@intentic/sandbox-contract 1.317.0 → 1.319.0

package/src/protocol/routes.test.ts

@@ -1,6 +1,6 @@
 import { eventIterator, oc } from "@orpc/contract";
 import { z } from "zod";
-import { SANDBOX_ROUTE_NAMES, SANDBOX_ROUTE_SHAPES, SANDBOX_ROUTES, sandboxRouteName } from "../index.js";
+import { SANDBOX_ROUTE_NAMES, SANDBOX_ROUTES, sandboxRouteName, sandboxRouteFingerprints } from "../index.js";
 import { procedure } from "./route-meta.js";
 import { contractRoutes, routeNameForRequest, routeShapes, servedRoute, streamOf } from "./routes.js";
 
@@ -231,7 +231,7 @@ describe(`the real sandbox contract`, () => {
     it(`fingerprints every route, streams included`, () => {
         // Nothing may opt out: a route with no fingerprint is a route the browser can never tell has drifted, and the
         // streaming ones (system.events, agent.attach, the exit dials) carry the frames a stale daemon breaks first.
-        expect(SANDBOX_ROUTE_NAMES.filter((name) => !(name in SANDBOX_ROUTE_SHAPES))).toEqual([]);
+        expect(SANDBOX_ROUTE_NAMES.filter((name) => !(name in sandboxRouteFingerprints()))).toEqual([]);
     });
 
     it(`fingerprints the streaming routes eventIterator used to hide`, () => {
@@ -250,7 +250,7 @@ describe(`the real sandbox contract`, () => {
                 `system.runDeviceAgentFlow`,
                 `vpn.connect`,
             ]
-                .filter((name) => name in SANDBOX_ROUTE_SHAPES)
+                .filter((name) => name in sandboxRouteFingerprints())
                 .toSorted(),
         ).toEqual([
             `agent.attach`,
@@ -269,8 +269,8 @@ describe(`the real sandbox contract`, () => {
     });
 
     it(`fingerprints every route exactly once`, () => {
-        expect(Object.keys(SANDBOX_ROUTE_SHAPES).every((name) => SANDBOX_ROUTE_NAMES.includes(name))).toBe(true);
-        expect(Object.keys(SANDBOX_ROUTE_SHAPES).length).toBe(SANDBOX_ROUTE_NAMES.length);
+        expect(Object.keys(sandboxRouteFingerprints()).every((name) => SANDBOX_ROUTE_NAMES.includes(name))).toBe(true);
+        expect(Object.keys(sandboxRouteFingerprints()).length).toBe(SANDBOX_ROUTE_NAMES.length);
     });
 
     it(`derives a route table with no duplicate names`, () => {
@@ -287,7 +287,7 @@ describe(`the real sandbox contract`, () => {
     // differently has to read as drift rather than as a machine that runs nothing.
     it(`fingerprints the fleet view the device buttons are gated on`, () => {
         expect(sandboxRouteName(`GET`, `/system/devices`)).toBe(`system.devices`);
-        expect(SANDBOX_ROUTE_SHAPES[`system.devices`]).toEqual(expect.any(String));
+        expect(sandboxRouteFingerprints()[`system.devices`]).toEqual(expect.any(String));
     });
 
     it(`resolves a known concrete request back to its contract name`, () => {

package/src/protocol/routes.ts

@@ -1,19 +1,12 @@
-import { eventIterator } from "@orpc/contract";
 import { z } from "zod";
 import type { RouteMeta } from "./route-meta.js";
+import { FRAME, streamOf } from "./stream-of.js";
 
 // Named route surface of the daemon's contract (`<group>.<route>`), derived automatically so nothing here is
 // hand-maintained. The daemon advertises which routes it implements (the /events hello frame); the browser diffs that
 // against its own contract so an old daemon's gap is a named feature check, not a silent 404.
 
-// Every streamed route declares its frames through this, never oRPC's `eventIterator` directly: that returns an opaque
-// standard-schema validator holding no reachable inner schema, so a stream's payload would be unfingerprintable and its
-// drift invisible. The frame schema rides along under a symbol, which oRPC never reads and JSON never serializes.
-// Typed as a plain `symbol`, not the inferred unique one: a unique symbol would ride into every contract's inferred
-// type and break declaration emit on a local name nothing outside can refer to.
-const FRAME: symbol = Symbol.for("intentic.contract.frame");
-
-export const streamOf = <T extends z.ZodType>(frame: T) => Object.assign(eventIterator(frame), { [FRAME]: frame });
+export { streamOf };
 
