@intentic/sandbox-contract 1.325.0 → 1.327.0

package/src/schemas/phone.ts

@@ -0,0 +1,121 @@
+// phone: the user's own Android phone (the `phone` capability's live half)
+import { z } from "zod";
+import { RelayChannelSchema } from "./push.js";
+
+// The card's switches. A phone's sibling of `device` and `webext`, not an arm of either: it has no shell and no home
+// folder, and what it can be asked (its screen, the apps on it, the folders and notifications the owner handed it)
+// is granted twice, once here and once on the phone itself, where Android asks the person for each kind of access.
+// Every switch is enforced by the app on the phone, never checked on the daemon side. A switch the app does not know
+// is read as off, so a newer sandbox never breaks an older app's connection.
+const phoneScope = z.enum(["on", "off"]);
+export const PhoneScopesSchema = z.object({
+    // On by default, as on a computer. Android still asks the person before the first capture of a session unless the
+    // touch-and-type service is on, so this switch is the sandbox's half of a consent the phone holds the other half of.
+    screen: phoneScope.default("on"),
+    // Tapping, swiping and typing in other apps, through the app's accessibility service. Off by default, like a
+    // computer's mouse and keyboard; only the direct-download build carries it at all (Google Play forbids an agent
+    // driving other apps through that service).
+    control: phoneScope.default("off"),
+    // Reading the folders the owner picked on the phone. Nothing else on the phone is reachable as a file.
+    files: phoneScope.default("on"),
+    // Creating, changing and trashing files in those folders.
+    write: phoneScope.default("off"),
+    // Reading the phone's notifications, which is where one-time codes and messages arrive. Off by default: it reads
+    // what every other app posts.
+    notifications: phoneScope.default("off"),
+    // Opening apps, links and the phone's own settings screens.
+    apps: phoneScope.default("on"),
+    // Typing text the command classifier reads as destructive, and acting in an app the person marked sensitive.
+    destructive: phoneScope.default("off"),
+    // "sensitive" (default) asks on the phone before a password, payment or delete action; "always" before every
+    // action; "never" trusts the owner to watch.
+    confirm: z.enum(["sensitive", "always", "never"]).default("sensitive"),
+});
+export type PhoneScopes = z.infer<typeof PhoneScopesSchema>;
+// An open slug like a device's `platform` (android today), so a new phone family needs no daemon release.
+export const PhoneConfigSchema = PhoneScopesSchema.extend({ platform: z.string().min(1) });
+export type PhoneConfig = z.infer<typeof PhoneConfigSchema>;
+
+// One app the person allowed the agent into, on the phone itself: `read` lets it look, `act` lets it touch too.
+// The phone's own allow-list, the way a browser's site grants are the browser's: the agent asks, only the person grants.
+export const PhoneAppGrantSchema = z.object({
+    package: z.string(),
+    label: z.string(),
+    mode: z.enum(["read", "act"]),
+});
+export type PhoneAppGrant = z.infer<typeof PhoneAppGrantSchema>;
+
+// A folder the person picked on the phone, by the name the agent addresses it with.
+export const PhoneFolderSchema = z.object({
+    name: z.string(),
+    writable: z.boolean(),
+});
+export type PhoneFolder = z.infer<typeof PhoneFolderSchema>;
+
+// What a connected phone reports about itself. Strings where a newer app may say something new, so an older sandbox
+// still reads it.
+export const PhoneFactsSchema = z.object({
+    // How a person names it: "Google Pixel 8".
+    device: z.string(),
+    // The Android release ("16") and its API level (36).
+    android: z.string(),
+    sdk: z.number().int(),
+    // "direct" (downloaded from intentic.dev, can touch and type) or "play" (the store build, which cannot).
+    build: z.string(),
+    // The pause tile on the phone; true means every tool refuses and says the person paused it.
+    paused: z.boolean(),
+    // What the person has switched on in Android's own settings for this app.
+    access: z.object({
+        // The accessibility service behind touch and type, and behind screenshots taken without asking.
+        accessibility: z.boolean(),
+        // The notification listener behind reading notifications.
+        notifications: z.boolean(),
+        // How a screenshot is taken now: "accessibility" (no prompt), "consent" (the person allows each session) or
+        // "none" (screenshots are off on the phone).
+        screenCapture: z.string(),
+    }),
+    folders: z.array(PhoneFolderSchema),
+    apps: z.array(PhoneAppGrantSchema),
+    battery: z.object({ level: z.number().min(0).max(100), charging: z.boolean() }).optional(),
+    // The phone's Firebase Cloud Messaging token, when Google Play services are there: what the sandbox wakes it with.
+    // Not a credential (sending needs the app vendor's key), so it rides the facts.
+    wake: z.object({ fcm: z.string().min(1) }).optional(),
+    // Optional procedures and tool families this build answers; strings, so a newer build's never fails a read.
+    features: z.array(z.string()).optional(),
+});
+export type PhoneFacts = z.infer<typeof PhoneFactsSchema>;
+
+// Whether the sandbox can wake this phone when it is asleep: "ready" holds a relay channel for the phone's current
+// token, "register" means the phone has a token nobody registered yet (the editor does it, signed in to the platform),
+// "none" means the phone has no way to be woken (no Google Play services) and only answers while its app is open or
+// set to stay connected.
+export const PhoneWakeStateSchema = z.enum(["ready", "register", "none"]);
+export type PhoneWakeState = z.infer<typeof PhoneWakeStateSchema>;
+
+export const PhoneSummarySchema = z.object({
+    // The capability id and the prefix of its tools (mcp__<id>__screenshot).
+    id: z.string(),
+    platform: z.string().min(1),
+    online: z.boolean(),
+    // Whether the sandbox holds a pairing for this phone. `online`, `lastSeen` and `facts` live in memory and are empty
+    // after every restart, so none of them can tell a phone that was never paired from one that has not dialled in yet.
+    // Absent from a daemon older than this field, which a reader takes as "cannot tell".
+    paired: z.boolean().optional(),
+    // The app's build; an old one reads as outdated rather than missing a tool.
+    version: z.string().optional(),
+    // Epoch ms of the last connection; absent after a restart rather than stale.
+    lastSeen: z.number().optional(),
+    facts: PhoneFactsSchema.optional(),
+    wake: PhoneWakeStateSchema,
+});
+export type PhoneSummary = z.infer<typeof PhoneSummarySchema>;
+export const PhonesListSchema = z.object({ phones: z.array(PhoneSummarySchema) });
+
+// The editor's half of making a phone wakeable: it registered the phone's token with the platform's push relay,
+// signed in as the owner, and hands the sandbox the channel the relay answered with. `token` is the one it registered,
+// so a phone that rotated its token reads "register" again instead of being woken through a dead channel.
+export const PhoneWakeRegistrationSchema = z.object({
+    token: z.string().min(1),
+    channel: RelayChannelSchema,
+});
+export type PhoneWakeRegistration = z.infer<typeof PhoneWakeRegistrationSchema>;

