@nylorun/runtime 0.20.0-beta → 0.21.1-beta

package/dist/store/types.d.ts

@@ -25,16 +25,18 @@
  *    generation, `streams/basin.ts`), and the cursor is
  *    `base64url("<sessionId>:<seq>")` (see `record/cursor.ts`).
  * 4. **No external I/O inside `fn`.** No model, tool, MCP, sandbox, Restate or
- *    S2 call, and no `fetch`, runs inside a transaction. Wakes go
- *    through `afterCommit`, and events are delivered to commit listeners after
- *    commit (seam rule 1 and 2).
+ *    S2 call, and no `fetch`, runs inside a transaction. A wake is written in the
+ *    transaction (`Tx.wake`, the wake outbox) and delivered after commit, and events
+ *    are delivered to commit listeners after commit (seam rule 1 and 2).
  * 5. **No nested transactions.** Calling `store.tx` from inside `fn` rejects.
  *    A `Tx` must not be used after its `tx` call settles.
  * 6. **Post-commit order.** After a commit, the store first calls every commit
  *    listener once with the transaction's events (in allocation order), then runs the `afterCommit` callbacks in registration
  *    order and awaits them. Listener and callback failures are reported to the
  *    store's error hook; they never reject `tx`, because the commit stands.
- *    Recovery from a lost post-commit step is the Tenant sweep's job.
+ *    Recovery from a lost post-commit step is the Tenant sweep's job: a wake's
+ *    delivery is a callback too, and its outbox row is what the sweep delivers
+ *    again (`Tx.wake`).
  * 7. **Documents are values.** `get` and queries return fresh copies; mutating
  *    them changes nothing until `put`.
  * 8. **Ownership columns are store-managed.** `owner`, `epoch` and
@@ -56,10 +58,11 @@
  */
 import type { KeyRole } from "@nylorun/core/compatibility";
 import type { RecordReader } from "../streams/relay/types.js";
+import type { Wake } from "../execution/types.js";
 import type { EventPayload, EventType, LiveEvent, SandboxEvent, SandboxEventPayload, SandboxEventType, SandboxKind, SandboxPodDesired, SandboxPodObserved, SessionEventOf } from "@nylorun/core/contracts";
 import type { SandboxManifest } from "@nylorun/core/define";
 import type { HostEffect } from "@nylorun/harness/run";
-import type { ArtifactRow, ArtifactVersionRow, DefinitionFileRow, ModelBudgetRow, ModelUsageRow, ModelUsageWrite, PrincipalRow, ToolCrossingRow, SigningKeyRow, VaultAuditRow, VaultCredentialRow, VaultIdempotencyRow, VaultRow, OAuthPendingRow } from "./postgres/schema.js";
+import type { ArtifactRow, ArtifactVersionRow, DefinitionFileRow, ModelBudgetRow, ModelUsageRow, ModelUsageWrite, PrincipalRow, ToolCrossingRow, SigningKeyRow, VaultAuditRow, VaultCredentialRow, VaultIdempotencyRow, VaultRow } from "./postgres/schema.js";
 /** Tables holding JSON documents keyed by `id`. */
 export type DocTable = "definitions" | "sessions" | "commands" | "effects" | "sandboxes" | "links";
 export declare const DOC_TABLES: readonly DocTable[];
@@ -195,7 +198,7 @@ export type CommitListener = (commit: Commit) => void;
  * `bytea` columns, never inside a JSON body), the vault's audit and idempotency records, the
  * Tenant's signing keys, a model call in the usage ledger and a model budget.
  */
-export type { ArtifactRow, ArtifactVersionRow, DefinitionFileRow, ModelBudgetRow, ModelUsageRow, ModelUsageWrite, ToolCrossingRow, PrincipalRow, SigningKeyRow, VaultAuditRow, VaultCredentialRow, VaultIdempotencyRow, VaultRow, OAuthPendingRow, };
+export type { ArtifactRow, ArtifactVersionRow, DefinitionFileRow, ModelBudgetRow, ModelUsageRow, ModelUsageWrite, ToolCrossingRow, PrincipalRow, SigningKeyRow, VaultAuditRow, VaultCredentialRow, VaultIdempotencyRow, VaultRow, };
 /** Which rows of the usage ledger a total covers. */
 export interface ModelUsageQuery {
     scope: "tenant" | "agent" | "turn";
@@ -271,6 +274,24 @@ export interface SessionStore {
     followSignals(onSignal: (signal: ControlSignal) => void, options?: FollowSignalsOptions): Promise<SignalFollower>;
     close(): Promise<void>;
 }
+/** A wake as the outbox delivers it: its `dedupeKey` is the request's idempotency key. */
+export type OutboxWake = Wake & {
+    dedupeKey: string;
+};
+/**
+ * Hands an outbox request to Durable Session Execution (`Tx.wake`). Resolving means the
+ * execution accepted it; `false` means it was not delivered and stays in the outbox, as a
+ * rejection does, without an error.
+ */
+export type WakeDelivery = (sessionId: string, wake: OutboxWake) => boolean | void | Promise<boolean | void>;
+/** A wake outbox request not yet delivered (`Tx.pendingWakes`). */
+export interface PendingWake {
+    id: string;
+    sessionId: string;
+    wake: OutboxWake;
+    /** ISO time it was written. */
+    createdAt: string;
+}
 /**
  * A signal on the control bus (D21, D48): one process tells the others with the Tenant open.
  * Signals are not events: they are never recorded in a session's log or streamed, and a
@@ -345,8 +366,28 @@ export interface Tx {
      * cursor is final.
      */
     event<T extends EventType>(sessionId: string, turnId: string | null, type: T, payload: EventPayload<T>): Promise<SessionEventOf<T>>;
-    /** Runs `fn` after a successful commit (never on rollback). Used for wakes. */
+    /**
+     * Runs `fn` after a successful commit (never on rollback): a sandbox signal or a host
+     * revocation. Nothing writes it down, so a crash after commit loses it. A wake goes
+     * through `wake`, which does.
+     */
     afterCommit(fn: () => void | Promise<void>): void;
+    /**
+     * Asks for an advance of `sessionId` once this transaction commits. The request is a row
+     * of the wake outbox written in this transaction, so it commits, or rolls back, with what
+     * caused it: a commit never loses its wake. After commit, in `afterCommit` order, the
+     * store calls `deliver` (`DurableExecution.wake`, through the Tenant) and deletes the row
+     * once it resolves to anything but `false`. A request `deliver` declines (`false`) or
+     * rejects, or one a crash cut off, stays in the outbox until the Tenant sweep delivers it
+     * (`pendingWakes`, `deleteWakes`). `deliver` gets the request's idempotency key as
+     * `dedupeKey`: the wake's own, or `wake:<row id>` without one, so a request delivered
+     * twice still causes one advance.
+     */
+    wake(sessionId: string, wake: Wake, deliver: WakeDelivery): Promise<void>;
+    /** Outbox requests written before `before`, oldest first. */
+    pendingWakes(before: Date, limit: number): Promise<PendingWake[]>;
+    /** Deletes delivered outbox requests. */
+    deleteWakes(ids: readonly string[]): Promise<void>;
     /**
      * Locks the session and takes ownership when it has no owner or the owner's
      * lease ended at or before `now`; then increments `epoch` and sets the lease
@@ -483,12 +524,6 @@ export interface Tx {
     getVaultIdempotency(id: string): Promise<VaultIdempotencyRow | undefined>;
     /** Rejects when the id exists. */
     insertVaultIdempotency(row: VaultIdempotencyRow): Promise<void>;
-    /** An MCP OAuth connect's start (F9 C2). Rejects on a duplicate state or an unknown vault. */
-    insertOAuthPending(row: OAuthPendingRow): Promise<void>;
-    /** Deletes and returns the pending connect of `stateHash`, expired or not: each is used once. */
-    takeOAuthPending(stateHash: string): Promise<OAuthPendingRow | undefined>;
-    /** Deletes the pending connects that expired before `now` (ISO); returns how many. */
-    deleteExpiredOAuthPending(now: string): Promise<number>;
     /**
      * Serializes signing key changes: held until the transaction ends. Take it before reading
      * the keys a change depends on, so concurrent first uses or rotations do not collide.

package/dist/tenant/advance.js

@@ -473,10 +473,7 @@ async function settle(ctx, lease, s, result, updates = [], cursor) {
             await slimModelEffects(t, id, s.activeTurnId);
             await t.put("sessions", id, current);
             const segment = finished.segment + 1;
-            t.afterCommit(() => ctx.wake(id, {
-                reason: "rollover",
-                dedupeKey: `rollover:${s.activeTurnId}:${segment}`,
-            }));
+            await t.wake(id, { reason: "rollover", dedupeKey: `rollover:${s.activeTurnId}:${segment}` }, ctx.wake);
             return siblings;
         }
         const flow = isWorkflowManifest(current.manifest);

package/dist/tenant/artifact-tool.d.ts

@@ -1,5 +1,13 @@
 import type { SandboxToolOutcome } from "@nylorun/core/contracts";
+import { type ToolResultFile } from "@nylorun/core/define";
 import type { HostEffect } from "@nylorun/harness/run";
 import { type TenantContext } from "./context.js";
-export { isSaveArtifactCall } from "../harness/calls.js";
+export { isReadArtifactCall, isSaveArtifactCall } from "../harness/calls.js";
 export declare function callSaveArtifact(ctx: TenantContext, request: HostEffect, signal: AbortSignal): Promise<SandboxToolOutcome>;
+/** What `read_artifact` returns: a page of a text artifact, or an image as a file. */
+interface ReadOutcome {
+    readonly kind: "completed";
+    readonly output: Record<string, unknown>;
+    readonly files?: readonly ToolResultFile[];
+}
+export declare function callReadArtifact(ctx: TenantContext, request: HostEffect, signal: AbortSignal): Promise<ReadOutcome | SandboxToolOutcome>;

package/dist/tenant/artifact-tool.js

@@ -1,20 +1,28 @@
 /**
- * `nylorun.save_artifact` (F8.1): our engine's built-in tool that saves a file as an artifact
- * of its session. The `nylorun.artifacts` capability comes with a session's sandbox
- * (`sandbox/session-sandbox.ts`); the Runtime runs the tool itself, like the sandbox tools:
+ * Our engine's built-in artifact tools, of the `nylorun.artifacts` capability
+ * (`sandbox/session-sandbox.ts`). The Runtime runs them itself, like the sandbox tools.
  *
+ * `save_artifact` (F8.1), which comes with a session's sandbox, saves a file as an artifact of
+ * its session:
  * - `path`: a file in the session's sandbox, read as bytes in the sandbox's queue;
  * - `content`: text the model passes.
- *
  * The version commits with `artifact.created` (or `artifact.version.created`) on the session's
- * stream, carrying the turn and the tool call. Expected problems (no such file, too large, the
- * Tenant's total reached) are failed outcomes the model sees; only infrastructure errors throw.
+ * stream, carrying the turn and the tool call.
+ *
+ * `read_artifact` (R2b C11, Q24), which an agent with a remote MCP server or an HTTP tool has,
+ * reads a text artifact of its own session in pages of at most 32 KiB, from a byte `offset`:
+ * how the model reads a tool result the Runtime stored because it was too large to show
+ * (`tool-results.ts`). An image is shown to a model that reads images, as a file of the result.
+ * It reaches only the session's own artifacts, never a Tenant-wide one or another session's.
+ *
+ * Expected problems (no such file, too large, the Tenant's total reached, not text) are failed
+ * outcomes the model sees; only infrastructure errors throw.
  */
 import { basename } from "node:path";
-import { SANDBOX_CAPABILITY_ID } from "@nylorun/core/define";
+import { READ_ARTIFACT_MAX_BYTES, SANDBOX_CAPABILITY_ID, } from "@nylorun/core/define";
 import { isArtifactId } from "@nylorun/core/compatibility";
 import { readArtifactLimits } from "../artifacts/config.js";
-import { contentTypeFor, normalizeContentType } from "../artifacts/media-types.js";
+import { MODEL_FILE_MAX_BYTES, contentTypeFor, essence, isModelImage, isText, normalizeContentType, } from "../artifacts/media-types.js";
 import { uploadArtifact } from "../artifacts/service.js";
 import { DEFAULT_CONTENT_TYPE } from "../blob/index.js";
 import { sandboxCapabilityOf } from "../sandbox/manager.js";
@@ -22,8 +30,9 @@ import { sandboxWorkspaceOf } from "../sandbox/share.js";
 import { sandboxLookup, sessionOf } from "./context.js";
 import { HttpError } from "./http.js";
 import { manifestFor } from "./session.js";
+import { jsonBytes, utf8Boundary } from "./tool-results.js";
 import { toolIds } from "./transcript.js";
-export { isSaveArtifactCall } from "../harness/calls.js";
+export { isReadArtifactCall, isSaveArtifactCall } from "../harness/calls.js";
 const failed = (code, message) => ({
     kind: "failed",
     code,
@@ -117,3 +126,98 @@ export async function callSaveArtifact(ctx, request, signal) {
         throw error;
     }
 }
+export async function callReadArtifact(ctx, request, signal) {
+    const input = (request.input ?? {});
+    const artifactId = typeof input.artifactId === "string" ? input.artifactId : "";
+    const offset = input.offset ?? 0;
+    const length = input.length ?? READ_ARTIFACT_MAX_BYTES;
+    if (artifactId === "" ||
+        typeof offset !== "number" ||
+        !Number.isSafeInteger(offset) ||
+        offset < 0 ||
+        typeof length !== "number" ||
+        !Number.isSafeInteger(length) ||
+        length < 1 ||
+        length > READ_ARTIFACT_MAX_BYTES)
+        return failed("artifact.invalid_input", `Give artifactId, an offset of 0 or more, and a length of 1 to ${READ_ARTIFACT_MAX_BYTES}.`);
+    const found = await ctx.store.tx(async (t) => {
+        const s = await sessionOf(t, request.sessionId);
+        if (!isArtifactId(artifactId))
+            return undefined;
+        // Only an artifact of this session: never a Tenant-wide one, nor another session's.
+        const artifact = await t.artifact(artifactId);
+        if (!artifact || artifact.sessionId !== s.id)
+            return undefined;
+        const version = await t.artifactVersion(artifact.id, artifact.latestVersion);
+        return version ? { artifact, version } : undefined;
+    });
+    if (!found)
+        return failed("artifact.not_found", `Artifact ${artifactId} is not an artifact of this session.`);
+    const { artifact, version } = found;
+    const about = {
+        artifactId: artifact.id,
+        version: version.version,
+        name: artifact.name,
+        contentType: version.contentType,
+        size: version.size,
+    };
+    if (artifact.kind !== "file")
+        return failed("artifact.not_text", `${artifact.name} is a folder; read_artifact reads a file.`);
+    if (isModelImage(version.contentType) && version.size <= MODEL_FILE_MAX_BYTES)
+        return {
+            kind: "completed",
+            output: about,
+            files: [
+                {
+                    mediaType: version.contentType,
+                    reference: { artifactId: artifact.id, version: version.version, name: artifact.name },
+                },
+            ],
+        };
+    if (!isText(version.contentType))
+        return failed("artifact.not_text", `${artifact.name} is ${essence(version.contentType)}, not text; read_artifact reads text and shows images.`);
+    if (offset > version.size || (offset === version.size && version.size > 0))
+        return failed("artifact.invalid_input", `Offset ${offset} is past the end of ${artifact.name}, which is ${version.size} bytes.`);
+    const end = Math.min(offset + length, version.size);
+    const bytes = end === offset ? new Uint8Array() : await readRange(ctx, version.blobKey, offset, end - 1, signal);
+    const page = textPage(bytes, end === version.size);
+    const next = offset + page.bytes;
+    return {
+        kind: "completed",
+        output: {
+            ...about,
+            offset,
+            content: page.text,
+            ...(next < version.size ? { nextOffset: next } : {}),
+        },
+    };
+}
+/** Bytes `start` to `end` (both inclusive) of a version's blob. */
+async function readRange(ctx, blobKey, start, end, signal) {
+    const got = await ctx.blobs.get(blobKey, { range: { start, end }, signal });
+    if (!got)
+        throw new Error("The artifact's bytes are missing from the Object store");
+    return new Uint8Array(await new Response(got.body).arrayBuffer());
+}
+/**
+ * The text of a page of UTF-8 `bytes` in whole characters, at most `READ_ARTIFACT_MAX_BYTES`
+ * once escaped as JSON, and how many bytes it used: the next page starts there. A page that
+ * starts inside a character skips its rest, and one that ends inside one (not `last`) stops
+ * before it.
+ */
+function textPage(bytes, last) {
+    const from = utf8Boundary(bytes, 0, "up");
+    let to = last ? bytes.byteLength : utf8Boundary(bytes, bytes.byteLength, "down");
+    // A page shorter than one character: take what there is.
+    if (to <= from)
+        to = bytes.byteLength;
+    const decode = () => Buffer.from(bytes.subarray(from, to)).toString("utf8");
+    let text = decode();
+    // Escaped (quotes, newlines, control characters), text takes more room than its bytes: each
+    // byte left out frees at least one.
+    for (let size = jsonBytes(text); to > from && size > READ_ARTIFACT_MAX_BYTES; size = jsonBytes(text)) {
+        to = utf8Boundary(bytes, Math.max(from, to - (size - READ_ARTIFACT_MAX_BYTES)), "down");
+        text = decode();
+    }
+    return { text, bytes: to };
+}

package/dist/tenant/commands.js

@@ -1,11 +1,11 @@
 /**
  * The session command service: `message`, `approve`/`respond` and `cancel`,
  * with per-session idempotency keys. A command locks its session and commits its state
- * change, events and wakes in one transaction (the store publishes the events and runs the
- * `afterCommit` wakes), then aborts a cancelled advance and cascades workflow cancels to the
- * linked agent sessions, one transaction each.
+ * change, events and wakes in one transaction (the store publishes the events and delivers the
+ * wakes from its outbox after commit, `Tx.wake`), then aborts a cancelled advance and cascades
+ * workflow cancels to the linked agent sessions, one transaction each.
  *
- * Wakes (`ctx.wake`, architecture §12.3) carry the command type as the reason and a dedupe
+ * Wakes (`t.wake`, architecture §12.3) carry the command type as the reason and a dedupe
  * key naming the cause: `<type>:<turnId>:<segment>` for `message`, `approve` and `respond`
  * (every accepted one writes a new checkpoint segment), except that a workflow's `approve` and
  * `respond` name `<type>:<turnId>:<interactionId>`: a flow resumes in the same segment.
@@ -231,7 +231,7 @@ export async function command(ctx, id, input, scope) {
                 reason: command.type,
                 dedupeKey: `${command.type}:${s.activeTurnId}:${cause}`,
             };
-            t.afterCommit(() => ctx.wake(id, commandWake));
+            await t.wake(id, commandWake, ctx.wake);
             event = await t.event(id, s.activeTurnId, `command.${command.type}`, command);
         }
         await t.put("sessions", id, s);

package/dist/tenant/context.d.ts

@@ -5,9 +5,10 @@
  *
  * Business code changes state only inside `ctx.store.tx(async (t) => …)` and follows the
  * seam rules: events through `t.event(...)` (the relay appends them to Durable Streams after
- * commit), and advances through `t.afterCommit(() => ctx.wake(id, { reason, dedupeKey }))`. It never publishes or notifies
- * itself; `runtime.ts` wires the streams with `wireStreams()`. No external I/O runs inside a
- * tx.
+ * commit), and advances through `await t.wake(id, { reason, dedupeKey }, ctx.wake)`, which
+ * writes the wake to the outbox in the transaction and delivers it after commit. It never
+ * publishes or notifies itself; `runtime.ts` wires the streams with `wireStreams()`. No
+ * external I/O runs inside a tx.
  *
  * `wake` goes to `DurableExecution.wake`, which calls the Tenant's `advance` (`advance.ts`)
  * under ownership (§10.6); `abortLocal` aborts an advance running on this process.
@@ -24,7 +25,6 @@ import type { ModelGate } from "../gates/model-gate.js";
 import type { ToolGate } from "../gates/tool-gate.js";
 import type { Keys } from "../keys/keys.js";
 import type { VaultService } from "../vault/service.js";
-import type { CredentialSources } from "../vault/sources.js";
 import type { McpPool } from "../mcp/pool.js";
 import type { McpDiagnostic, McpSnapshot } from "../mcp/snapshot.js";
 import type { HarnessApiServer } from "../harness-api/server.js";
@@ -46,6 +46,11 @@ export interface Session {
     /** Session pin — the manifest the session was created with. */
     manifest: any;
     manifestHash: string;
+    /**
+     * The hash of the definition the session was opened from; `manifestHash` differs when the
+     * Runtime pinned its own capabilities beside it (R2b C11). Absent on older sessions.
+     */
+    definitionHash?: string;
     /** Validated turn-manifest variants, keyed by hash (loops.md §4.2). */
     variants?: Record<string, AgentManifest>;
     implementationVersion: string;
@@ -139,11 +144,6 @@ export interface TenantContext {
     readonly envelope: TenantEnvelope;
     readonly store: SessionStore;
     readonly vault: VaultService;
-    /**
-     * A session's MCP credentials, for the in-process MCP pool: its attached vaults, then the
-     * operator's credential resolver (`TenantConfig.resolver`, F9 C1).
-     */
-    readonly credentials: CredentialSources;
     /**
      * The MCP pool of the Tenant's in-process harness. Absent when harnesses run elsewhere
      * (`NYLORUN_HARNESS=remote`): each keeps its own (F6.2).
@@ -212,11 +212,13 @@ export interface TenantContext {
     /** How long an advance's ownership lease lasts; the heartbeat renews it. */
     readonly ownerLeaseMs: number;
     /**
-     * Seam: request an advance of a session (`DurableExecution.wake`). Call it from
-     * `t.afterCommit`, never inside a tx. Dropped while the Tenant is closing; the sweep
-     * re-wakes anything left runnable.
+     * Seam: hand a wake to `DurableExecution.wake`, outside any tx. Business code passes it to
+     * `t.wake` (the outbox), which calls it after commit; the sweep calls it for outbox rows
+     * left undelivered and for orphaned sessions. Resolves `true` once the execution accepted
+     * the wake, `false` while the Tenant is closing: the wake is not sent, and its outbox row
+     * stays for the next sweep.
      */
-    wake(sessionId: string, wake: Wake): Promise<void>;
+    wake(sessionId: string, wake: Wake): Promise<boolean>;
     /**
      * Seam: abort the advance of a session running in this process, if any. With `turnId`, only
      * an advance of that turn (a cancel signal names the turn it cancelled).

