@nylorun/runtime 0.15.2-beta → 0.17.0-beta

package/dist/tenant/paths.js

@@ -24,7 +24,8 @@ export function hostPaths(hostRoot) {
  * root after realpath.
  *
  * The directory holds what stays on the Host (the Tenant's data is its database): `home/`,
- * `tmp/`, `sandboxes/`, `plugin-data/`, `logs/tenant.log`. The vault key is the one exception:
+ * `tmp/`, `sandboxes/`, `plugin-data/`, `blobs/` (the `fs` BlobStore, when the Host has no
+ * Object store), `logs/tenant.log`. The vault key is the one exception:
  * it lives beside the Tenant directory, in `<hostRoot>/keys/vault-kek`, which the local stack
  * mounts only into the gateway (F4.2), never into the runtime container.
  */
@@ -41,6 +42,7 @@ export function tenantPaths(hostRoot) {
         tmp: join(root, "tmp"),
         sandboxes: join(root, "sandboxes"),
         pluginData: join(root, "plugin-data"),
+        blobs: join(root, "blobs"),
         logs: join(root, "logs"),
         log: join(root, "logs", "tenant.log"),
     };

package/dist/tenant/principals.d.ts

@@ -2,23 +2,14 @@ import type { InitialPrincipal } from "../store/postgres/tenant.js";
 export type { PrincipalRow } from "../store/types.js";
 /** Principal id of the Studio key derived from the admin key. */
 export declare const STUDIO_PRINCIPAL_ID = "studio";
-/** The derived principal Projects use (`PROJECT_PRINCIPAL_ID` in `@nylorun/admin`). */
-export declare const PROJECT_PRINCIPAL_ID = "project";
-/** The derived principals a Host registers when not told otherwise. */
-export declare const DEFAULT_DERIVED_PRINCIPALS: readonly string[];
 /** The Studio key of `tenantId`: HMAC-SHA256 of the admin key. */
 export declare function deriveStudioKey(adminKey: string, tenantId: string): string;
-/** The key of derived principal `principalId` on `tenantId`: HMAC-SHA256 of the admin key. */
-export declare function deriveTenantKey(adminKey: string, tenantId: string, principalId: string): string;
-/** Whether `id` may name a derived principal: the client's name, never `studio`. */
-export declare function isDerivedPrincipalId(id: string): boolean;
 /**
- * The principals a Host's Tenant is created with: `studio`, each derived principal, and an
- * application principal when a key is given (the ephemeral Runtime). Keys are hashed here.
+ * The principals a Host's Tenant is created with: `studio`, and an application principal when
+ * a key is given (the ephemeral Runtime). Keys are hashed here.
  */
 export declare function hostPrincipals(options: {
     adminKey: string;
-    derived?: readonly string[];
     application?: {
         principalId: string;
         key: string;

