@nylorun/runtime 0.14.0-beta → 0.15.0-beta

package/dist/tenant/advance.js

@@ -34,8 +34,9 @@ import { runDurable, runFlowDurable, } from "@nylorun/harness/run";
 import { aggregateWaits, cancelSiblingWork, isWorkflowManifest, wakeLinkedWorkflow, } from "../core/flow-host.js";
 import { isOwnershipLost, ownedTx } from "../store/ownership.js";
 import { linkedAgentOutput, rebaseSessionState, sessionToolsOf, turnManifestOf, } from "./session.js";
-import { prepareMcp, resolveEffect } from "./effects.js";
+import { isRemoteMcpEffect, prepareMcp, recoversMcpCalls, recoversModelCalls, resolveEffect, } from "./effects.js";
 import { slimModelEffects } from "./slim.js";
+import { checkParity, foldTranscript, leanState, transcriptOf, transcriptUpdates, withTranscript, } from "./history.js";
 import { command } from "./commands.js";
 import { usesFixtureModel } from "./model-setting.js";
 import { toolFixtureModel } from "../core/provider.js";
@@ -86,6 +87,7 @@ export async function advance(ctx, id, signal) {
     else
         signal.addEventListener("abort", forward, { once: true });
     ctx.work.running.set(id, controller);
+    ctx.work.runningTurns.set(id, taken.session.activeTurnId ?? null);
     const heartbeat = startHeartbeat(ctx, lease, controller);
     let result = DONE;
     try {
@@ -111,8 +113,10 @@ export async function advance(ctx, id, signal) {
     finally {
         heartbeat.stop();
         signal.removeEventListener("abort", forward);
-        if (ctx.work.running.get(id) === controller)
+        if (ctx.work.running.get(id) === controller) {
             ctx.work.running.delete(id);
+            ctx.work.runningTurns.delete(id);
+        }
         // Best effort: a release that fails leaves a lease that simply expires.
         await ctx.store
             .tx((t) => t.releaseOwnership(id, lease.owner, lease.epoch))
@@ -147,7 +151,10 @@ async function takeOwnership(ctx, id) {
         };
         const s = await t.assertEpoch(id, taken.epoch);
         if (taken.takeover)
-            await takeOver(t, s);
+            await takeOver(t, s, {
+                recoversModelCalls: recoversModelCalls(ctx),
+                recoversMcpCalls: recoversMcpCalls(ctx),
+            });
         if (!s.checkpoint || !["running", "runnable"].includes(s.status)) {
             await t.releaseOwnership(id, lease.owner, lease.epoch);
             return { status: "idle" };
@@ -159,13 +166,20 @@ async function takeOwnership(ctx, id) {
 }
 /**
  * Takeover (§10.5 step 2, §11.4), inside the transaction that took ownership: the dead
- * owner's `invoking` effects become `uncertain` and are never invoked again. When one belongs
+ * owner's `invoking` effects become `uncertain` and are never invoked again, except model
+ * calls when the gate recovers them (P1.2) and remote MCP calls when the Tool Gate does (F4.1
+ * G3): those stay `invoking`, and the replay re-sends them. When one belongs
  * to the active turn, the session becomes `uncertain` too, with an `effect.uncertain` event.
  * Mutates and writes `s`. Returns the effect ids it marked.
  */
-export async function takeOver(t, s) {
+export async function takeOver(t, s, options = {}) {
     const marked = [];
     for (const effect of await t.invokingEffects(s.id)) {
+        // Still running at the gate, or finished there: the replay re-sends it (P1.2).
+        if (options.recoversModelCalls && effect.request.kind === "model")
+            continue;
+        if (options.recoversMcpCalls && isRemoteMcpEffect(s, effect.request))
+            continue;
         effect.status = "uncertain";
         effect.error ??= "The Worker running this effect stopped before its outcome was recorded";
         await t.put("effects", effect.request.effectId, effect);
@@ -238,12 +252,24 @@ async function runSegment(ctx, lease, started, signal) {
         const { current, fixtureModel } = await ownedTx(ctx.store, id, lease.epoch, async (t, current) => {
             if (!isWorkflowManifest(current.manifest) && current.checkpoint) {
                 rebaseSessionState(current, current.checkpoint.manifestHash);
+                await adoptStoredTranscript(t, current);
                 const cp = current.checkpoint;
                 current.checkpoint = { ...cp, state: current.state };
                 await t.put("sessions", id, current);
             }
             return { current, fixtureModel: await usesFixtureModel(t) };
         });
+        // One history (P0.3): the engine resumes from the transcript folded from the record.
+        let startTranscript = [];
+        let engineCheckpoint = current.checkpoint;
+        if (!isWorkflowManifest(current.manifest) && current.checkpoint) {
+            const cp = current.checkpoint;
+            if (cp.state) {
+                startTranscript = await foldSession(ctx, current);
+                checkParity(id, startTranscript, transcriptOf(cp.state));
+                engineCheckpoint = { ...cp, state: withTranscript(cp.state, startTranscript) };
+            }
+        }
         const segment = fixtureModel ? { model: fixture } : {};
         const host = {
             resolveEffect: (e) => resolveEffect(ctx, e, signal, lease, segment),
@@ -258,7 +284,7 @@ async function runSegment(ctx, lease, started, signal) {
             })
             : await runDurable({
                 manifest: turnManifestOf(current),
-                checkpoint: current.checkpoint,
+                checkpoint: engineCheckpoint,
                 signal,
                 sessionTools: sessionToolsOf(current.mcpSnapshot),
                 host,
@@ -273,8 +299,15 @@ async function runSegment(ctx, lease, started, signal) {
         if (signal.reason instanceof AdvanceDeadlineError &&
             (result.status === "cancelled" || result.status === "failed"))
