@nylorun/runtime 0.26.0-beta → 0.28.0-beta

package/dist/tenant/context.d.ts

@@ -19,8 +19,6 @@ import type { IssuerScope, SubjectScope, TenantEnvelope } from "@nylorun/core/co
 import type { DurableCheckpoint, FlowCheckpoint } from "@nylorun/harness/run";
 import type { AgentManifest, JsonValue, SandboxManifest } from "@nylorun/core/define";
 import type { OutboxRequest, SessionStore, Tx } from "../store/types.js";
-import type { FlowLimits } from "../core/limits.js";
-import type { ModelProvider } from "../core/provider.js";
 import type { ModelGate } from "../gates/model-gate.js";
 import type { ToolGate } from "../gates/tool-gate.js";
 import type { Keys } from "../keys/keys.js";
@@ -37,25 +35,33 @@ import type { StuckInvocation, Wake } from "../execution/types.js";
 import type { WorkState } from "./scheduler.js";
 import type { SigningKeys } from "./signing-keys.js";
 import type { BlobStore } from "../blob/index.js";
-import type { WorkspaceReader } from "../artifacts/workspace.js";
 import type { RunGrants } from "./run-grants.js";
 import type { TraceOptions } from "../traces/options.js";
 import type { TraceContext } from "../traces/ids.js";
 export interface Session {
     id: string;
+    /** The Agent the session runs on (protocol 16; a definition id before). */
     agentId: string;
     ownerUserId: string;
-    /** Session pin — the manifest the session was created with. */
+    /**
+     * Session pin: the loop manifest the session runs, its Agent's manifest version's harness
+     * section as the harness runs it (`loopManifestOf`), or a flow's leaf agent.
+     */
     manifest: any;
     manifestHash: string;
     /**
-     * The hash of the definition the session was opened from; `manifestHash` differs when the
-     * Runtime pinned its `runtime` block on it (R2b C11). Absent on older sessions.
+     * The agent manifest version the session runs (protocol 16): its Agent's when it opened, and
+     * again at a turn's first segment when its Agent's version changed since (T3, `repinTurn`).
+     * Absent on a session opened before protocol 16.
      */
-    definitionHash?: string;
+    definition?: {
+        name: string;
+        version: number;
+    };
+    /** The pinned version's `harness.loop`: passed to the harness, never read by the Runtime. */
+    loop?: Record<string, unknown>;
     /** Validated turn-manifest variants, keyed by hash (loops.md §4.2). */
     variants?: Record<string, AgentManifest>;
-    implementationVersion: string;
     info?: any;
     status: string;
     activeTurnId: string | null;
@@ -86,26 +92,35 @@ export interface Session {
      * and the context core hands on (to the harness, tools and sandbox commands) is in it.
      */
     turnTrace?: TraceContext;
+    /**
+     * What started the active turn when not a client (track T4): the trigger's run, or the session's
+     * own booked wake. A memory version written in the turn names its run (track T5).
+     */
+    turnCause?: {
+        kind: "trigger" | "self";
+        triggerId: string;
+        runId: string;
+    };
     creation: unknown;
     mcpSnapshot?: McpSnapshot;
     mcpDiagnostics?: readonly McpDiagnostic[];
     /**
-     * The Environment the session names (`environment`, protocol 11): its sandbox is the
-     * session's (the Environment's id keys the workspace) and its vault holds the session's
+     * The Agent's environment the session runs on: since protocol 16 always its Agent's id. Its
+     * sandbox is the session's (the id keys the workspace) and its vault holds the session's
      * credentials. It outlives the session.
      */
     environmentId?: string;
-    /** The Environment's recipe version when the session opened (shown, never enforced). */
+    /** The Agent's recipe version when the session last pinned (shown, never enforced). */
     environmentVersion?: number;
     /**
-     * The harness that runs the session's turns (R4.1), pinned when it opened: its Environment's
-     * harness, else `nylorun`. Absent on a session opened before R4: ours (`harnessOf`).
+     * The harness that runs the session's turns (R4.1), pinned when it opened: its manifest's
+     * `harness.id`, else `nylorun`. Absent on a session opened before R4: ours (`harnessOf`).
      */
     harness?: string;
     /**
      * A flow agent's linked session: the session whose turn opened the flow tree. Its sessions
      * share the tree's Environment, and their turns nest in the root's, so they do not hold the
-     * Environment against each other (`checkEnvironmentTurn`).
+     * Environment against each other (`checkAgentTurn`).
      */
     flowRootId?: string;
     /**
@@ -115,8 +130,10 @@ export interface Session {
     sandbox?: SandboxManifest;
     /**
      * Why the session takes no new turn: `protocol_11` for a session opened before protocol 11
-     * (migration 0020), `protocol_13` for one opened before protocol 13 (migration 0024). Its
-     * history stays readable.
+     * (migration 0020), `protocol_13` for one opened before protocol 13 (migration 0024),
