@nylorun/runtime 0.17.0-beta → 0.19.0-beta

package/dist/harness/service.d.ts

@@ -8,25 +8,24 @@ import { type HarnessClient, type HarnessClientOptions } from "./ws-client.js";
 export interface HarnessServiceOptions {
     readonly url: string;
     readonly token: HarnessClientOptions["token"];
-    /** Where workspaces (and their records) live, and the plugins' data. */
+    /** Where workspaces (and their records) live. */
     readonly paths: {
         readonly sandboxes: string;
-        readonly pluginData: string;
     };
-    /** The environment of MCP stdio servers: the allowlisted base, with HOME and TMPDIR. */
-    readonly childEnv: Readonly<Record<string, string>>;
     /** Vault-backed model calls (the gates service's client). */
     readonly modelGate: ModelGate;
     /** Models served without the vault; a harness process has none (`useVaultModel`). */
     readonly modelProvider?: ModelProvider;
     readonly useVaultModel: boolean;
     /** Remote MCP servers (`openMcp`) and keyed cancels; the gates service's client. */
-    readonly toolGate: Pick<ToolGate, "recovers" | "cancel" | "openMcp">;
+    readonly toolGate: Pick<ToolGate, "recovers" | "cancel" | "openMcp" | "callHttp">;
     /**
      * Authorizes a remote MCP server opened in this process. A harness process has no vault: it
      * opens remote servers through the Tool Gate, and refuses them without one.
      */
     readonly authorize?: ConstructorParameters<typeof McpPool>[0]["authorize"];
+    /** How remote MCP servers opened in this process are reached (`TenantConfig.delivery`). */
+    readonly delivery?: ConstructorParameters<typeof McpPool>[0]["policy"];
     /** Default: the virtual backend under `paths.sandboxes`. */
     readonly sandboxBackends?: readonly SandboxBackend[];
     /** Delete the workspaces on stop (an ephemeral Runtime's loopback harness). */

package/dist/harness/service.js

@@ -51,12 +51,11 @@ export function startHarnessService(options) {
         return manager;
     };
     const pool = new McpPool({
-        pluginData: options.paths.pluginData,
-        childEnv: options.childEnv,
         authorize: options.authorize ??
             (async () => {
                 throw new Error("This harness opens remote MCP servers only through the gates service");
             }),
+        ...(options.delivery ? { policy: options.delivery } : {}),
         ...(options.toolGate.openMcp ? { openRemote: (server) => options.toolGate.openMcp(server) } : {}),
     });
     const sweep = setInterval(() => void pool.sweep().catch(() => undefined), MCP_SWEEP_MS);
@@ -140,6 +139,14 @@ export function startHarnessService(options) {
                 backends,
                 preference: answer.sandbox.backend ?? "auto",
                 ephemeral: options.ephemeral === true,
+                // A skill file's bytes come from core, for the run that made the call.
+                definitionFile: async (sha256, session) => {
+                    const channel = client.channel();
+                    if (!channel || session.claim === undefined)
+                        throw new Error(`No run to fetch ${sha256} for`);
+                    const { base64 } = await channel.request("definition.file", { runId: session.claim, sha256 });
+                    return new Uint8Array(Buffer.from(base64, "base64"));
+                },
                 // A claim core refuses (its run ended, the session is gone) is dropped, as core's own
                 // SandboxManager drops an event it cannot write.
                 emit: async (sessionId, turnId, type, payload, meta) => {

package/dist/harness-api/in-process.js

@@ -66,8 +66,7 @@ export async function startLoopbackHarness(ctx, options = {}) {
     const service = startHarnessService({
         url: listener.url,
         token,
-        paths: { sandboxes: ctx.config.paths.sandboxes, pluginData: ctx.config.paths.pluginData },
-        childEnv: ctx.config.childEnv,
+        paths: { sandboxes: ctx.config.paths.sandboxes },
         modelGate: route.modelGate,
         modelProvider: route.modelProvider,
         useVaultModel: route.useVaultModel,
@@ -75,6 +74,7 @@ export async function startLoopbackHarness(ctx, options = {}) {
         ...(ctx.toolGate.openMcp
             ? {}
             : { authorize: (sessionId, request) => authorize(ctx, sessionId, request) }),
+        ...(ctx.config.delivery ? { delivery: ctx.config.delivery } : {}),
         ...(options.sandboxBackends ? { sandboxBackends: options.sandboxBackends } : {}),
         logger: quietLogger(ctx),
         name: "loopback",

