@xemahq/agent-session-runtime 0.7.0 → 0.9.0

package/src/lib/composer.ts

@@ -1,13 +1,19 @@
 import { createHash } from 'node:crypto';
 
 import {
-  AWP_V1_SPEC,
-  WorkspaceMount,
+  LogicalWorkspaceSlot,
+  LogicalMountPlanEntrySchema,
   WorkspaceMountMode,
-  type SlotDefinition,
+  type LogicalMountPlanEntry,
   type WorkspaceMountPlan,
-  type WorkspaceMountPlanEntry,
 } from '@xemahq/kernel-contracts/agent-workspace';
+import {
+  RuntimePlacementAssessment,
+  UnsupportedRuntimePlacementError,
+  WorkerRuntimeKind,
+  type RuntimeLayoutAdapter,
+  type UnsupportedPlacement,
+} from '@xemahq/kernel-contracts/worker-runtime';
 import {
   BriefcaseReferenceKind,
   type AgentRunRole,
@@ -54,6 +60,8 @@ interface AgentContextShape {
   readonly delegatedSubAgents?: readonly string[];
   readonly skills?: readonly string[];
   readonly instructions?: readonly string[];
+  readonly runtimeConfig?: Readonly<Record<string, unknown>>;
+  readonly mcpConfig?: Readonly<Record<string, unknown>>;
   readonly inputsJsonBase64?: string;
   readonly kbSpaceIds?: readonly string[];
   /**
@@ -113,8 +121,29 @@ export interface InputArtifactRef {
   readonly contentType?: string;
 }
 
+export interface ExplicitlyUnsupportedOptionalEntry {
+  readonly mountKey: string;
+  readonly slot: LogicalWorkspaceSlot;
+  readonly placement: UnsupportedPlacement;
+}
+
+export interface RuntimeAssessedWorkspaceMountPlan extends WorkspaceMountPlan {
+  readonly runtimeKind: WorkerRuntimeKind;
+  readonly runtimeLayoutRevision: string;
+  readonly runtimeLayoutProfileRef: string;
+  readonly staticDependencyClosureHash: string;
+  readonly unsupportedOptionalEntries: readonly ExplicitlyUnsupportedOptionalEntry[];
+}
+
 export class DefaultWorkspaceImageComposer implements WorkspaceImageComposer {
-  async compose(req: ComposeWorkspaceImageRequest): Promise<WorkspaceMountPlan> {
+  public constructor(
+    private readonly runtimeLayout: RuntimeLayoutAdapter,
+    private readonly optionalMountKeys: ReadonlySet<string> = new Set(),
+  ) {}
+
+  async compose(
+    req: ComposeWorkspaceImageRequest,
+  ): Promise<RuntimeAssessedWorkspaceMountPlan> {
     // Exactly-one-of invariant: the doc on `ComposeWorkspaceImageRequest`
     // promises `workflowRun` xor `interactive`. Enforce it here so
     // `deriveApplyId` can never collapse two unrelated requests onto a
@@ -172,7 +201,8 @@ export class DefaultWorkspaceImageComposer implements WorkspaceImageComposer {
       req.manifest.agent.deliverableSpecRef ??
       ctx.deliverableSpecRef;
 
-    const entries: WorkspaceMountPlanEntry[] = [];
+    assertNoSecretOrBindingMaterial(req);
+    const entries: LogicalMountPlanEntry[] = [];
 
