@nylorun/runtime 0.14.0-beta → 0.15.0-beta

package/dist/tenant/paths.js

@@ -1,14 +1,9 @@
-import { existsSync, mkdirSync, readdirSync, realpathSync, renameSync, } from "node:fs";
+import { existsSync, mkdirSync, realpathSync } from "node:fs";
 import { join, resolve, sep } from "node:path";
-import { isTenantId } from "@nylorun/core/compatibility";
-function ensureDir(path) {
-    mkdirSync(path, { recursive: true });
-    return realpathSync(path);
-}
 function assertContained(parent, child) {
     const root = parent.endsWith(sep) ? parent : parent + sep;
     if (child !== parent && !child.startsWith(root)) {
-        throw new Error(`Path ${child} escapes host tenants root ${parent}`);
+        throw new Error(`Path ${child} escapes the Host root ${parent}`);
     }
 }
 /** Host layout under NYLORUN_HOME / ~/.nylorun. */
@@ -20,72 +15,33 @@ export function hostPaths(hostRoot) {
         credentials: join(root, "host-credentials.json"),
         home: join(root, "home"),
         tmp: join(root, "tmp"),
-        tenants: join(root, "tenants"),
-        trash: join(root, "trash"),
+        tenant: join(root, "tenant"),
     };
 }
 /**
- * Absolute Tenant directory paths under `<hostRoot>/tenants/<tenantId>/`.
- * Validates the id and asserts containment after realpath.
+ * Absolute paths of the Tenant directory, `<hostRoot>/tenant/`: a Host serves one Tenant
+ * (tenancy.md §1), so the directory has no id segment. Asserts that it stays inside the Host
+ * root after realpath.
  *
- * The directory holds what stays on the Host (the Tenant's data is its Postgres schema):
- * `vault-kek`, `home/`, `tmp/`, `sandboxes/`, `plugin-data/`, `logs/tenant.log`.
+ * The directory holds what stays on the Host (the Tenant's data is its database): `home/`,
+ * `tmp/`, `sandboxes/`, `plugin-data/`, `logs/tenant.log`. The vault key is the one exception:
+ * it lives beside the Tenant directory, in `<hostRoot>/keys/vault-kek`, which the local stack
+ * mounts only into the gateway (F4.2), never into the runtime container.
  */
-export function tenantPaths(hostRoot, tenantId) {
-    if (!isTenantId(tenantId)) {
-        throw new Error(`Invalid tenant id: ${String(tenantId)}`);
-    }
-    const host = hostPaths(hostRoot);
-    const tenantsRoot = ensureDir(host.tenants);
-    const root = join(tenantsRoot, tenantId);
-    // Containment before the Tenant directory exists: resolve under real tenants root.
-    const resolvedRoot = resolve(tenantsRoot, tenantId);
-    assertContained(tenantsRoot, resolvedRoot);
-    if (existsSync(root)) {
-        assertContained(tenantsRoot, realpathSync(root));
-    }
+export function tenantPaths(hostRoot) {
+    mkdirSync(hostRoot, { recursive: true });
+    const host = realpathSync(hostRoot);
+    const root = join(host, "tenant");
+    if (existsSync(root))
+        assertContained(host, realpathSync(root));
     return {
-        root: resolvedRoot,
-        kek: join(resolvedRoot, "vault-kek"),
-        home: join(resolvedRoot, "home"),
-        tmp: join(resolvedRoot, "tmp"),
-        sandboxes: join(resolvedRoot, "sandboxes"),
-        pluginData: join(resolvedRoot, "plugin-data"),
-        logs: join(resolvedRoot, "logs"),
-        log: join(resolvedRoot, "logs", "tenant.log"),
+        root,
+        kek: join(host, "keys", "vault-kek"),
+        home: join(root, "home"),
+        tmp: join(root, "tmp"),
+        sandboxes: join(root, "sandboxes"),
+        pluginData: join(root, "plugin-data"),
+        logs: join(root, "logs"),
+        log: join(root, "logs", "tenant.log"),
     };
 }
-/** The database file of a Tenant from before the Postgres Session Store. */
-const SQLITE_DATABASE = "tenant.sqlite";
-/**
- * Moves every Tenant directory that holds a `tenant.sqlite` to `trash/`, logging each.
- *
- * Those are beta Tenants from the SQLite Runtime. They are not migrated (recreate them); a
- * Postgres Tenant's directory never holds that file. Moving them at Host start keeps a new
- * Postgres Tenant with the same id from sharing the old directory. Returns the moved ids.
- */
-export function trashSqliteTenants(hostRoot, logger) {
-    const host = hostPaths(hostRoot);
-    if (!existsSync(host.tenants))
-        return [];
-    const moved = [];
-    const stamp = new Date().toISOString().replaceAll(":", "-");
-    for (const entry of readdirSync(host.tenants, { withFileTypes: true })) {
-        if (!entry.isDirectory())
-            continue;
-        const directory = join(host.tenants, entry.name);
-        if (!existsSync(join(directory, SQLITE_DATABASE)))
-            continue;
-        mkdirSync(host.trash, { recursive: true });
-        const destination = join(host.trash, `${entry.name}-sqlite-${stamp}`);
-        renameSync(directory, destination);
-        moved.push(entry.name);
-        logger.warn("sqlite_tenant_moved_to_trash", {
-            tenant: entry.name,
-            from: directory,
-            to: destination,
-            reason: "SQLite Tenants are not migrated to the Postgres Session Store; recreate the Tenant",
-        });
-    }
-    return moved;
-}