package/dist/harness-api/record.d.ts

@@ -1,9 +1,12 @@
 /**
  * The Record seam of the Harness API: core's journal for the effects of a run. `recordIntent`
  * journals an effect before anything runs it, and either answers it from the journal, hands it
- * to core's own executors (Actions, flow work, delegation), or tells the harness to `execute`
- * it. `recordOutcome` records what the harness's call returned. Both run under the advance's
- * lease: every write is epoch-checked (`ownedSession`), and a lost epoch writes nothing.
+ * to core's own executors (flow work, delegation, `save_artifact` and the skill tools), tells
+ * the harness to `execute` it (model calls; MCP, HTTP and sandbox tools; a flow's HTTP stages
+ * and HTTP verifiers), or fails a tool the Runtime cannot run (one that would run the
+ * developer's code, R2 M6). `recordOutcome`
+ * records what the harness's call returned. Both run under the advance's lease: every write is
+ * epoch-checked (`ownedSession`), and a lost epoch writes nothing.
  *
  * Rows store the request's hash (`requestHash`) and, for a model call, the request without its
  * prompt: drift is a hash compare. Rows written before carry their full request, hashed on read.

package/dist/harness-api/record.js

@@ -1,25 +1,28 @@
 /**
  * The Record seam of the Harness API: core's journal for the effects of a run. `recordIntent`
  * journals an effect before anything runs it, and either answers it from the journal, hands it
- * to core's own executors (Actions, flow work, delegation), or tells the harness to `execute`
- * it. `recordOutcome` records what the harness's call returned. Both run under the advance's
- * lease: every write is epoch-checked (`ownedSession`), and a lost epoch writes nothing.
+ * to core's own executors (flow work, delegation, `save_artifact` and the skill tools), tells
+ * the harness to `execute` it (model calls; MCP, HTTP and sandbox tools; a flow's HTTP stages
+ * and HTTP verifiers), or fails a tool the Runtime cannot run (one that would run the
+ * developer's code, R2 M6). `recordOutcome`
+ * records what the harness's call returned. Both run under the advance's lease: every write is
+ * epoch-checked (`ownedSession`), and a lost epoch writes nothing.
  *
  * Rows store the request's hash (`requestHash`) and, for a model call, the request without its
  * prompt: drift is a hash compare. Rows written before carry their full request, hashed on read.
  */
 import { HarnessApiError, effectRequestHash, } from "@nylorun/core/harness-api";
-import { isFlowEffect, isFlowToolEffect } from "../core/flow-host.js";
+import { isFlowEffect, isFlowToolEffect, recordVerdict, settleAgentEffect, } from "../core/flow-host.js";
 import { sandboxCapabilityOf } from "../sandbox/capability.js";
 import { isSaveArtifactCall } from "../harness/calls.js";
 import { callSaveArtifact } from "../tenant/artifact-tool.js";
+import { callSkillTool, isSkillToolCall } from "../tenant/skill-tool.js";
 import { isOwnershipLost } from "../store/ownership.js";
 import { manifestFor, mcpToolOf } from "../mcp/snapshot.js";
+import { isHttpToolCall } from "../gates/http-tool.js";
 import { ownedSession } from "../tenant/context.js";
-import { actionTarget, pinnedTool } from "../tenant/session.js";
-import { offerAction } from "../tenant/delivery.js";
-import { isRemoteMcpEffect, linkedOutcome, recoversMcpCalls, recoversModelCalls, resolveNewFlowEffect, } from "../tenant/effects.js";
-import { assistantMessage, contextCompacted, modelFailed, toolCompleted, toolIds, } from "../tenant/transcript.js";
+import { isGateToolEffect, linkedOutcome, recoversModelCalls, recoversToolCalls, resolveNewFlowEffect, } from "../tenant/effects.js";
+import { assistantMessage, contextCompacted, modelFailed, toolCompleted, } from "../tenant/transcript.js";
 import { abortKind } from "../tenant/worker.js";
 const TURN_CANCELLED = () => new HarnessApiError("turn_cancelled", "Turn cancelled");
 /** The hash a journal row's request was recorded with. */
@@ -54,18 +57,17 @@ export async function recordIntent(scope, effect, requestHash) {
             if (existing.status === "completed")
                 return { status: "completed", outcome: existing.outcome };
             // A call its previous owner left running at the gate: re-send it, same key and request,
-            // to join it or collect its outcome (P1.2 for model calls, F4.1 for remote MCP calls).
+            // to join it or collect its outcome (P1.2 for model calls, F4.1 for remote MCP and HTTP
+            // tool calls).
