@boardwalk-labs/runner 0.1.4 → 0.1.6

package/dist/daemon/daemon.js

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: Apache-2.0
-// The self-hosted runner daemon (docs/SELF_HOSTED_RUNNERS.md R4): poll → claim → spawn ONE run
+// The self-hosted runner daemon (the self-hosted runner design): poll → claim → spawn ONE run
 // process → heartbeat while it runs → clean → poll. One run at a time per daemon (concurrency =
 // more daemons/machines); drain (Ctrl-C, admin drain, org toggle off) finishes the current run
 // then stops claiming. The per-run process is the SAME runtime a Boardwalk-hosted worker boots
@@ -24,7 +24,7 @@ export function runProcessEnv(claim, opts) {
         BOARDWALK_RUN_TOKEN: claim.control_plane.run_token,
         BOARDWALK_API_KEY: claim.control_plane.api_token,
         BOARDWALK_TASK_CPU_UNITS: String(os.cpus().length * 1024),
-        // The org's BYO inference providers, as data (plan D7) — consumed by the runtime's direct
+        // The org's BYO inference providers, as data (the runner-direct BYO design) — consumed by the runtime's direct
         // model path. Names + endpoints + secret NAMES only; never a credential value.
         BOARDWALK_BYO_PROVIDERS: JSON.stringify(claim.byo_providers),
         WORKER_ID: opts.runnerId,
@@ -92,6 +92,10 @@ export function startDaemon(deps) {
     }
     const done = (async () => {
         log.info("daemon_started", { runnerId: deps.runnerId, workDir: deps.workDir });
+        // Reclaim run dirs a previous daemon left behind (crash / SIGKILL / force-quit): a completed
+        // run always cleans its own dir, so anything here is orphaned and may hold a workspace the
+        // crashed run wrote. Best-effort; a failure must not stop the daemon.
+        await rm(path.join(deps.workDir, "runs"), { recursive: true, force: true }).catch(() => undefined);
         while (!draining) {
             deps.onIdle?.();
             try {

package/dist/runtime/agent/budget.d.ts

@@ -20,7 +20,7 @@ export interface UsageDelta {
  * Cumulative usage carried forward from PRIOR worker sessions of the same run. Seeded from the
  * checkpoint on resume so budget caps bound the WHOLE run, not just the current session — a run
  * that sleeps / waits on a child / recovers from a crash must not get a fresh budget each time
- * (review #2). Zero for a fresh run.
+ *. Zero for a fresh run.
  */
 export interface PriorUsage {
     inputTokens: number;
@@ -91,7 +91,7 @@ export declare class BudgetMeter {
      * RUN-CUMULATIVE snapshot: this session's usage PLUS the prior sessions' usage seeded at
      * construction. Cap enforcement ({@link assertWithinCaps}) and checkpoint persistence use
      * this so a run that resumes after a sleep/wait/crash is bounded by its declared caps across
-     * the whole run — not once per session (review #2). `snapshot()` stays session-local because
+     * the whole run — not once per session. `snapshot()` stays session-local because
      * per-session token metering reports token deltas; seeding it would double-report to Stripe.
      */
     cumulative(): BudgetSnapshot;

package/dist/runtime/agent/budget.js

@@ -10,7 +10,7 @@
 // not a hand-rolled token estimate. Only a BYO turn (no upstream price) or a managed turn whose cost
 // the broker couldn't read falls back to a single flat representative rate
 // (`model_rates.ts::BUDGET_GUARDRAIL_RATE`), since a per-`agent()`-model run has no one model. Actual
-// billing remains per-request cost pass-through via Stripe meters (MASTER_SPEC §15.2). The meter takes
+// billing remains per-request cost pass-through via Stripe meters (the platform spec). The meter takes
 // the fallback rate as a constructor arg so tests inject a fixed rate.
 import { AppError, ErrorCode } from "../support/index.js";
 const ZERO_PRIOR = {
@@ -77,7 +77,7 @@ export class BudgetMeter {
      * RUN-CUMULATIVE snapshot: this session's usage PLUS the prior sessions' usage seeded at
      * construction. Cap enforcement ({@link assertWithinCaps}) and checkpoint persistence use
      * this so a run that resumes after a sleep/wait/crash is bounded by its declared caps across
-     * the whole run — not once per session (review #2). `snapshot()` stays session-local because
+     * the whole run — not once per session. `snapshot()` stays session-local because
      * per-session token metering reports token deltas; seeding it would double-report to Stripe.
      */
     cumulative() {
@@ -100,11 +100,11 @@ export class BudgetMeter {
     assertWithinCaps() {
         if (this.budget === undefined)
             return;
-        // Cumulative across resume sessions — caps bound the whole run, not each session (review #2).
+        // Cumulative across resume sessions — caps bound the whole run, not each session.
         const snap = this.cumulative();
         // `max_tokens` deliberately bounds CONVERSATION tokens (input + output) only; cache-read /
         // cache-write tokens are tracked + fully billed via costFor() and are bounded by `max_usd`,
-        // not by this cap (review #19). totalTokens (snapshot/cumulative) reflects that choice.
+        // not by this cap. totalTokens (snapshot/cumulative) reflects that choice.
         if (this.budget.max_tokens !== undefined && snap.totalTokens > this.budget.max_tokens) {
             throw new AppError(ErrorCode.BUDGET_EXCEEDED, `Token cap exceeded: ${snap.totalTokens.toString()} > ${this.budget.max_tokens.toString()}`, { kind: "tokens", used: snap.totalTokens, cap: this.budget.max_tokens });
         }

package/dist/runtime/agent/model_rates.js

@@ -6,7 +6,7 @@
 // no upstream cost: a BYO-provider turn (the org pays its own key), or a managed turn whose cost the
 // broker couldn't read. It bounds runaway loops; it is NOT the bill. Actual billing is per-request
 // COST PASS-THROUGH (OpenRouter's reported cost × margin) via Stripe meters (domain/billing +
-// run_usage_service). MASTER_SPEC §15.2.
+// run_usage_service). the platform spec
 //
 // Deliberately NOT a per-model table with a silent fallback: a lookup that returns a Sonnet-class
 // default for any unknown id only created the ILLUSION of precision. The real per-request cost (above)

package/dist/runtime/agent/secret_redactor.js

@@ -1,5 +1,4 @@
-// SecretRedactor — scrubs known secret values from everything bound for an LLM (MASTER_SPEC §12,
-// docs/WORKFLOW_RUNTIME.md §6.2, plan #9).
+// SecretRedactor — scrubs known secret values from everything bound for an LLM (the platform spec).
 //
 // The architectural guarantee is structural: secrets live ONLY in the workflow PROGRAM (the trusted
 // deterministic tool layer), which holds them via `secrets.get` / `ctx.secrets.resolve`. The

package/dist/runtime/broker_artifact_store.js

@@ -1,10 +1,10 @@
 // BrokerArtifactStore — the ArtifactStore the `artifacts` tool uses under the Runner Credential
-// Broker (docs/RUNNER_BROKER.md §4 — Artifacts). It forwards every op to the Runner Control API:
-// the broker computes the S3 key, neutralizes the served content type (review #32), PUTs with its
+// Broker (the Runner Credential Broker model). It forwards every op to the Runner Control API:
+// the broker computes the S3 key, neutralizes the served content type, PUTs with its
 // own creds, and records the catalog row — so the untrusted runner holds no S3 credential and can't
 // bypass those server-side rules. A thin adapter over the run-bound RunnerControlClient.
 //
-// Writes route by size (docs/RUNNER_BROKER.md §7 step 4): a SMALL body is proxied inline through the
+// Writes route by size (the Runner Credential Broker model): a SMALL body is proxied inline through the
 // broker (`POST .../artifacts`); a LARGE one takes the presigned-PUT path — the broker signs an S3
 // PUT (still owning the key + content-type neutralization + catalog row) and the runner streams the
 // bytes straight to S3, so they never pass through the control plane (no body cap).

