---
spec_doc_type: spec
spec_id: runtime/edge-node-execution
status: 구현됨
source_evidence:
  - type: contract
    path: agent-contract/inner/execution-runtime.md
    notes: Host-neutral provider execution primitives
  - type: contract
    path: agent-contract/inner/edge-node-runtime-wire.md
    notes: Edge-Node registration, execution, tunnel, cancellation, command, and refresh wire
  - type: code
    path: packages/go/execution/types.go
    notes: Provider execution and event types
  - type: code
    path: apps/node/internal/node/runtime_bridge.go
    notes: Protobuf-to-execution translation
  - type: code
    path: apps/edge/internal/service/provider_tunnel.go
    notes: Provider selection, credential binding validation, lease acquisition, and pre-send fencing
  - type: code
    path: apps/node/internal/node/tunnel_handler.go
    notes: Provider tunnel handling and recipient-sealed credential lease consumption
  - type: code
    path: packages/go/credentiallease/envelope.go
    notes: Signed scope validation, recipient sealing, expiry, replay, and exact binding verification
  - type: test
    path: apps/node/internal/node/command_test.go
    notes: Closed provider commands, correlation, and cancellation regressions
---

# Edge-Node Provider Execution

## Current implementation

Edge owns provider selection, queue admission, leases, and connection-generation fencing. Node owns local provider adapters and executes normalized runs or provider HTTP tunnels after a ready handshake.

The shared `packages/go/execution` package contains provider lifecycle, registry, execution events, failures, cancellation, usage, and optional tunnel/command primitives. It does not manage host programs or durable conversation state.

## Runtime rules

- A registered Node is not dispatchable until its current connection completes readiness.
- `adapter + target` selects provider execution.
- `session_id` is copied through events and command results as opaque correlation only.
- Every run is independent, including repeated correlation values.
- Cancellation requires `run_id` and affects that run only.
- Node commands are limited to capabilities, transport status, and the Ollama API tunnel.
- Run and tunnel streams preserve ordering and exactly one terminal outcome.
- Provider usage, capacity, queue pressure, lifecycle, reconnect, and tool calling remain supported.
- Managed mode requires CA-validated Edge and Node workload identities before registration or dispatch.
- Edge binds the selected principal, route, slot, profile, upstream target, Node recipient, revisions, and projection generation before acquiring a short-lived sealed lease.
- Node opens the lease only after adapter-capacity admission and immediately before provider execution, injects the declared auth header in memory, and zeroes plaintext afterward.
- Revoked, disabled, expired, stale, replayed, wrong-recipient, or mismatched leases fail closed without provider or credential fallback.

## Removed ownership

IOP no longer provides persistent shell sessions, terminal emulation, process resume, local working-directory execution context, arbitrary host commands, or local quota/status probing.

## Verification

- `go test -count=1 ./packages/go/execution ./apps/node/... ./apps/edge/internal/service`
- `go test -race -count=1 ./packages/go/execution ./apps/node/internal/node ./apps/edge/internal/service`