package/dist/tenant/pool.d.ts

@@ -3,6 +3,6 @@ export declare class TimeoutError extends Error {
 }
 /**
  * Race a promise against a timeout. On timeout the late result is handed to
- * `onLate` (Risk R6: mark quarantined and close a late handle).
+ * `onLate` (Risk R6: the module closes a handle that opened too late).
  */
 export declare function withTimeout<T>(promise: Promise<T>, timeoutMs: number, onLate?: (late: Promise<T>) => void): Promise<T>;

package/dist/tenant/pool.js

@@ -6,7 +6,7 @@ export class TimeoutError extends Error {
 }
 /**
  * Race a promise against a timeout. On timeout the late result is handed to
- * `onLate` (Risk R6: mark quarantined and close a late handle).
+ * `onLate` (Risk R6: the module closes a handle that opened too late).
  */
 export async function withTimeout(promise, timeoutMs, onLate) {
     let timer;

package/dist/tenant/principals.d.ts

@@ -1,16 +1,28 @@
-import type { Tx } from "../store/types.js";
-import type { BootstrapPrincipal } from "./types.js";
+import type { InitialPrincipal } from "../store/postgres/tenant.js";
 export type { PrincipalRow } from "../store/types.js";
 /** Principal id of the Studio key derived from the admin key. */
 export declare const STUDIO_PRINCIPAL_ID = "studio";
+/** The derived principal Projects use (`PROJECT_PRINCIPAL_ID` in `@nylorun/admin`). */
+export declare const PROJECT_PRINCIPAL_ID = "project";
+/** The derived principals a Host registers when not told otherwise. */
+export declare const DEFAULT_DERIVED_PRINCIPALS: readonly string[];
+/** The Studio key of `tenantId`: HMAC-SHA256 of the admin key. */
+export declare function deriveStudioKey(adminKey: string, tenantId: string): string;
+/** The key of derived principal `principalId` on `tenantId`: HMAC-SHA256 of the admin key. */
+export declare function deriveTenantKey(adminKey: string, tenantId: string, principalId: string): string;
+/** Whether `id` may name a derived principal: the client's name, never `studio`. */
+export declare function isDerivedPrincipalId(id: string): boolean;
 /**
- * Writes the application principal and idempotency key in the caller's transaction, plus
- * principal `studio` when the bootstrap carries a Studio credential hash.
- * Exported for WS-B's `TenantStore.create` (A3).
+ * The principals a Host's Tenant is created with: `studio`, each derived principal, and an
+ * application principal when a key is given (the ephemeral Runtime). Keys are hashed here.
  */
-export declare function bootstrapPrincipal(t: Tx, bootstrap: BootstrapPrincipal, now?: Date): Promise<void>;
-/**
- * Whether the stored bootstrap, Studio and derived principals equal `bootstrap`. A retried
- * create names the same derived principals, so each must be stored with its hash.
- */
-export declare function bootstrapPrincipalMatches(t: Tx, bootstrap: BootstrapPrincipal): Promise<boolean>;
+export declare function hostPrincipals(options: {
+    adminKey: string;
+    derived?: readonly string[];
+    application?: {
+        principalId: string;
+        key: string;
+    };
+    /** Registers `studio` with this hash instead of the admin key's derivation. */
+    studioCredentialHash?: string;
+}): (tenantId: string) => InitialPrincipal[];

