@nylorun/runtime 0.26.0-beta → 0.28.0-beta

package/dist/gates/in-process.js

@@ -1,4 +1,5 @@
-import { piModel } from "../model/pi-model.js";
+import { modelCallSettingsOf, piModel } from "../model/pi-model.js";
+import { readRuntimeLimits } from "../tenant/runtime-limits.js";
 import { HostModelVault } from "../vault/host-model.js";
 import { createMeter } from "./meter.js";
 import { artifactFiles } from "../artifacts/files.js";
@@ -19,18 +20,25 @@ export function callFiles(store, blobs) {
  */
 export function tenantModelGate(options) {
     const vault = new HostModelVault({ store: options.store, kek: options.kek });
-    const gate = inProcessModelGate({
-        root: options.root,
-        readHostModel: () => vault.readHostModel(),
-        writeHostCredential: (credential) => vault.updateHostCredential(credential),
-        ...(options.settings ? { settings: options.settings } : {}),
-        ...(options.blobs ? { files: callFiles(options.store, options.blobs) } : {}),
-    });
     const meter = createMeter({ logger: options.logger });
     return {
-        call: (request, signal) => meter.call(options.store, request, () => serve(options.store, gate, request, signal)),
+        call: (request, signal) => meter.call(options.store, request, async () => {
+            // The Tenant's Runtime limits `model*`, read for this call.
+            const gate = inProcessModelGate({
+                root: options.root,
+                readHostModel: () => vault.readHostModel(),
+                writeHostCredential: (credential) => vault.updateHostCredential(credential),
+                settings: await modelCallSettings(options.store),
+                ...(options.blobs ? { files: callFiles(options.store, options.blobs) } : {}),
+            });
+            return serve(options.store, gate, request, signal);
+        }),
     };
 }
+/** The Tenant's model call settings: its Runtime limits `model*`, read now. */
+export async function modelCallSettings(store) {
+    return modelCallSettingsOf(await store.tx((t) => readRuntimeLimits(t)));
+}
 /**
  * Serves one call: from the fixture model while the Tenant's `model.fixture` setting is on (R4.3),
  * else from `gate`. Read per call, so a seed applies to the next call.

package/dist/gates/inflight.d.ts

@@ -49,9 +49,9 @@ export interface InflightCalls<T = ModelGateOutcome> {
     readonly size: number;
 }
 export interface InflightCallsOptions {
-    /** How long a settled outcome is kept. Default 30 minutes. */
+    /** How long a settled outcome is kept. Default `gates.inflightTtlMs` (Host tuning, 30 min). */
     readonly ttlMs?: number;
-    /** Most entries; the oldest settled ones go first. Default 10,000. */
+    /** Most entries; the oldest settled ones go first. Default `gates.inflightMax` (10,000). */
     readonly max?: number;
     readonly now?: () => number;
 }

package/dist/gates/inflight.js

@@ -1,3 +1,4 @@
+import { hostTuning } from "../tuning.js";
 /** A re-send whose request differs from the call already running under its key. */
 export class InflightConflict extends Error {
     name = "InflightConflict";
@@ -7,8 +8,8 @@ export class InflightStale extends Error {
     name = "InflightStale";
 }
 export function createInflightCalls(options = {}) {
-    const ttlMs = options.ttlMs ?? 30 * 60_000;
-    const max = options.max ?? 10_000;
+    const ttlMs = options.ttlMs ?? hostTuning().gates.inflightTtlMs;
+    const max = options.max ?? hostTuning().gates.inflightMax;
     const now = options.now ?? Date.now;
     const entries = new Map();
     /** Drops expired outcomes, then the oldest settled ones while over `max`. */

package/dist/gates/journal.js

@@ -1,4 +1,3 @@
-import { mcpToolOf } from "../mcp/snapshot.js";
 import { canonical } from "../store/canonical.js";
 import { httpToolRefOf } from "./http-tool.js";
 export function journalCheck(vaults) {
@@ -25,12 +24,11 @@ export function journalCheck(vaults) {
                         return `Effect '${key}' was journaled with other input`;
                     return held(row);
                 }
-                const session = await t.get("sessions", request.sessionId);
-                const tool = mcpToolOf(session?.mcpSnapshot, request);
-                if (!tool ||
-                    tool.serverName !== call.server.serverName ||
-                    (tool.agentId ?? null) !== (call.server.agentId ?? null) ||
-                    tool.serverToolName !== call.name)
+                const target = request.target;
+                if (target?.kind !== "mcp" ||
+                    target.server !== call.server.serverName ||
+                    target.tool !== call.name ||
+                    (request.agent?.id ?? null) !== (call.server.agentId ?? null))
                     return `Effect '${key}' calls another tool`;
                 if (canonical(argumentsOf(request.input)) !== canonical(call.arguments))
                     return `Effect '${key}' was journaled with other input`;