     // ── Platform-rendered single-file slots ───────────────────────────
     // The three rendered-* sources (agents-md, context-json, system-overlay)
@@ -197,8 +227,12 @@ export class DefaultWorkspaceImageComposer implements WorkspaceImageComposer {
       req.manifest.slug,
       req.manifest.version,
     );
-    const renderedInputArtifacts = buildRenderedInputArtifacts(ctx.inputArtifacts);
-    const renderedWorkingFiles = buildRenderedWorkingFiles(req.manifest.workingFiles);
+    const renderedInputArtifacts = buildRenderedInputArtifacts(
+      ctx.inputArtifacts,
+    );
+    const renderedWorkingFiles = buildRenderedWorkingFiles(
+      req.manifest.workingFiles,
+    );
     const renderedSourceParams: RenderedAgentRunContextParams = {
       orgId: req.orgId,
       projectId: req.projectId,
@@ -206,8 +240,12 @@ export class DefaultWorkspaceImageComposer implements WorkspaceImageComposer {
       stageKey: req.manifest.agent.stageKey,
       role,
       ...(deliverableSpecRef === undefined ? {} : { deliverableSpecRef }),
-      ...(req.workflowRun?.runId === undefined ? {} : { runId: req.workflowRun.runId }),
-      ...(req.workflowRun?.jobRunId === undefined ? {} : { jobRunId: req.workflowRun.jobRunId }),
+      ...(req.workflowRun?.runId === undefined
+        ? {}
+        : { runId: req.workflowRun.runId }),
+      ...(req.workflowRun?.jobRunId === undefined
+        ? {}
+        : { jobRunId: req.workflowRun.jobRunId }),
       ...(req.interactive?.sessionId === undefined
         ? {}
         : { sessionId: req.interactive.sessionId }),
@@ -223,7 +261,7 @@ export class DefaultWorkspaceImageComposer implements WorkspaceImageComposer {
 
     entries.push(
       buildEntry({
-        slot: WorkspaceMount.AgentsMd,
+        slot: LogicalWorkspaceSlot.AgentContext,
         relPath: '',
         mode: WorkspaceMountMode.ReadOnly,
         mountKey: 'agents-md',
@@ -231,9 +269,31 @@ export class DefaultWorkspaceImageComposer implements WorkspaceImageComposer {
       }),
     );
 
+    if (ctx.runtimeConfig !== undefined) {
+      assertRuntimeConfigExcludesImageOwnedContent(ctx.runtimeConfig);
+      entries.push(
+        buildCanonicalConfigEntry(
+          LogicalWorkspaceSlot.RuntimeConfig,
+          'runtime-config',
+          'runtime-config.json',
+          ctx.runtimeConfig,
+        ),
+      );
+    }
+    if (ctx.mcpConfig !== undefined) {
+      entries.push(
+        buildCanonicalConfigEntry(
+          LogicalWorkspaceSlot.McpConfig,
+          'mcp-config',
+          'mcp-config.json',
+          ctx.mcpConfig,
+        ),
+      );
+    }
+
     entries.push(
       buildEntry({
-        slot: WorkspaceMount.ContextJson,
+        slot: LogicalWorkspaceSlot.AgentContext,
         relPath: '',
         mode: WorkspaceMountMode.ReadOnly,
         mountKey: 'context-json',
@@ -243,7 +303,7 @@ export class DefaultWorkspaceImageComposer implements WorkspaceImageComposer {
 
     entries.push(
       buildEntry({
-        slot: WorkspaceMount.SystemOverlay,
+        slot: LogicalWorkspaceSlot.SystemOverlay,
         relPath: '',
         mode: WorkspaceMountMode.ReadOnly,
         mountKey: 'system-overlay',
@@ -257,65 +317,56 @@ export class DefaultWorkspaceImageComposer implements WorkspaceImageComposer {
     // and snapshots carry them across retries automatically.
     entries.push(
       buildEntry({
-        slot: WorkspaceMount.Tmp,
+        slot: LogicalWorkspaceSlot.Temporary,
         relPath: '.keep',
         mode: WorkspaceMountMode.ReadWrite,
         mountKey: 'tmp:seed',
         source: {
           kind: 'static-literal',
-          pathWithinWorkspace: 'tmp/.keep',
+          pathWithinWorkspace: '.keep',
           bytes: '',
         },
       }),
     );
 
