@nylorun/runtime 0.10.0-beta → 0.11.0-beta

package/dist/tenant/scheduler.d.ts

@@ -0,0 +1,25 @@
+import type { TenantContext } from "./context.js";
+import { type AdvanceAbortKind } from "./worker.js";
+export interface WorkState {
+    /** Advances running on this process, by session id. */
+    readonly running: Map<string, AbortController>;
+}
+export declare function createWorkState(): WorkState;
+/**
+ * Abort the advance of `id` if it runs on this process. Cancel calls it after committing
+ * `cancelled`, and so does the control stream for cancels made elsewhere.
+ */
+export declare function abortLocal(ctx: TenantContext, id: string, kind?: AdvanceAbortKind): void;
+/** Reset: abort every advance running on this process; their sessions are being cleared. */
+export declare function clearWork(ctx: TenantContext): void;
+/** Stop new advances; cancel active turns if asked; wait for running advances until the timeout. */
+export declare function drain(ctx: TenantContext, activeWork: "drain" | "cancel", timeoutMs: number): Promise<void>;
+/** Abort every advance running on this process; closing the Tenant is a `shutdown`. */
+export declare function abortAll(ctx: TenantContext, kind?: AdvanceAbortKind): void;
+/**
+ * Close: wait until no advance runs on this process, for at most `timeoutMs`. Advances still
+ * running then (an effect that ignores its abort signal) are abandoned and logged: they have
+ * stopped renewing their lease, so it lapses and the next advance takes the session over
+ * (§11.4); the epoch fences anything they still try to write. Returns their session ids.
+ */
+export declare function waitForIdle(ctx: TenantContext, timeoutMs: number): Promise<string[]>;

package/dist/tenant/scheduler.js

@@ -0,0 +1,84 @@
+/**
+ * Local work: the advances running on this process, for `abortLocal`, drain, reset and close.
+ *
+ * Scheduling itself lives behind `DurableExecution` (`ctx.wake`), the Tenant's handlers in
+ * `worker.ts`, `advance.ts` and `sweep.ts`. What stays here is only what one process must
+ * know about the advances it runs: their `AbortController`s, keyed by session id.
+ *
+ * Every abort carries an `AdvanceAbort` saying why (`worker.ts`): a cancel or a reset aborts
+ * with `cancel`, closing the Tenant with `shutdown`, which leaves the session for the next
+ * advance instead of settling it.
+ */
+import { randomUUID } from "node:crypto";
+import { command } from "./commands.js";
+import { AdvanceAbort } from "./worker.js";
+export function createWorkState() {
+    return { running: new Map() };
+}
+const MESSAGES = {
+    cancel: "Turn cancelled",
+    shutdown: "The Tenant is closing",
+    deadline: "The advance ran past its deadline",
+    "ownership.lost": "Ownership lost",
+};
+function abortWith(controller, kind) {
+    if (!controller.signal.aborted)
+        controller.abort(new AdvanceAbort(kind, MESSAGES[kind]));
+}
+/**
+ * Abort the advance of `id` if it runs on this process. Cancel calls it after committing
+ * `cancelled`, and so does the control stream for cancels made elsewhere.
+ */
+export function abortLocal(ctx, id, kind = "cancel") {
+    const controller = ctx.work.running.get(id);
+    if (controller)
+        abortWith(controller, kind);
+}
+/** Reset: abort every advance running on this process; their sessions are being cleared. */
+export function clearWork(ctx) {
+    abortAll(ctx, "cancel");
+}
+/** Stop new advances; cancel active turns if asked; wait for running advances until the timeout. */
+export async function drain(ctx, activeWork, timeoutMs) {
+    ctx.closing = true;
+    if (activeWork === "cancel") {
+        const active = await ctx.store.tx((t) => t.sessionsWithStatus(["running", "runnable", "paused"]));
+        for (const sess of active)
+            if (sess.activeTurnId)
+                await command(ctx, sess.id, {
+                    type: "cancel",
+                    requestId: randomUUID(),
+                    idempotencyKey: `drain-cancel-${sess.id}-${sess.activeTurnId}`,
+                    reason: "tenant drain cancel",
+                }, {
+                    kind: "application",
+                    principalId: "drain",
+                });
+    }
+    const deadline = Date.now() + timeoutMs;
+    while (ctx.work.running.size > 0 && Date.now() < deadline)
+        await new Promise((resolve) => setTimeout(resolve, 10));
+}
+/** Abort every advance running on this process; closing the Tenant is a `shutdown`. */
+export function abortAll(ctx, kind = "shutdown") {
+    for (const c of ctx.work.running.values())
+        abortWith(c, kind);
+}
+/**
+ * Close: wait until no advance runs on this process, for at most `timeoutMs`. Advances still
+ * running then (an effect that ignores its abort signal) are abandoned and logged: they have
+ * stopped renewing their lease, so it lapses and the next advance takes the session over
+ * (§11.4); the epoch fences anything they still try to write. Returns their session ids.
+ */
+export async function waitForIdle(ctx, timeoutMs) {
+    const deadline = Date.now() + timeoutMs;
+    while (ctx.work.running.size > 0 && Date.now() < deadline)
+        await new Promise((resolve) => setTimeout(resolve, 10));
+    const abandoned = [...ctx.work.running.keys()];
+    if (abandoned.length > 0)
+        ctx.config.logger.warn("tenant closed with advances still running", {
+            sessionIds: abandoned,
+            waitedMs: timeoutMs,
+        });
+    return abandoned;
+}

