@nylorun/runtime 0.15.2-beta → 0.17.0-beta

package/dist/tenant/session.d.ts

@@ -1,16 +1,8 @@
-/**
- * Pure helpers over the session document: turn-manifest pins and variants, state rebasing,
- * the tools of an MCP snapshot, and the event target of an Action. No store access and no I/O.
- *
- * Later waves: stable; the async store conversion (Wave 1 / A) does not change these.
- */
-import { type DurableSessionTool, type HostEffect } from "@nylorun/harness/run";
 import type { Action } from "@nylorun/core/contracts";
-import { type AgentManifest, type JsonValue } from "@nylorun/core/define";
+import type { AgentManifest, JsonValue } from "@nylorun/core/define";
 import { type TurnManifestStore } from "../core/turn-manifest.js";
-import type { McpSnapshot, McpToolRecord } from "../mcp/snapshot.js";
 import type { Session } from "./context.js";
-export declare function sessionToolsOf(snapshot: McpSnapshot | undefined): readonly DurableSessionTool[] | undefined;
+export { manifestFor, sessionToolsOf } from "../mcp/snapshot.js";
 /** Turn-manifest store backed by the session's `variants` map (no schema change). */
 export declare function variantStore(session: Session): TurnManifestStore;
 /** Manifest this turn's checkpoint is pinned to (session pin or a stored variant). */
@@ -18,9 +10,6 @@ export declare function turnManifestOf(session: Session): AgentManifest;
 /** Wrap a linked agent turn so the Loop learns the turn's manifest (SD-I4 pin stays on session). */
 export declare function linkedAgentOutput(session: Session, output: JsonValue | undefined): JsonValue;
 export declare function rebaseSessionState(session: Session, turnHash: string): void;
-export declare function mcpToolOf(session: Session, request: Pick<HostEffect, "agent" | "capabilityId" | "toolName">): McpToolRecord | undefined;
-/** The manifest of the agent an effect belongs to: the root, or an agent it uses as a tool. */
-export declare function manifestFor(manifest: AgentManifest, agent: HostEffect["agent"]): AgentManifest | undefined;
 export declare function pinnedTool(manifest: AgentManifest, capabilityId?: string, toolName?: string): import("@nylorun/core/define").ToolManifest | undefined;
 /** What an action runs, for events: a tool name, or a hook point and its capabilities. */
 export declare function actionTarget(action: Action): {

package/dist/tenant/session.js

@@ -1,29 +1,14 @@
 /**
  * Pure helpers over the session document: turn-manifest pins and variants, state rebasing,
- * the tools of an MCP snapshot, and the event target of an Action. No store access and no I/O.
+ * and the event target of an Action. No store access and no I/O. (The tools of an MCP snapshot
+ * live in `mcp/snapshot.ts`.)
  *
  * Later waves: stable; the async store conversion (Wave 1 / A) does not change these.
  */
-import { agentTurnValue, } from "@nylorun/harness/run";
-import { delegateManifest, } from "@nylorun/core/define";
+import { agentTurnValue } from "@nylorun/harness/run";
 import { isWorkflowManifest } from "../core/flow-host.js";
 import { allowedManifestHashes, rebaseTurnState, } from "../core/turn-manifest.js";
-export function sessionToolsOf(snapshot) {
-    if (!snapshot?.mcpTools.length)
-        return undefined;
-    return snapshot.mcpTools.map((tool) => ({
-        ...(tool.agentId === undefined ? {} : { agentId: tool.agentId }),
-        capabilityId: tool.capabilityId,
-        name: tool.name,
-        ...(tool.description === undefined
-            ? {}
-            : { description: tool.description }),
-        inputSchema: tool.inputSchema,
-        ...(tool.outputSchema === undefined
-            ? {}
-            : { outputSchema: tool.outputSchema }),
-    }));
-}
+export { manifestFor, sessionToolsOf } from "../mcp/snapshot.js";
 /** Turn-manifest store backed by the session's `variants` map (no schema change). */
 export function variantStore(session) {
     return {
@@ -61,15 +46,6 @@ export function rebaseSessionState(session, turnHash) {
     if (next !== session.state)
         session.state = next;
 }
-export function mcpToolOf(session, request) {
-    return session.mcpSnapshot?.mcpTools.find((tool) => tool.agentId === request.agent?.id &&
-        tool.capabilityId === request.capabilityId &&
-        tool.name === request.toolName);
-}
-/** The manifest of the agent an effect belongs to: the root, or an agent it uses as a tool. */
-export function manifestFor(manifest, agent) {
-    return agent ? delegateManifest(manifest, agent.id) : manifest;
-}
 export function pinnedTool(manifest, capabilityId, toolName) {
     const capability = manifest.capabilities.find((item) => item.id === capabilityId);
     return capability?.tools?.find((tool) => tool.name === toolName);

