@nylorun/runtime 0.26.0-beta → 0.28.0-beta

package/dist/tenant/advance.js

@@ -47,15 +47,16 @@ import { endAdvance } from "./scheduler.js";
 import { harnessOf } from "./context.js";
 import { HARNESS_ID } from "../sandbox/placement.js";
 import { recoversModelCalls } from "./effects.js";
+import { contextCompacted } from "./transcript.js";
 import { slimModelEffects } from "./slim.js";
 import { applyUpdates, leanState, transcriptShadow, withTranscript, } from "./history.js";
-import { command } from "./commands.js";
-import { exportOutputs } from "../artifacts/export.js";
-import { dropRunGrant, grantRun } from "./run-grants.js";
+import { command, startQueuedTurn } from "./commands.js";
+import { dropRunGrant, grantRun, rootAgentOf } from "./run-grants.js";
 import { startHeartbeat } from "../harness-api/renew.js";
 import { buildTurnStart, startSegment } from "../harness-api/start.js";
-import { touchEnvironment } from "./environments.js";
+import { touchAgent } from "./agents.js";
 import { endTurn, pauseTurn } from "./turn-timing.js";
+import { hostTuning } from "../tuning.js";
 import { AdvanceAbort, AdvanceDeadlineError, abortKind, } from "./worker.js";
 /**
  * A segment stopped by a `shutdown` or `ownership.lost` abort before it settled. Never
@@ -95,15 +96,6 @@ class HarnessUnavailable extends Error {
     }
 }
 const DONE = { status: "done" };
-/** How soon an advance whose segment no harness took is tried again. */
-const UNAVAILABLE_RETRY_MS = 1000;
-/**
- * How long a pod sandbox's segment waits for its engine (F7.2): a pod that is starting, or
- * resuming, takes longer than a harness that is already connected.
- */
-const POD_OFFER_WAIT_MS = 60_000;
-/** Shortest `busy` retry, so a lease about to lapse is not polled in a tight loop. */
-const MIN_RETRY_MS = 25;
 /**
  * Advance session `id` if it has a runnable checkpoint (`WorkerHandlers.advance`). Returns
  * `busy` when another advance holds a live lease, `done` otherwise.
@@ -115,7 +107,10 @@ export async function advance(ctx, id, signal) {
     if (taken.status === "busy")
         return {
             status: "busy",
-            retryAfterMs: Math.min(Math.max(Date.parse(taken.ownerExpiresAt) - Date.now(), MIN_RETRY_MS), ctx.ownerLeaseMs),
+            retryAfterMs: Math.min(
+            // The shortest `busy` retry (`tenant.busyRetryMinMs`), so a lease about to lapse is not
+            // polled in a tight loop.
+            Math.max(Date.parse(taken.ownerExpiresAt) - Date.now(), hostTuning().tenant.busyRetryMinMs), ctx.ownerLeaseMs),
         };
     if (taken.status === "idle")
         return DONE;
@@ -129,7 +124,10 @@ export async function advance(ctx, id, signal) {
     ctx.work.running.set(id, controller);
     ctx.work.runningTurns.set(id, taken.session.activeTurnId ?? null);
     // A harness renews the lease once it holds the run; until then, and without one, core does.
-    const run = { agentId: taken.session.agentId, activeTurnId: taken.session.activeTurnId };
+    // The run token names the root agent as the engine does: the loop manifest's id, i.e. the
+    // agent manifest's name (protocol 16), never the Agent the session runs on. The model gate's
+    // usage rows and `manifest` budgets key on it.
+    const run = { agentId: rootAgentOf(taken.session), activeTurnId: taken.session.activeTurnId };
     const heartbeat = startHeartbeat(ctx, lease, controller, run);
     let result = DONE;
     let release = true;
@@ -152,7 +150,7 @@ export async function advance(ctx, id, signal) {
                 sessionId: id,
                 epoch: lease.epoch,
             });
-            result = { status: "busy", retryAfterMs: UNAVAILABLE_RETRY_MS };
+            result = { status: "busy", retryAfterMs: hostTuning().tenant.unavailableRetryMs };
         }
         else if (error instanceof SegmentStopped && error.kind === "shutdown") {
             // Left for the next advance, which resumes from the checkpoint once this one releases.
