Operator-authored per-artifact configuration: the config: block on an artifact’s entry in
the capsule operator’s own manifest, lowered to compact JSON and delivered to that artifact
alone as ARTIFACT_CONFIG_ENV.
The runtime-provided background-command tool: the state of a shell command that was moved
to the background, a wait for it, or a stop of it, named by the work id its shell call
returned.
What the host programs a capsule’s tools run need from the host, as each tool’s own
murmur.yaml declares it (murmur_artifact::parse_program_needs), resolved against this
host at staging.
Who may call the A2A door: the tokens a capsule declaring network.authentication mints at
launch, the check every gated request passes, and the refusals it answers with.
Who in a formation may call whom: the credential a formation launcher issues for each roster
edge, the check every member’s door makes, and the channel a member’s runtime is handed its
credentials and its callees’ addresses on.
Launching a formation: every member of an admitted roster as a mur run subprocess of its own,
peers first and the entry member last, and every member stopped once the entry member’s process
has ended.
Where the files a capsule manifest names by path are read from: inference.system_prompt_file,
inference.compaction.system_prompt_file and a local-source artifacts[].source.
The program store, ~/.murmur/programs/: the pinned downloads a tool’s programs: block names
(murmur_artifact::parse_program_downloads), fetched once by mur install, and which copy of
each pinned program a session runs.
The session’s records directory: every record the runtime writes about a session, outside the
workdir the capsule’s commands can write, and kept after the session ends.
Roster admission: a parsed roster.yaml checked against the stores and the project’s
murmur.lock, and either bound to exact artifacts with its reachability expanded into edges, or
refused whole.
The machine-wide map of capsules that are currently running: one record per session, at
~/.murmur/running/<session_id>.json. An agent session writes its record once its A2A door is
bound and names the door in url; a script capsule binds no door, writes its record when its
session starts, and holds "url": null.
One command run in a session’s work folder after the session has ended, under the containment
the session’s own commands had: what mur eval run judges a case’s work by.
Where an agent session stands: what the runtime-provided session-status tool reports, the
hard deadline a session runs under, and the one notice an agent is given before it.
Durable, capsule-scoped state stores: ~/.murmur/state/<store>/, granted per artifact by
capabilities.state and mounted into a guest as a second WASI preopen named
STATE_PREOPEN_NAME.
The session’s temporary folder: tmp/ in the session’s records directory, which every shell
command, plan shell step and murmur:process program reaches as $TMPDIR, $TMP and $TEMP,
and on Linux as a literal /tmp wherever the host can give a command a private mount namespace.
Every runtime write, append, create, removal and decision-read inside a capsule’s workdir,
performed relative to a held directory descriptor with no symbolic link followed.
println! for report output, through report_to_stdout: same arguments, same bytes on an
open stream, and a closed stream drops the line instead of panicking. Evaluates to ().
What became of this session’s cgroup scope, carried into --explain-scope, into
session_start.effective_grants.cgroup_scope and into mur doctor’s cgroup scope: line.
lifecycle.done_check: the command whose exit status says whether a task’s work is done, and
how many times per task a failing run may reopen the task; see LifecycleConfig::done_check.
lifecycle.keep_working: what the runtime sends when a task’s attempt ends at a turn end, and
how many times per task it does so. Both fields are required; see
LifecycleConfig::keep_working.
A second appender to the session’s trace.jsonl, used by the resource plane, by the peer
plane’s listener, and by the peer-handoff tools in the agent loop.
Everything warn_on_unreachable_toolchain_helpers decided. Both lists empty means every
known driver was either probed with every helper covered, or answered nothing usable; a
driver that could not be asked always lands in unprobed.
One host path staging granted read-only: a trust-store location, or a path a tool’s declared
program need resolved to (crate::declared_needs::NeedPath).
Whether this session’s subprocesses get a delegated cgroup v2 scope, the precondition every
capsule that can run a subprocess is refused without (E-RUN-012).
The errors a door answers a completion with: murmur’s own protocol riding on SendMessage
with x-murmur-task-origin: completion, so none of them is an A2A error.
Every murmur:* WIT package declared under crates/capsule-runtime/wit/, paired with the one
version of it this host links and resolves, sorted by package name.
URI of the agent-card extension that lists the murmur frames the capsule’s stream can write,
and the A2A-Extensions value a client sends to receive them. It is the address of that
extension’s section in the reference docs, on the streaming protocol page beside the frames it
names. Every murmur frame on the wire sits under metadata keyed by this URI.
The trees a session placed at placement lets its commands write, as
derive_interpreter_runtimes takes them: the workdir root and the records group, which holds
every session’s temporary folder.
Whether the credential backstop would drop a variable of this name — the same question
[strip_credential_shaped_vars] answers per entry, asked of a name alone. See
credential_backstop_match for which pattern decided it.
The first credential backstop pattern that matches name, or None when the backstop keeps
it — the one decision procedure behind [strip_credential_shaped_vars],
credential_backstop_drops, W-SEC-024 and the E-CAP-016 staging refusal.
What mur run --explain-scope reports for policy’s cgroup scope and io.max, on the terms
a launch reports them: probe_scope for a contained session, and for an unconfined one the
no-scope reports when it declares no cgroup_* field, else the probe with io.max written
only when cgroup_io_bytes_per_sec is declared.
Fills cache with the entries derive_interpreter_runtimes would keep for the same
arguments, ahead of the launch that would otherwise work them out, and counts them.
The lines mur doctor prints under its Landlock heading for a kernel reporting
kernel_abi: what the kernel offers, what the runtime builds at, and what a capsule loses on
this host below [LANDLOCK_TARGET_ABI].
Answers “would a launch get its cgroup scope here, and would the declared io.max ceiling
apply on it?” by doing what a launch does, against a throwaway cgroup created and removed
inside this call: [delegated_base], then the scope directory through the same
[create_scope_dir] [prepare_scope] calls, then the io.max write.
Warns (W-SEC-012, non-fatal, once per uncovered helper) when a sealed capsule allowlists a
known compiler driver whose helper binaries have no grant carrying the Landlock Execute
right. Returns what it warned about so the decision is assertable without capturing stderr.