@boardwalk-labs/runner 0.1.11 → 0.1.12

package/binding.gyp

@@ -0,0 +1,12 @@
+{
+  "targets": [
+    {
+      "target_name": "bw_reseed",
+      "sources": ["native/reseed.c"],
+      "include_dirs": ["<(node_root_dir)/deps/openssl/openssl/include"],
+      "conditions": [
+        ["OS=='linux'", { "cflags": ["-fvisibility=hidden"] }]
+      ]
+    }
+  ]
+}

package/dist/runtime/agent/budget.d.ts

@@ -74,7 +74,7 @@ export declare class BudgetMeter {
     constructor(opts: BudgetMeterOptions);
     /**
      * Add a usage delta to the accumulator + recompute USD. `realCostUsd`, when provided, is the EXACT
-     * upstream cost the broker observed for this turn (OpenRouter's per-request `usage.cost`) — used
+     * upstream cost the broker observed for this turn (the managed provider's per-request cost) — used
      * verbatim so the `max_usd` cap tracks ACTUAL spend (already cache-discounted, model-correct).
      * Omitted for a BYO turn (no upstream price) or a managed turn whose cost the broker couldn't read,
      * which fall back to the representative-rate {@link costFor} estimate. Token counts accumulate on
@@ -83,7 +83,7 @@ export declare class BudgetMeter {
     addUsage(delta: UsageDelta, realCostUsd?: number): void;
     /**
      * THIS SESSION's accumulator snapshot (excludes prior-session usage). Read by per-session token
-     * metering — which reports token deltas to Stripe (deferred; not yet wired into the brokered
+     * metering — which reports token deltas to the platform (deferred; not yet wired into the brokered
      * loop) — and by audit/post-run cost rollups. Cap enforcement uses {@link cumulative} instead.
      */
     snapshot(): BudgetSnapshot;
@@ -92,7 +92,7 @@ export declare class BudgetMeter {
      * construction. Cap enforcement ({@link assertWithinCaps}) and checkpoint persistence use
      * this so a run that resumes after a sleep/wait/crash is bounded by its declared caps across
      * the whole run — not once per session. `snapshot()` stays session-local because
-     * per-session token metering reports token deltas; seeding it would double-report to Stripe.
+     * per-session token metering reports token deltas; seeding it would double-report usage.
      */
     cumulative(): BudgetSnapshot;
     /**
@@ -116,8 +116,8 @@ export declare class BudgetMeter {
     /**
      * USD cost for a single delta — the representative-rate ESTIMATE used only when the broker reports
      * no real upstream cost for the turn (a BYO-provider turn, or a managed turn whose cost tap missed).
-     * Managed turns instead carry OpenRouter's exact `usage.cost` through to {@link addUsage}. Public so
-     * the loop can stamp the per-step `cost_usd` column on `run_steps` without re-deriving the rate table.
+     * Managed turns instead carry the managed provider's exact per-request cost through to {@link addUsage}. Public so
+     * the loop can stamp the per-step cost without re-deriving the rate table.
      */
     costFor(delta: UsageDelta): number;
 }

package/dist/runtime/agent/budget.js

@@ -5,12 +5,12 @@
 // `AppError(BUDGET_EXCEEDED)` and the loop tears down with a `turn_ended
 // reason='error'` event.
 //
-// USD here tracks the bill closely: for a MANAGED turn the meter is fed OpenRouter's exact per-request
-// `usage.cost` (already cache-discounted + model-correct), so the `max_usd` cap reflects real spend —
+// USD here tracks the bill closely: for a MANAGED turn the meter is fed the managed provider's exact
+// per-request cost (already cache-discounted + model-correct), so the `max_usd` cap reflects real spend —
 // not a hand-rolled token estimate. Only a BYO turn (no upstream price) or a managed turn whose cost
 // the broker couldn't read falls back to a single flat representative rate
 // (`model_rates.ts::BUDGET_GUARDRAIL_RATE`), since a per-`agent()`-model run has no one model. Actual
-// billing remains per-request cost pass-through via Stripe meters (the platform spec). The meter takes
+// billing is metered by the platform, not by the runner. The meter takes
 // the fallback rate as a constructor arg so tests inject a fixed rate.
 import { AppError, ErrorCode } from "../support/index.js";
 const ZERO_PRIOR = {
@@ -44,7 +44,7 @@ export class BudgetMeter {
     }
     /**
      * Add a usage delta to the accumulator + recompute USD. `realCostUsd`, when provided, is the EXACT
-     * upstream cost the broker observed for this turn (OpenRouter's per-request `usage.cost`) — used
+     * upstream cost the broker observed for this turn (the managed provider's per-request cost) — used
      * verbatim so the `max_usd` cap tracks ACTUAL spend (already cache-discounted, model-correct).
      * Omitted for a BYO turn (no upstream price) or a managed turn whose cost the broker couldn't read,
      * which fall back to the representative-rate {@link costFor} estimate. Token counts accumulate on
@@ -59,7 +59,7 @@ export class BudgetMeter {
     }
     /**
      * THIS SESSION's accumulator snapshot (excludes prior-session usage). Read by per-session token
-     * metering — which reports token deltas to Stripe (deferred; not yet wired into the brokered
+     * metering — which reports token deltas to the platform (deferred; not yet wired into the brokered
      * loop) — and by audit/post-run cost rollups. Cap enforcement uses {@link cumulative} instead.
      */
     snapshot() {
@@ -78,7 +78,7 @@ export class BudgetMeter {
      * construction. Cap enforcement ({@link assertWithinCaps}) and checkpoint persistence use
      * this so a run that resumes after a sleep/wait/crash is bounded by its declared caps across
      * the whole run — not once per session. `snapshot()` stays session-local because
-     * per-session token metering reports token deltas; seeding it would double-report to Stripe.
+     * per-session token metering reports token deltas; seeding it would double-report usage.
      */
     cumulative() {
         const s = this.snapshot();
@@ -159,8 +159,8 @@ export class BudgetMeter {
     /**
      * USD cost for a single delta — the representative-rate ESTIMATE used only when the broker reports
      * no real upstream cost for the turn (a BYO-provider turn, or a managed turn whose cost tap missed).
-     * Managed turns instead carry OpenRouter's exact `usage.cost` through to {@link addUsage}. Public so
-     * the loop can stamp the per-step `cost_usd` column on `run_steps` without re-deriving the rate table.
+     * Managed turns instead carry the managed provider's exact per-request cost through to {@link addUsage}. Public so
+     * the loop can stamp the per-step cost without re-deriving the rate table.
      */
     costFor(delta) {
         const inputCost = ((delta.inputTokens ?? 0) * this.rate.inputPerMillion) / 1_000_000;

