@nylorun/runtime 0.15.1-beta → 0.16.0-beta

package/dist/host/app.js

@@ -45,7 +45,10 @@ export function createHostApp(options) {
     });
     app.use(async (c, next) => {
         const { incoming } = c.env;
-        if (requestHasBody(incoming) && !isJsonContentType(headerValue(incoming, "content-type")))
+        if (requestHasBody(incoming) &&
+            !isJsonContentType(headerValue(incoming, "content-type")) &&
+            // An artifact upload's body is the file itself, of any type.
+            tenantRouteOf(incoming)?.bytes !== true)
             return rejectedResponse(415, "unsupported_media_type", "Request bodies must use application/json");
         await next();
     });
@@ -100,7 +103,10 @@ export function createHostApp(options) {
             return rejectedResponse(400, "invalid_request", `${PUBLISHABLE_KEY_HEADER} header is malformed`);
         const tenantHeader = headerValue(incoming, TENANT_HEADER);
         const named = tenantHeader === undefined || tenantHeader.trim() === "" ? undefined : tenantHeader.trim();
-        if (!protocolAccepted(headerValue(incoming, PROTOCOL_HEADER)))
+        const protocol = headerValue(incoming, PROTOCOL_HEADER);
+        // A capability link is opened without the header; when one is sent, it is checked.
+        if (!protocolAccepted(protocol) &&
+            !(protocol === undefined && tenantRouteOf(incoming)?.unversioned === true))
             return protocolRejectedResponse();
         const resolution = await module.resolve();
         if (resolution.kind !== "open") {
@@ -152,6 +158,21 @@ export function createHostApp(options) {
 function browserRoute(method, segments) {
     return findTenantRoute(method, segments)?.browser === true;
 }
+/** The Tenant route a request names, if any; a malformed path names none. */
+function tenantRouteOf(incoming) {
+    const segments = [];
+    for (const segment of pathnameOf(incoming).split("/").filter(Boolean)) {
+        try {
+            segments.push(decodeURIComponent(segment));
+        }
+        catch {
+            return undefined;
+        }
+    }
+    if (segments[0] !== "v1" || segments[1] === "admin")
+        return undefined;
+    return findTenantRoute(incoming.method ?? "GET", segments);
+}
 /** The answer's status: a Response's, or the Node response's when it was written there. */
 function statusOf(c) {
     const logged = c.get("status");

package/dist/host/gates.d.ts

@@ -3,7 +3,8 @@
  * the Tool Gate's routes (`api/gate/routes.ts`), behind the same `Host` check as the Runtime's
  * listeners.
  * It opens no Tenant runtime, no Restate endpoint and no stream relay, and runs no migration;
- * it needs only the Postgres pool and the Host's tenant directory (read-only).
+ * it needs only the Postgres pool and the Host's tenant directory (read-only). Run tokens (F5)
+ * verify against the Tenant's public keys and session rows in that database.
  *
  * Nothing is written while a model call runs, so the server's request timeout sits above the
  * gate's longest call. Closing stops accepting calls, lets running ones finish for up to
@@ -13,11 +14,13 @@ import { type Server } from "node:http";
 import { type InflightCallsOptions } from "../gates/inflight.js";
 import type { openMcpServer } from "../mcp/connect.js";
 import type { OutboundPolicy } from "../tenant/outbound.js";
+import { type BlobStore } from "../blob/index.js";
 import type { ModelCallSettings } from "../gates/model-gate.js";
 import { type TenantVaults } from "../gates/tenant-vaults.js";
 import type { PostgresClient } from "../store/postgres/connect.js";
 import type { Logger } from "../tenant/types.js";
-import type { GatesConfig } from "./stack-config.js";
+import type { EgressConfig, GatesConfig } from "./stack-config.js";
+import { type EgressGate, type StartEgressGateOptions } from "../gates/egress.js";
 /** Above the gate's 600 s provider request timeout and the loop's 630 s client timeout. */
 export declare const GATES_REQUEST_TIMEOUT_MS = 660000;
 export interface StartGatesOptions {
@@ -48,6 +51,11 @@ export interface StartGatesOptions {
      * with the Tenant's vault key. The gateway is then not ready until the key file is there.
