@mono-agent/agent-app 0.19.1 → 0.20.1

package/dist/configured-agent.js

@@ -1,4 +1,4 @@
-import { createAgentHarness, createAgentResponder, createDurableHistoryStore, createToolPolicy, loadToolPolicyFromJsonFileSync, renderSkillIndexSection, } from "@mono-agent/agent-harness";
+import { createAgentHarness, createAgentResponder, acquireToolHistoryWriter, createDurableHistoryStore, createToolPolicy, loadToolPolicyFromJsonFileSync, renderSkillIndexSection, ToolHistoryReader, toolHistoryLogicalConversationId, } from "@mono-agent/agent-harness";
 import { readFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { resolve as resolvePath } from "node:path";
@@ -6,11 +6,17 @@ import { setToolActivityPathRoots } from "@mono-agent/agent-contracts";
 import { resolveSupermemoryContainer } from "@mono-agent/config";
 import { createCompositeRunRecorder, createJsonlRunRecorder } from "@mono-agent/observability";
 import { createPhoenixRunExporter } from "@mono-agent/observability/otel";
-import { assertExecutionModeCompatible, createMonoRuntime, createPiOAuthApiKeyResolver, defaultExecutionModeForModel, describeMonoRuntimeSupport, modelReferenceKey, monoRuntimeSupportsSessionResume, parseMonoRuntimeModelReference, runtimeOptionsForLocalProvider, } from "@mono-agent/runtime-adapter";
+import { assertExecutionModeCompatible, createMonoRuntime, createPiOAuthApiKeyResolver, createSrtSandboxEngine, defaultExecutionModeForModel, describeMonoRuntimeSupport, modelReferenceKey, monoRuntimeSupportsSessionResume, parseMonoRuntimeModelReference, runtimeOptionsForLocalProvider, mergeSandboxPolicies, } from "@mono-agent/runtime-adapter";
+import { agentArtifactDerivedRoots } from "./agent-artifact-paths.js";
+import { acquireAgentRootOwnership, assertAgentRootLeaseOutsideWorkspace, releaseAgentRootOwnershipWhenIdle, } from "./agent-root-coordinator.js";
 import { resolveMemoryRecallSettings } from "./memory-recall.js";
 import { BUILTIN_TOOL_NAMES, canonicalToolName, isAllowAllTools } from "./modules/known-tools.js";
 import { createSharedMemoryRecallRuntimeExtension, isSharedRecallStore, MemoryRetrievalService, } from "./memory-retrieval.js";
-import { composeRuntimeOptionExtensions } from "./runtime-option-extensions.js";
+import { clearSessionsSandboxPolicy, composeRuntimeOptionExtensions, createClearSessionsRuntimeExtension, } from "./runtime-option-extensions.js";
+import { configuredRuntimeFallbackModels, runtimeUsesFallbackRouter, } from "./runtime-routes.js";
+import { resolveProcessJobsProtectionPosture, } from "./process-jobs-protection.js";
+import { createProcessJobsRuntimeExtension, processJobsSandboxPolicy, PROCESS_JOBS_PI_NATIVE_REQUIRED_ERROR, PROCESS_JOBS_PROTECTION_UNAVAILABLE_ERROR, } from "./process-jobs-runtime.js";
+import { attestProcessJobsRootRegistrySnapshot, loadProcessJobsRootRegistryProtection, processJobsProtectionPolicyRoots, registerProcessJobsRoot, } from "./process-jobs-root-registry.js";
 import { isReadSkillDenied } from "./skill-registry.js";
 import { loadSupermemoryPlugin } from "./supermemory-plugin.js";
 /**
@@ -148,10 +154,22 @@ function recorderCompositionDeps(config, options, internalHooks = {}) {
 export function createConfiguredAgentRuntime(input) {
     const config = isRuntimeOptions(input) ? input.config : input;
     const options = isRuntimeOptions(input) ? input : undefined;
+    return wrapOwnedConfiguredRuntime(createConfiguredAgentRuntimeBase(config, options), config, options?.cwd, options?.sandboxEngine);
+}
+/** @internal App/harness seam; callers are already inside the shared root/request choke point. */
+export function createConfiguredAgentRuntimeForApp(input, internal = {}) {
+    const config = isRuntimeOptions(input) ? input.config : input;
+    const options = isRuntimeOptions(input) ? input : undefined;
+    return createConfiguredAgentRuntimeBase(config, options, internal.suppressSandboxEngine === true);
+}
+function createConfiguredAgentRuntimeBase(config, options, suppressSandboxEngine = false) {
     const fallback = fallbackChainForConfig(config, options);
+    const sandboxEngine = suppressSandboxEngine
+        ? undefined
+        : configuredSandboxEngine(config, options?.model ?? config.runtime.model, options?.sandboxEngine);
     const runtimeOptions = {
         ...runtimeHostOptionsForConfig(config),
-        ...(options?.sandboxEngine === undefined ? {} : { sandboxEngine: options.sandboxEngine }),
+        ...(sandboxEngine === undefined ? {} : { sandboxEngine }),
         ...fallback,
         ...(fallback.fallbackChain === undefined
             ? {}
@@ -175,6 +193,107 @@ export function createConfiguredAgentRuntime(input) {
     };
     return createMonoRuntime(runtimeOptions);
 }
+function configuredSandboxEngine(config, primaryModel, explicit) {
+    if (explicit !== undefined)
+        return explicit;
+    return [primaryModel, ...configuredRuntimeFallbackModels(config.runtime)]
+        .some((model) => model.sdk === "pi")
+        ? createSrtSandboxEngine()
+        : undefined;
+}
+function wrapOwnedConfiguredRuntime(runtime, config, agentRoot, configuredSandboxEngine) {
+    let security;
+    let disposed = false;
+    const loadSecurity = async () => {
+        const ownership = await acquireAgentRootOwnership(agentRoot);
+        try {
+            assertAgentRootLeaseOutsideWorkspace(ownership, config.runtime.workspace);
+            return { ownership };
+        }
+        catch (error) {
+            await releaseAgentRootOwnershipWhenIdle(ownership).catch(() => undefined);
+            throw error;
+        }
+    };
+    const secured = () => (security ??= loadSecurity());
+    const releaseOwnership = async () => {
+        const current = security;
+        security = undefined;
+        if (current === undefined)
+            return;
+        const { ownership } = await current.catch(() => ({ ownership: undefined }));
+        if (ownership !== undefined) {
+            await releaseAgentRootOwnershipWhenIdle(ownership);
+        }
+    };
+    return {
+        async run(systemPrompt, runOptions) {
+            if (disposed)
+                throw new Error("Configured runtime has been disposed.");
+            const { ownership } = await secured();
+            const registry = await loadProcessJobsRootRegistryProtection(ownership.agentRoot, config.runtime.workspace);
+            ownership.coordinator.synchronizeGeneration(registry.generation);
+            const boundary = await attestProcessJobsRootRegistrySnapshot(registry, config.runtime.workspace);
+            if (disposed)
+                throw new Error("Configured runtime has been disposed.");
+            const lease = ownership.coordinator.acquireRequestLease(boundary.generation);
+            try {
+                const attested = await attestProcessJobsRootRegistrySnapshot(boundary, config.runtime.workspace);
+                const protectedRoots = processJobsProtectionPolicyRoots(attested);
+                let effectiveOptions = runOptions;
+                if (protectedRoots.length > 0) {
+                    if (!configuredRoutesOnlyPiNative(config, runOptions.model)) {
+                        throw new Error(PROCESS_JOBS_PI_NATIVE_REQUIRED_ERROR);
+                    }
+                    if (runOptions.model.sdk !== "pi")
+                        throw new Error(PROCESS_JOBS_PI_NATIVE_REQUIRED_ERROR);
+                    const sandboxEngine = runOptions.sandboxEngine
+                        ?? configuredSandboxEngine
+                        ?? createSrtSandboxEngine();
+                    if (!await sandboxEngine.isAvailable().catch(() => false)) {
+                        throw new Error(PROCESS_JOBS_PROTECTION_UNAVAILABLE_ERROR);
