@nylorun/runtime 0.23.0-beta → 0.24.0-beta

package/dist/harness-api/workspace.js

@@ -15,9 +15,10 @@
  * - **Pod sandboxes** (F7.2, `withPodWorkspaces`): a session attached to a pod sandbox has its
  *   workspace in the pod, served by the sandbox's engine (its host connection). Its tool calls,
  *   listings and reads go there whatever serves the other workspaces; with the pod stopped or
- *   starting they are `409 sandbox_unavailable`.
+ *   starting they are `409 environment_unavailable`.
  */
 import { HarnessApiError } from "@nylorun/core/harness-api";
+import { fromWireAnswer, toWireOp } from "../sandbox/disk-fs.js";
 import { DEFAULT_SANDBOX_IMAGE } from "../sandbox/policy.js";
 import { fail } from "../tenant/http.js";
 import { NoWorkspaceHarness } from "./server.js";
@@ -27,9 +28,10 @@ export function localWorkspace(manager) {
         run: (session, capability, toolName, input, signal) => manager.run(session, capability, toolName, input, signal),
         listFiles: (session, capability, dir, maxEntries, signal) => manager.listFiles(session, capability, dir, maxEntries, signal),
         readBytes: (session, capability, path, maxBytes, signal) => manager.readBytes(session, capability, path, maxBytes, signal),
+        disk: (session, capability, op, signal) => manager.disk(session, capability, op, signal),
         report: () => manager.report(),
         sweep: (options) => manager.sweep(options),
-        removeSandbox: (sandboxId) => manager.removeSandbox(sandboxId),
+        removeSandbox: (environmentId) => manager.removeSandbox(environmentId),
         removeAll: () => manager.reconcile(() => false, () => false),
         close: () => manager.close(),
     };
@@ -45,7 +47,7 @@ const METHODS = {
 function sessionOf(session) {
     return {
         ownerId: session.id,
-        ...(session.sandboxId === undefined ? {} : { sandboxId: session.sandboxId }),
+        ...(session.environmentId === undefined ? {} : { environmentId: session.environmentId }),
         activeTurnId: session.activeTurnId,
     };
 }
@@ -55,7 +57,7 @@ export function remoteWorkspace(options) {
     const target = options.pod === undefined ? undefined : { pod: options.pod };
     const unavailable = (error) => error.pod === undefined
         ? fail(503, error.message, { code: "request_rejected" })
-        : fail(409, error.message, { code: "sandbox_unavailable" });
+        : fail(409, error.message, { code: "environment_unavailable" });
     /** The harness's answer, or `undefined` when none serves workspaces. */
     const ask = async (method, params, signal) => {
         try {
@@ -74,9 +76,9 @@ export function remoteWorkspace(options) {
         const { workspaces } = answer;
         const gone = [];
         for (const record of workspaces) {
-            const kept = record.sandboxId === undefined
+            const kept = record.environmentId === undefined
                 ? await sessionExists(record.sessionId)
-                : await sandboxExists(record.sandboxId);
+                : await sandboxExists(record.environmentId);
             if (!kept)
                 gone.push(record.key);
         }
@@ -154,6 +156,19 @@ export function remoteWorkspace(options) {
                 throw error;
             }
         },
+        async disk(session, capability, op, signal) {
+            try {
+                const answer = (await options.server.workspace("list" in op || "read" in op ? "workspace.read" : "workspace.write", { session: sessionOf(session), spec: capability.sandbox ?? {}, disk: toWireOp(op) }, signal, target));
+                return answer.kind === "failed"
+                    ? { kind: "failed", code: String(answer.code), message: String(answer.message) }
+                    : fromWireAnswer(answer);
+            }
+            catch (error) {
+                if (error instanceof NoWorkspaceHarness)
+                    return unavailable(error);
+                throw error;
+            }
+        },
         async report() {
             const answer = await ask("workspace.report", {}).catch(() => undefined);
             if (answer)
@@ -168,12 +183,12 @@ export function remoteWorkspace(options) {
             };
         },
         sweep: (pass) => sweep(pass.sessionExists, pass.sandboxExists, pass.now),
-        async removeSandbox(sandboxId) {
+        async removeSandbox(environmentId) {
             // With no harness connected, the next sweep removes it: its resource is gone.
