@nylorun/runtime 0.11.0-beta → 0.12.0-beta

package/CHANGELOG.md

@@ -1,5 +1,45 @@
 # Changelog
 
+## 0.12.0-beta
+
+### Minor Changes
+
+- a322696: **Derived principals** (optional Host feature `derived-principals`): a client that holds the admin key no longer needs to store an application key.
+
+  - `admin.createTenant({ name, principals: ["babai"] })` registers each named principal by the hash of its derived key, and `admin.deriveTenantKey(tenantId, principalId)` (or `deriveTenantKey(adminKey, tenantId, principalId)`) recomputes the key when needed.
+  - `POST /v1/admin/tenants` accepts `derivedPrincipals: [{ id, credentialHash }]`. Ids match `^[a-z][a-z0-9-]{0,31}$` and `studio` is reserved; duplicate ids or credentials answer `400`. A retried create must name the same principals.
+  - `createTenant` with `principals` throws `incompatible_host` before sending anything to a Host without the feature.
+
+- 844bff3: **Act for a person: `Nylorun-Subject` and `Nylorun-Scopes`.** An app server that holds the Tenant key can name the person each request is for, and the Runtime enforces it (optional Host feature `subject-headers`).
+
+  - `client.as(subject, { scopes })` in `@nylorun/agents` sends both headers on every call, event streams included. Scopes: `agents:read`, `agents:write`, `sessions:own`, `vaults:own`, `tenant:settings`; default `["sessions:own"]`.
+  - The Runtime limits a subject to the routes its scopes allow (`403 scope_required`) and to its own sessions and vaults: another owner's session, vault or sandbox is the same `404` as a missing one, including `PUT` on its session id (was `409`). Reset, config seed, executors, actions and the sandbox tool routes are open to no subject. Only application keys may send the headers.
+  - The AG-UI handler calls the Runtime as each person and requires `subject-headers`; new optional `scopes` option. The host's `session()` parameters can no longer replace a session's id, agent or owner.
+  - Core exports `SUBJECT_HEADER`, `SCOPES_HEADER`, `SUBJECT_SCOPES` and `parseSubjectHeaders`. Postgres Tenant schemas migrate to version 2 (an indexed session owner column).
+
+  Requests without `Nylorun-Subject` are unchanged.
+
+- a322696: **The session log now carries what a chat UI shows** (optional Host feature `transcript-events`).
+
+  - `message.assistant` for each completed model step: `{ invocationId, text, toolCalls: [{ callId, name, input }], agent? }`.
+  - `tool.completed` for an MCP or sandbox tool: `{ invocationId, callId, capabilityId, toolName, output }`, or `error: { code, message }` for a tool error.
+  - Tool `action.pending` and `action.completed` events, and `delegation.started` / `delegation.completed`, carry the model's `callId` (and `invocationId` on actions).
+  - Events are written in the transaction that completes the effect, so a replay writes none.
+  - `@nylorun/core/contracts` adds payload schemas and `parseTranscriptEvent(event)`; `LiveEvent.payload` stays `unknown`.
+
+  Fix: a tool with both `approval` and an `output` schema now pauses for approval. The Runtime validated its `interaction-required` result against the output schema and failed the tool with `tool.invalid-output`; `denied`, `interaction-required` and `deferred` results are no longer validated.
+
+### Patch Changes
+
+- Pin core to the tested release.
+- Pin harness to the tested release.
+- Updated dependencies [a322696]
+- Updated dependencies [844bff3]
+- Updated dependencies [a322696]
+- Updated dependencies
+  - @nylorun/core@0.7.0-beta
+  - @nylorun/harness@0.19.2-beta
+
 ## 0.11.0-beta
 
 ### Minor Changes

package/dist/core/sandbox-routes.d.ts

@@ -37,4 +37,8 @@ export declare function validateSandboxAttach(body: {
     sandbox?: {
         session: string;
     };
-}, newManifest: SessionSandboxRef["manifest"], lookup: (id: string) => SessionSandboxRef | undefined): string | undefined;
+}, newManifest: SessionSandboxRef["manifest"], lookup: (id: string) => SessionSandboxRef | undefined, 
+/** Acting for a subject: another owner's session is the 404 of a missing one. */
+options?: {
+    opaque?: boolean;
+}): string | undefined;

package/dist/core/sandbox-routes.js

@@ -85,12 +85,14 @@ export async function handleActionSandboxTool(deps, actionId, toolName, body, si
     return runTool(deps, read, tool, toolInput(body), signal);
 }
 /** Validate PutSession.sandbox attach: same owner, identical specs. */
-export function validateSandboxAttach(body, newManifest, lookup) {
+export function validateSandboxAttach(body, newManifest, lookup, 
+/** Acting for a subject: another owner's session is the 404 of a missing one. */
+options = {}) {
     const share = body.sandbox?.session;
     if (!share)
         return undefined;
     const owner = lookup(share);
-    if (!owner)
+    if (!owner || (options.opaque && owner.ownerUserId !== body.ownerUserId))
         throw new SandboxRouteError(404, "Sandbox session not found");
     if (owner.ownerUserId !== body.ownerUserId)
         throw new SandboxRouteError(403, "Sandbox session must belong to the same owner");

package/dist/host/create-host.js

@@ -96,6 +96,9 @@ export function createHost(options) {
                         ...(body.studioCredentialHash
                             ? { studioCredentialHash: body.studioCredentialHash }
                             : {}),
+                        ...(body.derivedPrincipals?.length
+                            ? { derivedPrincipals: body.derivedPrincipals }
+                            : {}),
                     });
                     return sendJson(response, result.created ? 201 : 200, result.envelope);
                 }

package/dist/store/memory.js

@@ -315,7 +315,9 @@ class MemoryTx {
     }
     async listSessions(filter = {}) {
         this.check();
-        return this.sessions().filter((s) => filter.agentId === undefined || s.agentId === filter.agentId);
+        return this.sessions().filter((s) => (filter.agentId === undefined || s.agentId === filter.agentId) &&
+            (filter.ownerUserId === undefined ||
+                s.ownerUserId === filter.ownerUserId));
     }
     async listDefinitions() {
         this.check();

package/dist/store/postgres/migrations/002_session_owner.d.ts

@@ -0,0 +1,6 @@
+import type { Migration } from "./index.js";
+/**
+ * The session owner (`ownerUserId`) as a stored generated column with an index, so a request
+ * acting for a subject lists only that subject's sessions. Not the lease column `owner`.
+ */
+export declare const sessionOwner: Migration;

package/dist/store/postgres/migrations/002_session_owner.js

@@ -0,0 +1,13 @@
+/**
+ * The session owner (`ownerUserId`) as a stored generated column with an index, so a request
+ * acting for a subject lists only that subject's sessions. Not the lease column `owner`.
+ */
+export const sessionOwner = {
+    version: 2,
+    name: "session_owner",
+    up: (s) => `
+    ALTER TABLE ${s}.sessions
+      ADD COLUMN owner_user_id text GENERATED ALWAYS AS (${s}.doc(body)->>'ownerUserId') STORED;
+    CREATE INDEX sessions_owner_user ON ${s}.sessions (owner_user_id);
+  `,
+};