package/dist/gates/mcp-handler.d.ts

@@ -4,12 +4,13 @@ import type { OutboundPolicy } from "../tenant/outbound.js";
 import type { Logger } from "../tenant/types.js";
 import type { McpAnswer } from "./tool-contract.js";
 import { type TenantVaults } from "./tenant-vaults.js";
-/** A connection unused this long is closed; the next request opens it again. */
-export declare const GATE_MCP_IDLE_MS: number;
 export interface McpHandlerOptions {
     readonly vaults: TenantVaults;
     readonly logger: Logger;
-    /** Default `GATE_MCP_IDLE_MS`. */
+    /**
+     * A connection unused this long is closed; the next request opens it again. Default
+     * `gates.mcpIdleMs` (Host tuning, 15 min).
+     */
     readonly idleMs?: number;
     readonly now?: () => number;
     /** Tests replace how a server is opened. */

package/dist/gates/mcp-handler.js

@@ -1,14 +1,14 @@
 import { McpCallFailed, McpConnectionStale, openMcpServer, unreachable, } from "../mcp/connect.js";
 import { findServer } from "../mcp/pool.js";
+import { readRuntimeLimits } from "../tenant/runtime-limits.js";
 import { GateRefusal } from "./tenant-vaults.js";
-/** A connection unused this long is closed; the next request opens it again. */
-export const GATE_MCP_IDLE_MS = 15 * 60_000;
+import { hostTuning } from "../tuning.js";
 /** The server is not one the session may reach through the gate. */
 class NotDeclared extends Error {
 }
 export function createMcpHandler(options) {
     const { vaults, logger } = options;
-    const idleMs = options.idleMs ?? GATE_MCP_IDLE_MS;
+    const idleMs = options.idleMs ?? hostTuning().gates.mcpIdleMs;
     const now = options.now ?? Date.now;
     const open = options.open ?? openMcpServer;
     const live = new Map();
@@ -42,6 +42,7 @@ export function createMcpHandler(options) {
                         ...(server.agentId === undefined ? {} : { agentId: server.agentId }),
                     }),
                     policy: options.delivery ?? {},
+                    errorExcerptChars: (await vault.store.tx((t) => readRuntimeLimits(t))).errorExcerptChars,
                 });
                 const entry = { connection, lastUsedAt: now(), active: 0 };
                 live.set(key, entry);
@@ -80,7 +81,11 @@ export function createMcpHandler(options) {
             // the session is not the server's failure, and stays as it was.
             if (!call || error instanceof GateRefusal || error instanceof NotDeclared)
                 throw error;
-            throw unreachable(server.serverName, error);
+            const limits = await vaults
+                .open(tenantId)
+                .then((vault) => vault.store.tx((t) => readRuntimeLimits(t)))
+                .catch(() => undefined);
+            throw unreachable(server.serverName, error, limits?.errorExcerptChars);
         }
     }
     async function use(tenantId, server, run, call = false) {
@@ -112,10 +117,15 @@ export function createMcpHandler(options) {
      * the call sent once more (R2b C7).
      */
     async function callOnce(tenantId, request, signal) {
+        // The Tenant's Runtime limits, read for this call: the largest answer the gate keeps, and how
+        // much of a failed one its error quotes.
+        const { toolAnswerBytes, errorExcerptChars } = await (await vaults.open(tenantId)).store.tx((t) => readRuntimeLimits(t));
         for (let attempt = 0;; attempt += 1) {
             try {
                 return await use(tenantId, request.server, (entry) => entry.connection.client.callTool({ name: request.name, arguments: request.arguments }, {
                     signal,
+                    maxResultBytes: toolAnswerBytes,
+                    errorExcerptChars,
                     ...(request.key === undefined ? {} : { key: request.key }),
                     ...(request.traceparent === undefined ? {} : { traceparent: request.traceparent }),
                 }), true);
@@ -188,7 +198,7 @@ function errorOf(error) {
             ...(error.code === "credential_rejected" ? { code: 401 } : {}),
             failure: error.failure,
         };
-    const message = error instanceof Error ? error.message.slice(0, 2000) : String(error);
+    const message = error instanceof Error ? error.message.slice(0, hostTuning().gates.errorMessageChars) : String(error);
     const code = error && typeof error === "object" && "code" in error && typeof error.code === "number"
         ? error.code
         : undefined;

