@springbrand/agent-runtime 0.3.0-alpha.20 → 0.3.0-alpha.21

package/src/adapter/cloudflare/schema.ts

@@ -19,8 +19,6 @@ export function initializeSchema(sql: SqlTaggedTemplate): void {
     error TEXT,
     created_at INTEGER NOT NULL,
     completed_at INTEGER,
-    assembly_revision TEXT NOT NULL,
-    assembly_descriptor TEXT NOT NULL,
     assistant_message_id TEXT NOT NULL,
     abort_reason TEXT
   )`;
@@ -28,6 +26,12 @@ export function initializeSchema(sql: SqlTaggedTemplate): void {
     sql<{ name: string }>`PRAGMA table_info(pi_submissions)`
       .map((column) => column.name),
   );
+  if (submissionColumns.has("assembly_revision")) {
+    sql`ALTER TABLE pi_submissions DROP COLUMN assembly_revision`;
+  }
+  if (submissionColumns.has("assembly_descriptor")) {
+    sql`ALTER TABLE pi_submissions DROP COLUMN assembly_descriptor`;
+  }
   if (!submissionColumns.has("runtime_key")) {
     sql`ALTER TABLE pi_submissions ADD COLUMN runtime_key TEXT NOT NULL DEFAULT ''`;
   }

package/src/config/activation.ts

@@ -2,7 +2,7 @@ import { connectConfiguredMcpServers } from "../lib/mcp";
 import { sha256Hex } from "../lib/artifacts";
 import type { RuntimeCandidate, RuntimeSnapshot } from "./assembler";
 import type { HarnessRuntimeConfig } from "./harness-runtime";
-import type { PreparedPiRuntime, PreparePiRuntimeOptions } from "./pinning";
+import type { PreparedPiRuntime, PreparePiRuntimeOptions } from "./prepared-runtime";
 import type { RuntimeGatewaySession, RuntimeSubmissionAdmissionHook } from "./ports";
 import { withRuntimeLoadTimeout } from "./runtime-load";
 import type { RuntimeLoadPhase } from "../conversation/state";
@@ -16,6 +16,16 @@ export interface ActiveRuntime {
   readonly admission?: RuntimeSubmissionAdmissionHook;
 }
 
+/** Check the same candidate guards during admission and final activation. */
+export async function verifyRuntimeCandidateGuards(
+  candidate: RuntimeCandidate,
+  phase: "admission" | "commit",
+): Promise<void> {
+  for (const [index, guard] of candidate.commitGuards.entries()) {
+    await withRuntimeLoadTimeout(`${phase}-guard:${index}`, guard);
+  }
+}
+
 async function closeRuntimeGatewaySession(
   session: RuntimeGatewaySession | undefined,
   step: string,
@@ -33,7 +43,6 @@ interface RuntimeActivationOptions {
   readonly sessionId: string;
   readonly createExtensionHostBinding: PreparePiRuntimeOptions["createExtensionHostBinding"];
   advance(phase: RuntimeLoadPhase): void;
-  isExecuting(): boolean;
   commit(runtime: ActiveRuntime): void;
 }
 
@@ -92,19 +101,10 @@ export async function activateRuntimeCandidate(
     throw error;
   }
   const revision = await sha256Hex(prepared.revisionDescriptor);
-  const contested = Boolean(previous) &&
-    revision !== previous?.revision &&
-    options.isExecuting();
-  if (contested) {
-    await closeRuntimeGatewaySession(gatewaySession, "gateway.close.contested");
-    throw new Error(
-      "Cannot reload Runtime while a revision-pinned SpringBrand Turn is active",
-    );
-  }
   const next = Object.freeze({
     snapshot: candidateSnapshot,
     revision,
-    runtimeKey: candidate.runtimeKey ?? revision,
+    runtimeKey: candidate.runtimeKey ?? "default",
     pi: prepared,
     ...(gatewaySession ? { gatewaySession } : {}),
     ...(candidate.admission
@@ -114,9 +114,7 @@ export async function activateRuntimeCandidate(
   let activated = false;
   const previousGatewaySession = previous?.gatewaySession;
   try {
-    for (const [index, guard] of candidate.commitGuards.entries()) {
-      await withRuntimeLoadTimeout(`commit-guard:${index}`, guard);
-    }
+    await verifyRuntimeCandidateGuards(candidate, "commit");
     options.pi.activate(candidateSnapshot);
     activated = true;
     options.commit(next);

