@nylorun/runtime 0.22.0-beta → 0.24.0-beta

package/dist/harness-api/ws-server.js

@@ -14,22 +14,31 @@
  * /nylorun/harness/v1/host/join` (`{ sandboxId, podUid, joinToken }`), renews it with `POST
  * .../host/renew` (`Authorization: Bearer <host token>`), and upgrades with the host token as
  * its bearer: that connection hosts its sandbox alone (`HarnessPeer.host`). Both answer
- * `{ hostToken, egressToken, sandboxId, epoch, expiresAt, caCertificate }` (the egress CA, R2c);
- * every refusal is the same 401. The harness token is never accepted as a host token, nor a host token anywhere but here.
+ * `{ hostToken, egressToken, sandboxId, epoch, expiresAt, caCertificate }` (the egress CA, R2c),
+ * and a join adds the disk's `setup` (R2d step 2). With its host token the engine also reads and
+ * reports its setup (`GET|POST .../host/setup`) and reads its input files (`GET
+ * .../host/files/{index}[/{path}]`). Every refusal is the same 401. The harness token is never
+ * accepted as a host token, nor a host token anywhere but here.
  */
 import { createHash, timingSafeEqual } from "node:crypto";
 import { createServer } from "node:http";
-import { createChannel } from "@nylorun/core/harness-api";
+import { DEFAULT_HARNESS, createChannel } from "@nylorun/core/harness-api";
 import { WebSocketServer } from "ws";
-import { HARNESS_API_HEADER, HARNESS_API_PATH, HARNESS_MAX_PAYLOAD, wsPort, } from "../harness/ws-port.js";
+import { HARNESS_API_HEADER, HARNESS_API_PATH, HARNESS_API_TRANSPORT, HARNESS_MAX_PAYLOAD, HOST_JOIN_PATH, HOST_RENEW_PATH, } from "@nylorun/core/harness-api";
+import { wsPort } from "../harness/ws-port.js";
 import { tokenType } from "../tenant/jwt.js";
 import { HOST_TOKEN_TYP } from "../tenant/host-token.js";
 import { HostAuthError } from "../sandbox/join.js";
-/** Where a pod's engine exchanges its join token, and renews its host token. */
-export const HOST_JOIN_PATH = `${HARNESS_API_PATH}/host/join`;
-export const HOST_RENEW_PATH = `${HARNESS_API_PATH}/host/renew`;
+import { parseSetupReport } from "../sandbox/setup.js";
+export { HOST_JOIN_PATH, HOST_RENEW_PATH };
+/** Where a pod's engine reads its setup and reports it (R2d step 2, `sandbox/setup.ts`). */
+export const HOST_SETUP_PATH = `${HARNESS_API_PATH}/host/setup`;
+/** Where it reads its input files: `/{index}`, and a folder's file `/{index}/{path}`. */
+export const HOST_FILES_PATH = `${HARNESS_API_PATH}/host/files`;
 /** A join's body is small. */
 const MAX_JOIN_BODY = 8 * 1024;
+/** A setup report carries the end of a command's output. */
+const MAX_REPORT_BODY = 64 * 1024;
 function refuse(socket, status, text, headers = {}) {
     const lines = [
         `HTTP/1.1 ${status} ${text}`,
@@ -76,12 +85,12 @@ export async function startHarnessListener(options) {
         });
         response.end(text);
     };
-    const readBody = (request) => new Promise((resolve, reject) => {
+    const readBody = (request, max = MAX_JOIN_BODY) => new Promise((resolve, reject) => {
         let size = 0;
         const chunks = [];
         request.on("data", (chunk) => {
             size += chunk.length;
-            if (size > MAX_JOIN_BODY) {
+            if (size > max) {
                 reject(new HostAuthError(400, "The body is too large"));
                 request.destroy();
             }
@@ -116,7 +125,61 @@ export async function startHarnessListener(options) {
             return reply(response, 503, { error: { code: "unavailable", message: "Try again" } });
         }
     };
-    // Plain requests get nothing but the pods' join and renewal: the listener speaks the Harness API.
