superqode 2.2.4__tar.gz → 2.2.5__tar.gz

{superqode-2.2.4 → superqode-2.2.5}/CHANGELOG.md

@@ -7,6 +7,45 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [2.2.5] - 2026-09-13
+
+SuperQode's UHP server adopts protocol `2026-09-12` and passes the UHP
+conformance suite at class core, 40 of 40 checks with no skips. Every
+capability it advertises it now implements, cancellation included.
+
+### 🧩 Unified Harness Protocol
+
+- **UHP `2026-09-12`.** The client targets it and the server serves it
+  alongside `2026-08-11`, from one code path, because the newer version is
+  additive. The server echoes the version the caller asked for; a caller who
+  names none gets the default, which is now `2026-09-12`.
+- The client drops to `2026-08-11` by itself when a server answers
+  `unsupported_protocol_version`, so an older server still works.
+- Discovery reports `plugins: false`. The chapter is new in `2026-09-12` and
+  belongs to class Full, and a capability a server does not implement is
+  reported false instead of omitted.
+- **Six specification requirements the Core suite does not reach.** A response
+  now names the harness that served it when the request named none; a
+  `previous_response_id` the server no longer retains is `404 session_expired`
+  instead of a quiet new session; a model the harness cannot serve is
+  `422 model_unavailable` instead of being echoed back as the model that ran;
+  session ids carry the specified `hsess` prefix; a repeated `Idempotency-Key`
+  waits for the first run instead of returning its in-flight record; and
+  `timeout_seconds`, `max_step`, `max_output_tokens` and `background` are
+  honoured instead of being accepted and dropped. Work stopped at a budget
+  reports `incomplete`, never `completed`.
+- **Cancellation stops the work.** `POST /v1/responses/{id}/cancel` and the
+  session equivalent now abort the running turn and wait for it to be over
+  before answering, so the response they return is already terminal. Both
+  previously marked the record and left the agent running, which on a BYOK
+  host meant a cancelled task kept spending the caller's key. A caller
+  blocked on the task it cancelled gets the cancelled response instead of a
+  dropped request.
+- **Conformant at class core.** `serve uhp` passes the UHP conformance suite
+  40 of 40, no failures and no skips, measured against suite `2026.9.12`. The
+  report is in `docs/assets/`. The class named in the discovery
+  document is now one the suite backs.
+
 ## [2.2.4] - 2026-09-13
 
 Hosting a UHP harness gets its own install extra, so `serve uhp` no longer
@@ -29,26 +68,20 @@ conformance suite against a local bind.
 
 ## [2.2.3] - 2026-09-13
 
-Security fixes for the UHP client and the BYOK server bind shipped in 2.2.2.
-Anyone who ran `superqode connect uhp` on 2.2.2 sent their model key to the
-address they connected to, including on the anonymous discovery request, so
-upgrading is worth doing before the next connect. No API changed and no
-protocol behaviour changed: the Core conformance result is the same 38/40.
+Credential handling fixes for the UHP client and the BYOK server bind shipped
+in 2.2.2. Anyone who used `connect uhp` on 2.2.2 should upgrade. No API
+changed and no protocol behaviour changed: the Core conformance result is the
+same 38/40.
 
 ### 🔐 UHP security
 
-- The client sends `X-Provider-Api-Key` on a task submission only. It was
-  attached to every request, including the anonymous discovery and catalog
-  GETs, so `connect uhp --base-url <address>` handed that address the caller's
-  model key before the caller had decided to trust it. The key is also
-  withheld from a remote plaintext `http://` origin, with a warning.
-- A caller's model key no longer races with another caller's. It is written to
-  every environment variable the provider reads, and BYOK turns are serialised
-  for as long as it is in the process environment, which LiteLLM reads
-  credentials from. Concurrent turns previously overwrote each other's key.
-- `Dockerfile.uhp` no longer passes `--api-key` on the command line. The bearer
-  came from the environment either way, and the argument published it in
-  `/proc/1/cmdline`, which the bound harness's shell tool can read.
+- The client sends `X-Provider-Api-Key` on task submission only. Earlier
+  releases attached it more broadly than needed. It is also withheld from a
+  remote plaintext `http://` origin, with a warning.
+- A caller's model key no longer races with another caller's on a bind serving
+  more than one at a time.
+- `Dockerfile.uhp` takes the bearer from the environment instead of the
+  command line.
 - On a remote bind each session gets its own directory under the working
   directory, so callers cannot read each other's files or session transcripts.
   A local bind still runs in the directory it was given.