+     * `protocol_15` for an agent session that pinned a `runtime` block before protocol 15
+     * (migrations 0029, 0030), `protocol_16` for one opened from a definition before protocol 16
+     * (migration 0032). Its history stays readable.
      */
     closedReason?: string;
     /**
@@ -140,7 +157,7 @@ export type AuthScope = {
 }
 /**
  * A trusted issuer's token (Host feature `trusted-issuers`, F9-D12): one subject, with the
- * issuer's scopes, agents and Environment grants, until `expiresAt` (ms). Only its expiry ends it.
+ * issuer's scopes and Agent grants, until `expiresAt` (ms). Only its expiry ends it.
  */
  | {
     kind: "token";
@@ -149,9 +166,8 @@ export type AuthScope = {
     subject: string;
     /** The issuer's scopes the token holds, which may add `studio`. */
     scopes: ReadonlySet<IssuerScope>;
-    agents: ReadonlySet<string> | "*";
-    /** The Environments it reaches: exact ids or `p/*` prefixes. Absent or empty reaches none. */
-    environments?: readonly string[];
+    /** The Agents it reaches: `*`, else exact ids or `p/*` prefixes; empty reaches none. */
+    agents: readonly string[] | "*";
     expiresAt: number;
     /** The token's `jti`, or a hash of it. */
     tokenId: string;
@@ -185,11 +201,15 @@ export interface TenantContext {
      * else the harness that serves workspaces (`harness-api/workspace.ts`).
      */
     readonly sandbox: WorkspacePort;
-    readonly flowLimits: FlowLimits;
-    readonly modelProvider: ModelProvider;
-    /** True when the model comes from the Tenant vault selection, served by `modelGate`. */
-    readonly useVaultModel: boolean;
-    /** Serves vault-backed model calls (blueprint §15): in this process, or the gates service. */
+    /**
+     * True when the Runtime's model is not the vault's (scripted, the fixture model, an embedder's
+     * provider): `modelGate` serves it, and no vault model need be configured.
+     */
+    readonly scriptedModel: boolean;
+    /**
+     * Serves every model call (blueprint §15, protocol 15): the vault's model in this process or
+     * the gates service, or a scripted model (`providerModelGate`).
+     */
     readonly modelGate: ModelGate;
     /**
      * Serves remote MCP servers and HTTP tools (blueprint §12, F4.1): in this process, or the
@@ -208,11 +228,6 @@ export interface TenantContext {
      * they mean, and a blob counts once a committed row names its key.
      */
     readonly blobs: BlobStore;
-    /**
-     * How core reads a session's sandbox workspace at turn end, to export its outputs (F8.2): over
-     * this process's `sandbox` today; over the Harness API's `workspace.read` from F6.2.
-     */
-    readonly workspaces: WorkspaceReader;
     /**
      * How the trace route (R7.5) makes spans: the resource and the content the installation exports
      * (R7.2). Absent: `service.name` `nylorun`, no content.
@@ -267,7 +282,7 @@ export interface TenantContext {
     abortLocal(sessionId: string, turnId?: string): void;
     /**
      * Sandbox pods (F7.2): the sandboxes service and the Runtime image pods copy the engine from.
-     * Absent without a cluster (`nylorun local sandbox enable`): kind `pod` is `environment_unavailable`.
+     * Absent without a cluster (`nylorun local sandbox enable`): kind `pod` is `agent_unavailable`.
      */
     readonly pods?: TenantPods;
     /**
@@ -277,6 +292,12 @@ export interface TenantContext {
      * sent); `true` without sandbox pods, where there is nothing to send.
      */
     sandboxSignal(sandboxId: string, signal: SandboxSignal): Promise<boolean>;
+    /**
+     * Seam: arm a durable timer (`DurableExecution.timer`; track T4's triggers), outside any tx. The
+     * latest time for a key wins. `false` while the Tenant is closing (not armed): what it was for
+     * is in Postgres, and the sweep arms it again.
+     */
+    timer(key: string, at: Date): Promise<boolean>;
     /** This Tenant's execution invocations that need an operator, for Tenant status. */
     readonly stuckInvocations?: () => Promise<StuckInvocation[]>;
     /** Callbacks the Tenant sweep runs after its own steps (`sweep.ts`). */
@@ -286,12 +307,15 @@ export interface TenantContext {
 }
 /**
  * What a request acting for a person may reach: that person's sessions, and, for a token
- * caller, only sessions of the agents its issuer allows. Undefined means the whole Tenant.
+ * caller, only sessions on the Agents its grants reach (ids and `p/*` prefixes). Undefined means
+ * the whole Tenant.
  */
 export interface SessionAccess {
     readonly owner: string;
-    readonly agents?: ReadonlySet<string>;
+    readonly agents?: readonly string[];
 }
+/** Whether `access` reaches sessions on Agent `agentId`. */
+export declare function reachesAgent(access: SessionAccess | undefined, agentId: string): boolean;
 /** The session, or a 404. Reads without locking. */
 export declare function sessionOf(t: Tx, id: string, access?: SessionAccess): Promise<Session>;
 /** Locks the session for the rest of the transaction and returns it, or a 404. */

package/dist/tenant/context.js

@@ -1,5 +1,9 @@
-import { DEFAULT_HARNESS } from "@nylorun/core/contracts";
+import { DEFAULT_HARNESS, agentGranted } from "@nylorun/core/contracts";
 import { fail } from "./http.js";
+/** Whether `access` reaches sessions on Agent `agentId`. */
+export function reachesAgent(access, agentId) {
+    return access?.agents === undefined || agentGranted(access.agents, agentId);
+}
 /**
  * `access`, when set, limits the request to the owner's sessions of the allowed agents:
  * anything else is the same 404 as a missing session, so a subject cannot learn which session
@@ -9,7 +13,7 @@ function owned(session, access) {
     if (!session ||
         (access !== undefined &&
             (session.ownerUserId !== access.owner ||
-                (access.agents !== undefined && !access.agents.has(session.agentId)))))
+                !reachesAgent(access, session.agentId))))
         return fail(404, "Session not found");
     return session;
 }

package/dist/tenant/definition-files.d.ts

@@ -1,5 +1,5 @@
 import { type DefinitionFileView } from "@nylorun/core/contracts";
-import type { BlobStore } from "../blob/index.js";
+import { type BlobStore } from "../blob/index.js";
 import type { Tx } from "../store/types.js";
 import type { TenantContext } from "./context.js";
 /** Where a definition file's bytes are in the Object store. */
@@ -8,7 +8,10 @@ export declare function definitionFileKey(sha256: string): string;
 export declare function hasDefinitionFile(ctx: TenantContext, file: string): Promise<boolean>;
 /**
  * Stores the bytes of definition file `file`: `201` when they are new, `200` when the Tenant
- * holds them already (the body is not read). Bytes that do not hash to `file` are a `400`.
+ * holds them already (the body is not read). Bytes that do not hash to `file` are a `400`; more
+ * than the Tenant's skill limit (`skills.config`) a `413`. The body streams to a staging key and is copied to
+ * the file's key only once its hash is checked, so no file is held in memory and bytes of
+ * another hash never replace a file at its key.
  */
 export declare function putDefinitionFile(ctx: TenantContext, file: string, request: {
     body: ReadableStream<Uint8Array> | null;
@@ -18,7 +21,25 @@ export declare function putDefinitionFile(ctx: TenantContext, file: string, requ
     status: 200 | 201;
     view: DefinitionFileView;
 }>;
-/** The definition files `document` names that the Tenant does not hold, in order. */
-export declare function missingDefinitionFiles(t: Tx, document: unknown): Promise<string[]>;
+/**
+ * Why `document` cannot be stored for the files it names: the files the Tenant does not hold
+ * (`missing`), else each skill whose files hold more than `limitBytes` together (`oversized`).
+ * A file a skill names at two paths counts twice: a sandbox holds both.
+ */
+export declare function definitionFileIssues(t: Tx, document: unknown, limitBytes: number): Promise<{
+    missing: string[];
+    oversized: {
+        name: string;
+        bytes: number;
+    }[];
+}>;
+/** A definition file's bytes as a stream, or undefined when the Object store does not have them. */
+export declare function openDefinitionFile(blobs: BlobStore, sha256: string, options?: {
+    range?: {
+        start: number;
+        end?: number;
+    };
+    signal?: AbortSignal;
+}): Promise<ReadableStream<Uint8Array> | undefined>;
 /** A definition file's bytes, or undefined when the Object store does not have them. */
 export declare function readDefinitionFile(blobs: BlobStore, sha256: string, signal?: AbortSignal): Promise<Uint8Array | undefined>;

package/dist/tenant/definition-files.js

@@ -3,15 +3,22 @@
  * today a skill's folder (`SkillManifest.files`). A client uploads each one once
  * (`PUT /v1/files/sha256:<hex>`); its bytes go to the Object store at
  * `definitions/sha256/<hex>`, and a `definition_files` row says the Tenant holds it. A
- * definition naming a file the Tenant does not hold is refused (`definition_files_missing`).
- * The Runtime reads them to serve the skill tools and to give a sandbox the skills' files.
+ * definition naming a file the Tenant does not hold is refused (`definition_files_missing`), and
+ * one whose skill's files hold more than the Tenant's skill limit together (`limit_exceeded`,
+ * `skills.config`, default 2 GiB). One file may be as large as a whole skill.
+ * The Runtime serves them to a run's harness (`definition.file`: our engine's skill tools read
+ * them) and gives a sandbox the skills' files.
  *
  * Files are never deleted here: `definition_file_uses` records which definition version names
  * which file, for a later sweep.
  */
-import { createHash } from "node:crypto";
-import { DEFINITION_FILE_MAX_BYTES, definitionFilesOf, isDefinitionFileHash, } from "@nylorun/core/contracts";
+import { randomUUID } from "node:crypto";
+import { definitionFilesOf, isDefinitionFileHash, skillsOf, } from "@nylorun/core/contracts";
+import { BlobTooLargeError } from "../blob/index.js";
 import { fail } from "./http.js";
+import { readSkillLimits } from "./limits.js";
+/** Where an upload's bytes wait while their hash is checked; never read as a definition file. */
+const STAGING_PREFIX = "definitions/uploads/";
 /** Where a definition file's bytes are in the Object store. */
 export function definitionFileKey(sha256) {
     return `definitions/sha256/${sha256.slice("sha256:".length)}`;
@@ -26,73 +33,104 @@ export async function hasDefinitionFile(ctx, file) {
     const sha256 = checkHash(file);
     return (await ctx.store.tx((t) => t.definitionFile(sha256))) !== undefined;
 }
-/** The body, at most `DEFINITION_FILE_MAX_BYTES`; past it, `413 limit_exceeded`. */
-async function readBody(body, declared) {
-    const tooLarge = () => fail(413, `A definition file may hold at most ${DEFINITION_FILE_MAX_BYTES} bytes`, {
+function tooLarge(limitBytes) {
+    return fail(413, `A definition file may hold at most ${limitBytes} bytes, the Tenant's limit for a whole skill`, {
         code: "limit_exceeded",
-        details: { limitBytes: DEFINITION_FILE_MAX_BYTES },
+        details: { limitBytes },
     });
-    if (declared !== undefined && declared > DEFINITION_FILE_MAX_BYTES) {
-        await body?.cancel().catch(() => undefined);
-        tooLarge();
-    }
-    if (body === null)
-        return new Uint8Array();
-    const chunks = [];
-    let size = 0;
-    const reader = body.getReader();
-    for (;;) {
-        const { done, value } = await reader.read();
-        if (done)
-            break;
-        size += value.byteLength;
-        if (size > DEFINITION_FILE_MAX_BYTES) {
-            await reader.cancel().catch(() => undefined);
-            tooLarge();
-        }
-        chunks.push(value);
-    }
-    return Buffer.concat(chunks);
 }
 /**
  * Stores the bytes of definition file `file`: `201` when they are new, `200` when the Tenant
- * holds them already (the body is not read). Bytes that do not hash to `file` are a `400`.
+ * holds them already (the body is not read). Bytes that do not hash to `file` are a `400`; more
+ * than the Tenant's skill limit (`skills.config`) a `413`. The body streams to a staging key and is copied to
+ * the file's key only once its hash is checked, so no file is held in memory and bytes of
+ * another hash never replace a file at its key.
  */
 export async function putDefinitionFile(ctx, file, request, signal) {
     const sha256 = checkHash(file);
-    const held = await ctx.store.tx((t) => t.definitionFile(sha256));
+    const { held, maxBytes } = await ctx.store.tx(async (t) => ({
+        held: await t.definitionFile(sha256),
+        maxBytes: (await readSkillLimits(t)).totalBytes,
+    }));
     if (held) {
         await request.body?.cancel().catch(() => undefined);
         return { status: 200, view: { sha256, size: held.size } };
     }
-    const bytes = await readBody(request.body, request.declaredBytes);
-    const actual = `sha256:${createHash("sha256").update(bytes).digest("hex")}`;
-    if (actual !== sha256)
-        fail(400, `The body's SHA-256 is ${actual}, not ${sha256}: upload a file at its own hash`, {
-            code: "invalid_request",
-            details: { expected: sha256, actual },
-        });
-    // The key is the content's hash: a concurrent upload of the same file writes the same bytes.
-    await ctx.blobs.put(definitionFileKey(sha256), bytes, {
+    if (request.declaredBytes !== undefined && request.declaredBytes > maxBytes) {
+        await request.body?.cancel().catch(() => undefined);
+        tooLarge(maxBytes);
+    }
+    const options = {
         ...(request.contentType === undefined ? {} : { contentType: request.contentType }),
         ...(signal ? { signal } : {}),
-    });
+    };
+    const staging = `${STAGING_PREFIX}${randomUUID()}`;
+    let size;
+    try {
+        let staged;
+        try {
+            staged = await ctx.blobs.put(staging, request.body ?? new Uint8Array(), {
+                ...options,
+                maxBytes,
+            });
+        }
+        catch (error) {
+            if (error instanceof BlobTooLargeError)
+                tooLarge(maxBytes);
+            throw error;
+        }
+        const actual = `sha256:${staged.sha256}`;
+        if (actual !== sha256)
+            fail(400, `The body's SHA-256 is ${actual}, not ${sha256}: upload a file at its own hash`, {
+                code: "invalid_request",
+                details: { expected: sha256, actual },
+            });
+        const got = await ctx.blobs.get(staging, signal ? { signal } : {});
+        if (!got)
+            throw new Error(`The Object store lost the upload of ${sha256} at ${staging}`);
+        // The key is the content's hash: a concurrent upload of the same file writes the same bytes.
+        await ctx.blobs.put(definitionFileKey(sha256), got.body, options);
+        size = staged.size;
+    }
+    finally {
+        await ctx.blobs.delete(staging).catch(() => undefined);
+    }
     const inserted = await ctx.store.tx((t) => t.insertDefinitionFile({
         sha256,
         kind: "skill",
-        size: bytes.byteLength,
+        size,
         contentType: request.contentType ?? null,
         createdAt: new Date().toISOString(),
     }));
-    return { status: inserted ? 201 : 200, view: { sha256, size: bytes.byteLength } };
+    return { status: inserted ? 201 : 200, view: { sha256, size } };
 }
-/** The definition files `document` names that the Tenant does not hold, in order. */
-export async function missingDefinitionFiles(t, document) {
+/**
+ * Why `document` cannot be stored for the files it names: the files the Tenant does not hold
+ * (`missing`), else each skill whose files hold more than `limitBytes` together (`oversized`).
+ * A file a skill names at two paths counts twice: a sandbox holds both.
+ */
+export async function definitionFileIssues(t, document, limitBytes) {
     const named = [...definitionFilesOf(document)].sort();
     if (named.length === 0)
-        return [];
+        return { missing: [], oversized: [] };
     const held = await t.heldDefinitionFiles(named);
-    return named.filter((sha256) => !held.has(sha256));
+    const missing = named.filter((sha256) => !held.has(sha256));
+    if (missing.length > 0)
+        return { missing, oversized: [] };
+    const oversized = [];
+    for (const skill of skillsOf(document)) {
+        let bytes = 0;
+        for (const hash of Object.values(skill.files ?? {}))
+            if (typeof hash === "string")
+                bytes += held.get(hash) ?? 0;
+        if (bytes > limitBytes)
+            oversized.push({ name: String(skill.name), bytes });
+    }
+    return { missing, oversized };
+}
+/** A definition file's bytes as a stream, or undefined when the Object store does not have them. */
+export async function openDefinitionFile(blobs, sha256, options = {}) {
+    return (await blobs.get(definitionFileKey(sha256), options))?.body;
 }
 /** A definition file's bytes, or undefined when the Object store does not have them. */
 export async function readDefinitionFile(blobs, sha256, signal) {

