@nylorun/runtime 0.52.0-beta → 0.53.0-beta

package/dist/sandbox/computer.js

@@ -0,0 +1,271 @@
+/**
+ * Computers in core (ADR-149, ADR-150): a pod Agent on an Agent Substrate cluster whose sandboxes
+ * service renders computers (`NYLORUN_SANDBOX_GATEWAY_URL` set). Its engine runs no loop: its
+ * sessions' runs go to the harness container, and its commands and files go through the sandbox
+ * gateway with a ticket core signs here (`computer-ticket.key`, Ed25519; ADR-148).
+ *
+ * - `computerAccess` wakes the computer when it isn't running (as a turn start does), waits until
+ *   the sandboxes service says it is ready (its wake-up probe answered), records its first contact
+ *   (`agent.running` or `agent.relaunched`, the pod's UID for the lost check), and answers where it
+ *   is and a ticket. Core's own uses (the sandbox route, disk versions, artifacts) open it so.
+ * - `openComputer` is what a harness gets with `computer.open`: the same, once a seed being copied
+ *   onto a new volume is written (R2d step 3), with the disk's setup run through the computer when
+ *   its marker isn't the recipe's (R2d step 2; `prepareComputerDisk`), and a version's start check
+ *   passed (T3).
+ */
+import { createPrivateKey, randomUUID, sign } from "node:crypto";
+import { readFileSync } from "node:fs";
+import { posix } from "node:path";
+import { fail, failRetryLater } from "../tenant/http.js";
+import { wakePod } from "../tenant/agents.js";
+import { passStartCheck } from "../tenant/agent-versions.js";
+import { computerBackend } from "../adapters/sandbox/computer.js";
+import { SandboxManager } from "./manager.js";
+import { memorySandboxRecords } from "./records.js";
+import { recordSetup, setupFile, setupPlanOf } from "./setup.js";
+import { hostTuning } from "../tuning.js";
+export const TICKET_TTL_MS = 10 * 60_000;
+/** Reads `NYLORUN_COMPUTER_TICKET_KEY_FILE`'s key (PKCS #8 PEM, Ed25519). */
+export function loadTicketKey(path) {
+    const key = createPrivateKey(readFileSync(path, "utf8"));
+    if (key.asymmetricKeyType !== "ed25519")
+        throw new Error(`${path} is not an Ed25519 key`);
+    return key;
+}
+/** A computer ticket for sandbox `subject`, signed with `key`: a compact JWS (EdDSA). */
+export function signTicket(key, subject, expiresAt) {
+    const header = Buffer.from(JSON.stringify({ alg: "EdDSA", typ: "JWT" })).toString("base64url");
+    const body = Buffer.from(JSON.stringify({ aud: "nylorun-computer", sub: subject, exp: Math.floor(expiresAt / 1000) })).toString("base64url");
+    const signature = sign(null, Buffer.from(`${header}.${body}`), key).toString("base64url");
+    return `${header}.${body}.${signature}`;
+}
+/** Whether pod Environments of this Tenant are computers. */
+export function computersOf(ctx) {
+    return ctx.pods?.computer;
+}
+const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+/**
+ * Wakes computer `id` if needed, waits until it is ready, and answers where it is with a ticket.
+ * Refused for a lost, deleted or failed one.
+ */
+export async function computerAccess(ctx, id, signal) {
+    const computers = computersOf(ctx);
+    const pods = ctx.pods;
+    if (!computers || !pods)
+        return fail(409, `Agent ${id} is not a computer on this Runtime.`, { code: "agent_unavailable" });
+    await wakePod(ctx, id);
+    const deadline = Date.now() + hostTuning().pods.readyDeadlineMs;
+    for (;;) {
+        if (signal?.aborted)
+            throw signal.reason ?? new Error("Cancelled");
+        const environment = await ctx.store.tx((t) => t.environment(id));
+        const pod = environment?.pod;
+        if (!environment || !pod || pod.desired === "deleted")
+            return fail(404, `Agent ${id} does not exist.`, { code: "not_found" });
+        if (pod.observed === "lost")
+            return fail(409, `Agent ${id}'s computer was lost (${pod.reason ?? "its volume is gone"}). Reset it.`, { code: "agent_lost" });
+        if (pod.observed === "failed")
+            return fail(409, `Agent ${id}'s computer failed: ${pod.reason ?? "it did not start"}.`, { code: "agent_unavailable" });
+        const status = await pods.client.status(pod.k8sName, { wait: "ready", timeoutMs: 20_000 }).catch(() => undefined);
+        if (status?.ready && status.podUID) {
+            await firstContact(ctx, id, status.podUID);
+            const expiresAt = Date.now() + computers.ttlMs;
+            return {
+                url: `${computers.gatewayUrl}/${pod.k8sName}`,
+                ticket: signTicket(computers.ticketKey, pod.k8sName, expiresAt),
