@intentic/sandbox-contract 1.311.0 → 1.313.0

package/src/models/plan-pools.test.ts

@@ -1,5 +1,18 @@
-import { bindingWindow, gatesModel, gatingWindows, scopedWindow, windowLive, windowPeriod } from "./plan-pools.js";
-import type { AccountUsage, UsageWindow } from "../schemas/providers/plan-limits.js";
+import {
+    bindingWindow,
+    gatesModel,
+    gatingWindows,
+    headroomState,
+    preferredAccount,
+    refusalVerdict,
+    roomiestAccount,
+    scopedWindow,
+    serviceState,
+    serviceStates,
+    windowLive,
+    windowPeriod,
+} from "./plan-pools.js";
+import type { AccountState, AccountUsage, ProviderRefusal, UsageWindow } from "../schemas/providers/plan-limits.js";
 
 // One rule for which pool blocks a given model, shared by the daemon and the browser: a plan can meter models
 // separately, so the account's fullest pool need not be the model's own.
@@ -102,3 +115,109 @@ test("a reading is live until its reset, or, with none published, for one window
     // And a pool whose length nothing names has only its reset instant; without one it stands.
     expect(windowLive(window({ kind: "claude:tangelo" }), NOW - 400 * HOUR, NOW)).toBe(true);
 });
+
+// Serviceability: the one verdict on whether an account can serve a turn.
+
+const at = (measuredAt: number, ...windows: UsageWindow[]): AccountUsage => ({ windows, measuredAt });
+const refusal = (over: Partial<ProviderRefusal> & Pick<ProviderRefusal, "kind">): ProviderRefusal => ({ at: 1_000, message: "no.", ...over });
+
+test("spent is the contract's one line: 99.5% still has room, 100% is spent until its last full pool reopens", () => {
+    expect(headroomState(usage(window({ kind: "five_hour", utilization: 99.5 })))).toEqual({ kind: "ready", room: 0.5 });
+    expect(
+        headroomState(usage(window({ kind: "five_hour", utilization: 100, resetsAt: 50 }), window({ kind: "seven_day", utilization: 100, resetsAt: 900 }))),
+    ).toEqual({ kind: "spent", reopensAt: 900 });
+    expect(headroomState(usage(window({ kind: "five_hour", utilization: 100 })))).toEqual({ kind: "spent" });
+    expect(headroomState(undefined)).toEqual({ kind: "unknown" });
+    expect(headroomState(CLAUDE, { id: "claude-haiku-4-5" })).toEqual({ kind: "ready", room: 70 });
+    expect(headroomState(CLAUDE, { id: "claude-opus-4-6" })).toEqual({ kind: "spent" });
+});
+
+test("with no model named, an account is spent only when no model can run on it", () => {
+    // A full Opus slice leaves every other model the room of the fullest pool still open.
+    expect(headroomState(CLAUDE)).toEqual({ kind: "ready", room: 70 });
+    expect(headroomState(GOOGLE)).toEqual({ kind: "ready", room: 73 });
+    // A pool gating every model, full: nothing runs, and it reopens with that pool.
+    expect(headroomState(usage(window({ kind: "seven_day", utilization: 100, resetsAt: 900 }), window({ kind: "model:Opus", utilization: 10, gates: { models: ["Opus"] } })))).toEqual({
+        kind: "spent",
+        reopensAt: 900,
+    });
+    // Every slice full: the first to reopen lets some model run again.
+    expect(
+        headroomState(
+            usage(
+                window({ kind: "g", utilization: 100, resetsAt: 500, gates: { models: ["gemini"] } }),
+                window({ kind: "c", utilization: 100, resetsAt: 800, gates: { models: ["claude"] } }),
+            ),
+        ),
+    ).toEqual({ kind: "spent", reopensAt: 500 });
+});
+
+test("a revoked sign-in outranks a lost seat, which outranks a bench, whatever the meters say", () => {
+    const facts = { account: "a", usage: usage(window({ kind: "five_hour", utilization: 0 })) };
+    expect(serviceState({ ...facts, needsReauth: true, seatRefusal: "no seat" })).toEqual({ kind: "blocked", fix: "reconnect", reason: "sign-in expired" });
+    expect(serviceState({ ...facts, seatRefusal: "Your org disabled Claude Code." })).toEqual({
+        kind: "blocked",
+        fix: "admin",
+        reason: "Your org disabled Claude Code.",
+    });
+    expect(serviceState({ ...facts, cooling: { reason: "no project" } })).toEqual({ kind: "blocked", fix: "reconnect", reason: "no project" });
+    expect(serviceState({ ...facts, cooling: { until: 2_000 } }, undefined, undefined, 1_000_000)).toEqual({
+        kind: "blocked",
+        fix: "wait",
+        reason: "cooling down",
+        until: 2_000,
+    });
+    // A bench whose instant has passed is over.
+    expect(serviceState({ ...facts, cooling: { until: 999 } }, undefined, undefined, 1_000_000)).toEqual({ kind: "ready", room: 100 });
+});
+
+test("a standing refusal blocks by its kind, and a limit refusal pins only the pool its model spends", () => {
+    const facts = { account: "a", usage: CLAUDE };
