@nylorun/runtime 0.37.0-beta → 0.39.0-beta

package/dist/sandbox/join.d.ts

@@ -20,7 +20,13 @@ export declare class HostAuthError extends Error {
 }
 /** The Tenant's side of the exchange, as the Harness API listener calls it. */
 export interface HostAuthority {
-    join(request: HostJoinRequest): Promise<HostJoinAnswer>;
+    /**
+     * `imageEngine`: the Runtime version an engine the workload image carries reported (ADR-99);
+     * absent for an engine copied in.
+     */
+    join(request: HostJoinRequest, from?: {
+        imageEngine?: string;
+    }): Promise<HostJoinAnswer>;
     renew(hostToken: string): Promise<HostJoinAnswer>;
     /** The claims of a current host's token, for a connection; refuses a stale one. */
     verify(hostToken: string): Promise<HostClaims>;

package/dist/sandbox/join.js

@@ -85,7 +85,7 @@ export function hostAuthority(ctx) {
         return verdict.claims;
     };
     return {
-        async join(request) {
+        async join(request, from) {
             const { sandboxId, podUid, joinToken, volumeId } = request;
             if (!isAgentId(sandboxId) ||
                 typeof podUid !== "string" ||
@@ -146,6 +146,10 @@ export function hostAuthority(ctx) {
                     hostEpoch: epoch,
                     podUid,
                     ...(pod.volumeId === undefined && volumeId !== undefined ? { volumeId } : {}),
+                    // The engine the image carries, against the digest this pod runs (ADR-99).
+                    ...(from?.imageEngine === undefined
+                        ? {}
+                        : { engineImage: { version: from.imageEngine, ...(pod.imageDigest ? { digest: pod.imageDigest } : {}) } }),
                     ...(pod.desired === "running" ? { observed: "running", reason: null } : {}),
                 }, now);
                 if (pod.podUid !== podUid) {

package/dist/sandbox/pods/builtin.d.ts

@@ -0,0 +1,18 @@
+export { BUILTIN_ENGINE_ROOT, ENGINE_VERSION_PATTERN, IMAGE_ENGINE_HEADER } from "../../harness/image-engine.js";
+/** The engine an image carries, as the pod's record keeps it: its version, seen on `digest`. */
+export interface EngineImage {
+    readonly version: string;
+    readonly digest?: string;
+}
+/**
+ * Whether a pod of `image` (its pinned digest, or as asked) runs the engine the image carries:
+ * the Tenant lists its repository, and the engine recorded for that digest is this Runtime's
+ * version or not known yet.
+ */
+export declare function runsBuiltinEngine(input: {
+    readonly image: string | undefined;
+    readonly imageDigest: string | undefined;
+    readonly engineImage: EngineImage | undefined;
+    readonly listed: readonly string[] | undefined;
+    readonly runtimeVersion?: string;
+}): boolean;

package/dist/sandbox/pods/builtin.js

@@ -0,0 +1,33 @@
+/**
+ * An engine built into the workload's image (ADR-99): the Runtime image's tini, node and bundled
+ * engine under `/opt/nylorun`, which the sandboxes service runs with `entrypoint: "builtin"` and
+ * nothing copied in.
+ *
+ * The Tenant lists the images that carry one (`engine.images`, by repository). Such an engine is
+ * whichever Runtime version the image was built from, so it reports that version when it joins
+ * (`IMAGE_ENGINE_HEADER`, sent only by an engine running from `/opt/nylorun`), and the pod's
+ * record keeps it beside the digest it ran (`engineImage`). A pod runs the image's engine while
+ * that version is the Runtime's own, or not known yet for the digest it runs (a first start, which
+ * the Harness API version check at `hello` still guards); otherwise the engine is copied in, so a
+ * Runtime upgrade never leaves a pod on an older engine for more than that first turn.
+ */
+import { RUNTIME_VERSION } from "../../version.js";
+import { repositoryOf } from "./lifecycle.js";
+export { BUILTIN_ENGINE_ROOT, ENGINE_VERSION_PATTERN, IMAGE_ENGINE_HEADER } from "../../harness/image-engine.js";
+/**
+ * Whether a pod of `image` (its pinned digest, or as asked) runs the engine the image carries:
+ * the Tenant lists its repository, and the engine recorded for that digest is this Runtime's
+ * version or not known yet.
+ */
+export function runsBuiltinEngine(input) {
+    const image = input.imageDigest ?? input.image;
+    if (!image || !input.listed?.length)
+        return false;
+    const repository = repositoryOf(image);
+    if (!input.listed.some((entry) => repositoryOf(entry) === repository))
+        return false;
+    const known = input.engineImage !== undefined && input.imageDigest !== undefined && input.engineImage.digest === input.imageDigest
+        ? input.engineImage.version
+        : undefined;
+    return known === undefined || known === (input.runtimeVersion ?? RUNTIME_VERSION);
+}

package/dist/sandbox/pods/client.d.ts

@@ -5,11 +5,12 @@ export interface PodSpec {
     /** The workload image; the service defaults it to `python:3.13-slim`. */
     readonly image?: string;
     /**
-     * What the workload runs: `engine` (default), our engine copied from `harnessImage`, or
-     * `image`, the image's own entrypoint, for a custom harness built into it (R4.4).
+     * What the workload runs: `engine` (default), our engine copied from `harnessImage`;
+     * `builtin`, our engine the image carries under `/opt/nylorun` (ADR-99); or `image`, the image's
+     * own entrypoint, for a custom harness built into it (R4.4).
      */
-    readonly entrypoint?: "engine" | "image";
-    /** The Runtime image the engine is copied from; not with `entrypoint: "image"`. */
+    readonly entrypoint?: "engine" | "builtin" | "image";
+    /** The Runtime image the engine is copied from; not with `entrypoint: "builtin"` or `"image"`. */
     readonly harnessImage?: string;
     /** Replaces the engine command (diagnostics). */
     readonly command?: readonly string[];

package/dist/sandbox/pods/spec.js

@@ -8,6 +8,7 @@ import { DEFAULT_HARNESS } from "@nylorun/core/contracts";
 import { idleMsOf, memoryMiBOf } from "../policy.js";
 import { podTuningEnv } from "../../tuning.js";
 import { opIdOf } from "./lifecycle.js";
+import { runsBuiltinEngine } from "./builtin.js";
 /** The pod's grace period to stop when the Tenant sets none (D34). */
 export const DEFAULT_STOP_GRACE_SECONDS = 10;
 /** The volume's size when the sandbox asks for none. */
@@ -40,12 +41,24 @@ export function podSpecOf(input) {
     // Pinned by digest once a pod ran it (Q14).
     const image = pod.imageDigest ?? spec.image;
     const ours = (input.harness ?? DEFAULT_HARNESS) === DEFAULT_HARNESS;
+    // Our engine, built into an image the Tenant lists, while it is this Runtime's (ADR-99).
+    const builtin = ours &&
+        runsBuiltinEngine({
+            image: spec.image,
+            imageDigest: pod.imageDigest,
+            engineImage: pod.engineImage,
+            listed: config.engine?.images,
+        });
     return {
         opId: opIdOf(pod),
         mode: input.mode,
         ...(image ? { image } : {}),
         // A custom harness is its image: the pod runs the image's entrypoint, nothing copied in.
-        ...(ours ? { harnessImage: input.harnessImage } : { entrypoint: "image" }),
+        ...(!ours
+            ? { entrypoint: "image" }
+            : builtin
+                ? { entrypoint: "builtin" }
+                : { harnessImage: input.harnessImage }),
         cpus: spec.resources?.cpus ?? 1,
         memoryMiB: memoryMiBOf(spec),
         storageGiB: storageGiBOf(spec),

package/dist/store/postgres/drizzle/0042_worker_engine_image.sql

@@ -0,0 +1 @@
+ALTER TABLE "nylorun"."agents" ADD COLUMN "engine_image" json;

package/dist/store/postgres/drizzle/meta/_journal.json

@@ -295,6 +295,13 @@
       "when": 1793448353003,
       "tag": "0041_turn_index_backfill",
       "breakpoints": true
+    },
+    {
+      "idx": 42,
+      "version": "7",
+      "when": 1793509192153,
+      "tag": "0042_worker_engine_image",
+      "breakpoints": true
     }
   ]
 }

package/dist/store/postgres/schema.d.ts

@@ -1302,6 +1302,25 @@ export declare const agents: import("drizzle-orm/pg-core").PgTableWithColumns<{
         }, {}, {
             pgColumnBuilderBrand: 'PgCustomColumnBuilderBrand';
         }>;
+        engineImage: import("drizzle-orm/pg-core").PgColumn<{
+            name: "engineImage";
+            tableName: "agents";
+            dataType: "custom";
+            columnType: "PgCustomColumn";
+            data: unknown;
+            driverParam: unknown;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            pgColumnBuilderBrand: 'PgCustomColumnBuilderBrand';
+        }>;
         diskOp: import("drizzle-orm/pg-core").PgColumn<{
             name: "diskOp";
             tableName: "agents";

package/dist/store/postgres/schema.js

@@ -171,6 +171,8 @@ export const agents = nylorun.table("agents", {
     volumeId: text(),
     /** The workload image by digest, from the first ready pod on (Q14): later pods run it. */
     imageDigest: textC(),
+    /** The engine the image carries (ADR-99): `{ version, digest? }`, from a join of its engine. */
+    engineImage: jsonText(),
     /**
      * The disk lease (R2d step 3): `{ kind, version?, startedAt, until }` while a snapshot, a
      * restore or a seed copies the disk; turns are refused until it ends or `until` passes.

package/dist/store/postgres/store.js

@@ -283,6 +283,7 @@ function environmentOf(row) {
                     ...(row.retiring !== null ? { retiring: row.retiring } : {}),
                     ...(row.volumeId !== null ? { volumeId: row.volumeId } : {}),
                     ...(row.imageDigest !== null ? { imageDigest: row.imageDigest } : {}),
+                    ...(row.engineImage ? { engineImage: row.engineImage } : {}),
                 },
             }
             : {}),
@@ -317,6 +318,7 @@ function podColumns(patch) {
         retiring: patch.retiring,
         volumeId: patch.volumeId,
         imageDigest: patch.imageDigest,
+        engineImage: patch.engineImage,
     };
     return Object.fromEntries(Object.entries(columns).filter(([, value]) => value !== undefined));
 }
@@ -1458,6 +1460,20 @@ class PostgresTx {
             .orderBy(desc(memoryVersions.id))
             .limit(options.limit);
     }
+    async memoryWritesSince(agentId, after, sessionId) {
+        this.check();
+        const conditions = [eq(memoryVersions.agentId, agentId)];
+        if (after !== undefined)
+            conditions.push(gt(memoryVersions.id, after));
+        const [row] = await this.db
+            .select({
+            newest: sql `max(${memoryVersions.id})`,
+            others: sql `coalesce(bool_or(${memoryVersions.sessionId} is distinct from ${sessionId}), false)`,
+        })
+            .from(memoryVersions)
+            .where(and(...conditions));
+        return { ...(row?.newest ? { newest: row.newest } : {}), others: row?.others === true };
+    }
     async memoryVersion(agentId, id) {
         this.check();
         const [row] = await this.db

package/dist/store/types.d.ts

@@ -260,6 +260,15 @@ export interface SandboxPodState {
      * Environment is ready (Q14): every later pod, after a stop, a relaunch or a reset, runs it.
      */
     imageDigest?: string;
+    /**
+     * The engine the workload image carries (ADR-99, `sandbox/pods/builtin.ts`): its Runtime
+     * version, as its engine reported at join, and the digest that pod ran. It counts only while
+     * that digest is `imageDigest`.
+     */
+    engineImage?: {
+        version: string;
+        digest?: string;
+    };
 }
 /** A change to a pod's columns: `null` clears an optional one. */
 export type SandboxPodPatch = {
@@ -794,6 +803,15 @@ export interface Tx {
         before?: string;
         limit: number;
     }): Promise<MemoryVersionRow[]>;
+    /**
+     * Of Agent `agentId`'s memory versions after version id `after` (every one without it): the
+     * newest's id, and whether any was written other than by session `sessionId` (another session,
+     * or the API).
+     */
+    memoryWritesSince(agentId: string, after: string | undefined, sessionId: string): Promise<{
+        newest?: string;
+        others: boolean;
+    }>;
     memoryVersion(agentId: string, id: string): Promise<MemoryVersionRow | undefined>;
     /** Copies Agent `from`'s memories to new Agent `to`, each at version 1, with no history (a fork). */
     copyMemories(from: string, to: string, now: string): Promise<number>;

package/dist/tenant/agent-versions.d.ts

@@ -21,8 +21,11 @@
  * - **A turn takes the Agent's version.** A turn's first segment re-pins its session to the
  *   version the Agent runs when that changed since the session's last turn (`repinTurn`), before
  *   anything of the turn has run: no effect is journaled for it yet. The turn keeps that version
- *   through every later segment, approval and rollover. A turn whose message named a variant,
- *   and a flow's sessions, keep the version they pinned.
+ *   through every later segment, approval and rollover. What its message asked of the turn's
+ *   manifest (`Session.turnRequest`) applies again to the new version: its `removeTools`, and its
+ *   variant, validated again against the new version. A variant that is no variant of it keeps
+ *   the turn on the version it pinned (`turn.version_kept`), so a variant never widens what the
+ *   turn may do. A flow's sessions keep the version they pinned.
  *
  * Re-pinning at the first segment, not when the message is accepted, keeps a turn that waits for
  * its compute to start on a version the Agent has at that start.
@@ -64,9 +67,14 @@ export declare function applyPin(session: Session, pin: SessionPin): void;
  * active turn is about to run its first segment and nothing of the turn has run yet: the turn
  * then runs that version. Returns whether it changed the session (the caller saves it).
  *
- * Leaves the session as it is for a flow and a flow's linked session, a turn whose message named
- * a variant, a later segment, a turn with any journaled effect, and a version whose harness is
- * not the session's (an Agent's harness is fixed for its life, D73).
+ * The turn's manifest on the new version is what its message asked (`Session.turnRequest`):
+ * its variant, validated against the new version, without the tools its `removeTools` names.
+ *
+ * Leaves the session as it is for a flow and a flow's linked session, a later segment, a turn
+ * with any journaled effect, a version whose harness is not the session's (an Agent's harness is
+ * fixed for its life, D73), a turn on a variant with no request recorded (accepted by an older
+ * Runtime), and a variant that is no variant of the new version: then the turn runs on the
+ * version it pinned, and `turn.version_kept` says why.
  */
 export declare function repinTurn(t: Tx, session: Session): Promise<boolean>;
 /** What a move of `agent` to `target` would do, and the target's runtime resolved. */

package/dist/tenant/agent-versions.js

@@ -1,6 +1,8 @@
 import { hashManifest } from "@nylorun/core/compatibility";
 import { loopManifestOf, runtimeOf } from "@nylorun/core/define";
 import { isWorkflowManifest } from "../core/flow-host.js";
+import { turnManifestFor } from "../core/turn-manifest.js";
+import { variantStore } from "./session.js";
 import { canonical } from "../store/canonical.js";
 import { resolveRecipe, sandboxSpecOf } from "../sandbox/resolve.js";
 import { effectiveSandboxConfig, readSandboxConfig } from "../sandbox/tenant-config.js";
@@ -60,9 +62,14 @@ export function applyPin(session, pin) {
  * active turn is about to run its first segment and nothing of the turn has run yet: the turn
  * then runs that version. Returns whether it changed the session (the caller saves it).
  *
- * Leaves the session as it is for a flow and a flow's linked session, a turn whose message named
- * a variant, a later segment, a turn with any journaled effect, and a version whose harness is
- * not the session's (an Agent's harness is fixed for its life, D73).
+ * The turn's manifest on the new version is what its message asked (`Session.turnRequest`):
+ * its variant, validated against the new version, without the tools its `removeTools` names.
+ *
+ * Leaves the session as it is for a flow and a flow's linked session, a later segment, a turn
+ * with any journaled effect, a version whose harness is not the session's (an Agent's harness is
+ * fixed for its life, D73), a turn on a variant with no request recorded (accepted by an older
+ * Runtime), and a variant that is no variant of the new version: then the turn runs on the
+ * version it pinned, and `turn.version_kept` says why.
  */
 export async function repinTurn(t, session) {
     const id = session.environmentId;
@@ -73,8 +80,9 @@ export async function repinTurn(t, session) {
         return false;
     if (!checkpoint || checkpoint.segment !== 0 || checkpoint.turnId !== session.activeTurnId)
         return false;
-    // A variant the message named (a turn-manifest variant) is validated against the old pin.
-    if (checkpoint.manifestHash !== session.manifestHash)
+    const request = session.turnRequest?.turnId === session.activeTurnId ? session.turnRequest : undefined;
+    // A variant whose request is not recorded cannot be validated against another version.
+    if (checkpoint.manifestHash !== session.manifestHash && request === undefined)
         return false;
     const agent = await t.environment(id);
     if (!agent)
@@ -86,10 +94,26 @@ export async function repinTurn(t, session) {
     const { pin } = await pinOf(t, agent);
     if (pin.harness !== harnessOf(session))
         return false;
+    const turn = request
+        ? turnManifestFor({ pinned: pin.manifest, pinnedHash: pin.manifestHash, request })
+        : { ok: true, manifest: pin.manifest, hash: pin.manifestHash };
+    if (!turn.ok) {
+        const from = { ...session.definition };
+        const to = { name: agent.manifestName, version: agent.manifestVersion };
+        await t.event(session.id, session.activeTurnId, "turn.version_kept", {
+            reason: "variant_invalid",
+            from,
+            to,
+            message: `The turn manifest the message carried is no variant of ${to.name}@${to.version}, the version Agent ${agent.id} runs now, so this turn runs on ${from.name}@${from.version}. Send a variant of the new version, or name the tools the turn may not use with removeTools.`,
+        });
+        return false;
+    }
     const changed = pin.manifestHash !== session.manifestHash;
     applyPin(session, pin);
     session.environmentVersion = agent.version;
-    session.checkpoint = { ...session.checkpoint, manifestHash: pin.manifestHash };
+    if (turn.hash !== pin.manifestHash)
+        variantStore(session).put(turn.hash, turn.manifest);
+    session.checkpoint = { ...session.checkpoint, manifestHash: turn.hash };
     // MCP discovery is per loop manifest: the next one is the new version's.
     if (changed) {
         delete session.mcpSnapshot;

package/dist/tenant/agents.d.ts

@@ -56,13 +56,25 @@ export declare function planAgentPut(ctx: TenantContext, id: string, body: PutAg
  * they are set (track T3). Best effort: the write stands either way.
  */
 export declare function secretWritten(ctx: TenantContext, id: string): Promise<void>;
+/**
+ * A secret write as the vault takes it (`Keys.putEnvironmentSecret`): the typed request, and
+ * whether its `via` is the slot's (`viaFromSlot`), so a session follows the slot of the version
+ * its Agent runs, rather than this installation's own `via` (Host feature `secret-routing`).
+ */
+export interface SecretWrite {
+    readonly request: PutAgentSecretRequest;
+    readonly viaFromSlot: boolean;
+}
 /**
  * The secret write `raw` asks of Environment `id` (D64). When what it runs declares secret
  * slots, the name must be one (`409 secret_not_in_manifest`), and the body is `{ value }` (or
  * `{ headers }` for a `headers` slot) with the binding from the slot; a full typed body is
- * accepted only when its binding is the slot's. Without slots, today's typed body.
+ * accepted only when its binding is the slot's. Without slots, today's typed body. Either way a
+ * `bearer` or `headers` slot's write may add this installation's routing (Host feature
+ * `secret-routing`): `via`, which wins over the slot's, and the gateway's `toolPrefix`, which
+ * gives way to the slot's (a different one is accepted, with a warning in the log).
  */
-export declare function secretRequestFor(ctx: TenantContext, id: string, name: string, raw: unknown): Promise<PutAgentSecretRequest>;
+export declare function secretRequestFor(ctx: TenantContext, id: string, name: string, raw: unknown): Promise<SecretWrite>;
 /** What a create does for a fork (`POST .../fork`); `copied` is filled in by the create. */
 interface Fork {
     source: string;

package/dist/tenant/agents.js

@@ -560,15 +560,18 @@ export async function secretWritten(ctx, id) {
  * The secret write `raw` asks of Environment `id` (D64). When what it runs declares secret
  * slots, the name must be one (`409 secret_not_in_manifest`), and the body is `{ value }` (or
  * `{ headers }` for a `headers` slot) with the binding from the slot; a full typed body is
- * accepted only when its binding is the slot's. Without slots, today's typed body.
+ * accepted only when its binding is the slot's. Without slots, today's typed body. Either way a
+ * `bearer` or `headers` slot's write may add this installation's routing (Host feature
+ * `secret-routing`): `via`, which wins over the slot's, and the gateway's `toolPrefix`, which
+ * gives way to the slot's (a different one is accepted, with a warning in the log).
  */
 export async function secretRequestFor(ctx, id, name, raw) {
-    const request = await parseSecretRequest(ctx, id, name, raw);
+    const write = await parseSecretRequest(ctx, id, name, raw);
     // Within the Tenant's Runtime limits `secretValueChars` and `secretHosts`, read for the write.
-    const issues = secretRequestIssues(request, await ctx.store.tx((t) => readRuntimeLimits(t)));
+    const issues = secretRequestIssues(write.request, await ctx.store.tx((t) => readRuntimeLimits(t)));
     if (issues.length > 0)
         fail(400, issues.join(" "));
-    return request;
+    return write;
 }
 async function parseSecretRequest(ctx, id, name, raw) {
     const { environment, slots } = await ctx.store.tx(async (t) => {
@@ -576,38 +579,73 @@ async function parseSecretRequest(ctx, id, name, raw) {
         return { environment, slots: environment && (await slotsAhead(t, environment)) };
     });
     if (!environment || slots === undefined)
-        return PutAgentSecretRequestSchema.parse(raw);
+        return { request: PutAgentSecretRequestSchema.parse(raw), viaFromSlot: false };
     const named = `${environment.manifestName}@${environment.targetVersion ?? environment.manifestVersion}`;
     const slot = slots[name] ??
         fail(409, `Agent ${id}'s manifest (${named}) declares no secret ${name}: add the slot to the manifest's runtime section, then move the Agent to the new version.`, { code: "secret_not_in_manifest", details: { declared: Object.keys(slots).sort() } });
     const full = slotRequest(slot);
+    const slotVia = typeof full.via === "string" ? full.via : undefined;
+    const routed = slot.type === "bearer" || slot.type === "headers";
+    /** The write's prefix gives way to the slot's: said in the log when they differ. */
+    const prefixed = (toolPrefix) => {
+        if (routed && toolPrefix !== undefined && slot.toolPrefix !== undefined && toolPrefix !== slot.toolPrefix)
+            ctx.config.logger.warn("secret tool prefix gives way to the manifest's", {
+                environmentId: id,
+                secret: name,
+                manifest: named,
+            });
+    };
     if (raw !== null && typeof raw === "object" && "type" in raw) {
         const body = PutAgentSecretRequestSchema.parse(raw);
-        // The gateway's tool prefix is this installation's to add (`gateway-credentials`).
-        const { requestId: _, value: _v, headers: _h, toolPrefix: _p, ...binding } = body;
-        if (canonical(binding) !== canonical(full))
+        // This installation's routing (`gateway-credentials`, `secret-routing`): its via and the
+        // gateway's tool prefix are its own to add.
+        const { requestId: _, value: _v, headers: _h, toolPrefix, via, ...binding } = body;
+        const { via: _s, ...slotBinding } = full;
+        if (canonical(binding) !== canonical(slotBinding))
             fail(409, `Secret ${name}'s type and binding come from Agent ${id}'s manifest: send only its value ({ "value": "…" }).`, {
                 code: "secret_not_in_manifest",
             });
-        return body;
+        prefixed(toolPrefix);
+        if (!routed || (via !== undefined && via !== slotVia))
+            return { request: body, viaFromSlot: false };
+        // No via of its own: the slot's, which a session reads from the version its Agent runs.
+        return {
+            request: PutAgentSecretRequestSchema.parse({ ...body, ...(slotVia === undefined ? {} : { via: slotVia }) }),
+            viaFromSlot: slotVia !== undefined,
+        };
     }
-    const { requestId, value, headers, toolPrefix } = PutAgentSecretValueRequestSchema.parse(raw);
+    const { requestId, value, headers, via, toolPrefix } = PutAgentSecretValueRequestSchema.parse(raw);
+    if (!routed && (via !== undefined || toolPrefix !== undefined))
+        fail(400, `Secret ${name} is an ${slot.type}: via and toolPrefix are for a bearer or headers secret.`);
+    if (toolPrefix !== undefined && via === undefined && slotVia === undefined)
+        fail(400, `toolPrefix needs via: Secret ${name}'s slot names none, so send one with the value.`);
+    prefixed(toolPrefix);
     const withId = {
         ...(requestId === undefined ? {} : { requestId }),
         ...(toolPrefix === undefined ? {} : { toolPrefix }),
     };
+    // The write's via wins over the slot's (`secret-routing`); the URL still picks the credential.
+    const routing = via === undefined ? {} : { via };
+    const viaFromSlot = via === undefined && slotVia !== undefined;
     if (slot.type === "headers") {
         if (headers === undefined)
             fail(400, `Secret ${name} is a headers credential: send { "headers": { … } }.`);
-        return PutAgentSecretRequestSchema.parse({ ...withId, ...full, headers });
+        return { request: PutAgentSecretRequestSchema.parse({ ...withId, ...full, ...routing, headers }), viaFromSlot };
     }
     if (value === undefined)
         fail(400, `Secret ${name} takes a value: send { "value": "…" }.`);
-    return PutAgentSecretRequestSchema.parse({ ...withId, ...full, value });
+    return { request: PutAgentSecretRequestSchema.parse({ ...withId, ...full, ...routing, value }), viaFromSlot };
 }
-/** A slot's type and binding, as a secret write's fields (without the value). */
+/**
+ * A slot's type and binding, as a secret write's fields (without the value). A slot's
+ * `toolPrefix` stays the slot's: a session reads it from the version its Agent runs.
+ */
 function slotRequest(slot) {
     const { required: _r, description: _d, ...binding } = slot;
+    if ("toolPrefix" in binding) {
+        const { toolPrefix: _p, ...rest } = binding;
+        return rest;
+    }
     return binding;
 }
 /**