package/src/config/harness-runtime.ts

@@ -15,19 +15,17 @@ export {
   readModelStreamStallDetails,
 } from "../models";
 import {
-  pinPiRuntime,
+  assembleCurrentPiContext,
   preparePiRuntime,
-  readPinnedPiRuntime,
   readPreparedPiRuntime,
-  type PinPiRuntimeOptions,
-  type PinnedPiRuntime,
+  type CurrentPiContextOptions,
   type PreparePiRuntimeOptions,
   type PreparedPiRuntime,
-} from "./pinning";
+} from "./prepared-runtime";
 import { refreshModelGuidance } from "./model-guidance";
 
 /**
- * Runtime 通过这个配置入口准备、固定并读取 Harness 的模型、提示和工具输入。
+ * Runtime 通过这个配置入口准备并读取当前 Harness 的模型、提示和工具输入。
  *
  * @remarks
  * Runtime、Pi、Turn、Tool Candidate 和 canonical transcript 等核心术语见包入口 `../../index.ts`。
@@ -37,9 +35,7 @@ import { refreshModelGuidance } from "./model-guidance";
  *   它包含已加载 Extension、Tool candidate 和快照，但 Runtime 只能读取 revision descriptor 与 degradation。
  * - revision descriptor 是影响执行行为的已排序 JSON 描述。
  *   Runtime 会对它取哈希，用来识别当前 Prepared Runtime 的基础版本。
- * - Pinned Runtime 是 Submission 准入时固定的描述符。
- *   它在 Prepared Runtime 基础上加入动态 system context、approval mode 和 base revision。
- * 调用方：`AgentRuntimeKernel` 在配置加载、请求准入与打开 SessionHarness 前调用这些粗粒度能力。
+ * 调用方：`AgentRuntimeKernel` 在配置加载与打开 SessionHarness 前调用这些粗粒度能力。
  *
  * 执行位置仍由 `SessionHarness` 拥有，消息读写和投影由 `ConversationHistory` 拥有。
  */
@@ -86,23 +82,31 @@ export class HarnessRuntimeConfig {
     );
   }
 
-  /** Read the immutable inputs consumed by the Session AgentHarness. */
-  harnessInputs(
+  interaction(prepared: PreparedPiRuntime, name: string) {
+    return readPreparedPiRuntime(prepared, this.owner).candidates.find(
+      (candidate) => candidate.tool.name === name,
+    )?.interaction;
+  }
+
+  /** Read all executable inputs from the current Prepared Runtime. */
+  async harnessInputs(
     prepared: PreparedPiRuntime,
-    pinnedDescriptor: string,
     request: {
       readonly modelSessionId?: string | (() => string);
       readonly onGeneration?: PiGenerationLifecycleObserver;
+      readonly includeMemory?: boolean;
+      readonly readExtensionContext?: CurrentPiContextOptions["readExtensionContext"];
       readonly assertRequestAllowed?: () => void;
       readonly onCompactionGeneration?: PiGenerationLifecycleObserver;
     } = {},
   ) {
-    const { state, descriptor } = readPinnedPiRuntime(
+    const state = readPreparedPiRuntime(prepared, this.owner);
+    const context = await assembleCurrentPiContext({
       prepared,
-      this.owner,
-      pinnedDescriptor,
-    );
-    const pinnedModel = state.snapshot.pi.model;
+      includeMemory: request.includeMemory,
+      readExtensionContext: request.readExtensionContext,
+    }, this.owner);
+    const currentModel = state.snapshot.pi.model;
     let models!: MutableModels;
     const requestStream = (observer = request.onGeneration) => {
       const stream = withProviderBoundary(
@@ -121,8 +125,8 @@ export class HarnessRuntimeConfig {
       get: (target, property) => {
         if (property === "getModel") {
           return (provider: string, modelId: string) =>
-            provider === pinnedModel.provider && modelId === pinnedModel.id
-              ? pinnedModel
+            provider === currentModel.provider && modelId === currentModel.id
+              ? currentModel
               : target.getModel(provider, modelId);
         }
         if (property === "streamSimple") return requestStream();
@@ -147,7 +151,8 @@ export class HarnessRuntimeConfig {
       models,
       model: state.snapshot.pi.model,
       thinkingLevel: state.snapshot.pi.thinkingLevel,
-      systemPrompt: descriptor.systemPrompt,
+      systemPrompt: context.systemPrompt,
+      degradations: context.degradations,
       candidates: state.candidates,
       workspace: state.snapshot.bindings.workspace,
       platform: state.snapshot.bindings.platform,
@@ -179,27 +184,12 @@ export class HarnessRuntimeConfig {
     }
   }
 