package/dist/runtime/broker_child_dispatcher.js

@@ -1,4 +1,4 @@
-// BrokerChildDispatcher — the broker-backed `workflows.call` (docs/RUNNER_BROKER.md). The host's
+// BrokerChildDispatcher — the broker-backed `workflows.call` (the Runner Credential Broker model). The host's
 // ChildDispatcher under the broker model: instead of touching the DB/SQS directly (the
 // WorkerChildDispatcher path), it asks the Runner Control API to create the child (resolve + the
 // `callable_by` gate + idempotent re-attach happen server-side) and then HOLDS the parent task,

package/dist/runtime/broker_event_publisher.js

@@ -1,5 +1,5 @@
 // BrokerEventPublisher — a `RedisPublisher` that ships the agent event-stream through the broker
-// instead of publishing to Redis directly (docs/RUNNER_BROKER.md §4 — Telemetry).
+// instead of publishing to Redis directly (the Runner Credential Broker model).
 //
 // The run-event live channel is a per-event `redis.publish(run:<id>, frame)`. Under the broker the
 // runner holds no Redis credential, so this stand-in BUFFERS frames and POSTs them in batches to the

package/dist/runtime/broker_tool_host.js

@@ -1,9 +1,9 @@
 // BrokerToolHost — the engine's `ToolHost` (the infrastructure seam for the host-backed built-in
 // coding tools `webfetch` / `http` / `web_search` / `artifacts`) wired over the Runner Credential Broker
-// (docs/RUNNER_BROKER.md). `@boardwalk-labs/engine` registers those three tools ONLY when the leaf's
+// (the Runner Credential Broker model). `@boardwalk-labs/engine` registers those three tools ONLY when the leaf's
 // `ToolSetContext.host` provides the backing hook; we supply one here so they light up on hosted
 // runs. Each hook delegates the privileged capability to whoever holds the credential/network/storage
-// — exactly as the broker model requires (security review #1): the untrusted worker holds no Tavily
+// — exactly as the broker model requires (security): the untrusted worker holds no Tavily
 // key, no S3 credential, and only reaches the public network through the egress proxy.
 //
 //   web_search → broker /tools/web_search (the broker holds the Tavily key; the worker just forwards

package/dist/runtime/cancel_watcher.js

@@ -1,4 +1,4 @@
-// CancelWatcher — stops a run when the user cancels it mid-flight (MASTER_SPEC §6 + docs/RUNNER_BROKER.md).
+// CancelWatcher — stops a run when the user cancels it mid-flight (the platform spec).
 //
 // The user-cancel counterpart to CreditWatcher. One per run session. On a timer it asks — through the
 // broker (`GET /cancel`, since the runner holds no DB/Redis credential) — whether the run has been

package/dist/runtime/credit_watcher.js

@@ -1,5 +1,4 @@
-// CreditWatcher — stops a run when its org runs out of prepaid credit mid-flight (MASTER_SPEC §15 +
-// docs/CODING_AGENT.md §6/§10).
+// CreditWatcher — stops a run when its org runs out of prepaid credit mid-flight (the platform spec).
 //
 // One per run session. On a timer it asks — through the broker (`GET /credit`, since the runner holds
 // no Stripe credential) — whether the org is still funded; the FIRST time it isn't, it fires

package/dist/runtime/direct_inference.d.ts

@@ -23,7 +23,13 @@ export interface DirectInferenceDeps {
 }
 /** One model turn, straight to the org's endpoint. Returns the ChatTurn + canonical model ref;
  *  BYO carries no platform cost (costMicros stays 0 — BYO is never metered). */
-export declare function streamDirectTurn(deps: DirectInferenceDeps, entry: ByoInferenceProvider, req: DirectTurnRequest, onDelta: ((text: string) => void) | undefined): Promise<{
+export declare function streamDirectTurn(deps: DirectInferenceDeps, entry: ByoInferenceProvider, req: DirectTurnRequest, onDelta: ((text: string) => void) | undefined, 
+/** Register the resolved key with the CURRENT leaf's engine redactor, before the model call.
+ *  The key resolves mid-leaf (after the leaf's redactor snapshot is seeded), so without this a
+ *  provider that echoes the Authorization header in an error body would leak it into that
+ *  leaf's error run event. The run-level redactor already has it via resolveSecret; this closes
+ *  the per-leaf gap. */
+registerSecret?: (value: string) => void): Promise<{
     turn: ChatTurn;
     modelRef: string;
 }>;

package/dist/runtime/direct_inference.js

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: Apache-2.0
-// Runner-direct BYO inference (docs/SELF_HOSTED_RUNNERS.md D7): the managed lane stays
+// Runner-direct BYO inference (the self-hosted runner design): the managed lane stays
 // brokered (the platform key never leaves the platform), but a BYO provider is the ORG'S OWN
 // endpoint + key — class-3 material the runner may hold — so the runtime calls it directly
 // with the SAME engine adapters the broker uses. This is what makes a LAN-only model work on
@@ -53,8 +53,16 @@ export function directProviderFor(registry, provider) {
 }
 /** One model turn, straight to the org's endpoint. Returns the ChatTurn + canonical model ref;
  *  BYO carries no platform cost (costMicros stays 0 — BYO is never metered). */
-export async function streamDirectTurn(deps, entry, req, onDelta) {
+export async function streamDirectTurn(deps, entry, req, onDelta, 
+/** Register the resolved key with the CURRENT leaf's engine redactor, before the model call.
+ *  The key resolves mid-leaf (after the leaf's redactor snapshot is seeded), so without this a
+ *  provider that echoes the Authorization header in an error body would leak it into that
+ *  leaf's error run event. The run-level redactor already has it via resolveSecret; this closes
+ *  the per-leaf gap. */
+registerSecret) {
     const apiKey = entry.auth_secret_name === null ? null : await deps.resolveSecret(entry.auth_secret_name);
+    if (apiKey !== null)
+        registerSecret?.(apiKey);
     if (entry.base_url === null) {
         throw new Error(`BYO provider '${entry.name}' has no base_url`);
     }

package/dist/runtime/index.d.ts

@@ -4,7 +4,7 @@ import type { ByoInferenceProvider } from "../contract.js";
 import { type ProgramWorkerDeps } from "./program_worker.js";
 /** Constructed primitives the pure assembly consumes (real ones in main(), fakes in tests). The
  *  runner holds NO platform credential — only the per-run control-plane handle (run token + broker
- *  URL); everything else is reached through the Runner Control API (docs/RUNNER_BROKER.md). */
+ *  URL); everything else is reached through the Runner Control API (the Runner Credential Broker model). */
 export interface WorkerRuntime {
     /** Stable worker identity stamped onto the lease (ECS task arn / hostname / run-derived). */
     workerId: string;
@@ -58,7 +58,7 @@ export declare function assembleWorkerDeps(runtime: WorkerRuntime): ProgramWorke
  * The per-run platform values the dispatcher injects as container env (ecs_run_task_client.ts). They
  * are captured into private worker state at bootstrap and DELETED from `process.env` before any user
  * program / agent leaf / subprocess can run — the run token + API token are credentials, and nothing
- * untrusted run code touches should inherit them (docs/RUN_ENV_AND_CREDS.md). The user owns the rest
+ * untrusted run code touches should inherit them (the run env/credential rules). The user owns the rest
  * of `process.env` outright.
  */
 export declare const PLATFORM_ENV_KEYS: readonly ["RUN_ID", "BOARDWALK_CONTROL_PLANE_URL", "BOARDWALK_RUN_TOKEN", "BOARDWALK_API_KEY", "BOARDWALK_TASK_CPU_UNITS"];