 // The frame schema behind a streamed route's validator, or undefined for an ordinary request/response schema.
 const frameOf = (schema: unknown): z.ZodType | undefined =>

package/src/protocol/stream-of.ts

@@ -0,0 +1,13 @@
+import { eventIterator } from "@orpc/contract";
+import type * as z from "zod";
+
+// Every streamed route declares its frames through this, never oRPC's `eventIterator` directly: that returns an opaque
+// standard-schema validator holding no reachable inner schema, so a stream's payload would be unfingerprintable and its
+// drift invisible. The frame schema rides along under a symbol, which oRPC never reads and JSON never serializes.
+// Typed as a plain `symbol`, not the inferred unique one: a unique symbol would ride into every contract's inferred
+// type and break declaration emit on a local name nothing outside can refer to.
+// Its own module, apart from routes.ts, because the browser extension's contract streams too and routes.ts reaches
+// zod's namespace at runtime, which the extension's bundle budget cannot carry.
+export const FRAME: symbol = Symbol.for("intentic.contract.frame");
+
+export const streamOf = <T extends z.ZodType>(frame: T) => Object.assign(eventIterator(frame), { [FRAME]: frame });

package/src/protocol/vitals.test.ts

@@ -0,0 +1,46 @@
+import { RAW_ROUTES, rawRoutePath } from "./raw-routes.js";
+import { parseVitals, type SandboxVitals, VITALS_PATH } from "./vitals.js";
+
+// The JSON browser-wire's own test pins (`vitals_are_the_camel_case_json_the_editor_parses_with_null_for_what_is_unknown`):
+// what the front writes, the editor reads.
+const RUST_GOLDEN_JSON = `{"node":"restarting","lagMs":null,"restarts":2,"uptimeS":3600,"pressure":{"cpu":12.34,"memory":0.0,"io":1.5}}`;
+
+const up: SandboxVitals = { node: "up", lagMs: 12, restarts: 0, uptimeS: 60, pressure: { cpu: 0.29, memory: 0.49, io: 0.88 } };
+
+it("reads the front's own answer as it writes it", () => {
+    expect(parseVitals(JSON.parse(RUST_GOLDEN_JSON))).toEqual({
+        node: "restarting",
+        lagMs: null,
+        restarts: 2,
+        uptimeS: 3600,
+        pressure: { cpu: 12.34, memory: 0, io: 1.5 },
+    });
+    expect(parseVitals(up)).toEqual(up);
+    expect(parseVitals({ ...up, node: "starting" })?.node).toBe("starting");
+});
+
+it("reads a lag or pressure it cannot make out as unknown, and keeps the rest", () => {
+    const { lagMs: _lag, pressure: _pressure, ...bare } = up;
+    expect(parseVitals(bare)).toEqual({ ...bare, lagMs: null, pressure: null });
+    expect(parseVitals({ ...up, lagMs: -1, pressure: { cpu: 1 } })).toEqual({ ...up, lagMs: null, pressure: null });
+    // A later front's extra fields are not this reader's business.
+    expect(parseVitals({ ...up, since: "later" })).toEqual(up);
+});
+
+it("is undefined for anything that is not the front's answer", () => {
+    // An older sandbox forwards the path to Node, which answers 404 as JSON, or a preview's HTML page.
+    expect(parseVitals({ error: "Not Found" })).toBeUndefined();
+    expect(parseVitals("<!doctype html><title>Not found</title>")).toBeUndefined();
+    expect(parseVitals(null)).toBeUndefined();
+    expect(parseVitals(42)).toBeUndefined();
+    expect(parseVitals([up])).toBeUndefined();
+    expect(parseVitals({ ...up, node: "crashed" })).toBeUndefined();
+    expect(parseVitals({ ...up, restarts: -1 })).toBeUndefined();
+    expect(parseVitals({ ...up, uptimeS: 1.5 })).toBeUndefined();
+    expect(parseVitals({ ...up, restarts: "2" })).toBeUndefined();
+});
+
+it("is a route the front serves itself, with no credential, before the daemon boots", () => {
+    expect(rawRoutePath("GET /system/vitals")).toBe(VITALS_PATH);
+    expect(RAW_ROUTES["GET /system/vitals"]).toEqual({ auth: "door", beforeBoot: true, front: true });
+});

