secondshift 0.1.0b12__py3-none-any.whl

secondshift/__init__.py

@@ -0,0 +1 @@
+"""SecondShift: run repository agent skills safely, on schedule."""

secondshift/__main__.py

@@ -0,0 +1,3 @@
+from secondshift.cli import main
+
+main()

secondshift/cli.py

@@ -0,0 +1,17 @@
+"""The `secondshift` command. It runs Django management commands.
+
+Installed, it defaults to the local environment (`secondshift up`). A
+checkout's manage.py defaults to dev.
+"""
+
+import sys
+
+from django.core.management import execute_from_command_line
+
+from secondshift.config.app import select_settings
+from secondshift.config.constants import Environment
+
+
+def main(default_environment: Environment = Environment.LOCAL) -> None:
+    select_settings(default_environment)
+    execute_from_command_line(sys.argv)

secondshift/config/api.py

@@ -0,0 +1,23 @@
+"""Compose the public API from routers owned by each Django app."""
+
+from django.http import HttpRequest, HttpResponse
+from ninja import NinjaAPI
+
+from secondshift.workspaces.access import AccessDenied
+
+api = NinjaAPI(title="SecondShift API", version="1.0")
+for app in (
+    "core",
+    "jobs",
+    "runs",
+    "triggers",
+    "workspaces",
+    "repositories",
+    "connections",
+):
+    api.add_router("", f"secondshift.{app}.api.router")
+
+
+@api.exception_handler(AccessDenied)
+def access_denied(request: HttpRequest, error: AccessDenied) -> HttpResponse:
+    return api.create_response(request, {"detail": str(error)}, status=403)

secondshift/config/app.py

@@ -0,0 +1,62 @@
+"""Server entry points for the web app, the model gateway and the runner.
+
+Start an HTTP role with SECONDSHIFT_SERVICE set to web, gateway or runner:
+
+    gunicorn --config python:secondshift.config.gunicorn
+"""
+
+import os
+
+from django.core.asgi import get_asgi_application
+from django.core.handlers.asgi import ASGIHandler
+from django.core.handlers.wsgi import WSGIHandler
+from django.core.wsgi import get_wsgi_application
+
+from secondshift.config.constants import (
+    ENVIRONMENT_VAR,
+    RUNNER_SETTINGS,
+    SERVICE_VAR,
+    SETTINGS_MODULE_VAR,
+    Environment,
+    Service,
+    settings_module,
+)
+
+
+def select_settings(default: Environment) -> None:
+    """Use SECONDSHIFT_ENV, or the default, to pick the settings module."""
+    environment = Environment(os.environ.setdefault(ENVIRONMENT_VAR, default))
+    os.environ.setdefault(SETTINGS_MODULE_VAR, settings_module(environment))
+
+
+def configure(service: Service) -> None:
+    os.environ[SERVICE_VAR] = service
+    if service == Service.RUNNER:
+        # Always its own settings, so it never loads the control plane's keys.
+        os.environ[SETTINGS_MODULE_VAR] = RUNNER_SETTINGS
+    else:
+        select_settings(default=Environment.PRODUCTION)
+
+
+def started(service: Service) -> None:
+    if service == Service.RUNNER:
+        # Imported here because it needs settings, which are chosen above.
+        from secondshift.runner.services import get_runner_service  # noqa: PLC0415
+
+        get_runner_service().verify_configuration()
+
+
+def wsgi(name: str = Service.WEB) -> WSGIHandler:
+    service = Service(name)
+    configure(service)
+    application = get_wsgi_application()
+    started(service)
+    return application
+
+
+def asgi(name: str = Service.WEB) -> ASGIHandler:
+    service = Service(name)
+    configure(service)
+    application = get_asgi_application()
+    started(service)
+    return application