package/dist/store/postgres/migrations/index.js

@@ -1,7 +1,8 @@
 import { quarantine } from "../../../tenant/quarantine.js";
 import { quoteIdentifier, tenantIdFromSchema } from "../names.js";
 import { initial } from "./001_initial.js";
-export const MIGRATIONS = [initial];
+import { sessionOwner } from "./002_session_owner.js";
+export const MIGRATIONS = [initial, sessionOwner];
 /** The schema version this Runtime writes and expects. */
 export const POSTGRES_SCHEMA_VERSION = MIGRATIONS.at(-1).version;
 /** Checks that versions run 1, 2, 3, … Throws otherwise. */

package/dist/store/postgres/store.js

@@ -420,9 +420,16 @@ class PostgresTx {
     }
     async listSessions(filter = {}) {
         this.check();
-        return this.sessionRows(filter.agentId === undefined
+        const sql = this.sql;
+        const conditions = [
+            ...(filter.agentId === undefined ? [] : [sql `agent_id = ${filter.agentId}`]),
+            ...(filter.ownerUserId === undefined
+                ? []
+                : [sql `owner_user_id = ${filter.ownerUserId}`]),
+        ];
+        return this.sessionRows(conditions.length === 0
             ? undefined
-            : this.sql `agent_id = ${filter.agentId}`);
+            : conditions.reduce((all, next) => sql `${all} AND ${next}`));
     }
     async bodies(table) {
         const rows = await this.sql `SELECT body FROM ${this.t(table)} ORDER BY id`;

package/dist/store/postgres/tenants.js

@@ -58,14 +58,17 @@ export function createPostgresTenantCatalog(options) {
         const schema = tenantSchemaName(id);
         const rows = await q `
       SELECT id, token_hash, idempotency_key FROM ${q(`${schema}.principals`)}
-      WHERE role = 'application' AND id IN (${bootstrap.principalId}, ${STUDIO_PRINCIPAL_ID})`;
+      WHERE role = 'application'`;
         const app = rows.find((row) => row.id === bootstrap.principalId);
         if (!app ||
             app.token_hash !== bootstrap.credentialHash ||
             app.idempotency_key !== bootstrap.idempotencyKey)
             return false;
         const studio = rows.find((row) => row.id === STUDIO_PRINCIPAL_ID);
-        return studio?.token_hash === bootstrap.studioCredentialHash;
+        if (studio?.token_hash !== bootstrap.studioCredentialHash)
+            return false;
+        return (bootstrap.derivedPrincipals ?? []).every((principal) => rows.find((row) => row.id === principal.id)?.token_hash ===
+            principal.credentialHash);
     }
     const catalog = {
         async listTenantIds() {
@@ -122,6 +125,10 @@ export function createPostgresTenantCatalog(options) {
             INSERT INTO ${tx(`${schema}.principals`)} (id, role, token_hash, idempotency_key, created_at)
             VALUES (${STUDIO_PRINCIPAL_ID}, 'application', ${principals.studioCredentialHash},
                     NULL, ${createdAt})`;
+                for (const derived of principals.derivedPrincipals ?? [])
+                    await tx `
+            INSERT INTO ${tx(`${schema}.principals`)} (id, role, token_hash, idempotency_key, created_at)
+            VALUES (${derived.id}, 'application', ${derived.credentialHash}, NULL, ${createdAt})`;
                 return { created: true, envelope: stored };
             });
             if (outcome.created)

package/dist/store/types.d.ts

@@ -347,8 +347,10 @@ export interface Tx {
      * ended at or before `now`, oldest lease first. The sweep re-wakes these.
      */
     orphanedSessions<T extends SessionDoc = SessionDoc>(now: Date, limit: number): Promise<StoredSession<T>[]>;
+    /** Sessions, optionally of one agent and one owner (`ownerUserId`), by id. */
     listSessions<T extends SessionDoc = SessionDoc>(filter?: {
         agentId?: string;
+        ownerUserId?: string;
     }): Promise<StoredSession<T>[]>;
     listDefinitions<T extends DefinitionDoc = DefinitionDoc>(): Promise<T[]>;
     listSandboxes<T extends SandboxDoc = SandboxDoc>(): Promise<T[]>;

package/dist/tenant/auth.d.ts

@@ -1,11 +1,32 @@
 /**
  * Tenant request authentication and authorization: a bearer token resolves to an application
- * principal or a registered executor; anything else is the opaque 404 (D5).
+ * principal or a registered executor; anything else is the opaque 404 (D5). An application
+ * principal may act for a subject (`Nylorun-Subject`, `Nylorun-Scopes`); `authorize` then
+ * limits the request to the routes its scopes allow, decided from the route alone.
  */
 import type { IncomingMessage } from "node:http";
-import type { Action } from "@nylorun/core/contracts";
+import { type Action, type SubjectScope } from "@nylorun/core/contracts";
 import type { AuthScope, TenantContext } from "./context.js";
 export declare function authenticate(ctx: TenantContext, request: IncomingMessage): Promise<AuthScope>;
+/** What a subject needs for a route: any one of the scopes, or nothing grants it. */
+export type RouteAccess = readonly SubjectScope[] | "never";
+/**
+ * The scopes a subject needs for `method path` (`path` starts with `v1`). `undefined` for a
+ * route that does not exist. Operator and executor routes are `never`: reset, config seed,
+ * executors, actions and the sandbox tool routes.
+ */
+export declare function routeAccess(method: string | undefined, path: readonly string[]): RouteAccess | undefined;
+/**
+ * Limits a subject to the routes its scopes allow. Decided from the route alone, before any
+ * lookup, so a refusal reveals nothing about which resources exist. A route the table does not
+ * know is a 404 for a subject: new routes stay closed until they are added here. Application
+ * and executor scopes pass through to the checks each route makes today.
+ */
+export declare function authorize(scope: AuthScope, method: string | undefined, path: readonly string[]): void;
+/** The subject whose sessions and vaults the request is limited to, if it acts for one. */
+export declare function ownerOf(scope: AuthScope): string | undefined;
+/** The application principal behind the request, acting for a subject or not. */
+export declare function requirePrincipal(scope: AuthScope): string;
 /** The executor scope must belong to the Action's agent. */
 export declare function scoped(scope: AuthScope, action: Action): void;
 export declare function requireApplication(scope: AuthScope): string;