-    // ── Agent bundles (primary + delegated subagents) ─────────────────
-    // WORKFLOW SURFACE ONLY. On the interactive session surface the session
-    // control-bundle (workspace-proxy `materializeSessionBundle`) is the sole
-    // authoritative writer of `/workspace/.opencode/agents/*.md`: it renders
-    // the primary with its composition overrides (node `instructions` +
-    // `promptMode: replace` + `permission`) server-side and patches the
-    // delegate allowlist. If the composer also emitted these here, the
-    // bootstrap mount-apply — which runs AFTER apply-control-bundle on launch
-    // and does a whole-slot `rmSync`+rename on the AgentBundles slot — would
-    // WIPE the control-bundle's correct render and replace it with the BARE
-    // base kernel (e.g. a composition extending `planner` collapses to raw
-    // `planner`, losing its persona prompt + delegate set). The workflow
-    // surface has no control-bundle, so it MUST still emit them here.
-    if (isWorkflowSurface) {
+    // ── Agent definitions (primary + delegated subagents) ─────────────
+    // The logical plan is the sole static closure authority on both
+    // workflow and interactive surfaces. Runtime-specific writers may render
+    // these differently, but no second control bundle may reconstruct them.
+    entries.push(
+      buildEntry({
+        slot: LogicalWorkspaceSlot.AgentDefinitions,
+        relPath: `${req.manifest.agent.slug}.md`,
+        mode: WorkspaceMountMode.ReadOnly,
+        mountKey: `agent-bundle:${req.manifest.agent.slug}`,
+        source: {
+          kind: 'agent-kernel',
+          orgId: req.orgId,
+          agentSlug: req.manifest.agent.slug,
+          stageKey: req.manifest.agent.stageKey,
+          agentMode: 'primary',
+        },
+      }),
+    );
+    for (const sub of dedupe(ctx.delegatedSubAgents ?? [])) {
+      if (sub === req.manifest.agent.slug) {
+        continue;
+      }
       entries.push(
         buildEntry({
-          slot: WorkspaceMount.AgentBundles,
-          relPath: `${req.manifest.agent.slug}.md`,
+          slot: LogicalWorkspaceSlot.AgentDefinitions,
+          relPath: `${sub}.md`,
           mode: WorkspaceMountMode.ReadOnly,
-          mountKey: `agent-bundle:${req.manifest.agent.slug}`,
+          mountKey: `agent-bundle:${sub}`,
           source: {
             kind: 'agent-kernel',
             orgId: req.orgId,
-            agentSlug: req.manifest.agent.slug,
+            agentSlug: sub,
             stageKey: req.manifest.agent.stageKey,
-            agentMode: 'primary',
+            agentMode: 'subagent',
           },
         }),
       );
-      for (const sub of ctx.delegatedSubAgents ?? []) {
-        if (sub === req.manifest.agent.slug) continue; // primary already emitted
-        entries.push(
-          buildEntry({
-            slot: WorkspaceMount.AgentBundles,
-            relPath: `${sub}.md`,
-            mode: WorkspaceMountMode.ReadOnly,
-            mountKey: `agent-bundle:${sub}`,
-            source: {
-              kind: 'agent-kernel',
-              orgId: req.orgId,
-              agentSlug: sub,
-              stageKey: req.manifest.agent.stageKey,
-              agentMode: 'subagent',
-            },
-          }),
-        );
-      }
     }
 
