@nylorun/runtime 0.23.0-beta → 0.25.0-beta

package/dist/harness-api/tool-status.js

@@ -0,0 +1,26 @@
+/**
+ * How a tool row of the effect journal reads (R5.1, R5.2), from its body alone: shared by the
+ * journal (`tool-journal.ts`) and the session reads (`/calls/tool`).
+ */
+import { durationBetween } from "../tenant/transcript.js";
+/** The codes of a call the Runtime ended rather than the tool: its status is `failed`. */
+const RUNTIME_ENDED = new Set(["tool.disabled", "tool.unavailable", "tool.interrupted", "tool.denied"]);
+/** How a tool row ended, as `tool.completed` and `/calls/tool` say it. */
+export function toolCallStatus(row) {
+    if (row.status === "cancelled")
+        return "cancelled";
+    if (row.status === "held")
+        return "held";
+    if (row.status === "uncertain")
+        return "uncertain";
+    if (row.status !== "completed")
+        return "invoking";
+    const value = row.outcome?.value;
+    return value?.kind === "failed" && typeof value.code === "string" && RUNTIME_ENDED.has(value.code)
+        ? "failed"
+        : "completed";
+}
+/** From the first send to the outcome, or undefined when the call never ran or has not ended. */
+export function toolCallDuration(row) {
+    return durationBetween(row.startedAt, row.settledAt);
+}

package/dist/harness-api/workspace.d.ts

@@ -1,5 +1,6 @@
-import type { CapabilityManifest, SandboxToolName } from "@nylorun/core/define";
+import type { SandboxManifest, SandboxToolName } from "@nylorun/core/define";
 import type { SandboxManager, SandboxSessionRef } from "../sandbox/manager.js";
+import { type DiskOp } from "../sandbox/disk-fs.js";
 import type { SandboxSelectionReport } from "../sandbox/select.js";
 import type { SandboxToolOutcome } from "../sandbox/tools.js";
 import type { SessionStore } from "../store/types.js";
@@ -12,11 +13,13 @@ export type WorkspaceReport = SandboxSelectionReport & {
 type Exists = (id: string) => boolean | Promise<boolean>;
 export interface WorkspacePort {
     /** Runs one sandbox tool in the workspace of `session`. */
-    run(session: SandboxSessionRef, capability: CapabilityManifest, toolName: SandboxToolName, input: unknown, signal: AbortSignal): Promise<SandboxToolOutcome>;
+    run(session: SandboxSessionRef, sandbox: SandboxManifest | undefined, toolName: SandboxToolName, input: unknown, signal: AbortSignal): Promise<SandboxToolOutcome>;
     /** Lists the files under `dir` of the workspace of `session` (the turn-end export, F8.2). */
-    listFiles(session: SandboxSessionRef, capability: CapabilityManifest, dir: string, maxEntries: number, signal: AbortSignal): ReturnType<SandboxManager["listFiles"]>;
+    listFiles(session: SandboxSessionRef, sandbox: SandboxManifest | undefined, dir: string, maxEntries: number, signal: AbortSignal): ReturnType<SandboxManager["listFiles"]>;
     /** Reads a file of the workspace of `session` as bytes, at most `maxBytes` (`save_artifact`). */
-    readBytes(session: SandboxSessionRef, capability: CapabilityManifest, path: string, maxBytes: number, signal: AbortSignal): ReturnType<SandboxManager["readBytes"]>;
+    readBytes(session: SandboxSessionRef, sandbox: SandboxManifest | undefined, path: string, maxBytes: number, signal: AbortSignal): ReturnType<SandboxManager["readBytes"]>;
+    /** One operation on the disk of the workspace of `session` (R2d step 3). */
+    disk(session: SandboxSessionRef, sandbox: SandboxManifest | undefined, op: DiskOp, signal: AbortSignal): ReturnType<SandboxManager["disk"]>;
     report(): Promise<WorkspaceReport>;
     /** One Tenant sweep pass: stop idle workspaces, remove those whose owner is gone. */
     sweep(options: {
@@ -24,8 +27,8 @@ export interface WorkspacePort {
         sessionExists: Exists;
         sandboxExists: Exists;
     }): Promise<void>;
-    /** Deletes sandbox resource `sandboxId`'s workspace (the resource was deleted). */
-    removeSandbox(sandboxId: string): Promise<void>;
+    /** Deletes sandbox resource `environmentId`'s workspace (the resource was deleted). */
+    removeSandbox(environmentId: string): Promise<void>;
     /** Deletes every workspace with its files (a sandboxes reset). */
     removeAll(): Promise<void>;
     close(): Promise<void>;
@@ -40,6 +43,8 @@ export interface RemoteWorkspaceOptions {
     readonly preference: string;
     /** The pod sandbox whose host serves these workspaces (F7.2). */
     readonly pod?: string;
+    /** With `pod`: the oldest host epoch that may serve them (`SandboxSessionRef.hostEpoch`). */
+    readonly minEpoch?: number;
 }
 /** The workspaces of the harness that serves them. */
 export declare function remoteWorkspace(options: RemoteWorkspaceOptions): WorkspacePort;
@@ -48,6 +53,6 @@ export declare function remoteWorkspace(options: RemoteWorkspaceOptions): Worksp
  * everything else goes to `base`. `podOf` says whether a sandbox resource is a pod sandbox.
  */
 export declare function withPodWorkspaces(base: WorkspacePort, options: Omit<RemoteWorkspaceOptions, "pod"> & {
-    readonly isPod: (sandboxId: string) => Promise<boolean>;
+    readonly isPod: (environmentId: string) => Promise<boolean>;
 }): WorkspacePort;
 export {};