package/src/schemas/privacy.ts

@@ -21,9 +21,10 @@ export const PERSONAL_DATA_CLASSES = [
 export const PersonalDataClassSchema = z.enum(PERSONAL_DATA_CLASSES);
 export type PersonalDataClass = z.infer<typeof PersonalDataClassSchema>;
 
-// off: nothing is routed or read. watch: every shieldable turn goes through the gateway, which reads and records what it
-// would have masked and sends everything unchanged. on: untrusted providers get tokens, and a turn that cannot be
-// shielded (a runtime the gateway cannot sit in front of) is refused unless its provider is trusted.
+// off: nothing is routed or read. watch: every shieldable turn is read on its way (the gateway, or a hooked runtime's
+// channels), which records what it would have masked and sends everything unchanged. on: untrusted providers get
+// tokens, and a turn that cannot be read by content at all (a runtime with no gateway and no hooks) is refused unless its
+// provider is trusted.
 export const PrivacyShieldModeSchema = z.enum(["off", "watch", "on"]);
 export type PrivacyShieldMode = z.infer<typeof PrivacyShieldModeSchema>;
 
@@ -103,7 +104,7 @@ export const DEFAULT_PRIVACY_SHIELD: PrivacyShieldPolicy = PrivacyShieldPolicySc
 export const PrivacyProviderSchema = z.object({
     id: z.string().describe("Provider id, as the trusted list names it."),
     label: z.string(),
-    shieldable: z.boolean().describe("Its runtime can be put behind the gateway; one that cannot is refused while the shield is on, unless trusted."),
+    shieldable: z.boolean().describe("The shield can read what its runtime sends by content (through the gateway or the runtime's hooks); one it cannot is refused while the shield is on, unless trusted."),
     local: z.boolean().describe("It runs on this machine, so it is trusted whatever the list says."),
 });
 export type PrivacyProvider = z.infer<typeof PrivacyProviderSchema>;
@@ -120,10 +121,28 @@ export const PrivacyShieldStatusSchema = z.object({
 });
 export type PrivacyShieldStatus = z.infer<typeof PrivacyShieldStatusSchema>;
 
