privacy/services/managed-python-runtime.json

{"display_name":"Managed Python runtime","external_boundaries":[{"activation":"automatic_on_first_use","content":"Published shared package names and version constraints plus ordinary package-index request metadata. No client files, prompts, case data, credentials, or generated work are sent by this runtime installer.","controls":["Only published shared core and explicitly selected OCR recipes are installed; package names are never derived from client material or prompts.","Host network denials stop package retrieval. Retry only the same declared setup after the host user or administrator authorizes registry access; never change host network settings or use an alternate installer to evade a denial.","Readiness probes the managed CPython 3.12 interpreter locally with isolated Python and site loading disabled, checks completed installation metadata, then checks the selected declared package versions and component imports in that interpreter. Recipe revisions, backend bytes and historical platform labels do not block a compatible environment. Compatible reuse leaves installation receipts unchanged; actual missing or incompatible dependencies require serialized repair.","All three products and their modules use the same environment. Optional OCR requires approval and is then retained in that environment. A shared environment is not a boundary between client matters."],"destination":"Python Package Index (PyPI) or the package index configured for the active Python interpreter","id":"declared-core-dependency-retrieval","kind":"hosted_service","optional":false,"purpose":"Prepare the published shared Vera, Clara and Lucia core requirements and explicitly approved optional OCR in one user-scoped Python 3.12 environment per operating-system host.","requires_confirmation":false,"retention":"Packages remain in one fixed user-scoped environment outside plugin source and client folders until explicitly removed. The default location is ~/.local/share/mparanza/runtime/venv on macOS and Linux, and LOCALAPPDATA/mpr/venv on Windows; MPARANZA_RUNTIME_ROOT may override the parent. Enabled OCR remains enabled across later core updates. Package-index request-log retention is controlled by the configured index. Failed updates invalidate the readiness receipt and require repair before execution; this shared environment has no retained generations. Verified temporary code copies are owned by the creating command and removed after completion, failure or cooperative cancellation, with process-exit retry if deletion is temporarily blocked. Preflight verification does not lease a persistent code copy. Installed code, client files and retained professional outputs are not removed. Forced termination or power loss may leave an orphan. On macOS and Linux, fresh code snapshots and native bootstrap copies have private sidecar device/inode records and shared kernel flock leases. Detached native workers inherit the snapshot lease. Normal termination signals stop intake and retain accepted jobs until completion; SIGKILL or power loss can leave copies, recovered on a later verified startup only after an exclusive nonblocking lease proves no holder remains and the directory identity matches. Unmarked historical copies, replaced directories, symlinks and live leases are retained. Lease records contain technical directory identity only, remain outside the indexed code and client folders, and are not returned to the model or sent to a service. Windows retains process-owned cleanup without automatic POSIX orphan recovery. Managed CLI command children independently acquire and inherit the same snapshot lease before launch; a terminated launcher cannot release a surviving helper's code. The child keeps that kernel lease until its actual exit. Automatic recovery accepts only lease protocol 2, which guarantees both native-worker and CLI-child inheritance. Older protocol-1 records remain uncollected even without a holder, because legacy helpers may be untracked; current CLI calls may still borrow their leases. Persistent shared-code device/inode metadata is renewed locally after complete package byte verification and a stable identity check during the current verification. This allows filesystem remounts without trusting a stale identity as executable authority. Modified bytes and directory changes during verification remain rejected; unverified replacements do not become eligible for collection. No client content or identity metadata is transmitted by this renewal. Before collecting an inactive package containing Journal Sampling, the collector preserves its index-verified module and unchanged package index under runtime/journal-sampling-replay, independently of idle-release limits. This local archive retains shipped code only, without product launchers or client data, until explicitly removed. Vouching validates the complete historical receipt set again and uses a private read-only replay; archived modules cannot launch new product work. If preservation fails, the original release remains available and current work continues. Removal of this replay archive can make historical verification unavailable.","runtime_profiles":["openai-codex","anthropic-cowork","openai-chatgpt","google-antigravity"]},{"activation":"automatic_on_first_use","content":"The fixed CPython 3.12 version request, operating-system and architecture selection, and ordinary download request metadata. Setup does not read client files or add prompts, case material or generated reports to this request.","controls":["Use an installed CPython 3.12 when available; otherwise use uv or automatically download the