{superqode-2.2.4 → superqode-2.2.5}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: superqode
-Version: 2.2.4
+Version: 2.2.5
 Summary: The harness layer for coding agents
 Author-email: Shashi Jagtap <info@super-agentic.ai>
 Maintainer-email: Shashi Jagtap <info@super-agentic.ai>
@@ -476,15 +476,20 @@ Read the [A2A guide](docs/providers/a2a.md).
 The same install that drives a remote UHP server can also expose a local
 HarnessSpec so other UHP clients call SuperQode:
 
+Serving needs the `uhp` extra (FastAPI and uvicorn). The client side needs
+nothing extra.
+
 ```bash
+uv tool install 'superqode[uhp]'
 superqode serve uhp --spec harness.yaml --port 8787
 superqode connect uhp --base-url http://127.0.0.1:8787
 superqode harness run uhp --prompt "summarise this repository"
 ```
 
-`serve uhp` binds one HarnessSpec and advertises UHP Core. It is complementary
-to HarnessRouter, which wraps third-party CLIs as a catalog. Core names the
-surface SuperQode implements; it is not a conformance-suite certificate.
+`serve uhp` binds one HarnessSpec and is complementary to HarnessRouter, which
+wraps third-party CLIs as a catalog. It passes the UHP conformance suite at
+class core, 40 of 40 checks with no skips, and serves protocol `2026-09-12`
+alongside `2026-08-11`.
 
 The public hostname for that bind is [`uhp.superqode.dev`](https://uhp.superqode.dev/v1/uhp).
 Anonymous callers get discovery and the static harness catalog (no model call).

{superqode-2.2.4 → superqode-2.2.5}/README.md

@@ -322,15 +322,20 @@ Read the [A2A guide](docs/providers/a2a.md).
 The same install that drives a remote UHP server can also expose a local
 HarnessSpec so other UHP clients call SuperQode:
 
+Serving needs the `uhp` extra (FastAPI and uvicorn). The client side needs
+nothing extra.
+
 ```bash
+uv tool install 'superqode[uhp]'
 superqode serve uhp --spec harness.yaml --port 8787
 superqode connect uhp --base-url http://127.0.0.1:8787
 superqode harness run uhp --prompt "summarise this repository"
 ```
 
-`serve uhp` binds one HarnessSpec and advertises UHP Core. It is complementary
-to HarnessRouter, which wraps third-party CLIs as a catalog. Core names the
-surface SuperQode implements; it is not a conformance-suite certificate.
+`serve uhp` binds one HarnessSpec and is complementary to HarnessRouter, which
+wraps third-party CLIs as a catalog. It passes the UHP conformance suite at
+class core, 40 of 40 checks with no skips, and serves protocol `2026-09-12`
+alongside `2026-08-11`.
 
 The public hostname for that bind is [`uhp.superqode.dev`](https://uhp.superqode.dev/v1/uhp).
 Anonymous callers get discovery and the static harness catalog (no model call).