package/dist/runtime/agent/model_rates.js

@@ -1,17 +1,16 @@
 // The flat budget-guardrail rate — the FALLBACK basis for the in-run `max_usd` cap (BudgetMeter).
 //
-// A MANAGED turn now caps on OpenRouter's EXACT per-request `usage.cost`, forwarded from the broker to
+// A MANAGED turn now caps on the managed provider's EXACT per-request cost, forwarded from the broker to
 // the worker (inference_proxy result frame → BudgetMeter.addUsage `realCostUsd`), so the cap tracks
 // real spend — already cache-discounted + model-correct. This flat rate is used ONLY when a turn has
 // no upstream cost: a BYO-provider turn (the org pays its own key), or a managed turn whose cost the
-// broker couldn't read. It bounds runaway loops; it is NOT the bill. Actual billing is per-request
-// COST PASS-THROUGH (OpenRouter's reported cost × margin) via Stripe meters (domain/billing +
-// run_usage_service). the platform spec
+// broker couldn't read. It bounds runaway loops; it is NOT the bill. Actual billing is metered by the
+// platform, not by the runner.
 //
 // Deliberately NOT a per-model table with a silent fallback: a lookup that returns a Sonnet-class
 // default for any unknown id only created the ILLUSION of precision. The real per-request cost (above)
 // is the precise path; this rate is just the model-agnostic backstop. Un-metered managed models are
-// rejected fail-closed at resolution (domain/inference/model_resolver), so the cap never has to price
+// rejected fail-closed at resolution by the broker, so the cap never has to price
 // a model we don't support.
 /**
  * The flat representative rate (USD / million tokens) the BudgetMeter applies to the `max_usd` cap

package/dist/runtime/agent/secret_redactor.js

@@ -1,4 +1,4 @@
-// SecretRedactor — scrubs known secret values from everything bound for an LLM (the platform spec).
+// SecretRedactor — scrubs known secret values from everything bound for an LLM.
 //
 // The architectural guarantee is structural: secrets live ONLY in the workflow PROGRAM (the trusted
 // deterministic tool layer), which holds them via `secrets.get` / `ctx.secrets.resolve`. The

package/dist/runtime/cancel_watcher.js

@@ -1,4 +1,4 @@
-// CancelWatcher — stops a run when the user cancels it mid-flight (the platform spec).
+// CancelWatcher — stops a run when the user cancels it mid-flight.
 //
 // The user-cancel counterpart to CreditWatcher. One per run session. On a timer it asks — through the
 // broker (`GET /cancel`, since the runner holds no DB/Redis credential) — whether the run has been

package/dist/runtime/credit_watcher.d.ts

@@ -4,7 +4,7 @@ export interface CreditWatcherDeps {
     /** The run being watched (for correlation/logging). */
     runId: string;
     /** Resolves true while the org can keep spending; false once it's out of credit. Brokered
-     *  (`RunnerControlClient.checkCredit` → `GET /credit`), so the runner never reads Stripe. */
+     *  (`RunnerControlClient.checkCredit` → `GET /credit`), so the runner never reads billing state directly. */
     isFunded: () => Promise<boolean>;
     /** Fired exactly once when the org is first seen to be out of credit. */
     onExhausted: () => void;