+    /** A pod's setup and input files (R2d step 2), with its host token. */
+    const serveSetup = async (request, response, path) => {
+        if (!allowed.has(String(request.headers.host ?? "").toLowerCase()))
+            return reply(response, 421);
+        const authority = await options.hosts?.().catch(() => undefined);
+        if (!authority || closing)
+            return reply(response, 503, { error: { code: "unavailable", message: "Try again" } });
+        const token = bearerOf(request.headers.authorization) ?? "";
+        try {
+            if (path === HOST_SETUP_PATH) {
+                if (request.method === "GET")
+                    return reply(response, 200, await authority.setup(token));
+                if (request.method !== "POST")
+                    return reply(response, 405, undefined, { allow: "GET, POST" });
+                const report = parseSetupReport(JSON.parse(await readBody(request, MAX_REPORT_BODY)));
+                if (!report)
+                    throw new HostAuthError(400, "The report is malformed");
+                await authority.reportSetup(token, report);
+                return reply(response, 200, {});
+            }
+            if (request.method !== "GET")
+                return reply(response, 405, undefined, { allow: "GET" });
+            const [index, ...rest] = path.slice(HOST_FILES_PATH.length + 1).split("/");
+            if (!/^\d{1,2}$/.test(index ?? ""))
+                return reply(response, 404);
+            const file = await authority.setupFile(token, Number(index), rest.length === 0 ? undefined : rest.map((part) => decodeURIComponent(part)).join("/"));
+            if (!file)
+                return reply(response, 404);
+            if (file.kind === "folder")
+                return reply(response, 200, { entries: file.entries }, { "x-nylorun-artifact-kind": "folder" });
+            response.writeHead(200, {
+                connection: "close",
+                "cache-control": "no-store",
+                "content-type": file.contentType,
+                "x-nylorun-artifact-kind": "file",
+            });
+            for await (const chunk of file.body)
+                response.write(chunk);
+            response.end();
+        }
+        catch (error) {
+            if (error instanceof HostAuthError) {
+                if (error.reason)
+                    logger.warn("sandbox_host_refused", { path, reason: error.reason });
+                return reply(response, error.status, { error: { code: error.status === 401 ? "unauthorized" : "invalid", message: error.message } }, error.status === 401 ? { "www-authenticate": "Bearer" } : {});
+            }
+            if (error instanceof SyntaxError)
+                return reply(response, 400, { error: { code: "invalid", message: "Not JSON" } });
+            logger.warn("sandbox_host_failed", { path, message: error instanceof Error ? error.message : String(error) });
+            if (response.headersSent)
+                return void response.destroy();
+            return reply(response, 503, { error: { code: "unavailable", message: "Try again" } });
+        }
+    };
+    // Plain requests get nothing but the pods' join, renewal and setup: the listener speaks the Harness API.
     const server = createServer((request, response) => {
         const path = new URL(request.url ?? "/", "http://harness.local").pathname;
         if (closing)
@@ -125,6 +188,10 @@ export async function startHarnessListener(options) {
             void serveHost(request, response, path);
             return;
         }
+        if ((path === HOST_SETUP_PATH || path.startsWith(`${HOST_FILES_PATH}/`)) && options.hosts) {
+            void serveSetup(request, response, path);
+            return;
+        }
         response.writeHead(426, { connection: "close", upgrade: "websocket" });
         response.end();
     });
@@ -140,10 +207,12 @@ export async function startHarnessListener(options) {
         const bearer = bearerOf(request.headers.authorization);
         // A pod's host token (F7.2): checked against its sandbox before the upgrade.
         const hostToken = bearer !== undefined && options.hosts && tokenType(bearer) === HOST_TOKEN_TYP;
-        if (!hostToken && !bearerMatches(request.headers.authorization, options.token))
+        // The harness token is our harness's; any other is a custom harness's own, or refused (R4.1).