@@ -186,7 +184,7 @@ export async function advance(ctx, id, signal) {
         // The Environment was used: `deleteAfter`, and a pod's idle time (D34), count from the end
         // of each segment.
         if (placed.environment !== undefined)
-            await touchEnvironment(ctx, placed.environment);
+            await touchAgent(ctx, placed.environment);
     }
     return result;
 }
@@ -199,11 +197,11 @@ function podUnusable(ctx, segment) {
         return `Environment ${pod.id} is a pod Environment, and this Runtime has no sandbox pods`;
     const state = pod.pod;
     if (state.desired === "deleted")
-        return `Environment ${pod.id} was deleted`;
+        return `Agent ${pod.id} was deleted`;
     if (state.observed === "lost")
-        return `Environment ${pod.id} was lost: ${state.reason ?? "its volume is gone"}`;
+        return `Agent ${pod.id} was lost: ${state.reason ?? "its volume is gone"}`;
     if (state.observed === "failed")
-        return `Environment ${pod.id} failed to start: ${state.reason ?? "its pod was not ready"}`;
+        return `Agent ${pod.id} failed to start: ${state.reason ?? "its pod was not ready"}`;
     return undefined;
 }
 /**
@@ -290,6 +288,10 @@ async function runRemoteSegment(ctx, lease, started, controller, run, onTaken, p
         // A new volume being seeded from a disk version takes no turn until it holds it (R2d step 3).
         if (segment.pod?.seeding)
             throw new HarnessUnavailable();
+        // A pod starting on a new version takes no turn until its harness joins (track T3): a start
+        // that fails goes back to the version it ran, and the turn's first segment re-pins to it.
+        if (segment.pod?.starting)
+            throw new HarnessUnavailable();
         const pod = segment.pod?.id;
         if (started.environmentId !== undefined)
             placed.environment = started.environmentId;
@@ -302,7 +304,8 @@ async function runRemoteSegment(ctx, lease, started, controller, run, onTaken, p
             onTaken,
             // Only a connection of the session's harness takes its runs (R4.1).
             harness: harnessOf(segment.current),
-            ...(pod === undefined ? {} : { pod, waitMs: POD_OFFER_WAIT_MS }),
+            // A pod that is starting, or resuming, takes longer than a harness already connected.
+            ...(pod === undefined ? {} : { pod, waitMs: hostTuning().harnessApi.podOfferWaitMs }),
         });
         if (end.kind === "unavailable") {
             // A pod stopped, or not yet started: make sure it is asked to run.
@@ -313,9 +316,6 @@ async function runRemoteSegment(ctx, lease, started, controller, run, onTaken, p
         // Aborted before a harness took it: settled as an abort of the engine would be.
         if (end.kind === "aborted")
             throw signal.reason;
-        // The harness's own tools take names of this turn's tools (Harness API 3): the turn fails.
-        if (end.kind === "refused")
-            throw new Error(end.message);
         // Checked before the abort: whatever core's signal says, the run's effects are unaccounted for.
         if (end.kind === "released" && end.reason === "connection.lost")
             throw new RunLost();
@@ -333,7 +333,7 @@ async function runRemoteSegment(ctx, lease, started, controller, run, onTaken, p
             await settleFailure(ctx, lease, started, signal.reason);
         else {
             const recorded = result.status === "yielded" || result.status === "completed" || result.status === "paused";
-            cursor = await settleTurn(ctx, lease, started, result, recorded ? output.transcript ?? [] : [], signal, segment.cursor, 
+            cursor = await settle(ctx, lease, started, result, recorded ? output.transcript ?? [] : [], segment.cursor, 
             // The turn's end and its transcript are what the harness reported (R4.9).
             { source: { kind: "harness", id: harnessOf(started) }, evidence: "claimed", runId: output.runId });
         }
@@ -419,17 +419,6 @@ async function wakeWorkflowOf(ctx, t, agent, turnId, type, payload) {
             error: "Agent turn was cancelled",
         });
 }
-/**
- * `settle`, then, for a completed turn, the turn-end export of its sandbox outputs (F8.2): after
- * the turn has committed and while the advance still holds the lease. The harness hears back
- * after the export. The export never throws.
- */
-async function settleTurn(ctx, lease, s, result, updates, signal, cursor, writer) {
-    const kept = await settle(ctx, lease, s, result, updates, cursor, writer);
-    if (result.status === "completed")
-        await exportOutputs(ctx, lease.sessionId, s.activeTurnId, signal);
-    return kept;
-}
 /**
  * Record a segment result, then cancel failed siblings and wake a linked workflow. Returns the
  * cursor of the transcript it recorded (`cursor` when it recorded no edit), or undefined when
@@ -580,6 +569,9 @@ writer) {
         await t.event(id, s.activeTurnId, type, payload, writer);
         await t.put("sessions", id, current);
         await wakeWorkflowOf(ctx, t, current, s.activeTurnId, type, payload);
+        // Messages that waited for this turn start the next one (protocol 17).