package/dist/tenant/effects.d.ts

@@ -14,7 +14,7 @@ import type { EffectOutcome } from "@nylorun/core/contracts";
 import type { EffectResolution, HostEffect } from "@nylorun/harness/run";
 import type { Tx } from "../store/types.js";
 import type { AuthorizeResult } from "../vault/service.js";
-import type { McpCredentialRequest } from "../vault/sources.js";
+import { type McpCredentialRequest } from "../vault/sources.js";
 import { type Lease, type Session, type TenantContext } from "./context.js";
 /**
  * The outcome of a flow `agent` effect once the linked turn it started ended, or undefined
@@ -42,6 +42,6 @@ export declare function recoversModelCalls(ctx: TenantContext): boolean;
 export declare function resolveNewFlowEffect(ctx: TenantContext, request: HostEffect, signal: AbortSignal, lease: Lease): Promise<EffectResolution>;
 /**
  * The credential of an MCP server or HTTP tool request made on behalf of a session: from its
- * attached vaults, else the operator's credential resolver (`vault/sources.ts`).
+ * attached vaults (`vault/sources.ts`).
  */
 export declare function authorize(ctx: TenantContext, sessionId: string, request: McpCredentialRequest): Promise<AuthorizeResult>;

package/dist/tenant/effects.js

@@ -1,10 +1,11 @@
 import { embeddedAgent, flowDelegateManifest, hashManifest, } from "@nylorun/core/define";
 import { countActiveFlowWork, deriveAgentEffectSessionId, isFlowToolEffect, isWorkflowManifest, linkedMessageInput, linkedMessageKey, linkedTurnEnd, settleAgentEffect, } from "../core/flow-host.js";
 import { mayDispatchMore } from "../core/limits.js";
+import { sessionCredentials } from "../vault/sources.js";
 import { isRemoteMcpCall } from "../harness/calls.js";
 import { isHttpToolCall } from "../gates/http-tool.js";
 import { owningSandboxSessionId, sandboxSpecOf, sessionSandboxSpec, } from "../sandbox/share.js";
-import { withSandboxCapability } from "../sandbox/session-sandbox.js";
+import { withPlatformTools, withSandboxCapability } from "../sandbox/session-sandbox.js";
 import { loadSession, ownedSession, sandboxLookup, sessionOf, } from "./context.js";
 import { fail } from "./http.js";
 import { turnManifestOf } from "./session.js";
@@ -150,12 +151,15 @@ export async function resolveNewFlowEffect(ctx, request, signal, lease) {
             : undefined;
         // A sandbox chosen when the tree was opened reaches every agent in it, with its tools.
         const inherited = inheritedSandbox(sandboxOwnerId === undefined ? undefined : lookup(sandboxOwnerId) ?? workflow, definition);
+        // Without one, an agent with MCP or HTTP tools still reads its stored results (R2b C11).
+        const pinned = inherited?.manifest ? inherited : platformTools(definition.manifest);
         const created = {
             id: agentSessionId,
             agentId: body.agentId,
             ownerUserId: workflow.ownerUserId,
-            manifest: inherited?.manifest ?? definition.manifest,
-            manifestHash: inherited?.manifestHash ?? definition.manifestHash,
+            manifest: pinned?.manifest ?? definition.manifest,
+            manifestHash: pinned?.manifestHash ?? definition.manifestHash,
+            definitionHash: definition.manifestHash,
             implementationVersion: definition.implementationVersion,
             status: "idle",
             activeTurnId: null,
@@ -241,13 +245,24 @@ function inheritedSandbox(owner, definition) {
         throw new Error(sandboxed.message);
     return { spec, manifest: sandboxed.manifest, manifestHash: sandboxed.manifestHash };
 }
+/** A linked agent session's `read_artifact` without a sandbox (R2b C11); undefined for none. */
+function platformTools(manifest) {
+    if (isWorkflowManifest(manifest))
+        return undefined;
+    const pinned = withPlatformTools(manifest);
+    if (pinned === undefined)
+        return undefined;
+    if (!pinned.ok)
+        throw new Error(pinned.message);
+    return { manifest: pinned.manifest, manifestHash: pinned.manifestHash };
+}
 /**
  * The credential of an MCP server or HTTP tool request made on behalf of a session: from its
- * attached vaults, else the operator's credential resolver (`vault/sources.ts`).
+ * attached vaults (`vault/sources.ts`).
  */
 export async function authorize(ctx, sessionId, request) {
     const s = await loadSession(ctx, sessionId);
-    return ctx.credentials.authorize({ ...s, id: sessionId }, request);
+    return sessionCredentials(ctx.vault, { ...s, id: sessionId }, request);
 }
 /**
  * The definition a flow leaf's session runs. A flow agent embeds its leaves, so they come

