simulo 0.32.0__tar.gz → 0.33.0__tar.gz

{simulo-0.32.0/src/simulo.egg-info → simulo-0.33.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: simulo
-Version: 0.32.0
+Version: 0.33.0
 Summary: Python SDK and CLI for cloud-native robotics simulation, reinforcement learning, and robot policy training on managed GPUs.
 Author-email: Simulo Team <team@simulo.ai>
 License: BSD-3-Clause
@@ -31,7 +31,7 @@ Classifier: Topic :: System :: Distributed Computing
 Classifier: Typing :: Typed
 Requires-Python: >=3.11
 Description-Content-Type: text/markdown
-Requires-Dist: simulo-interfaces<0.24,>=0.23.0
+Requires-Dist: simulo-interfaces<0.25,>=0.24.0
 Requires-Dist: mcap<2,>=1.3
 Requires-Dist: defusedxml>=0.7.1
 Requires-Dist: usd-core<27,>=26.5
@@ -94,7 +94,7 @@ simulo login
 cd mybot
 simulo run preview.py --frozen --strict-assets
 simulo run train.py --frozen --strict-assets
-simulo run play.py --policy policy_<job>:best --frozen --strict-assets
+simulo run play.py --policy <policy-id>:best --frozen --strict-assets
 ```
 
 `simulo create` writes a complete starter application to your machine without

{simulo-0.32.0 → simulo-0.33.0}/PYPI.md

@@ -38,7 +38,7 @@ simulo login
 cd mybot
 simulo run preview.py --frozen --strict-assets
 simulo run train.py --frozen --strict-assets
-simulo run play.py --policy policy_<job>:best --frozen --strict-assets
+simulo run play.py --policy <policy-id>:best --frozen --strict-assets
 ```
 
 `simulo create` writes a complete starter application to your machine without

{simulo-0.32.0 → simulo-0.33.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "simulo"
-version = "0.32.0"
+version = "0.33.0"
 description = "Python SDK and CLI for cloud-native robotics simulation, reinforcement learning, and robot policy training on managed GPUs."
 readme = "PYPI.md"
 requires-python = ">=3.11"
@@ -59,7 +59,7 @@ classifiers = [
 # mcap: used by `simulo recordings` to read back a downloaded recording and
 # verify it (message count) — MIT-licensed, deps only lz4+zstandard.
 dependencies = [
-    "simulo-interfaces>=0.23.0,<0.24",
+    "simulo-interfaces>=0.24.0,<0.25",
     "mcap>=1.3,<2",
     # Hardened XML parsing for URDF ingestion (USD Asset Catalogs, PR-12 fix
     # loop 2, security NIT): stdlib xml.etree.ElementTree relies on

{simulo-0.32.0 → simulo-0.33.0}/src/simulo/__init__.py

@@ -59,7 +59,9 @@ Three kinds of name live on ``simulo``:
   prebuilt place you bring, ``World.usd(...)``.)
 """
 
+import dis as _dis
 import pkgutil as _pkgutil
+import sys as _sys
 from typing import TYPE_CHECKING
 
 __path__ = _pkgutil.extend_path(__path__, __name__)
@@ -143,6 +145,8 @@ from simulo.interfaces.authoring import (
     LightConfig,
     PointMarker,
     PolicyCheckpoint,
+    PolicyInput,
+    PolicyInputSchema,
     PrimitiveShape,
     RigidPhysics,
     RoughTerrain,
@@ -188,6 +192,8 @@ __all__ = [
     "JobPublicId",
     "PolicyPublicId",
     "PolicyNetworkProtocol",
+    "PolicyInput",
+    "PolicyInputSchema",
     "RecordingPublicId",
     "OutputPublicId",
     "parse_job_public_id",
@@ -234,6 +240,8 @@ __all__ = [
     "PointMarker",
     # lazy, mode-aware (the learning names + save_output)
     "ActuatorGainsConfig",
+    "ArticulationConfig",
+    "JointConfig",
     "Camera",
     "CameraSpawnConfig",
     "ContactSensor",
@@ -283,6 +291,19 @@ __all__ = [
 ]
 
 
+def _is_from_import_lookup() -> bool:
+    """True when the running lookup is the ``IMPORT_FROM`` of ``from simulo import X``.
+
+    Attribute access and ``hasattr`` keep raising ``AttributeError``; only a ``from``
+    import needs the ``ImportError`` that carries the message. Any doubt answers False.
+    """
+    try:
+        caller = _sys._getframe(2)  # skip this helper and ``__getattr__``
+        return _dis.opname[caller.f_code.co_code[caller.f_lasti]] == "IMPORT_FROM"
+    except (ValueError, IndexError):
+        return False
+
+
 def __getattr__(name: str) -> object:
     """PEP 562 hook: lazily resolve the mode-aware learning names.
 