             if (existing.status === "invoking" && request.kind === "model" && recoversModelCalls(ctx))
                 return { status: "execute", rejoin: true };
-            if (existing.status === "invoking" && recoversMcpCalls(ctx) && isRemoteMcpEffect(s, existing.request))
+            if (existing.status === "invoking" && recoversToolCalls(ctx) && isGateToolEffect(s, existing.request))
                 return { status: "execute", rejoin: true };
             if (request.kind === "agent" && existing.status === "pending" && existing.agentSessionId) {
                 const agent = await t.get("sessions", existing.agentSessionId);
                 const outcome = await linkedOutcome(t, existing, agent);
                 if (outcome) {
-                    existing.status = "completed";
-                    existing.outcome = outcome;
-                    await t.put("effects", request.effectId, existing);
+                    await settleAgentEffect({ t, effect: existing, outcome });
                     return { status: "completed", outcome };
                 }
             }
@@ -73,13 +75,22 @@ export async function recordIntent(scope, effect, requestHash) {
                 status: existing.status === "uncertain" || existing.status === "invoking" ? "uncertain" : "pending",
             };
         }
-        if (request.kind === "agent" ||
-            request.kind === "fn" ||
-            request.kind === "verify" ||
-            isFlowToolEffect(request))
+        // A flow's HTTP stages and HTTP verifiers cross the Tool Gate like an agent's HTTP tool.
+        const flowHttp = isFlowToolEffect(request) && isHttpToolCall(s.manifest, request);
+        if (request.kind === "agent" || (isFlowToolEffect(request) && !flowHttp))
             return "flow";
         if (request.kind !== "model" && effectRequestHash(request) !== requestHash)
             throw new HarnessApiError("invalid", "The request hash does not match the request");
+        if (flowHttp) {
+            await t.put("effects", request.effectId, { request, requestHash, status: "invoking" });
+            await t.event(s.id, s.activeTurnId, "node.started", {
+                path: request.path,
+                kind: "http",
+                key: request.key,
+                ...(request.iterations !== undefined ? { iterations: request.iterations } : {}),
+            });
+            return { status: "execute" };
+        }
         if (request.kind === "delegation") {
             // Lifecycle points of an agent used as a tool: journaled once, so replays never re-emit.
             const outcome = { value: null };
@@ -99,25 +110,40 @@ export async function recordIntent(scope, effect, requestHash) {
         const executed = request.kind === "model" ||
             (request.kind === "tool" &&
                 (mcpToolOf(s.mcpSnapshot, request) !== undefined ||
+                    // HTTP tools (R2 M3) cross the Tool Gate.
+                    isHttpToolCall(s.manifest, request) ||
                     sandboxCapabilityOf(agentManifest, request.capabilityId, request.toolName) !== undefined ||
-                    // `save_artifact` (F8.1) runs beside the sandbox tools.
-                    isSaveArtifactCall(agentManifest, request)));
+                    // `save_artifact` (F8.1) runs beside the sandbox tools, and the skill tools (R2 M4).
+                    isSaveArtifactCall(agentManifest, request) ||
+                    isSkillToolCall(agentManifest, request)));
+        if (!executed) {
+            // A tool that would run the developer's code: refused at save (a turn's manifest only
+            // removes tools), so this is a backstop. The model sees the failure; nothing runs.
+            const outcome = { value: unrunnableTool(request) };
+            await t.put("effects", request.effectId, { request, requestHash, status: "completed", outcome });
+            const transcript = toolCompleted(request, outcome.value);
+            if (transcript)
+                await t.event(s.id, request.turnId, "tool.completed", transcript);
+            return { status: "completed", outcome };
+        }
         await t.put("effects", request.effectId, {
             request: storedRequest(request),
             requestHash,
-            status: executed ? "invoking" : "pending",
+            status: "invoking",
         });
         // `save_artifact` writes the Tenant's artifacts: core runs it, reading the file through the
         // workspace capability, wherever the sandbox is.
-        if (executed && request.kind === "tool" && isSaveArtifactCall(agentManifest, request))