package/dist/tenant/principals.js

@@ -1,56 +1,68 @@
+/**
+ * The principals the Host gives its Tenant when it creates it (tenancy.md §4, plan P9): the
+ * Studio principal and the derived principals, whose keys the admin key derives, so the
+ * clients holding the admin key (Studio, `nylorun start`, Babai) store none. The Tenant keeps
+ * only their hashes.
+ *
+ * The derivations are the ones `@nylorun/admin` computes on the client side
+ * (`admin/src/derived-credentials.ts`: `deriveStudioToken`, `deriveTenantKey`); both sides
+ * must stay byte for byte the same.
+ */
+import { createHmac } from "node:crypto";
+import { DERIVED_PRINCIPAL_ID_PATTERN } from "@nylorun/core/compatibility";
+import { hashToken } from "../core/bearer.js";
 /** Principal id of the Studio key derived from the admin key. */
 export const STUDIO_PRINCIPAL_ID = "studio";
+/** The derived principal Projects use (`PROJECT_PRINCIPAL_ID` in `@nylorun/admin`). */
+export const PROJECT_PRINCIPAL_ID = "project";
+/** The derived principals a Host registers when not told otherwise. */
+export const DEFAULT_DERIVED_PRINCIPALS = [PROJECT_PRINCIPAL_ID];
+/** The Studio key of `tenantId`: HMAC-SHA256 of the admin key. */
+export function deriveStudioKey(adminKey, tenantId) {
+    return hmac(adminKey, ["nylorun/studio/v1", tenantId]);
+}
+/** The key of derived principal `principalId` on `tenantId`: HMAC-SHA256 of the admin key. */
+export function deriveTenantKey(adminKey, tenantId, principalId) {
+    return hmac(adminKey, ["nylorun/principal/v1", principalId, tenantId]);
+}
+/** Whether `id` may name a derived principal: the client's name, never `studio`. */
+export function isDerivedPrincipalId(id) {
+    return DERIVED_PRINCIPAL_ID_PATTERN.test(id) && id !== STUDIO_PRINCIPAL_ID;
+}
 /**
- * Writes the application principal and idempotency key in the caller's transaction, plus
- * principal `studio` when the bootstrap carries a Studio credential hash.
- * Exported for WS-B's `TenantStore.create` (A3).
+ * The principals a Host's Tenant is created with: `studio`, each derived principal, and an
+ * application principal when a key is given (the ephemeral Runtime). Keys are hashed here.
  */
-export async function bootstrapPrincipal(t, bootstrap, now = new Date()) {
-    const createdAt = now.toISOString();
-    await t.insertPrincipal({
-        id: bootstrap.principalId,
-        role: "application",
-        tokenHash: bootstrap.credentialHash,
-        idempotencyKey: bootstrap.idempotencyKey,
-        createdAt,
-    });
-    if (bootstrap.studioCredentialHash)
-        await t.insertPrincipal({
+export function hostPrincipals(options) {
+    const derived = options.derived ?? DEFAULT_DERIVED_PRINCIPALS;
+    for (const id of derived)
+        if (!isDerivedPrincipalId(id))
+            throw new Error(`Derived principal id '${id}' must match ${DERIVED_PRINCIPAL_ID_PATTERN} and not be '${STUDIO_PRINCIPAL_ID}'`);
+    return (tenantId) => [
+        ...(options.application
+            ? [
+                {
+                    id: options.application.principalId,
+                    credentialHash: hashToken(options.application.key),
+                },
+            ]
+            : []),
+        {
             id: STUDIO_PRINCIPAL_ID,
-            role: "application",
-            tokenHash: bootstrap.studioCredentialHash,
-            idempotencyKey: null,
-            createdAt,
-        });
-    for (const principal of bootstrap.derivedPrincipals ?? [])
-        await t.insertPrincipal({
-            id: principal.id,
-            role: "application",
-            tokenHash: principal.credentialHash,
-            idempotencyKey: null,
-            createdAt,
-        });
+            credentialHash: options.studioCredentialHash ??
+                hashToken(deriveStudioKey(options.adminKey, tenantId)),
+        },
+        ...[...new Set(derived)].map((id) => ({
+            id,
+            credentialHash: hashToken(deriveTenantKey(options.adminKey, tenantId, id)),
+        })),
+    ];
 }
-/**
- * Whether the stored bootstrap, Studio and derived principals equal `bootstrap`. A retried
- * create names the same derived principals, so each must be stored with its hash.
- */
-export async function bootstrapPrincipalMatches(t, bootstrap) {
-    const row = await t.principalById(bootstrap.principalId);
-    if (!row ||
-        row.role !== "application" ||
-        row.tokenHash !== bootstrap.credentialHash ||
-        row.idempotencyKey !== bootstrap.idempotencyKey)
-        return false;
-    const studio = await t.principalById(STUDIO_PRINCIPAL_ID);
-    if ((studio?.role === "application" ? studio.tokenHash : undefined) !==
-        bootstrap.studioCredentialHash)
-        return false;
-    for (const principal of bootstrap.derivedPrincipals ?? []) {
-        const stored = await t.principalById(principal.id);
-        if (stored?.role !== "application" ||
-            stored.tokenHash !== principal.credentialHash)
-            return false;
-    }
-    return true;
+/** HMAC-SHA256 (hex) of `parts` joined by NUL bytes, keyed with the admin key. */
+function hmac(adminKey, parts) {
+    const message = Buffer.concat(parts.flatMap((part, index) => [
+        ...(index > 0 ? [Buffer.from([0])] : []),
+        Buffer.from(part, "utf8"),
+    ]));
+    return createHmac("sha256", Buffer.from(adminKey, "utf8")).update(message).digest("hex");
 }