     // ── Skill bundles + /skill launch commands ────────────────────────
@@ -324,8 +375,8 @@ export class DefaultWorkspaceImageComposer implements WorkspaceImageComposer {
     // resolver yields one file per bundle member, so the writer composes
     // `<skill-bundles slot>/<skillKey>/<resolver relPath>`.
     //
-    // Alongside each bundle we emit one OpenCode command file so typing
-    // `/<skillKey>` in a session loads and applies that skill natively.
+    // Alongside each bundle we emit one logical invocation intent. Qwen's
+    // adapter consumes it natively; file-oriented adapters render a command.
     //
     // Kernel-shipped System skills are PREPENDED to whatever skills the
     // caller already named in `agentContext.skills` (per the skill
@@ -339,7 +390,7 @@ export class DefaultWorkspaceImageComposer implements WorkspaceImageComposer {
     ])) {
       entries.push(
         buildEntry({
-          slot: WorkspaceMount.SkillBundles,
+          slot: LogicalWorkspaceSlot.SkillBundles,
           relPath: skillKey,
           mode: WorkspaceMountMode.ReadOnly,
           mountKey: `skill-bundle:${skillKey}`,
@@ -352,17 +403,21 @@ export class DefaultWorkspaceImageComposer implements WorkspaceImageComposer {
       const commandRelPath = `${skillKey}.md`;
       entries.push(
         buildEntry({
-          slot: WorkspaceMount.Commands,
+          slot: LogicalWorkspaceSlot.SkillCommands,
           relPath: commandRelPath,
           mode: WorkspaceMountMode.ReadOnly,
           mountKey: `skill-command:${skillKey}`,
-          source: {
-            kind: 'static-literal',
-            pathWithinWorkspace: `.opencode/command/${commandRelPath}`,
-            bytes: Buffer.from(renderSkillCommand(skillKey), 'utf8').toString(
-              'base64',
-            ),
-          },
+          source:
+            this.runtimeLayout.runtimeKind === WorkerRuntimeKind.Qwen
+              ? { kind: 'skill-bundle', skillKey }
+              : {
+                  kind: 'static-literal',
+                  pathWithinWorkspace: commandRelPath,
+                  bytes: Buffer.from(
+                    renderSkillCommand(skillKey),
+                    'utf8',
+                  ).toString('base64'),
+                },
         }),
       );
     }
@@ -371,7 +426,7 @@ export class DefaultWorkspaceImageComposer implements WorkspaceImageComposer {
     for (const sectionKey of dedupe(ctx.instructions ?? [])) {
       entries.push(
         buildEntry({
-          slot: WorkspaceMount.Instructions,
+          slot: LogicalWorkspaceSlot.Instructions,
           relPath: `${sectionKey}.md`,
           mode: WorkspaceMountMode.ReadOnly,
           mountKey: `instruction:${sectionKey}`,
@@ -410,24 +465,25 @@ export class DefaultWorkspaceImageComposer implements WorkspaceImageComposer {
             `Enable the slot in the agent manifest or change the inputArtifact's 'slot' to one of: [${[...enabledSlots].join(', ') || '(none)'}].`,
         );
       }
-      const slotDef = AWP_V1_SPEC.slots.find((s) => s.key === slotKey);
-      if (!slotDef) {
-        throw new UnknownSlotError(
-          slotKey,
-          'inputArtifacts',
-          req.manifest.slug,
-          req.manifest.version,
-        );
-      }
+      const slotDef = requireLogicalSlot(
+        slotKey,
+        'inputArtifacts',
+        req.manifest.slug,
+        req.manifest.version,
+      );
       const fileName = ia.fileName.trim();
-      if (fileName.length === 0 || fileName.includes('..') || fileName.startsWith('/')) {
+      if (
+        fileName.length === 0 ||
+        fileName.includes('..') ||
+        fileName.startsWith('/')
+      ) {
         throw new Error(