package/dist/tenant/auth.js

@@ -1,5 +1,19 @@
+import { SCOPES_HEADER, SUBJECT_HEADER, } from "@nylorun/core/compatibility";
+import { parseSubjectHeaders, } from "@nylorun/core/contracts";
 import { hashToken } from "../core/executors.js";
 import { fail, failOpaque } from "./http.js";
+const SUBJECT_INVALID = { code: "subject_invalid" };
+/** One header's value, or `undefined`; a header sent twice is refused. */
+function singleHeader(request, name) {
+    const values = request.headersDistinct?.[name.toLowerCase()];
+    if (!values) {
+        const raw = request.headers[name.toLowerCase()];
+        return Array.isArray(raw) ? fail(400, `${name} must be sent once`, SUBJECT_INVALID) : raw;
+    }
+    if (values.length > 1)
+        return fail(400, `${name} must be sent once`, SUBJECT_INVALID);
+    return values[0];
+}
 export async function authenticate(ctx, request) {
     const header = request.headers.authorization;
     const token = header?.startsWith("Bearer ") ? header.slice(7) : "";
@@ -11,16 +25,137 @@ export async function authenticate(ctx, request) {
     }
     const tokenHash = hashToken(token);
     const principal = await ctx.store.tx((t) => t.principalByTokenHash(tokenHash));
-    if (principal)
-        return { kind: "application", principalId: principal.id };
-    const executor = ctx.registry.find(tokenHash);
-    if (!executor) {
+    const executor = principal ? undefined : ctx.registry.find(tokenHash);
+    if (!principal && !executor) {
         ctx.config.logger.warn("credential rejected", {
             reason: "unknown_token",
         });
         return failOpaque();
     }
-    return { kind: "executor", executor };
+    // Read only after authentication, so an unknown caller sees the opaque 404 either way.
+    const subject = singleHeader(request, SUBJECT_HEADER);
+    const scopes = singleHeader(request, SCOPES_HEADER);
+    if (executor) {
+        if (subject !== undefined || scopes !== undefined)
+            fail(403, "An executor credential cannot act for a subject");
+        return { kind: "executor", executor };
+    }
+    if (subject === undefined) {
+        if (scopes !== undefined)
+            fail(400, `${SCOPES_HEADER} requires ${SUBJECT_HEADER}`, SUBJECT_INVALID);
+        return { kind: "application", principalId: principal.id };
+    }
+    const parsed = parseSubjectHeaders(subject, scopes);
+    if (!parsed.ok)
+        return fail(400, parsed.message, SUBJECT_INVALID);
+    return {
+        kind: "subject",
+        principalId: principal.id,
+        subject: parsed.subject,
+        scopes: parsed.scopes,
+    };
+}
+const SESSIONS = ["sessions:own"];
+const VAULTS = ["vaults:own"];
+const SETTINGS = ["tenant:settings"];
+/**
+ * The scopes a subject needs for `method path` (`path` starts with `v1`). `undefined` for a
+ * route that does not exist. Operator and executor routes are `never`: reset, config seed,
+ * executors, actions and the sandbox tool routes.
+ */
+export function routeAccess(method, path) {
+    const [v1, resource, id, sub] = path;
+    const n = path.length;
+    if (v1 !== "v1" || !resource)
+        return undefined;
+    switch (resource) {
+        case "executors":
+        case "actions":
+            return "never";
+        case "agents":
+            if (n === 2 && method === "GET")
+                return ["agents:read", "agents:write"];
+            if (n === 3 && method === "PUT")
+                return ["agents:write"];
+            return undefined;
+        case "sessions":
+            if (n === 2 && method === "GET")
+                return SESSIONS;
+            if (n === 3 && (method === "GET" || method === "PUT"))
+                return SESSIONS;
+            if (n === 4 && method === "GET" && (sub === "items" || sub === "events"))
+                return SESSIONS;
+            if (n === 4 && method === "POST" && sub === "commands")
+                return SESSIONS;
+            if (n === 5 && method === "POST" && sub === "sandbox")
+                return "never";
+            return undefined;
+        case "vaults":
+            if (n === 2)
+                return method === "GET" || method === "POST" ? VAULTS : undefined;
+            if (n === 3)
+                return method === "GET" || method === "DELETE" ? VAULTS : undefined;
+            if (sub !== "credentials")
+                return undefined;
+            if (n === 4)
+                return method === "GET" || method === "POST" ? VAULTS : undefined;
+            if (n === 5)
+                return method === "GET" || method === "POST" || method === "DELETE"
+                    ? VAULTS
+                    : undefined;
+            return undefined;
+        case "tenant":
+            if (n === 2 && method === "GET")
+                return SETTINGS;
+            if (n === 3 && id === "reset" && method === "POST")
+                return "never";
+            if (n === 4 && id === "config" && sub === "seed" && method === "PUT")
+                return "never";
+            if (n === 3 && method === "GET" && (id === "models" || id === "providers"))
+                return ["tenant:settings", "agents:write"];
+            if (n === 3 && method === "GET" && id === "sandbox")
+                return SETTINGS;
+            if (n === 3 && id === "model" && (method === "GET" || method === "PUT"))
+                return SETTINGS;
+            if (n === 4 && id === "model" && sub === "selection" && method === "PUT")
+                return SETTINGS;
+            return undefined;
+        default:
+            return undefined;
+    }
+}
+/**
+ * Limits a subject to the routes its scopes allow. Decided from the route alone, before any
+ * lookup, so a refusal reveals nothing about which resources exist. A route the table does not
+ * know is a 404 for a subject: new routes stay closed until they are added here. Application
+ * and executor scopes pass through to the checks each route makes today.
+ */
+export function authorize(scope, method, path) {
+    if (scope.kind !== "subject")
+        return;
+    const access = routeAccess(method, path);
+    if (access === undefined)
+        fail(404, "Route not found");
+    if (access === "never")
+        fail(403, "This route is not available when acting for a subject", {
+            code: "scope_required",
+            details: { scopes: [] },
+        });
+    if (!access.some((name) => scope.scopes.has(name)))
+        fail(403, `Scope ${access.join(" or ")} required`, {
+            code: "scope_required",
+            details: { scopes: access },
+        });
+}
+/** The subject whose sessions and vaults the request is limited to, if it acts for one. */
+export function ownerOf(scope) {
+    return scope.kind === "subject" ? scope.subject : undefined;
+}
+/** The application principal behind the request, acting for a subject or not. */
+export function requirePrincipal(scope) {
+    if (scope.kind !== "executor")
+        return scope.principalId;
+    return fail(403, "Application credential required");
 }
 /** The executor scope must belong to the Action's agent. */
 export function scoped(scope, action) {

