@nylorun/runtime 0.11.0-beta → 0.13.0-beta

package/CHANGELOG.md

@@ -1,5 +1,76 @@
 # Changelog
 
+## 0.13.0-beta
+
+### Minor Changes
+
+- 5278b4e: **Flow agents on workflow manifest v2.** A flow agent compiles to `workflowSchemaVersion: 2` and runs on the new `flow-2` engine; v1 workflows (`Chain`, `Switch`, `Parallel`, `Map`, `Loop`) keep running on `flow-1`, so in-flight runs finish as they began.
+
+  - **Manifest (core).** Any node may carry `id` and `input`; there are no slots. `chain` and `parallel` are bare collections, a Map is `{ map: { each } }` over its input, and a Loop has `max?` and `decide?`. The header adds `name`, `description`, `metadata`, `inputSchema` and `outputSchema`, and `agents` embeds every agent the flow runs, so one manifest hash covers the whole flow. `Agent.from(json, { nodes, agents })` rebuilds a flow agent. Path and key helpers (`leafPath`, `stageKey`, `forEachFlowNode`, `embeddedAgent`, …) are exported from `@nylorun/core/define`.
+  - **Paths (harness).** Linked agent sessions are named by the agent: its id, `[i]` per Map item, and a nested flow agent's id in front. Control stages add nothing, so wrapping a step in a Loop keeps its session. Functions are bound under stage keys (`route:on`, `@1.default.1:input`) and all receive `{ input, results, flowInput }`; `flowInput` works inside nested `flow()`. A Loop without `decide` retries with the verifier's feedback up to `max` and then fails with `loop.exhausted`. Nested flow agents run inline.
+  - **Runtime.** Leaves of a v2 workflow resolve from its embedded `agents` (with the workflow's plugin roots, keyed `<agent>/<capability>`) instead of the registry. `loop.iteration` is emitted only for a Loop's own agent turns.
+  - **Agents SDK.** `saveAgent(flowAgent)` PUTs one document; application mode registers the flow's executor with its manifest hash. An executor leaves `fn`, `verify` and tool actions of a v2 flow unclaimed when they belong to another manifest hash, because stage keys can shift between deploys; it reports each skipped action once through `onError`.
+  - **Studio.** Draws v2 manifests: agents and tools at their session paths, control stages at their stage keys, nested flow agents inline, and lights a Map's agent from its item sessions.
+  - Build diagnostics: `flow.duplicate-leaf`, `flow.duplicate-id`, `flow.agent-conflict`, `flow.v1-workflow`, `loop.invalid-verify`, `workflow.flow-agent-child`. Also fixes v1 flows passing an agent step's output to the next step still wrapped in the runtime's turn marker.
+
+- 426fd27: **Flow agents as subagents.** `.subagents(flowAgent)` lets a ReAct agent delegate to a flow agent. The flow's workflow manifest v2 is inlined in the delegating tool (`ToolManifest.agent` may be a workflow manifest), so it is saved with the parent and served by the parent's executor, plugin roots included (`<flow>/<agent>/<capability>`).
+
+  - **Engine (harness).** A call to a flow subagent is one durable `agent` effect (`role: "delegate"`) between the delegation's start and settle points; the flow's output is the tool result, and a failed flow is a failed tool result. Local `run()` refuses flow subagents, which need the Runtime.
+  - **Runtime.** The effect starts a linked flow session from the parent's pinned manifest, fresh per call, and settles when the flow's turn ends. Cancelling any session now cascades to the linked sessions it started, not only a workflow's.
+  - **Core.** `delegation.flow-unsupported` now only reports a workflow built with `Chain`, `Switch`, `Parallel`, `Map` or `Loop`. New helpers: `flowDelegatesOf`, `flowDelegateManifest`, `isFlowDelegate`; `delegatesOf` lists only the ReAct agents run in-process.
+
+### Patch Changes
+
+- Pin core to the tested release.