package/src/protocol/vitals.ts

@@ -0,0 +1,38 @@
+// The sandbox's proof of life, which intentic-front answers itself on the daemon's own address and never forwards to
+// Node: whether Node is up, how long its event loop takes to answer the front's ping, how often the front restarted it,
+// how long the container has run, and its pressure stall. The daemon's heartbeat on /events rides Node's event loop,
+// so a busy sandbox and a dead one look alike from there; this route tells them apart. The Rust crate `browser-wire`
+// is the definition (SandboxVitals), and wire-manifests.test.ts holds the path here to the manifest it writes.
+
+import { z } from "zod";
+import type { NodeLink, Pressure, SandboxVitals } from "../front/generated/browser-wire.js";
+
+export type { NodeLink, Pressure, SandboxVitals };
+
+// A plain GET any origin may read, answered by the front whatever state Node is in. The route is registered as
+// `front: true` in raw-routes.ts, so the daemon serves none.
+export const VITALS_PATH = "/system/vitals";
+
+// Every state, so a new one in the Rust enum fails this file's typecheck until it is read here too.
+const NODE_LINKS = { starting: "starting", up: "up", restarting: "restarting" } as const satisfies { readonly [K in NodeLink]: K };
+
+const PressureSchema = z.object({ cpu: z.number(), memory: z.number(), io: z.number() });
+
+// Lenient where a figure is only a detail: a lag or a pressure it cannot read is unknown, and the rest still stands.
+const VitalsSchema = z.object({
+    node: z.enum(NODE_LINKS),
+    lagMs: z.number().nonnegative().nullable().catch(null),
+    restarts: z.number().int().nonnegative(),
+    uptimeS: z.number().int().nonnegative(),
+    pressure: PressureSchema.nullable().catch(null),
+});
+
+// A response body as `Response.json()` hands it over: any JSON value, not yet known to be the front's answer.
+type JsonBody = string | number | boolean | null | readonly JsonBody[] | { readonly [key: string]: JsonBody };
+
+// The front's answer, or undefined for anything else: an older sandbox forwards the path to Node, which answers 404 or
+// an HTML page, and an edge in between may answer for a box that is not there.
+export const parseVitals = (body: JsonBody): SandboxVitals | undefined => {
+    const parsed = VitalsSchema.safeParse(body);
+    return parsed.success ? parsed.data : undefined;
+};

package/src/schemas/activity.ts

@@ -26,7 +26,7 @@ export const ActivityEventSchema = z.object({
     type: z
         .string()
         .describe(
-            "Exactly what happened: a message received or sent, a reaction, a turn starting or ending, a rule doing something. A rule that ran and passed says nothing here, because a feed of green ticks is one the eye learns to skip.",
+            "Exactly what happened: a message received or sent, a reaction, a turn starting or ending, a rule doing something. A rule that ran and passed says nothing here, because a feed of passes is one the eye learns to skip.",
         ),
     channelId: z.string().optional().describe("Which channel or thread it happened in."),
     // Inbound author display name.

package/src/schemas/agent.ts

@@ -131,7 +131,7 @@ export type ForkedFrom = z.infer<typeof ForkedFromSchema>;
 const AgentTurnFieldsSchema = z.object({
     prompt: z.string().describe("What to say to the agent. May be empty if you are only attaching files."),
     errand: TurnErrandSchema.optional().describe(
-        "What the words are for, when the app or the sandbox composed them rather than a person typing them: a land conflict to resolve, a red CI run to fix. Shown as the sandbox's words, not yours. Leave it out for your own words.",
+        "What the words are for, when the app or the sandbox composed them rather than a person typing them: a land conflict to resolve, a failed CI run to fix. Shown as the sandbox's words, not yours. Leave it out for your own words.",
     ),
     // Minted by the sender so a send whose answer was lost can be sent again without being delivered twice.
     messageId: z
@@ -304,6 +304,16 @@ const AgentTurnFieldsSchema = z.object({
     editorContext: EditorContextSchema.optional().describe(
         'What the user has open in their editor, folded into the prompt so that pointing words like "this" resolve.',
     ),
+    // The composer's scheduled send: a person who knows the account is spent books the message for its reopen instead of
+    // sending it into a refusal. Held in the conversation's queue, never started early; the queue's `until` is this.
+    sendAt: z
+        .number()
+        .int()
+        .positive()
+        .optional()
+        .describe(
+            "Hold this message until then (epoch milliseconds) instead of starting a turn now, for an allowance you know is spent. It waits in the conversation's queue, where it can be sent early, reworded or removed, and goes by itself at that instant. Ignored when already past, or when a turn is running.",
+        ),
 });
 export const AgentTurnSchema = AgentTurnFieldsSchema
     // An attachment-only send (no text) is legal; an entirely empty turn is not.
@@ -473,7 +483,7 @@ export const QueuedMessageSchema = z.object({
 });
 export type QueuedMessage = z.infer<typeof QueuedMessageSchema>;
 // Why a queue holds its messages rather than letting them go when the conversation is free.
-export const QueuePauseSchema = z.enum(["stopped", "refused"]);
+export const QueuePauseSchema = z.enum(["stopped", "refused", "scheduled"]);
 export type QueuePause = z.infer<typeof QueuePauseSchema>;
 // What waits for a conversation's next turn: messages that arrived while a turn that could not take them ran, and
 // held ones. Conversation state, the same for every window and kept across a restart.
@@ -481,13 +491,20 @@ export const ConversationQueueSchema = z.object({
     items: z.array(QueuedMessageSchema).describe("What waits, in the order it goes out."),
     revision: z.number().int().nonnegative().describe("Moves with every change to the queue, so of two copies the higher is the newer."),
     paused: QueuePauseSchema.optional().describe(
-        "Why nothing goes out by itself: somebody stopped the turn, or the turn these messages started was refused before it ran. Resuming, or sending another message, lets them go.",
+        "Why nothing goes out by itself: somebody stopped the turn, the turn these messages started was refused before it ran, or they were scheduled for later. Resuming lets them go, and so does sending another message unless they are scheduled.",
     ),
+    until: z
+        .number()
+        .optional()
+        .describe("When scheduled messages go out by themselves, in milliseconds. Only on a queue paused as `scheduled`."),
 });
 export type ConversationQueue = z.infer<typeof ConversationQueueSchema>;
 // What resuming a queue did: started a turn with what waited, when nothing else ran.
 export const QueueResumedSchema = z.object({
     run: z.string().optional().describe("The turn the waiting messages started. Absent when a turn was already running, and they go after it."),
+    queue: ConversationQueueSchema.optional().describe(
+        "The queue the release left: what still waits once the turn took what it could. Absent from sandboxes older than the field.",
+    ),
 });
 export type QueueResumed = z.infer<typeof QueueResumedSchema>;
 // Attaches to a conversation's newest run (live, or finished within retention); no cursor to resume from, the head