-            await ask("workspace.remove", { sandboxIds: [sandboxId] });
+            await ask("workspace.remove", { environmentIds: [environmentId] });
             await store.tx(async (t) => {
                 for (const row of await t.listSandboxes())
-                    if (row.sandboxId === sandboxId)
+                    if (row.environmentId === environmentId)
                         await t.delete("sandboxes", row.key);
             });
         },
@@ -188,13 +203,14 @@ export function remoteWorkspace(options) {
  * everything else goes to `base`. `podOf` says whether a sandbox resource is a pod sandbox.
  */
 export function withPodWorkspaces(base, options) {
-    const routed = async (session) => session.sandboxId !== undefined && (await options.isPod(session.sandboxId))
-        ? remoteWorkspace({ ...options, pod: session.sandboxId })
+    const routed = async (session) => session.environmentId !== undefined && (await options.isPod(session.environmentId))
+        ? remoteWorkspace({ ...options, pod: session.environmentId })
         : base;
     return {
         ...base,
         run: async (session, capability, toolName, input, signal) => (await routed(session)).run(session, capability, toolName, input, signal),
         listFiles: async (session, capability, dir, maxEntries, signal) => (await routed(session)).listFiles(session, capability, dir, maxEntries, signal),
         readBytes: async (session, capability, path, maxBytes, signal) => (await routed(session)).readBytes(session, capability, path, maxBytes, signal),
+        disk: async (session, capability, op, signal) => (await routed(session)).disk(session, capability, op, signal),
     };
 }

package/dist/harness-api/ws-server.d.ts

@@ -1,11 +1,14 @@
 import { type Server } from "node:http";
 import { type HarnessChannel } from "@nylorun/core/harness-api";
+import { HOST_JOIN_PATH, HOST_RENEW_PATH } from "@nylorun/core/harness-api";
 import { type WsPortOptions } from "../harness/ws-port.js";
 import { type HostAuthority } from "../sandbox/join.js";
 import type { HarnessPeer } from "./server.js";
-/** Where a pod's engine exchanges its join token, and renews its host token. */
-export declare const HOST_JOIN_PATH = "/nylorun/harness/v1/host/join";
-export declare const HOST_RENEW_PATH = "/nylorun/harness/v1/host/renew";
+export { HOST_JOIN_PATH, HOST_RENEW_PATH };
+/** Where a pod's engine reads its setup and reports it (R2d step 2, `sandbox/setup.ts`). */
+export declare const HOST_SETUP_PATH = "/nylorun/harness/v1/host/setup";
+/** Where it reads its input files: `/{index}`, and a folder's file `/{index}/{path}`. */
+export declare const HOST_FILES_PATH = "/nylorun/harness/v1/host/files";
 /** Attaches a harness's channel to the open Tenant; returns a function that detaches it. */
 export type HarnessAttach = (channel: HarnessChannel, peer: HarnessPeer) => () => void;
 export interface HarnessListenerOptions {
@@ -17,6 +20,11 @@ export interface HarnessListenerOptions {
     readonly token?: string;
     /** The open Tenant's `attachHarness`, or undefined while there is none. */
     readonly attach: () => Promise<HarnessAttach | undefined>;
+    /**
+     * The custom harness a per-harness token is for (R4.1), or undefined. Absent, only the harness
+     * token and host tokens are accepted.
+     */
+    readonly harnessOfToken?: (token: string) => Promise<string | undefined>;
     /** The open Tenant's host authority (sandbox pods, F7.2), or undefined without one. */
     readonly hosts?: () => Promise<HostAuthority | undefined>;
     readonly logger: {

package/dist/harness-api/ws-server.js

@@ -14,22 +14,31 @@
  * /nylorun/harness/v1/host/join` (`{ sandboxId, podUid, joinToken }`), renews it with `POST
  * .../host/renew` (`Authorization: Bearer <host token>`), and upgrades with the host token as
  * its bearer: that connection hosts its sandbox alone (`HarnessPeer.host`). Both answer
- * `{ hostToken, egressToken, sandboxId, epoch, expiresAt, caCertificate }` (the egress CA, R2c);
- * every refusal is the same 401. The harness token is never accepted as a host token, nor a host token anywhere but here.