-  /**
-   * 在接受 Submission 前固定本次执行使用的动态上下文和审批模式。
-   *
-   * @remarks
-   * 调用方：Runtime 的准入流程为每个新 Submission 调用，并把 descriptor 与其哈希一起持久化。
-   *
-   * 实现理由：memory、workspace 和 Extension context 可能随时间变化，所以把准入时的 Turn 字段保存在 descriptor 中。
-   * 不要把 pin 推迟到 Turn 启动后，否则已持久化的 Submission 将失去可验证的执行基线。
-   */
-  pin(options: PinPiRuntimeOptions): Promise<PinnedPiRuntime> {
-    return pinPiRuntime(options, this.owner);
-  }
-
 }
 
 export type {
-  PinPiRuntimeOptions,
-  PinnedPiRuntime,
   PreparePiRuntimeOptions,
   PreparedPiRuntime,
-} from "./pinning";
+} from "./prepared-runtime";
 
 /**
  * Input tokens above which a Turn compacts its history.

package/src/config/index.ts

@@ -7,7 +7,7 @@ export * from "./assembly-view";
 export * from "./definition";
 export * from "./degradation";
 export * from "./harness-runtime";
-export * from "./pinning";
+export * from "./prepared-runtime";
 export * from "./ports";
 export * from "./profile";
 export * from "./runtime-config";

package/src/config/{pinning.ts → prepared-runtime.ts}

@@ -1,4 +1,3 @@
-import { sha256Hex } from "../lib/artifacts";
 import type {
   RuntimeBindings,
   RuntimeGatewaySession,
@@ -9,7 +8,6 @@ import type {
   RuntimeExtensionPermissions,
 } from "../context/extension/contracts";
 import type { RuntimeProfile } from "./profile";
-import type { ExecutionLevel } from "../lib/execution-level";
 import type { RuntimeSnapshot } from "./assembler";
 import type { FinalizedPiToolSurface, PiRuntimeAssembly } from "../context";
 import {
@@ -28,29 +26,8 @@ import {
   type PiToolCandidate,
 } from "../tools";
 
-export interface RuntimeAssemblyPin {
-  readonly revision: string;
-  readonly descriptor: string;
-}
-
-/** A saved pin is reusable only with its original Runtime key and intact descriptor. */
-export async function validateRuntimeAssemblyPin(
-  runtimeKey: string,
-  pin: RuntimeAssemblyPin,
-): Promise<boolean> {
-  if (!runtimeKey) {
-    throw new Error("Cannot safely recover a pinned Submission without its original Runtime key");
-  }
-  if (!pin.revision && !pin.descriptor) return false;
-  if (!pin.revision || !pin.descriptor) throw new Error("Submission assembly pin is incomplete");
-  if (pin.revision !== await sha256Hex(pin.descriptor)) {
-    throw new Error("Pinned Runtime assembly descriptor is invalid");
-  }
-  return true;
-}
-
 /**
- * 本文件负责准备 Pi 的扩展与工具，并为每次提交固定可恢复的运行描述。
+ * 本文件负责准备当前 Pi 的扩展、工具与系统上下文。
  *
  * @remarks
  * 核心术语见本目录入口 `./index.ts`，这里不重复定义。
@@ -93,8 +70,8 @@ interface PreparePiAssemblyOptions {
   ) => Fetcher;
 }
 