-// One request the gateway handled, as the log keeps it: counts and kinds, never a value.
+// One request the gateway handled, as the log keeps it: counts and kinds, the tokens it gave and the masked text around
+// them, never a value.
 export const PrivacyLedgerActionSchema = z.enum(["masked", "watched", "passed", "refused"]);
 export type PrivacyLedgerAction = z.infer<typeof PrivacyLedgerActionSchema>;
 
+// The most replacements one entry keeps, and how much masked text it keeps on each side of a token: enough to see what a
+// value became and how the provider read it, not a second transcript.
+export const PRIVACY_REPLACEMENTS_MAX = 12;
+export const PRIVACY_EXCERPT_REACH = 48;
+
+// One value the shield replaced in what a request added, as its token: the value itself stays in the vault, off the
+// workspace, and only the owner can have it read back (privacy.reveal).
+export const PrivacyReplacementSchema = z.object({
+    token: z.string().describe("The token the value became, as the provider read it: Alice."),
+    class: PersonalDataClassSchema,
+    excerpt: z
+        .string()
+        .describe("The masked text around the token as it left this machine (watching: as it would have). Tokens only, never a value."),
+    image: z.boolean().optional().describe("Found in an image's text, so the token was painted over the picture rather than written."),
+});
+export type PrivacyReplacement = z.infer<typeof PrivacyReplacementSchema>;
+
 export const PrivacyLedgerEntrySchema = z.object({
     at: z.string().describe("When, as an ISO timestamp."),
     conversationId: z.string().optional(),
@@ -135,9 +154,19 @@ export const PrivacyLedgerEntrySchema = z.object({
     documents: z.number().int().describe("Documents replaced by their masked text."),
     protocol: z.string().describe("Which wire format the request spoke."),
     detail: z.string().optional().describe("Why it was refused, when it was."),
+    replacements: z
+        .array(PrivacyReplacementSchema)
+        .max(PRIVACY_REPLACEMENTS_MAX)
+        .optional()
+        .describe("The first values replaced in what this request added, one per token. Absent on entries written before it was kept."),
 });
 export type PrivacyLedgerEntry = z.infer<typeof PrivacyLedgerEntrySchema>;
 
+// Tokens read back to their values, for the owner checking what the shield masked; a token this vault never gave out is
+// left out of the answer.
+export const PRIVACY_REVEAL_MAX = 100;
+export const PrivacyRevealSchema = z.object({ tokens: z.array(z.string().min(1).max(64)).max(PRIVACY_REVEAL_MAX) });
+
 // A dataset taught to the shield: each value is matched exactly from then on, in every form it is written.
 export const PRIVACY_KNOWN_BATCH_MAX = 50_000;
 
@@ -159,7 +188,7 @@ export type PrivacyKnownSource = z.infer<typeof PrivacyKnownSourceSchema>;
 export const PrivacyNameListSchema = z.object({
     id: z.string().describe("Stable id of the list."),
     kind: z.enum(["first-name", "surname", "ambiguous", "title", "never"]).describe("What a word on it says about a name."),
-    languages: z.array(z.enum(["pl", "en"])).describe("The languages its words come from."),
+    languages: z.array(z.enum(["pl", "en", "multi"])).describe("The languages its words come from; multi: many languages at once."),
     count: z.number().int().describe("How many words it holds."),
     matching: z
         .enum(["inflected", "as-written"])
@@ -176,7 +205,7 @@ export const PrivacyNameWordSchema = z.object({
     firstName: z.boolean().describe("A listed first name, in this form or as an inflection of one."),
     surname: z.boolean().describe("A listed surname, in this form or as an inflection of one."),
     surnameForm: z.boolean().describe("Shaped like a Polish surname (-ski, -cki, -wicz…), listed or not."),
-    ambiguous: z.boolean().describe("Also an ordinary word, so found only beside other evidence (a surname, a title)."),
+    ambiguous: z.boolean().describe("Also an ordinary word in some language, so found only beside other evidence (a title, a name field) and no surname to pair a first name with."),
     never: z.boolean().describe("Never taken as part of a name (a title, an institution, a function word)."),
 });
 export type PrivacyNameWord = z.infer<typeof PrivacyNameWordSchema>;