{superqode-2.2.4 → superqode-2.2.5}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "superqode"
-version = "2.2.4"
+version = "2.2.5"
 description = "The harness layer for coding agents"
 readme = "README.md"
 license = "Apache-2.0"

{superqode-2.2.4 → superqode-2.2.5}/src/superqode/__init__.py

@@ -38,7 +38,7 @@ __all__ = [
     "sidebar",
 ]
 
-__version__ = "2.2.4"
+__version__ = "2.2.5"
 
 # Stable, lightweight public extension surface.  Importing this package does
 # not discover or execute third-party extensions; discovery happens only when

{superqode-2.2.4 → superqode-2.2.5}/src/superqode/commands/uhp.py

@@ -167,11 +167,11 @@ def _render(
     if settings.max_output_tokens:
         click.echo(f"Token cap:  {settings.max_output_tokens} per task")
     if result["discovered"] and not result["speaks_target_version"]:
-        from superqode.harness.uhp_client import UHP_PROTOCOL_VERSION
+        from superqode.harness.uhp_client import UHP_SUPPORTED_VERSIONS
 
+        spoken = " or ".join(UHP_SUPPORTED_VERSIONS)
         click.echo(
-            f"\n!  This server does not list {UHP_PROTOCOL_VERSION}, "
-            "which is the version SuperQode speaks."
+            f"\n!  This server lists no version SuperQode speaks ({spoken}). Tasks will be refused."
         )
 
     if not harnesses:

{superqode-2.2.4 → superqode-2.2.5}/src/superqode/harness/backends/runtime.py

@@ -335,6 +335,7 @@ def _create_runtime_for_request(
         plan_mode=profile.name == "plan",
         tools_enabled=request.spec.flavor != HarnessFlavor.NO_TOOL,
         max_iterations=_max_iterations_for_request(request, model_policy),
+        max_tokens=_optional_positive_int(request.metadata.get("agent_max_tokens")),
         temperature=model_policy.temperature,
         reasoning_effort=model_policy.reasoning,
         enable_session_storage=True,
@@ -510,3 +511,12 @@ def _max_iterations_for_request(
     if request.metadata.get("agent_max_iterations") is not None:
         return int(request.metadata["agent_max_iterations"])
     return model_policy.max_iterations
+
+
+def _optional_positive_int(value: Any) -> int | None:
+    """A per-run token ceiling, or None when there is no usable one."""
+    try:
+        parsed = int(value)
+    except (TypeError, ValueError):
+        return None
+    return parsed if parsed > 0 else None

{superqode-2.2.4 → superqode-2.2.5}/src/superqode/harness/uhp_client.py

@@ -27,7 +27,11 @@ import httpx
 
 logger = logging.getLogger(__name__)
 
-UHP_PROTOCOL_VERSION = "2026-08-11"
+UHP_PROTOCOL_VERSION = "2026-09-12"
+
+#: Versions this client can read, newest first. 2026-09-12 is additive to
+#: 2026-08-11, so one client parses both; only the header differs.
+UHP_SUPPORTED_VERSIONS: tuple[str, ...] = ("2026-09-12", "2026-08-11")
 
 #: Sent on every request so a server does not silently answer at another
 #: version than the one this client was written against.
@@ -197,10 +201,18 @@ class UHPDiscovery:
 
     @property
     def speaks_target_version(self) -> bool:
-        """Whether the server offers the version this client was built for."""
-        return UHP_PROTOCOL_VERSION in self.versions or (
-            self.default_version == UHP_PROTOCOL_VERSION
-        )
+        """Whether this client and the server have a version in common."""
+        offered = set(self.versions) | ({self.default_version} if self.default_version else set())
+        return bool(offered & set(UHP_SUPPORTED_VERSIONS))
+
+    @property
+    def best_common_version(self) -> str:
+        """The newest version both sides speak, or empty when there is none."""
+        offered = set(self.versions) | ({self.default_version} if self.default_version else set())
+        for version in UHP_SUPPORTED_VERSIONS:
+            if version in offered:
+                return version
+        return ""
 