+        const ours = !hostToken && bearerMatches(request.headers.authorization, options.token);
+        if (!hostToken && !ours && (bearer === undefined || !options.harnessOfToken))
             return refuse(socket, 401, "Unauthorized", { "WWW-Authenticate": "Bearer" });
-        if (request.headers[HARNESS_API_HEADER] !== "1")
-            return refuse(socket, 426, "Upgrade Required", { [HARNESS_API_HEADER]: "1" });
+        if (request.headers[HARNESS_API_HEADER] !== HARNESS_API_TRANSPORT)
+            return refuse(socket, 426, "Upgrade Required", { [HARNESS_API_HEADER]: HARNESS_API_TRANSPORT });
         const host = hostToken
             ? options.hosts().then(async (authority) => {
                 if (!authority)
@@ -152,15 +221,25 @@ export async function startHarnessListener(options) {
                 return { sandboxId: claims.sandboxId, epoch: claims.epoch };
             })
             : Promise.resolve(undefined);
-        void Promise.all([options.attach(), host]).then(([attach, hosted]) => {
+        const harness = hostToken
+            ? Promise.resolve(undefined)
+            : ours
+                ? Promise.resolve(DEFAULT_HARNESS)
+                : options.harnessOfToken(bearer).then((id) => {
+                    if (id === undefined)
+                        throw new HostAuthError(401, "Unauthorized");
+                    return id;
+                });
+        void Promise.all([options.attach(), host, harness]).then(([attach, hosted, harnessId]) => {
             if (!attach || closing || (hostToken && !hosted))
                 return refuse(socket, 503, "Service Unavailable");
             wss.handleUpgrade(request, socket, head, (ws) => {
                 const peer = {
                     name: hosted
                         ? `sandbox ${hosted.sandboxId}@${request.socket.remoteAddress ?? "unknown"}`
-                        : `harness@${request.socket.remoteAddress ?? "unknown"}`,
+                        : `harness ${harnessId}@${request.socket.remoteAddress ?? "unknown"}`,
                     ...(hosted ? { host: hosted } : {}),
+                    ...(harnessId === undefined ? {} : { harness: harnessId }),
                 };
                 const channel = createChannel(wsPort(ws, { ...options.liveness, ping: true }), { validate: true });
                 const detach = attach(channel, peer);

package/dist/host/execution.d.ts

@@ -19,12 +19,14 @@
  * services, so the open would fail. A core-only process relies on a Worker having registered
  * them first.
  *
- * **One Worker URL.** `start` registers the Worker endpoint (`NYLORUN_WORKER_URL`) with
- * Restate once. Restate sends new invocations to the latest registered deployment, so
- * several Workers that each register their own URL do not share load: the last one to start
- * takes every new invocation. The local stack runs a single `runtime` container with
- * `--service core,loop`. A deployment with several Worker processes (Helm, Cloud) must advertise one
- * load-balanced `NYLORUN_WORKER_URL` shared by all of them.
+ * **One Worker URL per version.** `start` registers the Worker endpoint with Restate once, as
+ * `<NYLORUN_WORKER_URL>/nylorun/<version>` (`workerDeployment` in `infra/execution.ts`).
+ * Restate sends new invocations to the latest registered deployment, so several Workers that
+ * each register their own URL do not share load: the last one to start takes every new
+ * invocation. The local stack runs a single `runtime` container with `--service core,loop`. A
+ * deployment with several Worker processes (Helm, Cloud) must advertise one load-balanced
+ * `NYLORUN_WORKER_URL` shared by all of them; a rolling upgrade registers the new version's
+ * path next to the old one, which keeps the invocations it started.
  */
 import type { DurableExecution } from "../execution/types.js";
 import type { Logger } from "../tenant/types.js";

package/dist/host/gates.d.ts

@@ -81,6 +81,7 @@ export interface StartEgressOptions {
 }
 /**
  * egress-gate (`--service egress`, F7.2): pods' CONNECT proxy, verifying egress tokens against the
- * Tenant's public keys and reading its sandboxes from the same database as the gates.
+ * Tenant's public keys and reading its sandboxes from the same database as the gates, where it
+ * also records each connection (R7.3).
