@nylorun/runtime 0.32.0-beta → 0.33.0-beta

package/CHANGELOG.md

@@ -1,5 +1,25 @@
 # Changelog
 
+## 0.33.0-beta
+
+### Minor Changes
+
+- 95f98f1: A model can use the Host's own identity (ADR-71, Host feature `model-host-identity`). `PUT /v1/tenant/model` takes `auth: { type: "host_identity", project, location }` for `google-vertex`. It keeps no secret, and the model gate calls Agent Platform with the Host's Google Application Default Credentials: on Google Cloud, the attached service account from the metadata server. It's off unless the operator lists the provider in `NYLORUN_MODEL_HOST_IDENTITY` on the process that runs the gates, which `nylorun start` passes from its shell to the `gateway` container. Every Tenant on that Host may use it. `nylorun tenant models set --provider google-vertex --model <id> --host-identity --project <id> --location <location>` sets it with no key.
+- d99b3ac: A session can have its own model (optional Host feature `session-model`). `PUT /v1/sessions/{id}/model` chooses one of a connected provider's models for that session's turns, `DELETE` clears it, and `GET` answers the model the next turn uses (`source: "session"` or `"tenant"`). The Tenant's model and every other session's stay as they are. The Model Gate calls the session's model on its provider's credential (a refreshed OAuth credential is written back to that provider), `turn.start.model` describes it, and the usage ledger records it. A choice names a connected provider and a model its catalog lists, is set by the application only (a trusted issuer's token can read it, not change it), and is refused while a turn runs or waits (`409 session_busy`); while its provider is disconnected the session uses the Tenant's model. The SDK adds `session.model()`, `setModel({ provider, model })` and `clearModel()`.
+
+  Studio's model picker under the message box now sets the model of that session only, instead of the Tenant's: "Tenant model" clears the session's choice, the picker is locked while a turn runs, it groups models by provider, and its search keeps what is typed. A Runtime without `session-model` shows no picker.
+
+### Patch Changes
+
+- 683de1a: The model catalog comes from pi-ai 1.3.0, which adds Gemini 4 Argon: `google-vertex/gemini-4-argon` on Google's Agent Platform (Vertex AI) and `google/gemini-4-argon` on the Gemini API, with a 1,048,576-token context and thinking. `nylorun tenant models set --provider google-vertex --model gemini-4-argon` takes a Google Cloud API key for the Agent Platform API; the Runtime still reads no ambient Google credentials.
+- Pin core to the tested release.
+- Pin harness to the tested release.
+- Updated dependencies [95f98f1]
+- Updated dependencies [d99b3ac]
+- Updated dependencies
+  - @nylorun/core@0.29.0-beta
+  - @nylorun/harness@0.29.5-beta
+
 ## 0.32.0-beta
 
 ### Minor Changes

package/dist/api/components.d.ts

@@ -2421,6 +2421,30 @@ export declare const SessionView: z.ZodObject<{
         error: z.ZodUnknown;
     }, z.core.$strict>>;
 }, z.core.$strict>;
+export declare const PutSessionModelRequest: z.ZodObject<{
+    provider: z.ZodString;
+    model: z.ZodString;
+}, z.core.$strict>;
+export declare const SessionModelView: z.ZodUnion<readonly [z.ZodObject<{
+    configured: z.ZodLiteral<false>;
+    choice: z.ZodOptional<z.ZodObject<{
+        provider: z.ZodString;
+        model: z.ZodString;
+    }, z.core.$strict>>;
+}, z.core.$strict>, z.ZodObject<{
+    configured: z.ZodLiteral<true>;
+    source: z.ZodEnum<{
+        session: "session";
+        tenant: "tenant";
+    }>;
+    provider: z.ZodString;
+    model: z.ZodString;
+    baseUrl: z.ZodOptional<z.ZodString>;
+    choice: z.ZodOptional<z.ZodObject<{
+        provider: z.ZodString;
+        model: z.ZodString;
+    }, z.core.$strict>>;
+}, z.core.$strict>]>;
 export declare const LiveEvent: z.ZodObject<{
     schema: z.ZodLiteral<"nylorun.event/2">;
     eventId: z.ZodString;
@@ -13457,6 +13481,7 @@ export declare const TenantStatus: z.ZodObject<{
         model: z.ZodString;
         authType: z.ZodEnum<{
             api_key: "api_key";
+            host_identity: "host_identity";
             oauth: "oauth";
             workload: "workload";
         }>;
@@ -13622,6 +13647,10 @@ export declare const SeedTenantConfigRequest: z.ZodObject<{
             expires: z.ZodNumber;
         }, z.core.$loose>, z.ZodObject<{
             type: z.ZodLiteral<"workload">;
+        }, z.core.$strict>, z.ZodObject<{
+            type: z.ZodLiteral<"host_identity">;
+            project: z.ZodString;
+            location: z.ZodString;
         }, z.core.$strict>], "type">;
     }, z.core.$strict>>;
     fixtureModel: z.ZodOptional<z.ZodLiteral<true>>;
@@ -13880,6 +13909,7 @@ export declare const ListProvidersResponse: z.ZodObject<{
         model: z.ZodString;
         authType: z.ZodEnum<{
             api_key: "api_key";
+            host_identity: "host_identity";
             oauth: "oauth";
             workload: "workload";
         }>;
@@ -13927,6 +13957,7 @@ export declare const HostModelView: z.ZodUnion<readonly [z.ZodObject<{
     model: z.ZodString;
     authType: z.ZodEnum<{
         api_key: "api_key";
+        host_identity: "host_identity";
         oauth: "oauth";
         workload: "workload";
     }>;
@@ -13995,6 +14026,10 @@ export declare const PutHostModelRequest: z.ZodObject<{
         expires: z.ZodNumber;
     }, z.core.$loose>, z.ZodObject<{
         type: z.ZodLiteral<"workload">;
+    }, z.core.$strict>, z.ZodObject<{
+        type: z.ZodLiteral<"host_identity">;
+        project: z.ZodString;
+        location: z.ZodString;
     }, z.core.$strict>], "type">;
 }, z.core.$strict>;
 export declare const SelectHostModelRequest: z.ZodObject<{

package/dist/api/components.js

@@ -5,7 +5,7 @@
  * global registry.
  */
 import { z } from "zod";
-import { QueuedResponseSchema, TriggerListSchema, MemoryListSchema, MemorySchema, PutMemoryRequestSchema, MemoryVersionPageSchema, MemoryVersionDetailSchema, TriggerRunPageSchema, RunTriggerResponseSchema, WebhookSecretResponseSchema, WebhookAcceptedResponseSchema, AgentManifestV8Schema, EnvironmentSecretSlotsSchema, DeleteAgentManifestResponseSchema, AgentManifestPlanSchema, AgentManifestVersionsSchema, AgentManifestViewSchema, ListAgentManifestsResponseSchema, PutAgentManifestRequestSchema, PutAgentFolderRequestSchema, AgentManifestSourceSchema, AgentManifestSourceDiffSchema, PutAgentSecretValueRequestSchema, SaveAgentManifestResponseSchema, SessionListItemSchema, ModelCallSchema, SessionPageSchema, SessionManifestViewSchema, HistoryPageSchema, SessionUsageTotalsSchema, ModelCallsPageSchema, ModelCallExportPageSchema, AgentPageSchema, ToolCallSchema, ToolCallsPageSchema, TurnTraceSchema, JwksSchema, SigningKeyListSchema, SigningKeyViewSchema, RotateSigningKeysRequestSchema, RevokeSigningKeyRequestSchema, MeResponseSchema, TenantStatusSchema, ResetTenantRequestSchema, ResetTenantResponseSchema, SeedTenantConfigRequestSchema, SeedTenantConfigResponseSchema, HostModelCatalogSchema, TenantSandboxViewSchema, ModelUsageTotalsSchema, ModelBudgetsSchema, PutModelBudgetsRequestSchema, ToolPolicySchema, PutToolPolicyRequestSchema, PutModelInputsRequestSchema, ModelInputsViewSchema, PutTenantEnvironmentsRequestSchema, ListProvidersResponseSchema, HostModelViewSchema, PutHostModelRequestSchema, SelectHostModelRequestSchema, PutAgentSecretRequestSchema, AgentSecretViewSchema, ListAgentSecretsResponseSchema, McpPreviewRequestSchema, McpPreviewSchema, CredentialCoverageRequestSchema, CredentialCoverageSchema, DeletedResponseSchema, ListSessionsResponseSchema, LiveEventSchema, PutAgentRequestSchema, PutSessionRequestSchema, SessionItemsResponseSchema, SessionViewSchema, StreamClosedFrameSchema, AcceptedResponseSchema, SandboxToolOutcomeSchema, AgentViewSchema, AgentSnapshotSchema, RestoreAgentRequestSchema, ForkAgentRequestSchema, AgentForkPlanSchema, ForkAgentResponseSchema, PutAgentDryRunResponseSchema, RestartAgentRequestSchema, AgentRestoreSchema, AgentDiskVersionsSchema, ListAgentsResponseSchema, DeleteAgentResponseSchema, ListAgentEventsResponseSchema, ArtifactViewSchema, ArtifactListItemSchema, ArtifactPageSchema, ArtifactVersionViewSchema, ListArtifactsResponseSchema, UploadArtifactResponseSchema, DefinitionFileViewSchema, DeleteArtifactResponseSchema, CreateArtifactLinkRequestSchema, ArtifactLinkSchema, PutTenantArtifactsRequestSchema, PutTenantSkillsRequestSchema, PutTenantLimitsRequestSchema, TenantLimitsViewSchema, TenantArtifactsViewSchema, TenantSkillsViewSchema, ArtifactTreeSchema, ArtifactDiffSchema, SessionCommandSchema, ListOperatorKeysResponseSchema, PutOperatorKeyResponseSchema, DeleteOperatorKeyResponseSchema, OperatorKeySchema, ProtocolRejectedResponseSchema, RejectedResponseSchema, EVENT_SCHEMAS, EVENT_TYPES, } from "@nylorun/core/contracts";
+import { PutSessionModelRequestSchema, SessionModelViewSchema, QueuedResponseSchema, TriggerListSchema, MemoryListSchema, MemorySchema, PutMemoryRequestSchema, MemoryVersionPageSchema, MemoryVersionDetailSchema, TriggerRunPageSchema, RunTriggerResponseSchema, WebhookSecretResponseSchema, WebhookAcceptedResponseSchema, AgentManifestV8Schema, EnvironmentSecretSlotsSchema, DeleteAgentManifestResponseSchema, AgentManifestPlanSchema, AgentManifestVersionsSchema, AgentManifestViewSchema, ListAgentManifestsResponseSchema, PutAgentManifestRequestSchema, PutAgentFolderRequestSchema, AgentManifestSourceSchema, AgentManifestSourceDiffSchema, PutAgentSecretValueRequestSchema, SaveAgentManifestResponseSchema, SessionListItemSchema, ModelCallSchema, SessionPageSchema, SessionManifestViewSchema, HistoryPageSchema, SessionUsageTotalsSchema, ModelCallsPageSchema, ModelCallExportPageSchema, AgentPageSchema, ToolCallSchema, ToolCallsPageSchema, TurnTraceSchema, JwksSchema, SigningKeyListSchema, SigningKeyViewSchema, RotateSigningKeysRequestSchema, RevokeSigningKeyRequestSchema, MeResponseSchema, TenantStatusSchema, ResetTenantRequestSchema, ResetTenantResponseSchema, SeedTenantConfigRequestSchema, SeedTenantConfigResponseSchema, HostModelCatalogSchema, TenantSandboxViewSchema, ModelUsageTotalsSchema, ModelBudgetsSchema, PutModelBudgetsRequestSchema, ToolPolicySchema, PutToolPolicyRequestSchema, PutModelInputsRequestSchema, ModelInputsViewSchema, PutTenantEnvironmentsRequestSchema, ListProvidersResponseSchema, HostModelViewSchema, PutHostModelRequestSchema, SelectHostModelRequestSchema, PutAgentSecretRequestSchema, AgentSecretViewSchema, ListAgentSecretsResponseSchema, McpPreviewRequestSchema, McpPreviewSchema, CredentialCoverageRequestSchema, CredentialCoverageSchema, DeletedResponseSchema, ListSessionsResponseSchema, LiveEventSchema, PutAgentRequestSchema, PutSessionRequestSchema, SessionItemsResponseSchema, SessionViewSchema, StreamClosedFrameSchema, AcceptedResponseSchema, SandboxToolOutcomeSchema, AgentViewSchema, AgentSnapshotSchema, RestoreAgentRequestSchema, ForkAgentRequestSchema, AgentForkPlanSchema, ForkAgentResponseSchema, PutAgentDryRunResponseSchema, RestartAgentRequestSchema, AgentRestoreSchema, AgentDiskVersionsSchema, ListAgentsResponseSchema, DeleteAgentResponseSchema, ListAgentEventsResponseSchema, ArtifactViewSchema, ArtifactListItemSchema, ArtifactPageSchema, ArtifactVersionViewSchema, ListArtifactsResponseSchema, UploadArtifactResponseSchema, DefinitionFileViewSchema, DeleteArtifactResponseSchema, CreateArtifactLinkRequestSchema, ArtifactLinkSchema, PutTenantArtifactsRequestSchema, PutTenantSkillsRequestSchema, PutTenantLimitsRequestSchema, TenantLimitsViewSchema, TenantArtifactsViewSchema, TenantSkillsViewSchema, ArtifactTreeSchema, ArtifactDiffSchema, SessionCommandSchema, ListOperatorKeysResponseSchema, PutOperatorKeyResponseSchema, DeleteOperatorKeyResponseSchema, OperatorKeySchema, ProtocolRejectedResponseSchema, RejectedResponseSchema, EVENT_SCHEMAS, EVENT_TYPES, } from "@nylorun/core/contracts";
 function named(id, schema) {
     return schema.meta({ id });
 }
@@ -77,6 +77,8 @@ export const WebhookAcceptedResponse = named("WebhookAcceptedResponse", WebhookA
 export const ListSessionsResponse = named("ListSessionsResponse", ListSessionsResponseSchema);
 export const PutSessionRequest = named("PutSessionRequest", PutSessionRequestSchema);
 export const SessionView = named("SessionView", SessionViewSchema);
+export const PutSessionModelRequest = named("PutSessionModelRequest", PutSessionModelRequestSchema);
+export const SessionModelView = named("SessionModelView", SessionModelViewSchema);
 export const LiveEvent = named("LiveEvent", LiveEventSchema);
 /** `environment.state` → `EnvironmentStateEvent`. */
 export function eventComponentName(type) {

package/dist/api/http/routes/sessions.js

@@ -1,10 +1,10 @@
 import { RESPONSE_ALREADY_SENT } from "@hono/node-server/utils/response";
 import { z } from "zod";
 import { PROTOCOL_HEADER } from "@nylorun/core/compatibility";
-import { PutSessionRequestSchema, SessionCommandSchema, } from "@nylorun/core/contracts";
+import { PutSessionModelRequestSchema, PutSessionRequestSchema, SessionCommandSchema, } from "@nylorun/core/contracts";
 import { handleSessionSandboxTool, SandboxRouteError } from "../../../core/sandbox-routes.js";
 import { traceContextOf } from "../../../traces/ids.js";
-import { AcceptedResponse, QueuedResponse, ListSessionsResponse, SessionPage, HistoryPage, SessionEvent, PutSessionRequest, SandboxToolOutcome, SessionCommand, SessionItemsResponse, SessionView, StreamClosedFrame, } from "../../components.js";
+import { AcceptedResponse, QueuedResponse, ListSessionsResponse, SessionPage, HistoryPage, SessionEvent, PutSessionModelRequest, PutSessionRequest, SandboxToolOutcome, SessionCommand, SessionItemsResponse, SessionModelView, SessionView, StreamClosedFrame, } from "../../components.js";
 import { accessOf, requireApplication } from "../../../tenant/auth.js";
 import { command } from "../../../tenant/commands.js";
 import { loadSession, sessionOf } from "../../../tenant/context.js";
@@ -12,6 +12,7 @@ import { fail } from "../../../tenant/http.js";
 import { agentGrantsOf, sandboxRouteDeps } from "../../../tenant/agents.js";
 import { readHistory, requestCursor, streamHolderOf, streamSessionEvents } from "../../../tenant/session-streams.js";
 import { listSessions, putSession, sessionView } from "../../../tenant/sessions.js";
+import { chooseSessionModel, readSessionModel } from "../../../tenant/session-model.js";
 import { readJson } from "../body.js";
 import { TraceHeaders, tenantRoute } from "../define.js";
 import { pageQuery, pageSize, sessionPage, sessionPageQuery, parseQuery } from "./reads.js";
@@ -20,6 +21,18 @@ const OWN_SESSIONS = {
     credentials: ["application", "subject", "token"],
     scopes: ["sessions:own"],
 };
+/**
+ * A session's own model costs what its model costs: the application chooses it (for a subject
+ * too), never a token a person's browser holds.
+ */
+const APP_SESSIONS = {
+    credentials: ["application", "subject"],
+    scopes: ["sessions:own"],
+};
+function refuseToken(scope) {
+    if (scope.kind === "token")
+        fail(403, "A token caller cannot choose a session's model", { code: "scope_required" });
+}
 const json = (schema, description) => ({
     description,
     content: { "application/json": { schema } },
@@ -122,6 +135,54 @@ export function sessionRoutes(api) {
         const id = c.req.param("sessionId");
         return jsonResponse(200, await ctx.store.tx(async (t) => sessionView(t, await sessionOf(t, id, accessOf(scope)))));
     });
+    tenantRoute(api, OWN_SESSIONS, {
+        method: "get",
+        path: "/v1/sessions/{sessionId}/model",
+        tags: ["Sessions"],
+        summary: "Get a session's model",
+        description: "The model the session's next turn uses (feature `session-model`): its own (`source: \"session\"`) while its provider is connected, else the Tenant's (`source: \"tenant\"`). `choice` is the session's own model, kept while its provider is disconnected.",
+        request: { params: sessionId },
+        responses: { 200: json(SessionModelView, "The session's model") },
+    }, async (c) => {
+        const scope = c.get("scope");
+        return jsonResponse(200, await readSessionModel(c.env.tenant, c.req.param("sessionId"), accessOf(scope)));
+    });
+    tenantRoute(api, APP_SESSIONS, {
+        method: "put",
+        path: "/v1/sessions/{sessionId}/model",
+        tags: ["Sessions"],
+        summary: "Choose a session's model",
+        description: "Chooses one of a connected provider's models for the session's turns (feature `session-model`), in place of the Tenant's model. The Tenant's model and every other session's stay as they are. Only the application sets it, for itself or for a subject: a trusted issuer's token is refused. A turn calls one model, so the choice changes only while no turn runs or waits (`409 session_busy`). A provider that is not connected, or a model its catalog does not list, is `422 request_rejected`.",
+        request: { params: sessionId, body: body(PutSessionModelRequest) },
+        responses: {
+            200: json(SessionModelView, "The session's model"),
+            403: { description: "A trusted issuer's token (`scope_required`)" },
+            409: { description: "A turn is running or waits (`session_busy`)" },
+            422: { description: "The provider is not connected, or the model is not one of its models" },
+        },
+    }, async (c) => {
+        const scope = c.get("scope");
+        refuseToken(scope);
+        const choice = PutSessionModelRequestSchema.parse(await readJson(c));
+        return jsonResponse(200, await chooseSessionModel(c.env.tenant, c.req.param("sessionId"), choice, accessOf(scope)));
+    });
+    tenantRoute(api, APP_SESSIONS, {
+        method: "delete",
+        path: "/v1/sessions/{sessionId}/model",
+        tags: ["Sessions"],
+        summary: "Clear a session's model",
+        description: "Clears the session's own model (feature `session-model`): its next turns use the Tenant's model. Refused while a turn runs or waits (`409 session_busy`).",
+        request: { params: sessionId },
+        responses: {
+            200: json(SessionModelView, "The session's model"),
+            403: { description: "A trusted issuer's token (`scope_required`)" },
+            409: { description: "A turn is running or waits (`session_busy`)" },
+        },
+    }, async (c) => {
+        const scope = c.get("scope");
+        refuseToken(scope);
+        return jsonResponse(200, await chooseSessionModel(c.env.tenant, c.req.param("sessionId"), undefined, accessOf(scope)));
+    });
     tenantRoute(api, OWN_SESSIONS, {
         method: "get",
         path: "/v1/sessions/{sessionId}/items",

package/dist/api/openapi.js

@@ -194,6 +194,9 @@ const RUNTIME_TAGS = [
             "GET /v1/sessions/{sessionId}/events",
             "GET /v1/sessions/{sessionId}/items",
             "GET /v1/sessions/{sessionId}/manifest",
+            "GET /v1/sessions/{sessionId}/model",
+            "PUT /v1/sessions/{sessionId}/model",
+            "DELETE /v1/sessions/{sessionId}/model",
             "GET /v1/sessions/{sessionId}/usage",
             "GET /v1/sessions/{sessionId}/calls/model",
             "GET /v1/sessions/{sessionId}/calls/tool",

package/dist/gates/handler.js

@@ -23,8 +23,8 @@ export function createModelCallHandler(options) {
                 request = call;
                 const gate = inProcessModelGate({
                     root: vault.root,
-                    readHostModel: () => vault.readHostModel(),
-                    writeHostCredential: (credential) => vault.writeHostCredential(credential),
+                    readHostModel: (request) => vault.readHostModel(request.sessionId),
+                    writeHostCredential: (credential, provider) => vault.writeHostCredential(credential, provider),
                     // The Tenant's Runtime limits `model*`, read for this call.
                     settings: await modelCallSettings(vault.store),
                     ...(blobs ? { files: callFiles(vault.store, blobs) } : {}),

package/dist/gates/in-process.d.ts

@@ -15,9 +15,10 @@ import type { ModelCaller } from "../model/call-headers.js";
 export interface InProcessModelGateOptions {
     /** The Tenant's home: `piModel` redacts secrets it finds there from failure messages. */
     readonly root?: string;
-    readonly readHostModel: () => Promise<HostModelSecret | undefined>;
-    /** Writes back a credential pi-ai refreshed (OAuth). */
-    readonly writeHostCredential: (credential: Credential) => Promise<void>;
+    /** The host model a call uses: its session's own model (`session-model`), else the Tenant's. */
+    readonly readHostModel: (request: ModelGateRequest) => Promise<HostModelSecret | undefined>;
+    /** Writes back a credential pi-ai refreshed (OAuth) to `provider`'s, the one the call read. */
+    readonly writeHostCredential: (credential: Credential, provider: string) => Promise<void>;
     readonly settings?: ModelCallSettings;
     /** Reads the files a call's prompt names (protocol 6): artifacts, for model-gate. */
     readonly files?: (request: ModelGateRequest) => FileResolver;

package/dist/gates/in-process.js

@@ -45,8 +45,8 @@ export function tenantModelGate(options) {
             // The Tenant's Runtime limits `model*`, read for this call.
             const gate = inProcessModelGate({
                 root: options.root,
-                readHostModel: () => vault.readHostModel(),
-                writeHostCredential: (credential) => vault.updateHostCredential(credential),
+                readHostModel: (request) => vault.readHostModel(request.sessionId),
+                writeHostCredential: (credential, provider) => vault.updateHostCredential(credential, provider),
                 settings: await modelCallSettings(options.store),
                 ...(options.blobs ? { files: callFiles(options.store, options.blobs) } : {}),
                 caller: callCaller(options.store),
@@ -71,11 +71,17 @@ export async function serve(store, gate, request, signal) {
 export function inProcessModelGate(options) {
     return {
         async call(request, signal) {
-            // One adapter per call, as before the gate: it reads the host model when invoked.
+            // One adapter per call, as before the gate: it reads the host model when invoked, and a
+            // refreshed credential goes back to the provider it read.
+            let provider;
             const adapter = piModel({
                 ...(options.root !== undefined ? { root: options.root } : {}),
-                readHostModel: options.readHostModel,
-                writeHostCredential: options.writeHostCredential,
+                readHostModel: async () => {
+                    const stored = await options.readHostModel(request);
+                    provider = stored?.provider;
+                    return stored;
+                },
+                writeHostCredential: (credential) => options.writeHostCredential(credential, provider),
                 ...(options.settings ? { settings: options.settings } : {}),
                 ...(options.files ? { files: options.files(request) } : {}),
                 ...(options.caller ? { caller: () => options.caller(request) } : {}),

package/dist/gates/tenant-vaults.d.ts

@@ -22,9 +22,10 @@ export interface TenantVault {
     readonly store: SessionStore;
     /** The Tenant's home: secrets found there are redacted from failure messages. */
     readonly root: string;
-    readHostModel(): Promise<HostModelSecret | undefined>;
-    /** Writes back a credential pi-ai refreshed (OAuth). */
-    writeHostCredential(credential: Credential): Promise<void>;
+    /** The host model a call uses: its session's own model (`session-model`), else the Tenant's. */
+    readHostModel(sessionId?: string): Promise<HostModelSecret | undefined>;
+    /** Writes back a credential pi-ai refreshed (OAuth) to `provider`'s, else the active one's. */
+    writeHostCredential(credential: Credential, provider?: string): Promise<void>;
     /** A session, for the remote MCP servers and HTTP tools its pinned manifest declares. */
     session(sessionId: string): Promise<Session | undefined>;
     /**

package/dist/gates/tenant-vaults.js

@@ -47,8 +47,8 @@ export function createTenantVaults(options) {
             tenantId,
             store,
             root: paths.home,
-            readHostModel: () => vault.readHostModel(),
-            writeHostCredential: (credential) => vault.updateHostCredential(credential),
+            readHostModel: (sessionId) => vault.readHostModel(sessionId),
+            writeHostCredential: (credential, provider) => vault.updateHostCredential(credential, provider),
             session,
             authorizeMcp: (sessionId, request) => authorizeSessionMcp(credentials, session, sessionId, request),
             keys: () => keys,

package/dist/harness-api/start.js

@@ -82,7 +82,7 @@ options = {}) {
     });
     // The model an agent's harness decides files by, read outside the session's transaction.
     const model = options.harness && !isWorkflowManifest(opened.current.manifest)
-        ? await currentModelDescriptor(ctx)
+        ? await currentModelDescriptor(ctx, opened.current.model)
         : undefined;
     const started = model ? { ...opened, model } : opened;
     // One history (P0.3): the engine resumes from the transcript folded from the record.

package/dist/host/main.js

@@ -65,6 +65,7 @@ import { startHarnessListener } from "../harness-api/ws-server.js";
 import { httpSandboxesClient } from "../sandbox/pods/client.js";
 import { retry } from "../retry.js";
 import { hostTuning, useHostTuning } from "../tuning.js";
+import { useHostIdentity } from "../vault/host-identity.js";
 import { useWorkloadToken } from "../vault/workload-token.js";
 const nodeRequire = createRequire(import.meta.url);
 function coreVersion() {
@@ -220,6 +221,7 @@ export async function main() {
     if (stack.tuning)
         useHostTuning(stack.tuning.values, stack.tuning.overrides);
     useWorkloadToken(stack.workloadToken ?? {});
+    useHostIdentity(stack.modelHostIdentity ?? []);
     if (stack.services.has("gates") || stack.services.has("keys") || stack.services.has("egress"))
         return runGates(stack);
     if (stack.services.has("harness"))

package/dist/host/stack-config.d.ts

@@ -188,6 +188,11 @@ export interface StackConfig {
         file?: string;
         origins?: string[];
     };
+    /**
+     * `NYLORUN_MODEL_HOST_IDENTITY`: the comma-separated providers whose models may use the Host's
+     * own identity (ADR-71, `vault/host-identity.ts`). Absent: none.
+     */
+    modelHostIdentity?: string[];
     /** Present when the process runs gates. */
     gates?: GatesConfig;
     /** Present when the process runs egress. */

package/dist/host/stack-config.js

@@ -50,6 +50,7 @@ import { isTenantId } from "@nylorun/core/compatibility";
 import { LOOPBACK_HOSTS } from "@nylorun/core/contracts";
 import { blockedAddresses } from "../sandbox/pods/network-gate.js";
 import { HostTuningError, parseHostTuning } from "../tuning.js";
+import { HOST_IDENTITY_PROVIDERS } from "../vault/host-identity.js";
 export const RUNTIME_SERVICES = ["core", "loop", "gates", "keys", "egress", "harness"];
 /**
  * Services that may share a process (D12): they hold the same secrets and parse the same
@@ -327,6 +328,7 @@ export function parseStackConfig(env, argv) {
     const delivery = parseDelivery(env);
     const tenant = servesApi ? parseTenant(env) : undefined;
     const workloadToken = parseWorkloadToken(env);
+    const modelHostIdentity = parseModelHostIdentity(env);
     const objectStore = parseObjectStore(env);
     const traces = services.has("core") ? parseTraces(env) : undefined;
     const removedResolverVariables = Object.keys(env)
@@ -350,6 +352,7 @@ export function parseStackConfig(env, argv) {
         ...(delivery ? { delivery } : {}),
         ...(tenant ? { tenant } : {}),
         ...(workloadToken ? { workloadToken } : {}),
+        ...(modelHostIdentity ? { modelHostIdentity } : {}),
         ...(objectStore ? { objectStore } : {}),
         ...(traces ? { traces } : {}),
         ...(tuning ? { tuning } : {}),
@@ -468,6 +471,18 @@ function parseWorkloadToken(env) {
         return undefined;
     return { ...(file ? { file } : {}), ...(origins ? { origins } : {}) };
 }
+/** `StackConfig.modelHostIdentity` (ADR-71): each a provider that can use the Host's identity. */
+function parseModelHostIdentity(env) {
+    const raw = read(env, "NYLORUN_MODEL_HOST_IDENTITY");
+    if (raw === undefined)
+        return undefined;
+    const providers = [...new Set(raw.split(",").map((item) => item.trim()).filter((item) => item !== ""))];
+    for (const provider of providers) {
+        if (!HOST_IDENTITY_PROVIDERS.includes(provider))
+            throw new StackConfigError(`NYLORUN_MODEL_HOST_IDENTITY: ${provider} can't use the Host's identity (only ${HOST_IDENTITY_PROVIDERS.join(", ")})`);
+    }
+    return providers.length ? providers : undefined;
+}
 /** `NYLORUN_WORKLOAD_TOKEN_ORIGINS`: each an `https` origin (`http` only to a loopback host). */
 function parseOrigins(raw) {
     if (raw === undefined)

package/dist/management-openapi.json

@@ -2,7 +2,7 @@
   "openapi": "3.2.0",
   "info": {
     "title": "Nylorun Management API",
-    "version": "0.32.0-beta",
+    "version": "0.33.0-beta",
     "x-nylorun-protocol": {
       "min": 16,
       "max": 18,
@@ -34,7 +34,9 @@
         "traces",
         "artifact-reads",
         "gateway-credentials",
-        "agent-folders"
+        "agent-folders",
+        "session-model",
+        "model-host-identity"
       ]
     },
     "description": "For operators: the Tenant's models, vaults, signing keys, settings and application keys, at `/v1/tenant/*` on the Tenant's URL, through `@nylorun/admin`. Every operation takes a management key, acting as itself: never for a subject and never from a browser. Management keys are issued only on the Tenant's machine (`nylorun tenant keys put <id> --management`) or from `NYLORUN_MANAGEMENT_KEY_FILE`."
@@ -427,7 +429,8 @@
                     "enum": [
                       "api_key",
                       "oauth",
-                      "workload"
+                      "workload",
+                      "host_identity"
                     ]
                   },
                   "baseUrl": {
@@ -1137,6 +1140,31 @@
                       "type"
                     ],
                     "additionalProperties": false
+                  },
+                  {
+                    "type": "object",
+                    "properties": {
+                      "type": {
+                        "type": "string",
+                        "enum": [
+                          "host_identity"
+                        ]
+                      },
+                      "project": {
+                        "type": "string",
+                        "pattern": "^[a-z][a-z0-9-]{4,28}[a-z0-9]$"
+                      },
+                      "location": {
+                        "type": "string",
+                        "pattern": "^[a-z][a-z0-9-]*$"
+                      }
+                    },
+                    "required": [
+                      "type",
+                      "project",
+                      "location"
+                    ],
+                    "additionalProperties": false
                   }
                 ]
               }
@@ -2680,7 +2708,8 @@
                   "enum": [
                     "api_key",
                     "oauth",
-                    "workload"
+                    "workload",
+                    "host_identity"
                   ]
                 },
                 "baseUrl": {
@@ -2860,7 +2889,8 @@
                 "enum": [
                   "api_key",
                   "oauth",
-                  "workload"
+                  "workload",
+                  "host_identity"
                 ]
               },
               "baseUrl": {
@@ -3170,6 +3200,31 @@
                   "type"
                 ],
                 "additionalProperties": false
+              },
+              {
+                "type": "object",
+                "properties": {
+                  "type": {
+                    "type": "string",
+                    "enum": [
+                      "host_identity"
+                    ]
+                  },
+                  "project": {
+                    "type": "string",
+                    "pattern": "^[a-z][a-z0-9-]{4,28}[a-z0-9]$"
+                  },
+                  "location": {
+                    "type": "string",
+                    "pattern": "^[a-z][a-z0-9-]*$"
+                  }
+                },
+                "required": [
+                  "type",
+                  "project",
+                  "location"
+                ],
+                "additionalProperties": false
               }
             ]
           }

package/dist/model/descriptor.d.ts

@@ -7,7 +7,7 @@
  * gate takes cannot disagree.
  */
 import type { Api, Model } from "@earendil-works/pi-ai";
-import { type CustomModelSettings, type HostModelView, type ModelInput } from "@nylorun/core/contracts";
+import { type CustomModelSettings, type HostModelView, type ModelInput, type SessionModelChoice } from "@nylorun/core/contracts";
 import type { ModelDescriptor } from "@nylorun/core/harness-api";
 import type { SessionStore } from "../store/types.js";
 import { type Selection } from "./models.js";
@@ -36,14 +36,15 @@ export declare const FIXTURE_DESCRIPTOR: ModelDescriptor;
 export declare function hostModelDescriptor(binding: ModelBindingView, added?: Readonly<Record<string, readonly ModelInput[]>>): ModelDescriptor | undefined;
 /**
  * The model the Tenant's turns use now: the fixture model's descriptor when the Tenant uses it,
- * else its active model's; undefined when none is configured (a test's scripted provider, say).
+ * else a session's own model's (`choice`, while its provider is connected), else its active
+ * model's; undefined when none is configured (a test's scripted provider, say).
  */
 export declare function currentModelDescriptor(ctx: {
     readonly store: SessionStore;
     readonly vault: {
-        getHostModel(): Promise<HostModelView>;
+        getHostModel(choice?: SessionModelChoice): Promise<HostModelView>;
     };
-}): Promise<ModelDescriptor | undefined>;
+}, choice?: SessionModelChoice): Promise<ModelDescriptor | undefined>;
 /**
  * The context window, in tokens, of the Tenant's model now; without one, or one the catalog does
  * not know, it is assumed small (`CUSTOM_MODEL_SETTING_DEFAULTS`), as for a custom endpoint.

package/dist/model/descriptor.js

@@ -62,16 +62,17 @@ export function hostModelDescriptor(binding, added = {}) {
 }
 /**
  * The model the Tenant's turns use now: the fixture model's descriptor when the Tenant uses it,
- * else its active model's; undefined when none is configured (a test's scripted provider, say).
+ * else a session's own model's (`choice`, while its provider is connected), else its active
+ * model's; undefined when none is configured (a test's scripted provider, say).
  */
-export async function currentModelDescriptor(ctx) {
+export async function currentModelDescriptor(ctx, choice) {
     const { fixture, added } = await ctx.store.tx(async (t) => ({
         fixture: await usesFixtureModel(t),
         added: await readAddedInputs(t),
     }));
     if (fixture)
         return FIXTURE_DESCRIPTOR;
-    const view = await ctx.vault.getHostModel();
+    const view = await ctx.vault.getHostModel(choice);
     return view.configured ? hostModelDescriptor(view, added) : undefined;
 }
 /**

package/dist/model/pi-model.js

@@ -8,6 +8,7 @@ import { classifyAssistantError, failure } from "./classify.js";
 import { addedInputsOf, describeModel, selectionOf } from "./descriptor.js";
 import { modelsFor } from "./models.js";
 import { callHeaders } from "./call-headers.js";
+import { hostIdentityRefused, VERTEX_ADC_MARKER } from "../vault/host-identity.js";
 import { workloadToken, WorkloadTokenUnavailable } from "../vault/workload-token.js";
 import { NativeBlocks, nativeKindsOf } from "./native-blocks.js";
 import { projectSecrets } from "./settings.js";
@@ -67,6 +68,12 @@ export function piModel(options = {}) {
                 throw error;
             }
         }
+        // The Host's identity (ADR-71): only while its operator still lends it.
+        if (stored.authType === "host_identity") {
+            const refused = hostIdentityRefused(stored.provider);
+            if (refused)
+                return failure("auth", refused, false);
+        }
         const secrets = [
             ...projectSecrets(root),
             ...credentialSecrets(stored.credential),
@@ -119,6 +126,8 @@ export function piModel(options = {}) {
             sessionId: call.executionId,
             cacheRetention: "short",
             ...(Object.keys(perCall).length > 0 ? { headers: perCall } : {}),
+            // With the Host's identity: where Agent Platform runs the call (ADR-71).
+            ...(stored.authType === "host_identity" && stored.credential.env ? { env: stored.credential.env } : {}),
             timeoutMs: settings.requestTimeoutMs,
             maxRetries: settings.providerRetries,
             maxRetryDelayMs: settings.maxRetryDelayMs,
@@ -504,7 +513,11 @@ function idleTimeout(selected, idleTimeoutMs) {
     };
 }
 function hostCredentialStore(stored, write) {
-    let current = stored.credential;
+    // The Host's identity (ADR-71): pi-ai's Vertex AI client uses Application Default Credentials
+    // for this marker in place of a key.
+    let current = stored.authType === "host_identity"
+        ? { type: "api_key", key: VERTEX_ADC_MARKER }
+        : stored.credential;
     // A workload model stores no credential: pi-ai then asks the provider's `resolve` (`modelsFor`).
     const stores = stored.authType !== "workload";
     return {
@@ -532,6 +545,9 @@ function hostCredentialStore(stored, write) {
     };
 }
 function credentialSecrets(credential) {
+    // The Host's identity keeps no secret: its project and location stay readable in messages.
+    if (credential.type === "host_identity")
+        return [];
     const values = [credential.key, credential.access, credential.refresh];
     if (credential.env)
         values.push(...Object.values(credential.env));