+                    }
+                    const sandboxPolicy = mergeSandboxPolicies(runOptions.sandboxPolicy, processJobsSandboxPolicy({ coreConfig: config, protectedRoots }));
+                    if (sandboxPolicy === undefined) {
+                        throw new Error(PROCESS_JOBS_PROTECTION_UNAVAILABLE_ERROR);
+                    }
+                    effectiveOptions = {
+                        ...runOptions,
+                        sandboxPolicy,
+                        sandboxEngine,
+                    };
+                }
+                return await runtime.run(systemPrompt, effectiveOptions);
+            }
+            finally {
+                lease.releaseAfterSettlement();
+            }
+        },
+        ...(runtime.configureTools === undefined
+            ? {}
+            : { configureTools: runtime.configureTools.bind(runtime) }),
+        ...(runtime.syncSession === undefined ? {} : { syncSession: runtime.syncSession.bind(runtime) }),
+        ...(runtime.refreshSession === undefined ? {} : { refreshSession: runtime.refreshSession.bind(runtime) }),
+        ...(runtime.retireDurableSession === undefined
+            ? {}
+            : { retireDurableSession: runtime.retireDurableSession.bind(runtime) }),
+        ...(runtime.disposeSession === undefined ? {} : { disposeSession: runtime.disposeSession.bind(runtime) }),
+        ...(runtime.invalidateSession === undefined
+            ? {}
+            : { invalidateSession: runtime.invalidateSession.bind(runtime) }),
+        async disposeAllSessions() {
+            if (disposed)
+                return;
+            disposed = true;
+            try {
+                await runtime.disposeAllSessions?.();
+            }
+            finally {
+                await releaseOwnership();
+            }
+        },
+    };
+}
 /**
  * Narrow the loaded MCP servers to the ones a profile names.
  *
@@ -327,6 +446,11 @@ function subagentsRuntimeOptions(config, deps) {
         const childSystemPrompt = childSkills === undefined
             ? request.systemPrompt
             : `${request.systemPrompt}\n\n${renderSkillIndexSection(childSkills)}`;
+        if (childModel.sdk !== "pi"
+            && (deps.processJobsProtectionPosture.requiresPiNative
+                || sandboxPolicyCarriesProtectedRoots(request.sandboxPolicy))) {
+            throw new Error(PROCESS_JOBS_PI_NATIVE_REQUIRED_ERROR);
+        }
         return await runtime.run(childSystemPrompt, {
             model: childModel,
             executionMode: childExecutionMode,
@@ -446,6 +570,27 @@ function fallbackChainForConfig(config, options) {
         ],
     };
 }
+function configuredRoutesOnlyPiNative(config, primary) {
+    try {
+        const fallback = fallbackChainForConfig(config, { config, model: primary });
+        const routes = fallback.fallbackChain?.map((entry) => entry.model) ?? [primary];
+        return routes.length > 0 && routes.every((model) => model.sdk === "pi");
+    }
+    catch {
+        return false;
+    }
+}
+function sandboxPolicyCarriesProtectedRoots(policy) {
+    if (policy === undefined || policy === null || typeof policy !== "object")
+        return false;
+    try {
+        const roots = policy.protectedRoots;
+        return roots !== undefined && (!Array.isArray(roots) || roots.length > 0);
+    }
+    catch {
+        return true;
+    }
+}
 let memoryBujoModule;
 let memorySearchModule;
 const loadMemoryBujoModule = async () => (memoryBujoModule ??= await import("@mono-agent/memory/bujo"));
@@ -455,156 +600,581 @@ export async function createConfiguredAgentHarness(options) {
 }
 async function createConfiguredAgentHarnessInternal(options, internalHooks = {}) {
     const config = options.config;
-    // Chat activity lines are formatted deep in the streaming layer, which has no
-    // per-message workspace to hand down. Without this the root falls back to
-    // `process.cwd()` — for a service-managed agent, whatever directory the
-    // supervisor started it in — and tool previews expose the full machine layout.
-    setToolActivityPathRoots({ workspaceRoot: config.runtime.workspace, homeDir: homedir() });
-    const model = options.model ?? config.runtime.model;
-    const executionMode = options.executionMode ?? config.runtime.executionMode;
-    const runtime = options.runtime ?? createConfiguredAgentRuntime({
-        config,
-        model,
-        executionMode,
-        ...(options.sandboxEngine === undefined ? {} : { sandboxEngine: options.sandboxEngine }),
-    });
-    // The memory LLM must NOT ride the channel `runtime`: that runtime carries the
-    // channel fallback chain whose primary is `config.runtime.model`, and the
-    // fallback router overrides each run's per-call `model` — so reusing it would
-    // execute memory capture on `config.runtime.model` instead of
-    // `config.memory.llm.model`. createConfiguredMemory builds the memory LLM its own
-    // fallback-free runtime when no `memoryRuntime` is injected.
-    const configuredMemory = options.memory ?? (await createConfiguredMemory(config, {
-        ...(options.cwd === undefined ? {} : { cwd: options.cwd }),
-    }));
-    const memory = configuredMemoryForHarness(config, configuredMemory);
-    const memoryRecall = resolveMemoryRecallSettings(config) === undefined
-        || !(memory instanceof MemoryRetrievalService)
-        ? undefined
-        : createSharedMemoryRecallRuntimeExtension(memory, {
-            ...(options.onMemoryRecallUnavailable === undefined
+    const ownership = await acquireAgentRootOwnership(options.cwd ?? process.cwd());
+    const agentRoot = ownership.agentRoot;
+    let ownershipTransferred = false;
+    try {
+        assertAgentRootLeaseOutsideWorkspace(ownership, config.runtime.workspace);
+        const loadedProcessJobsRegistry = internalHooks.processJobs?.registry
+            ?? (internalHooks.bootstrapProcessJobs?.stateDir === undefined
+                ? await loadProcessJobsRootRegistryProtection(ownership.agentRoot, config.runtime.workspace)
+                : (await registerProcessJobsRoot({
+                    agentRoot: ownership.agentRoot,
+                    workspace: config.runtime.workspace,
+                    stateDir: internalHooks.bootstrapProcessJobs.stateDir,
+                    coordinator: ownership.coordinator,
+                })).snapshot);
+        const processJobsRegistry = loadedProcessJobsRegistry.kind === "failed"
+            ? loadedProcessJobsRegistry
+            : await attestProcessJobsRootRegistrySnapshot(loadedProcessJobsRegistry, config.runtime.workspace);
+        ownership.coordinator.synchronizeGeneration(processJobsRegistry.generation);
+        const processJobsProtectionPosture = internalHooks.processJobs?.protectionPosture
+            ?? resolveProcessJobsProtectionPosture({
+                settings: internalHooks.bootstrapProcessJobs?.settings
+                    ?? { enabled: false, unsafeAllowUnprotectedState: false },
+                registry: processJobsRegistry,
+                coreConfig: config,
+            });
+        const processJobsProtectedRoots = processJobsProtectionPolicyRoots(processJobsRegistry);
+        const artifactDerivedRoots = agentArtifactDerivedRoots(config.artifacts.dir);
+        // Chat activity lines are formatted deep in the streaming layer, which has no
+        // per-message workspace to hand down. Without this the root falls back to
+        // `process.cwd()` — for a service-managed agent, whatever directory the
+        // supervisor started it in — and tool previews expose the full machine layout.