package/dist/runtime/index.js

@@ -1,9 +1,9 @@
-// Worker composition root (docs/WORKFLOW_RUNTIME.md + docs/RUNNER_BROKER.md). The Boardwalk-hosted
+// Worker composition root (the workflow runtime design). The Boardwalk-hosted
 // worker container runs `node dist/fargate/worker/index.js`; the dispatcher launches it per run with
 // RUN_ID + the per-run control-plane handle. This file assembles real implementations behind every
 // seam `runProgramWorker(runId, deps)` injects, then runs the one workflow program to terminal.
 //
-// BROKERED-ONLY (security review #1): the runner is UNTRUSTED and holds NO platform credential — only
+// BROKERED-ONLY (security): the runner is UNTRUSTED and holds NO platform credential — only
 // its short-lived run token. EVERY privileged seam goes through the Runner Control API (the broker):
 //   - agent()         → EngineLeafExecutor: the OSS engine's loop (runAgentLeaf) over a broker-backed
 //                       LeafIo — the model turn streams through /inference (invoked server-side).
@@ -90,7 +90,7 @@ export function assembleWorkerDeps(runtime) {
         runId: runtime.runId,
     });
     log.info("runner_control_enabled", { runId: runtime.runId });
-    // The replay frontier (the highest journaled seq at claim) drives SILENT REPLAY (docs/SUSPENSION.md):
+    // The replay frontier (the highest journaled seq at claim) drives SILENT REPLAY (the durable-suspension design):
     // a resumed run suppresses observability for seams it already ran. Captured at claim, read by
     // buildHost (which runs right after claim) when constructing the per-run host.
     let replayFrontier = 0;
@@ -109,7 +109,7 @@ export function assembleWorkerDeps(runtime) {
     // bootstrap captured + scrubbed it (capturePlatformContext) so the agent's bash / subprocesses
     // can't read it. The program reaches it ONLY via `runtime.apiToken()` (built below); we still
     // record it in each run's redactor so a value the program threads into a tool can't echo back out
-    // of a tool result. Absent in the dev no-signing-key path. (docs/RUN_ENV_AND_CREDS.md)
+    // of a tool result. Absent in the dev no-signing-key path. (the run env/credential rules)
     const runApiKey = runtime.controlPlane.apiToken;
     // The broker (Runner Control API) is hosted on the api-server, so the public API shares its
     // origin; `runtime.apiUrl` exposes it and the program appends `/v1` or `/mcp/v1`.
@@ -139,7 +139,7 @@ export function assembleWorkerDeps(runtime) {
         const nextMeterIdentifier = tokenMeterIdentifiers(run.id, meteringSessionId);
         // Per-run secret boundary: every value resolved (program `secrets.get` OR a tool's
         // ctx.secrets.resolve) is recorded into one shared redactor; the leaf seeds a fresh engine
-        // Redactor from it so the loop scrubs those values out of all model-bound content. MASTER_SPEC §12.
+        // Redactor from it so the loop scrubs those values out of all model-bound content. the platform spec
         const redactor = new SecretRedactor();
         // Record the run's own API key so a prompt-injected agent can't echo it back to the model.
         if (runApiKey !== undefined && runApiKey !== "")
@@ -227,7 +227,7 @@ export function assembleWorkerDeps(runtime) {
                 workspaceRoot: runtime.workspaceRoot,
             })
             : undefined;
-        // Durable suspension (docs/SUSPENSION.md): the host raises a suspend OUT OF BAND (onSuspend +
+        // Durable suspension (the durable-suspension design): the host raises a suspend OUT OF BAND (onSuspend +
         // a never-resolving seam), so a program's own try/catch can't swallow it; the program runner
         // races `suspendSignal` against the body. One deferred per run — the first seam to suspend wins.
         let resolveSuspend = () => undefined;
@@ -289,7 +289,7 @@ export function assembleWorkerDeps(runtime) {
                 : {}),
             phases: phaseTracker,
         });
-        // Hand the redactor back too: the worker scrubs a terminal error's message with it (review #5);
+        // Hand the redactor back too: the worker scrubs a terminal error's message with it;
         // workspace (when opted in) hydrates at start + persists at terminal.
         return Promise.resolve({
             host,
@@ -299,7 +299,12 @@ export function assembleWorkerDeps(runtime) {
             // throws) so no language-server process leaks past the run.
             lsp: lspService,
             // The orchestrator emits the program's declared output onto the wire (`output` kind).
-            activity: { output: (value) => void runEvents.emit({ kind: "output", value }) },
+            // Redact the declared-output EVENT (observability): a secret the program put in output()
+            // must not surface in the run's event stream. The FUNCTIONAL output program_runner returns
+            // for `workflows.call` is a separate path and stays raw, so cross-workflow data flow is intact.
+            activity: {
+                output: (value) => void runEvents.emit({ kind: "output", value: redactor.redactValue(value) }),
+            },
             // Filled by the runner once the artifact extracts; the leaf's `skillsDir` thunk reads it.
             setProgramDir: (dir) => {
                 programDir = dir;
@@ -349,7 +354,7 @@ export function assembleWorkerDeps(runtime) {
         finalizer: {
             finalize: (_id, status, output) => broker.finalize(status, output, runtime.workerId),
         },
-        // Durable suspension (docs/SUSPENSION.md): persist the wake condition through the broker (journal
+        // Durable suspension (the durable-suspension design): persist the wake condition through the broker (journal
         // entry + a HITL request row, or the wake time for a long sleep) and release the lease — no
         // finalize. A wake (an answer or a timer) re-dispatches the run.
         suspender: {
@@ -424,7 +429,7 @@ export function assembleWorkerDeps(runtime) {
  * The per-run platform values the dispatcher injects as container env (ecs_run_task_client.ts). They
  * are captured into private worker state at bootstrap and DELETED from `process.env` before any user
  * program / agent leaf / subprocess can run — the run token + API token are credentials, and nothing
- * untrusted run code touches should inherit them (docs/RUN_ENV_AND_CREDS.md). The user owns the rest
+ * untrusted run code touches should inherit them (the run env/credential rules). The user owns the rest
  * of `process.env` outright.
  */
 export const PLATFORM_ENV_KEYS = [
@@ -458,7 +463,7 @@ export function capturePlatformContext(env) {
         }
         return value.trim();
     };
-    // The dispatcher always injects the control-plane handle (docs/RUNNER_BROKER.md). The runner is
+    // The dispatcher always injects the control-plane handle (the Runner Credential Broker model). The runner is
     // brokered-only — there is no DB/Redis/Stripe fallback — so a missing handle is a hard config error.
     const runId = read("RUN_ID");
     const apiToken = env.BOARDWALK_API_KEY?.trim();
@@ -481,7 +486,7 @@ export function capturePlatformContext(env) {
 export async function main() {
     // Capture the platform context into private state and remove it from process.env BEFORE anything
     // else — so no user program / agent tool / subprocess we later spawn can read the run token or
-    // API token (docs/RUN_ENV_AND_CREDS.md). WORKER_ID / WORKSPACE_ROOT are non-secret infra knobs.
+    // API token (the run env/credential rules). WORKER_ID / WORKSPACE_ROOT are non-secret infra knobs.
     const platform = capturePlatformContext(process.env);
     const runId = platform.runId;
     const byoProviders = parseByoProviders(process.env.BOARDWALK_BYO_PROVIDERS);