package/dist/tenant/runtime.d.ts

@@ -1,13 +1,31 @@
 import type { TenantEnvelope } from "@nylorun/core/contracts";
 import { type ModelProvider } from "../core/provider.js";
+import type { ModelGate } from "../gates/model-gate.js";
 import { type AuthorizeResult } from "../vault/service.js";
 import type { DurableStreams } from "../streams/types.js";
 import type { NodeBindings, OpenedTenant, TenantConfig, TenantHandle, TenantSummary } from "./types.js";
 import { type StreamsStatus } from "./streams.js";
 import { type TenantExecution, type TenantWorker } from "./worker.js";
+import { type ToolGate } from "../gates/tool-gate.js";
+import { type Keys } from "../keys/keys.js";
 /** TENANTS-CCR: test/injection hooks until TenantConfig gains them. */
 export type TenantOpenHooks = {
     modelProvider?: ModelProvider;
+    /**
+     * Serves the Tenant's vault-backed model calls (the gates service's client). Without one,
+     * the Tenant calls the model in this process.
+     */
+    modelGate?: ModelGate;
+    /**
+     * Serves the Tenant's remote MCP servers and Action deliveries (the gates service's client).
+     * Without one, the Tenant opens them and POSTs deliveries in this process.
+     */
+    toolGate?: ToolGate;
+    /**
+     * Runs vault writes and token signing (the `keys` service's client, F4.2). With one, this
+     * process never reads, creates or holds the vault key. Without one, it does them here.
+     */
+    keys?: Keys;
     vaultKek?: Buffer | string | null;
     /** When true, create the KEK file on first vault write (tests / new Tenants). */
     createKekIfMissing?: boolean;
@@ -26,7 +44,7 @@ export type TenantOpenHooks = {
      */
     streams?: DurableStreams;
     /**
-     * The Host's stream relay feeds `streams` from the record for every Tenant. Without it the
+     * The Host's stream relay feeds `streams` from the record. Without it the
      * Tenant relays its own commits.
      */
     hostRelay?: boolean;