+    expect(serviceState(facts, refusal({ kind: "auth" }))).toEqual({ kind: "blocked", fix: "reconnect", reason: "no." });
+    expect(serviceState(facts, refusal({ kind: "entitlement" }))).toEqual({ kind: "blocked", fix: "admin", reason: "no." });
+    // Refused on Haiku: the 5-hour/weekly binding pool (seven_day, 30%) reads full, so Haiku is spent too.
+    expect(serviceState(facts, refusal({ kind: "limit", model: "claude-haiku-4-5" }), { id: "claude-haiku-4-5" })).toEqual({ kind: "spent" });
+    // Refused on Opus: its own slice was already full; Haiku keeps the room its pools show.
+    expect(serviceState(facts, refusal({ kind: "limit", model: "claude-opus-4-6" }), { id: "claude-haiku-4-5" })).toEqual({ kind: "ready", room: 70 });
+    // No reading at all: the refusal is the evidence, unless it was about another model.
+    expect(serviceState({ account: "a" }, refusal({ kind: "limit" }))).toEqual({ kind: "spent" });
+    expect(serviceState({ account: "a" }, refusal({ kind: "limit", model: "opus" }), { id: "haiku" })).toEqual({ kind: "unknown" });
+});
+
+test("a refusal stands until a later reading contradicts it, and never past its account's disconnection", () => {
+    const room = at(2_000, window({ kind: "five_hour", utilization: 40 }));
+    const full = at(2_000, window({ kind: "five_hour", utilization: 100 }));
+    const before = at(500, window({ kind: "five_hour", utilization: 40 }));
+    expect(refusalVerdict(refusal({ kind: "limit", account: "a" }), [{ account: "a", usage: room }])).toBe("answered");
+    expect(refusalVerdict(refusal({ kind: "limit", account: "a" }), [{ account: "a", usage: full }])).toBe("standing");
+    expect(refusalVerdict(refusal({ kind: "limit", account: "a" }), [{ account: "a", usage: before }])).toBe("standing");
+    // Another account's room proves nothing about the one refused.
+    expect(refusalVerdict(refusal({ kind: "limit", account: "a" }), [{ account: "a", usage: before }, { account: "b", usage: room }])).toBe("standing");
+    // A refusal naming no account is answered by any of them.
+    expect(refusalVerdict(refusal({ kind: "limit" }), [{ account: "a", usage: before }, { account: "b", usage: room }])).toBe("answered");
+    expect(refusalVerdict(refusal({ kind: "auth", account: "a" }), [{ account: "a", usage: full }])).toBe("answered");
+    expect(refusalVerdict(refusal({ kind: "auth", account: "a" }), [{ account: "a", usage: full, needsReauth: true }])).toBe("standing");
+    expect(refusalVerdict(refusal({ kind: "entitlement", account: "a" }), [{ account: "a", usage: room }])).toBe("standing");
+    expect(refusalVerdict(refusal({ kind: "limit", account: "gone" }), [{ account: "a", usage: room }])).toBe("gone");
+    expect(refusalVerdict(refusal({ kind: "limit", account: "a" }), [])).toBe("standing");
+});
+
+test("a provider's accounts are judged together: a standing refusal lands only on the account it names", () => {
+    const room = at(500, window({ kind: "five_hour", utilization: 40 }));
+    const states = serviceStates([{ account: "a", usage: room }, { account: "b", usage: room }], refusal({ kind: "entitlement", account: "a" }));
+    expect(Object.fromEntries(states)).toEqual({ a: { kind: "blocked", fix: "admin", reason: "no." }, b: { kind: "ready", room: 60 } });
+    const answered = serviceStates([{ account: "a", usage: at(2_000, window({ kind: "five_hour", utilization: 40 })) }], refusal({ kind: "limit", account: "a" }));
+    expect(answered.get("a")).toEqual({ kind: "ready", room: 60 });
+});
+
+test("an unnamed turn takes the most room, then an unmeasured account, then a spent one, and a blocked one only when that is all", () => {
+    const entry = (id: string, state: AccountState) => ({ id, state });
+    const blocked: AccountState = { kind: "blocked", fix: "admin", reason: "no seat" };
+    expect(preferredAccount([entry("seatless", blocked), entry("spent", { kind: "spent" }), entry("low", { kind: "ready", room: 5 }), entry("high", { kind: "ready", room: 60 })])?.id).toBe("high");
+    expect(preferredAccount([entry("seatless", blocked), entry("spent", { kind: "spent" }), entry("unread", { kind: "unknown" })])?.id).toBe("unread");
+    expect(preferredAccount([entry("seatless", blocked), entry("spent", { kind: "spent" })])?.id).toBe("spent");
+    expect(preferredAccount([entry("seatless", blocked), entry("other", blocked)])?.id).toBe("seatless");
+    expect(preferredAccount([entry("first", { kind: "ready", room: 60 }), entry("second", { kind: "ready", room: 60 })])?.id).toBe("first");
+    expect(roomiestAccount([entry("seatless", blocked), entry("unread", { kind: "unknown" })])).toBeUndefined();
+    expect(roomiestAccount([entry("low", { kind: "ready", room: 5 }), entry("high", { kind: "ready", room: 60 })])?.id).toBe("high");
+});

