Close final portability and release gaps

Author: johnnygreco

projects/openshell-agent-runner/Makefile

@@ -22,7 +22,7 @@ help: ## Show available targets and configurable variables.
 	@printf "  VERSION=X.Y.Z      Required package version for publish\n"
 	@printf "  DRY_RUN=1          Validate a release without tagging or uploading\n"
 	@printf "  ALLOW_NON_MAIN=1   Permit release validation or publishing off main\n"
-	@printf "  RETRY_ARTIFACT=... Retry only a missing wheel or sdist after partial upload\n"
+	@printf "  RETRY_ARTIFACT=... Retry a missing wheel, sdist, or both after a failed upload\n"
 
 publish: ## Validate or publish a release; requires VERSION.
 ifndef VERSION

projects/openshell-agent-runner/README.md

@@ -70,6 +70,7 @@ uvx --from openshell-agent-runner oar doctor --gateway openshell
 uvx --from openshell-agent-runner oar run \
   projects/openshell-agent-runner/profiles/reviewer \
   --task review \
+  --gateway openshell \
   --input README.md \
   --output /tmp/oar-review.md \
   --dry-run
@@ -330,9 +331,9 @@ OpenShell's managed inference path.
 | Code | Meaning |
 | --- | --- |
 | `0` | Execution completed and the output validated. |
-| `1` | OpenShell execution, timeout, download size limit, ownership inspection, or cleanup failed. |
+| `1` | OpenShell execution, timeout, missing remote output, download size limit, ownership inspection, or cleanup failed. |
 | `2` | CLI input or profile configuration was invalid. |
-| `3` | The output was missing, empty, invalid, or failed its contract. |
+| `3` | A downloaded output was empty, invalid, or failed its contract. |
 
 ## Development
 

projects/openshell-agent-runner/RELEASING.md

@@ -49,14 +49,15 @@ The script:
    repository.
 
 If the upload fails after the tag is pushed, check the repository or Twine log
-to identify which artifact is missing. Retry only that artifact:
+to identify which artifacts are missing. Retry a missing artifact with:
 
 ```bash
 make publish VERSION=0.1.0 RETRY_ARTIFACT=sdist
 ```
 
-Use `wheel` instead of `sdist` when the wheel is missing. The retry rebuilds and
-checks both artifacts from the tagged commit but uploads only the selected file,
-so it works with private indexes that reject duplicate filenames. A retry
+Use `wheel` instead of `sdist` when the wheel is missing. If neither artifact
+was accepted, use `RETRY_ARTIFACT=both`. Every retry rebuilds and checks both
+artifacts from the tagged commit, then uploads only the selected file or files.
+This works with private indexes that reject duplicate filenames. A retry
 requires the remote tag to match the current commit. If both files are already
 present, there is nothing to retry.

projects/openshell-agent-runner/docs/index.md

@@ -191,6 +191,6 @@ without creating a sandbox.
 | Exit code | Meaning |
 | --- | --- |
 | `0` | The result was validated and published. |
-| `1` | OpenShell execution, timeout, download size limit, ownership inspection, or cleanup failed. |
+| `1` | OpenShell execution, timeout, missing remote output, download size limit, ownership inspection, or cleanup failed. |
 | `2` | CLI input or profile configuration was invalid. |
-| `3` | The result was missing, empty, invalid, or failed its schema. |
+| `3` | A downloaded result was empty, invalid, or failed its schema. |

projects/openshell-agent-runner/scripts/publish.sh

@@ -8,7 +8,7 @@ PROJECT_DIRECTORY=$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)
 PYPIRC_REPOSITORY="openshell-research"
 