package/dist/tenant/principals.js

@@ -1,43 +1,27 @@
 /**
- * The principals the Host gives its Tenant when it creates it (tenancy.md §4, plan P9): the
- * Studio principal and the derived principals, whose keys the admin key derives, so the
- * clients holding the admin key (Studio, `nylorun start`, Babai) store none. The Tenant keeps
- * only their hashes.
+ * The principals the Host gives its Tenant when it creates it (tenancy.md §4): the Studio
+ * principal, whose key the admin key derives, so Studio (and an app embedding it) stores none,
+ * and, for the ephemeral Runtime, one application principal with a key of its own. The Tenant
+ * keeps only their hashes. Every other application key is an operator key
+ * (`PUT /v1/admin/keys/{id}`, `operator-keys.ts`); no other key is derived.
  *
- * The derivations are the ones `@nylorun/admin` computes on the client side
- * (`admin/src/derived-credentials.ts`: `deriveStudioToken`, `deriveTenantKey`); both sides
- * must stay byte for byte the same.
+ * The derivation is the one `@nylorun/admin` computes on the client side
+ * (`admin/src/derived-credentials.ts`: `deriveStudioToken`); both sides must stay byte for byte
+ * the same.
  */
 import { createHmac } from "node:crypto";
-import { DERIVED_PRINCIPAL_ID_PATTERN } from "@nylorun/core/compatibility";
 import { hashToken } from "../core/bearer.js";
 /** Principal id of the Studio key derived from the admin key. */
 export const STUDIO_PRINCIPAL_ID = "studio";
-/** The derived principal Projects use (`PROJECT_PRINCIPAL_ID` in `@nylorun/admin`). */
-export const PROJECT_PRINCIPAL_ID = "project";
-/** The derived principals a Host registers when not told otherwise. */
-export const DEFAULT_DERIVED_PRINCIPALS = [PROJECT_PRINCIPAL_ID];
 /** The Studio key of `tenantId`: HMAC-SHA256 of the admin key. */
 export function deriveStudioKey(adminKey, tenantId) {
     return hmac(adminKey, ["nylorun/studio/v1", tenantId]);
 }
-/** The key of derived principal `principalId` on `tenantId`: HMAC-SHA256 of the admin key. */
-export function deriveTenantKey(adminKey, tenantId, principalId) {
-    return hmac(adminKey, ["nylorun/principal/v1", principalId, tenantId]);
-}
-/** Whether `id` may name a derived principal: the client's name, never `studio`. */
-export function isDerivedPrincipalId(id) {
-    return DERIVED_PRINCIPAL_ID_PATTERN.test(id) && id !== STUDIO_PRINCIPAL_ID;
-}
 /**
- * The principals a Host's Tenant is created with: `studio`, each derived principal, and an
- * application principal when a key is given (the ephemeral Runtime). Keys are hashed here.
+ * The principals a Host's Tenant is created with: `studio`, and an application principal when
+ * a key is given (the ephemeral Runtime). Keys are hashed here.
  */
 export function hostPrincipals(options) {
-    const derived = options.derived ?? DEFAULT_DERIVED_PRINCIPALS;
-    for (const id of derived)
-        if (!isDerivedPrincipalId(id))
-            throw new Error(`Derived principal id '${id}' must match ${DERIVED_PRINCIPAL_ID_PATTERN} and not be '${STUDIO_PRINCIPAL_ID}'`);
     return (tenantId) => [
         ...(options.application
             ? [
@@ -52,10 +36,6 @@ export function hostPrincipals(options) {
             credentialHash: options.studioCredentialHash ??
                 hashToken(deriveStudioKey(options.adminKey, tenantId)),
         },
-        ...[...new Set(derived)].map((id) => ({
-            id,
-            credentialHash: hashToken(deriveTenantKey(options.adminKey, tenantId, id)),
-        })),
     ];
 }
 /** HMAC-SHA256 (hex) of `parts` joined by NUL bytes, keyed with the admin key. */

package/dist/tenant/reset.d.ts

@@ -1,11 +1,14 @@
 import type { ResetScope, SessionStore } from "../store/types.js";
-import type { SandboxManager } from "../sandbox/manager.js";
+import type { WorkspacePort } from "../harness-api/workspace.js";
 import type { TenantPaths } from "./types.js";
+import type { BlobStore } from "../blob/index.js";
 export type { ResetScope } from "../store/types.js";
 export interface ResetTenantContext {
     store: SessionStore;
-    sandbox: SandboxManager;
+    sandbox: WorkspacePort;
     paths: TenantPaths;
+    /** Where the deleted artifacts' bytes are; they are removed after the store wipe. */
+    blobs?: BlobStore;
     /** Clear in-memory session observers after the store wipe. */
     clearSessionState: () => void;
 }