package/dist/runtime/credit_watcher.js

@@ -1,14 +1,14 @@
-// CreditWatcher — stops a run when its org runs out of prepaid credit mid-flight (the platform spec).
+// CreditWatcher — stops a run when its org runs out of prepaid credit mid-flight.
 //
 // One per run session. On a timer it asks — through the broker (`GET /credit`, since the runner holds
-// no Stripe credential) — whether the org is still funded; the FIRST time it isn't, it fires
+// no billing credential) — whether the org is still funded; the FIRST time it isn't, it fires
 // `onExhausted` once (the orchestrator wires this to `AbortController.abort`, which the WorkflowHost
 // honors cooperatively) and stops checking. This is the org-level counterpart to the per-run
-// BudgetMeter cap: the run can't see Stripe balances, so funding is enforced here, out of band,
+// BudgetMeter cap: the run can't see its billing balance, so funding is enforced here, out of band,
 // against the live balance that incremental token metering keeps fresh.
 //
-// "Prompt, not instant": Stripe meter aggregation is eventually-consistent and the host honors the
-// abort at the next hook boundary, so a run stops within ~one check interval (plus Stripe's lag) of
+// "Prompt, not instant": the platform's usage metering is eventually-consistent and the host honors the
+// abort at the next hook boundary, so a run stops within ~one check interval (plus metering lag) of
 // going unfunded — bounding overshoot, not eliminating it. Applies to MANAGED and BYOK runs alike,
 // since runtime always burns credit (the gate requires the runtime floor regardless of token billing).
 import { createLogger } from "./support/index.js";

package/dist/runtime/freeze_coordinator.d.ts

@@ -51,6 +51,11 @@ export type FreezeOutcome = {
 } | {
     kind: "aborted";
     reason: string;
+}
+/** The caller withdrew the wait via its abort signal BEFORE it froze (register-without-release:
+ *  a held gate got its answer during the hold, so it resolves in-process instead of freezing). */
+ | {
+    kind: "withdrawn";
 };
 export interface FreezeCoordinatorHooks {
     /** Runs at quiescence, immediately before the freeze is requested: flush billable runtime
@@ -104,7 +109,7 @@ export declare class FreezeCoordinator {
      * the abort (the seam then holds in-process); other reasons retry the freeze after a
      * backoff. Concurrent suspending waits serialize through an internal chain.
      */
-    suspendingWait(signal: SuspendSignal): Promise<FreezeOutcome>;
+    suspendingWait(signal: SuspendSignal, abort?: AbortSignal): Promise<FreezeOutcome>;
     /** Relay handler: a wake injection landed. Validates, runs the after-wake hook (token
      *  swap + meter rebase), confirms to init, and resolves the parked seam. A wake with no
      *  parked seam is a duplicate delivery — re-confirm (idempotent), never crash. */

package/dist/runtime/freeze_coordinator.js

@@ -126,7 +126,7 @@ export class FreezeCoordinator {
      * the abort (the seam then holds in-process); other reasons retry the freeze after a
      * backoff. Concurrent suspending waits serialize through an internal chain.
      */
-    suspendingWait(signal) {
+    suspendingWait(signal, abort) {
         const turn = this.chain;
         let release = () => undefined;
         this.chain = new Promise((resolve) => {
@@ -137,7 +137,14 @@ export class FreezeCoordinator {
             try {
                 let backoff = ABORT_RETRY_INITIAL_MS;
                 for (;;) {
-                    await this.awaitQuiescence();
+                    // Withdraw window: the abort can cancel the wait any time BEFORE it sends
+                    // suspend_request (once sent, the VM freezes and the abort is moot — the process is
+                    // paused). This is register-without-release: a held gate answered during the hold.
+                    // awaitQuiescence short-circuits when already aborted, so one check after it covers
+                    // both loop entry and a mid-hold abort.
+                    await this.awaitQuiescence(abort);
+                    if (abort?.aborted === true)
+                        return { kind: "withdrawn" };
                     try {
                         await this.hooks.onBeforeFreeze?.();
                     }
@@ -167,6 +174,10 @@ export class FreezeCoordinator {
                     this.releaseGate();
                     if (outcome.kind === "wake")
                         return outcome;
+                    // The park only ever resolves wake or aborted (never withdrawn — that returns before the
+                    // park). Narrow explicitly so `.reason` is safe and a stray outcome propagates.
+                    if (outcome.kind !== "aborted")
+                        return outcome;
                     if (signal.reason === "sleep")
                         return outcome;
                     log.warn("suspend_aborted_retrying", {
@@ -228,11 +239,14 @@ export class FreezeCoordinator {
         this.parked = null;
         resolve({ kind: "aborted", reason });
     }
-    awaitQuiescence() {
-        if (this.inFlight === 0)
+    awaitQuiescence(abort) {
+        if (this.inFlight === 0 || abort?.aborted === true)
             return Promise.resolve();
         return new Promise((resolve) => {
+            // Resolve on quiescence OR abort (a held wait wakes immediately to withdraw). Resolving
+            // twice is harmless; endWork may still call the queued waiter later.
             this.quiescenceWaiters.push(resolve);
+            abort?.addEventListener("abort", () => resolve(), { once: true });
         });
     }
     releaseGate() {