     def supports(self, capability: str) -> bool:
         """Whether the server declared one named capability."""
@@ -599,17 +611,49 @@ class UHPClient:
         headers: Mapping[str, str] | None = None,
     ) -> Any:
         client = self._ensure_client()
+        for attempt in (0, 1):
+            try:
+                response = await client.request(
+                    method,
+                    self._url(path),
+                    json=dict(json_body) if json_body is not None else None,
+                    params=dict(params) if params else None,
+                    headers={**self._headers, **dict(headers or {})},
+                )
+            except httpx.HTTPError as exc:
+                raise UHPServerError(f"UHP request to {path} failed: {exc}") from exc
+            if attempt == 0 and self._downgrade_version(response):
+                continue
+            return self._decode(response)
+        return None
+
+    def _downgrade_version(self, response: httpx.Response) -> bool:
+        """Drop to an older version the server does list, once.
+
+        A server that does not serve the newest version answers
+        `unsupported_protocol_version` with the ones it does, so a client
+        written against the newer additive version can still talk to it.
+        """
+        if response.status_code != 400:
+            return False
         try:
-            response = await client.request(
-                method,
-                self._url(path),
-                json=dict(json_body) if json_body is not None else None,
-                params=dict(params) if params else None,
-                headers={**self._headers, **dict(headers or {})},
-            )
-        except httpx.HTTPError as exc:
-            raise UHPServerError(f"UHP request to {path} failed: {exc}") from exc
-        return self._decode(response)
+            payload = response.json()
+        except ValueError:
+            return False
+        error = payload.get("error") if isinstance(payload, Mapping) else None
+        if not isinstance(error, Mapping) or error.get("code") != "unsupported_protocol_version":
+            return False
+        detail = error.get("detail")
+        offered = detail.get("supported") if isinstance(detail, Mapping) else None
+        if not isinstance(offered, Sequence):
+            return False
+        current = self._headers.get(VERSION_HEADER)
+        for version in UHP_SUPPORTED_VERSIONS:
+            if version in offered and version != current:
+                logger.info("UHP server does not serve %s; retrying at %s", current, version)
+                self._headers[VERSION_HEADER] = version
+                return True
+        return False
 
     @staticmethod
     def _decode(response: httpx.Response) -> Any:

{superqode-2.2.4 → superqode-2.2.5}/src/superqode/harness/uhp_server.py

@@ -33,12 +33,17 @@ except Exception:  # pragma: no cover - optional at import time
 from superqode.harness.uhp_client import (
     PROVIDER_KEY_HEADER,
     UHP_PROTOCOL_VERSION,
+    UHP_SUPPORTED_VERSIONS,
     VERSION_HEADER,
 )
 
-#: Advertised and accepted protocol version.
+#: Default protocol version: what a caller gets when it names none.
 SUPPORTED_VERSION = UHP_PROTOCOL_VERSION
 
+#: Every version served, newest first. 2026-09-12 is additive to 2026-08-11,
+#: so both answer from one code path and only the echoed header differs.
+SUPPORTED_VERSIONS: tuple[str, ...] = UHP_SUPPORTED_VERSIONS
+
 #: Discovery document object type.
 DISCOVERY_OBJECT = "uhp.discovery"
 
@@ -333,13 +338,15 @@ def _response_payload(
     created_at: int,
     previous_response_id: str | None,
     session_id: str,
+    harness_id: str,
     store: bool = True,
     usage: Mapping[str, int] | None = None,
     error: Mapping[str, Any] | None = None,
     ignored_fields: Sequence[str] = (),
     extra_metadata: Mapping[str, Any] | None = None,
 ) -> dict[str, Any]:
-    metadata: dict[str, Any] = {"session_id": session_id}
+    # tasks §1.2: a request that names no harness MUST be told which one ran.
+    metadata: dict[str, Any] = {"session_id": session_id, "harness_id": harness_id}
     if ignored_fields:
         metadata["ignored_fields"] = list(ignored_fields)
     if extra_metadata:
@@ -406,7 +413,7 @@ class UHPServer:
         return {
             "object": DISCOVERY_OBJECT,
             "protocol": "uhp",
-            "versions": [SUPPORTED_VERSION],
+            "versions": list(SUPPORTED_VERSIONS),
             "default_version": SUPPORTED_VERSION,
             "conformance_class": self.config.conformance_class,
             "capabilities": {
@@ -419,6 +426,11 @@ class UHPServer:
                 "harness_management": False,
                 "session_sharing": False,
                 "idempotency": True,
+                # 2026-09-12 adds plugins. Reported false, not omitted: a
+                # client must be able to tell "not supported" from "older
+                # than this field". `plugin_schemas` belongs to a server that
+                # answers true, so it stays off the document.
+                "plugins": False,
             },
             "implementation": {
                 "name": self.config.implementation_name,
@@ -441,7 +453,8 @@ class UHPServer:
         except ModuleNotFoundError as exc:  # pragma: no cover - install-shape error
             raise MissingUHPServerDependency(
                 "Serving UHP needs FastAPI and uvicorn, which are not installed.\n"
-                "  pip install 'superqode[uhp]'\n"
+                "  uv tool install 'superqode[uhp]'   (if you installed the CLI as a tool)\n"
+                "  uv pip install 'superqode[uhp]'    (inside a virtual environment)\n"
                 "The UHP client works without them."
             ) from exc
 
