@tangle-network/agent-bench 0.7.1 → 0.8.0

package/src/sandbox-run.ts

@@ -13,11 +13,13 @@ import {
   type AgentProfile,
   type AgentRunSpec,
   type OutputAdapter,
-  routerChatWithUsage,
 } from '@tangle-network/agent-runtime/kernel'
-// `BackendType` is the sandbox SDK's harness union and its canonical home. agent-runtime consumes
-// it from there too; it is not re-exported from the kernel barrel.
+import { parseExactAgentProfile } from '@tangle-network/agent-runtime'
+// `BackendType` is the sandbox SDK's harness union and its canonical home. Runtime consumes it
+// from there too; benchmark profiles use the same values as their exact harness identity.
 import type { BackendType } from '@tangle-network/sandbox'
+import { assertExecutableAgentProfile } from '../../src/runtime/supervise/model-policy'
+import { benchRouterProfile, runBenchRouterTurn } from './router-turn'
 
 /** Parse the agent's final answer from the event stream (harness-agnostic).
  *  The default deliverable; a benchmark whose artifact is a file overrides via
@@ -63,18 +65,17 @@ export const llmAnalyst = (cfg: { routerBaseUrl: string; routerKey: string; mode
       .map((e) => (typeof e === 'string' ? e : JSON.stringify(e)))
       .join('\n')
       .slice(-2000)
-    const { content } = await routerChatWithUsage(cfg, [
+    const systemPrompt =
+      "You review an AI agent's previous attempt at a task. From the task, the attempt's output, and its execution trace ALONE, judge whether it correctly and completely solved the task. If you find a specific fault — a wrong value, a guessed API signature, a missing step, a misread requirement — name it and give the concrete correction in 1-3 sentences. Reply exactly 'no change needed' if the attempt looks correct and complete."
+    const turn = await runBenchRouterTurn(
       {
-        role: 'system',
-        content:
-          "You review an AI agent's previous attempt at a task. From the task, the attempt's output, and its execution trace ALONE, judge whether it correctly and completely solved the task. If you find a specific fault — a wrong value, a guessed API signature, a missing step, a misread requirement — name it and give the concrete correction in 1-3 sentences. Reply exactly 'no change needed' if the attempt looks correct and complete.",
+        routerBaseUrl: cfg.routerBaseUrl,
+        routerKey: cfg.routerKey,
+        profile: benchRouterProfile('sandbox-run-analyst', cfg.model, { systemPrompt }),
       },
-      {
-        role: 'user',
-        content: `Task:\n${task ?? '(task unavailable)'}\n\nPrevious answer:\n${last?.output ?? '(none)'}\n\nTrace tail:\n${traceTail}`,
-      },
-    ])
-    return content
+      `Task:\n${task ?? '(task unavailable)'}\n\nPrevious answer:\n${last?.output ?? '(none)'}\n\nTrace tail:\n${traceTail}`,
+    )
+    return turn.finalText
   }
 
 /** Cost-dial backend = the SDK's canonical `BackendType` (single source of truth; no local
@@ -83,43 +84,24 @@ export const llmAnalyst = (cfg: { routerBaseUrl: string; routerKey: string; mode
  *  agent runs — no per-backend worker. */
 export type WorkerBackendType = BackendType
 