+ * `{ hostToken, egressToken, sandboxId, epoch, expiresAt, caCertificate }` (the egress CA, R2c),
+ * and a join adds the disk's `setup` (R2d step 2). With its host token the engine also reads and
+ * reports its setup (`GET|POST .../host/setup`) and reads its input files (`GET
+ * .../host/files/{index}[/{path}]`). Every refusal is the same 401. The harness token is never
+ * accepted as a host token, nor a host token anywhere but here.
  */
 import { createHash, timingSafeEqual } from "node:crypto";
 import { createServer } from "node:http";
-import { createChannel } from "@nylorun/core/harness-api";
+import { DEFAULT_HARNESS, createChannel } from "@nylorun/core/harness-api";
 import { WebSocketServer } from "ws";
-import { HARNESS_API_HEADER, HARNESS_API_PATH, HARNESS_MAX_PAYLOAD, wsPort, } from "../harness/ws-port.js";
+import { HARNESS_API_HEADER, HARNESS_API_PATH, HARNESS_API_TRANSPORT, HARNESS_MAX_PAYLOAD, HOST_JOIN_PATH, HOST_RENEW_PATH, } from "@nylorun/core/harness-api";
+import { wsPort } from "../harness/ws-port.js";
 import { tokenType } from "../tenant/jwt.js";
 import { HOST_TOKEN_TYP } from "../tenant/host-token.js";
 import { HostAuthError } from "../sandbox/join.js";
-/** Where a pod's engine exchanges its join token, and renews its host token. */
-export const HOST_JOIN_PATH = `${HARNESS_API_PATH}/host/join`;
-export const HOST_RENEW_PATH = `${HARNESS_API_PATH}/host/renew`;
+import { parseSetupReport } from "../sandbox/setup.js";
+export { HOST_JOIN_PATH, HOST_RENEW_PATH };
+/** Where a pod's engine reads its setup and reports it (R2d step 2, `sandbox/setup.ts`). */
+export const HOST_SETUP_PATH = `${HARNESS_API_PATH}/host/setup`;
+/** Where it reads its input files: `/{index}`, and a folder's file `/{index}/{path}`. */
+export const HOST_FILES_PATH = `${HARNESS_API_PATH}/host/files`;
 /** A join's body is small. */
 const MAX_JOIN_BODY = 8 * 1024;
+/** A setup report carries the end of a command's output. */
+const MAX_REPORT_BODY = 64 * 1024;
 function refuse(socket, status, text, headers = {}) {
     const lines = [
         `HTTP/1.1 ${status} ${text}`,
@@ -76,12 +85,12 @@ export async function startHarnessListener(options) {
         });
         response.end(text);
     };
-    const readBody = (request) => new Promise((resolve, reject) => {
+    const readBody = (request, max = MAX_JOIN_BODY) => new Promise((resolve, reject) => {
         let size = 0;
         const chunks = [];
         request.on("data", (chunk) => {
             size += chunk.length;
-            if (size > MAX_JOIN_BODY) {
+            if (size > max) {
                 reject(new HostAuthError(400, "The body is too large"));
                 request.destroy();
             }
@@ -116,7 +125,61 @@ export async function startHarnessListener(options) {
             return reply(response, 503, { error: { code: "unavailable", message: "Try again" } });
         }
     };
-    // Plain requests get nothing but the pods' join and renewal: the listener speaks the Harness API.
