Move CORA's background runtimes onto the door they actually arrive at

apps/api/src/cora/agent/subscribers/authority_revocation_holder.py

@@ -131,7 +131,7 @@
 from cora.infrastructure.event_envelope import to_new_event
 from cora.infrastructure.logging import get_logger
 from cora.infrastructure.ports import ConcurrencyError, Deny
-from cora.infrastructure.routing import NIL_SENTINEL_ID
+from cora.infrastructure.routing import NIL_SENTINEL_ID, SYSTEM_IN_PROCESS_SURFACE_ID
 from cora.run.aggregates.run import (
     HOLD_CAUSE_AUTHORITY_REVOCATION,
     RunHeld,
@@ -340,7 +340,7 @@ async def _issue_hold(self, *, run_id: UUID, decision_id: UUID) -> tuple[str, st
             principal_id=AUTHORITY_REVOCATION_HOLDER_AGENT_ID,
             command_name=_HOLD_COMMAND_NAME,
             conduit_id=NIL_SENTINEL_ID,
-            surface_id=NIL_SENTINEL_ID,
+            surface_id=SYSTEM_IN_PROCESS_SURFACE_ID,
         )
         if isinstance(authz, Deny):
             return "HoldDeferred", "not authorized to hold (Authorize denied)"

apps/api/src/cora/agent/subscribers/caution_promoter.py

@@ -101,7 +101,7 @@
 from cora.infrastructure.event_envelope import to_new_event
 from cora.infrastructure.logging import get_logger
 from cora.infrastructure.ports import ConcurrencyError, Deny
-from cora.infrastructure.routing import NIL_SENTINEL_ID
+from cora.infrastructure.routing import NIL_SENTINEL_ID, SYSTEM_IN_PROCESS_SURFACE_ID
 from cora.shared.identity import ActorId
 
 if TYPE_CHECKING:
@@ -294,7 +294,7 @@ async def _evaluate(self, view: ProposedCautionView, decision: Decision) -> tupl
             principal_id=CAUTION_PROMOTER_AGENT_ID,
             command_name=_PROMOTE_COMMAND_NAME,
             conduit_id=NIL_SENTINEL_ID,
-            surface_id=NIL_SENTINEL_ID,
+            surface_id=SYSTEM_IN_PROCESS_SURFACE_ID,
         )
         if isinstance(authz, Deny):
             return "PromotionDeferred", "not authorized to promote (Authorize denied)"

apps/api/src/cora/agent/subscribers/ratification_hold.py

@@ -30,7 +30,7 @@
 from cora.infrastructure.event_envelope import to_new_event
 from cora.infrastructure.logging import get_logger
 from cora.infrastructure.ports import ConcurrencyError, Deny
-from cora.infrastructure.routing import NIL_SENTINEL_ID
+from cora.infrastructure.routing import NIL_SENTINEL_ID, SYSTEM_IN_PROCESS_SURFACE_ID
 from cora.run.aggregates.run import HOLD_CAUSE_RATIFICATION, RunHeld, RunStatus
 from cora.run.aggregates.run import event_type_name as run_event_type_name
 from cora.run.aggregates.run import fold as fold_run
@@ -108,7 +108,7 @@ async def _hold(self, run_id: UUID) -> None:
             principal_id=RATIFICATION_ENFORCER_AGENT_ID,
             command_name=HOLD_COMMAND_NAME,
             conduit_id=NIL_SENTINEL_ID,
-            surface_id=NIL_SENTINEL_ID,
+            surface_id=SYSTEM_IN_PROCESS_SURFACE_ID,
         )
         if isinstance(authz, Deny):
             _log.info("ratification_hold.unauthorized", run_id=str(run_id))

