SaladDay · Oct 11, 2026 · Oct 11, 2026 · Oct 11, 2026
diff --git a/Makefile b/Makefile
@@ -83,6 +83,7 @@ check-core-packages:
 	go test $$packages -count=1 -timeout=20m
 	PYTHONDONTWRITEBYTECODE=1 python3 -m unittest discover -s services/core/tests -p 'official_diagnostics_test.py'
 	PYTHONDONTWRITEBYTECODE=1 python3 services/core/deploy/e2b/managed_init_test.py
+	PYTHONDONTWRITEBYTECODE=1 python3 services/core/internal/workspacefs/nfs/quota/helper_test.py
 
 # Integration tests run serially and include bounded lifecycle waits that together exceed Go's 10m default.
 # OAC_CORE_INTEGRATION_SHARD=INDEX/TOTAL runs one deterministic partition; unset runs them all.

diff --git a/contracts/agents-api/admin-api.md b/contracts/agents-api/admin-api.md
@@ -42,9 +42,9 @@ Paths are relative to `/core/v1`.
 
 ## Workspace storage
 
-Operator scripts use `GET /core/v1/workspace-storage` and `PUT /core/v1/workspace-storage` with a Core key. Web has no workspace storage editor. The request and successful response use the canonical filesystem configuration: `{"id":"<canonical UUID>","adapter":"<adapter identifier>","parameters":{...}}`. `parameters` is an adapter-owned JSON object; the selected adapter validates it. Unknown top-level fields are rejected.
+Operator scripts use `GET /core/v1/workspace-storage` and `PUT /core/v1/workspace-storage` with a Core key. Web has no workspace storage editor. The successful response is the selection: `{"id":"<canonical UUID>","adapter":"<adapter identifier>","parameters":{...},"tenant_capacity_mib":<integer>}`. The request has the same required fields and an optional write-only `credential` object. `parameters` and `credential` are adapter-owned JSON objects; the selected adapter validates them. Unknown top-level fields are rejected.
 
-GET returns the selected configuration, or 404 `workspace_storage_not_found` when none is configured. PUT validates and selects an immutable configuration and returns it with 200. Reusing an ID requires identical adapter configuration; changing its meaning or conflicting with retained ownership returns 409 `workspace_storage_conflict`. Configuration changes are serialized with workspace ownership changes, and successful mutations carry the same administrator audit provenance as other deployment settings. The [workspace filesystem protocol](../../docs/workspace-provider.md) owns identity, attachment, admission and retention semantics.
+GET returns the selected configuration and tenant capacity policy, or 404 `workspace_storage_not_found` when none is configured. It never returns a credential. PUT validates and selects an immutable configuration together with [`tenant_capacity_mib`](../../docs/configuration.md#tenant-capacity) and returns the selection with 200. A positive `tenant_capacity_mib` requires a configuration that enforces capacity quotas, and such a configuration requires a positive value; otherwise PUT returns 400 `workspace_operation_unsupported`. Core encrypts the credential and never returns, logs or audits it. Reusing an ID requires identical adapter, parameters and credential; omitting `credential` keeps the stored one, and an explicit `null` is invalid. Changing its meaning or conflicting with retained ownership returns 409 `workspace_storage_conflict`. Configuration changes are serialized with workspace ownership changes, and successful mutations carry the same administrator audit provenance as other deployment settings. The [workspace filesystem protocol](../../docs/workspace-provider.md) owns identity, attachment, admission and retention semantics.
 
