. Stopping removes the backend container, and with it the LLM key in
+Docker's state (§9); the database container and its volume stay."""
+
+from __future__ import annotations
+
+import hashlib
+import ipaddress
+import json
+import os
+import secrets
+import socket
+import subprocess
+import time
+from collections.abc import Callable
+from dataclasses import dataclass
+from typing import Any
+from urllib.parse import urlsplit
+
+from cryptography.hazmat.primitives import hashes
+from cryptography.hazmat.primitives.kdf.hkdf import HKDF
+
+from app import literature_sources, model_endpoints, tunnels
+from app.db import Database
+from app.repo import TenantRepo
+from app.settings import Settings
+from app.setup import PURESCHOLAR_CREDENTIAL, LocalStatus, ServiceStatus
+
+# Pinned by digest (08 §5 step 12). pgvector/pgvector:pg16 as of 2026-10-29.
+PGVECTOR_IMAGE = ("pgvector/pgvector@sha256:"
+                  "1d533553fefe4f12e5d80c7b80622ba0c382abb5758856f52983d8789179f0fb")
+# The PureScholar backend at the pinned commit (01-purescholar.md §8, d2d2693), by the digest
+# of its multi-arch index (linux/amd64, linux/arm64) on GitHub Container Registry (KB-031,
+# KB-040).
+# `PM_PURESCHOLAR_IMAGE` overrides it for development and tests; without either, local mode
+# reports failed.
+PURESCHOLAR_IMAGE: str | None = (
+    "ghcr.io/hamzalabwork-sudo/purescholar-backend@sha256:"
+    "cbaee84502c582771d12d795f8c00c2b8d25a8ed616a016ef762e6b837384729")
+NOT_PUBLISHED = ("the bundled PureScholar image is not published yet; "
+                 "use a remote PureScholar for now")
+NOT_RUNNING = ("the bundled PureScholar is not running; restart puremethod, or save the "
+               "literature setting again")
+NO_SENTENCE_TRANSFORMERS = ("this PureScholar image does not include the local embedding "
+                            "model yet; choose another search quality")
+TOKEN_PREFIX = "psk_live_"  # noqa: S105 (the public prefix of PureScholar keys)
+READY_TIMEOUT_S = 300.0
+# A deep `/ask` (sub-questions, reflection rounds, rate-limited searches) often runs past the
+# adapter's 120 s default, and a timed-out ask is retried from scratch: a run paused after
+# four full attempts (DL-20261102-02). The bundled instance serves only this machine.
+REQUEST_TIMEOUT_S = 600.0
+POLL_S = 2.0
+PROBE_TIMEOUT_S = 5.0  # the liveness probe runs in API requests: a hung Docker is "not healthy"
+
+Docker = Callable[[list[str], dict[str, str] | None], tuple[int, str]]
+
+
+def run_docker(args: list[str], env: dict[str, str] | None = None,
+               timeout: float = 300.0) -> tuple[int, str]:
+    """`docker <args>`; `env` adds variables that `-e NAME` arguments read. No shell."""
+    try:
+        proc = subprocess.run(["docker", *args],  # noqa: S603, S607
+                              env={**os.environ, **env} if env else None,
+                              capture_output=True, text=True, encoding="utf-8",
+                              errors="replace", timeout=timeout, check=False)
+    except FileNotFoundError:
+        return 127, "docker is not installed"
+    except subprocess.TimeoutExpired:
+        return 124, "docker did not answer"
+    return proc.returncode, (proc.stdout + proc.stderr).strip()
+
+
+def _docker(docker: Docker | None) -> Docker:
+    return docker or run_docker  # resolved per call, so tests can replace run_docker
+
+
+def image(settings: Settings) -> str | None:
+    return settings.purescholar_image or PURESCHOLAR_IMAGE
+
+
+@dataclass(frozen=True)
+class Names:
+    network: str
+    db: str
+    backend: str
+    volume: str
+
+    @classmethod
+    def of(cls, tenant_id: str) -> Names:
+        s = hashlib.sha256(tenant_id.encode()).hexdigest()[:10]
+        return cls(f"puremethod-ps-{s}", f"puremethod-ps-db-{s}", f"puremethod-ps-{s}-api",
+                   f"puremethod-ps-data-{s}")
+
+
+def db_password(master_key: bytes) -> str:
+    """Derived, never stored (KB-031): the database is reachable only on its own network."""