+        if (request.kind === "tool" && isSaveArtifactCall(agentManifest, request))
             return "save";
-        if (executed)
-            return { status: "execute" };
-        await offerActionFor(scope, t, s, agentManifest, request);
-        return { status: "pending" };
+        // The skill tools read the agent's definition files: core serves them.
+        if (isSkillToolCall(agentManifest, request))
+            return { skill: agentManifest };
+        return { status: "execute" };
     });
     if (answer === "save")
-        return saveArtifact(scope, request);
+        return runInCore(scope, request, () => callSaveArtifact(scope.ctx, request, scope.signal));
+    if (typeof answer === "object" && "skill" in answer)
+        return runInCore(scope, request, () => callSkillTool(scope.ctx, answer.skill, request, scope.signal));
     if (answer !== "flow")
         return answer;
     if (!isFlowEffect(request))
@@ -125,13 +151,14 @@ export async function recordIntent(scope, effect, requestHash) {
     return resolveNewFlowEffect(ctx, request, signal, lease);
 }
 /**
- * Runs `save_artifact` (F8.1) for the run and records its outcome, as a harness would record a
- * call it ran: the run gets the outcome as the intent's answer.
+ * Runs a tool core serves (`save_artifact`, F8.1; the skill tools, R2 M4) for the run and records
+ * its outcome, as a harness would record a call it ran: the run gets the outcome as the intent's
+ * answer.
  */
-async function saveArtifact(scope, request) {
+async function runInCore(scope, request, call) {
     let value;
     try {
-        value = await callSaveArtifact(scope.ctx, request, scope.signal);
+        value = await call();
     }
     catch (error) {
         if (isOwnershipLost(error))
@@ -142,49 +169,13 @@ async function saveArtifact(scope, request) {
     }
     return recordOutcome(scope, request.effectId, { value });
 }
-/** A tool or hook Action for the agent's endpoint, in the intent's transaction. */
-async function offerActionFor(scope, t, s, agentManifest, request) {
-    const tool = request.kind === "tool" ? pinnedTool(agentManifest, request.capabilityId, request.toolName) : undefined;
-    const base = {
-        actionId: request.effectId,
-        sessionId: request.sessionId,
-        turnId: request.turnId,
-        agentId: request.agentId,
-        manifestHash: request.manifestHash,
-        implementationVersion: s.implementationVersion,
-        input: request.input,
-        context: request.context,
-        status: "pending",
-        generation: 0,
-        ...(request.agent ? { agent: request.agent } : {}),
+/** The failed outcome of a tool the Runtime cannot run: it would run the developer's code. */
+function unrunnableTool(request) {
+    return {
+        kind: "failed",
+        code: "tool.unavailable",
+        message: `Tool '${request.toolName ?? ""}' runs your code, and the Runtime runs no code of yours during a session. Make it an http() tool or serve it from a remote MCP server.`,
     };
-    const action = request.kind === "hook"
-        ? {
-            ...base,
-            kind: "hook",
-            hook: {
-                at: request.hook.at,
-                scope: request.hook.scope,
-                capabilityIds: [...request.hook.capabilityIds],
-            },
-        }
-        : {
-            ...base,
-            kind: "tool",
-            capabilityId: request.capabilityId,
-            toolName: request.toolName,
-            ...(tool?.inputSchema ? { inputSchema: tool.inputSchema } : {}),
-            ...(tool?.outputSchema ? { outputSchema: tool.outputSchema } : {}),
-        };
-    await t.put("actions", action.actionId, action);
-    await t.event(s.id, s.activeTurnId, "action.pending", {
-        actionId: action.actionId,
-        kind: action.kind,
-        ...actionTarget(action),
-        ...(action.kind === "tool" ? toolIds(request.context) : {}),
-        input: action.input,
-    });
-    await offerAction(t, scope.ctx, action);
 }
 /**
  * Records the outcome of a call the harness ran: `value`, with its transcript events, or the
@@ -230,6 +221,8 @@ export async function recordOutcome(scope, effectId, result) {
             : model
                 ? assistantMessage(request, value)
                 : toolCompleted(request, value);
+        if (request.context?.role === "verify-http")
+            await recordVerdict(t, request, value);
         if (failed)
             await t.event(s.id, request.turnId, "model.failed", failed);
         if (compacted)