  */
 export declare function startEgress(options: StartEgressOptions): Promise<EgressGate>;

package/dist/host/gates.js

@@ -23,9 +23,10 @@ import { tenantPaths } from "../tenant/paths.js";
 import { staleRun, verifyRunToken } from "../tenant/run-token.js";
 import { createFsBlobStore } from "../blob/index.js";
 import { createTenantVaults } from "../gates/tenant-vaults.js";
+import { journalCheck } from "../gates/journal.js";
 import { probeDatabase } from "../infra/database.js";
 import { bindListener, headerValue, isAllowedRequestHost, sendRejected } from "./http.js";
-import { startEgressGate, storeEgressSandboxes } from "../gates/egress.js";
+import { startEgressGate, storeEgressRecord, storeEgressSandboxes, } from "../gates/egress.js";
 import { verifyEgressToken } from "../sandbox/egress-token.js";
 import { leafKeyPair } from "../keys/x509.js";
 /** Above the gate's 600 s provider request timeout and the loop's 630 s client timeout. */
@@ -101,6 +102,7 @@ export async function startGates(options) {
         mcp,
         http: gateHttpTools(vaults, options.delivery ?? {}, logger),
         toolCalls,
+        journal: journalCheck(vaults),
         logger,
         ...(options.keys ? { keys: async () => (await vaults.open()).keys() } : {}),
     });
@@ -153,7 +155,8 @@ export async function startGates(options) {
 }
 /**
  * egress-gate (`--service egress`, F7.2): pods' CONNECT proxy, verifying egress tokens against the
- * Tenant's public keys and reading its sandboxes from the same database as the gates.
+ * Tenant's public keys and reading its sandboxes from the same database as the gates, where it
+ * also records each connection (R7.3).
  */
 export async function startEgress(options) {
     const { database } = options;
@@ -173,6 +176,11 @@ export async function startEgress(options) {
             return verifyEgressToken(vault.store, vault.tenantId, raw, publicKeys);
         },
         sandboxes: { live: async (sandboxId) => storeEgressSandboxes((await tenant.open()).store).live(sandboxId) },
+        // Each connection on the Tenant's record (R7.3): the gates' one write into it.
+        record: {
+            holder: async (environmentId) => storeEgressRecord((await tenant.open()).store).holder(environmentId),
+            write: async (holder, connection) => storeEgressRecord((await tenant.open()).store).write(holder, connection),
+        },
         credentials: {
             bound: async (sandboxId, host) => (await tenant.open()).environmentSecretBound(sandboxId, host),
             release: async (sandboxId, host) => (await tenant.open()).releaseEnvironmentSecret(sandboxId, host),

package/dist/host/main.js

@@ -12,7 +12,9 @@
  * first start (`NYLORUN_TENANT_ID`, `NYLORUN_TENANT_NAME`; tenancy.md §4), trusting the issuers of the identity file
  * `NYLORUN_IDENTITY_FILE` names (Host feature `trusted-issuers`); with S2, a process running core
  * runs the stream relay, which feeds the Tenant's streams from the record over
- * logical replication (one process at a time holds the slot); `/ready` reports
+ * logical replication (one process at a time holds the slot); with `OTEL_EXPORTER_OTLP_ENDPOINT`
+ * it also runs the trace projector, which posts the record's spans over OTLP from a slot of its
+ * own (R7.2); `/ready` reports
  * the Tenant and the infrastructure checks. With an Object store
  * (`NYLORUN_OBJECT_STORE_*`) the Tenant's blobs go to it through the `s3` BlobStore, and a
  * process running core creates its bucket; without one they stay on disk (`fs`). A process
@@ -36,8 +38,12 @@ import { createPostgresTenantOpener } from "../tenant/store-pg.js";
 import { openTenantRuntime } from "../tenant/runtime.js";
 import { createPgoutputSource } from "../adapters/replication/pgoutput.js";
 import { assertLogicalReplication } from "../store/postgres/connect.js";
-import { createPostgresRecordReader } from "../store/postgres/record.js";
 import { createStreamRelay } from "../streams/relay/core.js";
+import { createPostgresRecordReader, createPostgresTurnMessages } from "../store/postgres/record.js";
+import { createPostgresSessionStore } from "../store/postgres/store.js";
+import { createTraceProjector, TRACE_SLOT } from "../traces/projector.js";
+import { createOtlpPoster } from "../traces/otlp.js";
+import { traceKey } from "../traces/key.js";
 import { configForFactory } from "./config-for.js";
 import { createHost } from "./create-host.js";
 import { createHostExecution } from "./execution.js";
@@ -56,6 +62,7 @@ import { createRunGrants } from "../tenant/run-grants.js";
 import { runHarness } from "../harness/main.js";
 import { startHarnessListener } from "../harness-api/ws-server.js";
 import { httpSandboxesClient } from "../sandbox/pods/client.js";
+import { retry } from "../retry.js";
 const nodeRequire = createRequire(import.meta.url);
 function coreVersion() {
     try {
@@ -121,22 +128,15 @@ function objectStore(config) {
  * uploads and downloads fail meanwhile) and does not hold up the Host.