+    return HKDF(algorithm=hashes.SHA256(), length=24, salt=None,
+                info=b"purescholar-db").derive(master_key).hex()
+
+
+def _healthy(tenant_id: str, docker: Docker | None) -> bool:
+    args = ["inspect", "-f", "{{.State.Status}} {{.State.Health.Status}}",
+            Names.of(tenant_id).backend]
+    code, out = docker(args, None) if docker else run_docker(args, None,
+                                                             timeout=PROBE_TIMEOUT_S)
+    return code == 0 and out.strip() == "running healthy"
+
+
+def _loopback(host: str) -> bool:
+    if host.lower() == "localhost" or host.lower().endswith(".localhost"):
+        return True
+    try:
+        ip = ipaddress.ip_address(host)
+    except ValueError:
+        return False  # a name: the container resolves it itself
+    mapped = getattr(ip, "ipv4_mapped", None)
+    return ip.is_loopback or ip.is_unspecified or bool(mapped and mapped.is_loopback)
+
+
+# ---- read side (API process and run workers) -----------------------------------------------
+
+def status_for(settings: Settings, docker: Docker | None = None) -> LocalStatus:
+    def status(repo: TenantRepo) -> ServiceStatus:
+        if image(settings) is None:
+            return ServiceStatus("failed", NOT_PUBLISHED)
+        row = repo.bundled()
+        if row is None:
+            return ServiceStatus("stopped", "the bundled PureScholar has not started yet")
+        state = row["state"]
+        if state in ("pending", "starting"):
+            return ServiceStatus("starting", "starting the bundled PureScholar")
+        if state == "ready":
+            if _healthy(repo.tenant_id, docker):
+                return ServiceStatus("ready")
+            return ServiceStatus("failed", NOT_RUNNING)
+        return ServiceStatus(state, row["reason"] or state)
+    return status
+
+
+def url(repo: TenantRepo, docker: Docker | None = None) -> str | None:
+    """The bundled PureScholar's address while it is ready and healthy, else None: a run never
+    sends its key to a port a dead container left behind."""
+    row = repo.bundled()
+    if row is None or row["state"] != "ready" or not row["port"]:
+        return None
+    if not _healthy(repo.tenant_id, docker):
+        return None
+    return f"http://127.0.0.1:{int(row['port'])}"
+
+
+def request_start(repo: TenantRepo) -> None:
+    """Asks the supervisor for a start task (on local mode, and at server start). A start
+    already running sees the new request and its result is discarded."""
+    repo.set_bundled("pending", "")
+
+
+# ---- the literature-service task (worker side) --------------------------------------------
+
+class StartFailed(Exception):
+    """A reason the user can act on. Never carries a credential value."""
+
+
+def _free_port() -> int:
+    with socket.socket() as s:
+        s.bind(("127.0.0.1", 0))
+        return int(s.getsockname()[1])
+
+
+# A model with no key: PureScholar counts a provider as configured only with a key set, and
+# sends it as a bearer token, which such servers ignore. Not a secret (08 §5 step 12, KB-038).
+PLACEHOLDER_KEY = "no-key-needed"
+
+
+def model_source(repo: TenantRepo, setting: dict[str, Any], mode: str) -> dict[str, Any]:
+    """The model PureScholar generates with: provider, model, the credential name ("" for none)
+    and its endpoint (`base_url`, `local_port` or `ssh`). From the LLM credential's latest
+    passed check (KB-031), or from a profile role of a checked profile (KB-038, KB-041).
+    Raises StartFailed saying what to check first."""