package/dist/tenant/sessions.d.ts

@@ -15,7 +15,7 @@ export declare function listDefinitions(ctx: TenantContext): Promise<{
     }[];
 }>;
 /**
- * The agents a subject token or publishable key may see: id, name and description only, never
+ * The agents a token caller may see: id, name and description only, never
  * instructions, tools or MCP servers, and only the agents allowed.
  */
 export declare function listAgentsPublic(ctx: TenantContext, agents: ReadonlySet<string> | "*"): Promise<{
@@ -59,6 +59,11 @@ export declare function putSession(ctx: TenantContext, id: string, body: PutSess
      * session): an existing one must have the same owner and agent, or it is a 404.
      */
     createOnly?: boolean;
+    /**
+     * The sandboxes the caller reaches (a token caller's grants, `sandboxGrantsOf`); undefined
+     * reaches every one. `sandbox: { id }` must name one of them.
+     */
+    sandboxGrants?: readonly string[];
 }): Promise<Session>;
 /** The session resource returned by `GET`/`PUT /v1/sessions/:id`. */
 export declare function sessionView(t: Tx, s: Session): Promise<unknown>;

package/dist/tenant/sessions.js

@@ -12,6 +12,8 @@ import { resolveSandbox } from "../sandbox/resolve.js";
 import { withSandboxCapability } from "../sandbox/session-sandbox.js";
 import { declaredSandboxes, sandboxSpecOf, sessionSandboxSpec, } from "../sandbox/share.js";
 import { effectiveSandboxConfig, readSandboxConfig } from "../sandbox/tenant-config.js";
+import { checkPlacement, requirePods } from "../sandbox/placement.js";
+import { attachSandbox, recordAttachment } from "./sandboxes.js";
 import { sandboxLookup, } from "./context.js";
 import { fail } from "./http.js";
 /** A session's creation identity: everything but the request id and vault attachments. */
@@ -31,7 +33,7 @@ export async function listDefinitions(ctx) {
     };
 }
 /**
- * The agents a subject token or publishable key may see: id, name and description only, never
+ * The agents a token caller may see: id, name and description only, never
  * instructions, tools or MCP servers, and only the agents allowed.
  */
 export async function listAgentsPublic(ctx, agents) {
@@ -133,7 +135,14 @@ export async function putSession(ctx, id, body, access, options = {}) {
         }
         const definition = (await t.get("definitions", body.agentId)) ??
             fail(404, "Definition not found");
-        const sandbox = await sessionSandbox(t, body, definition, { opaque });
+        const sandbox = await sessionSandbox(t, body, definition, {
+            opaque,
+            ...(options.sandboxGrants === undefined ? {} : { grants: options.sandboxGrants }),
+        });
+        // Placement (D38): where this session's harness may run, decided now and kept.
+        checkPlacement(await readSandboxConfig(t), sandbox.kind);
+        if (sandbox.kind === "pod")
+            await requirePods(ctx.pods, `Sandbox ${sandbox.sandboxId}`);
         const created = {
             id,
             agentId: body.agentId,
@@ -151,23 +160,40 @@ export async function putSession(ctx, id, body, access, options = {}) {
             ...(sandbox.sandboxOwnerId !== undefined
                 ? { sandboxOwnerId: sandbox.sandboxOwnerId }
                 : {}),
+            ...(sandbox.sandboxId !== undefined ? { sandboxId: sandbox.sandboxId } : {}),
             ...(sandbox.spec !== undefined
                 ? { sandbox: sandbox.spec, sandboxSource: sandbox.source }
                 : {}),
         };
         await t.put("sessions", id, created);
         await ctx.vault.recordAttachment(t, id, vaultIds);
+        if (sandbox.sandboxId !== undefined)
+            await recordAttachment(t, id, sandbox.sandboxId);
         return created;
     });
 }
 function isShare(value) {
     return typeof value === "object" && value !== null && "session" in value;
 }
+function isAttach(value) {
+    return typeof value === "object" && value !== null && "id" in value;
+}
 /** Decide a new session's sandbox and, for an agent, the manifest that carries its tools. */
 async function sessionSandbox(t, body, definition, options) {
     const request = body.sandbox;
     const declared = sandboxSpecOf(definition.manifest) !== undefined;
+    if (isAttach(request)) {
+        if (declared)
+            fail(400, `'${body.agentId}' declares its own sandbox with .sandbox(). Remove it from the agent to attach a sandbox.`);
+        const sandbox = await attachSandbox(t, request.id, options.grants);
+        // A pod's storage and lifecycle are the resource's, not the agent's sandbox manifest.
+        const { storage: _storage, lifecycle: _lifecycle, ...spec } = sandbox.spec;
+        return { ...(await pin(definition, spec, "sandbox")), sandboxId: sandbox.id, kind: sandbox.kind };
+    }
     if (isShare(request)) {
+        const owner = await t.get("sessions", request.session);
+        if (owner?.sandboxId !== undefined && (!options.opaque || owner.ownerUserId === body.ownerUserId))
+            fail(400, `Session ${request.session} is attached to sandbox ${owner.sandboxId}: open this session with sandbox: { id: "${owner.sandboxId}" }.`);
         const lookup = await sandboxLookup(t, request.session);
         const sandboxOwnerId = validateSandboxAttach(body, definition.manifest, lookup, {
             opaque: options.opaque,
@@ -240,6 +266,7 @@ export async function sessionView(t, s) {
         vaultIds: s.vaultIds ?? [],
         credentialSelections: s.credentialSelections ?? [],
         sandboxOwnerId: s.sandboxOwnerId ?? null,
+        ...(s.sandboxId === undefined ? {} : { sandboxId: s.sandboxId }),
         sandbox: s.sandbox ?? null,
         ...(s.sandboxSource ? { sandboxSource: s.sandboxSource } : {}),
         mcpSnapshot: s.mcpSnapshot ?? null,

