verifiers 0.4.1.dev41__tar.gz → 0.4.1.dev42__tar.gz

{verifiers-0.4.1.dev41 → verifiers-0.4.1.dev42}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: verifiers
-Version: 0.4.1.dev41
+Version: 0.4.1.dev42
 Summary: Verifiers: Environments for LLM Reinforcement Learning
 Project-URL: Homepage, https://github.com/primeintellect-ai/verifiers
 Project-URL: Documentation, https://github.com/primeintellect-ai/verifiers
@@ -36,7 +36,7 @@ Requires-Dist: numpy>=2.1.0
 Requires-Dist: openai<3.0.0,>=2.54.0
 Requires-Dist: prime-pydantic-config[toml]>=0.4.3
 Requires-Dist: prime-runs>=0.1.4
-Requires-Dist: prime-sandboxes>=0.4.2
+Requires-Dist: prime-sandboxes>=0.4.7
 Requires-Dist: prime-tunnel>=0.1.14
 Requires-Dist: pydantic>=2.12.3
 Requires-Dist: pyzmq>=27.1.0

{verifiers-0.4.1.dev41 → verifiers-0.4.1.dev42}/pyproject.toml

@@ -33,7 +33,7 @@ dependencies = [
     "math-verify>=0.8.0",
     "openai>=2.54.0,<3.0.0",
     "prime-tunnel>=0.1.14",
-    "prime-sandboxes>=0.4.2",
+    "prime-sandboxes>=0.4.7",
     "prime-runs>=0.1.4",
     "pydantic>=2.12.3",
     "rich>=11.0.0",

{verifiers-0.4.1.dev41 → verifiers-0.4.1.dev42}/tests/integration/conftest.py

@@ -46,11 +46,14 @@ def harness_runtime(request) -> dict:
 @pytest.fixture
 def tool_runtime(request) -> dict:
     """A `taskset.task.tools` override placing the tool server: `colocated` (inside the harness's
-    runtime), `service` (in the task's `tools` Compose service) or its own runtime, by type."""
+    runtime), `service` (in the task's `tools` Compose service), `service-vm` (in the task's
+    `tools-vm` service VM) or its own runtime, by type."""
     if request.param == "colocated":
         return {"colocated": True}
     if request.param == "service":
         return {"service": "tools"}
+    if request.param == "service-vm":
+        return {"service": "tools-vm"}
     return {"runtime": {"type": request.param}}
 
 

verifiers-0.4.1.dev42/tests/integration/fixtures/fetch_tool_v1.py

@@ -0,0 +1,36 @@
+"""fetch (v1, MCP tool): a tool server on a Prime VM of its own, under its own egress.
+
+The integration test places a `FetchToolset` on a Prime runtime of its own
+(`tools.runtime`) beside an offline workspace. The server's VM joins the workspace over
+the rollout's private network and keeps the egress policy of its own runtime.
+"""
+
+import urllib.request
+
+import verifiers.v1 as vf
+
+
+class FetchToolset(vf.Toolset[vf.ToolsetConfig]):
+    TOOL_PREFIX = "fetch"
+
+    @vf.tool
+    def fetch(self, url: str) -> str:
+        """Fetch a URL; return its HTTP status, or the type of the error."""
+        try:
+            return str(urllib.request.urlopen(url, timeout=15).status)
+        except (OSError, ValueError) as error:  # URLError and timeouts are OSErrors
+            return type(error).__name__
+
+
+class FetchToolTaskConfig(vf.TaskConfig):
+    tools: vf.ToolsetConfig = vf.ToolsetConfig()
+
+
+class FetchToolTask(vf.Task[vf.TaskData, vf.State, FetchToolTaskConfig]):
+    @classmethod
+    def toolsets(cls, config: FetchToolTaskConfig) -> list[vf.Toolset]:
+        return [FetchToolset(config.tools)]
+
+
+if __name__ == "__main__":
+    FetchToolset.run()

