@nylorun/runtime 0.24.0-beta → 0.26.0-beta

package/dist/core/flow-host.js

@@ -80,14 +80,14 @@ export function isWorkflowManifest(manifest) {
         typeof manifest === "object" &&
         manifest.kind === "workflow");
 }
-/** Flow tool-node effect: `tool` with path/key and no agent capabilityId. */
+/** Flow tool-node effect: `tool` with path/key and no tool name (an agent's tool call names one). */
 export function isFlowToolEffect(request) {
     return (request.kind === "tool" &&
         typeof request.path === "string" &&
         request.path.length > 0 &&
         typeof request.key === "string" &&
         request.key.length > 0 &&
-        request.capabilityId === undefined);
+        request.toolName === undefined);
 }
 export function isFlowEffect(request) {
     return request.kind === "agent" || isFlowToolEffect(request);

package/dist/core/sandbox-routes.js

@@ -3,7 +3,7 @@
  * a tool run in the sandbox of the session's Environment.
  */
 import { isSandboxToolName, } from "@nylorun/core/define";
-import { capabilityForSandbox, sandboxWorkspaceOf, sessionSandboxSpec, } from "../sandbox/share.js";
+import { sandboxWorkspaceOf, sessionSandboxSpec, } from "../sandbox/share.js";
 export class SandboxRouteError extends Error {
     status;
     constructor(status, message) {
@@ -41,7 +41,7 @@ async function runTool(deps, session, tool, input, signal) {
         manifest: session.manifest,
         ...(workspace.environmentId === undefined ? {} : { environmentId: workspace.environmentId }),
     };
-    return deps.sandbox.run(ref, capabilityForSandbox(spec), tool, input, signal);
+    return deps.sandbox.run(ref, spec, tool, input, signal);
 }
 /**
  * `POST /v1/sessions/:id/sandbox/:tool` — application principal.

package/dist/core/turn-manifest.d.ts

@@ -16,8 +16,9 @@ export type TurnManifestErr = {
     readonly message: string;
 };
 /**
- * Parse `message.manifest`, require it to be a variant of the session pin,
- * hash it, and store it. Applies to that turn only (caller must not latch).
+ * Parse `message.manifest`, require it to be a variant of the session pin, and store the
+ * manifest the turn runs with: the variant with the pin's `runtime` block (a variant never sets
+ * one), by its hash. Applies to that turn only (caller must not latch).
  */
 export declare function pinTurnManifest(args: {
     readonly candidate: unknown;

package/dist/core/turn-manifest.js

@@ -2,8 +2,29 @@ import { AgentManifestSchema, } from "@nylorun/core/contracts";
 import { hashManifest } from "@nylorun/core/compatibility";
 import { isVariantOf } from "@nylorun/core/define";
 /**
- * Parse `message.manifest`, require it to be a variant of the session pin,
- * hash it, and store it. Applies to that turn only (caller must not latch).
+ * The candidate's agents used as tools with the `runtime` block the pin gave each, when the
+ * candidate left it out: a turn variant is written from the definition, and only the Runtime
+ * writes `runtime`. A candidate that sets one keeps it, and must then match the pin's.
+ */
+function withPinnedDelegates(candidate, pinned) {
+    if (candidate.tools === undefined)
+        return candidate;
+    const pinnedAgents = new Map((pinned.tools ?? []).flatMap((tool) => tool.agent !== undefined && !("kind" in tool.agent) ? [[tool.name, tool.agent]] : []));
+    let changed = false;
+    const tools = candidate.tools.map((tool) => {
+        const agent = tool.agent;
+        const prior = pinnedAgents.get(tool.name);
+        if (agent === undefined || "kind" in agent || agent.runtime !== undefined || prior?.runtime === undefined)
+            return tool;
+        changed = true;
+        return { ...tool, agent: { ...agent, runtime: prior.runtime } };
+    });
+    return changed ? { ...candidate, tools } : candidate;
+}
+/**
+ * Parse `message.manifest`, require it to be a variant of the session pin, and store the
+ * manifest the turn runs with: the variant with the pin's `runtime` block (a variant never sets
+ * one), by its hash. Applies to that turn only (caller must not latch).
  */
 export function pinTurnManifest(args) {
     const parsed = AgentManifestSchema.safeParse(args.candidate);
@@ -14,14 +35,17 @@ export function pinTurnManifest(args) {
             message: "Turn manifest failed AgentManifestSchema validation",
         };
     }
-    const manifest = parsed.data;
-    if (!isVariantOf(manifest, args.pinned)) {
+    const candidate = withPinnedDelegates(parsed.data, args.pinned);
+    if (!isVariantOf(candidate, args.pinned)) {
         return {
             ok: false,
             code: "loop.invalid-agent",
-            message: "Turn manifest is not a variant of the session's pinned manifest",
+            message: candidate.runtime === undefined
+                ? "Turn manifest is not a variant of the session's pinned manifest"
+                : "Turn manifest sets runtime, which only the Runtime writes: leave it out, and the turn runs with the session's",
         };
     }
+    const manifest = args.pinned.runtime === undefined ? candidate : { ...candidate, runtime: args.pinned.runtime };
     const hash = hashManifest(manifest);
     args.store.put(hash, manifest);
     return { ok: true, manifest, hash };