package/dist/tenant/runtime.js

@@ -1,6 +1,7 @@
 import { mkdirSync } from "node:fs";
 import { resolveFlowLimits } from "../core/limits.js";
-import { scriptedModel, gatewayModel, toolFixtureModel, } from "../core/provider.js";
+import { scriptedModel, toolFixtureModel, } from "../core/provider.js";
+import { tenantModelGate } from "../gates/in-process.js";
 import { createKekFile, readVaultKek } from "../vault/kek.js";
 import { SigningKeys } from "./signing-keys.js";
 import { VaultService } from "../vault/service.js";
@@ -8,7 +9,7 @@ import { McpPool } from "../mcp/pool.js";
 import { SandboxManager } from "../sandbox/manager.js";
 import { defaultSandboxBackends } from "../sandbox/select.js";
 import { MemoryExecution } from "../execution/memory.js";
-import { QuarantineError } from "./quarantine-error.js";
+import { openError } from "./cause.js";
 import { MemoryStreams } from "../streams/memory.js";
 import { createSessionStreams, endAllStreams, } from "./session-streams.js";
 import { closeStreams, streamsStatus, wireStreams, } from "./streams.js";
@@ -18,6 +19,8 @@ import { sweep } from "./sweep.js";
 import { deliverAction } from "./delivery.js";
 import { TenantWorkers, WORKER_ID, } from "./worker.js";
 import { authorize } from "./effects.js";
+import { inProcessToolGate } from "../gates/tool-gate.js";
+import { inProcessKeys } from "../keys/keys.js";
 import { tenantApi } from "../api/http/app.js";
 /** Default ownership lease of an advance; the heartbeat renews it every third. */
 const DEFAULT_OWNER_LEASE_MS = 30_000;
@@ -67,20 +70,28 @@ export class TenantRuntime {
         let wired;
         let detach;
         try {
-            let kek = readVaultKek({
-                vaultKek: hooks.vaultKek,
-                vaultKekPath: paths.kek,
-            });
-            const sealed = await store.tx(async (t) => (await t.countCredentials()) + (await t.countSigningKeys()));
-            if (sealed > 0 && !kek) {
-                throw new QuarantineError("kek-missing", "Vault key-encryption key is missing for ciphertext (vault credentials or signing keys) in this Tenant", "restore the vault-kek file in the Tenant directory");
+            // With the keys service (F4.2) the key lives in the gateway: this process never reads,
+            // creates or holds it, and the gateway reports a missing key on its readiness.
+            let kek = hooks.keys
+                ? undefined
+                : readVaultKek({
+                    vaultKek: hooks.vaultKek,
+                    vaultKekPath: paths.kek,
+                });
+            if (!hooks.keys) {
+                const sealed = await store.tx(async (t) => (await t.countCredentials()) + (await t.countSigningKeys()));
+                if (sealed > 0 && !kek) {
+                    throw openError("kek-missing", "Vault key-encryption key is missing for ciphertext (vault credentials or signing keys) in this Tenant");
+                }
             }
             const createKekIfMissing = hooks.createKekIfMissing !== false;
             const ensureKek = () => {
+                if (hooks.keys)
+                    throw new Error("The vault key lives in the gateway's keys service: this process never reads it");
                 if (kek)
                     return kek;
                 if (!createKekIfMissing)
-                    throw new QuarantineError("kek-missing", "Vault key-encryption key is required", "restore the vault-kek file in the Tenant directory");
+                    throw openError("kek-missing", "Vault key-encryption key is required");
                 kek = createKekFile(paths.kek);
                 return kek;
             };
@@ -94,10 +105,14 @@ export class TenantRuntime {
             });
             // `ctx` is assigned below; these callbacks only run once the Tenant is open.
             let ctx;
+            const toolGate = hooks.toolGate ?? inProcessToolGate(config.delivery ?? {});
+            const signingKeys = new SigningKeys({ tenantId: config.tenantId, kek: ensureKek });
+            const keys = hooks.keys ?? inProcessKeys({ store: opened, vault, signingKeys, kek: ensureKek });
             const mcp = new McpPool({
                 pluginData: paths.pluginData,
                 childEnv: config.childEnv,
                 authorize: (sessionId, request) => authorize(ctx, sessionId, request),
+                ...(toolGate.openMcp ? { openRemote: (server) => toolGate.openMcp(server) } : {}),
             });
             const ephemeral = config.mode === "ephemeral";
             const sandbox = new SandboxManager({
@@ -126,22 +141,18 @@ export class TenantRuntime {
                 modelProvider = scriptedModel(config.model.output);
             else if (config.model.kind === "fixture")
                 modelProvider = toolFixtureModel();
-            else if (config.model.kind === "gateway") {
-                const gateway = config.model;
-                modelProvider = async (effect, signal) => {
-                    const secret = await vault.readHostModel();
-                    const token = typeof secret?.credential.key === "string"
-                        ? secret.credential.key
-                        : "";
-                    return gatewayModel({
-                        url: gateway.url,
-                        model: gateway.model,
-                        token,
-                    })(effect, signal);
-                };
-            }
             else
                 modelProvider = scriptedModel();
+            // With the gates service the loop never reads a model credential: only a Runtime
+            // without one (embedding, the ephemeral Runtime, tests) reads it here.
+            const modelGate = hooks.modelGate ??
+                tenantModelGate({
+                    store: opened,
+                    kek: ensureKek,
+                    root: paths.home,
+                    logger: config.logger,
+                    ...(config.modelCall ? { settings: config.modelCall } : {}),
+                });
             const sessionStreams = createSessionStreams();
             const local = hooks.execution
                 ? undefined
@@ -166,11 +177,14 @@ export class TenantRuntime {
                 flowLimits,
                 modelProvider,
                 useVaultModel,
+                modelGate,
+                toolGate,
                 closing: false,
                 closed: false,
                 work: createWorkState(),
                 sessionStreams,
-                signingKeys: new SigningKeys({ tenantId: config.tenantId, kek: ensureKek }),
+                signingKeys,
+                keys,
                 workerId: hooks.workerId ?? WORKER_ID,
                 ownerLeaseMs: config.ownerLeaseMs ?? DEFAULT_OWNER_LEASE_MS,
                 wake: async (sessionId, wake) => {
@@ -178,7 +192,7 @@ export class TenantRuntime {
                         return;
                     await execution.wake(config.tenantId, sessionId, wake);
                 },
-                abortLocal: (sessionId) => abortLocal(ctx, sessionId),
+                abortLocal: (sessionId, turnId) => abortLocal(ctx, sessionId, "cancel", turnId),
                 deliver: async (actionId) => {
                     if (ctx.closing || ctx.closed)
                         return;

