@nylorun/runtime 0.20.0-beta → 0.21.1-beta

package/dist/gates/tenant-vaults.d.ts

@@ -9,12 +9,12 @@
 import type { Credential } from "@earendil-works/pi-ai";
 import type { ModelFailureOutcome } from "@nylorun/core/define";
 import type { PostgresClient } from "../store/postgres/connect.js";
-import { type AuthorizeResult, type HostModelSecret } from "../vault/service.js";
-import { CredentialSources, type McpCredentialRequest, type ResolverConfig } from "../vault/sources.js";
+import { VaultService, type AuthorizeResult, type HostModelSecret } from "../vault/service.js";
+import { type McpCredentialRequest } from "../vault/sources.js";
 import type { SessionStore } from "../store/types.js";
+import type { OutboundPolicy } from "../tenant/outbound.js";
 import type { Session } from "../tenant/context.js";
 import { type Keys } from "../keys/keys.js";
-import { type OutboundPolicy } from "../tenant/outbound.js";
 /** The Tenant, as a model call needs it. */
 export interface TenantVault {
     readonly tenantId: string;
@@ -29,8 +29,7 @@ export interface TenantVault {
     session(sessionId: string): Promise<Session | undefined>;
     /**
      * The authorization of one request to a session's remote MCP server or HTTP tool: its
-     * credential from the session's attached vaults, refreshed when due (F4.1), else from the
-     * operator's credential resolver (F9 C1).
+     * credential from the session's attached vaults.
      */
     authorizeMcp(sessionId: string, request: McpCredentialRequest): Promise<AuthorizeResult>;
     /** Vault writes and token signing with the Tenant's vault key (the keys service, F4.2). */
@@ -52,18 +51,13 @@ export interface TenantVaultsOptions {
     readonly sql: PostgresClient;
     /** The Host root; the gate reads `keys/vault-kek` and `tenant/home` under it. */
     readonly hostRoot: string;
-    /** The operator's credential resolver (`NYLORUN_RESOLVER_*`, F9 C1). */
-    readonly resolver?: ResolverConfig;
-    /**
-     * The Host's address policy (`NYLORUN_ENDPOINT_*`): OAuth refresh and MCP OAuth connect call
-     * authorization servers through `guardedFetch` under it (F9 C2).
-     */
+    /** How the keys service's tool preview reaches a server (`NYLORUN_ENDPOINT_*`, R2b C12). */
     readonly delivery?: OutboundPolicy;
 }
 export declare function createTenantVaults(options: TenantVaultsOptions): TenantVaults;
 /**
- * A request to a session's remote MCP server, authorized from the session's attached vaults,
- * else the operator's credential resolver: what the loop does in its own process
- * (`tenant/effects.ts` `authorize`). The owner and turn come from the session row.
+ * A request to a session's remote MCP server, authorized from the session's attached vaults:
+ * what the loop does in its own process (`tenant/effects.ts` `authorize`). The vaults come from
+ * the session row.
  */
-export declare function authorizeSessionMcp(sources: CredentialSources, session: (sessionId: string) => Promise<Session | undefined>, sessionId: string, request: McpCredentialRequest): Promise<AuthorizeResult>;
+export declare function authorizeSessionMcp(vault: Pick<VaultService, "authorize">, session: (sessionId: string) => Promise<Session | undefined>, sessionId: string, request: McpCredentialRequest): Promise<AuthorizeResult>;