      */
     readonly keys?: boolean;
+    /**
+     * The Object store model-gate reads the files a prompt names from (protocol 6): the stack's
+     * `s3` store. Without one, the Tenant's `fs` store under the Host root, when there is one.
+     */
+    readonly blobs?: BlobStore;
 }
 export interface GatesServer {
     /** Where the gate listens, e.g. `http://0.0.0.0:4100`. */
@@ -56,3 +64,20 @@ export interface GatesServer {
     close(): Promise<void>;
 }
 export declare function startGates(options: StartGatesOptions): Promise<GatesServer>;
+export interface StartEgressOptions {
+    readonly egress: EgressConfig;
+    readonly logger: Logger;
+    /** The pool for the Tenant's keys and sandboxes. Required unless `vaults` is given. */
+    readonly database?: PostgresClient;
+    /** The Host root. Required unless `vaults` is given. */
+    readonly hostRoot?: string;
+    /** Replaces the Postgres-backed Tenant (tests). */
+    readonly vaults?: TenantVaults;
+    /** Replaces how sandboxes are read, and the gate's limits and hooks (tests). */
+    readonly gate?: Partial<Omit<StartEgressGateOptions, "listen" | "logger" | "verify">>;
+}
+/**
+ * egress-gate (`--service egress`, F7.2): pods' CONNECT proxy, verifying egress tokens against the
+ * Tenant's public keys and reading its sandboxes from the same database as the gates.
+ */
+export declare function startEgress(options: StartEgressOptions): Promise<EgressGate>;

package/dist/host/gates.js

@@ -3,7 +3,8 @@
  * the Tool Gate's routes (`api/gate/routes.ts`), behind the same `Host` check as the Runtime's
  * listeners.
  * It opens no Tenant runtime, no Restate endpoint and no stream relay, and runs no migration;
- * it needs only the Postgres pool and the Host's tenant directory (read-only).
+ * it needs only the Postgres pool and the Host's tenant directory (read-only). Run tokens (F5)
+ * verify against the Tenant's public keys and session rows in that database.
  *
  * Nothing is written while a model call runs, so the server's request timeout sits above the
  * gate's longest call. Closing stops accepting calls, lets running ones finish for up to
@@ -18,9 +19,13 @@ import { createMcpHandler, GATE_MCP_IDLE_MS } from "../gates/mcp-handler.js";
 import { createToolCalls } from "../gates/tool-calls.js";
 import { existsSync } from "node:fs";
 import { tenantPaths } from "../tenant/paths.js";
+import { staleRun, verifyRunToken } from "../tenant/run-token.js";
+import { createFsBlobStore } from "../blob/index.js";
 import { createTenantVaults } from "../gates/tenant-vaults.js";
 import { probeDatabase } from "../infra/database.js";
 import { bindListener, headerValue, isAllowedRequestHost, sendRejected } from "./http.js";
+import { startEgressGate, storeEgressSandboxes } from "../gates/egress.js";
+import { verifyEgressToken } from "../sandbox/egress-token.js";
 /** Above the gate's 600 s provider request timeout and the loop's 630 s client timeout. */
 export const GATES_REQUEST_TIMEOUT_MS = 660_000;
 export async function startGates(options) {
@@ -31,6 +36,10 @@ export async function startGates(options) {
             throw new Error("startGates needs the Postgres pool and the Host root");
         vaults = createTenantVaults({ sql: database, hostRoot: options.hostRoot });
     }
+    const blobs = options.blobs ??
+        (options.hostRoot !== undefined
+            ? createFsBlobStore({ root: tenantPaths(options.hostRoot).blobs })
+            : undefined);
     const inflight = createInflightCalls(options.inflight);
     const mcpIdleMs = options.mcpIdleMs ?? GATE_MCP_IDLE_MS;
     const mcp = createMcpHandler({
@@ -49,13 +58,24 @@ export async function startGates(options) {
     sweep.unref();
     const prune = setInterval(() => void toolCalls.prune(), 60 * 60_000);
     prune.unref();
+    // Run tokens verify against the Tenant's public keys and session rows (F5): the same
+    // database the ledger and `tool_crossings` use.