package/src/schemas/project-delivery.ts

@@ -0,0 +1,78 @@
+import { z } from "zod";
+
+// LANDED WORK DELIVERED TO THE OWNER'S FOLDER. A folder attached to this computer's own sandbox is copied one way into
+// `/work/<name>`; when a conversation's work lands there, the daemon hands the same change to the machine agent that
+// holds the folder, which applies it file by file under a restore point and never over an edit of the owner's own.
+// The daemon asks (`deliverProject` on the device contract), the machine decides and writes; nothing an agent runs can
+// call it, since it is a procedure of the device link and not one of its tools.
+
+// One changed file, as the land changed it: `base` is the content the conversation started from, `next` what it
+// landed. Both base64, null where the file did not exist (an addition has no base, a deletion no next). A rename
+// arrives as a deletion and an addition.
+export const DeliveredFileSchema = z.strictObject({
+    path: z.string().min(1).describe("Folder-relative, `/`-separated, never `.`, `..`, a drive or a backslash."),
+    kind: z.enum(["added", "modified", "deleted"]),
+    base: z.string().nullable(),
+    next: z.string().nullable(),
+    // Set only when the landed file is executable; the owner's folder keeps its own bit otherwise.
+    executable: z.boolean().optional(),
+});
+export type DeliveredFile = z.infer<typeof DeliveredFileSchema>;
+
+// The whole of what a delivery may carry in one call, decoded; past it the daemon delivers nothing and says so, and the
+// window's Bring back still reaches every file.
+export const PROJECT_DELIVERY_MAX_BYTES = 32 * 1024 * 1024;
+
+export const ProjectDeliverySchema = z.strictObject({
+    // The sandbox folder the change landed in, exactly `/work/<name>`; the machine finds the folder paired with it.
+    remoteDir: z.string().min(1),
+    files: z.array(DeliveredFileSchema),
+    // Which land this is, for the restore point's record and the machine's audit line.
+    landing: z.strictObject({ agentId: z.string().min(1), title: z.string().optional() }),
+});
+export type ProjectDelivery = z.infer<typeof ProjectDeliverySchema>;
+
+// Why a file was left as the owner's folder holds it. `edited`: the owner changed it too and the two would not merge
+// cleanly (or it is not text). `link`: a link or a non-file stands on its path. `outside`: the path would leave the
+// folder. `missing-git`: the change needed a three-way merge and this machine has no git to make one.
+export const DeliveryConflictReasonSchema = z.enum(["edited", "link", "outside", "missing-git"]);
+export type DeliveryConflictReason = z.infer<typeof DeliveryConflictReasonSchema>;
+
+export const ProjectDeliveryResultSchema = z.object({
+    // The restore point taken before the first write (`intentic-machine sync restore --point <id>` undoes it); absent
+    // when nothing was written.
+    point: z.string().optional(),
+    // The folder on the machine, as the owner knows it.
+    folder: z.string(),
+    // Written as landed.
+    applied: z.array(z.string()),
+    // Written as a merge of the owner's edit and the landed change; `content` (base64) is what the folder now holds, so
+    // the sandbox's copy can be brought to the same bytes.
+    merged: z.array(z.object({ path: z.string(), content: z.string() })),
+    // Already as landed in the folder; nothing written.
+    already: z.array(z.string()),
+    conflicts: z.array(z.object({ path: z.string(), reason: DeliveryConflictReasonSchema })),
+});
+export type ProjectDeliveryResult = z.infer<typeof ProjectDeliveryResultSchema>;
+
+// What became of a land's delivery, kept on the conversation's landing record and shown on its card.
+// - delivered: every file is in the folder as landed (or merged with the owner's edit).
+// - partial: some were kept out, named in `conflicts`; the rest were written.
+// - waiting: the computer holding the folder is not connected; it is delivered when it next is.
+// - failed: the machine refused or broke; `reason` says why. Bring back still reaches the files.
+// - too-large: past PROJECT_DELIVERY_MAX_BYTES; Bring back reaches the files.
+export const LandingDeliveryStateSchema = z.enum(["delivered", "partial", "waiting", "failed", "too-large"]);
+export type LandingDeliveryState = z.infer<typeof LandingDeliveryStateSchema>;
+
+export const LandingDeliverySchema = z.object({
+    state: LandingDeliveryStateSchema,
+    at: z.number().describe("When this state was reached, in milliseconds."),
+    // Which project folder of the workspace the land was delivered from (`my-app` for /work/my-app).
+    project: z.string(),
+    folder: z.string().optional().describe("The folder on the owner's computer, as its machine reported it."),
+    applied: z.number().int().nonnegative().describe("Files written, merged ones included."),
+    conflicts: z.array(z.object({ path: z.string(), reason: DeliveryConflictReasonSchema })),
+    point: z.string().optional().describe("The machine's restore point taken before writing."),
+    reason: z.string().optional().describe("Why it failed or waits, in a sentence."),
+});
+export type LandingDelivery = z.infer<typeof LandingDeliverySchema>;