package/dist/tenant/commands.js

@@ -22,15 +22,17 @@ import { resolveMessageManifest } from "../core/turn-manifest.js";
 import { canonical } from "../store/canonical.js";
 import { lockedSession, } from "./context.js";
 import { fail } from "./http.js";
-import { scoped } from "./auth.js";
+import { ownerOf, scoped } from "./auth.js";
 import { actionTarget, rebaseSessionState, turnManifestOf, variantStore, } from "./session.js";
 import { signalSessionCancel } from "./streams.js";
+import { toolIds } from "./transcript.js";
 /** A tool result whose output does not match the Action's stored output schema fails the tool. */
 function acceptedToolResult(action, command) {
     if (action.kind !== "tool" || !action.outputSchema)
         return command;
     const value = command.outcome.value;
-    if (isFailedToolValue(value))
+    // Only a result carries output: failures, denials, interactions and deferrals pass as sent.
+    if (!isResultToolValue(value))
         return command;
     // Executors wrap successful tool output as `{ kind: "completed", output }`.
     // Validate the tool payload, not the outcome envelope.
@@ -66,11 +68,17 @@ function completedToolOutput(value) {
     }
     return value;
 }
-function isFailedToolValue(value) {
-    return (!!value &&
+const NON_RESULT_KINDS = new Set([
+    "failed",
+    "denied",
+    "interaction-required",
+    "deferred",
+]);
+function isResultToolValue(value) {
+    return !(!!value &&
         typeof value === "object" &&
         !Array.isArray(value) &&
-        value.kind === "failed");
+        NON_RESULT_KINDS.has(value.kind));
 }
 /** A command's identity for idempotency: everything but the request id. */
 const semantic = (value) => {
@@ -81,7 +89,7 @@ export async function command(ctx, id, input, scope) {
     const { store } = ctx;
     const cascadeCancelIds = [];
     const response = await store.tx(async (t) => {
-        const s = await lockedSession(t, id);
+        const s = await lockedSession(t, id, ownerOf(scope));
         let command = input;
         if (command.type === "action_result") {
             const a = (await t.get("actions", command.actionId)) ??
@@ -91,7 +99,7 @@ export async function command(ctx, id, input, scope) {
             scoped(scope, a);
             command = acceptedToolResult(a, command);
         }
-        else if (scope.kind !== "application")
+        else if (scope.kind === "executor")
             fail(403, "Application credential required");
         const key = commandKey(id, command.idempotencyKey);
         const existing = await t.get("commands", key);
@@ -135,6 +143,7 @@ export async function command(ctx, id, input, scope) {
                 actionId: action.actionId,
                 ...actionTarget(action),
                 kind: action.kind,
+                ...(action.kind === "tool" ? toolIds(action.context) : {}),
                 result: command.outcome.value,
             });
             if (action.kind === "verify") {

package/dist/tenant/context.d.ts

@@ -13,7 +13,7 @@
  * `wake` goes to `DurableExecution.wake`, which calls the Tenant's `advance` (`advance.ts`)
  * under ownership (§10.6); `abortLocal` aborts an advance running on this process.
  */
-import type { TenantEnvelope } from "@nylorun/core/contracts";
+import type { SubjectScope, TenantEnvelope } from "@nylorun/core/contracts";
 import type { DurableCheckpoint, FlowCheckpoint } from "@nylorun/harness/run";
 import type { AgentManifest, JsonValue } from "@nylorun/core/define";
 import type { CredentialSelection } from "@nylorun/core/contracts";
@@ -72,6 +72,13 @@ export interface Session {
 export type AuthScope = {
     kind: "application";
     principalId: string;
+}
+/** An application principal acting for `subject` (`Nylorun-Subject`), narrowed to `scopes`. */
+ | {
+    kind: "subject";
+    principalId: string;
+    subject: string;
+    scopes: ReadonlySet<SubjectScope>;
 } | {
     kind: "executor";
     executor: ExecutorRecord;
@@ -116,9 +123,9 @@ export interface TenantContext {
     onSweep(hook: () => Promise<void>): () => void;
 }
 /** The session, or a 404. Reads without locking. */
-export declare function sessionOf(t: Tx, id: string): Promise<Session>;
+export declare function sessionOf(t: Tx, id: string, owner?: string): Promise<Session>;
 /** Locks the session for the rest of the transaction and returns it, or a 404. */
-export declare function lockedSession(t: Tx, id: string): Promise<Session>;
+export declare function lockedSession(t: Tx, id: string, owner?: string): Promise<Session>;
 /** An advance's hold on its session (§10.6): every write the advance makes presents `epoch`. */
 export interface Lease {
     readonly sessionId: string;
@@ -132,7 +139,7 @@ export interface Lease {
  */
 export declare function ownedSession(t: Tx, lease: Lease, id: string): Promise<Session>;
 /** The session read in its own transaction, or a 404. */
-export declare function loadSession(ctx: TenantContext, id: string): Promise<Session>;
+export declare function loadSession(ctx: TenantContext, id: string, owner?: string): Promise<Session>;
 /**
  * A synchronous lookup over `start` and every session its `sandboxOwnerId` chain names, for
  * the sandbox-sharing helpers, which walk that chain synchronously.

package/dist/tenant/context.js

@@ -1,12 +1,20 @@
 import { fail } from "./http.js";
+/**
+ * `owner`, when set, is the subject the request acts for: another owner's session is the same
+ * 404 as a missing one, so a subject cannot learn which session ids exist.
+ */
+function owned(session, owner) {
+    if (!session || (owner !== undefined && session.ownerUserId !== owner))
+        return fail(404, "Session not found");
+    return session;
+}
 /** The session, or a 404. Reads without locking. */
-export async function sessionOf(t, id) {
-    return ((await t.get("sessions", id)) ??
-        fail(404, "Session not found"));
+export async function sessionOf(t, id, owner) {
+    return owned(await t.get("sessions", id), owner);
 }
 /** Locks the session for the rest of the transaction and returns it, or a 404. */
-export async function lockedSession(t, id) {
-    return ((await t.lockSession(id)) ?? fail(404, "Session not found"));
+export async function lockedSession(t, id, owner) {
+    return owned(await t.lockSession(id), owner);
 }
 /**
  * Locks `id` for the advance holding `lease`. The advance's own session is epoch-checked: a
@@ -19,8 +27,8 @@ export async function ownedSession(t, lease, id) {
     return lockedSession(t, id);
 }
 /** The session read in its own transaction, or a 404. */
-export function loadSession(ctx, id) {
-    return ctx.store.tx((t) => sessionOf(t, id));
+export function loadSession(ctx, id, owner) {
+    return ctx.store.tx((t) => sessionOf(t, id, owner));
 }
 /**
  * A synchronous lookup over `start` and every session its `sandboxOwnerId` chain names, for