+        if (await startQueuedTurn(ctx, t, current, id))
+            await t.put("sessions", id, current);
         return siblings;
     });
     for (const agentId of siblingCancelIds) {
@@ -613,6 +605,10 @@ async function heldCalls(t, effectIds) {
         const request = row.request;
         const context = (request.context ?? {});
         const toolName = request.toolName ?? request.key ?? effectId;
+        // A person approves the tool by its identity (protocol 15): an MCP tool by server and tool.
+        const what = row.server !== undefined && row.tool !== undefined && row.toolKind === "mcp"
+            ? `${row.server} / ${row.tool}`
+            : (row.tool ?? toolName);
         const reason = row.hold?.reason ?? "The Tenant's tool policy asks a person about this call";
         held.push({
             invocationId: typeof context.invocationId === "string" ? context.invocationId : effectId,
@@ -620,9 +616,10 @@ async function heldCalls(t, effectIds) {
             interaction: {
                 id: effectId,
                 kind: "approval",
-                prompt: `Approve ${toolName}?`,
+                prompt: `Approve ${what}?`,
                 reason,
                 ...(row.server === undefined ? {} : { server: row.server }),
+                ...(row.tool === undefined ? {} : { tool: row.tool }),
                 input: request.input ?? null,
             },
             status: "interaction",
@@ -649,6 +646,8 @@ async function settleFailure(ctx, lease, s, error) {
         current.activeTurnId = null;
         await t.put("sessions", id, current);
         await wakeWorkflowOf(ctx, t, current, s.activeTurnId, "turn.failed", payload);
+        if (await startQueuedTurn(ctx, t, current, id))
+            await t.put("sessions", id, current);
     });
 }
 /** Whether the session runs our harness, whose state core may store lean (R4.2). */
@@ -668,13 +667,16 @@ function leanCheckpoint(session, checkpoint) {
     return { ...checkpoint, state: leanOf(session, state) };
 }
 /**
- * Appends a segment's transcript edits; a snapshot moves `history.snapshot`. Returns the seq of
- * the last edit, if any.
+ * Appends a segment's transcript edits; a snapshot moves `history.snapshot`. An edit the harness
+ * marks as a compaction (`kind: "compaction"`, Q4) also writes `context.compacted`, from its facts
+ * and the summary calls it names. Returns the seq of the last edit, if any.
  */
 async function recordTranscript(t, id, turnId, s, updates, writer) {
     let last;
     for (const update of updates) {
         const event = await t.event(id, turnId, "transcript.updated", update, writer);
+        if ("compaction" in update)
+            await t.event(id, turnId, "context.compacted", await contextCompacted(t, id, turnId, update.compaction), writer);
         if (update.keep === 0)
             s.history = { from: s.history?.from ?? event.seq, snapshot: event.seq };
         last = event.seq;

package/dist/tenant/agent-manifests.d.ts

@@ -0,0 +1,72 @@
+/**
+ * Agent manifests (protocol 16, track T2): `/v1/agent-manifests/{name}`, named and versioned
+ * documents with what runs inside an agent's loop (`harness`) and what the Runtime provides
+ * around it (`runtime`). They replace agent definitions (`PUT /v1/agents/:id` before protocol
+ * 16) and environment manifests.
+ *
+ * - **Versions.** A save whose manifest hashes the same as the latest answers it unchanged; any
+ *   other writes the next version. A version is never changed or deleted alone.
+ * - **Tracking Agents move.** Saving a version moves every Agent that tracks the manifest to it
+ *   (track T3, `moveAgent`), in the save's transaction: at once, at its pod's next start, or once
+ *   its required secrets are set. A pinned Agent stays, and so does one the version cannot move
+ *   (a fixed field) or whose start failed on it. The plan counts both.
+ * - **Both sections at once.** The Runtime sees both sections, so it checks them against each
+ *   other (`sectionGaps`): every gap is named in one `422 manifest_inconsistent`, which is what
+ *   `requires` checked when a session opened before protocol 16. Each section's own checks run
+ *   too: the harness's (no code tools, no approvals, HTTP tool timeouts, the skill files) and the
+ *   runtime's (the Tenant's limits, its files).
+ * - **Plan and drift.** `?dryRun=true` answers what a save would do and saves nothing: the
+ *   changes from the latest by section, every reason the Runtime would refuse it, warnings, the
+ *   Agents it moves and how many stay on older versions. `If-Match: <version>` refuses
+ *   (`412 manifest_changed`) a save whose latest version moved since the client read it; `0` asks
+ *   for a manifest that does not exist yet.
+ * - **Every client is equal** (Q12): a version records who saved it (`savedBy`).
+ */
+import { type AgentManifestChange, type AgentManifestPlan, type AgentManifestV8, type AgentManifestVersions, type AgentManifestView, type PutAgentManifestRequest, type SaveAgentManifestResponse } from "@nylorun/core/contracts";
+import { type RecipeRequest } from "../sandbox/resolve.js";
+import type { AuthScope, TenantContext } from "./context.js";
+/** What a manifest's runtime section asks of an Agent's recipe, with the harness its loop names. */
+export declare function manifestRecipeRequest(manifest: Pick<AgentManifestV8, "harness" | "runtime">): RecipeRequest;
+/** The hash a manifest's version records: equal manifests hash the same. */
+export declare function agentManifestHash(manifest: AgentManifestV8): string;
+/** The owner a version's definition files are recorded under, for the sweep. */
+export declare function manifestFileOwner(name: string): string;
+/** Each field that differs between `before` and `after`, by path; arrays compare whole. */
+export declare function manifestChanges(before: unknown, after: unknown, path?: string): {
+    path: string;
+    from?: unknown;
+    to?: unknown;
+}[];
+/**
+ * The changes from `before` to `after` by section: `manifest` for the top-level fields, else
+ * `harness` or `runtime` with the path inside it. A section added or removed whole is one change.
+ */
+export declare function sectionChanges(before: Partial<AgentManifestV8> | undefined, after: AgentManifestV8): AgentManifestChange[];
+/**
+ * `PUT /v1/agent-manifests/{name}`: saves `body` as manifest `name`'s next version, or answers
+ * the latest unchanged; with `dryRun`, the plan of that save and nothing saved.
+ */
+export declare function saveAgentManifest(ctx: TenantContext, name: string, body: PutAgentManifestRequest, scope: AuthScope, options: {
+    dryRun: true;
+    ifMatch?: number;
+}): Promise<AgentManifestPlan>;
+export declare function saveAgentManifest(ctx: TenantContext, name: string, body: PutAgentManifestRequest, scope: AuthScope, options?: {
+    dryRun?: false;
+    ifMatch?: number;
+}): Promise<SaveAgentManifestResponse>;
+/** `GET /v1/agent-manifests/{name}` (the latest) and `.../versions/{n}`. */
+export declare function getAgentManifest(ctx: TenantContext, name: string, version?: number): Promise<AgentManifestView>;
+/** `GET /v1/agent-manifests`: each manifest's latest version. */
+export declare function listAgentManifests(ctx: TenantContext): Promise<{
+    manifests: AgentManifestView[];
+}>;
+/** `GET /v1/agent-manifests/{name}/versions`: every version, newest first. */
+export declare function agentManifestVersions(ctx: TenantContext, name: string): Promise<AgentManifestVersions>;
+/**
+ * `DELETE /v1/agent-manifests/{name}`: deletes every version, refused while any Agent was made
+ * from one (`409 manifest_in_use`): the Agent names the version it runs.
+ */
+export declare function deleteAgentManifest(ctx: TenantContext, name: string): Promise<{
+    name: string;
+    deleted: boolean;
+}>;

package/dist/tenant/agent-manifests.js

@@ -0,0 +1,359 @@
+/**
+ * Agent manifests (protocol 16, track T2): `/v1/agent-manifests/{name}`, named and versioned
+ * documents with what runs inside an agent's loop (`harness`) and what the Runtime provides
+ * around it (`runtime`). They replace agent definitions (`PUT /v1/agents/:id` before protocol
+ * 16) and environment manifests.
+ *
+ * - **Versions.** A save whose manifest hashes the same as the latest answers it unchanged; any
+ *   other writes the next version. A version is never changed or deleted alone.
+ * - **Tracking Agents move.** Saving a version moves every Agent that tracks the manifest to it
+ *   (track T3, `moveAgent`), in the save's transaction: at once, at its pod's next start, or once
+ *   its required secrets are set. A pinned Agent stays, and so does one the version cannot move
+ *   (a fixed field) or whose start failed on it. The plan counts both.
+ * - **Both sections at once.** The Runtime sees both sections, so it checks them against each
+ *   other (`sectionGaps`): every gap is named in one `422 manifest_inconsistent`, which is what
+ *   `requires` checked when a session opened before protocol 16. Each section's own checks run
+ *   too: the harness's (no code tools, no approvals, HTTP tool timeouts, the skill files) and the
+ *   runtime's (the Tenant's limits, its files).
+ * - **Plan and drift.** `?dryRun=true` answers what a save would do and saves nothing: the
+ *   changes from the latest by section, every reason the Runtime would refuse it, warnings, the
+ *   Agents it moves and how many stay on older versions. `If-Match: <version>` refuses
+ *   (`412 manifest_changed`) a save whose latest version moved since the client read it; `0` asks
+ *   for a manifest that does not exist yet.
+ * - **Every client is equal** (Q12): a version records who saved it (`savedBy`).
+ */
+import { definitionFilesOf, } from "@nylorun/core/contracts";
+import { hashManifest } from "@nylorun/core/compatibility";
+import { approvalRefusal, codeToolRefusal, harnessIdOf, loopManifestOf, runtimeOf, sectionGaps, } from "@nylorun/core/define";
+import { canonical } from "../store/canonical.js";
+import { resolveRecipe } from "../sandbox/resolve.js";
+import { declaredSandboxes } from "../sandbox/share.js";
+import { httpToolTimeoutIssues } from "../gates/http-tool.js";
+import { limitIssues, limitsInForce, manifestShapeIssues, readTenantLimits } from "./limits.js";
+import { triggerIssues } from "./triggers.js";
+import { readRuntimeLimits } from "./runtime-limits.js";
+import { effectiveSandboxConfig, readSandboxConfig } from "../sandbox/tenant-config.js";
+import { actorOf, fileErrors } from "./agents.js";
+import { moveAgent, planMove } from "./agent-versions.js";
+import { definitionFileIssues } from "./definition-files.js";
+import { fail } from "./http.js";
+/** What a manifest's runtime section asks of an Agent's recipe, with the harness its loop names. */
+export function manifestRecipeRequest(manifest) {
+    const runtime = runtimeOf(manifest);
+    return {
+        ...(runtime.image === undefined ? {} : { image: runtime.image }),
+        ...(runtime.resources === undefined ? {} : { resources: runtime.resources }),
+        ...(runtime.storage === undefined ? {} : { storage: runtime.storage }),
+        ...(runtime.network === undefined ? {} : { network: runtime.network }),
+        harness: harnessIdOf(manifest.harness),
+        ...(runtime.lifecycle === undefined ? {} : { lifecycle: runtime.lifecycle }),
+        ...(runtime.setup === undefined ? {} : { setup: runtime.setup }),
+        ...(runtime.files === undefined ? {} : { files: runtime.files }),
+        ...(runtime.limits === undefined ? {} : { limits: runtime.limits }),
+        ...(runtime.secrets === undefined ? {} : { secrets: runtime.secrets }),
+    };
+}
+/** The hash a manifest's version records: equal manifests hash the same. */
+export function agentManifestHash(manifest) {
+    return hashManifest(manifest);
+}
+/** The owner a version's definition files are recorded under, for the sweep. */
+export function manifestFileOwner(name) {
+    return `agent-manifest:${name}`;
+}
+const notFound = (name, version) => fail(404, version === undefined ? `No agent manifest is named ${name}.` : `Agent manifest ${name} has no version ${version}.`, {
+    code: "manifest_not_found",
+});
+function viewOf(row, counts) {
+    return {
+        name: row.name,
+        version: row.version,
+        hash: row.hash,
+        manifest: row.body,
+        savedBy: row.savedBy,
+        createdAt: row.createdAt,
+        agents: counts.get(row.version) ?? 0,
+    };
+}
+/** Each field that differs between `before` and `after`, by path; arrays compare whole. */
+export function manifestChanges(before, after, path = "") {
+    const object = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
+    if (object(before) && object(after)) {
+        const keys = [...new Set([...Object.keys(before), ...Object.keys(after)])].sort();
+        return keys.flatMap((key) => manifestChanges(before[key], after[key], path ? `${path}.${key}` : key));
+    }
+    if (canonical(before) === canonical(after))
+        return [];
+    return [
+        {
+            path,
+            ...(before === undefined ? {} : { from: before }),
+            ...(after === undefined ? {} : { to: after }),
+        },
+    ];
+}
+/**
+ * The changes from `before` to `after` by section: `manifest` for the top-level fields, else
+ * `harness` or `runtime` with the path inside it. A section added or removed whole is one change.
+ */
+export function sectionChanges(before, after) {
+    const op = (from, to) => from === undefined ? "add" : to === undefined ? "remove" : "replace";
+    const changes = [];
+    const { harness: beforeHarness, runtime: beforeRuntime, ...beforeTop } = before ?? {};
+    const { harness, runtime, ...top } = after;
+    for (const change of manifestChanges(beforeTop, top))
+        changes.push({ section: "manifest", ...change, op: op(change.from, change.to) });
+    for (const [section, from, to] of [
+        ["harness", beforeHarness, harness],
+        ["runtime", beforeRuntime, runtime],
+    ]) {
+        if (from === undefined || to === undefined) {
+            if (from !== to)
+                changes.push({
+                    section,
+                    path: "",
+                    op: op(from, to),
+                    ...(from === undefined ? {} : { from }),
+                    ...(to === undefined ? {} : { to }),
+                });
+            continue;
+        }
+        for (const change of manifestChanges(from, to))
+            changes.push({ section, ...change, op: op(change.from, change.to) });
+    }
+    return changes;
+}
+/**
+ * Each live Agent of manifest `name` on another version than `to`, and whether a save of `to`
+ * moves it: it tracks the manifest, is not moving to `to` already, and `to` did not fail to start on it.
+ */
+async function agentsBehind(t, name, to) {
+    return (await t.listEnvironments())
+        .filter((agent) => agent.manifestName === name && agent.pod?.desired !== "deleted" && agent.manifestVersion !== to)
+        .map((agent) => ({
+        agent,
+        moves: agent.manifestRef === "tracking" && agent.targetVersion !== to && agent.failedVersion !== to,
+    }));
+}
+/**
+ * Plans (or with `apply`, makes) the move of each Agent that tracks manifest `version.name` to
+ * `version` (track T3): each under its row lock, in the save's transaction.
+ */
+async function moveTracking(t, version, apply) {
+    const moves = { now: 0, nextStart: 0, secrets: 0, behind: 0 };
+    const now = new Date().toISOString();
+    for (const { agent: listed, moves: tracks } of await agentsBehind(t, version.name, version.version)) {
+        const agent = tracks && apply ? await t.environment(listed.id, { lock: true }) : listed;
+        if (!agent || !tracks) {
+            if (agent && agent.targetVersion !== version.version)
+                moves.behind++;
+            continue;
+        }
+        const move = await planMove(t, agent, version, "tracking");
+        if (move.plan.applies === "refused") {
+            moves.behind++;
+            continue;
+        }
+        const applies = apply ? await moveAgent(t, agent, move, now) : move.plan.applies;
+        if (applies === "now")
+            moves.now++;
+        else if (applies === "next_start")
+            moves.nextStart++;
+        else if (applies === "secrets")
+            moves.secrets++;
+    }
+    return moves;
+}
+/** What a save of `manifest` should tell its saver, though it would be saved. */
+function warningsOf(ctx, manifest, to, moves) {
+    const warnings = [];
+    const runtime = runtimeOf(manifest);
+    if (runtime.image !== undefined && !runtime.image.includes("@sha256:"))
+        warnings.push({
+            code: "image_tag",
+            message: `runtime.image ${runtime.image} is a tag, not a digest: each Agent pins what its first pod pulls, so two Tenants may run different bytes.`,
+        });
+    if (runtime.kind === "pod" && !ctx.pods)
+        warnings.push({
+            code: "pods_unavailable",
+            message: "runtime.kind pod needs sandbox pods, which this Tenant does not have: an Agent made from it is refused until `nylorun local sandbox enable`.",
+        });
+    if (moves === undefined)
+        return warnings;
+    const moved = moves.now + moves.nextStart + moves.secrets;
+    if (moved > 0) {
+        const parts = [
+            ...(moves.now > 0 ? [`${moves.now} at once`] : []),
+            ...(moves.nextStart > 0 ? [`${moves.nextStart} at their pod's next start`] : []),
+            ...(moves.secrets > 0 ? [`${moves.secrets} once their required secrets are set`] : []),
+        ];
+        warnings.push({
+            code: "agents_move",
+            message: `${moved} Agent${moved === 1 ? " tracks" : "s track"} ${manifest.name} and move${moved === 1 ? "s" : ""} to version ${to}: ${parts.join(", ")}.`,
+        });
+    }
+    if (moves.behind > 0)
+        warnings.push({
+            code: "agents_behind",
+            message: `${moves.behind} Agent${moves.behind === 1 ? " stays" : "s stay"} on an older version of ${manifest.name}: pinned, or ${moves.behind === 1 ? "it" : "they"} cannot move to version ${to} (move or fork ${moves.behind === 1 ? "it" : "them"}).`,
+        });
+    return warnings;
+}
+/**
+ * Every reason the Runtime would refuse `manifest` now, apart from the gaps between its sections:
+ * its harness section's own checks and its runtime section's (the Tenant's limits, its files).