package/dist/gates/meter.js

@@ -37,7 +37,7 @@ export function createMeter(options) {
                             session: request.sessionId,
                             effect: request.effectId,
                             scope: budget.scope,
-                            ...(budget.scope === "agent" ? { agent: budget.scopeId } : {}),
+                            ...(budget.scope === "manifest" ? { manifest: budget.scopeId } : {}),
                         });
                         return { keys, refusal: failure("budget_exhausted", reached, false) };
                     }
@@ -124,7 +124,8 @@ export function usageRow(request, outcome, at, timing) {
             : null,
         sessionId: request.sessionId,
         turnId: request.turnId,
-        agentId: request.agentId,
+        // The calling agent's loop manifest id: a manifest version's name (protocol 16).
+        manifestName: request.agentId,
         provider: producer.provider ?? null,
         model: producer.model ?? outcome.evidence?.resolvedModel ?? request.call.model?.id ?? null,
         inputTokens,
@@ -148,8 +149,8 @@ function scopeOf(budget, request, at) {
     const since = budget.period ? { since: periodStart(budget.period, at) } : {};
     if (budget.scope === "turn")
         return { scope: "turn", id: request.turnId };
-    if (budget.scope === "agent")
-        return budget.scopeId === request.agentId ? { scope: "agent", id: request.agentId, ...since } : undefined;
+    if (budget.scope === "manifest")
+        return budget.scopeId === request.agentId ? { scope: "manifest", id: request.agentId, ...since } : undefined;
     return { scope: "tenant", ...since };
 }
 /**
@@ -160,7 +161,7 @@ export function capReached(budget, spent, inflight) {
     const projected = (total) => total + (spent.calls > 0 ? (inflight * total) / spent.calls : 0);
     const name = budget.scope === "turn"
         ? "The turn's cap"
-        : `${budget.scope === "agent" ? `Agent ${budget.scopeId}'s` : "The Tenant's"} ${budget.period === "day" ? "daily" : "monthly"} cap`;
+        : `${budget.scope === "manifest" ? `Agent manifest ${budget.scopeId}'s` : "The Tenant's"} ${budget.period === "day" ? "daily" : "monthly"} cap`;
     const raise = "raise it with PUT /v1/tenant/budgets";
     if (budget.limitTokens !== null && projected(spent.tokens) >= budget.limitTokens)
         return `${name} of ${budget.limitTokens} tokens is reached (${spent.tokens} used); ${raise}`;

package/dist/gates/model-gate.d.ts

@@ -4,11 +4,13 @@
  * call needs that the loop must not hold: the provider credential, pi-ai, its retries and
  * idle watchdog, failure classification and scrubbing.
  *
- * Two implementations: `inProcessModelGate` (embedding, the ephemeral Runtime, tests) and the
+ * Three implementations: `inProcessModelGate` (embedding, the ephemeral Runtime, tests), the
  * HTTP client of the gates service (the `gateway` container), which keeps the credential out
- * of the loop process. Both return what `piModel` returns, so the effect journal is the same
+ * of the loop process, and `providerModelGate`, which serves a Runtime's scripted model (tests,
+ * `model: {kind: "scripted"}`) the same way, metered. Both return what `piModel` returns, so the effect journal is the same
  * either way.
  */
+import type { AgentRef } from "@nylorun/core/define";
 import type { RuntimeModelAdapter, RuntimeModelCall } from "../contracts.js";
 export type { ModelCallSettings } from "../model/pi-model.js";
 /**
@@ -25,6 +27,13 @@ export interface ModelGateRequest {
     /** The effect's journal id; sent as `Idempotency-Key` (acted on from P1.2). */
     readonly effectId: string;
     readonly invocationId: string;
+    /**
+     * The agent used as a tool the call is for; absent for the session's root agent. In process
+     * only: a scripted provider reads it (`providerModelGate`).
+     */
+    readonly agent?: AgentRef;
+    /** A call that summarizes history for a compaction (protocol 15); in process only, like `agent`. */
+    readonly purpose?: "summary";
     readonly call: RuntimeModelCall;
 }
 /** A model candidate or a failure outcome: exactly what `piModel` returns. */