package/src/models/plan-pools.ts

@@ -1,10 +1,11 @@
-import type { AccountUsage, UsageWindow, WindowGates } from "../schemas/providers/plan-limits.js";
+import type { AccountState, AccountUsage, ProviderRefusal, UsageWindow, WindowGates } from "../schemas/providers/plan-limits.js";
 
 // Single reading of which account pool gates a given model (or, with none named, the account's tightest pool), shared
 // by the daemon's picker/refusal logic and the browser's rings and rail. A pool gated `none` is excluded from the
 // no-model case: visible to the account, never a gate on a turn.
 
-// 100 = exhaustion (the call will be refused), not the browser's 90% warning threshold (usageStatus SPENT_PERCENT).
+// 100 = exhaustion (the call will be refused). The one spent line: the daemon's pickers and every surface read it, and
+// anything short of it still has room.
 export const SPENT_UTILIZATION = 100;
 
 export interface ModelRef {
@@ -132,3 +133,152 @@ export const windowLive = (window: UsageWindow, measuredAt: number, now: number)
     const period = windowPeriod(window);
     return period === undefined || measuredAt + period.seconds * 1000 > now;
 };
+
+// Whether an account can serve a turn: the one rule every picker and surface reads (AccountState). The daemon runs it and
+// publishes the verdict on each account row; the editor runs it only on a row from a daemon older than that field.
+
+/** Everything the serviceability rule reads of one account, as the account rows already carry it. */
+export interface ServiceFacts {
+    // The daemon's key: a native account's id, a routed credential's auth-file name.
+    readonly account: string;
+    readonly needsReauth?: boolean | undefined;
+    // Why the sign-in needs renewing, where the provider said.
+    readonly detail?: string | undefined;
+    readonly seatRefusal?: string | undefined;
+    readonly cooling?: { readonly until?: number | undefined; readonly reason?: string | undefined } | undefined;
+    readonly usage?: AccountUsage | undefined;
+}
+
+// A spent allowance is over once a reading with room lands after it; a refused credential once any reading does (the
+// token worked). Nothing a reading says answers an entitlement refusal: a seatless account authenticates and reads fine.
+const answers = (refusal: ProviderRefusal, facts: ServiceFacts): boolean => {
+    const measuredAt = facts.usage?.measuredAt;
+    if (refusal.kind === "entitlement" || measuredAt === undefined || measuredAt <= refusal.at) {
+        return false;
+    }
+    if (refusal.kind === "auth") {
+        return facts.needsReauth !== true;
+    }
+    const binding = bindingWindow(facts.usage);
+    return binding !== undefined && binding.utilization < SPENT_UTILIZATION;
+};
+
+/**
+ * How a provider's last refusal stands against everything read since, over every account the provider holds: `gone` once
+ * the account it named is disconnected, `answered` once that account (or, for a refusal naming none, any account) has a
+ * later reading that contradicts it, else `standing`. An empty list is one not loaded yet, so the refusal stands.
+ */
+export const refusalVerdict = (refusal: ProviderRefusal, accounts: readonly ServiceFacts[]): "standing" | "answered" | "gone" => {
+    const named = accounts.filter((facts) => facts.account === refusal.account);
+    if (refusal.account !== undefined && named.length === 0) {
+        return accounts.length === 0 ? "standing" : "gone";
+    }
+    return (refusal.account === undefined ? accounts : named).some((facts) => answers(refusal, facts)) ? "answered" : "standing";
+};
+
+// The account reopens for this question when the pools holding it shut do: all of them for a model's own question (or
+// the pools gating every model), the first to reopen when only per-model slices are full. Unknown if any is unpublished.
+const reopening = (full: readonly UsageWindow[], first: boolean): number | undefined => {
+    const resets = full.flatMap((window) => (window.resetsAt === undefined ? [] : [window.resetsAt]));
+    return resets.length === full.length && resets.length > 0 ? (first ? Math.min(...resets) : Math.max(...resets)) : undefined;
+};
+
+const spent = (reopensAt: number | undefined): AccountState => (reopensAt === undefined ? { kind: "spent" } : { kind: "spent", reopensAt });
+
+/**
+ * The plan-limit half of the verdict, at the contract's one spent line. With a model, the pools that model spends: spent
+ * once any is full, else the room the fullest leaves. With none, whether the account can serve SOME turn: spent once a
+ * pool gating every model is full, or every per-model slice is; a full slice alone (Opus at 100%) leaves the other
+ * models their room, which is then read off the fullest pool still open.
+ */
+export const headroomState = (usage: AccountUsage | undefined, model?: ModelRef): AccountState => {
+    const windows = gatingWindows(usage, model);
+    if (windows.length === 0) {
+        return { kind: "unknown" };
+    }
+    const full = windows.filter((window) => window.utilization >= SPENT_UTILIZATION);
+    const open = windows.filter((window) => window.utilization < SPENT_UTILIZATION);
+    if (model !== undefined || full.some((window) => window.gates === "all") || open.length === 0) {
+        const holding = model !== undefined ? full : full.some((window) => window.gates === "all") ? full.filter((window) => window.gates === "all") : full;
+        if (holding.length > 0) {
+            return spent(reopening(holding, model === undefined && !holding.some((window) => window.gates === "all")));
+        }
+    }
+    return { kind: "ready", room: SPENT_UTILIZATION - Math.max(...open.map((window) => window.utilization)) };
+};
+
+// A standing limit refusal reads its pool as full, since a polled reading freezes the moment a pool actually empties: the
+// pool the refused turn's model spends, else the one asked about, else the tightest. Never another model's allowance.
+const refusedPool = (usage: AccountUsage | undefined, refusal: ProviderRefusal, model: ModelRef | undefined): AccountState => {
+    const refusedModel = refusal.model === undefined ? model : { id: refusal.model };
+    const binding = bindingWindow(usage, refusedModel);
+    if (usage === undefined || binding === undefined) {
+        // No pool to pin: the refusal itself is the evidence, unless it was about a different model than this question.
+        const sameModel = refusal.model === undefined || model === undefined || refusal.model === model.id;
+        return sameModel ? { kind: "spent" } : headroomState(usage, model);
+    }
+    const pinned = usage.windows.map((window) => (window === binding ? { ...window, utilization: Math.max(window.utilization, SPENT_UTILIZATION) } : window));
+    return headroomState({ ...usage, windows: pinned }, model);
+};
+
+/**
+ * One account's verdict. `refusal` is the provider's last refusal only when it still stands and covers this account
+ * (serviceStates decides that). Precedence: a revoked sign-in outranks a lost seat (reconnecting fixes one, nothing here
+ * fixes the other), both outrank a standing refusal, then a translator bench, then the plan limits.
+ */
+export const serviceState = (facts: ServiceFacts, refusal?: ProviderRefusal, model?: ModelRef, now: number = Date.now()): AccountState => {
+    if (facts.needsReauth === true) {
+        return { kind: "blocked", fix: "reconnect", reason: facts.detail ?? "sign-in expired" };
+    }
+    if (facts.seatRefusal !== undefined) {
+        return { kind: "blocked", fix: "admin", reason: facts.seatRefusal };
+    }
+    if (refusal?.kind === "auth") {
+        return { kind: "blocked", fix: "reconnect", reason: refusal.message };
+    }
+    if (refusal?.kind === "entitlement") {
+        return { kind: "blocked", fix: "admin", reason: refusal.message };
+    }
+    const cooling = facts.cooling;
+    // A bench with no instant is one no wait lifts (a Google account with no project): somebody has to connect again.
+    if (cooling !== undefined && cooling.until === undefined) {
+        return { kind: "blocked", fix: "reconnect", reason: cooling.reason ?? "benched by the translator" };
+    }
+    if (cooling?.until !== undefined && cooling.until * 1000 > now) {
+        return { kind: "blocked", fix: "wait", reason: cooling.reason ?? "cooling down", until: cooling.until };
+    }
+    return refusal?.kind === "limit" ? refusedPool(facts.usage, refusal, model) : headroomState(facts.usage, model);
+};
+
+/** Every account of one provider, judged together, since a refusal naming no account is answered by any of them. */
+export const serviceStates = (
+    accounts: readonly ServiceFacts[],
+    refusal: ProviderRefusal | undefined,
+    model?: ModelRef,
+    now: number = Date.now(),
+): ReadonlyMap<string, AccountState> => {
+    const standing = refusal !== undefined && refusalVerdict(refusal, accounts) === "standing" ? refusal : undefined;
+    return new Map(
+        accounts.map((facts) => [
+            facts.account,
+            serviceState(facts, standing !== undefined && (standing.account ?? facts.account) === facts.account ? standing : undefined, model, now),
+        ]),
+    );
+};
+
+// Worst last: proven room, no reading either way, known spent, and nothing a turn can run on.
+const PREFERENCE: Record<AccountState["kind"], number> = { ready: 0, unknown: 1, spent: 2, blocked: 3 };
+
+/** The account an unnamed turn runs on: ready by most room, then unmeasured, then spent, blocked only when that is all there is. Ties keep the caller's order. */
+export const preferredAccount = <T extends { readonly state: AccountState }>(entries: readonly T[]): T | undefined =>
+    entries.reduce<T | undefined>((best, next) => {
+        if (best === undefined) {
+            return next;
+        }
+        const tier = PREFERENCE[next.state.kind] - PREFERENCE[best.state.kind];
+        return tier < 0 || (tier === 0 && next.state.kind === "ready" && best.state.kind === "ready" && next.state.room > best.state.room) ? next : best;
+    }, undefined);
+
+/** The roomiest account with proven room, or none: what a move off a refused account may land on. Ties keep the caller's order. */
+export const roomiestAccount = <T extends { readonly state: AccountState }>(entries: readonly T[]): T | undefined =>
+    preferredAccount(entries.filter((entry) => entry.state.kind === "ready"));