package/dist/runtime/inference_transport.js

@@ -1,5 +1,5 @@
 // The broker inference transport the engine-backed leaf streams a model turn through
-// (docs/RUNNER_BROKER.md §4 — "Inference (class 2)").
+// (the Runner Credential Broker model)").
 //
 // Under the Runner Credential Broker the runner invokes NO model directly: it holds neither the
 // managed-inference key nor any BYO provider key. So the `agent()` leaf's `LeafIo.streamModel`

package/dist/runtime/leaf_executor.d.ts

@@ -21,7 +21,7 @@ export interface MeterUsageInput {
 export interface EngineLeafExecutorDeps {
     /** Streams one model turn through the broker (RunnerControlClient satisfies it). */
     inference: InferenceProxyTransport;
-    /** Runner-direct BYO inference (docs/SELF_HOSTED_RUNNERS.md D7): when a per-`agent()` provider
+    /** Runner-direct BYO inference (the self-hosted runner design): when a per-`agent()` provider
      *  matches this registry (key-based HTTP sources only), the turn goes STRAIGHT to the org's
      *  endpoint with the engine adapters — the managed lane and bedrock stay brokered. Omitted ⇒
      *  everything brokered (legacy dispatch without a registry). */
@@ -32,7 +32,7 @@ export interface EngineLeafExecutorDeps {
     budget: BudgetMeter;
     /** RUN-level redactor (shared with the secret resolver): every resolved secret value is recorded
      *  here. We seed a fresh engine `Redactor` from it per leaf so the loop scrubs known values out of
-     *  the prompt, tool args/results, and transcript before they reach the model (MASTER_SPEC §12). */
+     *  the prompt, tool args/results, and transcript before they reach the model (the platform spec). */
     redactor: SecretRedactor;
     /** Builds this leaf's event sink; `leafIndex` (1-based) is only a metering identifier — the sink
      *  owns the run-global cursor. `identity` names the leaf on its turn frames. */

package/dist/runtime/leaf_executor.js

@@ -105,7 +105,7 @@ export class EngineLeafExecutor {
             // through providerIo.onDelta and return the terminal turn. An aborted run rejects in-flight.
             streamModel: async (req, providerIo) => {
                 throwIfAborted(signal);
-                return this.streamModel(req, providerIo, signal, (costMicros) => {
+                return this.streamModel(req, providerIo, signal, redactor, (costMicros) => {
                     pendingCostMicros = (pendingCostMicros ?? 0) + costMicros;
                 });
             },
@@ -193,7 +193,7 @@ export class EngineLeafExecutor {
     /** POST one model turn to the broker's `/inference` and adapt its NDJSON stream into the engine's
      *  ModelTurnResult: each `delta` frame drives providerIo.onDelta; the terminal `result` frame is
      *  the turn. An `error` frame throws (the broker already classified it). An abort mid-stream throws. */
-    async streamModel(req, providerIo, signal, onCost) {
+    async streamModel(req, providerIo, signal, redactor, onCost) {
         // Runner-direct BYO (D7): the org's own endpoint + key, called with the same engine adapters
         // the broker uses. No platform cost (BYO is never metered) — onCost stays untouched.
         // A direct turn needs an explicit model (an omitted model means the managed auto lane,
@@ -209,7 +209,10 @@ export class EngineLeafExecutor {
                 messages: req.messages,
                 tools: req.tools,
                 ...(req.reasoning !== undefined ? { reasoning: req.reasoning } : {}),
-            }, providerIo.onDelta);
+            }, providerIo.onDelta, 
+            // Register the org's key with THIS leaf's redactor before the model call, so an error
+            // body echoing it is scrubbed from the leaf's run events (not just the terminal error).
+            (value) => redactor.add("byo-key", value));
             throwIfAborted(signal);
             return { turn: out.turn, modelRef: out.modelRef };
         }

package/dist/runtime/lease_renewer.js

@@ -1,5 +1,5 @@
 // LeaseRenewer — keeps a long run's lease fresh so the recovery sweep doesn't reclaim a STILL-ALIVE
-// worker (docs/RUNNER_BROKER.md; MASTER_SPEC §6).
+// worker (the Runner Credential Broker model).
 //
 // A run is claimed with a fixed lease (DEFAULT_LEASE_MS, 5 min). The worker never used to renew it,
 // so any run longer than the lease (an Opus agentic loop is routinely 7+ min) had its lease expire

package/dist/runtime/main.js

@@ -2,6 +2,6 @@
 // Process entrypoint for one run: `node .../runtime/main.js` with the platform env contract
 // (RUN_ID + BOARDWALK_CONTROL_PLANE_URL + BOARDWALK_RUN_TOKEN [+ BOARDWALK_API_KEY]). Used by
 // the Boardwalk-hosted Fargate container AND spawned per-run by the self-hosted daemon —
-// one worker, two homes (docs/RUNNER_BROKER.md §6). Import `./index.js` for the library.
+// one worker, two homes (the Runner Credential Broker model). Import `./index.js` for the library.
 import { main } from "./index.js";
 void main();

package/dist/runtime/program_log_capture.d.ts

@@ -4,7 +4,13 @@ export type LogStream = "stdout" | "stderr";
  * Patch the global console so each call is forwarded to the original AND handed (formatted) to
  * `sink`. Returns a restore function — ALWAYS call it (the worker runs `restore()` in a finally).
  */
-export declare function captureConsole(sink: (stream: LogStream, text: string) => void): () => void;
+export declare function captureConsole(sink: (stream: LogStream, text: string) => void, 
+/** Scrub known secret values from each formatted line before it reaches EITHER sink. A program
+ *  that `console.log`s a resolved secret must not leak it — to the run's `program_output` events
+ *  OR to container stdout (CloudWatch). We format+redact once and print the SAME redacted string
+ *  to the original console (equivalent output; `util.format` is what console does internally).
+ *  Defaults to identity (tests/local). */
+redact?: (text: string) => string): () => void;
 export interface ProgramLogSinkOptions {
     /** The run's shared event emitter — program logs ride the one ordered stream (`log` channel). */
     sink: TurnEventSink;

package/dist/runtime/program_log_capture.js

@@ -24,7 +24,13 @@ const STREAM_BY_METHOD = {
  * Patch the global console so each call is forwarded to the original AND handed (formatted) to
  * `sink`. Returns a restore function — ALWAYS call it (the worker runs `restore()` in a finally).
  */
-export function captureConsole(sink) {
+export function captureConsole(sink, 
+/** Scrub known secret values from each formatted line before it reaches EITHER sink. A program
+ *  that `console.log`s a resolved secret must not leak it — to the run's `program_output` events
+ *  OR to container stdout (CloudWatch). We format+redact once and print the SAME redacted string
+ *  to the original console (equivalent output; `util.format` is what console does internally).
+ *  Defaults to identity (tests/local). */
+redact = (t) => t) {
     const console_ = globalThis.console;
     const originals = {};
     for (const [method, stream] of Object.entries(STREAM_BY_METHOD)) {
@@ -33,9 +39,10 @@ export function captureConsole(sink) {
             continue;
         originals[method] = original;
         console_[method] = (...args) => {
-            original.apply(console_, args); // still print to the container stdout (CloudWatch)
+            const text = redact(format(...args));
+            original.call(console_, text); // print the REDACTED line to container stdout (CloudWatch)
             try {
-                sink(stream, format(...args));
+                sink(stream, text);
             }
             catch {
                 // best-effort — a telemetry hiccup must never break the program's own logging

