@mcoda/mswarm 0.1.76 → 0.1.79

package/dist/runtime.js

@@ -1,9 +1,10 @@
-import { chmod, mkdir, readFile, rm, writeFile } from "node:fs/promises";
-import { dirname, join } from "node:path";
-import { hostname, homedir, platform, userInfo } from "node:os";
+import { chmod, lstat, mkdir, readdir, readFile, rm, writeFile } from "node:fs/promises";
+import { dirname, isAbsolute, join, relative, resolve } from "node:path";
+import { cpus, freemem, hostname, homedir, loadavg, platform, totalmem, userInfo } from "node:os";
 import { spawn } from "node:child_process";
-import { createHash, randomUUID } from "node:crypto";
+import { createHash, createHmac, randomUUID } from "node:crypto";
 import { MswarmCodaliExecutor } from "./codali-executor.js";
+import { MSWARM_CAPABILITY_SCHEMA_VERSION, assertMswarmSafeRelativePath, validateMswarmArchiveEntry, buildMswarmCapabilityNames, buildMswarmPrivateCapabilityCatalogEntry, buildMswarmLocalArtifactUri, buildMswarmSandboxProfile, defaultMswarmArtifactAccessPolicy, defaultMswarmArtifactRetentionPolicy, projectMswarmPublicCapabilities, validateMswarmGenericJobRequest } from "@mcoda/shared";
 const DEFAULT_GATEWAY_BASE_URL = "http://127.0.0.1:8080";
 const DEFAULT_SETUP_GATEWAY_BASE_URL = "https://api.mswarm.org";
 const DEFAULT_OLLAMA_BASE_URL = "http://127.0.0.1:11434";
@@ -14,11 +15,91 @@ const DEFAULT_SELF_HOSTED_NODE_VERSION = "0.1.70";
 const DEFAULT_REQUEST_TIMEOUT_MS = 10000;
 const DEFAULT_JOB_TIMEOUT_MS = 3600000;
 const DEFAULT_SERVICE_COMMAND_TIMEOUT_MS = 60000;
+const DEFAULT_CAPABILITY_PROBE_TIMEOUT_MS = 2000;
+const SELF_HOSTED_RUNTIME_PROTOCOL_VERSION = 1;
+const SELF_HOSTED_LOAD_BALANCER_PROTOCOL_VERSION = 1;
+const SELF_HOSTED_CATALOG_METADATA_VERSION = 1;
+const MAX_TELEMETRY_LATENCY_SAMPLES = 50;
+const MAX_TELEMETRY_FAILURES = 20;
 const DEFAULT_MCODA_BIN = "mcoda";
 const DEFAULT_MCODA_LIST_ARGS = ["agent", "list", "--json", "--refresh-health"];
 const DEFAULT_COMMAND_MAX_BUFFER = 16 * 1024 * 1024;
+const DEFAULT_LOCAL_ARTIFACT_MAX_BYTES = 512 * 1024 * 1024;
 const DEFAULT_JOB_POLL_WAIT_MS = 25000;
 const DEFAULT_STREAM_EVENT_BATCH_SIZE = 8;
+const OWNER_LOCAL_TEST_ECHO_JOB_TYPE = "tenant.test-echo";
+const TEST_ECHO_RUNNER_ID = "test.echo";
+const RENDER_BLENDER_JOB_TYPE = "render.blender";
+const BLENDER_RENDER_RUNNER_ID = "blender.render";
+const CUDA_RUN_JOB_TYPE = "cuda.run";
+const CUDA_PACKAGE_RUNNER_ID = "cuda.package";
+const APPROVED_NVIDIA_CUDA_IMAGES = new Set([
+    "nvidia/cuda:12.4.1-devel-ubuntu22.04"
+]);
+const OWNER_LOCAL_GENERIC_JOB_CATALOG = [
+    {
+        job_type: OWNER_LOCAL_TEST_ECHO_JOB_TYPE,
+        args_schema: {
+            type: "object",
+            additionalProperties: true,
+            properties: {
+                message: { type: "string" },
+                delay_ms: { type: "number", minimum: 0 },
+                repeat: { type: "number", minimum: 1 },
+                fail: { type: "boolean" }
+            }
+        },
+        policy: {
+            trust_mode: "owner-local",
+            network: "none",
+            allow_raw_command: false
+        },
+        runner: TEST_ECHO_RUNNER_ID
+    },
+    {
+        job_type: RENDER_BLENDER_JOB_TYPE,
+        args_schema: {
+            type: "object",
+            additionalProperties: false,
+            properties: {
+                frames: { type: ["string", "number"] },
+                engine: { enum: ["cycles", "eevee", "workbench"] },
+                resolution: { type: "string", pattern: "^[1-9][0-9]{0,4}x[1-9][0-9]{0,4}$" },
+                output_format: { enum: ["png", "jpeg", "open_exr"] },
+                scene: { type: "string" },
+                camera: { type: "string" }
+            }
+        },
+        policy: {
+            trust_mode: "owner-local",
+            network: "none",
+            allow_raw_command: false
+        },
+        runner: BLENDER_RENDER_RUNNER_ID,
+        required_capabilities: ["software.blender"]
+    },
+    {
+        job_type: CUDA_RUN_JOB_TYPE,
+        args_schema: {
+            type: "object",
+            additionalProperties: false,
+            required: ["manifest_path", "profile", "target"],
+            properties: {
+                manifest_path: { type: "string" },
+                profile: { type: "string" },
+                target: { type: "string" }
+            }
+        },
+        policy: {
+            trust_mode: "owner-local",
+            network: "none",
+            allow_raw_command: false,
+            allowed_images: Array.from(APPROVED_NVIDIA_CUDA_IMAGES)
+        },
+        runner: CUDA_PACKAGE_RUNNER_ID,
+        required_capabilities: ["gpu.nvidia", "software.docker", "docker.nvidia"]
+    }
+];
 const SERVICE_LABEL = "com.mcoda.mswarm.self-hosted-node";
 const SYSTEMD_SERVICE_NAME = "mswarm-self-hosted-node.service";
 const WINDOWS_TASK_NAME = "MswarmSelfHostedNode";
@@ -327,6 +408,9 @@ function defaultStatePath() {
 function defaultRuntimeTokenPath() {
     return join(homedir(), ".mswarm", "self-hosted-node", "node.key");
 }
+function defaultArtifactStorePath() {
+    return join(homedir(), ".mswarm", "self-hosted-node", "artifacts");
+}
 export async function readOrCreateSelfHostedMachineId(machineIdPath = defaultMachineIdPath()) {
     try {
         const existing = (await readFile(machineIdPath, "utf8")).trim();
@@ -381,6 +465,112 @@ function optionalBoolean(...values) {
     }
     return null;
 }
+function roundedTelemetryNumber(value, digits = 3) {
+    if (!Number.isFinite(value)) {
+        return 0;
+    }
+    const factor = 10 ** digits;
+    return Math.round(value * factor) / factor;
+}
+function nonNegativeTelemetryInteger(value) {
+    return typeof value === "number" && Number.isFinite(value) && value > 0 ? Math.floor(value) : 0;
+}
+function sha256Json(value) {
+    return createHash("sha256").update(JSON.stringify(value)).digest("hex");
+}
+function buildCatalogFingerprint(models) {
+    const projection = models
+        .map((model) => ({
+        name: optionalText(model.name) || "",
+        provider: optionalText(model.provider) || null,
+        adapter: optionalText(model.adapter) || null,
+        source_agent_slug: optionalText(model.source_agent_slug) || null,
+        model_id: optionalText(model.model_id) || optionalText(model.model) || null,
+        exposed: model.exposed !== false,
+        capabilities: normalizeCapabilities(model.capabilities).sort(),
+        health_status: normalizeHealthStatus(model.health_status)
+    }))
+        .sort((left, right) => `${left.provider || ""}:${left.name}`.localeCompare(`${right.provider || ""}:${right.name}`));
+    return `sha256:${sha256Json(projection)}`;
+}
+function executionClassCapacity(input) {
+    const maxConcurrency = Math.max(1, Math.floor(input.maxConcurrency));
+    const activeJobs = nonNegativeTelemetryInteger(input.activeJobs);
+    const queuedJobs = nonNegativeTelemetryInteger(input.queuedJobs);
+    return {
+        max_concurrency: maxConcurrency,
+        active_jobs: activeJobs,
+        queued_jobs: queuedJobs,
+        free_slots: input.drainMode ? 0 : Math.max(0, maxConcurrency - activeJobs - queuedJobs)
+    };
+}
+function totalHostMemoryBucket() {
+    const gib = totalmem() / (1024 ** 3);
+    if (!Number.isFinite(gib) || gib <= 0)
+        return "unknown";
+    if (gib <= 8)
+        return "<=8GiB";
+    if (gib <= 16)
+        return "<=16GiB";
+    if (gib <= 32)
+        return "<=32GiB";
+    if (gib <= 64)
+        return "<=64GiB";
+    if (gib <= 128)
+        return "<=128GiB";
+    return ">128GiB";
+}
+function coarsePublicVramTier(value, gpuCount) {
+    if (value === "none" ||
+        value === "lt8" ||
+        value === "8-15" ||
+        value === "16-31" ||
+        value === "32plus") {
+        return value;
+    }
+    return gpuCount > 0 ? "unknown" : "none";
+}
+function buildCoarseHardwarePressure(capabilityPayload) {
+    const cpuCount = Math.max(1, cpus().length || 1);
+    const totalMemory = totalmem();
+    const freeMemory = freemem();
+    const projection = capabilityPayload?.public_projection;
+    const projectionRecord = projection && typeof projection === "object" && !Array.isArray(projection)
+        ? projection
+        : {};
+    const accelerators = projectionRecord.accelerators && typeof projectionRecord.accelerators === "object"
+        ? projectionRecord.accelerators
+        : {};
+    const gpu = accelerators.gpu && typeof accelerators.gpu === "object" && !Array.isArray(accelerators.gpu)
+        ? accelerators.gpu
+        : null;
+    const rawGpuCount = gpu?.["count"];
+    const gpuCount = typeof rawGpuCount === "number" && Number.isFinite(rawGpuCount)
+        ? Math.max(0, Math.floor(rawGpuCount))
+        : 0;
+    const vramTier = coarsePublicVramTier(gpu?.["vram_tier"], gpuCount);
+    return {
+        schema_version: 1,
+        collected_at: new Date().toISOString(),
+        cpu: {
+            core_count: cpuCount,
+            load_1m_ratio: roundedTelemetryNumber((loadavg()[0] || 0) / cpuCount)
+        },
+        ram: {
+            used_ratio: totalMemory > 0 ? roundedTelemetryNumber((totalMemory - freeMemory) / totalMemory) : null,
+            total_bucket: totalHostMemoryBucket()
+        },
+        gpu: {
+            available: Boolean(gpu?.["available"]),
+            count: gpuCount,
+            cuda: Boolean(gpu?.["cuda"] || gpu?.["has_cuda"]),
+            vram: {
+                total_tier: vramTier,
+                used_ratio: null
+            }
+        }
+    };
+}
 function normalizeCapabilities(value) {
     if (!Array.isArray(value)) {
         return [];
@@ -537,6 +727,7 @@ function serviceEnvironment(config, env, homeDir) {
         MSWARM_GATEWAY_BASE_URL: config.gatewayBaseUrl,
         MSWARM_SELF_HOSTED_NODE_STATE_PATH: config.statePath,
         MSWARM_SELF_HOSTED_NODE_KEY_PATH: config.runtimeTokenPath,
+        MSWARM_SELF_HOSTED_ARTIFACT_STORE_PATH: config.artifactStorePath || null,
         MSWARM_SELF_HOSTED_RELAY_MODE: config.relayMode || "outbound",
         MSWARM_SELF_HOSTED_DIRECT_BASE_URL: config.directBaseUrl || null,
         MSWARM_SELF_HOSTED_DISCOVERY_MODE: config.discoveryMode,
@@ -550,7 +741,18 @@ function serviceEnvironment(config, env, homeDir) {
         MSWARM_SELF_HOSTED_MODEL_BLOCKLIST: config.modelBlocklist.join(","),
         MSWARM_SELF_HOSTED_HEARTBEAT_INTERVAL_SECONDS: String(config.heartbeatIntervalSeconds),
         MSWARM_SELF_HOSTED_REQUEST_TIMEOUT_MS: String(config.requestTimeoutMs),
-        MSWARM_SELF_HOSTED_JOB_TIMEOUT_MS: String(config.jobTimeoutMs)
+        MSWARM_SELF_HOSTED_JOB_TIMEOUT_MS: String(config.jobTimeoutMs),
+        MSWARM_SELF_HOSTED_MAX_CONCURRENT_JOBS: String(config.maxConcurrentJobs || 1),
+        MSWARM_SELF_HOSTED_MAX_CONCURRENT_LLM_JOBS: String(config.maxConcurrentLlmJobs || config.maxConcurrentJobs || 1),
+        MSWARM_SELF_HOSTED_GENERIC_JOBS_ENABLED: config.genericJobsEnabled ? "true" : "false",
+        MSWARM_SELF_HOSTED_GENERIC_JOB_TIMEOUT_MS: String(config.genericJobTimeoutMs),
+        MSWARM_SELF_HOSTED_GENERIC_JOB_MAX_CONCURRENCY: String(config.genericJobMaxConcurrency),
+        MSWARM_SELF_HOSTED_DRAIN_MODE: config.drainMode ? "true" : "false",
+        MSWARM_SELF_HOSTED_LOAD_REPORTING_ENABLED: config.loadReportingEnabled === false ? "false" : "true",
+        MSWARM_SELF_HOSTED_HARDWARE_TELEMETRY_ENABLED: config.hardwareTelemetryEnabled ? "true" : "false",
+        MSWARM_SELF_HOSTED_CAPABILITY_PROBE_TIMEOUT_MS: config.capabilityProbeTimeoutMs
+            ? String(config.capabilityProbeTimeoutMs)
+            : null
     };
     return Object.fromEntries(Object.entries(values).filter((entry) => typeof entry[1] === "string" && entry[1] !== ""));
 }
@@ -955,6 +1157,8 @@ export async function readSelfHostedNodeConfig(env = process.env) {
         optionalText(env.OLLAMA_HOST) ||
         DEFAULT_OLLAMA_BASE_URL;
     const packageNodeVersion = await readPackageNodeVersion();
+    const maxConcurrentJobs = parsePositiveInteger(env.MSWARM_SELF_HOSTED_MAX_CONCURRENT_JOBS, state.max_concurrent_jobs || 1);
+    const maxConcurrentLlmJobs = parsePositiveInteger(env.MSWARM_SELF_HOSTED_MAX_CONCURRENT_LLM_JOBS, state.max_concurrent_llm_jobs || maxConcurrentJobs);
     return {
         gatewayBaseUrl: trimTrailingSlash(gatewayBaseUrl),
         nodeId,
@@ -970,6 +1174,9 @@ export async function readSelfHostedNodeConfig(env = process.env) {
         ollamaBaseUrl: trimTrailingSlash(ollamaBaseUrl),
         statePath,
         runtimeTokenPath,
+        artifactStorePath: optionalText(env.MSWARM_SELF_HOSTED_ARTIFACT_STORE_PATH) ||
+            state.artifact_store_path ||
+            defaultArtifactStorePath(),
         invocationSigningSecret: optionalText(env.MSWARM_SELF_HOSTED_INVOCATION_SIGNING_SECRET) ||
             optionalText(env.MSWARM_SELF_HOSTED_RELAY_SIGNING_SECRET),
         listenHost: optionalText(env.MSWARM_SELF_HOSTED_LISTEN_HOST) || DEFAULT_LISTEN_HOST,
@@ -981,6 +1188,15 @@ export async function readSelfHostedNodeConfig(env = process.env) {
         heartbeatIntervalSeconds: parsePositiveInteger(env.MSWARM_SELF_HOSTED_HEARTBEAT_INTERVAL_SECONDS, state.heartbeat_interval_seconds || DEFAULT_HEARTBEAT_INTERVAL_SECONDS),
         requestTimeoutMs: parsePositiveInteger(env.MSWARM_SELF_HOSTED_REQUEST_TIMEOUT_MS, state.request_timeout_ms || DEFAULT_REQUEST_TIMEOUT_MS),
         jobTimeoutMs: parsePositiveInteger(env.MSWARM_SELF_HOSTED_JOB_TIMEOUT_MS, state.job_timeout_ms || DEFAULT_JOB_TIMEOUT_MS),
+        maxConcurrentJobs,
+        maxConcurrentLlmJobs,
+        genericJobsEnabled: parseBoolean(env.MSWARM_SELF_HOSTED_GENERIC_JOBS_ENABLED ?? env.MSWARM_SELF_HOSTED_GENERIC_JOBS, state.generic_jobs_enabled === true),
+        genericJobTimeoutMs: parsePositiveInteger(env.MSWARM_SELF_HOSTED_GENERIC_JOB_TIMEOUT_MS, state.generic_job_timeout_ms || state.job_timeout_ms || DEFAULT_JOB_TIMEOUT_MS),
+        genericJobMaxConcurrency: parsePositiveInteger(env.MSWARM_SELF_HOSTED_GENERIC_JOB_MAX_CONCURRENCY, state.generic_job_max_concurrency || 1),
+        capabilityProbeTimeoutMs: parsePositiveInteger(env.MSWARM_SELF_HOSTED_CAPABILITY_PROBE_TIMEOUT_MS, state.capability_probe_timeout_ms || DEFAULT_CAPABILITY_PROBE_TIMEOUT_MS),
+        drainMode: parseBoolean(env.MSWARM_SELF_HOSTED_DRAIN_MODE, state.drain_mode === true),
+        loadReportingEnabled: parseBoolean(env.MSWARM_SELF_HOSTED_LOAD_REPORTING_ENABLED ?? env.MSWARM_SELF_HOSTED_LOAD_REPORTING, state.load_reporting_enabled !== false),
+        hardwareTelemetryEnabled: parseBoolean(env.MSWARM_SELF_HOSTED_HARDWARE_TELEMETRY_ENABLED ?? env.MSWARM_SELF_HOSTED_HARDWARE_TELEMETRY, state.hardware_telemetry_enabled === true),
         exposeAllModels: resolveDaemonExposeAllModels(env, state),
         modelAllowlist: parseList(env.MSWARM_SELF_HOSTED_MODEL_ALLOWLIST || state.model_allowlist),
         modelBlocklist: parseList(env.MSWARM_SELF_HOSTED_MODEL_BLOCKLIST || state.model_blocklist)
@@ -1011,6 +1227,8 @@ export async function readOwnerSetupConfig(argv = process.argv.slice(3), env = p
     const allowlist = parseList(options.allow || env.MSWARM_SELF_HOSTED_MODEL_ALLOWLIST);
     const blocklist = parseList(options.block || env.MSWARM_SELF_HOSTED_MODEL_BLOCKLIST);
     const packageNodeVersion = await readPackageNodeVersion();
+    const maxConcurrentJobs = parsePositiveInteger(options["max-concurrent-jobs"] || env.MSWARM_SELF_HOSTED_MAX_CONCURRENT_JOBS, 1);
+    const maxConcurrentLlmJobs = parsePositiveInteger(options["max-concurrent-llm-jobs"] || env.MSWARM_SELF_HOSTED_MAX_CONCURRENT_LLM_JOBS, maxConcurrentJobs);
     return {
         apiKey,
         gatewayBaseUrl: trimTrailingSlash(gatewayBaseUrl),
@@ -1022,6 +1240,9 @@ export async function readOwnerSetupConfig(argv = process.argv.slice(3), env = p
         discoveryMode: parseDiscoveryMode(env.MSWARM_SELF_HOSTED_DISCOVERY_MODE),
         statePath,
         runtimeTokenPath,