package/dist/gates/tenant-vaults.js

@@ -8,10 +8,9 @@ import { tenantPaths } from "../tenant/paths.js";
 import { readVaultKek } from "../vault/kek.js";
 import { HostModelVault } from "../vault/host-model.js";
 import { VaultService } from "../vault/service.js";
-import { CredentialSources } from "../vault/sources.js";
+import { sessionCredentials } from "../vault/sources.js";
 import { inProcessKeys } from "../keys/keys.js";
 import { SigningKeys } from "../tenant/signing-keys.js";
-import { guardedFetch } from "../tenant/outbound.js";
 /** A call the gate refuses before the provider is called; it answers with `outcome`. */
 export class GateRefusal extends Error {
     outcome;
@@ -35,20 +34,13 @@ export function createTenantVaults(options) {
             return kek;
         };
         const vault = new HostModelVault({ store, kek: readKek });
-        const credentials = new VaultService({
-            store,
-            kek: readKek,
-            fetch: guardedFetch(options.delivery ?? {}),
-        });
-        const sources = new CredentialSources({
-            vault: credentials,
-            ...(options.resolver ? { resolver: options.resolver } : {}),
-        });
+        const credentials = new VaultService({ store, kek: readKek });
         const keys = inProcessKeys({
             store,
             vault: credentials,
             signingKeys: new SigningKeys({ tenantId, kek: readKek }),
             kek: readKek,
+            ...(options.delivery ? { policy: options.delivery } : {}),
         });
         const session = (sessionId) => store.tx((t) => t.get("sessions", sessionId));
         return {
@@ -58,7 +50,7 @@ export function createTenantVaults(options) {
             readHostModel: () => vault.readHostModel(),
             writeHostCredential: (credential) => vault.updateHostCredential(credential),
             session,
-            authorizeMcp: (sessionId, request) => authorizeSessionMcp(sources, session, sessionId, request),
+            authorizeMcp: (sessionId, request) => authorizeSessionMcp(credentials, session, sessionId, request),
             keys: () => keys,
         };
     }
@@ -87,13 +79,13 @@ export function createTenantVaults(options) {
     };
 }
 /**
- * A request to a session's remote MCP server, authorized from the session's attached vaults,
- * else the operator's credential resolver: what the loop does in its own process
- * (`tenant/effects.ts` `authorize`). The owner and turn come from the session row.
+ * A request to a session's remote MCP server, authorized from the session's attached vaults:
+ * what the loop does in its own process (`tenant/effects.ts` `authorize`). The vaults come from
+ * the session row.
  */
-export async function authorizeSessionMcp(sources, session, sessionId, request) {
+export async function authorizeSessionMcp(vault, session, sessionId, request) {
     const found = await session(sessionId);
     if (!found)
         throw new Error(`Session ${sessionId} not found`);
-    return sources.authorize({ ...found, id: sessionId }, request);
+    return sessionCredentials(vault, { ...found, id: sessionId }, request);
 }