+                expiresAt,
+            };
+        }
+        if (Date.now() > deadline)
+            failRetryLater(`Agent ${id}'s computer was not ready within ${hostTuning().pods.readyDeadlineMs / 1000} s.`, "agent_unavailable");
+        // The reconcile moves the row along (creating → running); the next look waits on the service.
+        await ctx.sandboxSignal(id, { kind: "reconcile" }).catch(() => undefined);
+        await sleep(500);
+    }
+}
+/** Records the computer's first answer since it started: its UID, and `agent.running` or `agent.relaunched`. */
+async function firstContact(ctx, id, podUid) {
+    await ctx.store.tx(async (t) => {
+        const environment = await t.environment(id, { lock: true });
+        const pod = environment?.pod;
+        if (!pod || pod.podUid === podUid || pod.desired !== "running")
+            return;
+        const now = new Date().toISOString();
+        const epoch = pod.hostEpoch + 1;
+        await t.updateEnvironmentPod(id, { podUid, hostEpoch: epoch, observed: "running", reason: null }, now);
+        if (pod.podUid !== undefined)
+            await t.agentEvent(id, "agent.relaunched", { hostEpoch: epoch });
+        else
+            await t.agentEvent(id, "agent.running", { hostEpoch: epoch });
+    });
+}
+const opening = new Map();
+/**
+ * What `computer.open` answers a harness: access to computer `id`, once a seed is written, its
+ * setup ran, and a version's start check passed. Concurrent opens of one computer share one.
+ */
+export function openComputer(ctx, id, signal) {
+    const key = `${ctx.config.tenantId}\0${id}`;
+    let pending = opening.get(key);
+    if (!pending) {
+        pending = openOnce(ctx, id, signal).finally(() => opening.delete(key));
+        opening.set(key, pending);
+    }
+    return pending;
+}
+async function openOnce(ctx, id, signal) {
+    let access = await computerAccess(ctx, id, signal);
+    // A new volume being seeded from a disk version (R2d step 3): wait until core has written it.
+    const deadline = Date.now() + hostTuning().pods.readyDeadlineMs;
+    for (;;) {
+        const environment = await ctx.store.tx((t) => t.environment(id));
+        if (!environment?.diskSeed || environment.diskSeed.written)
+            break;
+        const { runPendingSeed } = await import("../artifacts/disk.js");
+        void runPendingSeed(ctx, id);
+        if (Date.now() > deadline)
+            failRetryLater(`Agent ${id}'s disk is still being copied.`, "agent_busy");
+        await sleep(hostTuning().pods.enginePollMs);
+    }
+    const backend = computerBackend({ open: async () => (access = await computerAccess(ctx, id, signal)) });
+    const handle = await backend.open({ key: id, cpus: 1, memoryMiB: 1024, network: { preset: "none", hosts: [], suffixes: [] } });
+    await prepareComputerDisk(ctx, id, handle, signal);
+    const environment = await ctx.store.tx((t) => t.environment(id));
+    if (environment?.startCheck && environment.pod)
+        await passStartCheck(ctx, id, environment.pod.hostEpoch);
+    return access;
+}
+const MARKER = "/harness/setup.json";
+const VOLUME = "/harness/volume-id";
+/** The disk's setup, run through the computer when its marker isn't the recipe's (R2d step 2). */
+export async function prepareComputerDisk(ctx, id, handle, signal) {
+    const state = await ctx.store.tx(async (t) => {
+        const environment = await t.environment(id);
+        if (!environment?.pod)
+            return undefined;
+        return {
+            epoch: environment.pod.hostEpoch,
+            setup: await setupPlanOf(ctx, t, environment),
+            seeded: environment.diskSeed !== undefined,
+            afterSeed: environment.diskSeed?.setup === true,
+        };
+    });
+    if (!state)
+        return;
+    let volumeId = (await handle.readFile(VOLUME))?.trim();
+    if (!volumeId) {
+        volumeId = randomUUID();
+        await handle.writeFile(VOLUME, `${volumeId}\n`);
+    }
+    const markerOf = (setup) => ({
+        volumeId: volumeId,
+        recipeVersion: setup?.recipeVersion ?? 0,
+        ...(setup?.setupHash === undefined ? {} : { setupHash: setup.setupHash }),
+        status: "ok",
+    });
+    const setup = state.setup;
+    if (state.seeded && !state.afterSeed) {
+        // The disk version holds what setup made: mark it done.
+        await handle.writeFile(MARKER, `${JSON.stringify(markerOf(setup))}\n`);
+        return;
+    }
+    if (!setup) {
+        if (state.afterSeed)
