@nylorun/runtime 0.26.0-beta → 0.28.0-beta

package/dist/gates/tool-gate.d.ts

@@ -6,17 +6,20 @@
  *
  * Two implementations: `inProcessToolGate` (embedding, the ephemeral Runtime, tests), which
  * opens remote servers and calls HTTP tools in this process, and the HTTP client of the gates
- * service (`tool-client.ts`, the `gateway` container). The sandbox tools never cross it.
+ * service (`tool-client.ts`, the `gateway` container). The sandbox tools never cross it. A
+ * harness's MCP pool opens every server through a gate (`openMcp`), in process too (protocol
+ * 15): the vault authorizes a connection only here.
  */
-import type { LiveConnection } from "../mcp/connect.js";
-import type { McpServerRef } from "../mcp/pool.js";
+import { openMcpServer, type LiveConnection } from "../mcp/connect.js";
+import { type McpServerRef } from "../mcp/pool.js";
 import type { OutboundPolicy } from "../tenant/outbound.js";
 import type { Logger } from "../tenant/types.js";
 import { type HttpOutcome, type HttpToolCall, type HttpToolTenant } from "./http-tool.js";
 export interface ToolGate {
     /**
-     * Opens a remote (`streamable-http` or `sse`) MCP server of a session. Absent: the loop's
-     * pool opens it itself, with the Tenant vault.
+     * Opens a remote (`streamable-http` or `sse`) MCP server of a session: the one its pinned
+     * manifest declares, authorized with the Tenant vault. Absent: this Runtime opens no MCP
+     * server.
      */
     openMcp?(server: McpServerRef): Promise<LiveConnection>;
     /**
@@ -39,9 +42,17 @@ export interface ToolGate {
     }): Promise<void>;
 }
 /**
- * The Tool Gate in the caller's process: remote MCP through the pool, and HTTP tools with
- * `tenant`'s sessions and vault.
+ * The Tool Gate in the caller's process: remote MCP servers and HTTP tools with `tenant`'s
+ * sessions and vault. `openMcp` finds the server in the session's pinned manifest (as the gates
+ * service does), so a caller names a server, never a URL or a credential. `open` replaces how a
+ * server is opened (tests).
  */
 export declare function inProcessToolGate(policy?: OutboundPolicy, tenant?: HttpToolTenant & {
     readonly logger?: Logger;
+    readonly open?: typeof openMcpServer;
 }): ToolGate;
+/**
+ * How a harness's MCP pool opens a server: through `gate`, or, for a Runtime whose gate opens
+ * none, never (the call fails to the model as `mcp.unreachable`).
+ */
+export declare function openMcpThrough(gate: Pick<ToolGate, "openMcp">): (server: McpServerRef) => Promise<LiveConnection>;

package/dist/gates/tool-gate.js

@@ -1,14 +1,56 @@
+/**
+ * The Tool Gate seam (blueprint §12, F4.1). Every tool call that leaves the loop crosses one
+ * `ToolGate`: a remote MCP server's connection and calls, and an HTTP tool's request (R2 M3).
+ * The gate owns what those need that the loop must not hold: the MCP and HTTP tool credentials,
+ * and the outbound route.
+ *
+ * Two implementations: `inProcessToolGate` (embedding, the ephemeral Runtime, tests), which
+ * opens remote servers and calls HTTP tools in this process, and the HTTP client of the gates
+ * service (`tool-client.ts`, the `gateway` container). The sandbox tools never cross it. A
+ * harness's MCP pool opens every server through a gate (`openMcp`), in process too (protocol
+ * 15): the vault authorizes a connection only here.
+ */
+import { openMcpServer } from "../mcp/connect.js";
+import { findServer } from "../mcp/pool.js";
 import { runHttpTool } from "./http-tool.js";
 /**
- * The Tool Gate in the caller's process: remote MCP through the pool, and HTTP tools with
- * `tenant`'s sessions and vault.
+ * The Tool Gate in the caller's process: remote MCP servers and HTTP tools with `tenant`'s
+ * sessions and vault. `openMcp` finds the server in the session's pinned manifest (as the gates
+ * service does), so a caller names a server, never a URL or a credential. `open` replaces how a
+ * server is opened (tests).
  */
 export function inProcessToolGate(policy = {}, tenant) {
+    if (!tenant)
+        return {};
+    const open = tenant.open ?? openMcpServer;
     return {
-        ...(tenant
-            ? {
-                callHttp: (call, signal) => runHttpTool(tenant, call, { policy, signal, ...(tenant.logger ? { logger: tenant.logger } : {}) }),
-            }
-            : {}),
+        callHttp: (call, signal) => runHttpTool(tenant, call, { policy, signal, ...(tenant.logger ? { logger: tenant.logger } : {}) }),
+        async openMcp(server) {
+            const session = await tenant.session(server.sessionId);
+            if (!session)
+                throw new Error(`Session ${server.sessionId} not found`);
+            const declared = findServer(session.manifest, server.agentId, server.serverName);
+            if (!declared)
+                throw new Error(`MCP server '${server.serverName}' is not declared`);
+            return open({
+                server: declared.server,
+                policy,
+                errorExcerptChars: (await tenant.limits()).errorExcerptChars,
+                authorize: (url) => tenant.authorize(server.sessionId, {
+                    url,
+                    serverName: server.serverName,
+                    ...(server.agentId === undefined ? {} : { agentId: server.agentId }),
+                }),
+            });
+        },
     };
 }
+/**
+ * How a harness's MCP pool opens a server: through `gate`, or, for a Runtime whose gate opens
+ * none, never (the call fails to the model as `mcp.unreachable`).
+ */
+export function openMcpThrough(gate) {
+    return (server) => gate.openMcp
+        ? gate.openMcp(server)
+        : Promise.reject(new Error("This Runtime opens MCP servers only through a Tool Gate, and has none"));
+}