apps/api/src/cora/agent/subscribers/ratification_release.py

@@ -45,7 +45,7 @@
 from cora.infrastructure.event_envelope import to_new_event
 from cora.infrastructure.logging import get_logger
 from cora.infrastructure.ports import ConcurrencyError, Deny
-from cora.infrastructure.routing import NIL_SENTINEL_ID
+from cora.infrastructure.routing import NIL_SENTINEL_ID, SYSTEM_IN_PROCESS_SURFACE_ID
 from cora.run.aggregates.run import (
     HOLD_CAUSE_RATIFICATION,
     HoldClaimReleased,
@@ -132,7 +132,7 @@ async def _resume(self, run_id: UUID) -> None:
             principal_id=RATIFICATION_ENFORCER_AGENT_ID,
             command_name=RESUME_COMMAND_NAME,
             conduit_id=NIL_SENTINEL_ID,
-            surface_id=NIL_SENTINEL_ID,
+            surface_id=SYSTEM_IN_PROCESS_SURFACE_ID,
         )
         if isinstance(authz, Deny):
             _log.info("ratification_release.unauthorized", run_id=str(run_id))

apps/api/src/cora/api/_calibration_watcher.py

@@ -54,7 +54,7 @@
 from cora.calibration.errors import UnauthorizedError
 from cora.calibration.features.list_calibrations import ListCalibrations
 from cora.decision.aggregates.decision import DECISION_CONTEXT_CALIBRATION_VERIFICATION
-from cora.infrastructure.routing import NIL_SENTINEL_ID
+from cora.infrastructure.routing import SYSTEM_IN_PROCESS_SURFACE_ID
 
 if TYPE_CHECKING:
     from collections.abc import AsyncGenerator
@@ -137,7 +137,7 @@ async def _drain_provisional_calibrations(
             ),
             principal_id=CALIBRATION_WATCHER_AGENT_ID,
             correlation_id=deps.id_generator.new_id(),
-            surface_id=NIL_SENTINEL_ID,
+            surface_id=SYSTEM_IN_PROCESS_SURFACE_ID,
         )
         items.extend(page.items)
         if page.next_cursor is None:

apps/api/src/cora/api/_campaign_watcher.py

@@ -64,7 +64,7 @@
 from cora.campaign.errors import UnauthorizedError
 from cora.campaign.features.list_campaigns import ListCampaigns
 from cora.decision.aggregates.decision import DECISION_CONTEXT_CAMPAIGN_PROGRESS
-from cora.infrastructure.routing import NIL_SENTINEL_ID
+from cora.infrastructure.routing import SYSTEM_IN_PROCESS_SURFACE_ID
 
 if TYPE_CHECKING:
     from collections.abc import AsyncGenerator
@@ -139,7 +139,7 @@ async def _drain_held_campaigns(
             ListCampaigns(statuses=[_STATUS_HELD], cursor=cursor, limit=_PAGE_LIMIT),
             principal_id=CAMPAIGN_WATCHER_AGENT_ID,
             correlation_id=deps.id_generator.new_id(),
-            surface_id=NIL_SENTINEL_ID,
+            surface_id=SYSTEM_IN_PROCESS_SURFACE_ID,
         )
         items.extend(page.items)
         if page.next_cursor is None:

apps/api/src/cora/api/_clearance_expirer.py

@@ -64,7 +64,7 @@
 from cora.infrastructure.event_envelope import to_new_event
 from cora.infrastructure.logging import get_logger
 from cora.infrastructure.ports import ConcurrencyError
-from cora.infrastructure.routing import NIL_SENTINEL_ID
+from cora.infrastructure.routing import SYSTEM_IN_PROCESS_SURFACE_ID
 from cora.safety.aggregates.clearance import (
     ClearanceCannotExpireError,
     ClearanceNotFoundError,
@@ -188,7 +188,7 @@ async def _expire_one(
             ExpireClearance(clearance_id=clearance_id, reason=_EXPIRE_REASON),
             principal_id=CLEARANCE_EXPIRER_AGENT_ID,
             correlation_id=deps.id_generator.new_id(),
-            surface_id=NIL_SENTINEL_ID,
+            surface_id=SYSTEM_IN_PROCESS_SURFACE_ID,
         )
     except (ClearanceNotFoundError, ClearanceCannotExpireError) as exc:
         # The clearance changed under us between the list read and the expire
@@ -230,7 +230,7 @@ async def _drain_active_clearances(
             ListClearances(status="Active", cursor=cursor, limit=_PAGE_LIMIT),
             principal_id=CLEARANCE_EXPIRER_AGENT_ID,
             correlation_id=deps.id_generator.new_id(),
-            surface_id=NIL_SENTINEL_ID,
+            surface_id=SYSTEM_IN_PROCESS_SURFACE_ID,
         )
         items.extend(page.items)
         if page.next_cursor is None:

apps/api/src/cora/api/_clearance_watcher.py

@@ -67,7 +67,7 @@
     record_watcher_decision,
 )
 from cora.decision.aggregates.decision import DECISION_CONTEXT_CLEARANCE_PROGRESS
-from cora.infrastructure.routing import NIL_SENTINEL_ID
+from cora.infrastructure.routing import SYSTEM_IN_PROCESS_SURFACE_ID
 from cora.safety.errors import UnauthorizedError
 from cora.safety.features.get_clearance import GetClearance
 from cora.safety.features.list_clearances import ListClearances
@@ -154,7 +154,7 @@ async def _drain_watched_clearances(
                 ListClearances(status=status, cursor=cursor, limit=_PAGE_LIMIT),
                 principal_id=CLEARANCE_WATCHER_AGENT_ID,
                 correlation_id=deps.id_generator.new_id(),
-                surface_id=NIL_SENTINEL_ID,
+                surface_id=SYSTEM_IN_PROCESS_SURFACE_ID,
             )
             items.extend(page.items)
             if page.next_cursor is None:
@@ -176,7 +176,7 @@ async def _last_review_step_at(
         GetClearance(clearance_id=clearance_id),
         principal_id=CLEARANCE_WATCHER_AGENT_ID,
         correlation_id=deps.id_generator.new_id(),
-        surface_id=NIL_SENTINEL_ID,
+        surface_id=SYSTEM_IN_PROCESS_SURFACE_ID,
     )
     if clearance is None or not clearance.review_steps:
         return None

apps/api/src/cora/api/_durable_copy_registrar.py

@@ -139,7 +139,7 @@ class never reads `dataset.checksum` or `dataset.byte_size` for exactly
 from cora.data.ports.checksum_verifier import Unreachable
 from cora.infrastructure.event_envelope import to_new_event
 from cora.infrastructure.ports import ConcurrencyError, Deny
-from cora.infrastructure.routing import NIL_SENTINEL_ID
+from cora.infrastructure.routing import NIL_SENTINEL_ID, SYSTEM_IN_PROCESS_SURFACE_ID
 from cora.shared.identity import ActorId
 
 if TYPE_CHECKING:
@@ -233,7 +233,7 @@ async def register(
             principal_id=DURABLE_COPY_REGISTRAR_AGENT_ID,
             command_name=_COMMAND_NAME,
             conduit_id=NIL_SENTINEL_ID,
-            surface_id=NIL_SENTINEL_ID,
+            surface_id=SYSTEM_IN_PROCESS_SURFACE_ID,
         )
         if isinstance(decision, Deny):
             return DurableCopyRegisterUnauthorized()

apps/api/src/cora/api/_experiment_steerer.py

@@ -76,7 +76,7 @@
 from cora.infrastructure.ports import ConcurrencyError
 from cora.infrastructure.ports.inference_recorder import AgentInferenceTrace
 from cora.infrastructure.ports.llm import ModelRef
-from cora.infrastructure.routing import NIL_SENTINEL_ID
+from cora.infrastructure.routing import SYSTEM_IN_PROCESS_SURFACE_ID
 from cora.infrastructure.signing import SIGNED_EVENT_TYPES
 from cora.operation.features.conduct_until_advised import ConductUntilAdvised
 from cora.operation.features.hold_procedure import HoldProcedure
@@ -495,7 +495,7 @@ async def steer_experiment(
                 ),
                 principal_id=EXPERIMENT_STEERER_AGENT_ID,
                 correlation_id=correlation_id,
-                surface_id=NIL_SENTINEL_ID,
+                surface_id=SYSTEM_IN_PROCESS_SURFACE_ID,
             )
             break
         if choice == _CHOICE_CONCLUDE:

apps/api/src/cora/api/_flag_watcher.py

@@ -51,7 +51,7 @@
 from cora.infrastructure.event_envelope import to_new_event
 from cora.infrastructure.logging import get_logger
 from cora.infrastructure.ports import ConcurrencyError, Deny
-from cora.infrastructure.routing import NIL_SENTINEL_ID
+from cora.infrastructure.routing import NIL_SENTINEL_ID, SYSTEM_IN_PROCESS_SURFACE_ID
 from cora.shared.identity import ActorId
 
 if TYPE_CHECKING:
@@ -80,14 +80,15 @@ async def probe_read_grant(
     / test never trip it; under a real policy a missing grant is the silent
     worse-than-none failure, so it is surfaced loudly at boot when an operator is
     watching. Probes the exact tuple the runtime drain uses (the read
-    `command_name`, NIL conduit + surface). `strict` (operator opt-in via
-    `settings.watcher_authz_strict`) escalates the warning to a boot refusal.
+    `command_name`, the NIL conduit, and the in-process surface). `strict`
+    (operator opt-in via `settings.watcher_authz_strict`) escalates the
+    warning to a boot refusal.
     """
     decision = await deps.authz.authorize(
         principal_id=agent_id,
         command_name=read_command,
         conduit_id=NIL_SENTINEL_ID,
-        surface_id=NIL_SENTINEL_ID,
+        surface_id=SYSTEM_IN_PROCESS_SURFACE_ID,
     )
     if not isinstance(decision, Deny):
         return

apps/api/src/cora/api/_procedure_watcher.py

@@ -68,7 +68,7 @@
     record_watcher_decision,
 )
 from cora.decision.aggregates.decision import DECISION_CONTEXT_PROCEDURE_PROGRESS
-from cora.infrastructure.routing import NIL_SENTINEL_ID
+from cora.infrastructure.routing import SYSTEM_IN_PROCESS_SURFACE_ID
 from cora.operation.adapters.postgres_procedure_activity_lookup import (
     PostgresProcedureActivityLookup,
 )
@@ -166,7 +166,7 @@ async def _drain_watched_procedures(
                 ListProcedures(status=status, cursor=cursor, limit=_PAGE_LIMIT),
                 principal_id=PROCEDURE_WATCHER_AGENT_ID,
                 correlation_id=deps.id_generator.new_id(),
-                surface_id=NIL_SENTINEL_ID,
+                surface_id=SYSTEM_IN_PROCESS_SURFACE_ID,
             )
             items.extend(page.items)
             if page.next_cursor is None:

apps/api/src/cora/api/_run_initiator.py

@@ -62,7 +62,7 @@
 from cora.infrastructure.event_envelope import to_new_event
 from cora.infrastructure.logging import get_logger
 from cora.infrastructure.ports import ConcurrencyError
-from cora.infrastructure.routing import NIL_SENTINEL_ID
+from cora.infrastructure.routing import SYSTEM_IN_PROCESS_SURFACE_ID
 from cora.run.errors import UnauthorizedError
 from cora.run.features.list_runs import ListRuns
 from cora.run.features.start_run import StartRun
@@ -206,7 +206,7 @@ async def initiate_run(
             ),
             principal_id=RUN_INITIATOR_AGENT_ID,
             correlation_id=deps.id_generator.new_id(),
-            surface_id=NIL_SENTINEL_ID,
+            surface_id=SYSTEM_IN_PROCESS_SURFACE_ID,
         )
     except UnauthorizedError:
         # Configuration fault: the initiator principal is not granted StartRun.
@@ -225,7 +225,7 @@ async def _drain_running_runs(list_runs: ListRunsHandler, deps: Kernel) -> list[
             ListRuns(status="Running", cursor=cursor, limit=_PAGE_LIMIT),
             principal_id=RUN_INITIATOR_AGENT_ID,
             correlation_id=deps.id_generator.new_id(),
-            surface_id=NIL_SENTINEL_ID,
+            surface_id=SYSTEM_IN_PROCESS_SURFACE_ID,
         )
         items.extend(page.items)
         if page.next_cursor is None:
@@ -245,7 +245,7 @@ async def _drain_mounted_subjects(
             ListSubjects(status="Mounted", cursor=cursor, limit=_PAGE_LIMIT),
             principal_id=RUN_INITIATOR_AGENT_ID,
             correlation_id=deps.id_generator.new_id(),
-            surface_id=NIL_SENTINEL_ID,
+            surface_id=SYSTEM_IN_PROCESS_SURFACE_ID,
         )
         items.extend(page.items)
         if page.next_cursor is None:

apps/api/src/cora/api/_run_supervisor.py

@@ -103,7 +103,7 @@
 from cora.infrastructure.event_envelope import to_new_event
 from cora.infrastructure.logging import get_logger
 from cora.infrastructure.ports import ConcurrencyError
-from cora.infrastructure.routing import NIL_SENTINEL_ID
+from cora.infrastructure.routing import SYSTEM_IN_PROCESS_SURFACE_ID
 from cora.recipe.aggregates.method import load_method
 from cora.recipe.aggregates.plan import load_plan
 from cora.recipe.aggregates.practice import load_practice
@@ -721,7 +721,7 @@ async def _issue_hold(
             HoldRun(run_id=run_id, decided_by_decision_id=decision_id, cause=HOLD_CAUSE_SUPERVISOR),
             principal_id=RUN_SUPERVISOR_AGENT_ID,
             correlation_id=deps.id_generator.new_id(),
-            surface_id=NIL_SENTINEL_ID,
+            surface_id=SYSTEM_IN_PROCESS_SURFACE_ID,
         )
     except (RunCannotHoldError, RunNotFoundError) as exc:
         # The Run changed under us between read and issue (someone else acted,
@@ -754,7 +754,7 @@ async def _issue_resume(
             ),
             principal_id=RUN_SUPERVISOR_AGENT_ID,
             correlation_id=deps.id_generator.new_id(),
-            surface_id=NIL_SENTINEL_ID,
+            surface_id=SYSTEM_IN_PROCESS_SURFACE_ID,
         )
     except (RunCannotResumeError, RunNotFoundError) as exc:
         # The Run changed under us between read and issue (an operator resumed
@@ -793,7 +793,7 @@ async def _issue_truncate(
             ),
             principal_id=RUN_SUPERVISOR_AGENT_ID,
             correlation_id=deps.id_generator.new_id(),
-            surface_id=NIL_SENTINEL_ID,
+            surface_id=SYSTEM_IN_PROCESS_SURFACE_ID,
         )
     except (RunCannotTruncateError, RunNotFoundError) as exc:
         # The Run changed under us between read and issue (someone else acted, or
@@ -886,7 +886,7 @@ async def _issue_abort(
             ),
             principal_id=RUN_SUPERVISOR_AGENT_ID,
             correlation_id=deps.id_generator.new_id(),
-            surface_id=NIL_SENTINEL_ID,
+            surface_id=SYSTEM_IN_PROCESS_SURFACE_ID,
         )
     except (RunCannotAbortError, RunNotFoundError) as exc:
         _log.info("run_supervisor.abort_skipped", run_id=str(run_id), reason=type(exc).__name__)
@@ -912,7 +912,7 @@ async def _issue_stop(
             StopRun(run_id=run_id, reason=reason, decided_by_decision_id=decision_id),
             principal_id=RUN_SUPERVISOR_AGENT_ID,
             correlation_id=deps.id_generator.new_id(),
-            surface_id=NIL_SENTINEL_ID,
+            surface_id=SYSTEM_IN_PROCESS_SURFACE_ID,
         )
     except (RunCannotStopError, RunNotFoundError) as exc:
         _log.info("run_supervisor.stop_skipped", run_id=str(run_id), reason=type(exc).__name__)
@@ -1014,7 +1014,7 @@ async def _drain_runs(
             ListRuns(status=status, cursor=cursor, limit=_PAGE_LIMIT),
             principal_id=RUN_SUPERVISOR_AGENT_ID,
             correlation_id=deps.id_generator.new_id(),
-            surface_id=NIL_SENTINEL_ID,
+            surface_id=SYSTEM_IN_PROCESS_SURFACE_ID,
         )
         items.extend(page.items)
         if page.next_cursor is None: