@nylorun/runtime 0.25.0-beta → 0.27.0-beta

package/CHANGELOG.md

@@ -1,5 +1,174 @@
 # Changelog
 
+## 0.27.0-beta
+
+### Minor Changes
+
+- 0a2fbc5: **Artifacts reach the harness through the Harness API; `read_artifact` and `save_artifact` run in the harness (protocol 15, Harness API 4).** The first step of the harness boundary: model-facing work belongs to the harness, and the Runtime offers primitives and holds limits and access. A fresh start for agent sessions: the Runtime speaks protocol 15 only. See MIGRATION.md.
+
+  - **The artifact seam.** A harness reads and writes the artifacts of the run it holds: `artifact.read {artifactId, version?, offset?, length?}` answers the version's metadata (`ArtifactMetaSchema`) and its bytes from `offset`, at most `turn.start.limits.chunkBytes`; `artifact.write` (`begin`, `chunk`, `commit`, `abort`) makes a file artifact of the session or a new version of one of its own, streamed with backpressure into the Object store and committed in Postgres within the Tenant's and the Environment's artifact limits. The scope is always the run's session: its own artifacts, and the Tenant-wide ones its messages named; anything else is the new error code `not_found`, alike. A write's `key` makes it idempotent within the session (`artifact_versions.write_key`, migration 0028), and its `effectId` links the artifact to a tool call of the turn, whose call id `artifact.created` carries. An upload the run leaves open commits nothing. Client helpers: `readArtifact`, `openArtifactWrite`, `writeArtifactBytes`, `toBase64` and `fromBase64` in `@nylorun/core/harness-api`.
+  - **Our harness runs the artifact tools.** `read_artifact` (every agent) and `save_artifact` (with a sandbox) are our engine's tools, defined in `@nylorun/harness` (`artifactToolsFor`, `runArtifactTool`) and run over the seam and the run's sandbox files (`HarnessExecutors.files`, `SandboxManager.writeBytes`); their calls are kind `harness`. `save_artifact` keys its write by its effect id. `read_artifact` takes `path` with a sandbox, which copies the whole artifact into it, and hands a file of any other type to the model as a file of the result (the Model Gate writes the note for one the model does not read; `artifact.unsupported` is gone). Its page is harness configuration, `createHarness({ artifactPageBytes })` (32 KiB by default), and now always ends on a whole character. `runDurable` takes `engineTools`; `apiHost` takes the engine's configuration.
+  - **The Runtime pins no artifact tools.** `runtimeManifestFor` has no `save` or `read`; `RUNTIME_TOOL_NAMES` no longer holds the two names, so an author tool may take one (our harness then refuses the turn). A session without a sandbox or skills pins its definition unchanged. Core no longer runs either tool (`tenant/artifact-tool.ts` is gone). Migration 0029 closes every agent session that pinned them (`closedReason: "protocol_15"`, `409 session_closed`); workflow sessions carry over.
+  - **Media types are core's.** `contentTypeFor`, `essence`, `normalizeContentType`, `isText`, `isModelImage`, `modelInputOf`, `inputLabel`, `extensionFor`, `unreadableReason`, `MODEL_IMAGE_TYPES` and `DEFAULT_CONTENT_TYPE` are exported from `@nylorun/core/contracts`, for the Runtime and harnesses alike.
+  - `PROTOCOL_VERSION` 15 with required feature `harness-boundary`; `HARNESS_API_VERSION` 4. The SDKs and the CLI send protocol 15.
+
+- ebe7348: **The harness decides how files reach the model; the Model Gate only fetches and translates (protocol 15).** The second step of the harness boundary, still protocol 15 and Harness API 4. See MIGRATION.md.
+
+  - **Any file may be sent.** A message naming a file the model does not read is accepted: `422 attachment_unsupported` and its error code are gone, and AG-UI and A2A accept such files too. Files are still held to the artifact size limits at upload.
+  - **`turn.start.model`** is the model descriptor (`ModelDescriptorSchema`): the provider, id, inputs, context window and output limit of the model the turn's calls use, absent for flows and without a model. One resolution (`model/descriptor.ts`) serves it, the catalog's inputs and the gate.
+  - **Our engine shows each file.** An image or document the model reads goes as its artifact reference, a text file is read over the artifact seam and inlined as a `<file>` block, and anything else (past `modelFileBytes`, a kind the model does not read) is a note it writes. `fileView`, `representFiles`, `fileBlock`, `fileNote` and `mediaReferenceLine` (moved from `@nylorun/core/define`) are exported from `@nylorun/harness`. A budget from the descriptor bounds the prompt before the first answer, and compaction counts files as the model gets them.
+  - **The Model Gate refuses instead of writing notes.** A text file as a media part, or a kind the model or its API does not read, fails the call with the new model failure code `unsupported_input`; a reference it cannot fetch fails `invalid_request`. Nothing is sent, and neither is retried.
+  - **Structured answers are the engine's.** `ModelCall.outputSchema` is removed: our engine writes the JSON instruction and parses the answer (fenced, with control characters repaired; `parseJsonWithRepair` ported from pi-ai). `message.assistant` for a structured answer now carries its JSON text.
+  - **`read_artifact`** refuses a file the turn's model does not read (`artifact.unsupported`, with the reason).
+  - `unreadableReason` is removed; `isOffice` joins the media type helpers in `@nylorun/core/contracts`.
+  - Studio's file picker accepts every file, and the refusal chips are gone.
+
+- ff6470e: **The harness writes the model's instructions and defines the sandbox and skill tools; no `runtime` block (protocol 15).** The third step of the harness boundary, still protocol 15 and Harness API 4. See MIGRATION.md.
+
+  - **No `runtime` block.** The Runtime no longer pins model-facing text or tools on a session's manifest: a session pins its definition as registered (`manifestHash` equals `definitionHash`) and keeps its sandbox spec on the session. The manifest schema refuses `runtime` with what replaces it (`REMOVED_MANIFEST_FIELDS`). `runtimeManifestFor`, `runtimeToolOf`, `RuntimeManifest`, `RUNTIME_TOOL_NAMES`, `isRuntimeToolName`, `createSandboxTools`, `SANDBOX_INSTRUCTIONS`, the skill tool names, `isSkillTool`, `SKILLS_USAGE`, `formatSkillCatalog` and `skillOfToolCall` leave `@nylorun/core/define`; `RUNTIME_PART_ID` is `SESSION_PART_ID` (`"session"`), and `agentFrom` takes `sessionInstructions`. `@nylorun/agents` no longer re-exports the skill catalog helpers. Migration 0030 closes the agent sessions that still pinned a `runtime` block (`closedReason: "protocol_15"`).
+  - **`turn.start` states facts.** `environment` (`TurnEnvironmentSchema`: `{id, kind, sandbox?: {workspace}}`) and `routing.sandbox.spec` (the pinned spec) join the agent's `skills`.
+  - **Our engine words them.** `@nylorun/harness` writes the skill catalog, the sandbox note and the skills' folder note, and defines the six sandbox tools, `load_skill` and `read_skill_resource`, in the order and bytes the `runtime` block had, so the prompt's prefix is unchanged (`engineToolsFor`, `sandboxTools`, `sandboxInstructions`, `skillCatalogText`, `skillFolderNote`, `skillTools`, all exported for a harness of your own). The skill tools run in the harness over `definition.file` (`runSkillTool`), and core no longer runs them (`tenant/skill-tool.ts` is gone). The sandbox tools' limits are harness configuration (`createHarness({ sandboxTools })`, `harnessExecutors({ sandboxTools })`, `DEFAULT_SANDBOX_TOOL_LIMITS`), as is the most a skill read takes into the context (`createHarness({ skillReadBytes })`, 10 MiB by default), held to the run's `limits.recordEntryBytes`.
+  - **Effects name their target.** A tool effect carries `target: {kind: "mcp" | "http" | "sandbox" | "harness" | "platform"}` (`EffectTargetSchema`) and may carry `skill`; the record routes by the kind, never by the tool's name, and a call without a target or one the session lacks is `tool.unavailable`. `hello.features.tools` and `NativeToolSchema` are removed, no tool name is reserved, and the record keeps the skill the intent names when the agent has it. A skill tool's `tool.completed` is `kind: "harness"` (it was `platform`).
+  - **Studio** drops the manifest panel's Runtime section: it shows the sandbox tools when the session's Environment has a sandbox.
+
+- f443475: **The harness builds the MCP tool list and shapes tool results; tools are identified by server and tool (protocol 15).** The fourth step of the harness boundary, still protocol 15 and Harness API 4. See MIGRATION.md.
+
+  - **Tools have an identity.** An MCP tool call's target is `{kind: "mcp", server, tool}` (the server's own name for the tool) and an HTTP tool call's `{kind: "http", tool}` (its declared name); `platform` is gone. `toolName` is the model's name, for display. The record checks an MCP call against the session's discovery (`tool.unknown`) and the turn's tool settings (`tool.disabled`), and `tool.completed`, tool-call rows (`tool`), approvals (`Approve server / tool?`, `interaction.tool`) and traces (`nylorun.tool.identity`) carry the identity. The Tool Gate matches a call to its journaled target.
+  - **Tool policy keys on identity.** A rule's `tool` is the tool's identity, never the model's name. A rule whose `tool` has `__` in it is refused at `PUT /v1/tenant/tool-policy`; a stored one makes the policy unreadable, so every call is denied (and `GET` answers `409`) until the policy names the tool by `server` and `tool`.
+  - **`turn.start.mcp` states facts.** The session pins what its servers listed, raw (`McpSnapshot` v2: servers, scrubbed instructions, tools as named); each turn gets `mcp` (`McpFactsSchema`: every tool with `enabled` and the manifest's `deferred` hint) in place of `sessionTools` and `routing.mcpSnapshot`, and `session.mcp` answers `{mcp}`. `mcp.discovered` has no `renamed` or `deferred`. Migration 0031 closes the sessions that pinned the former snapshot (`closedReason: "protocol_15"`).
+  - **Our engine names, defers and searches.** `@nylorun/harness` names MCP tools (`mcpToolName`, `mcpToolNames`, within the 64-character provider ceiling), defers them by the manifest's setting or the model's window and pins that layout in its state (`mcpToolSet`, `McpLayout`), and runs `tool_search` (BM25) itself; core's `tool_search`, `deferredToolsTools`, `TOOL_SEARCH_TOOL` and `TOOL_CALL_TOOL` leave `@nylorun/core/define`, and `runDurable` takes `mcp` instead of `sessionTools`.
+  - **Our engine shapes tool results.** Core no longer stores large or binary tool results: the record refuses an outcome past `limits.recordEntryBytes` (`limit_exceeded`). Our engine spills them with `artifact.write`, keyed by the call and its bytes (`spillKey`), with a preview, an image as a file for a model that reads images, and one budget per step (`shapeToolOutcome`, `StepBudget`, exported for a harness of your own). The Tool Gate still scrubs credentials and refuses answers past `limits.toolAnswerBytes`.
+  - **Harness configuration.** `createHarness({ mcpTools, toolResults })` sets the deferral share, characters per token, fallback window, the note's instruction length, `tool_search`'s limits, the inline cap, preview head and tail, step budget, stub, small size and entry envelope (`DEFAULT_MCP_TOOL_CONFIG`, `DEFAULT_TOOL_RESULT_CONFIG`).
+  - **The MCP preview** names tools as Nylorun's engine would (`modelName`, `renamed`) and shows a server's instructions uncut.
+  - **Studio** shows an MCP tool as `server / tool` in tool and approval cards, with the model's name, and links the artifacts a tool's result was stored in.
+  - **`examples/harness-minimal`** spills a large `bash` output with `artifact.write` and keeps a preview; its README shows how a harness of your own offers MCP tools.
+
+- cf425c6: **The harness mounts skills and saves outputs; the in-process harness uses the gates; compaction is a transcript edit (protocol 15).** The fifth step of the harness boundary, still protocol 15 and Harness API 4. See MIGRATION.md.
+
+  - **Skill folders are our engine's.** Before each sandbox call our engine mounts each skill version of the turn's tree at `/skills/<name>@<hash>/` with `executors.files.mount`, reading the bytes over `definition.file`; the SandboxManager only writes them (`mountFolder`), once per open sandbox (`present` after). `SandboxManager.mountSkills`, its `definitionFile` port and `SandboxSessionRef.manifest` are gone, and the operator sandbox route mounts nothing.
+  - **The outputs folder is our engine's (Q5).** At a completed turn's end in a sandbox our engine saves `/workspace/outputs` as the session's `outputs` folder before `turn.completed`, over the new folder mode of `artifact.write` (`kind: "folder"`, `file`, chunks named by hash, `unchanged`, `refused`). Core takes every byte, checks each file's hash before content is stored under it, dedupes, and keeps the content epoch and quotas. Versions say `source: "engine"`; `artifact.export.skipped` and `artifact.export.failed` are harness claims. Core's export (`artifacts/export.ts`, the `WorkspaceReader`, `workspace.read` listing and bytes calls) is removed.
+  - **No limit literals.** The new Runtime limit `folderEntries` (10,000; a count, its ceiling from the manifest's one string) replaces `EXPORT_MAX_FILES`, and `createHarness({ outputs: { dir, maxBytes } })` (`/workspace/outputs`, 1 GiB) replaces `EXPORT_MAX_BYTES`. `RUNTIME_LIMIT_CEILINGS` entries are `{value, unit, why}`.