@@ -299,6 +320,10 @@ def __getattr__(name: str) -> object:
         "run": "simulo.run was removed. Use `simulo run train.py` instead.",
     }
     if name in removed_hints:
+        if _is_from_import_lookup():
+            # CPython swallows an AttributeError raised during ``from simulo import X``
+            # and reports a bare "cannot import name", so the pointer would be lost.
+            raise ImportError(removed_hints[name], name=__name__)
         raise AttributeError(removed_hints[name])
     raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
 
@@ -351,11 +376,11 @@ if TYPE_CHECKING:
     # ``simulo.interfaces.authoring`` (``CameraProtocol`` / ``PropProtocol``)
     # and both are instantiated, never subclassed (``simulo.Camera(width=640,
     # ...)``, ``simulo.Prop(shape)``), so each follows the "instantiated mirror
-    # -> facade" rule above exactly. The other 19 names
+    # -> facade" rule above exactly. The other names
     # have no TYPE_CHECKING alias, DELIBERATELY, per the rule's own "where none
     # exists, do not invent one" corollary:
     #   - ``CameraSpawnConfig`` / ``SensorOffset`` / ``RayPattern`` /
-    #     ``ActuatorGainsConfig`` / ``GripperState`` / ``GripperCommand`` /
+    #     ``GripperState`` / ``GripperCommand`` /
     #     ``Simulation`` have no contract Protocol at all — nothing to alias
     #     against.
     #   - ``ContactSensor`` / ``RayCaster`` / ``IMU`` / ``ForceTorqueSensor`` /
@@ -416,7 +441,10 @@ if TYPE_CHECKING:
     # ``simulo.interfaces.authoring`` class in both
     # modes, so these alias the real class — precise field/signature checking
     # (e.g. mypy rejects ``simulo.Pose(xyz="nope")``) instead of ``Any``.
+    from simulo.interfaces.authoring import ActuatorGainsConfig as ActuatorGainsConfig
+    from simulo.interfaces.authoring import ArticulationConfig as ArticulationConfig
     from simulo.interfaces.authoring import Entity as Entity
+    from simulo.interfaces.authoring import JointConfig as JointConfig
     from simulo.interfaces.authoring import Light as Light
     from simulo.interfaces.authoring import Material as Material
     from simulo.interfaces.authoring import Physics as Physics

{simulo-0.32.0 → simulo-0.33.0}/src/simulo/_client/_secure_downloads.py

@@ -2,7 +2,7 @@
 
 THE RACE THIS CLOSES. The bulk download path validates its assembled
 filename and the selected destination directory as PATH STRINGS
-(``_contained_bulk_download_destination`` in ``cli.py``: resolve, then
+(``_contained_bulk_download_destination`` in ``cli_downloads.py``: resolve, then
 ``relative_to``) before any bytes are fetched. The actual write — inside
 this client's checkpoint/output/recording download paths
 — re-derives the SAME destination from its path string again, after a
@@ -112,6 +112,7 @@ from __future__ import annotations
 
 import ctypes
 import errno
+import logging
 import os
 import secrets
 import stat as stat_module
@@ -136,7 +137,8 @@ class DestinationDirectoryError(OSError):
 
     An ``OSError`` subclass so every existing ``except (OSError, ValueError)``
     around a download write (``_download_and_report`` and its Model/Output
-    counterparts in ``cli.py``) already reports it as one clean CLI line;
+    counterparts in ``commands/jobs.py``, ``commands/policies.py``, and
+    ``commands/recordings.py``) already reports it as one clean CLI line;
     no caller needs a new except clause to handle this module's refusals.
     """
 
@@ -155,6 +157,38 @@ def _retained_temp_error(
     )
 