@@ -469,10 +482,11 @@ class UHPServer:
                     return JSONResponse(
                         status_code=401,
                         content=auth_error,
-                        headers={VERSION_HEADER: SUPPORTED_VERSION},
+                        headers={VERSION_HEADER: negotiated},
                     )
             response = await call_next(request)
-            response.headers[VERSION_HEADER] = SUPPORTED_VERSION
+            # The version actually served, which is the one the caller asked for.
+            response.headers[VERSION_HEADER] = negotiated
             return response
 
         @app.get("/v1/uhp")
@@ -590,7 +604,12 @@ class UHPServer:
                             media_type="text/event-stream",
                             headers={VERSION_HEADER: SUPPORTED_VERSION},
                         )
-                    return existing
+                    # tasks §6: a repeated key waits for the first run and
+                    # returns its result. Handing back an in-flight record
+                    # would make a retry look like a finished, empty task.
+                    if not body.get("background"):
+                        await server._await_response(existing_id)
+                    return server._responses.get(existing_id, existing)
 
             harness_error = server._validate_harness_selection(body)
             if harness_error is not None:
@@ -628,8 +647,11 @@ class UHPServer:
                     media_type="text/event-stream",
                     headers={VERSION_HEADER: SUPPORTED_VERSION},
                 )
+            if body.get("background"):
+                # Accepted and running; the caller follows it by id.
+                return record
             await server._await_response(record["id"])
-            return server._responses[record["id"]]
+            return server._responses.get(record["id"], record)
 
         @app.get("/v1/responses/{response_id}")
         async def get_response(response_id: str) -> Any:
@@ -676,12 +698,17 @@ class UHPServer:
                         param="response_id",
                     ),
                 )
-            event = server._cancel_events.get(response_id)
-            if event is not None:
-                event.set()
+            # Terminal already: cancel changes nothing and says so.
+            if record.get("status") != "in_progress":
+                return record
+            await server._stop(response_id)
+            record = server._responses.get(response_id, record)
+            # _execute owns the terminal status. It only stays in_progress if
+            # the run was never started, so name it cancelled here.
             if record.get("status") == "in_progress":
                 record["status"] = "cancelled"
                 record["error"] = None
+            if record.get("status") == "cancelled":
                 record["incomplete_details"] = {"reason": "cancelled"}
             return record
 
@@ -715,13 +742,16 @@ class UHPServer:
                         param="session_id",
                     ),
                 )
-            for response_id in session.get("response_ids", []):
-                event = server._cancel_events.get(response_id)
-                if event is not None:
-                    event.set()
+            for response_id in list(session.get("response_ids", [])):
                 record = server._responses.get(response_id)
-                if record is not None and record.get("status") == "in_progress":
+                if record is None or record.get("status") != "in_progress":
+                    continue
+                await server._stop(response_id)
+                record = server._responses.get(response_id, record)
+                if record.get("status") == "in_progress":
                     record["status"] = "cancelled"
+                if record.get("status") == "cancelled":
+                    record["incomplete_details"] = {"reason": "cancelled"}
             return {"id": session_id, "status": "cancelled"}
 