package/dist/gates/policy.d.ts

@@ -10,11 +10,17 @@
  * (`deny`, then `ask`, then `allow`), and a call no rule matches runs. A session pinned to a
  * manifest saved before R5 step 2 keeps its `approval: "always"` as an ask: no session loses
  * the approval it was opened with. A policy that cannot be read refuses every call.
+ *
+ * A rule's `tool` matches the tool's identity (protocol 15): an MCP tool's own name on its
+ * server (`server` names the server), an HTTP tool's declared name, a flow stage's key. The name
+ * a harness gave the model never matches. A stored rule whose `tool` has `__` in it (an MCP tool
+ * named by its old model-facing `server__tool` name) makes the policy unreadable, so every call
+ * is refused until the policy names it by `server` and `tool`: a rule never silently stops
+ * matching.
  */
 import { type ToolPolicy, type ToolRule } from "@nylorun/core/contracts";
 import type { AgentManifest } from "@nylorun/core/define";
 import type { HostEffect } from "@nylorun/harness/run";
-import { type McpSnapshot } from "../mcp/snapshot.js";
 import type { Tx } from "../store/types.js";
 import type { Session } from "../tenant/context.js";
 /** The `tenant_settings` key the policy is kept under. */
@@ -22,13 +28,18 @@ export declare const TOOL_POLICY_SETTING = "tool-policy";
 /** A call as the policy reads it. */
 export interface PolicyCall {
     readonly kind: "mcp" | "http";
-    /** The name the model calls the tool by; a flow stage's key. */
+    /**
+     * The tool's identity: an MCP tool's own name on its server, an HTTP tool's declared name, a
+     * flow stage's key.
+     */
     readonly tool: string;
     /** The MCP server's name. */
     readonly server?: string;
-    /** The agent that calls it. */
+    /** The agent that calls it: its manifest's id (an agent manifest's name), never an Agent's id. */
     readonly agent: string;
     readonly input: unknown;
+    /** The name the model called it by, for display only: no rule matches it. */
+    readonly name?: string;
 }
 export type PolicyDecision = {
     readonly effect: "allow";
@@ -36,14 +47,31 @@ export type PolicyDecision = {
     readonly effect: "ask" | "deny";
     readonly reason: string;
 };
-/** The Tenant's policy; an empty one when none was set. Throws when it cannot be read. */
+/** A stored policy this Runtime cannot apply: every call is refused, with `message` as why. */
+export declare class ToolPolicyUnreadable extends Error {
+    constructor(message: string);
+}
+/**
+ * The Tenant's policy; an empty one when none was set. Throws when it cannot be read, a
+ * `ToolPolicyUnreadable` saying which rule when one names an MCP tool by a model-facing name.
+ */
 export declare function readToolPolicy(t: Pick<Tx, "getSetting">): Promise<ToolPolicy>;
 /**
  * The decision for `request`, a session's MCP or HTTP tool call: the Tenant's rules and the
  * pinned manifest's `approval`. A policy that cannot be read refuses the call.
  */
 export declare function toolCallDecision(t: Pick<Tx, "getSetting">, s: Session, request: HostEffect, kind: "mcp" | "http"): Promise<PolicyDecision>;
+/**
+ * `request` as the policy reads it: by its target's identity (protocol 15), and by the agent that
+ * calls it: an agent used as a tool by its id, the session's root agent by its loop manifest's id
+ * (protocol 16: the agent manifest's name). Never the session's Agent id (`s.agentId`), which
+ * protocol 16 made the Agent the session runs on (`users/ada/desk` for the manifest `desk`).
+ */
+export declare function policyCallOf(s: Pick<Session, "manifest">, request: HostEffect, kind: "mcp" | "http"): PolicyCall;
 /** Decides `call` by `rules`; `pinnedAsk` adds the ask of a manifest saved before R5 step 2. */
 export declare function decide(rules: readonly ToolRule[], call: PolicyCall, pinnedAsk?: boolean): PolicyDecision;
-/** The pinned `approval: "always"` of the call's tool, in a manifest saved before R5 step 2. */
-export declare function pinnedApproval(manifest: AgentManifest, snapshot: McpSnapshot | undefined, request: HostEffect): boolean;
+/**
+ * The pinned `approval: "always"` of the call's tool, in a manifest saved before R5 step 2: an
+ * MCP tool's settings by its own name, an HTTP tool's declaration by its declared name.
+ */
+export declare function pinnedApproval(manifest: AgentManifest, request: HostEffect): boolean;