-/** Build the standard sandbox `AgentRunSpec` for a benchmark — the worker the
- *  kernel injects. `backendType` is the cost dial. Model auth is the BOX'S OWN
- *  provisioned credential: `backend.model` pins provider/model/baseUrl only, and
- *  the platform generates the in-box provider config keyed to
- *  `{env:OPENCODE_MODEL_API_KEY}`. Never pass an external router key into the
- *  box — the egress proxy rejects foreign credentials (403, empty output). */
+/** Build the standard sandbox `AgentRunSpec` for a benchmark. The complete profile is the only
+ * behavioral input: its harness selects the box backend and its provider/model select inference.
+ * Extra sandbox env remains infrastructure, not a second model-selection path. */
 export function sandboxAgentRun(opts: {
-  model: string
-  routerBaseUrl: string
-  backendType?: WorkerBackendType
-  /** In-box model provider. Default `openai` (registered models like gpt-4.1).
-   *  Cheap router models (deepseek/kimi/glm) are not in opencode's `openai`
-   *  registry and 404 in-box — pass `openai-compat` (generic passthrough). */
-  provider?: string
-  name?: string
+  profile: AgentProfile
   taskToPrompt?: (task: string) => string
   /** Extra box-level env (e.g. `TANGLE_SEARCH_DEFAULT_PROVIDER` to pin the in-box
    *  agent's web-search provider, provider keys like EXA_API_KEY). Allowlisted
    *  keys only reach the spawned CLI. Must NOT carry router/model credentials. */
   env?: Record<string, string>
-  /** The developer's AgentProfile — the one knob for "which agent" (prompt / model /
-   *  tools / mcp). Spread through verbatim; the backend cost-dial is tagged into
-   *  metadata. Omitted ⇒ a minimal worker profile. */
-  profile?: AgentProfile
 }): AgentRunSpec<string> {
-  const backendType = opts.backendType ?? 'opencode'
-  const name = opts.profile?.name ?? opts.name ?? `${backendType}-worker`
+  const profile = parseExactAgentProfile(opts.profile, 'sandboxAgentRun profile')
+  assertExecutableAgentProfile(profile, 'sandboxAgentRun profile')
+  const name = profile.name ?? 'sandbox-worker'
   return {
-    profile: { ...opts.profile, name, metadata: { ...opts.profile?.metadata, backendType } },
+    profile,
     name,
     taskToPrompt: opts.taskToPrompt ?? ((t) => t),
-    sandboxOverrides: {
-      ...(opts.env ? { env: opts.env } : {}),
-      backend: {
-        type: backendType,
-        model: { provider: opts.provider ?? 'openai', model: opts.model, baseUrl: opts.routerBaseUrl },
-      },
-    },
+    ...(opts.env ? { sandboxOverrides: { env: opts.env } } : {}),
   }
 }

package/src/search-bench/bridge.ts

@@ -13,6 +13,12 @@
  * `opencode/zai-coding-plan/glm-5.1`), so `harness` here is just the label.
  */
 import { createExecutor } from '@tangle-network/agent-runtime/kernel'
+import {
+  defineAgentProfileSecretRef,
+  harnessProviders,
+  type AgentProfile,
+  type HarnessType,
+} from '@tangle-network/agent-interface'
 import type { SearchArm } from './profiles'
 import { armLabel } from './profiles'
 import type { SearchCellResult } from './run.mts'
@@ -22,17 +28,63 @@ const nativeWebDisallowed = ['WebSearch', 'WebFetch', 'web_search', 'web_fetch',
 