package/dist/gates/egress-credentials.js

@@ -12,7 +12,7 @@
  * Nothing here knows a tool: the header name and its format are the credential's. A release the
  * vault refuses (two secrets for one host, an unreadable value) answers 502 and is logged, never
  * as an event; a value never is. Upgrades (WebSocket) and HTTP/2 are not served on this path.
- * Each connection keeps a tally for its `egress.connection` event (R7.3): how many requests it
+ * Each connection keeps a tally for its `environment.egress` event (R7.3, D67): how many requests it
  * read and which credentials it set, by id.
  */
 import { createServer } from "node:http";

package/dist/gates/egress.d.ts

@@ -1,6 +1,6 @@
 import { type Server } from "node:http";
 import { type Socket } from "node:net";
-import type { EventPayload, EventWriter } from "@nylorun/core/contracts";
+import type { EgressRunningTurn, EnvironmentEventPayload } from "@nylorun/core/contracts";
 import type { EgressTokenVerdict } from "../sandbox/egress-token.js";
 import type { SessionStore } from "../store/types.js";
 import type { Logger } from "../tenant/types.js";
@@ -16,22 +16,17 @@ export interface EgressSandboxes {
         readonly allow: readonly string[];
     } | undefined>;
 }
-/** The session and turn holding an Environment: turns are serial per Environment, so one at most. */
-export interface EgressHolder {
-    readonly sessionId: string;
-    readonly turnId: string;
-}
-/** One connection's record (R7.3): `egress.connection`'s payload, `environment.egress`'s too. */
-export type EgressConnection = EventPayload<"egress.connection">;
-/** Where egress-gate records connections (R7.3). */
+/** One connection's record (R7.3, D67): `environment.egress`'s payload. */
+export type EgressConnection = EnvironmentEventPayload<"environment.egress">;
+/** How many running turns one connection names, at most. */
+export declare const EGRESS_RUNNING_TURNS_MAX = 16;
+/** Where egress-gate records connections (R7.3, D67). */
 export interface EgressRecord {
-    /** The session whose turn holds the Environment now; `undefined` between turns. */
-    holder(environmentId: string): Promise<EgressHolder | undefined>;
-    /** Writes `connection` to `holder`'s session log, or to the Environment's stream without one. */
-    write(holder: EgressHolder | undefined, connection: EgressConnection): Promise<void>;
+    /** The turns active on the Environment now, at most `EGRESS_RUNNING_TURNS_MAX`. */
+    runningTurns(environmentId: string): Promise<readonly EgressRunningTurn[]>;
+    /** Writes `connection` to its Environment's stream; a deleted Environment gets nothing. */
+    write(connection: EgressConnection): Promise<void>;
 }
-/** egress-gate as the writer of its events (R4.9): the gate saw the connection itself. */
-export declare const EGRESS_WRITER: EventWriter;
 /** Ports a tunnel may open. */
 export declare const EGRESS_PORTS: readonly number[];
 /** Tunnels one sandbox may hold open at once. */
@@ -93,10 +88,9 @@ export declare function startEgressGate(options: StartEgressGateOptions): Promis
  */
 export declare function storeEgressSandboxes(store: SessionStore): EgressSandboxes;
 /**
- * `EgressRecord` over the Tenant's record (R7.3). The holder is the session on the Environment
- * whose body has an `activeTurnId` (turns are serial per Environment). With a holder, the write
- * is `egress.connection` on its session log, at that turn, under the session row's lock; without
- * one, `environment.egress` on the Environment's stream, under its row's lock. A deleted
+ * `EgressRecord` over the Tenant's record (R7.3, D67). The running turns are the sessions on the
+ * Environment whose body has an `activeTurnId`, in id order, at most `EGRESS_RUNNING_TURNS_MAX`.
+ * The write is `environment.egress` on the Environment's stream, under its row's lock; a deleted
  * Environment gets nothing.
  */
 export declare function storeEgressRecord(store: SessionStore): EgressRecord;

