@nylorun/runtime 0.31.0-beta → 0.33.0-beta

package/dist/management-openapi.json

@@ -2,7 +2,7 @@
   "openapi": "3.2.0",
   "info": {
     "title": "Nylorun Management API",
-    "version": "0.31.0-beta",
+    "version": "0.33.0-beta",
     "x-nylorun-protocol": {
       "min": 16,
       "max": 18,
@@ -34,7 +34,9 @@
         "traces",
         "artifact-reads",
         "gateway-credentials",
-        "agent-folders"
+        "agent-folders",
+        "session-model",
+        "model-host-identity"
       ]
     },
     "description": "For operators: the Tenant's models, vaults, signing keys, settings and application keys, at `/v1/tenant/*` on the Tenant's URL, through `@nylorun/admin`. Every operation takes a management key, acting as itself: never for a subject and never from a browser. Management keys are issued only on the Tenant's machine (`nylorun tenant keys put <id> --management`) or from `NYLORUN_MANAGEMENT_KEY_FILE`."
@@ -427,7 +429,8 @@
                     "enum": [
                       "api_key",
                       "oauth",
-                      "workload"
+                      "workload",
+                      "host_identity"
                     ]
                   },
                   "baseUrl": {
@@ -1137,6 +1140,31 @@
                       "type"
                     ],
                     "additionalProperties": false
+                  },
+                  {
+                    "type": "object",
+                    "properties": {
+                      "type": {
+                        "type": "string",
+                        "enum": [
+                          "host_identity"
+                        ]
+                      },
+                      "project": {
+                        "type": "string",
+                        "pattern": "^[a-z][a-z0-9-]{4,28}[a-z0-9]$"
+                      },
+                      "location": {
+                        "type": "string",
+                        "pattern": "^[a-z][a-z0-9-]*$"
+                      }
+                    },
+                    "required": [
+                      "type",
+                      "project",
+                      "location"
+                    ],
+                    "additionalProperties": false
                   }
                 ]
               }
@@ -1591,6 +1619,18 @@
               "flowLoopIterations": {
                 "type": "integer",
                 "exclusiveMinimum": 0
+              },
+              "folderFiles": {
+                "type": "integer",
+                "exclusiveMinimum": 0
+              },
+              "folderBytes": {
+                "type": "integer",
+                "exclusiveMinimum": 0
+              },
+              "folderTextFileBytes": {
+                "type": "integer",
+                "exclusiveMinimum": 0
               }
             },
             "required": [
@@ -1663,7 +1703,10 @@
               "sessionQueuedMessages",
               "flowConcurrency",
               "flowMapItems",
-              "flowLoopIterations"
+              "flowLoopIterations",
+              "folderFiles",
+              "folderBytes",
+              "folderTextFileBytes"
             ],
             "additionalProperties": false
           }
@@ -1958,6 +2001,18 @@
               "flowLoopIterations": {
                 "type": "integer",
                 "exclusiveMinimum": 0
+              },
+              "folderFiles": {
+                "type": "integer",
+                "exclusiveMinimum": 0
+              },
+              "folderBytes": {
+                "type": "integer",
+                "exclusiveMinimum": 0
+              },
+              "folderTextFileBytes": {
+                "type": "integer",
+                "exclusiveMinimum": 0
               }
             },
             "additionalProperties": false
@@ -2653,7 +2708,8 @@
                   "enum": [
                     "api_key",
                     "oauth",
-                    "workload"
+                    "workload",
+                    "host_identity"
                   ]
                 },
                 "baseUrl": {
@@ -2833,7 +2889,8 @@
                 "enum": [
                   "api_key",
                   "oauth",
-                  "workload"
+                  "workload",
+                  "host_identity"
                 ]
               },
               "baseUrl": {
@@ -3143,6 +3200,31 @@
                   "type"
                 ],
                 "additionalProperties": false
+              },
+              {
+                "type": "object",
+                "properties": {
+                  "type": {
+                    "type": "string",
+                    "enum": [
+                      "host_identity"
+                    ]
+                  },
+                  "project": {
+                    "type": "string",
+                    "pattern": "^[a-z][a-z0-9-]{4,28}[a-z0-9]$"
+                  },
+                  "location": {
+                    "type": "string",
+                    "pattern": "^[a-z][a-z0-9-]*$"
+                  }
+                },
+                "required": [
+                  "type",
+                  "project",
+                  "location"
+                ],
+                "additionalProperties": false
               }
             ]
           }
@@ -7328,7 +7410,7 @@
           "Settings"
         ],
         "summary": "Get the Tenant's Runtime limits",
-        "description": "The sizes, counts and deadlines the Runtime holds what crosses it to: the Tenant's (Tenant setting `limits.config`), with the default for each it leaves out. Harnesses get the ones they must respect in `turn.start.limits` (record entry, model call, model file, tool answer, custom harness state, Harness API chunk, folder entries). Defaults and ceilings: `recordEntryBytes` 983040 bytes, at most 983040 (S2 takes records of at most 1048576 bytes, and an event's envelope needs 65536 beside its payload); `modelCallBytes` 33554432 bytes, at most 536870888 (the Model Gate reads a call's body as one string, of at most 536870888 characters); `modelFileBytes` 8388608 bytes, at most 402653166 (a file goes to the provider as one base64 string, of at most 536870888 characters); `toolAnswerBytes` 8388608 bytes, at most 33554432 (a harness reports the answer to core in one Harness API frame (67108864 bytes), as JSON, whose escapes may double it); `harnessStateBytes` 262144 bytes, at most 33554432 (the state crosses in one Harness API frame (67108864 bytes) with the rest of its output or turn.start); `chunkBytes` 16777216 bytes, at most 50266112 (a chunk crosses in base64 in one Harness API frame (67108864 bytes), with room for the frame's own JSON); `folderEntries` 10000 entries, at most 4628197 (a folder's manifest is read as one string, of at most 536870888 characters, and each entry takes at least 116); `requestBodyBytes` 1048576 bytes, at most 536870888 (a body is read as one string, of at most 536870888 characters); `messageParts` 32 entries, at most 19884106 (parts arrive in one request body, read as one string of at most 536870888 characters, and each takes at least 27); `pageItems` 200 entries, at most 178956962 (a page's