fix(harness): keep reading_inputs through every re-save of a seeded contract (TH-8952)

src/fi/alk/harness/contract.py

@@ -13,6 +13,7 @@
 
 import collections.abc
 import json
+import logging
 import os
 import re
 import shlex
@@ -1483,6 +1484,10 @@ def adoptable(self, tool: str) -> bool:
     "RuntimeHttpSetupRequest",
 )
 CONTRACT_FILE = "contract.json"
+# What a reading was made from, saved beside its contract and outside the model: a build handed
+# that reading is told apart from one that read the agent itself by this key alone, so every
+# later save of the contract keeps it.
+READING_RECORD = "reading_inputs"
 _SEQUENCES = (
     list,
     tuple,
@@ -1562,6 +1567,32 @@ def walk(annotation: Any, saved: Any, held: Any) -> None:
     return pairs
 
 
+def _saved_record(path: Path) -> dict[str, Any]:
+    """The reading's record in the contract saved at ``path``, as ``{key: value}``; empty when
+    there is no file, no record in it, or it can't be read as a JSON object."""
+    try:
+        raw = path.read_bytes()
+    except FileNotFoundError:
+        return {}
+    except OSError as exc:
+        # The save goes on without it, so a seeded build saves as an unseeded one: log the error
+        # in full. The file is the kit's own contract, not the customer's source.
+        logging.getLogger(__name__).warning(
+            "reading record not carried; class: %s", type(exc).__name__, exc_info=True
+        )
+        return {}
+    # A contract that never held a record is not parsed again.
+    if READING_RECORD.encode() not in raw:
+        return {}
+    try:
+        saved = json.loads(raw.decode("utf-8"))
+    except (UnicodeDecodeError, ValueError, RecursionError):
+        return {}
+    if not isinstance(saved, dict) or READING_RECORD not in saved:
+        return {}
+    return {READING_RECORD: saved[READING_RECORD]}
+
+
 def write_contract(contract: AgentContract, destination: Path) -> AgentContract:
     """Save the contract to ``destination/contract.json``, its free text cleaned of URL credentials.
 
@@ -1570,6 +1601,10 @@ def write_contract(contract: AgentContract, destination: Path) -> AgentContract:
     so a write that fails partway leaves the earlier contract as it was. Only then are the
     cleaned values copied back onto ``contract`` itself, in place: the stage and its tools hold
     that object, and a fresh one would leave them working from the raw text. It is returned too.
+
+    The record of what a reading was made from is not part of the model. When the contract
+    already saved at ``destination`` holds one, the new save keeps its value, first, as the
+    reading put it; a save where none is held writes none.
     """
     body = contract.model_dump()
     places: list[tuple[Any, Any, Any, str]] = []
@@ -1589,8 +1624,11 @@ def write_contract(contract: AgentContract, destination: Path) -> AgentContract:
     destination.mkdir(parents=True, exist_ok=True)
     path = destination / CONTRACT_FILE
     partial = destination / f".{CONTRACT_FILE}.{os.getpid()}.{threading.get_ident()}"
+    written = {**_saved_record(path), **body}
     try:
-        partial.write_text(json.dumps(body, indent=2, ensure_ascii=False), encoding="utf-8")
+        partial.write_text(
+            json.dumps(written, indent=2, ensure_ascii=False), encoding="utf-8"
+        )
         # Synced before the move, so the move never publishes a file the disk does not hold.
         descriptor = os.open(partial, os.O_RDONLY)
         try:

src/fi/alk/harness/seed_contract.py

@@ -20,6 +20,7 @@
 from typing import Any, NamedTuple
 
 from .agent_type_check import EXIT_REFUSED
+from .contract import READING_RECORD
 from .failure_file import write_failure_file
 from .job import (
     FailureDomain,
@@ -31,7 +32,7 @@
 )
 from .reading_result import _CONTRACT_LIMIT_BYTES
 
-RECORD_KEY = "reading_inputs"
+RECORD_KEY = READING_RECORD
 SEED_ACCEPTED = ".futureagi-seed-accepted"
 SEED_CONTRACT_INVALID = "seed_contract_invalid"
 SEED_CONTRACT_TOO_LARGE = "seed_contract_too_large"

tests/harness/test_contract_writer.py

@@ -305,6 +305,82 @@ def test_writing_a_written_contract_again_changes_nothing(tmp_path: Path) -> Non
     assert (tmp_path / "second" / "contract.json").read_bytes() == first
 
 
+# What a reading saves beside its contract; any JSON value is kept as it was.
+RECORD = {
+    "version": 1,
+    "source": {"kind": "archive", "archive_artifact_id": "upload-1"},
+    "subfolder": "agents/a",
+    "evals_sha256": None,
+    "generic_harness_v1": True,
+    "odd": [0.1, "日本", {"nested": [None, False]}],
+}
+
+
+def _canon(value: Any) -> str:
+    return json.dumps(value, sort_keys=True, separators=(",", ":"), ensure_ascii=False)
+
+
+def test_write_contract_keeps_the_record_saved_beside_the_contract(
+    tmp_path: Path,
+) -> None:
+    held = _full_contract()
+    body = {**held.model_dump(), contract_module.READING_RECORD: RECORD}
+    (tmp_path / "contract.json").write_text(json.dumps(body), encoding="utf-8")
+
+    write_contract(held, tmp_path)
+    saved = json.loads((tmp_path / "contract.json").read_text(encoding="utf-8"))
+    write_contract(AgentContract.model_validate(saved), tmp_path)
+    again = json.loads((tmp_path / "contract.json").read_text(encoding="utf-8"))
+
+    for one in (saved, again):
+        assert next(iter(one)) == contract_module.READING_RECORD
+        assert _canon(one[contract_module.READING_RECORD]) == _canon(RECORD)
+    # Kept outside the model: neither the schema a model writes against nor the repair's hash
+    # of the contract sees it.
+    assert (
+        contract_module.READING_RECORD
+        not in AgentContract.model_json_schema()["properties"]
+    )
+    assert runtime_repair._contract_hash(
+        AgentContract.model_validate(again)
+    ) == runtime_repair._contract_hash(held)
+
+
+@pytest.mark.parametrize(
+    "saved",
+    [
+        None,
+        b"{}",
+        json.dumps({"agent": "a", "notes": "no reading_inputs here"}).encode(),
+        json.dumps({"runtime": {"reading_inputs": RECORD}}).encode(),
+        json.dumps(["reading_inputs", RECORD]).encode(),
+        b'{"reading_inputs": ',
+        b'\xff{"reading_inputs": {}}',
+    ],
+    ids=[
+        "no_file",
+        "empty",
+        "named_in_prose",
+        "nested",
+        "not_an_object",
+        "not_json",
+        "not_utf8",
+    ],
+)
+def test_write_contract_writes_no_record_where_none_is_saved(
+    tmp_path: Path, saved: bytes | None
+) -> None:
+    if saved is not None:
+        (tmp_path / "contract.json").write_bytes(saved)
+    write_contract(_full_contract(), tmp_path / "fresh")
+
+    write_contract(_full_contract(), tmp_path)
+
+    written = (tmp_path / "contract.json").read_bytes()
+    assert contract_module.READING_RECORD not in json.loads(written)
+    assert written == (tmp_path / "fresh" / "contract.json").read_bytes()
+
+
 def test_write_contract_cleans_the_callers_object_in_place_and_returns_it(tmp_path: Path) -> None:
     held = _full_contract()
     rules, tool = held.hard_constraints, held.tools[0]