@nylorun/runtime 0.23.0-beta → 0.25.0-beta

package/dist/core/turn-manifest.d.ts

@@ -16,8 +16,9 @@ export type TurnManifestErr = {
     readonly message: string;
 };
 /**
- * Parse `message.manifest`, require it to be a variant of the session pin,
- * hash it, and store it. Applies to that turn only (caller must not latch).
+ * Parse `message.manifest`, require it to be a variant of the session pin, and store the
+ * manifest the turn runs with: the variant with the pin's `runtime` block (a variant never sets
+ * one), by its hash. Applies to that turn only (caller must not latch).
  */
 export declare function pinTurnManifest(args: {
     readonly candidate: unknown;

package/dist/core/turn-manifest.js

@@ -2,8 +2,29 @@ import { AgentManifestSchema, } from "@nylorun/core/contracts";
 import { hashManifest } from "@nylorun/core/compatibility";
 import { isVariantOf } from "@nylorun/core/define";
 /**
- * Parse `message.manifest`, require it to be a variant of the session pin,
- * hash it, and store it. Applies to that turn only (caller must not latch).
+ * The candidate's agents used as tools with the `runtime` block the pin gave each, when the
+ * candidate left it out: a turn variant is written from the definition, and only the Runtime
+ * writes `runtime`. A candidate that sets one keeps it, and must then match the pin's.
+ */
+function withPinnedDelegates(candidate, pinned) {
+    if (candidate.tools === undefined)
+        return candidate;
+    const pinnedAgents = new Map((pinned.tools ?? []).flatMap((tool) => tool.agent !== undefined && !("kind" in tool.agent) ? [[tool.name, tool.agent]] : []));
+    let changed = false;
+    const tools = candidate.tools.map((tool) => {
+        const agent = tool.agent;
+        const prior = pinnedAgents.get(tool.name);
+        if (agent === undefined || "kind" in agent || agent.runtime !== undefined || prior?.runtime === undefined)
+            return tool;
+        changed = true;
+        return { ...tool, agent: { ...agent, runtime: prior.runtime } };
+    });
+    return changed ? { ...candidate, tools } : candidate;
+}
+/**
+ * Parse `message.manifest`, require it to be a variant of the session pin, and store the
+ * manifest the turn runs with: the variant with the pin's `runtime` block (a variant never sets
+ * one), by its hash. Applies to that turn only (caller must not latch).
  */
 export function pinTurnManifest(args) {
     const parsed = AgentManifestSchema.safeParse(args.candidate);
@@ -14,14 +35,17 @@ export function pinTurnManifest(args) {
             message: "Turn manifest failed AgentManifestSchema validation",
         };
     }
-    const manifest = parsed.data;
-    if (!isVariantOf(manifest, args.pinned)) {
+    const candidate = withPinnedDelegates(parsed.data, args.pinned);
+    if (!isVariantOf(candidate, args.pinned)) {
         return {
             ok: false,
             code: "loop.invalid-agent",
-            message: "Turn manifest is not a variant of the session's pinned manifest",
+            message: candidate.runtime === undefined
+                ? "Turn manifest is not a variant of the session's pinned manifest"
+                : "Turn manifest sets runtime, which only the Runtime writes: leave it out, and the turn runs with the session's",
         };
     }
+    const manifest = args.pinned.runtime === undefined ? candidate : { ...candidate, runtime: args.pinned.runtime };
     const hash = hashManifest(manifest);
     args.store.put(hash, manifest);
     return { ok: true, manifest, hash };

package/dist/execution/types.d.ts

@@ -72,7 +72,7 @@ export type AdvanceResult = {
     retryAfterMs: number;
 };
 /** A pod sandbox's timers. */
-export type SandboxTimer = "idle" | "ttl";
+export type SandboxTimer = "idle";
 /**
  * What `DurableExecution.sandbox` asks for: a reconcile, or a timer. A reconcile's `key` merges
  * repeated sends of one request (the outbox's `signal:<row id>`); without one, every send runs.