{verifiers-0.4.1.dev41 → verifiers-0.4.1.dev42}/tests/integration/fixtures/pyproject.toml

@@ -18,6 +18,7 @@ include = [
     "counter_tool_v1.py",
     "echo_acp_resume_v1.py",
     "echo_tool_v1.py",
+    "fetch_tool_v1.py",
     "tool_response_image_v1.py",
     "pyproject.toml",
 ]

{verifiers-0.4.1.dev41 → verifiers-0.4.1.dev42}/tests/integration/grid.py

@@ -240,9 +240,13 @@ def skip_harness(cells: list, harness: str, reason: str) -> list:
 def placements(
     harness_runtimes: tuple[str, ...] = tuple(RUNTIMES),
     tool_runtimes: tuple[str, ...] = ("colocated", *RUNTIMES),
+    *,
+    shared: bool = False,
 ) -> list:
     """`(harness_runtime, tool_runtime)` cells for a tool server placed colocated in the
-    harness's box, in a Compose service beside it (`service`), or in its own runtime."""
+    harness's box, in a Compose service beside it (`service`), or in its own runtime
+    (on Prime beside a Prime harness, a VM on the rollout's private network). A `shared`
+    server runs once per eval, so it joins no rollout's network."""
     cells = []
     for harness_runtime in harness_runtimes:
         for tool_runtime in tool_runtimes:
@@ -264,6 +268,8 @@ def placements(
             elif (
                 tool_runtime not in ("colocated", "service")
                 and not runtime_cls(tool_runtime).supports_expose
+                # Beside a Prime harness, a rollout's Prime server joins its private network.
+                and not (not shared and tool_runtime == harness_runtime == "prime")
             ):
                 marks.append(
                     pytest.mark.skip(

{verifiers-0.4.1.dev41 → verifiers-0.4.1.dev42}/tests/integration/test_shared_tool.py

@@ -8,7 +8,7 @@ from grid import HARNESS_RUNTIMES, placements
 
 @pytest.mark.parametrize(
     "harness_runtime,tool_runtime",
-    placements(tool_runtimes=tuple(HARNESS_RUNTIMES)),
+    placements(tool_runtimes=tuple(HARNESS_RUNTIMES), shared=True),
     indirect=True,
 )
 async def test_shared_tool(run, harness_runtime, tool_runtime):

