SEIF Docs

Context Runtime

The Context Runtime executes one verified Build. It is the same engine the Workstation uses for preview and tests.

In the Workstation

OBSERVE → Run starts the selected Build as a child process on http://127.0.0.1:4317 (next free port if busy) with traces under .workstation/runtime/traces. Health, active Build, endpoint, retention and the live trace list are shown; Stop / Restart are available. Connect to a runtime… observes a runtime started elsewhere (URL, optional token).

Runtime bundle (deploy anywhere)

BUILD → Export runtime bundle… writes a folder and a .tar.gz with .sha256:

support-agent-context-1-runtime/
  run.sh                   starts the runtime (extra args pass through: --port, --host, --data)
  bin/node                 pinned Node.js 24.21.0 (darwin-arm64)
  lib/engine/*.mjs         runtime modules only
  lib/node_modules/@and2carvalho/{seif-application,seif-core,seif-projection,seif-observability}
  build/                   the verified Context Build (read-only)
  runtime-manifest.json    bundle id, Build ref and digest, contract, engine, Node, packages
  config.template.json     host, port, trace retention, max traces, live source locations
  openapi.json             the API
  examples/                curl, Python, TypeScript
  licenses/                Node.js license, notices
  SHA256SUMS

It needs no Workstation, SEIF source checkout, CLI, global Node, Go or .NET. Export audits every file for machine paths and credentials and refuses to write a bundle that contains either.

tar -xzf support-agent-context-1-runtime.tar.gz && cd support-agent-context-1-runtime
shasum -a 256 -c SHA256SUMS
./run.sh                     # {"event":"listening","url":"http://127.0.0.1:4317",…}

config.json (copy the template) sets host, port, traceRetention, maxTraces, dataDir and liveSources. Command-line flags override it.

Security defaults

  • Binds 127.0.0.1. Any other host requires SEIF_CONTEXT_RUNTIME_TOKEN (≥ 24 characters); the runtime refuses to start otherwise (INSECURE_BIND). With a token set, every endpoint requires Authorization: Bearer <token>.
  • Requests carrying a browser Origin are refused; on loopback, non-loopback Host headers are refused (DNS-rebinding protection).
  • JSON only, 1 MiB bodies, 256 KiB input, request/header timeouts.
  • Logs contain request ids and outcomes, never content.
  • Trace retention follows the Build environment: metadata (digests only) or bounded content; maxTraces caps the count.

Context resolution never writes to sources. Tool Builds additionally enable a bounded gateway that validates and delegates explicitly approved calls to application-owned executors; backend authorization remains required. See Context tools.

Managed deployment and feedback

The same runtime contract now runs behind verified Registry deployments with distinct operational environment, deployment id and registered Build id. Health verifies exact identity before activation. /v1/context/outcome accepts explicit application labels (contextRef, optional traceRef, status success/failure/unknown, category, latencyMs, cost, numeric metrics); HTTP success does not imply agent outcome. /v1/trace-delivery and its acknowledgement route support durable authenticated collection, bounded retention and backpressure.

Thin SDKs simplify resolve/expand/consumption/outcome without owning model execution. Supplied context-only model token measurement is labelled MEASURED_FOR_MODEL; absent measurement remains UNKNOWN. Default resolution token counts remain estimates. See Deployment, Python, TypeScript.