published uv 0.12.10 wheel, verify its pinned SHA-256, and provision private CPython 3.12 without changing system Python or shell profiles.","Probe the selected interpreter before creating the dependency environment; never fall back to executing workflows with another Python minor version.","A failed download or interpreter probe stops setup; existing environments and client files remain intact."],"destination":"PyPI files.pythonhosted.org for the pinned uv bootstrap, and Astral python-build-standalone CPython distributions on GitHub","id":"declared-python312-retrieval","kind":"hosted_service","optional":false,"purpose":"Provision the single supported CPython 3.12 interpreter when it is absent, automatically bootstrapping uv if needed","requires_confirmation":false,"retention":"When uv must be bootstrapped, the bootstrap executable and private interpreter remain inside shared runtime storage until removed. Download request-log retention is controlled by the providers.","runtime_profiles":["openai-codex","anthropic-cowork","openai-chatgpt","google-antigravity"]},{"activation":"automatic_on_first_use","content":"Random installation UUID and opaque capability, Vera/host/runtime versions, platform and workflow technical IDs, failed stage, complete available technical diagnostic chains and measurements, explicit missing-measurement reasons, retry IDs and actual recovery outcomes. No professional helper stdout, client documents, case text, user prompts or arbitrary task logs. Known path, email and credential patterns are removed from technical messages; this mechanical filter does not establish semantic privacy. The host agent must select technical evidence without unrelated personal/client material. The remote channel does not read local files. Failed helpers retain complete stderr privately on disk; stderr may include unrelated private/client text and is read by the selected host model for semantic review under its existing account. Raw stderr is not forwarded to Mparanza. Only reviewed relevant technical diagnostics, linked by the original report UUID, are submitted as supplemental evidence. Professional stdout is not captured. Managed helpers also send source-bound exception classes, OS error numbers, package-relative stack coordinates, developer-authored error templates and missing required option names automatically. Dynamic exception/argument values, locals, professional stdout and arbitrary source excerpts are not part of these structured events. Process-session UUIDs, persistent operation UUIDs and optional keyed digests of existing run/input-receipt identities bind attempts without disclosing receipt fields or raw client-input hashes. Actual worker interpreter/platform fields are separate from the reporter's interpreter. Capture completeness, pending semantic review, exact remedy/retry events and host verification of the original task remain distinct evidence states; a structured event is not a semantic diagnosis. Installation-preparation failures also include stack coordinates from the independently digest-verified verification module, the numeric Windows error code when available, and the failed pathname character count. The pathname itself, exception message and values, locals and client contents are excluded from these automatic fields. These technical facts establish capture, not diagnosis or recovery. Windows execution snapshots use extended filesystem paths in the existing private runtime location without changing machine policy, access controls or network destinations.","controls":["Only closed technical transport schemas are accepted; unknown fields and arbitrary recovery commands are rejected.","The fixed HTTPS transport refuses redirects. Reporting failures retain the outbox and do not discard professional outputs.","The remote connector is independent of local command-process startup. If the host cannot expose/connect it, no successful report is claimed.","Only two built-in setup/preparation retries may execute automatically, once per remedy revision. Client documents, ACLs and security settings are not changed.","A published update is not recovery. The failed operation must actually execute successfully before that installation delivery closes.","Supplemental diagnostics require ownership of the original report and matching execution metadata; they are stored separately and cannot change the original report UUID, delivery status or remedy revision. Raw local diagnostic files can only be removed by acknowledging a matching recorded supplement.","Actionable remedies target an explicit original report. Each delivery uses its own applicable revision; a different report with the same generic signal does not inherit that remedy.","A cached actual connector status permits only the two fixed retries for an existing matching local receipt and latest report. It performs no direct HTTP polling or identity adoption. Missing local receipts cannot be fabricated to authorise a retry.","A helper success records readiness. Host AI verification of the original task and inputs is required for all recovered outcomes, including setup/startup. Delayed failures cannot reopen an already recovered episode.","Failed fixed retries retain complete stderr privately for semantic review. Raw recovery stderr is not automatically transmitted.","An explicitly selected MPARANZA_INCIDENT_DELIVERY=local-only setting blocks automatic client HTTP transport for this execution while preserving local evidence. Incident queues are durably marked and not automatically flushed later; this does not make model-provider processing local-only."],"destination":"Mparanza HTTPS operational-incident API and