LangBot/plugins/Runner/LocalAgent/CERTIFICATION.md

LocalAgent shared-runtime candidate

Version 0.2.1 targets langbot-plugin>=0.7.4,<0.8 and declares shared-runtime-v1. This declaration is not a certificate. Publication, independent exact-package review, signing and live acceptance remain separate gates.

State and authority review

• LocalAgentPlugin.initialize() retains no installation config, credentials, conversation cache or background task. The default Runner creates its API, assembler, context budget, Box binding, usage tracker and control checks per run.
• get_run_api(ctx) and the SDK-bound ctx helpers carry run resource permissions and the trusted RPC installation envelope. Models, tools, RAG, history, steering, state and Box actions use Host APIs; no provider keys or direct provider clients are constructed in this plugin. Configuring a resource ID does not grant it.
• Compaction checkpoints are Host-owned conversation state. Isolation of that state and provider credentials relies on the Host's installation/run authority, not globally unique user-provided conversation IDs or Box reuse keys.
• There is no plugin-owned durable filesystem state. A {global} Box reuse key means reuse within Host-authorized scope, not a process-global sandbox.
• Cancellation and deadlines terminate the local invocation. Cancelling an RPC waiter does not prove remote Host/provider work was cancelled or rolled back. Tests release their simulated remote model actions explicitly.

The repair aligns the dependency/admission contract and adds scoped regression coverage. It does not claim a previously reproduced tenant-data leak, and does not introduce unnecessary changes to the existing invocation-local algorithm.

Verification

Run from this plugin directory with the actual 0.7.4 interpreter:

python -m pytest tests -q

tests/test_shared_runtime.py uses real SDK discovery, controller initialization, Runner dispatch, authorization proxies and bidirectional loopback WebSocket RPC. One actual component object handles concurrent distinct installation envelopes. A bounded simulated Host checks every callback envelope against its run owner. It deliberately collides model, conversation, tool and state-key identifiers:

• distinct prompt/config/reasoning, Host-selected synthetic credentials and output;
• overlapping streaming/non-streaming model/tool calls and scoped RAG;
• real plugin compaction state writes and subsequent scoped readback;
• missing model grants/operations, ungranted tools and knowledge bases;
• one installation's history/model failure, cooperative cancellation or deadline while the other completes, followed by healthy same-component reuse;
• Box acquisition/binding/export and both automatic and explicit file reply paths, plus unavailable-Box isolation.

tests/test_shared_release.py checks real SDK PluginDependencyEnvironmentStore preparation/cache readback through the SDK's direct OSS installer into a disposable directory. It does not mutate the Runtime virtualenv or substitute an SDK stub.

Build once from this directory using the official CLI, then preserve the bytes:

python -m langbot_plugin.cli.__init__ build -o /absolute/external/candidate-directory

From the repository, verify the frozen package:

python Runner/certification-tests/verify_localagent_candidate.py \
  --package /absolute/external/candidate-directory/langbot-team-LocalAgent-0.2.1.lbpkg \
  --evidence /absolute/external/new-evidence-directory

The verifier requires committed clean plugin source, compares every archive entry against Git (regenerating only the SDK-serialized manifest), verifies the installed SDK distribution RECORD, installs the exact archive with PluginArtifactStore, prepares/reuses its dependency environment without shadow-installing the SDK, and runs the packaged suite from the read-only extraction in a fresh Python process. It records hashes, commands and results.

Limits

The Host/model/storage/credential/Box responses are fixtures, not genuine upstream service responses. These tests are not Core database/RLS acceptance, actual multi-Workspace installation, OS worker-supervisor/nsjail enforcement, real Box filesystem execution, or a real provider request. They do not bypass certificate admission. Final live execution and signing belong to the release owner.