items go in one response body, written as one string of at most 536870888 characters, and each takes at least 3); `exportPageItems` 1000 entries, at most 178956962 (a page's calls go in one response body, written as one string of at most 536870888 characters, and each takes at least 3); `environmentEventItems` 1000 entries, at most 178956962 (the events go in one response body, written as one string of at most 536870888 characters, and each takes at least 3); `inlineFileBytes` 20971520 bytes, at most 402653166 (a file sent inline arrives in base64 in a body read as one string, of at most 536870888 characters); `a2aWaitMs` 300000 milliseconds, at most 2147483647 (the wait is timed with a JavaScript timer, which waits at most 2147483647 ms); `errorExcerptChars` 2000 characters, at most 163840 (the excerpt is kept in one record entry (at most 983040 bytes), where JSON may escape a character to 6); `traceContentBytes` 8192 bytes, at most 983040 (span content is cut from one record entry, which holds at most 983040 bytes); `environmentLabels` 32 entries, at most 59652320 (labels arrive in one request body, read as one string of at most 536870888 characters, and each takes at least 9); `artifactLabels` 32 entries, at most 59652320 (labels arrive in one request body, read as one string of at most 536870888 characters, and each takes at least 9); `labelKeyChars` 63 characters, at most 536870888 (a label key arrives in one request body, read as one string of at most 536870888 characters); `labelValueChars` 256 characters, at most 536870888 (a label value arrives in one request body, read as one string of at most 536870888 characters); `environmentSetupCommands` 16 entries, at most 33554430 (setup commands arrive in one request body, read as one string of at most 536870888 characters, and each takes at least 16); `environmentFiles` 16 entries, at most 16268814 (input file entries arrive in one request body, read as one string of at most 536870888 characters, and each takes at least 33); `environmentFilesPerEntry` 1000 entries, at most 6710886 (the files of an entry arrive in one request body, read as one string of at most 536870888 characters, and each takes at least 80); `environmentSecretSlots` 64 entries, at most 14128181 (secret slots arrive in one request body, read as one string of at most 536870888 characters, and each takes at least 38); `setupCommandChars` 4096 characters, at most 43690 (a command runs as one argument of /bin/sh -c, which Linux takes up to 131072 bytes long (MAX_ARG_STRLEN, with its NUL), and UTF-8 may take 3 bytes for a character); `setupCommandMs` 1800000 milliseconds, at most 2147483647 (the engine times a command with a JavaScript timer, which waits at most 2147483647 ms); `setupOutputChars` 4096 characters, at most 163840 (the output is kept in one record entry (at most 983040 bytes), where JSON may escape a character to 6); `setupReasonChars` 500 characters, at most 163840 (the reason is kept in one record entry (at most 983040 bytes), where JSON may escape a character to 6); `setupCommandExcerptChars` 80 characters, at most 163840 (the reason is kept in one record entry (at most 983040 bytes), where JSON may escape a character to 6); `manifestDescriptionChars` 1024 characters, at most 536870888 (a description arrives in one request body, read as one string of at most 536870888 characters); `secretDescriptionChars` 500 characters, at most 536870888 (a description arrives in one request body, read as one string of at most 536870888 characters); `secretValueChars` 8192 characters, at most 536870888 (a value arrives in one request body, read as one string of at most 536870888 characters); `secretHosts` 32 entries, at most 89478481 (hosts arrive in one request body, read as one string of at most 536870888 characters, and each takes at least 6); `diskVersionEntries` 200000 entries, at most 1917396 (a disk is listed in one Harness API frame (67108864 bytes, each entry at least 35), and a version's manifest is read as one string of at most 536870888 characters); `diskVersionBytes` 10737418240 bytes, at most 9007199254740991 (the files' sizes are added up in a JavaScript number, exact up to 9007199254740991); `diskLeaseMs` 120000 milliseconds, at most 2147483647 (the lease is renewed with a JavaScript timer, which waits at most 2147483647 ms); `diskPodWaitMs` 60000 milliseconds, at most 9007199254740991 (the deadline is reckoned from the clock in a JavaScript number, exact up to 9007199254740991); `modelRequestMs` 600000 milliseconds, at most 2147483647 (the provider's SDK times the request with a JavaScript timer, which waits at most 2147483647 ms); `modelIdleMs` 300000 milliseconds, at most 2147483647 (the stream's silence is timed with a JavaScript timer, which waits at most 2147483647 ms); `modelAttempts` 3 attempts, at most 9007199254740991 (attempts are counted in a JavaScript number, exact up to 9007199254740991); `modelRetryDelayMs` 2000 milliseconds, at most 2147483647 (the delay is waited with a JavaScript timer, which waits at most 2147483647 ms); `modelProviderRetries` 2 retries, at most 9007199254740991 (retries are counted in a JavaScript number, exact up to 9007199254740991); `modelRetryDelayMaxMs` 60000 milliseconds, at most 2147483647 (the delay is waited with a JavaScript timer, which waits at most 2147483647 ms); `toolAttempts` 3 attempts, at most 9007199254740991 (sends are counted in a JavaScript number, exact up to 9007199254740991); `httpToolTimeoutMs` 300000 milliseconds, at most 2147483647 (the call is timed with a JavaScript timer, which waits at most 2147483647 ms); `mcpSnapshotBytes` 4194304 bytes, at most 16777216 (the facts cross in turn.start, one Harness API frame (67108864 bytes), beside the harness's state (at most half of it) and the rest); `mcpPreviewMs` 15000 milliseconds, at most 2147483647 (the preview is timed with a JavaScript timer, which waits at most 2147483647 ms); `mcpMetadataBytes` 65536 bytes, at most 536870888 (the document is read as one string, of at most 536870888 characters); `toolRules` 200 entries, at most 28256362 (rules arrive in one request body, read as one string of at most 536870888 characters, and each takes at least 19); `toolRuleFieldChars` 200 characters, at most 536870888 (a selector arrives in one request body, read as one string of at most 536870888 characters); `toolRuleTextChars` 500 characters, at most 536870888 (a text arrives in one request body, read as one string of at most 536870888 characters); `modelBudgets` 100 entries, at most 28256362 (budgets arrive in one request body, read as one string of at most 536870888 characters, and each takes at least 19); `triggersPerAgent` 20 entries, at most 8521760 (triggers arrive in one request body, read as one string of at most 536870888 characters, and each takes at least 63); `triggerMinIntervalMs` 60000 milliseconds, at most 9007199254740991 (the gap is reckoned from the clock in a JavaScript number, exact up to 9007199254740991); `triggerRunsPerHour` 60 runs, at most 9007199254740991 (runs are counted in a JavaScript number, exact up to 9007199254740991); `triggerJitterPercent` 10 percent, at most 50 (an offset past half the interval could move a run past the next one); `triggerJitterMaxMs` 300000 milliseconds, at most 2147483647 (the offset is waited with a JavaScript timer, which waits at most 2147483647 ms); `triggerPromptChars` 8000 characters, at most 163840 (the prompt is kept in one record entry (at most 983040 bytes), where JSON may escape a character to 6); `triggerRunRetentionMs` 2592000000 milliseconds, at most 9007199254740991 (the age is reckoned from the clock in a JavaScript number, exact up to 9007199254740991); `wakeMaxAheadMs` 2592000000 milliseconds, at most 9007199254740991 (the time is reckoned from the clock in a JavaScript number, exact up to 9007199254740991); `wakeNoteChars` 2000 characters, at most 163840 (the note is kept in one record entry (at most 983040 bytes), where JSON may escape a character to 6); `memoryBytes` 102400 bytes, at most 33554432 (a memory reaches a harness in one Harness API frame (67108864 bytes), as JSON, whose escapes may double it); `memoriesPerAgent` 10000 entries, at most 9007199254740991 (memories are counted in a JavaScript number, exact up to 9007199254740991); `memoryIndexLines` 200 entries, at most 9007199254740991 (the lines are counted in a JavaScript number, exact up to 9007199254740991); `memoryIndexBytes` 25600 bytes, at most 16777216 (the index crosses in turn.start, one Harness API frame (67108864 bytes), beside the harness's state and the rest); `webhookBodyBytes` 262144 bytes, at most 983040 (the payload goes into one record entry, which holds at most 983040 bytes); `sessionQueuedMessages` 100 entries, at most 9007199254740991 (queued messages are counted in a JavaScript number, exact up to 9007199254740991); `flowConcurrency` 8 effects, at most 9007199254740991 (running effects are counted in a JavaScript number, exact up to 9007199254740991); `flowMapItems` 1000 entries, at most 9007199254740991 (items are counted in a JavaScript number, exact up to 9007199254740991); `flowLoopIterations` 100 iterations, at most 9007199254740991 (iterations are counted in a JavaScript number, exact up to 9007199254740991).",
+        "description": "The sizes, counts and deadlines the Runtime holds what crosses it to: the Tenant's (Tenant setting `limits.config`), with the default for each it leaves out. Harnesses get the ones they must respect in `turn.start.limits` (record entry, model call, model file, tool answer, custom harness state, Harness API chunk, folder entries). Defaults and ceilings: `recordEntryBytes` 983040 bytes, at most 983040 (S2 takes records of at most 1048576 bytes, and an event's envelope needs 65536 beside its payload); `modelCallBytes` 33554432 bytes, at most 536870888 (the Model Gate reads a call's body as one string, of at most 536870888 characters); `modelFileBytes` 8388608 bytes, at most 402653166 (a file goes to the provider as one base64 string, of at most 536870888 characters); `toolAnswerBytes` 8388608 bytes, at most 33554432 (a harness reports the answer to core in one Harness API frame (67108864 bytes), as JSON, whose escapes may double it); `harnessStateBytes` 262144 bytes, at most 33554432 (the state crosses in one Harness API frame (67108864 bytes) with the rest of its output or turn.start); `chunkBytes` 16777216 bytes, at most 50266112 (a chunk crosses in base64 in one Harness API frame (67108864 bytes), with room for the frame's own JSON); `folderEntries` 10000 entries, at most 4628197 (a folder's manifest is read as one string, of at most 536870888 characters, and each entry takes at least 116); `requestBodyBytes` 1048576 bytes, at most 536870888 (a body is read as one string, of at most 536870888 characters); `messageParts` 32 entries, at most 19884106 (parts arrive in one request body, read as one string of at most 536870888 characters, and each takes at least 27); `pageItems` 200 entries, at most 178956962 (a page's items go in one response body, written as one string of at most 536870888 characters, and each takes at least 3); `exportPageItems` 1000 entries, at most 178956962 (a page's calls go in one response body, written as one string of at most 536870888 characters, and each takes at least 3); `environmentEventItems` 1000 entries, at most 178956962 (the events go in one response body, written as one string of at most 536870888 characters, and each takes at least 3); `inlineFileBytes` 20971520 bytes, at most 402653166 (a file sent inline arrives in base64 in a body read as one string, of at most 536870888 characters); `a2aWaitMs` 300000 milliseconds, at most 2147483647 (the wait is timed with a JavaScript timer, which waits at most 2147483647 ms); `errorExcerptChars` 2000 characters, at most 163840 (the excerpt is kept in one record entry (at most 983040 bytes), where JSON may escape a character to 6); `traceContentBytes` 8192 bytes, at most 983040 (span content is cut from one record entry, which holds at most 983040 bytes); `environmentLabels` 32 entries, at most 59652320 (labels arrive in one request body, read as one string of at most 536870888 characters, and each takes at least 9); `artifactLabels` 32 entries, at most 59652320 (labels arrive in one request body, read as one string of at most 536870888 characters, and each takes at least 9); `labelKeyChars` 63 characters, at most 536870888 (a label key arrives in one request body, read as one string of at most 536870888 characters); `labelValueChars` 256 characters, at most 536870888 (a label value arrives in one request body, read as one string of at most 536870888 characters); `environmentSetupCommands` 16 entries, at most 33554430 (setup commands arrive in one request body, read as one string of at most 536870888 characters, and each takes at least 16); `environmentFiles` 16 entries, at most 16268814 (input file entries arrive in one request body, read as one string of at most 536870888 characters, and each takes at least 33); `environmentFilesPerEntry` 1000 entries, at most 6710886 (the files of an entry arrive in one request body, read as one string of at most 536870888 characters, and each takes at least 80); `environmentSecretSlots` 64 entries, at most 14128181 (secret slots arrive in one request body, read as one string of at most 536870888 characters, and each takes at least 38); `setupCommandChars` 4096 characters, at most 43690 (a command runs as one argument of /bin/sh -c, which Linux takes up to 131072 bytes long (MAX_ARG_STRLEN, with its NUL), and UTF-8 may take 3 bytes for a character); `setupCommandMs` 1800000 milliseconds, at most 2147483647 (the engine times a command with a JavaScript timer, which waits at most 2147483647 ms); `setupOutputChars` 4096 characters, at most 163840 (the output is kept in one record entry (at most 983040 bytes), where JSON may escape a character to 6); `setupReasonChars` 500 characters, at most 163840 (the reason is kept in one record entry (at most 983040 bytes), where JSON may escape a character to 6); `setupCommandExcerptChars` 80 characters, at most 163840 (the reason is kept in one record entry (at most 983040 bytes), where JSON may escape a character to 6); `manifestDescriptionChars` 1024 characters, at most 536870888 (a description arrives in one request body, read as one string of at most 536870888 characters); `secretDescriptionChars` 500 characters, at most 536870888 (a description arrives in one request body, read as one string of at most 536870888 characters); `secretValueChars` 8192 characters, at most 536870888 (a value arrives in one request body, read as one string of at most 536870888 characters); `secretHosts` 32 entries, at most 89478481 (hosts arrive in one request body, read as one string of at most 536870888 characters, and each takes at least 6); `diskVersionEntries` 200000 entries, at most 1917396 (a disk is listed in one Harness API frame (67108864 bytes, each entry at least 35), and a version's manifest is read as one string of at most 536870888 characters); `diskVersionBytes` 10737418240 bytes, at most 9007199254740991 (the files' sizes are added up in a JavaScript number, exact up to 9007199254740991); `diskLeaseMs` 120000 milliseconds, at most 2147483647 (the lease is renewed with a JavaScript timer, which waits at most 2147483647 ms); `diskPodWaitMs` 60000 milliseconds, at most 9007199254740991 (the deadline is reckoned from the clock in a JavaScript number, exact up to 9007199254740991); `modelRequestMs` 600000 milliseconds, at most 2147483647 (the provider's SDK times the request with a JavaScript timer, which waits at most 2147483647 ms); `modelIdleMs` 300000 milliseconds, at most 2147483647 (the stream's silence is timed with a JavaScript timer, which waits at most 2147483647 ms); `modelAttempts` 3 attempts, at most 9007199254740991 (attempts are counted in a JavaScript number, exact up to 9007199254740991); `modelRetryDelayMs` 2000 milliseconds, at most 2147483647 (the delay is waited with a JavaScript timer, which waits at most 2147483647 ms); `modelProviderRetries` 2 retries, at most 9007199254740991 (retries are counted in a JavaScript number, exact up to 9007199254740991); `modelRetryDelayMaxMs` 60000 milliseconds, at most 2147483647 (the delay is waited with a JavaScript timer, which waits at most 2147483647 ms); `toolAttempts` 3 attempts, at most 9007199254740991 (sends are counted in a JavaScript number, exact up to 9007199254740991); `httpToolTimeoutMs` 300000 milliseconds, at most 2147483647 (the call is timed with a JavaScript timer, which waits at most 2147483647 ms); `mcpSnapshotBytes` 4194304 bytes, at most 16777216 (the facts cross in turn.start, one Harness API frame (67108864 bytes), beside the harness's state (at most half of it) and the rest); `mcpPreviewMs` 15000 milliseconds, at most 2147483647 (the preview is timed with a JavaScript timer, which waits at most 2147483647 ms); `mcpMetadataBytes` 65536 bytes, at most 536870888 (the document is read as one string, of at most 536870888 characters); `toolRules` 200 entries, at most 28256362 (rules arrive in one request body, read as one string of at most 536870888 characters, and each takes at least 19); `toolRuleFieldChars` 200 characters, at most 536870888 (a selector arrives in one request body, read as one string of at most 536870888 characters); `toolRuleTextChars` 500 characters, at most 536870888 (a text arrives in one request body, read as one string of at most 536870888 characters); `modelBudgets` 100 entries, at most 28256362 (budgets arrive in one request body, read as one string of at most 536870888 characters, and each takes at least 19); `triggersPerAgent` 20 entries, at most 8521760 (triggers arrive in one request body, read as one string of at most 536870888 characters, and each takes at least 63); `triggerMinIntervalMs` 60000 milliseconds, at most 9007199254740991 (the gap is reckoned from the clock in a JavaScript number, exact up to 9007199254740991); `triggerRunsPerHour` 60 runs, at most 9007199254740991 (runs are counted in a JavaScript number, exact up to 9007199254740991); `triggerJitterPercent` 10 percent, at most 50 (an offset past half the interval could move a run past the next one); `triggerJitterMaxMs` 300000 milliseconds, at most 2147483647 (the offset is waited with a JavaScript timer, which waits at most 2147483647 ms); `triggerPromptChars` 8000 characters, at most 163840 (the prompt is kept in one record entry (at most 983040 bytes), where JSON may escape a character to 6); `triggerRunRetentionMs` 2592000000 milliseconds, at most 9007199254740991 (the age is reckoned from the clock in a JavaScript number, exact up to 9007199254740991); `wakeMaxAheadMs` 2592000000 milliseconds, at most 9007199254740991 (the time is reckoned from the clock in a JavaScript number, exact up to 9007199254740991); `wakeNoteChars` 2000 characters, at most 163840 (the note is kept in one record entry (at most 983040 bytes), where JSON may escape a character to 6); `memoryBytes` 102400 bytes, at most 33554432 (a memory reaches a harness in one Harness API frame (67108864 bytes), as JSON, whose escapes may double it); `memoriesPerAgent` 10000 entries, at most 9007199254740991 (memories are counted in a JavaScript number, exact up to 9007199254740991); `memoryIndexLines` 200 entries, at most 9007199254740991 (the lines are counted in a JavaScript number, exact up to 9007199254740991); `memoryIndexBytes` 25600 bytes, at most 16777216 (the index crosses in turn.start, one Harness API frame (67108864 bytes), beside the harness's state and the rest); `webhookBodyBytes` 262144 bytes, at most 983040 (the payload goes into one record entry, which holds at most 983040 bytes); `sessionQueuedMessages` 100 entries, at most 9007199254740991 (queued messages are counted in a JavaScript number, exact up to 9007199254740991); `flowConcurrency` 8 effects, at most 9007199254740991 (running effects are counted in a JavaScript number, exact up to 9007199254740991); `flowMapItems` 1000 entries, at most 9007199254740991 (items are counted in a JavaScript number, exact up to 9007199254740991); `flowLoopIterations` 100 iterations, at most 9007199254740991 (iterations are counted in a JavaScript number, exact up to 9007199254740991); `folderFiles` 2000 entries, at most 5478274 (a folder's files arrive in one request body, read as one string of at most 536870888 characters, and each takes at least 98); `folderBytes` 52428800 bytes, at most 9007199254740991 (the files' sizes are added up in a JavaScript number, exact up to 9007199254740991); `folderTextFileBytes` 1048576 bytes, at most 536870888 (the compiler reads a file as one string, of at most 536870888 characters).",
         "security": [
           {
             "managementKey": []
@@ -7428,7 +7510,7 @@
           "Settings"
         ],
         "summary": "Set the Tenant's Runtime limits",
-        "description": "Replaces the Tenant's Runtime limits: a limit left out takes its default. A limit above its ceiling, which a dependency sets, is `400` naming the ceiling, and nothing is written. Each is read where it is checked, so a new value holds for the next request, write, call or segment. Defaults and ceilings: `recordEntryBytes` 983040 bytes, at most 983040 (S2 takes records of at most 1048576 bytes, and an event's envelope needs 65536 beside its payload); `modelCallBytes` 33554432 bytes, at most 536870888 (the Model Gate reads a call's body as one string, of at most 536870888 characters); `modelFileBytes` 8388608 bytes, at most 402653166 (a file goes to the provider as one base64 string, of at most 536870888 characters); `toolAnswerBytes` 8388608 bytes, at most 33554432 (a harness reports the answer to core in one Harness API frame (67108864 bytes), as JSON, whose escapes may double it); `harnessStateBytes` 262144 bytes, at most 33554432 (the state crosses in one Harness API frame (67108864 bytes) with the rest of its output or turn.start); `chunkBytes` 16777216 bytes, at most 50266112 (a chunk crosses in base64 in one Harness API frame (67108864 bytes), with room for the frame's own JSON); `folderEntries` 10000 entries, at most 4628197 (a folder's manifest is read as one string, of at most 536870888 characters, and each entry takes at least 116); `requestBodyBytes` 1048576 bytes, at most 536870888 (a body is read as one string, of at most 536870888 characters); `messageParts` 32 entries, at most 19884106 (parts arrive in one request body, read as one string of at most 536870888 characters, and each takes at least 27); `pageItems` 200 entries, at most 178956962 (a page's items go in one response body, written as one string of at most 536870888 characters, and each takes at least 3); `exportPageItems` 1000 entries, at most 178956962 (a page's calls go in one response body, written as one string of at most 536870888 characters, and each takes at least 3); `environmentEventItems` 1000 entries, at most 178956962 (the events go in one response body, written as one string of at most 536870888 characters, and each takes at least 3); `inlineFileBytes` 20971520 bytes, at most 402653166 (a file sent inline arrives in base64 in a body read as one string, of at most 536870888 characters); `a2aWaitMs` 300000 milliseconds, at most 2147483647 (the wait is timed with a JavaScript timer, which waits at most 2147483647 ms); `errorExcerptChars` 2000 characters, at most 163840 (the excerpt is kept in one record entry (at most 983040 bytes), where JSON may escape a character to 6); `traceContentBytes` 8192 bytes, at most 983040 (span content is cut from one record entry, which holds at most 983040 bytes); `environmentLabels` 32 entries, at most 59652320 (labels arrive in one request body, read as one string of at most 536870888 characters, and each takes at least 9); `artifactLabels` 32 entries, at most 59652320 (labels arrive in one request body, read as one string of at most 536870888 characters, and each takes at least 9); `labelKeyChars` 63 characters, at most 536870888 (a label key arrives in one request body, read as one string of at most 536870888 characters); `labelValueChars` 256 characters, at most 536870888 (a label value arrives in one request body, read as one string of at most 536870888 characters); `environmentSetupCommands` 16 entries, at most 33554430 (setup commands arrive in one request body, read as one string of at most 536870888 characters, and each takes at least 16); `environmentFiles` 16 entries, at most 16268814 (input file entries arrive in one request body, read as one string of at most 536870888 characters, and each takes at least 33); `environmentFilesPerEntry` 1000 entries, at most 6710886 (the files of an entry arrive in one request body, read as one string of at most 536870888 characters, and each takes at least 80); `environmentSecretSlots` 64 entries, at most 14128181 (secret slots arrive in one request body, read as one string of at most 536870888 characters, and each takes at least 38); `setupCommandChars` 4096 characters, at most 43690 (a command runs as one argument of /bin/sh -c, which Linux takes up to 131072 bytes long (MAX_ARG_STRLEN, with its NUL), and UTF-8 may take 3 bytes for a character); `setupCommandMs` 1800000 milliseconds, at most 2147483647 (the engine times a command with a JavaScript timer, which waits at most 2147483647 ms); `setupOutputChars` 4096 characters, at most 163840 (the output is kept in one record entry (at most 983040 bytes), where JSON may escape a character to 6); `setupReasonChars` 500 characters, at most 163840 (the reason is kept in one record entry (at most 983040 bytes), where JSON may escape a character to 6); `setupCommandExcerptChars` 80 characters, at most 163840 (the reason is kept in one record entry (at most 983040 bytes), where JSON may escape a character to 6); `manifestDescriptionChars` 1024 characters, at most 536870888 (a description arrives in one request body, read as one string of at most 536870888 characters); `secretDescriptionChars` 500 characters, at most 536870888 (a description arrives in one request body, read as one string of at most 536870888 characters); `secretValueChars` 8192 characters, at most 536870888 (a value arrives in one request body, read as one string of at most 536870888 characters); `secretHosts` 32 entries, at most 89478481 (hosts arrive in one request body, read as one string of at most 536870888 characters, and each takes at least 6); `diskVersionEntries` 200000 entries, at most 1917396 (a disk is listed in one Harness API frame (67108864 bytes, each entry at least 35), and a version's manifest is read as one string of at most 536870888 characters); `diskVersionBytes` 10737418240 bytes, at most 9007199254740991 (the files' sizes are added up in a JavaScript number, exact up to 9007199254740991); `diskLeaseMs` 120000 milliseconds, at most 2147483647 (the lease is renewed with a JavaScript timer, which waits at most 2147483647 ms); `diskPodWaitMs` 60000 milliseconds, at most 9007199254740991 (the deadline is reckoned from the clock in a JavaScript number, exact up to 9007199254740991); `modelRequestMs` 600000 milliseconds, at most 2147483647 (the provider's SDK times the request with a JavaScript timer, which waits at most 2147483647 ms); `modelIdleMs` 300000 milliseconds, at most 2147483647 (the stream's silence is timed with a JavaScript timer, which waits at most 2147483647 ms); `modelAttempts` 3 attempts, at most 9007199254740991 (attempts are counted in a JavaScript number, exact up to 9007199254740991); `modelRetryDelayMs` 2000 milliseconds, at most 2147483647 (the delay is waited with a JavaScript timer, which waits at most 2147483647 ms); `modelProviderRetries` 2 retries, at most 9007199254740991 (retries are counted in a JavaScript number, exact up to 9007199254740991); `modelRetryDelayMaxMs` 60000 milliseconds, at most 2147483647 (the delay is waited with a JavaScript timer, which waits at most 2147483647 ms); `toolAttempts` 3 attempts, at most 9007199254740991 (sends are counted in a JavaScript number, exact up to 9007199254740991); `httpToolTimeoutMs` 300000 milliseconds, at most 2147483647 (the call is timed with a JavaScript timer, which waits at most 2147483647 ms); `mcpSnapshotBytes` 4194304 bytes, at most 16777216 (the facts cross in turn.start, one Harness API frame (67108864 bytes), beside the harness's state (at most half of it) and the rest); `mcpPreviewMs` 15000 milliseconds, at most 2147483647 (the preview is timed with a JavaScript timer, which waits at most 2147483647 ms); `mcpMetadataBytes` 65536 bytes, at most 536870888 (the document is read as one string, of at most 536870888 characters); `toolRules` 200 entries, at most 28256362 (rules arrive in one request body, read as one string of at most 536870888 characters, and each takes at least 19); `toolRuleFieldChars` 200 characters, at most 536870888 (a selector arrives in one request body, read as one string of at most 536870888 characters); `toolRuleTextChars` 500 characters, at most 536870888 (a text arrives in one request body, read as one string of at most 536870888 characters); `modelBudgets` 100 entries, at most 28256362 (budgets arrive in one request body, read as one string of at most 536870888 characters, and each takes at least 19); `triggersPerAgent` 20 entries, at most 8521760 (triggers arrive in one request body, read as one string of at most 536870888 characters, and each takes at least 63); `triggerMinIntervalMs` 60000 milliseconds, at most 9007199254740991 (the gap is reckoned from the clock in a JavaScript number, exact up to 9007199254740991); `triggerRunsPerHour` 60 runs, at most 9007199254740991 (runs are counted in a JavaScript number, exact up to 9007199254740991); `triggerJitterPercent` 10 percent, at most 50 (an offset past half the interval could move a run past the next one); `triggerJitterMaxMs` 300000 milliseconds, at most 2147483647 (the offset is waited with a JavaScript timer, which waits at most 2147483647 ms); `triggerPromptChars` 8000 characters, at most 163840 (the prompt is kept in one record entry (at most 983040 bytes), where JSON may escape a character to 6); `triggerRunRetentionMs` 2592000000 milliseconds, at most 9007199254740991 (the age is reckoned from the clock in a JavaScript number, exact up to 9007199254740991); `wakeMaxAheadMs` 2592000000 milliseconds, at most 9007199254740991 (the time is reckoned from the clock in a JavaScript number, exact up to 9007199254740991); `wakeNoteChars` 2000 characters, at most 163840 (the note is kept in one record entry (at most 983040 bytes), where JSON may escape a character to 6); `memoryBytes` 102400 bytes, at most 33554432 (a memory reaches a harness in one Harness API frame (67108864 bytes), as JSON, whose escapes may double it); `memoriesPerAgent` 10000 entries, at most 9007199254740991 (memories are counted in a JavaScript number, exact up to 9007199254740991); `memoryIndexLines` 200 entries, at most 9007199254740991 (the lines are counted in a JavaScript number, exact up to 9007199254740991); `memoryIndexBytes` 25600 bytes, at most 16777216 (the index crosses in turn.start, one Harness API frame (67108864 bytes), beside the harness's state and the rest); `webhookBodyBytes` 262144 bytes, at most 983040 (the payload goes into one record entry, which holds at most 983040 bytes); `sessionQueuedMessages` 100 entries, at most 9007199254740991 (queued messages are counted in a JavaScript number, exact up to 9007199254740991); `flowConcurrency` 8 effects, at most 9007199254740991 (running effects are counted in a JavaScript number, exact up to 9007199254740991); `flowMapItems` 1000 entries, at most 9007199254740991 (items are counted in a JavaScript number, exact up to 9007199254740991); `flowLoopIterations` 100 iterations, at most 9007199254740991 (iterations are counted in a JavaScript number, exact up to 9007199254740991).",
+        "description": "Replaces the Tenant's Runtime limits: a limit left out takes its default. A limit above its ceiling, which a dependency sets, is `400` naming the ceiling, and nothing is written. Each is read where it is checked, so a new value holds for the next request, write, call or segment. Defaults and ceilings: `recordEntryBytes` 983040 bytes, at most 983040 (S2 takes records of at most 1048576 bytes, and an event's envelope needs 65536 beside its payload); `modelCallBytes` 33554432 bytes, at most 536870888 (the Model Gate reads a call's body as one string, of at most 536870888 characters); `modelFileBytes` 8388608 bytes, at most 402653166 (a file goes to the provider as one base64 string, of at most 536870888 characters); `toolAnswerBytes` 8388608 bytes, at most 33554432 (a harness reports the answer to core in one Harness API frame (67108864 bytes), as JSON, whose escapes may double it); `harnessStateBytes` 262144 bytes, at most 33554432 (the state crosses in one Harness API frame (67108864 bytes) with the rest of its output or turn.start); `chunkBytes` 16777216 bytes, at most 50266112 (a chunk crosses in base64 in one Harness API frame (67108864 bytes), with room for the frame's own JSON); `folderEntries` 10000 entries, at most 4628197 (a folder's manifest is read as one string, of at most 536870888 characters, and each entry takes at least 116); `requestBodyBytes` 1048576 bytes, at most 536870888 (a body is read as one string, of at most 536870888 characters); `messageParts` 32 entries, at most 19884106 (parts arrive in one request body, read as one string of at most 536870888 characters, and each takes at least 27); `pageItems` 200 entries, at most 178956962 (a page's items go in one response body, written as one string of at most 536870888 characters, and each takes at least 3); `exportPageItems` 1000 entries, at most 178956962 (a page's calls go in one response body, written as one string of at most 536870888 characters, and each takes at least 3); `environmentEventItems` 1000 entries, at most 178956962 (the events go in one response body, written as one string of at most 536870888 characters, and each takes at least 3); `inlineFileBytes` 20971520 bytes, at most 402653166 (a file sent inline arrives in base64 in a body read as one string, of at most 536870888 characters); `a2aWaitMs` 300000 milliseconds, at most 2147483647 (the wait is timed with a JavaScript timer, which waits at most 2147483647 ms); `errorExcerptChars` 2000 characters, at most 163840 (the excerpt is kept in one record entry (at most 983040 bytes), where JSON may escape a character to 6); `traceContentBytes` 8192 bytes, at most 983040 (span content is cut from one record entry, which holds at most 983040 bytes); `environmentLabels` 32 entries, at most 59652320 (labels arrive in one request body, read as one string of at most 536870888 characters, and each takes at least 9); `artifactLabels` 32 entries, at most 59652320 (labels arrive in one request body, read as one string of at most 536870888 characters, and each takes at least 9); `labelKeyChars` 63 characters, at most 536870888 (a label key arrives in one request body, read as one string of at most 536870888 characters); `labelValueChars` 256 characters, at most 536870888 (a label value arrives in one request body, read as one string of at most 536870888 characters); `environmentSetupCommands` 16 entries, at most 33554430 (setup commands arrive in one request body, read as one string of at most 536870888 characters, and each takes at least 16); `environmentFiles` 16 entries, at most 16268814 (input file entries arrive in one request body, read as one string of at most 536870888 characters, and each takes at least 33); `environmentFilesPerEntry` 1000 entries, at most 6710886 (the files of an entry arrive in one request body, read as one string of at most 536870888 characters, and each takes at least 80); `environmentSecretSlots` 64 entries, at most 14128181 (secret slots arrive in one request body, read as one string of at most 536870888 characters, and each takes at least 38); `setupCommandChars` 4096 characters, at most 43690 (a command runs as one argument of /bin/sh -c, which Linux takes up to 131072 bytes long (MAX_ARG_STRLEN, with its NUL), and UTF-8 may take 3 bytes for a character); `setupCommandMs` 1800000 milliseconds, at most 2147483647 (the engine times a command with a JavaScript timer, which waits at most 2147483647 ms); `setupOutputChars` 4096 characters, at most 163840 (the output is kept in one record entry (at most 983040 bytes), where JSON may escape a character to 6); `setupReasonChars` 500 characters, at most 163840 (the reason is kept in one record entry (at most 983040 bytes), where JSON may escape a character to 6); `setupCommandExcerptChars` 80 characters, at most 163840 (the reason is kept in one record entry (at most 983040 bytes), where JSON may escape a character to 6); `manifestDescriptionChars` 1024 characters, at most 536870888 (a description arrives in one request body, read as one string of at most 536870888 characters); `secretDescriptionChars` 500 characters, at most 536870888 (a description arrives in one request body, read as one string of at most 536870888 characters); `secretValueChars` 8192 characters, at most 536870888 (a value arrives in one request body, read as one string of at most 536870888 characters); `secretHosts` 32 entries, at most 89478481 (hosts arrive in one request body, read as one string of at most 536870888 characters, and each takes at least 6); `diskVersionEntries` 200000 entries, at most 1917396 (a disk is listed in one Harness API frame (67108864 bytes, each entry at least 35), and a version's manifest is read as one string of at most 536870888 characters); `diskVersionBytes` 10737418240 bytes, at most 9007199254740991 (the files' sizes are added up in a JavaScript number, exact up to 9007199254740991); `diskLeaseMs` 120000 milliseconds, at most 2147483647 (the lease is renewed with a JavaScript timer, which waits at most 2147483647 ms); `diskPodWaitMs` 60000 milliseconds, at most 9007199254740991 (the deadline is reckoned from the clock in a JavaScript number, exact up to 9007199254740991); `modelRequestMs` 600000 milliseconds, at most 2147483647 (the provider's SDK times the request with a JavaScript timer, which waits at most 2147483647 ms); `modelIdleMs` 300000 milliseconds, at most 2147483647 (the stream's silence is timed with a JavaScript timer, which waits at most 2147483647 ms); `modelAttempts` 3 attempts, at most 9007199254740991 (attempts are counted in a JavaScript number, exact up to 9007199254740991); `modelRetryDelayMs` 2000 milliseconds, at most 2147483647 (the delay is waited with a JavaScript timer, which waits at most 2147483647 ms); `modelProviderRetries` 2 retries, at most 9007199254740991 (retries are counted in a JavaScript number, exact up to 9007199254740991); `modelRetryDelayMaxMs` 60000 milliseconds, at most 2147483647 (the delay is waited with a JavaScript timer, which waits at most 2147483647 ms); `toolAttempts` 3 attempts, at most 9007199254740991 (sends are counted in a JavaScript number, exact up to 9007199254740991); `httpToolTimeoutMs` 300000 milliseconds, at most 2147483647 (the call is timed with a JavaScript timer, which waits at most 2147483647 ms); `mcpSnapshotBytes` 4194304 bytes, at most 16777216 (the facts cross in turn.start, one Harness API frame (67108864 bytes), beside the harness's state (at most half of it) and the rest); `mcpPreviewMs` 15000 milliseconds, at most 2147483647 (the preview is timed with a JavaScript timer, which waits at most 2147483647 ms); `mcpMetadataBytes` 65536 bytes, at most 536870888 (the document is read as one string, of at most 536870888 characters); `toolRules` 200 entries, at most 28256362 (rules arrive in one request body, read as one string of at most 536870888 characters, and each takes at least 19); `toolRuleFieldChars` 200 characters, at most 536870888 (a selector arrives in one request body, read as one string of at most 536870888 characters); `toolRuleTextChars` 500 characters, at most 536870888 (a text arrives in one request body, read as one string of at most 536870888 characters); `modelBudgets` 100 entries, at most 28256362 (budgets arrive in one request body, read as one string of at most 536870888 characters, and each takes at least 19); `triggersPerAgent` 20 entries, at most 8521760 (triggers arrive in one request body, read as one string of at most 536870888 characters, and each takes at least 63); `triggerMinIntervalMs` 60000 milliseconds, at most 9007199254740991 (the gap is reckoned from the clock in a JavaScript number, exact up to 9007199254740991); `triggerRunsPerHour` 60 runs, at most 9007199254740991 (runs are counted in a JavaScript number, exact up to 9007199254740991); `triggerJitterPercent` 10 percent, at most 50 (an offset past half the interval could move a run past the next one); `triggerJitterMaxMs` 300000 milliseconds, at most 2147483647 (the offset is waited with a JavaScript timer, which waits at most 2147483647 ms); `triggerPromptChars` 8000 characters, at most 163840 (the prompt is kept in one record entry (at most 983040 bytes), where JSON may escape a character to 6); `triggerRunRetentionMs` 2592000000 milliseconds, at most 9007199254740991 (the age is reckoned from the clock in a JavaScript number, exact up to 9007199254740991); `wakeMaxAheadMs` 2592000000 milliseconds, at most 9007199254740991 (the time is reckoned from the clock in a JavaScript number, exact up to 9007199254740991); `wakeNoteChars` 2000 characters, at most 163840 (the note is kept in one record entry (at most 983040 bytes), where JSON may escape a character to 6); `memoryBytes` 102400 bytes, at most 33554432 (a memory reaches a harness in one Harness API frame (67108864 bytes), as JSON, whose escapes may double it); `memoriesPerAgent` 10000 entries, at most 9007199254740991 (memories are counted in a JavaScript number, exact up to 9007199254740991); `memoryIndexLines` 200 entries, at most 9007199254740991 (the lines are counted in a JavaScript number, exact up to 9007199254740991); `memoryIndexBytes` 25600 bytes, at most 16777216 (the index crosses in turn.start, one Harness API frame (67108864 bytes), beside the harness's state and the rest); `webhookBodyBytes` 262144 bytes, at most 983040 (the payload goes into one record entry, which holds at most 983040 bytes); `sessionQueuedMessages` 100 entries, at most 9007199254740991 (queued messages are counted in a JavaScript number, exact up to 9007199254740991); `flowConcurrency` 8 effects, at most 9007199254740991 (running effects are counted in a JavaScript number, exact up to 9007199254740991); `flowMapItems` 1000 entries, at most 9007199254740991 (items are counted in a JavaScript number, exact up to 9007199254740991); `flowLoopIterations` 100 iterations, at most 9007199254740991 (iterations are counted in a JavaScript number, exact up to 9007199254740991); `folderFiles` 2000 entries, at most 5478274 (a folder's files arrive in one request body, read as one string of at most 536870888 characters, and each takes at least 98); `folderBytes` 52428800 bytes, at most 9007199254740991 (the files' sizes are added up in a JavaScript number, exact up to 9007199254740991); `folderTextFileBytes` 1048576 bytes, at most 536870888 (the compiler reads a file as one string, of at most 536870888 characters).",
         "security": [
           {
             "managementKey": []

package/dist/model/descriptor.d.ts

@@ -7,7 +7,7 @@
  * gate takes cannot disagree.