+    const publicKeys = new Map();
     const app = createGatesApp({
         token: gates.token,
+        runs: {
+            async verify(raw) {
+                const vault = await vaults.open();
+                return verifyRunToken(vault.store, vault.tenantId, raw, publicKeys);
+            },
+            stale: async (claims) => staleRun((await vaults.open()).store, claims),
+        },
         inflight,
         modelGate: createModelCallHandler({
             vaults,
             logger,
             ...(options.settings ? { settings: options.settings } : {}),
+            ...(blobs ? { blobs } : {}),
         }),
         ready: async () => {
             // The keys service needs the vault key, which `nylorun start` writes; it never creates one.
@@ -125,3 +145,28 @@ export async function startGates(options) {
         },
     };
 }
+/**
+ * egress-gate (`--service egress`, F7.2): pods' CONNECT proxy, verifying egress tokens against the
+ * Tenant's public keys and reading its sandboxes from the same database as the gates.
+ */
+export async function startEgress(options) {
+    const { database } = options;
+    let vaults = options.vaults;
+    if (!vaults) {
+        if (!database || options.hostRoot === undefined)
+            throw new Error("startEgress needs the Postgres pool and the Host root");
+        vaults = createTenantVaults({ sql: database, hostRoot: options.hostRoot });
+    }
+    const tenant = vaults;
+    const publicKeys = new Map();
+    return startEgressGate({
+        listen: options.egress.listen,
+        logger: options.logger,
+        async verify(raw) {
+            const vault = await tenant.open();
+            return verifyEgressToken(vault.store, vault.tenantId, raw, publicKeys);
+        },
+        sandboxes: { live: async (sandboxId) => storeEgressSandboxes((await tenant.open()).store).live(sandboxId) },
+        ...options.gate,
+    });
+}

package/dist/host/http.d.ts

@@ -43,7 +43,10 @@ export declare function isJsonContentType(value: string | undefined): boolean;
 export declare function requestHasBody(request: IncomingMessage): boolean;
 /** `/health` and `/ready` are polled; the request log leaves them out. */
 export declare function pathnameIsLogged(rawUrl: string | undefined): boolean;
-/** Redact path parameters after `/v1/sessions/` for Host logs. */
+/**
+ * Redact path parameters after `/v1/sessions/` for Host logs, and a capability link's token
+ * (a credential) after `/v1/artifact-links/`.
+ */
 export declare function redactRoutePath(pathname: string): string;
 /** Constant-time comparison of SHA-256 digests of the presented and stored admin keys. */
 export declare function adminKeyMatches(presented: string | undefined, adminKey: string): boolean;

package/dist/host/http.js

@@ -135,13 +135,18 @@ export function pathnameIsLogged(rawUrl) {
     const pathname = new URL(rawUrl, "http://runtime.local").pathname;
     return pathname !== "/health" && pathname !== "/ready";
 }
-/** Redact path parameters after `/v1/sessions/` for Host logs. */
+/**
+ * Redact path parameters after `/v1/sessions/` for Host logs, and a capability link's token
+ * (a credential) after `/v1/artifact-links/`.
+ */
 export function redactRoutePath(pathname) {
     const parts = pathname.split("/");
     // ["", "v1", "sessions", "<id>", ...]
     if (parts[1] === "v1" && parts[2] === "sessions" && parts.length > 3) {
         return `/v1/sessions/:id${parts.length > 4 ? "/…" : ""}`;
     }
+    if (parts[1] === "v1" && parts[2] === "artifact-links" && parts.length > 3)
+        return "/v1/artifact-links/:token";
     return pathname;
 }
 /** Constant-time comparison of SHA-256 digests of the presented and stored admin keys. */

package/dist/host/main.js

@@ -13,10 +13,15 @@
  * `NYLORUN_DERIVED_PRINCIPALS`; tenancy.md §4); with S2, a process running core
  * runs the stream relay, which feeds the Tenant's streams from the record over
  * logical replication (one process at a time holds the slot); `/ready` reports
- * the Tenant and the infrastructure checks. A process running the gates service (the local
- * stack's `gateway` container) starts only the gate (`runGates`): it needs
- * neither host.json nor host-credentials.json. See the startup order in `main()`. Tests compose a Host without this
- * entry, with `createHost` and an injected Tenant module.