             await settleFailure(ctx, lease, started, signal.reason);
-        else
-            await settle(ctx, lease, started, result);
+        else {
+            const state = !isWorkflowManifest(current.manifest) &&
+                (result.status === "yielded" || result.status === "completed" || result.status === "paused") &&
+                "result" in result
+                ? result.result?.state
+                : undefined;
+            const updates = state ? transcriptUpdates(startTranscript, transcriptOf(state)) : [];
+            await settle(ctx, lease, started, result, updates);
+        }
     }
     catch (error) {
         if (isOwnershipLost(error) || error instanceof SegmentStopped)
@@ -312,7 +345,7 @@ async function wakeWorkflowOf(ctx, t, agent, turnId, type, payload) {
         });
 }
 /** Record a segment result, then cancel failed siblings and wake a linked workflow. */
-async function settle(ctx, lease, s, result) {
+async function settle(ctx, lease, s, result, updates = []) {
     const id = lease.sessionId;
     const siblingCancelIds = await ownedTx(ctx.store, id, lease.epoch, async (t, current) => {
         const siblings = [];
@@ -348,7 +381,8 @@ async function settle(ctx, lease, s, result) {
         if (result.status === "yielded") {
             // The turn goes on in a new segment: same turn, next checkpoint, woken right away.
             const finished = result.checkpoint;
-            current.state = result.result.state;
+            await recordTranscript(t, id, s.activeTurnId, current, updates);
+            current.state = leanState(result.result.state);
             current.checkpoint = {
                 ...finished,
                 segment: finished.segment + 1,
@@ -357,7 +391,6 @@ async function settle(ctx, lease, s, result) {
             };
             current.status = "runnable";
             current.waits = undefined;
-            await t.put("checkpoints", JSON.stringify([id, s.activeTurnId, finished.segment]), { checkpoint: finished, status: "yielded" });
             await slimModelEffects(t, id, s.activeTurnId);
             await t.put("sessions", id, current);
             const segment = finished.segment + 1;
@@ -369,13 +402,14 @@ async function settle(ctx, lease, s, result) {
         }
         const flow = isWorkflowManifest(current.manifest);
         if (!flow) {
+            if (result.status !== "failed")
+                await recordTranscript(t, id, s.activeTurnId, current, updates);
             current.state =
                 result.status === "failed"
                     ? current.turnStartState
-                    : result.result.state;
+                    : leanState(result.result.state);
         }
-        current.checkpoint = result.checkpoint;
-        await t.put("checkpoints", JSON.stringify([id, s.activeTurnId, result.checkpoint.segment]), { checkpoint: result.checkpoint, status: result.status });
+        current.checkpoint = leanCheckpoint(result.checkpoint);
         current.status = result.status;
         current.waits =
             result.status === "paused" ? result.result.pending : undefined;
@@ -456,8 +490,6 @@ async function settleFailure(ctx, lease, s, error) {
             return;
         current.status = "failed";
         current.state = current.turnStartState;
-        if (current.checkpoint)
-            await t.put("checkpoints", JSON.stringify([id, s.activeTurnId, current.checkpoint.segment]), { checkpoint: current.checkpoint, status: "failed" });
         current.error = error instanceof Error ? error.message : String(error);
         const payload = { message: current.error };
         await t.event(id, current.activeTurnId, "turn.failed", payload);
@@ -469,3 +501,50 @@ async function settleFailure(ctx, lease, s, error) {
         await wakeWorkflowOf(ctx, t, current, s.activeTurnId, "turn.failed", payload);
     });
 }
+/** `checkpoint` with its engine state stored lean (`history.ts`). */
+function leanCheckpoint(checkpoint) {
+    const state = checkpoint?.state;
+    if (!checkpoint || !state)
+        return checkpoint;
+    return { ...checkpoint, state: leanState(state) };
+}
+/** Appends a segment's transcript edits; a snapshot moves `history.snapshot`. */
+async function recordTranscript(t, id, turnId, s, updates) {
+    for (const update of updates) {
+        const event = await t.event(id, turnId, "transcript.updated", update);
+        if (update.keep === 0)
+            s.history = { from: s.history?.from ?? event.seq, snapshot: event.seq };
+    }
+}
+/**
+ * A session written before transcripts were recorded keeps its transcript on its row: record
+ * it once (the turn's starting transcript, then the turn so far), and store the row lean.
+ */
+async function adoptStoredTranscript(t, s) {
+    if (s.history)
+        return;
+    const now = transcriptOf(s.state);
+    const start = s.activeTurnId ? transcriptOf(s.turnStartState) : now;
+    if (now.length === 0 && start.length === 0)
+        return;
+    let first;
+    const write = async (turnId, updates) => {
+        for (const update of updates) {
+            const event = await t.event(s.id, turnId, "transcript.updated", update);
+            first ??= event.seq;
+        }
+    };
+    await write(null, transcriptUpdates([], start));
+    if (s.activeTurnId)
+        await write(s.activeTurnId, transcriptUpdates(start, now));
+    s.history = { from: first ?? 0, snapshot: first ?? 0 };
+    s.state = leanState(s.state);
+    s.turnStartState = leanState(s.turnStartState);
+}
+/** The session's transcript, folded from its record from `history.from`. */
+async function foldSession(ctx, s) {
+    const rows = await ctx.store
+        .record()
+        .readRange(ctx.store.tenantId, s.id, s.history?.from ?? 0, Number.MAX_SAFE_INTEGER);
+    return foldTranscript(rows.map((row) => row.body));
+}