secondshift/config/constants.py

@@ -0,0 +1,279 @@
+"""Names shared by the settings modules, entry points and the launcher.
+
+The runner's settings must never import the control plane's settings, which
+read its keys. Values both need live here instead.
+"""
+
+from enum import StrEnum
+from urllib.parse import urlsplit
+
+# Git object formats supported by repository snapshots and execution plans.
+COMMIT_SHA_PATTERN = r"[0-9a-f]{40}|[0-9a-f]{64}"
+
+EXECUTE_RUN_WORKFLOW = "secondshift.execute_run"
+SCHEDULED_JOB_WORKFLOW = "secondshift.scheduled_job"
+RETRY_NOTIFICATION_WORKFLOW = "secondshift.retry_notification"
+RETRY_PULL_REQUEST_WORKFLOW = "secondshift.retry_pull_request"
+RETRY_ISSUES_WORKFLOW = "secondshift.retry_issues"
+
+ENVIRONMENT_VAR = "SECONDSHIFT_ENV"
+SETTINGS_MODULE_VAR = "DJANGO_SETTINGS_MODULE"
+SERVICE_VAR = "SECONDSHIFT_SERVICE"
+
+
+GUNICORN_CONFIG = "python:secondshift.config.gunicorn"
+
+# How agent containers reach services on the Docker host.
+HOST_ALIAS = "host.docker.internal"
+# `secondshift up` builds this tag from the installed package.
+LOCAL_AGENT_TAG = "secondshift-agent:local"
+LOCAL_GATEWAY_URL = "http://127.0.0.1:8001"
+
+
+# The gateway's MCP endpoint for subscription agents. Deploy files spell it out too.
+AGENT_BROKER_PATH = "gateway/agent/mcp"
+
+
+def local_agent_broker_url(gateway_url: str) -> str:
+    """The gateway's agent broker, as agent containers on this host reach it."""
+    port = urlsplit(gateway_url).port or 80
+    return f"http://{HOST_ALIAS}:{port}/{AGENT_BROKER_PATH}"
+
+
+class ArtifactStorage(StrEnum):
+    FILESYSTEM = "filesystem"
+    S3 = "s3"
+
+
+class AppEnv(StrEnum):
+    AGENT_IMAGE = "SECONDSHIFT_AGENT_IMAGE"
+    AGENT_RESOLV_CONF = "SECONDSHIFT_AGENT_RESOLV_CONF"
+    AGENT_NETWORK = "SECONDSHIFT_AGENT_NETWORK"
+    AGENT_BROKER_URL = "SECONDSHIFT_AGENT_BROKER_URL"
+    DATA_DIR = "SECONDSHIFT_DATA_DIR"
+    RUNNER_RUNTIME = "SECONDSHIFT_RUNNER_RUNTIME"
+    RUNNER_IMAGE = "SECONDSHIFT_RUNNER_IMAGE"
+    RUNNER_SERVICE_URL = "SECONDSHIFT_RUNNER_SERVICE_URL"
+    RUNNER_SERVICE_TOKEN = "SECONDSHIFT_RUNNER_SERVICE_TOKEN"
+    MODEL_GATEWAY_URL = "SECONDSHIFT_MODEL_GATEWAY_URL"
+    RUNNER_WORK_ROOT = "SECONDSHIFT_RUNNER_WORK_ROOT"
+    SOURCE_CACHE_ROOT = "SECONDSHIFT_SOURCE_CACHE_ROOT"
+    SOURCE_CACHE_MAX_BYTES = "SECONDSHIFT_SOURCE_CACHE_MAX_BYTES"
+    EXTERNAL_SKILLS_ENABLED = "SECONDSHIFT_EXTERNAL_SKILLS_ENABLED"
+    ARTIFACT_STORAGE = "SECONDSHIFT_ARTIFACT_STORAGE"
+    RUN_OUTPUT_MAX_BYTES = "SECONDSHIFT_RUN_OUTPUT_MAX_BYTES"
+    RUN_RETENTION_DAYS = "SECONDSHIFT_RUN_RETENTION_DAYS"
+    REPOSITORY_SYNC_INTERVAL_SECONDS = "SECONDSHIFT_REPOSITORY_SYNC_INTERVAL_SECONDS"
+
+    SECRET_KEY = "SECONDSHIFT_SECRET_KEY"
+    ENCRYPTION_KEY = "SECONDSHIFT_ENCRYPTION_KEY"
+    DATABASE_URL = "SECONDSHIFT_DATABASE_URL"
+    CACHE_URL = "SECONDSHIFT_CACHE_URL"
+    PUBLIC_URL = "SECONDSHIFT_PUBLIC_URL"
+    DEBUG = "SECONDSHIFT_DEBUG"
+    ALLOWED_HOSTS = "SECONDSHIFT_ALLOWED_HOSTS"
+    CSRF_TRUSTED_ORIGINS = "SECONDSHIFT_CSRF_TRUSTED_ORIGINS"
+    LOG_LEVEL = "SECONDSHIFT_LOG_LEVEL"
+    DB_CONN_MAX_AGE_SECONDS = "SECONDSHIFT_DB_CONN_MAX_AGE_SECONDS"
+    WORKFLOW_DATABASE_URL = "SECONDSHIFT_WORKFLOW_DATABASE_URL"
+    RUN_CONCURRENCY = "SECONDSHIFT_RUN_CONCURRENCY"
+    RUN_GLOBAL_CONCURRENCY = "SECONDSHIFT_RUN_GLOBAL_CONCURRENCY"
+    TASK_QUEUE_LIMIT = "SECONDSHIFT_TASK_QUEUE_LIMIT"
