You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
Return a prompt's output and give every run a private store - #15
A prompt now returns its output as its return value, and every run has one private store that no caller can seed or read.
What changes
A prompt has no output: frontmatter key, and RunReport has no output field. The result is report.result. ErrorCode::NoOutput is gone.
Every run has one empty in-memory Store outside the VfsRef, with its own claims ledger. Clones are the same store. Nothing outside the run can put files in it or read them back.
Store operations are still Effect::Vfs effects, so a run's records can rebuild its store. No Host policy or observer applies to the store, and tools and the store are disjoint.
A prelude's install makes no store call. A store call at a prelude's top level fails the load, and a captured store function works when a block calls it later. ErrorCode::NoStore is gone.
answer_vfs in the runner calls perform_vfs_op directly.
Commits
Remove the output file from the frontmatter and Harness
Fail a prelude that calls the store while it installs
Give every run a store of its own outside the filesystem
Plan and findings: plan/2026-11-14-1-private-store.plan.md (see "What the build found").
Checks
fmt, clippy (warnings denied), nextest (3784 passed, 24 skipped), both doc builds, xtask api --check, dylint, cargo test -p build-xtask, node --test tools/docs-claims.mjs, the run-prompt example, and cargo deny check all pass.
Companion changes (not pushed yet)
runvil-design: describe the run's own store and the return value as output
runvil-docs: teach that a run returns its output and has its own store
runvil: name a store operation in the Engine's list of effects
Summary by CodeRabbit
New Features
Each run has its own initially empty in-memory store, separate from mounted filesystems and tool-call file access.
Store operations are recorded as run events and can be replayed to reconstruct stored files.
Behavior Changes
Prompts return results directly; declared output-file results are no longer included in run reports.
Store calls during prelude loading fail without performing the operation. Captured store functions can be used later in a prompt block.
Run reports expose the prompt result instead of an output-file result.
A prompt declared a file under `output:`, and the Harness read that path from the store after the run into `RunReport::output`. The key, `FileDecl`, the report field, and `files.rs` are deleted, so the text that a prompt returns is the one result of a run.
- `RunReport` has three fields: `run_id`, `result`, and `unread`. `Harness::run` does not read the store after the run.
- `ErrorCode::NoOutput` had `files.rs` as its one producer. It is deleted with its tag `no_output`, and `ALL` in `error-tests.rs` has 68 codes.
- An `output:` key now fails the parse as an unknown key.
- Both `public-api.txt` listings lose `FileDecl`, `Frontmatter::output`, and `ErrorCode::NoOutput`, and the `runvil` listing loses `RunReport::output`.
- The fixtures that declared `output:` return their text: `SHOUTS`, `REVIEW`, `FILES`, and `GREET` in the `run-prompt` example. Their tests read `report.result`, and `SHOUTS` does not write the store.
- `prepare-files.rs` keeps the two tests of a file that the Host seeds in the store.
- `assert_not_completed`, the five tests of `report_output`, the two frontmatter tests of the key, and `MISSING_OUTPUT` with `extract_declared_output` are removed. No test covers a frontmatter that has an `output:` key.
Plan: /plan/2026-11-14-1-private-store.plan.md
A `store` function ran a direct closure while the Pack preludes installed and yielded only after, so the install of a prelude could change the store with no effect issued. `install_shims` now installs the `store` table of the shim chunk as the global before the preludes. A store call outside a block fails where it yields, as `tools.call` does, so the prelude fails to load and the store is not touched.
- `install_store_table`, its closures, `route_store_to_shims`, `install_store_shims`, the `store_conflict` slot with `take_store_conflict`, and `__impl_store.lua` are deleted. `engine_globals_store.rs` keeps `run_store_op`, the line bounds of the two reads, and the failure messages.
- The section VM holds no access and makes no store view. `inject_values` and `inject_test_values` take no access, `install_engine_globals` takes no `ScopeHandle`, and `SectionVmSetup`, `vm_setup`, and `SectionContext::new` lose `access` and `scope`.
- `SectionContext::new` loses its `too_many_arguments` expectation, and `type_size.rs` loses its entry for `SectionVmSetup`.
- The load failure of a prelude ends with `it must not call tools or the store while loading.`
- A prelude that catches the failure with `pcall` installs. A store function that a prelude captured as it installed runs when a block calls it. `preludes.rs` has a test of each rule, and the test of a conflict from the write of a prelude is removed with the slot.
- A VM without the coroutine shims has no `store` global.