package/dist/tenant/cause.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Why the Host's Tenant could not be opened (tenancy.md §5). A cause is about the Tenant's
+ * own data or files (its database is newer than this Runtime, its vault key is missing, the
+ * database has an old layout): the Host fails readiness, names the cause in
+ * `/v1/admin/status` and the logs, and answers Tenant requests with the opaque 404 until it is
+ * repaired and the Host restarted. A failure outside the Tenant (Postgres unreachable) is not
+ * a cause: it is `TenantUnavailableError`, and the next request tries again.
+ */
+import type { TenantCause, TenantEnvelope } from "@nylorun/core/contracts";
+export type { TenantCause };
+/** Thrown by migrations, the Tenant bootstrap and the Tenant Runtime when the Tenant cannot open. */
+export declare class TenantOpenError extends Error {
+    readonly code: TenantCause["code"];
+    readonly repair: string;
+    /** The Tenant, when it was read before opening failed (`/v1/admin/status` names it). */
+    envelope?: TenantEnvelope;
+    constructor(fields: TenantCause);
+    toCause(): TenantCause;
+}
+/** A `TenantOpenError` with the standard repair for `code`. */
+export declare function openError(code: TenantCause["code"], message: string): TenantOpenError;
+/** The cause an error carries, when it is a `TenantOpenError`. */
+export declare function causeOf(error: unknown): TenantCause | undefined;
+/** What an operator does about each cause. */
+export declare function repairFor(code: TenantCause["code"]): string;