+  - **In-process parity.** Every model call goes through the Model Gate: a scripted model is served by `providerModelGate`, metered like any. The MCP pool opens every server through the Tool Gate (`openRemote` is required; the in-process gate's `openMcp` finds the server in the session's pinned manifest and authorizes it with the vault). `ModelRoute` is `{tenantId, modelGate}`; `TenantContext.modelProvider`, `useVaultModel` and `workspaces` are gone.
+  - **Compaction is a transcript edit (Q4).** Summary calls say `purpose: "summary"` (no `message.assistant`), and the segment's edit that replaced the history says `kind: "compaction"` with its facts and summary calls (`CompactionFactsSchema`, `transcriptUpdates(..., compaction)`). Core checks the calls and writes one `context.compacted`, which loses `partial`.
+
+- dc75e58: **Host timings, retries and engine settings are configuration with defaults (B15).** Still protocol 15 and Harness API 4. See MIGRATION.md and DEPLOYMENT.md ("Host tuning").
+
+  - **Host tuning.** The Runtime processes' timeouts, retries, poll intervals and internal sizes are one typed schema with a default each (`HostTuningSchema`, `runtime/server/src/tuning.ts`): keys, the Harness API, the API's streams, the Host, the Object store, the Tenant, its sweep, Durable Session Execution, Restate, Postgres, Durable Streams and the relay, the gates, egress-gate, sandbox pods, harnesses and traces. An operator sets any part in `NYLORUN_TUNING` (JSON), parsed with the stack configuration and read once at start; every default is the value before. An unknown key or a value past its ceiling (Node's longest timer, S3's part sizes, S2's batch, the sandboxes service's wait) stops the process naming the key. Core hands a sandbox pod's engine the `harness` and `engine` groups the operator set. `nylorun start` passes `NYLORUN_TUNING` to the runtime, gateway and harness containers.
+  - **Our engine's loop is configuration.** `createHarness` takes `compaction` (`CompactionConfig`, `DEFAULT_COMPACTION_CONFIG`: the kept tail, the reply's reserve, the estimate), `partialOutputChars` (a failed agent-as-tool's output its parent sees), `resendDelaysMs` and `leaseRetryMs`; `runDurable` takes `loop` (`LoopConfig`), which an invocation hands its agents used as tools. `EngineToolConfig` is `EngineConfig`. The Runtime's harness host passes the tuning's `engine` group to `createHarness`.
+  - **Kept as constants**, each justified where it is defined: Node's longest timer, S3's part sizes and object key, S2's batch, the sandboxes service's longest wait and pod variable, the `environment.egress` event's 16 running turns, W3C's 512-character `tracestate`, and the 24-hour floor of a wake's dedupe key.
+
+- 23774c4: **The last hard-coded limits are configuration (harness boundary B15c).** Still protocol 15 and Harness API 4. Every default is the value before. See MIGRATION.md, and DEPLOYMENT.md's Runtime limits and Host tuning.
+
+  - **21 more Runtime limits** (`GET`/`PUT /v1/tenant/limits`): a message's parts (`messageParts`), page sizes (`pageItems`, `exportPageItems`, `environmentEventItems`; a page asked larger holds that many), labels (`artifactLabels`, `labelKeyChars`, `labelValueChars`), a manifest's setup command, descriptions and secret hosts (`setupCommandChars`, `manifestDescriptionChars`, `secretDescriptionChars`, `secretHosts`), a failed pod's reason (`setupReasonChars`, `setupCommandExcerptChars`), secret values (`secretValueChars`), the tool policy and budgets (`toolRules`, `toolRuleFieldChars`, `toolRuleTextChars`, `modelBudgets`) and flows (`flowConcurrency`, `flowMapItems`, `flowLoopIterations`, replacing the `NYLORUN_FLOW_*` variables no Host read). Request schemas lose these maxima; the Runtime checks the Tenant's.
+  - **More Host tuning** (`NYLORUN_TUNING`): token lifetimes and clock tolerance (`keys.*`), the advance deadline and grace (`execution.*`), `nylorun-operate`'s waits, the credential store's lock, sweep arming, Postgres batches and the replication pool, a basin repair's log cadence, egress sockets, the engine poll and sandbox memory floor, MCP listing pages and diagnostics, sandbox helper commands, the scrub threshold, exec event and local stream sizes; and in the engine, `flowValueChars` and `toolResults.minPreviewBytes`.
+  - **The CLI's own waits are `NYLORUN_CLI_TUNING`**: `nylorun start`'s waits and polls, the Compose healthchecks and WAL cap, and `nylorun local sandbox`'s waits.
+  - **Studio follows the Runtime's limits**: no upload cap of its own, the Tenant's `requestBodyBytes` read for a write it parses past the default (`@nylorun/agents` exports `RUNTIME_LIMIT_DEFAULTS`), no CPU cap in its form.
+  - **Kept, each justified where it is defined**: Linux's `MAX_ARG_STRLEN` (a setup command's ceiling) and `PATH_MAX` (a link target), a model-facing tool name's 64 characters, RFC 6838's media type length, Postgres's 65,535 bind parameters, a tmpfs page, and identifier grammars (the protocol's).
+
+- b1e815d: **Runtime limits are a Tenant setting, and harnesses get them in `turn.start.limits`.**
+
+  - What one record entry, model call, model file, tool answer, custom harness state and Harness API chunk may hold is the new Management API setting `GET`/`PUT /v1/tenant/limits` (`{ limits: { recordEntryBytes, modelCallBytes, modelFileBytes, toolAnswerBytes, harnessStateBytes, chunkBytes } }`), also `admin.settings.limits` and `nylorun tenant settings limits [get | put <file|->]`.
+    - The defaults are today's sizes (`RUNTIME_LIMIT_DEFAULTS`): 960 KiB, 32 MiB, 8 MiB, 8 MiB, 256 KiB and 16 MiB. A limit left out of a `PUT` takes its default.
+    - Each limit has a ceiling a dependency sets (`RUNTIME_LIMIT_CEILINGS`): S2's 1 MiB record less 64 KiB for the event's envelope, the 64 MiB Harness API frame, the longest JavaScript string. A limit above its ceiling is `400`, naming the ceiling.
+    - Each is read from the Tenant's database where it is checked; nothing keeps it.
+  - **The record holds every write to `recordEntryBytes`.** An event whose payload, or an effect outcome whose value, is larger, whoever wrote it, is refused with `limit_exceeded`: `413` (`details.limit: "recordEntryBytes"`) to an API client, the new Harness API error code `limit_exceeded` to a harness. A harness's claimed event past it is refused rather than dropped. Before, such an event reached a record S2 could not take.
+  - **The gates read the setting.** The Model Gate refuses a body past `modelCallBytes` and a file past `modelFileBytes`; the Tool Gate keeps no MCP or HTTP answer past `toolAnswerBytes` (`mcp.too-large`, `http.too-large`) and reads no tool body past it. A custom harness's state past `harnessStateBytes` fails its turn with `limit_exceeded` (it was `invalid`), and a `definition.file` range longer than `chunkBytes` is `limit_exceeded`. Core's step budget for tool results is unchanged (256 KiB), or half `recordEntryBytes` when that is less.
+  - **`turn.start` carries `limits`** (`RuntimeLimitsSchema`), the limits in force when the segment started. Harness API 3 and protocol 14 are unchanged, but `TurnStartSchema` is strict: a harness built against an older `@nylorun/core` refuses a `turn.start` with `limits`, so upgrade a custom harness with the Runtime. Our harness asks for skill files `limits.chunkBytes` at a time, and holds MCP answers on its own connections to `limits.toolAnswerBytes`. `createHarness` takes `onStart(grant, start)`.
+  - **Removed exports:** `MAX_MODEL_CALL_BYTES`, `MAX_TOOL_BODY_BYTES`, `MAX_HARNESS_STATE_BYTES` and `DEFINITION_FILE_CHUNK_BYTES` from `@nylorun/core`. Added: `RuntimeLimitsSchema`, `RUNTIME_LIMIT_DEFAULTS`, `RUNTIME_LIMIT_CEILINGS`, `runtimeLimitsOf`, `runtimeLimitIssues`, `limitExceededMessage`, `S2_RECORD_MAX_BYTES`, `RECORD_ENVELOPE_RESERVE_BYTES`, `JS_STRING_MAX_LENGTH` and the `TenantLimits*` schemas.
+
+- f2e9b0a: **Skill and artifact limits are set per Tenant and per Environment manifest; a skill holds up to 2 GiB by default, with no limit per file or on the number of files.**
+
+  - The 10 MiB limit per skill file and the 500-file limit are gone. A skill's files may hold up to the Tenant's skill limit together: 2 GiB by default (`SKILL_TOTAL_BYTES_DEFAULT`). A file at two paths counts twice, since a sandbox holds both copies. `SKILL_FILES_MAX` and `DEFINITION_FILE_MAX_BYTES` are no longer exported.
+  - The Tenant's skill limit is the new Management API setting `GET`/`PUT /v1/tenant/skills` (`{ limits: { totalBytes } }`), also available as `admin.settings.skills` and `nylorun tenant settings skills [get | put <file|->]`.
+    - `PUT /v1/files/sha256:<hex>` takes a file up to that limit.
+    - `PUT /v1/agents/{id}` refuses a skill over it, an agent used as a tool included: `413 limit_exceeded`, with `details.skills` listing each skill and its size.
+  - An environment manifest, or the inline fields of `PUT /v1/environments/{id}`, may set `limits`: `artifacts.fileBytes`, `artifacts.totalBytes` and `skills.totalBytes`. Like the manifest's other fields, they are fixed for the Environment's life.
+    - Each limit must be at most the Tenant's. A higher one is refused with `400` when the Environment is made or the manifest is saved.
+    - A limit left out is the Tenant's at the time it is checked. A Tenant that lowers a limit lowers it for every Environment.
+    - The Environment view's new `limits` field gives the limits in force.
+  - An Environment's artifacts are its sessions' artifacts and its disk versions. Uploads, `save_artifact`, turn-end exports and disk snapshots hold them to the Environment's per-file limit and to its own total, as well as to the Tenant's total. A turn-end export past the Environment's total is skipped with the new reason `environment_total`, and a disk snapshot past it is `413` with `details.limit: "environment_total"`.
+  - A session opens on an Environment only when its agent's skills fit the Environment's skill limit; otherwise it is `409 environment_unsuitable`, with `details.skills`.
+  - `PUT /v1/files` streams the body to the Object store instead of holding it in memory. Only bytes that match the named hash reach the file's key. Environment files named by hash are held to the same per-file maximum.
+  - `@nylorun/agents`: loading a skills folder no longer checks a size, since the limit is the Tenant's; the Runtime refuses an oversized skill. The `skills.file-too-large` and `skills.too-many-files` errors are gone. Files are hashed and read a chunk at a time.
+  - Sandboxes get skill files as a stream. A harness fetches them from core 16 MiB at a time: `definition.file` takes optional `offset` and `length` (at most the Runtime limit `chunkBytes`).
+  - `load_skill` and `read_skill_resource` read files of up to 10 MiB into the model's context. A larger file fails with `skill.resource_too_large`, and the error names the file's path in the sandbox when there is one.
+
+- 6772612: **The remaining request, upload, token and sandbox limits are Tenant settings (harness boundary B15).** Still protocol 15 and Harness API 4. See MIGRATION.md and DEPLOYMENT.md's Runtime limits.
+
+  - **27 more Runtime limits** in `GET`/`PUT /v1/tenant/limits`, each with today's value as its default and a ceiling from a dependency (a JavaScript string or timer, a request read as one string, a Harness API frame, a JavaScript number): request bodies and inline files (`requestBodyBytes`, `inlineFileBytes`), `a2aWaitMs`, `errorExcerptChars`, `traceContentBytes`, an Environment's labels, setup and input files (`environmentLabels`, `environmentSetupCommands`, `environmentFiles`, `environmentFilesPerEntry`, `environmentSecretSlots`, `setupCommandMs`, `setupOutputChars`), disk versions (`diskVersionEntries`, `diskVersionBytes`, `diskLeaseMs`, `diskPodWaitMs`; an Environment's manifest may lower the first two with `limits.disk`), model calls (`modelRequestMs`, `modelIdleMs`, `modelAttempts`, `modelRetryDelayMs`, `modelProviderRetries`, `modelRetryDelayMaxMs`, read by the gates for each call) and tools (`toolAttempts`, `httpToolTimeoutMs`, `mcpPreviewMs`, `mcpMetadataBytes`, and the new `mcpSnapshotBytes`: what a session pins of its MCP servers' tools and instructions, past which a server is left out with a diagnostic).
+  - **Schema maxima are checked against the Tenant's limits**: an Environment's labels, setup commands, input files, files per entry, secret slots and setup timeout, and an HTTP tool's `timeoutMs` (at deploy and at each call). `limits.environments` and `lifecycle.stopGrace` lose their arbitrary caps; an identity file's issuer takes any number of grants and `jwksFetch` settings.
+  - **`turn.start.limits` carries only a harness's limits** (`HarnessLimitsSchema`, `harnessLimitsOf`), and a harness drops one it does not know. `transcriptUpdates` takes `recordEntryBytes` and fills each event up to it; `CHUNK_BYTES` is gone.
+  - **Constants a dependency or a standard fixes stay, named for it**: a token is read up to Node's `http.maxHeaderSize`; artifact names and folder paths keep `FILE_NAME_MAX` (255) and `FILE_PATH_MAX` (1,024); a skill file's path is what `FILE_PATH_MAX` leaves under its mount folder; `tracestate` keeps W3C's 512.
+  - **Removed**: `ENVIRONMENT_LABELS_MAX`, `ENVIRONMENT_SETUP_MAX`, `ENVIRONMENT_SETUP_TIMEOUT_MAX_MS` (now `ENVIRONMENT_SETUP_TIMEOUT_DEFAULT`), `ENVIRONMENT_FILES_MAX`, `ENVIRONMENT_SECRET_SLOTS_MAX`, `TOKEN_ENVIRONMENT_GRANTS_MAX`, `HTTP_TOOL_MAX_TIMEOUT_MS`, `READ_ARTIFACT_MAX_BYTES` and `CHUNK_BYTES` from `@nylorun/core`; the image checks (`decodeImageBase64`, `validateImageBytes`, `IMAGE_MEDIA_TYPES`, `MAX_IMAGE_BYTES`), the Tenant configuration's `modelCall` and `TrustedIssuersOptions`' `refetchMs`/`maxAgeMs` from `@nylorun/runtime`. Studio's Environment form no longer caps setup commands and input files at 16: the Runtime checks the Tenant's limit.
+
+### Patch Changes
+
+- 8715ad8: The fixture model reads its `fixture:*` script in a turn that carries a file. Our harness ends such a turn with a user message listing the files (`FILES_MESSAGE_HEADER`, now exported by `@nylorun/harness`), and the fixture model read that message instead: it answered "I remember: …" and called no tool. It now skips that message, for the script and for the tool result it answers after.
+- 06940f5: The Model Gate reads only the files a session may read: its own artifacts and the Tenant-wide ones its messages named, as `read_artifact` does. Before, a model call could name any Tenant-wide artifact and the gate sent its bytes to the provider.
+- 0f3836f: A pod Environment pins its image by digest only when the digest is of the repository it asked for. kind names an image it loads onto a node `import-<date>`, and the Runtime pinned `docker.io/library/import-<date>@sha256:…`, which no registry serves: the next pod failed with `ErrImagePull`.
+- b8b5b8c: **The trace projector's status counts the batch it is posting.** `pendingTxs` now includes the transactions of a post in flight, which are not acknowledged until it settles; it said `0` while one was still being retried.
+- 2459430: **An `environment_secret` reads `nylorun_managed` in the sandbox instead of `nylorun-managed`, so CLIs that check a token's format send their requests.**
+
+  - The Vercel CLI refuses a `VERCEL_TOKEN` with any character outside letters, digits and `_` (`Must not contain: "-"`) and exits before egress-gate can set the header. `ENVIRONMENT_SECRET_SENTINEL` is now `nylorun_managed`.
+  - egress-gate never compares the value: it replaces the credential's header whatever the CLI sent, so nothing else changes. A script that checks for the literal `nylorun-managed` should check for `nylorun_managed`.
+
+- Pin core to the tested release.
+- Pin harness to the tested release.
+- Updated dependencies [8715ad8]
+- Updated dependencies [0a2fbc5]
+- Updated dependencies [ebe7348]
+- Updated dependencies [ff6470e]
+- Updated dependencies [f443475]
+- Updated dependencies [cf425c6]
+- Updated dependencies [dc75e58]
+- Updated dependencies [23774c4]
+- Updated dependencies [b1e815d]
+- Updated dependencies [2459430]
+- Updated dependencies [f2e9b0a]
+- Updated dependencies [6772612]
+- Updated dependencies
+  - @nylorun/core@0.23.0-beta
+  - @nylorun/harness@0.28.0-beta
+
+## 0.26.0-beta
+
+### Minor Changes
+
+- a0cf8b2: **HTTP tools take `GET` and `DELETE`, and URL path parameters.**
+
+  - `method` is `GET`, `POST` (default), `PUT`, `PATCH` or `DELETE`. `POST`, `PUT` and `PATCH` send the input as the JSON body, as before. `GET` and `DELETE` send no body: the input becomes the query string, after any query string written in the URL. An array repeats its name (`tag=a&tag=b`) and a `null` is left out.
+  - The URL's path may name input fields as `{field}`, as in `https://api.example.com/orders/{orderId}`. Each value is percent-encoded into the path and is not sent again in the body or query string. A value that is empty, `.` or `..`, or not a string, number or boolean is refused before the call is sent (`tool.invalid-input`).
+  - `http()` and the manifest contract check a tool against its input schema. Each `{field}` must be a required scalar property. For `GET` and `DELETE`, a property must not be an object and must not repeat a query parameter the URL already sets.
+  - An HTTP verifier still takes only `POST`, `PUT` or `PATCH` and a URL without `{field}` parameters, because it is sent `{ input, output, iteration }` as a body. A credential with `via` cannot serve a tool with `{field}` parameters (`http.credential`).
+  - core exports `httpToolRequest`, which maps a call's input to the request, and `httpPathParameters`. The Runtime's outbound `post()` is now `send()`, which can send a request without a body.
+
+### Patch Changes
+
+- 620072d: **Docs and schemas match what the CLI and the Runtime do.**
+
+  - `@nylorun/core`: the environment manifest's JSON Schema (`@nylorun/core/schemas/environment-manifest.json`) takes the CLI's `{ path, from }` `files` entry, so an editor no longer flags a manifest that `nylorun environments manifests save` accepts. The Runtime's own schema is unchanged: the CLI turns the folder into `{ path, files }` before saving. `manifest_changed` says to save without `If-Match` (`--if-match`, `ifMatch`); no command takes `--force`.
+  - Tool names, skill names and MCP server names are each unique within their kind, as the builder and the Runtime check; a tool, a skill and a server may share a name. The docs said they were unique across kinds.
+  - `harness_mismatch` is described as what it is since protocol 14: an Environment's harness is fixed for its life (fork onto a manifest version to run another), and a session's turn is refused when its Environment id was deleted and made again with another harness, or an Environment changed in place before protocol 14 applies that change.
+  - `@nylorun/agents`: the README names `nylorun environments list | delete`, not `nylorun local sandbox ls | rm`.
+  - MIGRATION.md no longer offers a tool's `approval`, removed in protocol 11, as a replacement for step middleware.
+
+- 71edf68: egress-gate's `environment.egress` names the turns its one read saw as the connection opened: the read starts as the name resolves and the tunnel never waits for it, as the docs now say. The egress-gate event test waits for that read before it moves a turn, so it no longer fails on a slow runner.
+- 000ff75: **READMEs and help text match protocol 14.**
+
+  - `nylorun --help` lists `environments fork`, `manifests` and `delete-version`. The package description no longer offers `nylo` as the Runtime client, and the README says nylorun depends on `@nylorun/agents` too.
+  - The READMEs name the current commands: `nylorun tenant keys`, `nylorun tenant mcp inspect`, `nylorun local logs` and `nylorun local reset`. `@nylorun/admin` says it speaks protocol 14.
+  - `@nylorun/agents`: a lost MCP or HTTP tool call is sent again with its key, then fails to the model as `tool.interrupted` (it is not left `uncertain`). Every manifest is v7. A2A takes `raw` files. A delegated agent cannot pause.
+  - `@nylorun/runtime`: the README describes protocol 14, `PUT /v1/sessions/{id}` says it answers an identical session (vaults are no longer attached), and the database-layout error names `nylorun local reset`.
+  - `@nylorun/create-agent`: `nylorun start` writes the project's keys (no key is derived any more).
+
+- Pin core to the tested release.
+- Pin harness to the tested release.
+- Updated dependencies [620072d]
+- Updated dependencies [a0cf8b2]
+- Updated dependencies
+  - @nylorun/core@0.22.0-beta
+  - @nylorun/harness@0.27.1-beta
+
 ## 0.25.0-beta
 