package/dist/harness-api/server.d.ts

@@ -1,5 +1,4 @@
 import { type CoreMethod, type HarnessChannel, type OutputMethod, type ParamsOf, type ReleaseReason, type ResultOf, type TurnOutput, type TurnStart } from "@nylorun/core/harness-api";
-import type { ActionOutcome } from "@nylorun/core/contracts";
 import { type Lease, type TenantContext } from "../tenant/context.js";
 import type { RunOf } from "../tenant/run-grants.js";
 /** Who is on the other end of a connection. */
@@ -57,13 +56,6 @@ export interface HarnessApiServer {
     /** Serves a harness's channel until it closes. Returns a function that detaches it. */
     attach(channel: HarnessChannel, peer: HarnessPeer): () => void;
     offer(offer: RunOffer): Promise<RunEnd>;
-    /**
-     * An Action outcome of session `sessionId` was recorded: the run holding it, if any, gets it
-     * (`effect.resolved`). Call it after the outcome's commit.
-     */
-    resolved(sessionId: string, effectId: string, outcome: ActionOutcome): void;
-    /** A harness holds a run of `sessionId` here. */
-    holds(sessionId: string): boolean;
     /**
      * Sends a `workspace.*` request to a harness that serves workspaces: with `pod`, the host of
      * that pod sandbox; otherwise one that hosts no sandbox. Throws `NoWorkspaceHarness` when
@@ -85,7 +77,7 @@ export interface HarnessApiServer {
     readonly connected: number;
     close(): void;
 }
-/** The Harness API's state, for Tenant and admin status. */
+/** The Harness API's state, for Tenant status and `/ready`. */
 export interface HarnessStatus {
     readonly connected: number;
     readonly workspace: boolean;

package/dist/harness-api/server.js

@@ -10,8 +10,7 @@
  * the connection's loss (`connection.lost`).
  *
  * F6.2: a harness readies the session's MCP servers itself and records what it found
- * (`session.mcp`); an Action outcome recorded while its run is held reaches it as
- * `effect.resolved`; and a harness that declared `workspace` in `hello` serves the Tenant's
+ * (`session.mcp`), and a harness that declared `workspace` in `hello` serves the Tenant's
  * workspaces (`workspace`, the `workspace.*` requests). A harness claims `sandbox.*` events
  * only for a run it holds (its session, or the session owning the run's sandbox) or a session a
  * workspace request it is serving acts for; a `sandbox.state` claim's record becomes the
@@ -27,11 +26,13 @@
  */
 import { randomUUID } from "node:crypto";
 import { HARNESS_API_VERSION, HARNESS_CLAIMS, HarnessApiError, } from "@nylorun/core/harness-api";
+import { definitionFilesOf } from "@nylorun/core/contracts";
 import { isOwnershipLost } from "../store/ownership.js";
 import { ownedSession } from "../tenant/context.js";
-import { sessionToolsOf } from "../mcp/snapshot.js";
+import { mcpDiscovered, sessionToolsOf } from "../mcp/snapshot.js";
 import { sandboxWorkspaceKey, workspacePrefix } from "../sandbox/records.js";
 import { abortKind } from "../tenant/worker.js";
+import { readDefinitionFile } from "../tenant/definition-files.js";
 import { recordIntent, recordOutcome } from "./record.js";
 import { beat, renewEveryMs, tokenOf } from "./renew.js";
 /** No attached harness serves workspaces (or, with `pod`, that pod sandbox's). */
@@ -141,6 +142,8 @@ export function createHarnessApiServer(ctx, options = {}) {
                 return { cursor: run.offer.start.transcript.cursor, entries: [...run.offer.transcript] };
             case "session.mcp":
                 return recordMcp(run, p);
+            case "definition.file":
+                return definitionFile(run, p.sha256, signal);
             default:
                 throw new HarnessApiError("invalid", `Unknown request ${method}`);
         }
@@ -188,8 +191,8 @@ export function createHarnessApiServer(ctx, options = {}) {
     };
     /**
      * What a harness found readying the run's MCP servers: the first snapshot recorded for the
-     * session wins; diagnostics replace those of the same server. Answers the session's snapshot
-     * and the tools the engine advertises.
+     * session wins, with `mcp.discovered` in its log; diagnostics replace those of the same server.
+     * Answers the session's snapshot and the tools the engine advertises.
      */
     const recordMcp = (run, params) => ctx.store.tx(async (t) => {
         const { lease } = run.offer;
@@ -202,6 +205,7 @@ export function createHarnessApiServer(ctx, options = {}) {
             current.mcpSnapshot = snapshot;
             current.mcpDiagnostics = diagnostics;
             await t.put("sessions", current.id, current);
+            await t.event(current.id, run.grant.turnId, "mcp.discovered", mcpDiscovered(snapshot, diagnostics));
         }
         else if (diagnostics.length > 0) {
             const prior = [...(current.mcpDiagnostics ?? [])];
@@ -217,9 +221,18 @@ export function createHarnessApiServer(ctx, options = {}) {
         }
         return {
             ...(current.mcpSnapshot ? { snapshot: current.mcpSnapshot } : {}),
-            sessionTools: [...(sessionToolsOf(current.mcpSnapshot) ?? [])],
+            sessionTools: [...(sessionToolsOf(current.mcpSnapshot, current.manifest) ?? [])],
         };
     });
+    /** A definition file the run's definition names (its skills', for its sandbox), base64. */
+    const definitionFile = async (run, sha256, signal) => {
+        if (!definitionFilesOf(run.offer.start.routing.rootManifest).has(sha256))
+            throw new HarnessApiError("invalid", `The run's definition names no file ${sha256}`);
+        const bytes = await readDefinitionFile(ctx.blobs, sha256, signal);
+        if (!bytes)
+            throw new HarnessApiError("unavailable", `The Object store has no bytes for ${sha256}`);
+        return { base64: Buffer.from(bytes).toString("base64") };
+    };
     const output = (run, method, params) => {
         const known = run.outputs.get(method);
         if (known)
@@ -252,17 +265,6 @@ export function createHarnessApiServer(ctx, options = {}) {
                 if (connection.host?.sandboxId === sandboxId && connection.host.epoch < epoch)
                     connection.channel.close("the sandbox's host epoch moved");
         },
-        holds(sessionId) {
-            for (const run of runs.values())
-                if (run.grant.sessionId === sessionId && !run.ended && run.connection)
-                    return true;
-            return false;
-        },
-        resolved(sessionId, effectId, outcome) {
-            for (const run of runs.values())
-                if (run.grant.sessionId === sessionId && !run.ended && run.connection)
-                    run.connection.channel.notify("effect.resolved", { runId: run.grant.runId, effectId, outcome });
-        },
         async workspace(method, params, signal, target) {
             const pod = target?.pod;
             const connection = [...connections].find((item) => item.workspace && !item.channel.closed && item.host?.sandboxId === pod);