 /** Build the cli-bridge `agent_profile` for one arm (bridge dialect: disable via
  *  `metadata.disallowedTools`, search MCP via `mcp.<name>.transport:'http'`). */
-function bridgeProfile(arm: SearchArm, routerSearchMcp: string, tangleApiKey: string, label: string): Record<string, unknown> {
-  if (arm === 'native') return { name: `search-bench-${label}` }
-  const base = { name: `search-bench-${label}`, metadata: { disallowedTools: nativeWebDisallowed } }
+function bridgeProfile(
+  arm: SearchArm,
+  routerSearchMcp: string,
+  tangleApiKey: string,
+  label: string,
+  harness: HarnessType,
+  wireModel: string,
+): AgentProfile {
+  const prefix = `${harness}/`
+  if (!wireModel.startsWith(prefix)) {
+    throw new Error(
+      `bridgeProfile: wire model '${wireModel}' must start with harness '${prefix}'`,
+    )
+  }
+  const modelPath = wireModel.slice(prefix.length)
+  const segments = modelPath.split('/').filter(Boolean)
+  if (segments.length === 0) {
+    throw new Error(`bridgeProfile: wire model '${wireModel}' has no model id`)
+  }
+  let provider: string
+  let model: string
+  if (segments.length === 1) {
+    const providers = harnessProviders(harness)
+    if (providers?.length !== 1) {
+      throw new Error(
+        `bridgeProfile: wire model '${wireModel}' must include a provider for harness '${harness}'`,
+      )
+    }
+    provider = providers[0]!
+    model = segments[0]!
+  } else {
+    provider = segments[0]!
+    model = segments.slice(1).join('/')
+  }
+  const identity: AgentProfile = {
+    name: `search-bench-${label}`,
+    harness,
+    model: { provider, default: model },
+  }
+  if (arm === 'native') return identity
+  const base: AgentProfile = {
+    ...identity,
+    metadata: { disallowedTools: nativeWebDisallowed },
+  }
   if (arm === 'off') return base
+  if (!tangleApiKey) {
+    throw new Error(`bridgeProfile: provider arm requires TANGLE_API_KEY`)
+  }
   return {
     ...base,
     mcp: {
       tangle_search: {
         transport: 'http',
         url: `${routerSearchMcp}?provider=${encodeURIComponent(arm.provider)}`,
-        headers: { Authorization: `Bearer ${tangleApiKey}` },
+        headers: {
+          Authorization: defineAgentProfileSecretRef('TANGLE_API_KEY', 'bearer'),
+        },
         enabled: true,
       },
     },
@@ -58,7 +110,7 @@ export interface BridgeCfg {
 export async function runBridgeCell(
   cfg: BridgeCfg,
   task: SearchTask,
-  harness: string,
+  harness: HarnessType,
   arm: SearchArm,
 ): Promise<SearchCellResult> {
   const startedAt = Date.now()
@@ -76,14 +128,20 @@ export async function runBridgeCell(
   try {
     // One harness turn through the unified bridge executor — same backend the
     // loop path uses; this cell scorer just adds oracle scoring + citations.
+    const profile = bridgeProfile(
+      arm,
+      cfg.routerSearchMcp,
+      cfg.tangleApiKey,
+      `${harness}-${armId}`,
+      harness,
+      cfg.bridgeModels[harness] ?? harness,
+    )
     const exec = createExecutor({
       backend: 'bridge',
       bridgeUrl: cfg.bridgeUrl,
       bridgeBearer: cfg.bridgeBearer,
-      model: cfg.bridgeModels[harness] ?? harness,
-      agentProfile: bridgeProfile(arm, cfg.routerSearchMcp, cfg.tangleApiKey, `${harness}-${armId}`),
       timeoutMs: cfg.timeoutMs ?? 300_000,
-    })({ profile: { name: `${harness}-${armId}` }, harness: null }, { signal: controller.signal, seams: {} })
+    })({ profile, harness: null }, { signal: controller.signal, seams: {} })
     // bridgeExecutor is one-shot (async execute resolves an ExecutorResult).
     const artifact = (await exec.execute(taskToPrompt(task), controller.signal)) as {
       out: unknown

package/src/search-bench/parametric-check.mts

@@ -11,7 +11,7 @@
  */
 import { writeFileSync } from 'node:fs'
 import { runPool } from '../run-pool'
-import { routerChatWithUsage } from '@tangle-network/agent-runtime/kernel'
+import { runBenchRouterTurn } from '../router-turn'
 import { freshTasks } from './tasks-fresh'
 import { scoreTask, taskToPrompt } from './tasks'
 
@@ -28,9 +28,24 @@ async function main(): Promise<void> {
 
   const outcomes = await runPool(freshTasks, conc, async (task) => {
     try {
-      const res = await routerChatWithUsage(cfg, [{ role: 'user', content: taskToPrompt(task) }])
-      const { score } = scoreTask(task, res.content)
-      return { id: task.id, score: score as 0 | 1 | null, cost: res.costUsd, err: undefined as string | undefined }
+      const res = await runBenchRouterTurn(
+        {
+          routerBaseUrl: cfg.routerBaseUrl,
+          routerKey: cfg.routerKey,
+          profile: {
+            name: 'search-parametric-check',
+            model: { provider: 'tangle-router', default: model },
+          },
+        },
+        taskToPrompt(task),
+      )
+      const { score } = scoreTask(task, res.finalText)
+      return {
+        id: task.id,
+        score: score as 0 | 1 | null,
+        cost: res.usage.usdKnown === false ? undefined : res.usage.costUsd,
+        err: undefined as string | undefined,
+      }
     } catch (err) {
       return { id: task.id, score: null as 0 | 1 | null, cost: undefined, err: err instanceof Error ? err.message : String(err) }
     }