 Invalid configuration returns 400 `invalid_workspace_configuration`; unsupported adapters or combinations return 400 `workspace_operation_unsupported`. Unavailable storage or an unconfirmed operation returns 503 `workspace_storage_unavailable`. Error messages do not expose native paths or adapter error text. The endpoint configures storage independently of Sandbox Provider selection; it does not create or delete a Session workspace.
 

diff --git a/contracts/agents-api/core.openapi.yaml b/contracts/agents-api/core.openapi.yaml
@@ -830,6 +830,25 @@ definitions:
       - status
       - turn_id
     type: object
+  api.WorkspaceStorageInput:
+    properties:
+      adapter:
+        type: string
+      credential:
+        type: object
+      id:
+        format: uuid
+        type: string
+      parameters:
+        type: object
+      tenant_capacity_mib:
+        type: integer
+    required:
+      - adapter
+      - id
+      - parameters
+      - tenant_capacity_mib
+    type: object
   coremetrics.Database:
     properties:
       ping_ms:
@@ -3836,20 +3855,6 @@ definitions:
     type: string
     x-enum-varnames:
       - AttachmentHostDirectory
-  workspacefs.Configuration:
-    properties:
-      adapter:
-        type: string
-      id:
-        format: uuid
-        type: string
-      parameters:
-        type: object
-    required:
-      - adapter
-      - id
-      - parameters
-    type: object
   workspacefs.Declaration:
     properties:
       attachment:
@@ -3863,6 +3868,23 @@ definitions:
       - capacity_quota
       - user_xattr
     type: object
+  workspaces.Selection:
+    properties:
+      adapter:
+        type: string
+      id:
+        format: uuid
+        type: string
+      parameters:
+        type: object
+      tenant_capacity_mib:
+        type: integer
+    required:
+      - adapter
+      - id
+      - parameters
+      - tenant_capacity_mib
+    type: object
   writeaudit.APIKey:
     properties:
       id:
@@ -7432,14 +7454,14 @@ paths:
         - Core Administration
   /core/v1/workspace-storage:
     get:
-      description: Core key only. Returns the immutable selected filesystem configuration. No configuration returns 404.
+      description: Core key only. Returns the immutable selected filesystem configuration and the tenant capacity policy, never a credential. No configuration returns 404.
       produces:
         - application/json
       responses:
         "200":
           description: OK
           schema:
-            $ref: '#/definitions/workspacefs.Configuration'
+            $ref: '#/definitions/workspaces.Selection'
         "400":
           description: Bad Request
           schema:
@@ -7472,21 +7494,21 @@ paths:
     put:
       consumes:
         - application/json
-      description: Core key only. Selects an immutable filesystem configuration. Reusing an ID requires the same adapter and parameters; conflicting ownership returns 409.
+      description: Core key only. Selects an immutable filesystem configuration and the tenant capacity policy in one change. Reusing an ID requires the same adapter, parameters and credential; an omitted credential retains the stored one. A positive tenant_capacity_mib requires, and is required by, a configuration that enforces capacity quotas. Conflicting ownership returns 409.
       parameters:
-        - description: Immutable workspace storage configuration
+        - description: Workspace storage selection
           in: body
           name: body
           required: true
           schema:
-            $ref: '#/definitions/workspacefs.Configuration'
+            $ref: '#/definitions/api.WorkspaceStorageInput'
       produces:
         - application/json
       responses:
         "200":
           description: OK
           schema:
-            $ref: '#/definitions/workspacefs.Configuration'
+            $ref: '#/definitions/workspaces.Selection'
         "400":
           description: Bad Request
           schema:

diff --git a/contracts/agents-api/index.md b/contracts/agents-api/index.md
@@ -125,6 +125,7 @@ Each item is Core's deliberate or native behavior where the official service beh
 
 **Environments and Templates**
 
+- Hosted workspace admission is limited by the [tenant capacity policy](../../docs/configuration.md#tenant-capacity) and the existing [input reservation deadline](./environments.md#reservations).
 - Runtimes do not enforce `disabled` or `restricted` networks, so Sessions that need them are rejected ([restricted network policy](./environments.md#restricted-network)).
 - `packages.system` is rejected; system packages must be preinstalled.
 - Cold continuation does not restore process memory, background processes or temporary system-disk changes; completed setup is not replayed. See [Environment persistence](./environments.md#runtime-capability-preparation). Cross-node memory restoration and takeover of an unconfirmed old writer are not qualified.