+        artifactStorePath: optionalText(options["artifact-store-path"]) ||
+            optionalText(env.MSWARM_SELF_HOSTED_ARTIFACT_STORE_PATH) ||
+            defaultArtifactStorePath(),
         machineIdPath: optionalText(env.MSWARM_SELF_HOSTED_MACHINE_ID_PATH) || defaultMachineIdPath(),
         mcodaBin: optionalText(env.MSWARM_SELF_HOSTED_MCODA_BIN) || DEFAULT_MCODA_BIN,
         mcodaListArgs: parseArgs(env.MSWARM_SELF_HOSTED_MCODA_LIST_ARGS, DEFAULT_MCODA_LIST_ARGS),
@@ -1030,6 +1251,17 @@ export async function readOwnerSetupConfig(argv = process.argv.slice(3), env = p
         heartbeatIntervalSeconds: parsePositiveInteger(env.MSWARM_SELF_HOSTED_HEARTBEAT_INTERVAL_SECONDS, DEFAULT_HEARTBEAT_INTERVAL_SECONDS),
         requestTimeoutMs: parsePositiveInteger(env.MSWARM_SELF_HOSTED_REQUEST_TIMEOUT_MS, DEFAULT_REQUEST_TIMEOUT_MS),
         jobTimeoutMs: parsePositiveInteger(options["job-timeout-ms"] || env.MSWARM_SELF_HOSTED_JOB_TIMEOUT_MS, DEFAULT_JOB_TIMEOUT_MS),
+        maxConcurrentJobs,
+        maxConcurrentLlmJobs,
+        genericJobsEnabled: parseBoolean(options["enable-generic-jobs"] || env.MSWARM_SELF_HOSTED_GENERIC_JOBS_ENABLED || env.MSWARM_SELF_HOSTED_GENERIC_JOBS, false),
+        genericJobTimeoutMs: parsePositiveInteger(options["generic-job-timeout-ms"] || env.MSWARM_SELF_HOSTED_GENERIC_JOB_TIMEOUT_MS, DEFAULT_JOB_TIMEOUT_MS),
+        genericJobMaxConcurrency: parsePositiveInteger(options["generic-job-max-concurrency"] || env.MSWARM_SELF_HOSTED_GENERIC_JOB_MAX_CONCURRENCY, 1),
+        capabilityProbeTimeoutMs: parsePositiveInteger(env.MSWARM_SELF_HOSTED_CAPABILITY_PROBE_TIMEOUT_MS, DEFAULT_CAPABILITY_PROBE_TIMEOUT_MS),
+        drainMode: parseBoolean(options.drain || env.MSWARM_SELF_HOSTED_DRAIN_MODE, false),
+        loadReportingEnabled: parseBoolean(options["disable-load-reporting"] === true
+            ? false
+            : (env.MSWARM_SELF_HOSTED_LOAD_REPORTING_ENABLED ?? env.MSWARM_SELF_HOSTED_LOAD_REPORTING), true),
+        hardwareTelemetryEnabled: parseBoolean(options["enable-hardware-telemetry"] || env.MSWARM_SELF_HOSTED_HARDWARE_TELEMETRY_ENABLED || env.MSWARM_SELF_HOSTED_HARDWARE_TELEMETRY, false),
         exposeAllModels: resolveOwnerSetupExposeAllModels(options, env),
         modelAllowlist: allowlist,
         modelBlocklist: blocklist,
@@ -1148,10 +1380,17 @@ async function defaultCommandRunner(command, args, options) {
         let stdout = "";
         let stderr = "";
         let settled = false;
+        const abort = () => {
+            if (settled)
+                return;
+            child.kill("SIGTERM");
+            finish(new Error("command aborted"));
+        };
         const timer = setTimeout(() => {
             if (settled)
                 return;
             settled = true;
+            options.signal?.removeEventListener("abort", abort);
             child.kill("SIGTERM");
             reject(new Error(`command timed out after ${options.timeoutMs}ms: ${command}`));
         }, options.timeoutMs);
@@ -1160,6 +1399,7 @@ async function defaultCommandRunner(command, args, options) {
                 return;
             settled = true;
             clearTimeout(timer);
+            options.signal?.removeEventListener("abort", abort);
             if (error) {
                 reject(error);
                 return;
@@ -1188,6 +1428,11 @@ async function defaultCommandRunner(command, args, options) {
             }
             finish();
         });
+        if (options.signal?.aborted) {
+            abort();
+            return;
+        }
+        options.signal?.addEventListener("abort", abort, { once: true });
         if (options.input) {
             child.stdin.write(options.input);
         }
@@ -1414,10 +1659,6 @@ function mapMcodaAgentToCodaliAgent(agent, fallbackSlug) {
         maxOutputTokens: optionalNumber(agent.maxOutputTokens, agent.max_output_tokens) ?? undefined,
     };
 }
-function isExposedLocalAgent(agent, config) {
-    const mapped = mapMcodaAgentToSelfHostedModel(agent, config);
-    return Boolean(mapped?.exposed);
-}
 function buildCodaliWorkspace(job) {
     const root = optionalText(job.workspace?.root);
     if (!root) {
@@ -1437,6 +1678,13 @@ const DOCDEX_JOB_ERROR_CODES = new Set([
     "docdex_repo_access_denied",
     "docdex_unavailable",
 ]);
+const PRE_START_JOB_ERROR_CODES = new Set([
+    "selected_agent_unavailable",
+    "selected_agent_unhealthy",
+    "validation_failed",
+    "docdex_context_missing",
+    "docdex_api_key_missing",
+]);
 class SelfHostedDocdexJobError extends Error {
     constructor(code, message) {
         super(message);
@@ -1444,6 +1692,13 @@ class SelfHostedDocdexJobError extends Error {
         this.code = code;
     }
 }
+class SelfHostedPreStartJobError extends Error {
+    constructor(code, message) {
+        super(message);
+        this.name = code;
+        this.code = code;
+    }
+}
 function normalizeDocdexCapabilityMap(value) {
     const record = objectRecord(value);
     if (!record)
@@ -1501,11 +1756,14 @@ function selfHostedErrorCode(error) {
     if (!error || typeof error !== "object")
         return undefined;
     const code = error.code;
-    if (typeof code === "string" && DOCDEX_JOB_ERROR_CODES.has(code)) {
+    if (typeof code === "string" &&
+        (DOCDEX_JOB_ERROR_CODES.has(code) || PRE_START_JOB_ERROR_CODES.has(code))) {
         return code;
     }
     const name = error.name;
-    return typeof name === "string" && DOCDEX_JOB_ERROR_CODES.has(name) ? name : undefined;
+    return typeof name === "string" && (DOCDEX_JOB_ERROR_CODES.has(name) || PRE_START_JOB_ERROR_CODES.has(name))
+        ? name
+        : undefined;
 }
 function redactRuntimeSecretValues(value, secrets) {
     let output = value;
@@ -1530,159 +1788,1556 @@ function buildCodaliPolicy(job) {
         maxOutputTokens: job.policy?.max_output_tokens ?? job.openai_request.max_tokens,
     };
 }
-function usageTokens(usage) {
-    return {
-        promptTokens: positiveInteger(usage?.inputTokens),
-        completionTokens: positiveInteger(usage?.outputTokens),
-    };
+function numberArg(value, fallback) {
+    const parsed = Number(value);
+    return Number.isFinite(parsed) ? parsed : fallback;
 }
-export class McodaLocalAgentExecutor {
-    constructor(input) {
-        this.command = input.command || DEFAULT_MCODA_BIN;
-        this.timeoutMs = input.timeoutMs || DEFAULT_JOB_TIMEOUT_MS;
-        this.runner = input.runner || defaultCommandRunner;
+function boundedMilliseconds(value, fallback, max) {
+    return Math.max(0, Math.min(max, Math.floor(numberArg(value, fallback))));
+}
+function abortErrorCode(signal) {
+    return signal.reason === "timeout" ? "timeout" : "cancelled";
+}
+function abortErrorMessage(signal) {
+    return abortErrorCode(signal) === "timeout" ? "generic job timed out" : "generic job cancelled";
+}
+async function sleepWithAbort(ms, signal) {
+    if (ms <= 0)
+        return;
+    if (signal.aborted) {
+        throw new Error(abortErrorMessage(signal));
     }
-    async invoke(agentSlug, prompt) {
-        const stdout = (await this.runner(this.command, ["agent-run", agentSlug, "--json", "--stdin"], {
-            timeoutMs: this.timeoutMs,
-            maxBuffer: DEFAULT_COMMAND_MAX_BUFFER,
-            input: prompt
-        })).stdout;
-        const parsed = JSON.parse(stdout);
-        if (!parsed || typeof parsed !== "object" || !Array.isArray(parsed.responses)) {
-            throw new Error("mcoda agent-run returned unsupported JSON");
+    await new Promise((resolve, reject) => {
+        const timer = setTimeout(() => {
+            cleanup();
+            resolve();
+        }, ms);
+        const onAbort = () => {
+            cleanup();
+            reject(new Error(abortErrorMessage(signal)));
+        };
+        const cleanup = () => {
+            clearTimeout(timer);
+            signal.removeEventListener("abort", onAbort);
+        };
+        signal.addEventListener("abort", onAbort, { once: true });
+    });
+}
+function safeLocalArtifactJobId(jobId) {
+    const normalized = jobId.replace(/[^a-zA-Z0-9_.-]/g, "_") || "job";
+    return assertMswarmSafeRelativePath(normalized, "job_id");
+}
+function safeLocalArtifactName(value, fallback) {
+    const normalized = value.replace(/[^a-zA-Z0-9_.-]/g, "_") || fallback;
+    return assertMswarmSafeRelativePath(normalized, "artifact_name");
+}
+function resolveWithinRoot(root, relativePath) {
+    const rootPath = resolve(root);
+    const target = resolve(rootPath, relativePath);
+    const delta = relative(rootPath, target);
+    if (delta === "" || (!delta.startsWith("..") && !isAbsolute(delta))) {
+        return target;
+    }
+    throw new Error("path_escape_not_allowed");
+}
+function sha256Hex(buffer) {
+    return createHash("sha256").update(buffer).digest("hex");
+}
+function positiveByteLimit(...values) {
+    const positive = values.filter((value) => typeof value === "number" && Number.isFinite(value) && value > 0);
+    return positive.length ? Math.min(...positive) : DEFAULT_LOCAL_ARTIFACT_MAX_BYTES;
+}
+function parseLocalArtifactUri(uri) {
+    try {
+        const parsed = new URL(uri);
+        if (parsed.protocol !== "artifact:" || parsed.hostname !== "local") {
+            return null;
         }
-        const response = parsed.responses[0] || {};
-        const output = optionalText(response.output);
-        if (!output) {
-            throw new Error("mcoda agent-run response did not include output");
+        const parts = decodeURIComponent(parsed.pathname).split("/").filter(Boolean);
+        if (parts.length < 2) {
+            return null;
         }
+        const [jobId, ...artifactPath] = parts;
         return {
-            output,
-            adapter: optionalText(response.adapter) || undefined,
-            model: optionalText(response.model) || undefined,
-            metadata: response.metadata && typeof response.metadata === "object" ? response.metadata : undefined
+            jobId: assertMswarmSafeRelativePath(jobId, "artifact_job_id"),
+            path: assertMswarmSafeRelativePath(artifactPath.join("/"), "artifact_path")
         };
     }
+    catch {
+        return null;
+    }
 }
-export class MswarmSelfHostedNodeClient {
-    constructor(input) {
-        this.gatewayBaseUrl = trimTrailingSlash(input.gatewayBaseUrl);
-        this.fetchImpl = input.fetchImpl || fetch;
-        this.timeoutMs = input.timeoutMs || DEFAULT_REQUEST_TIMEOUT_MS;
+export class MswarmLocalArtifactStore {
+    constructor(input = {}) {
+        this.rootDir = input.rootDir || defaultArtifactStorePath();
+        this.now = input.now || (() => new Date());
     }
-    async enroll(nodeId, enrollmentToken) {
-        return fetchJson(this.fetchImpl, `${this.gatewayBaseUrl}/v1/swarm/self-hosted/node/enroll`, {
-            method: "POST",
-            headers: { "content-type": "application/json" },
-            body: JSON.stringify({ node_id: nodeId, enrollment_token: enrollmentToken })
-        }, this.timeoutMs);
+    async prepareJobWorkspace(jobId, job) {
+        const safeJobId = safeLocalArtifactJobId(jobId);
+        const workDir = resolveWithinRoot(this.rootDir, safeJobId);
+        const inputDir = resolveWithinRoot(workDir, "inputs");
+        const outputDir = resolveWithinRoot(workDir, "outputs");
+        await rm(workDir, { recursive: true, force: true });
+        await mkdir(inputDir, { recursive: true });
+        await mkdir(outputDir, { recursive: true });
+        const store = {
+            backend: "local-dev",
+            root_uri: `artifact://local/${safeJobId}`
+        };
+        const registeredInputs = await Promise.all((job.inputs || []).map((input, index) => this.registerInput(jobId, job, input, index, inputDir, store)));
+        const outputSpecs = (job.outputs || []).map((output) => ({
+            ...output,
+            path: assertMswarmSafeRelativePath(output.path, "output_path")
+        }));
+        const sandbox = buildMswarmSandboxProfile({
+            policy: job.policy,
+            limits: job.limits,
+            containerized: job.policy.trust_mode === "tenant-owned" || job.job_type === CUDA_RUN_JOB_TYPE,
+            gpu: job.resources?.gpu ? "nvidia" : "none"
+        });
+        return {
+            store,
+            workDir,
+            inputDir,
+            outputDir,
+            registeredInputs,
+            outputSpecs,
+            sandbox
+        };
     }
-    async bootstrap(apiKey, payload) {
-        return fetchJson(this.fetchImpl, `${this.gatewayBaseUrl}/v1/swarm/self-hosted/node/bootstrap`, {
-            method: "POST",
-            headers: {
-                "content-type": "application/json",
-                "x-api-key": apiKey
-            },
-            body: JSON.stringify(payload)
-        }, this.timeoutMs);
+    async collectOutputs(context, jobId) {
+        const artifacts = [];
+        let totalBytes = 0;
+        for (const output of context.outputSpecs) {
+            const collected = await this.collectDeclaredOutput(context, jobId, output);
+            for (const artifact of collected) {
+                totalBytes += artifact.size_bytes || 0;
+                const totalLimit = positiveByteLimit(context.sandbox.limits.max_output_bytes);
+                if (totalBytes > totalLimit) {
+                    throw new Error("output_size_limit_exceeded");
+                }
+                artifacts.push(artifact);
+            }
+        }
+        return artifacts;
     }
-    async health() {
-        return fetchJson(this.fetchImpl, `${this.gatewayBaseUrl}/healthz`, { method: "GET" }, this.timeoutMs);
+    async registerInput(jobId, job, input, index, inputDir, store) {
+        const mountPath = input.mount_path
+            ? assertMswarmSafeRelativePath(input.mount_path, "input_mount_path")
+            : safeLocalArtifactName(input.name, `input-${index}`);
+        const targetPath = resolveWithinRoot(inputDir, mountPath);
+        const maxArtifactBytes = positiveByteLimit(job.policy.max_artifact_bytes);
+        if (Number.isFinite(input.artifact.size_bytes) && input.artifact.size_bytes !== undefined) {
+            if (input.artifact.size_bytes > maxArtifactBytes) {
+                throw new Error("input_artifact_size_limit_exceeded");
+            }
+        }
+        const source = parseLocalArtifactUri(input.artifact.uri);
+        let localPath;
+        if (source) {
+            const sourcePath = resolveWithinRoot(resolveWithinRoot(this.rootDir, source.jobId), join("outputs", source.path));
+            try {
+                const sourceStat = await lstat(sourcePath);
+                if (!sourceStat.isFile()) {
+                    throw new Error("input_artifact_must_be_file");
+                }
+                if (sourceStat.size > maxArtifactBytes) {
+                    throw new Error("input_artifact_size_limit_exceeded");
+                }
+                const bytes = await readFile(sourcePath);
+                if (input.artifact.sha256 && input.artifact.sha256 !== sha256Hex(bytes)) {
+                    throw new Error("input_artifact_checksum_mismatch");
+                }
+                await mkdir(dirname(targetPath), { recursive: true });
+                await writeFile(targetPath, bytes);
+                localPath = targetPath;
+            }
+            catch (error) {
+                if (error.code !== "ENOENT" || input.required === true) {
+                    throw error;
+                }
+            }
+        }
+        else if (input.required === true) {
+            throw new Error("input_artifact_unavailable");
+        }
+        const registeredAt = this.now().toISOString();
+        return {
+            ...input.artifact,
+            id: input.artifact.id || `input_${sha256Hex(Buffer.from(`${jobId}:${input.name}:${input.artifact.uri}`)).slice(0, 16)}`,
+            job_id: jobId,
+            name: input.name,
+            scope: "input",