package/dist/harness-api/start.js

@@ -6,8 +6,6 @@ import { checkParity, foldTranscriptWithCursor, leanState, transcriptOf, transcr
 import { usesFixtureModel } from "../tenant/model-setting.js";
 import { rebaseSessionState, sessionToolsOf, turnManifestOf } from "../tenant/session.js";
 import { bulkOutcomes } from "./record.js";
-/** How long a run waits in its lease for a pending Action's outcome (F6.2), by default. */
-const ACTION_HOLD_MS = 5 * 60_000;
 /** Segment rollover defaults (Model Calls §10), well inside the advance deadline. */
 const ROLLOVER_STEPS = 50;
 const ROLLOVER_MS = 20 * 60_000;
@@ -59,7 +57,7 @@ export function buildTurnStart(ctx, segment) {
         checkpoint: !flow && cp.state
             ? { ...cp, state: withTranscript(cp.state, []) }
             : cp,
-        ...(flow ? {} : { sessionTools: sessionToolsOf(current.mcpSnapshot) ?? [] }),
+        ...(flow ? {} : { sessionTools: sessionToolsOf(current.mcpSnapshot, current.manifest) ?? [] }),
         outcomes: segment.outcomes,
         transcript: { cursor: segment.cursor },
         options: {
@@ -67,11 +65,9 @@ export function buildTurnStart(ctx, segment) {
                 ? { flowLimits: ctx.flowLimits }
                 : { yieldAfter: yieldAfterOf(ctx) }),
             fixtureModel: segment.fixtureModel,
-            holdMs: ctx.config.actionHoldMs ?? ACTION_HOLD_MS,
         },
         routing: {
             rootManifest: current.manifest,
-            pluginRoots: current.pluginRoots ?? {},
             ...(current.mcpSnapshot ? { mcpSnapshot: current.mcpSnapshot } : {}),
             sandbox: segment.sandbox,
         },