+            await recordSetup(ctx, id, state.epoch, { status: "ok" });
+        return;
+    }
+    const raw = await handle.readFile(MARKER);
+    if (raw) {
+        try {
+            const done = JSON.parse(raw);
+            const same = done.setupHash === undefined || done.setupHash === setup.setupHash;
+            if (done.volumeId === volumeId && done.status === "ok" && same)
+                return;
+        }
+        catch {
+            // a broken marker: run it again
+        }
+    }
+    ctx.config.logger.info("environment setup started", { environmentId: id, recipeVersion: setup.recipeVersion });
+    const report = await runSetup(ctx, id, handle, setup, signal ?? new AbortController().signal);
+    if (report.status === "ok")
+        await handle.writeFile(MARKER, `${JSON.stringify(markerOf(setup))}\n`);
+    await recordSetup(ctx, id, state.epoch, report);
+    if (report.status === "failed")
+        fail(409, `Agent ${id}'s setup failed${report.index === undefined ? "" : ` at command ${report.index + 1}`}: ${(report.output ?? "").slice(-500)}`, {
+            code: "agent_unavailable",
+        });
+}
+async function bytesOf(body) {
+    return new Uint8Array(await new Response(body).arrayBuffer());
+}
+async function ensureDir(handle, path, signal) {
+    await handle.exec({ command: `mkdir -p '${path.replace(/'/g, "'\\''")}'`, cwd: "/", timeoutMs: 30_000 }, signal);
+}
+function under(base, relative) {
+    const joined = posix.normalize(posix.join(base, relative));
+    if (joined !== base && !joined.startsWith(`${base.replace(/\/$/, "")}/`))
+        throw new Error(`${relative} would leave ${base}`);
+    return joined;
+}
+async function runSetup(ctx, id, handle, setup, signal) {
+    for (const file of setup.files) {
+        try {
+            const first = await setupFile(ctx, id, file.index, undefined);
+            if (!first)
+                throw new Error(`input file ${file.index + 1} is gone`);
+            if (first.kind === "file") {
+                await ensureDir(handle, posix.dirname(file.path), signal);
+                await handle.writeFile(file.path, await bytesOf(first.body));
+                continue;
+            }
+            for (const entry of first.entries) {
+                const one = await setupFile(ctx, id, file.index, entry.path);
+                if (!one || one.kind !== "file")
+                    throw new Error(`input file ${file.index + 1}, ${entry.path}, is gone`);
+                const target = under(file.path, entry.path);
+                await ensureDir(handle, posix.dirname(target), signal);
+                await handle.writeFile(target, await bytesOf(one.body));
+            }
+        }
+        catch (error) {
+            return { status: "failed", output: error instanceof Error ? error.message : String(error) };
+        }
+    }
+    for (const [index, command] of setup.commands.entries()) {
+        await ensureDir(handle, command.cwd, signal).catch(() => undefined);
+        try {
+            const result = await handle.exec({ command: command.command, cwd: command.cwd, timeoutMs: command.timeoutMs, env: setup.environment }, signal);
+            if (result.exitCode !== 0) {
+                const output = `${result.stdout}${result.stderr ? `\n${result.stderr}` : ""}${result.timedOut ? "\n[timed out]" : ""}`;
+                return { status: "failed", index, exitCode: result.exitCode, output: output.slice(-hostTuning().harness.setupReportTailChars) };
+            }
+        }
+        catch (error) {
+            return { status: "failed", index, output: error instanceof Error ? error.message : String(error) };
+        }
+    }
+    return { status: "ok" };
+}
+/**
+ * A SandboxManager per computer, for core's own uses: its backend opens the computer with
+ * `computerAccess` (no setup run: the harness's `computer.open` does that before a turn's tools).
+ */
+export function computerManagers(ctx, emit) {
+    const managers = new Map();
+    return (environmentId) => {
+        let manager = managers.get(environmentId);
+        if (!manager) {
+            manager = new SandboxManager({
+                scope: ctx().config.tenantId,
+                records: memorySandboxRecords(),
+                backends: [computerBackend({ open: (signal) => computerAccess(ctx(), environmentId, signal) })],
+                preference: "auto",
+                ephemeral: false,
+                emit,
+            });
+            managers.set(environmentId, manager);
+        }
+        return manager;
+    };
+}

package/dist/sandbox/placement.d.ts

@@ -5,7 +5,8 @@
  * Runtime's harness: in process, or the harness container) and `sandbox` (the engine in a pod).
  * Default: both. `"*": { hosts: [] }` refuses every harness the map does not name (R4.1).
  *
- * A session on a pod Environment runs on `sandbox`; every other session (a virtual or `none`
+ * A session on a pod Environment runs on `sandbox` (on `harness-container` when pod Agents are
+ * computers, ADR-149); every other session (a virtual or `none`
  * Environment, or none) on `harness-container` (D52). A host the Tenant does not allow is
  * `409 placement_refused`. A pod Environment needs sandbox pods: without a cluster (`nylorun
  * sandbox enable`), or with the sandboxes service not ready, it is `409 agent_unavailable`.
@@ -21,7 +22,9 @@ export declare function placementOf(config: TenantSandboxConfig, harnessId?: str
 /** How to enable sandbox pods, for the messages that need them. */
 export declare const ENABLE_PODS = "run `nylorun local sandbox enable --context <name>` to give this Tenant a cluster";
 /** Refuses a session whose harness, on the host its Environment needs, the Tenant does not allow. */
-export declare function checkPlacement(config: TenantSandboxConfig, kind: EnvironmentKind | undefined, harness?: string): void;
+export declare function checkPlacement(config: TenantSandboxConfig, kind: EnvironmentKind | undefined, harness?: string, 
+/** Pod Agents are computers (ADR-149): their harness runs in the harness container. */
+computers?: boolean): void;
 /** Whether the sandboxes service is up, the answer reused for `pods.readyCacheMs` (Host tuning). */
 export declare function podsReady(pods: TenantPods): Promise<boolean>;
 /** Refuses a pod Environment without sandbox pods, or with the sandboxes service down. */

package/dist/sandbox/placement.js

@@ -5,7 +5,8 @@
  * Runtime's harness: in process, or the harness container) and `sandbox` (the engine in a pod).
  * Default: both. `"*": { hosts: [] }` refuses every harness the map does not name (R4.1).
  *
- * A session on a pod Environment runs on `sandbox`; every other session (a virtual or `none`
+ * A session on a pod Environment runs on `sandbox` (on `harness-container` when pod Agents are
+ * computers, ADR-149); every other session (a virtual or `none`
  * Environment, or none) on `harness-container` (D52). A host the Tenant does not allow is
  * `409 placement_refused`. A pod Environment needs sandbox pods: without a cluster (`nylorun
  * sandbox enable`), or with the sandboxes service not ready, it is `409 agent_unavailable`.
@@ -24,8 +25,10 @@ export function placementOf(config, harnessId = HARNESS_ID) {
 /** How to enable sandbox pods, for the messages that need them. */
 export const ENABLE_PODS = "run `nylorun local sandbox enable --context <name>` to give this Tenant a cluster";
 /** Refuses a session whose harness, on the host its Environment needs, the Tenant does not allow. */
-export function checkPlacement(config, kind, harness = HARNESS_ID) {
-    const host = kind === "pod" ? "sandbox" : "harness-container";
+export function checkPlacement(config, kind, harness = HARNESS_ID, 
+/** Pod Agents are computers (ADR-149): their harness runs in the harness container. */
+computers = false) {
+    const host = kind === "pod" && !computers ? "sandbox" : "harness-container";
     const allowed = placementOf(config, harness);
     if (allowed.includes(host))
         return;

package/dist/sandbox/pods/reconcile.js

@@ -131,6 +131,7 @@ export async function reconcileSandbox(ctx, sandboxId, trigger) {
             harness: row.applied.harness,
             ...(joinToken ? { joinToken } : {}),
             keys,
+            ...(pods.computer ? { computer: true } : {}),
         });
         try {
             await pods.client.put(row.pod.k8sName, spec);

package/dist/sandbox/pods/spec.d.ts

@@ -45,5 +45,10 @@ export interface PodSpecInput {
     readonly joinToken?: string;
     /** The keyed hosts (`keys.ts`), for Agent Substrate's egress. */
     readonly keys?: PodSpec["keys"];
+    /**
+     * The pod is a computer (ADR-149): our engine runs there in computer mode whatever harness the
+     * Agent runs, since every harness runs outside it.
+     */
+    readonly computer?: boolean;
 }
 export declare function podSpecOf(input: PodSpecInput): PodSpec;

package/dist/sandbox/pods/spec.js

@@ -40,7 +40,7 @@ export function podSpecOf(input) {
     const lifecycle = podLifecycleConfig(config);
     // Pinned by digest once a pod ran it (Q14).
     const image = pod.imageDigest ?? spec.image;
-    const ours = (input.harness ?? DEFAULT_HARNESS) === DEFAULT_HARNESS;
+    const ours = input.computer === true || (input.harness ?? DEFAULT_HARNESS) === DEFAULT_HARNESS;
     // Our engine, built into an image the Tenant lists, while it is this Runtime's (ADR-99).
     const builtin = ours &&
         runsBuiltinEngine({

package/dist/sandbox/records.d.ts

@@ -27,3 +27,5 @@ export declare function storeSandboxRecords(store: SessionStore): SandboxRecords
  * change. Writes are serialized; a file that cannot be read starts empty.
  */
 export declare function fileSandboxRecords(path: string): SandboxRecords;
+/** Records kept in memory: a computer's compute is core's pod row, not a `sandboxes` row. */
+export declare function memorySandboxRecords(): SandboxRecords;

package/dist/sandbox/records.js

@@ -77,3 +77,14 @@ export function fileSandboxRecords(path) {
         count: async () => records.size,
     };
 }
+/** Records kept in memory: a computer's compute is core's pod row, not a `sandboxes` row. */
+export function memorySandboxRecords() {
+    const rows = new Map();
+    return {
+        get: async (key) => rows.get(key),
+        put: async (record) => void rows.set(record.key, record),
+        delete: async (key) => void rows.delete(key),
+        list: async () => [...rows.values()],
+        count: async () => rows.size,
+    };
+}

package/dist/sandbox/types.d.ts

@@ -3,8 +3,11 @@
  * and import a substrate SDK; everything else in the Runtime talks to this interface.
  */
 import type { SandboxNetworkPreset } from "@nylorun/core/define";
-/** `virtual` (just-bash, in process); `local` (the pod sandbox the engine runs in, F7.2). */
-export type SandboxBackendName = "virtual" | "local";
+/**
+ * `virtual` (just-bash, in process); `local` (the pod sandbox the engine runs in, F7.2);
+ * `computer` (an Agent Substrate computer, reached through the sandbox gateway, ADR-149).
+ */
+export type SandboxBackendName = "virtual" | "local" | "computer";
 /** What separates a sandbox from its host: the Runtime process, or a container boundary. */
 export type SandboxIsolation = "process" | "container";
 export interface SandboxProbe {