package/dist/tenant/effects.js

@@ -12,6 +12,7 @@ import { loadSession, ownedSession, sandboxLookup, sessionOf, } from "./context.
 import { fail } from "./http.js";
 import { actionTarget, linkedAgentOutput, manifestFor, mcpToolOf, pinnedTool, } from "./session.js";
 import { command } from "./commands.js";
+import { assistantMessage, toolCompleted, toolIds } from "./transcript.js";
 import { abortKind } from "./worker.js";
 export function invokeModel(ctx, request, signal, model) {
     if (model)
@@ -51,6 +52,20 @@ async function linkedOutcome(t, effect, agent) {
         },
     };
 }
+/**
+ * What an effect's journal row must match on replay. A delegation's context carries only the
+ * parent's tool call id, for its events; rows journaled before it existed still match.
+ */
+function requestIdentity(request) {
+    if (request.kind !== "delegation")
+        return request;
+    const { context: _, ...identity } = request;
+    return identity;
+}
+function delegationCallId(request) {
+    const callId = request.context?.callId;
+    return typeof callId === "string" ? { callId } : {};
+}
 export async function resolveEffect(ctx, request, signal, lease, segment = {}) {
     const { store } = ctx;
     const journaled = await store.tx(async (t) => {
@@ -65,7 +80,7 @@ export async function resolveEffect(ctx, request, signal, lease, segment = {}) {
         });
         const existing = await t.get("effects", request.effectId);
         if (existing) {
-            if (canonical(existing.request) !== canonical(request))
+            if (canonical(requestIdentity(existing.request)) !== canonical(requestIdentity(request)))
                 throw new Error("Effect identity request drift");
             if (existing.status === "completed")
                 return resolved({ status: "completed", outcome: existing.outcome });
@@ -104,7 +119,11 @@ export async function resolveEffect(ctx, request, signal, lease, segment = {}) {
                 outcome,
             });
             const settled = request.effectId.endsWith(":settled");
-            await t.event(s.id, s.activeTurnId, settled ? "delegation.completed" : "delegation.started", { agent: request.agent, ...request.input });
+            await t.event(s.id, s.activeTurnId, settled ? "delegation.completed" : "delegation.started", {
+                agent: request.agent,
+                ...delegationCallId(request),
+                ...request.input,
+            });
             return resolved({ status: "completed", outcome });
         }
         const agentManifest = manifestFor(s.manifest, request.agent);
@@ -166,6 +185,7 @@ export async function resolveEffect(ctx, request, signal, lease, segment = {}) {
             actionId: action.actionId,
             kind: action.kind,
             ...actionTarget(action),
+            ...(action.kind === "tool" ? toolIds(request.context) : {}),
             input: action.input,
         });
         t.signalWork();
@@ -198,6 +218,11 @@ export async function resolveEffect(ctx, request, signal, lease, segment = {}) {
             effect.status = "completed";
             effect.outcome = { value };
             await t.put("effects", request.effectId, effect);
+            const transcript = invoke === "model"
+                ? assistantMessage(request, value)
+                : toolCompleted(request, value);
+            if (transcript)
+                await t.event(s.id, request.turnId, invoke === "model" ? "message.assistant" : "tool.completed", transcript);
             return { status: "completed", outcome: effect.outcome };
         });
     }

package/dist/tenant/http.d.ts

@@ -11,11 +11,17 @@ export declare const OPAQUE_NOT_FOUND: {
     code: "not_found";
     message: string;
 };
+/** A rejection's stable code and details, for the ones a client acts on (default `request_rejected`). */
+export interface Rejection {
+    readonly code?: string;
+    readonly details?: unknown;
+}
 export declare class HttpError extends Error {
     readonly status: number;
-    constructor(status: number, message: string);
+    readonly rejection: Rejection;
+    constructor(status: number, message: string, rejection?: Rejection);
 }
-export declare const fail: (status: number, message: string) => never;
+export declare const fail: (status: number, message: string, rejection?: Rejection) => never;
 export declare class OpaqueAuthError extends Error {
     readonly status = 404;
     readonly body: {

package/dist/tenant/http.js

@@ -6,13 +6,15 @@ export const OPAQUE_NOT_FOUND = {
 };
 export class HttpError extends Error {
     status;
-    constructor(status, message) {
+    rejection;
+    constructor(status, message, rejection = {}) {
         super(message);
         this.status = status;
+        this.rejection = rejection;
     }
 }
-export const fail = (status, message) => {
-    throw new HttpError(status, message);
+export const fail = (status, message, rejection) => {
+    throw new HttpError(status, message, rejection);
 };
 export class OpaqueAuthError extends Error {
     status = 404;

package/dist/tenant/module.js

@@ -152,6 +152,9 @@ export function createTenantModule(options) {
                 ...(input.studioCredentialHash
                     ? { studioCredentialHash: input.studioCredentialHash }
                     : {}),
+                ...(input.derivedPrincipals?.length
+                    ? { derivedPrincipals: input.derivedPrincipals }
+                    : {}),
             };
             // The store records its own schema version.
             const envelope = envelopeNow({

package/dist/tenant/principals.d.ts

@@ -9,5 +9,8 @@ export declare const STUDIO_PRINCIPAL_ID = "studio";
  * Exported for WS-B's `TenantStore.create` (A3).
  */
 export declare function bootstrapPrincipal(t: Tx, bootstrap: BootstrapPrincipal, now?: Date): Promise<void>;
-/** Whether the stored bootstrap (and Studio) principals equal `bootstrap`. */
+/**
+ * Whether the stored bootstrap, Studio and derived principals equal `bootstrap`. A retried
+ * create names the same derived principals, so each must be stored with its hash.
+ */
 export declare function bootstrapPrincipalMatches(t: Tx, bootstrap: BootstrapPrincipal): Promise<boolean>;

package/dist/tenant/principals.js

@@ -22,8 +22,19 @@ export async function bootstrapPrincipal(t, bootstrap, now = new Date()) {
             idempotencyKey: null,
             createdAt,
         });
+    for (const principal of bootstrap.derivedPrincipals ?? [])
+        await t.insertPrincipal({
+            id: principal.id,
+            role: "application",
+            tokenHash: principal.credentialHash,
+            idempotencyKey: null,
+            createdAt,
+        });
 }
-/** Whether the stored bootstrap (and Studio) principals equal `bootstrap`. */
+/**
+ * Whether the stored bootstrap, Studio and derived principals equal `bootstrap`. A retried
+ * create names the same derived principals, so each must be stored with its hash.
+ */
 export async function bootstrapPrincipalMatches(t, bootstrap) {
     const row = await t.principalById(bootstrap.principalId);
     if (!row ||
@@ -32,6 +43,14 @@ export async function bootstrapPrincipalMatches(t, bootstrap) {
         row.idempotencyKey !== bootstrap.idempotencyKey)
         return false;
     const studio = await t.principalById(STUDIO_PRINCIPAL_ID);
-    return ((studio?.role === "application" ? studio.tokenHash : undefined) ===
-        bootstrap.studioCredentialHash);
+    if ((studio?.role === "application" ? studio.tokenHash : undefined) !==
+        bootstrap.studioCredentialHash)
+        return false;
+    for (const principal of bootstrap.derivedPrincipals ?? []) {
+        const stored = await t.principalById(principal.id);
+        if (stored?.role !== "application" ||
+            stored.tokenHash !== principal.credentialHash)
+            return false;
+    }
+    return true;
 }

package/dist/tenant/routes-tenant.js

@@ -2,6 +2,7 @@ import { CreateCredentialRequestSchema, CreateVaultRequestSchema, PutHostModelRe
 import { hostModelCatalog } from "../model/catalog.js";
 import { resetTenant } from "./reset.js";
 import { buildTenantStatus, seedTenantConfig } from "./status.js";
+import { ownerOf } from "./auth.js";
 import { fail, readBody } from "./http.js";
 import { clearExecutorStreams, clearObservers } from "./live.js";
 import { requestStreamCollection, sessionStreamsAbandoned, streamsStatus, } from "./streams.js";
@@ -9,7 +10,8 @@ import { clearWork, drain } from "./scheduler.js";
 import { usesFixtureModel } from "./model-setting.js";
 export async function dispatchTenant(ctx, scope, method, path, request) {
     const { vault } = ctx;
-    if (scope.kind !== "application") {
+    // A subject reaches only the routes `authorize` allowed its scopes.
+    if (scope.kind === "executor") {
         await vault.reject(path.join("/"));
         fail(403, "Application credential required");
     }
@@ -83,22 +85,31 @@ export async function dispatchTenant(ctx, scope, method, path, request) {
 }
 export async function dispatchVault(ctx, scope, method, path, url, request) {
     const { vault } = ctx;
-    if (scope.kind !== "application") {
+    if (scope.kind === "executor") {
         await vault.reject(path.join("/"));
         fail(403, "Application credential required");
     }
+    // Acting for a subject: only the subject's own vaults, and never on another's behalf.
+    const owner = ownerOf(scope);
     if (path.length === 2 && method === "POST") {
         const body = CreateVaultRequestSchema.parse(await readBody(request));
+        if (owner !== undefined && body.ownerUserId !== owner)
+            fail(403, "ownerUserId must be the subject");
         return vault.createVault(body);
     }
     if (path.length === 2 && method === "GET") {
         const ownerUserId = url.searchParams.get("ownerUserId") ??
+            owner ??
             fail(400, "ownerUserId is required");
+        if (owner !== undefined && ownerUserId !== owner)
+            fail(403, "ownerUserId must be the subject");
         return { vaults: await vault.listVaults(ownerUserId) };
     }
     const vaultId = path[2];
     if (!vaultId)
         fail(404, "Vault not found");
+    if (owner !== undefined)
+        await vault.assertOwner(vaultId, owner);
     if (path.length === 3 && method === "GET")
         return vault.getVault(vaultId);
     if (path.length === 3 && method === "DELETE")

