Runtime Go contract

Import the first public contract from github.com/0x63616c/agent-runtime/sdk/go; its package name is agentruntime. It belongs to the single root module and its transitive import graph contains no Temporal, PostgreSQL, provider, sandbox-backend, blob-client, or telemetry implementation.

What exists

The package defines strict opaque IDs; immutable Agent and Policy revisions; Policy revisions have a canonical digest and only bounded named-Tool dispositions, never credentials or executable authority. It also defines revision-pinned Session snapshots; bounded text and Artifact-reference Input; serialized Turn states; stable safe Failure codes; ordered bounded Product events; opaque Cursors and explicit Gaps; and a narrow RuntimeClient interface with a concrete strict HTTP Client.

An owner-visible Approval can contain a fixed action verb/target and maximum-use bound when the private broker has admitted an elevated operation. It never exposes raw model arguments, a capability digest, capability bytes, or a sandbox descriptor.

The internal deterministic kernel currently proves these transitions:

create immutable Agent revision
  -> create Session pinned to that exact revision
  -> admit canonical idempotent Input
  -> run one Turn and durably queue later Turns
  -> succeed, fail, or explicitly cancel exactly once
  -> advance the next queued Turn
  -> close admission, drain, and complete
  -> or terminally cancel a drained Session

Input and result collections are deep-copied. Concurrent admission is atomic per ownership scope. Public Product events contain typed references and bounded state vocabulary, never raw Input text or backend identifiers. Replay resumes after an opaque Cursor; a removed or unavailable position produces an explicit Gap that directs the caller to inspect current Session state.

Current boundary

The HTTP client requires explicit transport, credential, request-ID, and size bound dependencies. It performs no hidden retries and rejects unknown or trailing JSON, oversized responses, unsafe failure envelopes, and request-ID mismatches.

ArtifactStreamer is an additive capability separate from RuntimeClient. Client.OpenArtifact returns a closable, non-buffering immutable Artifact stream with metadata authorized before content storage opens. It verifies the exact byte count and Digest trailer only at EOF; closing an unfinished body cancels observation without changing durable work.

SessionCanceller is likewise additive. Client.CancelSession is an authenticated, idempotent command that moves an owner Session from open or closing to cancelled only after every accepted Turn is terminal. A runtime-owned failure is observable as the safe failed Session state and session.failed Product event; it is not exposed as a caller command.

SessionArtifactLister is another additive capability. Its ListSessionArtifacts method returns a bounded Session-owned Artifact metadata index without making content storage discoverable. Research Dossier uses this index to recover its retained research outputs after reconnect or API restart, then makes a separate authorized read for one selected dossier.

The standalone API role still uses explicitly labelled memory-unsafe storage. It does not prove restart durability. The separate durable StateRuntime integration harness proves cancelled and failed projections, exact mutation replay, and recomposition through disposable PostgreSQL and MinIO; it is not a production rollout, provider, sandbox, or PITR claim. Temporal workflow execution, model/tool/approval execution, and live push streaming remain independently tracked paths. Artifact lifecycle/retention and production rollout remain separately verified boundaries. No release claim is made on the strength of this slice alone.