package/dist/tenant/cause.js

@@ -0,0 +1,45 @@
+/** Thrown by migrations, the Tenant bootstrap and the Tenant Runtime when the Tenant cannot open. */
+export class TenantOpenError extends Error {
+    code;
+    repair;
+    /** The Tenant, when it was read before opening failed (`/v1/admin/status` names it). */
+    envelope;
+    constructor(fields) {
+        super(fields.message);
+        this.name = "TenantOpenError";
+        this.code = fields.code;
+        this.repair = fields.repair;
+    }
+    toCause() {
+        return { code: this.code, message: this.message, repair: this.repair };
+    }
+}
+/** A `TenantOpenError` with the standard repair for `code`. */
+export function openError(code, message) {
+    return new TenantOpenError({ code, message, repair: repairFor(code) });
+}
+/** The cause an error carries, when it is a `TenantOpenError`. */
+export function causeOf(error) {
+    return error instanceof TenantOpenError ? error.toCause() : undefined;
+}
+/** What an operator does about each cause. */
+export function repairFor(code) {
+    switch (code) {
+        case "kek-missing":
+            return "restore the vault key (vault-kek in the Host root's keys/ directory) from a backup, then restart the Runtime and its gateway: the Tenant's ciphertext cannot be opened without it";
+        case "corrupt":
+            return "restore the database from a backup, then restart the Runtime";
+        case "schema-too-new":
+            return "the database was migrated by a newer Runtime: run that version or newer";
+        case "migration-failed":
+            return "inspect the Runtime log for the failed migration, fix it, then restart the Runtime";
+        case "envelope-invalid":
+            return "the nylorun.tenant row is missing or invalid: restore the database from a backup";
+        case "open-timeout":
+            return "opening the Tenant timed out: inspect the Runtime log and Postgres, then restart the Runtime";
+        case "open-failed":
+            return "inspect the Runtime log, repair what it names, then restart the Runtime";
+        case "database-layout-old":
+            return "this release starts fresh: point the Runtime at a new database (a new stack: `nylorun start`); the old database is left as it is";
+    }
+}

package/dist/tenant/commands.js

@@ -153,7 +153,7 @@ export async function command(ctx, id, input, scope) {
             });
             await slimModelEffects(t, id, cancelledTurnId);
             // The process running the advance aborts it on `session.cancel` (tenant/control).
-            t.afterCommit(() => signalSessionCancel(ctx, id));
+            t.afterCommit(() => signalSessionCancel(ctx, id, cancelledTurnId));
             s.activeTurnId = null;
             if (cancelledTurnId !== null)
                 s.lastTurnId = cancelledTurnId;
@@ -182,6 +182,9 @@ export async function command(ctx, id, input, scope) {
                 if (scope.kind === "token" && scope.limits)
                     await chargeTurn(t, scope.subject, scope.limits);
                 s.turnStartState = s.state;
+                // A new turn folds from the latest snapshot: a cancel or failure only reverts this turn.
+                if (s.history?.snapshot !== undefined)
+                    s.history = { ...s.history, from: s.history.snapshot };
                 s.activeTurnId = randomUUID();
                 if (isWorkflowManifest(s.manifest)) {
                     const input = "content" in command ? command.content : command.data;
@@ -263,7 +266,6 @@ export async function command(ctx, id, input, scope) {
                     segment: (s.checkpoint?.segment ?? 0) + 1,
                 });
             }
-            await t.put("checkpoints", JSON.stringify([id, s.activeTurnId, s.checkpoint.segment]), { checkpoint: s.checkpoint, status: "runnable" });
             s.status = "runnable";
             s.waits = undefined;
             const commandWake = {