package/dist/gates/egress.js

@@ -24,11 +24,13 @@
  * (an absolute-form plain HTTP request included) is answered 405. Refusals are logged; the token
  * never is. Tunnels close after `idleMs` without traffic in either direction.
  *
- * Every connection to a named host on a live token is recorded once (R7.3, Q6, Q7), when it
- * closes or at once when the gate refuses it: `egress.connection` on the session log of the turn
- * that held the Environment when it opened (read as the name resolves), else `environment.egress`
- * on the Environment's own stream. Host, port, outcome, bytes, duration and, for a credential
- * host, the request count and credential ids; never a header value, a path or a body. A refusal
+ * Every connection to a named host on a live token is recorded once (R7.3, D67), when it closes
+ * or at once when the gate refuses it, as `environment.egress` on the Environment's own stream:
+ * the connection is the Environment's, since its token names the pod and turns run in parallel
+ * (D66). `runningTurns` lists the turns active on the Environment as it opened, as context and
+ * never as an owner: one read, started as the name resolves and never waited for, so a turn that
+ * moves while it is in flight may show either way. Host, port, outcome, bytes, duration and, for a
+ * credential host, the request count and credential ids; never a header value, a path or a body. A refusal
  * before that (no token, a stale one, no `host:port`) stays a log line, and a client that hangs up
  * before the gate answers leaves nothing. A write never holds the tunnel up, and a failed one is
  * logged (`egress_record_failed`).
@@ -40,8 +42,8 @@ import { isSandboxHostPattern } from "@nylorun/core/define";
 import { isPrivateAddress } from "../tenant/outbound.js";
 import { bindListener } from "../host/http.js";
 import { CONNECT_ESTABLISHED, credentialTerminator, } from "./egress-credentials.js";
-/** egress-gate as the writer of its events (R4.9): the gate saw the connection itself. */
-export const EGRESS_WRITER = { source: { kind: "egress-gate", id: "egress" }, evidence: "observed" };
+/** How many running turns one connection names, at most. */
+export const EGRESS_RUNNING_TURNS_MAX = 16;
 /** Ports a tunnel may open. */
 export const EGRESS_PORTS = [443, 80];
 /** Tunnels one sandbox may hold open at once. */
@@ -146,16 +148,17 @@ function answer(socket, status, message, headers = []) {
     ].join("\r\n"));
 }
 function connectionRecord(sink, logger, client, at) {
-    let holding;
+    let running;
     let written = false;
-    const holder = (to) => (holding ??= to.holder(at.environmentId));
+    const runningTurns = (to) => (running ??= to.runningTurns(at.environmentId));
     const write = (fields) => {
         if (written || !sink)
             return;
         written = true;
         const socket = client;
         const allowed = fields.outcome === "allowed";
-        const connection = {
+        const durationMs = Math.max(0, Date.now() - at.startedAt.getTime());
+        const connection = (turns) => ({
             environmentId: at.environmentId,
             host: at.host,
             port: at.port,
@@ -165,11 +168,12 @@ function connectionRecord(sink, logger, client, at) {
             // Up is what the sandbox sent after its CONNECT, down what it got after the gate's 200.
             bytesUp: allowed ? Math.max(0, (socket.bytesRead ?? 0) - at.upFrom) : 0,
             bytesDown: allowed ? Math.max(0, (socket.bytesWritten ?? 0) - CONNECT_ESTABLISHED.length) : 0,
-            durationMs: Math.max(0, Date.now() - at.startedAt.getTime()),
+            durationMs,
             startedAt: at.startedAt.toISOString(),
-        };
-        holder(sink)
-            .then((held) => sink.write(held, connection))
+            runningTurns: [...turns],
+        });
+        runningTurns(sink)
+            .then((turns) => sink.write(connection(turns)))
             .catch((error) => logger.error("egress_record_failed", {
             sandboxId: at.environmentId,
             host: at.host,
@@ -179,7 +183,7 @@ function connectionRecord(sink, logger, client, at) {
     const record = {
         credentialBound: false,
         // A failed read is logged when the write needs it.
-        holder: () => void (sink && holder(sink).catch(() => undefined)),
+        opened: () => void (sink && runningTurns(sink).catch(() => undefined)),
         refused: (status, reason) => write({ outcome: "refused", reason, status }),
         closed: (tally) => write({
             outcome: "allowed",
@@ -257,8 +261,9 @@ export async function startEgressGate(options) {
             return refuse(403, "not_a_host_name", { sandboxId }, `${host} is not a host name; IP literals are refused`);
         if (!egressAllows(host, sandbox.allow))
             return refuse(403, "host_not_allowed", { sandboxId }, `${host} is not in this sandbox's network.allow`);
-        // Who holds the Environment as the connection opens, read while the name resolves.
-        record.holder();
+        // The turns running on the Environment as the connection opens: the read starts as the
+        // name resolves, and the 200 does not wait for it.
+        record.opened();
         let mine = open.get(sandboxId);
         if (!mine)
             open.set(sandboxId, (mine = new Set()));
@@ -409,25 +414,23 @@ export function storeEgressSandboxes(store) {
     };
 }
 /**
- * `EgressRecord` over the Tenant's record (R7.3). The holder is the session on the Environment
- * whose body has an `activeTurnId` (turns are serial per Environment). With a holder, the write
- * is `egress.connection` on its session log, at that turn, under the session row's lock; without
- * one, `environment.egress` on the Environment's stream, under its row's lock. A deleted
+ * `EgressRecord` over the Tenant's record (R7.3, D67). The running turns are the sessions on the
+ * Environment whose body has an `activeTurnId`, in id order, at most `EGRESS_RUNNING_TURNS_MAX`.
+ * The write is `environment.egress` on the Environment's stream, under its row's lock; a deleted
  * Environment gets nothing.
  */
 export function storeEgressRecord(store) {
     return {
-        async holder(environmentId) {
+        async runningTurns(environmentId) {
             const sessions = await store.tx((t) => t.sessionsOnEnvironment(environmentId));
-            const holding = sessions.find((session) => typeof session.activeTurnId === "string");
-            return holding ? { sessionId: holding.id, turnId: holding.activeTurnId } : undefined;
+            return sessions
+                .filter((session) => typeof session.activeTurnId === "string")
+                .map((session) => ({ sessionId: session.id, turnId: session.activeTurnId }))
+                .sort((a, b) => (a.sessionId < b.sessionId ? -1 : a.sessionId > b.sessionId ? 1 : 0))
+                .slice(0, EGRESS_RUNNING_TURNS_MAX);
         },
-        async write(holder, connection) {
+        async write(connection) {
             await store.tx(async (t) => {
-                if (holder) {
-                    await t.event(holder.sessionId, holder.turnId, "egress.connection", connection, EGRESS_WRITER);
-                    return;
-                }
                 if (!(await t.environment(connection.environmentId, { lock: true })))
                     return;
                 await t.environmentEvent(connection.environmentId, "environment.egress", connection);

package/dist/gates/http-tool.d.ts

@@ -24,14 +24,13 @@ export type HttpOutcome = {
 };
 /**
  * One declared HTTP tool of a session: what the gate finds it by in the pinned manifest. An
- * agent's HTTP tool is named by its capability and tool; a flow's HTTP stage or HTTP verifier
+ * agent's HTTP tool is named by its agent and tool name; a flow's HTTP stage or HTTP verifier
  * by its stage key.
  */
 export type HttpToolRef = {
     readonly sessionId: string;
     /** The agent used as a tool that declares it; absent for the session's root agent. */
     readonly agentId?: string;
-    readonly capabilityId: string;
     readonly toolName: string;
 } | {
     readonly sessionId: string;
@@ -57,8 +56,8 @@ export interface HttpToolTenant {
     } | undefined>;
     authorize(sessionId: string, request: McpCredentialRequest): Promise<AuthorizeResult>;
 }
-/** The HTTP tool `capabilityId`/`toolName` of the agent `agentId` (the root when absent). */
-export declare function declaredHttpTool(manifest: unknown, agentId: string | undefined, capabilityId: string | undefined, toolName: string | undefined): (ToolManifest & {
+/** The HTTP tool `toolName` of the agent `agentId` (the root when absent). */
+export declare function declaredHttpTool(manifest: unknown, agentId: string | undefined, toolName: string | undefined): (ToolManifest & {
     readonly http: HttpToolTarget;
 }) | undefined;
 /** The HTTP stage or HTTP verifier at stage key `stage` of a flow session's `manifest`. */

package/dist/gates/http-tool.js

@@ -3,8 +3,10 @@
  * The loop names the tool; the gate finds its URL, method and credential in the session's pinned
  * manifest, as it finds a remote MCP server, so the loop never chooses a URL or a credential.
  *
- * `callHttpTarget` is the request and its answer, for any declared HTTP target: the input as a
- * JSON body under the Host's address policy (`tenant/outbound.ts`), a 2xx answer as the output
+ * `callHttpTarget` is the request and its answer, for any declared HTTP target: the input as
+ * core's `httpToolRequest` maps it (path parameters in the URL, the rest as a JSON body or, for
+ * `GET` and `DELETE`, the query string) under the Host's address policy (`tenant/outbound.ts`),
+ * a 2xx answer as the output
  * (JSON, or text when the answer is not JSON and no output schema asks for JSON), and every other
  * answer, a timeout or a refused address as a failed outcome the model sees. `runHttpTool` adds
  * what a tool call needs: the declaration, the vault credential and the identity headers.
@@ -14,21 +16,19 @@
  * `Nylorun-Agent-Id` is the flow agent's.
  */
 import { AGENT_ID_HEADER, SESSION_ID_HEADER, TURN_ID_HEADER, } from "@nylorun/core/compatibility";
-import { HTTP_TOOL_DEFAULT_TIMEOUT_MS, delegateManifest, flowHttpTarget, isWorkflowManifest, schemaFromJSON, } from "@nylorun/core/define";
+import { HTTP_TOOL_DEFAULT_TIMEOUT_MS, delegateManifest, flowHttpTarget, httpPathParameters, httpToolRequest, isWorkflowManifest, schemaFromJSON, } from "@nylorun/core/define";
 import { scrubValues } from "../redact.js";
-import { MAX_RESPONSE_BYTES, post } from "../tenant/outbound.js";
+import { MAX_RESPONSE_BYTES, send } from "../tenant/outbound.js";
 import { credentialSecrets } from "../vault/headers.js";
 /** How much of a failed answer's body the model sees. */
 export const HTTP_ERROR_BODY_CHARS = 2_000;
-/** The HTTP tool `capabilityId`/`toolName` of the agent `agentId` (the root when absent). */
-export function declaredHttpTool(manifest, agentId, capabilityId, toolName) {
+/** The HTTP tool `toolName` of the agent `agentId` (the root when absent). */
+export function declaredHttpTool(manifest, agentId, toolName) {
     const root = manifest;
-    if (!root || !Array.isArray(root.capabilities))
+    if (!root || typeof root !== "object" || isWorkflowManifest(root) || toolName === undefined)
         return undefined;
     const agent = agentId === undefined ? root : delegateManifest(root, agentId);
-    const tool = agent?.capabilities
-        .find((capability) => capability.id === capabilityId)
-        ?.tools?.find((item) => item.name === toolName);
+    const tool = agent?.tools?.find((item) => item.name === toolName);
     return tool?.http ? tool : undefined;
 }
 /** The HTTP stage or HTTP verifier at stage key `stage` of a flow session's `manifest`. */
@@ -44,18 +44,17 @@ export function declaredFlowHttp(manifest, stage) {
 export function isHttpToolCall(manifest, request) {
     if (request.kind !== "tool")
         return false;
-    if (request.capabilityId === undefined)
+    if (request.toolName === undefined)
         return declaredFlowHttp(manifest, request.key) !== undefined;
-    return declaredHttpTool(manifest, request.agent?.id, request.capabilityId, request.toolName) !== undefined;
+    return declaredHttpTool(manifest, request.agent?.id, request.toolName) !== undefined;
 }
 /** The ref a `tool` effect calls the Tool Gate with: its agent's HTTP tool, or its flow stage. */
 export function httpToolRefOf(request) {
-    if (request.capabilityId === undefined)
+    if (request.toolName === undefined)
         return { sessionId: request.sessionId, stage: request.key };
     return {
         sessionId: request.sessionId,
         ...(request.agent ? { agentId: request.agent.id } : {}),
-        capabilityId: request.capabilityId,
         toolName: request.toolName,
     };
 }
@@ -64,11 +63,14 @@ export function httpToolRefOf(request) {
  * the request is an outcome. Rejects only when `signal` aborts, with its reason.
  */
 export async function callHttpTarget(target, input, options) {
+    const request = httpToolRequest(target, input);
+    if ("issue" in request)
+        return failed("tool.invalid-input", request.issue);
     const timeoutMs = target.timeoutMs ?? HTTP_TOOL_DEFAULT_TIMEOUT_MS;
     const timeout = AbortSignal.timeout(timeoutMs);
-    const result = await post(target.url, JSON.stringify(input ?? {}), { ...options.headers }, {
+    const result = await send(request.url, request.body, { ...options.headers }, {
         policy: options.policy,
-        method: target.method ?? "POST",
+        method: request.method,
         signal: AbortSignal.any([options.signal, timeout]),
     });
     if (options.signal.aborted)
@@ -138,7 +140,6 @@ export async function runHttpTool(tenant, call, options) {
         ...("stage" in tool
             ? { stage: tool.stage }
             : {
-                capability: tool.capabilityId,
                 tool: tool.toolName,
                 ...(tool.agentId === undefined ? {} : { agent: tool.agentId }),
             }),
@@ -154,7 +155,7 @@ export async function runHttpTool(tenant, call, options) {
         const agentId = "stage" in tool ? undefined : tool.agentId;
         const declared = "stage" in tool
             ? declaredFlowHttp(session.manifest, tool.stage)
-            : declaredHttpTool(session.manifest, agentId, tool.capabilityId, tool.toolName);
+            : declaredHttpTool(session.manifest, agentId, tool.toolName);
         if (!declared)
             return failed("http.undeclared", "stage" in tool
                 ? `'${tool.stage}' is not an HTTP stage of the flow`
@@ -174,7 +175,10 @@ export async function runHttpTool(tenant, call, options) {
                 return failed("http.credential", `The session's Environment holds no credential '${http.credential}' for ${authorized.url}`);
             credential = authorized.headers;
             identity = authorized.identity;
-            // A credential with `via` sends the call there, a gateway (R2b C2, Q9).
+            // A credential with `via` sends the call there, a gateway (R2b C2, Q9): to its one URL, so
+            // it has no place for the tool's URL parameters.
+            if (authorized.via !== undefined && httpPathParameters(http.url).length > 0)
+                return failed("http.credential", `The credential '${http.credential}' sends calls to its via URL, which cannot take the tool's {field} URL parameters`);
             if (authorized.via !== undefined)
                 target = { ...http, url: authorized.via };
         }