+    RUNNER_ALLOWED_HOSTS = "SECONDSHIFT_RUNNER_ALLOWED_HOSTS"
+    RUNNER_DATABASE_URL = "SECONDSHIFT_RUNNER_DATABASE_URL"
+    RUNNER_DB_CONN_MAX_AGE_SECONDS = "SECONDSHIFT_RUNNER_DB_CONN_MAX_AGE_SECONDS"
+    EMAIL_URL = "SECONDSHIFT_EMAIL_URL"
+    FROM_EMAIL = "SECONDSHIFT_FROM_EMAIL"
+
+    HTTP_BIND = "SECONDSHIFT_HTTP_BIND"
+    HTTP_PROCESSES = "SECONDSHIFT_HTTP_PROCESSES"
+    HTTP_TIMEOUT_SECONDS = "SECONDSHIFT_HTTP_TIMEOUT_SECONDS"
+    HTTP_GRACEFUL_TIMEOUT_SECONDS = "SECONDSHIFT_HTTP_GRACEFUL_TIMEOUT_SECONDS"
+    HTTP_LOG_LEVEL = "SECONDSHIFT_HTTP_LOG_LEVEL"
+    HTTP_ACCESS_LOG = "SECONDSHIFT_HTTP_ACCESS_LOG"
+
+
+GITHUB_HOST = "github.com"
+GITHUB_BASE_URL = f"https://{GITHUB_HOST}"
+GITHUB_SSH_PREFIX = f"git@{GITHUB_HOST}:"
+GITHUB_REPOSITORY_PATTERN = r"[A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+"
+GITHUB_API_URL = "https://api.github.com"
+GITHUB_OAUTH_URL = f"{GITHUB_BASE_URL}/login/oauth"
+# The REST API version every request asks for.
+GITHUB_API_VERSION = "2022-11-28"
+# Fine-grained tokens are limited to chosen repositories. Classic tokens are not.
+GITHUB_FINE_GRAINED_TOKEN_PATTERN = r"github_pat_[A-Za-z0-9_]+"
+GITHUB_TOKEN_HINT = "Enter a fine-grained GitHub token. It starts with github_pat_."
+# Limits for the files of one commit that a run gets. The control plane checks
+# them while it builds a snapshot, and the runner checks them again.
+MAX_SOURCE_SNAPSHOT_BYTES = 64 * 1024 * 1024
+MAX_SOURCE_UNPACKED_BYTES = 1024 * 1024 * 1024
+MAX_SOURCE_FILES = 200_000
+# Limits for what a run leaves behind: the agent's file changes, and the files
+# it saves in /outputs. The runner applies them, and the control plane again.
+MAX_CHANGES_BYTES = 20 * 1024 * 1024
+MAX_OUTPUT_FILES = 100
+MAX_OUTPUT_BYTES = 100 * 1024 * 1024
+# Earlier runs' saved files that one run gets back. Uploaded like a snapshot,
+# so it stays under that limit even when the files do not compress.
+MAX_HISTORY_FILES_BYTES = 48 * 1024 * 1024
+# Issues one run may open. A weekly review should file a few, not dozens.
+MAX_RUN_ISSUES = 10
+# Where a sandbox finds the folder for files it wants to hand back.
+SANDBOX_OUTPUTS_DIR = "/outputs"
+# Where a sandbox finds the files its job's earlier runs saved. Read-only.
+SANDBOX_HISTORY_DIR = "/history"
+# Where a sandbox finds a skill from another repository. Read-only.
+SANDBOX_SKILL_DIR = "/skill"
+# Limits for a skill from another repository: its SKILL.md and the files beside it.
+MAX_SKILL_FILES = 500
+MAX_SKILL_UNPACKED_BYTES = 20 * 1024 * 1024
+MAX_SKILL_SNAPSHOT_BYTES = 10 * 1024 * 1024
+GITHUB_MCP_URL = "https://api.githubcopilot.com/mcp/readonly"
+# The model gateway refuses a run past its token budget with this message.
+TOKEN_BUDGET_MESSAGE = "This run has used its token budget."
+
+
+class TriggerKind(StrEnum):
+    """Events a repository may ask to start a job. Never a URL or a secret."""
+
+    WEBHOOK = "webhook"
+
+
+class ModelFamily(StrEnum):
+    """The API shape a model provider speaks. Names the gateway's URL path."""
+
+    ANTHROPIC = "anthropic"
+    OPENAI = "openai"
+
+
+class RunStart(StrEnum):
+    """What started a run."""
+
+    SCHEDULE = "schedule"
+    MANUAL = "manual"
+    WEBHOOK = "webhook"
+    MCP = "mcp"
+
+
+# How much of a report a run keeps as its summary. Webhooks send the summary.
+SUMMARY_MAX_CHARS = 4_000
+
+
+class GitHubMCPTool(StrEnum):
+    """Read tools for pull requests, commits, and Actions runs.