package/dist/tenant/context.d.ts

@@ -13,6 +13,7 @@
  * `wake` goes to `DurableExecution.wake`, which calls the Tenant's `advance` (`advance.ts`)
  * under ownership (§10.6); `abortLocal` aborts an advance running on this process.
  */
+import type { SessionHistory } from "./history.js";
 import type { RoleLimits, SubjectScope, TenantEnvelope } from "@nylorun/core/contracts";
 import type { DurableCheckpoint, FlowCheckpoint } from "@nylorun/harness/run";
 import type { AgentManifest, JsonValue, SandboxManifest } from "@nylorun/core/define";
@@ -20,6 +21,9 @@ import type { CredentialSelection } from "@nylorun/core/contracts";
 import type { SessionStore, Tx } from "../store/types.js";
 import type { FlowLimits } from "../core/limits.js";
 import type { ModelProvider } from "../core/provider.js";
+import type { ModelGate } from "../gates/model-gate.js";
+import type { ToolGate } from "../gates/tool-gate.js";
+import type { Keys } from "../keys/keys.js";
 import type { VaultService } from "../vault/service.js";
 import type { McpPool } from "../mcp/pool.js";
 import type { McpDiagnostic, McpSnapshot } from "../mcp/snapshot.js";
@@ -43,8 +47,11 @@ export interface Session {
     status: string;
     activeTurnId: string | null;
     checkpoint?: DurableCheckpoint | FlowCheckpoint;
+    /** The engine state; its transcript is folded from the record (`history.ts`), not stored. */
     state?: any;
     turnStartState?: any;
+    /** Where the transcript's fold starts in the session's record (`history.ts`). */
+    history?: SessionHistory;
     waits?: unknown;
     error?: string;
     /** Last completed turn output (for linked agent → workflow settle). */
@@ -135,8 +142,21 @@ export interface TenantContext {
     readonly sandbox: SandboxManager;
     readonly flowLimits: FlowLimits;
     readonly modelProvider: ModelProvider;
-    /** True when the model comes from the Tenant vault selection (pi-ai adapter). */
+    /** True when the model comes from the Tenant vault selection, served by `modelGate`. */
     readonly useVaultModel: boolean;
+    /** Serves vault-backed model calls (blueprint §15): in this process, or the gates service. */
+    readonly modelGate: ModelGate;
+    /**
+     * Serves remote MCP servers and Action deliveries (blueprint §12, F4.1): in this process, or
+     * the gates service.
+     */
+    readonly toolGate: ToolGate;
+    /**
+     * Vault writes that touch a secret, and all token signing (blueprint §14, F4.2): in this
+     * process, or the gateway's keys service. Call it instead of `vault`'s sealing methods and
+     * `signingKeys`' private key.
+     */
+    readonly keys: Keys;
     /** Set by drain/close; reset clears it again. Stops new advances. */
     closing: boolean;
     /** Set once close has finished releasing resources. */
@@ -157,8 +177,11 @@ export interface TenantContext {
      * re-wakes anything left runnable.
      */
     wake(sessionId: string, wake: Wake): Promise<void>;
-    /** Seam: abort the advance of a session running in this process, if any. */
-    abortLocal(sessionId: string): void;
+    /**
+     * Seam: abort the advance of a session running in this process, if any. With `turnId`, only
+     * an advance of that turn (a cancel signal names the turn it cancelled).
+     */
+    abortLocal(sessionId: string, turnId?: string): void;
     /**
      * Seam: deliver an Action to its agent's Action endpoint (`DurableExecution.deliver`). Call it
      * from `t.afterCommit`. Dropped while the Tenant is closing; the sweep re-sends it.