 usage() {
-    echo "Usage: $0 VERSION [--dry-run] [--allow-non-main] [--retry-artifact wheel|sdist]"
+    echo "Usage: $0 VERSION [--dry-run] [--allow-non-main] [--retry-artifact wheel|sdist|both]"
     echo
     echo "Build and publish openshell-agent-runner using the '$PYPIRC_REPOSITORY'"
     echo "repository configured in ~/.pypirc."
@@ -58,8 +58,8 @@ if [[ ! "$VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+(rc[0-9]+)?$ ]]; then
     echo "publish: invalid version '$VERSION'; expected X.Y.Z or X.Y.ZrcN" >&2
     exit 2
 fi
-if [[ -n "$RETRY_ARTIFACT" && "$RETRY_ARTIFACT" != "wheel" && "$RETRY_ARTIFACT" != "sdist" ]]; then
-    echo "publish: --retry-artifact must be 'wheel' or 'sdist'" >&2
+if [[ -n "$RETRY_ARTIFACT" && "$RETRY_ARTIFACT" != "wheel" && "$RETRY_ARTIFACT" != "sdist" && "$RETRY_ARTIFACT" != "both" ]]; then
+    echo "publish: --retry-artifact must be 'wheel', 'sdist', or 'both'" >&2
     exit 2
 fi
 if [[ "$DRY_RUN" == true && -n "$RETRY_ARTIFACT" ]]; then
@@ -122,7 +122,7 @@ if [[ -n "$RETRY_ARTIFACT" && "$TAG_PUBLIC" != true ]]; then
     exit 1
 fi
 if [[ -z "$RETRY_ARTIFACT" && "$DRY_RUN" != true && "$TAG_PUBLIC" == true ]]; then
-    echo "publish: remote tag '$TAG' already exists; retry only the missing artifact with --retry-artifact" >&2
+    echo "publish: remote tag '$TAG' already exists; retry the missing artifact or artifacts with --retry-artifact" >&2
     exit 1
 fi
 
@@ -169,8 +169,12 @@ echo "Uploading openshell-agent-runner $VERSION with .pypirc repository '$PYPIRC
 if ! uv run --with twine python -m twine upload \
     --repository "$PYPIRC_REPOSITORY" \
     "${UPLOAD_ARTIFACTS[@]}"; then
-    echo "publish: upload failed; identify the missing artifact and retry only that artifact" >&2
+    echo "publish: upload failed; identify the missing artifact or artifacts before retrying" >&2
     exit 1
 fi
 
-echo "Published openshell-agent-runner $VERSION from $TAG."
+if [[ "$RETRY_ARTIFACT" == "wheel" || "$RETRY_ARTIFACT" == "sdist" ]]; then
+    echo "Uploaded the missing $RETRY_ARTIFACT artifact for openshell-agent-runner $VERSION."
+else
+    echo "Published openshell-agent-runner $VERSION from $TAG."
+fi

projects/openshell-agent-runner/src/openshell_agent_runner/config.py

@@ -339,29 +339,44 @@ def _validate_output_schema(path: Path) -> None:
 
 
 def _validate_schema_references(document: Any, path: Path) -> None:
-    if isinstance(document, dict):
-        for key, value in document.items():
-            if key in {"pattern", "patternProperties"}:
-                raise ConfigurationError(
-                    "output schemas do not support regular-expression keywords "
-                    f"({key}) because host and sandbox engines use different dialects"
-                )
-            if key in {"$ref", "$dynamicRef", "$recursiveRef"} and (
-                not isinstance(value, str) or not value.startswith("#")
-            ):
-                raise ConfigurationError(
-                    f"output schema references must stay inside {path}: {value!r}"
-                )
-            if key in {
-                "$defs",
-                "definitions",
-                "properties",
-                "dependentSchemas",
-            } and isinstance(value, dict):
-                for schema in value.values():
-                    _validate_schema_references(schema, path)
-            else:
-                _validate_schema_references(value, path)
-    elif isinstance(document, list):
-        for value in document:
-            _validate_schema_references(value, path)
+    if not isinstance(document, dict):
+        return
+
+    for key in {"pattern", "patternProperties"}:
+        if key in document:
+            raise ConfigurationError(
+                "output schemas do not support regular-expression keywords "
+                f"({key}) because host and sandbox engines use different dialects"
+            )
+    for key in {"$ref", "$dynamicRef", "$recursiveRef"}:
+        if key in document and (
+            not isinstance(document[key], str) or not document[key].startswith("#")
+        ):
+            raise ConfigurationError(
+                f"output schema references must stay inside {path}: {document[key]!r}"
+            )
+
+    for key in {"$defs", "definitions", "properties", "dependentSchemas"}:
+        value = document.get(key)
+        if isinstance(value, dict):
+            for schema in value.values():
+                _validate_schema_references(schema, path)
+    for key in {"allOf", "anyOf", "oneOf", "prefixItems"}:
+        value = document.get(key)
+        if isinstance(value, list):
+            for schema in value:
+                _validate_schema_references(schema, path)
+    for key in {
+        "additionalProperties",
+        "contains",
+        "contentSchema",
+        "else",
+        "if",
+        "items",
+        "not",
+        "propertyNames",
+        "then",
+        "unevaluatedItems",
+        "unevaluatedProperties",
+    }:
+        _validate_schema_references(document.get(key), path)

projects/openshell-agent-runner/tests/test_config.py

@@ -219,6 +219,19 @@ def test_output_schema_allows_property_names_that_match_schema_keywords(
     load_profile(tmp_path)
 