package/dist/gates/tool-client.js

@@ -6,9 +6,12 @@
  * has finished.
  *
  * Failures keep the meaning they had in the loop's own process:
- * - An MCP request that fails, at the server or on the hop, throws, so the pool reports a
- *   diagnostic and `resolveEffect` marks a call `uncertain`, as before. An HTTP tool call
- *   throws only for the hop, or a call lost with the gateway: its own failures are outcomes.
+ * - An MCP request that fails throws, so the pool reports a diagnostic. A tool call's coded
+ *   failure (R2b C7) throws the `McpCallFailed` the loop's own call would have, which becomes a
+ *   failed outcome the model sees. Only the hop's failures and a call lost with the gateway leave
+ *   it `uncertain`.
+ * - An HTTP tool call throws only for the hop, or a call lost with the gateway: its own failures
+ *   are outcomes.
  *
  * Credentials (F5): a session's MCP requests and keyed cancels carry its run token, read per
  * request from the advance's grant, and leave the session out of the body: the gate takes it
@@ -19,6 +22,7 @@
 import { randomUUID } from "node:crypto";
 import { request as httpRequest } from "node:http";
 import { request as httpsRequest } from "node:https";
+import { McpCallFailed, } from "../mcp/connect.js";
 import { TENANT_HEADER } from "./contract.js";
 import { GATE_CLIENT_TIMEOUT_MS } from "./http-client.js";
 import { HTTP_CALLS_PATH, MCP_CLOSE_PATH, MCP_CONNECT_PATH, MCP_LIST_PATH, TOOL_CALLS_PATH, } from "./tool-contract.js";
@@ -106,10 +110,11 @@ export function httpToolGate(options) {
         return { body: body(unnamed), bearer: token };
     }
     /**
-     * The result of an MCP or HTTP tool request, or a throw the pool and `resolveEffect` read as
-     * before: the call's fate is unknown, and the effect becomes `uncertain`.
+     * The answer of an MCP or HTTP tool request, or a throw: a coded MCP failure (`McpCallFailed`),
+     * or one the pool and `resolveEffect` read as before, the call's fate unknown and the effect
+     * `uncertain`.
      */
-    async function answered(path, scope, request) {
+    async function answer(path, scope, request) {
         const result = await exchange(path, scope.body, {
             ...request,
             timeoutMs,
@@ -123,9 +128,12 @@ export function httpToolGate(options) {
         if (result.status !== 200 || !parsed || !("ok" in parsed))
             throw new Error(gateRefusal(result.status, parsed));
         if (parsed.ok)
-            return parsed.result;
+            return parsed;
         throw mcpError(parsed.error);
     }
+    async function answered(path, scope, request) {
+        return (await answer(path, scope, request)).result;
+    }
     async function fireAndForget(path, scope) {
         await exchange(path, scope.body, {
             timeoutMs: SHORT_TIMEOUT_MS,
@@ -136,24 +144,32 @@ export function httpToolGate(options) {
         recovers: true,
         async openMcp(server) {
             // The credential is read per request: the connection outlives the advance that opened it.
-            await answered(MCP_CONNECT_PATH, scoped(server, (named) => ({ server: named })), {});
+            // A gate answers the server's instructions (R2b C10); an older one answers null.
+            const connected = await answered(MCP_CONNECT_PATH, scoped(server, (named) => ({ server: named })), {});
+            const instructions = typeof connected?.instructions === "string" && connected.instructions.length > 0
+                ? connected.instructions
+                : undefined;
             const client = {
                 listTools: (params, request) => answered(MCP_LIST_PATH, scoped(server, (named) => ({
                     server: named,
                     ...(params?.cursor ? { cursor: params.cursor } : {}),
                 })), request?.signal ? { signal: request.signal } : {}),
-                callTool: (params, request) => answered(TOOL_CALLS_PATH, scoped(server, (named) => ({
-                    server: named,
-                    effectId: request?.key ?? randomUUID(),
-                    name: params.name,
-                    arguments: params.arguments,
-                })), {
-                    ...(request?.signal ? { signal: request.signal } : {}),
-                    ...(request?.key ? { idempotencyKey: request.key } : {}),
-                }),
+                async callTool(params, request) {
+                    const called = await answer(TOOL_CALLS_PATH, scoped(server, (named) => ({
+                        server: named,
+                        effectId: request?.key ?? randomUUID(),
+                        name: params.name,
+                        arguments: params.arguments,
+                    })), {
+                        ...(request?.signal ? { signal: request.signal } : {}),
+                        ...(request?.key ? { idempotencyKey: request.key } : {}),
+                    });
+                    return { result: called.result, ...(called.redacted ? { redacted: called.redacted } : {}) };
+                },
             };
             return {
                 client,
+                ...(instructions === undefined ? {} : { instructions }),
                 close: () => fireAndForget(MCP_CLOSE_PATH, scoped(server, (named) => ({ server: named }))),
             };
         },
@@ -174,6 +190,9 @@ export function httpToolGate(options) {
 }
 /** An MCP failure the gate reported, as the loop's own MCP code would have thrown it. */
 function mcpError(error) {
+    // Coded (R2b C7): the model sees it. A call lost with the gateway never is.
+    if (error.failure && !error.uncertain)
+        return McpCallFailed.from(error.failure);
     const thrown = new Error(error.uncertain ? `${error.message} (the call may have run; it is not sent again)` : error.message);
     if (error.code !== undefined)
         thrown.code = error.code;