+        setToolActivityPathRoots({ workspaceRoot: config.runtime.workspace, homeDir: homedir() });
+        const model = options.model ?? config.runtime.model;
+        const executionMode = options.executionMode ?? config.runtime.executionMode;
+        const fallbackModels = configuredRuntimeFallbackModels(config.runtime);
+        const sandboxEngine = processJobsProtectionPosture.suppressSyntheticSandbox
+            ? undefined
+            : configuredSandboxEngine(config, model, options.sandboxEngine);
+        const harnessSandboxPolicy = processJobsProtectionPosture.suppressSyntheticSandbox
+            ? config.sandbox
+            : processJobsProtectedRoots.length === 0
+                ? config.sandbox
+                : processJobsSandboxPolicy({ coreConfig: config, protectedRoots: processJobsProtectedRoots });
+        const runtime = options.runtime ?? createConfiguredAgentRuntimeForApp({
+            config,
+            cwd: agentRoot,
+            model,
+            executionMode,
+            ...(sandboxEngine === undefined ? {} : { sandboxEngine }),
+        }, {
+            suppressSandboxEngine: processJobsProtectionPosture.suppressSyntheticSandbox,
+        });
+        const clearSessionsBoundaryOptions = {
+            cwd: agentRoot,
+            workspace: config.runtime.workspace,
+            baseModel: model,
+            fallbackModels,
+            ...(harnessSandboxPolicy === undefined ? {} : { sandboxPolicy: harnessSandboxPolicy }),
+            ...(processJobsProtectionPosture.suppressSyntheticSandbox
+                ? { suppressSyntheticSandbox: true }
+                : {}),
+        };
+        const routedClearSessionsPolicy = runtimeUsesFallbackRouter(config.runtime)
+            ? clearSessionsSandboxPolicy(clearSessionsBoundaryOptions)
+            : undefined;
+        // Request policy is still attested and applied per turn below. Configure the
+        // same stable engine/policy into the routed ToolContext so Pi filesystem
+        // builtins resolve their native boundary there; per-route-native projection
+        // clears both fields from every non-Pi attempt.
+        runtime.configureTools?.({
+            workspace: config.runtime.workspace,
+            ...(sandboxEngine === undefined ? {} : { sandboxEngine }),
+            ...(routedClearSessionsPolicy === undefined ? {} : { sandboxPolicy: routedClearSessionsPolicy }),
+        });
+        // The memory LLM must NOT ride the channel `runtime`: that runtime carries the
+        // channel fallback chain whose primary is `config.runtime.model`, and the
+        // fallback router overrides each run's per-call `model` — so reusing it would
+        // execute memory capture on `config.runtime.model` instead of
+        // `config.memory.llm.model`. createConfiguredMemory builds the memory LLM its own
+        // fallback-free runtime when no `memoryRuntime` is injected.
+        const configuredMemory = options.memory ?? (await createConfiguredMemoryInternal(config, { cwd: agentRoot }, processJobsProtectionPosture));
+        const memory = configuredMemoryForHarness(config, configuredMemory);
+        const memoryRecall = resolveMemoryRecallSettings(config) === undefined
+            || !(memory instanceof MemoryRetrievalService)
+            ? undefined
+            : createSharedMemoryRecallRuntimeExtension(memory, {
+                ...(options.onMemoryRecallUnavailable === undefined
+                    ? {}
+                    : { onUnavailable: options.onMemoryRecallUnavailable }),
+            });
+        const composedRuntimeOptionsForRequest = composeRuntimeOptionExtensions([
+            memoryRecall,
+            options.runtimeOptionsForRequest,
+        ], {
+            // The app-owned, read-only MemoryRecall endpoint is part of every configured
+            // memory tier. Preserve only this exact extension under an authenticated
+            // request override; arbitrary caller/action MCP extensions remain excluded.
+            preserveMcpServersUnderOverride: memoryRecall === undefined ? [] : [memoryRecall],
+        });
+        const clearSessionsRuntimeOptionsForRequest = createClearSessionsRuntimeExtension(composedRuntimeOptionsForRequest, clearSessionsBoundaryOptions);
+        const runtimeOptionsForRequest = createProcessJobsRuntimeExtension({
+            next: clearSessionsRuntimeOptionsForRequest,
+            ownership,
+            registry: processJobsRegistry,
+            service: internalHooks.processJobs?.service,
+            coreConfig: config,
+            baseModel: model,
+            channelId: internalHooks.processJobs?.channelId,
+            sandboxEngine,
+            protectionPosture: processJobsProtectionPosture,
+            routesOnlyPiNative: internalHooks.processJobs?.routesOnlyPiNative
+                ?? (() => configuredRoutesOnlyPiNative(config, model)),
+        });
+        const subagents = subagentsRuntimeOptions(config, {
+            runtime,
+            baseModel: model,
+            baseExecutionMode: executionMode,
+            processJobsProtectionPosture,
+            ...(options.runtimeForModel === undefined ? {} : { runtimeForModel: options.runtimeForModel }),
+        });
+        const runtimeOptions = mergeStaticRuntimeOptions(runtimeOptionsForLocalProvider(model, config.providers?.local), configRuntimeFlags(config), sandboxEngine === undefined ? undefined : { sandboxEngine }, subagents, options.runtimeOptions);
+        const sessionOptions = {
+            mode: config.runtime.session.mode,
+            idleTimeoutMs: config.runtime.session.idleTimeoutMs,
+            // Any fallback makes the logical run stateless. A provider-owned session
+            // cannot safely cross the route boundary, even when both bridges happen to
+            // expose resume support. History replay remains available to every attempt.