           `WorkspaceImageComposer: inputArtifact fileName '${ia.fileName}' is invalid — must be a non-empty relative path without '..' segments.`,
         );
       }
       entries.push(
         buildEntry({
-          slot: slotDef.path as WorkspaceMount,
+          slot: slotDef.slot,
           relPath: fileName,
           mode: WorkspaceMountMode.ReadOnly,
           mountKey: `input-artifact:${ia.artifactId}:v${ia.version}:${fileName}`,
@@ -436,8 +492,12 @@ export class DefaultWorkspaceImageComposer implements WorkspaceImageComposer {
             artifactId: ia.artifactId,
             version: ia.version,
             fileName,
-            ...(ia.payloadField !== undefined && { payloadField: ia.payloadField }),
-            ...(ia.contentType !== undefined && { contentType: ia.contentType }),
+            ...(ia.payloadField !== undefined && {
+              payloadField: ia.payloadField,
+            }),
+            ...(ia.contentType !== undefined && {
+              contentType: ia.contentType,
+            }),
           },
         }),
       );
@@ -446,18 +506,17 @@ export class DefaultWorkspaceImageComposer implements WorkspaceImageComposer {
     // ── User-data mounts (manifest-declared) ──────────────────────────
     for (const [slotKey, decl] of Object.entries(req.manifest.mounts)) {
       if (!decl.enabled) continue;
-      const slotDef = AWP_V1_SPEC.slots.find((s) => s.key === slotKey);
-      if (!slotDef) {
-        throw new UnknownSlotError(
-          slotKey,
-          'manifest.mounts',
-          req.manifest.slug,
-          req.manifest.version,
-        );
-      }
+      const slotDef = requireLogicalSlot(
+        slotKey,
+        'manifest.mounts',
+        req.manifest.slug,
+        req.manifest.version,
+      );
       const mode = decl.mode ?? slotDef.defaultMode;
       const mountMode =
-        mode === 'read-write' ? WorkspaceMountMode.ReadWrite : WorkspaceMountMode.ReadOnly;
+        mode === 'read-write'
+          ? WorkspaceMountMode.ReadWrite
+          : WorkspaceMountMode.ReadOnly;
       const sources = extractMountSourcesForSlot(
         slotKey,
         decl,
@@ -469,7 +528,7 @@ export class DefaultWorkspaceImageComposer implements WorkspaceImageComposer {
       for (const { source, relPath, mountKey } of sources) {
         entries.push(
           buildEntry({
-            slot: slotDef.path as WorkspaceMount,
+            slot: slotDef.slot,
             relPath,
             mode: mountMode,
             mountKey,
@@ -490,15 +549,12 @@ export class DefaultWorkspaceImageComposer implements WorkspaceImageComposer {
       );
     }
     for (const sf of req.manifest.seedFiles) {
-      const slotDef = AWP_V1_SPEC.slots.find((s) => s.key === sf.slot);
-      if (!slotDef) {
-        throw new UnknownSlotError(
-          sf.slot,
-          'manifest.seedFiles',
-          req.manifest.slug,
-          req.manifest.version,
-        );
-      }
+      const slotDef = requireLogicalSlot(
+        sf.slot,
+        'manifest.seedFiles',
+        req.manifest.slug,
+        req.manifest.version,
+      );
       let bytesBase64: string;
       if (sf.source.kind === 'inline') {
         bytesBase64 = sf.source.bytesBase64;
@@ -518,7 +574,7 @@ export class DefaultWorkspaceImageComposer implements WorkspaceImageComposer {
       // which is exactly what we want.
       entries.push(
         buildEntry({
-          slot: slotDef.path as WorkspaceMount,
+          slot: slotDef.slot,
           relPath: sf.relPath,
           mode: WorkspaceMountMode.ReadOnly,
           mountKey: `seed:${sf.slot}:${sf.relPath}`,
@@ -531,10 +587,12 @@ export class DefaultWorkspaceImageComposer implements WorkspaceImageComposer {
       );
     }
 