package/dist/tenant/signing-keys.d.ts

@@ -1,5 +1,6 @@
 /**
- * Tenant signing keys for subject tokens. Each key is an ES256 pair: the public JWK is stored
+ * Tenant signing keys for the tokens the Runtime signs itself (delivery tokens, capability
+ * links, run and host tokens). Each key is an ES256 pair: the public JWK is stored
  * as is, the PKCS#8 private key is sealed with the vault KEK (AAD bound to the Tenant and key
  * id), like a credential.
  *

package/dist/tenant/signing-keys.js

@@ -1,5 +1,6 @@
 /**
- * Tenant signing keys for subject tokens. Each key is an ES256 pair: the public JWK is stored
+ * Tenant signing keys for the tokens the Runtime signs itself (delivery tokens, capability
+ * links, run and host tokens). Each key is an ES256 pair: the public JWK is stored
  * as is, the PKCS#8 private key is sealed with the vault KEK (AAD bound to the Tenant and key
  * id), like a credential.
  *
@@ -117,7 +118,6 @@ export class SigningKeys {
         const [previous] = await t.signingKeys(["previous"]);
         if (previous && !force) {
             const retired = Date.parse(previous.retiredAt ?? previous.createdAt);
-            // Delivery tokens may outlive the policy's subject tokens.
             const longest = Math.max(maxTtlSeconds, DELIVERY_TOKEN_MAX_TTL_SECONDS);
             const until = retired + longest * 1000 + ROTATION_GRACE_MS;
             if (until > now.getTime())