  */
 async function ensureBucket(store, bucket, logger) {
-    for (let attempt = 1;; attempt += 1) {
-        try {
-            await store.ensureBucket();
-            logger.info("object_store_ready", { bucket });
-            return;
-        }
-        catch (error) {
-            if (attempt >= 10) {
-                logger.error("object_store_unavailable", {
-                    bucket,
-                    message: error instanceof Error ? error.message : String(error),
-                });
-                return;
-            }
-            await new Promise((resolve) => setTimeout(resolve, Math.min(1000 * attempt, 5000)));
-        }
+    try {
+        await retry(() => store.ensureBucket(), { minMs: 1000, maxMs: 5000, attempts: 10 });
+        logger.info("object_store_ready", { bucket });
+    }
+    catch (error) {
+        logger.error("object_store_unavailable", {
+            bucket,
+            message: error instanceof Error ? error.message : String(error),
+        });
     }
 }
 /**
@@ -147,7 +147,7 @@ function warnRemovedSettings(stack, logger) {
     if (stack.removedResolverVariables)
         logger.warn("resolver_removed", {
             variables: stack.removedResolverVariables,
-            message: "The credential resolver is gone (protocol 10) and these variables are ignored: keep a person's keys in their user vault, or reach their accounts through a gateway",
+            message: "The credential resolver is gone (protocol 10) and these variables are ignored: keep a person's keys in their Environment's vault, or reach their accounts through a gateway",
         });
 }
 /**
@@ -260,6 +260,7 @@ export async function main() {
         mode: stack.listen ? "container" : "local",
         endpoints: describeEndpoints(stack.endpoints),
         objectStore: stack.objectStore ? "s3" : "fs",
+        traces: stack.traces?.export ? "otlp" : "off",
     });
     const infra = createInfra(stack, { logger });
     const database = infra.database;
@@ -289,7 +290,11 @@ export async function main() {
     // running core runs one, once the Tenant is open (the relay reads its id); the replication
     // slot lets exactly one be active. Without S2, the Tenant relays its own commits.
     let relay;
-    if (streams && stack.services.has("core"))
+    // With an OTLP endpoint (R7.2, Q5), the trace projector reads the record on its own slot: one
+    // process running core at a time, as for the relay. Without one there is no slot.
+    const traceExport = stack.services.has("core") ? stack.traces?.export : undefined;
+    let projector;
+    if ((streams || traceExport) && stack.services.has("core"))
         await assertLogicalReplication(database);
     const startRelay = (tenantId) => {
         if (!streams || !stack.services.has("core") || relay)
@@ -307,6 +312,32 @@ export async function main() {
         });
         relay.start();
     };
+    const startProjector = (tenantId) => {
+        if (!traceExport || projector)
+            return;
+        const store = createPostgresSessionStore({ sql: database, tenantId });
+        const log = (message, fields) => logger.info(message, fields);
+        projector = createTraceProjector({
+            source: createPgoutputSource({
+                connectionString: stack.endpoints.databaseUrl,
+                tenantId,
+                slot: TRACE_SLOT,
+                applicationName: "nylorun-trace-export",
+                log,
+            }),
+            post: createOtlpPoster({
+                url: traceExport.url,
+                headers: traceExport.headers,
+                resource: stack.traces.resource,
+                log: (message, fields) => logger.warn(message, fields),
+            }),
+            key: () => traceKey(store),
+            turnMessage: createPostgresTurnMessages(database),
+            content: new Set(stack.traces.content),
+            log,
+        });
+        projector.start();
+    };
     // With the gates service the Tenant's vault-backed model calls, remote MCP calls and HTTP
     // tool calls cross it, and this process never reads a model or MCP credential.