package/dist/gates/tool-contract.d.ts

@@ -11,7 +11,9 @@
  * Remote MCP. The gate holds the connection and the vault credential; the loop names the
  * server, never a URL or a credential, and the gate finds it in the session's pinned manifest.
  * - `POST /nylorun/v1/mcp/connect` `{server}`: opens the server's connection (vault
- *   authorization included), or keeps the open one.
+ *   authorization included), or keeps the open one. Its result is `{instructions}` when the
+ *   server gave instructions at `initialize` (R2b C10, for the note on its deferred tools), else
+ *   `null`.
  * - `POST /nylorun/v1/mcp/list` `{server, cursor?}`: one page of `tools/list`.
  * - `POST /nylorun/v1/tool-calls` `{server, effectId, name, arguments}`: one
  *   `tools/call`. With an `Idempotency-Key` (the effect id) the call outlives its client and runs
@@ -20,8 +22,12 @@
  *   gate_forbidden` for another session's call under a run token.
  * - `POST /nylorun/v1/mcp/close` `{server}`: closes the server's connection; `204`.
  * Each answers `200 {ok: true, result}` or `200 {ok: false, error}`: an MCP failure is an
- * answer, not a gate error. A keyed call whose earlier attempt was lost with the gateway answers
- * `{ok: false, error: {uncertain: true}}` and is never run again.
+ * answer, not a gate error. A tool call's failure is coded (`error.failure`, R2b C7), and neither
+ * a result nor a failure carries a credential value the gate sent (C8). An answer past 8 MiB is
+ * `mcp.too-large` (C11), as an HTTP tool's is `http.too-large`; core shapes what fits into a
+ * result the model can take (`tenant/tool-results.ts`). A keyed call whose
+ * earlier attempt was lost with the gateway answers `{ok: false, error: {uncertain: true}}` and
+ * is never run again.
  *
  * HTTP tools (R2 M3). `POST /nylorun/v1/http-calls` `{tool, effectId, turnId, input}`: one call
  * of an HTTP tool. The loop names the tool (`{sessionId?, agentId?, capabilityId, toolName}`), or a
@@ -33,6 +39,7 @@
  * model sees), or `{ok: false, error: {uncertain: true}}` for a call lost with the gateway.
  */
 import { z } from "zod";
+import type { McpCallFailure } from "../mcp/connect.js";
 export declare const MCP_CONNECT_PATH = "/nylorun/v1/mcp/connect";
 export declare const MCP_LIST_PATH = "/nylorun/v1/mcp/list";
 export declare const MCP_CLOSE_PATH = "/nylorun/v1/mcp/close";
@@ -99,10 +106,19 @@ export interface McpGateError {
     readonly credentialIds?: readonly string[];
     /** The call may have run: its earlier attempt was lost with the gateway. Never re-run. */
     readonly uncertain?: boolean;
+    /**
+     * How the request failed, coded (R2b C1, C7): the loop's `McpCallFailed`, which a tool call
+     * turns into a failed outcome the model sees (`mcp.lost` only for a read-only or idempotent
+     * tool). `credential_rejected` for a `401`, with the server and the scope of the vault whose
+     * credential was sent. Its message has no credential value in it (C8).
+     */
+    readonly failure?: McpCallFailure;
 }
 export type McpAnswer<T> = {
     readonly ok: true;
     readonly result: T;
+    /** A `tools/call`'s: how many credential values its result echoed, replaced (R2b C8). */
+    readonly redacted?: number;
 } | {
     readonly ok: false;
     readonly error: McpGateError;

package/dist/gates/tool-contract.js

@@ -11,7 +11,9 @@
  * Remote MCP. The gate holds the connection and the vault credential; the loop names the
  * server, never a URL or a credential, and the gate finds it in the session's pinned manifest.
  * - `POST /nylorun/v1/mcp/connect` `{server}`: opens the server's connection (vault
- *   authorization included), or keeps the open one.
+ *   authorization included), or keeps the open one. Its result is `{instructions}` when the
+ *   server gave instructions at `initialize` (R2b C10, for the note on its deferred tools), else
+ *   `null`.
  * - `POST /nylorun/v1/mcp/list` `{server, cursor?}`: one page of `tools/list`.
  * - `POST /nylorun/v1/tool-calls` `{server, effectId, name, arguments}`: one
  *   `tools/call`. With an `Idempotency-Key` (the effect id) the call outlives its client and runs
@@ -20,8 +22,12 @@
  *   gate_forbidden` for another session's call under a run token.
  * - `POST /nylorun/v1/mcp/close` `{server}`: closes the server's connection; `204`.
  * Each answers `200 {ok: true, result}` or `200 {ok: false, error}`: an MCP failure is an
- * answer, not a gate error. A keyed call whose earlier attempt was lost with the gateway answers
- * `{ok: false, error: {uncertain: true}}` and is never run again.
+ * answer, not a gate error. A tool call's failure is coded (`error.failure`, R2b C7), and neither
+ * a result nor a failure carries a credential value the gate sent (C8). An answer past 8 MiB is
+ * `mcp.too-large` (C11), as an HTTP tool's is `http.too-large`; core shapes what fits into a
+ * result the model can take (`tenant/tool-results.ts`). A keyed call whose
+ * earlier attempt was lost with the gateway answers `{ok: false, error: {uncertain: true}}` and
+ * is never run again.
  *
  * HTTP tools (R2 M3). `POST /nylorun/v1/http-calls` `{tool, effectId, turnId, input}`: one call
  * of an HTTP tool. The loop names the tool (`{sessionId?, agentId?, capabilityId, toolName}`), or a

