@nylorun/runtime 0.45.0-beta → 0.46.0-beta

package/CHANGELOG.md

@@ -1,5 +1,35 @@
 # Changelog
 
+## 0.46.0-beta
+
+### Minor Changes
+
+- b6a7c1d: An agent sees the images and PDFs it makes in its sandbox (ADR-139). `read` of a file the turn's model reads as media, known by its extension (an image, a PDF, an Office document, audio or video), comes back as the file itself, shown to the model in the turn's files, instead of numbered lines of decoded bytes. Our engine runs it in the harness: it reads the bytes, checks they start as the type says, and stores them as an artifact for the model only. A model that can't read the kind is told so before anything is read or stored (`sandbox.unreadable`), and a file that isn't what its name says fails `sandbox.binary_file`.
+
+  - **Model-only artifacts.** `artifact.write` `begin` takes `audience: "model"` (Harness API 5, schema revision 5, `harness-api/v5.5.json`; only our own engine sends it). Such an artifact is readable by id and carries `audience: "model"` in its view and its `artifact.created` event, but is never listed (`GET /v1/artifacts`, a session's artifacts, pages) and is no A2A task file. Runtime store migration 0046 (`artifacts.audience`, nullable) runs at start.
+  - **Binary files.** The sandbox's `read` of any other binary file fails `sandbox.binary_file`, in words, instead of answering decoded bytes as text.
+  - **A cap per call.** A model call carries at most the 6 newest files from tool results as media; older ones in the same turn go as a note naming them, which `read_artifact` brings back. A person's own files are never capped.
+  - `read`'s description says what it now does, so the prompt prefix of every agent with a sandbox changes once: its first call after the upgrade misses the prompt cache.
+
+### Patch Changes
+
+- b6a7c1d: Trigger runs fired in the same millisecond now list in the order they fired: run ids a Runtime makes strictly increase, instead of breaking a same-millisecond tie on their random part.
+- 522e6d7: A pod Agent's idle period now runs from when its pod became ready, not from when it was asked to start. A slow start, such as a cold node pulling the image, no longer uses up the idle period: on the Agent Substrate exit test, a pod that took 56 s to start was suspended as idle 3.6 s after it could first take a turn. Becoming ready moves the pod's last activity to that moment, which the idle timer, the idle decision and the Tenant's sweep all read.
+- f1ac19f: Pods on Agent Substrate (preview): a wake no longer waits on a DNS lookup of the edge. The sandboxes service pins the edge's name to the address `enable` found in each actor's `/etc/hosts` (when the image lets the engine's user write it), so a restored actor's first lookup, which can be lost, is never made; the exit test's rerun measured 1.15–1.51 s in four of ten wakes from that lookup's retry. `nylorun local sandbox enable --backend substrate` also tries the pod's lookup of the Docker host three times before refusing the context, since a pod's first lookup can find no address on a cluster that just started.
+- Pin core to the tested release.
+- Pin harness to the tested release.
+- Updated dependencies [b6a7c1d]
+- Updated dependencies
+  - @nylorun/core@0.40.0-beta
+  - @nylorun/harness@0.36.0-beta
+
+## 0.45.1-beta
+
+### Patch Changes
+
+- 40820b8: Pods on Agent Substrate (preview): `nylorun local sandbox enable --backend substrate` no longer fails at the Tenant's atespace (`access_policy.metadata.atespace: Forbidden: must not be set`), and a pod that ran before wakes again instead of failing every later apply with `name: Required value`. The sandboxes service now writes the atespace's access policy without an atespace, as Substrate v1.0 requires of a global-scoped policy, and names the actor's egress policy (`default`) when it reads it back.
+- 1740a16: Pods on Agent Substrate (preview): a pod's first start on a node that lacks its image no longer fails. The sandboxes service tries a resume that times out or finds Substrate busy again, every 5 s for up to 10 minutes while the pod should still be running; before, the first resume gave up after 2 minutes during a long image pull and the actor stayed RESUMING. Actors also get `RES_OPTIONS=timeout:1 attempts:3`, so a wake whose first DNS lookup of the edge is lost waits about 1 s instead of 5 s (an Agent's own `RES_OPTIONS` wins).
+
 ## 0.45.0-beta
 