diff --git a/contracts/agents-api/sandbox-deployment.md b/contracts/agents-api/sandbox-deployment.md
@@ -48,7 +48,7 @@ The request has no Core address. Core derives the deployment's `core_url` from t
 | `cpus` | Integer, 1 through 255 |
 | `memory_mib` | Integer, 512 through 1048576 MiB |
 | `root_disk_mib` | microsandbox: at least 1024 MiB; Docker and E2B: omitted or zero |
-| `environment_disk_mib` | microsandbox owned disk: at least 1024 MiB; external filesystem: zero requests no quota; a positive value must be at least 1024 MiB and requires enforced quotas; Docker and E2B: omitted or zero |
+| `environment_disk_mib` | microsandbox owned disk: at least 1024 MiB; external filesystem: each new workspace's admitted capacity, where zero requests no quota and a positive value must be at least 1024 MiB and requires enforced quotas; Docker and E2B: omitted or zero |
 
 These limits describe each sandbox. A node's `max_active` and `max_retained` are separate reservation limits, and host measurements never permit exceeding either. Native providers may reject values that pass these bounds.
 
@@ -58,7 +58,7 @@ microsandbox configures the CPUs, memory, a managed root disk and a separate own
 
 The optional response `specification.workspace` is an immutable capability receipt derived from the selected [workspace filesystem](../../docs/workspace-provider.md), not an independently writable setting. It contains only `attachment`, `user_xattr` and `capacity_quota`; filesystem configuration, paths and credentials stay outside the sandbox specification. Core validates the combined declarations before saving, and retained generation validation and node construction use this receipt. Missing `workspace` preserves owned disk mode, including its existing disk bounds. Create and Resume must provide a binding exactly when the frozen generation selects external storage.
 
-To enable external storage for an existing owned deployment, select the filesystem configuration first, then update the sandbox deployment with compatible resources (`environment_disk_mib: 0` for a filesystem without quotas). Selecting the filesystem does not alter existing generations or allocations. The next sandbox update derives the external receipt; old owned allocations keep their owned disks. A filesystem selection must support the provider's declared requirements, and an already external deployment requires an equivalent declaration with compatible quota semantics.
+To enable external storage for an existing owned deployment, select the filesystem configuration first, then update the sandbox deployment with compatible resources (`environment_disk_mib: 0` for a filesystem without quotas). Selecting the filesystem does not alter existing generations or allocations. The next sandbox update derives the external receipt; old owned allocations keep their owned disks. A filesystem selection must support the provider's declared requirements. An already external deployment requires the same `attachment` and `user_xattr`; the selection may change `capacity_quota`, after which new workspaces are refused until a sandbox update sets a matching `environment_disk_mib`. Existing workspaces keep the capacity they were admitted with.
 
 ### Runtime release
 
@@ -142,7 +142,7 @@ A node is online while it is connected under the current owner epoch with a hear
 
 Each node adds `rollout: {state, ready_generation, diagnostic?}`, where `ready_generation` is the nullable durable serving pin and `diagnostic` a fixed code for the target generation; allocation items add `deployment_generation`. Poll every five seconds only while `rollout.state` is `preparing` or `reset` is not null; old Sessions and failed, update-required or offline nodes alone do not keep polling active.
 