+ * the Tenant and the infrastructure checks. With an Object store
+ * (`NYLORUN_OBJECT_STORE_*`) the Tenant's blobs go to it through the `s3` BlobStore, and a
+ * process running core creates its bucket; without one they stay on disk (`fs`). A process
+ * running the gates service (the local stack's `gateway` container) starts only the gate, and egress-gate with `egress` (`runGates`): it needs
+ * neither host.json nor host-credentials.json, and reads the files a prompt names from the Object store. A process running the harness service (`--service harness`, F6.2)
+ * starts only the harness (`harness/main.ts`), which connects to core's Harness API. With `NYLORUN_HARNESS=remote`
+ * the Tenant runs no harness of its own: core starts the Harness API listener (`NYLORUN_HARNESS_LISTEN_*`) and
+ * harnesses that present `NYLORUN_HARNESS_TOKEN` run its segments and hold its workspaces. See the startup order
+ * in `main()`. Tests compose a Host without this entry, with `createHost` and an injected Tenant module.
  */
 import { readFileSync, mkdirSync, existsSync } from "node:fs";
 import { createRequire } from "node:module";
@@ -40,10 +45,15 @@ import { createHostLogger } from "./logger.js";
 import { describeEndpoints, describeServices, parseStackConfig, } from "./stack-config.js";
 import { createExecution, createInfra } from "../infra/index.js";
 import { createDatabase } from "../infra/database.js";
-import { startGates } from "./gates.js";
+import { startEgress, startGates } from "./gates.js";
 import { httpToolGate } from "../gates/tool-client.js";
 import { httpKeys } from "../keys/client.js";
 import { httpModelGate } from "../gates/http-client.js";
+import { createS3BlobStore } from "../blob/index.js";
+import { createRunGrants } from "../tenant/run-grants.js";
+import { runHarness } from "../harness/main.js";
+import { startHarnessListener } from "../harness-api/ws-server.js";
+import { httpSandboxesClient } from "../sandbox/pods/client.js";
 const nodeRequire = createRequire(import.meta.url);
 function coreVersion() {
     try {
@@ -61,38 +71,85 @@ function resolveHostRoot() {
     const root = fromEnv && fromEnv.length > 0 ? fromEnv : resolve(homedir(), ".nylorun");
     return resolve(root);
 }
+/** The Object store's `s3` BlobStore (D35), from `StackConfig.objectStore`. */
+function objectStore(config) {
+    return createS3BlobStore({
+        endpoint: config.endpoint,
+        bucket: config.bucket,
+        region: config.region,
+        accessKeyId: config.accessKeyId,
+        secretAccessKey: config.secretAccessKey,
+    });
+}
+/**
+ * Creates the Object store's bucket unless it exists, retrying while the store starts. In the
+ * background: only artifacts use the store, so a store that stays down is logged (artifact
+ * uploads and downloads fail meanwhile) and does not hold up the Host.
+ */
+async function ensureBucket(store, bucket, logger) {
+    for (let attempt = 1;; attempt += 1) {
+        try {
+            await store.ensureBucket();
+            logger.info("object_store_ready", { bucket });
+            return;
+        }
+        catch (error) {
+            if (attempt >= 10) {
+                logger.error("object_store_unavailable", {
+                    bucket,
+                    message: error instanceof Error ? error.message : String(error),
+                });
+                return;
+            }
+            await new Promise((resolve) => setTimeout(resolve, Math.min(1000 * attempt, 5000)));
+        }
+    }
+}
 /** The slot's lag in WAL bytes, when the source can tell. */
 async function lagOf(source) {
     const lagBytes = await source.lag?.().catch(() => undefined);
     return lagBytes === undefined ? {} : { lagBytes };
 }
 /**
- * The gates service: the Model Gate's listener over the Postgres pool and the Host's tenant
- * directory. Writes nothing to the Host root (the local stack mounts it read-only).