+ */
+async function errorsOf(t, manifest) {
+    const loop = loopManifestOf(manifest);
+    const errors = [];
+    // The Runtime runs agents from their manifests alone (track R2): no tool may need it.
+    const code = codeToolRefusal(loop);
+    if (code)
+        errors.push(code);
+    // Tool approvals are the Tenant's tool policy, decided at the Tool Gate (R5 step 2).
+    const approval = approvalRefusal(loop);
+    if (approval)
+        errors.push(approval);
+    const declared = declaredSandboxes(loop);
+    if (declared.length > 0)
+        errors.push(`${declared.join(", ")} declares a sandbox: what an agent runs on is the manifest's runtime section.`);
+    const runtimeLimits = await readRuntimeLimits(t);
+    errors.push(...httpToolTimeoutIssues(loop, runtimeLimits.httpToolTimeoutMs));
+    const runtime = runtimeOf(manifest);
+    const config = effectiveSandboxConfig(await readSandboxConfig(t));
+    const resolved = resolveRecipe(runtime.kind, manifestRecipeRequest(manifest), config);
+    const tenantLimits = await readTenantLimits(t);
+    errors.push(...(resolved.kind === "error" ? resolved.errors : []), ...limitIssues(runtime.limits, tenantLimits), ...manifestShapeIssues({ ...runtime, ...(manifest.description === undefined ? {} : { description: manifest.description }) }, runtimeLimits), ...(await fileErrors(t, runtime.files)), ...triggerIssues(runtime.triggers, runtimeLimits));
+    // A skill's files count against the manifest's own skill limit, never above the Tenant's.
+    const limitBytes = limitsInForce(tenantLimits, runtime.limits).skills.totalBytes;
+    const { missing, oversized } = await definitionFileIssues(t, loop, limitBytes);
+    if (missing.length > 0)
+        errors.push(`The manifest names ${missing.length} file(s) the Runtime does not hold; upload each with PUT /v1/files/<sha256> first: ${missing.join(", ")}`);
+    if (oversized.length > 0)
+        errors.push(`A skill's files may hold at most ${limitBytes} bytes together: ${oversized.map((skill) => `'${skill.name}' holds ${skill.bytes}`).join(", ")}`);
+    return { errors, missing, oversized, limitBytes };
+}
+export async function saveAgentManifest(ctx, name, body, scope, options = {}) {
+    const { requestId: _, ...manifest } = body;
+    if (manifest.name !== name)
+        fail(400, `The manifest is named ${manifest.name}, and the path names ${name}: they must match.`);
+    const hash = agentManifestHash(manifest);
+    const gaps = sectionGaps(manifest);
+    return ctx.store.tx(async (t) => {
+        await t.lockAgentManifest(name);
+        const latest = await t.agentManifest(name);
+        if (options.ifMatch !== undefined && (latest?.version ?? 0) !== options.ifMatch)
+            fail(412, latest === undefined
+                ? `Agent manifest ${name} does not exist, and If-Match named version ${options.ifMatch}.`
+                : `Agent manifest ${name} is at version ${latest.version}, not ${options.ifMatch}: someone saved it since you read it. Read it again, or save without If-Match to replace it.`, { code: "manifest_changed", details: { latest: latest?.version ?? 0 } });
+        const unchanged = latest?.hash === hash;
+        const to = unchanged ? latest.version : (latest?.version ?? 0) + 1;
+        const counts = await t.agentsOfManifest(name);
+        const checked = await errorsOf(t, manifest);
+        // The version as it would be saved, for the plan of the Agents it moves.
+        const row = unchanged
+            ? latest
+            : { name, version: to, body: manifest, hash, savedBy: { actor: actorOf(scope) }, createdAt: new Date().toISOString() };
+        if (options.dryRun) {
+            const errors = [...gaps, ...checked.errors];
+            // A save with errors moves nothing; one that changes nothing moves no Agent either.