+            registered_at: registeredAt,
+            store,
+            access: defaultMswarmArtifactAccessPolicy(job.policy.trust_mode === "tenant-owned" ? "tenant-scoped" : "owner-local"),
+            retention: defaultMswarmArtifactRetentionPolicy(),
+            ...(localPath ? { local_path: localPath } : {})
+        };
     }
-    async heartbeat(runtimeToken, payload) {
-        return fetchJson(this.fetchImpl, `${this.gatewayBaseUrl}/v1/swarm/self-hosted/node/heartbeat`, {
-            method: "POST",
-            headers: {
-                "content-type": "application/json",
-                authorization: `Bearer ${runtimeToken}`
-            },
-            body: JSON.stringify(payload)
-        }, this.timeoutMs);
+    async collectDeclaredOutput(context, jobId, output) {
+        const normalizedPath = assertMswarmSafeRelativePath(output.path, "output_path");
+        const targetPath = resolveWithinRoot(context.outputDir, normalizedPath);
+        try {
+            const targetStat = await lstat(targetPath);
+            if (targetStat.isSymbolicLink()) {
+                throw new Error("output_symlink_not_allowed");
+            }
+            if (targetStat.isDirectory()) {
+                return this.collectOutputDirectory(context, jobId, output, normalizedPath);
+            }
+            if (targetStat.isFile()) {
+                return [await this.collectOutputFile(context, jobId, output, normalizedPath, targetPath)];
+            }
+            throw new Error("output_entry_type_not_allowed");
+        }
+        catch (error) {
+            if (error.code === "ENOENT" && output.required !== true) {
+                return [];
+            }
+            throw error;
+        }
     }
-    async uninstall(runtimeToken, payload) {
-        return fetchJson(this.fetchImpl, `${this.gatewayBaseUrl}/v1/swarm/self-hosted/node/uninstall`, {
-            method: "POST",
-            headers: {
-                "content-type": "application/json",
-                authorization: `Bearer ${runtimeToken}`
-            },
-            body: JSON.stringify(payload)
-        }, this.timeoutMs);
+    async collectOutputDirectory(context, jobId, output, relativeDir) {
+        const dirPath = resolveWithinRoot(context.outputDir, relativeDir);
+        const entries = await readdir(dirPath, { withFileTypes: true });
+        const artifacts = [];
+        for (const entry of entries) {
+            const childRelativePath = assertMswarmSafeRelativePath(`${relativeDir}/${entry.name}`, "output_path");
+            const childPath = resolveWithinRoot(context.outputDir, childRelativePath);
+            if (entry.isSymbolicLink()) {
+                throw new Error("output_symlink_not_allowed");
+            }
+            if (entry.isDirectory()) {
+                artifacts.push(...(await this.collectOutputDirectory(context, jobId, output, childRelativePath)));
+            }
+            else if (entry.isFile()) {
+                artifacts.push(await this.collectOutputFile(context, jobId, output, childRelativePath, childPath));
+            }
+            else {
+                throw new Error("output_entry_type_not_allowed");
+            }
+        }
+        return artifacts;
     }
-    async pushModels(runtimeToken, payload) {
-        return fetchJson(this.fetchImpl, `${this.gatewayBaseUrl}/v1/swarm/self-hosted/node/models`, {
-            method: "POST",
-            headers: {
-                "content-type": "application/json",
-                authorization: `Bearer ${runtimeToken}`
-            },
-            body: JSON.stringify(payload)
-        }, this.timeoutMs);
+    async collectOutputFile(context, jobId, output, relativePath, filePath) {
+        const stat = await lstat(filePath);
+        if (!stat.isFile()) {
+            throw new Error("output_entry_type_not_allowed");
+        }
+        const perArtifactLimit = positiveByteLimit(context.sandbox.limits.max_artifact_bytes, context.sandbox.limits.max_output_bytes);
+        if (stat.size > perArtifactLimit) {
+            throw new Error("output_artifact_size_limit_exceeded");
+        }
+        const bytes = await readFile(filePath);
+        return {
+            id: `output_${sha256Hex(Buffer.from(`${jobId}:${relativePath}`)).slice(0, 16)}`,
+            job_id: jobId,
+            name: output.path === relativePath ? output.name : `${output.name}/${relativePath}`,
+            uri: buildMswarmLocalArtifactUri(jobId, relativePath),
+            content_type: output.content_type,
+            size_bytes: stat.size,
+            sha256: sha256Hex(bytes),
+            scope: "output",
+            registered_at: this.now().toISOString(),
+            store: context.store,
+            access: defaultMswarmArtifactAccessPolicy(context.sandbox.trust_mode === "tenant-owned" ? "tenant-scoped" : "owner-local"),
+            retention: defaultMswarmArtifactRetentionPolicy()
+        };
     }
-    async pollJob(runtimeToken, payload) {
-        return fetchJson(this.fetchImpl, `${this.gatewayBaseUrl}/v1/swarm/self-hosted/node/jobs/poll`, {
-            method: "POST",
-            headers: {
-                "content-type": "application/json",
-                authorization: `Bearer ${runtimeToken}`
-            },
-            body: JSON.stringify(payload)
-        }, Math.max(this.timeoutMs, (payload.wait_ms || 0) + 5000));
+}
+export class MswarmTestEchoRunner {
+    constructor() {
+        this.id = TEST_ECHO_RUNNER_ID;
     }
-    async postJobResult(runtimeToken, jobId, payload) {
-        return fetchJson(this.fetchImpl, `${this.gatewayBaseUrl}/v1/swarm/self-hosted/node/jobs/${encodeURIComponent(jobId)}/result`, {
-            method: "POST",
-            headers: {
-                "content-type": "application/json",
-                authorization: `Bearer ${runtimeToken}`
-            },
-            body: JSON.stringify(payload)
-        }, this.timeoutMs);
+    async run(context) {
+        const args = context.job.args || {};
+        const message = optionalText(args.message) || "ok";
+        const repeat = Math.max(1, Math.min(20, Math.floor(numberArg(args.repeat, 1))));
+        const delayMs = boundedMilliseconds(args.delay_ms, 0, 30000);
+        if (args.fail === true) {
+            throw new Error(message);
+        }
+        for (let index = 0; index < repeat; index += 1) {
+            if (context.signal.aborted) {
+                throw new Error(abortErrorMessage(context.signal));
+            }
+            if (delayMs > 0) {
+                await sleepWithAbort(delayMs, context.signal);
+            }
+            await context.emitEvent({
+                type: "stdout",
+                message,
+                data: {
+                    runner: this.id,
+                    index,
+                    repeat
+                }
+            });
+        }
+        await context.emitEvent({
+            type: "progress",
+            message: "echo complete",
+            data: {
+                completed: repeat,
+                total: repeat
+            }
+        });
+        return {
+            job_id: context.job.idempotency_key || "local-generic-job",
+            status: "succeeded",
+            exit_code: 0,
+            started_at: new Date().toISOString(),
+            finished_at: new Date().toISOString(),
+            metrics: {
+                runner: this.id,
+                echoed: repeat,
+                message
+            }
+        };
     }
-    async postJobEvents(runtimeToken, jobId, payload) {
-        return fetchJson(this.fetchImpl, `${this.gatewayBaseUrl}/v1/swarm/self-hosted/node/jobs/${encodeURIComponent(jobId)}/events`, {
-            method: "POST",
-            headers: {
-                "content-type": "application/json",
-                authorization: `Bearer ${runtimeToken}`
-            },
-            body: JSON.stringify(payload)
-        }, this.timeoutMs);
+}
+const BLENDER_ENGINE_ARGS = {
+    cycles: "CYCLES",
+    eevee: "BLENDER_EEVEE_NEXT",
+    workbench: "BLENDER_WORKBENCH"
+};
+const BLENDER_OUTPUT_FORMAT_ARGS = {
+    png: "PNG",
+    jpeg: "JPEG",
+    open_exr: "OPEN_EXR"
+};
+function positiveSafeInteger(value) {
+    if (typeof value !== "number" || !Number.isSafeInteger(value) || value <= 0) {
+        return null;
     }
+    return value;
 }
-export class SelfHostedNodeRuntime {
-    constructor(config, deps) {
-        this.config = config;
-        this.gateway =
-            deps?.gateway ||
-                new MswarmSelfHostedNodeClient({
-                    gatewayBaseUrl: config.gatewayBaseUrl,
-                    fetchImpl: deps?.fetchImpl,
-                    timeoutMs: config.requestTimeoutMs
-                });
-        this.mcoda =
-            deps?.mcoda ||
-                new McodaAgentInventoryClient({
-                    command: config.mcodaBin,
-                    args: config.mcodaListArgs,
-                    timeoutMs: config.requestTimeoutMs
-                });
-        this.mcodaExecutor =
-            deps?.mcodaExecutor ||
-                new McodaLocalAgentExecutor({
-                    command: config.mcodaBin,
-                    timeoutMs: config.jobTimeoutMs
-                });
-        this.codaliExecutor = deps?.codaliExecutor || new MswarmCodaliExecutor();
-        this.ollama =
-            deps?.ollama ||
-                new OllamaClient({
-                    baseUrl: config.ollamaBaseUrl,
-                    fetchImpl: deps?.fetchImpl,
-                    timeoutMs: config.requestTimeoutMs
-                });
+function parseBlenderFrameSelection(value) {
+    const defaultFrame = 1;
+    if (value === undefined || value === null) {
+        return { mode: "frame", frame: defaultFrame, label: String(defaultFrame), total: 1 };
+    }
+    const numericFrame = positiveSafeInteger(value);
+    if (numericFrame !== null) {
+        return { mode: "frame", frame: numericFrame, label: String(numericFrame), total: 1 };
+    }
+    const raw = optionalText(value);
+    const match = raw?.match(/^([1-9]\d{0,6})(?:-([1-9]\d{0,6}))?$/);
+    if (!match) {
+        throw new Error("render.blender args.frames must be a positive frame number or start-end range");
+    }
+    const start = Number(match[1]);
+    const end = match[2] ? Number(match[2]) : start;
+    if (!Number.isSafeInteger(start) || !Number.isSafeInteger(end) || start <= 0 || end <= 0 || end < start) {
+        throw new Error("render.blender args.frames must use a valid positive frame range");
+    }
+    if (end - start > 10000) {
+        throw new Error("render.blender args.frames range exceeds the maximum supported 10001 frames");
+    }
+    if (start === end) {
+        return { mode: "frame", frame: start, label: String(start), total: 1 };
+    }
+    return { mode: "range", start, end, label: `${start}-${end}`, total: end - start + 1 };
+}
+function normalizeBlenderEngine(value) {
+    const raw = optionalText(value);
+    if (!raw)
+        return undefined;
+    const key = raw.toLowerCase();
+    const blender = BLENDER_ENGINE_ARGS[key];
+    if (!blender) {
+        throw new Error("render.blender args.engine must be cycles, eevee, or workbench");
+    }
+    return { label: key, blender };
+}
+function normalizeBlenderOutputFormat(value) {
+    const key = (optionalText(value) || "png").toLowerCase();
+    const blender = BLENDER_OUTPUT_FORMAT_ARGS[key];
+    if (!blender) {
+        throw new Error("render.blender args.output_format must be png, jpeg, or open_exr");
+    }
+    return { label: key, blender, extension: key === "open_exr" ? "exr" : key === "jpeg" ? "jpg" : "png" };
+}
+function parseBlenderResolution(value) {
+    if (value === undefined || value === null)
+        return undefined;
+    const raw = optionalText(value);
+    const match = raw?.match(/^([1-9]\d{0,4})x([1-9]\d{0,4})$/i);
+    if (!match) {
+        throw new Error("render.blender args.resolution must use WIDTHxHEIGHT");
+    }
+    const width = Number(match[1]);
+    const height = Number(match[2]);
+    if (width > 16384 || height > 16384) {
+        throw new Error("render.blender args.resolution exceeds 16384x16384");
+    }
+    return { width, height, label: `${width}x${height}` };
+}
+function safeBlenderSceneName(value, label) {
+    const raw = optionalText(value);
+    if (!raw)
+        return undefined;
+    if (raw.length > 128 || /[\0\r\n]/.test(raw)) {
+        throw new Error(`render.blender args.${label} is not a safe Blender object name`);
+    }
+    return raw;
+}
+function blenderSceneInputPath(context) {
+    const scene = context.artifacts.registeredInputs.find((input) => input.name === "scene") || context.artifacts.registeredInputs[0];
+    if (!scene?.local_path) {
+        throw new Error("render.blender requires a materialized scene input artifact");
+    }
+    return scene.local_path;
+}
+function blenderOutputPattern(context) {
+    const output = context.artifacts.outputSpecs[0];
+    if (!output) {
+        throw new Error("render.blender requires a declared output directory");
+    }
+    const normalizedPath = assertMswarmSafeRelativePath(output.path, "render_blender_output_path");
+    const leaf = normalizedPath.split("/").filter(Boolean).at(-1) || normalizedPath;
+    if (/\.[a-zA-Z0-9]{1,8}$/.test(leaf)) {
+        throw new Error("render.blender output path must be a directory, not a file path");
+    }
+    return resolveWithinRoot(context.artifacts.outputDir, `${normalizedPath}/frame_####`);
+}
+function redactBlenderLocalPaths(context, value) {
+    const replacements = [
+        [context.artifacts.workDir, "[job-workdir]"],
+        [context.artifacts.inputDir, "[job-inputs]"],
+        [context.artifacts.outputDir, "[job-outputs]"],
+        ...context.artifacts.registeredInputs.map((input) => [input.local_path, "[job-input]"])
+    ];
+    let output = value;
+    for (const [source, replacement] of replacements) {
+        if (source) {
+            output = output.split(source).join(replacement);
+        }
+    }
+    return output;
+}
+async function emitBlenderOutput(context, type, value) {
+    const lines = value.split(/\r?\n/).map((line) => line.trim()).filter(Boolean).slice(0, 200);
+    for (const line of lines) {
+        await context.emitEvent({
+            type,
+            message: redactBlenderLocalPaths(context, line),
+            data: { runner: BLENDER_RENDER_RUNNER_ID }
+        });
+    }
+}
+async function emitBlenderProgress(context, output, frames) {
+    const seen = new Set();
+    const lowerBound = frames.mode === "range" ? frames.start : frames.frame;
+    const upperBound = frames.mode === "range" ? frames.end : frames.frame;
+    for (const line of output.split(/\r?\n/)) {
+        const match = line.match(/\bFra:(\d+)\b/i) || line.match(/\bFrame\s+(\d+)\b/i);
+        if (!match)
+            continue;
+        const frame = Number(match[1]);
+        if (!Number.isSafeInteger(frame) || frame < lowerBound || frame > upperBound || seen.has(frame)) {
+            continue;
+        }
+        seen.add(frame);
+        await context.emitEvent({
+            type: "progress",
+            message: `rendered frame ${frame}`,
+            data: {
+                runner: BLENDER_RENDER_RUNNER_ID,
+                frame,
+                completed: seen.size,
+                total: frames.total
+            }
+        });
+    }
+}
+function blenderFailureResult(job, code, message, startedAt) {
+    return {
+        job_id: job.idempotency_key || "render.blender",
+        status: "failed",
+        exit_code: 1,
+        started_at: startedAt,
+        finished_at: new Date().toISOString(),
+        error: {
+            code,
+            message,
+            retryable: false
+        }
+    };
+}
+function blenderGpuComputeDeviceType() {
+    // The current GPU probe only marks NVIDIA devices as available, so CUDA is
+    // the only concrete Blender compute backend this runner can safely request.