verifiers-0.4.1.dev42/tests/integration/test_tool_vms.py

@@ -0,0 +1,88 @@
+"""A tool server on a Prime runtime of its own runs on a VM of its own, reachable from
+the restricted workspace over the rollout's private network, under the egress policy of
+its own runtime: unrestricted, or none at all."""
+
+import json
+import os
+
+import pytest
+from fetch_tool_v1 import FetchToolTask, FetchToolTaskConfig
+
+import verifiers.v1 as vf
+from verifiers.v1.configs.agent import TimeoutConfig
+
+pytestmark = pytest.mark.skipif(
+    not os.environ.get("PRIME_API_KEY"), reason="needs PRIME_API_KEY"
+)
+
+FETCH = """
+import sys, urllib.error, urllib.request
+try:
+    print(urllib.request.urlopen(sys.argv[1], timeout=15).status)
+except urllib.error.HTTPError as error:
+    print(error.code)
+except Exception as error:
+    print(type(error).__name__)
+"""
+
+# The workspace reaches the tool server (any HTTP status) but not the internet.
+PROBE = """
+import json, sys, urllib.error, urllib.request
+
+def fetch(url):
+    try:
+        return urllib.request.urlopen(url, timeout=15).status
+    except urllib.error.HTTPError as error:
+        return error.code
+    except Exception as error:
+        return type(error).__name__
+
+json.dump(
+    {"tool": fetch(sys.argv[1]), "public": fetch("https://example.com")},
+    open("/tmp/probe.json", "w"),
+)
+"""
+
+
+class ProbeHarness(vf.Harness):
+    SUPPORTS_MCP = True
+
+    async def launch(self, ctx, trace, runtime, endpoint, secret, mcp_urls, data):
+        trace.info["url"] = mcp_urls["fetch"]
+        return await runtime.run_program(["python", "-c", PROBE, mcp_urls["fetch"]], {})
+
+
+class ProbeTask(FetchToolTask):
+    async def finalize(self, trace, runtime, deployment):
+        trace.info["workspace"] = json.loads(await runtime.read("/tmp/probe.json"))
+        tool = await deployment.target("fetch").run(
+            ["python", "-c", FETCH, "https://example.com"], {}
+        )
+        trace.info["tool"] = tool.stdout.strip()
+
+
+@pytest.mark.parametrize(("allow", "egress"), [(["*"], "200"), ([], "URLError")])
+async def test_a_tool_vm_keeps_its_own_egress_beside_a_restricted_workspace(
+    allow, egress
+):
+    tools = vf.ToolsetConfig(
+        runtime=vf.PrimeConfig(labels=["vf-integration"], allow=allow)
+    )
+    task = ProbeTask(
+        vf.TaskData(prompt="Probe the network", network_allow=[]),
+        FetchToolTaskConfig(tools=tools),
+    )
+    config = vf.AgentConfig(
+        model="unused",
+        runtime=vf.PrimeConfig(labels=["vf-integration"]),
+        timeout=TimeoutConfig(setup=900, finalize=120, scoring=60),
+    )
+    async with vf.Agent(config) as agent:
+        agent.harness = ProbeHarness(vf.HarnessConfig())
+        trace = await agent.run(task)
+    assert trace.ok, trace.errors
+    assert ".sandbox.internal:" in trace.info["url"]
+    workspace = trace.info["workspace"]
+    assert isinstance(workspace["tool"], int), workspace
+    assert workspace["public"] == "URLError"
+    assert trace.info["tool"] == egress