package/dist/harness/calls.d.ts

@@ -1,31 +1,30 @@
 /**
- * The calls a harness executes, as pure helpers over what routes them: the Model Gate (or the
- * Tenant's provider), the Tool Gate, the MCP pool, the SandboxManager. No store, no record: the
- * session's routing comes with the run (`TurnStart.routing`).
+ * The calls a harness executes, as pure helpers over what routes them: the Model Gate, the Tool
+ * Gate, the MCP pool, the SandboxManager. No store, no record: the session's routing comes with
+ * the run (`TurnStart.routing`). Every model call goes through the Model Gate, in a harness
+ * process and in core's alike (protocol 15): a Runtime with a scripted model serves it from a
+ * gate too (`providerModelGate`).
  */
-import { type AgentManifest } from "@nylorun/core/define";
+import { type AgentManifest, type SandboxManifest } from "@nylorun/core/define";
 import type { HostEffect } from "@nylorun/harness/run";
+import type { SandboxToolLimits } from "@nylorun/harness";
 import type { AbortReason } from "@nylorun/core/harness-api";
-import type { ModelProvider } from "../core/provider.js";
 import type { ModelGate } from "../gates/model-gate.js";
 import type { ToolGate } from "../gates/tool-gate.js";
 import { type McpPool } from "../mcp/pool.js";
-import { type McpSnapshot } from "../mcp/snapshot.js";
 import type { SandboxManager } from "../sandbox/manager.js";
-/** Where a Tenant's model calls go. */
+/** Where a Tenant's model calls go: its Model Gate. */
 export interface ModelRoute {
     readonly tenantId: string;
     readonly modelGate: ModelGate;
-    readonly modelProvider: ModelProvider;
-    /** True when the model comes from the Tenant vault selection, served by `modelGate`. */
-    readonly useVaultModel: boolean;
 }
 /** What a session's tool calls are routed by. */
 export interface ToolRouting {
     readonly rootManifest: AgentManifest;
-    readonly mcpSnapshot?: McpSnapshot;
     /** The session that owns the tree's sandbox, and the sandbox resource it is attached to. */
     readonly sandboxOwnerId: string;
+    /** The sandbox spec the session pinned (`routing.sandbox.spec`); absent without a sandbox. */
+    readonly spec?: SandboxManifest;
     readonly environmentId?: string;
     /** Variables every sandbox command gets (R2c): secret names set to the sentinel, plain values. */
     readonly environment?: Readonly<Record<string, string>>;
@@ -34,14 +33,12 @@ export interface ToolRouting {
     readonly claim?: string;
 }
 /**
- * Call the model for one effect. A provider failure comes back as a failure outcome
- * (Model Calls §6), whichever provider serves the call; only an abort throws, and the
- * advance decides what the abort means. `atGate` sends the call to the Model Gate even when the
- * Tenant's model is not from the vault: the Tenant's fixture model is answered there (R4.3).
+ * Call the model for one effect, through the Model Gate. A provider failure comes back as a
+ * failure outcome (Model Calls §6), whichever provider serves the call; only an abort throws, and
+ * the advance decides what the abort means. The Tenant's fixture model is answered at the gate
+ * too (R4.3).
  */
-export declare function invokeModel(route: ModelRoute, request: HostEffect, signal: AbortSignal, options?: {
-    readonly atGate?: boolean;
-}): Promise<unknown>;
+export declare function invokeModel(route: ModelRoute, request: HostEffect, signal: AbortSignal): Promise<unknown>;
 /**
  * A signal that follows `signal` only for the abort kinds in `kinds`. An MCP call stops on a
  * cancel; at the Tool Gate it also stops waiting on a shutdown, since the gate keeps the call
@@ -49,13 +46,14 @@ export declare function invokeModel(route: ModelRoute, request: HostEffect, sign
  * so the next advance replays it.
  */
 export declare function abortOn(signal: AbortSignal, kinds: readonly AbortReason[]): AbortSignal;
-/** True when `request` calls `save_artifact`, which the Runtime pinned on `manifest`. */
-export declare function isSaveArtifactCall(manifest: AgentManifest | undefined, request: HostEffect): boolean;
-/** True when `request` calls `read_artifact` (R2b C11), which the Runtime pinned on `manifest`. */
-export declare function isReadArtifactCall(manifest: AgentManifest | undefined, request: HostEffect): boolean;
-/** True when `request` calls a tool of a declared MCP server (every one is remote). */
-export declare function isRemoteMcpCall(routing: Pick<ToolRouting, "rootManifest" | "mcpSnapshot">, request: HostEffect): boolean;
+/**
+ * True when `request` calls a tool of an MCP server its agent declares (every one is remote): an
+ * `mcp` call, by its target's `server` (protocol 15).
+ */
+export declare function isRemoteMcpCall(routing: Pick<ToolRouting, "rootManifest">, request: HostEffect): boolean;
 export declare function callMcpTool(mcp: McpPool, routing: ToolRouting, request: HostEffect, signal: AbortSignal, 
+/** The run's Runtime limit `toolAnswerBytes`: the largest answer kept where this process holds the connection. */
+maxResultBytes: number, 
 /** The call's span context (R7.4), sent as `traceparent` where this process holds the connection. */
 traceparent?: string): Promise<unknown>;
 /**
@@ -66,4 +64,8 @@ traceparent?: string): Promise<unknown>;
 export declare function callHttpTool(gate: Pick<ToolGate, "callHttp">, request: HostEffect, signal: AbortSignal, 
 /** The call's span context (R7.4); the gates service reads its own from the journal. */
 traceparent?: string): Promise<unknown>;
-export declare function callSandboxTool(sandbox: SandboxManager, routing: ToolRouting, request: HostEffect, signal: AbortSignal): Promise<unknown>;
+/**
+ * Runs a `sandbox` call: the operation it names, in the session's sandbox (the one its agents
+ * used as tools share), held to the harness's sandbox tool limits.
+ */
+export declare function callSandboxTool(sandbox: SandboxManager, routing: ToolRouting, request: HostEffect, signal: AbortSignal, limits?: SandboxToolLimits): Promise<unknown>;

package/dist/harness/calls.js

@@ -1,26 +1,23 @@
 /**
- * The calls a harness executes, as pure helpers over what routes them: the Model Gate (or the
- * Tenant's provider), the Tool Gate, the MCP pool, the SandboxManager. No store, no record: the
- * session's routing comes with the run (`TurnStart.routing`).
+ * The calls a harness executes, as pure helpers over what routes them: the Model Gate, the Tool
+ * Gate, the MCP pool, the SandboxManager. No store, no record: the session's routing comes with
+ * the run (`TurnStart.routing`). Every model call goes through the Model Gate, in a harness
+ * process and in core's alike (protocol 15): a Runtime with a scripted model serves it from a
+ * gate too (`providerModelGate`).
  */
-import { READ_ARTIFACT_TOOL, SAVE_ARTIFACT_TOOL, } from "@nylorun/core/define";
+import { isSandboxToolName } from "@nylorun/core/define";
 import { runAbortKind } from "@nylorun/harness/api";
 import { httpToolRefOf } from "../gates/http-tool.js";
 import { classifyThrown } from "../model/classify.js";
 import { findServer } from "../mcp/pool.js";
-import { manifestFor, mcpToolOf } from "../mcp/snapshot.js";
-import { isPinnedRuntimeTool, sandboxToolSpec } from "../sandbox/runtime-tools.js";
 /**
- * Call the model for one effect. A provider failure comes back as a failure outcome
- * (Model Calls §6), whichever provider serves the call; only an abort throws, and the
- * advance decides what the abort means. `atGate` sends the call to the Model Gate even when the
- * Tenant's model is not from the vault: the Tenant's fixture model is answered there (R4.3).
+ * Call the model for one effect, through the Model Gate. A provider failure comes back as a
+ * failure outcome (Model Calls §6), whichever provider serves the call; only an abort throws, and
+ * the advance decides what the abort means. The Tenant's fixture model is answered at the gate
+ * too (R4.3).
  */
-export async function invokeModel(route, request, signal, options = {}) {
-    const atGate = route.useVaultModel || options.atGate === true;
+export async function invokeModel(route, request, signal) {
     try {
-        if (!atGate)
-            return await route.modelProvider(request, signal);
         return await route.modelGate.call({
             tenantId: route.tenantId,
             sessionId: request.sessionId,
@@ -28,6 +25,8 @@ export async function invokeModel(route, request, signal, options = {}) {
             agentId: request.agentId,
             effectId: request.effectId,
             invocationId: String(request.context.invocationId),
+            ...(request.agent === undefined ? {} : { agent: request.agent }),
+            ...(request.purpose === undefined ? {} : { purpose: request.purpose }),
             call: request.input,
         }, signal);
     }
@@ -35,7 +34,7 @@ export async function invokeModel(route, request, signal, options = {}) {
         if (signal.aborted) {
             // A call that outlives this process stops only when told to: on a user cancel. After a
             // shutdown or a lost lease the next owner re-sends it and picks up its outcome (P1.2).
-            if (atGate && runAbortKind(signal) === "cancel" && route.modelGate.cancel)
+            if (runAbortKind(signal) === "cancel" && route.modelGate.cancel)
                 await route.modelGate.cancel({
                     tenantId: route.tenantId,
                     sessionId: request.sessionId,
@@ -65,43 +64,34 @@ export function abortOn(signal, kinds) {
         signal.addEventListener("abort", follow, { once: true });
     return controller.signal;
 }
-/** True when `request` calls `save_artifact`, which the Runtime pinned on `manifest`. */
-export function isSaveArtifactCall(manifest, request) {
-    return isArtifactsToolCall(manifest, request, SAVE_ARTIFACT_TOOL);
-}
-/** True when `request` calls `read_artifact` (R2b C11), which the Runtime pinned on `manifest`. */
-export function isReadArtifactCall(manifest, request) {
-    return isArtifactsToolCall(manifest, request, READ_ARTIFACT_TOOL);
-}
-function isArtifactsToolCall(manifest, request, toolName) {
-    return (request.kind === "tool" &&
-        request.toolName === toolName &&
-        isPinnedRuntimeTool(manifest, toolName));
-}
-/** True when `request` calls a tool of a declared MCP server (every one is remote). */
+/**
+ * True when `request` calls a tool of an MCP server its agent declares (every one is remote): an
+ * `mcp` call, by its target's `server` (protocol 15).
+ */
 export function isRemoteMcpCall(routing, request) {
-    if (request.kind !== "tool")
+    if (request.kind !== "tool" || request.target?.kind !== "mcp")
         return false;
-    const tool = mcpToolOf(routing.mcpSnapshot, request);
-    if (!tool)
-        return false;
-    return findServer(routing.rootManifest, tool.agentId, tool.serverName) !== undefined;
+    return findServer(routing.rootManifest, request.agent?.id, request.target.server) !== undefined;
 }
 export async function callMcpTool(mcp, routing, request, signal, 
+/** The run's Runtime limit `toolAnswerBytes`: the largest answer kept where this process holds the connection. */
+maxResultBytes, 
 /** The call's span context (R7.4), sent as `traceparent` where this process holds the connection. */
 traceparent) {
-    const tool = mcpToolOf(routing.mcpSnapshot, request);
-    if (!tool)
-        throw new Error(`MCP tool '${request.toolName ?? ""}' is not in the session snapshot`);
+    // The call names its tool by its identity (protocol 15): the server, and its own name there.
+    const target = request.target;
+    if (target?.kind !== "mcp")
+        throw new Error(`'${request.toolName ?? ""}' is not an MCP tool call`);
     return mcp.call({
         sessionId: request.sessionId,
-        ...(tool.agentId === undefined ? {} : { agentId: tool.agentId }),
-        serverName: tool.serverName,
-        serverToolName: tool.serverToolName,
+        ...(request.agent === undefined ? {} : { agentId: request.agent.id }),
+        serverName: target.server,
+        serverToolName: target.tool,
         args: request.input,
         manifest: routing.rootManifest,
         effectId: request.effectId,
         ...(traceparent ? { traceparent } : {}),
+        maxResultBytes,
         signal,
     });
 }
@@ -123,17 +113,21 @@ traceparent) {
         ...(traceparent ? { traceparent } : {}),
     }, signal);
 }
-export async function callSandboxTool(sandbox, routing, request, signal) {
-    const spec = sandboxToolSpec(manifestFor(routing.rootManifest, request.agent), request.toolName);
+/**
+ * Runs a `sandbox` call: the operation it names, in the session's sandbox (the one its agents
+ * used as tools share), held to the harness's sandbox tool limits.
+ */
+export async function callSandboxTool(sandbox, routing, request, signal, limits) {
+    const { spec } = routing;
     if (!spec)
-        throw new Error(`'${request.toolName ?? ""}' is not a sandbox tool`);
-    // Agents used as tools share the session's sandbox; the tree declares one sandbox spec.
+        throw new Error(`This session has no sandbox to run '${request.toolName ?? ""}' in`);
+    if (request.toolName === undefined || !isSandboxToolName(request.toolName))
+        throw new Error(`'${request.toolName ?? ""}' is not a sandbox operation`);
     return sandbox.run({
         id: routing.sandboxOwnerId,
         activeTurnId: routing.activeTurnId,
-        manifest: routing.rootManifest,
         ...(routing.environmentId === undefined ? {} : { environmentId: routing.environmentId }),
         ...(routing.environment === undefined ? {} : { environment: routing.environment }),
         ...(routing.claim === undefined ? {} : { claim: routing.claim }),
-    }, spec, request.toolName, request.input, signal);
+    }, spec, request.toolName, request.input, signal, limits);
 }

package/dist/harness/executors.d.ts

@@ -1,3 +1,4 @@
+import { type SandboxToolLimits } from "@nylorun/harness";
 import type { HarnessExecutors, HarnessRun, McpRecorder, PreparedRun } from "@nylorun/harness/api";
 import type { ToolGate } from "../gates/tool-gate.js";
 import { type McpPool } from "../mcp/pool.js";
@@ -10,12 +11,18 @@ export interface HarnessExecutorsOptions {
     readonly mcp: McpPool;
     /** The SandboxManager; a harness process creates it once `hello` names the Tenant. */
     readonly sandbox: () => SandboxManager;
+    /**
+     * The sandbox tools' limits the calls run with: the harness's configuration, the same it gives
+     * `createHarness({ sandboxTools })`. Each left out is its default.
+     */
+    readonly sandboxTools?: Partial<SandboxToolLimits>;
 }
 export declare function harnessExecutors(options: HarnessExecutorsOptions): HarnessExecutors;
 /**
- * Readies the run's MCP servers (§10.5 step 3): the first segment of a session discovers their
- * tools and records the snapshot (the first recorded wins); later ones reconnect them and record
- * what failed. Nothing for a session without MCP servers.
+ * Readies the run's MCP servers (§10.5 step 3): a run without MCP facts (`turn.start.mcp`, the
+ * session's first) discovers their tools and records the snapshot (the first recorded wins);
+ * later ones reconnect the snapshot's servers and record what failed. Answers the facts the run
+ * goes on with. Nothing for a session without MCP servers.
  */
 export declare function prepareMcp(pool: McpPool, run: HarnessRun, record: McpRecorder): Promise<PreparedRun | undefined>;
 /** A run's routing, as the call helpers take it. Its sandbox events are claimed for the run. */

package/dist/harness/executors.js

@@ -8,36 +8,42 @@
  * (`--service harness`, `main.ts`) its own, whose sandbox events it claims from core.
  */
 import { hashManifest } from "@nylorun/core/define";
+import { sandboxToolLimitsOf } from "@nylorun/harness";
 import { GateCallLost } from "../gates/tool-client.js";
 import { serversOf } from "../mcp/pool.js";
-import { mcpToolOf } from "../mcp/snapshot.js";
 import { isHttpToolCall } from "../gates/http-tool.js";
-import { abortOn, callHttpTool, callMcpTool, callSandboxTool, invokeModel, isRemoteMcpCall, isSaveArtifactCall, } from "./calls.js";
+import { abortOn, callHttpTool, callMcpTool, callSandboxTool, invokeModel, isRemoteMcpCall, } from "./calls.js";
 export function harnessExecutors(options) {
     const recoversTools = options.toolGate.recovers === true;
+    const sandboxTools = sandboxToolLimitsOf(options.sandboxTools);
     const atGate = (effect, run) => {
         const routing = routingOf(run);
         return isRemoteMcpCall(routing, effect) || isHttpToolCall(routing.rootManifest, effect);
     };
     const recovered = (effect, run) => recoversTools && atGate(effect, run);
     return {
-        // With the Tenant's fixture model on, the Model Gate answers it (R4.3), metered like any call.
-        model: (effect, signal, run) => invokeModel(options.model, effect, signal, { atGate: run.start.options.fixtureModel }),
+        // Every call goes through the Model Gate (protocol 15); with the Tenant's fixture model on,
+        // the gate answers it (R4.3), metered like any call.
+        model: (effect, signal) => invokeModel(options.model, effect, signal),
         tool(effect, signal, run, call) {
             const routing = routingOf(run);
             const traceparent = call?.traceparent;
             // A call at the Tool Gate outlives a shutdown there; a local one finishes and is recorded.
             const kinds = recovered(effect, run) ? ["cancel", "shutdown"] : ["cancel"];
+            // A call is routed by what it names as its target (protocol 15); a flow's HTTP stage names
+            // its stage.
             if (isHttpToolCall(routing.rootManifest, effect))
                 return callHttpTool(options.toolGate, effect, abortOn(signal, kinds), traceparent);
             // A sandbox command joins its call's span (R7.4): a CLI that reads TRACEPARENT traces under it.
-            if (!mcpToolOf(routing.mcpSnapshot, effect))
-                return callSandboxTool(options.sandbox(), traceparent ? { ...routing, environment: { ...routing.environment, TRACEPARENT: traceparent } } : routing, effect, signal);
-            return callMcpTool(options.mcp, routing, effect, abortOn(signal, kinds), traceparent);
+            if (effect.target?.kind === "sandbox")
+                return callSandboxTool(options.sandbox(), traceparent ? { ...routing, environment: { ...routing.environment, TRACEPARENT: traceparent } } : routing, effect, signal, sandboxTools);
+            if (effect.target?.kind !== "mcp")
+                throw new Error(`This harness runs no ${effect.target?.kind ?? "untargeted"} call of '${effect.toolName ?? ""}'`);
+            return callMcpTool(options.mcp, routing, effect, abortOn(signal, kinds), run.start.limits.toolAnswerBytes, traceparent);
         },
         recovers: {
             get model() {
-                return options.model.useVaultModel && options.model.modelGate.recovers === true;
+                return options.model.modelGate.recovers === true;
             },
             tool: recovered,
         },
@@ -51,12 +57,42 @@ export function harnessExecutors(options) {
             });
         },
         prepare: (run, record) => prepareMcp(options.mcp, run, record),
+        files: {
+            read: (run, path, maxBytes, signal) => withSandbox(run, (session, spec) => options.sandbox().readBytes(session, spec, path, maxBytes, signal)),
+            write: (run, path, body, signal) => withSandbox(run, (session, spec) => options.sandbox().writeBytes(session, spec, path, body, signal)),