package/dist/tenant/advance.js

@@ -285,14 +285,17 @@ async function runRemoteSegment(ctx, lease, started, controller, run, onTaken, p
         const unusable = podUnusable(ctx, segment);
         if (unusable)
             throw new Error(unusable);
+        // A computer's run goes to the harness container (ADR-149); `computer.open` waits for its
+        // seed, runs its setup and passes its start check.
+        const computer = ctx.pods?.computer !== undefined;
         // A new volume being seeded from a disk version takes no turn until it holds it (R2d step 3).
-        if (segment.pod?.seeding)
+        if (!computer && segment.pod?.seeding)
             throw new HarnessUnavailable();
         // A pod starting on a new version takes no turn until its harness joins (track T3): a start
         // that fails goes back to the version it ran, and the turn's first segment re-pins to it.
-        if (segment.pod?.starting)
+        if (!computer && segment.pod?.starting)
             throw new HarnessUnavailable();
-        const pod = segment.pod?.id;
+        const pod = computer ? undefined : segment.pod?.id;
         if (started.environmentId !== undefined)
             placed.environment = started.environmentId;
         end = await ctx.harness.offer({

package/dist/tenant/context.d.ts

@@ -14,6 +14,7 @@
  * `wake` goes to `DurableExecution.wake`, which calls the Tenant's `advance` (`advance.ts`)
  * under ownership (§10.6); `abortLocal` aborts an advance running on this process.
  */
+import type { TenantComputers } from "../sandbox/computer.js";
 import type { SessionHistory } from "./history.js";
 import type { IssuerScope, SessionModelChoice, SessionModelRecord, SubjectScope, TenantEnvelope } from "@nylorun/core/contracts";
 import type { DurableCheckpoint, FlowCheckpoint } from "@nylorun/harness/run";
@@ -390,6 +391,8 @@ export interface TenantPods {
     readonly client: SandboxesClient;
     /** The Runtime image the pods copy the engine from (`NYLORUN_SANDBOX_HARNESS_IMAGE`). */
     readonly harnessImage: string;
+    /** Computers (ADR-149): every pod Agent is one, reached through the sandbox gateway. */
+    readonly computer?: TenantComputers;
 }
 /** The harness a session runs (R4.1): the one it pinned, else ours. */
 export declare function harnessOf(session: Pick<Session, "harness">): string;

package/dist/tenant/runtime.js

@@ -1,3 +1,20 @@
+/**
+ * Composition root of an open Tenant: validates the config, opens the Session Store and the
+ * vault key, builds the services and the `TenantContext`, wires the seams, registers the
+ * Tenant's Worker handlers and arms its sweep, and implements `TenantHandle` (handle,
+ * summary, drain, close) by delegating to the Tenant modules.
+ *
+ * Seams wired here: `wireStreams()` connects the store's commits to Durable Streams (the
+ * relay, and the history and SSE readers); `wireControl()` follows the control bus on
+ * Postgres (cancels and resets from other processes); `wake` goes to the
+ * `DurableExecution`, whose handlers (`worker.ts`) call `advance` and `sweep`; `abortLocal`
+ * aborts an advance running on this process.
+ *
+ * Execution: the Host passes its `TenantExecution` (`TenantOpenHooks.execution`); without
+ * one, the Tenant runs its own in-process `MemoryExecution`. No lock file: several processes may open a Tenant, and ownership of each
+ * session (§10.6) keeps its advances apart.
+ */
+import { computerManagers } from "../sandbox/computer.js";
 import { mkdirSync } from "node:fs";
 import { scriptedModel, toolFixtureModel, } from "../core/provider.js";
 import { tenantModelGate } from "../gates/in-process.js";
@@ -185,6 +202,23 @@ export class TenantRuntime {
                     logger: config.logger,
                     preference,
                     isPod: async (sandboxId) => (await opened.tx((t) => t.environment(sandboxId)))?.kind === "pod",
+                    ...(hooks.pods.computer
+                        ? {
+                            computer: (() => {
+                                const managerOf = computerManagers(() => ctx, async (sessionId, turnId, type, payload) => {
+                                    if (ctx.closed)
+                                        return;
+                                    try {
+                                        await opened.tx((t) => t.event(sessionId, turnId, type, payload));
+                                    }
+                                    catch {
+                                        /* the session is gone (reset) or the store closed */
+                                    }
+                                });
+                                return (environmentId) => localWorkspace(managerOf(environmentId));
+                            })(),
+                        }
+                        : {}),
                 })
                 : workspaces;
             // A model that is not the vault's (scripted, the fixture, an embedder's provider) is

package/dist/tenant/sessions.js

@@ -93,7 +93,8 @@ export async function openSessionIn(ctx, t, id, body, access, options = {}) {
     await checkSkillLimit(t, pin.manifest, agent);
     const config = await readSandboxConfig(t);
     // Placement (D38, D52): where this session's harness may run, decided now and kept.
-    checkPlacement(config, agent.kind, pin.harness);
+    // A computer's harness runs in the harness container (ADR-149).
+    checkPlacement(config, agent.kind, pin.harness, ctx.pods?.computer !== undefined);
     if (agent.kind === "pod")
         await requirePods(ctx.pods, `Agent ${agent.id}`);
     // The model the version names (`harness.model`, Host feature `agent-model`) is the new

package/dist/tenant/sweep.js

@@ -328,7 +328,8 @@ async function reconcileStalePods(ctx, now) {
                 pod.observed === "deleting" ||
                 (pod.desired === "suspended" && pod.observed !== "suspended") ||
                 // Running, but its engine is not connected: the pod may be gone, or its volume.
-                (pod.desired === "running" && pod.observed === "running" && !ctx.harness.hosting(row.id)) ||
+                // (A computer has no engine connection, ADR-149.)
+                (pod.desired === "running" && pod.observed === "running" && !ctx.pods?.computer && !ctx.harness.hosting(row.id)) ||
                 // Running past its idle limit: its idle timer is missing (or a turn holds it, which the
                 // reconcile leaves alone).
                 (pod.desired === "running" &&