 
+def _write_failure_error(
+    destination_display_path: Path,
+    final_name: str,
+    temp_name: str,
+    exc: Exception,
+    *,
+    discarded: bool,
+    existing_final_preserved: bool = False,
+) -> DestinationDirectoryError:
+    """The error for a write that failed before publication.
+
+    When the temporary entry was removed the user needs only the reason; the
+    retained-entry wording is for the case where it could not be removed.
+    """
+    if not discarded:
+        return _retained_temp_error(
+            destination_display_path, temp_name, exc, existing_final_preserved=existing_final_preserved
+        )
+    if isinstance(exc, DestinationDirectoryError):
+        return exc
+    return DestinationDirectoryError(
+        f"Could not write {final_name!r} into {destination_display_path}: {exc}. " "The partial download was removed."
+    )
+
+
+def _existing_final_message(final_name: str, destination_display_path: Path) -> str:
+    return (
+        f"{final_name!r} already exists in {destination_display_path}; "
+        "remove it, or download it to another folder with -o DIR."
+    )
+
+
 def _close_fd_quietly(fd: int) -> None:
     try:
         os.close(fd)
@@ -194,8 +228,8 @@ _TEMP_NAME_ATTEMPTS = 64
 # or an existing final entry is left untouched.  ``link`` followed by
 # ``unlink`` cannot offer that postcondition because a process death between
 # those calls leaves both names behind.  Keep the optional libc binding at
-# module scope so unsupported libc/platform combinations are explicitly
-# refused rather than silently falling back to replacement.
+# module scope; a libc, platform or filesystem without the primitive falls back
+# to :func:`_publish_by_link`, which still never replaces an existing file.
 _AT_FDCWD = -100
 _RENAME_NOREPLACE = 1
 _RENAME_EXCL = 0x00000004
@@ -221,14 +255,16 @@ def _rename_noreplace(
     *,
     src_dir_fd: Optional[int] = None,
     dst_dir_fd: Optional[int] = None,
-) -> None:
+) -> bool:
     """Atomically publish *source* at absent *destination*, or fail closed.
 
     Linux uses ``renameat2(RENAME_NOREPLACE)`` and macOS uses
     ``renameatx_np(RENAME_EXCL)``.  Windows' native ``os.rename`` refuses an
-    existing destination. Other platforms deliberately refuse the
-    server-derived no-clobber path instead of using a two-name link/unlink
-    sequence or replacing an existing file. Explicit user file targets keep
+    existing destination. Where the platform, or the filesystem under the
+    destination (an NTFS or FAT mount), has no such primitive,
+    :func:`_publish_by_link` publishes without ever replacing an existing
+    file. Return ``True`` when linking leaves the temporary name for the caller
+    to discard after recording publication. Explicit user file targets keep
     using ``os.replace`` through ``replace_existing=True``.
     """
     if os.name == "nt":
@@ -237,7 +273,7 @@ def _rename_noreplace(
                 "This platform cannot atomically publish a server-named download through directory descriptors."
             )
         os.rename(source, destination)
-        return
+        return False
     if sys.platform.startswith("linux"):
         rename_function = _renameat2
         flag = _RENAME_NOREPLACE
@@ -248,9 +284,8 @@ def _rename_noreplace(
         rename_function = None
         flag = 0
     if rename_function is None:
-        raise DestinationDirectoryError(
-            "This platform cannot atomically publish a server-named download without replacing an existing file."
-        )
+        _publish_by_link(source, destination, src_dir_fd=src_dir_fd, dst_dir_fd=dst_dir_fd)
+        return True
     old_dir_fd = _AT_FDCWD if src_dir_fd is None else src_dir_fd
     new_dir_fd = _AT_FDCWD if dst_dir_fd is None else dst_dir_fd
     ctypes.set_errno(0)
@@ -262,17 +297,43 @@ def _rename_noreplace(
         flag,
     )
     if result == 0:
-        return
+        return False
     error_number = ctypes.get_errno()
     if error_number == errno.EEXIST:
         raise FileExistsError(error_number, os.strerror(error_number), destination)
-    if error_number in (errno.EINVAL, errno.ENOSYS, errno.EOPNOTSUPP):
-        raise DestinationDirectoryError(
-            "This filesystem cannot atomically publish a server-named download without replacing an existing file."
-        )
+    if error_number in (errno.EINVAL, errno.ENOSYS, errno.EOPNOTSUPP, errno.ENOTSUP):
+        # The filesystem (an NTFS or FAT mount, a network share) does not
+        # implement the no-replace flag.
+        _publish_by_link(source, destination, src_dir_fd=src_dir_fd, dst_dir_fd=dst_dir_fd)
+        return True
     raise OSError(error_number, os.strerror(error_number), destination)
 