package/dist/tenant/reset.js

@@ -1,5 +1,7 @@
 import { existsSync, mkdirSync, renameSync, rmSync, writeFileSync, } from "node:fs";
 import { join } from "node:path";
+import { detachAllSessions } from "./sandboxes.js";
+import { contentKey } from "../artifacts/folders.js";
 /**
  * Rename `dir` to a sibling, delete the sibling, recreate an empty `dir`.
  * Failure before rename leaves the original intact; after rename the empty
@@ -39,11 +41,29 @@ export async function resetTenant(ctx, scope) {
     const clearSandboxes = scope === "sandboxes" || scope === "all";
     const clearAll = scope === "all";
     if (clearSandboxes) {
-        await ctx.sandbox.reconcile(() => false);
+        await ctx.sandbox.removeAll();
     }
-    await ctx.store.tx((t) => t.reset(scope));
+    // The artifacts the reset deletes: their rows go in its transaction, their bytes after it.
+    const blobKeys = await ctx.store.tx(async (t) => {
+        // Sandbox resources outlive their sessions: a sessions reset only detaches them.
+        if (clearSessions && !clearSandboxes)
+            await detachAllSessions(t);
+        const scoped = clearAll ? "all" : "sessions";
+        const keys = clearSessions ? await t.artifactBlobKeys(scoped) : [];
+        // Folders' content-addressed files: those no remaining folder names (F8.2).
+        const content = clearSessions ? await t.artifactContentShas(scoped) : [];
+        await t.reset(scope);
+        const kept = await t.referencedArtifactContent(content);
+        for (const sha of content)
+            if (!kept.has(sha))
+                keys.push(contentKey(sha));
+        return keys;
+    });
     if (clearSessions)
         ctx.clearSessionState();
+    if (ctx.blobs)
+        for (const key of blobKeys)
+            await ctx.blobs.delete(key).catch(() => undefined);
     if (clearSandboxes)
         replaceDirectory(ctx.paths.sandboxes);
     if (clearAll) {

package/dist/tenant/run-grants.d.ts

@@ -0,0 +1,49 @@
+/**
+ * Run grants (F5, gate trust): the run token each advance of this process holds while it owns
+ * a session (`run-token.ts`). The advance mints one when it takes the lease (`grantRun`), the
+ * lease heartbeat re-mints it before it expires (`renewRunGrant`), and it goes when the
+ * advance ends or loses the lease (`dropRunGrant`). The HTTP gate clients read the session's
+ * token on every request (`RunTokens`), so a re-mint applies to the next call.
+ *
+ * Only a Runtime whose gates are a service has grants (`TenantContext.runGrants`). With the
+ * gates in this process nothing is minted (G6): the trust boundary is the gate's HTTP route.
+ */
+import type { Lease, TenantContext } from "./context.js";
+import { type RunGrant } from "./run-token.js";
+/** What a gate client reads: the current run token of a session, if an advance holds one. */
+export interface RunTokens {
+    token(sessionId: string): string | undefined;
+}
+/** The run grants of this process's advances, by session id. */
+export interface RunGrants extends RunTokens {
+    get(sessionId: string): RunGrant | undefined;
+    set(grant: RunGrant): void;
+    /** Forgets the grant of `sessionId` if it is the one of `epoch`: a newer advance's stays. */
+    drop(sessionId: string, epoch: number): void;
+}
+export declare function createRunGrants(): RunGrants;
+type GrantContext = Pick<TenantContext, "keys" | "config" | "runGrants">;
+/** What a run token names of the session: its root agent and the turn the advance runs. */
+export interface RunOf {
+    readonly agentId: string;
+    readonly activeTurnId: string | null;
+}
+/**
+ * Mints and registers the run token of the advance that just took `lease`. Nothing when the
+ * gates run in this process, or the session has no active turn (it makes no gate call).
+ *
+ * Never throws: an advance may make no gate call at all (a model the Tenant serves itself, a
+ * workflow step), so a keys service that does not answer must not stop it. Without a grant
+ * the session's model calls fail as when the gateway is down, its MCP requests use core's
+ * credential, and the heartbeat tries again (`renewRunGrant`).
+ */
+export declare function grantRun(ctx: GrantContext, lease: Lease, run: RunOf): Promise<void>;
+/**
+ * Re-mints the grant of `lease` when less than `RUN_TOKEN_RENEW_SECONDS` remain, or mints it
+ * when the first mint failed. `active` is false once the advance ended: a token minted after
+ * that is not registered.
+ */
+export declare function renewRunGrant(ctx: GrantContext, lease: Lease, run: RunOf, active?: () => boolean): Promise<void>;
+/** Forgets the grant of `lease` (the advance ended, or lost the lease). */
+export declare function dropRunGrant(ctx: Pick<TenantContext, "runGrants">, lease: Lease): void;
+export {};