+    /** A pod's setup and input files (R2d step 2), with its host token. */
+    const serveSetup = async (request, response, path) => {
+        if (!allowed.has(String(request.headers.host ?? "").toLowerCase()))
+            return reply(response, 421);
+        const authority = await options.hosts?.().catch(() => undefined);
+        if (!authority || closing)
+            return reply(response, 503, { error: { code: "unavailable", message: "Try again" } });
+        const token = bearerOf(request.headers.authorization) ?? "";
+        try {
+            if (path === HOST_SETUP_PATH) {
+                if (request.method === "GET")
+                    return reply(response, 200, await authority.setup(token));
+                if (request.method !== "POST")
+                    return reply(response, 405, undefined, { allow: "GET, POST" });
+                const report = parseSetupReport(JSON.parse(await readBody(request, MAX_REPORT_BODY)));
+                if (!report)
+                    throw new HostAuthError(400, "The report is malformed");
+                await authority.reportSetup(token, report);
+                return reply(response, 200, {});
+            }
+            if (request.method !== "GET")
+                return reply(response, 405, undefined, { allow: "GET" });
+            const [index, ...rest] = path.slice(HOST_FILES_PATH.length + 1).split("/");
+            if (!/^\d{1,2}$/.test(index ?? ""))
+                return reply(response, 404);
+            const file = await authority.setupFile(token, Number(index), rest.length === 0 ? undefined : rest.map((part) => decodeURIComponent(part)).join("/"));
+            if (!file)
+                return reply(response, 404);
+            if (file.kind === "folder")
+                return reply(response, 200, { entries: file.entries }, { "x-nylorun-artifact-kind": "folder" });
+            response.writeHead(200, {
+                connection: "close",
+                "cache-control": "no-store",
+                "content-type": file.contentType,
+                "x-nylorun-artifact-kind": "file",
+            });
+            for await (const chunk of file.body)
+                response.write(chunk);
+            response.end();
+        }
+        catch (error) {
+            if (error instanceof HostAuthError) {
+                if (error.reason)
+                    logger.warn("sandbox_host_refused", { path, reason: error.reason });
+                return reply(response, error.status, { error: { code: error.status === 401 ? "unauthorized" : "invalid", message: error.message } }, error.status === 401 ? { "www-authenticate": "Bearer" } : {});
+            }
+            if (error instanceof SyntaxError)
+                return reply(response, 400, { error: { code: "invalid", message: "Not JSON" } });
+            logger.warn("sandbox_host_failed", { path, message: error instanceof Error ? error.message : String(error) });
+            if (response.headersSent)
+                return void response.destroy();
+            return reply(response, 503, { error: { code: "unavailable", message: "Try again" } });
+        }
+    };
+    // Plain requests get nothing but the pods' join, renewal and setup: the listener speaks the Harness API.
     const server = createServer((request, response) => {
         const path = new URL(request.url ?? "/", "http://harness.local").pathname;
         if (closing)
@@ -125,6 +188,10 @@ export async function startHarnessListener(options) {
             void serveHost(request, response, path);
             return;
         }
+        if ((path === HOST_SETUP_PATH || path.startsWith(`${HOST_FILES_PATH}/`)) && options.hosts) {
+            void serveSetup(request, response, path);
+            return;
+        }
         response.writeHead(426, { connection: "close", upgrade: "websocket" });
         response.end();
     });
@@ -140,10 +207,12 @@ export async function startHarnessListener(options) {
         const bearer = bearerOf(request.headers.authorization);
         // A pod's host token (F7.2): checked against its sandbox before the upgrade.
         const hostToken = bearer !== undefined && options.hosts && tokenType(bearer) === HOST_TOKEN_TYP;
-        if (!hostToken && !bearerMatches(request.headers.authorization, options.token))
+        // The harness token is our harness's; any other is a custom harness's own, or refused (R4.1).