package/dist/harness-api/workspace.js

@@ -1,5 +1,5 @@
 /**
- * The workspace capability (F6.2): what core does with the Tenant's sandbox workspaces outside a
+ * The workspace feature (F6.2): what core does with the Tenant's sandbox workspaces outside a
  * run. `ctx.sandbox` is a `WorkspacePort`: the sandbox tool route (`POST
  * /v1/sessions/:id/sandbox/:tool`), Tenant status, the Tenant sweep, a sandbox resource's deletion and a sandboxes reset.
  *
@@ -15,21 +15,23 @@
  * - **Pod sandboxes** (F7.2, `withPodWorkspaces`): a session attached to a pod sandbox has its
  *   workspace in the pod, served by the sandbox's engine (its host connection). Its tool calls,
  *   listings and reads go there whatever serves the other workspaces; with the pod stopped or
- *   starting they are `409 sandbox_unavailable`.
+ *   starting they are `409 environment_unavailable`.
  */
 import { HarnessApiError } from "@nylorun/core/harness-api";
+import { fromWireAnswer, toWireOp } from "../sandbox/disk-fs.js";
 import { DEFAULT_SANDBOX_IMAGE } from "../sandbox/policy.js";
 import { fail } from "../tenant/http.js";
 import { NoWorkspaceHarness } from "./server.js";
 /** The Tenant's own SandboxManager. */
 export function localWorkspace(manager) {
     return {
-        run: (session, capability, toolName, input, signal) => manager.run(session, capability, toolName, input, signal),
-        listFiles: (session, capability, dir, maxEntries, signal) => manager.listFiles(session, capability, dir, maxEntries, signal),
-        readBytes: (session, capability, path, maxBytes, signal) => manager.readBytes(session, capability, path, maxBytes, signal),
+        run: (session, sandbox, toolName, input, signal) => manager.run(session, sandbox, toolName, input, signal),
+        listFiles: (session, sandbox, dir, maxEntries, signal) => manager.listFiles(session, sandbox, dir, maxEntries, signal),
+        readBytes: (session, sandbox, path, maxBytes, signal) => manager.readBytes(session, sandbox, path, maxBytes, signal),
+        disk: (session, sandbox, op, signal) => manager.disk(session, sandbox, op, signal),
         report: () => manager.report(),
         sweep: (options) => manager.sweep(options),
-        removeSandbox: (sandboxId) => manager.removeSandbox(sandboxId),
+        removeSandbox: (environmentId) => manager.removeSandbox(environmentId),
         removeAll: () => manager.reconcile(() => false, () => false),
         close: () => manager.close(),
     };
@@ -45,17 +47,19 @@ const METHODS = {
 function sessionOf(session) {
     return {
         ownerId: session.id,
-        ...(session.sandboxId === undefined ? {} : { sandboxId: session.sandboxId }),
+        ...(session.environmentId === undefined ? {} : { environmentId: session.environmentId }),
         activeTurnId: session.activeTurnId,
     };
 }
 /** The workspaces of the harness that serves them. */
 export function remoteWorkspace(options) {
     const { store } = options;
-    const target = options.pod === undefined ? undefined : { pod: options.pod };
+    const target = options.pod === undefined
+        ? undefined
+        : { pod: options.pod, ...(options.minEpoch === undefined ? {} : { minEpoch: options.minEpoch }) };
     const unavailable = (error) => error.pod === undefined
         ? fail(503, error.message, { code: "request_rejected" })
-        : fail(409, error.message, { code: "sandbox_unavailable" });
+        : fail(409, error.message, { code: "environment_unavailable" });
     /** The harness's answer, or `undefined` when none serves workspaces. */
     const ask = async (method, params, signal) => {
         try {
@@ -74,9 +78,9 @@ export function remoteWorkspace(options) {
         const { workspaces } = answer;
         const gone = [];
         for (const record of workspaces) {
-            const kept = record.sandboxId === undefined
+            const kept = record.environmentId === undefined
                 ? await sessionExists(record.sessionId)
-                : await sandboxExists(record.sandboxId);
+                : await sandboxExists(record.environmentId);
             if (!kept)
                 gone.push(record.key);
         }
@@ -96,11 +100,11 @@ export function remoteWorkspace(options) {
         });
     };
     return {
-        async run(session, capability, toolName, input, signal) {
+        async run(session, sandbox, toolName, input, signal) {
             try {
                 return (await options.server.workspace(METHODS[toolName], {
                     session: sessionOf(session),
-                    spec: capability.sandbox ?? {},
+                    spec: sandbox ?? {},
                     tool: toolName,
                     input: input ?? {},
                 }, signal, target));
@@ -115,9 +119,9 @@ export function remoteWorkspace(options) {
                 throw error;
             }
         },
-        async listFiles(session, capability, dir, maxEntries, signal) {
+        async listFiles(session, sandbox, dir, maxEntries, signal) {
             try {
-                const answer = (await options.server.workspace("workspace.read", { session: sessionOf(session), spec: capability.sandbox ?? {}, list: { dir, maxEntries } }, signal, target));
+                const answer = (await options.server.workspace("workspace.read", { session: sessionOf(session), spec: sandbox ?? {}, list: { dir, maxEntries } }, signal, target));
                 if (answer.kind === "listed")
                     return {
                         kind: "listed",
@@ -135,11 +139,11 @@ export function remoteWorkspace(options) {
                 throw error;
             }
         },
-        async readBytes(session, capability, path, maxBytes, signal) {
+        async readBytes(session, sandbox, path, maxBytes, signal) {
             try {
                 const answer = (await options.server.workspace("workspace.read", {
                     session: sessionOf(session),
-                    spec: capability.sandbox ?? {},
+                    spec: sandbox ?? {},
                     bytes: { path, maxBytes },
                 }, signal, target));
                 if (answer.kind === "read")
@@ -154,6 +158,19 @@ export function remoteWorkspace(options) {
                 throw error;
             }
         },
+        async disk(session, sandbox, op, signal) {
+            try {
+                const answer = (await options.server.workspace("list" in op || "read" in op ? "workspace.read" : "workspace.write", { session: sessionOf(session), spec: sandbox ?? {}, disk: toWireOp(op) }, signal, target));
+                return answer.kind === "failed"
+                    ? { kind: "failed", code: String(answer.code), message: String(answer.message) }
+                    : fromWireAnswer(answer);
+            }
+            catch (error) {
+                if (error instanceof NoWorkspaceHarness)
+                    return unavailable(error);
+                throw error;
+            }
+        },
         async report() {
             const answer = await ask("workspace.report", {}).catch(() => undefined);
             if (answer)
@@ -168,12 +185,12 @@ export function remoteWorkspace(options) {
             };
         },
         sweep: (pass) => sweep(pass.sessionExists, pass.sandboxExists, pass.now),
-        async removeSandbox(sandboxId) {
+        async removeSandbox(environmentId) {
             // With no harness connected, the next sweep removes it: its resource is gone.
-            await ask("workspace.remove", { sandboxIds: [sandboxId] });
+            await ask("workspace.remove", { environmentIds: [environmentId] });
             await store.tx(async (t) => {
                 for (const row of await t.listSandboxes())
-                    if (row.sandboxId === sandboxId)
+                    if (row.environmentId === environmentId)
                         await t.delete("sandboxes", row.key);
             });
         },
@@ -188,13 +205,18 @@ export function remoteWorkspace(options) {
  * everything else goes to `base`. `podOf` says whether a sandbox resource is a pod sandbox.
  */
 export function withPodWorkspaces(base, options) {
-    const routed = async (session) => session.sandboxId !== undefined && (await options.isPod(session.sandboxId))
-        ? remoteWorkspace({ ...options, pod: session.sandboxId })
+    const routed = async (session) => session.environmentId !== undefined && (await options.isPod(session.environmentId))
+        ? remoteWorkspace({
+            ...options,
+            pod: session.environmentId,
+            ...(session.hostEpoch === undefined ? {} : { minEpoch: session.hostEpoch }),
+        })
         : base;
     return {
         ...base,
-        run: async (session, capability, toolName, input, signal) => (await routed(session)).run(session, capability, toolName, input, signal),
-        listFiles: async (session, capability, dir, maxEntries, signal) => (await routed(session)).listFiles(session, capability, dir, maxEntries, signal),
-        readBytes: async (session, capability, path, maxBytes, signal) => (await routed(session)).readBytes(session, capability, path, maxBytes, signal),
+        run: async (session, sandbox, toolName, input, signal) => (await routed(session)).run(session, sandbox, toolName, input, signal),
+        listFiles: async (session, sandbox, dir, maxEntries, signal) => (await routed(session)).listFiles(session, sandbox, dir, maxEntries, signal),
+        readBytes: async (session, sandbox, path, maxBytes, signal) => (await routed(session)).readBytes(session, sandbox, path, maxBytes, signal),
+        disk: async (session, sandbox, op, signal) => (await routed(session)).disk(session, sandbox, op, signal),
     };
 }

package/dist/harness-api/ws-server.d.ts

@@ -1,11 +1,14 @@
 import { type Server } from "node:http";
 import { type HarnessChannel } from "@nylorun/core/harness-api";
+import { HOST_JOIN_PATH, HOST_RENEW_PATH } from "@nylorun/core/harness-api";
 import { type WsPortOptions } from "../harness/ws-port.js";
 import { type HostAuthority } from "../sandbox/join.js";
 import type { HarnessPeer } from "./server.js";
-/** Where a pod's engine exchanges its join token, and renews its host token. */
-export declare const HOST_JOIN_PATH = "/nylorun/harness/v1/host/join";
-export declare const HOST_RENEW_PATH = "/nylorun/harness/v1/host/renew";
+export { HOST_JOIN_PATH, HOST_RENEW_PATH };
+/** Where a pod's engine reads its setup and reports it (R2d step 2, `sandbox/setup.ts`). */
+export declare const HOST_SETUP_PATH = "/nylorun/harness/v1/host/setup";
+/** Where it reads its input files: `/{index}`, and a folder's file `/{index}/{path}`. */
+export declare const HOST_FILES_PATH = "/nylorun/harness/v1/host/files";
 /** Attaches a harness's channel to the open Tenant; returns a function that detaches it. */
 export type HarnessAttach = (channel: HarnessChannel, peer: HarnessPeer) => () => void;
 export interface HarnessListenerOptions {
@@ -17,6 +20,11 @@ export interface HarnessListenerOptions {
     readonly token?: string;
     /** The open Tenant's `attachHarness`, or undefined while there is none. */
     readonly attach: () => Promise<HarnessAttach | undefined>;
+    /**
+     * The custom harness a per-harness token is for (R4.1), or undefined. Absent, only the harness
+     * token and host tokens are accepted.
+     */
+    readonly harnessOfToken?: (token: string) => Promise<string | undefined>;
     /** The open Tenant's host authority (sandbox pods, F7.2), or undefined without one. */
     readonly hosts?: () => Promise<HostAuthority | undefined>;
     readonly logger: {

package/dist/harness-api/ws-server.js

@@ -14,22 +14,31 @@
  * /nylorun/harness/v1/host/join` (`{ sandboxId, podUid, joinToken }`), renews it with `POST
  * .../host/renew` (`Authorization: Bearer <host token>`), and upgrades with the host token as
  * its bearer: that connection hosts its sandbox alone (`HarnessPeer.host`). Both answer
- * `{ hostToken, egressToken, sandboxId, epoch, expiresAt, caCertificate }` (the egress CA, R2c);
- * every refusal is the same 401. The harness token is never accepted as a host token, nor a host token anywhere but here.
+ * `{ hostToken, egressToken, sandboxId, epoch, expiresAt, caCertificate }` (the egress CA, R2c),
+ * and a join adds the disk's `setup` (R2d step 2). With its host token the engine also reads and
+ * reports its setup (`GET|POST .../host/setup`) and reads its input files (`GET
+ * .../host/files/{index}[/{path}]`). Every refusal is the same 401. The harness token is never
+ * accepted as a host token, nor a host token anywhere but here.
  */
 import { createHash, timingSafeEqual } from "node:crypto";
 import { createServer } from "node:http";
-import { createChannel } from "@nylorun/core/harness-api";
+import { DEFAULT_HARNESS, createChannel } from "@nylorun/core/harness-api";
 import { WebSocketServer } from "ws";
-import { HARNESS_API_HEADER, HARNESS_API_PATH, HARNESS_MAX_PAYLOAD, wsPort, } from "../harness/ws-port.js";
+import { HARNESS_API_HEADER, HARNESS_API_PATH, HARNESS_API_TRANSPORT, HARNESS_MAX_PAYLOAD, HOST_JOIN_PATH, HOST_RENEW_PATH, } from "@nylorun/core/harness-api";
+import { wsPort } from "../harness/ws-port.js";
 import { tokenType } from "../tenant/jwt.js";
 import { HOST_TOKEN_TYP } from "../tenant/host-token.js";
 import { HostAuthError } from "../sandbox/join.js";
-/** Where a pod's engine exchanges its join token, and renews its host token. */
-export const HOST_JOIN_PATH = `${HARNESS_API_PATH}/host/join`;
-export const HOST_RENEW_PATH = `${HARNESS_API_PATH}/host/renew`;
+import { parseSetupReport } from "../sandbox/setup.js";
+export { HOST_JOIN_PATH, HOST_RENEW_PATH };
+/** Where a pod's engine reads its setup and reports it (R2d step 2, `sandbox/setup.ts`). */
+export const HOST_SETUP_PATH = `${HARNESS_API_PATH}/host/setup`;
+/** Where it reads its input files: `/{index}`, and a folder's file `/{index}/{path}`. */
+export const HOST_FILES_PATH = `${HARNESS_API_PATH}/host/files`;
 /** A join's body is small. */
 const MAX_JOIN_BODY = 8 * 1024;
+/** A setup report carries the end of a command's output. */
+const MAX_REPORT_BODY = 64 * 1024;
 function refuse(socket, status, text, headers = {}) {
     const lines = [
         `HTTP/1.1 ${status} ${text}`,
@@ -76,12 +85,12 @@ export async function startHarnessListener(options) {
         });
         response.end(text);
     };
-    const readBody = (request) => new Promise((resolve, reject) => {
+    const readBody = (request, max = MAX_JOIN_BODY) => new Promise((resolve, reject) => {
         let size = 0;
         const chunks = [];
         request.on("data", (chunk) => {
             size += chunk.length;
-            if (size > MAX_JOIN_BODY) {
+            if (size > max) {
                 reject(new HostAuthError(400, "The body is too large"));
                 request.destroy();
             }
@@ -116,7 +125,61 @@ export async function startHarnessListener(options) {
             return reply(response, 503, { error: { code: "unavailable", message: "Try again" } });
         }
     };
-    // Plain requests get nothing but the pods' join and renewal: the listener speaks the Harness API.
+    /** A pod's setup and input files (R2d step 2), with its host token. */
+    const serveSetup = async (request, response, path) => {
+        if (!allowed.has(String(request.headers.host ?? "").toLowerCase()))
+            return reply(response, 421);
+        const authority = await options.hosts?.().catch(() => undefined);
+        if (!authority || closing)
+            return reply(response, 503, { error: { code: "unavailable", message: "Try again" } });
+        const token = bearerOf(request.headers.authorization) ?? "";
+        try {
+            if (path === HOST_SETUP_PATH) {
+                if (request.method === "GET")
+                    return reply(response, 200, await authority.setup(token));
+                if (request.method !== "POST")
+                    return reply(response, 405, undefined, { allow: "GET, POST" });
+                const report = parseSetupReport(JSON.parse(await readBody(request, MAX_REPORT_BODY)));
+                if (!report)
+                    throw new HostAuthError(400, "The report is malformed");
+                await authority.reportSetup(token, report);
+                return reply(response, 200, {});
+            }
+            if (request.method !== "GET")
+                return reply(response, 405, undefined, { allow: "GET" });
+            const [index, ...rest] = path.slice(HOST_FILES_PATH.length + 1).split("/");
+            if (!/^\d{1,2}$/.test(index ?? ""))
+                return reply(response, 404);
+            const file = await authority.setupFile(token, Number(index), rest.length === 0 ? undefined : rest.map((part) => decodeURIComponent(part)).join("/"));
+            if (!file)
+                return reply(response, 404);
+            if (file.kind === "folder")
+                return reply(response, 200, { entries: file.entries }, { "x-nylorun-artifact-kind": "folder" });
+            response.writeHead(200, {
+                connection: "close",
+                "cache-control": "no-store",
+                "content-type": file.contentType,
+                "x-nylorun-artifact-kind": "file",
+            });
+            for await (const chunk of file.body)
+                response.write(chunk);
+            response.end();
+        }
+        catch (error) {
+            if (error instanceof HostAuthError) {
+                if (error.reason)
+                    logger.warn("sandbox_host_refused", { path, reason: error.reason });
+                return reply(response, error.status, { error: { code: error.status === 401 ? "unauthorized" : "invalid", message: error.message } }, error.status === 401 ? { "www-authenticate": "Bearer" } : {});
+            }
+            if (error instanceof SyntaxError)
+                return reply(response, 400, { error: { code: "invalid", message: "Not JSON" } });
+            logger.warn("sandbox_host_failed", { path, message: error instanceof Error ? error.message : String(error) });
+            if (response.headersSent)
+                return void response.destroy();
+            return reply(response, 503, { error: { code: "unavailable", message: "Try again" } });
+        }
+    };
+    // Plain requests get nothing but the pods' join, renewal and setup: the listener speaks the Harness API.
     const server = createServer((request, response) => {
         const path = new URL(request.url ?? "/", "http://harness.local").pathname;
         if (closing)
@@ -125,6 +188,10 @@ export async function startHarnessListener(options) {
             void serveHost(request, response, path);
             return;
         }
+        if ((path === HOST_SETUP_PATH || path.startsWith(`${HOST_FILES_PATH}/`)) && options.hosts) {
+            void serveSetup(request, response, path);
+            return;
+        }
         response.writeHead(426, { connection: "close", upgrade: "websocket" });
         response.end();
     });
@@ -140,10 +207,12 @@ export async function startHarnessListener(options) {
         const bearer = bearerOf(request.headers.authorization);
         // A pod's host token (F7.2): checked against its sandbox before the upgrade.
         const hostToken = bearer !== undefined && options.hosts && tokenType(bearer) === HOST_TOKEN_TYP;
-        if (!hostToken && !bearerMatches(request.headers.authorization, options.token))
+        // The harness token is our harness's; any other is a custom harness's own, or refused (R4.1).
+        const ours = !hostToken && bearerMatches(request.headers.authorization, options.token);
+        if (!hostToken && !ours && (bearer === undefined || !options.harnessOfToken))
             return refuse(socket, 401, "Unauthorized", { "WWW-Authenticate": "Bearer" });
-        if (request.headers[HARNESS_API_HEADER] !== "1")
-            return refuse(socket, 426, "Upgrade Required", { [HARNESS_API_HEADER]: "1" });
+        if (request.headers[HARNESS_API_HEADER] !== HARNESS_API_TRANSPORT)
+            return refuse(socket, 426, "Upgrade Required", { [HARNESS_API_HEADER]: HARNESS_API_TRANSPORT });
         const host = hostToken
             ? options.hosts().then(async (authority) => {
                 if (!authority)
@@ -152,15 +221,25 @@ export async function startHarnessListener(options) {
                 return { sandboxId: claims.sandboxId, epoch: claims.epoch };
             })
             : Promise.resolve(undefined);
-        void Promise.all([options.attach(), host]).then(([attach, hosted]) => {
+        const harness = hostToken
+            ? Promise.resolve(undefined)
+            : ours
+                ? Promise.resolve(DEFAULT_HARNESS)
+                : options.harnessOfToken(bearer).then((id) => {
+                    if (id === undefined)
+                        throw new HostAuthError(401, "Unauthorized");
+                    return id;
+                });
+        void Promise.all([options.attach(), host, harness]).then(([attach, hosted, harnessId]) => {
             if (!attach || closing || (hostToken && !hosted))
                 return refuse(socket, 503, "Service Unavailable");
             wss.handleUpgrade(request, socket, head, (ws) => {
                 const peer = {
                     name: hosted
                         ? `sandbox ${hosted.sandboxId}@${request.socket.remoteAddress ?? "unknown"}`
-                        : `harness@${request.socket.remoteAddress ?? "unknown"}`,
+                        : `harness ${harnessId}@${request.socket.remoteAddress ?? "unknown"}`,
                     ...(hosted ? { host: hosted } : {}),
+                    ...(harnessId === undefined ? {} : { harness: harnessId }),
                 };
                 const channel = createChannel(wsPort(ws, { ...options.liveness, ping: true }), { validate: true });
                 const detach = attach(channel, peer);

package/dist/host/gates.d.ts

@@ -81,6 +81,7 @@ export interface StartEgressOptions {
 }
 /**
  * egress-gate (`--service egress`, F7.2): pods' CONNECT proxy, verifying egress tokens against the
- * Tenant's public keys and reading its sandboxes from the same database as the gates.
+ * Tenant's public keys and reading its sandboxes from the same database as the gates, where it
+ * also records each connection (R7.3).
  */
 export declare function startEgress(options: StartEgressOptions): Promise<EgressGate>;

package/dist/host/gates.js

@@ -23,9 +23,10 @@ import { tenantPaths } from "../tenant/paths.js";
 import { staleRun, verifyRunToken } from "../tenant/run-token.js";
 import { createFsBlobStore } from "../blob/index.js";
 import { createTenantVaults } from "../gates/tenant-vaults.js";
+import { journalCheck } from "../gates/journal.js";
 import { probeDatabase } from "../infra/database.js";
 import { bindListener, headerValue, isAllowedRequestHost, sendRejected } from "./http.js";
-import { startEgressGate, storeEgressSandboxes } from "../gates/egress.js";
+import { startEgressGate, storeEgressRecord, storeEgressSandboxes, } from "../gates/egress.js";
 import { verifyEgressToken } from "../sandbox/egress-token.js";
 import { leafKeyPair } from "../keys/x509.js";
 /** Above the gate's 600 s provider request timeout and the loop's 630 s client timeout. */
@@ -101,6 +102,7 @@ export async function startGates(options) {
         mcp,
         http: gateHttpTools(vaults, options.delivery ?? {}, logger),
         toolCalls,
+        journal: journalCheck(vaults),
         logger,
         ...(options.keys ? { keys: async () => (await vaults.open()).keys() } : {}),
     });
@@ -153,7 +155,8 @@ export async function startGates(options) {
 }
 /**
  * egress-gate (`--service egress`, F7.2): pods' CONNECT proxy, verifying egress tokens against the
- * Tenant's public keys and reading its sandboxes from the same database as the gates.
+ * Tenant's public keys and reading its sandboxes from the same database as the gates, where it
+ * also records each connection (R7.3).
  */
 export async function startEgress(options) {
     const { database } = options;
@@ -173,6 +176,11 @@ export async function startEgress(options) {
             return verifyEgressToken(vault.store, vault.tenantId, raw, publicKeys);
         },
         sandboxes: { live: async (sandboxId) => storeEgressSandboxes((await tenant.open()).store).live(sandboxId) },
+        // Each connection on the Tenant's record (R7.3): the gates' one write into it.
+        record: {
+            runningTurns: async (environmentId) => storeEgressRecord((await tenant.open()).store).runningTurns(environmentId),
+            write: async (connection) => storeEgressRecord((await tenant.open()).store).write(connection),
+        },
         credentials: {
             bound: async (sandboxId, host) => (await tenant.open()).environmentSecretBound(sandboxId, host),
             release: async (sandboxId, host) => (await tenant.open()).releaseEnvironmentSecret(sandboxId, host),

package/dist/host/main.js

@@ -12,7 +12,9 @@
  * first start (`NYLORUN_TENANT_ID`, `NYLORUN_TENANT_NAME`; tenancy.md §4), trusting the issuers of the identity file
  * `NYLORUN_IDENTITY_FILE` names (Host feature `trusted-issuers`); with S2, a process running core
  * runs the stream relay, which feeds the Tenant's streams from the record over
- * logical replication (one process at a time holds the slot); `/ready` reports
+ * logical replication (one process at a time holds the slot); with `OTEL_EXPORTER_OTLP_ENDPOINT`
+ * it also runs the trace projector, which posts the record's spans over OTLP from a slot of its
+ * own (R7.2); `/ready` reports
  * the Tenant and the infrastructure checks. With an Object store
  * (`NYLORUN_OBJECT_STORE_*`) the Tenant's blobs go to it through the `s3` BlobStore, and a
  * process running core creates its bucket; without one they stay on disk (`fs`). A process
@@ -36,8 +38,12 @@ import { createPostgresTenantOpener } from "../tenant/store-pg.js";
 import { openTenantRuntime } from "../tenant/runtime.js";
 import { createPgoutputSource } from "../adapters/replication/pgoutput.js";
 import { assertLogicalReplication } from "../store/postgres/connect.js";
-import { createPostgresRecordReader } from "../store/postgres/record.js";
 import { createStreamRelay } from "../streams/relay/core.js";
+import { createPostgresRecordReader, createPostgresTurnMessages } from "../store/postgres/record.js";
+import { createPostgresSessionStore } from "../store/postgres/store.js";
+import { createTraceProjector, TRACE_SLOT } from "../traces/projector.js";
+import { createOtlpPoster } from "../traces/otlp.js";
+import { traceKey } from "../traces/key.js";
 import { configForFactory } from "./config-for.js";
 import { createHost } from "./create-host.js";
 import { createHostExecution } from "./execution.js";
@@ -141,7 +147,7 @@ function warnRemovedSettings(stack, logger) {
     if (stack.removedResolverVariables)
         logger.warn("resolver_removed", {
             variables: stack.removedResolverVariables,
-            message: "The credential resolver is gone (protocol 10) and these variables are ignored: keep a person's keys in their user vault, or reach their accounts through a gateway",
+            message: "The credential resolver is gone (protocol 10) and these variables are ignored: keep a person's keys in their Environment's vault, or reach their accounts through a gateway",
         });
 }
 /**
@@ -254,6 +260,7 @@ export async function main() {
         mode: stack.listen ? "container" : "local",
         endpoints: describeEndpoints(stack.endpoints),
         objectStore: stack.objectStore ? "s3" : "fs",
+        traces: stack.traces?.export ? "otlp" : "off",
     });
     const infra = createInfra(stack, { logger });
     const database = infra.database;
@@ -283,7 +290,11 @@ export async function main() {
     // running core runs one, once the Tenant is open (the relay reads its id); the replication
     // slot lets exactly one be active. Without S2, the Tenant relays its own commits.
     let relay;
-    if (streams && stack.services.has("core"))
+    // With an OTLP endpoint (R7.2, Q5), the trace projector reads the record on its own slot: one
+    // process running core at a time, as for the relay. Without one there is no slot.
+    const traceExport = stack.services.has("core") ? stack.traces?.export : undefined;
+    let projector;
+    if ((streams || traceExport) && stack.services.has("core"))
         await assertLogicalReplication(database);
     const startRelay = (tenantId) => {
         if (!streams || !stack.services.has("core") || relay)
@@ -301,6 +312,32 @@ export async function main() {
         });
         relay.start();
     };
+    const startProjector = (tenantId) => {
+        if (!traceExport || projector)
+            return;
+        const store = createPostgresSessionStore({ sql: database, tenantId });
+        const log = (message, fields) => logger.info(message, fields);
+        projector = createTraceProjector({
+            source: createPgoutputSource({
+                connectionString: stack.endpoints.databaseUrl,
+                tenantId,
+                slot: TRACE_SLOT,
+                applicationName: "nylorun-trace-export",
+                log,
+            }),
+            post: createOtlpPoster({
+                url: traceExport.url,
+                headers: traceExport.headers,
+                resource: stack.traces.resource,
+                log: (message, fields) => logger.warn(message, fields),
+            }),
+            key: () => traceKey(store),
+            turnMessage: createPostgresTurnMessages(database),
+            content: new Set(stack.traces.content),
+            log,
+        });
+        projector.start();
+    };
     // With the gates service the Tenant's vault-backed model calls, remote MCP calls and HTTP
     // tool calls cross it, and this process never reads a model or MCP credential.
     // Their credentials (F5): each advance's run token for its session's model and tool calls,
@@ -355,11 +392,17 @@ export async function main() {
                 ...(blobs ? { blobs } : {}),
                 ...(stack.harnessMode === "remote" ? { harness: "remote" } : {}),
                 ...(pods ? { pods } : {}),
+                ...(stack.traces
+                    ? { traces: { resource: stack.traces.resource, content: new Set(stack.traces.content) } }
+                    : {}),
                 ...opened,
             }),
         }),
         logger,
-        onOpen: (handle) => startRelay(handle.envelope.id),
+        onOpen: (handle) => {
+            startRelay(handle.envelope.id);
+            startProjector(handle.envelope.id);
+        },
     });
     const options = {
         hostRoot,
@@ -378,6 +421,7 @@ export async function main() {
             beforeTenants: async () => {
                 await hostExecution.stop();
                 await relay?.stop();
+                await projector?.stop();
                 // The harnesses' runs stop with the Tenant's advances; their connections close after.
             },
             afterTenants: async () => {
@@ -421,6 +465,11 @@ export async function main() {
                     const handle = resolved.kind === "open" ? resolved.handle : undefined;
                     return handle?.attachHarness ? (channel, peer) => handle.attachHarness(channel, peer) : undefined;
                 },
+                // Custom harnesses connect with their own tokens (R4.1).
+                harnessOfToken: async (token) => {
+                    const resolved = await module.resolve();
+                    return resolved.kind === "open" ? resolved.handle.harnessOfToken?.(token) : undefined;
+                },
                 logger,
             });
         await host.listen();