package/src/schemas/providers/plan-limits.ts

@@ -1,5 +1,5 @@
 import { z } from "zod";
-import { ChildRunSchema } from "../../events/requests.js";
+import { ChildRunSchema, PAGE_VALUE_MAX } from "../../events/requests.js";
 import { TRANSLATOR_PROVIDERS, type TranslatorProvider } from "../../models/provider-specs.js";
 import { AgentHarnessSchema, AgentProviderSchema, ConversationIdSchema, EditorContextSchema } from "../agent.js";
 import { MENTION_LIMIT } from "../../text/mentions.js";
@@ -271,6 +271,20 @@ export const AgentReplySchema = z.discriminatedUnion("kind", [
             .boolean()
             .describe("Yes releases exactly one payment. Anything else spends nothing. This click is the only way the money can move."),
     }),
+    // What a page the agent asked on sent back, as JSON text: the page's own answer, handed to the agent as it came.
+    z.object({
+        kind: z.literal("page_ask").describe("Answering a page the agent showed to be answered on."),
+        requestId: z.string().min(1).describe("Which card you are answering."),
+        value: z
+            .string()
+            .max(PAGE_VALUE_MAX)
+            .optional()
+            .describe("What the page sent back, as JSON text. Absent with a dismissal."),
+        cancelled: z
+            .boolean()
+            .optional()
+            .describe("Dismissing it instead, which tells the agent to carry on without an answer rather than leaving it waiting."),
+    }),
     // The one reply whose sender is checked: the daemon verifies identity against the card's named list and refuses
     // anyone else, including a `no` — otherwise a stranger could deny-of-service the approver.
     z.object({
@@ -410,10 +424,16 @@ export const QueueResumeSchema = z.object({
     routing: ResumeRoutingSchema.optional().describe(
         "Who serves the turn the waiting messages start, when the conversation has been re-pointed since they were queued: the usual answer to a refusal that held them. Leave it out to send them as they were queued.",
     ),
+    ids: z
+        .array(z.string().min(1))
+        .optional()
+        .describe(
+            "Which waiting messages to let go: a booked message named here goes now, and any held message goes with it. Leave it out to let every waiting message go, booked or held.",
+        ),
 });
 export type QueueResume = z.infer<typeof QueueResumeSchema>;
-// Re-times what a conversation's queue holds: the same messages, booked for another instant or for after another
-// conversation's work lands. One of the two, never both, since a hold waits on exactly one thing.
+// Re-times what a conversation's queue holds: the same messages (or only those `ids` names), booked for another instant
+// or for after another conversation's work lands. One of the two, never both, since a booking waits on exactly one thing.
 export const QueueScheduleSchema = z
     .object({
         conversationId: z.string().min(1).describe("Whose queue."),
@@ -426,6 +446,10 @@ export const QueueScheduleSchema = z
         sendAfter: ConversationIdSchema.optional().describe(
             "Send what waits once that conversation has finished and all of its work has landed in the workspace, instead. Sent now when it has nothing running and nothing left to land.",
         ),
+        ids: z
+            .array(z.string().min(1))
+            .optional()
+            .describe("Which waiting messages to re-time; every other keeps its own booking. Leave it out to re-time every waiting message."),
     })
     .refine((input) => (input.sendAt === undefined) !== (input.sendAfter === undefined), {
         message: "name exactly one of sendAt and sendAfter",