package/dist/gates/tool-gate.d.ts

@@ -1,8 +1,8 @@
 /**
  * The Tool Gate seam (blueprint §12, F4.1). Every tool call that leaves the loop crosses one
  * `ToolGate`: a remote MCP server's connection and calls, and an HTTP tool's request (R2 M3).
- * The gate owns what those need that the loop must not hold: the MCP and HTTP tool credentials
- * and their OAuth refresh, and the outbound route.
+ * The gate owns what those need that the loop must not hold: the MCP and HTTP tool credentials,
+ * and the outbound route.
  *
  * Two implementations: `inProcessToolGate` (embedding, the ephemeral Runtime, tests), which
  * opens remote servers and calls HTTP tools in this process, and the HTTP client of the gates

package/dist/harness/calls.d.ts

@@ -46,6 +46,8 @@ export declare function invokeModel(route: ModelRoute, request: HostEffect, sign
 export declare function abortOn(signal: AbortSignal, kinds: readonly AbortReason[]): AbortSignal;
 /** True when `request` calls `save_artifact` of the `nylorun.artifacts` capability `manifest` has. */
 export declare function isSaveArtifactCall(manifest: AgentManifest | undefined, request: HostEffect): boolean;
+/** True when `request` calls `read_artifact` (R2b C11) of the `nylorun.artifacts` capability. */
+export declare function isReadArtifactCall(manifest: AgentManifest | undefined, request: HostEffect): boolean;
 /** True when `request` calls a tool of a declared MCP server (every one is remote). */
 export declare function isRemoteMcpCall(routing: Pick<ToolRouting, "rootManifest" | "mcpSnapshot">, request: HostEffect): boolean;
 export declare function callMcpTool(mcp: McpPool, routing: ToolRouting, request: HostEffect, signal: AbortSignal): Promise<unknown>;

package/dist/harness/calls.js

@@ -3,7 +3,7 @@
  * Tenant's provider), the Tool Gate, the MCP pool, the SandboxManager. No store, no record: the
  * session's routing comes with the run (`TurnStart.routing`).
  */
-import { ARTIFACTS_CAPABILITY_ID, SAVE_ARTIFACT_TOOL } from "@nylorun/core/define";
+import { ARTIFACTS_CAPABILITY_ID, READ_ARTIFACT_TOOL, SAVE_ARTIFACT_TOOL, } from "@nylorun/core/define";
 import { runAbortKind } from "@nylorun/harness/api";
 import { httpToolRefOf } from "../gates/http-tool.js";
 import { classifyThrown } from "../model/classify.js";
@@ -67,10 +67,18 @@ export function abortOn(signal, kinds) {
 }
 /** True when `request` calls `save_artifact` of the `nylorun.artifacts` capability `manifest` has. */
 export function isSaveArtifactCall(manifest, request) {
+    return isArtifactsToolCall(manifest, request, SAVE_ARTIFACT_TOOL);
+}
+/** True when `request` calls `read_artifact` (R2b C11) of the `nylorun.artifacts` capability. */
+export function isReadArtifactCall(manifest, request) {
+    return isArtifactsToolCall(manifest, request, READ_ARTIFACT_TOOL);
+}
+function isArtifactsToolCall(manifest, request, toolName) {
     return (request.kind === "tool" &&
         request.capabilityId === ARTIFACTS_CAPABILITY_ID &&
-        request.toolName === SAVE_ARTIFACT_TOOL &&
-        manifest?.capabilities.some((capability) => capability.id === ARTIFACTS_CAPABILITY_ID) === true);
+        request.toolName === toolName &&
+        manifest?.capabilities.some((capability) => capability.id === ARTIFACTS_CAPABILITY_ID &&
+            capability.tools?.some((tool) => tool.name === toolName) === true) === true);
 }
 /** True when `request` calls a tool of a declared MCP server (every one is remote). */
 export function isRemoteMcpCall(routing, request) {
@@ -94,6 +102,8 @@ export async function callMcpTool(mcp, routing, request, signal) {
         args: request.input,
         manifest: routing.rootManifest,
         effectId: request.effectId,
+        // A read-only or idempotent tool's lost answer is the model's to retry (R2b C7, Q15).
+        retrySafe: tool.annotations?.readOnlyHint === true || tool.annotations?.idempotentHint === true,
         signal,
     });
 }