- `drive_block` in the lua test hub runs a block as a coroutine and answers each store request with `run_store_op`. `run_chunk` goes through it, so the tests in `tests/store.rs` take the yield path and assert the code of the store failure itself.
- The lua crate reports no store event. The store event tests move from `store_reports.rs` to `observations-store.rs`, which asserts those events on a run.
- `FailingBackend` is removed from the lua tests, so no lua test covers a store call that its backend fails. `engine_misuse.rs` is removed with its one test, and `a_store_install_without_a_store_names_why_in_its_message` is removed.
Plan: /plan/2026-11-14-1-private-store.plan.md
A run's store was one mount of the `VfsRef` that the caller gave the run, so the caller could fill it, read it, and put a policy on it, and a tool call could reach its files. A store is now a value of its own, `Store` in `runvil-vfs`: an empty set of files in memory under its own claims ledger, which the Engine makes for each run and reaches only through `Store::view`. The `VfsRef` holds the files that the run's tool calls work in, and each store operation stays an `Effect::Vfs`, so the records of a run hold every one.
- `Store::view` joins the scope of the access it gets and records its claims in the ledger of the store. The forks and joins of a run order store operations as they order file operations, and two stores share no path and no claim. Neither `public-api.txt` listing has `Store`.
- `SharedState` holds the `Store` of the run, made with `Store::new()` when the run is built. `dispatch_vfs` is the one place that makes a view, through `ChainState::store()`, so a chain that gets another store needs no other change.
- `VfsRefBuilder::store`, `StoreDecl`, `acquire_store`, `probe_store`, the `store_view` methods of `ScopeHandle` and `Access`, `VfsError::NoStore`, `ErrorCode::NoStore`, and the store probe of `check_start` are deleted. `VfsRef::default()` is one memory mount at `/`.
- Every access is rooted at `/`, so the root of an access and the root parameter of `canonicalize`, `strip_root`, and `relativize_error` are deleted. A boolean `store_view` marks a view.
- The policy and the operation observer of a handle see the file operations of tool calls and never a store operation. `a_handles_policy_and_observer_never_see_a_store_operation` and `a_hosts_policy_and_watcher_never_see_a_store_operation` hold the rule.
- A run sees no file of its handle through `store`, a tool call sees no file of the store, and two runs over one handle each start with an empty store.
- The first step checks the version gate, the arguments, and the requirements. A handle that refuses the root access of the run ends the run after those checks.
- `make_files_error` gives a refusal by the files of the caller the message `file access failed: {cause}`: the root access of the run, the fork for a task, and the fork for a tool call. A store view that the scope refuses keeps `store operation failed: {cause}` from `make_store_error`, which has the text of `store_probe_message`.
- `answer_vfs` calls `perform_vfs_op` with no `catch_unwind`, because the store is memory and no backend of the caller runs there.
- `SharedState` has 15 fields, and its entry in `type_size.rs` records 15.
- `handle/tests/store.rs` has the tests of a store, and `scope_handle-tests.rs` keeps the tests of `spawn`, `join`, `end_access`, and `end`. `a_runs_vfs_records_rebuild_its_store` and `a_runs_store_effect_records_rebuild_its_store` apply the `Vfs` records of a run to an empty memory handle and read back the files of the run.
- The runtime's `TestStore` reads the store of the run through `store_for_test`. In the runner, `stopping_store`, `sending_store`, and `HookedBackend` are deleted, and their tests hook the recorder with `HookedRecorder`, as `stopping_at_each_store_write` does.
- `tool_call_access.rs` and the tests of modes, the watcher, and a caller's edit work on a file that a tool call touches through its access.
- The tests of a store that the caller fills, reads, fails, or mounts at a path are deleted, and so are the tests of a `Vfs` operation's thread and of a backend that panics. `prepare-files.rs` and `temp_root.rs` are removed.
- `store_error_message` keeps its text for failures such as `PermissionDenied`, which a `Store` does not give. No test covers a store view that fails for a cause other than the end of its scope.
Plan: /plan/2026-11-14-1-private-store.plan.md
The change replaces declared output-file reporting with prompt return values. Each run now owns an empty in-memory store, separate from the filesystem used by tool calls. Lua store operations yield to the executor as effects.
Prompt frontmatter no longer declares an output file. RunReport returns the run result instead of output-file contents. Output-reporting APIs and the NoOutput error code were removed.
Define the independent store and its views crates/runvil-internal/vfs/src/*, crates/runvil/public-api.txt
The VFS crate adds Store and store views bound to an access identity and scope. Store mounts, store probes, and NoStore are removed. Store path handling now uses the namespace root.