 ### Minor Changes

package/README.md

@@ -172,11 +172,20 @@ are refused from browsers before they are looked up. The Runtime sends no CORS h
 `OPTIONS` with `204` and `Allow` only: the operator's reverse proxy answers preflights
 ([DEPLOYMENT.md](../../guides/DEPLOYMENT.md#calling-the-runtime-from-browsers-and-apps)). Missing or
 unsupported protocol → `426` before authentication, unless the request sends neither
-`Nylorun-Protocol` nor `Authorization` (the Host serves protocol 13 only; protocol 13 makes the
+`Nylorun-Protocol` nor `Authorization` (the Host serves protocol 15 only; protocol 15 moves
+`read_artifact` and `save_artifact` to our harness, which runs them over the Harness API's
+artifact seam, and closes every agent session that pinned them; protocol 14 adds
+environment manifests (`/v1/environment-manifests/{name}`): an Environment is made from one
+version and never changes what it runs (a new version reaches it through
+`POST /v1/environments/{id}/fork`), a manifest's `secrets` declare slots and an agent's
+`requires` is checked when a session opens; sessions on one Environment run their turns in
+parallel, and egress connections are `environment.egress` events on the Environment's stream,
+in no session log or trace; protocol 13 makes the
 manifest flat, manifest 7: no `capabilities`, tools known by name, the Runtime's own tools in the
 pinned manifest's `runtime` block and no `capabilityId` on events, tool call rows or the Harness
 API, now 3; it closes every session opened before it; protocol 12 adds
-model inputs, the `422 attachment_unsupported` accept check and `read_artifact` for every agent,
+model inputs and `read_artifact` for every agent (its accept check, `422
+attachment_unsupported`, left with protocol 15: the harness decides how the model sees a file),
 and changes nothing a protocol 11 client sends; protocol 11 replaces
 sandbox resources, the Tenant's default sandbox, inline sandboxes and user and installation
 vaults with Environments, each one sandbox and one vault, under `/v1/environments`, and
@@ -188,9 +197,9 @@ credential_required` or `credential_invalid` with a `WWW-Authenticate: Bearer` c
 token without a route's scope gets `error="insufficient_scope"`, and
 `/.well-known/oauth-protected-resource` lists the trusted issuers (RFC 9728); protocol 8 gives keys roles, moves vaults and signing keys under `/v1/tenant` and removes
 the Admin API, and those old paths answer `404` with no alias; protocol 7 removes subject tokens, the access policy, revocations, browser keys and
-derived principals, whose routes answer `404`; protocol 6 adds file and folder artifacts and message `parts`; at each turn's end the
-Runtime exports `/workspace/outputs` of the session's sandbox as a version of its
-`outputs` folder, read at `/v1/artifacts/{id}/versions/{n|latest}/tree`, `/files/{path}`,
+derived principals, whose routes answer `404`; protocol 6 adds file and folder artifacts and message `parts`; at each turn's end
+our harness saves `/workspace/outputs` of the session's sandbox as a version of its
+`outputs` folder (over the artifact seam since protocol 15), read at `/v1/artifacts/{id}/versions/{n|latest}/tree`, `/files/{path}`,
 `/diff?from=` and `/zip`). Clients name no Tenant (since protocol 5). A Tenant that
 could not be opened → opaque `404` with identical body. A path or method no route serves is `404 Route not found`
 once the caller is known.
@@ -268,11 +277,11 @@ stage) is refused. Your services are reached as tools: HTTP tools, POSTed from t
 so their URLs must be reachable from it, and remote MCP servers. Each URL gets a
 credential in the vault of the Environment a session names (`PUT
 /v1/environments/{id}/secrets/{name}`), the operator previews an MCP server's tools
-(`nylorun mcp inspect --environment <id>`),
-and the manifest says which tools are enabled or deferred
-([DEPLOYMENT.md](../../guides/DEPLOYMENT.md#mcp-servers-and-http-tools)). Which calls wait for a
-person, or are refused, is the Tenant's tool policy
-([DEPLOYMENT.md](../../guides/DEPLOYMENT.md#tool-policy)). Model gateway
+(`nylorun tenant mcp inspect --environment <id>`),
+and the manifest says which tools are enabled, and which to defer (a hint the harness
+follows; [DEPLOYMENT.md](../../guides/DEPLOYMENT.md#mcp-servers-and-http-tools)). Which calls wait for a
+person, or are refused, is the Tenant's tool policy, which names an MCP tool by `server` and
+its own name ([DEPLOYMENT.md](../../guides/DEPLOYMENT.md#tool-policy)). Model gateway
 and sandbox backend are Tenant configuration (the Tenant's own vault, Tenant
 settings and seed), not Host process env.
 
@@ -288,10 +297,11 @@ read from Durable Streams (S2). An advance owns its session through a lease with
 an epoch; a Worker that takes over after a crash marks in-flight model effects
 `uncertain`, and sends an interrupted MCP or HTTP tool call again with the same key (R5). Vault ciphertext needs that Tenant's own KEK.
 
-A session that names an Environment of kind `virtual` or `pod` gets Runtime-executed
-sandbox tools, pinned in its manifest's `runtime` block with `save_artifact`; the agent declares
-nothing, and none of its own tools may take a Runtime tool's name. The Tenant owns each Environment; backend
-names are prefixed `nylorun-<tenant-id>-`.
+A session that names an Environment of kind `virtual` or `pod` gets a sandbox, its spec pinned
+on the session: our harness offers the sandbox tools and `save_artifact` and writes their notes
+(protocol 15), and runs the calls in it. The agent declares nothing, and no tool name is
+reserved: each call names what runs it. The Tenant owns each Environment; backend names are
+prefixed `nylorun-<tenant-id>-`.
 
 ## Local Project workflow
 
@@ -311,11 +321,11 @@ the Project link (outside a project it runs the Tenant `default`); the project's
 | `database-layout-old` | The database holds `tenant_<id>` schemas of an older Runtime, or the `schema_version` tables of a pre-release one: point the Runtime at a new database (locally, a new Tenant: `nylorun start --tenant <new name>`); the old one is left as it is |
 | `426 protocol_unsupported` | Upgrade clients or Host to a compatible set |
 | `421 host_rejected` / `403 origin_rejected` | In a container, list the `Host` in `NYLORUN_ALLOWED_HOSTS`. From a browser, send a trusted issuer's token, never a key |
-| `422 attachment_unsupported` | A message names a file the Tenant's model does not read (`details.parts` says which and why): choose a model that reads it, add the input with `PUT /v1/tenant/models/inputs` (or a custom endpoint's `settings.inputs`), or send it as another type |
+| A turn fails `model.unsupported_input` | A custom harness sent the Model Gate a part the model cannot take (a text file as media, or a kind the model does not read): it should decide by `turn.start.model`. With our harness, the model was switched mid-turn: send the message again |
 | `403 key_role_mismatch` | The key belongs to the other API: use a management key on `/v1/tenant/*` (`@nylorun/admin`) and an application key everywhere else (`@nylorun/agents`) |
 | `503` for a Tenant | Postgres or Restate is unreachable; `GET /ready` names which |
 | Port in use | Change `NYLORUN_PORT` in `~/.nylorun/tenants/<name>/docker/.env` and run `nylorun start` |
-| Logs | `nylorun logs runtime` |
+| Logs | `nylorun local logs runtime` |
 
 Definitions have no `agent.run()`; applications use `@nylorun/agents`.
 

package/dist/adapters/execution/restate.d.ts

@@ -1,18 +1,12 @@
 import { type DurableExecution, type SandboxSignal, type StuckInvocation, type Wake, type WorkerHandlers } from "../../execution/types.js";
-/**
- * How long one send through the ingress keeps retrying while the ingress is unreachable,
- * overloaded, or answers 404 because a just-registered service has not reached it yet. The
- * outbox's grace (`OUTBOX_GRACE_MS` in `tenant/sweep.ts`) is longer.
- */
-export declare const SEND_RETRY_MS = 10000;
 export interface RestateTimeouts {
     /**
      * How long an invocation may run without journal progress before Restate
      * asks it to suspend. An advance makes no journal entries while it runs, so
-     * this must exceed the longest segment. Default one hour.
+     * this must exceed the longest segment. Default `restate.inactivityMs` (Host tuning, one hour).
      */
     inactivityMs?: number;
-    /** How long after the inactivity timeout Restate aborts the attempt. Default one hour. */
+    /** How long after the inactivity timeout Restate aborts the attempt. Default `restate.abortMs`. */
     abortMs?: number;
 }
 /**
@@ -21,13 +15,13 @@ export interface RestateTimeouts {
  * `listStuckInvocations` until an operator resumes it.
  */
 export interface RestateRetry {
-    /** Default 100. */
+    /** Default `restate.handlerRetry.minMs` (Host tuning, 100 ms). */
     initialIntervalMs?: number;
-    /** Default 30000. */
+    /** Default `restate.handlerRetry.maxMs` (30 s). */
     maxIntervalMs?: number;
-    /** Default 2. */
+    /** Default 2: the wait doubles, as every backoff of the Runtime does. */
     exponentiationFactor?: number;
-    /** Attempts, including the first, before pausing. Default 70. */
+    /** Attempts, including the first, before pausing. Default `restate.handlerAttempts` (70). */
     maxAttempts?: number;
 }
 export interface RestateExecutionOptions {
@@ -56,11 +50,11 @@ export interface RestateExecutionOptions {
     identityKeys?: string[];
     timeouts?: RestateTimeouts;
     retry?: RestateRetry;
-    /** Delay between sweep passes of one Tenant. Default 5000. */
+    /** Delay between sweep passes of one Tenant. Default `sweep.intervalMs` (Host tuning, 5 s). */
     sweepIntervalMs?: number;
     /**
-     * How long wakes with a `dedupeKey` are remembered. Default and minimum
-     * 24 hours (§12.3).
+     * How long wakes with a `dedupeKey` are remembered. Default `execution.dedupeRetentionMs`;
+     * at least 24 hours (§12.3, `DEDUPE_RETENTION_MIN_MS`).
      */
     dedupeRetentionMs?: number;
     /**
@@ -70,12 +64,15 @@ export interface RestateExecutionOptions {
      * versioned URL without it (`workerDeployment` in `infra/execution.ts`, §14.6).
      */
     forceRegistration?: boolean;
-    /** How long `start` keeps retrying registration while Restate comes up. Default 60000. */
+    /**
+     * How long `start` keeps retrying registration while Restate comes up. Default
+     * `restate.registrationDeadlineMs` (Host tuning, 60 s).
+     */
     registrationTimeoutMs?: number;
     /**
      * How long `stop` waits for running handlers after aborting them; the ones still running
      * then are abandoned and their attempts end with the dropped connections, so Restate
-     * retries them. Default `DEFAULT_STOP_GRACE_MS`.
+     * retries them. Default `execution.stopGraceMs` (Host tuning, 30 s).
      */
     stopGraceMs?: number;
     /** Replaces the SDK's console logging. */
@@ -132,7 +129,7 @@ export declare class RestateExecution implements DurableExecution {
     private serviceOptions;
     /**
      * One-way send through the ingress (`@restatedev/restate-sdk-clients`). Every send carries
-     * an idempotency key, so the client's retries (`SEND_RETRY_MS`), and a send repeated after
+     * an idempotency key, so the client's retries (`restate.sendRetryMs`), and a send repeated after
      * its answer was lost, start one invocation: the request's own key where it has one (an
      * outbox row's, a timer's time), or one made for this call.
      */