+        const ours = !hostToken && bearerMatches(request.headers.authorization, options.token);
+        if (!hostToken && !ours && (bearer === undefined || !options.harnessOfToken))
             return refuse(socket, 401, "Unauthorized", { "WWW-Authenticate": "Bearer" });
-        if (request.headers[HARNESS_API_HEADER] !== "1")
-            return refuse(socket, 426, "Upgrade Required", { [HARNESS_API_HEADER]: "1" });
+        if (request.headers[HARNESS_API_HEADER] !== HARNESS_API_TRANSPORT)
+            return refuse(socket, 426, "Upgrade Required", { [HARNESS_API_HEADER]: HARNESS_API_TRANSPORT });
         const host = hostToken
             ? options.hosts().then(async (authority) => {
                 if (!authority)
@@ -152,15 +221,25 @@ export async function startHarnessListener(options) {
                 return { sandboxId: claims.sandboxId, epoch: claims.epoch };
             })
             : Promise.resolve(undefined);
-        void Promise.all([options.attach(), host]).then(([attach, hosted]) => {
+        const harness = hostToken
+            ? Promise.resolve(undefined)
+            : ours
+                ? Promise.resolve(DEFAULT_HARNESS)
+                : options.harnessOfToken(bearer).then((id) => {
+                    if (id === undefined)
+                        throw new HostAuthError(401, "Unauthorized");
+                    return id;
+                });
+        void Promise.all([options.attach(), host, harness]).then(([attach, hosted, harnessId]) => {
             if (!attach || closing || (hostToken && !hosted))
                 return refuse(socket, 503, "Service Unavailable");
             wss.handleUpgrade(request, socket, head, (ws) => {
                 const peer = {
                     name: hosted
                         ? `sandbox ${hosted.sandboxId}@${request.socket.remoteAddress ?? "unknown"}`
-                        : `harness@${request.socket.remoteAddress ?? "unknown"}`,
+                        : `harness ${harnessId}@${request.socket.remoteAddress ?? "unknown"}`,
                     ...(hosted ? { host: hosted } : {}),
+                    ...(harnessId === undefined ? {} : { harness: harnessId }),
                 };
                 const channel = createChannel(wsPort(ws, { ...options.liveness, ping: true }), { validate: true });
                 const detach = attach(channel, peer);

package/dist/host/gates.d.ts

@@ -81,6 +81,7 @@ export interface StartEgressOptions {
 }
 /**
  * egress-gate (`--service egress`, F7.2): pods' CONNECT proxy, verifying egress tokens against the
- * Tenant's public keys and reading its sandboxes from the same database as the gates.
+ * Tenant's public keys and reading its sandboxes from the same database as the gates, where it
+ * also records each connection (R7.3).
  */
 export declare function startEgress(options: StartEgressOptions): Promise<EgressGate>;

package/dist/host/gates.js

@@ -23,9 +23,10 @@ import { tenantPaths } from "../tenant/paths.js";
 import { staleRun, verifyRunToken } from "../tenant/run-token.js";
 import { createFsBlobStore } from "../blob/index.js";
 import { createTenantVaults } from "../gates/tenant-vaults.js";
+import { journalCheck } from "../gates/journal.js";
 import { probeDatabase } from "../infra/database.js";
 import { bindListener, headerValue, isAllowedRequestHost, sendRejected } from "./http.js";
-import { startEgressGate, storeEgressSandboxes } from "../gates/egress.js";
+import { startEgressGate, storeEgressRecord, storeEgressSandboxes, } from "../gates/egress.js";
 import { verifyEgressToken } from "../sandbox/egress-token.js";
 import { leafKeyPair } from "../keys/x509.js";
 /** Above the gate's 600 s provider request timeout and the loop's 630 s client timeout. */
@@ -101,6 +102,7 @@ export async function startGates(options) {
         mcp,
         http: gateHttpTools(vaults, options.delivery ?? {}, logger),
         toolCalls,
+        journal: journalCheck(vaults),
         logger,
         ...(options.keys ? { keys: async () => (await vaults.open()).keys() } : {}),
     });
@@ -153,7 +155,8 @@ export async function startGates(options) {
 }
 /**
  * egress-gate (`--service egress`, F7.2): pods' CONNECT proxy, verifying egress tokens against the
- * Tenant's public keys and reading its sandboxes from the same database as the gates.
+ * Tenant's public keys and reading its sandboxes from the same database as the gates, where it
+ * also records each connection (R7.3).
  */
 export async function startEgress(options) {
     const { database } = options;
@@ -173,6 +176,11 @@ export async function startEgress(options) {
             return verifyEgressToken(vault.store, vault.tenantId, raw, publicKeys);
         },
         sandboxes: { live: async (sandboxId) => storeEgressSandboxes((await tenant.open()).store).live(sandboxId) },
+        // Each connection on the Tenant's record (R7.3): the gates' one write into it.
