AgentHost receives purpose-bound provider and repository capability data through one-time configuration, not ambient user-token stores, mounted token files, or Key Vault. Credential lifetimes differ: Copilot capability expiry is checked, BYOK has no equivalent expiry field, and turn/preview credentials are bound to the run lifecycle.
The A2A turn endpoint uses a separate per-run bearer token. Production KubernetesSandboxExecutor mints and sends it during POST /configure; RemoteAgentProxy sends it with each turn. AgentHost enforces equality when a nonempty token is configured. See the claim/configure sequence.
RunGitHubCapabilitySnapshotLifecycle captures immutable, purpose-bound snapshots before launch. In GitHub Copilot mode, the API redeems a live UnattendedCopilot capability and passes the bounded credential to the selected pod.
BYOK is the alternative. When byokProviderConfiguration is supplied, AgentHost uses it instead of copilotCredential. A live Copilot credential is required only when the BYOK configuration is absent.
Missing, revoked, mismatched, and expired Copilot capabilities fail closed. Never log credential values. AgentHost keeps configured credentials in memory, but the server side deliberately persists preview-control credentials under a deterministic per-run secret-store key for cross-replica callbacks. That persistence and deletion on actual release/orphan cleanup are best-effort; a missing vault configuration uses an in-memory server store and cannot provide durable cross-replica recovery.
| Field | Required | Meaning |
|---|---|---|
runId |
Yes | The Agentweaver run this pod executes. |
copilotCredential |
When no BYOK configuration is supplied | Immutable, run-bound Copilot capability credential. |
byokProviderConfiguration |
When copilotCredential is absent |
Run-scoped configuration for the active BYOK provider. |
turnBearerToken |
No | Per-run bearer token for POST /a2a/agent/v1/message:stream. |
repositoryAccessToken |
No | Separately redeemed UnattendedRepository capability for scoped Git operations. |
sharedWorkingDirectory |
No | API-visible run worktree. |
previewRunnerCredential |
No | Per-run bearer for pod-root control calls. |
mcpBrokerToken |
For OperatorAssistant purpose only |
Purpose-restricted broker token; not a general run credential. |
| Property | Detail |
|---|---|
| Purpose binding | Provider and repository capabilities have separate purposes. |
| Run binding | A credential provider rejects a different run ID. |
| Bounded lifetime | Copilot capability expiry is enforced; BYOK, turn and preview lifetimes have different contracts. |
| One-time delivery | /configure accepts one configuration per warm pod. |
| No ambient fallback | AgentHost has no Key Vault, CSI, shared-filesystem, environment-token, or user-token-store path. |
apps/Agentweaver.Api/Sandbox/KubernetesSandboxExecutor.csapps/Agentweaver.AgentHost/Program.csapps/Agentweaver.AgentHost/AgentHostRuntimeState.cs
Diagram details and constraints
| Element | Contract |
|---|---|
| title | Bind, reach standby, configure once |
| takeaway | Liveness precedes configuration; production delivers run credentials out of pod specs. |
| Prepare launch | Prepare launch |
| Prepare launch | Resolve provider and run context |
| Prepare launch | Mint fresh turn token |
| Claim warm pod | Claim warm pod |
| Claim warm pod | Create/adopt; omit spec.env |
| Claim warm pod | Wait Ready + bound pod name |
| Resolve and register | Resolve and register |
| Resolve and register | Pod mapping / token registry |
| Resolve and register | Resolve actual pod IP |
| GET /healthz | GET /healthz |
| GET /healthz | HTTP 200 standby |
| GET /healthz | Listener liveness, not turn ready |
| POST /configure | POST /configure |
| POST /configure | Identity / workspace / approvals |
| POST /configure | Copilot capability OR BYOK |
| AgentHost setup | AgentHost setup |
| AgentHost setup | One-time configuration |
| AgentHost setup | Effective workspace + HOME |
| Configuration guards | Configuration guards |
| Configuration guards | Second configure: 409 |
| Configuration guards | Other routes: 503 before ready |
| Register effective endpoint | Register effective endpoint |
| Register effective endpoint | Return effective working directory |
| Register effective endpoint | Shared/local/private fallback |
| First A2A turn | First A2A turn |
| First A2A turn | Production sends turn bearer |
| First A2A turn | Equality guard when nonempty |
| arrow-1 | launch |
| arrow-2 | bound |
| arrow-3 | poll |
| arrow-4 | reachable |
| arrow-5 | setup |
| arrow-6 | ready |
| arrow-7 | invoke |
| note-0 | Top, middle and bottom rows are successive launch stages. |
| note-1 | Repository / preview / broker credentials have separate purposes. |
| note-2 | Optional schema fields do not imply unconditional endpoint enforcement. |
| notes | Top, middle and bottom rows are successive launch stages.; Repository / preview / broker credentials have separate purposes.; Optional schema fields do not imply unconditional endpoint enforcement. |