package/dist/adapters/execution/restate.js

@@ -39,14 +39,8 @@ import { createServer } from "node:http2";
 import * as restate from "@restatedev/restate-sdk";
 import * as clients from "@restatedev/restate-sdk-clients";
 import { retry } from "../../retry.js";
-import { DEFAULT_STOP_GRACE_MS, WAKE_REASONS, parseSessionKey, sessionKey, settleWithin, } from "../../execution/types.js";
-const HOUR_MS = 60 * 60 * 1000;
-/**
- * How long one send through the ingress keeps retrying while the ingress is unreachable,
- * overloaded, or answers 404 because a just-registered service has not reached it yet. The
- * outbox's grace (`OUTBOX_GRACE_MS` in `tenant/sweep.ts`) is longer.
- */
-export const SEND_RETRY_MS = 10_000;
+import { DEDUPE_RETENTION_MIN_MS, hostTuning } from "../../tuning.js";
+import { WAKE_REASONS, parseSessionKey, sessionKey, settleWithin, } from "../../execution/types.js";
 export function createRestateExecution(options) {
     return new RestateExecution(options);
 }
@@ -75,20 +69,24 @@ export class RestateExecution {
             sandbox: `${prefix}NylorunSandbox`,
         };
         this.ingressUrl = options.ingressUrl.replace(/\/+$/, "");
+        const tuning = hostTuning().restate;
         this.ingress = clients.connect({
             url: this.ingressUrl,
+            // One send keeps retrying for `restate.sendRetryMs` while the ingress is unreachable,
+            // overloaded, or answers 404 because a just-registered service has not reached it yet;
+            // the outbox's grace (`sweep.outboxGraceMs`) is longer.
             retry: {
                 maxAttempts: false,
-                maxDuration: SEND_RETRY_MS,
-                initialInterval: 100,
-                maxInterval: 2000,
+                maxDuration: tuning.sendRetryMs,
+                initialInterval: tuning.sendBackoff.minMs,
+                maxInterval: tuning.sendBackoff.maxMs,
                 // A just-registered service can take a moment to reach the ingress.
                 shouldRetry: (failure) => clients.defaultShouldRetry(failure) ||
                     (failure.kind === "response" && failure.status === 404),
             },
         });
         this.adminUrl = options.adminUrl.replace(/\/+$/, "");
-        this.sweepIntervalMs = options.sweepIntervalMs ?? 5000;
+        this.sweepIntervalMs = options.sweepIntervalMs ?? hostTuning().sweep.intervalMs;
     }
     /** Service names this execution registers, for diagnostics and tests. */
     get serviceNames() {
@@ -179,7 +177,7 @@ export class RestateExecution {
         this.stopping = true;
         for (const controller of this.controllers)
             controller.abort(new Error("Worker stopping"));
-        const abandoned = await settleWithin(this.inflight, this.options.stopGraceMs ?? DEFAULT_STOP_GRACE_MS);
+        const abandoned = await settleWithin(this.inflight, this.options.stopGraceMs ?? hostTuning().execution.stopGraceMs);
         if (abandoned > 0)
             this.options.logger?.("warn", `Worker stopped with ${abandoned} handler(s) still running; abandoned`);
         this.handlers = undefined;
@@ -195,7 +193,7 @@ export class RestateExecution {
         const timeout = setTimeout(() => {
             for (const session of this.sessions)
                 session.destroy();
-        }, 2000);
+        }, hostTuning().restate.closeGraceMs);
         await closed;
         clearTimeout(timeout);
     }
@@ -216,7 +214,7 @@ export class RestateExecution {
             },
             options: {
                 ...serviceOptions,
-                idempotencyRetention: Math.max(this.options.dedupeRetentionMs ?? 24 * HOUR_MS, 24 * HOUR_MS),
+                idempotencyRetention: Math.max(this.options.dedupeRetentionMs ?? hostTuning().execution.dedupeRetentionMs, DEDUPE_RETENTION_MIN_MS),
             },
         });
         const tenant = restate.object({
@@ -352,26 +350,28 @@ export class RestateExecution {
         return run;
     }
     staleSweepMs() {
-        return Math.max(this.sweepIntervalMs * 3, 60_000);
+        const tuning = hostTuning().restate;
+        return Math.max(this.sweepIntervalMs * tuning.staleSweepIntervals, tuning.staleSweepMinMs);
     }
     serviceOptions() {
         const timeouts = this.options.timeouts ?? {};
         const retry = this.options.retry ?? {};
+        const tuning = hostTuning().restate;
         return {
-            inactivityTimeout: timeouts.inactivityMs ?? HOUR_MS,
-            abortTimeout: timeouts.abortMs ?? HOUR_MS,
+            inactivityTimeout: timeouts.inactivityMs ?? tuning.inactivityMs,
+            abortTimeout: timeouts.abortMs ?? tuning.abortMs,
             retryPolicy: {
-                initialInterval: retry.initialIntervalMs ?? 100,
-                maxInterval: retry.maxIntervalMs ?? 30_000,
+                initialInterval: retry.initialIntervalMs ?? tuning.handlerRetry.minMs,
+                maxInterval: retry.maxIntervalMs ?? tuning.handlerRetry.maxMs,
                 exponentiationFactor: retry.exponentiationFactor ?? 2,
-                maxAttempts: retry.maxAttempts ?? 70,
+                maxAttempts: retry.maxAttempts ?? tuning.handlerAttempts,
                 onMaxAttempts: "pause",
             },
         };
     }
     /**
      * One-way send through the ingress (`@restatedev/restate-sdk-clients`). Every send carries
-     * an idempotency key, so the client's retries (`SEND_RETRY_MS`), and a send repeated after
+     * an idempotency key, so the client's retries (`restate.sendRetryMs`), and a send repeated after
      * its answer was lost, start one invocation: the request's own key where it has one (an
      * outbox row's, a timer's time), or one made for this call.
      */
@@ -382,7 +382,7 @@ export class RestateExecution {
                 handler,
                 key,
                 parameter: body,
-                opts: clients.SendOpts.from({ idempotencyKey, timeout: 10_000 }),
+                opts: clients.SendOpts.from({ idempotencyKey, timeout: hostTuning().restate.sendTimeoutMs }),
             });
         }
         catch (error) {
@@ -402,7 +402,7 @@ export class RestateExecution {
                 method: "POST",
                 headers: { "content-type": "application/json" },
                 body: JSON.stringify({ uri, force }),
-                signal: AbortSignal.timeout(30_000),
+                signal: AbortSignal.timeout(hostTuning().restate.registrationRequestTimeoutMs),
             });
             if (response.ok)
                 return (await response.json().catch(() => ({})))
@@ -412,7 +412,10 @@ export class RestateExecution {
             // Discovery failures (Restate cannot reach the endpoint yet) come back
             // as 4xx/5xx; keep trying until the deadline.
             throw new Error(message);
-        }, { minMs: 100, maxMs: 2000, deadlineMs: this.options.registrationTimeoutMs ?? 60_000 }).catch((error) => {
+        }, {
+            ...hostTuning().restate.registrationBackoff,
+            deadlineMs: this.options.registrationTimeoutMs ?? hostTuning().restate.registrationDeadlineMs,
+        }).catch((error) => {
             throw new Error(`Restate deployment registration failed: ${error.message}`, {
                 cause: error,
             });
@@ -445,7 +448,8 @@ export async function listStuckInvocations(options) {
         const tenant = sqlString(options.tenantId);
         clauses.push(`(target_service_key = ${tenant} OR starts_with(target_service_key, ${sqlString(`${options.tenantId}:`)}))`);
     }
-    const limit = Math.max(1, Math.min(options.limit ?? 100, 1000));
+    const { stuckListDefault, stuckListMax } = hostTuning().restate;
+    const limit = Math.max(1, Math.min(options.limit ?? stuckListDefault, stuckListMax));
     const rows = await query(options.adminUrl, "SELECT id, status, target_service_name, target_handler_name, target_service_key, " +
         "retry_count, last_failure, modified_at FROM sys_invocation " +
         `WHERE ${clauses.join(" AND ")} ORDER BY modified_at LIMIT ${limit}`);
@@ -487,7 +491,7 @@ async function query(adminUrl, sql) {
         method: "POST",
         headers: { "content-type": "application/json", accept: "application/json" },
         body: JSON.stringify({ query: sql }),
-        signal: AbortSignal.timeout(10_000),
+        signal: AbortSignal.timeout(hostTuning().restate.queryTimeoutMs),
     });
     if (!response.ok)
         throw new Error(`Restate query ${response.status}: ${await response.text().catch(() => "")}`);