package/dist/tenant/session.d.ts

@@ -0,0 +1,60 @@
+/**
+ * Pure helpers over the session document: turn-manifest pins and variants, state rebasing,
+ * the tools of an MCP snapshot, and the event target of an Action. No store access and no I/O.
+ *
+ * Later waves: stable; the async store conversion (Wave 1 / A) does not change these.
+ */
+import { type DurableSessionTool, type HostEffect } from "@nylorun/harness/run";
+import type { Action } from "@nylorun/core/contracts";
+import { type AgentManifest, type JsonValue } from "@nylorun/core/define";
+import { type TurnManifestStore } from "../core/turn-manifest.js";
+import type { McpSnapshot, McpToolRecord } from "../mcp/snapshot.js";
+import type { Session } from "./context.js";
+export declare function sessionToolsOf(snapshot: McpSnapshot | undefined): readonly DurableSessionTool[] | undefined;
+/** Turn-manifest store backed by the session's `variants` map (no schema change). */
+export declare function variantStore(session: Session): TurnManifestStore;
+/** Manifest this turn's checkpoint is pinned to (session pin or a stored variant). */
+export declare function turnManifestOf(session: Session): AgentManifest;
+/** Wrap a linked agent turn so the Loop learns the turn's manifest (SD-I4 pin stays on session). */
+export declare function linkedAgentOutput(session: Session, output: JsonValue | undefined): JsonValue;
+export declare function rebaseSessionState(session: Session, turnHash: string): void;
+export declare function mcpToolOf(session: Session, request: Pick<HostEffect, "agent" | "capabilityId" | "toolName">): McpToolRecord | undefined;
+/** The manifest of the agent an effect belongs to: the root, or an agent it uses as a tool. */
+export declare function manifestFor(manifest: AgentManifest, agent: HostEffect["agent"]): AgentManifest | undefined;
+export declare function pinnedTool(manifest: AgentManifest, capabilityId?: string, toolName?: string): import("@nylorun/core/define").ToolManifest | undefined;
+/** What an action runs, for events: a tool name, or a hook point and its capabilities. */
+export declare function actionTarget(action: Action): {
+    hook: {
+        at: "after" | "before";
+        scope: "step" | "turn";
+        capabilityIds: string[];
+    };
+    agent?: {
+        id: string;
+        path: string;
+        delegationId?: string | undefined;
+    } | undefined;
+} | {
+    toolName: string;
+    agent?: {
+        id: string;
+        path: string;
+        delegationId?: string | undefined;
+    } | undefined;
+} | {
+    path: string;
+    key: string;
+    agent?: {
+        id: string;
+        path: string;
+        delegationId?: string | undefined;
+    } | {
+        id: string;
+        path: string;
+        delegationId?: string | undefined;
+    } | {
+        id: string;
+        path: string;
+        delegationId?: string | undefined;
+    } | undefined;
+};