package/src/search-bench/profiles.ts

@@ -17,7 +17,12 @@
  * shape — a `transport:'http'` server at the router's `/v1/search/mcp` endpoint,
  * provider pinned via the `?provider=` query param.
  */
-import type { AgentProfile } from '@tangle-network/agent-interface'
+import {
+  type AgentProfile,
+  type HarnessType,
+  agentProfileSchema,
+  defineAgentProfileSecretRef,
+} from '@tangle-network/agent-interface'
 
 export type SearchArm = 'native' | 'off' | { provider: string }
 
@@ -45,37 +50,45 @@ export interface BuildArmProfileArgs {
    *  foreign router credentials (403), so the provider arm needs the box-side
    *  credential flow before sandbox-backed provider runs are trustworthy. */
   tangleApiKey: string
+  harness: HarnessType
+  model: string
+  provider: string
   /** Optional name/metadata to merge. */
   name?: string
   metadata?: Record<string, unknown>
 }
 
 /**
- * Build the AgentProfile fragment (tools / permission / mcp) for one search arm.
- * Returned as a partial profile to be spread into `sandboxAgentRun({ profile })`.
+ * Build the complete executable AgentProfile for one search arm.
  */
 export function buildArmProfile(args: BuildArmProfileArgs): AgentProfile {
   const { arm, routerBaseUrl, tangleApiKey } = args
   const base: AgentProfile = {
     name: args.name ?? 'search-bench-worker',
+    harness: args.harness,
+    model: { provider: args.provider, default: args.model },
     ...(args.metadata ? { metadata: args.metadata } : {}),
-  } as AgentProfile
+  }
 
   if (arm === 'native') {
     // Native web tools stay on (harness default). No search MCP. For codex,
     // whose web_search ships off, explicitly enable it so the native arm is real.
-    return { ...base, tools: { web_search: true } } as AgentProfile
+    return agentProfileSchema.parse({ ...base, tools: { web_search: true } })
   }
 
   if (arm === 'off') {
     // No web access at all — the parametric floor (search contributes nothing).
-    return { ...base, tools: { ...nativeWebToolsDisabled }, permission: { webfetch: 'deny' } } as AgentProfile
+    return agentProfileSchema.parse({
+      ...base,
+      tools: { ...nativeWebToolsDisabled },
+      permission: { webfetch: 'deny' },
+    })
   }
 
   if (!tangleApiKey) {
     throw new Error(`buildArmProfile: provider arm "${arm.provider}" requires a tangleApiKey for the search MCP`)
   }
-  return {
+  return agentProfileSchema.parse({
     ...base,
     tools: { ...nativeWebToolsDisabled },
     permission: { webfetch: 'deny' },
@@ -83,11 +96,13 @@ export function buildArmProfile(args: BuildArmProfileArgs): AgentProfile {
       tangle_search: {
         transport: 'http',
         url: routerSearchMcpUrl(arm.provider, routerBaseUrl),
-        headers: { Authorization: `Bearer ${tangleApiKey}` },
+        headers: {
+          Authorization: defineAgentProfileSecretRef('TANGLE_API_KEY', 'bearer'),
+        },
         enabled: true,
       },
     },
-  } as AgentProfile
+  })
 }
 
 /** Stable condition label for the corpus: `<harness>:<arm>`. */

package/src/search-bench/run.mts

@@ -135,14 +135,13 @@ async function runCell(
   const timer = setTimeout(() => controller.abort(), cfg.timeoutMs ?? 300_000)
   try {
     const agentRun = sandboxAgentRun({
-      model: cfg.model,
-      routerBaseUrl: cfg.routerBaseUrl,
-      backendType: harness,
-      ...(cfg.provider ? { provider: cfg.provider } : {}),
       profile: buildArmProfile({
         arm,
         routerBaseUrl: cfg.routerBaseUrl,
         tangleApiKey: cfg.tangleApiKey,
+        harness,
+        model: cfg.model,
+        provider: cfg.provider ?? 'openai',
         name: `search-bench-${harness}-${armId}`,
         metadata: { harness, arm: armId, taskId: task.id },
       }),