package/src/policy/request-status.ts

@@ -1,5 +1,6 @@
-import type { RequestField, TranscriptRequests, TranscriptRow } from "../events/transcript.js";
+import { REQUEST_FIELDS, type RequestField, type TranscriptRequests, type TranscriptRow } from "../events/transcript.js";
 import type { AgentReply } from "../schemas/providers/plan-limits.js";
+import { startedChildCard } from "../events/child-run.js";
 
 // How a reply settles the card it answers: one rule used both by the fold and by a chat freezing its own card
 // optimistically before the frame returns. No reply (turn stopped or died) reads as cancelled for every card; a reply
@@ -22,7 +23,7 @@ export const settledRequests = (cards: TranscriptRequests, reply: AgentReply | u
     }
     if (permission !== undefined) {
         out.permission = {
-            ...permission,
+            ...startedChildCard(permission, reply),
             status:
                 reply?.kind !== "permission"
                     ? "cancelled"
@@ -65,16 +66,7 @@ export const settledRequests = (cards: TranscriptRequests, reply: AgentReply | u
 export const cancelledRequests = (cards: TranscriptRequests): TranscriptRequests => {
     const out: Cards = {};
     let changed = false;
-    for (const field of [
-        "plan",
-        "question",
-        "permission",
-        "browserHelp",
-        "terminalHelp",
-        "capabilityOffer",
-        "paymentOffer",
-        "credentialOffer",
-    ] as const) {
+    for (const field of REQUEST_FIELDS) {
         const card = cards[field];
         if (card === undefined) {
             continue;

package/src/policy/reserved-servers.test.ts

@@ -24,6 +24,12 @@ describe("reserved MCP server names", () => {
 });
 
 describe("collidesWithReservedServer", () => {
+    // Derived from the manifest schema's meanings: a cli card mints a server when it serves tools, a device and a
+    // connected browser always do, and `mcp` is the core kind that is its own endpoint.
+    test("the minting kinds are exactly the ones whose id becomes a server name", () => {
+        expect([...MCP_SERVER_MINTING_KINDS].toSorted()).toEqual(["cli", "device", "mcp", "webext"]);
+    });
+
     test("a kind whose id becomes a server name may not reuse a reserved one", () => {
         for (const kind of MCP_SERVER_MINTING_KINDS) {
             for (const name of RESERVED_MCP_SERVER_NAMES) {

package/src/policy/reserved-servers.ts

@@ -1,4 +1,5 @@
-// The MCP servers the daemon mounts in its OWN process, and whether each carries content from outside this container.
+import { contributedServerMintingKinds } from "@intentic/extension-manifest";
+// The MCP servers the daemon mounts under its own names, and whether each carries content from outside this container.
 // One source of truth: the outside-content guard's exemption list is the `control` subset of this, and a capability
 // whose id would become `mcp__<id>__…` is refused when the id is one of these, so nothing the owner configures can
 // shadow a daemon server. A daemon server's name is what reaches the model as the `mcp__<name>__` prefix.
@@ -8,9 +9,9 @@
 // - outside: the server carries content from beyond the container (a web page, a provider's verbatim sentence)
 export type ServerProvenance = "control" | "outside";
 