package/src/schemas/providers/usage.ts

@@ -71,15 +71,15 @@ export const UsageTurnSchema = z.object({
     // Arm of the project-map experiment, stable per conversation; mapChars is the note's length when sent.
     mapArm: z.boolean().optional(),
     mapChars: z.number().optional(),
+    // Which comparison `mapArm` belongs to: absent on the map-or-none rows, "compact-vs-full" since 2026-10-06, when
+    // the arm became the compact map and the holdout the full one.
+    mapCohort: z.string().optional(),
     // Arm of the field-notes experiment, stable per conversation; notesChars is what the budget let through.
     notesArm: z.boolean().optional(),
     notesChars: z.number().optional(),
     // Hash of the brief that was sent, recorded on control turns too. Load-bearing rather than decorative: the file is
     // rewritten monthly, so a 30-day window holds two different treatments and pooling them would measure neither.
     notesCohort: z.string().optional(),
-    // Arm of the lean-guidance experiment, stable per conversation; true is the short form. The cohort hashes both forms.
-    guidanceArm: z.boolean().optional(),
-    guidanceCohort: z.string().optional(),
     // Arm of the tool-result clearing experiment, stable per conversation; true is a conversation whose old tool results
     // the gateway drops. Native Claude turns only: no other runtime's requests pass a gateway that clears.
     clearingArm: z.boolean().optional(),

package/src/schemas/push.ts

@@ -69,6 +69,7 @@ export const PushConfigSchema = z.object({
             "Whether the asking device is already registered, so a toggle can show its real state instead of trusting the device's own permission, which can be granted with nothing behind it.",
         ),
 });
+export type PushConfig = z.infer<typeof PushConfigSchema>;
 export const PushChannelIdSchema = z.object({
     id: z.string().min(1).describe("Which device: a browser's push address, or a native install's device id."),
 });

package/src/schemas/secrets.ts

@@ -1,4 +1,5 @@
 // secrets: user-supplied env-var secrets the daemon writes to desired-state/.env
+import { BrokerRuleSchema } from "@intentic/extension-manifest";
 import { z } from "zod";
 import { SECRET_HOST_MAX, SECRET_HOST_PATTERN_RE, SECRET_HOSTS_MAX } from "../policy/secret-hosts.js";
 // Straight to the sandbox daemon, never through the platform; `apply` reloads .env with no restart. `list` returns keys
@@ -60,8 +61,10 @@ export const CredentialGateKindSchema = z
 export type CredentialGateKind = z.infer<typeof CredentialGateKindSchema>;
 
 export const CredentialLaneSchema = z
-    .enum(["shell", "code", "browser", "session", "otp"])
-    .describe("What the credential was about to be used for: a shell command, a script, typing into a page, mounting a connected account, or one one-time code.");
+    .enum(["shell", "code", "browser", "session", "otp", "gateway", "ssh"])
+    .describe(
+        "What the credential was about to be used for: a shell command, a script, typing into a page, mounting a connected account, one one-time code, a request the credential gateway attaches it to, or a signature the sandbox's ssh agent makes with a held key.",
+    );
 export type CredentialLane = z.infer<typeof CredentialLaneSchema>;
 
 export const CredentialGateSchema = z.object({
@@ -167,6 +170,44 @@ export const SecretHostGuardSetResultSchema = z.object({
 
