AF-compatible worker heartbeat
Updates `activeCount` on the worker's Redis record and resets its TTL. An optional closed, redacted HarnessConnection inventory report may be submitted only with a runtime worker JWT; it contains configured connection refs plus live evidence, never host-supplied connection configuration. Registration tokens remain valid for inventory-free bootstrap heartbeats but receive a typed 403 when inventory is present. A hosted runtime supplies the exact complete D12 sessionShim projection; the platform returns that same non-secret projection only after stable-host/controller/revision/quarantine and durable receipt authority match. The optional Donmai proof-v2 readiness shape is all-or-none and echoed only; it does not independently authorize a cutover or activation. Missing, stale, or changed publication leaves the host recovering. Returns pending work queue depth.
AuthorizationBearer <JWT>Short-lived worker runtime JWT minted by the platform. Claims bind the worker, project, organization, registration, and scopes.
id*stringapplication/json- body
activeCount*integer0 <= valueactiveInteractiveCount?integerCoherently sampled subset of activeCount containing live interactive PTY sessions plus legacy interview sessions. Must not exceed activeCount. Omission means classification is unknown and is stored as null, never zero or a stale prior sample.
0 <= valueload?daemonVersion?stringDaemon build version (e.g. '0.13.2'). Optional; when present it refreshes worker_hosts.daemon_version so the column tracks the running daemon. Omitted beats leave the registration-time stamp untouched.
harnessInventory?Runtime worker JWT only. Registration-token heartbeats containing this field are rejected with HARNESS_INVENTORY_RUNTIME_JWT_REQUIRED.
quota?array<>Per-account subscription quota windows published by the daemon: the JSON donmai marshals for []agent.UsageAccount, with no second shape. Each entry carries the provider (codex, claude or muse), the opaque account id (the platform stores only its per-org HMAC, never the raw id; an email or an @-shaped id drops the entry), the plan slug, an optional limit id (defaults to the provider), limits.windows[] with id, kind, label, usedPercent, resetsAt and windowDurationMins, and an optional authCheck. limits.resetCredits and limits.unavailable are accepted and not stored. An account with no windows carries no snapshot. Only muse is allowlisted for auth-only entries: empty or null windows with a well-formed authCheck naming muse feed tag evidence but do not count as readable accounts. Window-less codex and claude entries remain ignored; id and email validation is unchanged. authCheck is the daemon's host login check for the entry's harness and the only source of the host-session: capability tag (runtime worker JWT only): the tag is present while some entry of the harness carries authCheck with ok true and a checkedAt within 10 minutes (twice the daemon's 5 minute probe interval), and is removed when ok is false, when no entry of the harness carries one (including a beat with no quota), or when checkedAt is stale or more than 60 seconds in the future. authCheck.harness must match the entry provider. A daemon cannot self-declare the tag at registration. Omitted by daemons that do not probe quota. An unreadable value reads as omitted and never fails the beat. A beat that reports readable accounts replaces the host's stored windows; a beat with none leaves them untouched.
sessionShim?Runtime-JWT-only complete D12 adoption publication. Donmai proof-v2 readiness fields are optional only as an all-or-none, all-true set and are echoed exactly for compatibility; they do not independently authorize a cutover or activation. The daemon-published readiness triple is optional: readinessState: "ready" stands alone, a not-ready/unknown state requires both readinessReason and readinessObservedAt, and a degraded state is refused alongside the proof-v2 set. Omitting the triple without the five positive proof-v2 facts is silence, not a ready report — the platform preserves whatever readiness it has already recorded. When all five facts are true, an omitted triple is the released Donmai healthy spelling and restores readiness. streamBackPressureSessions is optional and additive in the same way, and is a COMPLETE snapshot when present: state: "none" rows are a positive all-clear, and an absent key is silence rather than an all-clear. A successful heartbeat response echoes this exact non-secret projection; local carrierActivationComplete is deliberately not a wire field.
Heartbeat acknowledged.
application/json- response
acknowledged*booleanserverTime*stringdate-timependingWorkCount*integersessionShim?Runtime-JWT-only complete D12 adoption publication. Donmai proof-v2 readiness fields are optional only as an all-or-none, all-true set and are echoed exactly for compatibility; they do not independently authorize a cutover or activation. The daemon-published readiness triple is optional: readinessState: "ready" stands alone, a not-ready/unknown state requires both readinessReason and readinessObservedAt, and a degraded state is refused alongside the proof-v2 set. Omitting the triple without the five positive proof-v2 facts is silence, not a ready report — the platform preserves whatever readiness it has already recorded. When all five facts are true, an omitted triple is the released Donmai healthy spelling and restores readiness. streamBackPressureSessions is optional and additive in the same way, and is a COMPLETE snapshot when present: state: "none" rows are a positive all-clear, and an absent key is silence rather than an all-clear. A successful heartbeat response echoes this exact non-secret projection; local carrierActivationComplete is deliberately not a wire field.
harnessInventory?Present only when the heartbeat supplied harnessInventory. A positive acknowledgement means the latest redacted host projection was stored; it is not immutable production-admission authority.
curl -X POST 'https://app.rensei.ai/api/workers/string/heartbeat' \ -H 'Content-Type: application/json' \ -d '{ "activeCount": 0}'{ "acknowledged": true, "serverTime": "2019-08-24T14:15:22Z", "pendingWorkCount": 0, "sessionShim": { "enabled": true, "adoptionComplete": true, "workerHostId": "string", "controllerId": "string", "adoptionRevision": "string", "durable_carrier_proof_v2_ready": true, "composingProofV1WritesClosed": true, "encryptedOriginalCredentialRetained": true, "remainingValidityConsumeGate": true, "adoptedCandidateRecovery": true, "readinessState": "ready", "readinessReason": "string", "readinessObservedAt": "2019-08-24T14:15:22Z", "quarantinedSessions": [ { "orgId": "string", "sessionId": "string", "shimId": "string", "processEpoch": 0, "controllerGeneration": "string", "protocolMin": 0, "protocolMax": 0, "reason": "protocol_mismatch", "ageSeconds": 0, "consumesCapacity": true } ], "streamBackPressureSessions": [ { "orgId": "string", "sessionId": "string", "state": "none", "stalledSeconds": 0 } ] }, "harnessInventory": { "accepted": true, "reportDigest": "string", "validUntil": "2019-08-24T14:15:22Z", "reason": "host_unavailable" }}Deregister a worker
Removes the worker from the registry and releases any remaining claims. Returns the list of sessions that were unclaimed as a result. Auth: runtime JWT only (`sub` must match worker ID).
Poll for queued work
Atomically pops and pre-claims work items from the priority queue (ZPOPMIN). Also returns inbox messages for the worker's active sessions. Workers that receive `preClaimed: true` must NOT make a separate claim call. Runtime-JWT callers also receive `gitCredentials` (short-lived GitHub PAT) and optionally `batchWork` (code-survival scan items, gated on the `code-survival-scan` capability).