-Node-backed creation validates the target deployment and commits the Session, pending Environment and any initial input without reserving compute. A full, offline or preparing fleet leaves that accepted work waiting; an unconfigured deployment, reset or unsupported combination still rejects admission. The common scheduler uses bounded rotating scans of unplaced demand, with pages ordered by recorded time and Environment ID and a fixed time boundary for each scan so continuous arrivals cannot prevent it from revisiting older work. It checks online presence, exact serving-generation readiness, address, shared capacity and the selected generation's Harness/filesystem compatibility, then prefers the newest qualifying pin. Placement is immutable once reserved until confirmed release or a settled checkpoint transfer. A bounded scan skips temporarily unavailable demand and resumes after a restart. Existing suspended allocations reserve eligible checkpoint capacity through the same lock under the [checkpoint transfer contract](../../docs/sandbox-provider.md#checkpoint-transfer); this is not a global fairness guarantee across hot restores and unplaced work. Input retains its [original five-minute deadline](./environments.md#reservations), including time waiting for capacity.
+Node-backed creation validates the target deployment and commits the Session, pending Environment and any initial input without reserving compute. A full, offline or preparing fleet leaves that accepted work waiting; an unconfigured deployment, reset or unsupported combination still rejects admission. The common scheduler uses bounded rotating scans of unplaced demand, with pages ordered by recorded time and Environment ID and a fixed time boundary for each scan so continuous arrivals cannot prevent it from revisiting older work. It checks online presence, exact serving-generation readiness, address, shared capacity and the selected generation's Harness/filesystem compatibility, then prefers the newest qualifying pin. Placement is immutable once reserved until confirmed release or a settled checkpoint transfer. A bounded scan skips temporarily unavailable demand and resumes after a restart. If preparation fails before a new allocation is reserved, Core releases only that attempt’s node reservation, retaining any filesystem identity. Its next placement demand is ordered no earlier than release time, behind already-waiting work; successful retries use the newly selected generation’s specification. An allocation with an unknown compute outcome keeps its reservation. Existing suspended allocations reserve eligible checkpoint capacity through the same lock under the [checkpoint transfer contract](../../docs/sandbox-provider.md#checkpoint-transfer); this is not a global fairness guarantee across hot restores and unplaced work. Input retains its [original five-minute deadline](./environments.md#reservations), including time waiting for capacity.
 
 ## Reset
 

diff --git a/contracts/agents-api/zh/admin-api.md b/contracts/agents-api/zh/admin-api.md
@@ -1,7 +1,7 @@
 ---
 title: "Core 管理 API"
 source: contracts/agents-api/admin-api.md
-source_hash: 9687c874ba9e39dbceeb6f2206aff8e5163309a381262955ca247c67aa10455c
+source_hash: 4538ac64f7aee138b27b98f7f33542230d0b21a4fc183dc375fe0803833ac0d6
 ---
 
 Core 管理 API（`/core/v1`）用于管理安装实例：Project 及其 API 密钥、Project 资源的读取和删除、执行器凭据、部署默认模型、沙箱部署及其节点、监控和审计。Web 的[控制台服务器](../../../docs/zh/web/console-server.md#forwarding-to-core)会为已登录的管理员调用它；运维人员则从 Core 主机上的脚本调用它（[编写 Core API 脚本](../../../docs/zh/getting-started/operations.md#script-the-core-api)）。生成的架构是 [core.openapi.yaml](../core.openapi.yaml)，所有错误都使用 [Core 错误封装](core-errors.md)。
@@ -44,9 +44,9 @@ Core 管理 API（`/core/v1`）用于管理安装实例：Project 及其 API 密
 
 ## 工作区存储 {#workspace-storage}
 
-运维脚本使用 Core key 调用 `GET /core/v1/workspace-storage` 和 `PUT /core/v1/workspace-storage`。Web 没有工作区存储编辑器。请求与成功响应使用规范文件系统配置：`{"id":"<canonical UUID>","adapter":"<adapter identifier>","parameters":{...}}`。`parameters` 是适配器定义的 JSON 对象，由所选适配器验证。未知顶层字段会被拒绝。
+运维脚本使用 Core key 调用 `GET /core/v1/workspace-storage` 和 `PUT /core/v1/workspace-storage`。Web 没有工作区存储编辑器。成功响应为选择结果：`{"id":"<canonical UUID>","adapter":"<adapter identifier>","parameters":{...},"tenant_capacity_mib":<integer>}`。请求包含相同的必需字段，以及可选的只写 `credential` 对象。`parameters` 和 `credential` 是适配器定义的 JSON 对象，由所选适配器验证。未知顶层字段会被拒绝。
 
