[release] v0.115.0

.agents/skills/agent-release-gate/SKILL.md

@@ -181,6 +181,62 @@ cell, promoted after the platform-guidance fix closed that exact gap; it reuses
 the same way the separate one-shot benchmark (Tier B) does — check there before writing a new
 mechanism-blind cell from scratch, to avoid duplicating scaffolding.
 
+## Session control cells
+
+`resources/session_control.py` is a second, standalone driver: sixteen cells that cover Stop,
+durable commands, and the runner's recovery paths (owner release, park/resume, watchdog
+quarantine). It drives the same product endpoint and asserts on the same wire, but it needs its
+own account bootstrap, so it runs as a separate process rather than as `qa_product.py` cells. See
+`resources/path_triggers.py` for the exact mandatory-cell mechanism.
+
+**These cells are MANDATORY** — run them, not just the standing gate — whenever the release diff
+touches any of:
+
+- `services/runner/src/sessions/**`
+- `services/runner/src/engines/sandbox_agent/**`
+- `api/oss/src/core/sessions/**`
+- `api/oss/src/tasks/asyncio/sessions/**`
+- `api/oss/src/apis/fastapi/sessions/**`
+
+Run every cell with one line:
+
+```bash
+uv run resources/session_control.py --cells all --harness pi_core --sandbox local
+```
+
+Add `--project <docker-compose project name>` to run the eight cells that need direct Docker and
+Postgres access (`sandbox-gone`, `records-outage`, `restart-after-stop`, `runner-gone`,
+`runner-gone-late`, `post-stop-row`, `codex-child`, `stale-tail`) and the abort-log subcheck inside
+`stop-after-finish`. Without `--project`, those eight cells SKIP with a named reason. The
+`stop-after-finish` HTTP check still runs, but only its abort-log subcheck is unavailable. The
+other eight cells
+(`stop-warm`, `double-send`, `stale-stop`, `stop-approval`, `stop-after-finish`,
+`repeat-stop`, `concurrent-stops`, `stop-during-completion`) run over HTTP alone against any
+deployment. Add
+`--resume <path to a prior run's results.json>` to pick a lost run back up: any cell already
+recorded there is loaded instead of re-run.
+
+Results land in a timestamped folder under `~/agenta-qa-evidence/` (override with
+`AGENTA_QA_RUNS_DIR`), as `results.json` and `summary.md` — the same PASS/FAIL/SKIP shape as the
+rest of the gate. When a release path makes session control mandatory, pass that artifact to the
+standing gate with `--session-control-results <path>`: a missing or incomplete artifact stops the
+gate before the matrix runs, and a recorded FAIL makes the final gate exit nonzero.
+
+**Environment, by name.** Same three-variable discipline as the rest of the gate, no env-file
+fallback:
+
+- `AGENTA_BASE` — the deployment origin.
+- `AGENTA_ADMIN_KEY` — mints the ephemeral account this driver runs under. Lives in
+  `~/.agenta-qa-secrets.env`.
+- `QA_OPENAI_API_KEY` — stocked into that account's vault so the `pi_core` and `codex` harnesses
+  have a provider key. Lives in `~/.agenta-qa-openai.env`.
+- `ANTHROPIC_API_KEY` — only required for `--harness claude`, stocked into the same vault the
+  same way. Lives in `~/.agenta-qa-secrets.env`. A pi_core- or codex-only run does not need it.
+
+A Daytona run additionally needs a Secrets-capable Daytona key on the runner; the key in most
+session env files returns 403 on the Secrets endpoint, so check that before trusting a Daytona
+result.
+
 ## When results lie
 
 The runtime **fails open**: a component can break, get logged, and the turn still succeeds with a

.agents/skills/agent-release-gate/resources/path_triggers.py

@@ -33,6 +33,12 @@
 # the second kind as required, because a standalone cell is a separate process it cannot observe.
 GATEWAY_TOOLS = ("matrix_gw1_gateway_tools.py",)
 
+# The standing session-control regression cells: Stop, durable commands, and the runner's
+# recovery paths (owner release, park/resume, watchdog quarantine). A separate standalone driver
+# because it needs its own account bootstrap and, for most cells, a docker-compose project name —
+# see resources/session_control.py and SKILL.md "Session control cells".
+SESSION_CONTROL = ("session_control.py",)
+
 # The cells that run a REMOTE sandbox and need no extra flag. A release that touches the sandbox
 # engine or the Daytona provider changes how a cold sandbox gets built and how its credentials are
 # delivered, and the `burst` and `crosstalk` journeys are the only ones that see that path under
@@ -71,8 +77,18 @@
     # A fault here shows up only when many sandboxes start at once, which is what `burst` and
     # `crosstalk` do on these cells. Production hit it as one first message in five failing with
     # a credential error (AGE-4249 / #6485) while the sequential gate stayed green.
-    "services/runner/src/engines/sandbox_agent/**": DAYTONA_CELLS,
+    # A dict literal keeps only the last value for a repeated key, so a glob that already names
+    # DAYTONA_CELLS lists SESSION_CONTROL alongside it in the SAME tuple rather than as a second
+    # entry that would silently drop the Daytona rule.
+    "services/runner/src/engines/sandbox_agent/**": DAYTONA_CELLS + SESSION_CONTROL,
     "services/runner/src/providers/daytona*": DAYTONA_CELLS,
+    # Session control: Stop, durable commands, park/resume, and the owner-release and watchdog
+    # sweeps. A change here can silently break a warm resume or leave a command stuck, and
+    # nothing in the fixed matrix drives Stop at all. See qa-audit-2026-09-03.md section 4.
+    "services/runner/src/sessions/**": SESSION_CONTROL,
+    "api/oss/src/core/sessions/**": SESSION_CONTROL,
+    "api/oss/src/tasks/asyncio/sessions/**": SESSION_CONTROL,
+    "api/oss/src/apis/fastapi/sessions/**": SESSION_CONTROL,
 }
 