     // Their credentials (F5): each advance's run token for its session's model and tool calls,
@@ -361,11 +392,17 @@ export async function main() {
                 ...(blobs ? { blobs } : {}),
                 ...(stack.harnessMode === "remote" ? { harness: "remote" } : {}),
                 ...(pods ? { pods } : {}),
+                ...(stack.traces
+                    ? { traces: { resource: stack.traces.resource, content: new Set(stack.traces.content) } }
+                    : {}),
                 ...opened,
             }),
         }),
         logger,
-        onOpen: (handle) => startRelay(handle.envelope.id),
+        onOpen: (handle) => {
+            startRelay(handle.envelope.id);
+            startProjector(handle.envelope.id);
+        },
     });
     const options = {
         hostRoot,
@@ -384,6 +421,7 @@ export async function main() {
             beforeTenants: async () => {
                 await hostExecution.stop();
                 await relay?.stop();
+                await projector?.stop();
                 // The harnesses' runs stop with the Tenant's advances; their connections close after.
             },
             afterTenants: async () => {
@@ -427,6 +465,11 @@ export async function main() {
                     const handle = resolved.kind === "open" ? resolved.handle : undefined;
                     return handle?.attachHarness ? (channel, peer) => handle.attachHarness(channel, peer) : undefined;
                 },
+                // Custom harnesses connect with their own tokens (R4.1).
+                harnessOfToken: async (token) => {
+                    const resolved = await module.resolve();
+                    return resolved.kind === "open" ? resolved.handle.harnessOfToken?.(token) : undefined;
+                },
                 logger,
             });
         await host.listen();

package/dist/host/operate.js

@@ -9,12 +9,16 @@
  *   nylorun-operate keys list [--json]
  *   nylorun-operate keys put <id> [--role application|management] [--json]
  *   nylorun-operate keys rm <id> [--json]
+ *   nylorun-operate harness token put <id> [--json]
+ *   nylorun-operate harness token list [--json]
+ *   nylorun-operate harness token rm <id> [--json]
  *
  * `status` says whether the Tenant is open and, when it is not, why: from the database (no
  * Tenant yet, an old layout, a schema newer or older than this Runtime) and from the running
  * Host's `/ready` on this container's listen port. It needs no key, so it works when the Tenant
  * cannot open. `keys put` prints the new key once on stdout (with `--json`, the whole
- * response). Exit codes: 0 done (`status`: the Tenant is open), 1 refused (an id, a role),
+ * response). `harness token put` makes a custom harness's own token (R4.1), bound to its harness
+ * id, and prints it once; putting it again rotates it. Exit codes: 0 done (`status`: the Tenant is open), 1 refused (an id, a role),
  * 2 the Tenant cannot be opened (`status` still prints it), 64 usage.
  */
 import { pathToFileURL } from "node:url";
@@ -26,6 +30,7 @@ import { createPostgresSessionStore } from "../store/postgres/store.js";
 import { readTenantEnvelope } from "../store/postgres/tenant.js";
 import { openError, TenantOpenError } from "../tenant/cause.js";
 import { operatorKeys } from "../tenant/operator-keys.js";
+import { deleteHarnessToken, listHarnessTokens, putHarnessToken } from "../tenant/harness-tokens.js";
 import { RUNTIME_VERSION } from "../version.js";
 import { DEFAULT_CONTAINER_LISTEN_PORT } from "./stack-config.js";
 export const EXIT_REFUSED = 1;
@@ -35,7 +40,10 @@ const USAGE = `Usage:
   nylorun-operate status [--json]
   nylorun-operate keys list [--json]
   nylorun-operate keys put <id> [--role application|management] [--json]
-  nylorun-operate keys rm <id> [--json]`;
+  nylorun-operate keys rm <id> [--json]
+  nylorun-operate harness token put <id> [--json]
+  nylorun-operate harness token list [--json]
+  nylorun-operate harness token rm <id> [--json]`;
 class Exit extends Error {
     code;
     constructor(code, message) {
@@ -52,14 +60,14 @@ export async function runOperate(argv, io) {
                 throw new Exit(EXIT_USAGE, USAGE);
             return await status(io, json);
         }
-        const command = parse(argv);
+        const command = argv[0] === "harness" ? harnessCommand(argv) : parse(argv);