package/dist/runtime/index.d.ts

@@ -7,7 +7,7 @@ import { type ProgramWorkerDeps } from "./program_worker.js";
  *  runner holds NO platform credential — only the per-run control-plane handle (run token + broker
  *  URL); everything else is reached through the Runner Control API (the Runner Credential Broker model). */
 export interface WorkerRuntime {
-    /** Stable worker identity stamped onto the lease (ECS task arn / hostname / run-derived). */
+    /** Stable worker identity stamped onto the lease (task ARN / hostname / run-derived). */
     workerId: string;
     /** Sandbox workspace root for filesystem/shell/git tools. */
     workspaceRoot: string;
@@ -33,13 +33,13 @@ export interface WorkerRuntime {
      *  relay's suspend/wake channel — instead of the exit-and-replay path. */
     freezeRelay?: IdentityRelay;
 }
-/** Durable events are deferred (run_step_events table) — live fan-out via the broker only. */
+/** Durable events are deferred (durable event storage) — live fan-out via the broker only. */
 /** Synthesize the run's AuthContext. The run was already authorized at trigger time; the
  *  worker acts on the org's behalf, so it carries the org + an owner role. Tool-level
  *  boundaries (the broker's server-side manifest allowlist) are the real guard.
  *
  *  source='workflow' (NOT 'session_jwt'): the program must never perform SESSION_JWT_ONLY
- *  credential mutations (§12.11), so a tool that ever exposed such a service is denied by
+ *  credential mutations, so a tool that ever exposed such a service is denied by
  *  construction regardless of the owner role. */
 export declare function workerAuthContext(run: Run): AuthContext;
 /**
@@ -57,10 +57,10 @@ export declare function workerAuthContext(run: Run): AuthContext;
  */
 export declare function tokenMeterIdentifiers(runId: string, sessionId: string): (leafIndex: number) => string;
 /** Pure wiring: build the full ProgramWorkerDeps from the control-plane handle. The runner reaches
- *  every privileged seam through the broker over its run token — no DB / Redis / Stripe / model creds. */
+ *  every privileged seam through the broker over its run token — no database, cache, billing, or model creds. */
 export declare function assembleWorkerDeps(runtime: WorkerRuntime): ProgramWorkerDeps;
 /**
- * The per-run platform values the dispatcher injects as container env (ecs_run_task_client.ts). They
+ * The per-run platform values the dispatcher injects as container env. They
  * are captured into private worker state at bootstrap and DELETED from `process.env` before any user
  * program / agent leaf / subprocess can run — the run token + API token are credentials, and nothing
  * untrusted run code touches should inherit them (the run env/credential rules). The user owns the rest
@@ -78,7 +78,7 @@ export interface PlatformContext {
     vcpus: number;
 }
 /** The public-API origin a run uses for raw API / MCP / CLI calls. The broker (Runner Control API)
- *  is hosted on the api-server, so the public API shares its origin; the program appends `/v1` or
+ *  shares an origin with the public API, so the program appends `/v1` or
  *  `/mcp/v1`. Falls back to the broker URL unchanged if it can't be parsed. */
 export declare function publicApiOrigin(controlPlaneBaseUrl: string): string;
 /**