+        record: {
+            holder: async (environmentId) => storeEgressRecord((await tenant.open()).store).holder(environmentId),
+            write: async (holder, connection) => storeEgressRecord((await tenant.open()).store).write(holder, connection),
+        },
         credentials: {
             bound: async (sandboxId, host) => (await tenant.open()).environmentSecretBound(sandboxId, host),
             release: async (sandboxId, host) => (await tenant.open()).releaseEnvironmentSecret(sandboxId, host),

package/dist/host/main.js

@@ -12,7 +12,9 @@
  * first start (`NYLORUN_TENANT_ID`, `NYLORUN_TENANT_NAME`; tenancy.md §4), trusting the issuers of the identity file
  * `NYLORUN_IDENTITY_FILE` names (Host feature `trusted-issuers`); with S2, a process running core
  * runs the stream relay, which feeds the Tenant's streams from the record over
- * logical replication (one process at a time holds the slot); `/ready` reports
+ * logical replication (one process at a time holds the slot); with `OTEL_EXPORTER_OTLP_ENDPOINT`
+ * it also runs the trace projector, which posts the record's spans over OTLP from a slot of its
+ * own (R7.2); `/ready` reports
  * the Tenant and the infrastructure checks. With an Object store
  * (`NYLORUN_OBJECT_STORE_*`) the Tenant's blobs go to it through the `s3` BlobStore, and a
  * process running core creates its bucket; without one they stay on disk (`fs`). A process
@@ -36,8 +38,12 @@ import { createPostgresTenantOpener } from "../tenant/store-pg.js";
 import { openTenantRuntime } from "../tenant/runtime.js";
 import { createPgoutputSource } from "../adapters/replication/pgoutput.js";
 import { assertLogicalReplication } from "../store/postgres/connect.js";
-import { createPostgresRecordReader } from "../store/postgres/record.js";
 import { createStreamRelay } from "../streams/relay/core.js";
+import { createPostgresRecordReader, createPostgresTurnMessages } from "../store/postgres/record.js";
+import { createPostgresSessionStore } from "../store/postgres/store.js";
+import { createTraceProjector, TRACE_SLOT } from "../traces/projector.js";
+import { createOtlpPoster } from "../traces/otlp.js";
+import { traceKey } from "../traces/key.js";
 import { configForFactory } from "./config-for.js";
 import { createHost } from "./create-host.js";
 import { createHostExecution } from "./execution.js";
@@ -141,7 +147,7 @@ function warnRemovedSettings(stack, logger) {
     if (stack.removedResolverVariables)
         logger.warn("resolver_removed", {
             variables: stack.removedResolverVariables,
-            message: "The credential resolver is gone (protocol 10) and these variables are ignored: keep a person's keys in their user vault, or reach their accounts through a gateway",
+            message: "The credential resolver is gone (protocol 10) and these variables are ignored: keep a person's keys in their Environment's vault, or reach their accounts through a gateway",
         });
 }
 /**
@@ -254,6 +260,7 @@ export async function main() {
         mode: stack.listen ? "container" : "local",
         endpoints: describeEndpoints(stack.endpoints),
         objectStore: stack.objectStore ? "s3" : "fs",
+        traces: stack.traces?.export ? "otlp" : "off",
     });
     const infra = createInfra(stack, { logger });
     const database = infra.database;
@@ -283,7 +290,11 @@ export async function main() {
     // running core runs one, once the Tenant is open (the relay reads its id); the replication
     // slot lets exactly one be active. Without S2, the Tenant relays its own commits.
     let relay;
-    if (streams && stack.services.has("core"))
+    // With an OTLP endpoint (R7.2, Q5), the trace projector reads the record on its own slot: one
+    // process running core at a time, as for the relay. Without one there is no slot.