package/dist/tenant/routes.js

@@ -3,7 +3,7 @@ import { VaultError } from "../vault/error.js";
 import { SandboxRouteError, handleSessionSandboxTool, } from "../core/sandbox-routes.js";
 import { loadSession, sessionOf } from "./context.js";
 import { HttpError, OpaqueAuthError, fail, readBody, requestAborted, } from "./http.js";
-import { authenticate, requireApplication } from "./auth.js";
+import { authenticate, authorize, ownerOf, requireApplication, requirePrincipal, } from "./auth.js";
 import { command } from "./commands.js";
 import { actionSandboxTool, deleteExecutor, listExecutors, listPendingActions, registerExecutors, sandboxRouteDeps, updateAction, } from "./actions.js";
 import { listDefinitions, listSessions, putDefinition, putSession, sessionView, } from "./sessions.js";
@@ -28,6 +28,9 @@ export async function handle(ctx, request, response, _url) {
         const scope = await authenticate(ctx, request);
         if (path[0] !== "v1")
             fail(404, "Route not found");
+        authorize(scope, method, path);
+        // Set when the request acts for a subject: only the subject's own sessions are reachable.
+        const owner = ownerOf(scope);
         if (path[1] === "executors" && path[2] === "connect" && method === "GET") {
             if (scope.kind !== "executor")
                 return fail(403, "Executor credential required");
@@ -59,7 +62,7 @@ export async function handle(ctx, request, response, _url) {
             return json(await dispatchVault(ctx, scope, method, path, url, request));
         if (path[1] === "tenant")
             return json(await dispatchTenant(ctx, scope, method, path, request));
-        const principalId = requireApplication(scope);
+        const principalId = requirePrincipal(scope);
         if (path[1] === "executors" && path.length === 2 && method === "GET")
             return json(listExecutors(ctx));
         // The length guard matters: the connect branch above only matches GET, so without it a
@@ -74,7 +77,7 @@ export async function handle(ctx, request, response, _url) {
         if (path[1] === "agents" && path.length === 2 && method === "GET")
             return json(await listDefinitions(ctx));
         if (path[1] === "sessions" && path.length === 2 && method === "GET")
-            return json(await listSessions(ctx, url.searchParams.get("agentId")));
+            return json(await listSessions(ctx, url.searchParams.get("agentId"), owner));
         if (path[1] === "agents" &&
             path[2] &&
             path.length === 3 &&
@@ -84,13 +87,13 @@ export async function handle(ctx, request, response, _url) {
             const id = path[2];
             if (method === "PUT" && path.length === 3) {
                 const body = PutSessionRequestSchema.parse(await readBody(request));
-                const session = await putSession(ctx, id, body);
+                const session = await putSession(ctx, id, body, owner);
                 return json(await ctx.store.tx((t) => sessionView(t, session)));
             }
             if (method === "GET" && path.length === 3)
-                return json(await ctx.store.tx(async (t) => sessionView(t, await sessionOf(t, id))));
+                return json(await ctx.store.tx(async (t) => sessionView(t, await sessionOf(t, id, owner))));
             // Every other session route needs the session to exist.
-            await loadSession(ctx, id);
+            await loadSession(ctx, id, owner);
             const cursor = requestCursor(request, url);
             if (method === "GET" && path[3] === "items")
                 return json(await readHistory(ctx, id, cursor, url.searchParams.get("agent") ?? undefined));
@@ -133,10 +136,16 @@ export async function handle(ctx, request, response, _url) {
                 error?.message === "Invalid cursor"
                 ? 400
                 : 500;
+        const rejection = error instanceof HttpError ? error.rejection : {};
         json({
             status: "rejected",
-            code: status === 500 ? "internal_error" : "request_rejected",
+            code: status === 500
+                ? "internal_error"
+                : rejection.code ?? "request_rejected",
             message: status === 500 ? "Runtime request failed" : error.message,
+            ...(rejection.details === undefined
+                ? {}
+                : { details: rejection.details }),
         }, status);
     }
 }

package/dist/tenant/sessions.d.ts

@@ -19,7 +19,8 @@ export declare function putDefinition(ctx: TenantContext, agentId: string, body:
     manifestHash: string;
     implementationVersion: string;
 }>;
-export declare function listSessions(ctx: TenantContext, agentId: string | null): Promise<{
+/** `owner`, when the request acts for a subject, limits the list to that subject's sessions. */
+export declare function listSessions(ctx: TenantContext, agentId: string | null, owner?: string): Promise<{
     sessions: {
         id: string;
         agentId: string;
@@ -28,7 +29,12 @@ export declare function listSessions(ctx: TenantContext, agentId: string | null)
         activeTurnId: string | null;
     }[];
 }>;
-/** Create a session from its definition, or re-attach vaults to an identical one. */
-export declare function putSession(ctx: TenantContext, id: string, body: PutSessionRequest): Promise<Session>;
+/**
+ * Create a session from its definition, or re-attach vaults to an identical one. `owner`, when
+ * the request acts for a subject, must be the session's owner: another owner's session id is
+ * the 404 of a missing one (not the 409 of a mismatch), and so are another owner's vaults and
+ * sandboxes.
+ */
+export declare function putSession(ctx: TenantContext, id: string, body: PutSessionRequest, owner?: string): Promise<Session>;
 /** The session resource returned by `GET`/`PUT /v1/sessions/:id`. */
 export declare function sessionView(t: Tx, s: Session): Promise<unknown>;

