Run the provider-native model/tool graph.

Compile the deployment contract

Start with the checked-in example. It builds a real tool-capable Agent, strict read-only policy, explicit unpriced accounting, generated state schema, standard runtime schemas, and initial checkpoint state. It needs no API key or database and performs no external I/O.

cargo run -p stateknot-runtime --example provider_native_agent --locked

Read the exact compiled example source before adapting it. The example stops at the deployment boundary; the PostgreSQL suite proves dispatch and recovery separately.

Pin code, policy, and accounting together

The composition digest binds the Agent, Model, Tool, instructions, execution limits, input security label, policy implementation, and accounting tables. Changing any one of them requires a new graph version.

let definition = ProviderNativeAgentGraph::compile(
    typed_definition.descriptor().clone(),
    graph_identity,
    reducer_identity,
    state_schema_id,
    input_security_label,
    policy,
    accounting,
)?;

definition.register_schema(&mut schemas)?;
register_standard_agent_cancellation_event_schema(&mut schemas)?;

Register every typed input/output schema, Tool schema, provider profile, and standard runtime event schema before freezing the registry. Startup fails on a missing or conflicting digest. Existing runs always reload the graph version pinned by their checkpoint.

Price real model evidence

ModelTokenAccounting pins an operator-verified rate card and provider-reported model ID to one exact model binding and graph version. It prices committed or failed model attempts from the durable usage ledger; missing usage or a required cached token breakdown is Unpriced, never free. Rates are not bundled with StateKnot because provider tariffs change. The real HTTP and PostgreSQL qualification verifies the adapter, invocation ledger, terminal cost, exact-key read authorization, and idempotent resubmission on PostgreSQL 16/17. Its rates and credentials are test fixtures; the standalone operator-configured runnable Agent example is still in progress.

Follow one durable turn

1. Reconstruct

   The model node rebuilds provider-native transcript order and cumulative usage from immutable invocation ledgers.

2. Commit before dispatch

   The logical invocation and physical attempt start become durable before provider or Tool I/O. An idempotently observed start never grants dispatch authority.

3. Authorize each action

   Canonical Tool arguments, proposal order, admission, and model invocation are bound into an action digest. Policy evidence is pinned before Tool preparation.

4. Advance from ledgers

   Exact terminal revisions become the node result. A crash reloads committed evidence instead of redispatching the external call.

Known Tool failures remain ordered transcript outcomes. An ambiguous write is never repeated as an ordinary business call. When the descriptor and exact provider both enable reconciliation, Unknown triggers one bounded original-attempt probe. Authoritative evidence commits atomically; Pending becomes a durable delayed retry under a later lease. Other bindings stay blocked for manual reconciliation.

Repair structured output from durable evidence

Configure a finite max_output_repair_turns below the total model-turn ceiling. A committed schema-invalid response, or a response-phase response.malformed adapter failure with exact usage, is bound to the node result before a distinct repair invocation and attempt are generated. A crash reloads that terminal ledger fact and never dispatches the malformed attempt again.

The fresh request retains the original input and trusted instructions, then appends the reserved framework instruction stateknot.output_repair. Invalid payloads and provider error text are not copied into the prompt or Transcript. Completed Tool history retains its exact definitions and results; selection is none with zero allowed calls. Models must explicitly support this choice when Tools and repair are configured. Repair-time Tool proposals reach neither policy nor Tool I/O. Exhaustion fails with runtime.agent.output_repair_exhausted and exact charged-turn evidence; malformed envelopes without usage remain fail closed.

Parallelize reads; make every write a barrier

parallel_read_only groups contiguous Tools whose immutable descriptor risk is ReadOnly, up to the configured bound. Policy, arguments, preparation, and physical starts remain serialized in provider proposal order. Only provider I/O overlaps. Terminal evidence is buffered and committed in that same order, so completion timing cannot reorder the Journal or next model Transcript.

Every write runs alone after earlier reads settle, and later reads wait for its terminal fact. Cancellation aborts child provider tasks instead of detaching them; committed starts remain visible to fenced recovery. Choose the bound from real provider quotas and connection capacity.

let execution = AgentExecutionConfig::new(
    AgentStructuredOutputStrategy::ModelNative,
    max_model_turns,
    ExecutionCount::new(1),
    max_tool_calls_per_turn,
    AgentToolConcurrency::parallel_read_only(ExecutionCount::new(8)),
)?;

Treat cancellation as two durable facts

Request

An authenticated control plane appends immutable cancellation intent. The Driver polls durable state, stops new dispatch, signals cooperative cancellation, and applies a bounded grace period.

Confirm

The Agent Loop carries the exact checkpoint, journal head, revision, failure ID, and lease to lifecycle. Lifecycle reconstructs usage and atomically confirms cancellation with database time.

Fail closed

Executing models, Unknown writes, or missing model usage keep the run cancellation_requested. StateKnot never substitutes zero usage for unavailable evidence.

The public-safe confirmation schema is available at its stable runtime identity. AgentService v1 now supplies the authorization-first cancellation ingress; an HTTP/gRPC transport remains an embedding-service responsibility in this pre-alpha cut.

Run the PostgreSQL proof

After configuring the test database as described in the PostgreSQL guide, require the integration suite instead of allowing an infrastructure skip.

STATEKNOT_REQUIRE_POSTGRES_TESTS=1 \
cargo test -p stateknot-runtime --test postgres provider_native --locked

The focused cases cover multi-turn recovery without model redispatch, stale-fence policy races, known failed Tools, Unknown → Pending → committed reconciliation with one business call, bounded read-only overlap with an ordered write barrier, committed and adapter-failed output repair across a new lease, exact repair exhaustion, repair-time Tool rejection, exact-usage cancellation, pre-dispatch cancellation, and evidence-unavailable fail-closed behavior on both supported PostgreSQL majors.

Keep the release boundary visible

• Sequential and bounded parallel read-only Tool execution are implemented; every write is intentionally serialized. Journal-isolated Graph sibling ordering is also implemented behind an explicit trusted executor contract.
• Model-native structured output and bounded durable repair are implemented; Tool-call-emulated final output is rejected.
• Exact cancellation confirmation and the AgentService v1 embedding ingress are implemented; stable HTTP/gRPC transport is not.
• The provider-native execution core, strict MCP Remote Tool, and A2A Remote Agent bindings are implemented. Independent MCP/A2A Server profiles exist but are not composed into this Graph. Broader protocol extensions, A2A live-peer reconciliation qualification, general artifact lifecycle/public delivery, failover, and a production release remain ahead.

The complete integration and operations contract lives in the repository guide.