package/src/schemas/agents.ts

@@ -89,7 +89,7 @@ export const UnfinishedWorkSchema = z.object({
         })
         .optional()
         .describe("The agent's own checklist where that turn left it. Absent for a conversation that kept no list."),
-    // Name of the `turn.ending` check still red when the turn ended. Retired with that check: nothing writes it now, and
+    // Name of the `turn.ending` check still failing when the turn ended. Retired with that check: nothing writes it now, and
     // it stays so entries written before still read.
     check: z
         .string()
@@ -98,7 +98,7 @@ export const UnfinishedWorkSchema = z.object({
 });
 export type UnfinishedWork = z.infer<typeof UnfinishedWorkSchema>;
 // What the last turn showed of its own work, read off its tool calls and never asked of the model: the record a card
-// badges instead of sending the turn back to prove anything. CI checks what the owner pushes (push-checks.ts).
+// badges instead of sending the turn back to prove anything. CI checks what the owner pushes (schemas/ci.ts).
 export const TurnProofSchema = z.object({
     at: z.number().describe("When the turn that left this ended, in milliseconds."),
     verification: z
@@ -432,6 +432,32 @@ export const AgentSummarySchema = z.object({
             "Since when somebody's composer has held a message for it that they have not sent yet, in milliseconds. While set, the sandbox never archives it on its own for being idle.",
         ),
     attention: AgentAttentionSchema.describe("Which kinds of waiting-for-you it is doing."),
+    // Beside `attention.permission`, which says only that one waits: the id an answer names and what it asks, so a card
+    // can offer the answer itself instead of a trip to the chat. The oldest one, while its turn runs.
+    permissionAsk: z
+        .object({
+            requestId: z.string().describe("Which request this is: the id an answer to it names."),
+            ask: z.string().describe("What it asks to do, on one line: the runtime's own sentence, else the tool's short name."),
+        })
+        .optional()
+        .describe(
+            "The oldest permission its running turn is waiting on, so it can be answered where the conversation is listed. Absent when none waits, and from a sandbox older than it.",
+        ),
+    // Kept on the record until a land goes through, unlike `failure`, which the next turn clears: a land that broke
+    // leaves the work stuck on its branch however many turns run after it.
+    landFailure: z
+        .object({
+            reason: z.string().describe("Why it failed, in the words it failed with."),
+            code: z
+                .string()
+                .optional()
+                .describe("Which kind of failure it was, when the sandbox could tell: unlinked when its copy lost its link to the workspace. Absent otherwise."),
+            at: z.number().describe("When it failed, in milliseconds."),
+        })
+        .optional()
+        .describe(
+            "The last attempt to bring its work into the workspace failed, and why. Cleared by the next land that goes through. Absent when nothing failed, and from a sandbox older than it.",
+        ),
     // Only the causes that still hold, re-read live (conversations/land/standing.ts), never the stored report's own list: a
     // blocker the user has since cleared is not something to offer them an action about.
     conflictCauses: z
@@ -452,8 +478,8 @@ export const AgentSummarySchema = z.object({
     // Completed turns and lifetime tool calls, the card's msgs/tools counters.
     turns: z.number().optional().describe("Turns it has finished."),
     toolUses: z.number().optional().describe("Tools it has used, over its whole life."),
-    // `running` reads the live subagent registry (swept after five minutes), `total` counts on the agent's own entry; a
-    // child's spend is its own, never folded into the parent's cost.
+    // `running` reads the live subagent roster, `total` counts on the agent's own entry; a child's spend is its own,
+    // never folded into the parent's cost.
     subagents: z
         .object({
             running: z.number().describe("Subagents working right now."),
@@ -479,6 +505,25 @@ export const AgentSummarySchema = z.object({
         .object({
             landed: z.number().describe("Paths this conversation merged in."),
             present: z.number().describe("How many of them are still there, either pending or committed."),
+            // Read off who acted on the tree between the land and the moment it was found missing; only a sole candidate