package/dist/harness-api/workspace.js

@@ -1,8 +1,7 @@
 /**
  * The workspace capability (F6.2): what core does with the Tenant's sandbox workspaces outside a
- * run. `ctx.sandbox` is a `WorkspacePort`: the sandbox tool routes (`POST
- * /v1/sessions/:id/sandbox/:tool` and an Action endpoint's `POST /v1/actions/:id/sandbox/:tool`),
- * Tenant status, the Tenant sweep, a sandbox resource's deletion and a sandboxes reset.
+ * run. `ctx.sandbox` is a `WorkspacePort`: the sandbox tool route (`POST
+ * /v1/sessions/:id/sandbox/:tool`), Tenant status, the Tenant sweep, a sandbox resource's deletion and a sandboxes reset.
  *
  * - **In process** (`localWorkspace`): the Tenant's own SandboxManager, which its in-process
  *   harness also runs sandbox tools with.

package/dist/harness-api/ws-server.js

@@ -1,6 +1,6 @@
 /**
  * The Harness API listener (F6.2): core's own port for harnesses (`NYLORUN_HARNESS_LISTEN_*`,
- * default 4200), apart from the Tenant and Admin APIs. It accepts the harness credential
+ * default 4200), apart from the Runtime and Management APIs. It accepts the harness credential
  * (`NYLORUN_HARNESS_TOKEN`), and nothing else does; nothing else is served here.
  *
  * An upgrade is accepted only on `/nylorun/harness/v1`, with a `Host` in the allowlist (421),

package/dist/host/app.d.ts

@@ -1,11 +1,7 @@
 import { Hono } from "hono";
 import type { Logger, NodeBindings, TenantModule } from "../tenant/types.js";
-import type { ListenerRole } from "./create-host.js";
-export type HostBindings = NodeBindings & {
-    readonly role: ListenerRole;
-};
 export type HostEnv = {
-    Bindings: HostBindings;
+    Bindings: NodeBindings;
     Variables: {
         /** The Tenant a request reached, for the request log. */
         tenantId?: string;
@@ -17,17 +13,14 @@ export interface HostAppOptions {
     module: TenantModule;
     logger: Logger;
     hostId: string;
-    adminKey: string;
     coreVersion: string;
     pid: number;
     readiness?: () => Promise<{
         ok: boolean;
         checks: Record<string, boolean>;
     }>;
-    /** Every listener is listening. */
+    /** The listener is listening. */
     listening(): boolean;
     closing(): boolean;
-    /** The Admin API (`admin-api.ts`), for a request whose admin key checked out. */
-    admin(request: Request, node: NodeBindings): Promise<Response>;
 }
 export declare function createHostApp(options: HostAppOptions): Hono<HostEnv>;