package/dist/runtime/program_runner.d.ts

@@ -48,7 +48,7 @@ export interface ProgramRunnerDeps {
      * Scrubs known secret values out of a string (the run's `SecretRedactor.redactText`). Applied to a
      * top-level throw's message before it is logged AND before it is returned to the worker — a program
      * that resolves a secret and then throws it in an error message must NOT land that secret raw in the
-     * logs or the finalized run output (MASTER_SPEC §12, review #5). Defaults to identity (tests/local).
+     * logs or the finalized run output (the platform spec). Defaults to identity (tests/local).
      */
     redactText?: (text: string) => string;
     /**
@@ -59,7 +59,7 @@ export interface ProgramRunnerDeps {
      */
     onOutput?: (value: unknown) => void;
     /**
-     * Resolves when a host seam SUSPENDS the run (docs/SUSPENSION.md) — the worker wires it to the
+     * Resolves when a host seam SUSPENDS the run (the durable-suspension design) — the worker wires it to the
      * host's `onSuspend` so a suspend is surfaced OUT OF BAND, racing the program body. The program's
      * own `try/catch` can't swallow a suspend this way (the suspending seam never resolves; this signal
      * short-circuits at the runner). Absent ⇒ no suspension wired (a seam that suspends throws

package/dist/runtime/program_runner.js

@@ -1,4 +1,4 @@
-// WorkflowProgramRunner — executes a workflow program (the JS-body model, docs/WORKFLOW_RUNTIME.md).
+// WorkflowProgramRunner — executes a workflow program (the JS-body model, the workflow runtime design).
 //
 // A run is the execution of a built program ARTIFACT (§3.9): the worker is handed the VERIFIED tarball
 // (its sha256 already checked against the pinned digest by the orchestrator) plus the entry module
@@ -20,13 +20,13 @@
 // Durability: the body runs once, in-process. `sleep`/`workflows.call` hold in-process via the host
 // (no checkpoint, no exit). A crash mid-run restarts the run from the top (handled by the
 // worker/scheduler-sweep, not here). Output capture is deferred (v0 returns null).
-import { mkdir, writeFile, rm, symlink } from "node:fs/promises";
+import { mkdir, writeFile, rm, symlink, lstat } from "node:fs/promises";
 import { dirname, join } from "node:path";
 import { createRequire } from "node:module";
 import { pathToFileURL } from "node:url";
 import { randomUUID } from "node:crypto";
 import { installHost, installInput, installConfig, takeDeclaredOutput, resetRuntime, } from "@boardwalk-labs/workflow/runtime";
-import { createLogger } from "./support/index.js";
+import { AppError, ErrorCode, createLogger } from "./support/index.js";
 import { SuspendError } from "./suspension.js";
 const log = createLogger("ProgramRunner");
 /** Subdirectory (under the work root) that holds transient extracted program trees. */
@@ -41,6 +41,17 @@ const RUN_DIR = ".bw-runs";
  * still exist.
  */
 export async function ensureSdkLink(execDir) {
+    // A program tarball that ships its own `node_modules/@boardwalk-labs/workflow` would shadow the
+    // runtime's copy — the host adapter is installed on OUR instance, so the program's hooks would
+    // silently throw "no host installed". Fail loudly instead of link-then-EEXIST-swallow. Only a
+    // REAL entry is a vendored copy; a symlink is our own link (idempotent re-invocation), left be.
+    const linkPath = join(execDir, "node_modules", "@boardwalk-labs", "workflow");
+    const existing = await lstat(linkPath).catch(() => null);
+    if (existing !== null) {
+        if (existing.isSymbolicLink())
+            return;
+        throw new AppError(ErrorCode.VALIDATION_FAILED, "Program bundles its own @boardwalk-labs/workflow; the runtime provides it (do not vendor it).");
+    }
     try {
         // Resolve via the MAIN entry (the SDK's export map exposes no "./package.json") and cut the
         // path back to the package root.

package/dist/runtime/program_worker.d.ts

@@ -44,7 +44,7 @@ export type RuntimeMeterStarter = (args: {
 export interface RunFinalizer {
     finalize(runId: string, status: "completed" | "failed", output: unknown): Promise<void>;
 }
-/** Persists a durable SUSPENSION (docs/SUSPENSION.md): the broker records the wake condition (a
+/** Persists a durable SUSPENSION (the durable-suspension design): the broker records the wake condition (a
  *  pending/suspended journal entry + a human-input request row for HITL, or the wake time for a long
  *  sleep), flips the run to its suspended status, and releases the lease — all transactionally. The
  *  run is NOT finalized; a wake (an answer, a child finalize, or a timer) re-dispatches it. */
@@ -74,7 +74,7 @@ export interface RunOutputHandle {
 /** Builds the per-run host (leaf + sleep + children + secrets) for a claimed run. Receives the run's
  *  cooperative-cancellation `signal` so every host hook honors it (credit exhaustion / cancel).
  *  Returns the run's `SecretRedactor` alongside the host so the orchestrator can scrub a terminal
- *  error with the SAME instance every resolved secret was recorded into (review #5); `readUsage` — a
+ *  error with the SAME instance every resolved secret was recorded into; `readUsage` — a
  *  sampler over the run-level BudgetMeter the token flusher meters from; and an optional `workspace`
  *  handle (when the workflow opted into persistence) the orchestrator hydrates at start + persists at
  *  terminal (the host's `sleep` also persists, wired inside buildHost). */
@@ -94,7 +94,7 @@ export type ProgramHostBuilder = (run: Run, manifest: WorkflowManifest, signal:
      *  it to the runner's `onExtracted`. Optional — absent on paths that don't surface bundled files. */
     setProgramDir?: (dir: string) => void;
     /** Resolves when a host seam SUSPENDS the run — wired to the host's `onSuspend`, threaded into the
-     *  program runner so a suspend short-circuits the body out of band (docs/SUSPENSION.md). Absent ⇒
+     *  program runner so a suspend short-circuits the body out of band (the durable-suspension design). Absent ⇒
      *  no durable suspension on this path (a suspend then surfaces as a thrown SuspendError). */
     suspendSignal?: Promise<SuspendSignal>;
 }>;
@@ -141,7 +141,7 @@ export interface ProgramWorkerDeps {
     /** Periodic runtime metering (optional — absent disables it, e.g. the local/test path). */
     startRuntimeFlush?: RuntimeMeterStarter;
     finalizer: RunFinalizer;
-    /** Persists a durable suspension (docs/SUSPENSION.md). Absent ⇒ no suspension support: a run that
+    /** Persists a durable suspension (the durable-suspension design). Absent ⇒ no suspension support: a run that
      *  reaches a suspend fails cleanly rather than stranding (the brokered worker always wires it). */
     suspender?: RunSuspender;
     buildHost: ProgramHostBuilder;

package/dist/runtime/program_worker.js

@@ -1,4 +1,4 @@
-// program_worker — the JS-body worker orchestration (docs/WORKFLOW_RUNTIME.md).
+// program_worker — the JS-body worker orchestration (the workflow runtime design).
 //
 // Replaces the checkpoint-and-resume run_worker. One run, claim to terminal:
 //   1. Race-safe claim (pending → running). Lose the race → exit.
@@ -53,7 +53,7 @@ export async function runProgramWorker(runId, deps) {
     }
     // Fetch + verify the program ARTIFACT before any work (pre-flight; an integrity failure = no charge,
     // no run). The bytes are the EXACT artifact the manifest was derived from at deploy; verifying the
-    // sha256 here means a tampered/corrupted object can never be imported (docs/WORKFLOW_RUNTIME.md §3.9).
+    // sha256 here means a tampered/corrupted object can never be imported (the workflow runtime design).
     let tarball;
     try {
         tarball = await deps.fetchProgram(loaded.program.downloadUrl);
@@ -162,7 +162,9 @@ export async function runProgramWorker(runId, deps) {
     // by `flushFinal()` after the body (on every path except a lease_lost handoff).
     const runtimeFlush = deps.startRuntimeFlush?.({ run: claimed, startedAtMs: sessionStartMs });
     // Capture the program's console.* as `log` run-events for the duration of the body (best-effort).
-    const restoreConsole = deps.onProgramLog !== undefined ? captureConsole(deps.onProgramLog) : () => undefined;
+    const restoreConsole = deps.onProgramLog !== undefined
+        ? captureConsole(deps.onProgramLog, (text) => redactor.redactText(text))
+        : () => undefined;
     let result;
     try {
         result = await runWorkflowProgram({