 
+@pytest.mark.parametrize("keyword", ["const", "examples", "x-oar-note"])
+def test_output_schema_does_not_treat_instance_data_as_a_schema(
+    tmp_path: Path, keyword: str
+) -> None:
+    _write_profile(tmp_path, task="output_schema: output.schema.json")
+    value: object = (
+        [{"pattern": "value"}] if keyword == "examples" else {"pattern": "value"}
+    )
+    (tmp_path / "output.schema.json").write_text(json.dumps({keyword: value}))
+
+    load_profile(tmp_path)
+
+
 @pytest.mark.parametrize("keyword", ["$ref", "$dynamicRef", "$recursiveRef"])
 def test_output_schema_rejects_external_references(
     tmp_path: Path, keyword: str

projects/openshell-agent-runner/tests/test_release.py

@@ -7,12 +7,18 @@
 import textwrap
 from pathlib import Path
 
+import pytest
+
 REPOSITORY = Path(__file__).resolve().parents[3]
 PUBLISH_SCRIPT = REPOSITORY / "projects/openshell-agent-runner/scripts/publish.sh"
 
 
-def test_publish_retry_uploads_only_the_missing_artifact(
-    tmp_path: Path,
+@pytest.mark.parametrize(
+    ("first_accepts_wheel", "retry_artifact"),
+    [(True, "sdist"), (False, "both")],
+)
+def test_publish_retry_uploads_only_missing_artifacts(
+    tmp_path: Path, first_accepts_wheel: bool, retry_artifact: str
 ) -> None:
     project = tmp_path / "project"
     script = project / "scripts/publish.sh"
@@ -73,8 +79,16 @@ def test_publish_retry_uploads_only_the_missing_artifact(
         if [[ "$*" == *"twine upload"* ]]; then
             if [[ "$*" == *"--skip-existing"* ]]; then exit 92; fi
             if [[ "$*" == *".whl"* && "$*" == *".tar.gz"* ]]; then
+                if [[ ! -e "$FAKE_REPOSITORY_STATE/attempted" ]]; then
+                    touch "$FAKE_REPOSITORY_STATE/attempted"
+                    if [[ "$FAKE_FIRST_ACCEPTS_WHEEL" == "true" ]]; then
+                        touch "$FAKE_REPOSITORY_STATE/wheel"
+                    fi
+                    exit 93
+                fi
                 touch "$FAKE_REPOSITORY_STATE/wheel"
-                exit 93
+                touch "$FAKE_REPOSITORY_STATE/sdist"
+                exit 0
             fi
             if [[ "$*" == *".tar.gz"* ]]; then
                 touch "$FAKE_REPOSITORY_STATE/sdist"
@@ -95,6 +109,7 @@ def test_publish_retry_uploads_only_the_missing_artifact(
     environment["FAKE_UV_LOG"] = str(uv_log)
     environment["FAKE_GIT_STATE"] = str(git_state)
     environment["FAKE_REPOSITORY_STATE"] = str(repository_state)
+    environment["FAKE_FIRST_ACCEPTS_WHEEL"] = str(first_accepts_wheel).lower()
 
     first_attempt = subprocess.run(
         ["bash", str(script), "0.1.0"],
@@ -104,11 +119,11 @@ def test_publish_retry_uploads_only_the_missing_artifact(
         check=False,
     )
     assert first_attempt.returncode == 1
-    assert (repository_state / "wheel").exists()
+    assert (repository_state / "wheel").exists() is first_accepts_wheel
     assert not (repository_state / "sdist").exists()
 
     retry = subprocess.run(
-        ["bash", str(script), "0.1.0", "--retry-artifact", "sdist"],
+        ["bash", str(script), "0.1.0", "--retry-artifact", retry_artifact],
         text=True,
         capture_output=True,
         env=environment,
@@ -121,7 +136,11 @@ def test_publish_retry_uploads_only_the_missing_artifact(
         line for line in uv_log.read_text().splitlines() if "twine upload" in line
     ]
     assert ".whl" in uploads[0] and ".tar.gz" in uploads[0]
-    assert ".whl" not in uploads[1] and ".tar.gz" in uploads[1]
+    assert (".whl" in uploads[1]) is (retry_artifact == "both")
+    assert ".tar.gz" in uploads[1]
+    if retry_artifact == "sdist":
+        assert "Uploaded the missing sdist artifact" in retry.stdout
+        assert "Published openshell-agent-runner" not in retry.stdout
 
 
 def _write_executable(path: Path, content: str) -> None: