@nylorun/runtime 0.28.0-beta → 0.30.0-beta

package/dist/openapi.json

@@ -2,10 +2,10 @@
   "openapi": "3.2.0",
   "info": {
     "title": "Nylorun Runtime API",
-    "version": "0.28.0-beta",
+    "version": "0.30.0-beta",
     "x-nylorun-protocol": {
       "min": 16,
-      "max": 17,
+      "max": 18,
       "features": [
         "studio-principal",
         "artifacts",
@@ -16,6 +16,7 @@
         "harness-boundary",
         "agents",
         "session-queue",
+        "usage-by-kind",
         "tenant-fixture-model",
         "transcript-events",
         "subject-headers",
@@ -31,7 +32,8 @@
         "environment-disk-versions",
         "tool-policy",
         "traces",
-        "artifact-reads"
+        "artifact-reads",
+        "gateway-credentials"
       ]
     },
     "description": "For developers: agent manifests, Agents, sessions (with AG-UI and A2A) and artifacts, through `@nylorun/agents`. Every Tenant serves it on its one URL, beside the Management API (`/openapi/management.json`). Every request sends `Nylorun-Protocol`. Who may call each operation is its `security` and its `x-nylorun-credentials` and `x-nylorun-scopes` (the subject scopes that reach it) fields: an application key (servers) or a trusted issuer's token (browsers and apps)."
@@ -12921,6 +12923,9 @@
                   "server": {
                     "type": "string"
                   },
+                  "gateway": {
+                    "type": "string"
+                  },
                   "retryable": {
                     "type": "boolean"
                   }
@@ -20800,6 +20805,7 @@
                   "enum": [
                     "bearer",
                     "headers",
+                    "workload",
                     "environment_secret",
                     "environment_variable"
                   ]
@@ -20846,6 +20852,9 @@
                 "via": {
                   "type": "string"
                 },
+                "toolPrefix": {
+                  "type": "string"
+                },
                 "identity": {
                   "type": "object",
                   "properties": {
@@ -20892,6 +20901,7 @@
             "enum": [
               "bearer",
               "headers",
+              "workload",
               "environment_secret",
               "environment_variable"
             ]
@@ -20938,6 +20948,9 @@
           "via": {
             "type": "string"
           },
+          "toolPrefix": {
+            "type": "string"
+          },
           "identity": {
             "type": "object",
             "properties": {
@@ -20983,6 +20996,12 @@
               "type": "string",
               "minLength": 1
             }
+          },
+          "toolPrefix": {
+            "type": "string",
+            "minLength": 1,
+            "maxLength": 64,
+            "pattern": "^[\\x21-\\x7e]+$"
           }
         },
         "additionalProperties": false
@@ -22298,7 +22317,7 @@
               }
             },
             "additionalProperties": false,
-            "description": "The Agent's memory: Markdown files under /memories it keeps across sessions (D72)"
+            "description": "The Agent's memory: Markdown files under /memories it keeps across sessions"
           },
           "functions": {
             "description": "Reserved: Functions are not available yet"
@@ -22644,11 +22663,11 @@
             "additionalProperties": {
               "$ref": "#/components/schemas/Trigger"
             },
-            "description": "What starts the Agent's turns with no client connected, by trigger id (D74)"
+            "description": "What starts the Agent's turns with no client connected, by trigger id"
           },
           "selfWake": {
             "type": "boolean",
-            "description": "Offer the agent schedule_wake: it books its session's next turn itself (D77)"
+            "description": "Offer the agent schedule_wake: it books its session's next turn itself"
           }
         },
         "required": [
@@ -24187,6 +24206,46 @@
           "unknownQualityCalls": {
             "type": "integer",
             "minimum": 0
+          },
+          "costSplit": {
+            "type": "object",
+            "properties": {
+              "input": {
+                "type": "number",
+                "minimum": 0
+              },
+              "cacheRead": {
+                "type": "number",
+                "minimum": 0
+              },
+              "cacheWrite": {
+                "type": "number",
+                "minimum": 0
+              },
+              "output": {
+                "type": "number",
+                "minimum": 0
+              }
+            },
+            "required": [
+              "input",
+              "cacheRead",
+              "cacheWrite",
+              "output"
+            ],
+            "additionalProperties": false
+          },
+          "splitCalls": {
+            "type": "integer",
+            "minimum": 0
+          },
+          "modelTimeMs": {
+            "type": "integer",
+            "minimum": 0
+          },
+          "timedCalls": {
+            "type": "integer",
+            "minimum": 0
           }
         },
         "required": [
@@ -24204,7 +24263,11 @@
           "duplicates",
           "unpricedCalls",
           "unreportedCalls",
-          "unknownQualityCalls"
+          "unknownQualityCalls",
+          "costSplit",
+          "splitCalls",
+          "modelTimeMs",
+          "timedCalls"
         ],
         "additionalProperties": false
       },
@@ -24267,6 +24330,18 @@
           "at": {
             "type": "string"
           },
+          "startedAt": {
+            "type": [
+              "string",
+              "null"
+            ]
+          },
+          "endedAt": {
+            "type": [
+              "string",
+              "null"
+            ]
+          },
           "outcome": {
             "type": "string",
             "enum": [
@@ -24322,6 +24397,37 @@
                   "boolean",
                   "null"
                 ]
+              },
+              "costSplit": {
+                "type": [
+                  "object",
+                  "null"
+                ],
+                "properties": {
+                  "input": {
+                    "type": "number",
+                    "minimum": 0
+                  },
+                  "cacheRead": {
+                    "type": "number",
+                    "minimum": 0
+                  },
+                  "cacheWrite": {
+                    "type": "number",
+                    "minimum": 0
+                  },
+                  "output": {
+                    "type": "number",
+                    "minimum": 0
+                  }
+                },
+                "required": [
+                  "input",
+                  "cacheRead",
+                  "cacheWrite",
+                  "output"
+                ],
+                "additionalProperties": false
               }
             },
             "required": [
@@ -24334,7 +24440,8 @@
               "costUsd",
               "duplicate",
               "tokensReported",
-              "costKnown"
+              "costKnown",
+              "costSplit"
             ],
             "additionalProperties": false
           }
@@ -24348,6 +24455,8 @@
           "provider",
           "model",
           "at",
+          "startedAt",
+          "endedAt",
           "outcome",
           "usage"
         ],
@@ -24683,7 +24792,7 @@
           "Agent manifests"
         ],
         "summary": "Save an agent manifest",