         const url = io.env.NYLORUN_DATABASE_URL;
         if (!url)
             throw new Exit(EXIT_TENANT, "NYLORUN_DATABASE_URL is not set: run this inside the runtime container");
         const sql = createPostgresClient(url, { max: 1 });
         try {
-            const keys = operatorKeys(await openStore(sql));
-            return await command(keys, io);
+            const store = await openStore(sql);
+            return await command(operatorKeys(store), io, store);
         }
         finally {
             await sql.end({ timeout: 5 });
@@ -74,6 +82,60 @@ export async function runOperate(argv, io) {
         return EXIT_TENANT;
     }
 }
+/** `harness token put|list|rm` (R4.1). */
+function harnessCommand(argv) {
+    const [, noun, verb, ...rest] = argv;
+    const json = rest.includes("--json");
+    const args = rest.filter((arg) => arg !== "--json");
+    if (noun !== "token")
+        throw new Exit(EXIT_USAGE, USAGE);
+    switch (verb) {
+        case "list":
+            if (args.length > 0)
+                throw new Exit(EXIT_USAGE, USAGE);
+            return async (_keys, io, store) => {
+                const tokens = await listHarnessTokens(store);
+                if (json)
+                    io.out(JSON.stringify({ tokens }));
+                else
+                    for (const token of tokens)
+                        io.out(`${token.id}\t${token.createdAt}`);
+                return 0;
+            };
+        case "put": {
+            const [id] = args;
+            if (!id || args.length !== 1)
+                throw new Exit(EXIT_USAGE, USAGE);
+            return async (_keys, io, store) => {
+                const put = await putHarnessToken(store, id);
+                if ("reason" in put)
+                    throw new Exit(EXIT_REFUSED, put.message);
+                if (json)
+                    io.out(JSON.stringify(put));
+                else {
+                    io.out(put.token);
+                    io.err(`${put.rotated ? "Rotated" : "Created"} the token of harness ${put.id}. It is shown this once: the harness connects with it as NYLORUN_HARNESS_TOKEN and must say ${put.id} in hello.`);
+                }
+                return 0;
+            };
+        }
+        case "rm": {
+            const [id] = args;
+            if (!id || args.length !== 1)
+                throw new Exit(EXIT_USAGE, USAGE);
+            return async (_keys, io, store) => {
+                const deleted = await deleteHarnessToken(store, id);
+                if (json)
+                    io.out(JSON.stringify({ id, deleted }));
+                else
+                    io.err(deleted ? `Deleted the token of harness ${id}.` : `Harness ${id} has no token.`);
+                return 0;
+            };
+        }
+        default:
+            throw new Exit(EXIT_USAGE, USAGE);
+    }
+}
 function parse(argv) {
     const [group, verb, ...rest] = argv;
     if (group !== "keys")

package/dist/host/stack-config.d.ts

@@ -1,3 +1,49 @@
+/**
+ * Stack configuration for the Runtime process, parsed from an environment
+ * snapshot and argv. Pure: `host/main.ts` passes the process environment and
+ * arguments; nothing here reads ambient state.
+ *
+ * `--service core,loop` names the Runtime services the process runs (blueprint
+ * §19, D12): one image runs every service, and a container may pack several.
+ * Without the flag a process runs core and loop. `--role api|worker|all` is
+ * the deprecated name of the same choice (core, loop, or both). `gates` (the
+ * Model Gate) never shares a process with core or loop: it holds the
+ * credentials they must not. Only a process that runs core or loop parses the
+ * API listener (`NYLORUN_LISTEN_*`); only one that runs gates parses its
+ * listener (`NYLORUN_GATES_LISTEN_*`), and only one that runs loop parses
+ * where to reach the gate (`NYLORUN_GATES_URL`). Both read
+ * `NYLORUN_GATES_TOKEN`. In a container, loop requires the gate: the loop
+ * process must never hold a model credential. `egress` (egress-gate, F7.2) joins gates and keys
+ * in the gateway and parses its listener (`NYLORUN_EGRESS_LISTEN_*`, default `0.0.0.0:4200`).
+ * The credential resolver is gone (protocol 10): its `NYLORUN_RESOLVER_*` variables are ignored,
+ * and the Host logs `resolver_removed` when one is set.