package/dist/tenant/session.js

@@ -0,0 +1,94 @@
+/**
+ * Pure helpers over the session document: turn-manifest pins and variants, state rebasing,
+ * the tools of an MCP snapshot, and the event target of an Action. No store access and no I/O.
+ *
+ * Later waves: stable; the async store conversion (Wave 1 / A) does not change these.
+ */
+import { agentTurnValue, } from "@nylorun/harness/run";
+import { delegateManifest, } from "@nylorun/core/define";
+import { isWorkflowManifest } from "../core/flow-host.js";
+import { allowedManifestHashes, rebaseTurnState, } from "../core/turn-manifest.js";
+export function sessionToolsOf(snapshot) {
+    if (!snapshot?.mcpTools.length)
+        return undefined;
+    return snapshot.mcpTools.map((tool) => ({
+        ...(tool.agentId === undefined ? {} : { agentId: tool.agentId }),
+        capabilityId: tool.capabilityId,
+        name: tool.name,
+        ...(tool.description === undefined
+            ? {}
+            : { description: tool.description }),
+        inputSchema: tool.inputSchema,
+        ...(tool.outputSchema === undefined
+            ? {}
+            : { outputSchema: tool.outputSchema }),
+    }));
+}
+/** Turn-manifest store backed by the session's `variants` map (no schema change). */
+export function variantStore(session) {
+    return {
+        get(hash) {
+            return session.variants?.[hash];
+        },
+        put(hash, manifest) {
+            session.variants = { ...(session.variants ?? {}), [hash]: manifest };
+        },
+    };
+}
+/** Manifest this turn's checkpoint is pinned to (session pin or a stored variant). */
+export function turnManifestOf(session) {
+    const hash = session.checkpoint?.manifestHash;
+    if (!hash || hash === session.manifestHash)
+        return session.manifest;
+    return session.variants?.[hash] ?? session.manifest;
+}
+/** Wrap a linked agent turn so the Loop learns the turn's manifest (SD-I4 pin stays on session). */
+export function linkedAgentOutput(session, output) {
+    if (isWorkflowManifest(session.manifest))
+        return output ?? null;
+    return agentTurnValue(output ?? null, turnManifestOf(session));
+}
+export function rebaseSessionState(session, turnHash) {
+    const allowed = allowedManifestHashes({
+        pinnedHash: session.manifestHash,
+        variantHashes: Object.keys(session.variants ?? {}),
+    });
+    const next = rebaseTurnState({
+        state: session.state,
+        turnManifestHash: turnHash,
+        isAllowedHash: (hash) => allowed.has(hash),
+    });
+    if (next !== session.state)
+        session.state = next;
+}
+export function mcpToolOf(session, request) {
+    return session.mcpSnapshot?.mcpTools.find((tool) => tool.agentId === request.agent?.id &&
+        tool.capabilityId === request.capabilityId &&
+        tool.name === request.toolName);
+}
+/** The manifest of the agent an effect belongs to: the root, or an agent it uses as a tool. */
+export function manifestFor(manifest, agent) {
+    return agent ? delegateManifest(manifest, agent.id) : manifest;
+}
+export function pinnedTool(manifest, capabilityId, toolName) {
+    const capability = manifest.capabilities.find((item) => item.id === capabilityId);
+    return capability?.tools?.find((tool) => tool.name === toolName);
+}
+/** What an action runs, for events: a tool name, or a hook point and its capabilities. */
+export function actionTarget(action) {
+    if (action.kind === "hook")
+        return {
+            hook: action.hook,
+            ...(action.agent ? { agent: action.agent } : {}),
+        };
+    if (action.kind === "tool" && "toolName" in action)
+        return {
+            toolName: action.toolName,
+            ...(action.agent ? { agent: action.agent } : {}),
+        };
+    return {
+        path: action.path,
+        key: action.key,
+        ...(action.agent ? { agent: action.agent } : {}),
+    };
+}

package/dist/tenant/sessions.d.ts

@@ -0,0 +1,34 @@
+/**
+ * Session and definition resources: `PUT/GET /v1/agents`, `PUT /v1/sessions/:id` (create or
+ * re-attach vaults), the session list and the session view. Reads use the store's typed
+ * queries; `PUT /v1/sessions/:id` runs in one transaction with the vault attachment checks.
+ */
+import { type PutAgentRequest, type PutSessionRequest } from "@nylorun/core/contracts";
+import type { Tx } from "../store/types.js";
+import { type Session, type TenantContext } from "./context.js";
+export declare function listDefinitions(ctx: TenantContext): Promise<{
+    agents: {
+        agentId: any;
+        manifest: any;
+        manifestHash: string;
+        implementationVersion: string;
+    }[];
+}>;
+export declare function putDefinition(ctx: TenantContext, agentId: string, body: PutAgentRequest): Promise<{
+    agentId: string;
+    manifestHash: string;
+    implementationVersion: string;
+}>;
+export declare function listSessions(ctx: TenantContext, agentId: string | null): Promise<{
+    sessions: {
+        id: string;
+        agentId: string;
+        ownerUserId: string;
+        status: string;
+        activeTurnId: string | null;
+    }[];
+}>;
+/** Create a session from its definition, or re-attach vaults to an identical one. */
+export declare function putSession(ctx: TenantContext, id: string, body: PutSessionRequest): Promise<Session>;
+/** The session resource returned by `GET`/`PUT /v1/sessions/:id`. */
+export declare function sessionView(t: Tx, s: Session): Promise<unknown>;

package/dist/tenant/sessions.js

@@ -0,0 +1,149 @@
+/**
+ * Session and definition resources: `PUT/GET /v1/agents`, `PUT /v1/sessions/:id` (create or
+ * re-attach vaults), the session list and the session view. Reads use the store's typed
+ * queries; `PUT /v1/sessions/:id` runs in one transaction with the vault attachment checks.
+ */
+import { DefinitionDocumentSchema, } from "@nylorun/core/contracts";
+import { hashManifest } from "@nylorun/core/compatibility";
+import { aggregateWaits, isWorkflowManifest } from "../core/flow-host.js";
+import { canonical } from "../store/canonical.js";
+import { newStreamIncarnation } from "../streams/types.js";
+import { validateSandboxAttach } from "../core/sandbox-routes.js";
+import { sandboxLookup } from "./context.js";
+import { fail } from "./http.js";
+/** A session's creation identity: everything but the request id and vault attachments. */
+const sessionIdentity = (value) => {
+    const { requestId: _requestId, vaultIds: _vaultIds, credentialSelections: _selections, ...body } = value ?? {};
+    return canonical(body);
+};
+export async function listDefinitions(ctx) {
+    const definitions = await ctx.store.tx((t) => t.listDefinitions());
+    return {
+        agents: definitions.map((d) => ({
+            agentId: d.manifest.id,
+            manifest: d.manifest,
+            manifestHash: d.manifestHash,
+            implementationVersion: d.implementationVersion,
+        })),
+    };
+}
+export async function putDefinition(ctx, agentId, body) {
+    if (body.manifest.id !== agentId)
+        fail(400, "Agent id mismatch");
+    DefinitionDocumentSchema.parse(body.manifest);
+    const definition = {
+        ...body,
+        manifestHash: hashManifest(body.manifest),
+    };
+    await ctx.store.tx((t) => t.put("definitions", agentId, definition));
+    return {
+        agentId,
+        manifestHash: definition.manifestHash,
+        implementationVersion: body.implementationVersion,
+    };
+}
+export async function listSessions(ctx, agentId) {
+    const sessions = await ctx.store.tx((t) => t.listSessions(agentId === null ? {} : { agentId }));
+    return {
+        sessions: sessions.map((s) => ({
+            id: s.id,
+            agentId: s.agentId,
+            ownerUserId: s.ownerUserId,
+            status: s.status,
+            activeTurnId: s.activeTurnId,
+        })),
+    };
+}
+/** Create a session from its definition, or re-attach vaults to an identical one. */
+export function putSession(ctx, id, body) {
+    const vaultIds = body.vaultIds ?? [];
+    const credentialSelections = body.credentialSelections ?? [];
+    return ctx.store.tx(async (t) => {
+        const prior = await t.lockSession(id);
+        const definition = prior === undefined || body.sandbox
+            ? (await t.get("definitions", body.agentId)) ??
+                fail(404, "Definition not found")
+            : undefined;
+        const sandboxOwnerId = body.sandbox
+            ? validateSandboxAttach(body, (definition ?? prior).manifest, await sandboxLookup(t, body.sandbox.session))
+            : undefined;
+        await ctx.vault.assertAttachment(t, body.ownerUserId, vaultIds, credentialSelections);
+        if (prior) {
+            if (sessionIdentity(prior.creation) !== sessionIdentity(body))
+                fail(409, "Session already exists with different creation parameters");
+            prior.vaultIds = vaultIds;
+            prior.credentialSelections = credentialSelections;
+            prior.creation = body;
+            if (sandboxOwnerId !== undefined)
+                prior.sandboxOwnerId = sandboxOwnerId;
+            await t.put("sessions", id, prior);
+            await ctx.vault.recordAttachment(t, id, vaultIds);
+            return prior;
+        }
+        const created = {
+            id,
+            agentId: body.agentId,
+            ownerUserId: body.ownerUserId,
+            manifest: definition.manifest,
+            manifestHash: definition.manifestHash,
+            implementationVersion: definition.implementationVersion,
+            info: body.info,
+            status: "idle",
+            activeTurnId: null,
+            creation: body,
+            vaultIds,
+            credentialSelections,
+            pluginRoots: definition.pluginRoots ?? {},
+            ...(sandboxOwnerId !== undefined ? { sandboxOwnerId } : {}),
+            streamIncarnation: newStreamIncarnation(),
+        };
+        await t.put("sessions", id, created);
+        await ctx.vault.recordAttachment(t, id, vaultIds);
+        return created;
+    });
+}
+/** The session resource returned by `GET`/`PUT /v1/sessions/:id`. */
+export async function sessionView(t, s) {
+    let waits = Array.isArray(s.waits)
+        ? s.waits.map((call) => ({
+            invocationId: call.invocationId,
+            interaction: call.interaction,
+            wait: call.wait,
+            status: call.status,
+        }))
+        : s.waits;
+    if (isWorkflowManifest(s.manifest)) {
+        const aggregated = await aggregateWaits({ t, workflowSessionId: s.id });
+        if (aggregated.length > 0)
+            waits = aggregated;
+    }
+    const actions = await t.actionsForSession(s.id, {
+        statuses: ["pending", "claimed", "uncertain"],
+    });
+    const uncertain = await t.effectsForSession(s.id, {
+        statuses: ["uncertain"],
+    });
+    return {
+        id: s.id,
+        agentId: s.agentId,
+        ownerUserId: s.ownerUserId,
+        manifestHash: s.manifestHash,
+        implementationVersion: s.implementationVersion,
+        status: s.status,
+        activeTurnId: s.activeTurnId,
+        vaultIds: s.vaultIds ?? [],
+        credentialSelections: s.credentialSelections ?? [],
+        sandboxOwnerId: s.sandboxOwnerId ?? null,
+        mcpSnapshot: s.mcpSnapshot ?? null,
+        mcpDiagnostics: s.mcpDiagnostics ?? [],
+        waits,
+        error: s.error,
+        actions,
+        uncertainEffects: uncertain.map((e) => ({
+            effectId: e.request.effectId,
+            turnId: e.request.turnId,
+            kind: e.request.kind,
+            error: e.error,
+        })),
+    };
+}

package/dist/tenant/status.d.ts

@@ -1,20 +1,29 @@
 import type { SeedTenantConfigRequest, SeedTenantConfigResponse, TenantStatus } from "@nylorun/core/contracts";
-import type { Store } from "../core/store.js";
+import type { SessionStore } from "../store/types.js";
 import type { ExecutorRegistry } from "../core/executors.js";
 import type { VaultService } from "../vault/service.js";
 import type { SandboxManager } from "../sandbox/manager.js";
 import type { TenantConfig } from "./types.js";
 import type { TenantEnvelope } from "@nylorun/core/contracts";
+import type { StuckInvocation } from "../execution/types.js";
+import type { StreamsStatus } from "./streams.js";
 export interface TenantStatusContext {
     envelope: TenantEnvelope;
     config: TenantConfig;
-    store: Store;
+    store: SessionStore;
     registry: ExecutorRegistry;
     vault: VaultService;
     sandbox: SandboxManager;
     closing: boolean;
     modelConfigured: boolean;
     executorStreams: Map<string, Set<unknown>>;
+    /**
+     * This Tenant's execution invocations that need an operator (`TenantExecution`). Absent
+     * when the execution cannot report them.
+     */
+    stuckInvocations?: () => Promise<StuckInvocation[]>;
+    /** This Tenant's Durable Streams status (`streamsStatus` in `streams.ts`). */
+    streamsStatus?: () => Promise<StreamsStatus>;
 }
 /** Build `TenantStatusSchema` with secrets redacted (A14). */
 export declare function buildTenantStatus(ctx: TenantStatusContext): Promise<TenantStatus>;
@@ -23,6 +32,6 @@ export declare function buildTenantStatus(ctx: TenantStatusContext): Promise<Ten
  * Response lists field names only; never secret values.
  */
 export declare function seedTenantConfig(ctx: {
-    store: Store;
+    store: SessionStore;
     vault: VaultService;
-}, body: SeedTenantConfigRequest): SeedTenantConfigResponse;
+}, body: SeedTenantConfigRequest): Promise<SeedTenantConfigResponse>;