package/dist/harness-api/record.d.ts

@@ -1,12 +1,13 @@
 /**
  * The Record seam of the Harness API: core's journal for the effects of a run. `recordIntent`
  * journals an effect before anything runs it, and either answers it from the journal, hands it
- * to core's own executors (flow work, delegation, `save_artifact` and the skill tools), tells
- * the harness to `execute` it (model calls; MCP, HTTP and sandbox tools; a flow's HTTP stages
- * and HTTP verifiers), or fails a tool the Runtime cannot run (one that would run the
- * developer's code, R2 M6). `recordOutcome`
- * records what the harness's call returned. Both run under the advance's lease: every write is
- * epoch-checked (`ownedSession`), and a lost epoch writes nothing.
+ * to core's own executors (flow work, delegation, `save_artifact`, `read_artifact`,
+ * `tool_search` and the skill tools), tells the harness to `execute` it (model calls; MCP, HTTP
+ * and sandbox tools, a deferred MCP tool's `tool_call` among them, whose effect names the tool;
+ * a flow's HTTP stages and HTTP verifiers), or fails a tool the Runtime cannot run (one that
+ * would run the developer's code, R2 M6). `recordOutcome` records what the harness's call returned, an
+ * agent's MCP or HTTP tool result first shaped to fit (R2b C11). Both run under the advance's
+ * lease: every write is epoch-checked (`ownedSession`), and a lost epoch writes nothing.
  *
  * Rows store the request's hash (`requestHash`) and, for a model call, the request without its
  * prompt: drift is a hash compare. Rows written before carry their full request, hashed on read.