verifiers-0.4.1.dev42/tests/unit/runtimes/test_private_network.py

@@ -0,0 +1,254 @@
+import asyncio
+from contextlib import asynccontextmanager
+from types import SimpleNamespace
+
+import pytest
+
+import verifiers.v1 as vf
+from verifiers.v1.errors import ToolsetError
+from verifiers.v1.mcp import launch
+from verifiers.v1.runtimes import (
+    DockerConfig,
+    PrimeBackend,
+    PrimeConfig,
+    prime,
+    private_network,
+)
+from verifiers.v1.runtimes.strategies import (
+    _ColocatedDeployment,
+    _ContainerDeployment,
+    _deployment_strategy,
+    _PrivateNetworkDeployment,
+)
+
+ATLAS = PrimeConfig(image="atlas:1", cpu=4, memory=10)  # open egress by default
+FORTH = PrimeConfig(image="forth:1", allow=[])
+
+
+def toolset(name, **config):
+    return SimpleNamespace(server_name=name, config=vf.ToolsetConfig(**config))
+
+
+def test_tool_servers_on_prime_runtimes_beside_a_prime_workspace_get_vms():
+    toolsets = [
+        toolset("atlas", runtime=ATLAS),
+        toolset("search"),  # the evaluator
+        toolset("files", colocated=True, runtime=ATLAS),  # the workspace
+        toolset("remote", url="https://tools.example/mcp"),
+        toolset("gym", service="tools"),  # a Compose service
+        toolset("local", runtime=DockerConfig()),  # a published port
+    ]
+    vms = private_network.tool_vms
+    assert vms(toolsets, PrimeConfig(), composed=False, borrowed=False) == {
+        "atlas": ATLAS
+    }
+    # Without a Prime workspace of the rollout's own, servers keep their published port.
+    for workspace, composed, borrowed in [
+        (DockerConfig(), False, False),
+        (PrimeConfig(), True, False),
+        (PrimeConfig(), False, True),
+    ]:
+        assert vms(toolsets, workspace, composed=composed, borrowed=borrowed) == {}
+    with pytest.raises(ValueError, match="cannot be named 'main'"):
+        vms(
+            [toolset("main", runtime=ATLAS)],
+            PrimeConfig(),
+            composed=False,
+            borrowed=False,
+        )
+
+
+def test_the_deployment_joins_tool_vms_over_a_private_network():
+    assert isinstance(
+        _deployment_strategy(None, PrimeConfig(), None, {"atlas": ATLAS}),
+        _PrivateNetworkDeployment,
+    )
+    assert isinstance(
+        _deployment_strategy(None, PrimeConfig(), None, {}), _ColocatedDeployment
+    )
+    spec = vf.ComposeSpec("task")
+    assert isinstance(
+        _deployment_strategy(None, PrimeConfig(), spec), _ContainerDeployment
+    )
+
+
+def test_the_private_network_needs_a_prime_workspace():
+    workspace = SimpleNamespace(config=DockerConfig())
+
+    async def enter():
+        async with private_network.private_network(workspace, {"atlas": ATLAS}, None):
+            pass
+
+    with pytest.raises(TypeError, match="needs the workspace on Prime, not docker"):
+        asyncio.run(enter())
+
+
+class FakeLanClient:
+    def __init__(self, events):
+        self.events = events
+
+    async def create_lan_network(self, name, rules):
+        self.events.append(("network", [(rule.from_, rule.to) for rule in rules]))
+        return SimpleNamespace(id="net1")
+
+    async def delete_lan_network(self, network_id):
+        self.events.append("network deleted")
+
+
+def boot(monkeypatch, members):
+    """Enter `private_network` with a fake LAN client and Prime VMs that record their
+    boot and stop there."""
+    events = []
+
+    @asynccontextmanager
+    async def leased_client():
+        yield FakeLanClient(events)
+
+    async def start(self):
+        events.append(("boot", self.name, self.config, self.lan))
+        raise RuntimeError("booted")
+
+    monkeypatch.setattr(private_network, "leased_client", leased_client)
+    monkeypatch.setattr(prime, "ensure_prime_auth", lambda: None)
+    monkeypatch.setattr(PrimeBackend, "start", start)
+    workspace = PrimeBackend(PrimeConfig(allow=[]), name="ws")
+
+    async def enter():
+        async with private_network.private_network(workspace, members, workspace.start):
+            pass
+
+    with pytest.raises(RuntimeError, match="booted"):
+        asyncio.run(enter())
+    return events
+
+
+def test_each_vm_boots_its_server_runtime_as_given(monkeypatch):
+    events = boot(monkeypatch, {"atlas": ATLAS, "forth": FORTH})
+    vms = {e[1]: e[2] for e in events if isinstance(e, tuple) and e[0] == "boot"}
+
+    def shape(config):
+        return config.image, config.cpu, config.memory, config.allow
+
+    assert shape(vms["ws-vf-tool-0"]) == ("atlas:1", 4, 10, ["*"])
+    assert shape(vms["ws-vf-tool-1"]) == ("forth:1", FORTH.cpu, FORTH.memory, [])