Streamable HTTP MCP endpoint","id":"runtime-failure-incident-delivery","kind":"hosted_service","optional":false,"purpose":"Diagnose observed execution/setup failures, return installation-specific remedies and receive actual recovery outcomes","requires_confirmation":false,"retention":"Local capability, pending reports and receipts persist outside client folders. The service retains incident, report, remedy and outcome records; no automatic deletion period is enforced. Status access is scoped by the opaque capability. Pending diagnostic pointers and raw stderr persist in the private incident directory until a matching actual recorded supplementation receipt is acknowledged; unsuccessful review or delivery retains them. Supplementation never replaces the original recovery episode or reopens recovered records. Recorded original/outcome receipts can acknowledge only their exact local queued UUID without replacing the local capability or saved connector identity. Remedy revisions are retained from the surviving migration revision onward; overwritten legacy revisions are not reconstructed.","runtime_profiles":["openai-codex","anthropic-cowork","openai-chatgpt","google-antigravity"]}],"governed_paths":["components.json","scripts/check_dependencies.py","scripts/_managed_python_runtime.py","scripts/managed_python_runtime.py","skills/clara/SKILL.md","scripts/_shared_python_runtime.py","scripts/_locked_dependencies.py","requirements-shared-core.lock","requirements-shared-ocr.lock","requirements-shared-core.txt","requirements-shared-ocr.txt","constraints-shared-macos-py312.txt","scripts/_python_bootstrap.py","scripts/verified_execution.py","scripts/operational_incidents.py","scripts/technical_runner.py"],"governed_repository_paths":["plugins/_shared/vendor/modules/vera_assurance/recovery.py"],"packaged_for_runtime":"openai-codex","repository_source_review":{"path":"privacy/repository-source-reviews/managed-python-runtime.json","scope":"reviewed_repository_declaration_not_hosted_runtime","service_id":"managed-python-runtime"},"review":{"basis":"external_boundary_review_of_shared_service_source","fingerprint_scope":"installed_client_and_repository_review_declaration","reviewed_at":"2026-11-03","reviewed_by":"privacy-surface-review","source_fingerprint":"f36171c4c6953c745b3d64e35d40a1e5a87b4364cfa75795f0f1e5a53a1cfef3"},"runtime_profiles":["openai-codex","anthropic-cowork","openai-chatgpt","google-antigravity"],"schema_version":2,"security_controls":[{"control":"Setup validates package-relative selections and installs the published shared recipe. No package names or dependency instructions are accepted from client documents.","id":"published-requirements-only","implemented_by":["scripts/managed_python_runtime.py","scripts/_managed_python_runtime.py","scripts/_shared_python_runtime.py"],"on_violation":"An unknown module, missing requirements file, invalid target, or failed dependency validation stops the helper instead of executing it in a partial environment."},{"control":"One fixed environment is located outside plugin source and client folders. An exclusive operating-system installation lock waits for running managed Python readers, which hold a shared lease through a startup hook. Setup removes the ready receipt before mutation and restores it only after pip check and component validation. Failed setup leaves execution unavailable until repair. Symlink roots, locks and metadata are rejected. The installer is launched from base Python to avoid self-deadlock. This lease is concurrency protection, not a security sandbox. Other historical environments are not automatically deleted. State metadata normally uses atomic replacement. Only EXDEV or Windows error 17 falls back under the same installer lock to a single-link regular-file write with full-byte writes and fsync. Failed writes attempt to restore existing metadata or remove a newly created file; the ready receipt remains invalid until setup succeeds. This fallback is local and does not add a recipient or payload.","id":"user-scoped-runtime-isolation","implemented_by":["scripts/managed_python_runtime.py","scripts/_managed_python_runtime.py","scripts/_shared_python_runtime.py"],"on_violation":"A target creation or validation failure returns a bounded setup error and the requested helper is not run."},{"control":"For the six explicitly supported assured modules, the launchers verify the complete package inventory and stable regular-file bytes against the embedded build-generated SHA-256 index. Symlinks, reparse entries, special files, extra directories/files, missing or changed code and unstable reads stop preparation. Unchanged hardlinked package code is materialized into a fresh private OS temporary directory; each copied file is re-read and must have one physical link, then the unchanged component integrity validator must pass. The managed installation and aliases are not modified. The copy contains indexed product code/assets, not client documents, credentials, workflow reports or dependency environments. This local index detects package drift; it is not a publisher signature, a signed origin attestation or proof of installed-host acceptance. The command releases its own temporary code copy after success, failure or cancellation; process-exit cleanup retries pending copies. Ownership is recorded by process ID and directory identity, so borrowed installations, caller paths and replaced roots are not deleted. Forced termination, power loss or persistent file locks can leave an orphan. Cleanup failures log the temporary path and local OS error; they do not add an external recipient or transmit client content. The root-level host .in_use