 
+def _publish_by_link(
+    source: str,
+    destination: str,
+    *,
+    src_dir_fd: Optional[int] = None,
+    dst_dir_fd: Optional[int] = None,
+) -> None:
+    """Publish with an atomic no-clobber hard link.
+
+    Unlike an exclusive-create claim followed by replacement, ``link`` refuses
+    any occupied destination at publication time. The caller discards the
+    temporary name after recording publication, checking its identity first.
+    Filesystems without hard links are refused rather than risking replacement.
+    """
+    try:
+        os.link(source, destination, src_dir_fd=src_dir_fd, dst_dir_fd=dst_dir_fd, follow_symlinks=False)
+    except FileExistsError:
+        raise
+    except (OSError, NotImplementedError) as exc:
+        raise DestinationDirectoryError(
+            "This filesystem cannot safely publish a download without replacing an existing file: "
+            f"the atomic hard link failed ({exc}). Choose another download folder with -o DIR."
+        ) from exc
+
+
 def _random_temp_name(final_name: str) -> str:
     """One candidate temp-file name for ``final_name``, unpredictable
     enough that an attacker cannot pre-plant a symlink at it — the
@@ -362,19 +423,62 @@ class DestinationDirectory:
         A same-directory temporary file is written, flushed, and ``fsync``'d,
         then published atomically. With ``replace_existing=True`` it replaces
         a prior complete entry; otherwise publication fails if *any* final
-        entry already exists. Any failure after temporary-file creation may
-        leave that mode-0600 ``.part`` entry behind. No backend deletes it
-        automatically because a pathname can be replaced before cleanup.
-        Ordinary write and publication errors name the temporary entry and ask
-        the operator to locate and verify it before manual cleanup.
-        ``KeyboardInterrupt`` and
-        ``SystemExit`` are re-raised unchanged; their possible residue is
-        documented here rather than reported while interrupting the caller.
+        entry already exists. After any failure before publication the
+        temporary entry is removed, but only when the name still refers to the
+        very file this call created (same device and inode, and for the
+        path-based writer the same directory): a pathname can be replaced
+        before cleanup, and an entry that is no longer provably ours is left
+        alone. Then the error says plainly why the write failed. Only when
+        that entry cannot be removed does the error name the retained
+        mode-0600 ``.part`` entry and ask the operator to locate and verify it
+        before manual cleanup. ``KeyboardInterrupt`` and ``SystemExit``
+        remove the entry the same way and are re-raised unchanged.
+        When publication uses a hard link, the completed temporary name is
+        removed using the same identity check; failed cleanup is reported.
         ``final_name`` must be a bare basename (no path separators); see
         :func:`_validate_leaf_name`.
         """
         raise NotImplementedError
 
+    def _discard_temp(self, temp_name: str, identity: Optional[tuple[int, int]]) -> bool:
+        raise NotImplementedError
+
+    def _discard_linked_temp(self, final_name: str, temp_name: str, identity: tuple[int, int]) -> None:
+        if not self._discard_temp(temp_name, identity):
+            logging.getLogger(__name__).warning(
+                "Download %r was published in %s. Temporary entry %r could not be safely removed. "
+                "Verify its identity before manual cleanup.",
+                final_name,
+                self.display_path,
+                temp_name,
+            )
+
+    def _unpublished_failure(
+        self,
+        final_name: str,
+        temp_name: str,
+        identity: Optional[tuple[int, int]],
+        exc: BaseException,
+        existing_final_preserved: bool,
+    ) -> Optional[DestinationDirectoryError]:
+        """Remove the unpublished temp entry; return the error to raise instead of *exc*.
+
+        ``None`` means re-raise *exc* unchanged: an interrupt or exit, or an
+        error that already says what it needs to.
+        """
+        discarded = self._discard_temp(temp_name, identity)
+        if not isinstance(exc, Exception):
+            return None
+        error = _write_failure_error(
+            self.display_path,
+            final_name,
+            temp_name,
+            exc,
+            discarded=discarded,
+            existing_final_preserved=existing_final_preserved,
+        )
+        return None if error is exc else error
+
     def close(self) -> None:
         raise NotImplementedError
 