+    if setting.get("llm_profile"):
+        profile = repo.get_profile(str(setting["llm_profile"]))
+        role = str(setting.get("llm_role") or "analyst")
+        if profile is None or role not in profile.roles:
+            raise StartFailed("the LLM profile chosen for PureScholar no longer exists")
+        if not repo.profile_checked(profile):  # its current version (KB-041)
+            raise StartFailed(f"check the LLM profile {profile.name!r} first: PureScholar "
+                              "uses its model")
+        spec = profile.roles[role]
+        try:
+            expanded = model_endpoints.expand(spec, mode, repo.resolve_machine)  # type: ignore[arg-type]
+        except (KeyError, ValueError) as exc:
+            raise StartFailed(f"the profile's SSH machine cannot be used: {exc}") from None
+        source: dict[str, Any] = {"provider": str(spec["provider"]), "model": str(spec["model"]),
+                  "credential": str(spec.get("credential") or "")}
+        for key in ("base_url", "ssh"):
+            if key in expanded:
+                source[key] = expanded[key]
+        if spec.get("local_port"):
+            source["local_port"] = int(spec["local_port"])
+            source.pop("base_url", None)  # the bridge gives the container its address
+        return source
+    name = str(setting["llm_credential"])
+    cred = next((c for c in repo.list_credentials() if c.name == name), None)
+    cc = repo.latest_credential_check(cred.id) if cred else None
+    if cred is None or cc is None or cc.kind != "llm" or not (
+            cc.report and cc.report.get("ok")):
+        raise StartFailed(f"check the LLM key {name!r} first: PureScholar uses its model")
+    source = {"provider": str(cc.request["provider"]), "model": str(cc.request["model"]),
+              "credential": name}
+    for key in ("base_url", "local_port", "ssh"):
+        if cc.request.get(key):
+            source[key] = cc.request[key]
+    return source
+
+
+def _generation_env(repo: TenantRepo, setting: dict[str, Any],
+                    lookup: Callable[[str], str], source: dict[str, Any]) -> dict[str, str]:
+    """PureScholar's model settings from `model_source`."""
+    name = str(source["credential"])
+    provider, model = str(source["provider"]), str(source["model"])
+    key = lookup(name) if name else PLACEHOLDER_KEY
+    embedding = str(setting["embedding"])
+    if embedding == "sentence-transformers":
+        raise StartFailed(NO_SENTENCE_TRANSFORMERS)
+    if provider == "anthropic":
+        env = {"LLM_PROVIDER": "anthropic", "ANTHROPIC_API_KEY": key, "ANTHROPIC_MODEL": model}
+    else:
+        env = {"LLM_PROVIDER": "openai", "OPENAI_API_KEY": key, "OPENAI_MODEL": model}
+        if provider == "openai_compatible" and bridge_spec(source) is not None:
+            pass  # OPENAI_API_BASE is the bridge's address, set by `Starter` (KB-036)
+        elif provider == "openai_compatible":
+            base = str(source.get("base_url") or "").rstrip("/")
+            if _loopback(urlsplit(base).hostname or ""):
+                raise StartFailed("the bundled PureScholar runs in a container and cannot reach "
+                                  "a model on 127.0.0.1; use a remote PureScholar, or a model "
+                                  "address the container can reach")
+            # PureScholar appends /v1/chat/completions to OPENAI_API_BASE.
+            if not base.endswith("/v1"):
+                raise StartFailed("the bundled PureScholar needs an OpenAI-compatible base URL "
+                                  "ending in /v1")
+            env["OPENAI_API_BASE"] = base[: -len("/v1")]
+        if provider == "openai_compatible":
+            if embedding == "openai":
+                # PureScholar's OpenAI embeddings ignore OPENAI_API_BASE: the key would go to
+                # api.openai.com.
+                raise StartFailed("OpenAI embeddings need an OpenAI model key; with an "
+                                  "OpenAI-compatible model, choose the basic search quality")
+    env["EMBED_BACKEND"] = embedding
+    if embedding == "openai":
+        other = str(setting.get("openai_credential") or "")
+        if "OPENAI_API_KEY" in env and other != name:
+            raise StartFailed("PureScholar uses one OpenAI key for chat and embeddings; use the "
+                              "same key for both, or another search quality")
+        env["OPENAI_API_KEY"] = lookup(other)
+    return env
+
+
+# ---- a local or tunnelled model for the container (08 §5 step 12, KB-036) ---------------------
+
+DOCKER_HOST_NAME = "host.docker.internal"
+KEEP_ALIVE_POLL_S = 5.0
+
+
+def bridge_spec(request: dict[str, Any]) -> dict[str, Any] | None:
+    """What the container needs a bridge to: a model on this computer (`local_port`) or on an
+    SSH machine (`ssh`), from `model_source`. None for a URL."""
