Bump Petri to the commit that reports `pebble.usage_by_model`, the root
session's usage by the route that spent it, and add an end-to-end test:
an agent stage on a scripted model whose primary answers once and then
fails mid-prompt keeps every token Petri reported, and files the
primary's share and the fallback's share under their own models.
Only Petri moves; Pebble and sandbox-driver stay at their locked
revisions.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Move Petri to current main, which picks up streamed stdin for Daytona
from sandbox-driver, reports how an ACP agent exited, extracts
checkouts as the sandbox user, and bumps lithos-llm and Pebble. Move
graphviz-sys to its latest commit (CI and README only). The Windows
crates return to main's newer versions.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Move sandbox-driver to the commit that streams stdin into Daytona
commands, and the Daytona SDK to the fix for stdout/stderr markers that
leaked into the session log stream. Together they let an ACP agent start
on Daytona and keep its JSON-RPC output intact. The agents docs no longer
say ACP fails on Daytona.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Share the managed-run cleanup between persist_run_failure and
fail_managed_run, return the committed projection from
commit_host_failure, and keep the run's status when the failure cannot
be stored. Restore the cancelled-launch message and keep the spawn
error's cause in the launch failure.
Rebuild Cargo.lock from main with only the Petri bump so the Windows
crates stay on their newer versions. Import the projection module
rather than the function, wrap long tracing calls, and document the
finalization test fixture.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Track Petri main now that required run finalization has merged there,
read workflow execution from the engine state, resume the failed-publication
regression with its admitted workflow, and keep the worker lifecycle helper
usable for rejected appends.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Clears RUSTSEC-2026-0185 (fixed in 0.11.15). quinn is only in the lock
through reqwest's optional http3 feature, which Fabro doesn't enable, so
this only stops lockfile scanners from flagging it.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Pin Petri at e46845b, the merge of its executor layer change. The stage
credential layer is now a Petri `SpawnEnv` applied with
`EnvHandle::with_spawn_env`, so Petri forwards every other environment
method and applies the layer to one-shot containers as well as processes.
A container gets the managed GITHUB_TOKEN, but no credential store refresh
or Git helper configuration: the store lives in the scope's sandbox, which
the container does not share.
The managed GITHUB_TOKEN now replaces one set in the workflow environment,
an ACP agent's environment or the sandbox's own, as Fabro's stage
environment did before Petri. The token carries exactly the access the run
declares; a stage that needs other access changes its declaration.
The new pin also keeps a timeout as the failure a partial success came
from: `PartialSuccess.underlying` is now an `UnderlyingFailure`, so the
projection reports "the step timed out" for a partial success converted
from a timeout. The run format moves from 7 to 8, which the attach JSON
snapshot records; runs stored before this pin are refused, as with earlier
format changes.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
