Repository navigation
Serve Environment work over the Link - #529
Merged
Merged
Conversation
The owner contract now holds its result types, workspace errors and a typed initialization failure, so a second owner returns every outcome without importing localworkspace. The export bound and empty-write filter move to the Router, and Binding.Resolve replaces the CLI and test copies of the resolver.
Busy checks for runtime_prepare, workspace_write, workspace_export and execution_prepare now look only at the Session's own work, so another Session's Executor never blocks an Environment; the aggregate slots stay. Shutdown and quiescence drain the owners of unreleased assignments, and release cleanups of one assignment run one at a time, so a retry never closes an owner concurrently.
The Runtime's Environment owner declares which Environments it serves, and agent.Registry.Register composes that with the Harness's own declaration. Views no longer carry a second capability declaration, adapters no longer load the local binding to declare capabilities, and the CLI no longer derives read preparation and export at heartbeat.
The installation, snapshot, manifest, marker, tool-environment, setup argument and MCP credential rules become functions over file lists and values, so an owner that reaches the installation through File applies the same rules. The os.Root helpers stay as thin wrappers for the guest.
Each Session bound to the agent host gets one Environment owner with its own Link attachment. It applies runtime_prepare to the sandbox through File and Process, prepares each Executor's request with sandbox paths, serves workspace reads, Files create and outputs export, and quarantines itself after a mutation whose effect is unknown. Dispatch loses the SessionEnvironments mode, which no owner backed.
The owner no longer repeats dispatch's state-key check: dispatch resolves it from the Session's assignment and checks the key before any writable preparation.
A runtime_prepare whose owner could not attach, open the Process service or have a step admitted ended unknown, which kept the Router's transfer slot and fenced every later transfer. Such a failure has no effect, so the owner now returns dispatch.ErrEnvironmentUnavailable, which also replaces the workspace write's unavailable error, and the Router ends it rejected with resource_unavailable.
The agent host installed a plugin whose stdio MCP server declares env_vars, which admission then rejects for every execution of the Session. The owner now refuses it before staging, through the predicate that also sets a binding's environment_configuration authority.
Config.Harnesses was composed when its kinds were registered and again by the agent host's Registry. Because composition only narrows, a registry built on a host without a local workspace lost local Environments for good. Config.Harnesses now holds the declarations as adapters state them, and Registry composes them once with the Environments the agent host serves.
The agent host copied the guest's workspace path rule, export bounds and setup kill grace. localworkspace now exports each once, uses its one path rule in its three checks, and the agent host reads them from there. The processbroker comment no longer lists TMPDIR among the sandbox values.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
On an agent host, a Session's Environment work now goes through one Environment owner, which works in the sandbox over its own Link attachment.
What changes
Environment owner on the agent host. It uses File and Process services, under the bind's grant, and handles:
runtime_prepare: it installs Skills, plugins and capability snapshots, and runs setup steps as Process operations named by the transfer ID;Before an Executor starts, it fills
LocalEnvironment.Skills,MCPandCapabilityRootwith paths in the sandbox. If it cannot observe the outcome of a mutation, it quarantines itself until the home is removed.Dispatch. Environment admission is per Session, and owners drain on release. The owner's outcomes are part of the dispatch contract, and
SessionEnvironmentsis gone.One composition. Each Environment owner declares its environment composition once, and the registry composes it with the Harness's own declaration once.
ViewCapabilities, the discovery mutations and the CLI export derivation are gone. Capability installation rules move out of the local-directory helpers inagentcapabilities.Typed failures. A
workspace_writeorruntime_preparethat cannot reach the sandbox before any effect endsrejected/resource_unavailable, through one error,dispatch.ErrEnvironmentUnavailable.unknownis kept for outcomes that really are uncertain.Plugin MCP credentials. A plugin whose MCP server declares literal
http_headers, or a stdio server that takes Environment credentials, is refused before anything is staged. The check uses one predicate shared withmcp_binding.Docs.
docs/runtime-protocol.mdandcontracts/agents-api/harness-onboarding.md, with zh.Review
A blind review found two major issues, both fixed here with tests:
unknown, which blocked the Router;Also fixed: a second composition, a test-only production field, guest rules that were copied instead of shared, and a stale comment. The real-Harness Skill Turn is deferred to C4b phase 3. Two follow-ups are recorded for PR5 and PR6: one preparation transfer per connection, and the export walk that PR6 deletes.
Checks
agent/..., localworkspace, agentcapabilities, cli and processbroker;-race -count=50on the changed dispatch and agenthost tests.make check-names check-docs check-ci.scripts/qualify-agent-host.shwith MiniMax passes.Need help on this PR? Tag
@codesmith-botwith what you need. Autofix is disabled.