+            supportsResume: hasConfiguredFallback(config)
+                ? false
+                : supportsSessionResume(model, executionMode),
+            ...(config.runtime.session.isolateProactive === undefined
+                ? {}
+                : { isolateProactive: config.runtime.session.isolateProactive }),
+            ...(options.onSessionEvent === undefined ? {} : { onSessionEvent: options.onSessionEvent }),
+        };
+        const piSessionsRoot = config.providers?.piNative?.piSessionsRoot;
+        const retireDurableSession = runtime.retireDurableSession?.bind(runtime);
+        const historyRoot = artifactDerivedRoots.history;
+        const baseHistoryStore = options.historyStore ?? createDurableHistoryStore({
+            root: historyRoot,
+            maxMessages: DEFAULT_HISTORY_MAX_MESSAGES,
+            ...(piSessionsRoot === undefined || retireDurableSession === undefined
                 ? {}
-                : { onUnavailable: options.onMemoryRecallUnavailable }),
+                : {
+                    retireProviderSession: async (providerSessionId) => {
+                        await retireDurableSession(providerSessionId, piSessionsRoot);
+                    },
+                }),
         });
-    const runtimeOptionsForRequest = composeRuntimeOptionExtensions([
-        memoryRecall,
-        options.runtimeOptionsForRequest,
-    ], {
-        // The app-owned, read-only MemoryRecall endpoint is part of every configured
-        // memory tier. Preserve only this exact extension under an authenticated
-        // request override; arbitrary caller/action MCP extensions remain excluded.
-        preserveMcpServersUnderOverride: memoryRecall === undefined ? [] : [memoryRecall],
-    });
-    const subagents = subagentsRuntimeOptions(config, {
-        runtime,
-        baseModel: model,
-        baseExecutionMode: executionMode,
-        ...(options.runtimeForModel === undefined ? {} : { runtimeForModel: options.runtimeForModel }),
-    });
-    const runtimeOptions = mergeStaticRuntimeOptions(runtimeOptionsForLocalProvider(model, config.providers?.local), configRuntimeFlags(config), options.sandboxEngine === undefined ? undefined : { sandboxEngine: options.sandboxEngine }, subagents, options.runtimeOptions);
-    const sessionOptions = {
-        mode: config.runtime.session.mode,
-        idleTimeoutMs: config.runtime.session.idleTimeoutMs,
-        // Any fallback makes the logical run stateless. A provider-owned session
-        // cannot safely cross the route boundary, even when both bridges happen to
-        // expose resume support. History replay remains available to every attempt.
-        supportsResume: hasConfiguredFallback(config)
-            ? false
-            : supportsSessionResume(model, executionMode),
-        ...(config.runtime.session.isolateProactive === undefined
-            ? {}
-            : { isolateProactive: config.runtime.session.isolateProactive }),
-        ...(options.onSessionEvent === undefined ? {} : { onSessionEvent: options.onSessionEvent }),
-    };
-    const piSessionsRoot = config.providers?.piNative?.piSessionsRoot;
-    const retireDurableSession = runtime.retireDurableSession?.bind(runtime);
-    const baseHistoryStore = options.historyStore ?? createDurableHistoryStore({
-        root: resolvePath(config.artifacts.dir, "..", "history"),
-        maxMessages: DEFAULT_HISTORY_MAX_MESSAGES,
-        ...(piSessionsRoot === undefined || retireDurableSession === undefined
-            ? {}
-            : {
-                retireProviderSession: async (providerSessionId) => {
-                    await retireDurableSession(providerSessionId, piSessionsRoot);
-                },
-            }),
-    });
-    const historyStore = internalHooks.wrapHistoryStore?.(baseHistoryStore) ?? baseHistoryStore;
-    return createAgentHarness({
-        identityPath: config.context.identityPath,
-        ...(config.context.soulPath === undefined ? {} : { soulPath: config.context.soulPath }),
-        ...(config.context.skillsRoot === undefined ? {} : { skillsRoot: config.context.skillsRoot }),
-        ...(config.context.skillMaxBytes === undefined ? {} : { skillMaxBytes: config.context.skillMaxBytes }),
-        ...(config.context.skillDisclosure === undefined ? {} : { skillDisclosure: config.context.skillDisclosure }),
-        selectedSkills: config.context.selectedSkills,
-        runtime,
-        model,
-        executionMode,
-        cwd: config.runtime.workspace,
-        ...(config.runtime.effort === undefined ? {} : { effort: config.runtime.effort }),
-        ...(config.runtime.maxTurns === undefined ? {} : { maxTurns: config.runtime.maxTurns }),
-        ...(config.providers?.piNative?.piSessionsRoot === undefined
-            ? {}
-            : { piSessionsRoot: config.providers.piNative.piSessionsRoot }),
-        session: sessionOptions,
-        ...(config.concurrency?.maxConcurrentRuns === undefined && config.concurrency?.maxPendingRuns === undefined
-            ? {}
-            : {
-                concurrency: {
-                    ...(config.concurrency?.maxConcurrentRuns === undefined
-                        ? {}
-                        : { maxConcurrentRuns: config.concurrency.maxConcurrentRuns }),
-                    ...(config.concurrency?.maxPendingRuns === undefined
-                        ? {}
-                        : { maxPendingRuns: config.concurrency.maxPendingRuns }),
-                },
-            }),
-        runtimeOptions,
-        ...(runtimeOptionsForRequest === undefined
+        const historyStore = internalHooks.wrapHistoryStore?.(baseHistoryStore) ?? baseHistoryStore;
+        const rollover = internalHooks.sessionRollover ?? config.runtime.session.rollover;
+        // Conversation history and managed-tool history are distinct contracts. A
+        // caller-supplied message store remains the sole message-history owner, while
+        // the configured app keeps its independent lifecycle sidecar and
+        // SessionHistory capability. Acquisition stays lazy so tool-free runs do not
+        // create either the sidecar or its owner database.
+        const toolHistory = lazyConfiguredToolHistory({
+            root: historyRoot,
+            artifactRoot: resolvePath(config.artifacts.dir, "tool-output"),
+            rollover,
+            ...(options.onToolHistoryWarning === undefined
+                ? {}
+                : { onWarning: options.onToolHistoryWarning }),
+        });
+        try {
+            const harness = createAgentHarness({
+                identityPath: config.context.identityPath,
+                ...(config.context.soulPath === undefined ? {} : { soulPath: config.context.soulPath }),
+                ...(config.context.skillsRoot === undefined ? {} : { skillsRoot: config.context.skillsRoot }),
+                ...(config.context.skillMaxBytes === undefined ? {} : { skillMaxBytes: config.context.skillMaxBytes }),
+                ...(config.context.skillDisclosure === undefined ? {} : { skillDisclosure: config.context.skillDisclosure }),
+                selectedSkills: config.context.selectedSkills,
+                runtime,
+                model,
+                executionMode,
+                cwd: config.runtime.workspace,
+                ...(config.runtime.effort === undefined ? {} : { effort: config.runtime.effort }),
+                ...(config.runtime.maxTurns === undefined ? {} : { maxTurns: config.runtime.maxTurns }),
+                ...(config.providers?.piNative?.piSessionsRoot === undefined
+                    ? {}
+                    : { piSessionsRoot: config.providers.piNative.piSessionsRoot }),
+                session: sessionOptions,
+                ...(config.concurrency?.maxConcurrentRuns === undefined && config.concurrency?.maxPendingRuns === undefined
+                    ? {}
+                    : {
+                        concurrency: {
+                            ...(config.concurrency?.maxConcurrentRuns === undefined
+                                ? {}
+                                : { maxConcurrentRuns: config.concurrency.maxConcurrentRuns }),
+                            ...(config.concurrency?.maxPendingRuns === undefined
+                                ? {}
+                                : { maxPendingRuns: config.concurrency.maxPendingRuns }),
+                        },
+                    }),
+                runtimeOptions,
+                ...(runtimeOptionsForRequest === undefined
+                    ? {}
+                    : { runtimeOptionsForRequest }),
+                ...(config.tools.mcpRequestContextServers === undefined
+                    ? {}
+                    : {
+                        mcpRequestContext: {
+                            serverNames: config.tools.mcpRequestContextServers,
+                            runOutputRoot: artifactDerivedRoots.outbound,
+                            ...(options.progressCapabilityIssuer === undefined
+                                ? {}
+                                : { progressCapabilityIssuer: options.progressCapabilityIssuer }),
+                        },
+                    }),
+                ...(config.tools.continuationServers === undefined || options.continuationCapabilityIssuer === undefined
+                    ? {}
+                    : {
+                        continuationContext: {
+                            serverNames: config.tools.continuationServers,
+                            capabilityIssuer: options.continuationCapabilityIssuer,
+                        },
+                    }),
+                ...(options.runtimeForModel === undefined ? {} : { runtimeForModel: options.runtimeForModel }),
+                ...(memory === undefined ? {} : { memory }),
+                memoryWriteMode: config.memory?.writeMode ?? "disabled",
+                ...(options.onMemoryWarning === undefined ? {} : { onMemoryWarning: options.onMemoryWarning }),
+                historyStore,
+                toolHistory,
+                ...(options.turnHistoryEnricher === undefined ? {} : { turnHistoryEnricher: options.turnHistoryEnricher }),
+                // Inbound channel attachments are saved here (under the artifacts dir, which
+                // sits inside a sandbox-readable root) so the agent can open them by path.