directory is non-executable bookkeeping: only ASCII numeric, ordinary single-link regular marker files are excluded from the product inventory. Nested directories, links, reparse points and non-numeric names there are rejected. Marker contents are not read, executed, transmitted or included in a recovery copy; host markers and installed product files are not modified. On macOS and Linux, fresh code snapshots and native bootstrap copies have private sidecar device/inode records and shared kernel flock leases. Detached native workers inherit the snapshot lease. Normal termination signals stop intake and retain accepted jobs until completion; SIGKILL or power loss can leave copies, recovered on a later verified startup only after an exclusive nonblocking lease proves no holder remains and the directory identity matches. Unmarked historical copies, replaced directories, symlinks and live leases are retained. Lease records contain technical directory identity only, remain outside the indexed code and client folders, and are not returned to the model or sent to a service. Windows retains process-owned cleanup without automatic POSIX orphan recovery. Managed CLI command children independently acquire and inherit the same snapshot lease before launch; a terminated launcher cannot release a surviving helper's code. The child keeps that kernel lease until its actual exit. Automatic recovery accepts only lease protocol 2, which guarantees both native-worker and CLI-child inheritance. Older protocol-1 records remain uncollected even without a holder, because legacy helpers may be untracked; current CLI calls may still borrow their leases.","id":"verified-code-copy-before-assured-execution","implemented_by":["scripts/verified_execution.py","scripts/check_dependencies.py","scripts/managed_python_runtime.py"],"on_violation":"Preparation failures and host permission denials stop execution. A failed private copy is removed; no installation chmod/unlink/manual repair, alternate sandbox or relaxed component validation is permitted."},{"control":"The parent Vera launcher reports a negative exit code or 137/247 as forced termination. It writes execution_failure.json only inside the selected workflow context output directory or its normalization/sample subdirectories; without that matching context it logs only. The diagnostic stores workflow/run identifiers, exit status and an explicit statement that memory exhaustion is not established by the exit code. It makes no model calls or network requests.","id":"worker-forced-termination-diagnostic","implemented_by":["scripts/managed_python_runtime.py"],"on_violation":"A worker failure remains failure; diagnostic persistence errors are logged rather than converted into a success."},{"control":"The standalone Python bootstrap passes uv only declared host paths, locale, proxy, CA and cache settings, preserving original environment-name casing. Unrelated token/API-key variables and inherited UV_*, VIRTUAL_ENV, CONDA_PREFIX, PYTHONHOME and PYTHONPATH are excluded; private UV_PYTHON_* and UV_CACHE_DIR values are set by the bootstrap. The same environment is used for interpreter discovery and its local probe.","id":"python-installer-environment-allowlist","implemented_by":["scripts/_python_bootstrap.py"],"on_violation":"Undeclared environment names are absent from every bootstrap child process."},{"control":"The built-in incident dependency-setup retry uses the shared host/runtime environment allowlist, named runtime/state locations and recovery recursion guard instead of inheriting unrelated user tokens and keys.","id":"helper-environment-allowlist","implemented_by":["scripts/operational_incidents.py"],"on_violation":"Undeclared environment names are absent from the child environment."},{"control":"When the maintained launcher itself runs under Python -I -B, it restores only its own resolved scripts directory for sibling technical-diagnostic imports. It does not add the caller working directory. Helper execution, diagnostic retention and explicit incident delivery policy remain unchanged.","id":"isolated-launcher-owned-imports","implemented_by":["scripts/managed_python_runtime.py"],"on_violation":"The maintained launcher must stop rather than resolving technical diagnostics from the caller working directory."},{"control":"When a managed helper carries a selected Archive context, the launcher checkpoints that exact run before and after the helper. Owner-private storage outside the selected archive retains deduplicated admitted inputs, source-receipt snapshots, completed outputs and run headers. It adds local copies with no external upload or automatic deletion. Recovery selects the same IDs and exact byte hashes, retains changed evidence and refuses unrelated destinations. Missing optional checkpoint storage does not hide a committed result or invalidate unchanged available inputs. The selected model may receive checkpoint status, technical identities and local context/output paths from the owning tool; copying bytes itself does not send them to a model. Standalone helpers without Archive context do not create an Archive run.","id":"admitted-archive-work-checkpoints","implemented_by":["scripts/_managed_python_runtime.py","repository:plugins/_shared/vendor/modules/vera_assurance/recovery.py"],"on_violation":"Keep the same job and accessible completed work, expose checkpoint availability separately, and recover only from actual verified copies at an authorized destination. Do not claim inaccessible or unsaved bytes were recovered."}],"service_id":"managed-python-runtime","source_contract_sha256":"072517f128e4892dec0d98c1d796df666819726274795cae0e8964268ff0f4bc"}