-// Every server agent/run/agent.ts and agent/run/harness/harness-servers.ts mount themselves; the browser router's two
-// names (web, browser) come in through `...turn.browser.servers`, so they are named here rather than discovered by the
-// text scan. A server added anywhere else without a row here fails the conformance test in the sandbox guard package.
+// Every server agent/run/agent.ts and agent/run/harness/harness-servers.ts mount themselves, plus the browser router's two
+// names (web, browser), which every turn mounts on its lease at the daemon's MCP door (browser-tools.ts) and which the
+// text scan reads from their constants. A server added anywhere else without a row here fails the conformance test in the sandbox guard package.
 export const DAEMON_MCP_SERVERS: Readonly<Record<string, ServerProvenance>> = {
     ui: "control", // agent.ts: AskUserQuestion
     accounts: "control", // agent.ts: the account roster and the credential typists
@@ -22,8 +23,8 @@ export const DAEMON_MCP_SERVERS: Readonly<Record<string, ServerProvenance>> = {
     watch: "control", // harness: condition watches
     deps: "control", // harness: dependency readiness
     diagnostics: "outside", // harness: two tools relay a provider's own sentence verbatim
-    web: "outside", // harness browser: the anonymous router; the page is the internet
-    browser: "outside", // harness browser: the signed-in router; the page is the internet
+    web: "outside", // the turn's mounts: the anonymous browser router; the page is the internet
+    browser: "outside", // the turn's mounts: the signed-in browser router; the page is the internet
 };
 
 // Every daemon-mounted server name, the set a capability id may not collide with.
@@ -37,10 +38,12 @@ export const CONTROL_MCP_SERVERS: ReadonlySet<string> = new Set(
         .map(([name]) => name),
 );
 
-// Capability kinds whose id becomes an MCP server name for the turn (`mcp` → its own endpoint; `device`/`webext` → the
-// loopback peer bridge), and so whose id must not collide with a daemon server. Other kinds mint accounts, providers or
-// infrastructure, never a `mcp__<id>__` server keyed by the id.
-export const MCP_SERVER_MINTING_KINDS: ReadonlySet<string> = new Set(["mcp", "device", "webext"]);
+// Capability kinds whose id becomes an MCP server name for the turn, and so whose id must not collide with a daemon
+// server: `mcp`, a core kind that is its own endpoint, and every contributable kind the manifest schema says mints one
+// (a device's and a connected browser's peer bridge, a cli card that serves tools), read off the schema's own meaning
+// (`contributedServerMintingKinds`), so a kind that starts minting is refused here without a second list. Other kinds
+// mint accounts, providers or infrastructure, never a `mcp__<id>__` server keyed by the id.
+export const MCP_SERVER_MINTING_KINDS: ReadonlySet<string> = new Set(["mcp", ...contributedServerMintingKinds()]);
 
 // Whether adding or renaming a capability of this kind to this id would shadow a daemon server. The one predicate the
 // capability routes consult, so the refusal and this list can't drift.

package/src/policy/turned-away.ts

@@ -5,6 +5,9 @@
 // A set rather than a run of case labels: what they share is a fact about the turn, not a shape.
 const TURNED_AWAY: ReadonlySet<string> = new Set([
     "claude-reauth",
+    // An organisation turned the account's Claude Code access off, or no account of the provider can serve: the next
+    // turn is routed off it (the daemon's blocked-account route), so the words wait for it rather than being spent.
+    "claude-not-entitled",
     "unknown-command",
     "context-window-too-small",
     "sandbox-memory-low",

package/src/protocol/container-requirements.test.ts

@@ -38,9 +38,8 @@ describe(`containerDrift`, () => {
         expect(containerDrift({ SANDBOX_PUBLIC_URL: `` })).toEqual([]);
     });
 
-    // A hosted Fly microVM has no grant by design, so this reports nothing on it.
-    it(`stays quiet on a hosted machine, which serves its address without dialling out`, () => {
-        expect(containerDrift({ SANDBOX_PUBLIC_URL: CURRENT.SANDBOX_PUBLIC_URL, SANDBOX_VM: `1` })).toEqual([]);
+    it(`holds a hosted machine to the same grant, since it dials the edge like any sandbox`, () => {
+        expect(containerDrift({ SANDBOX_PUBLIC_URL: CURRENT.SANDBOX_PUBLIC_URL, SANDBOX_VM: `1` }).map((gap) => gap.key)).toEqual([`reachability`]);
     });
 });
 

package/src/protocol/container-requirements.ts

@@ -7,8 +7,6 @@ export interface ContainerRequirement {
     readonly requires: readonly string[];
     // Absent `given` evidence means this sandbox never had the capability: not a fault, just unconfigured.
     readonly given: readonly string[];
-    // Row stays silent if any `unless` key is present: an alternate mechanism already satisfies the evidence.
-    readonly unless?: readonly string[];
     readonly enables: string;
     readonly lost: string;
     readonly repair: string;
@@ -25,8 +23,6 @@ export const CONTAINER_REQUIREMENTS: readonly ContainerRequirement[] = [
         key: "reachability",
         requires: ["SANDBOX_GRANT", "INGRESS_URL"],
         given: ["SANDBOX_PUBLIC_URL"],
-        // A Fly microVM's edge replays directly to it, so it holds no grant by design.
-        unless: ["SANDBOX_VM"],
         enables: "reaching this sandbox at its public address, from anywhere",
         lost:
             "Its public address answers 502 to everyone, including this browser when it is not on the same machine as the sandbox. " +
@@ -45,9 +41,7 @@ export interface ContainerGap {
 