package/dist/gates/policy.js

@@ -10,21 +10,44 @@
  * (`deny`, then `ask`, then `allow`), and a call no rule matches runs. A session pinned to a
  * manifest saved before R5 step 2 keeps its `approval: "always"` as an ask: no session loses
  * the approval it was opened with. A policy that cannot be read refuses every call.
+ *
+ * A rule's `tool` matches the tool's identity (protocol 15): an MCP tool's own name on its
+ * server (`server` names the server), an HTTP tool's declared name, a flow stage's key. The name
+ * a harness gave the model never matches. A stored rule whose `tool` has `__` in it (an MCP tool
+ * named by its old model-facing `server__tool` name) makes the policy unreadable, so every call
+ * is refused until the policy names it by `server` and `tool`: a rule never silently stops
+ * matching.
  */
 import { ToolPolicySchema } from "@nylorun/core/contracts";
-import { mcpToolOf, mcpToolSettingsIn } from "../mcp/snapshot.js";
+import { mcpToolSettingsIn } from "../mcp/snapshot.js";
 import { canonical } from "../store/canonical.js";
 import { turnManifestOf } from "../tenant/session.js";
 import { declaredHttpTool } from "./http-tool.js";
 /** The `tenant_settings` key the policy is kept under. */
 export const TOOL_POLICY_SETTING = "tool-policy";
 const STRICTNESS = { allow: 0, ask: 1, deny: 2 };
-/** The Tenant's policy; an empty one when none was set. Throws when it cannot be read. */
+/** A stored policy this Runtime cannot apply: every call is refused, with `message` as why. */
+export class ToolPolicyUnreadable extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "ToolPolicyUnreadable";
+    }
+}
+/**
+ * The Tenant's policy; an empty one when none was set. Throws when it cannot be read, a
+ * `ToolPolicyUnreadable` saying which rule when one names an MCP tool by a model-facing name.
+ */
 export async function readToolPolicy(t) {
     const raw = await t.getSetting(TOOL_POLICY_SETTING);
     if (raw === undefined)
         return { rules: [], updatedAt: null };
-    return ToolPolicySchema.parse(JSON.parse(raw));
+    const parsed = ToolPolicySchema.safeParse(JSON.parse(raw));
+    if (parsed.success)
+        return parsed.data;
+    const issue = parsed.error.issues[0];
+    throw new ToolPolicyUnreadable(issue?.path.at(-1) === "tool"
+        ? `Rule ${Number(issue.path[1]) + 1} of the Tenant's tool policy names a tool by a model-facing name: ${issue.message}. Set the policy again (PUT /v1/tenant/tool-policy)`
+        : `The Tenant's tool policy could not be read: ${issue?.message ?? "malformed"}`);
 }
 /**
  * The decision for `request`, a session's MCP or HTTP tool call: the Tenant's rules and the
@@ -35,22 +58,42 @@ export async function toolCallDecision(t, s, request, kind) {
     try {
         rules = (await readToolPolicy(t)).rules;
     }
-    catch {
-        return { effect: "deny", reason: "The Tenant's tool policy could not be read, so no tool call runs" };
+    catch (error) {
+        return {
+            effect: "deny",
+            reason: error instanceof ToolPolicyUnreadable
+                ? `${error.message}, so no tool call runs`
+                : "The Tenant's tool policy could not be read, so no tool call runs",
+        };
     }
-    const mcp = mcpToolOf(s.mcpSnapshot, request);
-    return decide(rules, {
+    return decide(rules, policyCallOf(s, request, kind), pinnedApproval(turnManifestOf(s), request));
+}
+/**
+ * `request` as the policy reads it: by its target's identity (protocol 15), and by the agent that
+ * calls it: an agent used as a tool by its id, the session's root agent by its loop manifest's id
+ * (protocol 16: the agent manifest's name). Never the session's Agent id (`s.agentId`), which
+ * protocol 16 made the Agent the session runs on (`users/ada/desk` for the manifest `desk`).
+ */
+export function policyCallOf(s, request, kind) {
+    const target = request.target;
+    return {
         kind,
-        tool: request.toolName ?? request.key ?? request.effectId,
-        ...(mcp ? { server: mcp.serverName } : {}),
-        agent: request.agent?.id ?? s.agentId,
+        tool: target?.kind === "mcp" || target?.kind === "http"
+            ? target.tool
+            : (request.key ?? request.effectId),
+        ...(target?.kind === "mcp" ? { server: target.server } : {}),
+        agent: request.agent?.id ?? s.manifest.id,
         input: request.input,
-    }, pinnedApproval(turnManifestOf(s), s.mcpSnapshot, request));
+        ...(request.toolName === undefined ? {} : { name: request.toolName }),
+    };
 }
 /** Decides `call` by `rules`; `pinnedAsk` adds the ask of a manifest saved before R5 step 2. */
 export function decide(rules, call, pinnedAsk = false) {
     let strictest = pinnedAsk
-        ? { effect: "ask", reason: `The agent's manifest asks for approval of '${call.tool}'` }
+        ? {
+            effect: "ask",
+            reason: `The agent's manifest asks for approval of '${call.server === undefined ? call.tool : `${call.server} / ${call.tool}`}'`,
+        }
         : undefined;
     for (const rule of rules) {
         if (!matches(rule, call))
@@ -63,12 +106,17 @@ export function decide(rules, call, pinnedAsk = false) {
         return { effect: "allow" };
     return { effect: strictest.effect, reason: strictest.reason };
 }
-/** The pinned `approval: "always"` of the call's tool, in a manifest saved before R5 step 2. */
-export function pinnedApproval(manifest, snapshot, request) {
-    const mcp = mcpToolOf(snapshot, request);
-    if (mcp)
-        return mcpToolSettingsIn(manifest, mcp).approval === "always";
-    return declaredHttpTool(manifest, request.agent?.id, request.toolName)?.approval === "always";
+/**
+ * The pinned `approval: "always"` of the call's tool, in a manifest saved before R5 step 2: an
+ * MCP tool's settings by its own name, an HTTP tool's declaration by its declared name.
+ */
+export function pinnedApproval(manifest, request) {
+    const target = request.target;
+    if (target?.kind === "mcp")
+        return mcpToolSettingsIn(manifest, request.agent?.id, target.server, target.tool).approval === "always";
+    if (target?.kind === "http")
+        return declaredHttpTool(manifest, request.agent?.id, target.tool)?.approval === "always";
+    return false;
 }
 function matches(rule, call) {
     if (rule.kind !== undefined && rule.kind !== call.kind)