 // Across every store: env/generated secrets, capability credentials, AI-provider accounts. Values never ride this
 // shape; `revealable` says whether `reveal` can return one (everything but provider accounts).
+// How the agent gets one connection's credential, and what it may do with it there. `gateway` is the default for every
+// connector that declares gateway routes: the credential never enters the agent's shell, and the rules below are
+// enforced where it is attached. `raw` is the owner's explicit choice for a tool that needs the real value; `direct` is a
+// connector with no gateway route at all (a database's wire protocol, a mail server, a request signature) or an SSH
+// machine signed into with a password; `ssh-agent` is an SSH machine's key, which the sandbox's ssh agent signs with.
+export const CredentialDeliveryModeSchema = z
+    .enum(["gateway", "raw", "direct", "ssh-agent"])
+    .describe(
+        "How the agent gets this connection's credential: `gateway` keeps it in the sandbox's credential gateway, which attaches it to each request the agent sends and checks the rules first; `raw` hands it to the agent because the owner chose that for a tool needing the real value; `direct` hands it over because nothing can use it on the agent's behalf (a database, a mail server, an SSH password); `ssh-agent` keeps an SSH key in the sandbox's ssh agent, which signs for the agent's ssh and never hands the key over.",
+    );
+export type CredentialDeliveryMode = z.infer<typeof CredentialDeliveryModeSchema>;
+
+export const CredentialPolicySchema = z.object({
+    subject: z.string().describe("The connection's id."),
+    delivery: CredentialDeliveryModeSchema,
+    rules: z
+        .array(BrokerRuleSchema)
+        .describe("What the credential may do through the gateway, checked in order, the first covering rule deciding; a request none covers is allowed."),
+    rulesFrom: z
+        .enum(["connector", "owner"])
+        .describe("Whose rules these are: the connector's own defaults, or the owner's, which replace them whole."),
+});
+export type CredentialPolicy = z.infer<typeof CredentialPolicySchema>;
+
+export const CredentialPolicySetSchema = z.object({
+    subject: z.string().describe("The connection's id."),
+    delivery: z
+        .enum(["gateway", "raw"])
+        .optional()
+        .describe("Hand the agent the credential itself (`raw`), or keep it in the gateway (`gateway`). Leave it out to keep what is set."),
+    rules: z
+        .array(BrokerRuleSchema)
+        .nullable()
+        .optional()
+        .describe("The owner's own rules, replacing the connector's whole; `null` goes back to the connector's. Leave it out to keep what is set."),
+});
+export type CredentialPolicySet = z.infer<typeof CredentialPolicySetSchema>;
+
 export const SecretInventoryEntrySchema = z.object({
     // Env-var key for env|generated; `<provider>:<accountId>` for provider; capability instance id otherwise.
     key: z.string().describe("What identifies it. Unique across the whole inventory, so several accounts of one provider each get their own entry."),
@@ -195,7 +236,11 @@ export const SecretInventoryEntrySchema = z.object({
     lastUse: z
         .object({
             at: z.number().describe("When, in milliseconds."),
-            lane: z.enum(["shell", "code", "browser"]).describe("How it was used: a command, a script, or typed into a page."),
+            lane: z
+                .enum(["shell", "code", "browser", "gateway", "ssh"])
+                .describe(
+                    "How it was used: a command, a script, typed into a page, attached by the credential gateway to a request the agent sent, or a key the sandbox's ssh agent signed with for the agent.",
+                ),
             detail: z
                 .string()
                 .optional()
@@ -204,6 +249,12 @@ export const SecretInventoryEntrySchema = z.object({
         })
         .optional()
         .describe("The last time an agent actually spent this secret. Absent while it never has been, which most never are."),
+    // Joined from the credential gateway's policy, on a connection's row only.
+    credential: CredentialPolicySchema.omit({ subject: true })
+        .optional()
+        .describe(
+            "How the agent gets this connection's credential and what it may do with it. Absent on everything but a connected command-line tool or SSH machine.",
+        ),
     // Joined from the gate policy, so the row can name the approver without a second call.
     gate: z
         .object({

package/src/schemas/settings-history.ts

@@ -110,4 +110,6 @@ export const SETTINGS_HISTORY = [
     at("offload", drop("landCheck")),
     // The model list for the fix a refused push offered (2026-09-28): a refused push now says why and offers nothing.
     at("modelRoles", drop("pre-push-fix")),
+    // The short guidance form (2026-10-06): it lost its A/B to the full one, which every turn now gets.
+    ...dropAll(["leanGuidance", "leanGuidanceHoldout"]),
 ] as const;

