Agent runtime and durable sessions

Mila is packaged under agents/mila and uses the logical model route interactive. Agent, profile, tool, and channel code does not select a model provider or computer vendor. The trusted willaOS runtime resolves those choices from deployment configuration.

Model routing

Set MILA_MODEL_PROVIDER to anthropic, gateway, openai-compatible, or fake. MILA_MODEL_ADAPTER=ai-sdk is the normal production path; anthropic-legacy exists only for behavior comparison during migration. An OpenAI-compatible route can target LiteLLM, Ollama, vLLM, or another compatible router through MILA_MODEL_BASE_URL without changing Mila.

MILA_DATA_POLICY=local_only requires a route configured with MILA_MODEL_DEPLOYMENT=local. The router fails closed before invoking an adapter when the policy or required capabilities do not match.

Each client also has an ai_policy. private_only and local_only require a local model and block client-scoped SuperMemory reads and writes, Deepgram transcription, and direct hosted-model features. Features without a local implementation use their deterministic fallback or return an unavailable response. A route declared local must use a loopback MILA_MODEL_BASE_URL; remote URLs cannot become trusted by setting MILA_MODEL_DEPLOYMENT=local. Changing an existing client to private or local processing first blocks external AI, deletes and verifies its SuperMemory data, and clears local sync identifiers. The update fails closed if deletion cannot be verified.

Use REST GET/PATCH /api/clients/:id or the MCP update_client_ai_policy tool with the current client version to read or change this policy. The policy does not decide whether unscoped internal SOPs may use SuperMemory; that organization-level vendor decision is separate.

Durable session API

• GET /api/agent-sessions lists sessions within the bearer key's client and project scope.
• POST /api/agent-sessions creates an allowed profile session.
• GET /api/agent-sessions/:id returns its append-only events and artifacts.
• GET /api/agent-sessions/:id/artifacts/:artifactId streams an artifact after the same scope check and never reveals its storage URL.

The matching authenticated app page is /agent-sessions/:id. QA sessions show recordings, traces, screenshots, redacted logs, findings, and the existing reviewed QA-to-Asana action.

Hosted adapter conformance

Hosted computer checks stay opt-in because they create billable resources. Run the credential-gated suite with:

RUN_LIVE_AGENT_COMPUTERS=1 \
LIVE_AGENT_COMPUTER_PROVIDERS=vercel,blaxel \
pnpm exec vitest run tests/integration/agent-computer-adapters.live.test.ts

Vercel Sandbox uses the SDK's VERCEL_OIDC_TOKEN flow. Blaxel uses BL_API_KEY and BL_WORKSPACE. These credentials belong only to the adapter test/control plane and are never included in agent instructions, model input, worker capabilities, or sandbox payloads.

External workers

Admins enroll workers through POST /api/agent-workers. The enrollment secret is returned once and only its hash is stored. Each run uses a short-lived, session/run/tool/audience-scoped capability against /api/agent-worker/mcp. Workers receive no database connection, general API key, general MCP key, or model-provider credential.

Remote QA jobs use the versioned willa-remote-qa-v1 envelope. Workers append events over the filtered MCP endpoint and upload binary evidence to POST /api/agent-worker/artifacts; the control plane derives session and run ownership from the capability rather than worker-provided IDs. Each binary upload is limited to 64 MiB. pnpm agent-worker:run executes one envelope from stdin and returns only status, correlation IDs, and opaque artifact IDs.

Repository operators should also read docs/architecture/agent-runtime-security.md, docs/architecture/agent-sessions.md, and docs/operations/self-hosted-agent-worker.md for the threat model and operations contract.