+ *
+ * `harness` (F6.2) runs alone: it holds the harness credential and nothing else. It connects to
+ * core's Harness API listener (`NYLORUN_HARNESS_URL`, `NYLORUN_HARNESS_TOKEN`), calls models and
+ * remote MCP servers through the gates service (`NYLORUN_GATES_URL`, with run tokens only), and
+ * keeps its workspaces under `NYLORUN_HARNESS_ROOT`. It refuses to start with a database, the
+ * gates' or keys' credential, or Restate settings. A process running core starts the Harness API
+ * listener when `NYLORUN_HARNESS=remote` (`NYLORUN_HARNESS_LISTEN_*`, `NYLORUN_HARNESS_TOKEN`).
+ *
+ * Two listen modes:
+ * - **local** (no `NYLORUN_LISTEN_*` / `NYLORUN_ALLOWED_HOSTS`): the Host binds
+ *   what `host.json` names, loopback only unless `allowNonLoopback`.
+ * - **container**: the Host binds `NYLORUN_LISTEN_HOST:NYLORUN_LISTEN_PORT`
+ *   (default `0.0.0.0:4000`) and accepts only the `Host` headers in
+ *   `NYLORUN_ALLOWED_HOSTS`, plus the loopback forms of the listen port for
+ *   probes from inside the container.
+ *
+ * The Postgres, Restate and S2 endpoints are parsed and validated here;
+ * `infra/*` builds the clients from them. So is the Object store (`NYLORUN_OBJECT_STORE_*`),
+ * which every service may read; `host/main.ts` builds the `BlobStore` from it. So is who the Host's Tenant is when its database
+ * holds none yet (`NYLORUN_TENANT_ID`, `NYLORUN_TENANT_NAME`). So are traces (R7.2), for a
+ * process running core: where they go (`OTEL_EXPORTER_OTLP_ENDPOINT`, or
+ * `OTEL_EXPORTER_OTLP_TRACES_ENDPOINT`, with `OTEL_EXPORTER_OTLP_HEADERS`), what they say of
+ * their source (`OTEL_SERVICE_NAME`, `OTEL_RESOURCE_ATTRIBUTES`) and which content they carry
+ * (`NYLORUN_TRACE_CONTENT`, or all of it with `OTEL_INSTRUMENTATION_GENAI_CAPTURE_MESSAGE_CONTENT=true`).
+ */
+import { type TraceResource } from "../traces/otlp.js";
+import { type TraceContentKind } from "../traces/map.js";
 import { type BlockedAddress } from "../sandbox/pods/network-gate.js";
 /** A Runtime service this release has. */
 export type RuntimeService = "core" | "loop" | "gates" | "keys" | "egress" | "harness";
@@ -39,6 +85,12 @@ export interface StackEndpoints {
     restateIngressUrl?: string;
     restateAdminUrl?: string;
     workerUrl?: string;
+    /**
+     * The Worker deployment's version, from `NYLORUN_WORKER_VERSION` (default: the Runtime's
+     * version): the Worker registers `<NYLORUN_WORKER_URL>/nylorun/<version>` with Restate
+     * (`infra/execution.ts`, `workerDeployment`).
+     */
+    workerVersion?: string;
     s2Endpoint?: string;
     s2Token?: string;
     workspaceStoreUrl?: string;
@@ -191,6 +243,24 @@ export interface StackConfig {
      * (the `fs` adapter, `TenantPaths.blobs`).
      */
     objectStore?: ObjectStoreConfig;
+    /**
+     * Present when the process runs core and an `OTEL_*` or `NYLORUN_TRACE_CONTENT` variable is set:
+     * how spans are made, for the trace projector and the trace route (R7.2, R7.5). `export` is
+     * present only with an endpoint (Q5): without one there is no replication slot and no cost.
+     */
+    traces?: TraceConfig;
+}
+/** Traces (R7.2), from the standard `OTEL_*` variables and `NYLORUN_TRACE_CONTENT`. */
+export interface TraceConfig {
+    /** `OTEL_SERVICE_NAME` (default `nylorun`) and `OTEL_RESOURCE_ATTRIBUTES`. */
+    resource: TraceResource;
+    /** The content kinds spans carry: none by default. */
+    content: TraceContentKind[];
+    /** Where the projector posts: the traces URL and `OTEL_EXPORTER_OTLP_HEADERS`. */
+    export?: {
+        url: string;
+        headers: Record<string, string>;
+    };
 }
 /** Where the Object store is and the credential for it (`NYLORUN_OBJECT_STORE_*`). */
 export interface ObjectStoreConfig {