+    if request.get("local_port"):
+        return {"local_port": int(request["local_port"])}
+    if isinstance(request.get("ssh"), dict):
+        return {"ssh": request["ssh"]}
+    return None
+
+
+class Bridge:
+    """The address the container uses for the model, and what keeps it open. On Docker
+    Desktop the container reaches the host's loopback as host.docker.internal, so a tunnel
+    listens on 127.0.0.1 and a local model needs nothing. On Docker Engine it cannot, so the
+    tunnel, or a relay for a local model, listens on the bundled network's gateway address
+    (INV-8)."""
+
+    def __init__(self, host: str, port: int, keeper: Any = None) -> None:
+        self.host, self.port, self.keeper = host, port, keeper
+
+    @property
+    def url(self) -> str:  # PureScholar appends /v1/chat/completions
+        return f"http://{self.host}:{self.port}"
+
+    def close(self) -> None:
+        if self.keeper is not None:
+            self.keeper.close()
+
+
+class Starter:
+    """Starts (or restarts) one tenant's bundled PureScholar and records the outcome."""
+
+    def __init__(self, settings: Settings, repo: TenantRepo, *, docker: Docker | None = None,
+                 clock: Callable[[], float] = time.monotonic,
+                 sleep: Callable[[float], None] = time.sleep,
+                 timeout_s: float = READY_TIMEOUT_S) -> None:
+        self._settings, self._repo, self._docker = settings, repo, _docker(docker)
+        self._clock, self._sleep, self._timeout = clock, sleep, timeout_s
+        self.names = Names.of(repo.tenant_id)
+        self.bridge: Bridge | None = None  # kept open by the literature task while it runs
+
+    def credentials_needed(self) -> set[str]:
+        setting = self._repo.service_setting("literature") or {}
+        names = {str(n) for n in (setting.get("llm_credential"),
+                                  setting.get("openai_credential")) if n}
+        if setting.get("mode") != "local":
+            return names
+        # The keys of enabled sources only (08 §5 step 3, KB-039).
+        names |= set(literature_sources.keys_needed(setting).values())
+        try:
+            source = model_source(self._repo, setting, self._settings.mode)
+        except StartFailed:
+            return names  # the start reports it
+        if source["credential"]:
+            names.add(str(source["credential"]))
+        spec = bridge_spec(source)
+        if spec and "ssh" in spec:  # the tunnel's SSH keys (KB-036)
+            names |= {str(h["key_credential"]) for h in spec["ssh"].get("hops", [])}
+        return names
+
+    def run(self, lookup: Callable[[str], str], scrub: Callable[[str], str]) -> None:
+        if not self._repo.set_bundled("starting", expect=("pending", "starting")):
+            return  # stopped or already settled meanwhile
+        setting = self._repo.service_setting("literature")
+        if not setting or setting.get("mode") != "local":
+            self._remove_backend()
+            self._repo.set_bundled("stopped", "the literature service is not local",
+                                   expect=("starting",))
+            return
+        img = image(self._settings)
+        if img is None:
+            self._repo.set_bundled("failed", NOT_PUBLISHED, expect=("starting",))
+            return
+        try:
+            source = model_source(self._repo, setting, self._settings.mode)
+            env = _generation_env(self._repo, setting, lookup, source)
+            env |= literature_sources.env(setting, lookup)  # KB-039
+            spec = bridge_spec(source)
+            if spec is not None:
+                self.bridge = self._bridge(spec, lookup)
+                env["OPENAI_API_BASE"] = self.bridge.url
+            key = self._key()
+            port = self._start(img, env, key[0], bridged=spec is not None)
+        except StartFailed as exc:
+            self._close_bridge()
+            self._repo.set_bundled("failed", scrub(str(exc)), expect=("starting",))
+            return
+        still_local = (self._repo.service_setting("literature") or {}).get("mode") == "local"
+        if not still_local or not self._repo.set_bundled("ready", port=port, key=key,
+                                                         expect=("starting",)):
+            # Stopped, switched to remote or re-requested while this ran: what it started
+            # must not keep running with the LLM key (review of slice 4, MAJOR-2). A newer
+            # start brings the database back up itself.