Own the store per run and dispatch effects crates/runvil-internal/runtime/src/execute/*, crates/runvil-internal/runtime/src/error.rs
The runtime creates an empty store in shared run state and derives a store view when dispatching a VFS effect. Startup no longer probes for a declared store.
Route Lua store calls through coroutine yields crates/runvil-internal/lua/src/*, crates/runvil-internal/runtime/src/execute/section_vm.rs
Lua installs store yield shims before Pack preludes. Store calls during prelude loading fail at the yield point; block execution handles store requests.
Update run, tool, and effect coverage crates/harness-internal/runner/tests/it/*, crates/runvil-internal/runtime/src/execute/tests/*, crates/runvil-engine/tests/suite/*, crates/runvil/tests/suite/*
Tests cover run-store isolation, tool-call filesystem separation, effect ordering and replay, and prompt results returned as text.
sequenceDiagram
participant LuaBlock
participant Scheduler
participant Store
participant Harness
LuaBlock->>Scheduler: yield store request
Scheduler->>Store: create store view and dispatch operation
Store-->>Scheduler: operation result
Scheduler-->>Harness: VFS effect and answer
Harness-->>LuaBlock: resume block with answer
Loading
Merge Risk: Minimal · up to 1664e
The change makes prompt output the returned result and gives each run its own in-memory store. No concrete merge-blocking issue was found. Public API removals are intentional and documented.
Pre-merge checks: 4
Check name
Status
Explanation
Description Check
Check skipped - CodeRabbit’s high-level summary is enabled.
Title check
The title names two changes: returning a prompt's output as the run result, and giving each run a private store. The changeset matches both. It removes the file-based output declaration and `RunReport…
Linked Issues check
Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check
Check skipped because no linked issues were found for this pull request.
Full details: Title check
Explanation
The title names two changes: returning a prompt's output as the run result, and giving each run a private store. The changeset matches both. It removes the file-based output declaration and RunReport::output, adds RunReport::result, and adds a per-run empty in-memory Store separate from the caller's VFS. The title is concise, specific, and written as one sentence, so it covers the main change.
Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
199-199: Minor · Functional Correctness · Quick win
Unverified finding
Verification ran but could not confirm this finding. It is shown for review, not as a verified issue.
Return compilation failures from run_chunk.
If source contains malformed Lua, such as local =, block(source) panics at LuaProgram::compile(...).expect(...). The caller cannot inspect the failure through this helper's Result, unlike other block failures.
Compile with LuaProgram::compile(...)? inside run_chunk. Keep block() for fixtures that must compile.
Review info
Run configuration
Source mode: Auto
Repository: Unavailable
Branch: Unavailable
File: No configuration file from this repository applied
Commit: Unavailable
Layers: defaults
Review profile: CHILL
Plan: Essentials
Run ID: 12cc8b63-f875-4a2b-a4e7-144633d2bcf1
Commits
Reviewing files that changed from the base of the PR and between 0d93888 and ceb5da4.
Included review availability: This review used your included allowance. 4 included reviews remain after this review. Your included PR review attempts over the past 7 days set your current allowance at 5 reviews per hour.
`run_chunk` in the Lua test VM compiled its source with `block`, which panics on malformed Lua. It now compiles with `LuaProgram::compile` and returns the failure through its `Result`, as every other block failure is returned.
- `block` is unchanged, for fixtures that must compile.
- A new test in `tests/store.rs` pins that `local =` gives an error and not a panic.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
A prompt now returns its output as its return value, and every run has one private store that no caller can seed or read.
What changes
output:frontmatter key, andRunReporthas nooutputfield. The result isreport.result.ErrorCode::NoOutputis gone.Storeoutside theVfsRef, with its own claims ledger. Clones are the same store. Nothing outside the run can put files in it or read them back.Effect::Vfseffects, so a run's records can rebuild its store. No Host policy or observer applies to the store, and tools and the store are disjoint.ErrorCode::NoStoreis gone.answer_vfsin the runner callsperform_vfs_opdirectly.Commits
Plan and findings:
plan/2026-11-14-1-private-store.plan.md(see "What the build found").Checks
fmt, clippy (warnings denied), nextest (3784 passed, 24 skipped), both doc builds,
xtask api --check, dylint,cargo test -p build-xtask,node --test tools/docs-claims.mjs, therun-promptexample, andcargo deny checkall pass.Companion changes (not pushed yet)
Summary by CodeRabbit