+
+    Actions tools that trigger runs, list artifacts, or return download links
+    are left out or blocked by method.
+    """
+
+    SEARCH_PULL_REQUESTS = "search_pull_requests"
+    PULL_REQUEST_READ = "pull_request_read"
+    LIST_COMMITS = "list_commits"
+    GET_COMMIT = "get_commit"
+    ACTIONS_LIST = "actions_list"
+    ACTIONS_GET = "actions_get"
+    GET_JOB_LOGS = "get_job_logs"
+
+
+GITHUB_MCP_TOOLS = tuple(GitHubMCPTool)
+
+SENTRY_MCP_URL = "https://mcp.sentry.dev/mcp"
+# Sentry organization and project slugs.
+SENTRY_SLUG_PATTERN = r"[a-z0-9][a-z0-9_\-]{0,63}"
+
+
+class SentryMCPTool(StrEnum):
+    """Read tools for errors, issues, and traces.
+
+    The search tools pass their query to Sentry's own search agent. Replays,
+    logs, and profiles are left out because they often hold personal data.
+    """
+
+    FIND_PROJECTS = "find_projects"
+    SEARCH_ISSUES = "search_issues"
+    SEARCH_ERRORS = "search_errors"
+    SEARCH_TRACES = "search_traces"
+    GET_SENTRY_RESOURCE = "get_sentry_resource"
+
+
+SENTRY_MCP_TOOLS = tuple(SentryMCPTool)
+
+
+class Environment(StrEnum):
+    """Where SecondShift runs. Each one has a settings module of the same name."""
+
+    PRODUCTION = "production"
+    LOCAL = "local"
+    DEV = "dev"
+    TEST = "test"
+
+
+class Service(StrEnum):
+    """The separately started parts of SecondShift."""
+
+    WEB = "web"
+    GATEWAY = "gateway"
+    RUNNER = "runner"
+    WORKER = "worker"
+
+
+def settings_module(name: str) -> str:
+    return f"secondshift.config.settings.{name}"
+
+
+class SandboxRuntime(StrEnum):
+    """The Docker runtime that runs command sandboxes."""
+
+    DOCKER = "docker"
+    GVISOR = "runsc"
+
+
+class RunSandbox(StrEnum):
+    """What a run records as its sandbox."""
+
+    PENDING = "pending-runner-service"
+    ISOLATED_RUNNER = "isolated-runner"
+
+
+RUNNER_SETTINGS = settings_module(Service.RUNNER)
+
+# Docker's official Python image, pinned by digest so a rebuilt tag can't change
+# what runs. The agent's tools need only `find`, `cat` and `grep`. Git runs in
+# the runner, not the sandbox. Operators override it with SECONDSHIFT_RUNNER_IMAGE.
+# To update, run `docker buildx imagetools inspect python:3.13-slim` and copy
+# the index digest.
+DEFAULT_SANDBOX_IMAGE = (
+    "python:3.13-slim"
+    "@sha256:57b29a7c050c4e679e4bea572e14b3965cf4b5839de2da49d55e49ffc4024f39"
+)
+
+# The repository file that lists jobs, at the repository root.
+MANIFEST_FILE = ".secondshift.yaml"
+
+# How much of a skill file a job keeps for people to read in the dashboard.
+MAX_SKILL_PREVIEW_CHARS = 200_000
+
+
+class AgentBackend(StrEnum):
+    """Who runs the agent: SecondShift's own loop, or a subscription CLI."""
+
+    PYDANTIC = "pydantic"
+    CLAUDE_CODE = "claude_code"
+    CODEX = "codex"
+
+    @property
+    def uses_model_api(self) -> bool:
+        """Runs call a model provider through SecondShift's gateway. The CLIs
+        call their provider directly with the subscription login."""
+        return self is AgentBackend.PYDANTIC
+
+    @property
+    def starts_subagents(self) -> bool:
+        """Runs can start sub-agents when the job allows them."""
+        return self is not AgentBackend.CODEX
+
+    @property
+    def limits_model_calls(self) -> bool:
+        """Runs stop at the run's model-call limit."""
+        return self is not AgentBackend.CODEX