package/src/smoke-structural-rollout.mts

@@ -37,12 +37,14 @@ import {
   defaultStructuralRolloutPolicy,
   runAgentic,
   type StructuralRolloutResult,
+  defaultAnalystInstruction,
   sandboxCheckRunner,
   selectBestIndex,
   structuralRollout,
   visibleCheckScore,
 } from '../../src/runtime/index'
 import { basePrompt, type HumanEvalTask, loadHumanEval, runChecker } from './benchmarks/humaneval'
+import { withBenchProfile } from './router-turn'
 
 function must(name: string): string {
   const v = process.env[name]
@@ -173,20 +175,34 @@ async function runTask(t: HumanEvalTask): Promise<TaskRow> {
     name: 'humaneval-inert',
     check: () => ({ passes: 0, total: 1, errored: 0 }),
   })
+  const workerProfile = withBenchProfile(
+    {
+      name: 'humaneval-structural-worker',
+      harness: 'cli-base',
+      model: { provider: 'together', default: MODEL },
+      tools: { submit_answer: true },
+    },
+    { systemPrompt, temperature: TEMP, maxTokens: MAX_TOKENS, maxTurns: 2 },
+  )
+  const analystProfile = withBenchProfile(
+    {
+      name: 'humaneval-structural-analyst',
+      harness: 'cli-base',
+      model: { provider: 'together', default: MODEL },
+    },
+    { systemPrompt: defaultAnalystInstruction, temperature: TEMP, maxTokens: MAX_TOKENS },
+  )
   const result = (await runAgentic({
     surface,
     task: {
       id: t.taskId,
-      systemPrompt,
       userPrompt: basePrompt(t),
       meta: { entryPoint: t.entryPoint },
     },
     routerBaseUrl: BASE,
     routerKey: must('TOGETHER_API_KEY'),
-    model: MODEL,
-    temperature: TEMP,
-    maxTokens: MAX_TOKENS,
-    innerTurns: 2,
+    workerProfile,
+    analystProfile,
     strategy,
     // The strategy's documented sizing: k samples + repair rounds + the check-author consult.
     budget: policy.k + policy.repairRounds + 1,

package/src/supervisor-arena.mts

@@ -37,6 +37,7 @@ import { appendFileSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import { type HumanEvalTask, basePrompt, extractCode, loadHumanEval } from './benchmarks/humaneval'
+import { runBenchRouterTurn } from './router-turn'
 import { pool } from './stats.mts'
 
 // ---------- pre-registered task sets (verbatim from the prereg; DO NOT EDIT) ----------
@@ -294,33 +295,40 @@ async function complete(cfg: ClientCfg, messages: Array<{ role: string; content:
   let lastErr = ''
   for (let attempt = 1; attempt <= 4; attempt += 1) {
     if (attempt > 1) await new Promise((r) => setTimeout(r, 2000 * 2 ** attempt))
-    const ctl = new AbortController()
-    const timer = setTimeout(() => ctl.abort(), Number(process.env.LLM_TIMEOUT_MS ?? 240_000))
     try {
-      const res = await fetch(`${cfg.base}/chat/completions`, {
-        method: 'POST',
-        headers: { Authorization: `Bearer ${cfg.key}`, 'Content-Type': 'application/json' },
-        body: JSON.stringify({ model: cfg.model, max_tokens: cfg.maxTokens, temperature: cfg.temperature, messages }),
-        signal: ctl.signal,
-      })
-      if (!res.ok) {
-        lastErr = `HTTP ${res.status}: ${(await res.text()).slice(0, 200)}`
-        continue
-      }
-      const d = (await res.json()) as {
-        choices?: Array<{ message?: { content?: string } }>
-        usage?: { prompt_tokens?: number; completion_tokens?: number }
-      }
-      const content = d.choices?.[0]?.message?.content ?? ''
+      const system = messages.find((message) => message.role === 'system')?.content
+      const result = await runBenchRouterTurn(
+        {
+          routerBaseUrl: cfg.base,
+          routerKey: cfg.key,
+          profile: {
+            name: 'supervisor-arena-agent',
+            harness: 'cli-base',
+            model: {
+              provider: 'tangle-router',
+              default: cfg.model,
+              metadata: { temperature: cfg.temperature, maxTokens: cfg.maxTokens },
+            },
+            ...(system ? { prompt: { systemPrompt: system } } : {}),
+          },
+          timeoutMs: Number(process.env.LLM_TIMEOUT_MS ?? 240_000),
+        },
+        { messages: messages.filter((message) => message.role !== 'system') },
+      )
+      if (result.usage.tokensKnown === false) throw new Error('provider omitted token usage')
+      const content = result.finalText
       if (content.trim() === '') {
         lastErr = 'empty content'
         continue
       }
-      return { content, attempts: attempt, tokensIn: d.usage?.prompt_tokens ?? 0, tokensOut: d.usage?.completion_tokens ?? 0 }
+      return {
+        content,
+        attempts: attempt,
+        tokensIn: result.usage.input,
+        tokensOut: result.usage.output,
+      }
     } catch (e) {
       lastErr = e instanceof Error ? e.message : String(e)
-    } finally {
-      clearTimeout(timer)
     }
   }
   throw new Error(`completion failed after retries: ${lastErr}`)