-    return {
-      applyId: deriveApplyId(req),
+    return finalizeLogicalPlan(
+      req,
       entries,
-    };
+      this.runtimeLayout,
+      this.optionalMountKeys,
+    );
   }
 }
 
@@ -576,6 +634,116 @@ function deriveApplyId(req: ComposeWorkspaceImageRequest): string {
   return createHash('sha256').update(components.join(':')).digest('hex');
 }
 
+function finalizeLogicalPlan(
+  req: ComposeWorkspaceImageRequest,
+  entries: readonly LogicalMountPlanEntry[],
+  runtimeLayout: RuntimeLayoutAdapter,
+  optionalMountKeys: ReadonlySet<string>,
+): RuntimeAssessedWorkspaceMountPlan {
+  return compileLogicalWorkspacePlan({
+    applySeed: deriveApplyId(req),
+    entries,
+    runtimeLayout,
+    optionalMountKeys,
+  });
+}
+
+export interface CompileLogicalWorkspacePlanInput {
+  readonly applySeed: string;
+  readonly entries: readonly LogicalMountPlanEntry[];
+  readonly runtimeLayout: RuntimeLayoutAdapter;
+  readonly optionalMountKeys?: ReadonlySet<string>;
+}
+
+export function compileLogicalWorkspacePlan(
+  input: CompileLogicalWorkspacePlanInput,
+): RuntimeAssessedWorkspaceMountPlan {
+  const { applySeed, entries, runtimeLayout } = input;
+  const optionalMountKeys = input.optionalMountKeys ?? new Set<string>();
+  const ordered = [...entries].sort(compareLogicalEntries);
+  const seenMountKeys = new Set<string>();
+  const supported: LogicalMountPlanEntry[] = [];
+  const unsupportedOptionalEntries: ExplicitlyUnsupportedOptionalEntry[] = [];
+
+  for (const entry of ordered) {
+    assertNoSecretOrBindingMaterial(entry.source);
+    LogicalMountPlanEntrySchema.parse(entry);
+    if (seenMountKeys.has(entry.mountKey)) {
+      throw new Error(`DUPLICATE_LOGICAL_MOUNT_KEY:${entry.mountKey}`);
+    }
+    seenMountKeys.add(entry.mountKey);
+    const placement = runtimeLayout.assess(entry);
+    if (placement.assessment === RuntimePlacementAssessment.Unsupported) {
+      if (!optionalMountKeys.has(entry.mountKey)) {
+        throw new UnsupportedRuntimePlacementError(placement);
+      }
+      unsupportedOptionalEntries.push({
+        mountKey: entry.mountKey,
+        slot: entry.slot,
+        placement,
+      });
+      continue;
+    }
+    supported.push(entry);
+  }
+
+  const closure = {
+    schemaVersion: 1,
+    runtimeKind: runtimeLayout.runtimeKind,
+    runtimeLayoutRevision: runtimeLayout.revision,
+    runtimeLayoutProfileRef: runtimeLayout.profileRef,
+    entries: supported,
+    unsupportedOptionalEntries,
+  } as const;
+  const staticDependencyClosureHash = createHash('sha256')
+    .update(JSON.stringify(stableSort(closure)))
+    .digest('hex');
+  const applyId = createHash('sha256')
+    .update(`${applySeed}:${staticDependencyClosureHash}`)
+    .digest('hex');
+  return {
+    applyId,
+    entries: supported,
+    runtimeKind: runtimeLayout.runtimeKind,
+    runtimeLayoutRevision: runtimeLayout.revision,
+    runtimeLayoutProfileRef: runtimeLayout.profileRef,
+    staticDependencyClosureHash,
+    unsupportedOptionalEntries,
+  };
+}
+
+function compareLogicalEntries(
+  left: LogicalMountPlanEntry,
+  right: LogicalMountPlanEntry,
+): number {
+  const leftKey = `${left.slot}\u0000${left.relPath}\u0000${left.mountKey}`;
+  const rightKey = `${right.slot}\u0000${right.relPath}\u0000${right.mountKey}`;
+  return leftKey === rightKey ? 0 : leftKey < rightKey ? -1 : 1;
+}
+
+const FORBIDDEN_MATERIAL_KEY =
+  /(?:secret|password|accessToken|refreshToken|credentialLease|runtimeBinding|sessionBinding)/i;
+
+function assertNoSecretOrBindingMaterial(value: unknown, path = 'input'): void {
+  if (value === null || typeof value !== 'object') {
+    return;
+  }
+  if (Array.isArray(value)) {
+    value.forEach((member, index) =>
+      assertNoSecretOrBindingMaterial(member, `${path}[${index}]`),
+    );
+    return;
+  }
+  for (const [key, member] of Object.entries(
+    value as Readonly<Record<string, unknown>>,
+  )) {
+    if (FORBIDDEN_MATERIAL_KEY.test(key) && member !== undefined) {
+      throw new Error(`FORBIDDEN_RUNTIME_MATERIAL:${path}.${key}`);
+    }
+    assertNoSecretOrBindingMaterial(member, `${path}.${key}`);
+  }
+}
+
 /**
  * Hash the manifest fields that drive mount composition. A change to
  * any of these fields produces a different `applyId`, forcing
@@ -633,12 +801,12 @@ function renderSkillCommand(skillKey: string): string {
 }
 
 function buildEntry(args: {
-  slot: WorkspaceMount;
+  slot: LogicalWorkspaceSlot;
   relPath: string;
   mode: WorkspaceMountMode;
   mountKey: string;
   source: MountSource;
-}): WorkspaceMountPlanEntry {
+}): LogicalMountPlanEntry {
   return {
     mountKey: args.mountKey,
     slot: args.slot,
@@ -648,6 +816,38 @@ function buildEntry(args: {
   };
 }
 