package/dist/tenant/run-grants.js

@@ -0,0 +1,62 @@
+import { mintRunToken, RUN_TOKEN_RENEW_SECONDS } from "./run-token.js";
+export function createRunGrants() {
+    const grants = new Map();
+    return {
+        token: (sessionId) => grants.get(sessionId)?.token,
+        get: (sessionId) => grants.get(sessionId),
+        set(grant) {
+            const held = grants.get(grant.claims.sessionId);
+            // An older advance of the same session (a lease lost while it still ran) never replaces it.
+            if (held && held.claims.epoch > grant.claims.epoch)
+                return;
+            grants.set(grant.claims.sessionId, grant);
+        },
+        drop(sessionId, epoch) {
+            if (grants.get(sessionId)?.claims.epoch === epoch)
+                grants.delete(sessionId);
+        },
+    };
+}
+/**
+ * Mints and registers the run token of the advance that just took `lease`. Nothing when the
+ * gates run in this process, or the session has no active turn (it makes no gate call).
+ *
+ * Never throws: an advance may make no gate call at all (a model the Tenant serves itself, a
+ * workflow step), so a keys service that does not answer must not stop it. Without a grant
+ * the session's model calls fail as when the gateway is down, its MCP requests use core's
+ * credential, and the heartbeat tries again (`renewRunGrant`).
+ */
+export async function grantRun(ctx, lease, run) {
+    if (!ctx.runGrants || !run.activeTurnId)
+        return;
+    try {
+        ctx.runGrants.set(await mintRunToken(ctx, lease, run));
+    }
+    catch (error) {
+        ctx.config.logger.warn("advance could not mint its run token", {
+            sessionId: lease.sessionId,
+            message: error instanceof Error ? error.message : String(error),
+        });
+    }
+}
+/**
+ * Re-mints the grant of `lease` when less than `RUN_TOKEN_RENEW_SECONDS` remain, or mints it
+ * when the first mint failed. `active` is false once the advance ended: a token minted after
+ * that is not registered.
+ */
+export async function renewRunGrant(ctx, lease, run, active = () => true) {
+    if (!ctx.runGrants || !run.activeTurnId)
+        return;
+    const held = ctx.runGrants.get(lease.sessionId);
+    if (held && held.claims.epoch !== lease.epoch)
+        return;
+    if (held && held.claims.expiresAt - Date.now() > RUN_TOKEN_RENEW_SECONDS * 1000)
+        return;
+    const grant = await mintRunToken(ctx, lease, held ? { agentId: held.claims.agentId, activeTurnId: held.claims.turnId } : run);
+    if (active())
+        ctx.runGrants.set(grant);
+}
+/** Forgets the grant of `lease` (the advance ended, or lost the lease). */
+export function dropRunGrant(ctx, lease) {
+    ctx.runGrants?.drop(lease.sessionId, lease.epoch);
+}