package/dist/tenant/ephemeral.d.ts

@@ -2,7 +2,6 @@ import { type PostgresClient } from "../store/postgres/connect.js";
 import type { TrustedIssuerConfig } from "./identity-file.js";
 import { type TrustedIssuers } from "./issuers.js";
 import type { Logger, TenantModelConfig } from "./types.js";
-import type { ResolverConfig } from "../vault/sources.js";
 export interface StartEphemeralRuntimeOptions {
     /**
      * Absolute Host root for `host.json`, the admin key and the Tenant's files (vault key,
@@ -37,11 +36,6 @@ export interface StartEphemeralRuntimeOptions {
      * `createTrustedIssuers`. Default none.
      */
     issuers?: readonly TrustedIssuerConfig[] | TrustedIssuers;
-    /**
-     * The operator's credential resolver (F9 C1): asked for a person's MCP credential when the
-     * session's vaults hold none. Default: none (vaults only).
-     */
-    resolver?: ResolverConfig;
     logger?: Logger;
     /**
      * The Postgres database of the Tenant (one Tenant per database): a pool, which the caller

package/dist/tenant/ephemeral.js

@@ -82,7 +82,6 @@ export async function startEphemeralRuntime(options) {
             sandbox: { backend: sandboxBackend },
             model,
             ...(issuers ? { issuers } : {}),
-            ...(options.resolver ? { resolver: options.resolver } : {}),
             logger: createTenantLogger({
                 tenantId,
                 logPath: tenant.log,

package/dist/tenant/outbound.d.ts

@@ -58,9 +58,19 @@ export declare class OutboundRefused extends Error {
 /** A request `guardedFetch` sent that failed: refused connection, reset, timeout, redirect. */
 export declare class OutboundFailed extends Error {
     readonly code: string;
-    constructor(message: string, code: string);
+    /**
+     * The request was sent in full before it failed, as `post()`'s `lost` (R2b C7): the server
+     * may have acted on it. False for a failure to resolve or connect.
+     */
+    readonly sent: boolean;
+    constructor(message: string, code: string, 
+    /**
+     * The request was sent in full before it failed, as `post()`'s `lost` (R2b C7): the server
+     * may have acted on it. False for a failure to resolve or connect.
+     */
+    sent?: boolean);
 }
-/** The largest answer `guardedFetch` reads. OAuth metadata and tokens are small. */
+/** The largest answer `guardedFetch` reads. */
 export declare const MAX_FETCH_RESPONSE_BYTES: number;
 /** How long a `guardedFetch` request may take without a signal of its own. */
 export declare const FETCH_TIMEOUT_MS = 30000;
@@ -68,9 +78,8 @@ export declare const FETCH_TIMEOUT_MS = 30000;
  * A `fetch` under the Host's address policy (F9 C2): the literal-IP and DNS checks of `post`
  * on the address actually connected to, `localhost` rewritten for the local stack, no
  * redirects (`redirect: "error"`; a 3xx answer rejects), a bounded answer and a 30 s timeout
- * unless the caller passes a signal. The gateway calls OAuth discovery, registration, the code
- * exchange and refresh with it. A refused URL or address rejects with `OutboundRefused`, any
- * other failure with `OutboundFailed`.
+ * unless the caller passes a signal. A refused URL or address rejects with `OutboundRefused`,
+ * any other failure with `OutboundFailed`.
  *
  * `stream`: the Response resolves once the headers arrive and its body streams, unbounded and
  * with no timeout but the caller's signal: remote MCP servers, whose answers and event streams