+function buildCanonicalConfigEntry(
+  slot: LogicalWorkspaceSlot.RuntimeConfig | LogicalWorkspaceSlot.McpConfig,
+  mountKey: string,
+  sourceName: string,
+  value: Readonly<Record<string, unknown>>,
+): LogicalMountPlanEntry {
+  assertNoSecretOrBindingMaterial(value, mountKey);
+  return buildEntry({
+    slot,
+    relPath: '',
+    mode: WorkspaceMountMode.ReadOnly,
+    mountKey,
+    source: {
+      kind: 'static-literal',
+      pathWithinWorkspace: sourceName,
+      bytes: Buffer.from(JSON.stringify(stableSort(value)), 'utf8').toString(
+        'base64',
+      ),
+    },
+  });
+}
+
+function assertRuntimeConfigExcludesImageOwnedContent(
+  config: Readonly<Record<string, unknown>>,
+): void {
+  for (const key of ['plugins', 'tools']) {
+    if (config[key] !== undefined) {
+      throw new Error(`RUNTIME_IMAGE_OWNED_CONTENT:${key}`);
+    }
+  }
+}
+
 interface ExtractedMountSource {
   readonly source: MountSource;
   readonly relPath: string;
@@ -720,7 +920,9 @@ function extractMountSourcesForSlot(
           mountKey: `references:project:${projectId}`,
         });
       }
-      for (const entry of extractBriefcaseReferenceMounts(briefcase?.references)) {
+      for (const entry of extractBriefcaseReferenceMounts(
+        briefcase?.references,
+      )) {
         out.push(entry);
       }
       return out;
@@ -749,7 +951,10 @@ function extractMountSourcesForSlot(
       if (!deliverableSpecRef) return [];
       return [
         {
-          source: { kind: 'deliverable-specs', contractKey: deliverableSpecRef },
+          source: {
+            kind: 'deliverable-specs',
+            contractKey: deliverableSpecRef,
+          },
           relPath: deliverableSpecRef,
           mountKey: `deliverable-specs:${deliverableSpecRef}`,
         },
@@ -796,7 +1001,11 @@ function extractBriefcaseUploadMounts(
   if (!uploads || uploads.length === 0) return [];
   return uploads.map((u) => {
     const fileName = u.filename.trim();
-    if (fileName.length === 0 || fileName.includes('..') || fileName.startsWith('/')) {
+    if (
+      fileName.length === 0 ||
+      fileName.includes('..') ||
+      fileName.startsWith('/')
+    ) {
       throw new Error(
         `WorkspaceImageComposer: briefcase upload filename '${u.filename}' is invalid — must be a non-empty relative path without '..' segments.`,
       );
@@ -839,7 +1048,9 @@ function extractBriefcaseReferenceMounts(
   return out;
 }
 
-function briefcaseReferenceToMount(ref: BriefcaseReference): ExtractedMountSource | null {
+function briefcaseReferenceToMount(
+  ref: BriefcaseReference,
+): ExtractedMountSource | null {
   switch (ref.kind) {
     case BriefcaseReferenceKind.KB_SPACE:
       return {
@@ -881,7 +1092,8 @@ function briefcaseReferenceToMount(ref: BriefcaseReference): ExtractedMountSourc
         );
       }
       const trimmedTitle = ref.title?.trim() ?? '';
-      const fileName = trimmedTitle.length > 0 ? trimmedTitle : `${artifactId}-v${version}`;
+      const fileName =
+        trimmedTitle.length > 0 ? trimmedTitle : `${artifactId}-v${version}`;
       return {
         source: {
           kind: 'artifact-version',
@@ -916,13 +1128,53 @@ function briefcaseReferenceToMount(ref: BriefcaseReference): ExtractedMountSourc
   }
 }
 
-// Static-only assertion that AWP slot `path`s align with the
-// WorkspaceMount enum we depend on. Kept here so a kernel slot rename
-// fails fast at build time.
-function _assertSlotsCover(): SlotDefinition[] {
-  return [...AWP_V1_SPEC.slots];
+interface ManifestLogicalSlot {
+  readonly slot: LogicalWorkspaceSlot;
+  readonly defaultMode: 'read-only' | 'read-write';
+}
+
+const MANIFEST_LOGICAL_SLOTS: Readonly<Record<string, ManifestLogicalSlot>> =
+  Object.freeze({
+    inputs: { slot: LogicalWorkspaceSlot.Inputs, defaultMode: 'read-only' },
+    tmp: { slot: LogicalWorkspaceSlot.Temporary, defaultMode: 'read-write' },
+    deliverables: {
+      slot: LogicalWorkspaceSlot.Deliverables,
+      defaultMode: 'read-write',
+    },
+    'deliverable-specs': {
+      slot: LogicalWorkspaceSlot.DeliverableSpecs,
+      defaultMode: 'read-only',
+    },
+    references: {
+      slot: LogicalWorkspaceSlot.References,
+      defaultMode: 'read-only',
+    },
+    repos: {
+      slot: LogicalWorkspaceSlot.Repositories,
+      defaultMode: 'read-write',
+    },
+    uploads: {
+      slot: LogicalWorkspaceSlot.Uploads,
+      defaultMode: 'read-only',
+    },
+  });
+
+function requireLogicalSlot(
+  key: string,
+  source:
+    | 'manifest.mounts'
+    | 'manifest.seedFiles'
+    | 'rendered.mounts'
+    | 'inputArtifacts',
+  manifestSlug: string,
+  manifestVersion: string,
+): ManifestLogicalSlot {
+  const slot = MANIFEST_LOGICAL_SLOTS[key];
+  if (!slot) {
+    throw new UnknownSlotError(key, source, manifestSlug, manifestVersion);
+  }
+  return slot;
 }
-void _assertSlotsCover;
 