package/dist/runtime/index.js

@@ -1,5 +1,5 @@
-// Worker composition root (the workflow runtime design). The Boardwalk-hosted
-// worker container runs `node dist/fargate/worker/index.js`; the dispatcher launches it per run with
+// Worker composition root (the workflow runtime design). The hosted worker container runs the
+// compiled worker entrypoint; the dispatcher launches it per run with
 // RUN_ID + the per-run control-plane handle. This file assembles real implementations behind every
 // seam `runProgramWorker(runId, deps)` injects, then runs the one workflow program to terminal.
 //
@@ -11,21 +11,21 @@
 //   - secrets.get()   → broker /secrets/resolve (allowlist enforced server-side).
 //   - workflows.call()→ broker /children (durable child run, hold + poll).
 //   - events.emit()   → broker /events (fan-out server-side).
-//   - artifacts / web_search → broker /artifacts + /tools/web_search (no S3 / Tavily creds here).
+//   - artifacts / web_search → broker /artifacts + /tools/web_search (no storage or search-provider creds here).
 //   - lifecycle / usage / telemetry → broker /claim,/version,/finalize,/usage,/telemetry.
-// There is no DB / Redis / Stripe / Bedrock client on the runner — so its task role is near-zero and
-// the metadata-endpoint escape has nothing to steal. The legacy direct (pre-broker) path is removed.
+// There is no database, cache, billing, or model-provider client on the runner — so its task role is
+// near-zero and the metadata-endpoint escape has nothing to steal. The legacy direct (pre-broker) path is removed.
 //
 // Split: `assembleWorkerDeps(runtime)` is pure wiring (unit-tested with a fake fetch); `main()` is the
 // bootstrap shell (read the control-plane env, install signal handlers).
 //
-// Per-session loops wired here (all brokered): a UsageFlusher meters token deltas (§10.7 →
-// /usage/tokens), a CreditWatcher polls funding (§15 → /credit, aborting the run on exhaustion), and a
-// CancelWatcher polls for a user cancel (§6 → /cancel, aborting the run when the user cancels — the
-// brokered worker holds no Redis, so it can't receive the api-server's cancel publish directly).
+// Per-session loops wired here (all brokered): a UsageFlusher meters token deltas (→ /usage/tokens), a
+// CreditWatcher polls funding (→ /credit, aborting the run on exhaustion), and a CancelWatcher polls
+// for a user cancel (→ /cancel, aborting the run when the user cancels — the brokered worker holds no
+// cache client, so it can't receive the platform's cancel publish directly).
 //
-// Documented v0 deferral (a clear seam): durable events — a no-op AgentEventStore (live Redis fan-out
-// via the broker only) until the run_step_events table lands.
+// Documented v0 deferral (a clear seam): durable events — a no-op AgentEventStore (live fan-out
+// via the broker only) until durable event storage lands.
 import { createLogger, newId, AppError, ErrorCode, DEFAULT_LEASE_MS } from "./support/index.js";
 import { LspService } from "@boardwalk-labs/engine/core";
 import { BudgetMeter } from "./agent/budget.js";
@@ -37,6 +37,7 @@ import { EngineLeafExecutor } from "./leaf_executor.js";
 import { parseByoProviders } from "./direct_inference.js";
 import { applyIdentityToEnv, connectIdentityRelayFd, relayFdFromEnv, workerDiagnostics, } from "./identity_relay.js";
 import { FreezeCoordinator } from "./freeze_coordinator.js";
+import { reseedUserspaceCsprng } from "./uniqueness_reseed.js";
 import { WorkerWorkflowHost } from "./workflow_host.js";
 import { runProgramWorker, } from "./program_worker.js";
 import { RunnerControlClient } from "./runner_control_client.js";
@@ -54,13 +55,13 @@ import { PhaseTracker } from "./phase_tracker.js";
 import { mkdir } from "node:fs/promises";
 import { join } from "node:path";
 const log = createLogger("worker_entrypoint");
-/** Durable events are deferred (run_step_events table) — live fan-out via the broker only. */
+/** Durable events are deferred (durable event storage) — live fan-out via the broker only. */
 /** Synthesize the run's AuthContext. The run was already authorized at trigger time; the
  *  worker acts on the org's behalf, so it carries the org + an owner role. Tool-level
  *  boundaries (the broker's server-side manifest allowlist) are the real guard.
  *
  *  source='workflow' (NOT 'session_jwt'): the program must never perform SESSION_JWT_ONLY
- *  credential mutations (§12.11), so a tool that ever exposed such a service is denied by
+ *  credential mutations, so a tool that ever exposed such a service is denied by
  *  construction regardless of the owner role. */
 export function workerAuthContext(run) {
     const userId = run.actor.type === "user" ? run.actor.user_id : `workflow:${run.workflowId}`;
@@ -84,7 +85,7 @@ export function tokenMeterIdentifiers(runId, sessionId) {
     return (leafIndex) => `${runId}:${sessionId}:${String(leafIndex)}:${String(seq++)}`;
 }
 /** Pure wiring: build the full ProgramWorkerDeps from the control-plane handle. The runner reaches
- *  every privileged seam through the broker over its run token — no DB / Redis / Stripe / model creds. */
+ *  every privileged seam through the broker over its run token — no database, cache, billing, or model creds. */
 export function assembleWorkerDeps(runtime) {
     const broker = new RunnerControlClient({
         baseUrl: runtime.controlPlane.baseUrl,
@@ -114,8 +115,9 @@ export function assembleWorkerDeps(runtime) {
         freeze = new FreezeCoordinator({ channel });
         log.info("freeze_mode_enabled", { runId: runtime.runId });
     }
-    // Live agent-event stream → /telemetry (broker publishes to Redis server-side). Inference,
-    // web_search, artifacts, and the model call are all brokered — no Redis / model creds / Tavily / S3.
+    // Live agent-event stream → /telemetry (broker fans out server-side). Inference,
+    // web_search, artifacts, and the model call are all brokered — no cache client, model creds,
+    // search-provider creds, or object-storage creds here.
     const eventPublisher = new BrokerEventPublisher({
         send: (frames) => broker.publishTelemetry(frames),
     });
@@ -129,11 +131,11 @@ export function assembleWorkerDeps(runtime) {
     // bootstrap captured + scrubbed it (capturePlatformContext) so the agent's bash / subprocesses
     // can't read it. The program reaches it ONLY via `runtime.apiToken()` (built below); we still
     // record it in each run's redactor so a value the program threads into a tool can't echo back out
-    // of a tool result. Absent in the dev no-signing-key path. (the run env/credential rules)
+    // of a tool result. Absent in the dev no-signing-key path.
     // MUTABLE: on the snapshot substrate a wake carries a fresh token (the frozen one expired).