package/dist/tenant/status.d.ts

@@ -1,8 +1,9 @@
-import type { SeedTenantConfigRequest, SeedTenantConfigResponse, TenantStatus } from "@nylorun/core/contracts";
+import type { HarnessStatus, SeedTenantConfigRequest, SeedTenantConfigResponse, TenantStatus } from "@nylorun/core/contracts";
 import type { SessionStore } from "../store/types.js";
 import type { VaultService } from "../vault/service.js";
-import type { SandboxManager } from "../sandbox/manager.js";
+import type { WorkspacePort } from "../harness-api/workspace.js";
 import type { TenantConfig } from "./types.js";
+import type { TenantContext } from "./context.js";
 import type { TenantEnvelope } from "@nylorun/core/contracts";
 import type { StuckInvocation } from "../execution/types.js";
 import type { StreamsStatus } from "./streams.js";
@@ -12,7 +13,7 @@ export interface TenantStatusContext {
     config: TenantConfig;
     store: SessionStore;
     vault: VaultService;
-    sandbox: SandboxManager;
+    sandbox: Pick<WorkspacePort, "report">;
     closing: boolean;
     modelConfigured: boolean;
     /**
@@ -22,7 +23,11 @@ export interface TenantStatusContext {
     stuckInvocations?: () => Promise<StuckInvocation[]>;
     /** This Tenant's Durable Streams status (`streamsStatus` in `streams.ts`). */
     streamsStatus?: () => Promise<StreamsStatus>;
+    /** The Tenant's harnesses (F6.2). */
+    harness?: HarnessStatus;
 }
+/** The Tenant's harnesses, for its status and the Host's. */
+export declare function harnessStatusOf(ctx: Pick<TenantContext, "mcp" | "harness">): HarnessStatus;
 /** Build `TenantStatusSchema` with secrets redacted (A14). */
 export declare function buildTenantStatus(ctx: TenantStatusContext): Promise<TenantStatus>;
 /**

package/dist/tenant/status.js

@@ -1,5 +1,9 @@
 import { FIXTURE_MODEL_SETTING, seedFixtureModel } from "./model-setting.js";
 import { SANDBOX_CONFIG_SETTING, writeSandboxConfig } from "../sandbox/tenant-config.js";
+/** The Tenant's harnesses, for its status and the Host's. */
+export function harnessStatusOf(ctx) {
+    return { mode: ctx.mcp ? "in-process" : "remote", ...ctx.harness.status() };
+}
 /** How long status waits for the execution to list stuck invocations. */
 const STUCK_TIMEOUT_MS = 5000;
 /** `TenantStatus.execution`: paused and backing-off invocations, or why they are unknown. */
@@ -84,6 +88,7 @@ export async function buildTenantStatus(ctx) {
             backend: sandboxReport.backend,
             retained: counts.sandboxes,
         },
+        ...(ctx.harness ? { harness: ctx.harness } : {}),
         ...(execution ? { execution } : {}),
         ...(streams ? { streams } : {}),
     };

package/dist/tenant/streams.d.ts

@@ -17,8 +17,8 @@
  * - **Readers.** History and session SSE read the session's stream
  *   (`tenant/session-streams.ts`). This module runs one `tenant/control` reader per Tenant per
  *   process, on the current basin, which calls `ctx.abortLocal` for each `session.cancel`,
- *   checks the session streams for each `sessions.reset`, and ends a subject's streams for
- *   each `subject.revoked`.
+ *   passes an Action's outcome to a run held here for each `action.resolved` (F6.2), and
+ *   checks the session streams for each `sessions.reset`.
  *
  * The caller passes the streams: the Host's S2 streams, or `MemoryStreams` for tests and a
  * local development Host (not durable).
@@ -78,6 +78,12 @@ export declare function wireStreams(ctx: TenantContext, options: WireStreamsOpti
  * effect), so failures are logged, never thrown.
  */
 export declare function signalSessionCancel(ctx: TenantContext, sessionId: string, turnId: string | null): void;
+/**
+ * Appends `action.resolved` for an Action whose outcome just committed, so a run held for it
+ * by a harness of another process goes on (F6.2). Call it from `t.afterCommit`. A lost signal
+ * costs the hold's time only: the segment then ends as waiting and resumes by replay.
+ */
+export declare function signalActionOutcome(ctx: TenantContext, sessionId: string, actionId: string): void;
 /**
  * After a reset deleted the Tenant's sessions and moved it to a new basin generation: tells
  * every process with the Tenant open (`sessions.reset` on the old basin's control stream),

