@nylorun/runtime 0.23.0-beta → 0.25.0-beta

package/dist/gates/tool-calls.d.ts

@@ -8,10 +8,14 @@
  * - The gate also writes a `tool_crossings` row before it calls the server, and the answer
  *   after. A re-send that finds the answer gets it. One that finds a row without an answer,
  *   for a call this gateway is not running, was lost with an earlier gateway (a restart mid
- *   call): it answers `uncertain`, because the call may have run, and is never run again.
+ *   call): it is started again under the same key (R5.3), so the tool sees the key twice and
+ *   a tool that honors it acts once. Core counts the sends and stops at its cap (R5.4).
+ * - A re-send that another gateway process started or settled between this one's read and its
+ *   write answers `{uncertain: true}`: not answered here, so the caller sends it again later.
  *
- * A cancel aborts the call and leaves its row without an answer. Settled rows are deleted a day
- * later (`prune`).
+ * A cancel aborts the call and settles its row as cancelled: it never runs again under its key.
+ * A shutdown leaves the row open, so the next gateway starts it again. Settled rows are deleted
+ * a day later (`prune`); a re-send after that runs the call again, which at least once allows.
  */
 import type { Logger } from "../tenant/types.js";
 import { type InflightCallsOptions, type InflightOwner } from "./inflight.js";
@@ -29,8 +33,9 @@ export interface ToolCalls {
      */
     run(tenantId: string | undefined, key: string, hash: string, call: (signal: AbortSignal) => Promise<ToolCallAnswer>, owner?: InflightOwner): Promise<ToolCallAnswer>;
     /**
-     * Aborts the call under `key`; it is never run again under that key. With `sessionId`, false
-     * when the running call is another session's (nothing is aborted).
+     * Aborts the call under `key` and settles its crossing as cancelled: it is never run again
+     * under that key. With `sessionId`, false when the running call is another session's (nothing
+     * is aborted).
      */
     cancel(key: string, sessionId?: string): boolean;
     /** Aborts every running call (gateway shutdown). */

package/dist/gates/tool-calls.js

@@ -1,11 +1,15 @@
 import { createInflightCalls, InflightConflict, } from "./inflight.js";
 /** How long a settled crossing is kept. */
 export const TOOL_CROSSING_TTL_MS = 24 * 60 * 60_000;
-const LOST = {
+const CANCELLED = {
+    ok: false,
+    error: { message: "The call was cancelled while it ran; it may have reached its server" },
+};
+const ELSEWHERE = {
     ok: false,
     error: {
         uncertain: true,
-        message: "The gateway stopped while this tool call ran; the call may have reached its server, so it is not run again",
+        message: "Another gateway process is running this tool call; send it again",
     },
 };
 export function createToolCalls(options) {
@@ -16,7 +20,7 @@ export function createToolCalls(options) {
     return {
         async run(tenantId, key, hash, call, owner) {
             if (inflight.has(key))
-                return inflight.run(key, hash, () => Promise.resolve(LOST), owner);
+                return inflight.run(key, hash, () => Promise.resolve(ELSEWHERE), owner);
             const vault = await vaults.open(tenantId);
             const store = vault.store;
             const row = await store.tx((t) => t.toolCrossing(key));
@@ -25,16 +29,19 @@ export function createToolCalls(options) {
                     throw new InflightConflict(`A different request already ran under ${key}`);
                 if (row.answer !== null && row.answer !== undefined)
                     return row.answer;
-                // Started here a moment ago, or lost with an earlier gateway.
+                // Started here a moment ago: join it.
                 if (inflight.has(key))
-                    return inflight.run(key, hash, () => Promise.resolve(LOST), owner);
-                return LOST;
+                    return inflight.run(key, hash, () => Promise.resolve(ELSEWHERE), owner);
+                // Otherwise it was lost with an earlier gateway: it starts again below (R5.3).
             }
             return inflight.run(key, hash, async (signal) => {
-                const started = await store.tx((t) => t.startToolCrossing({ key, hash, startedAt: iso() }));
-                // Another gateway process wrote it between the read and now: never run it twice.
+                const startedAt = iso();
+                const started = await store.tx((t) => row
+                    ? t.restartToolCrossing({ key, hash, startedAt })
+                    : t.startToolCrossing({ key, hash, startedAt }));
+                // Another gateway process started or settled it between the read and now.
                 if (!started)
-                    return LOST;
+                    return ELSEWHERE;
                 const answer = await call(signal);
                 // A cancel or a shutdown: the call may have reached the server; the row stays open.
                 if (signal.aborted)
@@ -48,7 +55,18 @@ export function createToolCalls(options) {
                 return answer;
             }, owner);
         },
-        cancel: (key, sessionId) => inflight.cancel(key, sessionId),
+        cancel(key, sessionId) {
+            if (!inflight.cancel(key, sessionId))
+                return false;
+            void vaults
+                .open(undefined)
+                .then((vault) => vault.store.tx((t) => t.settleToolCrossing(key, CANCELLED, iso())))
+                .catch((error) => logger.warn("tool_crossing_unsettled", {
+                effect: key,
+                message: error instanceof Error ? error.message : String(error),
+            }));
+            return true;
+        },
         close: () => inflight.close(),
         async prune() {
             try {

package/dist/gates/tool-client.d.ts

@@ -1,5 +1,13 @@
 import type { ToolGate } from "./tool-gate.js";
 import type { RunTokens } from "../tenant/run-grants.js";
+/**
+ * A keyed call whose answer the hop lost (R5.3): the gate never got it, the connection broke,
+ * the gate answered `5xx`, or another gateway process holds the call. Sending it again with the
+ * same key is safe: the gate joins the call, answers it from its crossing, or runs it again.
+ */
+export declare class GateCallLost extends Error {
+    readonly name = "GateCallLost";
+}
 export interface HttpToolGateOptions {
     /** The gates service, e.g. `http://gateway:4100` (`NYLORUN_GATES_URL`). */
     readonly url: string;

package/dist/gates/tool-client.js

@@ -8,10 +8,12 @@
  * Failures keep the meaning they had in the loop's own process:
  * - An MCP request that fails throws, so the pool reports a diagnostic. A tool call's coded
  *   failure (R2b C7) throws the `McpCallFailed` the loop's own call would have, which becomes a
- *   failed outcome the model sees. Only the hop's failures and a call lost with the gateway leave
- *   it `uncertain`.
- * - An HTTP tool call throws only for the hop, or a call lost with the gateway: its own failures
- *   are outcomes.
+ *   failed outcome the model sees.
+ * - An HTTP tool call throws only for the hop: its own failures are outcomes.
+ * - A hop that lost the answer (the gate unreachable, the connection lost, a `5xx`, or a call
+ *   another gateway process holds) throws `GateCallLost`: sending the call again with the same
+ *   key joins it, collects its answer, or runs it again (R5.3). A gate's refusal (`4xx`) throws
+ *   a plain error.
  *
  * Credentials (F5): a session's MCP requests and keyed cancels carry its run token, read per
  * request from the advance's grant, and leave the session out of the body: the gate takes it
@@ -26,6 +28,14 @@ import { McpCallFailed, } from "../mcp/connect.js";
 import { TENANT_HEADER } from "./contract.js";
 import { GATE_CLIENT_TIMEOUT_MS } from "./http-client.js";
 import { HTTP_CALLS_PATH, MCP_CLOSE_PATH, MCP_CONNECT_PATH, MCP_LIST_PATH, TOOL_CALLS_PATH, } from "./tool-contract.js";
+/**
+ * A keyed call whose answer the hop lost (R5.3): the gate never got it, the connection broke,
+ * the gate answered `5xx`, or another gateway process holds the call. Sending it again with the
+ * same key is safe: the gate joins the call, answers it from its crossing, or runs it again.
+ */
+export class GateCallLost extends Error {
+    name = "GateCallLost";
+}
 /** How long a close or a cancel may take; neither changes an outcome. */
 const SHORT_TIMEOUT_MS = 2_000;
 export function httpToolGate(options) {
@@ -111,8 +121,7 @@ export function httpToolGate(options) {
     }
     /**
      * The answer of an MCP or HTTP tool request, or a throw: a coded MCP failure (`McpCallFailed`),
-     * or one the pool and `resolveEffect` read as before, the call's fate unknown and the effect
-     * `uncertain`.
+     * a lost hop (`GateCallLost`, sent again), or a gate's refusal.
      */
     async function answer(path, scope, request) {
         const result = await exchange(path, scope.body, {
@@ -123,8 +132,10 @@ export function httpToolGate(options) {
         if (result.kind === "aborted")
             throw result.reason ?? new Error("aborted");
         if (result.kind !== "answer")
-            throw new Error(result.message);
+            throw new GateCallLost(result.message);
         const parsed = parse(result.text);
+        if (result.status >= 500)
+            throw new GateCallLost(gateRefusal(result.status, parsed));
         if (result.status !== 200 || !parsed || !("ok" in parsed))
             throw new Error(gateRefusal(result.status, parsed));
         if (parsed.ok)
@@ -176,7 +187,9 @@ export function httpToolGate(options) {
         async callHttp(call, signal) {
             const token = options.runTokens?.token(call.tool.sessionId);
             const { sessionId: _, ...unnamed } = call.tool;
-            const body = { ...call, tool: token ? unnamed : { ...call.tool } };
+            // The gate reads the call's span context from its journal row (R7.4), not from the caller.
+            const { traceparent: _traceparent, ...sent } = call;
+            const body = { ...sent, tool: token ? unnamed : { ...call.tool } };
             return answered(HTTP_CALLS_PATH, { body, ...(token ? { bearer: token } : {}) }, { signal, idempotencyKey: call.effectId });
         },
         async cancel(request) {
@@ -190,10 +203,13 @@ export function httpToolGate(options) {
 }
 /** An MCP failure the gate reported, as the loop's own MCP code would have thrown it. */
 function mcpError(error) {
-    // Coded (R2b C7): the model sees it. A call lost with the gateway never is.
-    if (error.failure && !error.uncertain)
+    // Held by another gateway process: send it again (R5.3).
+    if (error.uncertain)
+        return new GateCallLost(error.message);
+    // Coded (R2b C7): the model sees it.
+    if (error.failure)
         return McpCallFailed.from(error.failure);
-    const thrown = new Error(error.uncertain ? `${error.message} (the call may have run; it is not sent again)` : error.message);
+    const thrown = new Error(error.message);
     if (error.code !== undefined)
         thrown.code = error.code;
     if (error.credentialIds !== undefined)

package/dist/gates/tool-contract.d.ts

@@ -1,7 +1,7 @@
 /**
  * The Tool Gate's wire format (blueprint §12, F4.1): the routes the loop calls on the gates
- * service for remote MCP servers and HTTP tools. Internal, like the model call route
- * (`contract.ts`): same optional Tenant header, not in the published OpenAPI documents.
+ * service for remote MCP servers and HTTP tools. Like the model call route (`contract.ts`): same
+ * optional Tenant header, bodies published in `@nylorun/core/harness-api` (R4.5).
  *
  * Credentials (F5). A session's MCP requests carry its run token, and the gate takes the
  * session from it: `server.sessionId` is then absent (or the token's). Core's credential
@@ -25,78 +25,21 @@
  * answer, not a gate error. A tool call's failure is coded (`error.failure`, R2b C7), and neither
  * a result nor a failure carries a credential value the gate sent (C8). An answer past 8 MiB is
  * `mcp.too-large` (C11), as an HTTP tool's is `http.too-large`; core shapes what fits into a
- * result the model can take (`tenant/tool-results.ts`). A keyed call whose
- * earlier attempt was lost with the gateway answers `{ok: false, error: {uncertain: true}}` and
- * is never run again.
+ * result the model can take (`tenant/tool-results.ts`). A keyed call whose earlier attempt was
+ * lost with the gateway runs again under the same key (R5.3); one another gateway process holds
+ * answers `{ok: false, error: {uncertain: true}}`, and the caller sends it again.
  *
  * HTTP tools (R2 M3). `POST /nylorun/v1/http-calls` `{tool, effectId, turnId, input}`: one call
- * of an HTTP tool. The loop names the tool (`{sessionId?, agentId?, capabilityId, toolName}`), or a
+ * of an HTTP tool. The loop names the tool (`{sessionId?, agentId?, toolName}`), or a
  * flow's HTTP stage or HTTP verifier by its stage key (`{sessionId?, stage}`); the gate finds its
  * URL, method and credential in the session's pinned manifest
  * (`gates/http-tool.ts`). A run token's turn is the call's; `turnId` counts only under core's
  * credential. Keyed like a tool call, and cancelled by the same route. It answers
  * `200 {ok: true, result}` with the tool outcome (a failed request is a failed outcome the
- * model sees), or `{ok: false, error: {uncertain: true}}` for a call lost with the gateway.
+ * model sees), or `{ok: false, error: {uncertain: true}}` for a call another gateway process holds.
  */
-import { z } from "zod";
 import type { McpCallFailure } from "../mcp/connect.js";
-export declare const MCP_CONNECT_PATH = "/nylorun/v1/mcp/connect";
-export declare const MCP_LIST_PATH = "/nylorun/v1/mcp/list";
-export declare const MCP_CLOSE_PATH = "/nylorun/v1/mcp/close";
-export declare const TOOL_CALLS_PATH = "/nylorun/v1/tool-calls";
-export declare const HTTP_CALLS_PATH = "/nylorun/v1/http-calls";
-/** Largest tool call body the gate reads. */
-export declare const MAX_TOOL_BODY_BYTES: number;
-export declare const McpServerRefSchema: z.ZodObject<{
-    sessionId: z.ZodOptional<z.ZodString>;
-    agentId: z.ZodOptional<z.ZodString>;
-    capabilityId: z.ZodString;
-    serverName: z.ZodString;
-}, z.core.$strip>;
-export declare const McpServerBodySchema: z.ZodObject<{
-    server: z.ZodObject<{
-        sessionId: z.ZodOptional<z.ZodString>;
-        agentId: z.ZodOptional<z.ZodString>;
-        capabilityId: z.ZodString;
-        serverName: z.ZodString;
-    }, z.core.$strip>;
-}, z.core.$strip>;
-export declare const McpListBodySchema: z.ZodObject<{
-    server: z.ZodObject<{
-        sessionId: z.ZodOptional<z.ZodString>;
-        agentId: z.ZodOptional<z.ZodString>;
-        capabilityId: z.ZodString;
-        serverName: z.ZodString;
-    }, z.core.$strip>;
-    cursor: z.ZodOptional<z.ZodString>;
-}, z.core.$strip>;
-export declare const ToolCallBodySchema: z.ZodObject<{
-    server: z.ZodObject<{
-        sessionId: z.ZodOptional<z.ZodString>;
-        agentId: z.ZodOptional<z.ZodString>;
-        capabilityId: z.ZodString;
-        serverName: z.ZodString;
-    }, z.core.$strip>;
-    effectId: z.ZodString;
-    name: z.ZodString;
-    arguments: z.ZodRecord<z.ZodString, z.ZodUnknown>;
-}, z.core.$strip>;
-export type ToolCallBody = z.infer<typeof ToolCallBodySchema>;
-export declare const HttpCallBodySchema: z.ZodObject<{
-    tool: z.ZodUnion<readonly [z.ZodObject<{
-        sessionId: z.ZodOptional<z.ZodString>;
-        agentId: z.ZodOptional<z.ZodString>;
-        capabilityId: z.ZodString;
-        toolName: z.ZodString;
-    }, z.core.$strip>, z.ZodObject<{
-        sessionId: z.ZodOptional<z.ZodString>;
-        stage: z.ZodString;
-    }, z.core.$strip>]>;
-    effectId: z.ZodString;
-    turnId: z.ZodString;
-    input: z.ZodUnknown;
-}, z.core.$strip>;
-export type HttpCallBody = z.infer<typeof HttpCallBodySchema>;
+export { HTTP_CALLS_PATH, HttpCallBodySchema, MAX_TOOL_BODY_BYTES, MCP_CLOSE_PATH, MCP_CONNECT_PATH, MCP_LIST_PATH, McpListBodySchema, McpServerBodySchema, McpServerRefSchema, TOOL_CALLS_PATH, ToolCallBodySchema, type HttpCallBody, type ToolCallBody, } from "@nylorun/core/harness-api";
 /** Why an MCP request failed, as the loop's diagnostics read it (`mcp/connect.ts`). */
 export interface McpGateError {
     readonly message: string;
@@ -104,13 +47,12 @@ export interface McpGateError {
     readonly code?: number;
     /** The vault credentials a refused authorization names. */
     readonly credentialIds?: readonly string[];
-    /** The call may have run: its earlier attempt was lost with the gateway. Never re-run. */
+    /** Not answered here: another gateway process holds the keyed call. Send it again (R5.3). */
     readonly uncertain?: boolean;
     /**
      * How the request failed, coded (R2b C1, C7): the loop's `McpCallFailed`, which a tool call
-     * turns into a failed outcome the model sees (`mcp.lost` only for a read-only or idempotent
-     * tool). `credential_rejected` for a `401`, with the server and the scope of the vault whose
-     * credential was sent. Its message has no credential value in it (C8).
+     * turns into a failed outcome the model sees (`mcp.lost` included). `credential_rejected` for a
+     * `401`, with the server. Its message has no credential value in it (C8).
      */
     readonly failure?: McpCallFailure;
 }

package/dist/gates/tool-contract.js

@@ -1,85 +1 @@
-/**
- * The Tool Gate's wire format (blueprint §12, F4.1): the routes the loop calls on the gates
- * service for remote MCP servers and HTTP tools. Internal, like the model call route
- * (`contract.ts`): same optional Tenant header, not in the published OpenAPI documents.
- *
- * Credentials (F5). A session's MCP requests carry its run token, and the gate takes the
- * session from it: `server.sessionId` is then absent (or the token's). Core's credential
- * (`NYLORUN_GATES_TOKEN`) is accepted too, for requests made outside a run, and then
- * `server.sessionId` names the session.
- *
- * Remote MCP. The gate holds the connection and the vault credential; the loop names the
- * server, never a URL or a credential, and the gate finds it in the session's pinned manifest.
- * - `POST /nylorun/v1/mcp/connect` `{server}`: opens the server's connection (vault
- *   authorization included), or keeps the open one. Its result is `{instructions}` when the
- *   server gave instructions at `initialize` (R2b C10, for the note on its deferred tools), else
- *   `null`.
- * - `POST /nylorun/v1/mcp/list` `{server, cursor?}`: one page of `tools/list`.
- * - `POST /nylorun/v1/tool-calls` `{server, effectId, name, arguments}`: one
- *   `tools/call`. With an `Idempotency-Key` (the effect id) the call outlives its client and runs
- *   once (G3); a re-send joins it or gets its outcome.
- * - `POST /nylorun/v1/tool-calls/{key}/cancel`: aborts a keyed call; `204` either way, `403
- *   gate_forbidden` for another session's call under a run token.
- * - `POST /nylorun/v1/mcp/close` `{server}`: closes the server's connection; `204`.
- * Each answers `200 {ok: true, result}` or `200 {ok: false, error}`: an MCP failure is an
- * answer, not a gate error. A tool call's failure is coded (`error.failure`, R2b C7), and neither
- * a result nor a failure carries a credential value the gate sent (C8). An answer past 8 MiB is
- * `mcp.too-large` (C11), as an HTTP tool's is `http.too-large`; core shapes what fits into a
- * result the model can take (`tenant/tool-results.ts`). A keyed call whose
- * earlier attempt was lost with the gateway answers `{ok: false, error: {uncertain: true}}` and
- * is never run again.
- *
- * HTTP tools (R2 M3). `POST /nylorun/v1/http-calls` `{tool, effectId, turnId, input}`: one call
- * of an HTTP tool. The loop names the tool (`{sessionId?, agentId?, capabilityId, toolName}`), or a
- * flow's HTTP stage or HTTP verifier by its stage key (`{sessionId?, stage}`); the gate finds its
- * URL, method and credential in the session's pinned manifest
- * (`gates/http-tool.ts`). A run token's turn is the call's; `turnId` counts only under core's
- * credential. Keyed like a tool call, and cancelled by the same route. It answers
- * `200 {ok: true, result}` with the tool outcome (a failed request is a failed outcome the
- * model sees), or `{ok: false, error: {uncertain: true}}` for a call lost with the gateway.
- */
-import { z } from "zod";
-export const MCP_CONNECT_PATH = "/nylorun/v1/mcp/connect";
-export const MCP_LIST_PATH = "/nylorun/v1/mcp/list";
-export const MCP_CLOSE_PATH = "/nylorun/v1/mcp/close";
-export const TOOL_CALLS_PATH = "/nylorun/v1/tool-calls";
-export const HTTP_CALLS_PATH = "/nylorun/v1/http-calls";
-/** Largest tool call body the gate reads. */
-export const MAX_TOOL_BODY_BYTES = 8 * 1024 * 1024;
-export const McpServerRefSchema = z.object({
-    /** Required with core's credential; a run token names the session itself. */
-    sessionId: z.string().min(1).optional(),
-    agentId: z.string().min(1).optional(),
-    capabilityId: z.string().min(1),
-    serverName: z.string().min(1),
-});
-export const McpServerBodySchema = z.object({ server: McpServerRefSchema });
-export const McpListBodySchema = z.object({
-    server: McpServerRefSchema,
-    cursor: z.string().optional(),
-});
-export const ToolCallBodySchema = z.object({
-    server: McpServerRefSchema,
-    effectId: z.string().min(1),
-    name: z.string().min(1),
-    arguments: z.record(z.string(), z.unknown()),
-});
-export const HttpCallBodySchema = z.object({
-    tool: z.union([
-        z.object({
-            /** Required with core's credential; a run token names the session itself. */
-            sessionId: z.string().min(1).optional(),
-            agentId: z.string().min(1).optional(),
-            capabilityId: z.string().min(1),
-            toolName: z.string().min(1),
-        }),
-        z.object({
-            sessionId: z.string().min(1).optional(),
-            /** A flow's HTTP stage or HTTP verifier. */
-            stage: z.string().min(1),
-        }),
-    ]),
-    effectId: z.string().min(1),
-    turnId: z.string().min(1),
-    input: z.unknown(),
-});
+export { HTTP_CALLS_PATH, HttpCallBodySchema, MAX_TOOL_BODY_BYTES, MCP_CLOSE_PATH, MCP_CONNECT_PATH, MCP_LIST_PATH, McpListBodySchema, McpServerBodySchema, McpServerRefSchema, TOOL_CALLS_PATH, ToolCallBodySchema, } from "@nylorun/core/harness-api";

package/dist/gates/tool-gate.d.ts

@@ -28,7 +28,7 @@ export interface ToolGate {
     /**
      * True when a keyed MCP or HTTP tool call outlives the caller's process (the gates service,
      * G3): after a takeover or a shutdown, re-sending it joins the call or returns its outcome,
-     * and a call lost with the gateway answers `uncertain` instead of running again.
+     * and a call lost with the gateway runs again under the same key (R5.3).
      */
     readonly recovers?: boolean;
     /** Stops a keyed tool call that outlives its caller (a user cancel). Never rejects. */

package/dist/harness/calls.d.ts

@@ -26,7 +26,7 @@ export interface ToolRouting {
     readonly mcpSnapshot?: McpSnapshot;
     /** The session that owns the tree's sandbox, and the sandbox resource it is attached to. */
     readonly sandboxOwnerId: string;
-    readonly sandboxId?: string;
+    readonly environmentId?: string;
     /** Variables every sandbox command gets (R2c): secret names set to the sentinel, plain values. */
     readonly environment?: Readonly<Record<string, string>>;
     readonly activeTurnId: string | null;
@@ -36,9 +36,12 @@ export interface ToolRouting {
 /**
  * Call the model for one effect. A provider failure comes back as a failure outcome
  * (Model Calls §6), whichever provider serves the call; only an abort throws, and the
- * advance decides what the abort means.
+ * advance decides what the abort means. `atGate` sends the call to the Model Gate even when the
+ * Tenant's model is not from the vault: the Tenant's fixture model is answered there (R4.3).
  */
-export declare function invokeModel(route: ModelRoute, request: HostEffect, signal: AbortSignal, model?: ModelProvider): Promise<unknown>;
+export declare function invokeModel(route: ModelRoute, request: HostEffect, signal: AbortSignal, options?: {
+    readonly atGate?: boolean;
+}): Promise<unknown>;
 /**
  * A signal that follows `signal` only for the abort kinds in `kinds`. An MCP call stops on a
  * cancel; at the Tool Gate it also stops waiting on a shutdown, since the gate keeps the call
@@ -46,17 +49,21 @@ export declare function invokeModel(route: ModelRoute, request: HostEffect, sign
  * so the next advance replays it.
  */
 export declare function abortOn(signal: AbortSignal, kinds: readonly AbortReason[]): AbortSignal;
-/** True when `request` calls `save_artifact` of the `nylorun.artifacts` capability `manifest` has. */
+/** True when `request` calls `save_artifact`, which the Runtime pinned on `manifest`. */
 export declare function isSaveArtifactCall(manifest: AgentManifest | undefined, request: HostEffect): boolean;
-/** True when `request` calls `read_artifact` (R2b C11) of the `nylorun.artifacts` capability. */
+/** True when `request` calls `read_artifact` (R2b C11), which the Runtime pinned on `manifest`. */
 export declare function isReadArtifactCall(manifest: AgentManifest | undefined, request: HostEffect): boolean;
 /** True when `request` calls a tool of a declared MCP server (every one is remote). */
 export declare function isRemoteMcpCall(routing: Pick<ToolRouting, "rootManifest" | "mcpSnapshot">, request: HostEffect): boolean;
-export declare function callMcpTool(mcp: McpPool, routing: ToolRouting, request: HostEffect, signal: AbortSignal): Promise<unknown>;
+export declare function callMcpTool(mcp: McpPool, routing: ToolRouting, request: HostEffect, signal: AbortSignal, 
+/** The call's span context (R7.4), sent as `traceparent` where this process holds the connection. */
+traceparent?: string): Promise<unknown>;
 /**
  * Calls an HTTP tool through the Tool Gate (R2 M3), keyed by the effect id: an agent's (the
  * effect's agent used as a tool, or the root), or a flow's HTTP stage or HTTP verifier. Its
  * outcome is the effect's value; a throw leaves the effect `uncertain`.
  */
-export declare function callHttpTool(gate: Pick<ToolGate, "callHttp">, request: HostEffect, signal: AbortSignal): Promise<unknown>;
+export declare function callHttpTool(gate: Pick<ToolGate, "callHttp">, request: HostEffect, signal: AbortSignal, 
+/** The call's span context (R7.4); the gates service reads its own from the journal. */
+traceparent?: string): Promise<unknown>;
 export declare function callSandboxTool(sandbox: SandboxManager, routing: ToolRouting, request: HostEffect, signal: AbortSignal): Promise<unknown>;

package/dist/harness/calls.js

@@ -3,23 +3,23 @@
  * Tenant's provider), the Tool Gate, the MCP pool, the SandboxManager. No store, no record: the
  * session's routing comes with the run (`TurnStart.routing`).
  */
-import { ARTIFACTS_CAPABILITY_ID, READ_ARTIFACT_TOOL, SAVE_ARTIFACT_TOOL, } from "@nylorun/core/define";
+import { READ_ARTIFACT_TOOL, SAVE_ARTIFACT_TOOL, } from "@nylorun/core/define";
 import { runAbortKind } from "@nylorun/harness/api";
 import { httpToolRefOf } from "../gates/http-tool.js";
 import { classifyThrown } from "../model/classify.js";
 import { findServer } from "../mcp/pool.js";
 import { manifestFor, mcpToolOf } from "../mcp/snapshot.js";
-import { sandboxCapabilityOf } from "../sandbox/capability.js";
+import { isPinnedRuntimeTool, sandboxToolSpec } from "../sandbox/runtime-tools.js";
 /**
  * Call the model for one effect. A provider failure comes back as a failure outcome
  * (Model Calls §6), whichever provider serves the call; only an abort throws, and the
- * advance decides what the abort means.
+ * advance decides what the abort means. `atGate` sends the call to the Model Gate even when the
+ * Tenant's model is not from the vault: the Tenant's fixture model is answered there (R4.3).
  */
-export async function invokeModel(route, request, signal, model) {
+export async function invokeModel(route, request, signal, options = {}) {
+    const atGate = route.useVaultModel || options.atGate === true;
     try {
-        if (model)
-            return await model(request, signal);
-        if (!route.useVaultModel)
+        if (!atGate)
             return await route.modelProvider(request, signal);
         return await route.modelGate.call({
             tenantId: route.tenantId,
@@ -35,7 +35,7 @@ export async function invokeModel(route, request, signal, model) {
         if (signal.aborted) {
             // A call that outlives this process stops only when told to: on a user cancel. After a
             // shutdown or a lost lease the next owner re-sends it and picks up its outcome (P1.2).
-            if (!model && route.useVaultModel && runAbortKind(signal) === "cancel" && route.modelGate.cancel)
+            if (atGate && runAbortKind(signal) === "cancel" && route.modelGate.cancel)
                 await route.modelGate.cancel({
                     tenantId: route.tenantId,
                     sessionId: request.sessionId,
@@ -65,20 +65,18 @@ export function abortOn(signal, kinds) {
         signal.addEventListener("abort", follow, { once: true });
     return controller.signal;
 }
-/** True when `request` calls `save_artifact` of the `nylorun.artifacts` capability `manifest` has. */
+/** True when `request` calls `save_artifact`, which the Runtime pinned on `manifest`. */
 export function isSaveArtifactCall(manifest, request) {
     return isArtifactsToolCall(manifest, request, SAVE_ARTIFACT_TOOL);
 }
-/** True when `request` calls `read_artifact` (R2b C11) of the `nylorun.artifacts` capability. */
+/** True when `request` calls `read_artifact` (R2b C11), which the Runtime pinned on `manifest`. */
 export function isReadArtifactCall(manifest, request) {
     return isArtifactsToolCall(manifest, request, READ_ARTIFACT_TOOL);
 }
 function isArtifactsToolCall(manifest, request, toolName) {
     return (request.kind === "tool" &&
-        request.capabilityId === ARTIFACTS_CAPABILITY_ID &&
         request.toolName === toolName &&
-        manifest?.capabilities.some((capability) => capability.id === ARTIFACTS_CAPABILITY_ID &&
-            capability.tools?.some((tool) => tool.name === toolName) === true) === true);
+        isPinnedRuntimeTool(manifest, toolName));
 }
 /** True when `request` calls a tool of a declared MCP server (every one is remote). */
 export function isRemoteMcpCall(routing, request) {
@@ -87,23 +85,23 @@ export function isRemoteMcpCall(routing, request) {
     const tool = mcpToolOf(routing.mcpSnapshot, request);
     if (!tool)
         return false;
-    return findServer(routing.rootManifest, tool.agentId, tool.capabilityId, tool.serverName) !== undefined;
+    return findServer(routing.rootManifest, tool.agentId, tool.serverName) !== undefined;
 }
-export async function callMcpTool(mcp, routing, request, signal) {
+export async function callMcpTool(mcp, routing, request, signal, 
+/** The call's span context (R7.4), sent as `traceparent` where this process holds the connection. */
+traceparent) {
     const tool = mcpToolOf(routing.mcpSnapshot, request);
     if (!tool)
         throw new Error(`MCP tool '${request.toolName ?? ""}' is not in the session snapshot`);
     return mcp.call({
         sessionId: request.sessionId,
         ...(tool.agentId === undefined ? {} : { agentId: tool.agentId }),
-        capabilityId: tool.capabilityId,
         serverName: tool.serverName,
         serverToolName: tool.serverToolName,
         args: request.input,
         manifest: routing.rootManifest,
         effectId: request.effectId,
-        // A read-only or idempotent tool's lost answer is the model's to retry (R2b C7, Q15).
-        retrySafe: tool.annotations?.readOnlyHint === true || tool.annotations?.idempotentHint === true,
+        ...(traceparent ? { traceparent } : {}),
         signal,
     });
 }
@@ -112,22 +110,30 @@ export async function callMcpTool(mcp, routing, request, signal) {
  * effect's agent used as a tool, or the root), or a flow's HTTP stage or HTTP verifier. Its
  * outcome is the effect's value; a throw leaves the effect `uncertain`.
  */
-export async function callHttpTool(gate, request, signal) {
+export async function callHttpTool(gate, request, signal, 
+/** The call's span context (R7.4); the gates service reads its own from the journal. */
+traceparent) {
     if (!gate.callHttp)
         throw new Error("This Runtime has no Tool Gate for HTTP tools");
-    return gate.callHttp({ tool: httpToolRefOf(request), effectId: request.effectId, turnId: request.turnId, input: request.input }, signal);
+    return gate.callHttp({
+        tool: httpToolRefOf(request),
+        effectId: request.effectId,
+        turnId: request.turnId,
+        input: request.input,
+        ...(traceparent ? { traceparent } : {}),
+    }, signal);
 }
 export async function callSandboxTool(sandbox, routing, request, signal) {
-    const capability = sandboxCapabilityOf(manifestFor(routing.rootManifest, request.agent), request.capabilityId, request.toolName);
-    if (!capability)
+    const spec = sandboxToolSpec(manifestFor(routing.rootManifest, request.agent), request.toolName);
+    if (!spec)
         throw new Error(`'${request.toolName ?? ""}' is not a sandbox tool`);
     // Agents used as tools share the session's sandbox; the tree declares one sandbox spec.
     return sandbox.run({
         id: routing.sandboxOwnerId,
         activeTurnId: routing.activeTurnId,
         manifest: routing.rootManifest,
-        ...(routing.sandboxId === undefined ? {} : { sandboxId: routing.sandboxId }),
+        ...(routing.environmentId === undefined ? {} : { environmentId: routing.environmentId }),
         ...(routing.environment === undefined ? {} : { environment: routing.environment }),
         ...(routing.claim === undefined ? {} : { claim: routing.claim }),
-    }, capability, request.toolName, request.input, signal);
+    }, spec, request.toolName, request.input, signal);
 }