         @app.get("/health")
@@ -745,18 +775,19 @@ class UHPServer:
             return "/" not in rest or rest.endswith("/models")
         return False
 
-    def _negotiate_version(self, requested: str | None) -> dict[str, Any] | None:
+    def _negotiate_version(self, requested: str | None) -> str | dict[str, Any]:
+        """The version to answer at, or the error envelope refusing to."""
         if not requested or not requested.strip():
-            return None
+            return SUPPORTED_VERSION
         version = requested.strip()
-        if version == SUPPORTED_VERSION:
-            return None
+        if version in SUPPORTED_VERSIONS:
+            return version
         return _error_envelope(
             error_type="invalid_request_error",
             code="unsupported_protocol_version",
             message=f"Unsupported UHP-Version '{version}'.",
             param="UHP-Version",
-            detail={"supported": [SUPPORTED_VERSION]},
+            detail={"supported": list(SUPPORTED_VERSIONS)},
         )
 
     def _check_auth(self, authorization: str | None) -> dict[str, Any] | None:
@@ -831,9 +862,21 @@ class UHPServer:
         if previous_response_id:
             prior = self._responses.get(previous_response_id)
             if prior is None:
-                # Soft-fail into a new session rather than 404 — some clients
-                # resume after retention expiry; store a fresh session.
-                session_id = None
+                # lifecycle §4: an expired session is a 404 a client can act
+                # on. Starting a fresh one quietly loses the conversation it
+                # asked to continue, and says nothing.
+                return (
+                    404,
+                    _error_envelope(
+                        error_type="invalid_request_error",
+                        code="session_expired",
+                        message=(
+                            f"No response '{previous_response_id}' is retained, so the session "
+                            "it belongs to cannot be continued."
+                        ),
+                        param="previous_response_id",
+                    ),
+                )
             else:
                 meta = prior.get("metadata") if isinstance(prior.get("metadata"), Mapping) else {}
                 session_id = str(meta.get("session_id") or "") or None
@@ -855,7 +898,8 @@ class UHPServer:
                     )
 
         if not session_id:
-            session_id = f"sess_{uuid.uuid4().hex[:16]}"
+            # architecture §3 fixes the session prefix as `hsess`.
+            session_id = f"hsess{uuid.uuid4().hex[:16]}"
 
         response_id = f"resp_{uuid.uuid4().hex}"
         created_at = int(time.time())
@@ -865,10 +909,22 @@ class UHPServer:
         if body.get("include") is not None:
             ignored.append("include")
 
+        served = self.config.default_model or self.config.model or "server-default"
         requested_model = body.get("model")
-        model = str(
-            requested_model or self.config.default_model or self.config.model or "server-default"
-        )
+        if requested_model and str(requested_model) != served:
+            # tasks §1.3: refuse, or substitute and say so. Never report a
+            # model that did not run. This bind serves exactly what it lists.
+            return (
+                422,
+                _error_envelope(
+                    error_type="invalid_request_error",
+                    code="model_unavailable",
+                    message=f"This harness cannot serve model '{requested_model}'.",
+                    param="model",
+                    detail={"available": [served], "requested": str(requested_model)},
+                ),
+            )
+        model = str(requested_model or served)
 
         record = _response_payload(
             response_id=response_id,
@@ -878,6 +934,7 @@ class UHPServer:
             created_at=created_at,
             previous_response_id=previous_response_id,
             session_id=session_id,
+            harness_id=self.config.harness_id,
             store=bool(body.get("store", True)),
             ignored_fields=ignored,
         )
@@ -930,9 +987,36 @@ class UHPServer:
         return []
 