+- Pin harness to the tested release.
+- Updated dependencies [e537a82]
+- Updated dependencies [5278b4e]
+- Updated dependencies [426fd27]
+- Updated dependencies [8cda500]
+- Updated dependencies
+  - @nylorun/core@0.8.0-beta
+  - @nylorun/harness@0.20.0-beta
+
+## 0.12.0-beta
+
+### Minor Changes
+
+- a322696: **Derived principals** (optional Host feature `derived-principals`): a client that holds the admin key no longer needs to store an application key.
+
+  - `admin.createTenant({ name, principals: ["babai"] })` registers each named principal by the hash of its derived key, and `admin.deriveTenantKey(tenantId, principalId)` (or `deriveTenantKey(adminKey, tenantId, principalId)`) recomputes the key when needed.
+  - `POST /v1/admin/tenants` accepts `derivedPrincipals: [{ id, credentialHash }]`. Ids match `^[a-z][a-z0-9-]{0,31}$` and `studio` is reserved; duplicate ids or credentials answer `400`. A retried create must name the same principals.
+  - `createTenant` with `principals` throws `incompatible_host` before sending anything to a Host without the feature.
+
+- 844bff3: **Act for a person: `Nylorun-Subject` and `Nylorun-Scopes`.** An app server that holds the Tenant key can name the person each request is for, and the Runtime enforces it (optional Host feature `subject-headers`).
+
+  - `client.as(subject, { scopes })` in `@nylorun/agents` sends both headers on every call, event streams included. Scopes: `agents:read`, `agents:write`, `sessions:own`, `vaults:own`, `tenant:settings`; default `["sessions:own"]`.
+  - The Runtime limits a subject to the routes its scopes allow (`403 scope_required`) and to its own sessions and vaults: another owner's session, vault or sandbox is the same `404` as a missing one, including `PUT` on its session id (was `409`). Reset, config seed, executors, actions and the sandbox tool routes are open to no subject. Only application keys may send the headers.
+  - The AG-UI handler calls the Runtime as each person and requires `subject-headers`; new optional `scopes` option. The host's `session()` parameters can no longer replace a session's id, agent or owner.
+  - Core exports `SUBJECT_HEADER`, `SCOPES_HEADER`, `SUBJECT_SCOPES` and `parseSubjectHeaders`. Postgres Tenant schemas migrate to version 2 (an indexed session owner column).
+
+  Requests without `Nylorun-Subject` are unchanged.
+
+- a322696: **The session log now carries what a chat UI shows** (optional Host feature `transcript-events`).
+
+  - `message.assistant` for each completed model step: `{ invocationId, text, toolCalls: [{ callId, name, input }], agent? }`.
+  - `tool.completed` for an MCP or sandbox tool: `{ invocationId, callId, capabilityId, toolName, output }`, or `error: { code, message }` for a tool error.
+  - Tool `action.pending` and `action.completed` events, and `delegation.started` / `delegation.completed`, carry the model's `callId` (and `invocationId` on actions).
+  - Events are written in the transaction that completes the effect, so a replay writes none.
+  - `@nylorun/core/contracts` adds payload schemas and `parseTranscriptEvent(event)`; `LiveEvent.payload` stays `unknown`.
+
+  Fix: a tool with both `approval` and an `output` schema now pauses for approval. The Runtime validated its `interaction-required` result against the output schema and failed the tool with `tool.invalid-output`; `denied`, `interaction-required` and `deferred` results are no longer validated.
+
+### Patch Changes
+
+- Pin core to the tested release.
+- Pin harness to the tested release.
+- Updated dependencies [a322696]
+- Updated dependencies [844bff3]
+- Updated dependencies [a322696]
+- Updated dependencies
+  - @nylorun/core@0.7.0-beta
+  - @nylorun/harness@0.19.2-beta
+
 ## 0.11.0-beta
 