+    const traceExport = stack.services.has("core") ? stack.traces?.export : undefined;
+    let projector;
+    if ((streams || traceExport) && stack.services.has("core"))
         await assertLogicalReplication(database);
     const startRelay = (tenantId) => {
         if (!streams || !stack.services.has("core") || relay)
@@ -301,6 +312,32 @@ export async function main() {
         });
         relay.start();
     };
+    const startProjector = (tenantId) => {
+        if (!traceExport || projector)
+            return;
+        const store = createPostgresSessionStore({ sql: database, tenantId });
+        const log = (message, fields) => logger.info(message, fields);
+        projector = createTraceProjector({
+            source: createPgoutputSource({
+                connectionString: stack.endpoints.databaseUrl,
+                tenantId,
+                slot: TRACE_SLOT,
+                applicationName: "nylorun-trace-export",
+                log,
+            }),
+            post: createOtlpPoster({
+                url: traceExport.url,
+                headers: traceExport.headers,
+                resource: stack.traces.resource,
+                log: (message, fields) => logger.warn(message, fields),
+            }),
+            key: () => traceKey(store),
+            turnMessage: createPostgresTurnMessages(database),
+            content: new Set(stack.traces.content),
+            log,
+        });
+        projector.start();
+    };
     // With the gates service the Tenant's vault-backed model calls, remote MCP calls and HTTP
     // tool calls cross it, and this process never reads a model or MCP credential.
     // Their credentials (F5): each advance's run token for its session's model and tool calls,
@@ -355,11 +392,17 @@ export async function main() {
                 ...(blobs ? { blobs } : {}),
                 ...(stack.harnessMode === "remote" ? { harness: "remote" } : {}),
                 ...(pods ? { pods } : {}),
+                ...(stack.traces
+                    ? { traces: { resource: stack.traces.resource, content: new Set(stack.traces.content) } }
+                    : {}),
                 ...opened,
             }),
         }),
         logger,
-        onOpen: (handle) => startRelay(handle.envelope.id),
+        onOpen: (handle) => {
+            startRelay(handle.envelope.id);
+            startProjector(handle.envelope.id);
+        },
     });
     const options = {
         hostRoot,
@@ -378,6 +421,7 @@ export async function main() {
             beforeTenants: async () => {
                 await hostExecution.stop();
                 await relay?.stop();
+                await projector?.stop();
                 // The harnesses' runs stop with the Tenant's advances; their connections close after.
             },
             afterTenants: async () => {
@@ -421,6 +465,11 @@ export async function main() {
                     const handle = resolved.kind === "open" ? resolved.handle : undefined;
                     return handle?.attachHarness ? (channel, peer) => handle.attachHarness(channel, peer) : undefined;
                 },
+                // Custom harnesses connect with their own tokens (R4.1).
+                harnessOfToken: async (token) => {
+                    const resolved = await module.resolve();
+                    return resolved.kind === "open" ? resolved.handle.harnessOfToken?.(token) : undefined;
+                },
                 logger,
             });
         await host.listen();

package/dist/host/operate.js

@@ -9,12 +9,16 @@
  *   nylorun-operate keys list [--json]
  *   nylorun-operate keys put <id> [--role application|management] [--json]
  *   nylorun-operate keys rm <id> [--json]
+ *   nylorun-operate harness token put <id> [--json]
+ *   nylorun-operate harness token list [--json]
+ *   nylorun-operate harness token rm <id> [--json]
  *
  * `status` says whether the Tenant is open and, when it is not, why: from the database (no
  * Tenant yet, an old layout, a schema newer or older than this Runtime) and from the running
  * Host's `/ready` on this container's listen port. It needs no key, so it works when the Tenant
  * cannot open. `keys put` prints the new key once on stdout (with `--json`, the whole
- * response). Exit codes: 0 done (`status`: the Tenant is open), 1 refused (an id, a role),
+ * response). `harness token put` makes a custom harness's own token (R4.1), bound to its harness
+ * id, and prints it once; putting it again rotates it. Exit codes: 0 done (`status`: the Tenant is open), 1 refused (an id, a role),
  * 2 the Tenant cannot be opened (`status` still prints it), 64 usage.