+            list: (run, dir, maxEntries, signal) => withSandbox(run, async (session, spec) => {
+                const listed = await options.sandbox().listFiles(session, spec, dir, maxEntries, signal);
+                return listed.kind === "listed"
+                    ? { kind: "listed", entries: listed.listing.entries, truncated: listed.listing.truncated }
+                    : listed.kind === "missing"
+                        ? { kind: "missing" }
+                        : listed;
+            }),
+            mount: (run, folder, files, read, signal) => withSandbox(run, (session, spec) => options.sandbox().mountFolder(session, spec, folder, files, read, signal)),
+        },
     };
 }
 /**
- * Readies the run's MCP servers (§10.5 step 3): the first segment of a session discovers their
- * tools and records the snapshot (the first recorded wins); later ones reconnect them and record
- * what failed. Nothing for a session without MCP servers.
+ * Runs `use` on the run's sandbox (the session's, which its agents used as tools share), or
+ * answers `artifact.no_sandbox` for a session without one.
+ */
+async function withSandbox(run, use) {
+    const routing = routingOf(run);
+    const { spec } = routing;
+    if (spec === undefined)
+        return { kind: "failed", code: "artifact.no_sandbox", message: "This session has no sandbox." };
+    return use({
+        id: routing.sandboxOwnerId,
+        activeTurnId: routing.activeTurnId,
+        ...(routing.environmentId === undefined ? {} : { environmentId: routing.environmentId }),
+        ...(routing.claim === undefined ? {} : { claim: routing.claim }),
+    }, spec);
+}
+/**
+ * Readies the run's MCP servers (§10.5 step 3): a run without MCP facts (`turn.start.mcp`, the
+ * session's first) discovers their tools and records the snapshot (the first recorded wins);
+ * later ones reconnect the snapshot's servers and record what failed. Answers the facts the run
+ * goes on with. Nothing for a session without MCP servers.
  */
 export async function prepareMcp(pool, run, record) {
     const routing = routingOf(run);
@@ -65,38 +101,32 @@ export async function prepareMcp(pool, run, record) {
         return undefined;
     const sessionId = run.grant.sessionId;
     let answer;
-    if (!routing.mcpSnapshot) {
+    const facts = run.start.mcp;
+    if (!facts) {
         const found = await pool.discover({
             sessionId,
             manifest,
             manifestHash: hashManifest(manifest),
+            maxInstructionBytes: run.start.limits.recordEntryBytes,
             signal: run.signal,
         });
         answer = await record({ snapshot: found.snapshot, diagnostics: found.diagnostics });
     }
     else {
-        const diagnostics = await pool.reconnect({
-            sessionId,
-            manifest,
-            tools: routing.mcpSnapshot.mcpTools,
-            signal: run.signal,
-        });
+        const diagnostics = await pool.reconnect({ sessionId, manifest, servers: facts.servers, signal: run.signal });
         if (diagnostics.length === 0)
             return undefined;
         answer = await record({ diagnostics });
     }
-    return {
-        sessionTools: answer.sessionTools,
-        ...(answer.snapshot === undefined ? {} : { mcpSnapshot: answer.snapshot }),
-    };
+    return answer.mcp === undefined ? undefined : { mcp: answer.mcp };
 }
 /** A run's routing, as the call helpers take it. Its sandbox events are claimed for the run. */
 export function routingOf(run) {
     const { routing } = run.start;
     return {
         rootManifest: routing.rootManifest,
-        ...(routing.mcpSnapshot ? { mcpSnapshot: routing.mcpSnapshot } : {}),
         sandboxOwnerId: routing.sandbox?.ownerId ?? run.grant.sessionId,
+        ...(routing.sandbox?.spec === undefined ? {} : { spec: routing.sandbox.spec }),
         ...(routing.sandbox?.environmentId === undefined ? {} : { environmentId: routing.sandbox.environmentId }),
         ...(routing.sandbox?.environment === undefined ? {} : { environment: routing.sandbox.environment }),
         activeTurnId: run.grant.turnId,

package/dist/harness/main.js

@@ -28,6 +28,7 @@ import { podHost } from "./pod.js";
 import { prepareDisk } from "./setup.js";
 import { harnessRunTokens } from "./run-tokens.js";
 import { startHarnessService } from "./service.js";
+import { hostTuning } from "../tuning.js";
 /**
  * `baseline` is the allowlisted environment of a pod's sandbox tools (`baselineEnvironment`),
  * read by `host/main.ts`: nothing here reads the process environment.
@@ -77,7 +78,6 @@ export async function runHarness(stack, baseline) {
             : {}),
         paths,
         modelGate: httpModelGate({ url: config.gatesUrl, runTokens }),
-        useVaultModel: true,
         toolGate: httpToolGate({ url: config.gatesUrl, runTokens }),
         logger,
         version: RUNTIME_VERSION,
@@ -107,7 +107,7 @@ export async function runHarness(stack, baseline) {
             // Runs are given back (core resumes them in its next advance), then MCP and sandboxes stop.
             pod?.stop();
             void service
-                .stop(pod ? 7_000 : 10_000)
+                .stop(pod ? hostTuning().harness.podStopMs : hostTuning().harness.stopMs)
                 .catch((error) => logger.warn("harness_stop_failed", { message: error instanceof Error ? error.message : String(error) }))
                 .finally(() => {
                 health.close();