 ### Minor Changes

package/dist/api/a2a/tasks.d.ts

@@ -84,7 +84,8 @@ export declare function telemetryOf(payload: unknown, traceId: string | undefine
 export declare function fileUrl(baseUrl: string | undefined, artifactId: string, version: number): string;
 /**
  * The A2A artifact of a file the turn wrote (`artifact.created`, `artifact.version.created`), with
- * `files/v1`, or undefined for the caller's own uploads. A folder is served as its zip.
+ * `files/v1`, or undefined for the caller's own uploads and for a file stored only for the model
+ * (ADR-139). A folder is served as its zip.
  */
 export declare function fileArtifact(payload: unknown, baseUrl: string | undefined): Artifact | undefined;
 /**

package/dist/api/a2a/tasks.js

@@ -246,13 +246,17 @@ export function fileUrl(baseUrl, artifactId, version) {
 }
 /**
  * The A2A artifact of a file the turn wrote (`artifact.created`, `artifact.version.created`), with
- * `files/v1`, or undefined for the caller's own uploads. A folder is served as its zip.
+ * `files/v1`, or undefined for the caller's own uploads and for a file stored only for the model
+ * (ADR-139). A folder is served as its zip.
  */
 export function fileArtifact(payload, baseUrl) {
     if (!isRecord(payload) || typeof payload.artifactId !== "string" || typeof payload.name !== "string")
         return undefined;
     if (payload.source === "upload")
         return undefined;
+    // A file stored only for the model to see (ADR-139) is no output of the task.
+    if (payload.audience === "model")
+        return undefined;
     const version = Number(payload.version);
     const folder = payload.kind === "folder";
     return {

package/dist/api/components.d.ts

@@ -1805,6 +1805,7 @@ export declare const ArtifactView: z.ZodObject<{
     agentId: z.ZodOptional<z.ZodString>;
     latestVersion: z.ZodNumber;
     labels: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    audience: z.ZodOptional<z.ZodLiteral<"model">>;
     createdAt: z.ZodString;
     updatedAt: z.ZodString;
     versions: z.ZodOptional<z.ZodArray<z.ZodObject<{
@@ -1833,6 +1834,7 @@ export declare const ArtifactListItem: z.ZodObject<{
     agentId: z.ZodOptional<z.ZodString>;
     latestVersion: z.ZodNumber;
     labels: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    audience: z.ZodOptional<z.ZodLiteral<"model">>;
     createdAt: z.ZodString;
     updatedAt: z.ZodString;
 }, z.core.$strict>;
@@ -1850,6 +1852,7 @@ export declare const ArtifactPage: z.ZodObject<{
         agentId: z.ZodOptional<z.ZodString>;
         latestVersion: z.ZodNumber;
         labels: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        audience: z.ZodOptional<z.ZodLiteral<"model">>;
         createdAt: z.ZodString;
         updatedAt: z.ZodString;
     }, z.core.$strict>>;
@@ -1867,6 +1870,7 @@ export declare const ListArtifactsResponse: z.ZodObject<{
         agentId: z.ZodOptional<z.ZodString>;
         latestVersion: z.ZodNumber;
         labels: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        audience: z.ZodOptional<z.ZodLiteral<"model">>;
         createdAt: z.ZodString;
         updatedAt: z.ZodString;
         versions: z.ZodOptional<z.ZodArray<z.ZodObject<{
@@ -1897,6 +1901,7 @@ export declare const UploadArtifactResponse: z.ZodObject<{
         agentId: z.ZodOptional<z.ZodString>;
         latestVersion: z.ZodNumber;
         labels: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        audience: z.ZodOptional<z.ZodLiteral<"model">>;
         createdAt: z.ZodString;
         updatedAt: z.ZodString;
         versions: z.ZodOptional<z.ZodArray<z.ZodObject<{
@@ -2844,6 +2849,7 @@ export declare const SessionEvent: z.ZodDiscriminatedUnion<[z.ZodObject<{
             snapshot: "snapshot";
             upload: "upload";
         }>;
+        audience: z.ZodOptional<z.ZodLiteral<"model">>;
         callId: z.ZodOptional<z.ZodString>;
         fileCount: z.ZodOptional<z.ZodNumber>;
         claimed: z.ZodOptional<z.ZodBoolean>;
@@ -3154,6 +3160,7 @@ export declare const SessionEvent: z.ZodDiscriminatedUnion<[z.ZodObject<{
             snapshot: "snapshot";
             upload: "upload";
         }>;
+        audience: z.ZodOptional<z.ZodLiteral<"model">>;
         callId: z.ZodOptional<z.ZodString>;
         fileCount: z.ZodOptional<z.ZodNumber>;
         claimed: z.ZodOptional<z.ZodBoolean>;
@@ -6075,6 +6082,7 @@ export declare const SessionEvent: z.ZodDiscriminatedUnion<[z.ZodObject<{
             snapshot: "snapshot";
             upload: "upload";
         }>;
+        audience: z.ZodOptional<z.ZodLiteral<"model">>;
         callId: z.ZodOptional<z.ZodString>;
         fileCount: z.ZodOptional<z.ZodNumber>;
         claimed: z.ZodOptional<z.ZodBoolean>;
@@ -6385,6 +6393,7 @@ export declare const SessionEvent: z.ZodDiscriminatedUnion<[z.ZodObject<{
             snapshot: "snapshot";
             upload: "upload";
         }>;
+        audience: z.ZodOptional<z.ZodLiteral<"model">>;
         callId: z.ZodOptional<z.ZodString>;
         fileCount: z.ZodOptional<z.ZodNumber>;
         claimed: z.ZodOptional<z.ZodBoolean>;
@@ -9309,6 +9318,7 @@ export declare const SessionItemsResponse: z.ZodObject<{
                 snapshot: "snapshot";
                 upload: "upload";
             }>;
+            audience: z.ZodOptional<z.ZodLiteral<"model">>;
             callId: z.ZodOptional<z.ZodString>;
             fileCount: z.ZodOptional<z.ZodNumber>;
             claimed: z.ZodOptional<z.ZodBoolean>;
@@ -9619,6 +9629,7 @@ export declare const SessionItemsResponse: z.ZodObject<{
                 snapshot: "snapshot";
                 upload: "upload";
             }>;
+            audience: z.ZodOptional<z.ZodLiteral<"model">>;
             callId: z.ZodOptional<z.ZodString>;
             fileCount: z.ZodOptional<z.ZodNumber>;
             claimed: z.ZodOptional<z.ZodBoolean>;
@@ -12540,6 +12551,7 @@ export declare const SessionItemsResponse: z.ZodObject<{
                 snapshot: "snapshot";
                 upload: "upload";
             }>;
+            audience: z.ZodOptional<z.ZodLiteral<"model">>;
             callId: z.ZodOptional<z.ZodString>;
             fileCount: z.ZodOptional<z.ZodNumber>;
             claimed: z.ZodOptional<z.ZodBoolean>;
@@ -12850,6 +12862,7 @@ export declare const SessionItemsResponse: z.ZodObject<{
                 snapshot: "snapshot";
                 upload: "upload";
             }>;
+            audience: z.ZodOptional<z.ZodLiteral<"model">>;
             callId: z.ZodOptional<z.ZodString>;
             fileCount: z.ZodOptional<z.ZodNumber>;
             claimed: z.ZodOptional<z.ZodBoolean>;
@@ -16694,6 +16707,7 @@ export declare const HistoryPage: z.ZodObject<{
                 snapshot: "snapshot";
                 upload: "upload";
             }>;
+            audience: z.ZodOptional<z.ZodLiteral<"model">>;
             callId: z.ZodOptional<z.ZodString>;
             fileCount: z.ZodOptional<z.ZodNumber>;
             claimed: z.ZodOptional<z.ZodBoolean>;
@@ -17004,6 +17018,7 @@ export declare const HistoryPage: z.ZodObject<{
                 snapshot: "snapshot";
                 upload: "upload";
             }>;
+            audience: z.ZodOptional<z.ZodLiteral<"model">>;
             callId: z.ZodOptional<z.ZodString>;
             fileCount: z.ZodOptional<z.ZodNumber>;
             claimed: z.ZodOptional<z.ZodBoolean>;
@@ -19925,6 +19940,7 @@ export declare const HistoryPage: z.ZodObject<{
                 snapshot: "snapshot";
                 upload: "upload";
             }>;
+            audience: z.ZodOptional<z.ZodLiteral<"model">>;
             callId: z.ZodOptional<z.ZodString>;
             fileCount: z.ZodOptional<z.ZodNumber>;
             claimed: z.ZodOptional<z.ZodBoolean>;
@@ -20235,6 +20251,7 @@ export declare const HistoryPage: z.ZodObject<{
                 snapshot: "snapshot";
                 upload: "upload";
             }>;
+            audience: z.ZodOptional<z.ZodLiteral<"model">>;
             callId: z.ZodOptional<z.ZodString>;
             fileCount: z.ZodOptional<z.ZodNumber>;
             claimed: z.ZodOptional<z.ZodBoolean>;

package/dist/artifacts/disk.js

@@ -324,6 +324,7 @@ async function commitDiskVersion(ctx, id, entries, epoch) {
                 createdAt,
                 updatedAt: createdAt,
                 environmentId: id,
+                audience: null,
             };
             await t.insertArtifact(artifact, version);
         }

package/dist/artifacts/folders.js

@@ -195,6 +195,7 @@ export async function commitFolderVersion(ctx, input) {
                     createdAt,
                     updatedAt: createdAt,
                     environmentId: null,
+                    audience: null,
                 };
                 await t.insertArtifact(row, version);
             }

package/dist/artifacts/service.d.ts

@@ -1,4 +1,4 @@
-import type { ArtifactSource, ArtifactVersionView, ArtifactView, FolderManifest } from "@nylorun/core/contracts";
+import type { ArtifactAudience, ArtifactSource, ArtifactVersionView, ArtifactView, FolderManifest } from "@nylorun/core/contracts";
 import { type BlobBody } from "../blob/index.js";
 import type { ArtifactRow, ArtifactVersionRow, Tx } from "../store/types.js";
 import { type SessionAccess, type TenantContext } from "../tenant/context.js";
@@ -18,6 +18,8 @@ export interface UploadInput {
     /** The body's declared length (`Content-Length`): one past the limits is refused unread. */
     readonly declaredBytes?: number;
     readonly source: ArtifactSource;
+    /** `model`: a new artifact stored only for the model to see (ADR-139). */
+    readonly audience?: ArtifactAudience;
     /** The turn that saved it (a harness's `artifact.write`), for the event. */
     readonly turnId?: string | null;
     /** The tool call that saved it, for the event. */

package/dist/artifacts/service.js

@@ -85,6 +85,7 @@ export function artifactView(row, versions) {
         ...(row.environmentId === null ? {} : { agentId: row.environmentId }),
         latestVersion: row.latestVersion,
         ...(row.labelsJson === null ? {} : { labels: JSON.parse(row.labelsJson) }),
+        ...(row.audience === null ? {} : { audience: row.audience }),
         createdAt: row.createdAt,
         updatedAt: row.updatedAt,
         ...(versions === undefined ? {} : { versions: versions.map(versionView) }),
@@ -236,6 +237,7 @@ export async function uploadArtifact(ctx, input, body, access, signal) {
                     createdAt,
                     updatedAt: createdAt,
                     environmentId: null,
+                    audience: input.audience ?? null,
                 };
                 version = {
                     artifactId,
@@ -260,6 +262,7 @@ export async function uploadArtifact(ctx, input, body, access, signal) {
                     size: version.size,
                     sha256: version.sha256,
                     source: version.source,
+                    ...(row.audience === null ? {} : { audience: row.audience }),
                     ...(input.callId === undefined ? {} : { callId: input.callId }),
                 });
             return { artifact: artifactView(row), version: versionView(version), created: true };

package/dist/harness-api/artifacts.js

@@ -202,6 +202,7 @@ export function createArtifactSeam(ctx) {
             ...(contentType === undefined ? {} : { contentType }),
             sessionId,
             source: "engine",
+            ...(params.audience === undefined || params.artifactId !== undefined ? {} : { audience: params.audience }),
             turnId: scope.turnId,
             ...(begun.callId === undefined ? {} : { callId: begun.callId }),
             writeKey,

package/dist/management-openapi.json

@@ -2,7 +2,7 @@
   "openapi": "3.2.0",
   "info": {
     "title": "Nylorun Management API",
-    "version": "0.45.0-beta",
+    "version": "0.46.0-beta",
     "x-nylorun-protocol": {
       "min": 16,
       "max": 18,

package/dist/openapi.json

@@ -2,7 +2,7 @@
   "openapi": "3.2.0",
   "info": {
     "title": "Nylorun Runtime API",
-    "version": "0.45.0-beta",
+    "version": "0.46.0-beta",
     "x-nylorun-protocol": {
       "min": 16,
       "max": 18,
@@ -17563,6 +17563,12 @@
                   "snapshot"
                 ]
               },
+              "audience": {
+                "type": "string",
+                "enum": [
+                  "model"
+                ]
+              },
               "callId": {
                 "type": "string"
               },
@@ -17805,6 +17811,12 @@
                   "snapshot"
                 ]
               },
+              "audience": {
+                "type": "string",
+                "enum": [
+                  "model"
+                ]
+              },
               "callId": {
                 "type": "string"
               },
@@ -25717,6 +25729,12 @@
                   "type": "string"
                 }
               },
+              "audience": {
+                "type": "string",
+                "enum": [
+                  "model"
+                ]
+              },
               "createdAt": {
                 "type": "string"
               },
@@ -25868,6 +25886,12 @@
                     "type": "string"
                   }
                 },
+                "audience": {
+                  "type": "string",
+                  "enum": [
+                    "model"
+                  ]
+                },
                 "createdAt": {
                   "type": "string"
                 },
@@ -25995,6 +26019,12 @@
               "type": "string"
             }
           },
+          "audience": {
+            "type": "string",
+            "enum": [
+              "model"
+            ]
+          },
           "createdAt": {
             "type": "string"
           },
@@ -26049,6 +26079,12 @@
               "type": "string"
             }
           },
+          "audience": {
+            "type": "string",
+            "enum": [
+              "model"
+            ]
+          },
           "createdAt": {
             "type": "string"
           },

package/dist/sandbox/pods/lifecycle.d.ts

@@ -19,6 +19,8 @@
  *   reconciled, whichever path woke it: a turn's end arms it too, but a wake with no turn end
  *   (a disk copy's `wakePod`, commands through the session's sandbox route) armed nothing and
  *   ran on for days. A timer that fires during a turn looks again one idle period later.
+ *   Becoming ready moves `lastActiveAt` to that moment, so a slow start doesn't use up the
+ *   idle period before the pod can take a turn.
  * - **Lost**: an incarnation that has run (a pod joined) whose Sandbox is gone or whose volume
  *   is missing is `lost` (`agent.lost`): its host epoch moves, its Sandbox is deleted, and
  *   only a reset brings the Environment back. agent-sandbox recreates a deleted claim empty, so