package/dist/tenant/run-token.d.ts

@@ -0,0 +1,70 @@
+import { importJWK } from "jose";
+import type { Keys } from "../keys/keys.js";
+import type { SessionStore } from "../store/types.js";
+import type { Lease } from "./context.js";
+export declare const RUN_TOKEN_TYP = "nylorun-run+jwt";
+export declare const RUN_TOKEN_AUD = "nylorun-gates";
+/** How long a run token lives. */
+export declare const RUN_TOKEN_TTL_SECONDS: number;
+/** The lease heartbeat re-mints a token with less than this left. */
+export declare const RUN_TOKEN_RENEW_SECONDS: number;
+/** What a verified run token says: one lease of one session's turn. */
+export interface RunClaims {
+    readonly tenantId: string;
+    readonly sessionId: string;
+    readonly turnId: string;
+    /** The session's root agent: the ledger's and the agent budget's scope. */
+    readonly agentId: string;
+    /** The lease epoch: the fence. */
+    readonly epoch: number;
+    /** Milliseconds since the epoch. */
+    readonly expiresAt: number;
+}
+/** A minted run token and what it says. */
+export interface RunGrant {
+    readonly token: string;
+    readonly claims: RunClaims;
+}
+/** Who mints: the Tenant's keys and id (a `TenantContext` is one). */
+export interface RunTokenSigner {
+    readonly keys: Keys;
+    readonly config: {
+        readonly tenantId: string;
+    };
+}
+/**
+ * Mints the run token of `lease` over `session`'s active turn. Throws when the session has
+ * no active turn: there is no run to name.
+ */
+export declare function mintRunToken(signer: RunTokenSigner, lease: Lease, session: {
+    readonly agentId: string;
+    readonly activeTurnId: string | null;
+}): Promise<RunGrant>;
+/** A verified token's claims, or why it was refused (logged, never answered). */
+export type RunTokenVerdict = {
+    readonly ok: true;
+    readonly claims: RunClaims;
+} | {
+    readonly ok: false;
+    readonly reason: string;
+};
+type PublicKey = Awaited<ReturnType<typeof importJWK>>;
+/**
+ * Public keys imported by key id. The key row is read on every verification, so a new key
+ * (a rotation) and a revoked one apply at once; only the imported key object is kept.
+ */
+export type RunTokenKeyCache = Map<string, PublicKey>;
+/**
+ * Verifies a run token of Tenant `tenantId` against the public keys in `store`: everything a
+ * forger controls (size, shape, header) is checked before any key is read, then the
+ * signature, `iss`, `aud`, `typ`, lifetime and claims. A revoked key refuses even a token it
+ * signed while it was live.
+ */
+export declare function verifyRunToken(store: SessionStore, tenantId: string, raw: string, cache?: RunTokenKeyCache): Promise<RunTokenVerdict>;
+/**
+ * Why calls under `claims` are stale, or undefined while its lease is still the session's
+ * (G4): the session's epoch is the token's, its active turn is the token's, and it is not
+ * cancelled. One indexed read of the session row.
+ */
+export declare function staleRun(store: SessionStore, claims: RunClaims): Promise<string | undefined>;
+export {};