package/dist/tenant/effects.js

@@ -1,11 +1,10 @@
 import { embeddedAgent, flowDelegateManifest, hashManifest, } from "@nylorun/core/define";
 import { countActiveFlowWork, deriveAgentEffectSessionId, isFlowToolEffect, isWorkflowManifest, linkedMessageInput, linkedMessageKey, linkedTurnEnd, settleAgentEffect, } from "../core/flow-host.js";
 import { mayDispatchMore } from "../core/limits.js";
+import { readRuntimeLimits } from "./runtime-limits.js";
 import { sessionCredentials } from "../vault/sources.js";
 import { isRemoteMcpCall } from "../harness/calls.js";
 import { isHttpToolCall } from "../gates/http-tool.js";
-import { sandboxSpecOf } from "../sandbox/share.js";
-import { withRuntimeTools, withSandbox } from "../sandbox/session-sandbox.js";
 import { loadSession, ownedSession, sessionOf, } from "./context.js";
 import { fail } from "./http.js";
 import { turnManifestOf } from "./session.js";
@@ -41,7 +40,7 @@ export function recoversToolCalls(ctx) {
 }
 /** True when `request` calls a tool of a declared MCP server (every one is remote) or an HTTP tool. */
 export function isGateToolEffect(s, request) {
-    return (isRemoteMcpCall({ rootManifest: s.manifest, mcpSnapshot: s.mcpSnapshot }, request) ||
+    return (isRemoteMcpCall({ rootManifest: s.manifest }, request) ||
         isHttpToolCall(s.manifest, request));
 }
 /**
@@ -50,7 +49,7 @@ export function isGateToolEffect(s, request) {
  * the running call or gets its outcome, instead of becoming `uncertain`.
  */
 export function recoversModelCalls(ctx) {
-    return ctx.useVaultModel && ctx.modelGate.recovers === true;
+    return ctx.modelGate.recovers === true;
 }
 /** Journal and dispatch a new flow effect (agent or tool node). */
 export async function resolveNewFlowEffect(ctx, request, signal, lease) {
@@ -87,7 +86,7 @@ export async function resolveNewFlowEffect(ctx, request, signal, lease) {
         const active = await countActiveFlowWork(t, request.sessionId, request.turnId);
         // When the run journaled the effect (R7.1); a queued effect keeps it once dispatched.
         const startedAt = existing?.startedAt ?? new Date().toISOString();
-        if (!mayDispatchMore(active, ctx.flowLimits)) {
+        if (!mayDispatchMore(active, await readRuntimeLimits(t))) {
             if (!existing || existing.status !== "queued")
                 await t.put("effects", request.effectId, {
                     request,
@@ -162,25 +161,22 @@ export async function resolveNewFlowEffect(ctx, request, signal, lease) {
         if (exists)
             return;
         const definition = leafDefinition(workflow, body, request);
-        // The tree's Environment reaches every agent in it: its sandbox, with its tools, and its vault.
-        const inherited = inheritedSandbox(workflow, definition);
-        // Without one, the agent still gets its runtime block: read_artifact (R2b C11) and its skill tools.
-        const pinned = inherited?.manifest ? inherited : runtimeTools(definition.manifest);
+        // The flow's Agent (Q6) reaches every agent in the tree: its sandbox and its vault. Each leaf
+        // session runs on it, with the flow's manifest version, and its leaf agent's loop manifest.
+        const sandbox = workflow.sandbox;
         const created = {
             id: agentSessionId,
-            agentId: body.agentId,
+            agentId: workflow.agentId,
             ownerUserId: workflow.ownerUserId,
-            manifest: pinned?.manifest ?? definition.manifest,
-            manifestHash: pinned?.manifestHash ?? definition.manifestHash,
-            definitionHash: definition.manifestHash,
-            implementationVersion: definition.implementationVersion,
+            manifest: definition.manifest,
+            manifestHash: definition.manifestHash,
+            ...(workflow.definition === undefined ? {} : { definition: workflow.definition }),
             status: "idle",
             activeTurnId: null,
             creation: {
                 requestId: `flow-put-${request.effectId}`,
-                agentId: body.agentId,
+                agent: workflow.agentId,
                 ownerUserId: workflow.ownerUserId,
-                ...(workflow.environmentId === undefined ? {} : { environment: workflow.environmentId }),
             },
             flowRootId: workflow.flowRootId ?? workflow.id,
             ...(workflow.environmentId === undefined
@@ -191,7 +187,7 @@ export async function resolveNewFlowEffect(ctx, request, signal, lease) {
                         ? {}
                         : { environmentVersion: workflow.environmentVersion }),
                 }),
-            ...(inherited ? { sandbox: inherited.spec } : {}),
+            ...(sandbox === undefined ? {} : { sandbox }),
         };
         await t.put("sessions", agentSessionId, created);
     });
@@ -247,30 +243,6 @@ export async function resolveNewFlowEffect(ctx, request, signal, lease) {
         return { status: "pending" };
     });
 }
-/**
- * The sandbox a linked session inherits from its tree's owner when that sandbox was chosen at
- * open (pinned on the owner). A definition that declares its own sandbox keeps it, as before.
- */
-function inheritedSandbox(owner, definition) {
-    const spec = owner?.sandbox;
-    if (!spec || sandboxSpecOf(definition.manifest))
-        return undefined;
-    if (isWorkflowManifest(definition.manifest))
-        return { spec };
-    const sandboxed = withSandbox(definition.manifest, spec);
-    if (!sandboxed.ok)
-        throw new Error(sandboxed.message);
-    return { spec, manifest: sandboxed.manifest, manifestHash: sandboxed.manifestHash };
-}
-/** A linked agent session's `runtime` block without a sandbox (R2b C11); undefined for a workflow. */
-function runtimeTools(manifest) {
-    if (isWorkflowManifest(manifest))
-        return undefined;
-    const pinned = withRuntimeTools(manifest);
-    if (!pinned.ok)
-        throw new Error(pinned.message);
-    return { manifest: pinned.manifest, manifestHash: pinned.manifestHash };
-}
 /**
  * The credential of an MCP server or HTTP tool request made on behalf of a session: from its
  * Environment's vault (`vault/sources.ts`).
@@ -289,11 +261,7 @@ function leafDefinition(workflow, body, request) {
         const flow = flowDelegateManifest(turnManifestOf(workflow), body.agentId);
         if (!flow)
             return fail(404, `Agent '${body.agentId}' is not a flow agent used as a tool`);
-        return {
-            manifest: flow,
-            manifestHash: hashManifest(flow),
-            implementationVersion: workflow.implementationVersion,
-        };
+        return { manifest: flow, manifestHash: hashManifest(flow) };
     }
     const leaf = isWorkflowManifest(workflow.manifest)
         ? embeddedAgent(workflow.manifest, body.flow ?? [], body.agentId)
@@ -301,9 +269,5 @@ function leafDefinition(workflow, body, request) {
     if (!leaf || isWorkflowManifest(leaf))
         return fail(404, `Agent '${body.agentId}' is not embedded in workflow '${workflow.manifest.id}'`);
     const manifest = leaf;
-    return {
-        manifest,
-        manifestHash: hashManifest(manifest),
-        implementationVersion: workflow.implementationVersion,
-    };
+    return { manifest, manifestHash: hashManifest(manifest) };
 }