package/dist/tenant/transcript.d.ts

@@ -231,7 +231,6 @@ export declare function toolCompleted(request: HostEffect, value: unknown, facts
     gate?: GateTimes | undefined;
     policy?: ToolPolicyFact | undefined;
 } | {
-    redacted?: undefined;
     agent: import("@nylorun/core/define").AgentRef;
     error: {
         code: string;
@@ -241,6 +240,7 @@ export declare function toolCompleted(request: HostEffect, value: unknown, facts
         retryable?: boolean | undefined;
     };
     output?: undefined;
+    redacted?: undefined;
     toolName: string;
     status?: "cancelled" | "completed" | "failed" | undefined;
     kind?: "harness" | "http" | "mcp" | "runtime" | "sandbox" | undefined;
@@ -254,7 +254,6 @@ export declare function toolCompleted(request: HostEffect, value: unknown, facts
     gate?: GateTimes | undefined;
     policy?: ToolPolicyFact | undefined;
 } | {
-    redacted?: undefined;
     agent?: undefined;
     error: {
         code: string;
@@ -264,6 +263,7 @@ export declare function toolCompleted(request: HostEffect, value: unknown, facts
         retryable?: boolean | undefined;
     };
     output?: undefined;
+    redacted?: undefined;
     toolName: string;
     status?: "cancelled" | "completed" | "failed" | undefined;
     kind?: "harness" | "http" | "mcp" | "runtime" | "sandbox" | undefined;
@@ -311,10 +311,10 @@ export declare function toolCompleted(request: HostEffect, value: unknown, facts
     gate?: GateTimes | undefined;
     policy?: ToolPolicyFact | undefined;
 } | {
-    redacted?: undefined;
     agent: import("@nylorun/core/define").AgentRef;
     error?: undefined;
     output: unknown;
+    redacted?: undefined;
     toolName: string;
     status?: "cancelled" | "completed" | "failed" | undefined;
     kind?: "harness" | "http" | "mcp" | "runtime" | "sandbox" | undefined;
@@ -328,10 +328,10 @@ export declare function toolCompleted(request: HostEffect, value: unknown, facts
     gate?: GateTimes | undefined;
     policy?: ToolPolicyFact | undefined;
 } | {
-    redacted?: undefined;
     agent?: undefined;
     error?: undefined;
     output: unknown;
+    redacted?: undefined;
     toolName: string;
     status?: "cancelled" | "completed" | "failed" | undefined;
     kind?: "harness" | "http" | "mcp" | "runtime" | "sandbox" | undefined;
@@ -395,7 +395,6 @@ export declare function toolCompleted(request: HostEffect, value: unknown, facts
     gate?: GateTimes | undefined;
     policy?: ToolPolicyFact | undefined;
 } | {
-    redacted?: undefined;
     callId: string;
     invocationId: string;
     agent: import("@nylorun/core/define").AgentRef;
@@ -407,6 +406,7 @@ export declare function toolCompleted(request: HostEffect, value: unknown, facts
         retryable?: boolean | undefined;
     };
     output?: undefined;
+    redacted?: undefined;
     toolName: string;
     status?: "cancelled" | "completed" | "failed" | undefined;
     kind?: "harness" | "http" | "mcp" | "runtime" | "sandbox" | undefined;
@@ -420,7 +420,6 @@ export declare function toolCompleted(request: HostEffect, value: unknown, facts
     gate?: GateTimes | undefined;
     policy?: ToolPolicyFact | undefined;
 } | {
-    redacted?: undefined;
     callId: string;
     invocationId: string;
     agent?: undefined;
@@ -432,6 +431,7 @@ export declare function toolCompleted(request: HostEffect, value: unknown, facts
         retryable?: boolean | undefined;
     };
     output?: undefined;
+    redacted?: undefined;
     toolName: string;
     status?: "cancelled" | "completed" | "failed" | undefined;
     kind?: "harness" | "http" | "mcp" | "runtime" | "sandbox" | undefined;
@@ -483,12 +483,12 @@ export declare function toolCompleted(request: HostEffect, value: unknown, facts
     gate?: GateTimes | undefined;
     policy?: ToolPolicyFact | undefined;
 } | {
-    redacted?: undefined;
     callId: string;
     invocationId: string;
     agent: import("@nylorun/core/define").AgentRef;
     error?: undefined;
     output: unknown;
+    redacted?: undefined;
     toolName: string;
     status?: "cancelled" | "completed" | "failed" | undefined;
     kind?: "harness" | "http" | "mcp" | "runtime" | "sandbox" | undefined;
@@ -502,12 +502,12 @@ export declare function toolCompleted(request: HostEffect, value: unknown, facts
     gate?: GateTimes | undefined;
     policy?: ToolPolicyFact | undefined;
 } | {
-    redacted?: undefined;
     callId: string;
     invocationId: string;
     agent?: undefined;
     error?: undefined;
     output: unknown;
+    redacted?: undefined;
     toolName: string;
     status?: "cancelled" | "completed" | "failed" | undefined;
     kind?: "harness" | "http" | "mcp" | "runtime" | "sandbox" | undefined;

package/dist/version.d.ts

@@ -1 +1 @@
-export declare const RUNTIME_VERSION = "0.52.0-beta";
+export declare const RUNTIME_VERSION = "0.53.0-beta";

package/dist/version.js

@@ -1,3 +1,3 @@
 // Kept in step with package.json by runtime/server/scripts/check-package.mjs, which runs in npm run check.
 // release:prepare also rewrites this when it bumps @nylorun/runtime.
-export const RUNTIME_VERSION = "0.52.0-beta";
+export const RUNTIME_VERSION = "0.53.0-beta";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nylorun/runtime",
-  "version": "0.52.0-beta",
+  "version": "0.53.0-beta",
   "description": "Nylorun Runtime: the agent execution Host on Postgres, Restate and S2, and model providers.",
   "type": "module",
   "license": "Apache-2.0",
@@ -65,8 +65,8 @@
     "@hono/node-server": "^2.1.8",
     "@hono/zod-openapi": "^1.6.3",
     "@modelcontextprotocol/sdk": "^1.32.2",
-    "@nylorun/core": "0.45.0-beta",
-    "@nylorun/harness": "0.36.5-beta",
+    "@nylorun/core": "0.46.0-beta",
+    "@nylorun/harness": "0.36.6-beta",
     "@restatedev/restate-sdk": "1.18.3",
     "@restatedev/restate-sdk-clients": "1.18.3",
     "@s2-dev/streamstore": "0.30.0",