+    return "CUDA";
+}
+export class MswarmBlenderRenderRunner {
+    constructor(runner = defaultCommandRunner) {
+        this.id = BLENDER_RENDER_RUNNER_ID;
+        this.runner = runner;
+    }
+    async run(context) {
+        const startedAt = new Date().toISOString();
+        if (context.signal.aborted) {
+            throw new Error(abortErrorMessage(context.signal));
+        }
+        if (context.job.policy.trust_mode !== "owner-local") {
+            return blenderFailureResult(context.job, "policy_denied", "render.blender is owner-local only until containerized Blender execution is available", startedAt);
+        }
+        let scenePath;
+        let frames;
+        let engine;
+        let outputFormat;
+        let resolution;
+        let sceneName;
+        let cameraName;
+        let outputPattern;
+        const gpuRequested = Boolean(context.job.resources?.gpu);
+        try {
+            const args = context.job.args || {};
+            scenePath = blenderSceneInputPath(context);
+            frames = parseBlenderFrameSelection(args.frames);
+            engine = normalizeBlenderEngine(args.engine);
+            outputFormat = normalizeBlenderOutputFormat(args.output_format);
+            resolution = parseBlenderResolution(args.resolution);
+            sceneName = safeBlenderSceneName(args.scene, "scene");
+            cameraName = safeBlenderSceneName(args.camera, "camera");
+            outputPattern = blenderOutputPattern(context);
+            await mkdir(dirname(outputPattern), { recursive: true });
+        }
+        catch (error) {
+            return blenderFailureResult(context.job, "validation_failed", error instanceof Error ? error.message : String(error || "render.blender validation failed"), startedAt);
+        }
+        const pythonStatements = [];
+        if (resolution) {
+            pythonStatements.push(`bpy.context.scene.render.resolution_x=${resolution.width}`);
+            pythonStatements.push(`bpy.context.scene.render.resolution_y=${resolution.height}`);
+        }
+        if (cameraName) {
+            pythonStatements.push(`camera=bpy.data.objects.get(${JSON.stringify(cameraName)})`);
+            pythonStatements.push("bpy.context.scene.camera=camera if camera is not None else bpy.context.scene.camera");
+        }
+        if (gpuRequested) {
+            const computeDeviceType = blenderGpuComputeDeviceType();
+            pythonStatements.push("cycles_addon=bpy.context.preferences.addons.get('cycles')");
+            pythonStatements.push("cycles_prefs=cycles_addon.preferences if cycles_addon is not None else None");
+            pythonStatements.push(`setattr(cycles_prefs,'compute_device_type',${JSON.stringify(computeDeviceType)}) if cycles_prefs is not None and hasattr(cycles_prefs,'compute_device_type') else None`);
+            pythonStatements.push("getattr(cycles_prefs,'get_devices',lambda: None)() if cycles_prefs is not None else None");
+            pythonStatements.push("setattr(bpy.context.scene.cycles,'device','GPU') if hasattr(bpy.context.scene,'cycles') else None");
+            pythonStatements.push("[setattr(device,'use',True) for device in getattr(cycles_prefs,'devices',[]) if hasattr(device,'use')] if cycles_prefs is not None else None");
+        }
+        const blenderArgs = ["-b", scenePath];
+        if (sceneName) {
+            blenderArgs.push("--scene", sceneName);
+        }
+        if (engine) {
+            blenderArgs.push("--engine", engine.blender);
+        }
+        if (pythonStatements.length > 0) {
+            blenderArgs.push("--python-expr", `import bpy; ${pythonStatements.join("; ")}`);
+        }
+        blenderArgs.push("--render-output", outputPattern, "--render-format", outputFormat.blender);
+        if (frames.mode === "range") {
+            blenderArgs.push("-s", String(frames.start), "-e", String(frames.end), "-a");
+        }
+        else {
+            blenderArgs.push("--render-frame", String(frames.frame));
+        }
+        await context.emitEvent({
+            type: "progress",
+            message: "blender render starting",
+            data: {
+                runner: this.id,
+                frames: frames.label,
+                engine: engine?.label || "scene-default",
+                output_format: outputFormat.label,
+                ...(resolution ? { resolution: resolution.label } : {}),
+                gpu_requested: gpuRequested,
+                render_device: gpuRequested ? "gpu" : "scene-default"
+            }
+        });
+        const timeoutMs = Math.max(1000, Math.min(DEFAULT_JOB_TIMEOUT_MS, Math.floor((context.sandbox.limits.timeout_sec || DEFAULT_JOB_TIMEOUT_MS / 1000) * 1000)));
+        const maxBuffer = Math.min(DEFAULT_COMMAND_MAX_BUFFER, Math.max(1024 * 1024, context.job.limits?.max_stdout_bytes || 0, context.job.limits?.max_stderr_bytes || 0));
+        try {
+            const result = await this.runner("blender", blenderArgs, {
+                timeoutMs,
+                maxBuffer,
+                signal: context.signal
+            });
+            await emitBlenderOutput(context, "stdout", result.stdout);
+            await emitBlenderOutput(context, "stderr", result.stderr);
+            await emitBlenderProgress(context, `${result.stdout}\n${result.stderr}`, frames);
+            return {
+                job_id: context.job.idempotency_key || "render.blender",
+                status: "succeeded",
+                exit_code: 0,
+                started_at: startedAt,
+                finished_at: new Date().toISOString(),
+                metrics: {
+                    runner: this.id,
+                    frames: frames.label,
+                    engine: engine?.label || "scene-default",
+                    output_format: outputFormat.label,
+                    ...(resolution ? { resolution: resolution.label } : {}),
+                    gpu_requested: gpuRequested,
+                    render_device: gpuRequested ? "gpu" : "scene-default"
+                }
+            };
+        }
+        catch (error) {
+            if (context.signal.aborted) {
+                throw error;
+            }
+            return blenderFailureResult(context.job, "runner_failed", redactBlenderLocalPaths(context, error instanceof Error ? error.message : String(error || "Blender render failed")), startedAt);
+        }
+    }
+}
+const SAFE_CUDA_IDENTIFIER = /^[a-zA-Z0-9][a-zA-Z0-9_.-]{0,127}$/;
+const SAFE_CUDA_TOKEN = /^[a-zA-Z0-9_@%+=:,./-]{1,200}$/;
+const UNSAFE_CUDA_MANIFEST_KEYS = new Set([
+    "command",
+    "cmd",
+    "shell",
+    "entrypoint",
+    "docker_args",
+    "mount",
+    "mounts",
+    "volumes",
+    "binds",
+    "device",
+    "devices",
+    "privileged",
+    "network",
+    "host_network"
+]);
+function cudaFailureResult(job, code, message, startedAt) {
+    return {
+        job_id: job.idempotency_key || "cuda.run",
+        status: "failed",
+        exit_code: 1,
+        started_at: startedAt,
+        finished_at: new Date().toISOString(),
+        error: {
+            code,
+            message,
+            retryable: false
+        }
+    };
+}
+function safeCudaIdentifier(value, label) {
+    const text = optionalText(value);
+    if (!text || !SAFE_CUDA_IDENTIFIER.test(text)) {
+        throw new Error(`${label}_invalid`);
+    }
+    return text;
+}
+function safeCudaRelativePath(value, label) {
+    return assertMswarmSafeRelativePath(optionalText(value), label);
+}
+function safeCudaToken(value, label) {
+    const text = optionalText(value);
+    if (!text || !SAFE_CUDA_TOKEN.test(text) || /[`$;&|<>\r\n]/.test(text)) {
+        throw new Error(`${label}_invalid`);
+    }
+    return text;
+}
+function safeCudaTokenList(value, label) {
+    if (value === undefined)
+        return [];
+    if (!Array.isArray(value)) {
+        throw new Error(`${label}_must_be_array`);
+    }
+    return value.map((entry, index) => safeCudaToken(entry, `${label}_${index}`));
+}
+function assertNoUnsafeCudaManifestKeys(record, label) {
+    for (const key of Object.keys(record)) {
+        if (UNSAFE_CUDA_MANIFEST_KEYS.has(key)) {
+            throw new Error(`${label}_${key}_not_allowed`);
+        }
+    }
+}
+function parseCudaRunArgs(job) {
+    const args = job.args || {};
+    return {
+        manifestPath: safeCudaRelativePath(args.manifest_path, "cuda_manifest_path"),
+        profile: safeCudaIdentifier(args.profile, "cuda_profile"),
+        target: safeCudaIdentifier(args.target, "cuda_target")
+    };
+}
+function cudaPackageArchive(context) {
+    const registeredInput = context.artifacts.registeredInputs.find((input) => input.name === "package" && input.local_path) ||
+        context.artifacts.registeredInputs.find((input) => input.local_path && input.name !== "manifest");
+    if (!registeredInput?.local_path) {
+        throw new Error("cuda_package_artifact_required");
+    }
+    const inputPath = assertMswarmSafeRelativePath(relative(context.artifacts.inputDir, registeredInput.local_path), "cuda_package_input_path");
+    if (!/(\.tar\.gz|\.tgz)$/i.test(inputPath)) {
+        throw new Error("cuda_package_archive_must_be_targz");
+    }
+    return { hostPath: registeredInput.local_path, inputPath };
+}
+function cudaArchiveValidationError(reason) {
+    return new Error(`cuda_package_archive_${reason || "invalid"}`);
+}
+function cudaTarVerboseEntryType(line) {
+    const marker = line.trimStart()[0];
+    if (marker === "d")
+        return "directory";
+    if (marker === "-")
+        return "file";
+    if (marker === "l")
+        return "symlink";
+    if (marker === "h")
+        return "hardlink";
+    if (marker === "b" || marker === "c")
+        return "device";
+    return marker ? "other" : "file";
+}
+async function validateCudaPackageArchive(context, runner, archive) {
+    const listOptions = {
+        timeoutMs: 5000,
+        maxBuffer: 512 * 1024,
+        signal: context.signal
+    };
+    const names = await runner("tar", ["-tzf", archive.hostPath], listOptions);
+    let entryCount = 0;
+    for (const rawLine of names.stdout.split(/\r?\n/)) {
+        const entryPath = rawLine.trim();
+        if (!entryPath)
+            continue;
+        entryCount += 1;
+        const result = validateMswarmArchiveEntry({
+            path: entryPath,
+            type: entryPath.endsWith("/") ? "directory" : "file"
+        });
+        if (!result.ok) {
+            throw cudaArchiveValidationError(result.reason);
+        }
+    }
+    if (entryCount === 0) {
+        throw cudaArchiveValidationError("empty");
+    }
+    const verbose = await runner("tar", ["-tvzf", archive.hostPath], listOptions);
+    for (const rawLine of verbose.stdout.split(/\r?\n/)) {
+        if (!rawLine.trim())
+            continue;
+        const type = cudaTarVerboseEntryType(rawLine);
+        if (type === "file" || type === "directory")
+            continue;
+        const result = validateMswarmArchiveEntry({ path: "entry", type });
+        throw cudaArchiveValidationError(result.reason);
+    }
+}
+async function readCudaManifestText(context, runner, args) {
+    const directManifestPath = resolveWithinRoot(context.artifacts.inputDir, args.manifestPath);
+    try {
+        const directStat = await lstat(directManifestPath);
+        if (directStat.isFile()) {
+            return await readFile(directManifestPath, "utf8");
+        }
+    }
+    catch (error) {
+        if (error.code !== "ENOENT") {
+            throw error;
+        }
+    }
+    const archive = cudaPackageArchive(context);
+    const extracted = await runner("tar", ["-xOf", archive.hostPath, args.manifestPath], {
+        timeoutMs: 5000,
+        maxBuffer: 256 * 1024,
+        signal: context.signal
+    });
+    return extracted.stdout;
+}
+function parseCudaPackageManifest(text, args, policy) {
+    const parsed = JSON.parse(text);
+    const manifest = objectRecord(parsed);
+    if (!manifest) {
+        throw new Error("cuda_manifest_must_be_object");
+    }
+    assertNoUnsafeCudaManifestKeys(manifest, "cuda_manifest");
+    const schemaVersion = optionalText(manifest.schema_version);
+    if (schemaVersion !== "2026-06-14") {
+        throw new Error("cuda_manifest_schema_version_invalid");
+    }
+    const packageInfo = objectRecord(manifest.package);
+    const publisher = optionalText(packageInfo?.publisher);
+    if (policy.allowed_package_publishers?.length) {
+        if (!publisher || !policy.allowed_package_publishers.includes(publisher)) {
+            throw new Error("cuda_manifest_publisher_not_allowed");
+        }
+    }
+    const profiles = objectRecord(manifest.profiles);
+    const targets = objectRecord(manifest.targets);
+    const profile = objectRecord(profiles?.[args.profile]);
+    const target = objectRecord(targets?.[args.target]);
+    if (!profile) {
+        throw new Error("cuda_manifest_profile_not_found");
+    }
+    if (!target) {
+        throw new Error("cuda_manifest_target_not_found");
+    }
+    assertNoUnsafeCudaManifestKeys(profile, "cuda_manifest_profile");
+    assertNoUnsafeCudaManifestKeys(target, "cuda_manifest_target");
+    const image = optionalText(profile.image);
+    if (!image || !APPROVED_NVIDIA_CUDA_IMAGES.has(image)) {
+        throw new Error("cuda_image_not_approved");
+    }
+    if (!policy.allowed_images?.includes(image)) {
+        throw new Error("cuda_image_not_allowed_by_policy");
+    }
+    const compiler = optionalText(profile.compiler) || "nvcc";
+    if (compiler !== "nvcc") {
+        throw new Error("cuda_compiler_not_allowed");
+    }
+    const source = safeCudaRelativePath(target.source, "cuda_target_source");
+    if (!source.endsWith(".cu")) {
+        throw new Error("cuda_target_source_must_be_cu");
+    }
+    const output = safeCudaRelativePath(optionalText(target.output) || `bin/${args.target}`, "cuda_target_output");
+    return {
+        schemaVersion,
+        packageName: optionalText(packageInfo?.name) ?? undefined,
+        publisher: publisher ?? undefined,
+        image,
+        compiler,
+        source,
+        output,
+        flags: [...safeCudaTokenList(profile.flags, "cuda_profile_flags"), ...safeCudaTokenList(target.flags, "cuda_target_flags")],
+        runArgs: safeCudaTokenList(target.args, "cuda_target_args")
+    };
+}
+function redactCudaLocalPaths(context, value) {
+    const replacements = [
+        ...context.artifacts.registeredInputs.map((input) => [input.local_path, "[job-input]"]),
+        [context.artifacts.inputDir, "[job-inputs]"],
+        [context.artifacts.outputDir, "[job-outputs]"],
+        [context.artifacts.workDir, "[job-workdir]"]
+    ];
+    replacements.sort((left, right) => (right[0]?.length || 0) - (left[0]?.length || 0));
+    let output = value;
+    for (const [source, replacement] of replacements) {
+        if (source) {
+            output = output.split(source).join(replacement);
+        }
+    }
+    return output;
+}
+async function emitCudaOutput(context, type, value) {
+    const lines = value.split(/\r?\n/).map((line) => line.trim()).filter(Boolean).slice(0, 200);
+    for (const line of lines) {
+        await context.emitEvent({
+            type,
+            message: redactCudaLocalPaths(context, line),
+            data: { runner: CUDA_PACKAGE_RUNNER_ID }
+        });
+    }
+}
+function buildCudaRunnerScript(input) {
+    const srcDir = "/workspace/work/src";
+    const buildOutput = `/workspace/work/${input.selection.output}`;
+    const compile = [
+        "/usr/local/cuda/bin/nvcc",
+        ...input.selection.flags,
+        "-o",
+        buildOutput,
+        `${srcDir}/${input.selection.source}`
+    ].map(quotePosixShellValue).join(" ");
+    const run = [
+        buildOutput,
+        ...input.selection.runArgs
+    ].map(quotePosixShellValue).join(" ");
+    return [
+        "set -euo pipefail",
+        "mkdir -p /workspace/work/src /workspace/outputs",
+        `tar -xzf ${quotePosixShellValue(`/workspace/inputs/${input.archiveInputPath}`)} -C /workspace/work/src`,
+        `mkdir -p ${quotePosixShellValue(dirname(buildOutput))}`,
+        "cd /workspace/work/src",
+        compile,
+        run
+    ].join("\n");
+}
+function dockerBindMount(hostPath, containerPath, mode) {