package/dist/harness-api/record.js

@@ -1,12 +1,13 @@
 /**
  * The Record seam of the Harness API: core's journal for the effects of a run. `recordIntent`
  * journals an effect before anything runs it, and either answers it from the journal, hands it
- * to core's own executors (flow work, delegation, `save_artifact` and the skill tools), tells
- * the harness to `execute` it (model calls; MCP, HTTP and sandbox tools; a flow's HTTP stages
- * and HTTP verifiers), or fails a tool the Runtime cannot run (one that would run the
- * developer's code, R2 M6). `recordOutcome`
- * records what the harness's call returned. Both run under the advance's lease: every write is
- * epoch-checked (`ownedSession`), and a lost epoch writes nothing.
+ * to core's own executors (flow work, delegation, `save_artifact`, `read_artifact`,
+ * `tool_search` and the skill tools), tells the harness to `execute` it (model calls; MCP, HTTP
+ * and sandbox tools, a deferred MCP tool's `tool_call` among them, whose effect names the tool;
+ * a flow's HTTP stages and HTTP verifiers), or fails a tool the Runtime cannot run (one that
+ * would run the developer's code, R2 M6). `recordOutcome` records what the harness's call returned, an
+ * agent's MCP or HTTP tool result first shaped to fit (R2b C11). Both run under the advance's
+ * lease: every write is epoch-checked (`ownedSession`), and a lost epoch writes nothing.
  *
  * Rows store the request's hash (`requestHash`) and, for a model call, the request without its
  * prompt: drift is a hash compare. Rows written before carry their full request, hashed on read.
@@ -14,9 +15,12 @@
 import { HarnessApiError, effectRequestHash, } from "@nylorun/core/harness-api";
 import { isFlowEffect, isFlowToolEffect, recordVerdict, settleAgentEffect, } from "../core/flow-host.js";
 import { sandboxCapabilityOf } from "../sandbox/capability.js";
-import { isSaveArtifactCall } from "../harness/calls.js";
-import { callSaveArtifact } from "../tenant/artifact-tool.js";
+import { abortOn, isReadArtifactCall, isSaveArtifactCall } from "../harness/calls.js";
+import { callReadArtifact, callSaveArtifact } from "../tenant/artifact-tool.js";
+import { mayNeedShaping, resultBytes, resultLimit, shapeToolOutcome, } from "../tenant/tool-results.js";
 import { callSkillTool, isSkillToolCall } from "../tenant/skill-tool.js";
+import { callToolSearch, isToolSearchCall } from "../tenant/tool-search.js";
+import { turnManifestOf } from "../tenant/session.js";
 import { isOwnershipLost } from "../store/ownership.js";
 import { manifestFor, mcpToolOf } from "../mcp/snapshot.js";
 import { isHttpToolCall } from "../gates/http-tool.js";
@@ -109,17 +113,24 @@ export async function recordIntent(scope, effect, requestHash) {
             throw new Error(`Agent '${request.agent?.id ?? ""}' is not used as a tool`);
         const executed = request.kind === "model" ||
             (request.kind === "tool" &&
-                (mcpToolOf(s.mcpSnapshot, request) !== undefined ||
+                // An MCP tool the turn's manifest disables is not one (R2b C9).
+                (mcpToolOf(s.mcpSnapshot, request, turnManifestOf(s)) !== undefined ||
                     // HTTP tools (R2 M3) cross the Tool Gate.
                     isHttpToolCall(s.manifest, request) ||
                     sandboxCapabilityOf(agentManifest, request.capabilityId, request.toolName) !== undefined ||
-                    // `save_artifact` (F8.1) runs beside the sandbox tools, and the skill tools (R2 M4).
+                    // `save_artifact` (F8.1) runs beside the sandbox tools, as do `read_artifact` (R2b
+                    // C11) and the skill tools (R2 M4).
                     isSaveArtifactCall(agentManifest, request) ||
-                    isSkillToolCall(agentManifest, request)));
+                    isReadArtifactCall(agentManifest, request) ||
+                    isSkillToolCall(agentManifest, request) ||
+                    // `tool_search` (R2b C10) reads the session's pinned MCP snapshot: core serves it.
+                    isToolSearchCall(agentManifest, request)));
         if (!executed) {
             // A tool that would run the developer's code: refused at save (a turn's manifest only
-            // removes tools), so this is a backstop. The model sees the failure; nothing runs.
-            const outcome = { value: unrunnableTool(request) };
+            // removes tools), so this is a backstop, as is an MCP tool the turn disabled, which the
+            // model was never offered. The model sees the failure; nothing runs.
+            const disabled = request.kind === "tool" && mcpToolOf(s.mcpSnapshot, request) !== undefined;
+            const outcome = { value: disabled ? disabledTool(request) : unrunnableTool(request) };
             await t.put("effects", request.effectId, { request, requestHash, status: "completed", outcome });
             const transcript = toolCompleted(request, outcome.value);
             if (transcript)
@@ -135,13 +146,22 @@ export async function recordIntent(scope, effect, requestHash) {
         // workspace capability, wherever the sandbox is.
         if (request.kind === "tool" && isSaveArtifactCall(agentManifest, request))
             return "save";
+        // `read_artifact` reads the session's artifacts: core serves it, with or without a sandbox.
+        if (isReadArtifactCall(agentManifest, request))
+            return "read";
         // The skill tools read the agent's definition files: core serves them.
         if (isSkillToolCall(agentManifest, request))