package/src/swe-arena/arms.ts

@@ -17,6 +17,13 @@ import { chmod, mkdir, readdir, readFile, rm, writeFile } from 'node:fs/promises
 import { join, resolve } from 'node:path'
 import { homedir } from 'node:os'
 import { fileURLToPath } from 'node:url'
+import type { AgentProfile } from '@tangle-network/agent-interface'
+import {
+  collectAgentTurn,
+  createExecutor,
+  streamAgentTurn,
+  type CollectedAgentTurn,
+} from '@tangle-network/agent-runtime/kernel'
 import { run, runOk, type RunResult, shq } from './proc'
 import { materializeWorkspace } from './materialize'
 import type { ArmSpec, SoloUsage } from './types'
@@ -192,12 +199,15 @@ export interface SoloArmSpec {
   kind: 'solo'
   /** Ledger/run-dir label, e.g. 'SOLO'. */
   name: string
-  /** opencode model id, e.g. 'zai-coding-plan/glm-5.2'. */
-  model: string
+  /** Complete worker identity. Runtime reads harness/provider/model/prompt only from here. */
+  profile: AgentProfile
   /** Appended to the problem statement. Default: the shared worker suffix. */
   promptSuffix?: string
   /** Whole-run ceiling. solo.sh used `timeout 1000` (s). */
   timeoutMs?: number
+  /** Runtime bridge transport. Defaults to the CLI_BRIDGE environment variables. */
+  bridgeUrl?: string
+  bridgeBearer?: string
 }
 
 export interface SupervisorArmSpec {
@@ -271,8 +281,8 @@ export async function toArmIdentity(spec: ExecutableArmSpec): Promise<ArmSpec> {
     return {
       name: spec.name,
       kind: 'solo',
-      env: { model: spec.model },
-      provenance: { repo: 'opencode', commit: 'cli' },
+      env: { model: spec.profile.model?.default ?? 'missing' },
+      provenance: { repo: spec.profile.harness ?? 'missing', commit: 'runtime-bridge' },
     }
   }
   const loopsRepo = spec.loopsRepo ?? DEFAULT_LOOPS_REPO
@@ -450,7 +460,29 @@ async function verifyWorkspace(
   return res.code
 }
 