  */
 import type { Api, Model } from "@earendil-works/pi-ai";
-import { type CustomModelSettings, type HostModelView, type ModelInput } from "@nylorun/core/contracts";
+import { type CustomModelSettings, type HostModelView, type ModelInput, type SessionModelChoice } from "@nylorun/core/contracts";
 import type { ModelDescriptor } from "@nylorun/core/harness-api";
 import type { SessionStore } from "../store/types.js";
 import { type Selection } from "./models.js";
@@ -36,14 +36,15 @@ export declare const FIXTURE_DESCRIPTOR: ModelDescriptor;
 export declare function hostModelDescriptor(binding: ModelBindingView, added?: Readonly<Record<string, readonly ModelInput[]>>): ModelDescriptor | undefined;
 /**
  * The model the Tenant's turns use now: the fixture model's descriptor when the Tenant uses it,
- * else its active model's; undefined when none is configured (a test's scripted provider, say).
+ * else a session's own model's (`choice`, while its provider is connected), else its active
+ * model's; undefined when none is configured (a test's scripted provider, say).
  */
 export declare function currentModelDescriptor(ctx: {
     readonly store: SessionStore;
     readonly vault: {
-        getHostModel(): Promise<HostModelView>;
+        getHostModel(choice?: SessionModelChoice): Promise<HostModelView>;
     };
-}): Promise<ModelDescriptor | undefined>;
+}, choice?: SessionModelChoice): Promise<ModelDescriptor | undefined>;
 /**
  * The context window, in tokens, of the Tenant's model now; without one, or one the catalog does
  * not know, it is assumed small (`CUSTOM_MODEL_SETTING_DEFAULTS`), as for a custom endpoint.

package/dist/model/descriptor.js

@@ -62,16 +62,17 @@ export function hostModelDescriptor(binding, added = {}) {
 }
 /**
  * The model the Tenant's turns use now: the fixture model's descriptor when the Tenant uses it,
- * else its active model's; undefined when none is configured (a test's scripted provider, say).
+ * else a session's own model's (`choice`, while its provider is connected), else its active
+ * model's; undefined when none is configured (a test's scripted provider, say).
  */
-export async function currentModelDescriptor(ctx) {
+export async function currentModelDescriptor(ctx, choice) {
     const { fixture, added } = await ctx.store.tx(async (t) => ({
         fixture: await usesFixtureModel(t),
         added: await readAddedInputs(t),
     }));
     if (fixture)
         return FIXTURE_DESCRIPTOR;
-    const view = await ctx.vault.getHostModel();
+    const view = await ctx.vault.getHostModel(choice);
     return view.configured ? hostModelDescriptor(view, added) : undefined;
 }
 /**

package/dist/model/pi-model.js

@@ -8,6 +8,7 @@ import { classifyAssistantError, failure } from "./classify.js";
 import { addedInputsOf, describeModel, selectionOf } from "./descriptor.js";
 import { modelsFor } from "./models.js";
 import { callHeaders } from "./call-headers.js";
+import { hostIdentityRefused, VERTEX_ADC_MARKER } from "../vault/host-identity.js";
 import { workloadToken, WorkloadTokenUnavailable } from "../vault/workload-token.js";
 import { NativeBlocks, nativeKindsOf } from "./native-blocks.js";
 import { projectSecrets } from "./settings.js";
@@ -67,6 +68,12 @@ export function piModel(options = {}) {
                 throw error;
             }
         }
+        // The Host's identity (ADR-71): only while its operator still lends it.
+        if (stored.authType === "host_identity") {
+            const refused = hostIdentityRefused(stored.provider);
+            if (refused)
+                return failure("auth", refused, false);
+        }
         const secrets = [
             ...projectSecrets(root),
             ...credentialSecrets(stored.credential),
@@ -119,6 +126,8 @@ export function piModel(options = {}) {
             sessionId: call.executionId,
             cacheRetention: "short",
             ...(Object.keys(perCall).length > 0 ? { headers: perCall } : {}),
+            // With the Host's identity: where Agent Platform runs the call (ADR-71).
+            ...(stored.authType === "host_identity" && stored.credential.env ? { env: stored.credential.env } : {}),
             timeoutMs: settings.requestTimeoutMs,
             maxRetries: settings.providerRetries,
             maxRetryDelayMs: settings.maxRetryDelayMs,
@@ -504,7 +513,11 @@ function idleTimeout(selected, idleTimeoutMs) {
     };
 }
 function hostCredentialStore(stored, write) {
-    let current = stored.credential;
+    // The Host's identity (ADR-71): pi-ai's Vertex AI client uses Application Default Credentials
+    // for this marker in place of a key.
+    let current = stored.authType === "host_identity"
+        ? { type: "api_key", key: VERTEX_ADC_MARKER }
+        : stored.credential;
     // A workload model stores no credential: pi-ai then asks the provider's `resolve` (`modelsFor`).
     const stores = stored.authType !== "workload";
     return {
@@ -532,6 +545,9 @@ function hostCredentialStore(stored, write) {
     };
 }
 function credentialSecrets(credential) {
+    // The Host's identity keeps no secret: its project and location stay readable in messages.
+    if (credential.type === "host_identity")
+        return [];
     const values = [credential.key, credential.access, credential.refresh];
     if (credential.env)
         values.push(...Object.values(credential.env));