 ### Minor Changes

package/dist/core/flow-host.js

@@ -61,6 +61,9 @@ export function deriveSessionId(workflowSessionId, path, ...parts) {
  * (path, turnId, iterations) so prior verdicts cannot leak across Loop iterations.
  */
 export function deriveAgentEffectSessionId(workflowSessionId, path, request) {
+    // A flow agent used as a tool starts fresh on every call, like any agent used as a tool.
+    if (request.context?.role === "delegate")
+        return deriveSessionId(workflowSessionId, path, "delegate", String(request.context.delegationId ?? request.turnId));
     if (request.context?.role === "verify-agent") {
         const iterations = request.iterations ?? "-";
         const iterParts = iterations !== "-" && iterations.length > 0 ? iterations.split(".") : [];

package/dist/core/sandbox-routes.d.ts

@@ -37,4 +37,8 @@ export declare function validateSandboxAttach(body: {
     sandbox?: {
         session: string;
     };
-}, newManifest: SessionSandboxRef["manifest"], lookup: (id: string) => SessionSandboxRef | undefined): string | undefined;
+}, newManifest: SessionSandboxRef["manifest"], lookup: (id: string) => SessionSandboxRef | undefined, 
+/** Acting for a subject: another owner's session is the 404 of a missing one. */
+options?: {
+    opaque?: boolean;
+}): string | undefined;

package/dist/core/sandbox-routes.js

@@ -85,12 +85,14 @@ export async function handleActionSandboxTool(deps, actionId, toolName, body, si
     return runTool(deps, read, tool, toolInput(body), signal);
 }
 /** Validate PutSession.sandbox attach: same owner, identical specs. */
-export function validateSandboxAttach(body, newManifest, lookup) {
+export function validateSandboxAttach(body, newManifest, lookup, 
+/** Acting for a subject: another owner's session is the 404 of a missing one. */
+options = {}) {
     const share = body.sandbox?.session;
     if (!share)
         return undefined;
     const owner = lookup(share);
-    if (!owner)
+    if (!owner || (options.opaque && owner.ownerUserId !== body.ownerUserId))
         throw new SandboxRouteError(404, "Sandbox session not found");
     if (owner.ownerUserId !== body.ownerUserId)
         throw new SandboxRouteError(403, "Sandbox session must belong to the same owner");

package/dist/host/create-host.js

@@ -96,6 +96,9 @@ export function createHost(options) {
                         ...(body.studioCredentialHash
                             ? { studioCredentialHash: body.studioCredentialHash }
                             : {}),
+                        ...(body.derivedPrincipals?.length
+                            ? { derivedPrincipals: body.derivedPrincipals }
+                            : {}),
                     });
                     return sendJson(response, result.created ? 201 : 200, result.envelope);
                 }

package/dist/store/memory.js

@@ -315,7 +315,9 @@ class MemoryTx {
     }
     async listSessions(filter = {}) {
         this.check();
-        return this.sessions().filter((s) => filter.agentId === undefined || s.agentId === filter.agentId);
+        return this.sessions().filter((s) => (filter.agentId === undefined || s.agentId === filter.agentId) &&
+            (filter.ownerUserId === undefined ||
+                s.ownerUserId === filter.ownerUserId));
     }
     async listDefinitions() {
         this.check();

package/dist/store/postgres/migrations/002_session_owner.d.ts

@@ -0,0 +1,6 @@
+import type { Migration } from "./index.js";
+/**
+ * The session owner (`ownerUserId`) as a stored generated column with an index, so a request
+ * acting for a subject lists only that subject's sessions. Not the lease column `owner`.
+ */
+export declare const sessionOwner: Migration;

package/dist/store/postgres/migrations/002_session_owner.js

@@ -0,0 +1,13 @@
+/**
+ * The session owner (`ownerUserId`) as a stored generated column with an index, so a request
+ * acting for a subject lists only that subject's sessions. Not the lease column `owner`.
+ */
+export const sessionOwner = {
+    version: 2,
+    name: "session_owner",
+    up: (s) => `
+    ALTER TABLE ${s}.sessions
+      ADD COLUMN owner_user_id text GENERATED ALWAYS AS (${s}.doc(body)->>'ownerUserId') STORED;
+    CREATE INDEX sessions_owner_user ON ${s}.sessions (owner_user_id);
+  `,
+};

package/dist/store/postgres/migrations/index.js

@@ -1,7 +1,8 @@
 import { quarantine } from "../../../tenant/quarantine.js";
 import { quoteIdentifier, tenantIdFromSchema } from "../names.js";
 import { initial } from "./001_initial.js";
-export const MIGRATIONS = [initial];
+import { sessionOwner } from "./002_session_owner.js";
+export const MIGRATIONS = [initial, sessionOwner];
 /** The schema version this Runtime writes and expects. */
 export const POSTGRES_SCHEMA_VERSION = MIGRATIONS.at(-1).version;
 /** Checks that versions run 1, 2, 3, … Throws otherwise. */