+ * The gateway's services: the Model Gate's listener (gates, keys) and egress-gate's (egress), over
+ * the Postgres pool and the Host's tenant directory. Writes nothing to the Host root (the local
+ * stack mounts it read-only).
  */
 async function runGates(stack) {
-    const gates = stack.gates;
     if (!stack.endpoints.databaseUrl)
-        throw new Error("NYLORUN_DATABASE_URL is required for --service gates: the gate reads Tenant vaults from Postgres (`nylorun start` sets it)");
+        throw new Error(`NYLORUN_DATABASE_URL is required for --service ${describeServices(stack.services)}: the gateway reads the Tenant from Postgres (\`nylorun start\` sets it)`);
     const logger = createHostLogger();
     logger.info("host_stack_config", {
         services: [...stack.services],
         ...(stack.packing ? { packing: stack.packing } : {}),
         endpoints: describeEndpoints(stack.endpoints),
+        objectStore: stack.objectStore ? "s3" : "none",
     });
     const database = createDatabase(stack);
-    let server;
+    const servers = [];
     try {
-        server = await startGates({
-            gates,
-            database,
-            hostRoot: resolveHostRoot(),
-            logger,
-            ...(stack.delivery ? { delivery: stack.delivery } : {}),
-            ...(stack.services.has("keys") ? { keys: true } : {}),
-        });
+        if (stack.gates) {
+            const server = await startGates({
+                gates: stack.gates,
+                database,
+                hostRoot: resolveHostRoot(),
+                logger,
+                ...(stack.delivery ? { delivery: stack.delivery } : {}),
+                ...(stack.services.has("keys") ? { keys: true } : {}),
+                // Model-gate reads the files a prompt names from the Object store (protocol 6).
+                ...(stack.objectStore ? { blobs: objectStore(stack.objectStore) } : {}),
+            });
+            servers.push(server);
+            logger.info("gates_ready", { url: server.url });
+        }
+        if (stack.egress) {
+            const egress = await startEgress({ egress: stack.egress, database, hostRoot: resolveHostRoot(), logger });
+            servers.push(egress);
+            logger.info("egress_ready", { url: egress.url });
+        }
     }
     catch (error) {
+        await Promise.all(servers.map((server) => server.close()));
         await database.end({ timeout: 5 });
         if (error instanceof HostListenError) {
             logger.error("listen_failed", { message: error.message, exitCode: error.exitCode });
@@ -101,23 +158,23 @@ async function runGates(stack) {
         }
         throw error;
     }
-    logger.info("gates_ready", { url: server.url });
     let stopping = false;
     for (const signal of ["SIGINT", "SIGTERM"])
         process.on(signal, () => {
             if (stopping)
                 return;
             stopping = true;
-            void server
-                .close()
+            void Promise.all(servers.map((server) => server.close()))
                 .then(() => database.end({ timeout: 5 }))
                 .finally(() => process.exit(0));
         });
 }
 export async function main() {
     const stack = parseStackConfig(process.env, process.argv.slice(2));
-    if (stack.services.has("gates") || stack.services.has("keys"))
+    if (stack.services.has("gates") || stack.services.has("keys") || stack.services.has("egress"))
         return runGates(stack);
+    if (stack.services.has("harness"))
+        return runHarness(stack, baselineEnvironment(process.env));
     const hostRoot = resolveHostRoot();
     const paths = hostPaths(hostRoot);
     mkdirSync(paths.home, { recursive: true });
@@ -150,8 +207,10 @@ export async function main() {
         ...(stack.services.has("loop")
             ? { modelGate: stack.modelGate ? stack.modelGate.url : "in-process" }
             : {}),
+        harness: stack.harnessMode ?? "in-process",
         mode: stack.listen ? "container" : "local",
         endpoints: describeEndpoints(stack.endpoints),
+        objectStore: stack.objectStore ? "s3" : "fs",
     });
     const infra = createInfra(stack, { logger });
     const database = infra.database;
@@ -206,15 +265,31 @@ export async function main() {
     };
     // With the gates service the Tenant's vault-backed model calls, remote MCP calls and Action
     // deliveries cross it, and this process never reads a model or MCP credential.