     let runApiKey = runtime.controlPlane.apiToken;
-    // The broker (Runner Control API) is hosted on the api-server, so the public API shares its
-    // origin; `runtime.apiUrl` exposes it and the program appends `/v1` or `/mcp/v1`.
+    // The broker (Runner Control API) shares an origin with the public API;
+    // `runtime.apiUrl` exposes it and the program appends `/v1` or `/mcp/v1`.
     const apiUrl = publicApiOrigin(runtime.controlPlane.baseUrl);
     // Per-run host: agent() leaf + sleep-hold + secrets + children + events, all brokered. `signal`
     // carries cooperative cancellation (credit exhaustion) into every host hook.
@@ -143,7 +145,7 @@ export function assembleWorkerDeps(runtime) {
             // Fallback budget-cap rate. A managed turn caps on the broker's EXACT upstream cost (forwarded on
             // the inference result frame → BudgetMeter `realCostUsd`); this representative sonnet-class rate
             // applies only to a turn with no upstream cost (BYO / unavailable). `max_usd` is a guardrail, not
-            // the bill — that's per-leaf cost pass-through at the broker.
+            // the bill — the platform meters the actual per-leaf usage.
             rate: BUDGET_GUARDRAIL_RATE,
             startedAt: Date.now(),
             // deadline_seconds is WALL-CLOCK from the run's ORIGINAL start (incl. suspended idle), so a run
@@ -160,7 +162,7 @@ export function assembleWorkerDeps(runtime) {
         const nextMeterIdentifier = tokenMeterIdentifiers(run.id, meteringSessionId);
         // Per-run secret boundary: every value resolved (program `secrets.get` OR a tool's
         // ctx.secrets.resolve) is recorded into one shared redactor; the leaf seeds a fresh engine
-        // Redactor from it so the loop scrubs those values out of all model-bound content. the platform spec
+        // Redactor from it so the loop scrubs those values out of all model-bound content.
         const redactor = new SecretRedactor();
         // Record the run's own API key so a prompt-injected agent can't echo it back to the model.
         if (runApiKey !== undefined && runApiKey !== "")
@@ -210,9 +212,9 @@ export function assembleWorkerDeps(runtime) {
             // until the artifact extracts. The empty `/workspace` and this dir are SEPARATE dirs on hosted,
             // exactly the two-tier case the engine's AGENTS.md loader is built for.
             programDir: () => programDir,
-            // Per-leaf, per-model token metering — reported THROUGH the broker (the worker holds no Stripe
-            // credential); the broker decides `billed_by_boardwalk` per model + meters to Stripe (BYO models
-            // no-op there). Fire-and-forget: a metering hiccup must never fail the run.
+            // Per-leaf, per-model token metering — reported THROUGH the broker (the worker holds no billing
+            // credential); the broker decides `billed_by_boardwalk` per model + meters usage to the platform
+            // (BYO models no-op there). Fire-and-forget: a metering hiccup must never fail the run.
             meterUsage: ({ model, inputTokens, outputTokens, cachedReadTokens, cachedWriteTokens, leafIndex, }) => {
                 void broker
                     .meterTokens({
@@ -237,7 +239,7 @@ export function assembleWorkerDeps(runtime) {
             // comes from the org's connection vault via the Runner Control API — never stored on the worker.
             brokerMcpToken: (serverUrl, invalidateToken) => broker.mcpToken(serverUrl, invalidateToken),
         });
-        // Per-workflow persistent /workspace (§5): only when the manifest opts in. The BROKER additionally
+        // Per-workflow persistent /workspace: only when the manifest opts in. The BROKER additionally
         // gates on hosted (self-hosted runs get null URLs), and snapshots are keyed per-workflow + scoped
         // by the run token — so even the untrusted in-process program can't reach another tenant's data.
         const workspaceStore = manifest.workspace?.persist === true
@@ -311,6 +313,16 @@ export function assembleWorkerDeps(runtime) {
             // Snapshot-substrate suspension: seams freeze in place under the quiescence gate instead of
             // raising onSuspend (which stays wired as the transitional/local path's fallback).
             ...(freeze !== undefined ? { freeze } : {}),
+            // Register-without-release for held HITL gates — only on the
+            // freeze substrate, backed by the broker's inputs endpoints.
+            ...(freeze !== undefined
+                ? {
+                    heldInput: {
+                        register: (seq, gate) => broker.registerInput(seq, gate),
+                        poll: (seq) => broker.pollInputAnswers(seq),
+                    },
+                }
+                : {}),
             phases: phaseTracker,
         });
         // Late-bind the coordinator's per-run hooks now that the run-scoped objects exist.
@@ -319,18 +331,21 @@ export function assembleWorkerDeps(runtime) {
             let freezeWallMs = 0;
             coordinator.setHooks({
                 // At quiescence, immediately before the freeze: book the runtime tail (suspended time must
-                // never appear billed — SUSPEND_POLICY) and persist the workspace (crash-during-suspension
+                // never appear billed) and persist the workspace (crash-during-suspension
                 // recovery parity with the sleep-hold path). The wall stamp anchors the idle rebase below.
                 onBeforeFreeze: async () => {
                     freezeWallMs = Date.now();
                     await activeFlusher?.flushNow();
                     await workspaceStore?.persist();
                 },
-                // On wake: swap the fresh tokens onto the broker client + the program-facing apiToken()
-                // (recording the new values in the run's redactor, same discipline as boot), and exclude
-                // the frozen window from billed runtime using the wake's authoritative wall clock (the
-                // guest's own clock was stopped).
+                // On wake: reseed the userspace CSPRNG (clause 3 — a suspend snapshot restored more than
+                // once, e.g. a re-dispatch retry, would otherwise repeat its post-wake `crypto.*` draws),
+                // swap the fresh tokens onto the broker client + the program-facing apiToken() (recording
+                // the new values in the run's redactor, same discipline as boot), and exclude the frozen
+                // window from billed runtime using the wake's authoritative wall clock. The reseed runs
+                // BEFORE the seam resolves, so no woken author code draws from the stale (pre-suspend) DRBG.