+            // is named, so an unattributed removal says nothing rather than guessing.
+            removedBy: z
+                .discriminatedUnion("kind", [
+                    z.object({
+                        kind: z.literal("agent"),
+                        id: z.string().describe("The conversation that took them out."),
+                        title: z.string().optional().describe("What that conversation is called."),
+                    }),
+                    z.object({
+                        kind: z.literal("person"),
+                        email: z.string().optional().describe("Who it was, as the sandbox verified them. Absent when the request carried no identity."),
+                        name: z.string().optional().describe("What to call them, when their sign-in carried a name."),
+                    }),
+                ])
+                .optional()
+                .describe(
+                    "Who took them out, when the sandbox could tell: an agent working in the workspace, or a person throwing the changes away. Absent when it could not tell, and from a sandbox older than it.",
+                ),
         })
         .optional()
         .describe(
@@ -593,6 +638,12 @@ export const awaitsWake = (agent: { readonly awaitingWake?: boolean | undefined
 export type AgentWatch = NonNullable<AgentSummary["watches"]>[number];
 // One background job as a card carries it.
 export type AgentJob = NonNullable<AgentSummary["jobs"]>[number];
+// Who took landed work out of the workspace, as the card names them.
+export type LandedRemover = NonNullable<NonNullable<AgentSummary["landedPresence"]>["removedBy"]>;
+// A land that broke, kept on the card until one goes through.
+export type LandFailure = NonNullable<AgentSummary["landFailure"]>;
+// The permission a running turn waits on, as a card can answer it.
+export type WaitingPermission = NonNullable<AgentSummary["permissionAsk"]>;
 // AgentsListSchema is declared later, after AutomationApprovalSchema, since the fleet list carries held wakes and zod
 // needs that type declared first.
 export const AgentIdSchema = z.object({ id: z.string().min(1).describe("Which conversation.") });
@@ -623,6 +674,9 @@ export const AgentTranscriptQuerySchema = AgentIdSchema.extend({
 export const AgentToolChildrenQuerySchema = AgentIdSchema.extend({
     toolId: z.string().min(1).describe("Which tool call, by the id its card carries."),
 });
+export const AgentSubagentQuerySchema = AgentIdSchema.extend({
+    subagentId: z.string().min(1).describe("Which subagent this conversation's runtime ran in-process, by the id of the call that started it."),
+});
 // Absent `ids` archives every archivable finished agent (the lane's "Clear"); unarchive always names its own ids.
 export const AgentIdsSchema = z.object({ ids: z.array(z.string().min(1)).min(1).max(500).describe("Which conversations.") });
 // What actually moved, not the roster afterward: two archives finishing at once would otherwise let a slower snapshot

package/src/schemas/automations.ts

@@ -29,7 +29,7 @@ import { ZoneSchema } from "../time/zone.js";
 // turn.settled: fires once per isolated turn regardless of outcome, while the diff is still on screen
 // agent.landed: fires only once work reaches the main tree, including a later manual Land
 // deps.broken/deps.fixed: retired with the check that ran after every land (2026-09-27). Nothing emits them any more;
-// they stay so an automation written for them still reads, and it never fires. Main's red CI is the `ci` listener's.
+// they stay so an automation written for them still reads, and it never fires. Main's failing CI is the `ci` listener's.
 export const WorkspaceEventKindSchema = z.enum(["turn.settled", "agent.landed", "deps.broken", "deps.fixed"]);
 export type WorkspaceEventKind = z.infer<typeof WorkspaceEventKindSchema>;
 // Payload of a workspace-triggered wake, delivered as JSON in $AUTOMATION_PAYLOAD and appended to the prompt.
@@ -45,7 +45,7 @@ export const WorkspaceEventSchema = z.object({
     outcome: z.enum(["landed", "conflict", "ready", "idle", "error"]),
     repos: z.array(z.object({ repo: z.string(), from: z.string(), dir: z.string() })),
     // Present only for `deps.*` events: which project broke, the command and exit code, a bounded log tail, and
-    // `attempt` counting consecutive reds since the last green.
+    // `attempt` counting consecutive failures since the last pass.
     deps: z
         .object({
             project: z.string(),

