@nylorun/runtime 0.27.0-beta → 0.29.0-beta

package/dist/core/flow-host.d.ts

@@ -56,7 +56,6 @@ export type FlowHostSession = {
     ownerUserId: string;
     manifest: any;
     manifestHash: string;
-    implementationVersion: string;
     status: string;
     activeTurnId: string | null;
     info?: any;

package/dist/gates/egress-credentials.js

@@ -12,7 +12,7 @@
  * Nothing here knows a tool: the header name and its format are the credential's. A release the
  * vault refuses (two secrets for one host, an unreadable value) answers 502 and is logged, never
  * as an event; a value never is. Upgrades (WebSocket) and HTTP/2 are not served on this path.
- * Each connection keeps a tally for its `environment.egress` event (R7.3, D67): how many requests it
+ * Each connection keeps a tally for its `agent.egress` event (R7.3, D67): how many requests it
  * read and which credentials it set, by id.
  */
 import { createServer } from "node:http";

package/dist/gates/egress.d.ts

@@ -1,6 +1,6 @@
 import { type Server } from "node:http";
 import { type Socket } from "node:net";
-import type { EgressRunningTurn, EnvironmentEventPayload } from "@nylorun/core/contracts";
+import type { EgressRunningTurn, AgentEventPayload } from "@nylorun/core/contracts";
 import type { EgressTokenVerdict } from "../sandbox/egress-token.js";
 import type { SessionStore } from "../store/types.js";
 import type { Logger } from "../tenant/types.js";
@@ -16,10 +16,10 @@ export interface EgressSandboxes {
         readonly allow: readonly string[];
     } | undefined>;
 }
-/** One connection's record (R7.3, D67): `environment.egress`'s payload. */
-export type EgressConnection = EnvironmentEventPayload<"environment.egress">;
+/** One connection's record (R7.3, D67): `agent.egress`'s payload. */
+export type EgressConnection = AgentEventPayload<"agent.egress">;
 /**
- * How many running turns one connection names, at most: fixed by the `environment.egress` event
+ * How many running turns one connection names, at most: fixed by the `agent.egress` event
  * contract (`runningTurns` holds at most 16 in `/core/contracts`), which every reader
  * validates against, so not a setting here.
  */
@@ -90,7 +90,7 @@ export declare function storeEgressSandboxes(store: SessionStore): EgressSandbox
 /**
  * `EgressRecord` over the Tenant's record (R7.3, D67). The running turns are the sessions on the
  * Environment whose body has an `activeTurnId`, in id order, at most `EGRESS_RUNNING_TURNS_MAX`.
- * The write is `environment.egress` on the Environment's stream, under its row's lock; a deleted
+ * The write is `agent.egress` on the Environment's stream, under its row's lock; a deleted
  * Environment gets nothing.
  */
 export declare function storeEgressRecord(store: SessionStore): EgressRecord;

package/dist/gates/egress.js

@@ -25,7 +25,7 @@
  * never is. Tunnels close after `idleMs` without traffic in either direction.
  *
  * Every connection to a named host on a live token is recorded once (R7.3, D67), when it closes
- * or at once when the gate refuses it, as `environment.egress` on the Environment's own stream:
+ * or at once when the gate refuses it, as `agent.egress` on the Environment's own stream:
  * the connection is the Environment's, since its token names the pod and turns run in parallel
  * (D66). `runningTurns` lists the turns active on the Environment as it opened, as context and
  * never as an owner: one read, started as the name resolves and never waited for, so a turn that
@@ -44,7 +44,7 @@ import { bindListener } from "../host/http.js";
 import { hostTuning } from "../tuning.js";
 import { CONNECT_ESTABLISHED, credentialTerminator, } from "./egress-credentials.js";
 /**
- * How many running turns one connection names, at most: fixed by the `environment.egress` event
+ * How many running turns one connection names, at most: fixed by the `agent.egress` event
  * contract (`runningTurns` holds at most 16 in `/core/contracts`), which every reader
  * validates against, so not a setting here.
  */
@@ -156,7 +156,7 @@ function connectionRecord(sink, logger, client, at) {
         const allowed = fields.outcome === "allowed";
         const durationMs = Math.max(0, Date.now() - at.startedAt.getTime());
         const connection = (turns) => ({
-            environmentId: at.environmentId,
+            agentId: at.environmentId,
             host: at.host,
             port: at.port,
             ...fields,
@@ -414,7 +414,7 @@ export function storeEgressSandboxes(store) {
 /**
  * `EgressRecord` over the Tenant's record (R7.3, D67). The running turns are the sessions on the
  * Environment whose body has an `activeTurnId`, in id order, at most `EGRESS_RUNNING_TURNS_MAX`.
- * The write is `environment.egress` on the Environment's stream, under its row's lock; a deleted
+ * The write is `agent.egress` on the Environment's stream, under its row's lock; a deleted
  * Environment gets nothing.
  */
 export function storeEgressRecord(store) {
@@ -429,9 +429,9 @@ export function storeEgressRecord(store) {
         },
         async write(connection) {
             await store.tx(async (t) => {
-                if (!(await t.environment(connection.environmentId, { lock: true })))
+                if (!(await t.environment(connection.agentId, { lock: true })))
                     return;
-                await t.environmentEvent(connection.environmentId, "environment.egress", connection);
+                await t.agentEvent(connection.agentId, "agent.egress", connection);
             });
         },
     };