                 onAfterWake: (wake) => {
+                    reseedUserspaceCsprng();
                     broker.swapRunToken(wake.run_token);
                     redactor.record(wake.run_token);
                     if (wake.api_token !== undefined && wake.api_token !== "") {
@@ -412,7 +427,7 @@ export function assembleWorkerDeps(runtime) {
         suspender: {
             suspend: (signal, workerId) => broker.suspend(signal, workerId),
         },
-        // Runtime metering (§15): flush runtime as periodic deltas (+ a terminal tail) through the broker,
+        // Runtime metering: flush runtime as periodic deltas (+ a terminal tail) through the broker,
         // idempotent per flush, so a long/perpetual run bills as it burns and the credit watcher sees it —
         // not a single charge at terminal (which a never-terminating run never reached). A fresh per-session
         // id keeps a restarted run's sessions distinct in the idempotency key (distinct ids sum).
@@ -434,7 +449,7 @@ export function assembleWorkerDeps(runtime) {
             return { stop: () => flusher.stop(), flushFinal: () => flusher.flushFinal() };
         },
         buildHost,
-        // Mid-run credit watching (§15): a CreditWatcher polls the broker's GET /credit on a timer; when
+        // Mid-run credit watching: a CreditWatcher polls the broker's GET /credit on a timer; when
         // the org runs out, onExhausted aborts the run (the orchestrator wires it to AbortController).
         startCreditWatch: ({ run, onExhausted }) => {
             const watcher = new CreditWatcher({
@@ -445,10 +460,10 @@ export function assembleWorkerDeps(runtime) {
             watcher.start();
             return { stop: () => watcher.stop() };
         },
-        // Mid-run user-cancel watching (§6): a CancelWatcher polls the broker's GET /cancel on a timer;
+        // Mid-run user-cancel watching: a CancelWatcher polls the broker's GET /cancel on a timer;
         // when the user cancels (the run is flipped to `cancelling`), onCancelled aborts the run. This is
-        // how the brokered (Redis-less) worker learns of a cancel — the api-server's Redis publish can't
-        // reach it.
+        // how the brokered (cache-less) worker learns of a cancel — the platform's cancel publish can't
+        // reach it directly.
         startCancelWatch: ({ run, onCancelled }) => {
             const watcher = new CancelWatcher({
                 runId: run.id,
@@ -458,7 +473,7 @@ export function assembleWorkerDeps(runtime) {
             watcher.start();
             return { stop: () => watcher.stop() };
         },
-        // Lease renewal (§6): a LeaseRenewer extends the lease through the broker's POST /renew on a timer
+        // Lease renewal: a LeaseRenewer extends the lease through the broker's POST /renew on a timer
         // (well under the lease), so a run longer than the 5-min lease isn't reclaimed mid-flight by the
         // recovery sweep. `renew` re-extends with the SAME workerId that claimed it; a null result (the
         // run is no longer ours) fires onLost → the run aborts `lease_lost` without finalizing.
@@ -481,7 +496,7 @@ export function assembleWorkerDeps(runtime) {
 }
 // ---- Bootstrap (real container only) -------------------------------------------------
 /**
- * The per-run platform values the dispatcher injects as container env (ecs_run_task_client.ts). They
+ * The per-run platform values the dispatcher injects as container env. They
  * are captured into private worker state at bootstrap and DELETED from `process.env` before any user
  * program / agent leaf / subprocess can run — the run token + API token are credentials, and nothing
  * untrusted run code touches should inherit them (the run env/credential rules). The user owns the rest
@@ -495,7 +510,7 @@ export const PLATFORM_ENV_KEYS = [
     "BOARDWALK_TASK_CPU_UNITS",
 ];
 /** The public-API origin a run uses for raw API / MCP / CLI calls. The broker (Runner Control API)
- *  is hosted on the api-server, so the public API shares its origin; the program appends `/v1` or
+ *  shares an origin with the public API, so the program appends `/v1` or
  *  `/mcp/v1`. Falls back to the broker URL unchanged if it can't be parsed. */
 export function publicApiOrigin(controlPlaneBaseUrl) {
     try {
@@ -519,7 +534,7 @@ export function capturePlatformContext(env) {
         return value.trim();
     };
     // The dispatcher always injects the control-plane handle (the Runner Credential Broker model). The runner is
-    // brokered-only — there is no DB/Redis/Stripe fallback — so a missing handle is a hard config error.
+    // brokered-only — there is no database, cache, or billing fallback — so a missing handle is a hard config error.
     const runId = read("RUN_ID");
     const apiToken = env.BOARDWALK_API_KEY?.trim();
     const controlPlane = {
@@ -552,6 +567,12 @@ export async function main() {
         relay.announceReady(workerDiagnostics());
         const identity = await relay.awaitIdentity();
         applyIdentityToEnv(identity, process.env);
+        // Clause 3 (SNAPSHOT_UNIQUENESS_CONTRACT): this run was restored from the SHARED base
+        // snapshot, so its OpenSSL DRBG is identical to every other run's. Reseed it from the
+        // (VMGenID-diverged) OS entropy BEFORE `acceptIdentity` releases the worker into the brokered
+        // lifecycle — so no `crypto.*` draw by the SDK, the agent, or author code can collide across
+        // clones. Every wake reseeds again (the after-wake hook).
+        reseedUserspaceCsprng();
         relay.acceptIdentity();
         // The relay now becomes the suspend/wake channel: assembleWorkerDeps opens it into the
         // FreezeCoordinator, and the host's suspending seams freeze in place instead of exiting.
@@ -573,11 +594,11 @@ export async function main() {
         ...(byoProviders.length > 0 ? { byoProviders } : {}),
         ...(freezeRelay !== undefined ? { freezeRelay } : {}),
     });
-    // The only thing to drain is the batched telemetry buffer — the runner opens no DB/Redis/SQS.
+    // The only thing to drain is the batched telemetry buffer — the runner opens no database, cache, or queue.
     const cleanup = async () => {
         await deps.flushTelemetry?.().catch(() => undefined);
     };
-    // SIGTERM: ECS is stopping the task. Hold-and-pay has no mid-run checkpoint; we exit and let the
+    // SIGTERM: the orchestrator is stopping the task. Hold-and-pay has no mid-run checkpoint; we exit and let the
     // lease expire → the scheduler-sweep reclaims it and a fresh worker RESTARTS the run from the
     // top (Lambda/GHA semantics; durable children re-attach via idempotency). Crash-safe by design.
     let shuttingDown = false;