package/dist/gates/contract.d.ts

@@ -1,6 +1,6 @@
 /**
- * The gates service's wire format (blueprint §15, P1.1). Internal: only the loop calls it, so
- * it is not in the published OpenAPI documents.
+ * The gates service's wire format (blueprint §15, P1.1). Not in the published OpenAPI documents:
+ * harnesses call it, and its bodies are published in `@nylorun/core/harness-api` (R4.5).
  *
  * `POST /nylorun/v1/model-calls`
  * - Headers: `Authorization: Bearer <run token>` (F5, `tenant/run-token.ts`), `Idempotency-Key:
@@ -22,31 +22,10 @@
  * whether or not it exists, `403 gate_forbidden` when it is another session's call. The token
  * need not be live: a user cancel makes it stale, and still stops its call.
  */
-import { z } from "zod";
 import type { ModelGateOutcome } from "./model-gate.js";
-export declare const MODEL_CALLS_PATH = "/nylorun/v1/model-calls";
+export { MAX_MODEL_CALL_BYTES, MODEL_CALLS_PATH, ModelCallBodySchema, type GateErrorBody, type ModelCallBody, } from "@nylorun/core/harness-api";
 /** Header naming the Tenant a call is for: optional, and checked against the gate's Tenant. */
 export declare const TENANT_HEADER = "nylorun-tenant";
-/** Largest request body the gate reads: one `ModelCall` with its whole projected history. */
-export declare const MAX_MODEL_CALL_BYTES: number;
-export declare const ModelCallBodySchema: z.ZodObject<{
-    effectId: z.ZodString;
-    invocationId: z.ZodString;
-    call: z.ZodObject<{
-        prompt: z.ZodArray<z.ZodUnknown>;
-        tools: z.ZodArray<z.ZodObject<{
-            name: z.ZodString;
-        }, z.core.$loose>>;
-    }, z.core.$loose>;
-}, z.core.$strict>;
-export type ModelCallBody = z.infer<typeof ModelCallBodySchema>;
 export interface ModelCallResponse {
     readonly outcome: ModelGateOutcome;
 }
-/** An error answer: `{error: {code, message}}`. */
-export interface GateErrorBody {
-    readonly error: {
-        readonly code: "gate_unauthorized" | "gate_forbidden" | "run_stale" | "invalid_request" | "gate_conflict";
-        readonly message: string;
-    };
-}

package/dist/gates/contract.js

@@ -1,38 +1,3 @@
-/**
- * The gates service's wire format (blueprint §15, P1.1). Internal: only the loop calls it, so
- * it is not in the published OpenAPI documents.
- *
- * `POST /nylorun/v1/model-calls`
- * - Headers: `Authorization: Bearer <run token>` (F5, `tenant/run-token.ts`), `Idempotency-Key:
- *   <effect id>`, and optionally `Nylorun-Tenant: <tenant id>`, which must then be the token's
- *   Tenant. Core's credential (`NYLORUN_GATES_TOKEN`) is refused: only a run calls the model.
- * - Body: `ModelCallBody`, at most `MAX_MODEL_CALL_BYTES`. It names no session, turn or agent:
- *   the gate takes them from the token, and refuses a body that names them.
- * - `200 {outcome}` once the call has finished, whether the outcome is a candidate or a
- *   failure; nothing is sent while it runs. `401 gate_unauthorized` for a missing, malformed,
- *   expired or foreign token, `409 run_stale` when the token's lease is no longer the
- *   session's (a cancel, a new turn, a takeover), `400 invalid_request` for a malformed Tenant
- *   header or a bad body, `409 gate_conflict` when a different request already runs under the
- *   same key.
- * - With an `Idempotency-Key` the call outlives its client (P1.2): a re-send with the same key
- *   and body joins it, or gets its outcome for 30 minutes. Without one, a client that goes
- *   away aborts the call.
- *
- * `POST /nylorun/v1/model-calls/{key}/cancel` (same headers): aborts the keyed call; `204`
- * whether or not it exists, `403 gate_forbidden` when it is another session's call. The token
- * need not be live: a user cancel makes it stale, and still stops its call.
- */
-import { z } from "zod";
-export const MODEL_CALLS_PATH = "/nylorun/v1/model-calls";
+export { MAX_MODEL_CALL_BYTES, MODEL_CALLS_PATH, ModelCallBodySchema, } from "@nylorun/core/harness-api";
 /** Header naming the Tenant a call is for: optional, and checked against the gate's Tenant. */
 export const TENANT_HEADER = "nylorun-tenant";
-/** Largest request body the gate reads: one `ModelCall` with its whole projected history. */
-export const MAX_MODEL_CALL_BYTES = 32 * 1024 * 1024;
-export const ModelCallBodySchema = z.strictObject({
-    effectId: z.string().min(1),
-    invocationId: z.string().min(1),
-    call: z.looseObject({
-        prompt: z.array(z.unknown()),
-        tools: z.array(z.looseObject({ name: z.string() })),
-    }),
-});