package/dist/gates/http-tool.js

@@ -198,7 +198,7 @@ export async function runHttpTool(tenant, call, options) {
             if (authorized.status === "refused")
                 return failed("http.credential", `The credential '${http.credential}' was refused: ${authorized.reason}`);
             if (authorized.status === "unauthenticated")
-                return failed("http.credential", `The session's Environment holds no credential '${http.credential}' for ${authorized.url}`);
+                return failed("http.credential", `The session's Agent holds no credential '${http.credential}' for ${authorized.url}`);
             credential = authorized.headers;
             identity = authorized.identity;
             // A credential with `via` sends the call there, a gateway (R2b C2, Q9): to its one URL, so
@@ -229,7 +229,7 @@ export async function runHttpTool(tenant, call, options) {
             return outcome;
         return {
             ...outcome,
-            message: `The service answered HTTP 401: it rejected the credential '${http.credential}' from the session's Environment`,
+            message: `The service answered HTTP 401: it rejected the credential '${http.credential}' from the session's Agent`,
             server: http.credential,
         };
     }

package/dist/gates/meter.js

@@ -37,7 +37,7 @@ export function createMeter(options) {
                             session: request.sessionId,
                             effect: request.effectId,
                             scope: budget.scope,
-                            ...(budget.scope === "agent" ? { agent: budget.scopeId } : {}),
+                            ...(budget.scope === "manifest" ? { manifest: budget.scopeId } : {}),
                         });
                         return { keys, refusal: failure("budget_exhausted", reached, false) };
                     }
@@ -124,7 +124,8 @@ export function usageRow(request, outcome, at, timing) {
             : null,
         sessionId: request.sessionId,
         turnId: request.turnId,
-        agentId: request.agentId,
+        // The calling agent's loop manifest id: a manifest version's name (protocol 16).
+        manifestName: request.agentId,
         provider: producer.provider ?? null,
         model: producer.model ?? outcome.evidence?.resolvedModel ?? request.call.model?.id ?? null,
         inputTokens,
@@ -141,6 +142,22 @@ export function usageRow(request, outcome, at, timing) {
         ...(typeof firstTokenMs === "number" && Number.isFinite(firstTokenMs) && firstTokenMs >= 0
             ? { firstTokenMs: Math.round(firstTokenMs) }
             : {}),
+        ...costSplitColumns(outcome.evidence?.extras?.costSplit),
+    };
+}
+/** The ledger's cost-by-kind columns from the adapter's `costSplit`; none unless all four are costs. */
+function costSplitColumns(split) {
+    if (!split || typeof split !== "object" || Array.isArray(split))
+        return {};
+    const { input, cacheRead, cacheWrite, output } = split;
+    const parts = [input, cacheRead, cacheWrite, output];
+    if (!parts.every((part) => typeof part === "number" && Number.isFinite(part) && part >= 0))
+        return {};
+    return {
+        costInputUsd: input,
+        costCacheReadUsd: cacheRead,
+        costCacheWriteUsd: cacheWrite,
+        costOutputUsd: output,
     };
 }
 /** The ledger rows a budget counts for `request`; undefined when it doesn't apply. */
@@ -148,8 +165,8 @@ function scopeOf(budget, request, at) {
     const since = budget.period ? { since: periodStart(budget.period, at) } : {};
     if (budget.scope === "turn")
         return { scope: "turn", id: request.turnId };
-    if (budget.scope === "agent")
-        return budget.scopeId === request.agentId ? { scope: "agent", id: request.agentId, ...since } : undefined;
+    if (budget.scope === "manifest")
+        return budget.scopeId === request.agentId ? { scope: "manifest", id: request.agentId, ...since } : undefined;
     return { scope: "tenant", ...since };
 }
 /**
@@ -160,7 +177,7 @@ export function capReached(budget, spent, inflight) {
     const projected = (total) => total + (spent.calls > 0 ? (inflight * total) / spent.calls : 0);
     const name = budget.scope === "turn"
         ? "The turn's cap"
-        : `${budget.scope === "agent" ? `Agent ${budget.scopeId}'s` : "The Tenant's"} ${budget.period === "day" ? "daily" : "monthly"} cap`;
+        : `${budget.scope === "manifest" ? `Agent manifest ${budget.scopeId}'s` : "The Tenant's"} ${budget.period === "day" ? "daily" : "monthly"} cap`;
     const raise = "raise it with PUT /v1/tenant/budgets";
     if (budget.limitTokens !== null && projected(spent.tokens) >= budget.limitTokens)
         return `${name} of ${budget.limitTokens} tokens is reached (${spent.tokens} used); ${raise}`;

package/dist/gates/policy.d.ts

@@ -35,7 +35,7 @@ export interface PolicyCall {
     readonly tool: string;
     /** The MCP server's name. */
     readonly server?: string;
-    /** The agent that calls it. */
+    /** The agent that calls it: its manifest's id (an agent manifest's name), never an Agent's id. */
     readonly agent: string;
     readonly input: unknown;
     /** The name the model called it by, for display only: no rule matches it. */
@@ -61,8 +61,13 @@ export declare function readToolPolicy(t: Pick<Tx, "getSetting">): Promise<ToolP
  * pinned manifest's `approval`. A policy that cannot be read refuses the call.
  */
 export declare function toolCallDecision(t: Pick<Tx, "getSetting">, s: Session, request: HostEffect, kind: "mcp" | "http"): Promise<PolicyDecision>;
-/** `request` as the policy reads it: by its target's identity (protocol 15). */
-export declare function policyCallOf(s: Pick<Session, "agentId">, request: HostEffect, kind: "mcp" | "http"): PolicyCall;
+/**
+ * `request` as the policy reads it: by its target's identity (protocol 15), and by the agent that
+ * calls it: an agent used as a tool by its id, the session's root agent by its loop manifest's id
+ * (protocol 16: the agent manifest's name). Never the session's Agent id (`s.agentId`), which
+ * protocol 16 made the Agent the session runs on (`users/ada/desk` for the manifest `desk`).
+ */
+export declare function policyCallOf(s: Pick<Session, "manifest">, request: HostEffect, kind: "mcp" | "http"): PolicyCall;
 /** Decides `call` by `rules`; `pinnedAsk` adds the ask of a manifest saved before R5 step 2. */
 export declare function decide(rules: readonly ToolRule[], call: PolicyCall, pinnedAsk?: boolean): PolicyDecision;
 /**

package/dist/gates/policy.js

@@ -68,7 +68,12 @@ export async function toolCallDecision(t, s, request, kind) {
     }
     return decide(rules, policyCallOf(s, request, kind), pinnedApproval(turnManifestOf(s), request));
 }
-/** `request` as the policy reads it: by its target's identity (protocol 15). */
+/**
+ * `request` as the policy reads it: by its target's identity (protocol 15), and by the agent that
+ * calls it: an agent used as a tool by its id, the session's root agent by its loop manifest's id
+ * (protocol 16: the agent manifest's name). Never the session's Agent id (`s.agentId`), which
+ * protocol 16 made the Agent the session runs on (`users/ada/desk` for the manifest `desk`).
+ */
 export function policyCallOf(s, request, kind) {
     const target = request.target;
     return {
@@ -77,7 +82,7 @@ export function policyCallOf(s, request, kind) {
             ? target.tool
             : (request.key ?? request.effectId),
         ...(target?.kind === "mcp" ? { server: target.server } : {}),
-        agent: request.agent?.id ?? s.agentId,
+        agent: request.agent?.id ?? s.manifest.id,
         input: request.input,
         ...(request.toolName === undefined ? {} : { name: request.toolName }),
     };

package/dist/gates/tenant-vaults.d.ts

@@ -29,7 +29,7 @@ export interface TenantVault {
     session(sessionId: string): Promise<Session | undefined>;
     /**
      * The authorization of one request to a session's remote MCP server or HTTP tool: its
-     * credential from the vault of the session's Environment.
+     * credential from the vault of the session's Agent.
      */
     authorizeMcp(sessionId: string, request: McpCredentialRequest): Promise<AuthorizeResult>;
     /** Vault writes and token signing with the Tenant's vault key (the keys service, F4.2). */

package/dist/harness/pod.d.ts

@@ -2,6 +2,8 @@ import type { PodHostConfig } from "../host/stack-config.js";
 /** What to run and copy on a new disk (`sandbox/setup.ts` in core), from the join answer. */
 export interface DiskSetup {
     readonly recipeVersion: number;
+    /** The sha256 of the commands and files (track T3): a marker with another runs the setup again. */
+    readonly setupHash?: string;
     readonly commands: readonly {
         readonly command: string;
         readonly cwd: string;

package/dist/harness/setup.js

@@ -1,9 +1,10 @@
 /**
  * The disk's setup in a pod Environment's engine (R2d step 2): after it joins and before it takes
  * any turn, the engine copies the recipe's input files and runs its setup commands, once per
- * volume. A marker on the volume (`/harness/setup.json`, `{ volumeId, recipeVersion, status }`)
- * says it was done: a resume finds it and skips, a reset (a new volume, a new volume id) runs it
- * again. Commands run as the sandbox tools' do (`localExec`): `/bin/sh -c` in `cwd`, with the
+ * volume. A marker on the volume (`/harness/setup.json`, `{ volumeId, recipeVersion, setupHash,
+ * status }`) says it was done: a resume finds it and skips, a reset (a new volume, a new volume
+ * id) runs it again, and so does a start on a new version whose setup differs (`setupHash`,
+ * track T3). A marker without a hash (written before T3) counts as this setup's. Commands run as the sandbox tools' do (`localExec`): `/bin/sh -c` in `cwd`, with the
  * Environment's variables and secrets (as the sentinel) and egress through egress-gate.
  *
  * A failure is reported to core, which fails the pod and the turn waiting for it; the engine then
@@ -17,6 +18,15 @@ import { mkdir, readFile, rename, writeFile } from "node:fs/promises";
 import { randomUUID } from "node:crypto";
 import { dirname, posix } from "node:path";
 import { hostTuning } from "../tuning.js";
+/** The marker of `setup` done on volume `volumeId`. */
+function markerOf(volumeId, setup) {
+    return {
+        volumeId,
+        recipeVersion: setup?.recipeVersion ?? 0,
+        ...(setup?.setupHash === undefined ? {} : { setupHash: setup.setupHash }),
+        status: "ok",
+    };
+}
 async function readText(path) {
     try {
         return (await readFile(path, "utf8")).trim();
@@ -111,7 +121,7 @@ export async function prepareDisk(options) {
     else if (options.host.seeded) {
         // A volume seeded from a disk version: the version holds what setup made, so mark it done.
         if (volumeId) {
-            const done = { volumeId, recipeVersion: setup?.recipeVersion ?? 0, status: "ok" };
+            const done = markerOf(volumeId, setup);
             await writeAtomic(options.markerFile, new TextEncoder().encode(`${JSON.stringify(done)}\n`));
         }
         options.logger.info("environment_setup_skipped", { reason: "seeded" });
@@ -123,7 +133,8 @@ export async function prepareDisk(options) {
     if (marker && volumeId) {
         try {
             const done = JSON.parse(marker);
-            if (done.volumeId === volumeId && done.status === "ok")
+            const same = done.setupHash === undefined || setup.setupHash === undefined || done.setupHash === setup.setupHash;
+            if (done.volumeId === volumeId && done.status === "ok" && same)
                 return;
         }
         catch {
@@ -137,7 +148,7 @@ export async function prepareDisk(options) {
         const report = await runOnce(options, setup);
         if (report.status === "ok") {
             if (volumeId) {
-                const done = { volumeId, recipeVersion: setup.recipeVersion, status: "ok" };
+                const done = markerOf(volumeId, setup);
                 await writeAtomic(options.markerFile, new TextEncoder().encode(`${JSON.stringify(done)}\n`));
             }
             await options.host.reportSetup(report).catch((error) => options.logger.warn("environment_setup_report_failed", {

package/dist/harness-api/record.js

@@ -38,6 +38,8 @@ import { abortKind } from "../tenant/worker.js";
 import { redactTokens } from "./redact.js";
 import { toolCallDecision } from "../gates/policy.js";
 import { traceKey } from "../traces/key.js";
+import { serveRuntimeTool } from "../tenant/triggers.js";
+import { serveMemoryTool } from "../memory/tool.js";
 import { effectSpanOf, traceparentOf, turnTraceIdOf } from "../traces/ids.js";
 import { firstSend, interrupted, settleToolRow, toolKindOf, } from "./tool-journal.js";
 const TURN_CANCELLED = () => new HarnessApiError("turn_cancelled", "Turn cancelled");
@@ -138,6 +140,14 @@ export async function recordIntent(scope, effect, requestHash) {
         const agentManifest = manifestFor(s.manifest, request.agent);
         if (!agentManifest)
             throw new Error(`Agent '${request.agent?.id ?? ""}' is not used as a tool`);
+        // An operation the Runtime serves itself (track T4): settled here, in the call's own
+        // transaction, keyed by its effect id, so a replay finds it completed.
+        if (request.kind === "tool" && request.target?.kind === "runtime") {
+            const row = { request, requestHash, status: "invoking", ...firstSend(toolKindOf(s, agentManifest, request)) };
+            const served = request.target.operation === "memory" ? await serveMemoryTool(t, s, request) : await serveRuntimeTool(t, s, request);
+            const outcome = await settleToolRow(t, s, row, served, { writer: coreIn(scope) });
+            return { status: "completed", outcome };
+        }
         const refused = request.kind === "tool" ? refusal(s, request) : undefined;
         if (refused) {
             // A call with no target (an author's code tool, refused at save, so a backstop), or one
@@ -188,6 +198,7 @@ export async function recordIntent(scope, effect, requestHash) {
  * - `http`: an HTTP tool its agent declares under that name (R2 M3), which crosses the Tool Gate;
  * - `sandbox`: one of the sandbox operations, in a session with a sandbox;
  * - `harness`: a tool the harness runs in its own process; its egress gate is its only control.
+ * - `runtime`: served by `recordIntent` itself, before this (`schedule_wake`, track T4).
  *
  * No target, and anything else, runs nothing (`tool.unavailable`).
  */

package/dist/harness-api/server.js

@@ -45,6 +45,7 @@ import { RecordEntryTooLargeError } from "../record/index.js";
 import { redactTokens } from "./redact.js";
 import { beat, renewEveryMs, tokenOf } from "./renew.js";
 import { hostTuning } from "../tuning.js";
+import { passStartCheck } from "../tenant/agent-versions.js";
 /** No attached harness serves workspaces (or, with `pod`, that pod sandbox's). */
 export class NoWorkspaceHarness extends Error {
     pod;
@@ -211,6 +212,9 @@ export function createHarnessApiServer(ctx, options = {}) {
             const expected = environment?.applied.harness ?? DEFAULT_HARNESS;
             if (expected !== name)
                 throw new HarnessApiError("invalid", `Environment ${connection.host.sandboxId} runs the ${expected} harness, and this pod says ${name}`);
+            // Its pod started on the version it switched to, setup done (track T3): the start check passed.
+            if (environment?.startCheck)
+                await passStartCheck(ctx, connection.host.sandboxId, connection.host.epoch);
         }
         return name;
     };