package/src/schemas/capabilities.ts

@@ -244,7 +244,8 @@ export const LOCAL_MODEL_WINDOW_MAX = 1_048_576;
 // against.
 export const LOCAL_MODEL_KV_BYTES_PER_TOKEN = 65_536;
 // What a rung honestly serves. `instant` is the one the connect view prefetches — it downloads in under a minute and
-// cannot drive a full agent turn, so no surface may sell it as one; `work` is what that view recommends for real use.
+// cannot drive a full agent turn, so its catalog row is helper-only (Model.helperOnly): the chat picker does not offer
+// it and the daemon refuses a turn on it. `work` is what that view recommends for real use.
 export type LocalModelTier = "instant" | "work";
 export interface LocalModelChoice {
     // Hugging Face owner/repo/file.gguf, exactly as LocalModelConfig.model carries it.
@@ -254,21 +255,57 @@ export interface LocalModelChoice {
     // estimate all read this, so a model cannot be priced two ways.
     readonly weightsBytes: number;
     readonly tier: LocalModelTier;
+    // The repository commit the file is fetched at, a sha and never a branch: `main` moves, and a re-upload under the
+    // same name would change what a card promised without the card changing.
+    readonly revision: string;
+    // The file's own sha256 at that commit (its LFS oid). A download that does not hash to it is deleted, not served.
+    readonly sha256: string;
 }
-// The curated list, smallest first. ponytail: these bytes are the Hugging Face tree API's answer for each file — the
+// The curated list, smallest first. ponytail: sizes, revisions and digests are the Hugging Face API's answer for each
+// file (`/api/models/<repo>/revision/main` for the sha, `/tree/<sha>` for the size and LFS oid), read 2026-09-29 — the
 // hand-written labels that predated them overstated gemma-4 12B by 2x and Qwen3.8 27B by a third, which is the class of
-// drift a machine-readable size exists to end.
+// drift a machine-readable size exists to end. Bump a row's three together: each belongs to its revision.
 export const LOCAL_MODELS: readonly LocalModelChoice[] = [
-    { id: "unsloth/Qwen3.5-2B-GGUF/Qwen3.5-2B-Q4_K_M.gguf", label: "Qwen3.5 2B", weightsBytes: 1_280_835_840, tier: "instant" },
+    {
+        id: "unsloth/Qwen3.5-2B-GGUF/Qwen3.5-2B-Q4_K_M.gguf",
+        label: "Qwen3.5 2B",
+        weightsBytes: 1_280_835_840,
+        tier: "instant",
+        revision: "f6d5376be1edb4d416d56da11e5397a961aca8ae",
+        sha256: "aaf42c8b7c3cab2bf3d69c355048d4a0ee9973d48f16c731c0520ee914699223",
+    },
     {
         id: "unsloth/Phi-4-mini-instruct-GGUF/Phi-4-mini-instruct-Q4_K_M.gguf",
         label: "Phi-4-mini 3.8B",
         weightsBytes: 2_491_874_272,
         tier: "work",
+        revision: "78eb92a46fc37e6b524df991ed9aca9bc6aa7b80",
+        sha256: "88c00229914083cd112853aab84ed51b87bdf6b9ce42f532d8c85c7c63b1730a",
+    },
+    {
+        id: "unsloth/Qwen3.5-9B-GGUF/Qwen3.5-9B-Q4_K_M.gguf",
+        label: "Qwen3.5 9B",
+        weightsBytes: 5_680_522_464,
+        tier: "work",
+        revision: "3885219b6810b007914f3a7950a8d1b469d598a5",
+        sha256: "03b74727a860a56338e042c4420bb3f04b2fec5734175f4cb9fa853daf52b7e8",
+    },
+    {
+        id: "unsloth/gemma-4-12b-it-GGUF/gemma-4-12b-it-Q4_K_M.gguf",
+        label: "Gemma 4 12B",
+        weightsBytes: 7_121_861_440,
+        tier: "work",
+        revision: "fc034cfff751157913579611efad8462ac1be606",
+        sha256: "0a270ec9fe6b34f4a0d33992b6135117b484ebc4766ab76b51d4ae8c457e4c42",
+    },
+    {
+        id: "unsloth/Qwen3.8-27B-GGUF/Qwen3.8-27B-UD-Q4_K_M.gguf",
+        label: "Qwen3.8 27B",
+        weightsBytes: 16_464_440_224,
+        tier: "work",
+        revision: "4ca720788d1e01f1bff70c033e0d0028fd02e502",
+        sha256: "322e194ff79741c7baa497c240f677f54b201b0efab44ca8e50f122b39123482",
     },
-    { id: "unsloth/Qwen3.5-9B-GGUF/Qwen3.5-9B-Q4_K_M.gguf", label: "Qwen3.5 9B", weightsBytes: 5_680_522_464, tier: "work" },
-    { id: "unsloth/gemma-4-12b-it-GGUF/gemma-4-12b-it-Q4_K_M.gguf", label: "Gemma 4 12B", weightsBytes: 7_121_861_440, tier: "work" },
-    { id: "unsloth/Qwen3.8-27B-GGUF/Qwen3.8-27B-UD-Q4_K_M.gguf", label: "Qwen3.8 27B", weightsBytes: 16_464_440_224, tier: "work" },
 ];
 export const localModelChoice = (id: string): LocalModelChoice | undefined => LOCAL_MODELS.find((choice) => choice.id === id);
 // Exactly one row carries the instant tier; the fit module and the prefetch route take it from here rather than