package/dist/store/postgres/store.js

@@ -420,9 +420,16 @@ class PostgresTx {
     }
     async listSessions(filter = {}) {
         this.check();
-        return this.sessionRows(filter.agentId === undefined
+        const sql = this.sql;
+        const conditions = [
+            ...(filter.agentId === undefined ? [] : [sql `agent_id = ${filter.agentId}`]),
+            ...(filter.ownerUserId === undefined
+                ? []
+                : [sql `owner_user_id = ${filter.ownerUserId}`]),
+        ];
+        return this.sessionRows(conditions.length === 0
             ? undefined
-            : this.sql `agent_id = ${filter.agentId}`);
+            : conditions.reduce((all, next) => sql `${all} AND ${next}`));
     }
     async bodies(table) {
         const rows = await this.sql `SELECT body FROM ${this.t(table)} ORDER BY id`;

package/dist/store/postgres/tenants.js

@@ -58,14 +58,17 @@ export function createPostgresTenantCatalog(options) {
         const schema = tenantSchemaName(id);
         const rows = await q `
       SELECT id, token_hash, idempotency_key FROM ${q(`${schema}.principals`)}
-      WHERE role = 'application' AND id IN (${bootstrap.principalId}, ${STUDIO_PRINCIPAL_ID})`;
+      WHERE role = 'application'`;
         const app = rows.find((row) => row.id === bootstrap.principalId);
         if (!app ||
             app.token_hash !== bootstrap.credentialHash ||
             app.idempotency_key !== bootstrap.idempotencyKey)
             return false;
         const studio = rows.find((row) => row.id === STUDIO_PRINCIPAL_ID);
-        return studio?.token_hash === bootstrap.studioCredentialHash;
+        if (studio?.token_hash !== bootstrap.studioCredentialHash)
+            return false;
+        return (bootstrap.derivedPrincipals ?? []).every((principal) => rows.find((row) => row.id === principal.id)?.token_hash ===
+            principal.credentialHash);
     }
     const catalog = {
         async listTenantIds() {
@@ -122,6 +125,10 @@ export function createPostgresTenantCatalog(options) {
             INSERT INTO ${tx(`${schema}.principals`)} (id, role, token_hash, idempotency_key, created_at)
             VALUES (${STUDIO_PRINCIPAL_ID}, 'application', ${principals.studioCredentialHash},
                     NULL, ${createdAt})`;
+                for (const derived of principals.derivedPrincipals ?? [])
+                    await tx `
+            INSERT INTO ${tx(`${schema}.principals`)} (id, role, token_hash, idempotency_key, created_at)
+            VALUES (${derived.id}, 'application', ${derived.credentialHash}, NULL, ${createdAt})`;
                 return { created: true, envelope: stored };
             });
             if (outcome.created)

package/dist/store/types.d.ts

@@ -347,8 +347,10 @@ export interface Tx {
      * ended at or before `now`, oldest lease first. The sweep re-wakes these.
      */
     orphanedSessions<T extends SessionDoc = SessionDoc>(now: Date, limit: number): Promise<StoredSession<T>[]>;
+    /** Sessions, optionally of one agent and one owner (`ownerUserId`), by id. */
     listSessions<T extends SessionDoc = SessionDoc>(filter?: {
         agentId?: string;
+        ownerUserId?: string;
     }): Promise<StoredSession<T>[]>;
     listDefinitions<T extends DefinitionDoc = DefinitionDoc>(): Promise<T[]>;
     listSandboxes<T extends SandboxDoc = SandboxDoc>(): Promise<T[]>;