package/dist/gates/egress-credentials.d.ts

@@ -27,6 +27,13 @@ export interface EgressCredentials {
     /** Tests: the port requests are sent to, instead of 443. */
     readonly upstreamPort?: number;
 }
+/** The answer to a CONNECT the gate serves; a tunnel's byte counts leave it out. */
+export declare const CONNECT_ESTABLISHED = "HTTP/1.1 200 Connection Established\r\n\r\n";
+/** What one terminated connection did so far (R7.3): requests read, credentials set (ids). */
+export interface EgressTally {
+    requests: number;
+    readonly credentialIds: Set<string>;
+}
 export interface CredentialTerminator {
     /**
      * Answers the CONNECT, terminates TLS for `host` and serves its requests, sending each to one
@@ -39,6 +46,8 @@ export interface CredentialTerminator {
             address: string;
             family: number;
         }[];
+        /** Counted as requests are served, read when the connection closes. */
+        readonly tally: EgressTally;
     }): Promise<void>;
 }
 export declare function credentialTerminator(options: {

package/dist/gates/egress-credentials.js

@@ -12,10 +12,14 @@
  * Nothing here knows a tool: the header name and its format are the credential's. A release the
  * vault refuses (two secrets for one host, an unreadable value) answers 502 and is logged, never
  * as an event; a value never is. Upgrades (WebSocket) and HTTP/2 are not served on this path.
+ * Each connection keeps a tally for its `environment.egress` event (R7.3, D67): how many requests it
+ * read and which credentials it set, by id.
  */
 import { createServer } from "node:http";
 import { Agent, request } from "node:https";
 import { createSecureContext, TLSSocket } from "node:tls";
+/** The answer to a CONNECT the gate serves; a tunnel's byte counts leave it out. */
+export const CONNECT_ESTABLISHED = "HTTP/1.1 200 Connection Established\r\n\r\n";
 /** Headers that describe one hop and are never forwarded. */
 const HOP_BY_HOP = new Set([
     "connection",
@@ -74,6 +78,7 @@ export function credentialTerminator(options) {
             return;
         }
         const { sandboxId, host } = at;
+        at.tally.requests += 1;
         const release = await credentials.release(sandboxId, host);
         if (release.status === "refused") {
             logger.warn("egress_credential_refused", { status: 502, reason: release.reason, sandboxId, host });
@@ -82,8 +87,10 @@ export function credentialTerminator(options) {
         }
         const header = release.status === "released" ? release.header.toLowerCase() : undefined;
         const headers = forwardable(req.rawHeaders, header);
-        if (release.status === "released")
+        if (release.status === "released") {
             headers[header] = [release.value];
+            at.tally.credentialIds.add(release.credentialId);
+        }
         const upstream = request({
             host,
             port: credentials.upstreamPort ?? 443,
@@ -111,7 +118,7 @@ export function credentialTerminator(options) {
     }
     return {
         async terminate(client, target) {
-            const { sandboxId, host, addresses } = target;
+            const { sandboxId, host, addresses, tally } = target;
             const leaf = await credentials.leaf(host);
             if (client.destroyed)
                 return;
@@ -128,13 +135,13 @@ export function credentialTerminator(options) {
                 lookup,
                 ...(credentials.upstreamCa ? { ca: credentials.upstreamCa } : {}),
             });
-            client.write("HTTP/1.1 200 Connection Established\r\n\r\n");
+            client.write(CONNECT_ESTABLISHED);
             const tls = new TLSSocket(client, {
                 isServer: true,
                 secureContext: createSecureContext({ key: leaf.key, cert: leaf.cert }),
                 ALPNProtocols: ["http/1.1"],
             });
-            terminated.set(tls, { sandboxId, host, agent });
+            terminated.set(tls, { sandboxId, host, agent, tally });
             tls.on("error", () => tls.destroy());
             tls.on("close", () => {
                 agent.destroy();

package/dist/gates/egress.d.ts

@@ -1,5 +1,6 @@
 import { type Server } from "node:http";
 import { type Socket } from "node:net";
+import type { EgressRunningTurn, EnvironmentEventPayload } from "@nylorun/core/contracts";
 import type { EgressTokenVerdict } from "../sandbox/egress-token.js";
 import type { SessionStore } from "../store/types.js";
 import type { Logger } from "../tenant/types.js";
@@ -15,6 +16,17 @@ export interface EgressSandboxes {
         readonly allow: readonly string[];
     } | undefined>;
 }
+/** One connection's record (R7.3, D67): `environment.egress`'s payload. */
+export type EgressConnection = EnvironmentEventPayload<"environment.egress">;
+/** How many running turns one connection names, at most. */
+export declare const EGRESS_RUNNING_TURNS_MAX = 16;
+/** Where egress-gate records connections (R7.3, D67). */
+export interface EgressRecord {
+    /** The turns active on the Environment now, at most `EGRESS_RUNNING_TURNS_MAX`. */
+    runningTurns(environmentId: string): Promise<readonly EgressRunningTurn[]>;
+    /** Writes `connection` to its Environment's stream; a deleted Environment gets nothing. */
+    write(connection: EgressConnection): Promise<void>;
+}
 /** Ports a tunnel may open. */
 export declare const EGRESS_PORTS: readonly number[];
 /** Tunnels one sandbox may hold open at once. */
@@ -49,6 +61,8 @@ export interface StartEgressGateOptions {
     readonly dial?: (address: string, port: number) => Socket;
     /** The vault and keys, for hosts an `environment_secret` is bound to (R2c). None: tunnels only. */
     readonly credentials?: EgressCredentials;
+    /** Where connections are recorded (R7.3). None: they are only logged. */
+    readonly record?: EgressRecord;
 }
 export interface EgressGate {
     /** Where the gate listens, e.g. `http://0.0.0.0:4200`. */
@@ -70,6 +84,13 @@ export declare function startEgressGate(options: StartEgressGateOptions): Promis
 /**
  * `EgressSandboxes` over the Tenant's `sandbox_resources` (one indexed read): a pod sandbox's
  * host epoch, the pod that joined at it and its spec's allowlist; nothing for a virtual
- * sandbox, or one deleted, lost or expired, as `staleHost` judges a host token.
+ * Environment, or one deleted or lost, as `staleHost` judges a host token.
  */
 export declare function storeEgressSandboxes(store: SessionStore): EgressSandboxes;
+/**
+ * `EgressRecord` over the Tenant's record (R7.3, D67). The running turns are the sessions on the
+ * Environment whose body has an `activeTurnId`, in id order, at most `EGRESS_RUNNING_TURNS_MAX`.
+ * The write is `environment.egress` on the Environment's stream, under its row's lock; a deleted
+ * Environment gets nothing.
+ */
+export declare function storeEgressRecord(store: SessionStore): EgressRecord;

package/dist/gates/egress.js

@@ -21,8 +21,18 @@
  * `environment_secret` of a live session on the sandbox is bound to. There the gate terminates
  * TLS and sets the credential's header on every request (`egress-credentials.ts`), still sending
  * only to the checked address. Every other host gets the tunnel. Any other request
- * (an absolute-form plain HTTP request included) is answered 405. Refusals are logged, never as
- * events; the token never is. Tunnels close after `idleMs` without traffic in either direction.
+ * (an absolute-form plain HTTP request included) is answered 405. Refusals are logged; the token
+ * never is. Tunnels close after `idleMs` without traffic in either direction.
+ *
+ * Every connection to a named host on a live token is recorded once (R7.3, D67), when it closes
+ * or at once when the gate refuses it, as `environment.egress` on the Environment's own stream:
+ * the connection is the Environment's, since its token names the pod and turns run in parallel
+ * (D66). `runningTurns` lists the turns active on the Environment as it opened (read as the name
+ * resolves), as context and never as an owner. Host, port, outcome, bytes, duration and, for a
+ * credential host, the request count and credential ids; never a header value, a path or a body. A refusal
+ * before that (no token, a stale one, no `host:port`) stays a log line, and a client that hangs up
+ * before the gate answers leaves nothing. A write never holds the tunnel up, and a failed one is
+ * logged (`egress_record_failed`).
  */
 import { lookup as dnsLookup } from "node:dns/promises";
 import { createServer } from "node:http";
@@ -30,7 +40,9 @@ import { BlockList, connect, isIP } from "node:net";
 import { isSandboxHostPattern } from "@nylorun/core/define";
 import { isPrivateAddress } from "../tenant/outbound.js";
 import { bindListener } from "../host/http.js";
-import { credentialTerminator } from "./egress-credentials.js";
+import { CONNECT_ESTABLISHED, credentialTerminator, } from "./egress-credentials.js";
+/** How many running turns one connection names, at most. */
+export const EGRESS_RUNNING_TURNS_MAX = 16;
 /** Ports a tunnel may open. */
 export const EGRESS_PORTS = [443, 80];
 /** Tunnels one sandbox may hold open at once. */
@@ -134,6 +146,51 @@ function answer(socket, status, message, headers = []) {
         body,
     ].join("\r\n"));
 }
+function connectionRecord(sink, logger, client, at) {
+    let running;
+    let written = false;
+    const runningTurns = (to) => (running ??= to.runningTurns(at.environmentId));
+    const write = (fields) => {
+        if (written || !sink)
+            return;
+        written = true;
+        const socket = client;
+        const allowed = fields.outcome === "allowed";
+        const durationMs = Math.max(0, Date.now() - at.startedAt.getTime());
+        const connection = (turns) => ({
+            environmentId: at.environmentId,
+            host: at.host,
+            port: at.port,
+            ...fields,
+            mode: record.credentialBound ? "credential" : "tunnel",
+            credentialBound: record.credentialBound,
+            // Up is what the sandbox sent after its CONNECT, down what it got after the gate's 200.
+            bytesUp: allowed ? Math.max(0, (socket.bytesRead ?? 0) - at.upFrom) : 0,
+            bytesDown: allowed ? Math.max(0, (socket.bytesWritten ?? 0) - CONNECT_ESTABLISHED.length) : 0,
+            durationMs,
+            startedAt: at.startedAt.toISOString(),
+            runningTurns: [...turns],
+        });
+        runningTurns(sink)
+            .then((turns) => sink.write(connection(turns)))
+            .catch((error) => logger.error("egress_record_failed", {
+            sandboxId: at.environmentId,
+            host: at.host,
+            error: error instanceof Error ? error.message : String(error),
+        }));
+    };
+    const record = {
+        credentialBound: false,
+        // A failed read is logged when the write needs it.
+        opened: () => void (sink && runningTurns(sink).catch(() => undefined)),
+        refused: (status, reason) => write({ outcome: "refused", reason, status }),
+        closed: (tally) => write({
+            outcome: "allowed",
+            ...(tally ? { requests: tally.requests, credentialIds: [...tally.credentialIds] } : {}),
+        }),
+    };
+    return record;
+}
 export async function startEgressGate(options) {
     const { logger, sandboxes } = options;
     const idleMs = options.idleMs ?? EGRESS_IDLE_MS;
@@ -160,11 +217,17 @@ export async function startEgressGate(options) {
         : undefined;
     const open = new Map();
     const tunnels = new Set();
+    /** Each connection's record, once its Environment and target are known. */
+    const records = new WeakMap();
     async function onConnect(req, client, head) {
+        const startedAt = new Date();
+        // What the sandbox sent before the tunnel: its CONNECT, less the bytes after it (`head`).
+        const upFrom = (client.bytesRead ?? 0) - head.length;
         const target = parseTarget(req.url);
         const refuse = (status, reason, fields = {}, message) => {
             logger.warn("egress_refused", { status, reason, ...(target ? { host: target.host, port: target.port } : {}), ...fields });
             answer(client, status, message ?? reason, status === 407 ? ['proxy-authenticate: Basic realm="nylorun-egress"'] : []);
+            records.get(client)?.refused(status, reason);
         };
         const raw = proxyToken(req.headers["proxy-authorization"]);
         if (!raw)
@@ -183,12 +246,22 @@ export async function startEgressGate(options) {
         if (!target)
             return refuse(403, "target_invalid", { sandboxId }, "CONNECT needs host:port");
         const { host, port } = target;
+        const record = connectionRecord(options.record, logger, client, {
+            environmentId: sandboxId,
+            host,
+            port,
+            startedAt,
+            upFrom,
+        });
+        records.set(client, record);
         if (!EGRESS_PORTS.includes(port))
             return refuse(403, "port_refused", { sandboxId }, `port ${port} is not allowed; tunnels open to 443 or 80 only`);
         if (isIP(host.replace(/^\[|\]$/g, "")) !== 0 || !isSandboxHostPattern(host) || host.startsWith("*."))
             return refuse(403, "not_a_host_name", { sandboxId }, `${host} is not a host name; IP literals are refused`);
         if (!egressAllows(host, sandbox.allow))
             return refuse(403, "host_not_allowed", { sandboxId }, `${host} is not in this sandbox's network.allow`);
+        // The turns running on the Environment as the connection opens, read while the name resolves.
+        record.opened();
         let mine = open.get(sandboxId);
         if (!mine)
             open.set(sandboxId, (mine = new Set()));
@@ -217,10 +290,13 @@ export async function startEgressGate(options) {
         if (client.destroyed)
             return;
         if (terminator && port === 443 && (await options.credentials.bound(sandboxId, host))) {
+            record.credentialBound = true;
             // A client that spoke before the 200 is not one this path serves.
             if (head.length > 0)
                 return refuse(403, "early_data", { sandboxId }, "wait for the CONNECT answer before sending");
-            return terminator.terminate(client, { sandboxId, host, addresses: allowed });
+            const tally = { requests: 0, credentialIds: new Set() };
+            client.once("close", () => record.closed(tally));
+            return terminator.terminate(client, { sandboxId, host, addresses: allowed, tally });
         }
         const upstream = await dialFirst(allowed.map((entry) => entry.address), port);
         if (!upstream)
@@ -237,8 +313,11 @@ export async function startEgressGate(options) {
         upstream.on("timeout", close);
         upstream.on("error", close);
         upstream.on("close", () => client.destroy());
-        client.on("close", () => upstream.destroy());
-        client.write("HTTP/1.1 200 Connection Established\r\n\r\n");
+        client.on("close", () => {
+            upstream.destroy();
+            record.closed();
+        });
+        client.write(CONNECT_ESTABLISHED);
         if (head.length > 0)
             upstream.write(head);
         upstream.pipe(client);
@@ -284,6 +363,7 @@ export async function startEgressGate(options) {
         onConnect(req, client, head).catch((error) => {
             logger.error("egress_failed", { error: error instanceof Error ? error.message : String(error) });
             answer(client, 502, "the tunnel failed");
+            records.get(client)?.refused(502, "egress_failed");
         });
     });
     server.on("clientError", (_error, socket) => {
@@ -311,22 +391,48 @@ export async function startEgressGate(options) {
 /**
  * `EgressSandboxes` over the Tenant's `sandbox_resources` (one indexed read): a pod sandbox's
  * host epoch, the pod that joined at it and its spec's allowlist; nothing for a virtual
- * sandbox, or one deleted, lost or expired, as `staleHost` judges a host token.
+ * Environment, or one deleted or lost, as `staleHost` judges a host token.
  */
 export function storeEgressSandboxes(store) {
     return {
         async live(sandboxId) {
-            const sandbox = await store.tx((t) => t.sandboxResource(sandboxId));
+            const sandbox = await store.tx((t) => t.environment(sandboxId));
             const pod = sandbox?.pod;
             if (!sandbox || sandbox.kind !== "pod" || !pod)
                 return undefined;
-            if (pod.desired === "deleted" || pod.observed === "lost" || pod.observed === "expired")
+            if (pod.desired === "deleted" || pod.observed === "lost")
                 return undefined;
             return {
                 epoch: pod.hostEpoch,
                 ...(pod.podUid ? { podUid: pod.podUid } : {}),
-                allow: sandbox.spec.network?.allow ?? [],
+                // The applied allowlist: a recipe change writes it at once (Q8).
+                allow: sandbox.applied.network?.allowedHosts ?? [],
             };
         },
     };
 }
+/**
+ * `EgressRecord` over the Tenant's record (R7.3, D67). The running turns are the sessions on the
+ * Environment whose body has an `activeTurnId`, in id order, at most `EGRESS_RUNNING_TURNS_MAX`.
+ * The write is `environment.egress` on the Environment's stream, under its row's lock; a deleted
+ * Environment gets nothing.
+ */
+export function storeEgressRecord(store) {
+    return {
+        async runningTurns(environmentId) {
+            const sessions = await store.tx((t) => t.sessionsOnEnvironment(environmentId));
+            return sessions
+                .filter((session) => typeof session.activeTurnId === "string")
+                .map((session) => ({ sessionId: session.id, turnId: session.activeTurnId }))
+                .sort((a, b) => (a.sessionId < b.sessionId ? -1 : a.sessionId > b.sessionId ? 1 : 0))
+                .slice(0, EGRESS_RUNNING_TURNS_MAX);
+        },
+        async write(connection) {
+            await store.tx(async (t) => {
+                if (!(await t.environment(connection.environmentId, { lock: true })))
+                    return;
+                await t.environmentEvent(connection.environmentId, "environment.egress", connection);
+            });
+        },
+    };
+}

package/dist/gates/fixture-model.d.ts

@@ -0,0 +1,28 @@
+/**
+ * The fixture model (R4.3): a deterministic, scripted model the Model Gate answers with when the
+ * Tenant's setting `model.fixture` is on (`PUT /v1/tenant/config/seed {fixtureModel: true}`).
+ * The gate answers it itself, metered like any model (a `model_usage` row per call, provider
+ * `fixture`, tokens counted from the text, cost 0), so every harness that calls the gate is seen
+ * the same way: ours, and one written from the published contract.
+ *
+ * What it answers is read from the call: the last user message and the offered tools.
+ * - `fixture:text`: one text answer, `fixture ok`.
+ * - `fixture:tool <name> <json>`: one call of the offered tool `<name>` with `<json>` as its
+ *   arguments; once the tool's result is in the prompt, a text answer that quotes it.
+ * - `fixture:unoffered <name> <json>`: the same call of a tool `<name>` the call does *not*
+ *   offer (a model that names a tool it was never given), for the check that such a call runs
+ *   nothing; once a result is in the prompt, a text answer that quotes it.
+ * - `fixture:budget`: a `budget_exhausted` failure.
+ * - `fixture:slow <seconds>`: a text answer after that long (at most 60 s), or nothing once
+ *   the call is aborted, for cancel checks.
+ * - Anything else keeps the release demo: with a `lookup_order` tool it looks up order
+ *   `demo-123` once, then answers with the result; on a later user message it says what the
+ *   first one was; otherwise it says hello.
+ */
+import type { ModelCandidate, ModelFailureOutcome } from "@nylorun/core/harness-api";
+import type { RuntimeModelCall } from "../contracts.js";
+export declare const FIXTURE_PROVIDER = "fixture";
+type Answer = ModelCandidate | ModelFailureOutcome;
+/** The fixture model's answer to `call`. */
+export declare function fixtureAnswer(call: RuntimeModelCall, signal?: AbortSignal): Promise<Answer>;
+export {};