package/dist/gates/provider-gate.d.ts

@@ -0,0 +1,22 @@
+/**
+ * A Model Gate over a `ModelProvider` (protocol 15): how a Runtime whose model is scripted (tests,
+ * `model: {kind: "scripted"}` or `"fixture"`, an embedder's provider) serves its harness's model
+ * calls. The harness calls the gate as it calls any (`invokeModel`), in process or not: no harness
+ * calls a provider directly.
+ *
+ * The provider gets the call as an effect (`HostEffect`), rebuilt from the request: the ids, the
+ * agent used as a tool, the call's purpose, and the call as its `input`. With a store, each call
+ * is metered in the usage ledger like the Tenant's own gate's, and the Tenant's fixture model
+ * setting is answered first (R4.3). It dies with its process: it never `recovers`.
+ */
+import type { HostEffect } from "@nylorun/harness/run";
+import type { ModelProvider } from "../core/provider.js";
+import type { SessionStore } from "../store/types.js";
+import type { Logger } from "../tenant/types.js";
+import type { ModelGate, ModelGateRequest } from "./model-gate.js";
+/** The effect a provider sees for `request`. */
+export declare function providerEffect(request: ModelGateRequest): HostEffect;
+export declare function providerModelGate(provider: ModelProvider, options?: {
+    readonly store?: SessionStore;
+    readonly logger?: Logger;
+}): ModelGate;

package/dist/gates/provider-gate.js

@@ -0,0 +1,30 @@
+import { serve } from "./in-process.js";
+import { createMeter } from "./meter.js";
+/** The effect a provider sees for `request`. */
+export function providerEffect(request) {
+    return {
+        effectId: request.effectId,
+        sessionId: request.sessionId,
+        turnId: request.turnId,
+        agentId: request.agentId,
+        // The gate is told no definition hash; a provider routes by the call, never by the hash.
+        manifestHash: "",
+        kind: "model",
+        ...(request.agent === undefined ? {} : { agent: request.agent }),
+        ...(request.purpose === undefined ? {} : { purpose: request.purpose }),
+        input: request.call,
+        context: { invocationId: request.invocationId },
+    };
+}
+export function providerModelGate(provider, options = {}) {
+    const direct = {
+        call: async (request, signal) => (await provider(providerEffect(request), signal)),
+    };
+    const { store, logger } = options;
+    if (!store || !logger)
+        return direct;
+    const meter = createMeter({ logger });
+    return {
+        call: (request, signal) => meter.call(store, request, () => serve(store, direct, request, signal)),
+    };
+}