package/dist/tenant/auth.d.ts

@@ -1,11 +1,32 @@
 /**
  * Tenant request authentication and authorization: a bearer token resolves to an application
- * principal or a registered executor; anything else is the opaque 404 (D5).
+ * principal or a registered executor; anything else is the opaque 404 (D5). An application
+ * principal may act for a subject (`Nylorun-Subject`, `Nylorun-Scopes`); `authorize` then
+ * limits the request to the routes its scopes allow, decided from the route alone.
  */
 import type { IncomingMessage } from "node:http";
-import type { Action } from "@nylorun/core/contracts";
+import { type Action, type SubjectScope } from "@nylorun/core/contracts";
 import type { AuthScope, TenantContext } from "./context.js";
 export declare function authenticate(ctx: TenantContext, request: IncomingMessage): Promise<AuthScope>;
+/** What a subject needs for a route: any one of the scopes, or nothing grants it. */
+export type RouteAccess = readonly SubjectScope[] | "never";
+/**
+ * The scopes a subject needs for `method path` (`path` starts with `v1`). `undefined` for a
+ * route that does not exist. Operator and executor routes are `never`: reset, config seed,
+ * executors, actions and the sandbox tool routes.
+ */
+export declare function routeAccess(method: string | undefined, path: readonly string[]): RouteAccess | undefined;
+/**
+ * Limits a subject to the routes its scopes allow. Decided from the route alone, before any
+ * lookup, so a refusal reveals nothing about which resources exist. A route the table does not
+ * know is a 404 for a subject: new routes stay closed until they are added here. Application
+ * and executor scopes pass through to the checks each route makes today.
+ */
+export declare function authorize(scope: AuthScope, method: string | undefined, path: readonly string[]): void;
+/** The subject whose sessions and vaults the request is limited to, if it acts for one. */
+export declare function ownerOf(scope: AuthScope): string | undefined;
+/** The application principal behind the request, acting for a subject or not. */
+export declare function requirePrincipal(scope: AuthScope): string;
 /** The executor scope must belong to the Action's agent. */
 export declare function scoped(scope: AuthScope, action: Action): void;
 export declare function requireApplication(scope: AuthScope): string;