+    assert vms["ws"].allow == []  # the workspace keeps its own policy
+
+
+def test_the_network_starts_with_its_rules_and_every_vm_joins_as_it_boots(monkeypatch):
+    events = boot(monkeypatch, {"atlas": ATLAS, "forth": FORTH})
+    assert events[0] == (
+        "network",
+        [("tag:vf-workspace", "tag:vf-tool-0"), ("tag:vf-workspace", "tag:vf-tool-1")],
+    )
+    boots = {name: lan for kind, name, _, lan in events[1:-1] if kind == "boot"}
+    assert boots == {
+        "ws": ("net1", ["vf-workspace"]),
+        "ws-vf-tool-0": ("net1", ["vf-tool-0"]),
+        "ws-vf-tool-1": ("net1", ["vf-tool-1"]),
+    }
+    assert events[-1] == "network deleted"
+
+
+def test_a_tool_vm_keeps_only_its_state_channel_and_the_harness_its_routes():
+    applied = []
+
+    def backend(name):
+        async def prepare_execution(routes):
+            applied.append((name, routes))
+
+        def host_url(url):
+            return url.replace("http://127.0.0.1:9000", "https://tunnel.example")
+
+        return SimpleNamespace(prepare_execution=prepare_execution, host_url=host_url)
+
+    strategy = _PrivateNetworkDeployment()
+    strategy._service_backends = [backend("forth")]
+    deployment = SimpleNamespace(harness_backend=backend("main"))
+    # The harness reaches the model and a remote tool server; the tool VM needs neither.
+    routes = ["https://tunnel.example/v1", "https://tools.example/mcp"]
+    asyncio.run(
+        strategy.prepare_execution(
+            deployment, routes, state_route="http://127.0.0.1:9000/state"
+        )
+    )
+    assert sorted(applied) == [
+        ("forth", ["https://tunnel.example/state"]),
+        ("main", routes),
+    ]
+
+
+def test_the_workspace_stops_before_tool_evidence_and_is_released_regardless():
+    events = []
+
+    async def stop():
+        events.append("workspace stopped")
+
+    async def aclose():
+        events.append("tool VMs released")
+        raise RuntimeError("network deletion failed")
+
+    strategy = _PrivateNetworkDeployment()
+    strategy._services = SimpleNamespace(aclose=aclose)
+    deployment = SimpleNamespace(execution_backend=SimpleNamespace(stop=stop))
+
+    # As Compose stops its workspace, before finalize_services reads the targets.
+    asyncio.run(strategy.stop_execution(deployment))
+    assert events == ["workspace stopped"]
+
+    # A failed tool VM or network release neither skips the workspace's nor raises.
+    events.clear()
+    asyncio.run(strategy.prepare_verifier(deployment))
+    assert events == ["workspace stopped", "tool VMs released"]
+
+
+def served_url(monkeypatch, server, **kwargs):
+    async def serve_in_runtime(server, runtime, **options):
+        assert options["listen_all"]
+        return 1234
+
+    monkeypatch.setattr(launch, "serve_in_runtime", serve_in_runtime)
+
+    async def url():
+        async with launch._serve(server, **kwargs) as served:
+            return served.url
+
+    return asyncio.run(url())
+
+
+def test_a_tool_server_on_its_own_vm_is_reached_by_its_lan_name(monkeypatch):
+    runtime = SimpleNamespace(is_local=False, host_url=lambda url: url)
+    # Its restricted runtime is enforced on its own VM, so it is not refused.
+    server = toolset("forth", runtime=FORTH)
+    assert (
+        served_url(
+            monkeypatch,
+            server,
+            hosts={"forth": "sb1.sandbox.internal"},
+            placements={"forth": runtime},
+        )
+        == "http://sb1.sandbox.internal:1234/mcp"
+    )
+    # A Compose service keeps its name.
+    compose = toolset("echo", service="tools")
+    assert served_url(monkeypatch, compose, services={"tools": runtime}) == (
+        "http://tools:1234/mcp"
+    )
+
+
+@pytest.mark.parametrize("service", ["main", "forth"])
+def test_an_explicit_service_names_only_a_compose_service(monkeypatch, service):
+    # The workspace and another server's VM are deployment targets, not services.
+    runtime = SimpleNamespace(is_local=False, host_url=lambda url: url)
+    with pytest.raises(ToolsetError, match="Compose services define it"):
+        served_url(
+            monkeypatch,
+            toolset("echo", service=service),
+            services={},
+            hosts={"forth": "sb1.sandbox.internal"},
+            placements={"forth": runtime},
+        )
+
+
+def test_a_restricted_runtime_without_a_private_network_is_refused(monkeypatch):
+    with pytest.raises(ToolsetError, match="joins the rollout's private network"):
+        served_url(monkeypatch, toolset("forth", runtime=FORTH))