@@ -455,29 +559,45 @@ class _DirFdDestinationDirectory(DestinationDirectory):
             f"Refusing to publish {final_name!r}: portable-equivalent alias {aliases[0]!r} exists."
         )
 
+    def _discard_temp(self, temp_name: str, identity: Optional[tuple[int, int]]) -> bool:
+        """Remove the temporary entry this call created; ``True`` when it is gone.
+
+        The held directory descriptor pins the directory, so only the entry's
+        name can have changed. It is removed only while it still has the
+        identity of the file this call created. A name that now refers to
+        anything else is left alone.
+        """
+        try:
+            if identity is None:
+                return False
+            current = os.stat(temp_name, dir_fd=self._fd, follow_symlinks=False)
+            if (current.st_dev, current.st_ino) != identity:
+                return False
+            os.unlink(temp_name, dir_fd=self._fd)
+        except FileNotFoundError:
+            return True
+        except OSError:
+            return False
+        return True
+
     def write_atomic(self, final_name: str, data: bytes, *, replace_existing: bool = True) -> None:
         _validate_leaf_name(final_name)
         if not replace_existing:
             self._refuse_portable_alias(final_name)
         fd, temp_name = self._mkstemp(final_name)
+        identity: Optional[tuple[int, int]] = None
+        published = False
+        existing_final_preserved = False
         try:
-            published_identity = os.fstat(fd)
-        except (KeyboardInterrupt, SystemExit):
-            _close_fd_quietly(fd)
-            raise
-        except Exception as exc:
-            _close_fd_quietly(fd)
-            raise _retained_temp_error(self.display_path, temp_name, exc) from exc
-        try:
+            created = os.fstat(fd)
+            identity = (created.st_dev, created.st_ino)
             handle = os.fdopen(fd, "wb")
-        except (KeyboardInterrupt, SystemExit):
+        except BaseException as exc:
             _close_fd_quietly(fd)
+            replacement = self._unpublished_failure(final_name, temp_name, identity, exc, existing_final_preserved)
+            if replacement is not None:
+                raise replacement from exc
             raise
-        except Exception as exc:
-            _close_fd_quietly(fd)
-            raise _retained_temp_error(self.display_path, temp_name, exc) from exc
-        published = False
-        existing_final_preserved = False
         try:
             with handle:
                 handle.write(data)
@@ -488,25 +608,24 @@ class _DirFdDestinationDirectory(DestinationDirectory):
                 published = True
             else:
                 try:
-                    _rename_noreplace(temp_name, final_name, src_dir_fd=self._fd, dst_dir_fd=self._fd)
+                    linked = _rename_noreplace(temp_name, final_name, src_dir_fd=self._fd, dst_dir_fd=self._fd)
                 except FileExistsError as exc:
                     existing_final_preserved = True
-                    raise DestinationDirectoryError(
-                        f"Refusing to replace existing download destination {final_name!r} in {self.display_path}. "
-                        "The existing final entry was preserved."
-                    ) from exc
+                    raise DestinationDirectoryError(_existing_final_message(final_name, self.display_path)) from exc
                 published = True
-                self._refuse_portable_alias(
-                    final_name, published_identity=(published_identity.st_dev, published_identity.st_ino)
-                )
-        except (KeyboardInterrupt, SystemExit):
-            raise
-        except Exception as exc:
+                assert identity is not None
+                try:
+                    self._refuse_portable_alias(final_name, published_identity=identity)
+                finally:
+                    if linked:
+                        self._discard_linked_temp(final_name, temp_name, identity)
+        except BaseException as exc:
             if published:
                 raise
-            raise _retained_temp_error(
-                self.display_path, temp_name, exc, existing_final_preserved=existing_final_preserved
-            ) from exc
+            replacement = self._unpublished_failure(final_name, temp_name, identity, exc, existing_final_preserved)
+            if replacement is not None:
+                raise replacement from exc
+            raise
 
     def close(self) -> None:
         if not self._closed:
@@ -599,31 +718,48 @@ class _PathIdentityDestinationDirectory(DestinationDirectory):
             )
         raise DestinationDirectoryError(f"Refusing to publish {final_name!r}: portable-equivalent alias exists.")
 