+            self._remove_backend()
+            self._docker(["stop", "-t", "10", self.names.db], None)
+            self._close_bridge()
+
+    def _close_bridge(self) -> None:
+        if self.bridge is not None:
+            self.bridge.close()
+            self.bridge = None
+
+    def _desktop(self) -> bool:
+        code, out = self._docker(["info", "--format", "{{.OperatingSystem}}"], None)
+        return code == 0 and "docker desktop" in out.lower()
+
+    def _gateway(self) -> str:
+        n = self.names
+        if self._docker(["network", "inspect", n.network], None)[0] != 0:
+            self._ok(["network", "create", "--label", f"puremethod.tenant={n.network}",
+                      n.network])
+        out = self._ok(["network", "inspect", "-f", "{{(index .IPAM.Config 0).Gateway}}",
+                        n.network]).strip()
+        if not out:
+            raise StartFailed("cannot find the bundled network's gateway address")
+        return out
+
+    def _bridge(self, spec: dict[str, Any], lookup: Callable[[str], str]) -> Bridge:
+        desktop = self._desktop()
+        bind = "127.0.0.1" if desktop else self._gateway()
+        host = DOCKER_HOST_NAME if desktop else bind
+        if "local_port" in spec:
+            if desktop:
+                return Bridge(host, int(spec["local_port"]))
+            relay = tunnels.Relay(int(spec["local_port"]), bind)
+            return Bridge(host, relay.open(), relay)
+        ssh = spec["ssh"]
+        tunnel = tunnels.Tunnel(list(ssh["hops"]), int(ssh["remote_port"]), lookup, bind)
+        return Bridge(host, tunnel.open(), tunnel)
+
+    def keep_open(self, sleep: Callable[[float], None] = time.sleep) -> None:
+        """While the backend runs on this bridge, keep it open (08 §5 step 12): until the
+        service is stopped or restarted, or the backend container is gone."""
+        try:
+            while self.bridge is not None:
+                row = self._repo.bundled() or {}
+                if row.get("state") != "ready" or \
+                        self._docker(["container", "inspect", self.names.backend], None)[0] != 0:
+                    return
+                sleep(KEEP_ALIVE_POLL_S)
+        finally:
+            self._close_bridge()
+
+    def _remove_backend(self) -> None:
+        self._docker(["rm", "-f", self.names.backend], None)
+
+    def _key(self) -> tuple[str, str]:
+        """(sha256, credential id) of the PureScholar key. Generated here, sealed as the
+        `purescholar` credential, and never decrypted again (KB-031). Regenerated whenever the
+        stored `purescholar` credential is not the one generated (review, BLOCKER-1)."""