package/dist/harness-api/start.d.ts

@@ -1,4 +1,4 @@
-import type { ModelDescriptor, RecordedOutcome, RuntimeLimits, TurnEnvironment, TurnStart } from "@nylorun/core/harness-api";
+import type { ModelDescriptor, RecordedOutcome, RuntimeLimits, TurnAgent, TurnMemory, TurnStart } from "@nylorun/core/harness-api";
 import { type SandboxManifest } from "@nylorun/core/define";
 import type { SandboxPodState } from "../store/types.js";
 import { type Lease, type Session, type TenantContext } from "../tenant/context.js";
@@ -14,7 +14,7 @@ export interface SegmentStart {
     /** The record position of `transcript` (`foldTranscriptWithCursor`). */
     readonly cursor: number;
     readonly outcomes: RecordedOutcome[];
-    /** The session's sandbox workspace: the session, and the Environment whose workspace it is. */
+    /** The session's sandbox workspace: the session, and the Agent whose workspace it is. */
     readonly sandbox: {
         readonly ownerId: string;
         readonly environmentId?: string;
@@ -24,18 +24,20 @@ export interface SegmentStart {
         readonly spec?: SandboxManifest;
     };
     /**
-     * The Environment the session runs in, as `TurnStart.environment` states it (protocol 15): its
-     * id and kind, and its sandbox's workspace when the session has a sandbox.
+     * The Agent the session runs on, as `TurnStart.agent` states it (Harness API 5): its id and
+     * kind, and its sandbox's workspace when the session has a sandbox.
      */
-    readonly environment?: TurnEnvironment;
+    readonly agent?: TurnAgent;
     /**
-     * The Environment is a pod (F7.2): its engine runs the segment. Its lifecycle state, and
-     * whether its new volume is still being seeded from a disk version (R2d step 3).
+     * The Agent is a pod (F7.2): its engine runs the segment. Its lifecycle state, and whether its
+     * new volume is still being seeded from a disk version (R2d step 3).
      */
     readonly pod?: {
         readonly id: string;
         readonly pod: SandboxPodState;
         readonly seeding?: boolean;
+        /** It starts on a new version (track T3) and has not joined yet: a failed start goes back. */
+        readonly starting?: boolean;
     };
     /** The turn's span context (R7.4): what `TurnStart.trace` hands the harness. */
     readonly trace?: TraceContext;
@@ -44,6 +46,8 @@ export interface SegmentStart {
      * hands an agent's harness. Absent for a flow, and when the Tenant has no model.
      */
     readonly model?: ModelDescriptor;
+    /** The Agent's memory (track T5): its access, instructions and the index the harness pins. */
+    readonly memory?: TurnMemory;
 }
 /** The segment's starting transaction and fold. */
 export declare function startSegment(ctx: TenantContext, lease: Lease, 

package/dist/harness-api/start.js

@@ -11,6 +11,7 @@ import { isWorkflowManifest } from "../core/flow-host.js";
 import { sandboxWorkspaceOf } from "../sandbox/share.js";
 import { ownedTx } from "../store/ownership.js";
 import { harnessOf } from "../tenant/context.js";
+import { repinTurn } from "../tenant/agent-versions.js";
 import { HARNESS_ID } from "../sandbox/placement.js";
 import { checkParity, foldTranscriptWithCursor, leanState, transcriptOf, transcriptUpdates, withTranscript, } from "../tenant/history.js";
 import { usesFixtureModel } from "../tenant/model-setting.js";
@@ -20,6 +21,8 @@ import { flowLimitsOf } from "../core/limits.js";
 import { turnManifestOf } from "../tenant/session.js";
 import { mcpFactsOf } from "../mcp/snapshot.js";
 import { bulkOutcomes } from "./record.js";
+import { renderMemoryIndex } from "../memory/service.js";
+import { memorySettingsOf } from "../memory/tool.js";
 import { traceKey } from "../traces/key.js";
 import { hostTuning } from "../tuning.js";
 import { traceparentOf, turnSpanOf, turnTraceIdOf, } from "../traces/ids.js";
@@ -31,6 +34,9 @@ options = {}) {
     // Read before the transaction: the first read of the Tenant may create the key.
     const key = options.harness ? await traceKey(ctx.store) : undefined;
     const opened = await ownedTx(ctx.store, id, lease.epoch, async (t, current) => {
+        // A turn's first segment runs the version its Agent runs now (T3, D73).
+        if (options.harness && (await repinTurn(t, current)))
+            await t.put("sessions", id, current);
         // A transcript left on our engine's state by an older Runtime is recorded once; another
         // harness's state is its own (R4.2).
         const limits = await readRuntimeLimits(t);
@@ -52,16 +58,25 @@ options = {}) {
             ...(current.sandbox === undefined ? {} : { spec: current.sandbox }),
         };
         const turnId = current.activeTurnId;
+        const memory = isWorkflowManifest(current.manifest) ? undefined : await turnMemoryOf(t, current, limits);
         return {
             current,
             fixtureModel,
             limits,
+            ...(memory ? { memory } : {}),
             outcomes: current.checkpoint ? await bulkOutcomes(t, current, current.checkpoint) : [],
             sandbox,
-            ...(resource ? { environment: environmentOf(resource, current.sandbox) } : {}),
+            ...(resource ? { agent: agentOf(resource, current.sandbox, await selfWakeOf(t, current)) } : {}),
             ...(key && turnId ? { trace: turnContextOf(key, ctx.store.tenantId, current, turnId) } : {}),
             ...(resource?.pod
-                ? { pod: { id: resource.id, pod: resource.pod, ...(resource.diskSeed ? { seeding: true } : {}) } }
+                ? {
+                    pod: {
+                        id: resource.id,
+                        pod: resource.pod,
+                        ...(resource.diskSeed ? { seeding: true } : {}),
+                        ...(resource.startCheck ? { starting: true } : {}),
+                    },
+                }
                 : {}),
         };
     });
@@ -116,20 +131,49 @@ export function buildTurnStart(ctx, segment) {
         ...(segment.trace ? { trace: segment.trace } : {}),
         limits: harnessLimitsOf(segment.limits),
         ...(segment.model && !flow ? { model: segment.model } : {}),
-        ...(segment.environment && !flow ? { environment: segment.environment } : {}),
+        ...(segment.agent && !flow ? { agent: segment.agent } : {}),
+        // The agent manifest version the session pinned, and its harness's own settings (protocol 16).
+        ...(current.definition === undefined ? {} : { definition: current.definition }),
+        ...(current.loop === undefined || flow ? {} : { loop: current.loop }),
+        ...(segment.memory && !flow ? { memory: segment.memory } : {}),
     };
 }
 /**
- * The facts of the Environment a session runs in (protocol 15): its id and kind, and, with the
+ * The Agent's memory as the segment starts (track T5, D72), when the version the session runs sets
+ * `harness.memory`: its access (the same in every turn), the agent's instructions, and the index of
+ * its memories, newest first, within the Tenant's index limits.
+ */
+async function turnMemoryOf(t, s, limits) {
+    const settings = await memorySettingsOf(t, s);
+    if (!settings)
+        return undefined;
+    const { index, truncated } = await renderMemoryIndex(t, s.agentId, limits);
+    return {
+        access: settings.access ?? "read_write",
+        ...(settings.instructions === undefined ? {} : { instructions: settings.instructions }),
+        index,
+        truncated,
+    };
+}
+/**
+ * The facts of the Agent a session runs on (Harness API 5): its id and kind, and, with the
  * session's sandbox, the workspace its commands start in. The harness words them.
  */
-function environmentOf(resource, spec) {
+function agentOf(resource, spec, selfWake) {
     return {
         id: resource.id,
         kind: resource.kind,
         ...(spec === undefined ? {} : { sandbox: { workspace: SANDBOX_WORKSPACE } }),
+        ...(selfWake ? { selfWake: true } : {}),
     };
 }
+/** Whether the manifest version the session runs sets `runtime.selfWake` (track T4, D77). */
+async function selfWakeOf(t, s) {
+    if (!s.definition)
+        return false;
+    const version = await t.agentManifest(s.definition.name, s.definition.version);
+    return version?.body.runtime?.selfWake === true;
+}
 /**
  * The context of turn `turnId`'s span (R7.4): its trace (the caller's when its message carried a
  * `traceparent`) and its span, as the trace projector derives them, with the caller's