package/dist/gates/tool-calls.d.ts

@@ -21,8 +21,6 @@ import type { Logger } from "../tenant/types.js";
 import { type InflightCallsOptions, type InflightOwner } from "./inflight.js";
 import type { TenantVaults } from "./tenant-vaults.js";
 import type { McpAnswer } from "./tool-contract.js";
-/** How long a settled crossing is kept. */
-export declare const TOOL_CROSSING_TTL_MS: number;
 /** A tool call's answer: an MCP `CallToolResult`, or an HTTP tool's outcome. */
 export type ToolCallAnswer = McpAnswer<Record<string, unknown>>;
 export interface ToolCalls {
@@ -40,7 +38,7 @@ export interface ToolCalls {
     cancel(key: string, sessionId?: string): boolean;
     /** Aborts every running call (gateway shutdown). */
     close(): void;
-    /** Deletes crossings settled more than `TOOL_CROSSING_TTL_MS` ago. */
+    /** Deletes crossings settled more than `gates.toolCrossingTtlMs` (Host tuning, 24 h) ago. */
     prune(): Promise<void>;
 }
 export interface ToolCallsOptions {

package/dist/gates/tool-calls.js

@@ -1,6 +1,5 @@
 import { createInflightCalls, InflightConflict, } from "./inflight.js";
-/** How long a settled crossing is kept. */
-export const TOOL_CROSSING_TTL_MS = 24 * 60 * 60_000;
+import { hostTuning } from "../tuning.js";
 const CANCELLED = {
     ok: false,
     error: { message: "The call was cancelled while it ran; it may have reached its server" },
@@ -71,7 +70,7 @@ export function createToolCalls(options) {
         async prune() {
             try {
                 const vault = await vaults.open(undefined);
-                const before = new Date(now() - TOOL_CROSSING_TTL_MS).toISOString();
+                const before = new Date(now() - hostTuning().gates.toolCrossingTtlMs).toISOString();
                 await vault.store.tx((t) => t.pruneToolCrossings(before));
             }
             catch {

package/dist/gates/tool-client.d.ts

@@ -21,7 +21,7 @@ export interface HttpToolGateOptions {
     readonly runTokens?: RunTokens;
     /** Sent as `Nylorun-Tenant`; the gate checks it against its database's Tenant. */
     readonly tenantId?: string;
-    /** How long an MCP request may stay silent. Default `GATE_CLIENT_TIMEOUT_MS`. */
+    /** How long an MCP request may stay silent. Default `gates.clientTimeoutMs` (Host tuning). */
     readonly timeoutMs?: number;
 }
 export declare function httpToolGate(options: HttpToolGateOptions): ToolGate;

package/dist/gates/tool-client.js

@@ -26,7 +26,7 @@ import { request as httpRequest } from "node:http";
 import { request as httpsRequest } from "node:https";
 import { McpCallFailed, } from "../mcp/connect.js";
 import { TENANT_HEADER } from "./contract.js";
-import { GATE_CLIENT_TIMEOUT_MS } from "./http-client.js";
+import { hostTuning } from "../tuning.js";
 import { HTTP_CALLS_PATH, MCP_CLOSE_PATH, MCP_CONNECT_PATH, MCP_LIST_PATH, TOOL_CALLS_PATH, } from "./tool-contract.js";
 /**
  * A keyed call whose answer the hop lost (R5.3): the gate never got it, the connection broke,
@@ -36,11 +36,9 @@ import { HTTP_CALLS_PATH, MCP_CLOSE_PATH, MCP_CONNECT_PATH, MCP_LIST_PATH, TOOL_
 export class GateCallLost extends Error {
     name = "GateCallLost";
 }
-/** How long a close or a cancel may take; neither changes an outcome. */
-const SHORT_TIMEOUT_MS = 2_000;
 export function httpToolGate(options) {
     const where = new URL(options.url).origin;
-    const timeoutMs = options.timeoutMs ?? GATE_CLIENT_TIMEOUT_MS;
+    const timeoutMs = options.timeoutMs ?? hostTuning().gates.clientTimeoutMs;
     function exchange(path, body, request) {
         const url = new URL(path, options.url);
         const send = url.protocol === "https:" ? httpsRequest : httpRequest;
@@ -88,7 +86,7 @@ export function httpToolGate(options) {
                 responded = true;
                 readBody(response).then((text) => settle({ kind: "answer", status: response.statusCode ?? 0, text }), (error) => failed(error));
             });
-            outgoing.on("socket", (socket) => socket.setKeepAlive(true, 30_000));
+            outgoing.on("socket", (socket) => socket.setKeepAlive(true, hostTuning().gates.keepAliveMs));
             outgoing.on("finish", () => {
                 sent = true;
             });
@@ -147,7 +145,8 @@ export function httpToolGate(options) {
     }
     async function fireAndForget(path, scope) {
         await exchange(path, scope.body, {
-            timeoutMs: SHORT_TIMEOUT_MS,
+            // A close or a cancel is short (`gates.shortTimeoutMs`); neither changes an outcome.
+            timeoutMs: hostTuning().gates.shortTimeoutMs,
             ...(scope.bearer ? { bearer: scope.bearer } : {}),
         });
     }

