Execution Backend Conformance
Read this if: you are implementing or reviewing an execution backend for Tyrum.
Skip this if: you only need the high-level turn lifecycle; start with Agent Loop.
Go deeper: Transcript, Conversation State, and Prompt Context and Tools.
This reference specifies the observable behavior every execution backend must provide, independently of its harness implementation.
Parent concept
Scope
These criteria define backend conformance at the Tyrum execution port. They cover transcript durability, streaming, approvals, harness continuity, and tool observations. They do not prescribe harness internals or continuity-file formats.
Normative conformance criteria
| # | Criterion | Observable check |
|---|---|---|
| 1 | Text turn | Reply persisted in the Tyrum transcript |
| 2 | Streaming | Partial output + tool-activity notices on chat.ui-message.stream |
| 3 | Approval | require_approval pauses the call; approve resumes, deny reaches the model |
| 4 | Transcript independence | History readable after harness continuity files are deleted |
| 5 | Resume | Same harness context continues; fresh-context recovery seeds from the conversation-state checkpoint |
| 6 | Tool surface + observation | No adapter-level tool lists; gated calls need durable approval; auto-allowed calls still hit the transcript |
- Text turn. Given a prompt, the backend MUST complete a text turn whose reply is persisted in the Tyrum transcript.
- Streaming. The backend MUST make partial output visible in web chat through
chat.ui-message.stream, including tool-activity notices. - Approval. When policy returns
require_approval, the backend MUST pause the harness tool call until a durable approval is resolved. Operator approval MUST resume the call, and operator denial MUST propagate to the model. - Transcript independence. The full conversation history MUST remain readable from Tyrum after harness-side continuity files are deleted.
- Resume. A second message MUST continue the same harness execution context. When continuity files are missing, fresh-context recovery MUST seed the harness from Tyrum's conversation-state checkpoint.
- Full tool surface and observation tap. The adapter MUST NOT impose adapter-level tool restrictions. A state-changing call MUST execute only after its durable approval is resolved; a denial MUST propagate to the model as a message; and auto-allowed read-only calls MUST still appear in the transcript through the backend's observation channel.
Constraints and edge cases
- Passing one criterion does not compensate for failing another; a backend is conformant only when all six criteria pass.
- Harness continuity state is an optimization and continuity aid, not the durable source of transcript truth.
- Backend-specific policy or tool filtering cannot replace Tyrum's durable policy and approval boundary.
Operational notes
- Run the shared conformance suite against each backend implementation before declaring it available.
- Treat deletion of harness-side continuity files as a required recovery test, not as a destructive operation against Tyrum state.