@tangle-network/agent-runtime 0.287.0 → 0.287.1

package/dist/testing.js

@@ -1,14 +1,14 @@
 import { O as immutableCandidateValue, w as canonicalCandidateDigest$1 } from "./workspace-archive-MhowMCmp.js";
-import { f as verifyAgentImprovementProposal } from "./improvement-cycle-CYlT8ljt.js";
+import { f as verifyAgentImprovementProposal } from "./improvement-cycle-DBvwFjzV.js";
 import { i as applyExactAgentProfileDiff, p as parseExactAgentProfile } from "./profile-C4NDjZyB.js";
-import { r as driverAgent } from "./coordination-driver-DDghv2Gd.js";
-import { a as superviseWithTestBrain, h as supervisorAgentWithTestBrain } from "./supervise-PbqXJ2vC.js";
-import { i as runGraphWithTestBrain } from "./graph-BTpOi49c.js";
+import { r as driverAgent } from "./coordination-driver-JuhaM7h9.js";
+import { a as superviseWithTestBrain, h as supervisorAgentWithTestBrain } from "./supervise-C-OUl-0_.js";
+import { i as runGraphWithTestBrain } from "./graph-BrbDHk_N.js";
 import { SANDBOX_SIZE_PRESET_NAMES, canonicalAgentProfileDigest } from "@tangle-network/agent-interface";
 //#region src/testing/fixtures/agent-improvement-proposal.json
 var agent_improvement_proposal_default = {
 	changedSurfaces: ["prompt"],
-	digest: "sha256:1881be550553aeebaed1edf0f88060b19db8a84a9a8dbaefa8634afa7fbafba0",
+	digest: "sha256:74a384270db9ec81273d835f9a5ca58bfcae65fd1a3c6726d8a76de202792a4f",
 	evaluation: {
 		"decision": {
 			"contributingChecks": [
@@ -4579,7 +4579,7 @@ var agent_improvement_proposal_default = {
 		],
 		"metadata": {
 			"fixture": "agent-improvement-proposal",
-			"runtimeVersion": "0.287.0"
+			"runtimeVersion": "0.287.1"
 		},
 		"objectives": [
 			{
@@ -4690,8 +4690,8 @@ var agent_improvement_proposal_default = {
 			"baselineContentHash": "sha256:5c21ee53e513fc604cb09754e21c392b24a424da0ef37dbf8f1ee4a8a0b08f09",
 			"candidateContentHash": "sha256:60fcbb1c728194bd51d7d19cb732d1c3f1881dce7e0a6266b41c8b98cfd65693",
 			"kind": "agent-eval-loop",
-			"recordDigest": "sha256:e707b76cdbd81f6b9a8c724221e56af001e6533530f5f7ea86ef3685855a39dd",
-			"runId": "agent-runtime-0.287.0-proposal-fixture",
+			"recordDigest": "sha256:4fbd49f487cdc3c39227e5a0f1edc5fddc026de81f8316b4a32a738507399c55",
+			"runId": "agent-runtime-0.287.1-proposal-fixture",
 			"schema": "agent-candidate-experiment"
 		}
 	},
@@ -4714,13 +4714,13 @@ var agent_improvement_proposal_default = {
 	}],
 	kind: "agent-improvement-proposal",
 	proposedAt: "2026-07-10T01:00:00.000Z",
-	runId: "agent-runtime-0.287.0-proposal-fixture"
+	runId: "agent-runtime-0.287.1-proposal-fixture"
 };
 //#endregion
 //#region src/testing/fixtures/agent-profile-improvement-proposal.json
 var agent_profile_improvement_proposal_default = {
 	changedSurfaces: ["prompt", "skills"],
-	digest: "sha256:8050e70299889de2d59e96b952bb55bb08ed5f60b91aabac1b9c646564445ccd",
+	digest: "sha256:07a9787d1b86722e3772e344ff4475f5843ef3adfbae51713a7975337155f48d",
 	evaluation: {
 		"decision": {
 			"contributingChecks": [
@@ -6354,7 +6354,7 @@ var agent_profile_improvement_proposal_default = {
 		],
 		"metadata": {
 			"fixture": "agent-profile-improvement-proposal",
-			"runtimeVersion": "0.287.0"
+			"runtimeVersion": "0.287.1"
 		},
 		"objectives": [
 			{
@@ -6465,7 +6465,7 @@ var agent_profile_improvement_proposal_default = {
 			"baselineContentHash": "sha256:21c495a37c418c10bde64fbaa188beddeed31f1f051ea60a6a6582a9ee0db704",
 			"candidateContentHash": "sha256:103f77bc8481601eef1ad5fe6ba84a40dffabc3a44f421f8c8559121edab84e9",
 			"kind": "agent-eval-loop",
-			"recordDigest": "sha256:c5dbdd0b90f5ecf567ded1b15b22ff62b1e64a773be0a52feefd7f62596cba0b",
+			"recordDigest": "sha256:9dfb96341ebe388ed169662248fb7a4a437d57e41e3b40720667d172cedcb362",
 			"runId": "profile-improvement-1",
 			"schema": "agent-profile-improvement-experiment"
 		}