 /** Empty means every requirement is met or not applicable; non-empty always means a setup rerun is needed. */
 export const containerDrift = (env: ContainerEnv): readonly ContainerGap[] =>
-    CONTAINER_REQUIREMENTS.filter(
-        (requirement) => requirement.given.every((name) => present(env, name)) && !(requirement.unless ?? []).some((name) => present(env, name)),
-    )
+    CONTAINER_REQUIREMENTS.filter((requirement) => requirement.given.every((name) => present(env, name)))
         .map((requirement) => ({
             key: requirement.key,
             missing: requirement.requires.filter((name) => !present(env, name)),

package/src/protocol/edge-verdict.ts

@@ -3,19 +3,21 @@
 // JavaScript unless the responder allows it — so the verdict rides an exposed header and the edge CORS-allows its own
 // errors. Ingress writes it, the editor's connection machine reads it; both sides import this file so they cannot drift.
 
+import type { EdgeVerdict } from "../front/generated/browser-wire.js";
+
 export const EDGE_VERDICT_HEADER = "x-intentic-edge";
 
-export type EdgeVerdict =
-    // No tunnel is registered for this sandbox: its container is not running, or the machine it runs on is off.
-    // Retrying is right — a container that comes back redials within seconds.
-    | "no-tunnel"
-    // The platform has no such sandbox. The row is deleted, no tunnel for this id will ever be accepted again, and
-    // nothing the reader waits for can change that.
-    | "unknown-sandbox"
-    // A tunnel was held and the forward failed mid-flight: the box went away between being routed to and answering.
-    | "dropped";
-
-const VERDICTS: ReadonlySet<string> = new Set(["no-tunnel", "unknown-sandbox", "dropped"]);
+// The verdicts themselves are the edge's (browser-wire's `EdgeVerdict`), each documented there:
+// - no-tunnel: no tunnel is registered for this sandbox, and retrying is right, since a container that comes back redials
+//   within seconds;
+// - unknown-sandbox: the platform has no such sandbox, and nothing the reader waits for can change that;
+// - dropped: a tunnel was held and the forward failed mid-flight.
+export type { EdgeVerdict };
+
+// Every verdict, so a new one in the Rust enum fails this file's typecheck until it is read here too.
+const VERDICTS: ReadonlySet<string> = new Set(
+    Object.keys({ "no-tunnel": true, "unknown-sandbox": true, dropped: true } satisfies Record<EdgeVerdict, true>),
+);
 
 // A header value only counts when it is one of ours: a 502 from anything else on the path (a corporate proxy, a CDN)
 // carries no verdict and must not be read as one.