package/dist/tenant/delivery-token.js

@@ -10,7 +10,7 @@
  * (`signing-keys.ts`), so a rotation never revokes a live token.
  */
 import { createHash, randomUUID } from "node:crypto";
-import { errors, jwtVerify, SignJWT } from "jose";
+import { errors, jwtVerify } from "jose";
 import { DELIVERY_TOKEN_MAX_TTL_SECONDS, DELIVERY_TOKEN_TYPE, subjectTokenIssuer, } from "@nylorun/core/contracts";
 import { failOpaque, HttpError } from "./http.js";
 import { CLOCK_TOLERANCE_SECONDS, tokenKeyId } from "./jwt.js";
@@ -23,27 +23,26 @@ export function bodyHash(body) {
  * is capped at `DELIVERY_TOKEN_MAX_TTL_SECONDS`.
  */
 export async function mintDeliveryToken(ctx, options) {
-    const kek = ctx.signingKeys.kek();
-    const row = await ctx.store.tx((t) => ctx.signingKeys.ensure(t, kek));
-    const signer = await ctx.signingKeys.privateKey(row, kek);
     const ttl = Math.max(1, Math.min(Math.floor(options.ttlSeconds), DELIVERY_TOKEN_MAX_TTL_SECONDS));
     const iat = Math.floor(Date.now() / 1000);
     const tokenId = randomUUID();
     const delivery = options.for;
-    const token = await new SignJWT({
-        agt: delivery.agentId,
-        gen: delivery.kind === "action" ? delivery.generation : 0,
-        bdy: bodyHash(options.body),
-    })
-        .setProtectedHeader({ alg: "ES256", typ: DELIVERY_TOKEN_TYPE, kid: signer.id })
-        .setIssuer(subjectTokenIssuer(ctx.config.tenantId))
-        .setAudience(options.audience)
-        .setSubject(delivery.kind === "action" ? delivery.actionId : "ping")
-        .setIssuedAt(iat)
-        .setExpirationTime(iat + ttl)
-        .setJti(tokenId)
-        .sign(signer.key);
-    return { token, expiresAt: (iat + ttl) * 1000, tokenId, keyId: signer.id };
+    // Signed by the keys service (F4.2): this process never holds the private key.
+    const { token, keyId } = await ctx.keys.sign({
+        typ: DELIVERY_TOKEN_TYPE,
+        claims: {
+            agt: delivery.agentId,
+            gen: delivery.kind === "action" ? delivery.generation : 0,
+            bdy: bodyHash(options.body),
+            iss: subjectTokenIssuer(ctx.config.tenantId),
+            aud: options.audience,
+            sub: delivery.kind === "action" ? delivery.actionId : "ping",
+            iat,
+            exp: iat + ttl,
+            jti: tokenId,
+        },
+    });
+    return { token, expiresAt: (iat + ttl) * 1000, tokenId, keyId };
 }
 /**
  * Verifies a delivery token presented as a bearer. Answers `401 token_expired` for an expired

package/dist/tenant/delivery.d.ts

@@ -3,7 +3,7 @@ import type { DeliverResult } from "../execution/types.js";
 import type { Tx } from "../store/types.js";
 import { type Session, type TenantContext } from "./context.js";
 import { type DeliveryScope } from "./delivery-token.js";
-import { type OutboundResult } from "./outbound.js";
+import type { OutboundResult } from "./outbound.js";
 /**
  * Offers an Action that just became `pending` to its agent's endpoint, after the transaction
  * commits. Without an endpoint it waits for the agent's next registration (`PUT /v1/endpoints`).