-// 暴露后续准备和固定阶段会读取的扩展装配结果。
-// preparePiRuntime 读取工具与降级，pinPiRuntime 读取上下文贡献。
+// 暴露后续准备和执行阶段会读取的扩展装配结果。
+// preparePiRuntime 读取工具与降级，assembleCurrentPiContext 读取上下文贡献。
 // 访问器直接代理扩展装配，避免维护会漂移的副本。
 interface PreparedPiAssembly {
   readonly loaded: readonly PiLoadedExtension[];
@@ -133,10 +110,10 @@ export interface PreparePiRuntimeOptions {
 }
 
 /**
- * 表示已经准备好、但尚未固定到某次提交的 Pi 配置。
+ * 表示已准备好供当前执行使用的 Pi 配置。
  *
  * @remarks
- * Runtime 在配置完成后保存这个句柄，并在提交准入或创建 Turn 时传回。
+ * Runtime 在配置完成后保存这个句柄，并在创建 Turn 时传回。
  *
  * 公开形状只给出版本描述和加载降级，调用方不会直接拿到可变的装配状态。
  */
@@ -147,26 +124,25 @@ export interface PreparedPiRuntime {
 }
 
 /**
- * 提供把一次提交固定到当前 Runtime 所需的值。
+ * 当前执行切片读取系统上下文所需的值。
  *
  * @remarks
- * Runtime 在写入提交前的准入阶段把它交给 `HarnessRuntimeConfig.pin`。
+ * Runtime 在打开或恢复 Harness 前把它交给 `HarnessRuntimeConfig.harnessInputs`。
  *
  * 扩展没有可读上下文时不需要读取函数，所以该端口保持可选。
  */
-export interface PinPiRuntimeOptions {
+export interface CurrentPiContextOptions {
   readonly prepared: PreparedPiRuntime;
-  readonly baseRevision: string;
   /**
    * Whether this Submission may inherit automatic hot and cold Memory context.
    * Scheduled task input is intentionally isolated from those sources.
    */
   readonly includeMemory?: boolean;
   /**
-   * 读取一个扩展要写入固定系统提示词的上下文。
+   * 读取一个扩展对当前系统提示词的上下文贡献。
    *
    * @remarks
-   * pinPiRuntime 在准入阶段为已加载扩展声明的上下文贡献调用它。
+   * 每次装配 Harness 输入时为已加载扩展读取当前上下文。
    *
    * 本模块不持有扩展上下文存储，所以读取端口必须留在 Host。
    */
@@ -175,40 +151,6 @@ export interface PinPiRuntimeOptions {
   ) => Promise<string | null>;
 }
 
-/**
- * 返回已经固定到一次提交的描述和上下文降级。
- *
- * @remarks
- * Runtime 在准入时持久化描述，并在创建 Turn 时传回。
- *
- * 固定这些值可让恢复继续使用当时已经准入的配置。
- */
-export interface PinnedPiRuntime {
-  readonly descriptor: string;
-  readonly degradations: readonly RuntimeDegradation[];
-}
-
-/**
- * 描述一条已存提交可以恢复到哪份 Pi 配置。
- *
- * @remarks
- * `HarnessRuntimeConfig.harnessInputs` 在打开或恢复 operation 前读取这个 JSON 结构。
- *
- * 基础版本作为准入时元数据保留，创建 Turn 时不与当前 Runtime 比较。
- */
-export interface PinnedPiRuntimeDescriptor {
-  readonly version: 1;
-  readonly baseRevision: string;
-  readonly model: string;
-  readonly provider: string;
-  readonly thinking: RuntimeSnapshot["pi"]["thinkingLevel"];
-  readonly systemPrompt: string;
-  readonly executionLevel: ExecutionLevel;
-  readonly deny: readonly string[];
-  readonly tools: readonly ReturnType<typeof describeTools>[number][];
-  readonly [key: string]: unknown;
-}
-
 /**
  * 保存创建 Pi Turn 所需的内部准备结果。
  *
@@ -345,7 +287,7 @@ class PreparedRuntime implements PreparedPiRuntime {
   ) {}
 