  */
 import { pathToFileURL } from "node:url";
@@ -26,6 +30,7 @@ import { createPostgresSessionStore } from "../store/postgres/store.js";
 import { readTenantEnvelope } from "../store/postgres/tenant.js";
 import { openError, TenantOpenError } from "../tenant/cause.js";
 import { operatorKeys } from "../tenant/operator-keys.js";
+import { deleteHarnessToken, listHarnessTokens, putHarnessToken } from "../tenant/harness-tokens.js";
 import { RUNTIME_VERSION } from "../version.js";
 import { DEFAULT_CONTAINER_LISTEN_PORT } from "./stack-config.js";
 export const EXIT_REFUSED = 1;
@@ -35,7 +40,10 @@ const USAGE = `Usage:
   nylorun-operate status [--json]
   nylorun-operate keys list [--json]
   nylorun-operate keys put <id> [--role application|management] [--json]
-  nylorun-operate keys rm <id> [--json]`;
+  nylorun-operate keys rm <id> [--json]
+  nylorun-operate harness token put <id> [--json]
+  nylorun-operate harness token list [--json]
+  nylorun-operate harness token rm <id> [--json]`;
 class Exit extends Error {
     code;
     constructor(code, message) {
@@ -52,14 +60,14 @@ export async function runOperate(argv, io) {
                 throw new Exit(EXIT_USAGE, USAGE);
             return await status(io, json);
         }
-        const command = parse(argv);
+        const command = argv[0] === "harness" ? harnessCommand(argv) : parse(argv);
         const url = io.env.NYLORUN_DATABASE_URL;
         if (!url)
             throw new Exit(EXIT_TENANT, "NYLORUN_DATABASE_URL is not set: run this inside the runtime container");
         const sql = createPostgresClient(url, { max: 1 });
         try {
-            const keys = operatorKeys(await openStore(sql));
-            return await command(keys, io);
+            const store = await openStore(sql);
+            return await command(operatorKeys(store), io, store);
         }
         finally {
             await sql.end({ timeout: 5 });
@@ -74,6 +82,60 @@ export async function runOperate(argv, io) {
         return EXIT_TENANT;
     }
 }
+/** `harness token put|list|rm` (R4.1). */
+function harnessCommand(argv) {
+    const [, noun, verb, ...rest] = argv;
+    const json = rest.includes("--json");
+    const args = rest.filter((arg) => arg !== "--json");
+    if (noun !== "token")
+        throw new Exit(EXIT_USAGE, USAGE);
+    switch (verb) {
+        case "list":
+            if (args.length > 0)
+                throw new Exit(EXIT_USAGE, USAGE);
+            return async (_keys, io, store) => {
+                const tokens = await listHarnessTokens(store);
+                if (json)
+                    io.out(JSON.stringify({ tokens }));
+                else
+                    for (const token of tokens)
+                        io.out(`${token.id}\t${token.createdAt}`);
+                return 0;
+            };
+        case "put": {
+            const [id] = args;
+            if (!id || args.length !== 1)
+                throw new Exit(EXIT_USAGE, USAGE);
+            return async (_keys, io, store) => {
+                const put = await putHarnessToken(store, id);
+                if ("reason" in put)
+                    throw new Exit(EXIT_REFUSED, put.message);
+                if (json)
+                    io.out(JSON.stringify(put));
+                else {
+                    io.out(put.token);
+                    io.err(`${put.rotated ? "Rotated" : "Created"} the token of harness ${put.id}. It is shown this once: the harness connects with it as NYLORUN_HARNESS_TOKEN and must say ${put.id} in hello.`);
+                }
+                return 0;
+            };
+        }
+        case "rm": {
+            const [id] = args;
+            if (!id || args.length !== 1)
+                throw new Exit(EXIT_USAGE, USAGE);
+            return async (_keys, io, store) => {
+                const deleted = await deleteHarnessToken(store, id);
+                if (json)
+                    io.out(JSON.stringify({ id, deleted }));
+                else
+                    io.err(deleted ? `Deleted the token of harness ${id}.` : `Harness ${id} has no token.`);
+                return 0;
+            };
+        }
+        default:
+            throw new Exit(EXIT_USAGE, USAGE);
+    }
+}
 function parse(argv) {
     const [group, verb, ...rest] = argv;
     if (group !== "keys")