[hallerite]

Why

Today the harness lives inside the task's machine. The agent loop, the model credentials, the supervisor and the conversation ledger share a filesystem and a process tree with every command the agent runs. For RL that is the wrong boundary: a command can read the API key, kill or starve the loop, or rewrite the ledger; the harness's install and processes become part of the environment being graded; and every task image has to be able to host the harness.

This PR moves the boundary to the tool call. The harness keeps the loop, the credentials, the supervisor and the authoritative conversation, and a small worker in the workspace runs the tools. The model sees the same tools, prompt and results as before.

How it works

Tool calls cross the boundary (following Damian's RFC comment). ipython, bash, edit and fetch travel as a name and arguments to python -m rlm.execution in the workspace, which hosts the persistent IPython kernel, the builtin skills, interruption and kernel recovery. Recursive agents use the same worker, each with a kernel of its own.

rlm.* calls come back. A cell's calls into the supervisor (rlm.agent, rlm.inbox, rlm.shell, …) return over the same connection, scoped to the agent that made them. The supervisor's shell jobs, services and path watches run in the worker beside the kernels, while the supervisor keeps their records and inbox events. Nothing is refused in split mode, and the runtime prompt is the one local execution uses.

The ledger follows the cell. Before each cell the worker receives the conversation's new records, in chunks that fit a frame, so rlm.history() reads locally in the workspace. A child's history comes from the supervisor in pages.

Transport. Length-prefixed JSON frames of up to 16 MiB, over a trusted command's stdio or over TCP with a token on a private network. With --port 0 the worker announces listening on HOST:PORT. TCP does not encrypt, so use a private network or a tunnel. The orchestrator provisions the workspace, starts the worker, and owns teardown and the episode's outcome. It configures execution_command and execution_cwd, or execution_tcp, in the ACP runtime metadata, and initialization advertises ai.prime.rlm/execution-v1.

What it costs. A tool call adds one round trip between the machines and each rlm.* call one more; rlm.shell.run takes two. The worker holds a running job's new output for up to 50 ms, so a short command's output and exit arrive together, and both ends set TCP_NODELAY. On Prime's private network a round trip takes 26–200 ms, depending on the pair of VMs.

Local and split behave the same

A wire needs bounded messages and explicit process ownership. These changes therefore apply to local execution too, and what the agent sees stays as on main:

• Long output. A command or cell runs to its end and keeps the first and last 512 KiB of its output. The result carries the whole output's size, so the model sees the same truncation, token count and line count as before.
• Processes live as on a Linux box. A kernel restart or a closing session stops what is attached to the kernel, as a closing terminal does. Each bash command leads its own process group: a timeout or a cancelled turn stops it and returns its partial output. Bash background jobs and daemons outlive the call, the kernel and the agent, so an agent that leaves a server running gets graded with it.
• Bash reads an empty stdin, never the harness's terminal or protocol stream.

	kernel restart	timeout or cancelled turn	session end
started from a cell, still attached	stopped	cell interrupted	stopped
bash command	unaffected	stopped, partial output kept	stopped
bash background job	runs on	runs on	runs on
daemon (a session of its own)	runs on	runs on	runs on

Validation

• Suite (396 passed). Real stdio and TCP workers cover:

  • persistent state and all four tools, token rejection and concurrent sessions;
  • cancellation, endless and long output, and the process lifetimes above;
  • recursive agents with scoped callbacks and supervisor jobs, services and watches;
  • histories larger than a frame.

  Most of these run in both local and split.

• Docker. In a network-isolated workspace container, all tools work, the harness's files and credentials are out of reach, and killing the container fails the session promptly.

• Prime, with verifiers#2803. The harness and the workspace ran on separate VMs on the rollout's private network.

  • In split mode, file tasks and the rlm.* API scored 1.0, graded in the workspace. A workspace powered off mid-turn ended the rollout as lost.
  • In both split and local execution:
    • the model's view of a 300,000-line output matched the truncation of the whole output;
    • an agent that never finishes left a daemon or a held bash job that completed the task after the harness was gone;
    • in a latency run, every fast job came back complete with its output.

• Terminal-Bench 2.1. On 78 tasks, one attempt each, split mode solved 62 where main solved 63, with no infrastructure errors.

Limits

• Both sides need the same nano-rlm revision.
• A worker process alone does not isolate the filesystem; the command or VM that runs it defines the boundary.
• Uploaded skill packages are not yet supported by the verifiers adapter.

Companion: verifiers#2803 runs this worker on a Prime workspace VM, and the workspace-loss outcome policy is in verifiers#2831.

🤖 Generated with Claude Code

---

Note

Medium Risk
Large new execution path spanning RPC, remote supervisor operations, and process lifecycle; credentials stay in the harness but misconfiguration or worker disconnect fails sessions.

Overview
Adds split execution: orchestrators can set execution_command or execution_tcp on the ACP runtime contract so the harness keeps the loop, model credentials, supervisor, and ledger while python -m rlm.execution runs ipython, bash, edit, and fetch in the task workspace over stdio or token-authenticated TCP. Initialize now advertises ai.prime.rlm/execution-v1.

The engine swaps in RemoteREPL, streams ledger chunks and tool RPCs on 16 MiB frames, and proxies rlm.* via a worker-side broker socket. The root supervisor attach_host so shell jobs, services, and path watches execute in the workspace through WorkspaceHost / RemoteShellJobs while records and inbox events stay on the harness.

Tool output handling changes apply locally too: bounded head/tail capture (512 KiB per command/cell), omitted sizes for accurate conversation truncation, paginated child.history(), bash streaming with process-group lifecycle and empty stdin, and kernel session cleanup on shutdown/interrupt. README and diagrams document colocated vs split layout and round-trip costs.

^{Reviewed by Cursor Bugbot for commit 220db7d. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Stale Bugbot comment from a previous run.

[cursor]

Stale Bugbot comment from a previous run.

[cursor]

Stale Bugbot comment from a previous run.

[cursor]

Stale Bugbot comment from a previous run.

[cursor]

Stale Bugbot comment from a previous run.

[cursor]

Stale Bugbot comment from a previous run.

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

There are 2 total unresolved issues (including 1 from previous review).

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 023b3e9. Configure here.}