 /**
  * Drop the keys the composer itself consumes (subagents, skills, mount
@@ -938,6 +1190,8 @@ function pickWorkflowInputs(
     'delegatedSubAgents',
     'skills',
     'instructions',
+    'runtimeConfig',
+    'mcpConfig',
     'inputsJsonBase64',
     'kbSpaceIds',
     'kbPageMounts',
@@ -994,10 +1248,10 @@ function buildRenderedInputArtifacts(
   }> = [];
   for (const ia of inputArtifacts) {
     const slotKey = ia.slot ?? 'inputs';
-    const slotDef = AWP_V1_SPEC.slots.find((s) => s.key === slotKey);
+    const slotDef = MANIFEST_LOGICAL_SLOTS[slotKey];
     if (!slotDef) continue;
     out.push({
-      path: `${slotDef.path}/${ia.fileName}`,
+      path: `${slotDef.slot}/${ia.fileName}`,
       ...(ia.contentType !== undefined && { contentType: ia.contentType }),
       sourceArtifactId: ia.artifactId,
       sourceVersion: ia.version,
@@ -1021,35 +1275,42 @@ function buildRenderedWorkingFiles(
   readonly sourceRef: Readonly<Record<string, string>>;
 }> {
   if (!workingFiles || workingFiles.length === 0) return [];
-  return workingFiles.map((wf) => ({
-    slug: wf.slug,
-    path: wf.path,
-    format: wf.format,
-    syncDirection: wf.syncDirection,
-    sourceKind: wf.sourceKind,
-    sourceRef: wf.sourceRef,
-  }));
+  return workingFiles.map((wf) => {
+    if (
+      wf.path.startsWith('/') ||
+      /(^|\/)\.(?:opencode|qwen|claude|hermes)(\/|$)/.test(wf.path)
+    ) {
+      throw new Error(`NON_LOGICAL_WORKING_FILE_PATH:${wf.slug}:${wf.path}`);
+    }
+    return {
+      slug: wf.slug,
+      path: wf.path,
+      format: wf.format,
+      syncDirection: wf.syncDirection,
+      sourceKind: wf.sourceKind,
+      sourceRef: wf.sourceRef,
+    };
+  });
 }
 
 function buildRenderedMounts(
-  mounts: Readonly<Record<string, { enabled: boolean; mode?: 'read-only' | 'read-write' }>>,
+  mounts: Readonly<
+    Record<string, { enabled: boolean; mode?: 'read-only' | 'read-write' }>
+  >,
   manifestSlug: string,
   manifestVersion: string,
 ): ReadonlyArray<{ mount: string; mode: 'read-only' | 'read-write' }> {
   const out: { mount: string; mode: 'read-only' | 'read-write' }[] = [];
   for (const [slotKey, decl] of Object.entries(mounts)) {
     if (!decl.enabled) continue;
-    const slotDef = AWP_V1_SPEC.slots.find((s) => s.key === slotKey);
-    if (!slotDef) {
-      throw new UnknownSlotError(
-        slotKey,
-        'rendered.mounts',
-        manifestSlug,
-        manifestVersion,
-      );
-    }
+    const slotDef = requireLogicalSlot(
+      slotKey,
+      'rendered.mounts',
+      manifestSlug,
+      manifestVersion,
+    );
     const mode = decl.mode ?? slotDef.defaultMode;
-    out.push({ mount: slotDef.path, mode });
+    out.push({ mount: slotDef.slot, mode });
   }
   return out;
 }