package/dist/tui/index.js

@@ -1,3 +1,3 @@
-import { t as provisionSupervisor } from "../provision-supervisor-DOcn_znM.js";
+import { t as provisionSupervisor } from "../provision-supervisor-Cqsvapjc.js";
 import { a as renderTopFrameWithLayout, i as renderTopFrame, n as runTopApp, r as loadTopSnapshot, t as renderTopOnce } from "../top-app-DaiR4LXM.js";
 export { loadTopSnapshot, provisionSupervisor, renderTopFrame, renderTopFrameWithLayout, renderTopOnce, runTopApp };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tangle-network/agent-runtime",
-  "version": "0.287.0",
+  "version": "0.287.1",
   "description": "Shared task-lifecycle skeleton for agents: a recursive loop kernel for chat turns, one-shot tasks, and multi-attempt loops, with trace capture and eval-gated self-improvement. Domain behavior lives in adapters; scoring and ship-gates in @tangle-network/agent-eval.",
   "homepage": "https://github.com/tangle-network/agent-runtime#readme",
   "repository": {

package/skills/profile-authoring/SKILL.md

@@ -123,7 +123,9 @@ Hard limits live in Runtime options and per-assignment budgets: `budget`, `worke
 Prompt text enforces no limit.
 `maxTokens` is settled after the work: an overspent child keeps its output and carries a `budgetViolation`.
 A child's total counts input tokens on every turn, so reserve turns times context.
-Give each paid job its own named key with a dollar cap, and state the dollars before launch.
+For paid calls, use the execution owner's named credential and enforceable dollar limit.
+For subscriptions, retain token, iteration, time, and compute bounds that the installed path can enforce.
+An unmeasured dollar cost stays unknown; an unsupported dollar cap is not protection.
 
 ## 8. Register arms, a control and outcomes
 
@@ -153,6 +155,16 @@ Group retries of the same assignment into one lineage when comparing teams.
 Grant `submit_result` only when Runtime gives that node an independent check; otherwise its settlement stays unassessed.
 Grant only the observation, steering and journal tools that the assignment needs.
 Set `harness`, `model.default` and `model.provider` explicitly, and validate against the current `agentProfileSchema`.
+
+For subscription execution, select a harness and model that the granted account can serve.
+The private executor resolves the authorized credential and materializes the harness's authentication files.
+Keep credential references in supported configuration; keep credential values outside profiles, tasks, resources, and journals.
+Runtime descendants use the same configured provider and credential resolver; author their profiles rather than copying login files.
+Check the child's materialization receipt and actual session before claiming that account or harness executed.
+Grant only the models and authentication routes the execution owner authorized.
+When the run requires cloud execution, place its controller, root, and descendants through the maintained managed-cloud deployment.
+When mounted, [execution and credentials](references/execution-and-credentials.md) explains binding, renewal, and recovery in more detail.
+
 A tool name must be one the harness publishes, and a refused name fails the same way on retry.
 `ls`, `list` and `find` are not tool names; select paths with a glob tool and search contents with a grep tool.
 Inspect materialized permissions and served tools before relying on a restriction.