package/dist/tenant/commands.js

@@ -24,7 +24,7 @@
 import { randomUUID } from "node:crypto";
 import { createDurableCheckpoint, createFlowCheckpoint, resumeFlowCheckpoint, } from "@nylorun/harness/run";
 import { commandKey, cancelQueuedEffects, flowInteractionOf, foreignInteractionConflict, isWorkflowManifest, planCancelCascade, wakeLinkedWorkflow, } from "../core/flow-host.js";
-import { resolveMessageManifest } from "../core/turn-manifest.js";
+import { resolveMessageManifest, turnManifestFor, turnManifestRequestOf } from "../core/turn-manifest.js";
 import { canonical } from "../store/canonical.js";
 import { lockedSession, } from "./context.js";
 import { fail, HttpError } from "./http.js";
@@ -388,14 +388,21 @@ async function beginMessageTurn(t, s, id, messages) {
             input: first.input,
         });
     else {
-        const resolved = resolveMessageManifest({
-            pinned: s.manifest,
-            pinnedHash: s.manifestHash,
-            messageManifest: first.command.manifest,
-            store: variantStore(s),
-        });
+        const request = turnManifestRequestOf(first.command);
+        const resolved = turnManifestFor({ pinned: s.manifest, pinnedHash: s.manifestHash, request: request ?? {} });
         if (!resolved.ok)
             return fail(400, resolved.message);
+        if (resolved.hash !== s.manifestHash)
+            variantStore(s).put(resolved.hash, resolved.manifest);
+        // A turn's first segment applies the request again to the version it re-pins (`repinTurn`).
+        if (request)
+            s.turnRequest = {
+                turnId,
+                ...(resolved.variant === undefined ? {} : { manifest: resolved.variant }),
+                ...(request.removeTools === undefined ? {} : { removeTools: [...request.removeTools] }),
+            };
+        else
+            delete s.turnRequest;
         checkpoint = createDurableCheckpoint({
             manifest: resolved.manifest,
             sessionId: id,
@@ -456,7 +463,8 @@ export async function startQueuedTurn(ctx, t, s, id) {
     const queued = await t.queuedMessages(id);
     if (queued.length === 0)
         return undefined;
-    const manifestOf = (row) => canonical(row.command.manifest ?? null);
+    // Messages that ask the same of their turn's manifest (a variant, `removeTools`) share a turn.
+    const manifestOf = (row) => canonical(turnManifestRequestOf(row.command) ?? null);
     const batch = isWorkflowManifest(s.manifest) ? [queued[0]] : [];
     if (batch.length === 0)
         for (const row of queued) {

package/dist/tenant/context.d.ts

@@ -15,7 +15,7 @@
  * under ownership (§10.6); `abortLocal` aborts an advance running on this process.
  */
 import type { SessionHistory } from "./history.js";
-import type { IssuerScope, SessionModelChoice, SubjectScope, TenantEnvelope } from "@nylorun/core/contracts";
+import type { IssuerScope, SessionModelChoice, SessionModelRecord, SubjectScope, TenantEnvelope } from "@nylorun/core/contracts";
 import type { DurableCheckpoint, FlowCheckpoint } from "@nylorun/harness/run";
 import type { AgentManifest, JsonValue, SandboxManifest } from "@nylorun/core/define";
 import type { OutboxRequest, SessionStore, Tx } from "../store/types.js";
@@ -63,6 +63,17 @@ export interface Session {
     loop?: Record<string, unknown>;
     /** Validated turn-manifest variants, keyed by hash (loops.md §4.2). */
     variants?: Record<string, AgentManifest>;
+    /**
+     * What the active turn's first message asked of its manifest: a variant (`manifest`) and the
+     * tools it may not use (`removeTools`, Host feature `remove-tools`). A turn's first segment that
+     * re-pins the session to its Agent's version applies it again to that version (`repinTurn`).
+     * Absent when the message asked for neither.
+     */
+    turnRequest?: {
+        turnId: string;
+        manifest?: AgentManifest;
+        removeTools?: string[];
+    };
     info?: any;
     status: string;
     activeTurnId: string | null;
@@ -147,6 +158,24 @@ export interface Session {
      * place of the Tenant's while its provider is connected. Absent: the Tenant's model.
      */
     model?: SessionModelChoice;
+    /**
+     * The Agent's memory as the session's last turn started (track T5): the newest memory version
+     * then (`seen`), and whether that turn's first segment asked the harness to pin the index again
+     * (`refresh`: someone else wrote the memory since the turn before). Absent before its first turn.
+     */
+    memoryIndex?: {
+        turnId: string;
+        seen?: string;
+        refresh: boolean;
+    };
+    /** Where `model` came from: `manifest` when its Agent's version named it (`harness.model`). Absent: chosen. */
+    modelSource?: "manifest";
+    /**
+     * The model the session's turns call and why (`SessionModelRecord`, `tenant/session-model.ts`):
+     * as the session opened or chose it, and at each segment's start since. Absent while the
+     * Tenant has no model, and on a session opened before it was kept.
+     */
+    modelRecord?: SessionModelRecord;
 }
 export type AuthScope = {
     kind: "application";