 # Glob -> journeys that MUST run when the rule fires. Same matching as PATH_TRIGGERS, kept as a

.agents/skills/agent-release-gate/resources/qa_product.py

@@ -3118,6 +3118,68 @@ def approval(i: int) -> dict:
 }
 
 
+def _load_session_control_result(path: str) -> dict:
+    """Load and summarize a complete standalone session-control result."""
+    result_path = pathlib.Path(path).expanduser()
+    try:
+        payload = json.loads(result_path.read_text())
+    except (OSError, json.JSONDecodeError) as exc:
+        raise SystemExit(
+            f"Cannot read --session-control-results {result_path}: {exc}"
+        ) from exc
+
+    cells = payload.get("cells")
+    if not isinstance(cells, dict):
+        raise SystemExit(
+            f"Invalid session-control result {result_path}: expected a top-level cells object."
+        )
+
+    # Import the standalone driver's registry instead of copying its cell names here. A newly
+    # added session-control cell must become release-mandatory without a second list to update.
+    from session_control import CELLS as session_control_cells
+
+    missing = sorted(set(session_control_cells) - set(cells))
+    if missing:
+        raise SystemExit(
+            f"Incomplete session-control result {result_path}: missing cells: "
+            + ", ".join(missing)
+        )
+
+    statuses: dict[str, str] = {}
+    for name in session_control_cells:
+        entry = cells.get(name)
+        verdict = entry.get("verdict") if isinstance(entry, dict) else None
+        if (
+            not isinstance(verdict, dict)
+            or not isinstance(verdict.get("pass"), bool)
+            or not isinstance(verdict.get("skip"), bool)
+            or (verdict["pass"] and verdict["skip"])
+        ):
+            raise SystemExit(
+                f"Invalid session-control result {result_path}: cell {name!r} has no valid "
+                "PASS/FAIL/SKIP verdict."
+            )
+        statuses[name] = (
+            "SKIP" if verdict["skip"] else ("PASS" if verdict["pass"] else "FAIL")
+        )
+
+    failed = sorted(name for name, status in statuses.items() if status == "FAIL")
+    skipped = sorted(name for name, status in statuses.items() if status == "SKIP")
+    return {
+        "path": str(result_path),
+        "status": "FAIL" if failed else ("INCOMPLETE" if skipped else "PASS"),
+        "failed": failed,
+        "skipped": skipped,
+    }
+
+
+def _session_control_result_label(result: dict) -> str:
+    label = f"recorded {result['status']}"
+    if result["skipped"]:
+        label += "; SKIPPED, UNTESTED: " + ", ".join(result["skipped"])
+    return label
+
+
 def main() -> int:
     # Declared here, not beside the assignments below, because the flag help strings read these
     # module defaults and a `global` statement must precede every use of the name in a function.
@@ -3271,6 +3333,13 @@ def main() -> int:
         "--repo",
         help="repository the release diff is read from (default: the current directory)",
     )
+    p.add_argument(
+        "--session-control-results",
+        help=(
+            "results.json written by resources/session_control.py. Required when a path rule "
+            "makes that standalone driver mandatory; all of its cells must be recorded."
+        ),
+    )
     args = p.parse_args()
 
     resolve_credentials(args.env_file)
@@ -3368,6 +3437,16 @@ def main() -> int:
     external_cells = [
         cell for cell in triggered if cell not in CELLS and cell not in missing_cells
     ]
+    session_control_result = None
+    if "session_control.py" in external_cells:
+        if not args.session_control_results:
+            raise SystemExit(
+                "This release makes session_control.py mandatory. Run it separately, then pass "
+                "its results.json with --session-control-results."
+            )
+        session_control_result = _load_session_control_result(
+            args.session_control_results
+        )
     for cell in triggered:
         if cell in CELLS and cell not in cells:
             cells.append(cell)
@@ -3380,7 +3459,11 @@ def main() -> int:
                 else (
                     "MISSING — no such cell exists"
                     if cell in missing_cells
-                    else "run it separately"
+                    else (
+                        _session_control_result_label(session_control_result)
+                        if cell == "session_control.py" and session_control_result
+                        else "run it separately"
+                    )
                 )
             )
             print(f"  {cell} ({where})")
@@ -3479,9 +3562,19 @@ def main() -> int:
         table += "\n\nMandatory for this release, by path rule:\n\n"
         table += "| cell | run here | because this release changed |\n|---|---|---|\n"
         for cell, why in triggered.items():
-            here = "yes" if cell in CELLS else "no — run it separately"
+            if cell in CELLS:
+                here = "yes"
+            elif cell == "session_control.py" and session_control_result:
+                here = _session_control_result_label(session_control_result)
+            else:
+                here = "no — run it separately"
             table += f"| {cell} | {here} | {', '.join(why)} |\n"
-        if external_cells:
+        unrecorded_external_cells = [
+            cell
+            for cell in external_cells
+            if not (cell == "session_control.py" and session_control_result)
+        ]
+        if unrecorded_external_cells:
             table += (
                 "\nThis release is NOT green until every cell above marked "
                 "`run it separately` has a recorded result.\n"
@@ -3506,7 +3599,10 @@ def main() -> int:
         for cell in results.values()
         for journey in cell["journeys"].values()
     )
-    return 1 if failed else 0
+    standalone_failed = bool(
+        session_control_result and session_control_result["status"] != "PASS"
+    )
+    return 1 if failed or standalone_failed else 0
 
 
 if __name__ == "__main__":