package/dist/sandbox/pods/lifecycle.js

@@ -171,9 +171,17 @@ export function decide(facts) {
         if (pod.observed === "failed" && pod.reason?.startsWith(SETUP_FAILED))
             return done();
         if (status.ready) {
+            // Becoming ready counts as activity: the idle period runs from when the pod could first take
+            // a turn, so a slow start (a cold node's image pull) doesn't use it up (P1.8 rerun: a 56 s
+            // start was suspended as idle 3.6 s after it ran).
+            let lastActive = Date.parse(pod.lastActiveAt ?? row.createdAt);
             if (pod.observed !== "running") {
                 patch.observed = "running";
                 patch.reason = null;
+                if (now > lastActive) {
+                    patch.lastActiveAt = new Date(now).toISOString();
+                    lastActive = now;
+                }
             }
             // The image it runs, pinned by digest from now on (Q14).
             const digest = pod.imageDigest === undefined ? imageDigestOf(status.imageID, facts.image) : undefined;
@@ -181,7 +189,7 @@ export function decide(facts) {
                 patch.imageDigest = digest;
             // Whatever woke it, a running pod has an idle timer (the idle trigger armed its own above).
             if (facts.trigger !== "idle")
-                arm.push({ timer: "idle", at: Date.parse(pod.lastActiveAt ?? row.createdAt) + facts.config.idleMs });
+                arm.push({ timer: "idle", at: lastActive + facts.config.idleMs });
             return done();
         }
         const startedAt = Date.parse(pod.startedAt ?? row.updatedAt);

package/dist/sandbox/tools.d.ts

@@ -15,6 +15,11 @@ export interface SandboxToolReport {
  * mounting a skill, a tool's own helper command): `harness.helperCommandTimeoutMs`.
  */
 export declare const helperCommandTimeoutMs: () => number;
+/**
+ * Whether decoded file content is binary: a NUL among its first 8000 characters, or a run of
+ * replacement characters where invalid UTF-8 was (more than 1 in 10). Text never has NULs.
+ */
+export declare function looksBinary(content: string): boolean;
 export declare function quote(value: string): string;
 /**
  * An absolute path inside the sandbox. Relative paths are relative to the workspace; on a backend

package/dist/sandbox/tools.js

@@ -13,6 +13,20 @@ import { hostTuning } from "../tuning.js";
  * mounting a skill, a tool's own helper command): `harness.helperCommandTimeoutMs`.
  */
 export const helperCommandTimeoutMs = () => hostTuning().harness.helperCommandTimeoutMs;
+/**
+ * Whether decoded file content is binary: a NUL among its first 8000 characters, or a run of
+ * replacement characters where invalid UTF-8 was (more than 1 in 10). Text never has NULs.
+ */
+export function looksBinary(content) {
+    const head = content.slice(0, 8000);
+    if (head.includes("\u0000"))
+        return true;
+    let replaced = 0;
+    for (const char of head)
+        if (char === "\ufffd")
+            replaced += 1;
+    return head.length > 0 && replaced / head.length > 0.1;
+}
 export function quote(value) {
     return `'${value.replaceAll("'", `'\\''`)}'`;
 }
@@ -75,6 +89,9 @@ environment) {
             const content = await handle.readFile(path);
             if (content === undefined)
                 return failed("sandbox.not_found", `No file at ${path}`);
+            // A binary file decodes to garbage the model can't tell from text (ADR-139): say so instead.
+            if (looksBinary(content))
+                return failed("sandbox.binary_file", `${path} is a binary file, not text. read shows text files, and images, PDFs and other files your model reads by their extension; use bash to inspect this one.`);
             const lines = content.split("\n");
             if (lines.at(-1) === "")
                 lines.pop();

package/dist/store/postgres/drizzle/0046_artifacts_audience.sql

@@ -0,0 +1 @@
+ALTER TABLE "nylorun"."artifacts" ADD COLUMN "audience" text;

package/dist/store/postgres/drizzle/meta/_journal.json

@@ -323,6 +323,13 @@
       "when": 1793954783377,
       "tag": "0045_session_queue_delivery",
       "breakpoints": true
+    },
+    {
+      "idx": 46,
+      "version": "7",
+      "when": 1794240246972,
+      "tag": "0046_artifacts_audience",
+      "breakpoints": true
     }
   ]
 }

package/dist/store/postgres/reads.js

@@ -179,6 +179,8 @@ export function createPostgresReadStore(source, tenantId) {
                     .where(and(eq(sessions.id, artifacts.sessionId), accessWhere(access)))), filters.sessionId === undefined
                 ? undefined
                 : eq(artifacts.sessionId, filters.sessionId), filters.kind === undefined ? undefined : eq(artifacts.kind, filters.kind), 
+            // A file stored only for the model (ADR-139) is never listed.
+            isNull(artifacts.audience), 
             // Labels are a flat string map serialized by JSON.stringify. Match its exact
             // key/value pair: jsonb rejects NUL/unpaired surrogate escapes labels may hold.
             ...Object.entries(filters.labels).map(([k, v]) => sql `strpos(${artifacts.labelsJson}, ${JSON.stringify(k) + ":" + JSON.stringify(v)}) > 0`), key ? sql `(${artifacts.createdAt}, ${artifacts.id}) < (${key[0]}, ${key[1]})` : undefined))

package/dist/store/postgres/schema.d.ts

@@ -4995,6 +4995,23 @@ export declare const artifacts: import("drizzle-orm/pg-core").PgTableWithColumns
         }, {}, {
             pgColumnBuilderBrand: 'PgCustomColumnBuilderBrand';
         }>;
+        audience: import("drizzle-orm/pg-core").PgColumn<{
+            name: "audience";
+            tableName: "artifacts";
+            dataType: "string";
+            columnType: "PgText";
+            data: "model";
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: ["model"];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
     };
     dialect: 'pg';
 }>;

package/dist/store/postgres/schema.js

@@ -626,6 +626,11 @@ export const artifacts = nylorun.table("artifacts", {
     updatedAt: text().notNull(),
     /** The Agent whose disk versions this folder holds (R2d step 3); one per Agent. */
     environmentId: textC(),
+    /**
+     * `model`: our engine stored it only for its model to see (ADR-139); null for an output.
+     * Such an artifact is readable by id and never listed.
+     */
+    audience: text({ enum: ["model"] }),
 }, (t) => [
     index("artifacts_session").on(t.sessionId, t.createdAt, t.id),
     uniqueIndex("artifacts_environment_disk").on(t.environmentId).where(sql `environment_id IS NOT NULL`),

package/dist/store/postgres/store.js

@@ -1581,7 +1581,8 @@ class PostgresTx {
         return this.db
             .select()
             .from(artifacts)
-            .where(filter.sessionId === undefined ? undefined : eq(artifacts.sessionId, filter.sessionId))
+            // A file stored only for the model (ADR-139) is never listed.
+            .where(and(isNull(artifacts.audience), filter.sessionId === undefined ? undefined : eq(artifacts.sessionId, filter.sessionId)))
             .orderBy(artifacts.createdAt, artifacts.id);
     }
     async insertArtifact(row, version) {