-        "description": "Saves the manifest as its next version, or answers the latest unchanged when nothing differs. Every Agent that tracks the manifest moves to the new version (track T3): at once, at its pod's next start for a runtime change a pod applies only when it starts, or once a required secret the version adds is set; a pinned one stays, and so does one whose kind, harness or storage the version changes (`agents_behind`). The Runtime checks the harness and runtime sections against each other: a custom harness needs a pod with an image, every credential the harness names is a declared slot of the right type, and the runtime's kind gives the loop the sandbox it needs; every gap is named in one `422 manifest_inconsistent` (`details.gaps`). `If-Match: <version>` refuses the save with `412 manifest_changed` when the latest version is no longer the one you read (`0` for a manifest that does not exist yet). With `?dryRun=true` the answer is the plan: the changes by section, every reason a save would be refused (`errors`, the gaps first), warnings, the Agents it would move (`moves`) and how many stay on older versions (`behind`); nothing is saved. Clients compose the authoring files and drop their `$schema` before they send one document.",
+        "description": "Saves the manifest as its next version, or answers the latest unchanged when nothing differs. Every Agent that tracks the manifest moves to the new version: at once, at its pod's next start for a runtime change a pod applies only when it starts, or once a required secret the version adds is set; a pinned one stays, and so does one whose kind, harness or storage the version changes (`agents_behind`). The Runtime checks the harness and runtime sections against each other: a custom harness needs a pod with an image, every credential the harness names is a declared slot of the right type, and the runtime's kind gives the loop the sandbox it needs; every gap is named in one `422 manifest_inconsistent` (`details.gaps`). `If-Match: <version>` refuses the save with `412 manifest_changed` when the latest version is no longer the one you read (`0` for a manifest that does not exist yet). With `?dryRun=true` the answer is the plan: the changes by section, every reason a save would be refused (`errors`, the gaps first), warnings, the Agents it would move (`moves`) and how many stay on older versions (`behind`); nothing is saved. Clients compose the authoring files and drop their `$schema` before they send one document.",
         "security": [
           {
             "applicationKey": []
@@ -24724,10 +24833,10 @@
           {
             "schema": {
               "type": "string",
-              "description": "The protocol version, `17`"
+              "description": "The protocol version, `18`"
             },
             "required": true,
-            "description": "The protocol version, `17`",
+            "description": "The protocol version, `18`",
             "name": "Nylorun-Protocol",
             "in": "header"
           },
@@ -24878,10 +24987,10 @@
           {
             "schema": {
               "type": "string",
-              "description": "The protocol version, `17`"
+              "description": "The protocol version, `18`"
             },
             "required": true,
-            "description": "The protocol version, `17`",
+            "description": "The protocol version, `18`",
             "name": "Nylorun-Protocol",
             "in": "header"
           },
@@ -25011,10 +25120,10 @@
           {
             "schema": {
               "type": "string",
-              "description": "The protocol version, `17`"
+              "description": "The protocol version, `18`"
             },
             "required": true,
-            "description": "The protocol version, `17`",
+            "description": "The protocol version, `18`",
             "name": "Nylorun-Protocol",
             "in": "header"
           },
@@ -25141,10 +25250,10 @@
           {
             "schema": {
               "type": "string",
-              "description": "The protocol version, `17`"
+              "description": "The protocol version, `18`"
             },
             "required": true,
-            "description": "The protocol version, `17`",
+            "description": "The protocol version, `18`",
             "name": "Nylorun-Protocol",
             "in": "header"
           },
@@ -25278,10 +25387,10 @@
           {
             "schema": {
               "type": "string",
-              "description": "The protocol version, `17`"
+              "description": "The protocol version, `18`"
             },
             "required": true,
-            "description": "The protocol version, `17`",
+            "description": "The protocol version, `18`",
             "name": "Nylorun-Protocol",
             "in": "header"
           },
@@ -25424,10 +25533,10 @@
           {
             "schema": {
               "type": "string",
-              "description": "The protocol version, `17`"
+              "description": "The protocol version, `18`"
             },
             "required": true,
-            "description": "The protocol version, `17`",
+            "description": "The protocol version, `18`",
             "name": "Nylorun-Protocol",
             "in": "header"
           },
@@ -25556,10 +25665,10 @@
           {
             "schema": {
               "type": "string",
-              "description": "The protocol version, `17`"
+              "description": "The protocol version, `18`"
             },
             "required": true,
-            "description": "The protocol version, `17`",
+            "description": "The protocol version, `18`",
             "name": "Nylorun-Protocol",
             "in": "header"
           }
@@ -25691,10 +25800,10 @@
           {
             "schema": {
               "type": "string",
-              "description": "The protocol version, `17`"
+              "description": "The protocol version, `18`"
             },
             "required": true,
-            "description": "The protocol version, `17`",
+            "description": "The protocol version, `18`",
             "name": "Nylorun-Protocol",
             "in": "header"
           }
@@ -25772,7 +25881,7 @@
           "Agents"
         ],
         "summary": "Create, find or move an Agent",
-        "description": "Creates the Agent, its vault and its compute from a saved agent manifest, within the Tenant's limits, or answers the one with this id, so get-or-create is one call. `manifest: \"name\"` records that it tracks the manifest (its latest version, and each version saved later) and `\"name@n\"` that it is pinned; the version it runs is `resolvedVersion`. On an existing one, labels replace, `owner` sets or (with `null`) clears the owner guard, and `manifest` moves it (track T3) with its id, disk, vault and sessions: a harness-only change applies at once (each session's next turn runs it), a runtime change of a pod at its next start (`targetVersion`, `waitingFor: start`), and a version that adds a required secret once a value is set (`waitingFor: secrets`). Its manifest's name, kind, harness and storage are fixed (`409 agent_fixed_field`): fork it to change them. `?dryRun=true` answers the move's plan and changes nothing. Creating an Agent opens no session (D71). Kind `pod` needs sandbox pods (`nylorun local sandbox enable`) and is created at once.",
+        "description": "Creates the Agent, its vault and its compute from a saved agent manifest, within the Tenant's limits, or answers the one with this id, so get-or-create is one call. `manifest: \"name\"` records that it tracks the manifest (its latest version, and each version saved later) and `\"name@n\"` that it is pinned; the version it runs is `resolvedVersion`. On an existing one, labels replace, `owner` sets or (with `null`) clears the owner guard, and `manifest` moves it with its id, disk, vault and sessions: a harness-only change applies at once (each session's next turn runs it), a runtime change of a pod at its next start (`targetVersion`, `waitingFor: start`), and a version that adds a required secret once a value is set (`waitingFor: secrets`). Its manifest's name, kind, harness and storage are fixed (`409 agent_fixed_field`): fork it to change them. `?dryRun=true` answers the move's plan and changes nothing. Creating an Agent opens no session. Kind `pod` needs sandbox pods (`nylorun local sandbox enable`) and is created at once.",
         "security": [
           {
             "applicationKey": []
@@ -25817,10 +25926,10 @@
           {
             "schema": {
               "type": "string",
-              "description": "The protocol version, `17`"
+              "description": "The protocol version, `18`"
             },
             "required": true,
-            "description": "The protocol version, `17`",
+            "description": "The protocol version, `18`",
             "name": "Nylorun-Protocol",
             "in": "header"
           },
@@ -25969,10 +26078,10 @@
           {
             "schema": {
               "type": "string",
-              "description": "The protocol version, `17`"
+              "description": "The protocol version, `18`"
             },
             "required": true,
-            "description": "The protocol version, `17`",
+            "description": "The protocol version, `18`",
             "name": "Nylorun-Protocol",
             "in": "header"
           },
@@ -26106,10 +26215,10 @@
           {
             "schema": {
               "type": "string",
-              "description": "The protocol version, `17`"
+              "description": "The protocol version, `18`"
             },
             "required": true,
-            "description": "The protocol version, `17`",
+            "description": "The protocol version, `18`",
             "name": "Nylorun-Protocol",
             "in": "header"
           },
@@ -26217,7 +26326,7 @@
           "Agents"
         ],
         "summary": "List Agents",
-        "description": "Every Agent with all the labels asked for, in `state`, made from `manifest` and `outdated` (moving to another version, track T3) when given, by id. A token caller sees only the Agents its grants reach, and a caller acting for a person only that person's sessions on each. `limit` opts into pages.",
+        "description": "Every Agent with all the labels asked for, in `state`, made from `manifest` and `outdated` (moving to another version) when given, by id. A token caller sees only the Agents its grants reach, and a caller acting for a person only that person's sessions on each. `limit` opts into pages.",
         "security": [
           {
             "applicationKey": []
@@ -26313,10 +26422,10 @@
           {
             "schema": {
               "type": "string",
-              "description": "The protocol version, `17`"
+              "description": "The protocol version, `18`"
             },
             "required": true,
-            "description": "The protocol version, `17`",
+            "description": "The protocol version, `18`",
             "name": "Nylorun-Protocol",
             "in": "header"
           },
@@ -26428,7 +26537,7 @@
           "Agents"
         ],
         "summary": "Read an Agent's events",
-        "description": "`agent.created`, `.attached`, `.detached`, `.deleted`, a pod's `.running`, `.suspended`, `.relaunched`, `.lost`, `.reset` and `.failed`, `.forked`, a move's `.outdated`, `.version_changed` and `.start_failed` (track T3), and `agent.egress` for every connection its sandbox opens through egress-gate, naming the turns that were running (D67), in order, numbered from 0, at most the Tenant's Runtime limit `environmentEventItems` (default 1000) per call: `from` reads on.",
+        "description": "`agent.created`, `.attached`, `.detached`, `.deleted`, a pod's `.running`, `.suspended`, `.relaunched`, `.lost`, `.reset` and `.failed`, `.forked`, a move's `.outdated`, `.version_changed` and `.start_failed`, and `agent.egress` for every connection its sandbox opens through egress-gate, naming the turns that were running, in order, numbered from 0, at most the Tenant's Runtime limit `environmentEventItems` (default 1000) per call: `from` reads on.",
         "security": [
           {
             "applicationKey": []
@@ -26501,10 +26610,10 @@
           {
             "schema": {
               "type": "string",
-              "description": "The protocol version, `17`"
+              "description": "The protocol version, `18`"
             },
             "required": true,
-            "description": "The protocol version, `17`",
+            "description": "The protocol version, `18`",
             "name": "Nylorun-Protocol",
             "in": "header"
           },
@@ -26640,10 +26749,10 @@
           {
             "schema": {
               "type": "string",
-              "description": "The protocol version, `17`"
+              "description": "The protocol version, `18`"
             },
             "required": true,
-            "description": "The protocol version, `17`",
+            "description": "The protocol version, `18`",
             "name": "Nylorun-Protocol",
             "in": "header"
           },
@@ -26775,10 +26884,10 @@
           {
             "schema": {
               "type": "string",
-              "description": "The protocol version, `17`"
+              "description": "The protocol version, `18`"
             },
             "required": true,
-            "description": "The protocol version, `17`",
+            "description": "The protocol version, `18`",
             "name": "Nylorun-Protocol",
             "in": "header"
           },
@@ -26879,7 +26988,7 @@
           "Agents"
         ],
         "summary": "Restart an Agent on its pending version",
-        "description": "Applies a version the Agent waits to apply (track T3): a running pod stops, so the next turn starts it on the version, on the same volume; a stopped or failed one is asked to run at once. `retry: true` first moves it to the version that failed to start (`failedVersion`) again. Kinds `virtual` and `none` apply a version at once, so there is nothing to wait for. Refused during a turn (`agent_busy`). The body is optional.",
+        "description": "Applies a version the Agent waits to apply: a running pod stops, so the next turn starts it on the version, on the same volume; a stopped or failed one is asked to run at once. `retry: true` first moves it to the version that failed to start (`failedVersion`) again. Kinds `virtual` and `none` apply a version at once, so there is nothing to wait for. Refused during a turn (`agent_busy`). The body is optional.",
         "security": [
           {
             "applicationKey": []
@@ -26910,10 +27019,10 @@
           {
             "schema": {
               "type": "string",
-              "description": "The protocol version, `17`"
+              "description": "The protocol version, `18`"
             },
             "required": true,
-            "description": "The protocol version, `17`",
+            "description": "The protocol version, `18`",
             "name": "Nylorun-Protocol",
             "in": "header"
           },
@@ -27064,10 +27173,10 @@
           {
             "schema": {
               "type": "string",
-              "description": "The protocol version, `17`"
+              "description": "The protocol version, `18`"
             },
             "required": true,
-            "description": "The protocol version, `17`",
+            "description": "The protocol version, `18`",
             "name": "Nylorun-Protocol",
             "in": "header"
           },
@@ -27215,10 +27324,10 @@
           {
             "schema": {
               "type": "string",
-              "description": "The protocol version, `17`"
+              "description": "The protocol version, `18`"
             },
             "required": true,
-            "description": "The protocol version, `17`",
+            "description": "The protocol version, `18`",
             "name": "Nylorun-Protocol",
             "in": "header"
           },
@@ -27321,7 +27430,7 @@
           "Agents"
         ],
         "summary": "Write an Agent's secret",
-        "description": "Creates or replaces one credential of the Agent's vault: an `environment_secret` (the variable `name` reads the sentinel `nylorun_managed` in the sandbox, and egress-gate sets the value as a header on requests to `allowedHosts`), an `environment_variable` (a plain variable), or a `bearer` token or `headers` map for the MCP servers and HTTP tools at `url`. The same name and type re-seals the value and binding; another type replaces it. A rotated value is used from the next request. A second credential for a host or a URL is `409 credential_conflict`. When the Agent's manifest declares secret slots (D64; while it moves to another version, that version's), send only the value (`{ value }`, or `{ headers }` for a `headers` slot): the type and binding come from the slot, and a name it does not declare is `409 secret_not_in_manifest`.",
+        "description": "Creates or replaces one credential of the Agent's vault: an `environment_secret` (the variable `name` reads the sentinel `nylorun_managed` in the sandbox, and egress-gate sets the value as a header on requests to `allowedHosts`), an `environment_variable` (a plain variable), or a `bearer` token or `headers` map for the MCP servers and HTTP tools at `url`. The same name and type re-seals the value and binding; another type replaces it. A rotated value is used from the next request. A second credential for a host or a URL is `409 credential_conflict`. When the Agent's manifest declares secret slots (while it moves to another version, that version's), send only the value (`{ value }`, or `{ headers }` for a `headers` slot): the type and binding come from the slot, and a name it does not declare is `409 secret_not_in_manifest`.",
         "security": [
           {
             "applicationKey": []
@@ -27362,10 +27471,10 @@
           {
             "schema": {
               "type": "string",
-              "description": "The protocol version, `17`"
+              "description": "The protocol version, `18`"
             },
             "required": true,
-            "description": "The protocol version, `17`",
+            "description": "The protocol version, `18`",
             "name": "Nylorun-Protocol",
             "in": "header"
           },
@@ -27506,6 +27615,12 @@
                           "header"
                         ],
                         "additionalProperties": false
+                      },
+                      "toolPrefix": {
+                        "type": "string",
+                        "minLength": 1,
+                        "maxLength": 64,
+                        "pattern": "^[\\x21-\\x7e]+$"
                       }
                     },
                     "required": [
@@ -27554,6 +27669,12 @@
                           "header"
                         ],
                         "additionalProperties": false
+                      },
+                      "toolPrefix": {
+                        "type": "string",
+                        "minLength": 1,
+                        "maxLength": 64,
+                        "pattern": "^[\\x21-\\x7e]+$"
                       }
                     },
                     "required": [
@@ -27563,6 +27684,53 @@
                     ],
                     "additionalProperties": false
                   },
+                  {
+                    "type": "object",
+                    "properties": {
+                      "requestId": {
+                        "type": "string",
+                        "minLength": 1
+                      },
+                      "type": {
+                        "type": "string",
+                        "enum": [
+                          "workload"
+                        ]
+                      },
+                      "url": {
+                        "type": "string",
+                        "minLength": 1
+                      },
+                      "via": {
+                        "type": "string"
+                      },
+                      "identity": {
+                        "type": "object",
+                        "properties": {
+                          "header": {
+                            "type": "string",
+                            "pattern": "^[!#$%&'*+.^_`|~0-9A-Za-z-]+$"
+                          }
+                        },
+                        "required": [
+                          "header"
+                        ],
+                        "additionalProperties": false
+                      },
+                      "toolPrefix": {
+                        "type": "string",
+                        "minLength": 1,
+                        "maxLength": 64,
+                        "pattern": "^[\\x21-\\x7e]+$"
+                      }
+                    },
+                    "required": [
+                      "type",
+                      "url",
+                      "via"
+                    ],
+                    "additionalProperties": false
+                  },
                   {
                     "$ref": "#/components/schemas/PutAgentSecretValueRequest"
                   }
@@ -27693,10 +27861,10 @@
           {
             "schema": {
               "type": "string",
-              "description": "The protocol version, `17`"
+              "description": "The protocol version, `18`"
             },
             "required": true,
-            "description": "The protocol version, `17`",
+            "description": "The protocol version, `18`",
             "name": "Nylorun-Protocol",
             "in": "header"
           },
@@ -27832,10 +28000,10 @@
           {
             "schema": {
               "type": "string",
-              "description": "The protocol version, `17`"
+              "description": "The protocol version, `18`"
             },
             "required": true,
-            "description": "The protocol version, `17`",
+            "description": "The protocol version, `18`",
             "name": "Nylorun-Protocol",
             "in": "header"
           },
@@ -27970,10 +28138,10 @@
           {
             "schema": {
               "type": "string",
-              "description": "The protocol version, `17`"
+              "description": "The protocol version, `18`"
             },
             "required": true,
-            "description": "The protocol version, `17`",
+            "description": "The protocol version, `18`",
             "name": "Nylorun-Protocol",
             "in": "header"
           },
@@ -28084,7 +28252,7 @@
           "Agents"
         ],
         "summary": "Fork an Agent",
-        "description": "Copies the Agent into a new one (Q15), which is how an Agent changes what is fixed for its life: a new Agent `id`, made from `manifest` (default the source's manifest name, tracking, at its latest version), its disk started from a version of this one's (`disk`: `latest`, the default, takes a snapshot first; a version number; or `empty`) and its secrets copied inside the Runtime (`secrets`: `copy`, the default, copies those the new manifest declares; `none`). On a fork onto other setup the new manifest's setup runs on the copied disk before its first turn. This Agent keeps what it runs, its disk and its sessions. `dryRun` answers the plan and makes nothing. To move an Agent to another version of the same manifest, with the same kind, harness and storage, `PUT` it instead (track T3).",
+        "description": "Copies the Agent into a new one, which is how an Agent changes what is fixed for its life: a new Agent `id`, made from `manifest` (default the source's manifest name, tracking, at its latest version), its disk started from a version of this one's (`disk`: `latest`, the default, takes a snapshot first; a version number; or `empty`) and its secrets copied inside the Runtime (`secrets`: `copy`, the default, copies those the new manifest declares; `none`). On a fork onto other setup the new manifest's setup runs on the copied disk before its first turn. This Agent keeps what it runs, its disk and its sessions. `dryRun` answers the plan and makes nothing. To move an Agent to another version of the same manifest, with the same kind, harness and storage, `PUT` it instead.",
         "security": [
           {
             "applicationKey": []
@@ -28115,10 +28283,10 @@
           {
             "schema": {
               "type": "string",
-              "description": "The protocol version, `17`"
+              "description": "The protocol version, `18`"
             },
             "required": true,
-            "description": "The protocol version, `17`",
+            "description": "The protocol version, `18`",
             "name": "Nylorun-Protocol",
             "in": "header"
           },
@@ -28265,10 +28433,10 @@
           {
             "schema": {
               "type": "string",
-              "description": "The protocol version, `17`"
+              "description": "The protocol version, `18`"
             },
             "required": true,
-            "description": "The protocol version, `17`",
+            "description": "The protocol version, `18`",
             "name": "Nylorun-Protocol",
             "in": "header"
           },
@@ -28412,10 +28580,10 @@
           {
             "schema": {
               "type": "string",
-              "description": "The protocol version, `17`"
+              "description": "The protocol version, `18`"
             },
             "required": true,
-            "description": "The protocol version, `17`",
+            "description": "The protocol version, `18`",
             "name": "Nylorun-Protocol",
             "in": "header"
           },
@@ -28572,10 +28740,10 @@
           {
             "schema": {
               "type": "string",
-              "description": "The protocol version, `17`"
+              "description": "The protocol version, `18`"
             },
             "required": true,
-            "description": "The protocol version, `17`",
+            "description": "The protocol version, `18`",
             "name": "Nylorun-Protocol",
             "in": "header"
           },
@@ -28721,10 +28889,10 @@
           {
             "schema": {
               "type": "string",
-              "description": "The protocol version, `17`"
+              "description": "The protocol version, `18`"
             },
             "required": true,
-            "description": "The protocol version, `17`",
+            "description": "The protocol version, `18`",
             "name": "Nylorun-Protocol",
             "in": "header"
           },
@@ -28873,10 +29041,10 @@
           {
             "schema": {
               "type": "string",
-              "description": "The protocol version, `17`"
+              "description": "The protocol version, `18`"
             },
             "required": true,
-            "description": "The protocol version, `17`",
+            "description": "The protocol version, `18`",
             "name": "Nylorun-Protocol",
             "in": "header"
           },
@@ -29025,10 +29193,10 @@
           {
             "schema": {
               "type": "string",
-              "description": "The protocol version, `17`"
+              "description": "The protocol version, `18`"
             },
             "required": true,
-            "description": "The protocol version, `17`",
+            "description": "The protocol version, `18`",
             "name": "Nylorun-Protocol",
             "in": "header"
           },
@@ -29205,10 +29373,10 @@
           {
             "schema": {
               "type": "string",
-              "description": "The protocol version, `17`"
+              "description": "The protocol version, `18`"
             },
             "required": true,
-            "description": "The protocol version, `17`",
+            "description": "The protocol version, `18`",
             "name": "Nylorun-Protocol",
             "in": "header"
           },
@@ -29354,10 +29522,10 @@
           {
             "schema": {
               "type": "string",
-              "description": "The protocol version, `17`"
+              "description": "The protocol version, `18`"
             },
             "required": true,
-            "description": "The protocol version, `17`",
+            "description": "The protocol version, `18`",
             "name": "Nylorun-Protocol",
             "in": "header"
           },
@@ -29455,21 +29623,9 @@
           "Triggers"
         ],
         "summary": "Deliver to a webhook trigger",
-        "description": "A sender's delivery, signed with Standard Webhooks (`webhook-id`, `webhook-timestamp` within 5 minutes by default, `webhook-signature`): no credential and no `Nylorun-Protocol`. The body, any media type, at most the Runtime limit `webhookBodyBytes`, is read as bytes and verified before anything else. It runs the trigger once per `webhook-id`: a retry answers the first run. The body reaches the model as data under the trigger's prompt. Other senders (GitHub, Stripe, Slack) are relayed by an app.",
-        "security": [
-          {
-            "applicationKey": []
-          },
-          {
-            "issuerToken": []
-          },
-          {}
-        ],
-        "x-nylorun-credentials": [
-          "application",
-          "subject",
-          "token"
-        ],
+        "description": "A sender's delivery, signed with Standard Webhooks (`webhook-id`, `webhook-timestamp` within 5 minutes by default, `webhook-signature`): no credential (an `Authorization` header is ignored) and no `Nylorun-Protocol`. The body, any media type, at most the Runtime limit `webhookBodyBytes`, is read as bytes and verified before anything else. It runs the trigger once per `webhook-id`: a retry answers the first run. The body reaches the model as data under the trigger's prompt. Other senders (GitHub, Stripe, Slack) are relayed by an app.",
+        "security": [],
+        "x-nylorun-credentials": [],
         "x-nylorun-scopes": "any",
         "parameters": [
           {
@@ -29482,42 +29638,12 @@
             "name": "endpointId",
             "in": "path"
           },
-          {
-            "schema": {
-              "type": "string",
-              "description": "The protocol version, `17`"
-            },
-            "required": false,