{verifiers-0.4.1.dev41 → verifiers-0.4.1.dev42}/verifiers/v1/mcp/launch.py

@@ -434,17 +434,27 @@ async def _serve(
     state_secret: str = "",
     state_base: str | None = None,
     services: Mapping[str, Runtime] | None = None,
+    hosts: Mapping[str, str] | None = None,
+    placements: Mapping[str, Runtime] | None = None,
 ):
     cfg = server.config
     colocated = getattr(cfg, "colocated", False)
-    if (service := getattr(cfg, "service", None)) is not None:
-        # The harness reaches the server over the deployment's Compose network.
-        if services is None or service not in services:
+    service = getattr(cfg, "service", None)
+    own_vm = (placements or {}).get(server.server_name)
+    if service is not None or own_vm is not None:
+        # The harness reaches the server over the deployment's network: a Compose
+        # service by its name, a VM of its own by its LAN name.
+        if own_vm is not None:
+            runtime = own_vm
+            host = (hosts or {})[server.server_name]
+        elif services is None or service not in services:
             raise ToolsetError(
-                f"server {server.server_name!r} runs in Compose service {service!r}, "
+                f"server {server.server_name!r} runs in service {service!r}, "
                 "which needs a task whose Compose services define it"
             )
-        runtime = services[service]
+        else:
+            runtime = services[service]
+            host = (hosts or {}).get(service, service)
         if runtime.is_local:
             # A local service cannot reach the host-loopback state channel.
             raise ToolsetError(
@@ -463,7 +473,7 @@ async def _serve(
             ),
             state_secret=state_secret,
         )
-        yield _ServedServer(f"http://{service}:{port}/mcp", runtime)
+        yield _ServedServer(f"http://{host}:{port}/mcp", runtime)
         return
     async with contextlib.AsyncExitStack() as stack:
         # Colocated servers inherit the harness cut. A separately provisioned filtered
@@ -475,9 +485,10 @@ async def _serve(
             and not (colocated and harness_runtime is not None)
         ):
             raise ToolsetError(
-                "Runtime network policies are supported on the harness runtime; "
-                f"server {server.server_name!r} must be colocated or use an "
-                "unrestricted runtime"
+                f"server {server.server_name!r} restricts its runtime's network, which "
+                "needs the server colocated with the harness, or on a Prime runtime "
+                "of its own beside a Prime workspace without Compose services (it then "
+                "joins the rollout's private network)"
             )
         if colocated and harness_runtime is not None:
             runtime = harness_runtime
@@ -532,6 +543,8 @@ async def serve(
     state_secret: str = "",
     state_base: str | None = None,
     services: Mapping[str, Runtime] | None = None,
+    hosts: Mapping[str, str] | None = None,
+    placements: Mapping[str, Runtime] | None = None,
 ):
     """Serve one MCP server and yield the URL visible to its consumer."""
     async with _serve(
@@ -541,6 +554,8 @@ async def serve(
         state_secret=state_secret,
         state_base=state_base,
         services=services,
+        hosts=hosts,
+        placements=placements,
     ) as served:
         yield served.url
 
@@ -649,6 +664,8 @@ async def serve_tools(
     state_route: str = "",
     state_base: str | None = None,
     services: Mapping[str, Runtime] | None = None,
+    hosts: Mapping[str, str] | None = None,
+    placements: Mapping[str, Runtime] | None = None,
 ):
     """Bring up a rollout's tool servers and yield `{name: url}` the harness reaches: the
     task-scoped `toolsets` are launched by `serve` (placement off each one's `config`; the
@@ -690,6 +707,8 @@ async def serve_tools(
                         state_secret=state_secret,
                         state_base=state_base,
                         services=services,
+                        hosts=hosts,
+                        placements=placements,
                     )
                 )
                 logger.info("tool server '%s': %s", name, urls[name])

