@nylorun/runtime 0.44.2-beta → 0.45.0-beta

package/CHANGELOG.md

@@ -1,5 +1,23 @@
 # Changelog
 
+## 0.45.0-beta
+
+### Minor Changes
+
+- f87ba81: Pods on Agent Substrate (preview, ADR-138 Phase 1a). `nylorun local sandbox enable --context <name> --backend substrate` runs the Tenant's sandboxes as Agent Substrate v1.0 actors instead of agent-sandbox Sandboxes, on a Kubernetes 1.37 cluster with Substrate installed (Docker Desktop's kind cluster, or Substrate's own kind script). It creates the Tenant's namespace and the sandboxes service's RBAC, makes the Tenant's atespace with the service as its editor, gives actors a name for the edge in CoreDNS, and publishes the edge's two ports from the `sandboxes` service: a TLS front, in that container, through which actors reach the Harness API and the gates. The default backend stays agent-sandbox, and nothing changes for a Tenant that does not pass `--backend substrate`.
+
+  The sandboxes service drives Substrate's API: a template per pod incarnation, pinned by digest; an egress policy from the Agent's network (its preset, hosts and suffixes, which the core now sends with each pod); suspend and resume for `mode`; and the same `/v1/pods` contract, so the core is unchanged. Not yet on Substrate: keys injected at egress, builds and tags; those come in Phase 1b.
+
+### Patch Changes
+
+- 0c6634b: `GET /v1/tenant/sandbox`'s `cluster` names its `backend` (`agent-sandbox` or `substrate`) and, on Agent Substrate, its `atespace`. `nylorun doctor sandbox` prints the Tenant's pods line (backend, context, namespace, ready), and Studio's Sandbox section says Agent Substrate with the atespace.
+- Pin core to the tested release.
+- Pin harness to the tested release.
+- Updated dependencies [0c6634b]
+- Updated dependencies
+  - @nylorun/core@0.39.0-beta
+  - @nylorun/harness@0.35.1-beta
+
 ## 0.44.2-beta
 
 ### Patch Changes

package/dist/api/components.d.ts

@@ -15910,6 +15910,11 @@ export declare const TenantSandboxView: z.ZodObject<{
         namespace: z.ZodString;
         context: z.ZodString;
         ready: z.ZodBoolean;
+        backend: z.ZodOptional<z.ZodEnum<{
+            "agent-sandbox": "agent-sandbox";
+            substrate: "substrate";
+        }>>;
+        atespace: z.ZodOptional<z.ZodString>;
         controllerVersion: z.ZodOptional<z.ZodString>;
         networkPolicy: z.ZodOptional<z.ZodObject<{
             enforced: z.ZodBoolean;

package/dist/api/http/routes/tenant.js

@@ -69,6 +69,8 @@ async function clusterOf(ctx) {
             namespace: info.namespace,
             context: info.context,
             ready,
+            backend: info.backend === "substrate" ? "substrate" : "agent-sandbox",
+            ...(info.backend === "substrate" && info.atespace ? { atespace: info.atespace } : {}),
             ...(info.controllerVersion ? { controllerVersion: info.controllerVersion } : {}),
             ...(info.networkPolicy
                 ? {

package/dist/management-openapi.json

@@ -2,7 +2,7 @@
   "openapi": "3.2.0",
   "info": {
     "title": "Nylorun Management API",
-    "version": "0.44.2-beta",
+    "version": "0.45.0-beta",
     "x-nylorun-protocol": {
       "min": 16,
       "max": 18,
@@ -2258,6 +2258,16 @@
               "ready": {
                 "type": "boolean"
               },
+              "backend": {
+                "type": "string",
+                "enum": [
+                  "agent-sandbox",
+                  "substrate"
+                ]
+              },
+              "atespace": {
+                "type": "string"
+              },
               "controllerVersion": {
                 "type": "string"
               },

package/dist/openapi.json

@@ -2,7 +2,7 @@
   "openapi": "3.2.0",
   "info": {
     "title": "Nylorun Runtime API",
-    "version": "0.44.2-beta",
+    "version": "0.45.0-beta",
     "x-nylorun-protocol": {
       "min": 16,
       "max": 18,

package/dist/sandbox/pods/client.d.ts

@@ -24,6 +24,15 @@ export interface PodSpec {
     readonly env?: Readonly<Record<string, string>>;
     /** Written to the Sandbox's join Secret before it is applied. */
     readonly joinToken?: string;
+    /**
+     * The Agent's resolved network. agent-sandbox ignores it (egress-gate enforces it); the
+     * Substrate backend renders the actor's egress policy from it (ADR-138).
+     */
+    readonly network?: {
+        readonly preset: string;
+        readonly hosts: readonly string[];
+        readonly suffixes: readonly string[];
+    };
 }
 /** A Sandbox as the service's informers see it (`driver.Status` in Go). */
 export interface PodStatus {
@@ -52,6 +61,9 @@ export interface ClusterInfo {
     readonly context: string;
     readonly controllerVersion?: string;
     readonly apiVersion?: string;
+    /** `agent-sandbox` (also when absent: older services) or `substrate` (ADR-138, preview). */
+    readonly backend?: "agent-sandbox" | "substrate";
+    readonly atespace?: string;
     readonly hostAddress?: string;
     readonly ports?: Readonly<Record<string, number>>;
     readonly networkPolicy?: {

package/dist/sandbox/pods/spec.js

@@ -5,7 +5,7 @@
  */
 import { parseSandboxDuration, parseSandboxSize } from "@nylorun/core/define";
 import { DEFAULT_HARNESS } from "@nylorun/core/contracts";
-import { idleMsOf, memoryMiBOf } from "../policy.js";
+import { idleMsOf, memoryMiBOf, resolveNetwork } from "../policy.js";
 import { podTuningEnv } from "../../tuning.js";
 import { opIdOf } from "./lifecycle.js";
 import { runsBuiltinEngine } from "./builtin.js";
@@ -71,5 +71,11 @@ export function podSpecOf(input) {
             ...podTuningEnv(),
         },
         ...(input.joinToken ? { joinToken: input.joinToken } : {}),
+        network: networkOf(spec),
     };
 }
+/** The spec's network as the sandboxes service reads it. */
+function networkOf(spec) {
+    const network = resolveNetwork(spec);
+    return { preset: network.preset, hosts: [...network.hosts], suffixes: [...network.suffixes] };
+}

package/dist/version.d.ts

@@ -1 +1 @@
-export declare const RUNTIME_VERSION = "0.44.2-beta";
+export declare const RUNTIME_VERSION = "0.45.0-beta";

package/dist/version.js

@@ -1,3 +1,3 @@
 // Kept in step with package.json by runtime/server/scripts/check-package.mjs, which runs in npm run check.
 // release:prepare also rewrites this when it bumps @nylorun/runtime.
-export const RUNTIME_VERSION = "0.44.2-beta";
+export const RUNTIME_VERSION = "0.45.0-beta";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nylorun/runtime",
-  "version": "0.44.2-beta",
+  "version": "0.45.0-beta",
   "description": "Nylorun Runtime: the agent execution Host on Postgres, Restate and S2, and model providers.",
   "type": "module",
   "license": "Apache-2.0",
@@ -65,8 +65,8 @@
     "@hono/node-server": "^2.1.5",
     "@hono/zod-openapi": "^1.6.3",
     "@modelcontextprotocol/sdk": "^1.32.1",
-    "@nylorun/core": "0.38.0-beta",
-    "@nylorun/harness": "0.35.0-beta",
+    "@nylorun/core": "0.39.0-beta",
+    "@nylorun/harness": "0.35.1-beta",
     "@restatedev/restate-sdk": "1.17.3",
     "@restatedev/restate-sdk-clients": "1.17.3",
     "@s2-dev/streamstore": "0.28.0",