package/dist/tenant/outbound.js

@@ -1,6 +1,6 @@
 /**
  * The Runtime's requests to developer URLs: HTTP tools (`gates/http-tool.ts`) and, through
- * `guardedFetch`, remote MCP servers and OAuth: one request, no redirects, a bounded answer, and
+ * `guardedFetch`, remote MCP servers: one request, no redirects, a bounded answer, and
  * the Host's address policy checked on the address actually connected to, so a DNS answer cannot
  * steer a request somewhere the Host forbids.
  *
@@ -153,13 +153,20 @@ export class OutboundRefused extends Error {
 /** A request `guardedFetch` sent that failed: refused connection, reset, timeout, redirect. */
 export class OutboundFailed extends Error {
     code;
-    constructor(message, code) {
+    sent;
+    constructor(message, code, 
+    /**
+     * The request was sent in full before it failed, as `post()`'s `lost` (R2b C7): the server
+     * may have acted on it. False for a failure to resolve or connect.
+     */
+    sent = false) {
         super(message);
         this.code = code;
+        this.sent = sent;
         this.name = "OutboundFailed";
     }
 }
-/** The largest answer `guardedFetch` reads. OAuth metadata and tokens are small. */
+/** The largest answer `guardedFetch` reads. */
 export const MAX_FETCH_RESPONSE_BYTES = 1024 * 1024;
 /** How long a `guardedFetch` request may take without a signal of its own. */
 export const FETCH_TIMEOUT_MS = 30_000;
@@ -167,9 +174,8 @@ export const FETCH_TIMEOUT_MS = 30_000;
  * A `fetch` under the Host's address policy (F9 C2): the literal-IP and DNS checks of `post`
  * on the address actually connected to, `localhost` rewritten for the local stack, no
  * redirects (`redirect: "error"`; a 3xx answer rejects), a bounded answer and a 30 s timeout
- * unless the caller passes a signal. The gateway calls OAuth discovery, registration, the code
- * exchange and refresh with it. A refused URL or address rejects with `OutboundRefused`, any
- * other failure with `OutboundFailed`.
+ * unless the caller passes a signal. A refused URL or address rejects with `OutboundRefused`,
+ * any other failure with `OutboundFailed`.
  *
  * `stream`: the Response resolves once the headers arrive and its body streams, unbounded and
  * with no timeout but the caller's signal: remote MCP servers, whose answers and event streams
@@ -217,6 +223,9 @@ export function guardedFetch(policy, options = {}) {
             outgoing["content-length"] = String(body.byteLength);
         return await new Promise((resolve, reject) => {
             let settled = false;
+            // Set when the request is fully sent, as `post()` does: a failure after it may follow
+            // the server acting on the request.
+            let delivered = false;
             const settle = (fn) => {
                 if (settled)
                     return;
@@ -225,12 +234,12 @@ export function guardedFetch(policy, options = {}) {
             };
             const failed = (error) => settle(() => reject(error instanceof RefusedAddress
                 ? new OutboundRefused(error.message)
-                : new OutboundFailed(signal?.aborted ? `The request to ${originalHost} was aborted or timed out` : error.message, signal?.aborted ? "ABORTED" : (error.code ?? error.name))));
+                : new OutboundFailed(signal?.aborted ? `The request to ${originalHost} was aborted or timed out` : error.message, signal?.aborted ? "ABORTED" : (error.code ?? error.name), delivered)));
             const sent = (url.protocol === "https:" ? httpsRequest : httpRequest)(url, { method, headers: outgoing, lookup: lookup, ...(signal ? { signal } : {}) }, (response) => {
                 const status = response.statusCode ?? 0;
                 if (status >= 300 && status < 400 && response.headers.location !== undefined) {
                     response.resume();
-                    return settle(() => reject(new OutboundFailed(`${originalHost} answered a redirect, which this Runtime does not follow`, "REDIRECT")));
+                    return settle(() => reject(new OutboundFailed(`${originalHost} answered a redirect, which this Runtime does not follow`, "REDIRECT", true)));
                 }
                 const noBody = status === 204 || status === 304 || method === "HEAD";
                 const answer = (body) => {
@@ -258,7 +267,7 @@ export function guardedFetch(policy, options = {}) {
                 response.on("data", (chunk) => {
                     size += chunk.length;
                     if (size > limit) {
-                        settle(() => reject(new OutboundFailed(`The answer from ${originalHost} is larger than ${limit} bytes`, "TOO_LARGE")));
+                        settle(() => reject(new OutboundFailed(`The answer from ${originalHost} is larger than ${limit} bytes`, "TOO_LARGE", true)));
                         response.destroy();
                         return;
                     }
@@ -268,6 +277,9 @@ export function guardedFetch(policy, options = {}) {
                 response.on("error", failed);
                 response.on("aborted", () => failed(Object.assign(new Error("The answer was cut off"), { code: "ECONNRESET" })));
             });
+            sent.on("finish", () => {
+                delivered = true;
+            });
             sent.on("error", failed);
             sent.end(body);
         });