package/dist/tenant/scheduler.d.ts

@@ -3,6 +3,8 @@ import { type AdvanceAbortKind } from "./worker.js";
 export interface WorkState {
     /** Advances running on this process, by session id. */
     readonly running: Map<string, AbortController>;
+    /** The turn each running advance belongs to, by session id (`null`: none). */
+    readonly runningTurns: Map<string, string | null>;
     /** Deliveries to Action endpoints in flight on this process, by their Action's session id. */
     readonly deliveries: Map<string, Set<AbortController>>;
     /** When each Action last reported a failed delivery (`action.delivery_failed` throttling). */
@@ -12,9 +14,9 @@ export declare function createWorkState(): WorkState;
 /**
  * Abort the advance of `id` if it runs on this process, and its deliveries to Action endpoints.
  * Cancel calls it after committing `cancelled`, and so does the control stream for cancels made
- * elsewhere.
+ * elsewhere. With `turnId`, an advance of another turn keeps running: the signal came late.
  */
-export declare function abortLocal(ctx: TenantContext, id: string, kind?: AdvanceAbortKind): void;
+export declare function abortLocal(ctx: TenantContext, id: string, kind?: AdvanceAbortKind, turnId?: string): void;
 /** Reset: abort every advance running on this process; their sessions are being cleared. */
 export declare function clearWork(ctx: TenantContext): void;
 /** Stop new advances; cancel active turns if asked; wait for running advances until the timeout. */

package/dist/tenant/scheduler.js

@@ -13,7 +13,7 @@ import { randomUUID } from "node:crypto";
 import { command } from "./commands.js";
 import { AdvanceAbort } from "./worker.js";
 export function createWorkState() {
-    return { running: new Map(), deliveries: new Map(), deliveryNotices: new Map() };
+    return { running: new Map(), runningTurns: new Map(), deliveries: new Map(), deliveryNotices: new Map() };
 }
 const MESSAGES = {
     cancel: "Turn cancelled",
@@ -28,11 +28,11 @@ function abortWith(controller, kind) {
 /**
  * Abort the advance of `id` if it runs on this process, and its deliveries to Action endpoints.
  * Cancel calls it after committing `cancelled`, and so does the control stream for cancels made
- * elsewhere.
+ * elsewhere. With `turnId`, an advance of another turn keeps running: the signal came late.
  */
-export function abortLocal(ctx, id, kind = "cancel") {
+export function abortLocal(ctx, id, kind = "cancel", turnId) {
     const controller = ctx.work.running.get(id);
-    if (controller)
+    if (controller && (turnId === undefined || ctx.work.runningTurns.get(id) === turnId))
         abortWith(controller, kind);
     // A cancel also closes the session's deliveries, which aborts the tools' `ctx.signal`.
     for (const delivery of ctx.work.deliveries.get(id) ?? [])