+                attachmentsDir: artifactDerivedRoots.attachments,
+                toolPolicy: createToolPolicy(toolPolicyInput(config)),
+                ...(harnessSandboxPolicy === undefined ? {} : { sandboxPolicy: harnessSandboxPolicy }),
+                recorderFactory: ({ runId, conversationId, userInput, source, sourceDetail, isolated }) => composeRunRecorder(recorderCompositionDeps(config, options, internalHooks), {
+                    runId,
+                    conversationId,
+                    runKind: "channel",
+                    ...(isolated === undefined ? {} : { isolated }),
+                    ...(userInput === undefined ? {} : { userInput }),
+                    ...(source === undefined ? {} : { source }),
+                    ...(sourceDetail === undefined ? {} : { sourceDetail }),
+                }),
+                ...(options.createRunId === undefined ? {} : { createRunId: options.createRunId }),
+                ...(options.now === undefined ? {} : { now: options.now }),
+            });
+            ownershipTransferred = true;
+            return harnessWithAgentRootOwnership(harness, ownership);
+        }
+        catch (error) {
+            await toolHistory?.release?.().catch(() => undefined);
+            throw error;
+        }
+    }
+    finally {
+        if (!ownershipTransferred) {
+            await releaseAgentRootOwnershipWhenIdle(ownership).catch(() => undefined);
+        }
+    }
+}
+function harnessWithAgentRootOwnership(harness, ownership) {
+    let disposePromise;
+    return {
+        run: harness.run.bind(harness),
+        ...(harness.submit === undefined ? {} : { submit: harness.submit.bind(harness) }),
+        ...(harness.offerLiveInput === undefined
             ? {}
-            : { runtimeOptionsForRequest }),
-        ...(config.tools.mcpRequestContextServers === undefined
+            : { offerLiveInput: harness.offerLiveInput.bind(harness) }),
+        ...(harness.cancel === undefined ? {} : { cancel: harness.cancel.bind(harness) }),
+        ...(harness.resetConversation === undefined
             ? {}
-            : {
-                mcpRequestContext: {
-                    serverNames: config.tools.mcpRequestContextServers,
-                    runOutputRoot: resolvePath(config.artifacts.dir, "outbound"),
-                    ...(options.progressCapabilityIssuer === undefined
-                        ? {}
-                        : { progressCapabilityIssuer: options.progressCapabilityIssuer }),
-                },
-            }),
-        ...(config.tools.continuationServers === undefined || options.continuationCapabilityIssuer === undefined
+            : { resetConversation: harness.resetConversation.bind(harness) }),
+        ...(harness.appendVerbatimTurn === undefined
             ? {}
-            : {
-                continuationContext: {
-                    serverNames: config.tools.continuationServers,
-                    capabilityIssuer: options.continuationCapabilityIssuer,
-                },
-            }),
-        ...(options.runtimeForModel === undefined ? {} : { runtimeForModel: options.runtimeForModel }),
-        ...(memory === undefined ? {} : { memory }),
-        memoryWriteMode: config.memory?.writeMode ?? "disabled",
-        ...(options.onMemoryWarning === undefined ? {} : { onMemoryWarning: options.onMemoryWarning }),
-        historyStore,
-        ...(options.turnHistoryEnricher === undefined ? {} : { turnHistoryEnricher: options.turnHistoryEnricher }),
-        // Inbound channel attachments are saved here (under the artifacts dir, which
-        // sits inside a sandbox-readable root) so the agent can open them by path.