package/dist/tenant/auth.js

@@ -1,5 +1,19 @@
+import { SCOPES_HEADER, SUBJECT_HEADER, } from "@nylorun/core/compatibility";
+import { parseSubjectHeaders, } from "@nylorun/core/contracts";
 import { hashToken } from "../core/executors.js";
 import { fail, failOpaque } from "./http.js";
+const SUBJECT_INVALID = { code: "subject_invalid" };
+/** One header's value, or `undefined`; a header sent twice is refused. */
+function singleHeader(request, name) {
+    const values = request.headersDistinct?.[name.toLowerCase()];
+    if (!values) {
+        const raw = request.headers[name.toLowerCase()];
+        return Array.isArray(raw) ? fail(400, `${name} must be sent once`, SUBJECT_INVALID) : raw;
+    }
+    if (values.length > 1)
+        return fail(400, `${name} must be sent once`, SUBJECT_INVALID);
+    return values[0];
+}
 export async function authenticate(ctx, request) {
     const header = request.headers.authorization;
     const token = header?.startsWith("Bearer ") ? header.slice(7) : "";
@@ -11,16 +25,137 @@ export async function authenticate(ctx, request) {
     }
     const tokenHash = hashToken(token);
     const principal = await ctx.store.tx((t) => t.principalByTokenHash(tokenHash));
-    if (principal)
-        return { kind: "application", principalId: principal.id };
-    const executor = ctx.registry.find(tokenHash);
-    if (!executor) {
+    const executor = principal ? undefined : ctx.registry.find(tokenHash);
+    if (!principal && !executor) {
         ctx.config.logger.warn("credential rejected", {
             reason: "unknown_token",
         });
         return failOpaque();
     }
-    return { kind: "executor", executor };
+    // Read only after authentication, so an unknown caller sees the opaque 404 either way.
+    const subject = singleHeader(request, SUBJECT_HEADER);
+    const scopes = singleHeader(request, SCOPES_HEADER);
+    if (executor) {
+        if (subject !== undefined || scopes !== undefined)
+            fail(403, "An executor credential cannot act for a subject");
+        return { kind: "executor", executor };
+    }
+    if (subject === undefined) {
+        if (scopes !== undefined)
+            fail(400, `${SCOPES_HEADER} requires ${SUBJECT_HEADER}`, SUBJECT_INVALID);
+        return { kind: "application", principalId: principal.id };
+    }
+    const parsed = parseSubjectHeaders(subject, scopes);
+    if (!parsed.ok)
+        return fail(400, parsed.message, SUBJECT_INVALID);
+    return {
+        kind: "subject",
+        principalId: principal.id,
+        subject: parsed.subject,
+        scopes: parsed.scopes,
+    };
+}
+const SESSIONS = ["sessions:own"];
+const VAULTS = ["vaults:own"];
+const SETTINGS = ["tenant:settings"];
+/**
+ * The scopes a subject needs for `method path` (`path` starts with `v1`). `undefined` for a
+ * route that does not exist. Operator and executor routes are `never`: reset, config seed,
+ * executors, actions and the sandbox tool routes.
+ */
+export function routeAccess(method, path) {
+    const [v1, resource, id, sub] = path;
+    const n = path.length;
+    if (v1 !== "v1" || !resource)
+        return undefined;
+    switch (resource) {
+        case "executors":
+        case "actions":
+            return "never";
+        case "agents":
+            if (n === 2 && method === "GET")
+                return ["agents:read", "agents:write"];
+            if (n === 3 && method === "PUT")
+                return ["agents:write"];
+            return undefined;
+        case "sessions":
+            if (n === 2 && method === "GET")
+                return SESSIONS;
+            if (n === 3 && (method === "GET" || method === "PUT"))
+                return SESSIONS;
+            if (n === 4 && method === "GET" && (sub === "items" || sub === "events"))
+                return SESSIONS;
+            if (n === 4 && method === "POST" && sub === "commands")
+                return SESSIONS;
+            if (n === 5 && method === "POST" && sub === "sandbox")
+                return "never";
+            return undefined;
+        case "vaults":
+            if (n === 2)
+                return method === "GET" || method === "POST" ? VAULTS : undefined;
+            if (n === 3)
+                return method === "GET" || method === "DELETE" ? VAULTS : undefined;
+            if (sub !== "credentials")
+                return undefined;
+            if (n === 4)
+                return method === "GET" || method === "POST" ? VAULTS : undefined;
+            if (n === 5)
+                return method === "GET" || method === "POST" || method === "DELETE"
+                    ? VAULTS
+                    : undefined;
+            return undefined;
+        case "tenant":
+            if (n === 2 && method === "GET")
+                return SETTINGS;
+            if (n === 3 && id === "reset" && method === "POST")
+                return "never";
+            if (n === 4 && id === "config" && sub === "seed" && method === "PUT")
+                return "never";
+            if (n === 3 && method === "GET" && (id === "models" || id === "providers"))
+                return ["tenant:settings", "agents:write"];
+            if (n === 3 && method === "GET" && id === "sandbox")
+                return SETTINGS;
+            if (n === 3 && id === "model" && (method === "GET" || method === "PUT"))
+                return SETTINGS;
+            if (n === 4 && id === "model" && sub === "selection" && method === "PUT")
+                return SETTINGS;
+            return undefined;
+        default:
+            return undefined;
+    }
+}
+/**
+ * Limits a subject to the routes its scopes allow. Decided from the route alone, before any
+ * lookup, so a refusal reveals nothing about which resources exist. A route the table does not
+ * know is a 404 for a subject: new routes stay closed until they are added here. Application
+ * and executor scopes pass through to the checks each route makes today.
+ */
+export function authorize(scope, method, path) {
+    if (scope.kind !== "subject")
+        return;
+    const access = routeAccess(method, path);
+    if (access === undefined)
+        fail(404, "Route not found");
+    if (access === "never")
+        fail(403, "This route is not available when acting for a subject", {
+            code: "scope_required",
+            details: { scopes: [] },
+        });
+    if (!access.some((name) => scope.scopes.has(name)))
+        fail(403, `Scope ${access.join(" or ")} required`, {
+            code: "scope_required",
+            details: { scopes: access },
+        });
+}
+/** The subject whose sessions and vaults the request is limited to, if it acts for one. */
+export function ownerOf(scope) {
+    return scope.kind === "subject" ? scope.subject : undefined;
+}
+/** The application principal behind the request, acting for a subject or not. */
+export function requirePrincipal(scope) {
+    if (scope.kind !== "executor")
+        return scope.principalId;
+    return fail(403, "Application credential required");
 }
 /** The executor scope must belong to the Action's agent. */
 export function scoped(scope, action) {