package/dist/gates/journal.js

@@ -28,7 +28,6 @@ export function journalCheck(vaults) {
                 const session = await t.get("sessions", request.sessionId);
                 const tool = mcpToolOf(session?.mcpSnapshot, request);
                 if (!tool ||
-                    tool.capabilityId !== call.server.capabilityId ||
                     tool.serverName !== call.server.serverName ||
                     (tool.agentId ?? null) !== (call.server.agentId ?? null) ||
                     tool.serverToolName !== call.name)

package/dist/gates/mcp-handler.js

@@ -13,13 +13,13 @@ export function createMcpHandler(options) {
     const open = options.open ?? openMcpServer;
     const live = new Map();
     const opening = new Map();
-    const keyOf = (server) => JSON.stringify([server.sessionId, server.agentId ?? null, server.capabilityId, server.serverName]);
+    const keyOf = (server) => JSON.stringify([server.sessionId, server.agentId ?? null, server.serverName]);
     /** The declared remote server, from the session's pinned manifest. */
     async function declared(vault, server) {
         const session = await vault.session(server.sessionId);
         if (!session)
             throw new NotDeclared(`Session ${server.sessionId} not found`);
-        const found = findServer(session.manifest, server.agentId, server.capabilityId, server.serverName);
+        const found = findServer(session.manifest, server.agentId, server.serverName);
         if (!found)
             throw new NotDeclared(`MCP server '${server.serverName}' is not declared`);
         return found.server;
@@ -174,7 +174,6 @@ export function createMcpHandler(options) {
 function fields(server) {
     return {
         session: server.sessionId,
-        capability: server.capabilityId,
         server: server.serverName,
         ...(server.agentId === undefined ? {} : { agent: server.agentId }),
     };

package/dist/gates/policy.js

@@ -68,9 +68,7 @@ export function pinnedApproval(manifest, snapshot, request) {
     const mcp = mcpToolOf(snapshot, request);
     if (mcp)
         return mcpToolSettingsIn(manifest, mcp).approval === "always";
-    if (request.capabilityId === undefined)
-        return false;
-    return declaredHttpTool(manifest, request.agent?.id, request.capabilityId, request.toolName)?.approval === "always";
+    return declaredHttpTool(manifest, request.agent?.id, request.toolName)?.approval === "always";
 }
 function matches(rule, call) {
     if (rule.kind !== undefined && rule.kind !== call.kind)