package/src/schemas/ci.ts

@@ -1,7 +1,6 @@
 // ci: pipeline runs on the workspace repos' github/gitlab remotes
 import { z } from "zod";
 import { AgentRunPickSchema } from "./agent.js";
-import { RedDecisionSchema } from "./workspace/push-checks.js";
 // The daemon maps each workspace repo to its CI project via a connected github/gitlab capability, registers a webhook
 // to fire `ci` listener automations instantly, and serves the Pipelines rail from a webhook-freshened, poll-backfilled
 // cache. `host` names which provider API serves a repo; the listener provider is always `ci`, since a trigger narrows
@@ -112,31 +111,72 @@ export type CiRepo = z.infer<typeof CiRepoSchema>;
 // Fallback poll interval when a repo's webhook couldn't register; lives here since both the poller and the automation
 // editor need it to tell the owner what a `hookWarning` actually costs (minutes' delay, not the feature).
 export const CI_POLL_INTERVAL_MS = 2 * 60_000;
-// Main's CI while it is red, as the daemon's one fix agent on it sees it (ci/main-fixer.ts): from the first job that
-// failed until a later run of every workflow that failed on it passes, whatever else failed along the way.
-export const CiMainRedSchema = z.object({
+// What was decided about a main-line branch while its CI fails, in the order it was decided (ci/main-fixer.ts).
+export const MainFailureDecisionKindSchema = z.enum([
+    // Its one fix agent was put on it: by the sandbox at the first job that failed, or by a person's Fix press, which
+    // gives the agent its turns back.
+    "fix-up",
+    // Nobody was sent: repairs are switched off, or nothing could take it.
+    "reported",
+    // The fix agent had its turns, or stopped without a fix: it waits for a person.
+    "spent",
+]);
+export type MainFailureDecisionKind = z.infer<typeof MainFailureDecisionKindSchema>;
+
+// Why the fix agent handed the failure back (a `spent` decision), as a closed set the editor words for itself, so what a
+// reader sees stays a few words in every language rather than whatever the turn's error happened to say.
+export const MainFailureHandBackSchema = z.enum([
+    // It had every turn the sandbox gives one failure, and main still fails.
+    "turns",
+    // Its turn ended without changing anything, so the failure is likely not in the code.
+    "no-change",
+    // A person stopped it.
+    "stopped",
+    // Its turn was cut off.
+    "interrupted",
+    // Its turn failed.
+    "turn-failed",
+    // Its conversation is gone or archived.
+    "gone",
+    // It could not be told about the newest failure.
+    "refused",
+]);
+export type MainFailureHandBack = z.infer<typeof MainFailureHandBackSchema>;
+
+export const MainFailureDecisionSchema = z.object({
+    kind: MainFailureDecisionKindSchema.describe("What was decided."),
+    reason: MainFailureHandBackSchema.optional().describe("Why the fix agent handed it back, on a `spent` decision."),
+    conversationId: z.string().optional().describe("The conversation working on it, when one is."),
+    at: z.number().describe("When that was decided, in milliseconds."),
+    detail: z.string().optional().describe("One short sentence on why, in the sandbox's words."),
+});
+export type MainFailureDecision = z.infer<typeof MainFailureDecisionSchema>;
+
+// A main-line branch while its CI fails, as the daemon's one fix agent on it sees it (ci/main-fixer.ts): from the first
+// job that failed until a later run of every workflow that failed on it passes, whatever else failed along the way.
+export const CiMainFailureSchema = z.object({
     repo: z.string().describe("Which workspace repository."),
     branch: z.string().describe("Which main-line branch."),
     since: z.number().describe("When its first job failed, in milliseconds."),
     runId: z.number().describe("The newest run that failed on it."),
-    jobs: z.array(z.string()).describe("The jobs failing on it now, by name: the newest red run's failures, and any that failed since."),
+    jobs: z.array(z.string()).describe("The jobs failing on it now, by name: the newest failed run's failures, and any that failed since."),
     fixer: z
         .string()
         .optional()
-        .describe("The one conversation working on it, which every failure goes to until the branch is green. Absent while nobody is on it."),
-    decision: RedDecisionSchema.optional().describe(
+        .describe("The one conversation working on it, which every failure goes to until the branch passes. Absent while nobody is on it."),
+    decision: MainFailureDecisionSchema.optional().describe(
         "The latest thing decided about it: `fix-up` while the fix agent has it, `spent` once it waits for you (its turns are used up, or it stopped without a fix), `reported` when repairs are off.",
     ),
 });
-export type CiMainRed = z.infer<typeof CiMainRedSchema>;
+export type CiMainFailure = z.infer<typeof CiMainFailureSchema>;
 export const CiRunsResponseSchema = z.object({
     repos: z.array(CiRepoSchema).describe("Which workspace repositories are wired to a forge, and how each one's notifications are set up."),
     // Newest first, across all mapped repos.
     runs: z.array(PipelineRunSchema).describe("Runs across all of them, newest first."),
-    reds: z
-        .array(CiMainRedSchema)
+    failures: z
+        .array(CiMainFailureSchema)
         .optional()
-        .describe("Every main-line branch red right now, with the fix agent on it. Absent from a daemon that keeps none."),
+        .describe("Every main-line branch failing right now, with the fix agent on it. Absent from a daemon that keeps none."),
 });
 export type CiRunsResponse = z.infer<typeof CiRunsResponseSchema>;
 // Re-resolves repo → project + token on every call, so a stale card can't act on a mapping the workspace no longer has.
@@ -155,6 +195,11 @@ export const CiFixParamSchema = CiRunParamSchema.extend({
     pick: AgentRunPickSchema.describe(
         "Which model to open the conversation on, when somebody chose one. Leave it out for the sandbox's own choice, which is the ordinary path.",
     ),
+    // The browser's own chat pick, which the daemon never holds: without it an unpinned fix opened on a provider the
+    // owner never chose. Absent (an older app, or nobody pressed) keeps the sandbox's own fallback.
+    fallback: AgentRunPickSchema.describe(
+        "The model a new chat opens on for whoever pressed, for when nobody chose one and no model set for fixing pipelines can run. Used while this sandbox can serve its provider; left out, or not servable, the sandbox takes its default provider when connected, else the first one connected.",
+    ),
     // The verb the picker's bar was ended with, when an attempt already exists (state/fix-attempt-plan.ts). Left out,
     // an ended attempt is continued and a fresh press opens attempt 1; one still in play answers CONFLICT.
     mode: z

