diff --git a/vm/ai-env/ai.env b/vm/ai-env/ai.env
index 9e86d81..a806c9a 100644
--- a/vm/ai-env/ai.env
+++ b/vm/ai-env/ai.env
@@ -19,6 +19,11 @@ ANTHROPIC_FEDERATION_RULE_ID=fdrl_01NYa2DRXZMrWhqDC5uNP3Yy
 ANTHROPIC_ORGANIZATION_ID=fc82f31f-51c4-4416-95f5-62584092e1bc
 ANTHROPIC_SERVICE_ACCOUNT_ID=svac_01RMQAkUx4vD6X5scTxwmebU
 ANTHROPIC_WORKSPACE_ID=wrkspc_0149qfHWmbEEBmEh4aL2vHjw
+# external-* model ids (apps b0ff118, reference runs 2026-10-16): each loop turn is answered by a client outside the VM
+# over the 127.0.0.1:8090 listener (compose EXTERNAL_ADDR). Deadlines: one diagnosis / one turn, seconds. The harness
+# waits 26 minutes per /diagnose for these ids. Results are reference records, not rows of the model comparison.
+EXTERNAL_DIAGNOSE_TIMEOUT_S=1500
+EXTERNAL_TURN_TIMEOUT_S=1200
 HARNESS_URL=http://10.20.0.11:8080
 MIMIR_URL=http://10.20.0.10:9009/prometheus
 LOKI_URL=http://10.20.0.10:3100
diff --git a/vm/ai-env/compose.yaml b/vm/ai-env/compose.yaml
index 81f8127..6ed23a2 100644
--- a/vm/ai-env/compose.yaml
+++ b/vm/ai-env/compose.yaml
@@ -16,12 +16,14 @@ services:
       K8S_CA_FILE: /run/secrets/k8s-ca.crt
       PROMPT_DIR: /etc/ai/prompts
       RUNBOOK_DIR: /etc/ai/runbooks
+      EXTERNAL_ADDR: ":8090"   # external-* model ids: turns served to a client outside the VM (reference runs)
     volumes:
       - /opt/selfheal/ai/secrets:/run/secrets:ro
       - ./prompts:/etc/ai/prompts:ro
       - ./runbooks:/etc/ai/runbooks:ro
     ports:
       - "8080:8080"
+      - "127.0.0.1:8090:8090"   # external responder: host-local only, reached through the IAP SSH tunnel (a reply is a diagnosis)
     depends_on: [rag-db]
   hitl:
     image: asia-northeast1-docker.pkg.dev/cms-d-414903/selfheal-public/ai-hitl:${AI_TAG}
diff --git a/vm/ai-env/image.tag b/vm/ai-env/image.tag
index 21e3a63..db54e06 100644
--- a/vm/ai-env/image.tag
+++ b/vm/ai-env/image.tag
@@ -1 +1 @@
-f671e24
+b0ff118
diff --git a/vm/harness/image.tag b/vm/harness/image.tag
index f04c8c4..40fe2af 100644
--- a/vm/harness/image.tag
+++ b/vm/harness/image.tag
@@ -1 +1 @@
-85d9932
+ed3d41d