package/dist/tenant/run-token.js

@@ -0,0 +1,138 @@
+/**
+ * Run tokens (F5, gate trust): the ES256 JWT core mints for one advance's lease of a session.
+ * It is the only credential of a model call at the gates, and the credential of a session's
+ * remote MCP calls. The gates take session, turn and agent from it, never from the body, and
+ * check on every call that the lease it names is still the session's (`staleRun`).
+ *
+ * Signed by the keys service with the Tenant's current signing key, like subject and delivery
+ * tokens, and told apart from them by `typ` and `aud`. Internal: not in `openapi.json`. A token
+ * lives `RUN_TOKEN_TTL_SECONDS`, no longer than a delivery token, so a key rotation never
+ * revokes a live one (`signing-keys.ts`).
+ *
+ * ```text
+ * header  { alg: ES256, typ: nylorun-run+jwt, kid }
+ * claims  { iss: urn:nylorun:tenant:<id>, aud: nylorun-gates, sub: <sessionId>,
+ *           trn: <turnId>, agt: <root agentId>, epc: <lease epoch>, iat, exp, jti }
+ * ```
+ */
+import { randomUUID } from "node:crypto";
+import { errors, importJWK, jwtVerify } from "jose";
+import { tenantTokenIssuer } from "@nylorun/core/contracts";
+import { CLOCK_TOLERANCE_SECONDS, tokenKeyId } from "./jwt.js";
+export const RUN_TOKEN_TYP = "nylorun-run+jwt";
+export const RUN_TOKEN_AUD = "nylorun-gates";
+/** How long a run token lives. */
+export const RUN_TOKEN_TTL_SECONDS = 15 * 60;
+/** The lease heartbeat re-mints a token with less than this left. */
+export const RUN_TOKEN_RENEW_SECONDS = 5 * 60;
+/** Allowed spread between `iat` and `exp` beyond the lifetime. */
+const LIFETIME_SLACK_SECONDS = 60;
+/**
+ * Mints the run token of `lease` over `session`'s active turn. Throws when the session has
+ * no active turn: there is no run to name.
+ */
+export async function mintRunToken(signer, lease, session) {
+    const turnId = session.activeTurnId;
+    if (!turnId)
+        throw new Error(`Session ${lease.sessionId} has no active turn to mint a run token for`);
+    const tenantId = signer.config.tenantId;
+    const iat = Math.floor(Date.now() / 1000);
+    const exp = iat + RUN_TOKEN_TTL_SECONDS;
+    // Signed by the keys service (F4.2): this process never holds the private key.
+    const { token } = await signer.keys.sign({
+        typ: RUN_TOKEN_TYP,
+        claims: {
+            iss: tenantTokenIssuer(tenantId),
+            aud: RUN_TOKEN_AUD,
+            sub: lease.sessionId,
+            trn: turnId,
+            agt: session.agentId,
+            epc: lease.epoch,
+            iat,
+            exp,
+            jti: randomUUID(),
+        },
+    });
+    return {
+        token,
+        claims: {
+            tenantId,
+            sessionId: lease.sessionId,
+            turnId,
+            agentId: session.agentId,
+            epoch: lease.epoch,
+            expiresAt: exp * 1000,
+        },
+    };
+}
+/**
+ * Verifies a run token of Tenant `tenantId` against the public keys in `store`: everything a
+ * forger controls (size, shape, header) is checked before any key is read, then the
+ * signature, `iss`, `aud`, `typ`, lifetime and claims. A revoked key refuses even a token it
+ * signed while it was live.
+ */
+export async function verifyRunToken(store, tenantId, raw, cache = new Map()) {
+    const refused = (reason) => ({ ok: false, reason: `run_token_${reason}` });
+    const checked = tokenKeyId(raw, RUN_TOKEN_TYP);
+    if ("refused" in checked)
+        return refused(checked.refused);
+    const { kid } = checked;
+    const row = await store.tx((t) => t.signingKey(kid));
+    if (!row)
+        return refused("key_unknown");
+    let key = cache.get(kid);
+    if (!key) {
+        key = await importJWK({ ...JSON.parse(row.publicJwk), alg: "ES256" }, "ES256");
+        cache.set(kid, key);
+    }
+    let payload;
+    try {
+        const verified = await jwtVerify(raw, key, {
+            algorithms: ["ES256"],
+            issuer: tenantTokenIssuer(tenantId),
+            audience: RUN_TOKEN_AUD,
+            typ: RUN_TOKEN_TYP,
+            clockTolerance: CLOCK_TOLERANCE_SECONDS,
+            requiredClaims: ["sub", "iat", "exp", "jti"],
+        });
+        payload = verified.payload;
+    }
+    catch (error) {
+        return refused(error instanceof errors.JWTExpired ? "expired" : "invalid");
+    }
+    if (row.state === "revoked")
+        return refused("key_revoked");
+    const { sub, trn, agt, epc, iat, exp } = payload;
+    if (typeof sub !== "string" ||
+        sub === "" ||
+        typeof trn !== "string" ||
+        trn === "" ||
+        typeof agt !== "string" ||
+        agt === "" ||
+        typeof epc !== "number" ||
+        !Number.isSafeInteger(epc) ||
+        epc < 1 ||
+        exp - iat > RUN_TOKEN_TTL_SECONDS + LIFETIME_SLACK_SECONDS)
+        return refused("claims");
+    return {
+        ok: true,
+        claims: { tenantId, sessionId: sub, turnId: trn, agentId: agt, epoch: epc, expiresAt: exp * 1000 },
+    };
+}
+/**
+ * Why calls under `claims` are stale, or undefined while its lease is still the session's
+ * (G4): the session's epoch is the token's, its active turn is the token's, and it is not
+ * cancelled. One indexed read of the session row.
+ */
+export async function staleRun(store, claims) {
+    const state = await store.tx((t) => t.runState(claims.sessionId));
+    if (!state)
+        return "the session is gone";
+    if (state.epoch !== claims.epoch)
+        return "another advance owns the session now";
+    if (state.activeTurnId !== claims.turnId)
+        return "the turn has ended";
+    if (state.status === "cancelled")
+        return "the turn was cancelled";
+    return undefined;
+}