package/dist/gates/fixture-model.js

@@ -0,0 +1,92 @@
+export const FIXTURE_PROVIDER = "fixture";
+const MARKER = /^fixture:(\w+)(?:\s+([\s\S]*))?$/;
+/** The fixture model's answer to `call`. */
+export async function fixtureAnswer(call, signal) {
+    const last = call.prompt.at(-1);
+    const users = call.prompt.filter((item) => item.kind === "message" && item.role === "user");
+    const marker = MARKER.exec(textOf(users.at(-1)?.content ?? []).trim());
+    if (marker)
+        return scripted(call, marker[1], marker[2]?.trim() ?? "", last, signal);
+    if (last?.kind === "tool-result")
+        return candidate(call, `Order lookup complete: ${textOf(last.content, true)}`);
+    if (users.length > 1)
+        return candidate(call, `I remember: ${textOf(users[0].content)}`);
+    if (!call.tools.some((tool) => tool.name === "lookup_order"))
+        return candidate(call, "Hello from the fixture model.");
+    return candidate(call, [{ type: "tool-call", id: "fixture_lookup", name: "lookup_order", args: { orderId: "demo-123" } }]);
+}
+async function scripted(call, kind, rest, last, signal) {
+    switch (kind) {
+        case "text":
+            return candidate(call, "fixture ok");
+        case "tool":
+        case "unoffered": {
+            if (last?.kind === "tool-result")
+                return candidate(call, `fixture tool ${last.status}: ${textOf(last.content, true)}`);
+            const space = rest.indexOf(" ");
+            const name = space < 0 ? rest : rest.slice(0, space);
+            const offered = call.tools.some((tool) => tool.name === name);
+            if (kind === "tool" && !offered)
+                return candidate(call, `fixture: no tool ${name} is offered`);
+            if (kind === "unoffered" && offered)
+                return candidate(call, `fixture: tool ${name} is offered`);
+            let args = {};
+            try {
+                if (space >= 0)
+                    args = JSON.parse(rest.slice(space + 1));
+            }
+            catch {
+                return candidate(call, "fixture: the tool arguments are not JSON");
+            }
+            if (typeof args !== "object" || args === null || Array.isArray(args))
+                return candidate(call, "fixture: the tool arguments are not an object");
+            return candidate(call, [{ type: "tool-call", id: "fixture_call", name, args: args }]);
+        }
+        case "budget":
+            return {
+                kind: "failed",
+                code: "budget_exhausted",
+                message: "The fixture model's budget is exhausted (fixture:budget)",
+                retryable: false,
+            };
+        case "slow": {
+            const seconds = Math.min(Math.max(Number(rest) || 0, 0), 60);
+            await sleep(seconds * 1000, signal);
+            return candidate(call, `fixture slept ${seconds} s`);
+        }
+        default:
+            return candidate(call, `fixture: unknown marker ${kind}`);
+    }
+}
+function candidate(call, output) {
+    const blocks = typeof output === "string" ? [{ type: "text", text: output }] : output;
+    const inputTokens = tokens(JSON.stringify(call.prompt));
+    const outputTokens = tokens(JSON.stringify(blocks));
+    return {
+        output: blocks,
+        finishReason: blocks.some((block) => block.type === "tool-call") ? "tool-calls" : "stop",
+        usage: { inputTokens, outputTokens, totalTokens: inputTokens + outputTokens, costUsd: 0 },
+        evidence: {
+            resolvedModel: FIXTURE_PROVIDER,
+            extras: { producer: { provider: FIXTURE_PROVIDER, model: FIXTURE_PROVIDER }, costKnown: true },
+        },
+    };
+}
+/** About four characters a token, at least one. */
+const tokens = (text) => Math.max(1, Math.ceil(text.length / 4));
+function textOf(content, json = false) {
+    return content
+        .map((part) => (part.type === "text" ? (part.text ?? "") : json ? JSON.stringify(part) : ""))
+        .join(" ");
+}
+function sleep(ms, signal) {
+    return new Promise((resolve, reject) => {
+        if (signal?.aborted)
+            return reject(signal.reason);
+        const timer = setTimeout(resolve, ms);
+        signal?.addEventListener("abort", () => {
+            clearTimeout(timer);
+            reject(signal.reason);
+        }, { once: true });
+    });
+}

package/dist/gates/handler.js

@@ -1,12 +1,12 @@
 /**
  * Serves one model call in the gates service: opens the Tenant's vault (the database's one
- * Tenant; a call naming another is refused) and calls the model
- * through `inProcessModelGate`, the same code the loop ran before the gate, so outcomes,
+ * Tenant; a call naming another is refused) and calls the model (the fixture model while the
+ * Tenant's `model.fixture` is on, R4.3) through `inProcessModelGate`, the same code the loop ran before the gate, so outcomes,
  * retries, classification and redaction are unchanged. The meter records the call's usage in
  * the Tenant's ledger. Logs one line per call, never the prompt, the output or a credential.
  */
 import { classifyThrown } from "../model/classify.js";
-import { callFiles, inProcessModelGate } from "./in-process.js";
+import { callFiles, inProcessModelGate, serve } from "./in-process.js";
 import { createMeter } from "./meter.js";
 import { GateRefusal } from "./tenant-vaults.js";
 export function createModelCallHandler(options) {
@@ -28,7 +28,7 @@ export function createModelCallHandler(options) {
                     ...(settings ? { settings } : {}),
                     ...(blobs ? { files: callFiles(vault.store, blobs) } : {}),
                 });
-                outcome = await meter.call(vault.store, call, () => gate.call(call, signal));
+                outcome = await meter.call(vault.store, call, () => serve(vault.store, gate, call, signal));
             }
             catch (error) {
                 if (signal.aborted) {