The historical release remains ten tools
The original release should not be rewritten simply because the protocol later grew. It proved the first execution boundary and closed M0–M7. Four later tools entered only after repeated work showed universal gaps:
workspace.getandworkspace.listrestore Workspace identity after a client or conversation loses local memory;workspace.execPlanruns ordered native steps and exposes structured progress without parsing shell text;workspace.patchbriefly supplied positional multi-file editing, then left the public surface after production use showed thatworkspace.mutateand ordinary scripts already covered the need.
The current surface contains thirteen tools. The historical ten-tool release and the later fourteen-tool phase remain accurate for their dates.
The decisive abstraction is commitment
An Agent may choose a different action after interruption. A command runner cannot distinguish a proposal from a committed effect, or process exit from proof that an external action occurred exactly once. The Runtime now states a narrower kernel:
Bind one Agent candidate to a stable, world-conditioned operation; dispatch one physical Attempt at most once; retain identity-bound evidence; and preserve uncertainty without inventing or repeating effects.
Operation identity binds the principal, client request identity, Workspace source digest, executable, arguments, explicit environment, working directory, limits, and budgets. Request identity remains separate from the observed world. A response-loss replay returns the original Job even when the Workspace has since changed or closed.
Source commitment is strong but scoped
Initial admission hashes the semantic Git index, actual tracked bytes and modes, recursively initialized submodules, and nonignored untracked source. The Runner validates that source again immediately before spawn, and Runtime-mediated mutation is rejected while active work owns the Workspace.
This detects stale source and fails closed. It does not create an immutable host snapshot. Direct writes by an equally privileged process, ignored caches, wall-clock time, network responses, and external service state remain outside the guarantee.
Opaque execution does not become idempotent by declaration
workspace.exec can run any trusted-local executable. The Runtime cannot prove the number or identity of effects inside it. A structured non-opaque adapter must jointly own canonical identity, enforceable preconditions, committed authority, provider evidence, deterministic reconciliation, and ambiguity behavior.
Until one real operation satisfies that full contract, ambiguous arbitrary execution is not automatically redispatched.
Agent-facing UX improved without absorbing every workflow
Observation now exposes elapsed time, retained byte counts, last output time, progress revision, current step, completed steps, and the first failed step. A caller can wait for change or terminal state instead of polling empty “working” responses.
Typed operation errors identify origin, retry class, commitment state, trace identity, and—when known—operation identity. Git publication, GitHub pull requests, and compiler-report normalization remain replaceable Skills outside the trusted kernel.
Execution stopped inheriting ambient service state
Target processes now receive a configured PATH and HOME plus fixed locale, temporary directory, and external cache roots. Request-specific environment values overlay those committed defaults. Root authority remains available, but Runtime service secrets and unrelated variables no longer enter an operation through ambient inheritance.
Workspace and cache lifecycles were separated
Build, cache, and temporary outputs moved outside Git Workspaces. workspace.close removes disposable external state before worktree removal and tombstone commitment. A cleanup failure therefore leaves the Workspace open and retryable rather than returning an error after closure already committed.
A thin lifecycle controller adds three policy classes over existing truth owners: ephemeral Workspaces default to 24 hours, review Workspaces to seven days, and pinned Workspaces are never automatic. The later of creation and durable Job activity forms the retention basis. Active, dirty, pinned, unknown, and orphan-directory cases remain excluded.
Repair and status preserve evidence
Repository renames left healthy worktrees pointing at old source paths. Repair uses exact aliases, verifies the recorded commit in the mapped repository, repairs Git metadata, rechecks HEAD, and updates only source identity. Unrepairable bytes can be quarantined only through a second explicit confirmation.
The one-time installation hygiene pass digest-checked obsolete binaries and legacy state before moving them into receipt quarantine, then retired from the active subsystem. A secret-free status command now compares deployment receipts, installed binary digests, systemd state, allowlisted configuration, Registry facts, Workspace state, and lifecycle receipts without loading the bearer token.
Deployment became a receipted transaction
An exact clean commit produces a digest-bound candidate manifest. Planning checks source identity, candidate and installed binaries, Registry capacity, environment files, and the expected tool catalog. Apply stages, stops admission, rechecks active work, installs, starts, initializes MCP, probes, and records digests. Rollback validates and restores the exact receipt-bound previous set.
A production audit found one real gap: auxiliary operational scripts were deployed separately from Rust binaries, allowing an older reclaim script to survive. The script was synchronized and receipted. The current deployment also binds the status operator asset and the retirement of one-time hygiene to the same release receipt while preserving separate digests.
The production cleanup was measurable
Four unknown Workspaces caused by repository renames were repaired. A one-time backlog drain then closed 42 clean, inactive Workspaces through the existing close contract. No active or dirty work was forced. The Runtime store fell from roughly 7.2 GB to 3.4 GB, while caches belonging to active work were preserved.
The important result is not deletion volume. It is that source state, execution state, disposable computation, review retention, active leases, and unknown cases are now distinct enough for the Runtime to maintain itself conservatively.
What remains outside Runtime
Runtime does not own Goal or Task continuity, model choice, prompts, memory, semantic correctness, product workflows, cluster scheduling, untrusted-code isolation, or exactly-once external effects. Those exclusions keep Host, providers, operating systems, and domain systems as independent state owners.
The next persistent addition must either enforce one complete real effect contract or remove repeated friction that cannot be handled better by Linux, systemd, Git, SQLite, a provider, Host, or a replaceable Skill.