package/dist/gates/tool-contract.d.ts

@@ -23,14 +23,17 @@
  * - `POST /nylorun/v1/mcp/close` `{server}`: closes the server's connection; `204`.
  * Each answers `200 {ok: true, result}` or `200 {ok: false, error}`: an MCP failure is an
  * answer, not a gate error. A tool call's failure is coded (`error.failure`, R2b C7), and neither
- * a result nor a failure carries a credential value the gate sent (C8). An answer past 8 MiB is
- * `mcp.too-large` (C11), as an HTTP tool's is `http.too-large`; core shapes what fits into a
- * result the model can take (`tenant/tool-results.ts`). A keyed call whose earlier attempt was
+ * a result nor a failure carries a credential value the gate sent (C8). An answer past the
+ * Tenant's Runtime limit `toolAnswerBytes` (default 8 MiB), which also caps the bodies the gate
+ * reads, is `mcp.too-large` (C11), as an HTTP tool's is `http.too-large`; the harness shapes
+ * what fits into a result the model can take (`shapeToolOutcome`, protocol 15). The tool-calls
+ * body names the tool by its identity: the server (`{agentId?, serverName}`) and the server's
+ * own name for the tool (`name`). A keyed call whose earlier attempt was
  * lost with the gateway runs again under the same key (R5.3); one another gateway process holds
  * answers `{ok: false, error: {uncertain: true}}`, and the caller sends it again.
  *
  * HTTP tools (R2 M3). `POST /nylorun/v1/http-calls` `{tool, effectId, turnId, input}`: one call
- * of an HTTP tool. The loop names the tool (`{sessionId?, agentId?, toolName}`), or a
+ * of an HTTP tool. The loop names the tool (`{sessionId?, agentId?, toolName}`, its declared name), or a
  * flow's HTTP stage or HTTP verifier by its stage key (`{sessionId?, stage}`); the gate finds its
  * URL, method and credential in the session's pinned manifest
  * (`gates/http-tool.ts`). A run token's turn is the call's; `turnId` counts only under core's
@@ -39,7 +42,7 @@
  * model sees), or `{ok: false, error: {uncertain: true}}` for a call another gateway process holds.
  */
 import type { McpCallFailure } from "../mcp/connect.js";
-export { HTTP_CALLS_PATH, HttpCallBodySchema, MAX_TOOL_BODY_BYTES, MCP_CLOSE_PATH, MCP_CONNECT_PATH, MCP_LIST_PATH, McpListBodySchema, McpServerBodySchema, McpServerRefSchema, TOOL_CALLS_PATH, ToolCallBodySchema, type HttpCallBody, type ToolCallBody, } from "@nylorun/core/harness-api";
+export { HTTP_CALLS_PATH, HttpCallBodySchema, MCP_CLOSE_PATH, MCP_CONNECT_PATH, MCP_LIST_PATH, McpListBodySchema, McpServerBodySchema, McpServerRefSchema, TOOL_CALLS_PATH, ToolCallBodySchema, type HttpCallBody, type ToolCallBody, } from "@nylorun/core/harness-api";
 /** Why an MCP request failed, as the loop's diagnostics read it (`mcp/connect.ts`). */
 export interface McpGateError {
     readonly message: string;

package/dist/gates/tool-contract.js

@@ -1 +1 @@
-export { HTTP_CALLS_PATH, HttpCallBodySchema, MAX_TOOL_BODY_BYTES, MCP_CLOSE_PATH, MCP_CONNECT_PATH, MCP_LIST_PATH, McpListBodySchema, McpServerBodySchema, McpServerRefSchema, TOOL_CALLS_PATH, ToolCallBodySchema, } from "@nylorun/core/harness-api";
+export { HTTP_CALLS_PATH, HttpCallBodySchema, MCP_CLOSE_PATH, MCP_CONNECT_PATH, MCP_LIST_PATH, McpListBodySchema, McpServerBodySchema, McpServerRefSchema, TOOL_CALLS_PATH, ToolCallBodySchema, } from "@nylorun/core/harness-api";