package/dist/tenant/sessions.js

@@ -42,8 +42,12 @@ export async function putDefinition(ctx, agentId, body) {
         implementationVersion: body.implementationVersion,
     };
 }
-export async function listSessions(ctx, agentId) {
-    const sessions = await ctx.store.tx((t) => t.listSessions(agentId === null ? {} : { agentId }));
+/** `owner`, when the request acts for a subject, limits the list to that subject's sessions. */
+export async function listSessions(ctx, agentId, owner) {
+    const sessions = await ctx.store.tx((t) => t.listSessions({
+        ...(agentId === null ? {} : { agentId }),
+        ...(owner === undefined ? {} : { ownerUserId: owner }),
+    }));
     return {
         sessions: sessions.map((s) => ({
             id: s.id,
@@ -54,20 +58,30 @@ export async function listSessions(ctx, agentId) {
         })),
     };
 }
-/** Create a session from its definition, or re-attach vaults to an identical one. */
-export function putSession(ctx, id, body) {
+/**
+ * Create a session from its definition, or re-attach vaults to an identical one. `owner`, when
+ * the request acts for a subject, must be the session's owner: another owner's session id is
+ * the 404 of a missing one (not the 409 of a mismatch), and so are another owner's vaults and
+ * sandboxes.
+ */
+export function putSession(ctx, id, body, owner) {
     const vaultIds = body.vaultIds ?? [];
     const credentialSelections = body.credentialSelections ?? [];
+    const opaque = owner !== undefined;
+    if (opaque && body.ownerUserId !== owner)
+        fail(403, "ownerUserId must be the subject");
     return ctx.store.tx(async (t) => {
         const prior = await t.lockSession(id);
+        if (opaque && prior && prior.ownerUserId !== owner)
+            fail(404, "Session not found");
         const definition = prior === undefined || body.sandbox
             ? (await t.get("definitions", body.agentId)) ??
                 fail(404, "Definition not found")
             : undefined;
         const sandboxOwnerId = body.sandbox
-            ? validateSandboxAttach(body, (definition ?? prior).manifest, await sandboxLookup(t, body.sandbox.session))
+            ? validateSandboxAttach(body, (definition ?? prior).manifest, await sandboxLookup(t, body.sandbox.session), { opaque })
             : undefined;
-        await ctx.vault.assertAttachment(t, body.ownerUserId, vaultIds, credentialSelections);
+        await ctx.vault.assertAttachment(t, body.ownerUserId, vaultIds, credentialSelections, { opaque });
         if (prior) {
             if (sessionIdentity(prior.creation) !== sessionIdentity(body))
                 fail(409, "Session already exists with different creation parameters");

package/dist/tenant/transcript.d.ts

@@ -0,0 +1,104 @@
+/**
+ * Transcript events (Host feature `transcript-events`): what a chat UI shows, written in the
+ * transaction that completes the effect, so a replayed effect never writes them again.
+ * Payload schemas: `@nylorun/core/contracts` (`parseTranscriptEvent`).
+ */
+import type { HostEffect } from "@nylorun/harness/run";
+/** The model's tool call id and the harness invocation, for tool effects and tool actions. */
+export declare function toolIds(context: unknown): {
+    callId: string;
+    invocationId: string;
+} | Record<string, never>;
+/**
+ * `message.assistant` for a completed model effect: the step's text and tool calls. The
+ * provider returns a `ModelCandidate` or a bare string; anything else writes no event.
+ */
+export declare function assistantMessage(request: HostEffect, value: unknown): {
+    agent: import("@nylorun/core").AgentRef;
+    invocationId: string;
+    text: string;
+    toolCalls: {
+        callId: string;
+        name: string;
+        input: unknown;
+    }[];
+} | {
+    agent?: undefined;
+    invocationId: string;
+    text: string;
+    toolCalls: {
+        callId: string;
+        name: string;
+        input: unknown;
+    }[];
+} | undefined;
+/** `tool.completed` for an MCP or sandbox tool: its output, or the tool error it reported. */
+export declare function toolCompleted(request: HostEffect, value: unknown): {
+    agent: import("@nylorun/core").AgentRef;
+    error: {
+        code: string;
+        message: string;
+    };
+    output?: undefined;
+    capabilityId: string;
+    toolName: string;
+} | {
+    agent?: undefined;
+    error: {
+        code: string;
+        message: string;
+    };
+    output?: undefined;
+    capabilityId: string;
+    toolName: string;
+} | {
+    agent: import("@nylorun/core").AgentRef;
+    error?: undefined;
+    output: unknown;
+    capabilityId: string;
+    toolName: string;
+} | {
+    agent?: undefined;
+    error?: undefined;
+    output: unknown;
+    capabilityId: string;
+    toolName: string;
+} | {
+    callId: string;
+    invocationId: string;
+    agent: import("@nylorun/core").AgentRef;
+    error: {
+        code: string;
+        message: string;
+    };
+    output?: undefined;
+    capabilityId: string;
+    toolName: string;
+} | {
+    callId: string;
+    invocationId: string;
+    agent?: undefined;
+    error: {
+        code: string;
+        message: string;
+    };
+    output?: undefined;
+    capabilityId: string;
+    toolName: string;
+} | {
+    callId: string;
+    invocationId: string;
+    agent: import("@nylorun/core").AgentRef;
+    error?: undefined;
+    output: unknown;
+    capabilityId: string;
+    toolName: string;
+} | {
+    callId: string;
+    invocationId: string;
+    agent?: undefined;
+    error?: undefined;
+    output: unknown;
+    capabilityId: string;
+    toolName: string;
+} | undefined;

package/dist/tenant/transcript.js

@@ -0,0 +1,58 @@
+/** The model's tool call id and the harness invocation, for tool effects and tool actions. */
+export function toolIds(context) {
+    const c = context;
+    return typeof c?.callId === "string" && typeof c.invocationId === "string"
+        ? { callId: c.callId, invocationId: c.invocationId }
+        : {};
+}
+const agentOf = (request) => request.agent ? { agent: request.agent } : {};
+/**
+ * `message.assistant` for a completed model effect: the step's text and tool calls. The
+ * provider returns a `ModelCandidate` or a bare string; anything else writes no event.
+ */
+export function assistantMessage(request, value) {
+    const invocationId = request.context
+        ?.invocationId;
+    if (typeof invocationId !== "string")
+        return undefined;
+    const blocks = typeof value === "string"
+        ? [{ type: "text", text: value }]
+        : Array.isArray(value?.output)
+            ? value.output
+            : [];
+    let text = "";
+    const toolCalls = [];
+    for (const block of blocks) {
+        if (block?.type === "text" && typeof block.text === "string")
+            text += block.text;
+        else if (block?.type === "tool-call" &&
+            typeof block.id === "string" &&
+            typeof block.name === "string")
+            toolCalls.push({ callId: block.id, name: block.name, input: block.args });
+    }
+    if (!text && toolCalls.length === 0)
+        return undefined;
+    return { invocationId, text, toolCalls, ...agentOf(request) };
+}
+/** `tool.completed` for an MCP or sandbox tool: its output, or the tool error it reported. */
+export function toolCompleted(request, value) {
+    const ids = toolIds(request.context);
+    if (!("callId" in ids))
+        return undefined;
+    const outcome = value;
+    const result = outcome?.kind === "failed"
+        ? {
+            error: {
+                code: String(outcome.code ?? "tool.failed"),
+                message: String(outcome.message ?? ""),
+            },
+        }
+        : { output: outcome?.kind === "completed" ? outcome.output : value };
+    return {
+        ...ids,
+        capabilityId: request.capabilityId,
+        toolName: request.toolName,
+        ...result,
+        ...agentOf(request),
+    };
+}

package/dist/tenant/types.d.ts

@@ -109,6 +109,12 @@ export interface BootstrapPrincipal {
     idempotencyKey: string;
     /** When set, also registers application principal `studio` with this hash. */
     studioCredentialHash?: string;
+    /** Application principals whose keys the admin key derives (feature `derived-principals`). */
+    derivedPrincipals?: readonly DerivedPrincipal[];
+}
+export interface DerivedPrincipal {
+    id: string;
+    credentialHash: string;
 }
 /**
  * The deep module (§8). HTTP, CLI and tests use only this.