package/dist/tenant/commands.js

@@ -22,15 +22,17 @@ import { resolveMessageManifest } from "../core/turn-manifest.js";
 import { canonical } from "../store/canonical.js";
 import { lockedSession, } from "./context.js";
 import { fail } from "./http.js";
-import { scoped } from "./auth.js";
+import { ownerOf, scoped } from "./auth.js";
 import { actionTarget, rebaseSessionState, turnManifestOf, variantStore, } from "./session.js";
 import { signalSessionCancel } from "./streams.js";
+import { toolIds } from "./transcript.js";
 /** A tool result whose output does not match the Action's stored output schema fails the tool. */
 function acceptedToolResult(action, command) {
     if (action.kind !== "tool" || !action.outputSchema)
         return command;
     const value = command.outcome.value;
-    if (isFailedToolValue(value))
+    // Only a result carries output: failures, denials, interactions and deferrals pass as sent.
+    if (!isResultToolValue(value))
         return command;
     // Executors wrap successful tool output as `{ kind: "completed", output }`.
     // Validate the tool payload, not the outcome envelope.
@@ -66,11 +68,17 @@ function completedToolOutput(value) {
     }
     return value;
 }
-function isFailedToolValue(value) {
-    return (!!value &&
+const NON_RESULT_KINDS = new Set([
+    "failed",
+    "denied",
+    "interaction-required",
+    "deferred",
+]);
+function isResultToolValue(value) {
+    return !(!!value &&
         typeof value === "object" &&
         !Array.isArray(value) &&
-        value.kind === "failed");
+        NON_RESULT_KINDS.has(value.kind));
 }
 /** A command's identity for idempotency: everything but the request id. */
 const semantic = (value) => {
@@ -81,7 +89,7 @@ export async function command(ctx, id, input, scope) {
     const { store } = ctx;
     const cascadeCancelIds = [];
     const response = await store.tx(async (t) => {
-        const s = await lockedSession(t, id);
+        const s = await lockedSession(t, id, ownerOf(scope));
         let command = input;
         if (command.type === "action_result") {
             const a = (await t.get("actions", command.actionId)) ??
@@ -91,7 +99,7 @@ export async function command(ctx, id, input, scope) {
             scoped(scope, a);
             command = acceptedToolResult(a, command);
         }
-        else if (scope.kind !== "application")
+        else if (scope.kind === "executor")
             fail(403, "Application credential required");
         const key = commandKey(id, command.idempotencyKey);
         const existing = await t.get("commands", key);
@@ -135,6 +143,7 @@ export async function command(ctx, id, input, scope) {
                 actionId: action.actionId,
                 ...actionTarget(action),
                 kind: action.kind,
+                ...(action.kind === "tool" ? toolIds(action.context) : {}),
                 result: command.outcome.value,
             });
             if (action.kind === "verify") {
@@ -183,13 +192,13 @@ export async function command(ctx, id, input, scope) {
         else if (command.type === "cancel") {
             cancelledTurnId = s.activeTurnId;
             const workflowCancel = isWorkflowManifest(s.manifest);
-            const cascade = workflowCancel
-                ? await planCancelCascade({
-                    t,
-                    workflowSessionId: id,
-                    turnId: cancelledTurnId,
-                })
-                : null;
+            // Linked sessions this one started: a workflow's agents, or flow agents an agent
+            // uses as tools.
+            const cascade = await planCancelCascade({
+                t,
+                workflowSessionId: id,
+                turnId: cancelledTurnId,
+            });
             s.status = "cancelled";
             if (workflowCancel) {
                 await fenceWorkflowActions({
@@ -236,15 +245,13 @@ export async function command(ctx, id, input, scope) {
             s.error = undefined;
             // Cascade: cancel linked agent sessions deepest-first (after fencing this session), each
             // in its own transaction after this one commits (child sessions are never locked here).
-            if (cascade) {
-                for (const agentId of cascade.agentSessionIds) {
-                    const agent = await t.get("sessions", agentId);
-                    if (!agent ||
-                        !agent.activeTurnId ||
-                        ["idle", "completed", "failed", "cancelled"].includes(agent.status))
-                        continue;
-                    cascadeCancelIds.push(agentId);
-                }
+            for (const agentId of cascade.agentSessionIds) {
+                const agent = await t.get("sessions", agentId);
+                if (!agent ||
+                    !agent.activeTurnId ||
+                    ["idle", "completed", "failed", "cancelled"].includes(agent.status))
+                    continue;
+                cascadeCancelIds.push(agentId);
             }
         }
         else {