secondshift/config/container_env.py

@@ -0,0 +1,118 @@
+"""Generate private per-role env files for a new container installation."""
+
+import argparse
+import os
+import re
+import secrets
+from pathlib import Path
+
+from cryptography.fernet import Fernet
+
+from secondshift.config.constants import (
+    ENVIRONMENT_VAR,
+    SERVICE_VAR,
+    AppEnv,
+    Environment,
+    SandboxRuntime,
+    Service,
+)
+
+ROLE_FILES = {role: f"{role}.env" for role in Service}
+
+
+def generate_environment(hostname: str, directory: Path) -> None:
+    if len(hostname) > 253 or not all(
+        re.fullmatch(r"[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?", label)
+        for label in hostname.split(".")
+    ):
+        raise ValueError(
+            "Use a DNS hostname without a scheme, port, path or credentials"
+        )
+    directory = directory.resolve()
+    directory.mkdir(parents=True, exist_ok=True)
+    # Never overwrite existing configuration or replace its keys.
+    if any((directory / name).exists() for name in [*ROLE_FILES.values(), ".env"]):
+        raise FileExistsError(
+            "Configuration already exists; reuse it rather than generating new keys"
+        )
+    common = {
+        AppEnv.SECRET_KEY: secrets.token_urlsafe(48),
+        AppEnv.ENCRYPTION_KEY: Fernet.generate_key().decode(),
+        AppEnv.DATABASE_URL: "sqlite:////var/lib/secondshift/control.sqlite3",
+    }
+    public = {
+        AppEnv.PUBLIC_URL: f"https://{hostname.lower()}",
+        AppEnv.RUNNER_RUNTIME: SandboxRuntime.GVISOR,
+    }
+    token = secrets.token_urlsafe(48)
+    runner = directory / "runner"
+    runner.mkdir(mode=0o700, exist_ok=True)
+    configs = {
+        Service.WEB: {
+            **common,
+            **public,
+            AppEnv.RUNNER_SERVICE_URL: "http://secondshift-runner:8002",
+            AppEnv.RUNNER_SERVICE_TOKEN: token,
+            AppEnv.HTTP_TIMEOUT_SECONDS: "300",
+        },
+        Service.GATEWAY: {
+            **common,
+            # The agent broker runs workspace tools for subscription runs.
+            AppEnv.RUNNER_SERVICE_URL: "http://secondshift-runner:8002",
+            AppEnv.RUNNER_SERVICE_TOKEN: token,
+            AppEnv.ALLOWED_HOSTS: "secondshift-gateway",
+            AppEnv.HTTP_BIND: "0.0.0.0:8001",
+            AppEnv.HTTP_GRACEFUL_TIMEOUT_SECONDS: "600",
+        },
+        Service.WORKER: {
+            **common,
+            **public,
+            AppEnv.RUNNER_SERVICE_URL: "http://secondshift-runner:8002",
+            AppEnv.RUNNER_SERVICE_TOKEN: token,
+            AppEnv.MODEL_GATEWAY_URL: "http://secondshift-gateway:8001",
+        },
+        Service.RUNNER: {
+            AppEnv.HTTP_BIND: "0.0.0.0:8002",
+            AppEnv.HTTP_PROCESSES: "1",
+            AppEnv.HTTP_TIMEOUT_SECONDS: "180",
+            AppEnv.RUNNER_ALLOWED_HOSTS: "secondshift-runner",
+            AppEnv.RUNNER_SERVICE_TOKEN: token,