+    def _discard_temp(self, temp_name: str, identity: Optional[tuple[int, int]]) -> bool:
+        """Remove the temporary entry this call created; ``True`` when it is gone.
+
+        Nothing holds this directory, so the directory is re-verified first and
+        the entry is removed only while it still has the identity of the file
+        this call created. Anything else is left alone.
+        """
+        try:
+            if identity is None:
+                return False
+            self._verify_unchanged()
+            temp_path = os.fspath(self.display_path / temp_name)
+            current = os.stat(temp_path, follow_symlinks=False)
+            if (current.st_dev, current.st_ino) != identity:
+                return False
+            os.unlink(temp_path)
+        except FileNotFoundError:
+            return True
+        except OSError:
+            return False
+        return True
+
     def write_atomic(self, final_name: str, data: bytes, *, replace_existing: bool = True) -> None:
         _validate_leaf_name(final_name)
         self._verify_unchanged()
         if not replace_existing:
             self._refuse_portable_alias(final_name)
         fd, temp_path = self._mkstemp(final_name)
-        try:
-            published_identity = os.fstat(fd)
-        except (KeyboardInterrupt, SystemExit):
-            _close_fd_quietly(fd)
-            raise
-        except Exception as exc:
-            _close_fd_quietly(fd)
-            raise _retained_temp_error(self.display_path, temp_path.name, exc) from exc
+        identity: Optional[tuple[int, int]] = None
         final_path = self.display_path / final_name
+        published = False
+        existing_final_preserved = False
         try:
+            created = os.fstat(fd)
+            identity = (created.st_dev, created.st_ino)
             handle = os.fdopen(fd, "wb")
-        except (KeyboardInterrupt, SystemExit):
+        except BaseException as exc:
             _close_fd_quietly(fd)
+            replacement = self._unpublished_failure(final_name, temp_path.name, identity, exc, existing_final_preserved)
+            if replacement is not None:
+                raise replacement from exc
             raise
-        except Exception as exc:
-            _close_fd_quietly(fd)
-            raise _retained_temp_error(self.display_path, temp_path.name, exc) from exc
-        published = False
-        existing_final_preserved = False
         try:
             with handle:
                 handle.write(data)
@@ -635,25 +771,24 @@ class _PathIdentityDestinationDirectory(DestinationDirectory):
                 published = True
             else:
                 try:
-                    _rename_noreplace(os.fspath(temp_path), os.fspath(final_path))
+                    linked = _rename_noreplace(os.fspath(temp_path), os.fspath(final_path))
                 except FileExistsError as exc:
                     existing_final_preserved = True
-                    raise DestinationDirectoryError(
-                        f"Refusing to replace existing download destination {final_name!r} in {self.display_path}. "
-                        "The existing final entry was preserved."
-                    ) from exc
+                    raise DestinationDirectoryError(_existing_final_message(final_name, self.display_path)) from exc
                 published = True
-                self._refuse_portable_alias(
-                    final_name, published_identity=(published_identity.st_dev, published_identity.st_ino)
-                )
-        except (KeyboardInterrupt, SystemExit):
-            raise
-        except Exception as exc:
+                assert identity is not None
+                try:
+                    self._refuse_portable_alias(final_name, published_identity=identity)
+                finally:
+                    if linked:
+                        self._discard_linked_temp(final_name, temp_path.name, identity)
+        except BaseException as exc:
             if published:
                 raise
-            raise _retained_temp_error(
-                self.display_path, temp_path.name, exc, existing_final_preserved=existing_final_preserved
-            ) from exc
+            replacement = self._unpublished_failure(final_name, temp_path.name, identity, exc, existing_final_preserved)
+            if replacement is not None:
+                raise replacement from exc
+            raise
 
     def close(self) -> None:
         self._closed = True

{simulo-0.32.0 → simulo-0.33.0}/src/simulo/_client/app.py

@@ -161,6 +161,7 @@ def viewstream_requested(enabled: bool) -> Iterator[None]:
 _INPUT_CHECKPOINT_REF: Optional[str] = None
 _INPUT_CHECKPOINT_FLAG = "--from"
 _COMPARE_CHECKPOINT_REF: Optional[str] = None
+_REQUIRE_SUCCESS: Optional[float] = None
 
 
 class InputCheckpointRequiresCloudError(RuntimeError):
@@ -201,6 +202,18 @@ def compare_checkpoint_requested(checkpoint_ref: Optional[str]) -> Iterator[None
         _COMPARE_CHECKPOINT_REF = previous
 