package/dist/host/app.js

@@ -3,8 +3,8 @@ import { RESPONSE_ALREADY_SENT } from "@hono/node-server/utils/response";
 import { checkCompatibility, HOST_PROTOCOL, PROTOCOL_HEADER, TENANT_HEADER, } from "@nylorun/core/compatibility";
 import { RUNTIME_VERSION } from "../version.js";
 import { findTenantRoute } from "../api/http/app.js";
-import { tenantDocument } from "../api/openapi.js";
-import { adminKeyMatches, headerValue, isJsonContentType, jsonResponse, opaqueNotFoundResponse, protocolRejectedResponse, readBearer, pathnameIsLogged, redactRoutePath, rejectedResponse, requestHasBody, } from "./http.js";
+import { managementDocument, runtimeDocument } from "../api/openapi.js";
+import { headerValue, isJsonContentType, jsonResponse, opaqueNotFoundResponse, protocolRejectedResponse, pathnameIsLogged, redactRoutePath, rejectedResponse, requestHasBody, } from "./http.js";
 export function createHostApp(options) {
     const { module, logger } = options;
     const app = new Hono();
@@ -26,13 +26,11 @@ export function createHostApp(options) {
         }
     });
     app.use(async (c, next) => {
-        const { incoming, role } = c.env;
+        const { incoming } = c.env;
         if (headerValue(incoming, "origin") !== undefined) {
-            const route = pathnameOf(incoming).split("/").filter(Boolean);
-            // Only Tenant routes of the public listener; the Tenant then accepts only a trusted
-            // issuer's token from a browser. The operator listener never serves browsers.
-            const tenantRoute = route[0] === "v1" && route[1] !== "admin";
-            if (role === "operator" || !tenantRoute)
+            // Only Tenant routes; the Tenant then accepts only a trusted issuer's token from a
+            // browser.
+            if (pathnameOf(incoming).split("/").filter(Boolean)[0] !== "v1")
                 return rejectedResponse(403, "origin_rejected", "Browser Origin headers are not accepted");
         }
         // CORS is the operator's proxy's: an OPTIONS request gets no CORS header.
@@ -50,7 +48,7 @@ export function createHostApp(options) {
         await next();
     });
     app.all("*", async (c) => {
-        const { incoming, outgoing, role } = c.env;
+        const { incoming, outgoing } = c.env;
         const url = new URL(incoming.url ?? "/", "http://runtime.local");
         const pathname = url.pathname;
         if (pathname === "/health")
@@ -72,27 +70,19 @@ export function createHostApp(options) {
             const tenant = module.ready;
             const infra = await options.readiness?.();
             const ready = listener && tenant && !options.closing() && (infra?.ok ?? true);
+            const harness = module.harnessStatus();
             return jsonResponse(ready ? 200 : 503, {
                 status: ready ? "ready" : "not_ready",
                 service: "nylorun-runtime",
                 checks: { listener, tenant, ...infra?.checks },
+                ...(harness ? { harness: { mode: harness.mode, connected: harness.connected } } : {}),
             });
         }
-        // This API's own description: public, as the npm package that ships it.
-        if (pathname === "/openapi.json" && incoming.method === "GET")
-            return jsonResponse(200, tenantDocument(), { "cache-control": "no-cache" });
-        const segments = pathname.split("/").filter(Boolean);
-        if (segments[0] === "v1" && segments[1] === "admin") {
-            // A public listener has no admin routes: the same 404 as a wrong admin key.
-            if (role === "public")
-                return opaqueNotFoundResponse();
-            if (!protocolAccepted(headerValue(incoming, PROTOCOL_HEADER)))
-                return protocolRejectedResponse();
-            const token = readBearer(headerValue(incoming, "authorization"));
-            if (!adminKeyMatches(token, options.adminKey))
-                return opaqueNotFoundResponse();
-            return await options.admin(c.req.raw, { incoming, outgoing });
-        }
+        // The two APIs' descriptions: public, as the npm package that ships them.
+        if ((pathname === "/openapi.json" || pathname === "/openapi/runtime.json") && incoming.method === "GET")
+            return jsonResponse(200, runtimeDocument(), { "cache-control": "no-cache" });
+        if (pathname === "/openapi/management.json" && incoming.method === "GET")
+            return jsonResponse(200, managementDocument(), { "cache-control": "no-cache" });
         // Tenant routes: protocol → the Tenant → selection → the Tenant's routes.
         const tenantHeader = headerValue(incoming, TENANT_HEADER);
         const named = tenantHeader === undefined || tenantHeader.trim() === "" ? undefined : tenantHeader.trim();
@@ -159,7 +149,7 @@ function tenantRouteOf(incoming) {
             return undefined;
         }
     }
-    if (segments[0] !== "v1" || segments[1] === "admin")
+    if (segments[0] !== "v1")
         return undefined;
     return findTenantRoute(incoming.method ?? "GET", segments);
 }

package/dist/host/config-for.d.ts

@@ -1,4 +1,3 @@
-import type { HostConfigFile } from "./config.js";
 import type { Logger, TenantConfig } from "../tenant/types.js";
 /**
  * Builds the TenantConfig of the Host's Tenant for `openTenantRuntime`.
@@ -7,14 +6,11 @@ import type { Logger, TenantConfig } from "../tenant/types.js";
  */
 export declare function configForFactory(options: {
     hostRoot: string;
-    hostConfig: HostConfigFile;
     logger: Logger;
-    /** Allowlisted baseline from `baselineEnvironment` (built in `host/main.ts`). */
-    baseline: Readonly<Record<string, string>>;
     mode?: TenantConfig["mode"];
     /** Override model; default vault. Fixture/scripted require ephemeral/test mode. */
     model?: TenantConfig["model"];
-    /** How Tenants may call Action endpoints (`StackConfig.delivery`). */
+    /** How Tenants may call MCP servers and HTTP tools (`StackConfig.delivery`). */
     delivery?: TenantConfig["delivery"];
     /** The trusted issuers of the identity file (`NYLORUN_IDENTITY_FILE`). */
     issuers?: TenantConfig["issuers"];