package/dist/tenant/session-streams.d.ts

@@ -105,6 +105,8 @@ export declare function observeSession(ctx: TenantContext, sessionId: string, cu
     holder?: StreamHolder;
     signal: AbortSignal;
 }): AsyncGenerator<LiveEvent>;
+/** Internal events (`transcript.updated`) are recorded and streamed but never served. */
+export declare function served(event: LiveEvent): boolean;
 /**
  * Ends every feed in this process whose session is gone or whose Tenant moved to a new basin
  * generation, and moves this process to the Tenant's current generation. Run on a

package/dist/tenant/session-streams.js

@@ -1,4 +1,4 @@
-import { decodeCursor, encodeCursor } from "../store/cursor.js";
+import { decodeCursor, encodeCursor } from "../record/index.js";
 import { basinOf } from "../streams/basin.js";
 import { sessionStream, } from "../streams/types.js";
 import { fail } from "./http.js";
@@ -88,7 +88,7 @@ export async function readHistory(ctx, sessionId, cursor, agent) {
     try {
         for await (const record of streams.read(ref.basin, ref.stream, from, { follow: false })) {
             last = record.seq;
-            if (agent === undefined || belongsTo(record.body, agent))
+            if (served(record.body) && (agent === undefined || belongsTo(record.body, agent)))
                 items.push(record.body);
         }
     }
@@ -255,7 +255,12 @@ function deliver(observer, record) {
     if (record.seq < observer.next)
         return;
     observer.next = record.seq + 1;
-    observer.sink.write(record.body);
+    if (served(record.body))
+        observer.sink.write(record.body);
+}
+/** Internal events (`transcript.updated`) are recorded and streamed but never served. */
+export function served(event) {
+    return event.visibility !== "internal";
 }
 /**
  * Follows the feed's stream from `feed.next` for the current `feed.read`, retrying failed

package/dist/tenant/status.d.ts

@@ -6,6 +6,7 @@ import type { TenantConfig } from "./types.js";
 import type { TenantEnvelope } from "@nylorun/core/contracts";
 import type { StuckInvocation } from "../execution/types.js";
 import type { StreamsStatus } from "./streams.js";
+import type { Keys } from "../keys/keys.js";
 export interface TenantStatusContext {
     envelope: TenantEnvelope;
     config: TenantConfig;
@@ -31,4 +32,6 @@ export declare function buildTenantStatus(ctx: TenantStatusContext): Promise<Ten
 export declare function seedTenantConfig(ctx: {
     store: SessionStore;
     vault: VaultService;
+    /** Seals the seeded model credential (F4.2). */
+    keys: Pick<Keys, "putHostModel">;
 }, body: SeedTenantConfigRequest): Promise<SeedTenantConfigResponse>;

package/dist/tenant/status.js

@@ -125,7 +125,7 @@ export async function seedTenantConfig(ctx, body) {
             kept.push("model");
         }
         else {
-            await ctx.vault.putHostModel({
+            await ctx.keys.putHostModel({
                 requestId: body.requestId,
                 idempotencyKey: `seed-model:${body.requestId}`,
                 ...body.model,

package/dist/tenant/store-pg.d.ts

@@ -1,15 +1,18 @@
 import type { PostgresClient } from "../store/postgres/connect.js";
-import type { Migration } from "../store/postgres/migrations/index.js";
-import { type Logger, type OpenTenantRuntime, type TenantConfig, type TenantStore } from "./types.js";
-export interface PostgresTenantStoreOptions {
+import type { Migration } from "../store/postgres/migrate.js";
+import { type TenantCreation } from "../store/postgres/tenant.js";
+import { type Logger, type OpenTenantRuntime, type TenantConfig, type TenantOpener } from "./types.js";
+export interface PostgresTenantOptions {
     hostRoot: string;
-    /** The Host's pool. The store never ends it. */
+    /** The pool on the Tenant's database. The Tenant never ends it. */
     sql: PostgresClient;
-    /** Opens the Tenant Runtime on a store the catalog opened; the Runtime then owns it. */
+    /** Who the Tenant is when the database holds none yet. */
+    create: TenantCreation;
+    /** Opens the Tenant Runtime on the opened store; the Runtime then owns it. */
     openRuntime: OpenTenantRuntime;
     configFor: (tenantId: string) => TenantConfig;
     logger?: Logger;
     /** Tests only: the migrations this Runtime knows. */
     migrations?: readonly Migration[];
 }
-export declare function createPostgresTenantStore(options: PostgresTenantStoreOptions): TenantStore;
+export declare function createPostgresTenantOpener(options: PostgresTenantOptions): TenantOpener;