+    return `${hostPath}:${containerPath}:${mode}`;
+}
+function buildCudaDockerArgs(input) {
+    const gpuCount = Math.max(1, input.context.job.resources?.gpu?.count || 1);
+    const args = [
+        "run",
+        "--rm",
+        "--pull",
+        "never",
+        "--network",
+        "none",
+        "--runtime",
+        "nvidia",
+        "--gpus",
+        `count=${gpuCount}`,
+        "--user",
+        input.context.sandbox.container.user,
+        "--read-only",
+        "--cap-drop",
+        "ALL",
+        "--security-opt",
+        "no-new-privileges",
+        "--workdir",
+        "/workspace",
+        "--env",
+        "CUDA_CACHE_PATH=/workspace/work/.cuda-cache",
+        "--tmpfs",
+        "/tmp:rw,nosuid,nodev,size=64m"
+    ];
+    if (Number.isFinite(input.context.job.resources?.memory_gb) && input.context.job.resources?.memory_gb) {
+        args.push("--memory", `${Math.floor(input.context.job.resources.memory_gb)}g`);
+    }
+    if (Number.isFinite(input.context.job.resources?.disk_gb) && input.context.job.resources?.disk_gb) {
+        args.push("--storage-opt", `size=${Math.floor(input.context.job.resources.disk_gb)}G`);
+    }
+    args.push("-v", dockerBindMount(input.context.artifacts.inputDir, "/workspace/inputs", "ro"), "-v", dockerBindMount(input.context.artifacts.outputDir, "/workspace/outputs", "rw"), "-v", dockerBindMount(input.workPath, "/workspace/work", "rw"), "-v", dockerBindMount(input.scriptPath, "/workspace/__mcoda_cuda_run.sh", "ro"), input.selection.image, "/bin/bash", "/workspace/__mcoda_cuda_run.sh");
+    return args;
+}
+export class MswarmCudaPackageRunner {
+    constructor(runner = defaultCommandRunner) {
+        this.id = CUDA_PACKAGE_RUNNER_ID;
+        this.runner = runner;
+    }
+    async run(context) {
+        const startedAt = new Date().toISOString();
+        if (context.signal.aborted) {
+            throw new Error(abortErrorMessage(context.signal));
+        }
+        if (context.job.policy.network !== "none") {
+            return cudaFailureResult(context.job, "policy_denied", "cuda.run requires network policy none", startedAt);
+        }
+        if (context.job.policy.allow_raw_command !== false) {
+            return cudaFailureResult(context.job, "policy_denied", "cuda.run does not allow raw commands", startedAt);
+        }
+        if (!context.job.resources?.gpu) {
+            return cudaFailureResult(context.job, "validation_failed", "cuda.run requires GPU resources", startedAt);
+        }
+        if (!context.job.outputs?.length) {
+            return cudaFailureResult(context.job, "validation_failed", "cuda.run requires declared outputs", startedAt);
+        }
+        let args;
+        let archive;
+        let selection;
+        let scriptPath;
+        let workPath;
+        try {
+            args = parseCudaRunArgs(context.job);
+            archive = cudaPackageArchive(context);
+            await validateCudaPackageArchive(context, this.runner, archive);
+            const manifestText = await readCudaManifestText(context, this.runner, args);
+            selection = parseCudaPackageManifest(manifestText, args, context.job.policy);
+            scriptPath = resolveWithinRoot(context.artifacts.workDir, "__mcoda_cuda_run.sh");
+            workPath = resolveWithinRoot(context.artifacts.workDir, "cuda-work");
+            await mkdir(workPath, { recursive: true });
+            await chmod(workPath, 0o777);
+            await chmod(context.artifacts.outputDir, 0o777);
+            await writeFile(scriptPath, buildCudaRunnerScript({ archiveInputPath: archive.inputPath, selection }), { mode: 0o644 });
+        }
+        catch (error) {
+            return cudaFailureResult(context.job, "validation_failed", redactCudaLocalPaths(context, error instanceof Error ? error.message : String(error || "cuda.run validation failed")), startedAt);
+        }
+        const dockerArgs = buildCudaDockerArgs({
+            context,
+            selection,
+            archiveInputPath: archive.inputPath,
+            scriptPath,
+            workPath
+        });
+        await context.emitEvent({
+            type: "progress",
+            message: "cuda package container starting",
+            data: {
+                runner: this.id,
+                image: selection.image,
+                profile: args.profile,
+                target: args.target,
+                gpu_count: Math.max(1, context.job.resources.gpu.count || 1),
+                network: "none",
+                container_user: context.sandbox.container.user
+            }
+        });
+        const timeoutMs = Math.max(1000, Math.min(DEFAULT_JOB_TIMEOUT_MS, Math.floor((context.sandbox.limits.timeout_sec || DEFAULT_JOB_TIMEOUT_MS / 1000) * 1000)));
+        const maxBuffer = Math.min(DEFAULT_COMMAND_MAX_BUFFER, Math.max(1024 * 1024, context.job.limits?.max_stdout_bytes || 0, context.job.limits?.max_stderr_bytes || 0));
+        try {
+            const result = await this.runner("docker", dockerArgs, {
+                timeoutMs,
+                maxBuffer,
+                signal: context.signal
+            });
+            await emitCudaOutput(context, "stdout", result.stdout);
+            await emitCudaOutput(context, "stderr", result.stderr);
+            await context.emitEvent({
+                type: "progress",
+                message: "cuda package container completed",
+                data: {
+                    runner: this.id,
+                    profile: args.profile,
+                    target: args.target
+                }
+            });
+            return {
+                job_id: context.job.idempotency_key || "cuda.run",
+                status: "succeeded",
+                exit_code: 0,
+                started_at: startedAt,
+                finished_at: new Date().toISOString(),
+                metrics: {
+                    runner: this.id,
+                    image: selection.image,
+                    profile: args.profile,
+                    target: args.target,
+                    package: selection.packageName,
+                    publisher: selection.publisher,
+                    gpu_count: Math.max(1, context.job.resources.gpu.count || 1),
+                    network: "none",
+                    container_user: context.sandbox.container.user
+                }
+            };
+        }
+        catch (error) {
+            if (context.signal.aborted) {
+                throw error;
+            }
+            return cudaFailureResult(context.job, "runner_failed", redactCudaLocalPaths(context, error instanceof Error ? error.message : String(error || "cuda.run failed")), startedAt);
+        }
+    }
+}
+function createDefaultGenericJobRunners(runner = defaultCommandRunner) {
+    return [new MswarmTestEchoRunner(), new MswarmBlenderRenderRunner(runner), new MswarmCudaPackageRunner(runner)];
+}
+function uniqueSortedStrings(values) {
+    return Array.from(new Set(values.filter((value) => typeof value === "string" && value.length > 0))).sort();
+}
+function capabilityProbeTimeoutMs(config) {
+    return parsePositiveInteger(config.capabilityProbeTimeoutMs, DEFAULT_CAPABILITY_PROBE_TIMEOUT_MS);
+}
+function capabilityCommandFailureMessage(error) {
+    if (error instanceof Error && error.message)
+        return error.message;
+    return String(error || "capability probe failed");
+}
+function isMissingCapabilityCommand(error, stderr = "") {
+    const message = `${capabilityCommandFailureMessage(error)}\n${stderr}`.toLowerCase();
+    return /enoent|not found|command not found|no such file|executable file not found/.test(message);
+}
+async function runCapabilityCommand(runner, command, args, timeoutMs) {
+    try {
+        const result = await runner(command, args, {
+            timeoutMs,
+            maxBuffer: Math.min(DEFAULT_COMMAND_MAX_BUFFER, 512 * 1024)
+        });
+        return { ok: true, stdout: result.stdout, stderr: result.stderr };
+    }
+    catch (error) {
+        return {
+            ok: false,
+            missing: isMissingCapabilityCommand(error),
+            message: capabilityCommandFailureMessage(error)
+        };
+    }
+}
+function parseNvidiaSmiMemoryGb(value) {
+    if (!value)
+        return undefined;
+    const parsed = Number(value.replace(/[^\d.]/g, ""));
+    if (!Number.isFinite(parsed) || parsed <= 0)
+        return undefined;
+    return Math.round((parsed / 1024) * 10) / 10;
+}
+function parseNvidiaGpuProbe(stdout) {
+    const devices = [];
+    const cudaVersions = new Set();
+    for (const line of stdout.split(/\r?\n/)) {
+        const trimmed = line.trim();
+        if (!trimmed)
+            continue;
+        const [index, name, memoryMb, driverVersion, computeCapability, cudaVersion] = trimmed
+            .split(",")
+            .map((part) => part.trim());
+        const id = index ? `gpu-${index}` : `gpu-${devices.length}`;
+        if (cudaVersion) {
+            cudaVersions.add(cudaVersion);
+        }
+        devices.push({
+            id,
+            vendor: "nvidia",
+            ...(name ? { name } : {}),
+            ...(parseNvidiaSmiMemoryGb(memoryMb) ? { vram_gb: parseNvidiaSmiMemoryGb(memoryMb) } : {}),
+            ...(driverVersion ? { driver_version: driverVersion } : {}),
+            ...(cudaVersion ? { cuda_version: cudaVersion } : {}),
+            ...(computeCapability ? { compute_capability: computeCapability } : {}),
+            capabilities: ["cuda"]
+        });
+    }
+    const maxVramGb = devices.reduce((max, device) => {
+        if (!Number.isFinite(device.vram_gb))
+            return max;
+        return max === undefined ? device.vram_gb : Math.max(max, device.vram_gb || 0);
+    }, undefined);
+    return {
+        status: devices.length > 0 ? "available" : "missing",
+        count: devices.length,
+        vendors: devices.length > 0 ? ["nvidia"] : [],
+        devices,
+        ...(cudaVersions.size > 0 ? { cuda_versions: Array.from(cudaVersions).sort() } : {}),
+        ...(maxVramGb !== undefined ? { max_vram_gb: maxVramGb } : {}),
+        ...(devices.length === 0 ? { message: "nvidia-smi returned no GPU rows" } : {})
+    };
+}
+function parseNvidiaSmiCudaVersion(stdout) {
+    return stdout.match(/CUDA\s+Version:\s*([0-9]+(?:\.[0-9]+)?)/i)?.[1];
+}
+async function probeNvidiaGpuCapabilities(runner, timeoutMs) {
+    const result = await runCapabilityCommand(runner, "nvidia-smi", ["--query-gpu=index,name,memory.total,driver_version,compute_cap", "--format=csv,noheader,nounits"], timeoutMs);
+    if (!result.ok) {
+        return {
+            status: result.missing ? "missing" : "error",
+            count: 0,
+            vendors: [],
+            devices: [],
+            message: result.message
+        };
+    }
+    const probe = parseNvidiaGpuProbe(result.stdout);
+    const versionResult = await runCapabilityCommand(runner, "nvidia-smi", [], timeoutMs);
+    if (!versionResult.ok) {
+        return probe;
+    }
+    const cudaVersion = parseNvidiaSmiCudaVersion(versionResult.stdout || versionResult.stderr);
+    if (!cudaVersion) {
+        return probe;
+    }
+    const cudaVersions = Array.from(new Set([...(probe.cuda_versions || []), cudaVersion])).sort();
+    return {
+        ...probe,
+        cuda_versions: cudaVersions,
+        devices: probe.devices.map((device) => ({
+            ...device,
+            cuda_version: device.cuda_version || cudaVersion
+        }))
+    };
+}
+function missingSoftwareProbe(name, message) {
+    return {
+        name,
+        status: "missing",
+        ...(message ? { message } : {})
+    };
+}
+function errorSoftwareProbe(name, message) {
+    return {
+        name,
+        status: "error",
+        message
+    };
+}
+function extractToolVersion(stdout, tool) {
+    const firstLine = stdout.split(/\r?\n/).find((line) => line.trim().length > 0)?.trim() || "";
+    if (tool === "blender") {
+        return firstLine.match(/Blender\s+([^\s]+)/i)?.[1];
+    }
+    if (tool === "ffmpeg") {
+        return firstLine.match(/ffmpeg\s+version\s+([^\s]+)/i)?.[1];
+    }
+    return firstLine || undefined;
+}
+async function probeVersionedSoftware(runner, name, command, args, timeoutMs) {
+    const result = await runCapabilityCommand(runner, command, args, timeoutMs);
+    if (!result.ok) {
+        return result.missing
+            ? missingSoftwareProbe(name, result.message)
+            : errorSoftwareProbe(name, result.message);
+    }
+    return {
+        name,
+        status: "available",
+        ...(extractToolVersion(result.stdout || result.stderr, name) ? { version: extractToolVersion(result.stdout || result.stderr, name) } : {})
+    };
+}
+async function probeDockerCapabilities(runner, timeoutMs) {
+    const result = await runCapabilityCommand(runner, "docker", ["info", "--format", "{{json .Runtimes}}"], timeoutMs);
+    if (!result.ok) {
+        const docker = result.missing
+            ? missingSoftwareProbe("docker", result.message)
+            : errorSoftwareProbe("docker", result.message);
+        return {
+            docker,
+            dockerNvidia: { name: "docker-nvidia", status: docker.status, message: result.message }
+        };
+    }
+    try {
+        const runtimes = JSON.parse(result.stdout || "{}");
+        const runtimeNames = Object.keys(runtimes);
+        const hasNvidiaRuntime = runtimeNames.some((name) => name.toLowerCase() === "nvidia");
+        return {
+            docker: { name: "docker", status: "available" },
+            dockerNvidia: hasNvidiaRuntime
+                ? { name: "docker-nvidia", status: "available", version: "nvidia" }
+                : missingSoftwareProbe("docker-nvidia", "Docker is available but the nvidia runtime is not registered")
+        };
+    }
+    catch (error) {
+        const message = capabilityCommandFailureMessage(error);
+        return {
+            docker: errorSoftwareProbe("docker", `Unable to parse docker runtime inventory: ${message}`),
+            dockerNvidia: errorSoftwareProbe("docker-nvidia", `Unable to parse docker runtime inventory: ${message}`)
+        };
+    }
+}
+function capabilityDiagnostics(snapshot) {
+    const diagnostics = [];
+    if (snapshot.gpu.status !== "available") {
+        diagnostics.push({
+            name: "gpu",
+            status: snapshot.gpu.status,
+            message: snapshot.gpu.message
+        });
+    }
+    for (const result of Object.values(snapshot.software)) {
+        if (result.status !== "available") {
+            diagnostics.push({
+                name: result.name,
+                status: result.status,
+                message: result.message
+            });
+        }
+    }
+    return diagnostics.length ? diagnostics : undefined;
+}
+function buildCapabilitySnapshotId(snapshot) {
+    const digest = createHash("sha256").update(JSON.stringify(snapshot)).digest("hex").slice(0, 16);
+    return `caps_${digest}`;
+}
+function buildRunnerCapabilityCatalog(config, runners) {
+    if (!config.genericJobsEnabled) {
+        return [];
+    }
+    return OWNER_LOCAL_GENERIC_JOB_CATALOG
+        .filter((entry) => runners.has(entry.runner))
+        .map((entry) => ({
+        job_type: entry.job_type,
+        runner: entry.runner,
+        trust_modes: uniqueSortedStrings([entry.policy.trust_mode]),
+        required_capabilities: entry.required_capabilities || []
+    }));
+}
+function runnerCapabilityRequirementsAvailable(entry, input) {
+    if (!input.genericJobsEnabled)
+        return false;
+    if (!entry.required_capabilities?.length)
+        return true;
+    const snapshot = {
+        schema_version: MSWARM_CAPABILITY_SCHEMA_VERSION,
+        snapshot_id: "caps_requirement_check",
+        captured_at: new Date(0).toISOString(),
+        generic_jobs_enabled: input.genericJobsEnabled,
+        job_types: [],
+        trust_modes: [],
+        gpu: input.gpu,
+        software: input.software,
+        runner_catalog: []
+    };
+    const capabilities = new Set(buildMswarmCapabilityNames(snapshot));
+    return entry.required_capabilities.every((capability) => capabilities.has(capability));
+}
+function registeredOwnerLocalGenericJobCatalog() {
+    return OWNER_LOCAL_GENERIC_JOB_CATALOG.filter((entry) => entry.job_type.startsWith("tenant.") || entry.job_type.startsWith("package."));