package/dist/vault/service.d.ts

@@ -46,6 +46,8 @@ export declare class VaultService {
     createVault(body: CreateVaultRequest): Promise<VaultInfo>;
     listVaults(ownerUserId: string): Promise<VaultInfo[]>;
     getVault(id: string): Promise<VaultInfo>;
+    /** Another owner's vault, or the host vault, is the same 404 as a missing one. */
+    assertOwner(id: string, ownerUserId: string): Promise<void>;
     deleteVault(id: string): Promise<{
         id: string;
     }>;
@@ -56,8 +58,13 @@ export declare class VaultService {
     deleteCredential(vaultId: string, id: string): Promise<{
         id: string;
     }>;
-    /** Checks a session's vaults and selections. Run in the session PUT transaction. */
-    assertAttachment(t: Tx, ownerUserId: string, vaultIds: readonly string[], selections: readonly CredentialSelection[]): Promise<void>;
+    /**
+     * Checks a session's vaults and selections. Run in the session PUT transaction. `opaque`
+     * (a request acting for a subject) reports another owner's vault as the 404 of a missing one.
+     */
+    assertAttachment(t: Tx, ownerUserId: string, vaultIds: readonly string[], selections: readonly CredentialSelection[], options?: {
+        opaque?: boolean;
+    }): Promise<void>;
     /** Writes the `attach` audit row. Run in the session PUT transaction. */
     recordAttachment(t: Tx, sessionId: string, vaultIds: readonly string[]): Promise<void>;
     authorize(input: {

package/dist/vault/service.js

@@ -14,6 +14,7 @@
  * createVault(body: CreateVaultRequest): Promise<VaultInfo>
  * listVaults(ownerUserId: string): Promise<VaultInfo[]>
  * getVault(id: string): Promise<VaultInfo>
+ * assertOwner(id: string, ownerUserId: string): Promise<void>
  * deleteVault(id: string): Promise<{ id: string }>
  * createCredential(vaultId: string, body: CreateCredentialRequest): Promise<CredentialInfo>
  * listCredentials(vaultId: string): Promise<CredentialInfo[]>
@@ -22,7 +23,7 @@
  * deleteCredential(vaultId: string, id: string): Promise<{ id: string }>
  *
  * // Attachment: run inside the caller's session PUT transaction.
- * assertAttachment(t: Tx, ownerUserId: string, vaultIds: readonly string[], selections: readonly CredentialSelection[]): Promise<void>
+ * assertAttachment(t: Tx, ownerUserId: string, vaultIds: readonly string[], selections: readonly CredentialSelection[], options?: { opaque?: boolean }): Promise<void>
  * recordAttachment(t: Tx, sessionId: string, vaultIds: readonly string[]): Promise<void>
  *
  * // Use: opens its own transactions; never call it inside one.
@@ -104,6 +105,14 @@ export class VaultService {
     async getVault(id) {
         return this.store.tx((t) => this.vaultInfo(t, id));
     }
+    /** Another owner's vault, or the host vault, is the same 404 as a missing one. */
+    async assertOwner(id, ownerUserId) {
+        await this.store.tx(async (t) => {
+            const row = await t.getVault(id);
+            if (!row || row.scope !== "user" || row.ownerUserId !== ownerUserId)
+                throw new VaultError(404, "Vault not found");
+        });
+    }
     async deleteVault(id) {
         return this.store.tx(async (t) => {
             await this.vaultInfo(t, id);
@@ -210,8 +219,11 @@ export class VaultService {
         });
     }
     // --- attachment (caller's transaction) --------------------------------------
-    /** Checks a session's vaults and selections. Run in the session PUT transaction. */
-    async assertAttachment(t, ownerUserId, vaultIds, selections) {
+    /**
+     * Checks a session's vaults and selections. Run in the session PUT transaction. `opaque`
+     * (a request acting for a subject) reports another owner's vault as the 404 of a missing one.
+     */
+    async assertAttachment(t, ownerUserId, vaultIds, selections, options = {}) {
         if (new Set(vaultIds).size !== vaultIds.length)
             throw new VaultError(400, "Duplicate vault id");
         if (new Set(selections.map((item) => item.serverName)).size !== selections.length)
@@ -223,7 +235,9 @@ export class VaultService {
             if (vault.scope === "host")
                 throw new VaultError(400, "Host vault cannot be attached to a session");
             if (vault.ownerUserId !== ownerUserId)
-                throw new VaultError(403, "Vault belongs to another user");
+                throw options.opaque
+                    ? new VaultError(404, "Vault not found")
+                    : new VaultError(403, "Vault belongs to another user");
         }
         for (const selection of selections) {
             const row = await t.getCredential(selection.credentialId);

package/dist/version.d.ts

@@ -1 +1 @@
-export declare const RUNTIME_VERSION = "0.11.0-beta";
+export declare const RUNTIME_VERSION = "0.12.0-beta";

package/dist/version.js

@@ -1,3 +1,3 @@
 // Kept in step with package.json by runtime/scripts/check-package.mjs, which runs in npm run check.
 // release:prepare also rewrites this when it bumps @nylorun/runtime.
-export const RUNTIME_VERSION = "0.11.0-beta";
+export const RUNTIME_VERSION = "0.12.0-beta";

package/package.json

@@ -1,12 +1,12 @@
 {
   "name": "@nylorun/runtime",
-  "version": "0.11.0-beta",
+  "version": "0.12.0-beta",
   "description": "Nylorun Runtime: the agent execution Host on Postgres, Restate and S2, and model providers.",
   "type": "module",
   "license": "Apache-2.0",
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/nylorun/harness.git",
+    "url": "git+https://github.com/nylorun/agents.git",
     "directory": "runtime"
   },
   "engines": {
@@ -58,14 +58,15 @@
     "@modelcontextprotocol/sdk": "^1.30.0",
     "@earendil-works/pi-ai": "0.87.0",
     "@hono/node-server": "^2.1.1",
-    "@nylorun/harness": "0.19.1-beta",
-    "@nylorun/core": "0.6.0-beta",
+    "@nylorun/harness": "0.19.2-beta",
+    "@nylorun/core": "0.7.0-beta",
     "@restatedev/restate-sdk": "1.16.9",
     "@s2-dev/streamstore": "0.27.0",
     "just-bash": "3.4.2",
     "postgres": "^3.4.9"
   },
   "devDependencies": {
+    "@ag-ui/client": "1.0.0",
     "@types/node": "^26.5.0",
     "@typescript/native": "npm:typescript@^7.0.2",
     "hono": "^4.13.8",