+        row = self._repo.bundled() or {}
+        cred = next((c for c in self._repo.list_credentials()
+                     if c.name == PURESCHOLAR_CREDENTIAL), None)
+        if cred is not None and row.get("key_sha256") and row.get("key_credential_id") == cred.id:
+            return str(row["key_sha256"]), cred.id
+        token = TOKEN_PREFIX + secrets.token_urlsafe(32)
+        if cred is not None:
+            self._repo.delete_credential(cred.id)
+        made = self._repo.add_credential(PURESCHOLAR_CREDENTIAL, "purescholar-key", token)
+        key = (hashlib.sha256(token.encode()).hexdigest(), made.id)
+        self._repo.set_bundled("starting", key=key, expect=("starting",))
+        return key
+
+    def _ok(self, args: list[str], env: dict[str, str] | None = None) -> str:
+        code, out = self._docker(args, env)
+        if code != 0:
+            first = out.splitlines()[0] if out else f"exit {code}"
+            raise StartFailed(f"docker {args[0]} failed: {first}")
+        return out
+
+    def _start(self, img: str, gen_env: dict[str, str], digest: str,
+               bridged: bool = False) -> int:
+        n, label = self.names, f"puremethod.tenant={self.names.network}"
+        if self._docker(["network", "inspect", n.network], None)[0] != 0:
+            self._ok(["network", "create", "--label", label, n.network])
+        pw = db_password(self._settings.master_key)
+        if self._docker(["container", "inspect", n.db], None)[0] != 0:
+            self._ok(["run", "-d", "--name", n.db, "--network", n.network, "--label", label,
+                      "-e", "POSTGRES_PASSWORD", "-e", "POSTGRES_DB=purechain",
+                      "-v", f"{n.volume}:/var/lib/postgresql/data", PGVECTOR_IMAGE],
+                     {"POSTGRES_PASSWORD": pw})
+        else:
+            self._ok(["start", n.db])
+        self._remove_backend()  # new settings take effect on each start
+        port = _free_port()
+        env = {**gen_env, "DATABASE_URL": f"postgresql://postgres:{pw}@{n.db}:5432/purechain",
+               "BOOTSTRAP_API_KEY_SHA256": digest}
+        args = ["run", "-d", "--name", n.backend, "--network", n.network, "--label", label,
+                "-p", f"127.0.0.1:{port}:8000", "-e", "HEADLESS_MODE=true",
+                "-e", "BOOTSTRAP_LAB_NAME=Local", "-e", "ENABLE_EXTERNAL_RETRIEVAL=true"]
+        if bridged:  # Docker Engine needs the name mapped; Docker Desktop has it already
+            args += ["--add-host", f"{DOCKER_HOST_NAME}:host-gateway"]
+        for name in sorted(env):
+            args += ["-e", name]  # the value comes from the subprocess environment
+        self._ok([*args, img], env)
+        end = self._clock() + self._timeout
+        while self._clock() < end:
+            code, health = self._docker(["inspect", "-f",
+                                         "{{.State.Status}} {{.State.Health.Status}}",
+                                         n.backend], None)
+            health = health.strip()
+            if code == 0 and health == "running healthy":
+                return port
+            if code != 0 or health.startswith(("exited", "dead")) or \
+                    health.endswith("unhealthy"):
+                self._remove_backend()
+                raise StartFailed(f"the bundled PureScholar did not start; see "
+                                  f"`docker logs {n.backend}` before saving the setting again")
+            self._sleep(POLL_S)
+        self._remove_backend()
+        raise StartFailed(f"the bundled PureScholar was not healthy within "
+                          f"{int(self._timeout)} s")
+
+
+# ---- the server's start and shutdown (launcher side; crosses tenants, ids only) ------------
+
+def local_tenants(db: Database) -> list[str]:
+    with db.tx() as c:
+        rows = c.execute("SELECT tenant_id, config FROM service_settings "
+                         "WHERE service = 'literature'")
+    return [str(t) for t, cfg in rows if json.loads(cfg).get("mode") == "local"]
+
+
+def start_all(db: Database) -> None:
+    for tid in local_tenants(db):
+        request_start(TenantRepo(db, tid))
+
+
+def stop_tenant(repo: TenantRepo, reason: str, docker: Docker | None = None) -> None:
+    """Records the stop first, so a start still running cannot mark the service ready, then
+    removes the backend (and the LLM key in its Docker state) and stops the database. The
+    database's volume, and so the corpus, stays. No decryption."""
+    repo.set_bundled("stopped", reason)
+    n = Names.of(repo.tenant_id)
+    _docker(docker)(["rm", "-f", n.backend], None)
+    _docker(docker)(["stop", "-t", "10", n.db], None)
+
+
+def stop_all(db: Database, docker: Docker | None = None) -> None:
+    """Stops every tenant's bundled PureScholar that has state, whatever its mode now
+    (`puremethod stop`, Ctrl+C)."""
+    with db.tx() as c:
+        tenants = [str(r[0]) for r in c.execute("SELECT tenant_id FROM bundled_services")]
+    for tid in tenants:
+        stop_tenant(TenantRepo(db, tid), "puremethod is not running", docker)