-            "description": "The protocol version, `17`",
-            "name": "Nylorun-Protocol",
-            "in": "header"
-          },
-          {
-            "schema": {
-              "type": "string",
-              "description": "The person an application key acts for"
-            },
-            "required": false,
-            "description": "The person an application key acts for",
-            "name": "Nylorun-Subject",
-            "in": "header"
-          },
-          {
-            "schema": {
-              "type": "string",
-              "description": "The subject's space-separated scopes; required with a subject"
-            },
-            "required": false,
-            "description": "The subject's space-separated scopes; required with a subject",
-            "name": "Nylorun-Scopes",
-            "in": "header"
-          },
           {
             "schema": {
               "type": "string",
               "description": "The delivery's id; a retry sends the same"
             },
-            "required": false,
+            "required": true,
             "description": "The delivery's id; a retry sends the same",
             "name": "webhook-id",
             "in": "header"
@@ -29527,7 +29653,7 @@
               "type": "string",
               "description": "Seconds since the epoch"
             },
-            "required": false,
+            "required": true,
             "description": "Seconds since the epoch",
             "name": "webhook-timestamp",
             "in": "header"
@@ -29537,7 +29663,7 @@
               "type": "string",
               "description": "`v1,<base64>`, space-separated"
             },
-            "required": false,
+            "required": true,
             "description": "`v1,<base64>`, space-separated",
             "name": "webhook-signature",
             "in": "header"
@@ -29577,17 +29703,7 @@
             }
           },
           "401": {
-            "description": "Not signed with the endpoint's secret, or a timestamp out of tolerance"
-          },
-          "403": {
-            "description": "Not allowed for this credential or subject scope (`scope_required`; a token also gets `WWW-Authenticate: Bearer error=\"insufficient_scope\"` and the scope), a key of the other API (`key_role_mismatch`), or an application key from a browser (`origin_rejected`)",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Rejected"
-                }
-              }
-            }
+            "description": "Unsigned, not signed with the endpoint's secret, or a timestamp out of tolerance"
           },
           "404": {
             "description": "No endpoint has this id"
@@ -29689,10 +29805,10 @@
           {
             "schema": {
               "type": "string",
-              "description": "The protocol version, `17`"
+              "description": "The protocol version, `18`"
             },
             "required": true,
-            "description": "The protocol version, `17`",
+            "description": "The protocol version, `18`",
             "name": "Nylorun-Protocol",
             "in": "header"
           },
@@ -29840,10 +29956,10 @@
           {
             "schema": {
               "type": "string",
-              "description": "The protocol version, `17`"
+              "description": "The protocol version, `18`"
             },
             "required": true,
-            "description": "The protocol version, `17`",
+            "description": "The protocol version, `18`",
             "name": "Nylorun-Protocol",
             "in": "header"
           },
@@ -29980,10 +30096,10 @@
           {
             "schema": {
               "type": "string",
-              "description": "The protocol version, `17`"
+              "description": "The protocol version, `18`"
             },
             "required": true,
-            "description": "The protocol version, `17`",
+            "description": "The protocol version, `18`",
             "name": "Nylorun-Protocol",
             "in": "header"
           },
@@ -30143,10 +30259,10 @@
           {
             "schema": {
               "type": "string",
-              "description": "The protocol version, `17`"
+              "description": "The protocol version, `18`"
             },
             "required": true,
-            "description": "The protocol version, `17`",
+            "description": "The protocol version, `18`",
             "name": "Nylorun-Protocol",
             "in": "header"
           },
@@ -30320,10 +30436,10 @@
           {
             "schema": {
               "type": "string",
-              "description": "The protocol version, `17`"
+              "description": "The protocol version, `18`"
             },
             "required": true,
-            "description": "The protocol version, `17`",
+            "description": "The protocol version, `18`",
             "name": "Nylorun-Protocol",
             "in": "header"
           },
@@ -30471,10 +30587,10 @@
           {
             "schema": {
               "type": "string",
-              "description": "The protocol version, `17`"
+              "description": "The protocol version, `18`"
             },
             "required": true,
-            "description": "The protocol version, `17`",
+            "description": "The protocol version, `18`",
             "name": "Nylorun-Protocol",
             "in": "header"
           },
@@ -30601,10 +30717,10 @@
           {
             "schema": {
               "type": "string",
-              "description": "The protocol version, `17`"
+              "description": "The protocol version, `18`"
             },
             "required": true,
-            "description": "The protocol version, `17`",
+            "description": "The protocol version, `18`",
             "name": "Nylorun-Protocol",
             "in": "header"
           },
@@ -30748,10 +30864,10 @@
           {
             "schema": {
               "type": "string",
-              "description": "The protocol version, `17`"
+              "description": "The protocol version, `18`"
             },
             "required": true,
-            "description": "The protocol version, `17`",
+            "description": "The protocol version, `18`",
             "name": "Nylorun-Protocol",
             "in": "header"
           },
@@ -30939,10 +31055,10 @@
           {
             "schema": {
               "type": "string",
-              "description": "The protocol version, `17`"
+              "description": "The protocol version, `18`"
             },
             "required": true,
-            "description": "The protocol version, `17`",
+            "description": "The protocol version, `18`",
             "name": "Nylorun-Protocol",
             "in": "header"
           },
@@ -31083,10 +31199,10 @@
           {
             "schema": {
               "type": "string",
-              "description": "The protocol version, `17`"
+              "description": "The protocol version, `18`"
             },
             "required": true,
-            "description": "The protocol version, `17`",
+            "description": "The protocol version, `18`",
             "name": "Nylorun-Protocol",
             "in": "header"
           },
@@ -31273,10 +31389,10 @@
           {
             "schema": {
               "type": "string",
-              "description": "The protocol version, `17`"
+              "description": "The protocol version, `18`"
             },
             "required": true,
-            "description": "The protocol version, `17`",
+            "description": "The protocol version, `18`",
             "name": "Nylorun-Protocol",
             "in": "header"
           },
@@ -31546,10 +31662,10 @@
           {
             "schema": {
               "type": "string",
-              "description": "The protocol version, `17`"
+              "description": "The protocol version, `18`"
             },
             "required": true,
-            "description": "The protocol version, `17`",
+            "description": "The protocol version, `18`",
             "name": "Nylorun-Protocol",
             "in": "header"
           },
@@ -31686,10 +31802,10 @@
           {
             "schema": {
               "type": "string",
-              "description": "The protocol version, `17`"
+              "description": "The protocol version, `18`"
             },
             "required": true,
-            "description": "The protocol version, `17`",
+            "description": "The protocol version, `18`",
             "name": "Nylorun-Protocol",
             "in": "header"
           },
@@ -31823,10 +31939,10 @@
           {
             "schema": {
               "type": "string",
-              "description": "The protocol version, `17`"
+              "description": "The protocol version, `18`"
             },
             "required": true,
-            "description": "The protocol version, `17`",
+            "description": "The protocol version, `18`",
             "name": "Nylorun-Protocol",
             "in": "header"
           }
@@ -31959,10 +32075,10 @@
           {
             "schema": {
               "type": "string",
-              "description": "The protocol version, `17`"
+              "description": "The protocol version, `18`"
             },
             "required": true,
-            "description": "The protocol version, `17`",
+            "description": "The protocol version, `18`",
             "name": "Nylorun-Protocol",
             "in": "header"
           }
@@ -32095,10 +32211,10 @@
           {
             "schema": {
               "type": "string",
-              "description": "The protocol version, `17`"
+              "description": "The protocol version, `18`"
             },
             "required": true,
-            "description": "The protocol version, `17`",
+            "description": "The protocol version, `18`",
             "name": "Nylorun-Protocol",
             "in": "header"
           }
@@ -32213,10 +32329,10 @@
           {
             "schema": {
               "type": "string",
-              "description": "The protocol version, `17`"
+              "description": "The protocol version, `18`"
             },
             "required": true,
-            "description": "The protocol version, `17`",
+            "description": "The protocol version, `18`",
             "name": "Nylorun-Protocol",
             "in": "header"
           }
@@ -32339,10 +32455,10 @@
           {
             "schema": {
               "type": "string",
-              "description": "The protocol version, `17`"
+              "description": "The protocol version, `18`"
             },
             "required": true,
-            "description": "The protocol version, `17`",
+            "description": "The protocol version, `18`",
             "name": "Nylorun-Protocol",
             "in": "header"
           }
@@ -32471,10 +32587,10 @@
           {
             "schema": {
               "type": "string",
-              "description": "The protocol version, `17`"
+              "description": "The protocol version, `18`"
             },
             "required": true,
-            "description": "The protocol version, `17`",
+            "description": "The protocol version, `18`",
             "name": "Nylorun-Protocol",
             "in": "header"
           },
@@ -32663,10 +32779,10 @@
           {
             "schema": {
               "type": "string",
-              "description": "The protocol version, `17`"
+              "description": "The protocol version, `18`"
             },
             "required": true,
-            "description": "The protocol version, `17`",
+            "description": "The protocol version, `18`",
             "name": "Nylorun-Protocol",
             "in": "header"
           },
@@ -32809,10 +32925,10 @@
           {
             "schema": {
               "type": "string",
-              "description": "The protocol version, `17`"
+              "description": "The protocol version, `18`"
             },
             "required": true,
-            "description": "The protocol version, `17`",
+            "description": "The protocol version, `18`",
             "name": "Nylorun-Protocol",
             "in": "header"
           },
@@ -32955,10 +33071,10 @@
           {
             "schema": {
               "type": "string",
-              "description": "The protocol version, `17`"
+              "description": "The protocol version, `18`"
             },
             "required": true,
-            "description": "The protocol version, `17`",
+            "description": "The protocol version, `18`",
             "name": "Nylorun-Protocol",
             "in": "header"
           },
@@ -33089,10 +33205,10 @@
           {
             "schema": {
               "type": "string",
-              "description": "The protocol version, `17`"
+              "description": "The protocol version, `18`"
             },
             "required": true,
-            "description": "The protocol version, `17`",
+            "description": "The protocol version, `18`",
             "name": "Nylorun-Protocol",
             "in": "header"
           },
@@ -33239,10 +33355,10 @@
           {
             "schema": {
               "type": "string",
-              "description": "The protocol version, `17`"
+              "description": "The protocol version, `18`"
             },
             "required": true,
-            "description": "The protocol version, `17`",
+            "description": "The protocol version, `18`",
             "name": "Nylorun-Protocol",
             "in": "header"
           },
@@ -33438,10 +33554,10 @@
           {
             "schema": {
               "type": "string",
-              "description": "The protocol version, `17`"
+              "description": "The protocol version, `18`"
             },
             "required": true,
-            "description": "The protocol version, `17`",
+            "description": "The protocol version, `18`",
             "name": "Nylorun-Protocol",
             "in": "header"
           },
@@ -33641,10 +33757,10 @@
           {
             "schema": {
               "type": "string",
-              "description": "The protocol version, `17`"
+              "description": "The protocol version, `18`"
             },
             "required": true,
-            "description": "The protocol version, `17`",
+            "description": "The protocol version, `18`",
             "name": "Nylorun-Protocol",
             "in": "header"
           },
@@ -33785,10 +33901,10 @@
           {
             "schema": {
               "type": "string",
-              "description": "The protocol version, `17`"
+              "description": "The protocol version, `18`"
             },
             "required": true,
-            "description": "The protocol version, `17`",
+            "description": "The protocol version, `18`",
             "name": "Nylorun-Protocol",
             "in": "header"
           },
@@ -33920,10 +34036,10 @@
           {
             "schema": {
               "type": "string",
-              "description": "The protocol version, `17`"
+              "description": "The protocol version, `18`"
             },