package/dist/runtime/recording_secret_resolver.js

@@ -1,4 +1,4 @@
-// RecordingSecretResolver — the redaction feeder (MASTER_SPEC §12, plan #9).
+// RecordingSecretResolver — the redaction feeder (the platform spec).
 //
 // Decorates any SecretResolver so EVERY value a run resolves — whether the workflow program asked
 // via `secrets.get(name)` or a tool asked via `ctx.secrets.resolve(ref)` — is recorded into the

package/dist/runtime/run_abort.js

@@ -1,5 +1,4 @@
-// run_abort — the provider-agnostic cooperative-cancellation substrate for a run (docs/RUNNER_BROKER.md
-// §15 credit watching; the foundation user-initiated cancel will reuse).
+// run_abort — the provider-agnostic cooperative-cancellation substrate for a run (the Runner Credential Broker model).
 //
 // The cancellation primitive is a Web-standard `AbortSignal` — NOT a Strands/model concept. The worker
 // owns one `AbortController` per run session; a watcher (credit, later user-cancel) calls

package/dist/runtime/runner_control_client.d.ts

@@ -60,7 +60,7 @@ export declare class RunnerControlClient {
      *  whose lease expired and whose run was reclaimed + re-dispatched to a new owner), so a
      *  hung/partitioned worker that later recovers can't clobber the live run or revive a terminal one. */
     finalize(status: "completed" | "failed", output: unknown, workerId: string): Promise<void>;
-    /** Look up a durable-seam journal entry by its seq (docs/SUSPENSION.md), or null on a replay miss
+    /** Look up a durable-seam journal entry by its seq (the durable-suspension design), or null on a replay miss
      *  (404). The broker joins a parked agent leaf's answers into the result server-side. */
     journalGet(seq: number): Promise<JournalLookup | null>;
     /** Record a RESOLVED seam result (idempotent on the run + seq server-side; a resolved entry is
@@ -129,7 +129,7 @@ export declare class RunnerControlClient {
     /** Store a run artifact through the broker (which holds the S3 credential + neutralizes the served
      *  content type server-side). Returns the catalog id + a signed download URL. */
     writeArtifact(input: ArtifactWriteInput): Promise<ArtifactWriteResult>;
-    /** Phase 1 of the LARGE-artifact path (docs/RUNNER_BROKER.md §7 step 4): presign an S3 PUT. The
+    /** Phase 1 of the LARGE-artifact path (the Runner Credential Broker model): presign an S3 PUT. The
      *  broker derives the S3 key + neutralizes/pins the served content type; it returns the upload URL +
      *  required headers + the `s3Key` to echo back at commit. No catalog row exists yet. */
     presignArtifact(input: ArtifactPresignInput): Promise<ArtifactPresignResult>;
@@ -168,7 +168,7 @@ export declare class RunnerControlClient {
         output: unknown;
     } | null>;
     /**
-     * Proxy one model turn through the broker (docs/RUNNER_BROKER.md §4 — Inference). POSTs the
+     * Proxy one model turn through the broker (the Runner Credential Broker model). POSTs the
      * neutral conversation; the broker resolves the REAL model server-side (the runner holds no model
      * creds), invokes the matching engine adapter, and relays the model's stream back as NDJSON
      * `InferenceFrame`s (delta / result / error). Yields each frame; the engine-backed leaf surfaces

package/dist/runtime/runner_control_client.js

@@ -1,4 +1,4 @@
-// RunnerControlClient — the worker's HTTP client for the Runner Control API (docs/RUNNER_BROKER.md).
+// RunnerControlClient — the worker's HTTP client for the Runner Control API (the Runner Credential Broker model).
 //
 // Under the broker model the worker reaches run lifecycle through the api-server, not the DB directly:
 // it presents its per-run token (BOARDWALK_RUN_TOKEN) as a bearer credential and calls the broker for
@@ -37,7 +37,7 @@ export class RunnerControlClient {
         return {
             run: body.run,
             lastEventCursor: body.lastEventCursor ?? 0,
-            // The replay frontier for silent replay (docs/SUSPENSION.md): the highest journaled seq, so a
+            // The replay frontier for silent replay (the durable-suspension design): the highest journaled seq, so a
             // resumed run knows which seams already ran (suppress their re-emitted observability).
             lastJournalSeq: body.lastJournalSeq ?? 0,
         };
@@ -70,7 +70,7 @@ export class RunnerControlClient {
         if (res.status !== 204)
             throw await brokerError(res, "finalize");
     }
-    /** Look up a durable-seam journal entry by its seq (docs/SUSPENSION.md), or null on a replay miss
+    /** Look up a durable-seam journal entry by its seq (the durable-suspension design), or null on a replay miss
      *  (404). The broker joins a parked agent leaf's answers into the result server-side. */
     async journalGet(seq) {
         const res = await this.fetchImpl(this.url(`journal/${encodeURIComponent(String(seq))}`), {
@@ -243,7 +243,7 @@ export class RunnerControlClient {
             throw await brokerError(res, "artifacts");
         return (await res.json());
     }
-    /** Phase 1 of the LARGE-artifact path (docs/RUNNER_BROKER.md §7 step 4): presign an S3 PUT. The
+    /** Phase 1 of the LARGE-artifact path (the Runner Credential Broker model): presign an S3 PUT. The
      *  broker derives the S3 key + neutralizes/pins the served content type; it returns the upload URL +
      *  required headers + the `s3Key` to echo back at commit. No catalog row exists yet. */
     async presignArtifact(input) {
@@ -381,7 +381,7 @@ export class RunnerControlClient {
         return (await res.json());
     }
     /**
-     * Proxy one model turn through the broker (docs/RUNNER_BROKER.md §4 — Inference). POSTs the
+     * Proxy one model turn through the broker (the Runner Credential Broker model). POSTs the
      * neutral conversation; the broker resolves the REAL model server-side (the runner holds no model
      * creds), invokes the matching engine adapter, and relays the model's stream back as NDJSON
      * `InferenceFrame`s (delta / result / error). Yields each frame; the engine-backed leaf surfaces

package/dist/runtime/runtime_flusher.js

@@ -1,5 +1,5 @@
 // RuntimeFlusher — meters a run's held-task runtime as periodic DELTAS, instead of one charge at
-// terminal (MASTER_SPEC §15; docs/RUNNER_BROKER.md). The heartbeat counterpart to the credit / cancel
+// terminal (the platform spec). The heartbeat counterpart to the credit / cancel
 // / lease watchers.
 //
 // Why: runtime used to be booked once, at terminal (`now - sessionStart`). That left two holes — a run

package/dist/runtime/suspension.js

@@ -1,4 +1,4 @@
-// Durable-suspension primitives for the JS-body worker (docs/SUSPENSION.md).
+// Durable-suspension primitives for the JS-body worker (the durable-suspension design).
 //
 // A run SUSPENDS at a durable seam — a long `sleep`, a `humanInput()` gate, or the in-leaf
 // `human_input` tool — by releasing its Fargate task and re-acquiring one on wake. The mechanism is

package/dist/runtime/testing_artifact_build.js

@@ -1,4 +1,4 @@
-// Server-side single-file artifact build (web / MCP deploy surface, docs/WORKFLOW_RUNTIME.md §3.9).
+// Server-side single-file artifact build (web / MCP deploy surface, the workflow runtime design).
 //
 // The CLI bundles packages locally; web + MCP submit a single TS/JS file with no client bundler, so
 // the api-server builds the IDENTICAL artifact shape: type-strip the source → `index.mjs`, pack a