-        attachmentsDir: resolvePath(config.artifacts.dir, "attachments"),
-        toolPolicy: createToolPolicy(toolPolicyInput(config)),
-        ...(config.sandbox === undefined ? {} : { sandboxPolicy: config.sandbox }),
-        recorderFactory: ({ runId, conversationId, userInput, source, sourceDetail, isolated }) => composeRunRecorder(recorderCompositionDeps(config, options, internalHooks), {
-            runId,
-            conversationId,
-            runKind: "channel",
-            ...(isolated === undefined ? {} : { isolated }),
-            ...(userInput === undefined ? {} : { userInput }),
-            ...(source === undefined ? {} : { source }),
-            ...(sourceDetail === undefined ? {} : { sourceDetail }),
-        }),
-        ...(options.createRunId === undefined ? {} : { createRunId: options.createRunId }),
-        ...(options.now === undefined ? {} : { now: options.now }),
-    });
+            : { appendVerbatimTurn: harness.appendVerbatimTurn.bind(harness) }),
+        dispose: () => {
+            disposePromise ??= Promise.resolve()
+                .then(async () => await harness.dispose?.())
+                .finally(async () => {
+                await releaseAgentRootOwnershipWhenIdle(ownership);
+            });
+            return disposePromise;
+        },
+    };
+}
+const TOOL_HISTORY_ACQUISITION_FAILURE_BACKOFF_MS = 30_000;
+const TOOL_HISTORY_ACQUISITION_FAILURE_BACKOFF_MAX_MS = 5 * 60_000;
+export function lazyConfiguredToolHistory(options) {
+    const failureBackoffMs = options.acquisitionFailureBackoffMs
+        ?? TOOL_HISTORY_ACQUISITION_FAILURE_BACKOFF_MS;
+    if (!Number.isSafeInteger(failureBackoffMs) || failureBackoffMs < 1) {
+        throw new TypeError("tool history acquisition failure backoff must be a positive integer.");
+    }
+    const failureBackoffMaxMs = options.acquisitionFailureBackoffMaxMs
+        ?? Math.max(TOOL_HISTORY_ACQUISITION_FAILURE_BACKOFF_MAX_MS, failureBackoffMs);
+    if (!Number.isSafeInteger(failureBackoffMaxMs)
+        || failureBackoffMaxMs < failureBackoffMs) {
+        throw new TypeError("tool history acquisition failure backoff maximum must be an integer at least as large as the initial backoff.");
+    }
+    const now = options.now ?? Date.now;
+    let sharedAttempt;
+    let latestTurnGeneration = 0;
+    const turnStates = new Map();
+    let resetTail = Promise.resolve();
+    let retirementTail = Promise.resolve();
+    let acquisitionOutage = false;
+    let consecutiveAcquisitionFailures = 0;
+    const reader = new ToolHistoryReader(options.root);
+    const warn = (message) => {
+        try {
+            options.onWarning?.(message);
+        }
+        catch { /* diagnostics are best-effort */ }
+    };
+    const turnKey = (conversationId, runId) => JSON.stringify([conversationId, runId]);
+    const stateFor = (conversationId, runId) => {
+        const key = turnKey(conversationId, runId);
+        const existing = turnStates.get(key);
+        if (existing !== undefined)
+            return existing;
+        const state = { generation: ++latestTurnGeneration };
+        if (sharedAttempt?.failed === true
+            && sharedAttempt.retryAtMs !== undefined
+            && now() < sharedAttempt.retryAtMs) {
+            state.attempt = sharedAttempt;
+        }
+        turnStates.set(key, state);
+        return state;
+    };
+    const failedPromise = (code) => {
+        const error = Object.assign(new Error("Tool history writer became unavailable; a fresh boundary must reacquire it."), { code });
+        const failure = Promise.reject(error);
+        void failure.catch(() => undefined);
+        return failure;
+    };
+    const nextFailureBackoffMs = () => {
+        let backoffMs = failureBackoffMs;
+        for (let index = 0; index < consecutiveAcquisitionFailures && backoffMs < failureBackoffMaxMs; index += 1) {
+            backoffMs = backoffMs > Math.floor(failureBackoffMaxMs / 2)
+                ? failureBackoffMaxMs
+                : Math.min(failureBackoffMaxMs, backoffMs * 2);
+        }
+        consecutiveAcquisitionFailures += 1;
+        return backoffMs;
+    };
+    const retire = (attempt) => {
+        if (attempt.retired || attempt.handle === undefined)
+            return;
+        attempt.retired = true;
+        retirementTail = retirementTail.then(async () => {
+            try {
+                await attempt.handle?.release();
+            }
+            catch { /* replacement acquisition must remain armed */ }
+        });
+    };
+    const latchExistingTurns = (attempt, failure) => {
+        const failedThrough = latestTurnGeneration;
+        for (const state of turnStates.values()) {
+            if (state.generation > failedThrough)
+                continue;
+            if (state.attempt === undefined || state.attempt === attempt)
+                state.failure = failure;
+        }
+    };
+    const invalidate = (attempt, code) => {
+        if (attempt.failed)
+            return attempt.failurePromise ?? attempt.promise;
+        const failure = failedPromise(code);
+        attempt.failed = true;
+        attempt.failurePromise = failure;
+        attempt.retryAtMs = now() + nextFailureBackoffMs();
+        latchExistingTurns(attempt, failure);
+        retire(attempt);
+        if (sharedAttempt === attempt) {
+            sharedAttempt = {
+                promise: failure,
+                failurePromise: failure,
+                failed: true,
+                retryAtMs: attempt.retryAtMs,
+                retired: true,
+            };
+        }
+        acquisitionOutage = true;
+        return failure;
+    };
+    const startAttempt = () => {
+        const acquisition = retirementTail.then(async () => await (options.acquireWriter ?? acquireToolHistoryWriter)({
+            root: options.root,
+            artifactRoot: options.artifactRoot,
+            ...(options.onWarning === undefined ? {} : { onWarning: options.onWarning }),
+        }));
+        const attempt = {
+            promise: acquisition,
+            failed: false,
+            retired: false,
+        };
+        attempt.promise = acquisition.then((handle) => {
+            attempt.handle = handle;
+            consecutiveAcquisitionFailures = 0;
+            if (acquisitionOutage) {
+                warn("Tool history writer acquisition recovered; lifecycle persistence resumed.");
+            }
+            acquisitionOutage = false;
+            return handle;
+        }).catch((error) => {
+            attempt.failed = true;
+            attempt.failurePromise = attempt.promise;
+            const retryBackoffMs = nextFailureBackoffMs();
+            attempt.retryAtMs = now() + retryBackoffMs;
+            latchExistingTurns(attempt, attempt.promise);
+            if (!acquisitionOutage) {
+                acquisitionOutage = true;
+                warn(`Tool history writer acquisition failed (${toolHistoryAcquisitionErrorCode(error)}); new turns fail fast for ${String(retryBackoffMs)} ms and repeated failures back off to ${String(failureBackoffMaxMs)} ms, while explicit reset may retry immediately.`);
+            }
+            throw error;
+        });
+        void attempt.promise.catch(() => undefined);
+        sharedAttempt = attempt;
+        return attempt;
+    };
+    const selectAttempt = (bypassFailureBackoff) => {
+        if (sharedAttempt !== undefined) {
+            if (sharedAttempt.handle?.writer.isClosed === true) {
+                invalidate(sharedAttempt, "history_writer_closed");
+            }
+            const withinFailureBackoff = sharedAttempt.retryAtMs !== undefined
+                && now() < sharedAttempt.retryAtMs;
+            if (!sharedAttempt.failed
+                || (!bypassFailureBackoff && withinFailureBackoff)) {
+                return sharedAttempt;
+            }
+            sharedAttempt = undefined;
+        }
+        return startAttempt();
+    };
+    const acquireForTurn = async (state) => {
+        if (state.failure !== undefined)
+            return await state.failure;
+        state.attempt ??= selectAttempt(false);
+        const handle = await state.attempt.promise;
+        if (handle.writer.isClosed) {
+            state.failure = invalidate(state.attempt, "history_writer_closed");
+            return await state.failure;
+        }
+        return handle;
+    };
+    const writer = {
+        createSink(binding) {
+            const state = stateFor(binding.conversationId, binding.runId);
+            return async (event) => {
+                const handle = await acquireForTurn(state);
+                try {
+                    const result = await handle.writer.persist(binding, event);
+                    const terminalCode = terminalToolHistoryWriterFailureCode(result, handle);
+                    if (terminalCode !== undefined && state.attempt !== undefined) {
+                        state.failure = invalidate(state.attempt, terminalCode);
+                    }
+                    return result;
+                }
+                catch (error) {
+                    const terminalCode = terminalToolHistoryWriterFailureCode(error, handle);
+                    if (terminalCode !== undefined && state.attempt !== undefined) {
+                        state.failure = invalidate(state.attempt, terminalCode);
+                    }
+                    throw error;
+                }
+            };
+        },
+        async finishRun(binding, status, failureKind) {
+            const key = turnKey(binding.conversationId, binding.runId);
+            const state = turnStates.get(key);
+            try {
+                if (state?.attempt === undefined || state.failure !== undefined)
+                    return;
+                const handle = await state.attempt.promise.catch(() => undefined);
+                try {
+                    await handle?.writer.finishRun(binding, status, failureKind);
+                }
+                catch (error) {
+                    if (handle === undefined)
+                        return;
+                    const terminalCode = terminalToolHistoryWriterFailureCode(error, handle);
+                    if (terminalCode === undefined)
+                        throw error;
+                    invalidate(state.attempt, terminalCode);
+                    return;
+                }
+                const terminalCode = handle === undefined
+                    ? undefined
+                    : terminalToolHistoryWriterFailureCode(undefined, handle);
+                if (terminalCode !== undefined)
+                    invalidate(state.attempt, terminalCode);
+            }
+            finally {
+                turnStates.delete(key);
+            }
+        },
+        async resetConversation(logicalConversationId) {
+            const reset = resetTail.then(async () => {
+                if (!await reader.exists())
+                    return;
+                // Reset is serialized and host-explicit, so it may bypass only the
+                // progressive post-failure cooldown. It still reuses a healthy/pending handle
+                // and every fresh acquisition keeps the full restart-handoff ceiling.