package/dist/gates/tool-contract.d.ts

@@ -30,7 +30,7 @@
  * answers `{ok: false, error: {uncertain: true}}`, and the caller sends it again.
  *
  * HTTP tools (R2 M3). `POST /nylorun/v1/http-calls` `{tool, effectId, turnId, input}`: one call
- * of an HTTP tool. The loop names the tool (`{sessionId?, agentId?, capabilityId, toolName}`), or a
+ * of an HTTP tool. The loop names the tool (`{sessionId?, agentId?, toolName}`), or a
  * flow's HTTP stage or HTTP verifier by its stage key (`{sessionId?, stage}`); the gate finds its
  * URL, method and credential in the session's pinned manifest
  * (`gates/http-tool.ts`). A run token's turn is the call's; `turnId` counts only under core's

package/dist/harness/calls.d.ts

@@ -49,9 +49,9 @@ export declare function invokeModel(route: ModelRoute, request: HostEffect, sign
  * so the next advance replays it.
  */
 export declare function abortOn(signal: AbortSignal, kinds: readonly AbortReason[]): AbortSignal;
-/** True when `request` calls `save_artifact` of the `nylorun.artifacts` capability `manifest` has. */
+/** True when `request` calls `save_artifact`, which the Runtime pinned on `manifest`. */
 export declare function isSaveArtifactCall(manifest: AgentManifest | undefined, request: HostEffect): boolean;
-/** True when `request` calls `read_artifact` (R2b C11) of the `nylorun.artifacts` capability. */
+/** True when `request` calls `read_artifact` (R2b C11), which the Runtime pinned on `manifest`. */
 export declare function isReadArtifactCall(manifest: AgentManifest | undefined, request: HostEffect): boolean;
 /** True when `request` calls a tool of a declared MCP server (every one is remote). */
 export declare function isRemoteMcpCall(routing: Pick<ToolRouting, "rootManifest" | "mcpSnapshot">, request: HostEffect): boolean;

package/dist/harness/calls.js

@@ -3,13 +3,13 @@
  * Tenant's provider), the Tool Gate, the MCP pool, the SandboxManager. No store, no record: the
  * session's routing comes with the run (`TurnStart.routing`).
  */
-import { ARTIFACTS_CAPABILITY_ID, READ_ARTIFACT_TOOL, SAVE_ARTIFACT_TOOL, } from "@nylorun/core/define";
+import { READ_ARTIFACT_TOOL, SAVE_ARTIFACT_TOOL, } from "@nylorun/core/define";
 import { runAbortKind } from "@nylorun/harness/api";
 import { httpToolRefOf } from "../gates/http-tool.js";
 import { classifyThrown } from "../model/classify.js";
 import { findServer } from "../mcp/pool.js";
 import { manifestFor, mcpToolOf } from "../mcp/snapshot.js";
-import { sandboxCapabilityOf } from "../sandbox/capability.js";
+import { isPinnedRuntimeTool, sandboxToolSpec } from "../sandbox/runtime-tools.js";
 /**
  * Call the model for one effect. A provider failure comes back as a failure outcome
  * (Model Calls §6), whichever provider serves the call; only an abort throws, and the
@@ -65,20 +65,18 @@ export function abortOn(signal, kinds) {
         signal.addEventListener("abort", follow, { once: true });
     return controller.signal;
 }
-/** True when `request` calls `save_artifact` of the `nylorun.artifacts` capability `manifest` has. */
+/** True when `request` calls `save_artifact`, which the Runtime pinned on `manifest`. */
 export function isSaveArtifactCall(manifest, request) {
     return isArtifactsToolCall(manifest, request, SAVE_ARTIFACT_TOOL);
 }
-/** True when `request` calls `read_artifact` (R2b C11) of the `nylorun.artifacts` capability. */
+/** True when `request` calls `read_artifact` (R2b C11), which the Runtime pinned on `manifest`. */
 export function isReadArtifactCall(manifest, request) {
     return isArtifactsToolCall(manifest, request, READ_ARTIFACT_TOOL);
 }
 function isArtifactsToolCall(manifest, request, toolName) {
     return (request.kind === "tool" &&
-        request.capabilityId === ARTIFACTS_CAPABILITY_ID &&
         request.toolName === toolName &&
-        manifest?.capabilities.some((capability) => capability.id === ARTIFACTS_CAPABILITY_ID &&
-            capability.tools?.some((tool) => tool.name === toolName) === true) === true);
+        isPinnedRuntimeTool(manifest, toolName));
 }
 /** True when `request` calls a tool of a declared MCP server (every one is remote). */
 export function isRemoteMcpCall(routing, request) {
@@ -87,7 +85,7 @@ export function isRemoteMcpCall(routing, request) {
     const tool = mcpToolOf(routing.mcpSnapshot, request);
     if (!tool)
         return false;
-    return findServer(routing.rootManifest, tool.agentId, tool.capabilityId, tool.serverName) !== undefined;
+    return findServer(routing.rootManifest, tool.agentId, tool.serverName) !== undefined;
 }
 export async function callMcpTool(mcp, routing, request, signal, 
 /** The call's span context (R7.4), sent as `traceparent` where this process holds the connection. */
@@ -98,7 +96,6 @@ traceparent) {
     return mcp.call({
         sessionId: request.sessionId,
         ...(tool.agentId === undefined ? {} : { agentId: tool.agentId }),
-        capabilityId: tool.capabilityId,
         serverName: tool.serverName,
         serverToolName: tool.serverToolName,
         args: request.input,
@@ -127,8 +124,8 @@ traceparent) {
     }, signal);
 }
 export async function callSandboxTool(sandbox, routing, request, signal) {
-    const capability = sandboxCapabilityOf(manifestFor(routing.rootManifest, request.agent), request.capabilityId, request.toolName);
-    if (!capability)
+    const spec = sandboxToolSpec(manifestFor(routing.rootManifest, request.agent), request.toolName);
+    if (!spec)
         throw new Error(`'${request.toolName ?? ""}' is not a sandbox tool`);
     // Agents used as tools share the session's sandbox; the tree declares one sandbox spec.
     return sandbox.run({
@@ -138,5 +135,5 @@ export async function callSandboxTool(sandbox, routing, request, signal) {
         ...(routing.environmentId === undefined ? {} : { environmentId: routing.environmentId }),
         ...(routing.environment === undefined ? {} : { environment: routing.environment }),
         ...(routing.claim === undefined ? {} : { claim: routing.claim }),
-    }, capability, request.toolName, request.input, signal);
+    }, spec, request.toolName, request.input, signal);
 }