package/dist/runtime/leaf_executor.d.ts

@@ -32,7 +32,7 @@ export interface EngineLeafExecutorDeps {
     budget: BudgetMeter;
     /** RUN-level redactor (shared with the secret resolver): every resolved secret value is recorded
      *  here. We seed a fresh engine `Redactor` from it per leaf so the loop scrubs known values out of
-     *  the prompt, tool args/results, and transcript before they reach the model (the platform spec). */
+     *  the prompt, tool args/results, and transcript before they reach the model. */
     redactor: SecretRedactor;
     /** Builds this leaf's event sink; `leafIndex` (1-based) is only a metering identifier — the sink
      *  owns the run-global cursor. `identity` names the leaf on its turn frames. */
@@ -51,7 +51,7 @@ export interface EngineLeafExecutorDeps {
      *  omitted ⇒ no bundled tier (only the workspace AGENTS.md applies). */
     programDir?: () => string | null;
     /** Per-leaf token metering seam (fire-and-forget). Reports THIS leaf's tokens + its model to the
-     *  broker, which decides `billed_by_boardwalk` per model + meters to Stripe. Omitted in tests. */
+     *  broker, which decides `billed_by_boardwalk` per model + meters usage to the platform. Omitted in tests. */
     meterUsage?: (input: MeterUsageInput) => void;
     /** Backend for the engine's host-backed built-in tools (`webfetch` / `web_search` / `artifacts`):
      *  set as the leaf's `capabilities.host` so the engine registers them. Broker-backed on hosted runs

package/dist/runtime/program_runner.d.ts

@@ -53,7 +53,7 @@ export interface ProgramRunnerDeps {
      * Scrubs known secret values out of a string (the run's `SecretRedactor.redactText`). Applied to a
      * top-level throw's message before it is logged AND before it is returned to the worker — a program
      * that resolves a secret and then throws it in an error message must NOT land that secret raw in the
-     * logs or the finalized run output (the platform spec). Defaults to identity (tests/local).
+     * logs or the finalized run output. Defaults to identity (tests/local).
      */
     redactText?: (text: string) => string;
     /**

package/dist/runtime/program_runner.js

@@ -1,6 +1,6 @@
 // WorkflowProgramRunner — executes a workflow program (the JS-body model, the workflow runtime design).
 //
-// A run is the execution of a built program ARTIFACT (§3.9): the worker is handed the VERIFIED tarball
+// A run is the execution of a built program ARTIFACT: the worker is handed the VERIFIED tarball
 // (its sha256 already checked against the pinned digest by the orchestrator) plus the entry module
 // name. This module is the mechanism: it installs the host adapter + trigger payload onto the
 // `@boardwalk-labs/workflow` singleton, extracts the artifact into a unique temp dir under a