package/dist/tenant/streams.js

@@ -1,8 +1,8 @@
 import { basinOf } from "../streams/basin.js";
-import { signalCancel, signalSessionsReset } from "../streams/control.js";
+import { signalActionResolved, signalCancel, signalSessionsReset } from "../streams/control.js";
 import { createStreamRelay, } from "../streams/relay/core.js";
 import { CONTROL_STREAM, } from "../streams/types.js";
-import { checkSessionStreams, currentBasin, endSubjectStreams, sleep, } from "./session-streams.js";
+import { checkSessionStreams, currentBasin, sleep, } from "./session-streams.js";
 const RETRY_MIN_MS = 100;
 const RETRY_MAX_MS = 2000;
 /** The longest wait between two `ensureTenant` attempts while the basin is being repaired. */
@@ -59,12 +59,12 @@ export async function wireStreams(ctx, options) {
         const signal = body;
         if (signal?.type === "session.cancel" && typeof signal.sessionId === "string")
             ctx.abortLocal(signal.sessionId, typeof signal.turnId === "string" ? signal.turnId : undefined);
+        else if (signal?.type === "action.resolved" &&
+            typeof signal.sessionId === "string" &&
+            typeof signal.actionId === "string")
+            void resolveHeld(ctx, signal.sessionId, signal.actionId).catch(report("held run resolution failed"));
         else if (signal?.type === "sessions.reset")
             void checkSessionStreams(ctx).catch(report("session stream check failed"));
-        else if (signal?.type === "subject.revoked" &&
-            typeof signal.subject === "string" &&
-            typeof signal.epoch === "number")
-            endSubjectStreams(ctx.sessionStreams, signal.subject, signal.epoch);
     }, report("control stream read failed; retrying"));
     // Signals appended from here on reach this process.
     await startControl();
@@ -171,6 +171,25 @@ export function signalSessionCancel(ctx, sessionId, turnId) {
         message: messageOf(error),
     }));
 }
+/**
+ * Appends `action.resolved` for an Action whose outcome just committed, so a run held for it
+ * by a harness of another process goes on (F6.2). Call it from `t.afterCommit`. A lost signal
+ * costs the hold's time only: the segment then ends as waiting and resumes by replay.
+ */
+export function signalActionOutcome(ctx, sessionId, actionId) {
+    const streams = ctx.sessionStreams.wiring?.streams;
+    if (!streams)
+        return;
+    void signalActionResolved(streams, currentBasin(ctx), sessionId, actionId).catch((error) => ctx.config.logger.warn("action resolved signal failed", { sessionId, message: messageOf(error) }));
+}
+/** Passes an Action's recorded outcome to the run of `sessionId` held here, if any. */
+async function resolveHeld(ctx, sessionId, actionId) {
+    if (!ctx.harness.holds(sessionId))
+        return;
+    const effect = await ctx.store.tx((t) => t.get("effects", actionId));
+    if (effect?.status === "completed" && effect.outcome)
+        ctx.harness.resolved(sessionId, actionId, effect.outcome);
+}
 /**
  * After a reset deleted the Tenant's sessions and moved it to a new basin generation: tells
  * every process with the Tenant open (`sessions.reset` on the old basin's control stream),

package/dist/tenant/sweep.js

@@ -9,9 +9,10 @@
  * 2. **Orphaned sessions.** `running` or `runnable` sessions with no owner, or an owner whose
  *    lease expired, are woken with reason `recover`: a wake lost between commit and send, or
  *    a Worker that died mid-advance (the advance then takes over, §11.4).
- * 3. **Sandboxes.** Idle sandboxes are stopped, records of compute this process no longer
- *    holds are marked stopped, and sandboxes whose session is gone are removed. Idle MCP
- *    connections are closed.
+ * 3. **Sandboxes.** Idle sandboxes are stopped, records of compute no longer held are marked
+ *    stopped, and sandboxes whose session or sandbox resource is gone are removed, by the
+ *    workspace capability (`harness-api/workspace.ts`: here, or in the harness that serves
+ *    workspaces). Idle MCP connections of the in-process harness are closed.
  * 4. **Hooks.** Callbacks registered with `ctx.onSweep`.
  * 5. **Deliveries.** Deliveries to Action endpoints whose deadline passed without an answer are
  *    lost (`delivery.ts` `loseAction`), and pending Actions of agents with an endpoint are sent
@@ -38,9 +39,12 @@ export async function sweep(ctx) {
             () => ctx.sandbox.sweep({
                 now: now.getTime(),
                 sessionExists: async (id) => !!(await ctx.store.tx((t) => t.get("sessions", id))),
+                sandboxExists: async (id) => (await ctx.store.tx((t) => t.sandboxResource(id))) !== undefined,
             }),
         ],
-        ["mcp", () => ctx.mcp.sweep()],
+        ["pods", () => reconcileStalePods(ctx, now)],
+        // A harness elsewhere closes its own idle MCP connections.
+        ["mcp", async () => ctx.mcp?.sweep()],
         ...[...ctx.sweepHooks].map((hook) => ["hook", hook]),
     ];
     let failure;
@@ -80,3 +84,32 @@ export async function wakeOrphanedSessions(ctx, now = new Date()) {
         await ctx.wake(id, { reason: "recover" });
     return ids;
 }
+/** A pod sandbox in a change this long without a reconcile gets one from the sweep. */
+const STALE_POD_MS = 60_000;
+/**
+ * Pod sandboxes (F7.2) whose change has not finished (creating, deleting, an old volume still
+ * to delete, an expiry not yet recorded), or that should run but whose engine is not connected,
+ * and whose row has not moved for a minute: a reconcile the `Sandbox` object lost (a send
+ * dropped while the Tenant closed) is sent again, and a pod or volume deleted outside the
+ * Runtime is found.
+ */
+async function reconcileStalePods(ctx, now) {
+    if (!ctx.pods)
+        return;
+    const stale = await ctx.store.tx(async (t) => (await t.listSandboxResources()).filter((row) => {
+        const pod = row.pod;
+        if (!pod || now.getTime() - Date.parse(row.updatedAt) < STALE_POD_MS)
+            return false;
+        const expiring = pod.expiresAt !== undefined && Date.parse(pod.expiresAt) <= now.getTime() && pod.observed !== "expired";
+        return (pod.desired === "deleted" ||
+            pod.retiring !== undefined ||
+            pod.observed === "creating" ||
+            pod.observed === "deleting" ||
+            expiring ||
+            (pod.desired === "suspended" && pod.observed !== "suspended") ||
+            // Running, but its engine is not connected: the pod may be gone, or its volume.
+            (pod.desired === "running" && pod.observed === "running" && !ctx.harness.hosting(row.id)));
+    }));
+    for (const row of stale)
+        await ctx.sandboxSignal(row.id, { kind: "reconcile" });
+}