package/dist/runtime/tools/artifacts.js

@@ -1,4 +1,4 @@
-// artifacts — persist + reference run outputs (MASTER_SPEC §9.1 + §13.6). Available to any agent
+// artifacts — persist + reference run outputs (the platform spec). Available to any agent
 // (no sandbox required). Three operations:
 //   * write(name, content_type, body)   → store a file under the run's prefix; returns id + a signed URL.
 //   * list()                            → artifacts produced in THIS run.
@@ -6,13 +6,13 @@
 //
 // This tool is a THIN agent-facing surface: it validates input + formats output and delegates the
 // actual storage to an injected `ArtifactStore`. Under the Runner Credential Broker
-// (docs/RUNNER_BROKER.md) the store is broker-backed — the broker computes the S3 key, neutralizes
-// the content type (review #32), PUTs with its own creds, and records the catalog row, so the
+// (the Runner Credential Broker model) the store is broker-backed — the broker computes the S3 key, neutralizes
+// the content type, PUTs with its own creds, and records the catalog row, so the
 // untrusted runner holds no S3 credential and can't bypass those server-side rules.
 import { z } from "zod";
 import { ARTIFACT_MAX_BYTES } from "../wire/artifact_storage.js";
 // Body cap: a small write travels through the broker's buffered Runner Control endpoint (≤5 MiB
-// wire); a large one takes the presigned-PUT path (docs/RUNNER_BROKER.md §7 step 4) that streams the
+// wire); a large one takes the presigned-PUT path (the Runner Credential Broker model) that streams the
 // body straight to S3. Either way the artifact is bounded by ARTIFACT_MAX_BYTES — the cap here is on
 // the body STRING, sized for a full-size binary artifact carried as base64 (~4/3 inflation). The
 // broker re-validates the true byte size server-side (the authoritative check).

package/dist/runtime/tools/types.d.ts

@@ -41,7 +41,7 @@ export interface BoardwalkTool<TInput = unknown, TOutput = unknown> {
     /**
      * Zod schema for the tool's SUCCESS output (the `TOutput` shape — never the
      * control-signal branch). The adapter validates the tool's return value
-     * against this before it lands in the LLM conversation, per CODE_QUALITY
+     * against this before it lands in the LLM conversation, per the code standards
      * §2.1/§8.3 (LLM-facing output is treated like untrusted external input).
      */
     readonly outputSchema: z.ZodType<TOutput>;

package/dist/runtime/tools/types.js

@@ -9,7 +9,7 @@
 //     they bubble a signal up to the engine. Our adapter (lands with the worker
 //     in Phase 10.5) translates between this interface and the Strands surface.
 //
-// Per MASTER_SPEC §12: tools NEVER see secret values. Secrets resolve to
+// Per the platform spec: tools NEVER see secret values. Secrets resolve to
 // short-lived bearer tokens, ARNs, etc. via the injected `SecretResolver`.
 export function isControlSignal(value) {
     return (typeof value === "object" &&

package/dist/runtime/tools/web_search.d.ts

@@ -48,7 +48,7 @@ export interface WebSearchDeps {
 }
 export declare function makeWebSearchTool(deps: WebSearchDeps): BoardwalkTool<WebSearchInput, WebSearchOutput>;
 /**
- * Broker-backed web_search for the runner (docs/RUNNER_BROKER.md): identical name/schemas/behavior
+ * Broker-backed web_search for the runner (the Runner Credential Broker model): identical name/schemas/behavior
  * to {@link makeWebSearchTool}, but the Tavily call runs in the broker (which holds the platform key)
  * — the runner just forwards the query, so it needs NO Tavily secret (`secretsRequired: []`). Wired on
  * the worker when the control plane is on; the direct tool above is the pre-broker/local path.

package/dist/runtime/tools/web_search.js

@@ -1,6 +1,6 @@
 // web_search — wraps the Tavily API (https://docs.tavily.com/docs/api-reference).
 //
-// Per MASTER_SPEC §13.5: Tavily is Boardwalk's default web-search provider. API
+// Per the platform spec: Tavily is Boardwalk's default web-search provider. API
 // key fetched from Secrets Manager (`boardwalk/<stage>/tavily/api-key`) and
 // cached at the module level per container, NEVER appearing in the agent's
 // conversation.
@@ -105,7 +105,7 @@ export function makeWebSearchTool(deps) {
     };
 }
 /**
- * Broker-backed web_search for the runner (docs/RUNNER_BROKER.md): identical name/schemas/behavior
+ * Broker-backed web_search for the runner (the Runner Credential Broker model): identical name/schemas/behavior
  * to {@link makeWebSearchTool}, but the Tavily call runs in the broker (which holds the platform key)
  * — the runner just forwards the query, so it needs NO Tavily secret (`secretsRequired: []`). Wired on
  * the worker when the control plane is on; the direct tool above is the pre-broker/local path.

package/dist/runtime/wire/artifact_storage.d.ts

@@ -17,7 +17,7 @@ export declare function extFor(name: string, contentType: string): string;
 /**
  * Map an agent-supplied content type to one safe to serve inline from a Boardwalk origin. Active
  * types are forced to text/plain so the browser renders them as inert text instead of executing
- * embedded script (review #32). The base type (before any `;` params) is what's matched. The body is
+ * embedded script. The base type (before any `;` params) is what's matched. The body is
  * never altered — only the type the object is SERVED as.
  *
  * MUST run server-side (in the broker), never on the untrusted runner: the served content type is

package/dist/runtime/wire/artifact_storage.js

@@ -1,6 +1,6 @@
 // Artifact storage policy — the server-side rules for turning an agent's artifact-write request into
-// a stored S3 object (MASTER_SPEC §13.6, review #32). These used to live in the `artifacts` TOOL,
-// which runs on the UNTRUSTED runner; under the Runner Credential Broker (docs/RUNNER_BROKER.md) the
+// a stored S3 object (the platform spec). These used to live in the `artifacts` TOOL,
+// which runs on the UNTRUSTED runner; under the Runner Credential Broker (the Runner Credential Broker model) the
 // broker owns them so a malicious runner can't bypass content-type neutralization or escape its
 // run's key prefix. Pure functions — unit-tested exhaustively.
 import * as nodePath from "node:path";
@@ -60,7 +60,7 @@ const NEUTRAL_CONTENT_TYPE = "text/plain; charset=utf-8";
 /**
  * Map an agent-supplied content type to one safe to serve inline from a Boardwalk origin. Active
  * types are forced to text/plain so the browser renders them as inert text instead of executing
- * embedded script (review #32). The base type (before any `;` params) is what's matched. The body is
+ * embedded script. The base type (before any `;` params) is what's matched. The body is
  * never altered — only the type the object is SERVED as.
  *
  * MUST run server-side (in the broker), never on the untrusted runner: the served content type is
@@ -74,7 +74,7 @@ export function neutralizeActiveContentType(contentType) {
 //
 // The proxy path (`POST .../artifacts`) buffers the base64 body through the Runner Control body
 // limit (5 MiB wire), so it's bounded WELL under that. Anything larger takes the presigned-PUT path
-// (`POST .../artifacts/presign`, docs/RUNNER_BROKER.md §7 step 4): the broker signs an S3 PUT and the
+// (`POST .../artifacts/presign`, the Runner Credential Broker model): the broker signs an S3 PUT and the
 // runner streams the bytes straight to S3, so the body never passes through the control plane.
 /** Largest raw artifact body the broker will accept INLINE (proxied). Comfortably under the 5 MiB
  *  control-plane body cap so the base64 string + JSON envelope fit. Above this ⇒ presigned PUT. */