package/dist/harness-api/workspace.js

@@ -15,7 +15,7 @@
  * - **Pod sandboxes** (F7.2, `withPodWorkspaces`): a session attached to a pod sandbox has its
  *   workspace in the pod, served by the sandbox's engine (its host connection). Its tool calls
  *   and disk operations go there whatever serves the other workspaces; with the pod stopped or
- *   starting they are `409 environment_unavailable`.
+ *   starting they are `409 agent_unavailable`.
  */
 import { HarnessApiError } from "@nylorun/core/harness-api";
 import { fromWireAnswer, toWireOp } from "../sandbox/disk-fs.js";
@@ -57,7 +57,7 @@ export function remoteWorkspace(options) {
         : { pod: options.pod, ...(options.minEpoch === undefined ? {} : { minEpoch: options.minEpoch }) };
     const unavailable = (error) => error.pod === undefined
         ? fail(503, error.message, { code: "request_rejected" })
-        : fail(409, error.message, { code: "environment_unavailable" });
+        : fail(409, error.message, { code: "agent_unavailable" });
     /** The harness's answer, or `undefined` when none serves workspaces. */
     const ask = async (method, params, signal) => {
         try {

package/dist/host/config-for.d.ts

@@ -14,4 +14,6 @@ export declare function configForFactory(options: {
     delivery?: TenantConfig["delivery"];
     /** The trusted issuers of the identity file (`NYLORUN_IDENTITY_FILE`). */
     issuers?: TenantConfig["issuers"];
+    /** The URL clients reach the Runtime API at (`NYLORUN_PUBLIC_URL`). */
+    publicUrl?: string;
 }): (id: string) => TenantConfig;

package/dist/host/config-for.js

@@ -16,6 +16,7 @@ export function configForFactory(options) {
             model: options.model ?? { kind: "vault" },
             ...(options.delivery ? { delivery: options.delivery } : {}),
             ...(options.issuers ? { issuers: options.issuers } : {}),
+            ...(options.publicUrl ? { publicUrl: options.publicUrl } : {}),
             logger: {
                 info: (message, fields) => options.logger.info(message, { tenantId: id, ...fields }),
                 warn: (message, fields) => options.logger.warn(message, { tenantId: id, ...fields }),

package/dist/host/http.d.ts

@@ -44,8 +44,8 @@ export declare function requestHasBody(request: IncomingMessage): boolean;
 /** `/health` and `/ready` are polled; the request log leaves them out. */
 export declare function pathnameIsLogged(rawUrl: string | undefined): boolean;
 /**
- * Redact path parameters after `/v1/sessions/` for Host logs, and a capability link's token
- * (a credential) after `/v1/artifact-links/`.
+ * Redact path parameters after `/v1/sessions/` for Host logs, a capability link's token (a
+ * credential) after `/v1/artifact-links/`, and a webhook endpoint's id after `/v1/webhooks/`.
  */
 export declare function redactRoutePath(pathname: string): string;
 /** Constant-time comparison of SHA-256 digests of a presented and a stored secret. */

package/dist/host/http.js

@@ -136,8 +136,8 @@ export function pathnameIsLogged(rawUrl) {
     return pathname !== "/health" && pathname !== "/ready";
 }
 /**
- * Redact path parameters after `/v1/sessions/` for Host logs, and a capability link's token
- * (a credential) after `/v1/artifact-links/`.
+ * Redact path parameters after `/v1/sessions/` for Host logs, a capability link's token (a
+ * credential) after `/v1/artifact-links/`, and a webhook endpoint's id after `/v1/webhooks/`.
  */
 export function redactRoutePath(pathname) {
     const parts = pathname.split("/");
@@ -147,6 +147,9 @@ export function redactRoutePath(pathname) {
     }
     if (parts[1] === "v1" && parts[2] === "artifact-links" && parts.length > 3)
         return "/v1/artifact-links/:token";
+    // A webhook endpoint's id is its address: whoever has it may try to deliver (T4).
+    if (parts[1] === "v1" && parts[2] === "webhooks" && parts.length > 3)
+        return "/v1/webhooks/:endpointId";
     return pathname;
 }
 /** Constant-time comparison of SHA-256 digests of a presented and a stored secret. */

package/dist/host/main.js

@@ -279,6 +279,7 @@ export async function main() {
         logger,
         ...(stack.delivery ? { delivery: stack.delivery } : {}),
         ...(issuers ? { issuers } : {}),
+        ...(stack.publicUrl ? { publicUrl: stack.publicUrl } : {}),
     });
     // The process's Durable Session Execution: Restate when its endpoints are set, else the
     // in-process memory execution. An invocation that arrives while the Tenant opens waits for it.