package/dist/tenant/types.d.ts

@@ -1,10 +1,15 @@
 import type { IncomingMessage, ServerResponse } from "node:http";
-import type { HostAggregate, HostTenant, TenantEnvelope } from "@nylorun/core/contracts";
+import type { HarnessStatus, HostAggregate, HostTenant, TenantEnvelope } from "@nylorun/core/contracts";
+import type { HarnessChannel } from "@nylorun/core/harness-api";
 import type { FlowLimits } from "../core/limits.js";
+import type { HarnessPeer } from "../harness-api/server.js";
+import type { HostAuthority } from "../sandbox/join.js";
 import type { SessionStore } from "../store/types.js";
 import type { SandboxBackend } from "../sandbox/types.js";
 import type { TenantCause } from "./cause.js";
+import type { OperatorKeys } from "./operator-keys.js";
 import type { OutboundPolicy } from "./outbound.js";
+import type { ResolverConfig } from "../vault/sources.js";
 import type { TenantWorker } from "./worker.js";
 export type TenantMode = "shared" | "ephemeral" | "test";
 /**
@@ -19,6 +24,8 @@ export interface TenantPaths {
     tmp: string;
     sandboxes: string;
     pluginData: string;
+    /** The `fs` BlobStore's directory, used when the Host has no Object store. */
+    blobs: string;
     logs: string;
     log: string;
 }
@@ -48,6 +55,12 @@ export interface TenantConfig {
         steps?: number;
         ms?: number;
     };
+    /**
+     * How long a run waits in its lease for a pending Action's outcome (F6.2): the turn goes on
+     * at once when the Action endpoint answers in time, and ends its segment as waiting (resumed
+     * by replay) otherwise. Default 5 minutes; 0 never waits.
+     */
+    actionHoldMs?: number;
     /** Retries and timeouts for model calls (Model Calls §5, §6). Defaults in `piModel`. */
     modelCall?: import("../gates/model-gate.js").ModelCallSettings;
     childEnv: Readonly<Record<string, string>>;
@@ -70,6 +83,23 @@ export interface TenantConfig {
      */
     flowEnv?: Readonly<Record<string, string | undefined>>;
     vaultFetch?: typeof fetch;
+    /**
+     * The trusted issuers whose JWTs the Tenant API accepts (Host feature `trusted-issuers`), from
+     * the identity file (`NYLORUN_IDENTITY_FILE`). Absent: none.
+     */
+    issuers?: import("./issuers.js").TrustedIssuers;
+    /**
+     * The operator's credential resolver (F9 C1), asked for a person's MCP credential when the
+     * session's vaults hold none. Used where this process authorizes MCP calls itself (embedding,
+     * the ephemeral Runtime, tests); the gateway takes `NYLORUN_RESOLVER_*` instead.
+     */
+    resolver?: ResolverConfig;
+    /**
+     * The URL browsers reach this Tenant API at (`NYLORUN_PUBLIC_URL`, no trailing slash): the
+     * base of the MCP OAuth callback, `<publicUrl>/v1/oauth/callback` (F9 C2). Absent (embedding,
+     * tests): the origin the start request was sent to.
+     */
+    publicUrl?: string;
     logger: Logger;
 }
 export interface Logger {
@@ -84,6 +114,8 @@ export interface TenantSummary {
     inFlightDeliveries: number;
     pendingActions: number;
     uncertainEffects: number;
+    /** The Tenant's harnesses (F6.2). */
+    harness?: HarnessStatus;
 }
 /**
  * The Node request and response behind a `Request`, for what still writes to Node directly
@@ -107,6 +139,12 @@ export interface TenantHandle {
     /** Stop scheduling; wait for or cancel active turns. */
     drain(activeWork: "drain" | "cancel", timeoutMs?: number): Promise<void>;
     close(): Promise<void>;
+    /** Serves a harness's Harness API channel until it closes. Returns a function that detaches it. */
+    attachHarness?(channel: HarnessChannel, peer: HarnessPeer): () => void;
+    /** The Tenant's side of a sandbox pod's join (F7.2); absent without sandbox pods. */
+    hostAuthority?(): HostAuthority | undefined;
+    /** The Tenant's operator keys, for the Admin API (`/v1/admin/keys`, F9 I1). */
+    operatorKeys?(): OperatorKeys;
 }
 /**
  * The Host's Tenant for a request: open, or unavailable. `cause` says why when opening it