+            AppEnv.RUNNER_RUNTIME: SandboxRuntime.GVISOR,
+            AppEnv.DATA_DIR: str(runner),
+            AppEnv.RUNNER_WORK_ROOT: str(runner),
+        },
+    }
+    for role, values in configs.items():
+        descriptor = os.open(
+            directory / ROLE_FILES[role], os.O_WRONLY | os.O_CREAT | os.O_EXCL, 0o600
+        )
+        with os.fdopen(descriptor, "w") as output:
+            output.write(f"{ENVIRONMENT_VAR}={Environment.PRODUCTION}\n")
+            output.write(f"{SERVICE_VAR}={role}\n")
+            for name, value in values.items():
+                output.write(f"{name}={value}\n")
+
+
+def main() -> None:
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument(
+        "--hostname", required=True, help="Public DNS hostname, without https://"
+    )
+    parser.add_argument(
+        "--directory",
+        type=Path,
+        default=Path.cwd(),
+        help="Output directory (default: current directory)",
+    )
+    args = parser.parse_args()
+    try:
+        generate_environment(args.hostname, args.directory)
+    except (ValueError, OSError) as error:
+        parser.exit(1, f"{error}\n")
+    print(
+        "Created web.env, gateway.env, worker.env and runner.env. Keep these files private."
+    )
+
+
+if __name__ == "__main__":
+    main()

secondshift/config/first_run.py

@@ -0,0 +1,40 @@
+"""First start of a development install: create the data folder and its keys."""
+
+import fcntl
+import os
+import secrets
+from pathlib import Path
+
+from cryptography.fernet import Fernet
+
+from secondshift.config.constants import AppEnv
+
+
+def write_generated_env(data_dir: Path) -> None:
+    """Create the data folder with fresh keys in its .env, once.
+
+    The runner gets only its token, in runner.env. A lock keeps processes
+    starting together from writing different keys.
+    """
+    data_dir.mkdir(parents=True, exist_ok=True, mode=0o700)
+    with open(data_dir / ".lock", "w") as lock:
+        fcntl.flock(lock, fcntl.LOCK_EX)
+        if (data_dir / ".env").exists():
+            return
+        token = secrets.token_urlsafe(48)
+        files = {
+            "runner.env": f"SECONDSHIFT_RUNNER_SERVICE_TOKEN={token}\n",
+            ".env": (
+                "# Generated on first start. Back it up: SECONDSHIFT_ENCRYPTION_KEY\n"
+                "# decrypts stored connection credentials.\n"
+                f"{AppEnv.SECRET_KEY}={secrets.token_urlsafe(48)}\n"
+                f"{AppEnv.ENCRYPTION_KEY}={Fernet.generate_key().decode()}\n"
+                f"SECONDSHIFT_RUNNER_SERVICE_TOKEN={token}\n"
+            ),
+        }
+        for name, content in files.items():  # .env last: it marks completion
+            descriptor = os.open(
+                data_dir / name, os.O_WRONLY | os.O_CREAT | os.O_TRUNC, 0o600
+            )
+            with os.fdopen(descriptor, "w") as file:
+                file.write(content)