package/dist/tenant/triggers.d.ts

@@ -8,7 +8,12 @@ export declare const triggerTimerKey: (agentId: string, triggerId: string) => st
 export declare const newEndpointId: () => string;
 /** A webhook endpoint's path, under the Runtime API's origin. */
 export declare const webhookPath: (endpointId: string) => string;
-/** A new run id: increasing with time, so runs list newest first by id. */
+/**
+ * A new run id: its time in ms then a random 64-bit suffix, so runs list newest first by id. Ids
+ * this process makes strictly increase: one in the same ms as the last (or with the clock moved
+ * back) keeps the last's time and adds one to its suffix, so two runs fired back to back never
+ * list in the wrong order.
+ */
 export declare function newRunId(now?: number): string;
 /** A schedule's cron in its time zone (UTC by default); throws on a bad pattern or zone. */
 export declare function cronOf(trigger: Pick<Trigger, "schedule" | "timezone">): Cron;

package/dist/tenant/triggers.js

@@ -59,9 +59,28 @@ function parseTimerKey(key) {
 export const newEndpointId = () => `wh_${randomBytes(16).toString("hex")}`;
 /** A webhook endpoint's path, under the Runtime API's origin. */
 export const webhookPath = (endpointId) => `/v1/webhooks/${endpointId}`;
-/** A new run id: increasing with time, so runs list newest first by id. */
+/** The last run id this process made: its time and 64-bit suffix, for `newRunId`'s tie-break. */
+let lastRunId;
+const SUFFIX_MAX = (1n << 64n) - 1n;
+/**
+ * A new run id: its time in ms then a random 64-bit suffix, so runs list newest first by id. Ids
+ * this process makes strictly increase: one in the same ms as the last (or with the clock moved
+ * back) keeps the last's time and adds one to its suffix, so two runs fired back to back never
+ * list in the wrong order.
+ */
 export function newRunId(now = Date.now()) {
-    return `run_${now.toString(36).padStart(9, "0")}${randomBytes(8).toString("hex")}`;
+    let ms = now;
+    let suffix = BigInt(`0x${randomBytes(8).toString("hex")}`);
+    if (lastRunId && ms <= lastRunId.ms) {
+        ms = lastRunId.ms;
+        suffix = lastRunId.suffix + 1n;
+        if (suffix > SUFFIX_MAX) {
+            ms += 1;
+            suffix = 0n;
+        }
+    }
+    lastRunId = { ms, suffix };
+    return `run_${ms.toString(36).padStart(9, "0")}${suffix.toString(16).padStart(16, "0")}`;
 }
 /** A schedule's cron in its time zone (UTC by default); throws on a bad pattern or zone. */
 export function cronOf(trigger) {

package/dist/version.d.ts

@@ -1 +1 @@
-export declare const RUNTIME_VERSION = "0.45.0-beta";
+export declare const RUNTIME_VERSION = "0.46.0-beta";

package/dist/version.js

@@ -1,3 +1,3 @@
 // Kept in step with package.json by runtime/server/scripts/check-package.mjs, which runs in npm run check.
 // release:prepare also rewrites this when it bumps @nylorun/runtime.
-export const RUNTIME_VERSION = "0.45.0-beta";
+export const RUNTIME_VERSION = "0.46.0-beta";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nylorun/runtime",
-  "version": "0.45.0-beta",
+  "version": "0.46.0-beta",
   "description": "Nylorun Runtime: the agent execution Host on Postgres, Restate and S2, and model providers.",
   "type": "module",
   "license": "Apache-2.0",
@@ -65,8 +65,8 @@
     "@hono/node-server": "^2.1.5",
     "@hono/zod-openapi": "^1.6.3",
     "@modelcontextprotocol/sdk": "^1.32.1",
-    "@nylorun/core": "0.39.0-beta",
-    "@nylorun/harness": "0.35.1-beta",
+    "@nylorun/core": "0.40.0-beta",
+    "@nylorun/harness": "0.36.0-beta",
     "@restatedev/restate-sdk": "1.17.3",
     "@restatedev/restate-sdk-clients": "1.17.3",
     "@s2-dev/streamstore": "0.28.0",