-/** solo.sh port: materialize → prompt → opencode run → patch extract → verify. */
+function runtimeSoloUsage(turn: CollectedAgentTurn): SoloUsage {
+  const calls = turn.events.filter((event) => event.type === 'llm_call')
+  const maxCtx = calls.reduce(
+    (max, event) => Math.max(max, (event.tokensIn ?? 0) + (event.tokensOut ?? 0)),
+    0,
+  )
+  const cacheRead = Number(turn.usage.promptCache?.readTokens ?? 0)
+  const cacheWrite = Number(turn.usage.promptCache?.writeTokens ?? 0)
+  const reasoning = turn.usage.reasoningTokens ?? 0
+  return {
+    steps: calls.length,
+    in: turn.usage.input,
+    out: turn.usage.output,
+    reasoning,
+    cache_w: Number.isFinite(cacheWrite) ? cacheWrite : 0,
+    cache_r: Number.isFinite(cacheRead) ? cacheRead : 0,
+    max_ctx: maxCtx,
+    oc_cost: turn.usage.costUsd ?? turn.usage.estimatedCostUsd ?? 0,
+    total_io: turn.usage.input + turn.usage.output + reasoning,
+  }
+}
+
+/** Solo arm: materialize → exact Runtime profile turn → patch extract → verify. */
 export async function runSoloArm(spec: SoloArmSpec, ctx: ArmRunContext): Promise<SoloArmResult> {
   const runDir = join(ctx.outDir, 'runs', ctx.instanceId, spec.name)
   const ws = join(runDir, 'ws')
@@ -469,18 +501,44 @@ export async function runSoloArm(spec: SoloArmSpec, ctx: ArmRunContext): Promise
     })
 
   const promptFile = join(runDir, 'prompt.txt')
-  await writeFile(promptFile, ctx.problemStatement + (spec.promptSuffix ?? WORKER_PROMPT_SUFFIX))
+  const prompt = ctx.problemStatement + (spec.promptSuffix ?? WORKER_PROMPT_SUFFIX)
+  await writeFile(promptFile, prompt)
+
+  const bridgeUrl = spec.bridgeUrl ?? process.env.CLI_BRIDGE_URL ?? process.env.BRIDGE_URL
+  const bridgeBearer =
+    spec.bridgeBearer ?? process.env.CLI_BRIDGE_BEARER ?? process.env.BRIDGE_BEARER
+  if (!bridgeUrl || !bridgeBearer) {
+    throw new Error(
+      'runSoloArm requires CLI_BRIDGE_URL/BRIDGE_URL and CLI_BRIDGE_BEARER/BRIDGE_BEARER',
+    )
+  }
 
   const t0 = Date.now()
-  const oc = await dotenvxBash(
-    ctx.secrets,
-    `cd ${shq(ws)} && opencode run "$(cat ${shq(promptFile)})" -m ${shq(spec.model)} --format json`,
-    { timeoutMs: spec.timeoutMs ?? 1_000_000, env: cell.env, signal: ctx.signal },
+  const timeoutMs = spec.timeoutMs ?? 1_000_000
+  const factory = createExecutor({
+    backend: 'bridge',
+    bridgeUrl,
+    bridgeBearer,
+    cwd: ws,
+    timeoutMs,
+  })
+  const turn = await collectAgentTurn(
+    streamAgentTurn(
+      { kind: 'executor', factory, profile: spec.profile },
+      prompt,
+      { timeoutMs, ...(ctx.signal ? { signal: ctx.signal } : {}) },
+    ),
   )
   const wall_s = Math.round((Date.now() - t0) / 1000)
-  await writeFile(join(runDir, 'oc.jsonl'), oc.stdout)
-  await writeFile(join(runDir, 'oc.err'), oc.stderr)
-  assertSoloProcessCompleted(oc, `runSoloArm ${ctx.instanceId}/${spec.name}`)
+  await writeFile(
+    join(runDir, 'runtime-events.jsonl'),
+    turn.events.map((event) => JSON.stringify(event)).join('\n') + '\n',
+  )
+  if (turn.status !== 'completed') {
+    throw new Error(
+      `runSoloArm ${ctx.instanceId}/${spec.name}: ${turn.error?.message ?? turn.status}`,
+    )
+  }
   if (ctx.signal?.aborted) throw ctx.signal.reason
 
   const patch = await extractPatch(ws, ctx.baseCommit, ctx.excludes, ctx.signal)
@@ -492,12 +550,12 @@ export async function runSoloArm(spec: SoloArmSpec, ctx: ArmRunContext): Promise
   return {
     arm: spec.name,
     iid: ctx.instanceId,
-    oc_rc: oc.code,
+    oc_rc: 0,
     wall_s,
     patch_lines: patchLineCount(patch),
     verify_rc,
     verify_pass: verify_rc === 0,
-    usage: parseOcUsage(oc.stdout),
+    usage: runtimeSoloUsage(turn),
     patchPath,
     ws,
   }