package/dist/harness/main.js

@@ -40,6 +40,7 @@ export async function runHarness(stack, baseline) {
     logger.info("host_stack_config", { services: [...stack.services], harness: config.url, gates: config.gatesUrl });
     // A pod's engine trusts the network only once its NetworkPolicy blocks what it must.
     let pod;
+    let prepare;
     if (config.pod) {
         const { waitedMs } = await awaitNetworkPolicy({
             addresses: config.pod.blocked,
@@ -53,13 +54,16 @@ export async function runHarness(stack, baseline) {
         // Join, then make the disk ready (R2d step 2) before taking any turn.
         await pod.token();
         const host = pod;
-        await prepareDisk({
+        prepare = () => prepareDisk({
             host,
             exec: localExec({ env: baseline, proxyEnv: () => host.proxyEnv() }),
             volumeFile: join(config.root, "volume-id"),
             markerFile: join(config.root, "setup.json"),
             logger,
         });
+        // A fork onto other setup (Q17) runs it after connecting: core writes its disk through the connection.
+        if (!pod.afterSeed)
+            await prepare();
     }
     const token = pod ? () => pod.token() : config.token;
     if (token === undefined)
@@ -79,6 +83,8 @@ export async function runHarness(stack, baseline) {
         version: RUNTIME_VERSION,
         onGrant: (grant) => runTokens.grant(grant),
     });
+    if (pod?.afterSeed && prepare)
+        void prepare().catch((error) => logger.warn("environment_setup_failed", { message: error instanceof Error ? error.message : String(error) }));
     const health = createServer((request, response) => {
         if (request.url !== "/health") {
             response.writeHead(404).end();

package/dist/harness/pod.d.ts

@@ -31,8 +31,13 @@ export interface PodHost {
     readonly epoch: number | undefined;
     /** The disk's setup from the last join, if its recipe has one. */
     readonly setup: DiskSetup | undefined;
-    /** The last join's volume starts from a disk version core writes: no setup runs on it. */
+    /** The last join's volume starts from a disk version core writes: no setup runs on it… */
     readonly seeded: boolean;
+    /**
+     * …unless it is a fork onto other setup (Q17): the setup runs once core has written the
+     * version, which it does through this engine's connection, so the engine connects first.
+     */
+    readonly afterSeed: boolean;
     /** Whether to run the setup again after a failure, with the plan to run now. */
     setupState(): Promise<{
         retry: boolean;