Configuration

The Agent Runtime Pack reads its configuration from the agent_runtime namespace in workspace.yaml.

Enable The Pack

Add an agent-runtime pin to the workspace pack list:

packs:
  - id: agent-runtime
    version: 0.1.0
    integrity: dev
    source: local

This example shows the monorepo or local-pack development path. The same pack manifest contract works with other pack sources once you publish and pin a verifiable integrity hash.

integrity: dev requires an explicit non-production opt-in: LUMENFLOW_ALLOW_DEV_PACKS=1 (or allowDevIntegrity: true when constructing PackLoader). Repository-local wrappers may add that value only to the child process they launch; published binaries and normal production loading remain fail-closed. For a non-loopback registry, provide a sha256: hash obtained independently from the registry serving the pack.

Workspace Config

agent_runtime:
  default_model: operations
  models:
    operations:
      provider: messages_compatible
      model: ops-assistant
      api_key_env: AGENT_RUNTIME_API_KEY
      base_url: https://models.internal.example/
    planning:
      provider: openai_compatible
      model: planner
      api_key_env: PLANNER_API_KEY
      base_url_env: PLANNER_BASE_URL
    responses:
      provider: openai_responses
      model: reasoning-agent
      api_key_env: OPENAI_API_KEY
      base_url: https://api.openai.com/v1/responses
  policy_profiles:
    scheduling-agent:
      description: Scheduling tools for a persisted agent task
      allow_tools:
        - calendar:create-event
        - calendar:reschedule-event
      approval_required_tools:
        - calendar:delete-event
  connected_compute:
    policy_profile: scheduling-agent
  limits:
    max_turns_per_session: 12
    max_tool_calls_per_session: 6
    max_input_bytes: 65536

Model Profiles

Each profile declares:

| Field | Meaning | | --------------------------- | ------------------------------------------------------------------------------------------- | | provider | Adapter family used for request/response normalization | | model | Provider-specific model identifier carried into the normalized response | | api_key_env | Environment variable that holds the credential for the selected profile | | base_url / base_url_env | Absolute provider base URL used both for outbound requests and network allowlist derivation |

default_model selects the profile a host should use when it does not supply a different model_profile.

The provider value selects the wire protocol:

| Provider | Protocol contract | | --------------------- | ------------------------------------------------------------------ | | openai_compatible | Chat Completions-style messages, choices, and [DONE] streams | | openai_responses | Responses input/output items and typed semantic SSE events | | messages_compatible | Messages-style content blocks and semantic stream events |

Caution

Provider selection is explicit. A /v1/responses URL does not make an openai_compatible profile use the Responses protocol, and a Chat Completions URL does not rewrite an openai_responses profile.

The Responses adapter owns stateless continuation history: it sends store: false, requests function tools with strict: false, and replays the complete ordered output history on the next turn. OpenAI returns encrypted reasoning for this stateless mode; the adapter preserves it as opaque provider state. strict: false is deliberate because governed tool schemas may use JSON Schema features that do not satisfy OpenAI’s narrower strict structured-output requirements.

Input URL Matching

agent-runtime:execute-turn still receives a url field on each call. That url must match the resolved base URL for the selected model profile. This keeps the requested endpoint aligned with the profile-derived network allowlist and avoids drift between host input and pack config.

Persisted Policy Profiles

The policy_profiles map drives runtime-authored policy rules through the pack policy_factory:

• allow_tools defines the only tools a task using that profile may use.
• approval_required_tools is a stricter subset that pauses execution with APPROVAL_REQUIRED.

The trusted task spec selects one profile with execution_policy_profile. The kernel projects that value from the immutable task; request and model payloads cannot replace it. When profiles are configured, a task with a missing or unknown selection fails closed before discovery or execution.

Note

Policy profiles do not run inside the model prompt. They run in the kernel policy layer against the capability selected through the authenticated execution facade.

agent_runtime.connected_compute.policy_profile selects the configured profile that a trusted Connected Compute task persists for code assignments. The runner does not accept a profile from the assignment payload.

Caution

WU-3361 composes and tests the host-bound authority; WU-3408 supplies the fenced execution bridge (ownership-generation fencing, lease renewal, cancellation); WU-3409 supplies durable receipt/terminal reconciliation (the atomic RunAggregate receipt/outbox/terminal-event batch, its fenced drain, and outage/takeover recovery) plus the sealed host lifecycle adapter that runs wu:prep gate authority separately from the model’s own governed tool authority. A code assignment only completes remotely after that sealed gate passes — never through a model-requested tool call or assignment-envelope content. See connected-compute-local-runner.md for the full contract.

Limits

limits bounds host-driven loops and pack-owned orchestration:

• max_turns_per_session
• max_tool_calls_per_session
• max_input_bytes

Hosts can pass per-call limits only to tighten these ceilings. Missing, non-finite, non-positive, or widening values are rejected or clamped to the configured host bound.

Credentials And Network Allowlisting

The pack uses two separate safeguards:

1. Manifest-declared and capability-derived required_env Only declared environment variable names are passed into the sandboxed tool process.
2. Capability-derived network allowlists Provider hosts are derived from the configured model profiles and intersected with workspace and lane policy before the turn runs.

This means a valid profile must declare both:

• how the pack authenticates
• which provider hosts the sandbox may contact

Connected Compute additionally requires the agent-runtime pack pin plus explicit workspace and lane grants for .agent-runtime/** read/write and the canonical provider host:port allowlist entry derived from the configured host default model. A payload URL, model profile, scope, or tool catalog cannot broaden those grants.

Next Steps

• Workflows & Examples
• Kernel Packs
• Tool Execution