package/dist/adapters/replication/pgoutput.d.ts

@@ -15,7 +15,7 @@ export interface PgoutputSourceOptions {
     schema?: string;
     /** The connections' `application_name`. Default `nylorun-stream-relay`. */
     applicationName?: string;
-    /** Wait between attempts to take the slot. Default 5 s. */
+    /** Wait between attempts to take the slot. Default `postgres.replicationRetryMs` (Host tuning, 5 s). */
     retryMs?: number;
     log?: (message: string, fields?: Record<string, unknown>) => void;
 }

package/dist/adapters/replication/pgoutput.js

@@ -21,18 +21,19 @@
  */
 import pg from "pg";
 import { LogicalReplicationService, PgoutputPlugin } from "pg-logical-replication";
+import { hostTuning } from "../../tuning.js";
 export const DEFAULT_RELAY_SLOT = "nylorun_stream_relay";
 export function createPgoutputSource(options) {
     const slot = options.slot ?? DEFAULT_RELAY_SLOT;
     const publication = options.publication ?? "nylorun_stream_relay";
     const schema = options.schema ?? "nylorun_streams";
-    const retryMs = options.retryMs ?? 5000;
+    const retryMs = options.retryMs ?? hostTuning().postgres.replicationRetryMs;
     const applicationName = options.applicationName ?? "nylorun-stream-relay";
     const { tenantId } = options;
     const log = options.log ?? (() => { });
     const pool = new pg.Pool({
         connectionString: options.connectionString,
-        max: 2,
+        max: hostTuning().postgres.replicationPoolSize,
         application_name: applicationName,
     });
     let service;

package/dist/adapters/sandbox/local.js

@@ -16,8 +16,7 @@ import { lstat, readdir, readFile, stat, writeFile } from "node:fs/promises";
 import { posix } from "node:path";
 import { SANDBOX_WORKSPACE } from "@nylorun/core/define";
 import { SandboxFileTooLargeError } from "../../sandbox/types.js";
-/** The most of each stream kept from one command (the tools keep 30 000 characters of it). */
-const STREAM_LIMIT = 4 * 1024 * 1024;
+import { hostTuning } from "../../tuning.js";
 /** This process's environment without the engine's own variables. */
 function baseEnv(env, workspace) {
     const out = {};
@@ -26,18 +25,22 @@ function baseEnv(env, workspace) {
             out[name] = value;
     return { PATH: "/usr/local/bin:/usr/bin:/bin", LANG: "C.UTF-8", TERM: "dumb", ...out, HOME: workspace };
 }
-/** Collects a stream, keeping at most `STREAM_LIMIT` bytes (head first). */
+/**
+ * Collects a stream, keeping at most `harness.commandStreamBytes` (Host tuning) of it, head first;
+ * the tools keep less of it (`engine.sandboxTools.outputChars`).
+ */
 function collector() {
+    const limit = hostTuning().harness.commandStreamBytes;
     const chunks = [];
     let size = 0;
     let dropped = 0;
     return {
         push(chunk) {
-            if (size >= STREAM_LIMIT) {
+            if (size >= limit) {
                 dropped += chunk.length;
                 return;
             }
-            const room = STREAM_LIMIT - size;
+            const room = limit - size;
             const kept = chunk.length > room ? chunk.subarray(0, room) : chunk;
             chunks.push(kept);
             size += kept.length;

package/dist/adapters/sandbox/virtual.js

@@ -7,7 +7,7 @@
 import { mkdirSync, readdirSync, rmSync } from "node:fs";
 import { join, posix } from "node:path";
 import { SANDBOX_WORKSPACE } from "@nylorun/core/define";
-import { SandboxFileTooLargeError } from "../../sandbox/types.js";
+import { SandboxFileTooLargeError, wholeBytes } from "../../sandbox/types.js";
 const ENV = Object.freeze({
     PATH: "/usr/local/bin:/usr/bin:/bin",
     HOME: SANDBOX_WORKSPACE,
@@ -143,7 +143,7 @@ export function virtualBackend(options) {
                     return { entries, truncated: !complete };
                 },
                 async writeFile(path, content) {
-                    await (typeof content === "string" ? fs.writeFile(path, content, "utf8") : fs.writeFile(path, content));
+                    await (typeof content === "string" ? fs.writeFile(path, content, "utf8") : fs.writeFile(path, await wholeBytes(content)));
                 },
                 async stop() { },
             };