package/dist/tenant/runtime.d.ts

@@ -8,6 +8,13 @@ import { type StreamsStatus } from "./streams.js";
 import { type TenantExecution, type TenantWorker } from "./worker.js";
 import { type ToolGate } from "../gates/tool-gate.js";
 import { type Keys } from "../keys/keys.js";
+import type { RunGrants } from "./run-grants.js";
+import { type BlobStore } from "../blob/index.js";
+import type { HarnessChannel, MemoryPortsOptions } from "@nylorun/core/harness-api";
+import { type HarnessPeer } from "../harness-api/server.js";
+import { type HostAuthority } from "../sandbox/join.js";
+import type { TenantPods } from "./context.js";
+import { type OperatorKeys } from "./operator-keys.js";
 /** TENANTS-CCR: test/injection hooks until TenantConfig gains them. */
 export type TenantOpenHooks = {
     modelProvider?: ModelProvider;
@@ -26,6 +33,11 @@ export type TenantOpenHooks = {
      * process never reads, creates or holds the vault key. Without one, it does them here.
      */
     keys?: Keys;
+    /**
+     * The run grants the gates service's clients read (F5): each advance mints its session's
+     * run token into them. Give the same object to `modelGate` and `toolGate`.
+     */
+    runGrants?: RunGrants;
     vaultKek?: Buffer | string | null;
     /** When true, create the KEK file on first vault write (tests / new Tenants). */
     createKekIfMissing?: boolean;
@@ -50,6 +62,28 @@ export type TenantOpenHooks = {
     hostRelay?: boolean;
     /** How long a retired stream basin is kept after a reset (tests). Default 60 s. */
     retireGraceMs?: number;
+    /**
+     * The Object store, owned by the caller (the Host's `s3` BlobStore, D35). Without one the
+     * Tenant keeps blobs on disk under `paths.blobs` (the `fs` adapter: embedding, tests).
+     */
+    blobs?: BlobStore;
+    /**
+     * The Tenant's harness (F6.1, F6.2): `memory` (default) runs one in this process over a memory
+     * channel, with the Tenant's MCP pool and SandboxManager; `json` the same through JSON with
+     * every frame validated (tests). `remote` runs none: harnesses attach with
+     * `TenantHandle.attachHarness` (the Harness API listener, `NYLORUN_HARNESS=remote`), and the
+     * one that declares `workspace` holds the workspaces; this process has no MCP pool and no
+     * SandboxManager. `ws` is `remote` with a harness service in this process over a loopback
+     * WebSocket (tests).
+     */
+    harness?: "memory" | "json" | "ws" | "remote";
+    /** Sees each frame of the in-process harness's channel (tests and benchmarks). */
+    harnessTap?: MemoryPortsOptions["tap"];
+    /**
+     * Sandbox pods (F7.2): the sandboxes service (`NYLORUN_SANDBOXES_URL`) and the Runtime image
+     * pods copy the engine from. Without it, kind `pod` is `sandbox_unavailable`.
+     */
+    pods?: TenantPods;
 } & OpenedTenant;
 export declare class TenantRuntime implements TenantHandle {
     private readonly ctx;
@@ -59,12 +93,17 @@ export declare class TenantRuntime implements TenantHandle {
     private readonly detach;
     /** How long close waits for running advances: the execution's advance grace period. */
     private readonly closeGraceMs;
+    private readonly harness?;
+    private readonly hosts?;
     private constructor();
+    /** The Tenant's side of a sandbox pod's join (F7.2). */
+    hostAuthority(): HostAuthority | undefined;
     static open(config: TenantConfig, hooks: TenantOpenHooks): Promise<TenantRuntime>;
     fetch(request: Request, node: NodeBindings): Promise<Response>;
     authorize(sessionId: string, request: {
         url: string;
         serverName?: string;
+        agentId?: string;
     }): Promise<AuthorizeResult>;
     summary(): Promise<TenantSummary>;
     drain(activeWork: "drain" | "cancel", timeoutMs?: number): Promise<void>;
@@ -80,6 +119,9 @@ export declare class TenantRuntime implements TenantHandle {
     streamsStatus(): Promise<StreamsStatus>;
     /** Adds a callback to the Tenant sweep. Returns a function that removes it. */
     onSweep(hook: () => Promise<void>): () => void;
+    attachHarness(channel: HarnessChannel, peer: HarnessPeer): () => void;
+    /** The Tenant's operator keys (F9 I1), over its store. */
+    operatorKeys(): OperatorKeys;
     close(): Promise<void>;
 }
 /**