-    const modelGate = stack.modelGate
-        ? httpModelGate({ url: stack.modelGate.url, token: stack.modelGate.token })
+    // Their credentials (F5): each advance's run token for its session's model and MCP calls,
+    // core's credential (NYLORUN_GATES_TOKEN) for deliveries and MCP requests outside a run.
+    const runGrants = stack.modelGate ? createRunGrants() : undefined;
+    const modelGate = stack.modelGate && runGrants
+        ? httpModelGate({ url: stack.modelGate.url, runTokens: runGrants })
         : undefined;
-    const toolGate = stack.modelGate
-        ? httpToolGate({ url: stack.modelGate.url, token: stack.modelGate.token })
+    const toolGate = stack.modelGate && runGrants
+        ? httpToolGate({ url: stack.modelGate.url, token: stack.modelGate.token, runTokens: runGrants })
         : undefined;
     // With the keys service, vault writes and token signing cross it, and this process never
     // reads the vault key (F4.2).
     const keys = stack.keys ? httpKeys({ url: stack.keys.url, token: stack.keys.token }) : undefined;
+    // The Object store (D35): the stack's S3 server through the BlobStore seam, handed to the
+    // Tenant (`TenantContext.blobs`). Without one the Tenant keeps blobs on disk. core creates
+    // the bucket.
+    const blobs = stack.objectStore ? objectStore(stack.objectStore) : undefined;
+    if (blobs && stack.services.has("core"))
+        void ensureBucket(blobs, stack.objectStore.bucket, logger);
+    // Sandbox pods (F7.2): the sandboxes service, which alone holds the cluster's credentials.
+    const pods = stack.sandboxes
+        ? {
+            client: httpSandboxesClient({ url: stack.sandboxes.url, token: stack.sandboxes.token }),
+            harnessImage: stack.sandboxes.harnessImage,
+        }
+        : undefined;
     const tenantSettings = stack.tenant ?? { name: "default", derivedPrincipals: ["project"] };
     const module = createTenantModule({
         open: createPostgresTenantOpener({
@@ -234,8 +309,12 @@ export async function main() {
                 execution: hostExecution.tenantExecution,
                 ...(modelGate ? { modelGate } : {}),
                 ...(toolGate ? { toolGate } : {}),
+                ...(runGrants ? { runGrants } : {}),
                 ...(keys ? { keys } : {}),
                 ...(streams ? { streams, hostRelay: true } : {}),
+                ...(blobs ? { blobs } : {}),
+                ...(stack.harnessMode === "remote" ? { harness: "remote" } : {}),
+                ...(pods ? { pods } : {}),
                 ...opened,
             }),
         }),
@@ -273,8 +352,12 @@ export async function main() {
             beforeTenants: async () => {
                 await hostExecution.stop();
                 await relay?.stop();
+                // The harnesses' runs stop with the Tenant's advances; their connections close after.
+            },
+            afterTenants: async () => {
+                await harnessListener?.close();
+                await infra.close();
             },
-            afterTenants: () => infra.close(),
         },
     };
     const host = createHost(options);
@@ -289,11 +372,35 @@ export async function main() {
     // Restate's state (§14.8), and starts the stream relay. A Tenant that cannot
     // be opened leaves the Host listening but not ready, with the cause in
     // `/v1/admin/status`.
+    // The Harness API listener (NYLORUN_HARNESS=remote): only harnesses connect here, with the
+    // harness credential, and only while the Tenant is open.
+    let harnessListener;
     try {
         await hostExecution.start();
+        if (stack.harnessListener)
+            harnessListener = await startHarnessListener({
+                ...stack.harnessListener.listen,
+                ...(stack.harnessListener.token ? { token: stack.harnessListener.token } : {}),
+                // Sandbox pods join here and connect with host tokens (F7.2).