   // 在调用方证明适配器身份后返回内部准备状态。
-  // readPreparedPiRuntime 在固定配置或创建 Turn 前调用它。
+  // readPreparedPiRuntime 在创建 Turn 前调用它。
   // 公开接口没有可信的来源字段，所以这里必须比较对象身份。
   read(owner: object): PreparedPiRuntimeState {
     if (owner !== this.owner) {
@@ -361,7 +303,7 @@ class PreparedRuntime implements PreparedPiRuntime {
  * 为创建它的 HarnessRuntimeConfig 打开准备句柄。
  *
  * @remarks
- * 固定配置和创建 Turn 都会先调用它，再读取快照、装配结果或工具候选。
+ * 创建 Turn 前调用它，读取快照、装配结果或工具候选。
  *
  * 具体类检查与 owner 检查一起拒绝伪造句柄和跨适配器复用。
  */
@@ -375,42 +317,6 @@ export function readPreparedPiRuntime(
   return prepared.read(owner);
 }
 
-/**
- * 读取已存的固定描述。
- *
- * @remarks
- * `HarnessRuntimeConfig.harnessInputs` 在新建或恢复 Pi operation 前调用它。
- *
- * Prepared Runtime 提供当前执行能力，descriptor 仅保留 Submission 固定的 Turn 字段。
- */
-export function readPinnedPiRuntime(
-  prepared: PreparedPiRuntime,
-  owner: object,
-  descriptorBody: string,
-): {
-  readonly state: PreparedPiRuntimeState;
-  readonly descriptor: PinnedPiRuntimeDescriptor;
-} {
-  const state = readPreparedPiRuntime(prepared, owner);
-  let value: unknown;
-  try {
-    value = JSON.parse(descriptorBody);
-  } catch {
-    throw new Error("Pinned Runtime assembly descriptor is invalid");
-  }
-  if (!value || typeof value !== "object") {
-    throw new Error("Pinned Runtime assembly descriptor is invalid");
-  }
-  const descriptor = value as PinnedPiRuntimeDescriptor;
-  if (
-    descriptor.version !== 1 ||
-    typeof descriptor.systemPrompt !== "string"
-  ) {
-    throw new Error("Pinned Runtime assembly descriptor is invalid");
-  }
-  return { state, descriptor };
-}
-
 // #endregion
 
 // #region 扩展与工具装配
@@ -462,7 +368,7 @@ async function preparePiAssembly(
 
 // #endregion
 
-// #region Runtime 准备与提交固定
+// #region Runtime 准备与当前上下文
 
 /**
  * 为一份已校验的 Runtime 快照准备扩展和工具状态。
@@ -499,17 +405,17 @@ export async function preparePiRuntime(
 }
 
 /**
- * 把请求时的上下文和执行档位固定到一次提交的描述中。
+ * 从当前 Runtime 装配模型要用的系统上下文。
  *
  * @remarks
- * Runtime 在持久化提交并启动 Turn 前的准入阶段调用它。
+ * Runtime 每次打开或恢复 Harness 前调用它。
  *
- * 此时重建上下文可避免把动态记忆和扩展上下文写进 Pi 消息，同时让恢复继续使用已准入的结果。
+ * 重新读取动态记忆和扩展上下文，不从旧 Submission 描述恢复配置。
  */
-export async function pinPiRuntime(
-  options: PinPiRuntimeOptions,
+export async function assembleCurrentPiContext(
+  options: CurrentPiContextOptions,
   owner: object,
-): Promise<PinnedPiRuntime> {
+): Promise<{ systemPrompt: string; degradations: readonly RuntimeDegradation[] }> {
   const state = readPreparedPiRuntime(options.prepared, owner);
   const { snapshot, assembly } = state;
   const includeMemory = options.includeMemory !== false;
@@ -525,11 +431,7 @@ export async function pinPiRuntime(
     readExtensionContext: options.readExtensionContext,
   });
   return Object.freeze({
-    descriptor: JSON.stringify({
-      ...JSON.parse(options.prepared.revisionDescriptor),
-      systemPrompt: context.systemPrompt,
-      baseRevision: options.baseRevision,
-    }),
+    systemPrompt: context.systemPrompt,
     degradations: context.degradations,
   });
 }