+}
+function base64UrlEncodeRuntime(buffer) {
+    return buffer.toString("base64").replace(/=/g, "").replace(/\+/g, "-").replace(/\//g, "_");
+}
+function signCapabilityPayload(input) {
+    const unsignedPayload = {
+        schema_version: MSWARM_CAPABILITY_SCHEMA_VERSION,
+        snapshot_id: input.privateCatalogEntry.snapshot_id,
+        private_catalog_entry: input.privateCatalogEntry,
+        scheduler_match: input.privateCatalogEntry.scheduler_match,
+        public_projection: input.privateCatalogEntry.public_projection
+    };
+    const signature = base64UrlEncodeRuntime(createHmac("sha256", input.runtimeToken).update(JSON.stringify(unsignedPayload)).digest());
+    return {
+        ...unsignedPayload,
+        signature: {
+            alg: "HS256",
+            value: signature,
+            signed_at: new Date().toISOString(),
+            key_id: "self_hosted_runtime_token"
+        }
+    };
+}
+function runnerForGenericJob(job, runners) {
+    const catalogEntry = OWNER_LOCAL_GENERIC_JOB_CATALOG.find((entry) => entry.job_type === job.job_type);
+    return catalogEntry ? runners.get(catalogEntry.runner) || null : null;
+}
+function compareDottedVersion(left, right) {
+    if (!left || !right)
+        return 0;
+    const leftParts = left.split(".").map((part) => Number(part.replace(/[^\d]/g, "")) || 0);
+    const rightParts = right.split(".").map((part) => Number(part.replace(/[^\d]/g, "")) || 0);
+    const length = Math.max(leftParts.length, rightParts.length);
+    for (let index = 0; index < length; index += 1) {
+        const delta = (leftParts[index] || 0) - (rightParts[index] || 0);
+        if (delta !== 0)
+            return delta;
+    }
+    return 0;
+}
+function snapshotHasCudaVersion(snapshot, minVersion) {
+    if (!minVersion)
+        return true;
+    const versions = [
+        ...(snapshot.gpu.cuda_versions || []),
+        ...snapshot.gpu.devices.map((device) => device.cuda_version).filter((value) => Boolean(value))
+    ];
+    return versions.some((version) => compareDottedVersion(version, minVersion) >= 0);
+}
+export function genericJobCapabilityMismatch(job, snapshot) {
+    if (!snapshot.generic_jobs_enabled) {
+        return { code: "no_capable_node", message: "Generic jobs are disabled on this node." };
+    }
+    if (job.job_type === RENDER_BLENDER_JOB_TYPE && snapshot.software.blender.status !== "available") {
+        return {
+            code: "no_capable_node",
+            message: "Blender is not available on this node."
+        };
+    }
+    if (job.job_type === CUDA_RUN_JOB_TYPE) {
+        if (snapshot.gpu.status !== "available" || !snapshot.gpu.vendors.includes("nvidia")) {
+            return {
+                code: "no_capable_node",
+                message: "No NVIDIA GPU is available on this node."
+            };
+        }
+        if (snapshot.software.docker.status !== "available" || snapshot.software["docker-nvidia"].status !== "available") {
+            return {
+                code: "no_capable_node",
+                message: "Docker with the NVIDIA runtime is not available on this node."
+            };
+        }
+    }
+    if (!snapshot.job_types.includes(job.job_type)) {
+        return {
+            code: "no_capable_node",
+            message: `No capable owner-local node is available for ${job.job_type}.`
+        };
+    }
+    if (job.resources?.gpu) {
+        const requestedCount = Math.max(1, job.resources.gpu.count || 1);
+        if (snapshot.gpu.status !== "available" || snapshot.gpu.count < requestedCount) {
+            return {
+                code: "no_capable_node",
+                message: `Requested ${requestedCount} GPU(s), but this node reports ${snapshot.gpu.count}.`
+            };
+        }
+        if (job.resources.gpu.vendor && !snapshot.gpu.vendors.includes(job.resources.gpu.vendor)) {
+            return {
+                code: "no_capable_node",
+                message: `Requested GPU vendor ${job.resources.gpu.vendor} is not available on this node.`
+            };
+        }
+        if (Number.isFinite(job.resources.gpu.min_vram_gb) &&
+            job.resources.gpu.min_vram_gb !== undefined &&
+            (!Number.isFinite(snapshot.gpu.max_vram_gb) || (snapshot.gpu.max_vram_gb || 0) < job.resources.gpu.min_vram_gb)) {
+            return {
+                code: "no_capable_node",
+                message: `Requested GPU VRAM ${job.resources.gpu.min_vram_gb}GB exceeds this node capability.`
+            };
+        }
+        if (!snapshotHasCudaVersion(snapshot, job.resources.gpu.cuda_min_version)) {
+            return {
+                code: "no_capable_node",
+                message: `Requested CUDA ${job.resources.gpu.cuda_min_version} is not available on this node.`
+            };
+        }
+    }
+    return null;
+}
+function genericJobTimeoutMs(job, fallbackMs) {
+    const limitSeconds = positiveInteger(job.limits?.timeout_sec);
+    if (!limitSeconds) {
+        return fallbackMs;
+    }
+    return Math.max(1, Math.min(fallbackMs, limitSeconds * 1000));
+}
+function isGenericAbortError(error, signal) {
+    if (signal.aborted)
+        return true;
+    if (!(error instanceof Error))
+        return false;
+    return /cancelled|canceled|aborted|timed out|timeout/i.test(error.message);
+}
+function usageTokens(usage) {
+    return {
+        promptTokens: positiveInteger(usage?.inputTokens),
+        completionTokens: positiveInteger(usage?.outputTokens),
+    };
+}
+export class McodaLocalAgentExecutor {
+    constructor(input) {
+        this.command = input.command || DEFAULT_MCODA_BIN;
+        this.timeoutMs = input.timeoutMs || DEFAULT_JOB_TIMEOUT_MS;
+        this.runner = input.runner || defaultCommandRunner;
+    }
+    async invoke(agentSlug, prompt) {
+        const stdout = (await this.runner(this.command, ["agent-run", agentSlug, "--json", "--stdin"], {
+            timeoutMs: this.timeoutMs,
+            maxBuffer: DEFAULT_COMMAND_MAX_BUFFER,
+            input: prompt
+        })).stdout;
+        const parsed = JSON.parse(stdout);
+        if (!parsed || typeof parsed !== "object" || !Array.isArray(parsed.responses)) {
+            throw new Error("mcoda agent-run returned unsupported JSON");
+        }
+        const response = parsed.responses[0] || {};
+        const output = optionalText(response.output);
+        if (!output) {
+            throw new Error("mcoda agent-run response did not include output");
+        }
+        return {
+            output,
+            adapter: optionalText(response.adapter) || undefined,
+            model: optionalText(response.model) || undefined,
+            metadata: response.metadata && typeof response.metadata === "object" ? response.metadata : undefined
+        };
+    }
+}
+export class MswarmSelfHostedNodeClient {
+    constructor(input) {
+        this.gatewayBaseUrl = trimTrailingSlash(input.gatewayBaseUrl);
+        this.fetchImpl = input.fetchImpl || fetch;
+        this.timeoutMs = input.timeoutMs || DEFAULT_REQUEST_TIMEOUT_MS;
+    }
+    async enroll(nodeId, enrollmentToken) {
+        return fetchJson(this.fetchImpl, `${this.gatewayBaseUrl}/v1/swarm/self-hosted/node/enroll`, {
+            method: "POST",
+            headers: { "content-type": "application/json" },
+            body: JSON.stringify({ node_id: nodeId, enrollment_token: enrollmentToken })
+        }, this.timeoutMs);
+    }
+    async bootstrap(apiKey, payload) {
+        return fetchJson(this.fetchImpl, `${this.gatewayBaseUrl}/v1/swarm/self-hosted/node/bootstrap`, {
+            method: "POST",
+            headers: {
+                "content-type": "application/json",
+                "x-api-key": apiKey
+            },
+            body: JSON.stringify(payload)
+        }, this.timeoutMs);
+    }
+    async health() {
+        return fetchJson(this.fetchImpl, `${this.gatewayBaseUrl}/healthz`, { method: "GET" }, this.timeoutMs);
+    }
+    async heartbeat(runtimeToken, payload) {
+        return fetchJson(this.fetchImpl, `${this.gatewayBaseUrl}/v1/swarm/self-hosted/node/heartbeat`, {
+            method: "POST",
+            headers: {
+                "content-type": "application/json",
+                authorization: `Bearer ${runtimeToken}`
+            },
+            body: JSON.stringify(payload)
+        }, this.timeoutMs);
+    }
+    async uninstall(runtimeToken, payload) {
+        return fetchJson(this.fetchImpl, `${this.gatewayBaseUrl}/v1/swarm/self-hosted/node/uninstall`, {
+            method: "POST",
+            headers: {
+                "content-type": "application/json",
+                authorization: `Bearer ${runtimeToken}`
+            },
+            body: JSON.stringify(payload)
+        }, this.timeoutMs);
+    }
+    async pushModels(runtimeToken, payload) {
+        return fetchJson(this.fetchImpl, `${this.gatewayBaseUrl}/v1/swarm/self-hosted/node/models`, {
+            method: "POST",
+            headers: {
+                "content-type": "application/json",
+                authorization: `Bearer ${runtimeToken}`
+            },
+            body: JSON.stringify(payload)
+        }, this.timeoutMs);
+    }
+    async pollJob(runtimeToken, payload) {
+        return fetchJson(this.fetchImpl, `${this.gatewayBaseUrl}/v1/swarm/self-hosted/node/jobs/poll`, {
+            method: "POST",
+            headers: {
+                "content-type": "application/json",
+                authorization: `Bearer ${runtimeToken}`
+            },
+            body: JSON.stringify(payload)
+        }, Math.max(this.timeoutMs, (payload.wait_ms || 0) + 5000));
+    }
+    async postJobResult(runtimeToken, jobId, payload) {
+        return fetchJson(this.fetchImpl, `${this.gatewayBaseUrl}/v1/swarm/self-hosted/node/jobs/${encodeURIComponent(jobId)}/result`, {
+            method: "POST",
+            headers: {
+                "content-type": "application/json",
+                authorization: `Bearer ${runtimeToken}`
+            },
+            body: JSON.stringify(payload)
+        }, this.timeoutMs);
+    }
+    async postJobStart(runtimeToken, jobId, payload) {
+        return fetchJson(this.fetchImpl, `${this.gatewayBaseUrl}/v1/swarm/self-hosted/node/jobs/${encodeURIComponent(jobId)}/start`, {
+            method: "POST",
+            headers: {
+                "content-type": "application/json",
+                authorization: `Bearer ${runtimeToken}`
+            },
+            body: JSON.stringify(payload)
+        }, this.timeoutMs);
+    }
+    async postJobEvents(runtimeToken, jobId, payload) {
+        return fetchJson(this.fetchImpl, `${this.gatewayBaseUrl}/v1/swarm/self-hosted/node/jobs/${encodeURIComponent(jobId)}/events`, {
+            method: "POST",
+            headers: {
+                "content-type": "application/json",
+                authorization: `Bearer ${runtimeToken}`
+            },
+            body: JSON.stringify(payload)
+        }, this.timeoutMs);
+    }
+}
+export class SelfHostedNodeRuntime {
+    constructor(config, deps) {
+        this.activeLlmJobs = 0;
+        this.activeGenericJobs = 0;
+        this.queuedLlmJobs = 0;
+        this.queuedGenericJobs = 0;
+        this.latencySamplesMs = [];
+        this.recentFailures = [];
+        this.config = config;
+        this.gateway =
+            deps?.gateway ||
+                new MswarmSelfHostedNodeClient({
+                    gatewayBaseUrl: config.gatewayBaseUrl,
+                    fetchImpl: deps?.fetchImpl,
+                    timeoutMs: config.requestTimeoutMs
+                });
+        this.mcoda =
+            deps?.mcoda ||
+                new McodaAgentInventoryClient({
+                    command: config.mcodaBin,
+                    args: config.mcodaListArgs,
+                    timeoutMs: config.requestTimeoutMs
+                });
+        this.mcodaExecutor =
+            deps?.mcodaExecutor ||
+                new McodaLocalAgentExecutor({
+                    command: config.mcodaBin,
+                    timeoutMs: config.jobTimeoutMs
+                });
+        this.codaliExecutor = deps?.codaliExecutor || new MswarmCodaliExecutor();
+        this.ollama =
+            deps?.ollama ||
+                new OllamaClient({
+                    baseUrl: config.ollamaBaseUrl,
+                    fetchImpl: deps?.fetchImpl,
+                    timeoutMs: config.requestTimeoutMs
+                });
         this.jobOllama =
             deps?.ollama ||
                 new OllamaClient({
@@ -1690,6 +3345,107 @@ export class SelfHostedNodeRuntime {
                     fetchImpl: deps?.fetchImpl,
                     timeoutMs: config.jobTimeoutMs
                 });
+        this.capabilityRunner = deps?.capabilityRunner || defaultCommandRunner;
+        this.genericRunners = new Map((deps?.genericRunners || createDefaultGenericJobRunners(this.capabilityRunner)).map((runner) => [runner.id, runner]));
+        this.artifactStore =
+            deps?.artifactStore ||
+                new MswarmLocalArtifactStore({
+                    rootDir: config.artifactStorePath || defaultArtifactStorePath()
+                });
+    }
+    updateLocalQueueTelemetry(input) {
+        if (input.llmQueuedJobs !== undefined) {
+            this.queuedLlmJobs = nonNegativeTelemetryInteger(input.llmQueuedJobs);
+        }
+        if (input.genericQueuedJobs !== undefined) {
+            this.queuedGenericJobs = nonNegativeTelemetryInteger(input.genericQueuedJobs);
+        }
+    }
+    beginExecutionTelemetry(executionClass) {
+        if (executionClass === "generic_job") {
+            this.activeGenericJobs += 1;
+            return;
+        }
+        this.activeLlmJobs += 1;
+    }
+    finishExecutionTelemetry(input) {
+        if (input.executionClass === "generic_job") {
+            this.activeGenericJobs = Math.max(0, this.activeGenericJobs - 1);
+        }
+        else {
+            this.activeLlmJobs = Math.max(0, this.activeLlmJobs - 1);
+        }
+        this.latencySamplesMs.push(Math.max(0, Date.now() - input.startedAt));
+        while (this.latencySamplesMs.length > MAX_TELEMETRY_LATENCY_SAMPLES) {
+            this.latencySamplesMs.shift();
+        }
+        if (!input.ok) {
+            this.recentFailures.unshift({
+                execution_class: input.executionClass === "generic_job" ? "generic_job" : "agentic",
+                code: optionalText(input.code) || "upstream_error",
+                at: new Date().toISOString()
+            });
+            this.recentFailures.splice(MAX_TELEMETRY_FAILURES);
+        }
+    }
+    averageLatencyMs(fallback = null) {
+        if (this.latencySamplesMs.length === 0) {
+            return fallback;
+        }
+        const total = this.latencySamplesMs.reduce((sum, value) => sum + value, 0);
+        return Math.round(total / this.latencySamplesMs.length);
+    }
+    buildLoadTelemetry(input) {
+        const drainMode = this.config.drainMode === true;
+        const llmMaxConcurrency = Math.max(1, Math.floor(this.config.maxConcurrentLlmJobs || this.config.maxConcurrentJobs || 1));
+        const genericMaxConcurrency = Math.max(1, Math.floor(this.config.genericJobMaxConcurrency || 1));
+        const maxConcurrency = Math.max(1, Math.floor(this.config.maxConcurrentJobs || 1), llmMaxConcurrency, this.config.genericJobsEnabled ? genericMaxConcurrency : 1);
+        const activeLlmJobs = nonNegativeTelemetryInteger(this.activeLlmJobs);
+        const activeGenericJobs = nonNegativeTelemetryInteger(this.activeGenericJobs);
+        const queuedLlmJobs = nonNegativeTelemetryInteger(this.queuedLlmJobs);
+        const queuedGenericJobs = nonNegativeTelemetryInteger(this.queuedGenericJobs);
+        const llmCapacity = executionClassCapacity({
+            maxConcurrency: llmMaxConcurrency,
+            activeJobs: activeLlmJobs,
+            queuedJobs: queuedLlmJobs,
+            drainMode
+        });
+        const genericCapacity = executionClassCapacity({
+            maxConcurrency: genericMaxConcurrency,
+            activeJobs: activeGenericJobs,
+            queuedJobs: queuedGenericJobs,
+            drainMode: drainMode || !this.config.genericJobsEnabled
+        });