package/dist/tenant/worker.d.ts

@@ -1,4 +1,6 @@
-import type { AdvanceResult, DeliverResult, DurableExecution, StuckInvocation, WorkerHandlers } from "../execution/types.js";
+import type { AbortReason } from "@nylorun/core/harness-api";
+import { RunAbort } from "@nylorun/harness/api";
+import type { AdvanceResult, DeliverResult, SandboxResult, SandboxTrigger, DurableExecution, StuckInvocation, WorkerHandlers } from "../execution/types.js";
 import type { Logger } from "./types.js";
 /** This process's Worker id: the `owner` it writes on the sessions it advances (§10.6). */
 export declare const WORKER_ID: string;
@@ -11,10 +13,12 @@ export declare const DEFAULT_ADVANCE_DEADLINE_MS: number;
 /** Default time an aborted advance has to settle before it is abandoned. */
 export declare const DEFAULT_ADVANCE_GRACE_MS = 30000;
 /** Why an advance's signal aborted (see "Abort reasons" above). */
-export type AdvanceAbortKind = "cancel" | "shutdown" | "deadline" | "ownership.lost";
-/** The abort reason of an advance. */
-export declare class AdvanceAbort extends Error {
-    readonly kind: AdvanceAbortKind;
+export type AdvanceAbortKind = AbortReason;
+/**
+ * The abort reason of an advance. A harness run's reason (`RunAbort`) has the same kinds, so the
+ * executors read either one.
+ */
+export declare class AdvanceAbort extends RunAbort {
     readonly name: string;
     constructor(kind: AdvanceAbortKind, message: string, options?: {
         cause?: unknown;
@@ -40,6 +44,8 @@ export interface TenantWorker {
     sweep(): Promise<void>;
     /** Delivers one Action to its endpoint. Only infrastructure errors throw. */
     deliver?(actionId: string, signal: AbortSignal): Promise<DeliverResult>;
+    /** Reconciles one pod sandbox (F7.2). Only infrastructure errors throw. */
+    sandbox?(sandboxId: string, trigger: SandboxTrigger, signal: AbortSignal): Promise<SandboxResult>;
 }
 export interface TenantWorkersOptions {
     /** Finds or opens a Tenant that is not registered on this process. */