package/dist/runtime/wire/human_input.d.ts

@@ -34,7 +34,7 @@ export declare function normalizeHumanInputResult(raw: unknown): HumanInputResul
  *  interface with optional props, which TS won't structurally accept as JsonValue; an explicit object
  *  literal IS assignable to the index signature). The inverse of {@link normalizeHumanInputResult}. */
 export declare function humanInputResultToJson(result: HumanInputResult): JsonValue;
-/** What to do when a gate's `timeout` elapses with no answer (docs/SUSPENSION.md §4.3). Mirrors the
+/** What to do when a gate's `timeout` elapses with no answer (the durable-suspension design). Mirrors the
  *  SDK's `HumanInputOptions.onTimeout`: fail the run, or resolve the gate with a default value. */
 export type OnTimeoutPolicy = {
     kind: "fail";

package/dist/runtime/wire/human_input.js

@@ -1,4 +1,4 @@
-// Human-input form spec + response validation (docs/SUSPENSION.md §4.3).
+// Human-input form spec + response validation (the durable-suspension design).
 //
 // The `HumanInputSpec` is the single source of truth for BOTH the UI form and server-side
 // validation, so a `humanInput()` gate needs no JSON Schema. A responder's raw submission (from

package/dist/runtime/wire/inference_proxy.js

@@ -1,4 +1,4 @@
-// Inference proxy protocol (docs/RUNNER_BROKER.md §4 — "Inference (class 2)").
+// Inference proxy protocol (the Runner Credential Broker model)").
 //
 // The runner never invokes a model directly: under the Runner Credential Broker it holds no
 // managed-inference creds and no BYO provider key. Instead the `agent()` leaf's model turn (the
@@ -13,7 +13,7 @@
 //
 // Transport: the response is **newline-delimited JSON** (one frame per line). A model turn streams
 // many text deltas; NDJSON lets the runner consume them incrementally over the raw socket (the
-// buffered REST path can't stream — MASTER_SPEC §4.2). Each frame is one of:
+// buffered REST path can't stream — the platform spec). Each frame is one of:
 //   { "t": "delta",  "text": <string> }                  — a streamed assistant-text chunk
 //   { "t": "result", "turn": <ChatTurn>, "modelRef": <string>, "costMicros": <number> }  — terminal turn
 //   { "t": "error",  "error": { code, message } }         — a terminal model/broker error

package/dist/runtime/workflow_host.d.ts

@@ -72,7 +72,7 @@ export declare class TimerSleepController implements SleepController {
  * `import { runtime } from "@boardwalk-labs/workflow"`. MIRRORS the SDK's `RuntimeContext` — defined
  * locally so the host compiles BEFORE the @boardwalk-labs/workflow bump that adds the optional
  * `runtime` member to `WorkflowHost`; once that lands, the host's `runtime` satisfies it
- * structurally. Platform credentials are NEVER placed in `process.env` (docs/RUN_ENV_AND_CREDS.md):
+ * structurally. Platform credentials are NEVER placed in `process.env` (the run env/credential rules):
  * trusted program code reaches the public-API bearer ONLY through `apiToken()`, which is redacted
  * from all LLM context.
  */
@@ -113,7 +113,7 @@ export interface WorkerWorkflowHostDeps {
     /** Override the 7-day hold ceiling (tests). */
     maxSleepMs?: number;
     /**
-     * Durable-suspension journal (docs/SUSPENSION.md): the host memoizes each `agent`/`step`/`sleep`/
+     * Durable-suspension journal (the durable-suspension design): the host memoizes each `agent`/`step`/`sleep`/
      * `humanInput` seam here, so a resumed run replays journaled seams instantly instead of re-running
      * them. Backed by the broker over the run token on hosted runs. Absent ⇒ no memoization (the
      * local/test path): seams run live every time and a suspend can't be resumed.
@@ -138,7 +138,7 @@ export declare class WorkerWorkflowHost implements WorkflowHost {
     private readonly sleeper;
     private readonly now;
     private readonly maxSleepMs;
-    /** Synchronous durable-seam counter + silent-replay live flag (docs/SUSPENSION.md). */
+    /** Synchronous durable-seam counter + silent-replay live flag (the durable-suspension design). */
     private readonly seq;
     /** Run context + on-demand public-API bearer the SDK `runtime` accessor reads off the host. */
     readonly runtime: RuntimeContext;
@@ -171,7 +171,7 @@ export declare class WorkerWorkflowHost implements WorkflowHost {
     step(name: string, fn: () => unknown): Promise<unknown>;
     private stepSeam;
     callWorkflow(slug: string, input: unknown, opts: CallOptions | undefined): Promise<unknown>;
-    /** The `workflows.call` durable seam (docs/SUSPENSION.md): start the child once + memoize its
+    /** The `workflows.call` durable seam (the durable-suspension design): start the child once + memoize its
      *  output; a non-terminal child SUSPENDS the parent (`waiting_for_child`, the child's id journaled)
      *  — the parent releases its task and is woken when the child finalizes. On resume the seam polls
      *  the journaled child and returns its output (or throws on a failed child). Without a journal (the

package/dist/runtime/workflow_host.js

@@ -1,5 +1,5 @@
 // WorkerWorkflowHost — the real WorkflowHost the worker installs onto @boardwalk-labs/workflow
-// before running a program (docs/WORKFLOW_RUNTIME.md §3.8). The program's hooks delegate here:
+// before running a program (the workflow runtime design). The program's hooks delegate here:
 //
 //   agent(prompt, opts)        → an ephemeral Strands agent leaf (the demoted agent loop)
 //   sleep(arg)                 → an IN-PROCESS hold (hold-and-pay; no checkpoint, no exit)
@@ -67,7 +67,7 @@ export class WorkerWorkflowHost {
     sleeper;
     now;
     maxSleepMs;
-    /** Synchronous durable-seam counter + silent-replay live flag (docs/SUSPENSION.md). */
+    /** Synchronous durable-seam counter + silent-replay live flag (the durable-suspension design). */
     seq;
     /** Run context + on-demand public-API bearer the SDK `runtime` accessor reads off the host. */
     runtime;
@@ -240,7 +240,7 @@ export class WorkerWorkflowHost {
     callWorkflow(slug, input, opts) {
         return this.guarded(() => this.callWorkflowSeam(slug, input, opts));
     }
-    /** The `workflows.call` durable seam (docs/SUSPENSION.md): start the child once + memoize its
+    /** The `workflows.call` durable seam (the durable-suspension design): start the child once + memoize its
      *  output; a non-terminal child SUSPENDS the parent (`waiting_for_child`, the child's id journaled)
      *  — the parent releases its task and is woken when the child finalizes. On resume the seam polls
      *  the journaled child and returns its output (or throws on a failed child). Without a journal (the

package/dist/runtime/workspace_store.js

@@ -1,4 +1,4 @@
-// WorkspaceStore — per-workflow persistent /workspace, broker-mediated (docs/RUNNER_BROKER.md §5).
+// WorkspaceStore — per-workflow persistent /workspace, broker-mediated (the Runner Credential Broker model).
 //
 // Hosted runs that opt in (manifest `workspace.persist`) get a `/workspace` that survives ACROSS runs
 // of the workflow + across a crash-restart. It is NOT a mounted shared filesystem — that would be

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@boardwalk-labs/runner",
-  "version": "0.1.4",
+  "version": "0.1.6",
   "description": "Boardwalk self-hosted runner: execute cloud-scheduled runs on your own machines. Currently: the canonical runner contract types.",
   "license": "Apache-2.0",
   "repository": {