{verifiers-0.4.1.dev41 → verifiers-0.4.1.dev42}/verifiers/v1/mcp/toolset.py

@@ -17,6 +17,9 @@ if TYPE_CHECKING:
 class ToolsetConfig(BaseConfig):
     colocated: bool = False
     runtime: RuntimeConfig = SubprocessConfig()
+    """Where the server runs: the evaluator by default. A Prime runtime beside a Prime
+    workspace without Compose services is a VM of the server's own that joins the
+    workspace over the rollout's private network, under its own egress policy."""
     url: str | None = None
     service: str | None = None
     """Run the server in this service of the task's Compose services (on a Prime or

{verifiers-0.4.1.dev41 → verifiers-0.4.1.dev42}/verifiers/v1/rollout.py

@@ -36,6 +36,7 @@ from verifiers.v1.runtimes import (
     RuntimeConfig,
     make_backend,
 )
+from verifiers.v1.runtimes.private_network import tool_vms
 from verifiers.v1.session import RolloutLimits, RolloutSession, hook_boundary
 from verifiers.v1.state import state_cls
 from verifiers.v1.task import Task
@@ -290,8 +291,18 @@ class Rollout:
                         "task.prompt, or drive the run through agent.interaction() and open "
                         "it with the first turn(message)"
                     )
+                async with boundary(ToolsetError, "building tool servers"):
+                    toolsets = self.task.toolsets(self.task.config)
+                spec = self.task.deployment_spec()
                 self.deployment = runtime.backend.deploy(
-                    spec=self.task.deployment_spec(),
+                    spec=spec,
+                    # Tool servers on Prime VMs of their own boot with the workspace.
+                    tool_vms=tool_vms(
+                        toolsets,
+                        runtime.backend.config,
+                        composed=spec is not None,
+                        borrowed=self._borrowed_runtime is not None,
+                    ),
                     env=runtime.env,
                     config=self._deployment_config,
                     borrowed_runtime=self._borrowed_runtime,
@@ -344,8 +355,6 @@ class Rollout:
                         runtime, self.task.data.agent_user
                     )
                     await self.harness.setup(self._agent_runtime)
-                async with boundary(ToolsetError, "building tool servers"):
-                    toolsets = self.task.toolsets(self.task.config)
                 # `base_url` is the interception server's reachable URL for this rollout.
                 # The harness reaches the model at `{base_url}/v1`; tool servers reach this
                 # rollout's `/state` + `/task` at `base_url` — it's universally reachable
@@ -382,17 +391,27 @@ class Rollout:
                         state_route=self.trace.id,
                         state_base=base_url,
                         services=services,
+                        hosts=self.deployment.hosts,
+                        # Tool servers on VMs of their own, by server name; an explicit
+                        # `service` names only a Compose service.
+                        placements={
+                            name: self.deployment.target(name)
+                            for name in self.deployment.tool_vms
+                        },
                     )
                 )
                 # Setup and service provisioning are complete. Apply the runtime's
                 # execution policy while preserving the framework routes the agent uses.
-                # Compose service names resolve inside the deployment, not as egress.
+                # Service hosts resolve inside the deployment (Compose names, LAN
+                # names), not as egress.
+                internal = {*services, *self.deployment.hosts.values()}
                 await self.deployment.prepare_execution(
                     [
                         url
                         for url in [self._endpoint, *self._urls.values()]
-                        if urlsplit(url).hostname not in services
-                    ]
+                        if urlsplit(url).hostname not in internal
+                    ],
+                    state_route=f"{base_url.rstrip('/')}/state",
                 )
                 async with (
                     boundary(HarnessError, "opening harness session"),