+            const moves = errors.length > 0 || unchanged ? undefined : await moveTracking(t, row, false);
+            return {
+                name,
+                from: latest?.version ?? null,
+                to,
+                unchanged,
+                changes: unchanged ? [] : sectionChanges(latest?.body, manifest),
+                warnings: warningsOf(ctx, manifest, to, moves),
+                errors,
+                behind: moves?.behind ?? (await agentsBehind(t, name, to)).length,
+                moves: { now: moves?.now ?? 0, nextStart: moves?.nextStart ?? 0, secrets: moves?.secrets ?? 0 },
+            };
+        }
+        if (gaps.length > 0)
+            fail(422, `Agent manifest ${name}'s harness and runtime sections do not fit: ${gaps.join("; ")}.`, {
+                code: "manifest_inconsistent",
+                details: { gaps },
+            });
+        if (checked.missing.length > 0)
+            fail(400, checked.errors.find((error) => error.startsWith("The manifest names")), {
+                code: "definition_files_missing",
+                details: { missing: checked.missing },
+            });
+        if (checked.oversized.length > 0)
+            fail(413, `This manifest allows a skill's files at most ${checked.limitBytes} bytes together: ${checked.oversized.map((skill) => `'${skill.name}' holds ${skill.bytes}`).join(", ")}`, {
+                code: "limit_exceeded",
+                details: { limitBytes: checked.limitBytes, skills: checked.oversized },
+            });
+        if (checked.errors.length > 0)
+            fail(400, checked.errors.join(" "));
+        if (unchanged)
+            return { manifest: viewOf(latest, counts), unchanged: true, warnings: warningsOf(ctx, manifest, to, undefined) };
+        await t.insertAgentManifest(row);
+        // Its files by hash, skills' and runtime files' alike, for the sweep that deletes unused ones.
+        const shas = new Set(definitionFilesOf(loopManifestOf(manifest)));
+        for (const file of runtimeOf(manifest).files ?? [])
+            if ("files" in file)
+                for (const sha of Object.values(file.files))
+                    shas.add(sha);
+        if (shas.size > 0)
+            await t.insertDefinitionFileUses(manifestFileOwner(name), hash, [...shas]);
+        // Every Agent that tracks the manifest moves to the new version (track T3).
+        const moves = await moveTracking(t, row, true);
+        return { manifest: viewOf(row, await t.agentsOfManifest(name)), unchanged: false, warnings: warningsOf(ctx, manifest, to, moves) };
+    });
+}
+/** `GET /v1/agent-manifests/{name}` (the latest) and `.../versions/{n}`. */
+export async function getAgentManifest(ctx, name, version) {
+    return ctx.store.tx(async (t) => {
+        const row = (await t.agentManifest(name, version)) ?? notFound(name, version);
+        return viewOf(row, await t.agentsOfManifest(name));
+    });
+}
+/** `GET /v1/agent-manifests`: each manifest's latest version. */
+export async function listAgentManifests(ctx) {
+    return ctx.store.tx(async (t) => {
+        const manifests = [];
+        for (const row of await t.listAgentManifests())
+            manifests.push(viewOf(row, await t.agentsOfManifest(row.name)));
+        return { manifests };
+    });
+}
+/** `GET /v1/agent-manifests/{name}/versions`: every version, newest first. */
+export async function agentManifestVersions(ctx, name) {
+    return ctx.store.tx(async (t) => {
+        const rows = await t.agentManifestVersions(name);
+        if (rows.length === 0)
+            notFound(name);
+        const counts = await t.agentsOfManifest(name);
+        return {
+            name,
+            latest: rows[0].version,
+            versions: rows.map((row) => ({
+                version: row.version,
+                hash: row.hash,
+                savedBy: row.savedBy,
+                createdAt: row.createdAt,
+                agents: counts.get(row.version) ?? 0,
+            })),
+        };
+    });
+}
+/**
+ * `DELETE /v1/agent-manifests/{name}`: deletes every version, refused while any Agent was made
+ * from one (`409 manifest_in_use`): the Agent names the version it runs.
+ */
+export async function deleteAgentManifest(ctx, name) {
+    return ctx.store.tx(async (t) => {
+        await t.lockAgentManifest(name);
+        let made = 0;
+        for (const n of (await t.agentsOfManifest(name)).values())
+            made += n;
+        if (made > 0)
+            fail(409, `${made} Agent(s) were made from agent manifest ${name}: delete them first, or keep the manifest.`, {
+                code: "manifest_in_use",
+                details: { agents: made },
+            });
+        return { name, deleted: (await t.deleteAgentManifest(name)) > 0 };
+    });
+}