package/src/protocol/ingress-contract.fixture.json

@@ -0,0 +1,90 @@
+{
+    "publicKey": "-----BEGIN PUBLIC KEY-----\nMCowBQYDK2VwAyEAfiMlxPB/8tnjh6TYS3rVde63OXB/wY77KWWtJ39XjBg=\n-----END PUBLIC KEY-----\n",
+    "grants": [
+        { "token": "ig1.eyJzdWIiOiJhYmNkZWYwMTIzNDUiLCJpYXQiOjE3MDAwMDAwMDB9.wdpBpqmMl21mqAZvRSYi4WfDejreTKDxHfOQp_sBKOTQB0_N2trL6iFcRxFUDrGBnGHmYnv-x66FgU_j57ZECA", "claim": {"sandboxId": "abcdef012345", "issuedAt": 1700000000} },
+        { "token": "ig1.eyJzdWIiOiIwMTIzNDU2Nzg5YWIiLCJpYXQiOjE3NTcwMDAwMDAsImV4dHJhIjoiaWdub3JlZCJ9.NK2BR2L_ycCACdmnbZgkg7sovw-Nhlt5vIL6ldArAx_jN9XOh-k1wisviROAgU40YGBgUASIgA6Wdn5SyYHHCA", "claim": {"sandboxId": "0123456789ab", "issuedAt": 1757000000} },
+        { "token": "ig1.eyJpYXQiOjE3MDAwMDAwMDAsInN1YiI6ImFiY2RlZjAxMjM0NSJ9.AenzYQn3Opfc-Sg_vkBrMEIOnCFZ3a46oSzjABAWyoVe3GP0vXlIM8MFgddHDQc7yow4kdfn1kHcUcsOoKkLCg", "claim": {"sandboxId": "abcdef012345", "issuedAt": 1700000000} },
+        { "token": "ig1.eyJzdWIiOiJhYmNkZWYwMTIzNDUiLCJpYXQiOjE3MDAwMDAwMDB9.wNpBpqmMl21mqAZvRSYi4WfDejreTKDxHfOQp_sBKOTQB0_N2trL6iFcRxFUDrGBnGHmYnv-x66FgU_j57ZECA", "claim": null },
+        { "token": "ig1.eiJzdWIiOiJhYmNkZWYwMTIzNDUiLCJpYXQiOjE3MDAwMDAwMDB9.wdpBpqmMl21mqAZvRSYi4WfDejreTKDxHfOQp_sBKOTQB0_N2trL6iFcRxFUDrGBnGHmYnv-x66FgU_j57ZECA", "claim": null },
+        { "token": "ig1.eyJzdWIiOiJhYmNkZWYwMTIzNDUiLCJpYXQiOjE3MDAwMDAwMDB9.Ac2ofn7IxD3M51pchXEycOPg4TP_kiTzu-aTVowDLTirjVzYrvfJ-ntrzPbQg-3RpBhmc53yP7s7iWyOgGWuAw", "claim": null },
+        { "token": "ig2.eyJzdWIiOiJhYmNkZWYwMTIzNDUiLCJpYXQiOjE3MDAwMDAwMDB9.wdpBpqmMl21mqAZvRSYi4WfDejreTKDxHfOQp_sBKOTQB0_N2trL6iFcRxFUDrGBnGHmYnv-x66FgU_j57ZECA", "claim": null },
+        { "token": "eyJzdWIiOiJhYmNkZWYwMTIzNDUiLCJpYXQiOjE3MDAwMDAwMDB9.wdpBpqmMl21mqAZvRSYi4WfDejreTKDxHfOQp_sBKOTQB0_N2trL6iFcRxFUDrGBnGHmYnv-x66FgU_j57ZECA", "claim": null },
+        { "token": "ig1.eyJzdWIiOiJhYmNkZWYwMTIzNDUiLCJpYXQiOjE3MDAwMDAwMDB9.wdpBpqmMl21mqAZvRSYi4WfDejreTKDxHfOQp_sBKOTQB0_N2trL6iFcRxFUDrGBnGHmYnv-x66FgU_j57ZECA.wdpBpqmMl21mqAZvRSYi4WfDejreTKDxHfOQp_sBKOTQB0_N2trL6iFcRxFUDrGBnGHmYnv-x66FgU_j57ZECA", "claim": null },
+        { "token": "ig1.eyJzdWIiOiJhYmNkZWYwMTIzNDUiLCJpYXQiOjE3MDAwMDAwMDB9.", "claim": null },
+        { "token": "", "claim": null },
+        { "token": "ig1", "claim": null },
+        { "token": "ig1..", "claim": null },
+        { "token": "ig1.%%%.%%%", "claim": null },
+        { "token": "ig1.eyJzdWIiOiJBQkNERUYwMTIzNDUiLCJpYXQiOjE3MDAwMDAwMDB9.CbPEciFki-GXJnUcS5F9_9uXUOw5tWhv3iS69BjuQpSmsA72_xnvYUIjhAMiBPI98XBQ9-zKc9GSPJIFGQqaDA", "claim": null },
+        { "token": "ig1.eyJzdWIiOiJhYmNkZWYwMTIzNCIsImlhdCI6MTcwMDAwMDAwMH0.qfJbxpVtbcymaweaCu9fUounkldkMy4HSdllEDlHs5Yq8b11XxiHLguDyvqubXcMGCuVVygCeg2MjU3i0vEuDA", "claim": null },
+        { "token": "ig1.eyJzdWIiOiJhYmNkZWYwMTIzNDUiLCJpYXQiOiIxNzAwMDAwMDAwIn0.BI6UT1aTaN01bGZyI9SHc_qIf9S-JlpmNtiBd8by_giZCq8pQIJCBKIutYZW0mmqCF0YHf0NHc9icq1h9Wr7BA", "claim": null },
+        { "token": "ig1.eyJzdWIiOiJhYmNkZWYwMTIzNDUifQ.Aa5FeLKazhsr2IvYZ2p5BJmLL1qvQWReXeCKt5gxCq9PqSaAnn8Pa6PJp0jiaXY5FIbc_S9MFrUCeEfQ6vnkBQ", "claim": null },
+        { "token": "ig1.eyJzdWIiOjEyMzQ1Njc4OTAxMiwiaWF0IjoxNzAwMDAwMDAwfQ.kb_lMTBvFS4nzTmqLf-T7l9IF8PHaPPkP5HB1T0yd0IRWqYJnIZH2eoKexv7e6aA2PkqCpe-B1FL8Nbu4qPvDg", "claim": null },
+        { "token": "ig1.bm90IGpzb24.Ffec27cYSbvKvjlxtSUIFFX7sGo3Zp4BxotW02rFwcJHfJikM51Zfzn3_0Rg8coR4y43iOUA2u-ZOcBJg4mmDA", "claim": null },
+        { "token": "ig1.bnVsbA.lFa3FNSkMcf3WCyjdb87YRVdt8h3aSzt4cignx9Rkwq6drwl12m0rlrmzdPkLjsdrQdL1oWZ2E2MGuo2CMeSBw", "claim": null },
+        { "token": "ig1.WyJhYmNkZWYwMTIzNDUiLDE3MDAwMDAwMDBd.BWFTD0bHKDBAEWwhYq6F-cWo_HXEC8UvDWkrTmafOycvTZUHvVOjWy_97OYl_pF-svCO1vbeumhF89ybhqv4Dw", "claim": null }
+    ],
+    "owners": [
+        { "host": "sandbox-abcdef012345.sbx.example.test", "owner": "abcdef012345" },
+        { "host": "sandbox-abcdef012345.sbx.example.test:443", "owner": "abcdef012345" },
+        { "host": "preview-web-app-abcdef012345.sbx.example.test:443", "owner": "abcdef012345" },
+        { "host": "port-0f0f0f0f0f0f-abcdef012345.sbx.example.dev", "owner": "abcdef012345" },
+        { "host": "public-1a2b3c4d5e6f-abcdef012345.sbx.example.dev", "owner": "abcdef012345" },
+        { "host": "SANDBOX-abcdef012345.sbx.example.test", "owner": "abcdef012345" },
+        { "host": "-abcdef012345.example.com", "owner": "abcdef012345" },
+        { "host": "sandbox-abcdef012345", "owner": "abcdef012345" },
+        { "host": "ingress.sbx.example.test", "owner": null },
+        { "host": "sbx.example.test", "owner": null },
