Skip to main content
The Runtime screen lists the sandbox workers leased to the active organization. A sandbox worker is the per-session agent-worker process a workerMode: "sandbox" profile boots. It binds no port and never registers with the sidecar registry, so it is invisible to fleet-level topology, and this screen is the only place it appears. It reads GET /api/worker/leases, which is scoped to the caller’s tenant and paginated. The table lists each worker’s session, runtime, substrate, lease state, age, and worker ID. Select a row to open its detail tray.
The runner table that used to lead this page has been removed. It was built on GET /api/topology, which reports the fleet rather than one tenant’s slice of it, and a tenant has no action to take on a runner. The /api/topology endpoint itself is unchanged and still serves the SDKs.

​
Lease state

Lease state is read live from the substrate, so it reflects a sandbox stopped or deleted outside Orca. It answers what the next message to that session will do:
  • Running serves it immediately.
  • Paused resumes first, and the conversation survives. This is where an idle session normally rests, so it is not a fault.
  • Gone launches a replacement worker, which starts without the earlier conversation.
  • Starting is still booting. Unknown means the substrate could not be reached, which is not the same as gone.
State describes the substrate lease, not the worker process inside it: a substrate keeps the sandbox up after a worker crashes so its log survives.

​
Reading the page

  • The Sandbox workers headline figure comes from the X-Total-Count header, which counts every lease this tenant holds on the runners that answered within the conductor’s fan-out window. On a multi-runner deployment a runner that does not answer in time is omitted, so the total is a floor rather than a census. Single-runner deployments never hit that path.
  • Ready to serve, Runtimes, and Substrates are computed from the rows currently on screen. When the workspace has more workers than one page holds, those figures are labelled on this page rather than presented as workspace totals.
  • The state chips beside the table header tally the visible page for the same reason.
  • -- means the backend returned nothing for that value. It is not a measured zero.
  • Session and worker IDs are truncated in the table; hover for the full value. Substrate worker IDs are useless without credentials for the substrate that issued them, which is why they are shown at all.

​
Detail tray

Selecting a row opens a tray that re-reads that session through GET /api/sessions/{id}/worker rather than echoing the row. The list refreshes underneath an open tray, so a worker whose session has since ended reports No worker leased instead of leaving a stale snapshot on screen. There are no controls in the tray. A worker’s lifecycle follows its session: the session’s first run launches it, and shutdown closes it. Idle pausing is what keeps an unused worker from being billed.

​
Refresh behavior

The lease list refreshes every 10 seconds, and the tray refreshes on the same interval. This reads runner lease state, which costs one liveness check per worker (a docker inspect on the docker substrate). Refresh forces a read immediately. Because workers disappear on their own when their session ends, the page clamps to the last page that still has rows rather than leaving an empty table under a footer offering a page that no longer exists.