package/src/config/runtime-config.ts

@@ -1,4 +1,5 @@
 export interface RuntimeConfigUpdateResult<Change> {
   readonly change: Change;
-  readonly runtime: "unchanged" | "reloaded" | "reload-failed";
+  /** Deferred changes are persisted but activated at the next execution slice. */
+  readonly runtime: "unchanged" | "reloaded" | "deferred" | "reload-failed";
 }

package/src/conversation/message/contract.ts

@@ -17,13 +17,25 @@ export type PiCanonicalUserInput = UserMessage;
 
 export type UIChatTrigger = "submit-message" | "regenerate-message";
 
-/** A user-selected Runtime capability persisted with the visible UIMessage. */
+/**
+ * A user-selected Runtime capability persisted with the visible UIMessage.
+ *
+ * - `skill`: `name` is the installed Skill name.
+ * - `tool`: `name` is a Tool materialized on the Runtime surface.
+ * - `plan`: `name` is always `"plan"`.
+ * - `action`: `name` is a host-owned Action capability id. The Runtime only adds
+ *   `requested capability: action/<id>` to private model context; the host is
+ *   responsible for telling the model how to act on it.
+ *
+ * `label` is the display name; capability ids never enter visible message text.
+ * `iconUrl` is a display-only `https:` icon (for example an Action supplier's
+ * logo); it is persisted with the message and never sent to the model.
+ */
 export interface RequestedCapability {
-  readonly kind: "skill" | "tool" | "plan";
+  readonly kind: "skill" | "tool" | "plan" | "action";
   readonly name: string;
   readonly label: string;
-  /** Stable Resource identity used only to group capabilities in presentation. */
-  readonly resourceId?: string;
+  readonly iconUrl?: string;
 }
 
 export interface UIChatRequestBody {

package/src/conversation/message/conversion.ts

@@ -2,6 +2,32 @@ import type { UserMessage } from "@earendil-works/pi-ai";
 import type { UIMessage } from "ai";
 import type { RequestedCapability } from "./contract";
 
+const REQUESTED_CAPABILITY_KINDS: ReadonlySet<RequestedCapability["kind"]> = new Set([
+  "skill",
+  "tool",
+  "plan",
+  "action",
+]);
+
+function isRequestedCapabilityKind(value: unknown): value is RequestedCapability["kind"] {
+  return typeof value === "string" &&
+    REQUESTED_CAPABILITY_KINDS.has(value as RequestedCapability["kind"]);
+}
+
+const MAX_CAPABILITY_ICON_URL_LENGTH = 2048;
+
+/** Keep a display-only icon only when it is an `https:` URL; drop anything else silently. */
+function capabilityIconUrlOf(value: unknown): string | undefined {
+  if (typeof value !== "string" || value.length > MAX_CAPABILITY_ICON_URL_LENGTH) {
+    return undefined;
+  }
+  try {
+    return new URL(value).protocol === "https:" ? value : undefined;
+  } catch {
+    return undefined;
+  }
+}
+
 export function requestedCapabilitiesOf(metadata: unknown): RequestedCapability[] {
   if (metadata === null || typeof metadata !== "object" || Array.isArray(metadata)) {
     return [];
@@ -19,7 +45,7 @@ export function requestedCapabilitiesOf(metadata: unknown): RequestedCapability[
     }
     const capability = value as Record<string, unknown>;
     if (
-      (capability.kind !== "skill" && capability.kind !== "tool" && capability.kind !== "plan") ||
+      !isRequestedCapabilityKind(capability.kind) ||
       typeof capability.name !== "string" ||
       !capability.name.trim() ||
       typeof capability.label !== "string" ||
@@ -30,7 +56,15 @@ export function requestedCapabilitiesOf(metadata: unknown): RequestedCapability[
     const key = `${capability.kind}:${capability.name}`;
     if (seen.has(key)) continue;
     seen.add(key);
-    result.push({ kind: capability.kind, name: capability.name, label: capability.label });
+    // Copy only the current fields: persisted messages may still carry legacy
+    // fields such as the retired `resourceId`, which are ignored.
+    const iconUrl = capabilityIconUrlOf(capability.iconUrl);
+    result.push({
+      kind: capability.kind,
+      name: capability.name,
+      label: capability.label,
+      ...(iconUrl ? { iconUrl } : {}),
+    });
   }
   return result;
 }
@@ -65,6 +99,13 @@ export function normalizeUIUserInput(
       );
       continue;
     }
+    if (capability.kind === "action") {
+      // Actions are host capabilities, not Runtime Tools: the Runtime only
+      // names the request and does not check installation. The host owns how
+      // the model acts on `action/<id>` (its tools and system guidance).
+      context.push(`requested capability: action/${capability.name}`);
+      continue;
+    }
     if (capability.name !== "plan") {
       throw new Error(`Unknown plan capability: ${capability.name}`);
     }