package/dist/tenant/context.d.ts

@@ -13,7 +13,7 @@
  * `wake` goes to `DurableExecution.wake`, which calls the Tenant's `advance` (`advance.ts`)
  * under ownership (§10.6); `abortLocal` aborts an advance running on this process.
  */
-import type { TenantEnvelope } from "@nylorun/core/contracts";
+import type { SubjectScope, TenantEnvelope } from "@nylorun/core/contracts";
 import type { DurableCheckpoint, FlowCheckpoint } from "@nylorun/harness/run";
 import type { AgentManifest, JsonValue } from "@nylorun/core/define";
 import type { CredentialSelection } from "@nylorun/core/contracts";
@@ -72,6 +72,13 @@ export interface Session {
 export type AuthScope = {
     kind: "application";
     principalId: string;
+}
+/** An application principal acting for `subject` (`Nylorun-Subject`), narrowed to `scopes`. */
+ | {
+    kind: "subject";
+    principalId: string;
+    subject: string;
+    scopes: ReadonlySet<SubjectScope>;
 } | {
     kind: "executor";
     executor: ExecutorRecord;
@@ -116,9 +123,9 @@ export interface TenantContext {
     onSweep(hook: () => Promise<void>): () => void;
 }
 /** The session, or a 404. Reads without locking. */
-export declare function sessionOf(t: Tx, id: string): Promise<Session>;
+export declare function sessionOf(t: Tx, id: string, owner?: string): Promise<Session>;
 /** Locks the session for the rest of the transaction and returns it, or a 404. */
-export declare function lockedSession(t: Tx, id: string): Promise<Session>;
+export declare function lockedSession(t: Tx, id: string, owner?: string): Promise<Session>;
 /** An advance's hold on its session (§10.6): every write the advance makes presents `epoch`. */
 export interface Lease {
     readonly sessionId: string;
@@ -132,7 +139,7 @@ export interface Lease {
  */
 export declare function ownedSession(t: Tx, lease: Lease, id: string): Promise<Session>;
 /** The session read in its own transaction, or a 404. */
-export declare function loadSession(ctx: TenantContext, id: string): Promise<Session>;
+export declare function loadSession(ctx: TenantContext, id: string, owner?: string): Promise<Session>;
 /**
  * A synchronous lookup over `start` and every session its `sandboxOwnerId` chain names, for
  * the sandbox-sharing helpers, which walk that chain synchronously.

package/dist/tenant/context.js

@@ -1,12 +1,20 @@
 import { fail } from "./http.js";
+/**
+ * `owner`, when set, is the subject the request acts for: another owner's session is the same
+ * 404 as a missing one, so a subject cannot learn which session ids exist.
+ */
+function owned(session, owner) {
+    if (!session || (owner !== undefined && session.ownerUserId !== owner))
+        return fail(404, "Session not found");
+    return session;
+}
 /** The session, or a 404. Reads without locking. */
-export async function sessionOf(t, id) {
-    return ((await t.get("sessions", id)) ??
-        fail(404, "Session not found"));
+export async function sessionOf(t, id, owner) {
+    return owned(await t.get("sessions", id), owner);
 }
 /** Locks the session for the rest of the transaction and returns it, or a 404. */
-export async function lockedSession(t, id) {
-    return ((await t.lockSession(id)) ?? fail(404, "Session not found"));
+export async function lockedSession(t, id, owner) {
+    return owned(await t.lockSession(id), owner);
 }
 /**
  * Locks `id` for the advance holding `lease`. The advance's own session is epoch-checked: a
@@ -19,8 +27,8 @@ export async function ownedSession(t, lease, id) {
     return lockedSession(t, id);
 }
 /** The session read in its own transaction, or a 404. */
-export function loadSession(ctx, id) {
-    return ctx.store.tx((t) => sessionOf(t, id));
+export function loadSession(ctx, id, owner) {
+    return ctx.store.tx((t) => sessionOf(t, id, owner));
 }
 /**
  * A synchronous lookup over `start` and every session its `sandboxOwnerId` chain names, for