+        const activeJobs = activeLlmJobs + activeGenericJobs;
+        const queuedJobs = queuedLlmJobs + queuedGenericJobs;
+        const freeSlots = drainMode ? 0 : Math.max(0, maxConcurrency - activeJobs - queuedJobs);
+        const failures = this.recentFailures.slice(0, 10);
+        const discoveryFailureCount = nonNegativeTelemetryInteger(input.discoveryFailureCount);
+        const telemetry = {
+            runtime_protocol_version: SELF_HOSTED_RUNTIME_PROTOCOL_VERSION,
+            load_balancer_protocol_version: SELF_HOSTED_LOAD_BALANCER_PROTOCOL_VERSION,
+            catalog_metadata_version: SELF_HOSTED_CATALOG_METADATA_VERSION,
+            catalog_fingerprint: buildCatalogFingerprint(input.models),
+            max_concurrency: maxConcurrency,
+            max_concurrent_llm_jobs: llmMaxConcurrency,
+            max_concurrent_generic_jobs: this.config.genericJobsEnabled ? genericMaxConcurrency : 0,
+            active_jobs: activeJobs,
+            queued_jobs: queuedJobs,
+            free_slots: freeSlots,
+            drain_mode: drainMode,
+            execution_class_capacity: {
+                chat: llmCapacity,
+                agentic: llmCapacity,
+                generic_job: genericCapacity
+            },
+            avg_latency_ms: this.averageLatencyMs(input.discoveryLatencyMs ?? null),
+            recent_failure_count: failures.length + discoveryFailureCount,
+            recent_failures: failures
+        };
+        if (this.config.hardwareTelemetryEnabled === true) {
+            telemetry.hardware_pressure = buildCoarseHardwarePressure(input.capabilityPayload || null);
+        }
+        return telemetry;
     }
     static async setup(setupConfig, deps) {
         const gateway = deps?.gateway ||
@@ -1711,7 +3467,13 @@ export class SelfHostedNodeRuntime {
             expose_all_models: setupConfig.exposeAllModels,
             model_allowlist: setupConfig.modelAllowlist,
             model_blocklist: setupConfig.modelBlocklist,
-            heartbeat_interval_seconds: setupConfig.heartbeatIntervalSeconds
+            heartbeat_interval_seconds: setupConfig.heartbeatIntervalSeconds,
+            max_concurrent_jobs: setupConfig.maxConcurrentJobs,
+            max_concurrent_llm_jobs: setupConfig.maxConcurrentLlmJobs,
+            drain_mode: setupConfig.drainMode,
+            load_reporting_enabled: setupConfig.loadReportingEnabled,
+            hardware_telemetry_enabled: setupConfig.hardwareTelemetryEnabled,
+            generic_job_max_concurrency: setupConfig.genericJobMaxConcurrency
         });
         const nodeId = optionalText(bootstrap.node?.node_id);
         const runtimeToken = optionalText(bootstrap.runtime_token);
@@ -1726,6 +3488,7 @@ export class SelfHostedNodeRuntime {
             machine_fingerprint: machineFingerprint,
             direct_base_url: setupConfig.directBaseUrl || null,
             runtime_token: undefined,
+            artifact_store_path: setupConfig.artifactStorePath || defaultArtifactStorePath(),
             config_version: bootstrap.config_version,
             heartbeat_interval_seconds: heartbeatInterval,
             heartbeat_timeout_seconds: bootstrap.heartbeat_timeout_seconds,
@@ -1739,6 +3502,15 @@ export class SelfHostedNodeRuntime {
             node_version: setupConfig.nodeVersion,
             request_timeout_ms: setupConfig.requestTimeoutMs,
             job_timeout_ms: setupConfig.jobTimeoutMs,
+            max_concurrent_jobs: setupConfig.maxConcurrentJobs,
+            max_concurrent_llm_jobs: setupConfig.maxConcurrentLlmJobs,
+            generic_jobs_enabled: setupConfig.genericJobsEnabled,
+            generic_job_timeout_ms: setupConfig.genericJobTimeoutMs,
+            generic_job_max_concurrency: setupConfig.genericJobMaxConcurrency,
+            capability_probe_timeout_ms: setupConfig.capabilityProbeTimeoutMs || DEFAULT_CAPABILITY_PROBE_TIMEOUT_MS,
+            drain_mode: setupConfig.drainMode,
+            load_reporting_enabled: setupConfig.loadReportingEnabled,
+            hardware_telemetry_enabled: setupConfig.hardwareTelemetryEnabled,
             expose_all_models: setupConfig.exposeAllModels,
             exposure_policy: setupConfig.exposeAllModels ? "all" : "none",
             model_allowlist: setupConfig.modelAllowlist,
@@ -1761,6 +3533,7 @@ export class SelfHostedNodeRuntime {
             ollamaBaseUrl: setupConfig.ollamaBaseUrl,
             statePath: setupConfig.statePath,
             runtimeTokenPath: setupConfig.runtimeTokenPath,
+            artifactStorePath: setupConfig.artifactStorePath || defaultArtifactStorePath(),
             invocationSigningSecret: null,
             listenHost: DEFAULT_LISTEN_HOST,
             listenPort: DEFAULT_LISTEN_PORT,
@@ -1768,6 +3541,15 @@ export class SelfHostedNodeRuntime {
             heartbeatIntervalSeconds: heartbeatInterval,
             requestTimeoutMs: setupConfig.requestTimeoutMs,
             jobTimeoutMs: setupConfig.jobTimeoutMs,
+            maxConcurrentJobs: setupConfig.maxConcurrentJobs,
+            maxConcurrentLlmJobs: setupConfig.maxConcurrentLlmJobs,
+            genericJobsEnabled: setupConfig.genericJobsEnabled,
+            genericJobTimeoutMs: setupConfig.genericJobTimeoutMs,
+            genericJobMaxConcurrency: setupConfig.genericJobMaxConcurrency,
+            capabilityProbeTimeoutMs: setupConfig.capabilityProbeTimeoutMs || DEFAULT_CAPABILITY_PROBE_TIMEOUT_MS,
+            drainMode: setupConfig.drainMode,
+            loadReportingEnabled: setupConfig.loadReportingEnabled,
+            hardwareTelemetryEnabled: setupConfig.hardwareTelemetryEnabled,
             exposeAllModels: setupConfig.exposeAllModels,
             modelAllowlist: setupConfig.modelAllowlist,
             modelBlocklist: setupConfig.modelBlocklist
@@ -1795,6 +3577,53 @@ export class SelfHostedNodeRuntime {
         const models = await this.mcoda.listAgents(this.config);
         return { source: "mcoda", status: "online", models, version: null, failureCount: 0 };
     }
+    async probeCapabilities() {
+        const timeoutMs = capabilityProbeTimeoutMs(this.config);
+        const [gpu, docker, blender, ffmpeg] = await Promise.all([
+            probeNvidiaGpuCapabilities(this.capabilityRunner, timeoutMs),
+            probeDockerCapabilities(this.capabilityRunner, timeoutMs),
+            probeVersionedSoftware(this.capabilityRunner, "blender", "blender", ["--version"], timeoutMs),
+            probeVersionedSoftware(this.capabilityRunner, "ffmpeg", "ffmpeg", ["-version"], timeoutMs)
+        ]);
+        const software = {
+            docker: docker.docker,
+            "docker-nvidia": docker.dockerNvidia,
+            blender,
+            ffmpeg
+        };
+        const runnerCatalog = buildRunnerCapabilityCatalog(this.config, this.genericRunners).filter((entry) => runnerCapabilityRequirementsAvailable(entry, {
+            gpu,
+            software,
+            genericJobsEnabled: this.config.genericJobsEnabled
+        }));
+        const snapshotWithoutId = {
+            schema_version: MSWARM_CAPABILITY_SCHEMA_VERSION,
+            captured_at: new Date().toISOString(),
+            node_id: this.config.nodeId,
+            platform: platform(),
+            arch: process.arch,
+            generic_jobs_enabled: this.config.genericJobsEnabled,
+            job_types: uniqueSortedStrings(runnerCatalog.map((entry) => entry.job_type)),
+            trust_modes: uniqueSortedStrings(runnerCatalog.flatMap((entry) => entry.trust_modes)),
+            gpu,
+            software,
+            runner_catalog: runnerCatalog
+        };
+        const snapshot = {
+            ...snapshotWithoutId,
+            snapshot_id: buildCapabilitySnapshotId(snapshotWithoutId)
+        };
+        const diagnostics = capabilityDiagnostics(snapshot);
+        return diagnostics ? { ...snapshot, diagnostics } : snapshot;
+    }
+    async publicCapabilityProjection() {
+        return projectMswarmPublicCapabilities(await this.probeCapabilities());
+    }
+    async buildCapabilityHeartbeatPayload(runtimeToken) {
+        const snapshot = await this.probeCapabilities();
+        const privateCatalogEntry = buildMswarmPrivateCapabilityCatalogEntry(snapshot);
+        return signCapabilityPayload({ privateCatalogEntry, runtimeToken });
+    }
     async ensureEnrolled() {
         const currentState = await readSelfHostedNodeState(this.config.statePath);
         const persistedRuntimeToken = await readSelfHostedRuntimeToken(this.config.runtimeTokenPath);
@@ -1827,6 +3656,14 @@ export class SelfHostedNodeRuntime {
             node_version: this.config.nodeVersion,
             request_timeout_ms: this.config.requestTimeoutMs,
             job_timeout_ms: this.config.jobTimeoutMs,
+            max_concurrent_jobs: this.config.maxConcurrentJobs,
+            max_concurrent_llm_jobs: this.config.maxConcurrentLlmJobs,
+            generic_jobs_enabled: this.config.genericJobsEnabled,
+            generic_job_timeout_ms: this.config.genericJobTimeoutMs,
+            generic_job_max_concurrency: this.config.genericJobMaxConcurrency,
+            drain_mode: this.config.drainMode === true,
+            load_reporting_enabled: this.config.loadReportingEnabled !== false,
+            hardware_telemetry_enabled: this.config.hardwareTelemetryEnabled === true,
             expose_all_models: this.config.exposeAllModels,
             exposure_policy: this.config.exposeAllModels ? "all" : "none",
             model_allowlist: this.config.modelAllowlist,
@@ -1837,27 +3674,213 @@ export class SelfHostedNodeRuntime {
         return { runtimeToken, state: nextState, enrolled: true };
     }
     async resolveMcodaAgentForJob(job) {
-        const selected = optionalText(job.source_agent_slug) ||
-            optionalText(job.agent_slug) ||
-            optionalText(job.model) ||
-            optionalText(job.openai_request.model);
+        const selectedSourceAgentSlug = optionalText(job.source_agent_slug);
+        const selectedAgentSlug = optionalText(job.agent_slug);
+        const selectedModel = optionalText(job.model) || optionalText(job.openai_request.model);
+        const selected = selectedSourceAgentSlug || selectedAgentSlug || selectedModel;
         if (!selected) {
-            throw new Error("mcoda source agent slug is required");
+            throw new SelfHostedPreStartJobError("selected_agent_unavailable", "mcoda source agent slug is required");
         }
         const rawAgents = await this.mcoda.listRawAgents();
+        const strictSelectedAgent = selectedSourceAgentSlug || selectedAgentSlug;
         const agent = rawAgents.find((entry) => {
             const slug = optionalText(entry.slug);
+            if (strictSelectedAgent) {
+                return slug === strictSelectedAgent;
+            }
             const defaultModel = mcodaAgentDefaultModel(entry);
             return slug === selected || defaultModel === selected;
         });
-        if (!agent || !isExposedLocalAgent(agent, this.config)) {
-            throw new Error("selected local mcoda agent is not exposed by this node");
+        if (!agent) {
+            throw new SelfHostedPreStartJobError("selected_agent_unavailable", `selected local mcoda agent ${selected} is not available on this node`);
+        }
+        const mapped = mapMcodaAgentToSelfHostedModel(agent, this.config);
+        if (!mapped?.exposed) {
+            throw new SelfHostedPreStartJobError("selected_agent_unavailable", `selected local mcoda agent ${selected} is not exposed by this node`);
+        }
+        if (mapped.health_status && mapped.health_status !== "healthy" && mapped.health_status !== "unknown") {
+            throw new SelfHostedPreStartJobError("selected_agent_unhealthy", `selected local mcoda agent ${selected} is ${mapped.health_status}`);
         }
         return mapMcodaAgentToCodaliAgent(agent, selected);
     }
+    async executeGenericJob(envelope, options = {}) {
+        const startedAt = Date.now();
+        this.beginExecutionTelemetry("generic_job");
+        const events = [];
+        let sequence = 0;
+        const emitEvent = async (event) => {
+            const next = {
+                job_id: envelope.job_id,
+                sequence,
+                timestamp: new Date().toISOString(),
+                ...event
+            };
+            sequence += 1;
+            events.push(next);
+            await options.onEvent?.(next);
+        };
+        const failed = async (code, message, validationIssues) => {
+            await emitEvent({
+                type: code === "cancelled" ? "cancelled" : "failed",
+                message,
+                data: { code }
+            });
+            const status = code === "cancelled" ? "cancelled" : "failed";
+            const result = {
+                job_id: envelope.job_id,
+                status,
+                error: {
+                    code,
+                    message,
+                    retryable: code === "timeout"
+                },
+                finished_at: new Date().toISOString()
+            };
+            this.finishExecutionTelemetry({
+                executionClass: "generic_job",
+                startedAt,
+                ok: false,
+                code
+            });
+            return {
+                job_id: envelope.job_id,
+                request_id: envelope.request_id,
+                status,
+                result,
+                events,
+                ...(validationIssues?.length ? { validation_issues: validationIssues } : {}),
+                timing: { local_latency_ms: Date.now() - startedAt }
+            };
+        };
+        if (!this.config.genericJobsEnabled) {
+            return failed("feature_disabled", "Generic node jobs are disabled on this node.");
+        }
+        if (envelope.node_id !== this.config.nodeId) {
+            return failed("validation_failed", "generic job node_id does not match this node");
+        }
+        const validation = validateMswarmGenericJobRequest(envelope.job, {
+            registeredJobCatalog: registeredOwnerLocalGenericJobCatalog()
+        });
+        if (!validation.ok || !validation.value) {
+            return failed("validation_failed", "generic job request failed validation", validation.issues);
+        }
+        const job = validation.value;
+        const runner = runnerForGenericJob(job, this.genericRunners);
+        if (!runner) {
+            return failed("runner_unavailable", `No generic job runner is registered for ${job.job_type}.`);
+        }
+        if (job.job_type === RENDER_BLENDER_JOB_TYPE || job.job_type === CUDA_RUN_JOB_TYPE) {
+            const capabilityMismatch = genericJobCapabilityMismatch(job, await this.probeCapabilities());
+            if (capabilityMismatch) {
+                return failed(capabilityMismatch.code, capabilityMismatch.message);
+            }
+        }
+        let artifactContext;
+        try {
+            artifactContext = await this.artifactStore.prepareJobWorkspace(envelope.job_id, job);
+        }
+        catch (error) {
+            return failed("validation_failed", error instanceof Error ? error.message : String(error || "generic job artifact preparation failed"));
+        }
+        const controller = new AbortController();
+        const timeoutMs = genericJobTimeoutMs(job, this.config.genericJobTimeoutMs || this.config.jobTimeoutMs);
+        const onAbort = () => {
+            if (!controller.signal.aborted) {
+                controller.abort(options.signal?.reason || "cancelled");
+            }
+        };
+        if (options.signal?.aborted) {
+            controller.abort(options.signal.reason || "cancelled");
+        }
+        options.signal?.addEventListener("abort", onAbort, { once: true });
+        const timeout = setTimeout(() => {
+            if (!controller.signal.aborted) {
+                controller.abort("timeout");
+            }
+        }, timeoutMs);
+        try {
+            await emitEvent({
+                type: "started",
+                message: `Running ${job.job_type}`,
+                data: {
+                    runner: runner.id,
+                    sandbox_profile: artifactContext.sandbox.name,