 
+@contextlib.contextmanager
+def evaluation_success_required(rate: Optional[float]) -> Iterator[None]:
+    """Scope ``--require-success`` to one eval submission."""
+    global _REQUIRE_SUCCESS
+    previous = _REQUIRE_SUCCESS
+    _REQUIRE_SUCCESS = rate
+    try:
+        yield
+    finally:
+        _REQUIRE_SUCCESS = previous
+
+
 # ---------------------------------------------------------------------------
 # Asset-pin ambient signals — `simulo run --frozen` / `--strict-assets` scope
 # these for one submit, exactly like `--viewstream` / `--from` above and for the
@@ -516,6 +529,7 @@ def _spawn_cloud(
     viewstream: bool = False,
     input_checkpoint: Optional[str] = None,
     compare_checkpoint: Optional[str] = None,
+    require_success: Optional[float] = None,
     frozen_assets: bool = False,
     strict_assets: bool = False,
     skip_preflight: bool = False,
@@ -709,6 +723,7 @@ def _spawn_cloud(
         viewstream=viewstream,
         input_checkpoint=input_checkpoint,
         compare_checkpoint=compare_checkpoint,
+        require_success=require_success,
         assets=asset_pins,
         app_name=app_name,
         system=system,
@@ -813,7 +828,7 @@ class JobFunction:
         app_file, project_root = _app_source_location(self._spec.module)
         # Construction-capture (authored-ref mount invariant): every Asset
         # constructed so far in the active `simulo run` capture scope (armed
-        # around the whole discovery import + sole-job submission — see cli.py) is
+        # around the whole discovery import + sole-job submission — see commands/run.py) is
         # unioned into this bundle's `resources`, even when never explicitly
         # mounted via App(mounts=...) — an unmounted registry handle
         # (`forklift = simulo.Asset.from_registry(...)`, used only via
@@ -848,6 +863,7 @@ class JobFunction:
                         viewstream=_VIEWSTREAM_REQUESTED,
                         input_checkpoint=_INPUT_CHECKPOINT_REF,
                         compare_checkpoint=_COMPARE_CHECKPOINT_REF,
+                        require_success=_REQUIRE_SUCCESS,
                         frozen_assets=_FROZEN_ASSETS_REQUESTED,
                         strict_assets=_STRICT_ASSETS_REQUESTED,
                         skip_preflight=_SKIP_PREFLIGHT_REQUESTED,

{simulo-0.32.0 → simulo-0.33.0}/src/simulo/_client/asset_api.py

@@ -53,7 +53,7 @@ _MAX_PART_NUMBERS_PER_BATCH = 1000
 #: download equivalent the way the upload side does), so this must
 #: comfortably cover the :data:`~simulo.interfaces.platform.asset_catalog.
 #: MAX_ASSET_VERSION_BYTES` (10 GiB) ceiling on a slow connection. Matches
-#: the magnitude of ``cli.py``'s own big-cloud-operation windows
+#: the magnitude of ``commands/assets.py``'s own big-cloud-operation windows
 #: (``_ASSET_VALIDATION_WINDOW_S``), not the much smaller
 #: ``submit_api._DOWNLOAD_TIMEOUT_S`` (60s) sized for job outputs/recordings,
 #: which are typically orders of magnitude smaller than an asset package.

{simulo-0.32.0 → simulo-0.33.0}/src/simulo/_client/asset_package.py

@@ -37,9 +37,9 @@ command.
 NTFS-clean: a source file whose package-relative path contains ``:`` or ``\\``,
 names a reserved device (``CON``, ``NUL``, ``COM1``…), or ends a segment with
 ``.``/space is REFUSED here (naming the file), because PR-8's cache extraction
-on Windows could not represent it faithfully. Mirrors ``cli.py``'s
-``_is_windows_unsafe_basename`` reasoning (kept self-contained here — ``cli``
-imports this module, so importing back would cycle).
+on Windows could not represent it faithfully. Mirrors ``cli_downloads.py``'s
+``_is_windows_unsafe_basename`` reasoning while keeping package inspection
+independent of CLI download helpers.
 
 **Symlink / realpath containment (security HIGH, PR-7 trio review; freeze
 "Packaging containment is REALPATH-based").** Every authored reference this