             "required": true,
-            "description": "The protocol version, `17`",
+            "description": "The protocol version, `18`",
             "name": "Nylorun-Protocol",
             "in": "header"
           },
@@ -34060,10 +34176,10 @@
           {
             "schema": {
               "type": "string",
-              "description": "The protocol version, `17`"
+              "description": "The protocol version, `18`"
             },
             "required": true,
-            "description": "The protocol version, `17`",
+            "description": "The protocol version, `18`",
             "name": "Nylorun-Protocol",
             "in": "header"
           },
@@ -34222,10 +34338,10 @@
           {
             "schema": {
               "type": "string",
-              "description": "The protocol version, `17`"
+              "description": "The protocol version, `18`"
             },
             "required": true,
-            "description": "The protocol version, `17`",
+            "description": "The protocol version, `18`",
             "name": "Nylorun-Protocol",
             "in": "header"
           },
@@ -34436,10 +34552,10 @@
           {
             "schema": {
               "type": "string",
-              "description": "The protocol version, `17`"
+              "description": "The protocol version, `18`"
             },
             "required": true,
-            "description": "The protocol version, `17`",
+            "description": "The protocol version, `18`",
             "name": "Nylorun-Protocol",
             "in": "header"
           },
@@ -34593,10 +34709,10 @@
           {
             "schema": {
               "type": "string",
-              "description": "The protocol version, `17`"
+              "description": "The protocol version, `18`"
             },
             "required": true,
-            "description": "The protocol version, `17`",
+            "description": "The protocol version, `18`",
             "name": "Nylorun-Protocol",
             "in": "header"
           },
@@ -34817,10 +34933,10 @@
           {
             "schema": {
               "type": "string",
-              "description": "The protocol version, `17`"
+              "description": "The protocol version, `18`"
             },
             "required": true,
-            "description": "The protocol version, `17`",
+            "description": "The protocol version, `18`",
             "name": "Nylorun-Protocol",
             "in": "header"
           },
@@ -34964,10 +35080,10 @@
           {
             "schema": {
               "type": "string",
-              "description": "The protocol version, `17`"
+              "description": "The protocol version, `18`"
             },
             "required": true,
-            "description": "The protocol version, `17`",
+            "description": "The protocol version, `18`",
             "name": "Nylorun-Protocol",
             "in": "header"
           },
@@ -35102,10 +35218,10 @@
           {
             "schema": {
               "type": "string",
-              "description": "The protocol version, `17`"
+              "description": "The protocol version, `18`"
             },
             "required": true,
-            "description": "The protocol version, `17`",
+            "description": "The protocol version, `18`",
             "name": "Nylorun-Protocol",
             "in": "header"
           },
@@ -35248,10 +35364,10 @@
           {
             "schema": {
               "type": "string",
-              "description": "The protocol version, `17`"
+              "description": "The protocol version, `18`"
             },
             "required": false,
-            "description": "The protocol version, `17`",
+            "description": "The protocol version, `18`",
             "name": "Nylorun-Protocol",
             "in": "header"
           },
@@ -35491,10 +35607,10 @@
           {
             "schema": {
               "type": "string",
-              "description": "The protocol version, `17`"
+              "description": "The protocol version, `18`"
             },
             "required": true,
-            "description": "The protocol version, `17`",
+            "description": "The protocol version, `18`",
             "name": "Nylorun-Protocol",
             "in": "header"
           },
@@ -35647,10 +35763,10 @@
           {
             "schema": {
               "type": "string",
-              "description": "The protocol version, `17`"
+              "description": "The protocol version, `18`"
             },
             "required": true,
-            "description": "The protocol version, `17`",
+            "description": "The protocol version, `18`",
             "name": "Nylorun-Protocol",
             "in": "header"
           },
@@ -35768,7 +35884,7 @@
   "tags": [
     {
       "name": "Agent manifests",
-      "description": "Named, versioned agent manifests (protocol 16): one document with what runs inside an agent's loop (`harness`) and what the Runtime provides around it (`runtime`), checked against each other when it is saved. Save one with a plan first (`?dryRun=true`) and `If-Match`; an Agent is made from one version and keeps it, so a save changes no Agent. `client.agentManifests` in `@nylorun/agents`, and `nylorun apply`."
+      "description": "Named, versioned agent manifests (protocol 16): one document with what runs inside an agent's loop (`harness`) and what the Runtime provides around it (`runtime`), checked against each other when it is saved. Save one with a plan first (`?dryRun=true`) and `If-Match`; an Agent runs one version at a time, and a save moves every Agent that tracks the manifest to the new version, while a pinned one stays. `client.agentManifests` in `@nylorun/agents`, and `nylorun apply`."
     },
     {
       "name": "Definition files",
@@ -35780,11 +35896,11 @@
     },
     {
       "name": "Triggers",
-      "description": "What starts an Agent's turns with no client connected (track T4, D74): the schedules, one-shot times and webhook endpoints its manifest's `runtime.triggers` declare. Each trigger's status is the Agent's: pause and resume it, run it now, make a webhook trigger's signing secret, and read its runs (`started`, `queued`, `skipped` or `failed`, with a reason). In `@nylorun/agents` and `nylorun agents triggers`."
+      "description": "What starts an Agent's turns with no client connected: the schedules, one-shot times and webhook endpoints its manifest's `runtime.triggers` declare. Each trigger's status is the Agent's: pause and resume it, run it now, make a webhook trigger's signing secret, and read its runs (`started`, `queued`, `skipped` or `failed`, with a reason). In `@nylorun/agents` and `nylorun agents triggers`."
     },
     {
       "name": "Memory",
-      "description": "An Agent's memories (track T5, D72): Markdown files under `/memories` it keeps across sessions, wakes and upgrades, shaped like Anthropic's memory stores. List and read them, write one whole (with a `content_sha256` precondition), delete one or a folder, and read the version every change leaves, with who made it. In `@nylorun/agents` and `nylorun agents memories`."
+      "description": "An Agent's memories: Markdown files under `/memories` it keeps across sessions, wakes and upgrades, shaped like Anthropic's memory stores. List and read them, write one whole (with a `content_sha256` precondition), delete one or a folder, and read the version every change leaves, with who made it. In `@nylorun/agents` and `nylorun agents memories`."
     },
     {
       "name": "Sessions API",