+        { "host": "abcdef012345.local.sbx.example.dev", "owner": null },
+        { "host": "sandbox-ABCDEF012345.sbx.example.test", "owner": null },
+        { "host": "sandbox-abcdef01234.sbx.example.test", "owner": null },
+        { "host": "sandbox-abcdef012345x.sbx.example.test", "owner": null },
+        { "host": "sandbox-abcdef012345-.sbx.example.test", "owner": null },
+        { "host": "[::1]:8788", "owner": null },
+        { "host": "127.0.0.1:8788", "owner": null },
+        { "host": "", "owner": null }
+    ],
+    "bulk": [
+        "GET /diff/raw",
+        "GET /workspace/raw",
+        "GET /workspace/media",
+        "POST /workspace/upload",
+        "POST /workspace/upload-archive",
+        "GET /system/sync/ssh",
+        "GET /bundles/download",
+        "GET /extensions/{id}/bundle",
+        "GET /system/runners/git/{repo}/info/refs",
+        "POST /system/runners/git/{repo}/git-upload-pack",
+        "POST /system/runners/git/{repo}/git-receive-pack"
+    ],
+    "lanes": [
+        { "host": "sandbox-abcdef012345.sbx.example.test", "method": "GET", "path": "/workspace/media?path=a.mp4", "lane": "bulk" },
+        { "host": "sandbox-abcdef012345.sbx.example.test", "method": "POST", "path": "/workspace/upload?path=a", "lane": "bulk" },
+        { "host": "sandbox-abcdef012345.sbx.example.test:443", "method": "GET", "path": "/system/runners/git/app/info/refs?service=git-upload-pack", "lane": "bulk" },
+        { "host": "sandbox-abcdef012345.sbx.example.test", "method": "POST", "path": "/system/runners/git/app/git-receive-pack", "lane": "bulk" },
+        { "host": "sandbox-abcdef012345.sbx.example.test", "method": "GET", "path": "/system/sync/ssh", "lane": "bulk" },
+        { "host": "sandbox-abcdef012345.sbx.example.test", "method": "GET", "path": "/extensions/abc/bundle", "lane": "bulk" },
+        { "host": "sandbox-abcdef012345.sbx.example.test", "method": "GET", "path": "/diff/raw?a=1?b=2", "lane": "bulk" },
+        { "host": "sandbox-abcdef012345.sbx.example.test", "method": "GET", "path": "/bundles/download?ticket=x", "lane": "bulk" },
+        { "host": "sandbox-abcdef012345.sbx.example.test", "method": "POST", "path": "/workspace/upload-archive", "lane": "bulk" },
+        { "host": "sandbox-abcdef012345.sbx.example.test", "method": "HEAD", "path": "/workspace/raw?path=a", "lane": "bulk" },
+        { "host": "sandbox-abcdef012345.sbx.example.test", "method": "OPTIONS", "path": "/workspace/raw", "lane": "bulk" },
+        { "host": "sandbox-abcdef012345.sbx.example.test", "method": "OPTIONS", "path": "/system/runners/git/app/git-upload-pack", "lane": "bulk" },
+        { "host": "sandbox-abcdef012345.sbx.example.test", "method": "get", "path": "/workspace/raw?path=a", "lane": "bulk" },
+        { "host": "sandbox-abcdef012345.sbx.example.test", "method": "GET", "path": "/workspace/thumb?path=a.png", "lane": "interactive" },
+        { "host": "sandbox-abcdef012345.sbx.example.test", "method": "POST", "path": "/workspace/upload-diff", "lane": "interactive" },
+        { "host": "sandbox-abcdef012345.sbx.example.test", "method": "GET", "path": "/agents", "lane": "interactive" },
+        { "host": "sandbox-abcdef012345.sbx.example.test", "method": "GET", "path": "/system/terminal?ticket=t", "lane": "interactive" },
+        { "host": "sandbox-abcdef012345.sbx.example.test", "method": "POST", "path": "/workspace/raw", "lane": "interactive" },
+        { "host": "sandbox-abcdef012345.sbx.example.test", "method": "GET", "path": "/workspace/raw/", "lane": "interactive" },
+        { "host": "sandbox-abcdef012345.sbx.example.test", "method": "GET", "path": "/system/runners/git//info/refs", "lane": "interactive" },
+        { "host": "sandbox-abcdef012345.sbx.example.test", "method": "GET", "path": "/x/anything/at/all", "lane": "interactive" },
+        { "host": "sandbox-abcdef012345.sbx.example.test", "method": "GET", "path": "/", "lane": "interactive" },
+        { "host": "sandbox-abcdef012345.sbx.example.test", "method": "GET", "path": "", "lane": "interactive" },
+        { "host": "preview-web-abcdef012345.sbx.example.test", "method": "GET", "path": "/agents", "lane": "bulk" },
+        { "host": "port-1a2b3c4d5e6f-abcdef012345.sbx.example.test", "method": "GET", "path": "/", "lane": "bulk" },
+        { "host": "Sandbox-abcdef012345.sbx.example.test", "method": "GET", "path": "/agents", "lane": "bulk" },
+        { "host": "sbx.example.test", "method": "GET", "path": "/agents", "lane": "bulk" },
+        { "host": "", "method": "GET", "path": "/agents", "lane": "bulk" }
+    ]
+}