package/dist/tenant/worker.js

@@ -51,6 +51,7 @@
  */
 import { hostname } from "node:os";
 import { randomBytes } from "node:crypto";
+import { RunAbort } from "@nylorun/harness/api";
 /** This process's Worker id: the `owner` it writes on the sessions it advances (§10.6). */
 export const WORKER_ID = `worker-${hostname()}-${process.pid}-${randomBytes(4).toString("hex")}`;
 /**
@@ -61,13 +62,14 @@ export const WORKER_ID = `worker-${hostname()}-${process.pid}-${randomBytes(4).t
 export const DEFAULT_ADVANCE_DEADLINE_MS = 50 * 60_000;
 /** Default time an aborted advance has to settle before it is abandoned. */
 export const DEFAULT_ADVANCE_GRACE_MS = 30_000;
-/** The abort reason of an advance. */
-export class AdvanceAbort extends Error {
-    kind;
+/**
+ * The abort reason of an advance. A harness run's reason (`RunAbort`) has the same kinds, so the
+ * executors read either one.
+ */
+export class AdvanceAbort extends RunAbort {
     name = "AdvanceAbort";
     constructor(kind, message, options) {
-        super(message, options);
-        this.kind = kind;
+        super(kind, message, options);
     }
 }
 /** The abort reason of an advance that ran past its deadline. */
@@ -87,7 +89,7 @@ export class AdvanceDeadlineError extends AdvanceAbort {
 export function abortKind(signal) {
     if (!signal.aborted)
         return undefined;
-    return signal.reason instanceof AdvanceAbort ? signal.reason.kind : "shutdown";
+    return signal.reason instanceof RunAbort ? signal.reason.kind : "shutdown";
 }
 /** The execution's abort reason as a `shutdown`, keeping its message. */
 function shutdownOf(reason) {
@@ -138,6 +140,10 @@ export class TenantWorkers {
             const worker = await this.find(tenantId);
             return worker?.deliver ? worker.deliver(actionId, signal) : DONE;
         },
+        sandbox: async (tenantId, sandboxId, trigger, signal) => {
+            const worker = await this.find(tenantId);
+            return worker?.sandbox ? worker.sandbox(sandboxId, trigger, signal) : {};
+        },
     };
     /** Runs one advance under the deadline and the grace period (see the module comment). */
     async bounded(tenantId, sessionId, worker, signal) {

package/dist/vault/crypto.d.ts

@@ -10,3 +10,10 @@ export declare function encryptSecret(kek: Buffer, aad: Buffer, plaintext: Buffe
     kekId: string;
 };
 export declare function decryptSecret(kek: Buffer, aad: Buffer, nonce: Buffer, ciphertext: Buffer, wrappedDek: Buffer, expectedKekId: string): Buffer;
+/**
+ * `encryptSecret` in one column: nonce, wrapped DEK, then ciphertext and tag. For rows that
+ * seal several short secrets under one `kekId` (`oauth_pending`, F9 C2).
+ */
+export declare function sealBytes(kek: Buffer, aad: Buffer, plaintext: Buffer): Buffer;
+/** Opens what `sealBytes` sealed; `VaultCryptoError` when it cannot. */
+export declare function openBytes(kek: Buffer, aad: Buffer, sealed: Buffer, expectedKekId: string): Buffer;

package/dist/vault/crypto.js

@@ -78,3 +78,19 @@ function unwrapKey(kek, wrapped) {
         throw new VaultCryptoError();
     }
 }
+/** The wrapped DEK's length: its nonce, the 32-byte key and the tag. */
+const WRAPPED_DEK_BYTES = IV_BYTES + 32 + TAG_BYTES;
+/**
+ * `encryptSecret` in one column: nonce, wrapped DEK, then ciphertext and tag. For rows that
+ * seal several short secrets under one `kekId` (`oauth_pending`, F9 C2).
+ */
+export function sealBytes(kek, aad, plaintext) {
+    const sealed = encryptSecret(kek, aad, plaintext);
+    return Buffer.concat([sealed.nonce, sealed.wrappedDek, sealed.ciphertext]);
+}
+/** Opens what `sealBytes` sealed; `VaultCryptoError` when it cannot. */
+export function openBytes(kek, aad, sealed, expectedKekId) {
+    if (sealed.length < IV_BYTES + WRAPPED_DEK_BYTES + TAG_BYTES)
+        throw new VaultCryptoError();
+    return decryptSecret(kek, aad, sealed.subarray(0, IV_BYTES), sealed.subarray(IV_BYTES + WRAPPED_DEK_BYTES), sealed.subarray(IV_BYTES, IV_BYTES + WRAPPED_DEK_BYTES), expectedKekId);
+}