secondshift/config/formatting.py

@@ -0,0 +1,5 @@
+def duration_label(seconds: int) -> str:
+    if seconds % 60 == 0:
+        minutes = seconds // 60
+        return f"{minutes} minute" if minutes == 1 else f"{minutes} minutes"
+    return f"{seconds} seconds"

secondshift/config/gunicorn.py

@@ -0,0 +1,31 @@
+"""Shared Gunicorn options, configured by each process environment."""
+
+import os
+
+from environ import Env
+
+from secondshift.config.constants import SERVICE_VAR, AppEnv, Service
+
+service = Service(os.environ.get(SERVICE_VAR, Service.WEB))
+if service == Service.WORKER:
+    raise ValueError(
+        "The worker role runs python manage.py run_dbos_worker, not Gunicorn"
+    )
+env = Env()
+
+# Both hold long requests open (model streams, agent runs) while serving others.
+async_http = service in (Service.GATEWAY, Service.RUNNER)
+factory = "asgi" if async_http else "wsgi"
+wsgi_app = f"secondshift.config.app:{factory}('{service}')"
+worker_class = "uvicorn_worker.UvicornWorker" if async_http else "sync"
+# One address, or several separated by commas.
+bind = env.list(AppEnv.HTTP_BIND, default=["0.0.0.0:8000"])
+workers = env.int(AppEnv.HTTP_PROCESSES, default=2)
+timeout = env.int(AppEnv.HTTP_TIMEOUT_SECONDS, default=30)
+graceful_timeout = env.int(AppEnv.HTTP_GRACEFUL_TIMEOUT_SECONDS, default=30)
+loglevel = env.str(AppEnv.HTTP_LOG_LEVEL, default="info").lower()
+accesslog = env.str(AppEnv.HTTP_ACCESS_LOG, default="-") or None
+if workers < 1 or timeout < 1 or graceful_timeout < 1:
+    raise ValueError("Gunicorn worker count and timeouts must be positive")
+# Services may share a data directory. Never compete for a shared control socket.
+control_socket_disable = True

secondshift/config/logging.py

@@ -0,0 +1,40 @@
+"""Shared logging policy for the control plane and isolated runner."""
+
+from typing import Any
+
+
+def logging_config(level: str, service: str) -> dict[str, Any]:
+    """Route application and Django records through one console handler."""
+    return {
+        "version": 1,
+        "disable_existing_loggers": False,
+        "formatters": {
+            "console": {
+                "format": (
+                    "{asctime} {levelname} " + service + "[{process}] {name}: {message}"
+                ),
+                "style": "{",
+            }
+        },
+        "handlers": {
+            "console": {"class": "logging.StreamHandler", "formatter": "console"},
+            "null": {"class": "logging.NullHandler"},
+        },
+        "root": {"handlers": ["console"], "level": level},
+        "loggers": {
+            # Replace Django's default handlers to avoid duplicate output and
+            # let LOG_LEVEL apply to requests and development server messages.
+            "django": {"handlers": [], "level": "NOTSET", "propagate": True},
+            "django.server": {
+                "handlers": [],
+                "level": "NOTSET",
+                "propagate": True,
+            },
+            # Request URLs may contain provider or webhook credentials.
+            "httpx": {"level": "WARNING"},
+            "httpcore": {"level": "WARNING"},
+            # The SDK can log raw payloads and session identifiers. The broker
+            # emits bounded audit events and sanitized errors instead.
+            "mcp": {"handlers": ["null"], "propagate": False},
+        },
+    }