-GET 返回所选配置；尚未配置时返回 404 `workspace_storage_not_found`。PUT 验证并选择不可变配置，以 200 返回该配置。复用 ID 要求适配器配置完全一致；更改其含义或与保留归属冲突会返回 409 `workspace_storage_conflict`。配置更改与工作区归属变更串行执行，成功变更携带与其他部署设置相同的管理员审计来源。[工作区文件系统协议](../../../docs/zh/workspace-provider.md) 规定标识、挂载、准入和保留语义。
+GET 返回所选配置和租户容量策略；尚未配置时返回 404 `workspace_storage_not_found`。它绝不返回凭据。PUT 验证并选择不可变配置，同时设置 [`tenant_capacity_mib`](../../../docs/zh/configuration.md#tenant-capacity)，以 200 返回选择结果。正的 `tenant_capacity_mib` 要求实施容量配额的配置，此类配置也要求正值；否则 PUT 返回 400 `workspace_operation_unsupported`。Core 加密凭据，绝不返回、记录日志或审计凭据。复用 ID 要求适配器、参数和凭据完全一致；省略 `credential` 会保留已存储的凭据，显式 `null` 无效。更改其含义或与保留归属冲突会返回 409 `workspace_storage_conflict`。配置更改与工作区归属变更串行执行，成功变更携带与其他部署设置相同的管理员审计来源。[工作区文件系统协议](../../../docs/zh/workspace-provider.md) 规定标识、挂载、准入和保留语义。
 
 无效配置返回 400 `invalid_workspace_configuration`；不支持的适配器或组合返回 400 `workspace_operation_unsupported`。存储不可用或操作尚未确认返回 503 `workspace_storage_unavailable`。错误消息不暴露原生路径或适配器错误文本。此端点独立于 Sandbox Provider 选择配置存储，不创建或删除 Session 工作区。
 

diff --git a/contracts/agents-api/zh/index.md b/contracts/agents-api/zh/index.md
@@ -1,7 +1,7 @@
 ---
 title: "Agents API 覆盖台账"
 source: contracts/agents-api/index.md
-source_hash: 37355fa7100a2610ef727a3bb28f028d175be1b48b2d9f81c89b40f14cf17aef
+source_hash: ddc93473d2f9acf6623072b3245b1dc244109f8fc597ef097e25d7ddf07cf392
 ---
 
 Core 旨在以下方固定版本为准支持完整的 OpenAI Agents API（[public API rule](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/AGENTS.md#public-api)）。本台账记录 Core 对各项资源实现了哪些内容、哪些契约保存其详细信息，并列出相对于 OpenAI 服务的所有已知差异和所有未解决缺口。[API namespaces and credentials](../../../docs/zh/api/index.md) 说明谁调用哪些 API；[Agents API guide](../../../docs/zh/api/public-agent-api.md) 介绍使用方法。
@@ -128,6 +128,7 @@ Core 自身字段位于 `x_agents_core` 中（[Core extensions](../../../docs/zh
 
 **Environments 和 Templates**
 
+- Hosted 工作区准入受[租户容量策略](../../../docs/zh/configuration.md#tenant-capacity)及既有[输入预留截止时间](environments.md#reservations)限制。
 - Runtime 不会实施 `disabled` 或 `restricted` 网络，因此需要这些网络的 Session 会被拒绝（[restricted network policy](environments.md#restricted-network)）。
 - `packages.system` 会被拒绝；系统软件包必须预先安装。
 - 冷续接不恢复进程内存、后台进程或临时系统盘修改；已完成的 setup 不会重放。参见 [Environment 持久化](environments.md#runtime-capability-preparation)。跨节点内存恢复及接管未确认停止的旧写入者尚未通过资格验证。