package/dist/harness/pod.d.ts

@@ -1,9 +1,9 @@
 import type { PodHostConfig } from "../host/stack-config.js";
-/** How often the host and egress tokens are renewed. */
-export declare const RENEW_MS: number;
 /** What to run and copy on a new disk (`sandbox/setup.ts` in core), from the join answer. */
 export interface DiskSetup {
     readonly recipeVersion: number;
+    /** The sha256 of the commands and files (track T3): a marker with another runs the setup again. */
+    readonly setupHash?: string;
     readonly commands: readonly {
         readonly command: string;
         readonly cwd: string;

package/dist/harness/pod.js

@@ -15,8 +15,7 @@ import { randomUUID } from "node:crypto";
 import { mkdir, readFile, rename, writeFile } from "node:fs/promises";
 import { rootCertificates } from "node:tls";
 import { dirname } from "node:path";
-/** How often the host and egress tokens are renewed. */
-export const RENEW_MS = 5 * 60_000;
+import { hostTuning } from "../tuning.js";
 /** The variables CLIs read their trust bundle from: OpenSSL, Node, Python, curl, git, AWS. */
 const TRUST_VARIABLES = [
     "SSL_CERT_FILE",
@@ -44,7 +43,7 @@ export function podHost(config, logger, options = {}) {
                 ...(init.bearer ? { authorization: `Bearer ${init.bearer}` } : {}),
             },
             ...(init.body === undefined ? {} : { body: JSON.stringify(init.body) }),
-            signal: AbortSignal.timeout(15_000),
+            signal: AbortSignal.timeout(hostTuning().harness.podJoinTimeoutMs),
         });
         const text = await response.text();
         if (response.status === 401 || response.status === 400)
@@ -109,11 +108,13 @@ export function podHost(config, logger, options = {}) {
     };
     /** A request with a current host token: the held one, renewed near expiry, or a new join. */
     const authorized = async (path, init) => {
-        const current = held && held.expiresAt - Date.now() > 60_000 ? held : ((await renew()) ?? (await join()));
+        const current = held && held.expiresAt - Date.now() > hostTuning().harness.podRenewEarlyMs
+            ? held
+            : ((await renew()) ?? (await join()));
         return call(`${config.httpUrl}/nylorun/harness/v1/host/${path}`, {
             ...init,
             headers: { ...init.headers, authorization: `Bearer ${current.hostToken}` },
-            signal: AbortSignal.timeout(5 * 60_000),
+            signal: AbortSignal.timeout(hostTuning().harness.podRequestTimeoutMs),
         });
     };
     const renew = async () => {
@@ -134,7 +135,7 @@ export function podHost(config, logger, options = {}) {
     };
     const timer = setInterval(() => {
         void renew().catch((error) => logger.warn("sandbox_host_renew_failed", { message: error instanceof Error ? error.message : String(error) }));
-    }, options.renewMs ?? RENEW_MS);
+    }, options.renewMs ?? hostTuning().harness.podRenewMs);
     timer.unref();
     return {
         async token() {

package/dist/harness/run-tokens.d.ts

@@ -14,5 +14,8 @@ export interface HarnessRunTokens {
     /** Keeps a run's grant: `createHarness({ onGrant })`. */
     grant(grant: RunGrant): void;
 }
-/** Remembers the last token of at most `limit` sessions (least recently granted dropped first). */
+/**
+ * Remembers the last token of at most `limit` sessions (least recently granted dropped first).
+ * Default `harness.runTokensMax` (Host tuning, 10,000).
+ */
 export declare function harnessRunTokens(limit?: number): HarnessRunTokens;

package/dist/harness/run-tokens.js

@@ -1,5 +1,9 @@
-/** Remembers the last token of at most `limit` sessions (least recently granted dropped first). */
-export function harnessRunTokens(limit = 10_000) {
+import { hostTuning } from "../tuning.js";
+/**
+ * Remembers the last token of at most `limit` sessions (least recently granted dropped first).
+ * Default `harness.runTokensMax` (Host tuning, 10,000).
+ */
+export function harnessRunTokens(limit = hostTuning().harness.runTokensMax) {
     const tokens = new Map();
     return {
         token: (sessionId) => tokens.get(sessionId),