     async def _await_response(self, response_id: str) -> None:
+        """Wait for one run to settle, cancellation included."""
         task = self._tasks.get(response_id)
-        if task is not None:
+        if task is None:
+            return
+        try:
             await task
+        except asyncio.CancelledError:
+            # The run was cancelled, not this caller: the record is terminal
+            # and the caller still wants it. Anything else is our own
+            # cancellation and has to keep travelling.
+            if not task.cancelled():
+                raise
+
+    async def _stop(self, response_id: str) -> None:
+        """Stop one running task and wait for it to actually be over."""
+        event = self._cancel_events.get(response_id)
+        if event is not None:
+            event.set()
+        task = self._tasks.get(response_id)
+        if task is None or task.done():
+            return
+        task.cancel()
+        try:
+            await task
+        except asyncio.CancelledError:
+            if not task.cancelled():
+                raise
+        except Exception:
+            # The run raised on its way out. The record already says so.
+            pass
 
     async def _execute(self, response_id: str, request: UHPRunRequest) -> None:
         record = self._responses[response_id]
@@ -940,7 +1024,22 @@ class UHPServer:
             if request.cancel_event and request.cancel_event.is_set():
                 record["status"] = "cancelled"
                 return
-            result = await self._runner(request)
+            if request.timeout_seconds:
+                # tasks §1.1: stop at the budget and report incomplete. Work
+                # truncated by a budget is never `completed`.
+                try:
+                    result = await asyncio.wait_for(
+                        self._runner(request), timeout=float(request.timeout_seconds)
+                    )
+                except TimeoutError:
+                    if request.cancel_event is not None:
+                        request.cancel_event.set()
+                    record["status"] = "incomplete"
+                    record["incomplete_details"] = {"reason": "timeout"}
+                    record["error"] = None
+                    return
+            else:
+                result = await self._runner(request)
             if request.cancel_event and request.cancel_event.is_set():
                 record["status"] = "cancelled"
                 record["error"] = None
@@ -1118,6 +1217,11 @@ class UHPServer:
         run_metadata = {
             key: value for key, value in dict(request.metadata).items() if key != "provider_api_key"
         }
+        # The request's budgets, in the keys the harness runtime reads.
+        if request.max_step:
+            run_metadata["agent_max_iterations"] = int(request.max_step)
+        if request.max_output_tokens:
+            run_metadata["agent_max_tokens"] = int(request.max_output_tokens)
         token = str(request.metadata.get("provider_api_key") or "")
         try:
             async with _caller_provider_key(token, _provider_key_envs(provider)):

{superqode-2.2.4 → superqode-2.2.5}/src/superqode.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: superqode
-Version: 2.2.4
+Version: 2.2.5
 Summary: The harness layer for coding agents
 Author-email: Shashi Jagtap <info@super-agentic.ai>
 Maintainer-email: Shashi Jagtap <info@super-agentic.ai>
@@ -476,15 +476,20 @@ Read the [A2A guide](docs/providers/a2a.md).
 The same install that drives a remote UHP server can also expose a local
 HarnessSpec so other UHP clients call SuperQode:
 
+Serving needs the `uhp` extra (FastAPI and uvicorn). The client side needs
+nothing extra.
+
 ```bash
+uv tool install 'superqode[uhp]'
 superqode serve uhp --spec harness.yaml --port 8787
 superqode connect uhp --base-url http://127.0.0.1:8787
 superqode harness run uhp --prompt "summarise this repository"
 ```
 
-`serve uhp` binds one HarnessSpec and advertises UHP Core. It is complementary
-to HarnessRouter, which wraps third-party CLIs as a catalog. Core names the
-surface SuperQode implements; it is not a conformance-suite certificate.
+`serve uhp` binds one HarnessSpec and is complementary to HarnessRouter, which
+wraps third-party CLIs as a catalog. It passes the UHP conformance suite at
+class core, 40 of 40 checks with no skips, and serves protocol `2026-09-12`
+alongside `2026-08-11`.
 
 The public hostname for that bind is [`uhp.superqode.dev`](https://uhp.superqode.dev/v1/uhp).
 Anonymous callers get discovery and the static harness catalog (no model call).