package/dist/tenant/ephemeral.js

@@ -25,6 +25,7 @@ import { hostPaths, tenantPaths } from "./paths.js";
 import { hostPrincipals } from "./principals.js";
 import { openTenantRuntime } from "./runtime.js";
 import { createTrustedIssuers } from "./issuers.js";
+import { hostTuning } from "../tuning.js";
 const nodeRequire = createRequire(import.meta.url);
 function coreVersion() {
     try {
@@ -127,7 +128,7 @@ export async function startEphemeralRuntime(options) {
         await host?.close();
         await module.close();
         await streams.close();
-        await ownPool?.end({ timeout: 5 });
+        await ownPool?.end({ timeout: hostTuning().postgres.closeTimeoutSeconds });
         if (!options.retainRoot)
             rmSync(hostRoot, { recursive: true, force: true });
     };

package/dist/tenant/history.d.ts

@@ -16,7 +16,7 @@
  *   transcript on the row too and checks the fold against it at every segment start.
  */
 import type { LiveEvent } from "@nylorun/core/contracts";
-export { CHUNK_BYTES, TranscriptFoldError, applyUpdate, applyUpdates, transcriptOf, transcriptUpdates, withTranscript, type TranscriptUpdate, } from "@nylorun/core/harness-api";
+export { TranscriptFoldError, applyUpdate, applyUpdates, transcriptOf, transcriptUpdates, withTranscript, type TranscriptUpdate, } from "@nylorun/core/harness-api";
 /** Where a session's fold starts. */
 export interface SessionHistory {
     /** The fold reads the record from this seq: a snapshot at or before the turn's start. */

package/dist/tenant/history.js

@@ -1,5 +1,5 @@
 import { applyUpdate, transcriptOf } from "@nylorun/core/harness-api";
-export { CHUNK_BYTES, TranscriptFoldError, applyUpdate, applyUpdates, transcriptOf, transcriptUpdates, withTranscript, } from "@nylorun/core/harness-api";
+export { TranscriptFoldError, applyUpdate, applyUpdates, transcriptOf, transcriptUpdates, withTranscript, } from "@nylorun/core/harness-api";
 let shadow = false;
 /** Shadow mode: keep the transcript on the session row and check the fold against it. */
 export function transcriptShadow() {

package/dist/tenant/host-token.d.ts

@@ -5,8 +5,8 @@ export declare const HOST_TOKEN_TYP = "nylorun-host+jwt";
 export declare const HOST_TOKEN_AUD = "nylorun-harness-api";
 export declare const EGRESS_TOKEN_TYP = "nylorun-egress+jwt";
 export declare const EGRESS_TOKEN_AUD = "nylorun-egress";
-/** How long a host or egress token lives. The engine renews them before. */
-export declare const HOST_TOKEN_TTL_SECONDS: number;
+/** How long a host or egress token lives (`keys.hostTokenTtlSeconds`). The engine renews them before. */
+export declare const hostTokenTtlSeconds: () => number;
 /** What a verified host or egress token says. */
 export interface HostClaims {
     readonly tenantId: string;
@@ -37,7 +37,7 @@ export interface EgressTokenRequest {
     /** The host epoch the join set. */
     readonly epoch: number;
     readonly podUid: string;
-    /** Seconds. Default and maximum `HOST_TOKEN_TTL_SECONDS`. */
+    /** Seconds. Default and maximum `keys.hostTokenTtlSeconds`. */
     readonly ttl?: number;
 }
 /**