package/dist/tenant/delivery.js

@@ -27,7 +27,6 @@ import { acceptedOutcome, recordActionOutcome } from "./commands.js";
 import { sandboxLookup } from "./context.js";
 import { mintDeliveryToken } from "./delivery-token.js";
 import { fail } from "./http.js";
-import { post } from "./outbound.js";
 const DONE = { status: "done" };
 /** Extra time past the endpoint's timeout before an unanswered delivery counts as lost. */
 const DEADLINE_GRACE_MS = 5_000;
@@ -115,14 +114,17 @@ export async function deliverAction(ctx, actionId, signal) {
     const inFlight = track(ctx, action.sessionId, cancel);
     let result;
     try {
-        result = await post(endpoint.url, body, {
-            [SIGNATURE_HEADER]: minted.token,
-            [PROTOCOL_HEADER]: String(PROTOCOL_VERSION),
-            "idempotency-key": actionId,
-        }, {
-            policy: ctx.config.delivery ?? {},
-            signal: AbortSignal.any([signal, cancel.signal, AbortSignal.timeout(endpoint.timeoutMs)]),
-        });
+        // Through the Tool Gate (F4.1): the gates service POSTs it under its own address policy.
+        result = await ctx.toolGate.post({
+            url: endpoint.url,
+            body,
+            headers: {
+                [SIGNATURE_HEADER]: minted.token,
+                [PROTOCOL_HEADER]: String(PROTOCOL_VERSION),
+                "idempotency-key": actionId,
+            },
+            timeoutMs: endpoint.timeoutMs,
+        }, AbortSignal.any([signal, cancel.signal, AbortSignal.timeout(endpoint.timeoutMs)]));
     }
     finally {
         inFlight();
@@ -370,10 +372,13 @@ export async function pingEndpoint(ctx, agentId) {
         body,
         ttlSeconds: TOKEN_SLACK_SECONDS,
     });
-    const result = await post(endpoint.url, body, { [SIGNATURE_HEADER]: minted.token, [PROTOCOL_HEADER]: String(PROTOCOL_VERSION) }, {
-        policy: ctx.config.delivery ?? {},
-        signal: AbortSignal.timeout(Math.min(endpoint.timeoutMs, 10_000)),
-    });
+    const timeoutMs = Math.min(endpoint.timeoutMs, 10_000);
+    const result = await ctx.toolGate.post({
+        url: endpoint.url,
+        body,
+        headers: { [SIGNATURE_HEADER]: minted.token, [PROTOCOL_HEADER]: String(PROTOCOL_VERSION) },
+        timeoutMs,
+    }, AbortSignal.timeout(timeoutMs));
     const at = new Date().toISOString();
     const refuse = async (code, message) => {
         await ctx.store.tx((t) => t.recordEndpointHealth(agentId, { kind: "failure", at, code, message }));

package/dist/tenant/effects.d.ts

@@ -1,6 +1,6 @@
 import type { EffectResolution, HostEffect } from "@nylorun/harness/run";
 import type { AuthorizeResult } from "../vault/service.js";
-import { type Lease, type TenantContext } from "./context.js";
+import { type Lease, type Session, type TenantContext } from "./context.js";
 import type { ModelProvider } from "../core/provider.js";
 /** What one advance's segment decides for all its effects. */
 export interface SegmentOptions {
@@ -13,6 +13,20 @@ export interface SegmentOptions {
  * advance decides what the abort means.
  */
 export declare function invokeModel(ctx: TenantContext, request: HostEffect, signal: AbortSignal, model?: ModelProvider): Promise<unknown>;
+/**
+ * True when this Tenant's remote MCP calls outlive the process that sent them (the gates
+ * service, F4.1 G3): after a takeover or a shutdown, the journaled call is re-sent and joins
+ * the running call or gets its answer, instead of becoming `uncertain`.
+ */
+export declare function recoversMcpCalls(ctx: TenantContext): boolean;
+/** True when `request` calls a tool of a remote (`streamable-http` or `sse`) MCP server. */
+export declare function isRemoteMcpEffect(s: Session, request: HostEffect): boolean;
+/**
+ * True when this Tenant's vault-backed model calls outlive the process that sent them (the
+ * gates service, P1.2): after a takeover or a shutdown, the journaled call is re-sent and joins
+ * the running call or gets its outcome, instead of becoming `uncertain`.
+ */
+export declare function recoversModelCalls(ctx: TenantContext): boolean;
 export declare function resolveEffect(ctx: TenantContext, request: HostEffect, signal: AbortSignal, lease: Lease, segment?: SegmentOptions): Promise<EffectResolution>;
 /** Journal and dispatch a new flow effect (agent / tool node / fn / verify). */
 export declare function resolveNewFlowEffect(ctx: TenantContext, request: HostEffect, signal: AbortSignal, lease: Lease): Promise<EffectResolution>;