+                ...(pods
+                    ? {
+                        hosts: async () => {
+                            const resolved = await module.resolve();
+                            return resolved.kind === "open" ? resolved.handle.hostAuthority?.() : undefined;
+                        },
+                    }
+                    : {}),
+                attach: async () => {
+                    const resolved = await module.resolve();
+                    const handle = resolved.kind === "open" ? resolved.handle : undefined;
+                    return handle?.attachHarness ? (channel, peer) => handle.attachHarness(channel, peer) : undefined;
+                },
+                logger,
+            });
         await host.listen();
     }
     catch (error) {
+        await harnessListener?.close().catch(() => undefined);
         await hostExecution.stop().catch(() => undefined);
         await module.close().catch(() => undefined);
         await relay?.stop().catch(() => undefined);
@@ -311,6 +418,7 @@ export async function main() {
     const tenant = module.tenant();
     logger.info("host_ready", {
         url: host.url,
+        ...(harnessListener ? { harness: harnessListener.url } : {}),
         hostId: config.hostId,
         tenantId: tenant.id,
         tenant: tenant.state,

package/dist/host/stack-config.d.ts

@@ -1,9 +1,16 @@
+import { type BlockedAddress } from "../sandbox/pods/network-gate.js";
 /** A Runtime service this release has. */
-export type RuntimeService = "core" | "loop" | "gates" | "keys";
+export type RuntimeService = "core" | "loop" | "gates" | "keys" | "egress" | "harness";
 export type RuntimeServices = ReadonlySet<RuntimeService>;
 export declare const RUNTIME_SERVICES: readonly RuntimeService[];
 /** Where the gates service listens by default. */
 export declare const DEFAULT_GATES_LISTEN_PORT = 4100;
+/** Where egress-gate listens by default. */
+export declare const DEFAULT_EGRESS_LISTEN_PORT = 4200;
+/** Where core's Harness API listener listens by default. */
+export declare const DEFAULT_HARNESS_LISTEN_PORT = 4200;
+/** Where a harness process answers `/health` (loopback only). */
+export declare const DEFAULT_HARNESS_HEALTH_PORT = 4300;
 /** What a process runs without `--service`: core and loop, as `--role all` did. */
 export declare const DEFAULT_SERVICES: RuntimeServices;
 /** The deprecated `--role` values, and the services each stands for. */
@@ -48,16 +55,90 @@ export interface GatesConfig {
     /** `NYLORUN_GATES_TOKEN`: the bearer the loop presents; at least 32 bytes as hex. */
     token: string;
 }
+/** egress-gate's listener (`NYLORUN_EGRESS_LISTEN_HOST`, `NYLORUN_EGRESS_LISTEN_PORT`). */
+export interface EgressConfig {
+    listen: {
+        host: string;
+        port: number;
+    };
+}
 /** Where the loop reaches the gates service (`NYLORUN_GATES_URL`, `NYLORUN_GATES_TOKEN`). */
 export interface ModelGateEndpoint {
     url: string;
     token: string;
 }
+/**
+ * Core's Harness API listener (`NYLORUN_HARNESS=remote`, or sandbox pods): where harnesses
+ * connect, and the credential they present (`NYLORUN_HARNESS_TOKEN`), which nothing else
+ * accepts. With sandbox pods and no harness container there is no token: only pods' host tokens
+ * are accepted (F7.2).
+ */
+export interface HarnessListenConfig {
+    listen: ContainerListen;
+    token?: string;
+}
+/**
+ * Sandbox pods (`NYLORUN_SANDBOXES_URL`, F7.2): the sandboxes service core drives them with, its
+ * token, and the Runtime image pods copy the engine from.
+ */
+export interface SandboxesConfig {
+    url: string;
+    token: string;
+    /** `NYLORUN_SANDBOX_HARNESS_IMAGE` (the stack sets it to the Runtime image). */
+    harnessImage: string;
+}
+/**
+ * The engine in a pod sandbox (`--service harness` with `NYLORUN_SANDBOX_KIND=pod`, F7.2): no
+ * harness token; it joins with the join token mounted in the pod.