+                    timeout_ms: timeoutMs
+                }
+            });
+            const runnerResult = await runner.run({
+                job,
+                signal: controller.signal,
+                emitEvent,
+                artifacts: artifactContext,
+                sandbox: artifactContext.sandbox
+            });
+            const status = runnerResult.status || "succeeded";
+            const outputContext = status === "succeeded"
+                ? artifactContext
+                : {
+                    ...artifactContext,
+                    outputSpecs: artifactContext.outputSpecs.map((output) => ({ ...output, required: false }))
+                };
+            const outputArtifacts = await this.artifactStore.collectOutputs(outputContext, envelope.job_id);
+            for (const artifact of outputArtifacts) {
+                await emitEvent({
+                    type: "artifact",
+                    message: "output artifact collected",
+                    data: { artifact }
+                });
+            }
+            const result = {
+                ...runnerResult,
+                job_id: envelope.job_id,
+                status,
+                artifacts: [...(runnerResult.artifacts || []), ...outputArtifacts],
+                started_at: runnerResult.started_at || new Date(startedAt).toISOString(),
+                finished_at: runnerResult.finished_at || new Date().toISOString()
+            };
+            await emitEvent({
+                type: status === "succeeded" ? "completed" : "failed",
+                message: status === "succeeded" ? "generic job completed" : runnerResult.error?.message || "generic job failed",
+                data: {
+                    status,
+                    exit_code: result.exit_code,
+                    runner: runner.id
+                }
+            });
+            this.finishExecutionTelemetry({
+                executionClass: "generic_job",
+                startedAt,
+                ok: status === "succeeded",
+                code: runnerResult.error?.code || status
+            });
+            return {
+                job_id: envelope.job_id,
+                request_id: envelope.request_id,
+                status,
+                result,
+                events,
+                timing: { local_latency_ms: Date.now() - startedAt }
+            };
+        }
+        catch (error) {
+            const code = isGenericAbortError(error, controller.signal) ? abortErrorCode(controller.signal) : "runner_error";
+            const message = code === "timeout" || code === "cancelled"
+                ? abortErrorMessage(controller.signal)
+                : error instanceof Error
+                    ? error.message
+                    : String(error);
+            return failed(code, message);
+        }
+        finally {
+            clearTimeout(timeout);
+            options.signal?.removeEventListener("abort", onAbort);
+        }
+    }
     async executeJob(job, options = {}) {
         const startedAt = Date.now();
+        this.beginExecutionTelemetry("llm");
         let selectedAgent;
+        let jobStarted = false;
         const progressEvents = [];
         const streamEvents = [];
         const recordProgress = async (event) => {
@@ -1868,13 +3891,35 @@ export class SelfHostedNodeRuntime {
             streamEvents.push(chunk);
             await options.onOpenAIChunk?.(chunk);
         };
+        const acknowledgeStarted = async (agent) => {
+            if (jobStarted) {
+                return;
+            }
+            await options.onStarted?.({
+                job_id: job.job_id,
+                request_id: job.request_id,
+                node_id: job.node_id,
+                agent_slug: optionalText(job.agent_slug) || agent?.slug || "",
+                source_agent_slug: optionalText(job.source_agent_slug) || agent?.slug || null,
+                model: optionalText(job.model) || optionalText(job.openai_request.model)
+            });
+            jobStarted = true;
+        };
         if (job.node_id !== this.config.nodeId) {
-            return {
+            const result = {
                 job_id: job.job_id,
                 request_id: job.request_id,
                 status: "failed",
+                pre_start_failure: true,
                 error: { code: "validation_failed", message: "job node_id does not match this node" }
             };
+            this.finishExecutionTelemetry({
+                executionClass: "llm",
+                startedAt,
+                ok: false,
+                code: "validation_failed"
+            });
+            return result;
         }
         try {
             if (job.provider === "ollama") {
@@ -1887,7 +3932,8 @@ export class SelfHostedNodeRuntime {
                     options.num_predict = job.openai_request.max_tokens;
                 if (job.openai_request.stop !== undefined)
                     options.stop = job.openai_request.stop;
-                const result = await this.jobOllama.chat({
+                await acknowledgeStarted();
+                const ollamaResult = await this.jobOllama.chat({
                     model: job.model || job.openai_request.model,
                     messages: job.openai_request.messages,
                     options,
@@ -1900,7 +3946,7 @@ export class SelfHostedNodeRuntime {
                         created: Math.floor(Date.now() / 1000),
                         model: job.openai_request.model,
                         choices: [
-                            { index: 0, delta: { content: result.content }, finish_reason: null }
+                            { index: 0, delta: { content: ollamaResult.content }, finish_reason: null }
                         ]
                     });
                     await emitOpenAIChunk({
@@ -1913,22 +3959,28 @@ export class SelfHostedNodeRuntime {
                         ]
                     });
                 }
-                return {
+                const invocationResult = {
                     job_id: job.job_id,
                     request_id: job.request_id,
                     status: "success",
                     openai_response: buildOpenAIChatCompletion({
                         requestId: job.request_id,
                         model: job.openai_request.model,
-                        content: result.content,
-                        promptTokens: result.promptTokens,
-                        completionTokens: result.completionTokens,
-                        metadata: { provider: "ollama", raw: result.raw }
+                        content: ollamaResult.content,
+                        promptTokens: ollamaResult.promptTokens,
+                        completionTokens: ollamaResult.completionTokens,
+                        metadata: { provider: "ollama", raw: ollamaResult.raw }
                     }),
                     ...(streamEvents.length ? { stream_events: streamEvents } : {}),
                     ...(progressEvents.length ? { progress_events: progressEvents } : {}),
                     timing: { local_latency_ms: Date.now() - startedAt }
                 };
+                this.finishExecutionTelemetry({
+                    executionClass: "llm",
+                    startedAt,
+                    ok: true
+                });
+                return invocationResult;
             }
             const taskPreview = messagesToPrompt(job.openai_request.messages);
             if (!taskPreview) {
@@ -1938,6 +3990,7 @@ export class SelfHostedNodeRuntime {
             selectedAgent = agent;
             validateRequiredDocdexContext(job, options.attachedMswarmApiKey);
             const attachedMswarmApiKey = attachedMswarmApiKeyForDocdex(job, options.attachedMswarmApiKey);
+            await acknowledgeStarted(agent);
             await recordProgress({
                 type: "agent_selected",
                 job_id: job.job_id,
@@ -1976,7 +4029,7 @@ export class SelfHostedNodeRuntime {
                 }
             });
             const tokens = usageTokens(response.usage);
-            return {
+            const result = {
                 job_id: job.job_id,
                 request_id: job.request_id,
                 status: "success",
@@ -2002,6 +4055,12 @@ export class SelfHostedNodeRuntime {
                 ...(progressEvents.length ? { progress_events: progressEvents } : {}),
                 timing: { local_latency_ms: Date.now() - startedAt }
             };
+            this.finishExecutionTelemetry({
+                executionClass: "llm",
+                startedAt,
+                ok: true
+            });
+            return result;
         }
         catch (error) {
             const message = redactRuntimeSecretValues(error instanceof Error ? error.message : String(error), [selectedAgent?.apiKey, options.attachedMswarmApiKey]);
@@ -2014,10 +4073,11 @@ export class SelfHostedNodeRuntime {
                         : /permission|policy|denied/i.test(message)
                             ? "policy_denied"
                             : "upstream_error");
-            return {
+            const result = {
                 job_id: job.job_id,
                 request_id: job.request_id,
                 status: "failed",
+                ...(!jobStarted ? { pre_start_failure: true } : {}),
                 error: {
                     code,
                     message
@@ -2026,6 +4086,13 @@ export class SelfHostedNodeRuntime {
                 ...(progressEvents.length ? { progress_events: progressEvents } : {}),
                 timing: { local_latency_ms: Date.now() - startedAt }
             };
+            this.finishExecutionTelemetry({
+                executionClass: "llm",
+                startedAt,
+                ok: false,
+                code
+            });
+            return result;
         }
     }
     async runOnce() {
@@ -2050,11 +4117,49 @@ export class SelfHostedNodeRuntime {
             models = [];
             version = null;
         }
+        const discoveryLatencyMs = Date.now() - startedAt;
+        const capabilityPayload = await this.buildCapabilityHeartbeatPayload(enrollment.runtimeToken);
+        const loadTelemetry = this.buildLoadTelemetry({
+            models,
+            discoveryLatencyMs,
+            discoveryFailureCount: recentFailureCount,
+            capabilityPayload
+        });
+        const exposedModelCount = models.filter((model) => model.exposed !== false).length;
+        const loadReportingEnabled = this.config.loadReportingEnabled !== false;
+        const capacityPayload = loadReportingEnabled
+            ? {
+                protocol_version: loadTelemetry.runtime_protocol_version,
+                runtime_protocol_version: loadTelemetry.runtime_protocol_version,
+                load_balancer_protocol_version: loadTelemetry.load_balancer_protocol_version,
+                catalog_metadata_version: loadTelemetry.catalog_metadata_version,
+                catalog_fingerprint: loadTelemetry.catalog_fingerprint,
+                max_concurrency: loadTelemetry.max_concurrency,
+                max_concurrent_llm_jobs: loadTelemetry.max_concurrent_llm_jobs,
+                max_concurrent_generic_jobs: loadTelemetry.max_concurrent_generic_jobs,
+                active_jobs: loadTelemetry.active_jobs,
+                queued_jobs: loadTelemetry.queued_jobs,
+                free_slots: loadTelemetry.free_slots,
+                drain_mode: loadTelemetry.drain_mode,
+                execution_class_capacity: loadTelemetry.execution_class_capacity
+            }
+            : {
+                active_jobs: loadTelemetry.active_jobs,
+                queued_jobs: loadTelemetry.queued_jobs
+            };
         const heartbeatPayload = {
             node_id: this.config.nodeId,
             node_version: this.config.nodeVersion,
+            runtime_protocol_version: SELF_HOSTED_RUNTIME_PROTOCOL_VERSION,
             config_version: enrollment.state.config_version ?? null,
             status,
+            runtime: {
+                protocol_version: SELF_HOSTED_RUNTIME_PROTOCOL_VERSION,
+                relay_mode: this.config.relayMode || "outbound",
+                load_reporting_enabled: loadReportingEnabled,
+                hardware_telemetry_enabled: this.config.hardwareTelemetryEnabled === true,
+                drain_mode: this.config.drainMode === true
+            },
             discovery: {
                 source: discoverySource,
                 mcoda_status: discoverySource === "mcoda" && status === "online" ? "ok" : status === "degraded" ? "error" : null
@@ -2068,19 +4173,24 @@ export class SelfHostedNodeRuntime {
                     status: null,
                     version: null
                 },
-            capacity: {
-                active_jobs: 0,
-                queued_jobs: 0
-            },
+            capacity: capacityPayload,
             health: {
-                avg_latency_ms: Date.now() - startedAt,
-                recent_failure_count: recentFailureCount,
+                avg_latency_ms: loadTelemetry.avg_latency_ms ?? discoveryLatencyMs,
+                recent_failure_count: loadTelemetry.recent_failure_count,
+                recent_failures: loadTelemetry.recent_failures,
                 last_success_at: status === "online" ? new Date().toISOString() : null
             },
-            models
+            local_agent_catalog: {
+                revision: loadTelemetry.catalog_fingerprint,
+                metadata_version: loadTelemetry.catalog_metadata_version,
+                model_count: models.length,
+                exposed_model_count: exposedModelCount
+            },
+            models,
+            capabilities: capabilityPayload,
+            ...(loadTelemetry.hardware_pressure ? { hardware_pressure: loadTelemetry.hardware_pressure } : {})
         };
         const heartbeatResponse = await this.gateway.heartbeat(enrollment.runtimeToken, heartbeatPayload);
-        const exposedModelCount = models.filter((model) => model.exposed !== false).length;
         return {
             enrolled: enrollment.enrolled,
             status,
@@ -2088,6 +4198,7 @@ export class SelfHostedNodeRuntime {
             discovery_source: discoverySource,
             mcoda_agent_count: discoverySource === "mcoda" ? exposedModelCount : undefined,
             ollama_version: version,
+            capacity: loadTelemetry,
             heartbeat_response: heartbeatResponse
         };
     }
@@ -2122,9 +4233,17 @@ export class SelfHostedNodeRuntime {
     }
     async pollAndExecuteJob(waitMs = DEFAULT_JOB_POLL_WAIT_MS) {
         const enrollment = await this.ensureEnrolled();
+        const pollCapacity = this.buildLoadTelemetry({ models: [] });
         const response = await this.gateway.pollJob(enrollment.runtimeToken, {
             node_id: this.config.nodeId,
-            capacity: { active_jobs: 0, max_jobs: 1 },
+            capacity: {
+                active_jobs: pollCapacity.active_jobs,
+                queued_jobs: pollCapacity.queued_jobs,
+                max_jobs: pollCapacity.max_concurrency,
+                max_concurrency: pollCapacity.max_concurrency,
+                free_slots: pollCapacity.free_slots,
+                drain_mode: pollCapacity.drain_mode
+            },
             wait_ms: waitMs
         });
         const job = response.job || null;
@@ -2152,6 +4271,14 @@ export class SelfHostedNodeRuntime {
         };
         const result = await this.executeJob(job, {
             attachedMswarmApiKey: optionalText(response.attached_mswarm_api_key) || undefined,
+            onStarted: async (event) => {
+                await this.gateway.postJobStart(enrollment.runtimeToken, job.job_id, {
+                    node_id: this.config.nodeId,
+                    agent_slug: event.agent_slug || job.agent_slug,
+                    source_agent_slug: event.source_agent_slug || job.source_agent_slug || null,
+                    model: event.model || job.model || job.openai_request.model
+                });
+            },
             onOpenAIChunk: async (chunk) => {
                 if (job.openai_request.stream !== true || streamEventForwardingFailed) {
                     return;