package/dist/tenant/status.js

@@ -1,28 +1,57 @@
-import { readTenantSetting, schemaVersionOf, TENANT_SCHEMA_VERSION, writeTenantSetting, } from "./schema.js";
-/** Build `TenantStatusSchema` with secrets redacted (A14). */
-export async function buildTenantStatus(ctx) {
-    const sessions = ctx.store.all("sessions");
-    const runningSessions = sessions.filter((s) => s.status === "running" || s.status === "runnable").length;
-    const pendingActions = ctx.store
-        .all("actions")
-        .filter((a) => a.status === "pending" || a.status === "claimed").length;
-    const uncertainEffects = ctx.store
-        .all("effects")
-        .filter((e) => e.status === "uncertain").length;
-    let sqlite = false;
+import { FIXTURE_MODEL_SETTING, seedFixtureModel } from "./model-setting.js";
+/** How long status waits for the execution to list stuck invocations. */
+const STUCK_TIMEOUT_MS = 5000;
+/** `TenantStatus.execution`: paused and backing-off invocations, or why they are unknown. */
+async function executionStatus(stuckInvocations) {
+    let timer;
     try {
-        ctx.store.db.prepare("SELECT 1").get();
-        sqlite = true;
+        const stuck = await Promise.race([
+            stuckInvocations(),
+            new Promise((_, reject) => {
+                timer = setTimeout(() => reject(new Error("Timed out listing stuck invocations")), STUCK_TIMEOUT_MS);
+            }),
+        ]);
+        return {
+            stuckInvocations: stuck.map((invocation) => ({
+                id: invocation.id,
+                status: invocation.status,
+                service: invocation.service,
+                handler: invocation.handler,
+                key: invocation.key,
+                retryCount: invocation.retryCount,
+                ...(invocation.lastFailure !== undefined
+                    ? { lastFailure: invocation.lastFailure }
+                    : {}),
+                ...(invocation.modifiedAt !== undefined
+                    ? { modifiedAt: invocation.modifiedAt }
+                    : {}),
+            })),
+        };
+    }
+    catch (error) {
+        return {
+            stuckInvocations: [],
+            error: error instanceof Error ? error.message : String(error),
+        };
     }
-    catch {
-        sqlite = false;
+    finally {
+        clearTimeout(timer);
     }
-    const schemaOk = schemaVersionOf(ctx.store.db) === TENANT_SCHEMA_VERSION;
-    const modelView = ctx.vault.getHostModel();
-    const sandboxReport = await ctx.sandbox.report();
-    const retained = ctx.store.all("sandboxes").length;
-    const definitionIds = new Set(ctx.store
-        .all("definitions")
+}
+/** Build `TenantStatusSchema` with secrets redacted (A14). */
+export async function buildTenantStatus(ctx) {
+    const health = await ctx.store.health();
+    const { counts, definitions } = await ctx.store.tx(async (t) => ({
+        counts: await t.counts(),
+        definitions: await t.listDefinitions(),
+    }));
+    const [modelView, sandboxReport, execution, streams] = await Promise.all([
+        ctx.vault.getHostModel(),
+        ctx.sandbox.report(),
+        ctx.stuckInvocations ? executionStatus(ctx.stuckInvocations) : undefined,
+        ctx.streamsStatus?.(),
+    ]);
+    const definitionIds = new Set(definitions
         .map((d) => d.manifest?.id)
         .filter((id) => typeof id === "string"));
     const executorIds = new Set(ctx.registry.list().map((e) => e.agentId));
@@ -40,50 +69,56 @@ export async function buildTenantStatus(ctx) {
         tenant: ctx.envelope,
         path: ctx.config.paths.root,
         checks: {
-            sqlite,
+            store: health.schemaVersion > 0,
             scheduler: !ctx.closing,
             model: ctx.modelConfigured || modelView.configured,
             executors: true,
-            schema: schemaOk,
+            schema: health.ok,
         },
         model: modelView,
         agents,
         counts: {
-            sessions: sessions.length,
-            runningSessions,
-            pendingActions,
-            uncertainEffects,
+            sessions: counts.sessions,
+            runningSessions: counts.runningSessions,
+            pendingActions: counts.pendingActions,
+            uncertainEffects: counts.uncertainEffects,
         },
         sandbox: {
             backend: sandboxReport.backend,
-            retained,
+            retained: counts.sandboxes,
         },
+        ...(execution ? { execution } : {}),
+        ...(streams ? { streams } : {}),
     };
 }
 /**
  * Insert-if-absent Tenant configuration seed (A18).
  * Response lists field names only; never secret values.
  */
-export function seedTenantConfig(ctx, body) {
+export async function seedTenantConfig(ctx, body) {
     const applied = [];
     const kept = [];
-    if (body.sandbox?.backend) {
-        const existing = readTenantSetting(ctx.store.db, "sandbox.backend");
-        if (existing === undefined) {
-            writeTenantSetting(ctx.store.db, "sandbox.backend", body.sandbox.backend);
-            applied.push("sandbox.backend");
-        }
-        else {
-            kept.push("sandbox.backend");
-        }
+    const backend = body.sandbox?.backend;
+    if (backend) {
+        const inserted = await ctx.store.tx(async (t) => {
+            if ((await t.getSetting("sandbox.backend")) !== undefined)
+                return false;
+            await t.putSetting("sandbox.backend", backend);
+            return true;
+        });
+        (inserted ? applied : kept).push("sandbox.backend");
+    }
+    if (body.fixtureModel) {
+        const inserted = await ctx.store.tx((t) => seedFixtureModel(t));
+        (inserted ? applied : kept).push(FIXTURE_MODEL_SETTING);
     }
     if (body.model) {
-        const current = ctx.vault.getHostModel();
+        const current = await ctx.vault.getHostModel();
         if (current.configured) {
             kept.push("model");
         }
         else {
-            ctx.vault.putHostModel({
+            await ctx.vault.putHostModel({
                 requestId: body.requestId,
                 idempotencyKey: `seed-model:${body.requestId}`,
                 ...body.model,