             return { skill: agentManifest };
+        if (isToolSearchCall(agentManifest, request))
+            return "search";
         return { status: "execute" };
     });
     if (answer === "save")
         return runInCore(scope, request, () => callSaveArtifact(scope.ctx, request, scope.signal));
+    if (answer === "read")
+        return runInCore(scope, request, () => callReadArtifact(scope.ctx, request, scope.signal));
+    if (answer === "search")
+        return runInCore(scope, request, () => callToolSearch(scope.ctx, request));
     if (typeof answer === "object" && "skill" in answer)
         return runInCore(scope, request, () => callSkillTool(scope.ctx, answer.skill, request, scope.signal));
     if (answer !== "flow")
@@ -151,9 +171,10 @@ export async function recordIntent(scope, effect, requestHash) {
     return resolveNewFlowEffect(ctx, request, signal, lease);
 }
 /**
- * Runs a tool core serves (`save_artifact`, F8.1; the skill tools, R2 M4) for the run and records
- * its outcome, as a harness would record a call it ran: the run gets the outcome as the intent's
- * answer.
+ * Runs a tool core serves (`save_artifact`, F8.1; `read_artifact`, R2b C11; `tool_search`, R2b
+ * C10; the skill tools, R2 M4) for the run and records its outcome, as a harness would record a
+ * call it ran: the run gets
+ * the outcome as the intent's answer.
  */
 async function runInCore(scope, request, call) {
     let value;
@@ -169,6 +190,14 @@ async function runInCore(scope, request, call) {
     }
     return recordOutcome(scope, request.effectId, { value });
 }
+/** The failed outcome of an MCP tool the turn's manifest disables (R2b C9). */
+function disabledTool(request) {
+    return {
+        kind: "failed",
+        code: "tool.disabled",
+        message: `Tool '${request.toolName ?? ""}' is disabled by its MCP server's tools settings.`,
+    };
+}
 /** The failed outcome of a tool the Runtime cannot run: it would run the developer's code. */
 function unrunnableTool(request) {
     return {
@@ -199,7 +228,7 @@ export async function recordOutcome(scope, effectId, result) {
         });
         return { status: "uncertain" };
     }
-    const { value } = result;
+    const value = await shaped(scope, effectId, result.value);
     return ctx.store.tx(async (t) => {
         const s = await t.assertEpoch(lease.sessionId, lease.epoch);
         const effect = await t.get("effects", effectId);
@@ -234,6 +263,59 @@ export async function recordOutcome(scope, effectId, result) {
         return { status: "completed", outcome: effect.outcome };
     });
 }
+/**
+ * The outcome of an agent's remote MCP or HTTP tool call, shaped to fit before anything records
+ * it (R2b C11, `tenant/tool-results.ts`): what does not fit becomes the session's artifacts. Any
+ * other outcome, and one a cancel will discard, as it is. Only a cancel stops the upload: after a
+ * shutdown or a deadline the outcome is still recorded, so the next advance replays it.
+ *
+ * Its cap is what its step's budget has left (`resultLimit`): a step's results are one transcript
+ * entry. Parallel results are counted under the session lock, each reserving its share on its
+ * row (`resultBytes`) before it is shaped, so two never spend the same room.
+ */
+async function shaped(scope, effectId, value) {
+    const { ctx, lease, signal } = scope;
+    if (abortKind(signal) === "cancel" || !mayNeedShaping(value))
+        return value;
+    const call = await ctx.store.tx(async (t) => {
+        const s = await t.lockSession(lease.sessionId);
+        const effect = await t.get("effects", effectId);
+        if (!s || !effect || effect.status === "completed")
+            return undefined;
+        const request = effect.request;
+        // An agent's tool; a flow's HTTP stage or verifier names no capability, and its output is data.
+        if (request.kind !== "tool" || request.capabilityId === undefined)
+            return undefined;
+        const mcp = mcpToolOf(s.mcpSnapshot, request) !== undefined;
+        if (!mcp && !isHttpToolCall(s.manifest, request))
+            return undefined;
+        const step = stepOf(request);
+        let used = 0;
+        if (step !== undefined)
+            for (const other of await t.effectsForTurn(s.id, request.turnId, [
+                "invoking",
+                "completed",
+            ])) {
+                if (other.request.effectId === effectId || stepOf(other.request) !== step)
+                    continue;
+                used +=
+                    other.resultBytes ??
+                        (other.status === "completed" ? resultBytes(other.outcome?.value) : 0);
+            }
+        const limit = resultLimit(used);
+        effect.resultBytes = Math.min(resultBytes(value), limit);
+        await t.put("effects", effectId, effect);
+        return { request, session: { id: s.id, ownerUserId: s.ownerUserId }, mcp, limit };
+    });
+    return call ? shapeToolOutcome(ctx, call, value, abortOn(signal, ["cancel"])) : value;
+}
+/** The model step a tool call answers, and whose agent: its results share one transcript entry. */
+function stepOf(request) {
+    if (request.kind !== "tool")
+        return undefined;
+    const stepId = request.context?.stepId;
+    return typeof stepId === "string" ? JSON.stringify([request.agent?.id ?? null, stepId]) : undefined;
+}
 /** What a journal row keeps of a request: a model call without its prompt. */
 function storedRequest(request) {
     if (request.kind !== "model" || request.input === undefined)