+                const observedAttempt = sharedAttempt;
+                if (observedAttempt !== undefined && !observedAttempt.failed) {
+                    await observedAttempt.promise.catch(() => undefined);
+                }
+                let recoveryRetriesRemaining = 1;
+                for (;;) {
+                    const attempt = selectAttempt(true);
+                    const handle = await attempt.promise;
+                    try {
+                        await handle.writer.resetConversation(logicalConversationId);
+                    }
+                    catch (error) {
+                        const terminalCode = reportedToolHistoryWriterFailureCode(error);
+                        if (terminalCode === undefined) {
+                            if (handle.writer.isClosed)
+                                invalidate(attempt, "history_writer_closed");
+                            throw error;
+                        }
+                        invalidate(attempt, terminalCode);
+                        if (recoveryRetriesRemaining === 0)
+                            throw error;
+                        recoveryRetriesRemaining -= 1;
+                        continue;
+                    }
+                    const terminalCode = terminalToolHistoryWriterFailureCode(undefined, handle);
+                    if (terminalCode !== undefined)
+                        invalidate(attempt, terminalCode);
+                    // A resolved reset was acknowledged only after its transaction
+                    // committed. Retire a concurrently closed handle, but never open a
+                    // second destructive reset window for an operation that succeeded.
+                    return;
+                }
+            });
+            resetTail = reset.then(() => undefined, () => undefined);
+            await reset;
+        },
+    };
+    return {
+        writer,
+        reader,
+        logicalConversationId: (conversationId) => toolHistoryLogicalConversationId(conversationId, options.rollover),
+        async release() {
+            const attempt = sharedAttempt;
+            sharedAttempt = undefined;
+            if (attempt !== undefined) {
+                await attempt.promise.catch(() => undefined);
+                retire(attempt);
+            }
+            await retirementTail;
+        },
+    };
+}
+function terminalToolHistoryWriterFailureCode(value, handle) {
+    return reportedToolHistoryWriterFailureCode(value)
+        ?? (handle.writer.isClosed ? "history_writer_closed" : undefined);
+}
+function reportedToolHistoryWriterFailureCode(value) {
+    const candidate = typeof value === "object" && value !== null
+        ? "errorCode" in value
+            ? value.errorCode
+            : "code" in value
+                ? value.code
+                : undefined
+        : undefined;
+    if (candidate === "history_writer_closed")
+        return candidate;
+    return undefined;
+}
+function toolHistoryAcquisitionErrorCode(error) {
+    const candidate = typeof error === "object" && error !== null && "code" in error
+        ? error.code
+        : undefined;
+    return typeof candidate === "string" && /^history_[a-z0-9_]+$/u.test(candidate)
+        ? candidate
+        : "history_writer_unavailable";
 }
 function configuredMemoryForHarness(config, memory) {
     if (memory instanceof MemoryRetrievalService || config.memory === undefined || !isSharedRecallStore(memory)) {
@@ -654,6 +1224,13 @@ function supportsSessionResume(model, executionMode) {
 // provider default (30s). The harness degrades recall to empty on timeout.
 const DEFAULT_EMBEDDINGS_TIMEOUT_MS = 10_000;
 export async function createConfiguredMemory(config, deps = {}) {
+    return await createConfiguredMemoryInternal(config, deps);
+}
+/** @internal App-only unsafe authority; deliberately absent from the package root. */
+export async function createConfiguredMemoryForApp(config, deps, protectionPosture) {
+    return await createConfiguredMemoryInternal(config, deps, protectionPosture);
+}
+async function createConfiguredMemoryInternal(config, deps, protectionPosture) {
     if (config.memory === undefined) {
         return undefined;
     }
@@ -705,7 +1282,7 @@ export async function createConfiguredMemory(config, deps = {}) {
         throw new Error(`memory.embeddings.apiKeyEnv ${embeddingsConfig.apiKeyEnv} is declared but has no resolved value; ` +
             `set ${embeddingsConfig.apiKeyEnv} before starting managed memory.`);
     }
-    const embeddings = search.createCircuitBreakerEmbeddingProvider(search.createEmbeddingProvider({
+    const embeddings = wrapOwnedDirectEmbeddingProvider(search.createCircuitBreakerEmbeddingProvider(search.createEmbeddingProvider({
         provider: embeddingsConfig?.provider ?? "ollama",
         model: embeddingsConfig?.model ?? "nomic-embed-text:v1.5",
         ...(embeddingsConfig?.endpoint !== undefined && { endpoint: embeddingsConfig.endpoint }),
@@ -718,7 +1295,7 @@ export async function createConfiguredMemory(config, deps = {}) {
         ...(embeddingsConfig?.circuitBreaker?.cooldownMs !== undefined && {
             cooldownMs: embeddingsConfig.circuitBreaker.cooldownMs,
         }),
-    });
+    }), config, deps.cwd ?? process.cwd(), protectionPosture);
     const dim = embeddingsConfig?.dim ?? 768;
     if (mode === "journal") {
         if (embeddingsConfig === undefined) {
@@ -746,7 +1323,7 @@ export async function createConfiguredMemory(config, deps = {}) {
     const recording = deps.observability === undefined
         ? undefined
         : recorderCompositionDeps(config, deps.observability);
-    const llm = configuredMemoryLlm(bujo, config, llmConfig, deps.memoryRuntime, recording);
+    const llm = configuredMemoryLlm(bujo, config, llmConfig, deps.memoryRuntime, recording, deps.cwd ?? process.cwd(), protectionPosture);
     if (llm === undefined) {
         throw new Error("memory.mode 'bujo' could not construct the required memory.llm.");
     }
@@ -773,16 +1350,16 @@ function configuredMemoryLlm(bujo, config, llmConfig,
 // Explicit memory-LLM runtime (tests). MUST be fallback-chain-free — see the
 // `memoryRuntime` doc on createConfiguredMemory. When undefined the memory LLM
 // builds its own fallback-free runtime so the per-call memory model is primary.