package/src/schemas/context-trim.ts

@@ -1,5 +1,6 @@
 // context-trim: what a window too small for a full turn made the sandbox leave out
 import { z } from "zod";
+import type { SandboxNotice } from "../events/sandbox-notice.js";
 
 // The only disclosure of a note that never rode; without it a turn runs thinner and nothing on screen says why.
 export const ContextTrimSchema = z.object({
@@ -18,12 +19,16 @@ export type ContextTrim = z.infer<typeof ContextTrimSchema>;
 // 16k, 32k; a server's own odd number spelled out in full.
 const windowLabel = (tokens: number): string => (tokens % 1024 === 0 ? `${tokens / 1024}k` : tokens.toLocaleString("en-US"));
 
+/** The trim's notice by code and facts, for a reader that words it in its own language. */
+export const contextTrimNotice = ({ window, omitted, base }: ContextTrim): Extract<SandboxNotice, { code: "contextTrim" }> => ({
+    code: "contextTrim",
+    params: { window: windowLabel(window), ...(omitted.length === 0 ? {} : { omitted: omitted.join(`, `) }), base },
+});
+
 // The closing clause is load-bearing: without it the row reads as "my AGENTS.md may not have arrived".
-export const contextTrimLine = ({ window, omitted, base }: ContextTrim): string => {
+export const contextTrimLine = (trim: ContextTrim): string => {
+    const { window, omitted, base } = contextTrimNotice(trim).params;
     const swapped = base ? ` The agent's own base instructions were swapped for a short paragraph, too.` : ``;
-    const left = omitted.length === 0 ? `` : ` — left out: ${omitted.join(`, `)}`;
-    return (
-        `Sent thin for this model's ${windowLabel(window)} window${left}.${swapped}` +
-        ` Your workspace rules, this turn's persona and where its files live still rode.`
-    );
+    const left = omitted === undefined ? `` : ` — left out: ${omitted}`;
+    return `Sent thin for this model's ${window} window${left}.${swapped}` + ` Your workspace rules, this turn's persona and where its files live still rode.`;
 };