package/skills/profile-authoring/references/execution-and-credentials.md

@@ -0,0 +1,73 @@
+# Execution and credentials
+
+## Choose the profile; inherit the authorized execution
+
+The profile defines the harness, model, instructions, capabilities, and research behavior.
+The private executor supplies authentication and placement under the run's authority.
+An account credential does not select a different model or grant additional tools.
+
+Select the harness and model explicitly from the installed capability contract.
+Use the granted provider for the root and its Runtime descendants.
+Let its credential resolver select an authorized account for each exact profile and creation identity.
+Use the installed provider's supported static binding when no dynamic selector is configured.
+Account selection, quota, validity, and renewal belong to that account owner.
+
+The executor materializes credentials in the format the selected harness requires.
+Authentication files are private execution inputs, even when they are ordinary files inside the sandbox.
+Keep their values outside public profiles, mounted research inputs, prompts, and evidence archives.
+Use supported secret references or private backend configuration at the execution boundary.
+Read the current schema before naming a profile field; metadata alone does not configure authentication.
+
+The director authors each descendant's profile and grants its permitted capabilities.
+It does not need to perform an interactive login or export a parent's token.
+A descendant that can spawn receives the complete profile-authoring skill and the same authorized execution path.
+Changing its harness requires a granted authentication route for that harness.
+Native harness subagents and Runtime descendants remain distinct observation units.
+
+## Cloud execution and persistence
+
+When the run requires cloud execution, place its controller, root, and descendants in the managed cloud.
+Use the maintained managed-process deployment and ingress rather than a detached host process.
+Choose a distinct run identity and immutable controller image for each commission.
+The ingress binds each Runtime actor to its own authenticated listener.
+Research policy stays in profiles and the registered method, not the ingress.
+
+Retain the original workspace and native session through the execution owner's supported continuation path.
+Record account changes, renewal, reconnects, and native-session changes separately.
+A fresh environment with copied files is not proof that the original native session resumed.
+Preserve partial artifacts before environment cleanup and archive them through the existing storage path.
+Check that retained capture excludes authentication files and other private credentials.
+
+## What proves execution
+
+Separate configuration, materialization, model execution, research progress, and outside acceptance.
+For a root and a recursively spawned child, inspect:
+
+- The exact authored profile and materialization receipt.
+- The cloud placement, Runtime actor, and native session identities.
+- The granted account reference and actual harness/model evidence, without credential values.
+- The first model invocation and a real tool action.
+- The child-to-grandchild edge when claiming recursion.
+- Retrievable trace and artifact bytes after capture.
+
+A merged source change or published package does not prove a running deployment supports it.
+A supported deployment does not prove an account was used.
+An agent's claim of delegation does not prove that its child executed.
+Keep missing identity, usage, cost, and renewal evidence unknown.
+
+The operator establishes the execution path before research begins.
+When an authorized capability fails inside a run, retain its receipt and use the granted reporting or recovery tool.
+Continue useful research through capabilities that remain available within the same authority.
+
+## Maintained contracts
+
+Use these owners for changing fields and commands instead of copying an API catalog into this skill.
+
+- [Runtime profile and execution composition](https://github.com/tangle-network/agent-runtime/blob/main/docs/canonical-api.md#15-the-agentprofile-rule-author-the-profile-the-substrate-materializes-it).
+- [Runtime managed compute](https://github.com/tangle-network/agent-runtime/blob/main/docs/agent-managed-compute/README.md).
+- [Portable profile schema](https://github.com/tangle-network/agent-sdk/blob/main/packages/agent-interface/src/profile-schema.ts).
+- [Tangle provider credentials and execution](https://github.com/tangle-network/agent-sdk/blob/main/packages/agent-provider-tangle/README.md).
+- [Discovery cloud submission and retention](https://github.com/tangle-network/discovery-lab/blob/master/README.md).
+
+Read the installed provider's contract before using a newer source-only resolver or capability.
+The core skill remains sufficient to author a child; mount this reference when its assignment includes execution integration.