-memoryRuntimeOverride, recording) {
+memoryRuntimeOverride, recording, agentRoot, protectionPosture) {
     if (llmConfig === undefined) {
         return undefined;
     }
     if (llmConfig.provider === "ollama") {
         // The ollama memory LLM does not ride `runtime.run`, so it is not recorded.
-        return bujo.createOllamaLlm({
+        return wrapOwnedDirectMemoryLlm(bujo.createOllamaLlm({
             model: llmConfig.model,
             ...(llmConfig.endpoint !== undefined && { endpoint: llmConfig.endpoint }),
-        });
+        }), config, agentRoot, protectionPosture);
     }
     const model = parseMonoRuntimeModelReference(llmConfig.model);
     const executionMode = llmConfig.executionMode ?? defaultExecutionModeForModel(model);
@@ -795,7 +1372,7 @@ memoryRuntimeOverride, recording) {
     // channel runtime (which carries the fallback chain whose primary is
     // `config.runtime.model`) is intentionally NOT reused — see the `memoryRuntime`
     // doc on createConfiguredMemory.
-    const runtime = memoryRuntimeOverride ?? createMonoRuntime(runtimeHostOptionsForConfig(config));
+    const runtime = wrapPerRunOwnedConfiguredRuntime(memoryRuntimeOverride ?? createMonoRuntime(runtimeHostOptionsForConfig(config)), config, agentRoot, protectionPosture);
     return createAgentHostMemoryLlm({
         runtime,
         model,
@@ -812,6 +1389,113 @@ memoryRuntimeOverride, recording) {
             : {}),
     });
 }
+/**
+ * Memory completion is a model-running surface even when no channel harness is
+ * present. Acquire the canonical-root owner and protection generation for the
+ * exact duration of the provider call; release follows actual runtime
+ * settlement, never its abort signal.
+ */
+function wrapPerRunOwnedConfiguredRuntime(runtime, config, agentRoot, protectionPosture) {
+    return {
+        ...runtime,
+        async run(systemPrompt, runOptions) {
+            const ownership = await acquireAgentRootOwnership(agentRoot);
+            let requestLease;
+            try {
+                assertAgentRootLeaseOutsideWorkspace(ownership, config.runtime.workspace);
+                const loaded = await loadProcessJobsRootRegistryProtection(ownership.agentRoot, config.runtime.workspace);
+                ownership.coordinator.synchronizeGeneration(loaded.generation);
+                const boundary = await attestProcessJobsRootRegistrySnapshot(loaded, config.runtime.workspace);
+                requestLease = ownership.coordinator.acquireRequestLease(boundary.generation);
+                const attested = await attestProcessJobsRootRegistrySnapshot(boundary, config.runtime.workspace);
+                const protectedRoots = processJobsProtectionPolicyRoots(attested);
+                let effectiveOptions = runOptions;
+                if (protectedRoots.length > 0) {
+                    if (runOptions.model.sdk !== "pi")
+                        throw new Error(PROCESS_JOBS_PI_NATIVE_REQUIRED_ERROR);
+                    if (protectionPosture?.suppressSyntheticSandbox !== true) {
+                        const sandboxEngine = runOptions.sandboxEngine ?? createSrtSandboxEngine();
+                        if (!await sandboxEngine.isAvailable().catch(() => false)) {
+                            throw new Error(PROCESS_JOBS_PROTECTION_UNAVAILABLE_ERROR);
+                        }
+                        const sandboxPolicy = mergeSandboxPolicies(runOptions.sandboxPolicy, processJobsSandboxPolicy({ coreConfig: config, protectedRoots }));
+                        if (sandboxPolicy === undefined) {
+                            throw new Error(PROCESS_JOBS_PROTECTION_UNAVAILABLE_ERROR);
+                        }
+                        effectiveOptions = {
+                            ...runOptions,
+                            sandboxPolicy,
+                            sandboxEngine,
+                        };
+                    }
+                }
+                return await runtime.run(systemPrompt, effectiveOptions);
+            }
+            finally {
+                requestLease?.releaseAfterSettlement();
+                await releaseAgentRootOwnershipWhenIdle(ownership);
+            }
+        },
+    };
+}
+function wrapOwnedDirectMemoryLlm(llm, config, agentRoot, protectionPosture) {
+    return {
+        ...llm,
+        async complete(prompt, options) {
+            const ownership = await acquireAgentRootOwnership(agentRoot);
+            let requestLease;
+            try {
+                assertAgentRootLeaseOutsideWorkspace(ownership, config.runtime.workspace);
+                const loaded = await loadProcessJobsRootRegistryProtection(ownership.agentRoot, config.runtime.workspace);
+                ownership.coordinator.synchronizeGeneration(loaded.generation);
+                const boundary = await attestProcessJobsRootRegistrySnapshot(loaded, config.runtime.workspace);
+                requestLease = ownership.coordinator.acquireRequestLease(boundary.generation);
+                const attested = await attestProcessJobsRootRegistrySnapshot(boundary, config.runtime.workspace);
+                if (processJobsProtectionPolicyRoots(attested).length > 0
+                    && protectionPosture?.suppressSyntheticSandbox !== true) {
+                    throw new Error(PROCESS_JOBS_PI_NATIVE_REQUIRED_ERROR);
+                }
+                return await llm.complete(prompt, options);
+            }
+            finally {
+                requestLease?.releaseAfterSettlement();
+                await releaseAgentRootOwnershipWhenIdle(ownership);
+            }
+        },
+    };
+}
+/**
+ * Configured embedding providers execute outside the channel harness. Hold the
+ * same canonical-root owner and generation lease through the true embed()
+ * settlement, and reject the non-Pi provider before invocation whenever a
+ * retained process-job root makes native SRT confinement mandatory.
+ */
+function wrapOwnedDirectEmbeddingProvider(provider, config, agentRoot, protectionPosture) {
+    return {
+        ...provider,
+        async embed(texts) {
+            const ownership = await acquireAgentRootOwnership(agentRoot);
+            let requestLease;
+            try {
+                assertAgentRootLeaseOutsideWorkspace(ownership, config.runtime.workspace);
+                const loaded = await loadProcessJobsRootRegistryProtection(ownership.agentRoot, config.runtime.workspace);
+                ownership.coordinator.synchronizeGeneration(loaded.generation);
+                const boundary = await attestProcessJobsRootRegistrySnapshot(loaded, config.runtime.workspace);
+                requestLease = ownership.coordinator.acquireRequestLease(boundary.generation);
+                const attested = await attestProcessJobsRootRegistrySnapshot(boundary, config.runtime.workspace);
+                if (processJobsProtectionPolicyRoots(attested).length > 0
+                    && protectionPosture?.suppressSyntheticSandbox !== true) {
+                    throw new Error(PROCESS_JOBS_PI_NATIVE_REQUIRED_ERROR);
+                }
+                return await provider.embed(texts);
+            }
+            finally {
+                requestLease?.releaseAfterSettlement();
+                await releaseAgentRootOwnershipWhenIdle(ownership);
+            }
+        },
+    };
+}
 const MEMORY_LLM_SYSTEM_PROMPT = [
     "You are the private memory maintenance LLM for mono-agent.",
     "Return only the requested JSON or plain text.",