package/src/harness/session-harness.ts

@@ -184,6 +184,8 @@ export class SessionHarness {
       runtime.requestId = unfinished[0].requestId;
     }
     await runtime.restoreGovernance(context);
+    // Harness.open is passive; install the current Config before anything resumes scheduling.
+    await runtime.applyCurrentConfiguration(context);
     return runtime;
   }
 
@@ -236,6 +238,22 @@ export class SessionHarness {
     this.conversation = (await this.harness.conversation(created.id, context))!;
     this.turnsAtOpen = (await this.entries(context)).filter((entry) => entry.kind === "pi.assistant").length;
   }
+  private async applyCurrentConfiguration(context: Context): Promise<void> {
+    const names = new Set(this.options.activeToolNames ?? this.options.tools?.map((tool) => tool.name) ?? []);
+    const previous = await this.harness.snapshot(AgentDoc, this.conversation.id, context);
+    if (Array.isArray(previous?.tools)) {
+      for (const name of previous.tools) if (this.options.onDemandToolNames?.includes(name)) names.add(name);
+    }
+    await this.conversation.configure({
+      model: { provider: this.options.model.provider, modelId: this.options.model.id },
+      thinkingLevel: this.options.thinkingLevel ?? "off",
+      tools: this.wrapUpStarted || this.governance.wrapUp
+        ? []
+        : this.options.tools?.filter((tool) => names.has(tool.name)) ?? [],
+      // Wrap-up instructions belong to one Submission and are supplied by the request hook.
+      instructions: null,
+    }, context);
+  }
   async admit(request: SessionRunRequest, context: Context): Promise<void> {
     if (this.submission && this.requestId !== request.operationId) throw new Error("A native Pi Submission is already active");
     const existing = await this.submissionFor(request.operationId, context);
@@ -244,12 +262,9 @@ export class SessionHarness {
       this.submission = await this.harness.submission(existing.id, context);
     } else {
       if (request.prompt === undefined) throw new Error("A new native Pi Submission needs input");
-      const names = new Set(this.options.activeToolNames ?? this.options.tools?.map((tool) => tool.name) ?? []);
-      const previous = await this.harness.snapshot(AgentDoc, this.conversation.id, context);
-      if (Array.isArray(previous?.tools)) for (const name of previous.tools) if (this.options.onDemandToolNames?.includes(name)) names.add(name);
-      await this.conversation.configure({ model: { provider: this.options.model.provider, modelId: this.options.model.id }, thinkingLevel: this.options.thinkingLevel ?? "off", tools: this.options.tools?.filter((tool) => names.has(tool.name)) ?? [],
-        // Earlier runtimes stored the wrap-up instruction in the agent; it applies to one Submission only.
-        instructions: null }, context);
+      this.wrapUpStarted = false;
+      this.governance = new ToolGovernance();
+      await this.applyCurrentConfiguration(context);
       this.requestId = request.operationId;
       this.submission = await this.conversation.submit({ type: "input", requestId: request.operationId, content: typeof request.prompt === "string" ? request.prompt : request.prompt.content, whenBusy: "reject" }, context);
     }