Legacy agent and VM migration reference

Lobstack retired the hosted agent-VM product on 11 September 2026. A legacy runtime was a long-running process on a dedicated VM that held credentials and called the Gateway on an agent's behalf. No new VM is created, and the old provisioning, fleet and runtime APIs are not migration targets.

For a current integration, start with API keys, then see Gateway concepts, metering and errors for the live contract.

Retired credentials

gateway_token was a per-agent bearer credential stored by its hash on the agent row. It remains readable in historical traces as the gateway_token principal, but new clients should mint a scoped, revocable lsk_… API key instead.

The older x-agent-secret plus x-agent-id pair was the shared runtime credential. It was retired on 17 October 2026 and is no longer accepted; older trace rows may show it as agent_secret.

Agent bindings and agent_instances

Keys could once be bound to an agent row and inherit its model, provider key and mode. Binding new keys is retired. Existing historical bindings explain why some usage records carry an agent_id; an org-level API key has no agent id.

The agent_instances table survives because it is still the billing and compatibility record used to resolve plan data for older callers. It is not a machine record now. Fields such as server_tier and region describe the retired product and should not be used to provision or size infrastructure.

Older execution modes

direct meant that the runtime called a provider itself, outside the Gateway. It is retained on historical ledger and trace rows for interpretation only. Current Gateway calls use managed or byok; see Models & providers for current provider-key behavior.

The agents:read and agents:write scopes are vestigial compatibility grants for existing keys. They do not restore the retired runtime routes.