+ */
+export interface PodHostConfig {
+    /** `NYLORUN_SANDBOX_ID`. */
+    sandboxId: string;
+    /** `NYLORUN_POD_UID` (the downward API's `metadata.uid`). */
+    podUid: string;
+    /** `NYLORUN_SANDBOX_JOIN_FILE`. */
+    joinFile: string;
+    /** The Harness API listener's HTTP base, for `host/join` and `host/renew`. */
+    httpUrl: string;
+    /** `NYLORUN_EGRESS_PROXY`: egress-gate's address, or undefined while it is not published. */
+    egressProxy?: string;
+    /** Addresses the pod's NetworkPolicy must block, probed before the engine starts. */
+    blocked: BlockedAddress[];
+}
+/** A harness process (`--service harness`). */
+export interface HarnessServiceConfig {
+    /** `NYLORUN_HARNESS_URL`: core's Harness API, e.g. `ws://runtime:4200/nylorun/harness/v1`. */
+    url: string;
+    /** `NYLORUN_HARNESS_TOKEN`; absent for a pod's engine, which joins (`pod`). */
+    token?: string;
+    /** Present for the engine in a pod sandbox. */
+    pod?: PodHostConfig;
+    /** `NYLORUN_GATES_URL`: the gates service its model and MCP calls cross, with run tokens. */
+    gatesUrl: string;
+    /** `NYLORUN_HARNESS_ROOT`: its sandboxes, plugin data, home and tmp. Default `/harness`. */
+    root: string;
+    /** `/health` on `127.0.0.1:<NYLORUN_HARNESS_HEALTH_PORT>` (default 4300). */
+    healthPort: number;
+}
 export interface StackConfig {
     /** The Runtime services this process runs. */
     services: RuntimeServices;
     /** Present when the process runs gates. */
     gates?: GatesConfig;
+    /** Present when the process runs egress. */
+    egress?: EgressConfig;
+    /** Present when the process runs the harness service (`--service harness`). */
+    harness?: HarnessServiceConfig;
+    /**
+     * `NYLORUN_HARNESS` (`in-process` or `remote`; absent means `in-process`), for a process running
+     * core or loop: whether the Tenant runs its own harness, or harnesses connect to
+     * `harnessListener`.
+     */
+    harnessMode?: "in-process" | "remote";
+    /** Present when `harnessMode` is `remote`, or with `sandboxes`: core's Harness API listener. */
+    harnessListener?: HarnessListenConfig;
+    /** Present when the process runs core or loop and `NYLORUN_SANDBOXES_URL` is set (F7.2). */
+    sandboxes?: SandboxesConfig;
     /**
      * Present when the process runs core or loop and `NYLORUN_GATES_URL` is set: its model calls,
      * remote MCP calls and Action deliveries cross the gates service. Required for loop in
@@ -110,6 +191,25 @@ export interface StackConfig {
     };
     /** Present when the process runs core or loop: who its Tenant is on first start. */
     tenant?: TenantSettings;
+    /**
+     * The Object store (blueprint D35) behind the `BlobStore` seam's `s3` adapter, from
+     * `NYLORUN_OBJECT_STORE_*`; the local stack's RustFS. Absent: the Tenant keeps blobs on disk
+     * (the `fs` adapter, `TenantPaths.blobs`).
+     */
+    objectStore?: ObjectStoreConfig;
+}
+/** Where the Object store is and the credential for it (`NYLORUN_OBJECT_STORE_*`). */
+export interface ObjectStoreConfig {
+    /** `NYLORUN_OBJECT_STORE_ENDPOINT`: the S3 endpoint, e.g. `http://rustfs:9000`. */
+    endpoint: string;
+    /** `NYLORUN_OBJECT_STORE_BUCKET`. Default `nylorun`. */
+    bucket: string;
+    /** `NYLORUN_OBJECT_STORE_REGION`. Default `us-east-1`. */
+    region: string;
+    /** `NYLORUN_OBJECT_STORE_ACCESS_KEY`. */
+    accessKeyId: string;
+    /** `NYLORUN_OBJECT_STORE_SECRET_KEY`. */
+    secretAccessKey: string;
 }
 /**
  * The Tenant a Host creates when its database holds none (tenancy.md §4). Later starts open the