package/src/schemas/settings.ts

@@ -9,6 +9,11 @@ import { LimitPolicySchema, RetryPolicySchema } from "./turn-break.js";
 import { ZoneSchema } from "../time/zone.js";
 // Which prompt base the agent runs before this turn composes anything on top: Intentic's own (default), Claude Code's
 // preset, or the owner's text. Declared out here since both the daemon and the browser branch on it.
+// Kept in the daemon's auth root, never in SandboxSettings: an agent cannot edit its execution boundary.
+export const AgentDomainSchema = z.enum(["root", "unprivileged"]);
+export const AgentDomainPolicySchema = z.object({ agentDomain: AgentDomainSchema.default("root") });
+export type AgentDomainPolicy = z.infer<typeof AgentDomainPolicySchema>;
+
 export const SystemPromptModeSchema = z.enum(["intentic", "claude", "custom"]);
 export type SystemPromptMode = z.infer<typeof SystemPromptModeSchema>;
 // Excludes "custom": there is nothing to fetch, it's whatever the owner already typed into the settings field.
@@ -280,6 +285,14 @@ export const SandboxSettingsSchema = z.object({
         .describe(
             "Whether a new chat is matched to one of your personas from its first message. It is read once the message is sent, in the same single call that chooses what the chat runs on (the New chat routing job under Models), and the chat says in its own transcript which persona it landed on. Never applies to unwatched runs, which name their persona themselves.",
         ),
+    // The `show_page`/`ask_page` tools and the guidance that names them (agent/pages/page-tools.ts); off, a turn is
+    // offered neither and draws no page, which costs it nothing.
+    chatPages: z
+        .boolean()
+        .default(true)
+        .describe(
+            "Let the agent answer with a page drawn right in the chat: a chart, a table, a diagram, a mock-up, or a small form you answer it on. Off, the agent is not offered the tools at all, so it spends nothing on them.",
+        ),
     hashlineEdits: z
         .boolean()
         .default(false)
@@ -303,21 +316,6 @@ export const SandboxSettingsSchema = z.object({
         .describe(
             "Your own instructions, used only when the mode above says custom. Then it is the whole of them: both built-in bases go, and so does everything this product would otherwise add, including the guidance the chat's own cards are driven by. That is the price of total control.",
         ),
-    // Measured by the `guidance` experiment against the full set; the full set stays the default until that says otherwise.
-    leanGuidance: z
-        .boolean()
-        .default(false)
-        .describe(
-            "Send this product's own guidance in its short form: only what the agent cannot find out by looking, instead of a paragraph for every habit it was once caught in. Off by default, because the long form is the one the product was tuned on.",
-        ),
-    leanGuidanceHoldout: z
-        .number()
-        .min(0)
-        .max(1)
-        .default(0)
-        .describe(
-            "What share of conversations to keep on the long form, so the two can be compared. Whole conversations rather than individual turns, because the guidance sits in the prompt for the whole session.",
-        ),
     // Measured by the `clearing` experiment: the gateway in front of a native Claude turn replaces old tool results with
     // a placeholder, a chunk at a time, so the cached prompt breaks once per chunk rather than on every call
     // (privacy/gateway/tool-result-clearing.ts). Off by default until that experiment says it pays.
@@ -353,17 +351,18 @@ export const SandboxSettingsSchema = z.object({
         .boolean()
         .default(false)
         .describe(
-            "Open every conversation with a map of the project it starts in: what is in it, what each part is for, and where the agent is standing. Worked out fresh each time rather than written down anywhere, because a written layout is wrong within a fortnight. Off by default, since it spends tokens on the first message of every conversation.",
+            "Open every conversation with a map of the project it starts in: the parts recent work touched and what each is for, the rest by name, where the agent is standing, and which folders the last three weeks of commits landed in. Worked out fresh each time from the tree and its history rather than written down anywhere, because a written layout is wrong within a fortnight. Off by default, since it spends tokens on the first message of every conversation.",
         ),
     // Judged on the opening turn's own directory listings, not averaged across the conversation, or a twelve-turn
-    // conversation would divide the effect by twelve.
+    // conversation would divide the effect by twelve. Since 2026-10-06 the held-out share gets the full map (every area
+    // with its size) rather than none: the map-or-none comparison had settled its one effect, fewer opening listings.
     workspaceMapHoldout: z
         .number()
         .min(0)
         .max(1)
         .default(0)
         .describe(
-            "What share of conversations to open without the map, so the two can be compared. Whole conversations rather than individual turns, because the map is sent once and stays in the conversation's history afterwards.",
+            "What share of conversations to open with the full map instead, every area with its size, so the two forms can be compared. Whole conversations rather than individual turns, because the map is sent once and stays in the conversation's history afterwards.",
         ),
     // The one composed piece that is WRITTEN rather than derived: a monthly automation rewrites it off the session
     // corpus, so it carries what no scan of the tree can (which commands really work here, what the box can take, how
@@ -486,9 +485,9 @@ export const SandboxSettingsSchema = z.object({
             "Whether each workspace repo keeps up with the remote branch it tracks. Every couple of minutes it is fetched, and what arrived is brought into the main tree: a fast-forward when you have no commits of your own, else a merge commit. Only while it is quiet (no turn working in the main tree, no merge or rebase of yours open), and never half-way: a conflict, or an uncommitted file in the way, leaves the repo exactly as it was until the next try. Nothing is ever pushed. Off, nothing is fetched.",
         ),
     // Where heavy work runs: a runner (the same image, on one of the owner's machines) instead of this sandbox. Keyed by
-    // the heavy-command rule an agent's command matched (system/resources/heavy-commands.ts), each naming a runner id. A
+    // the heavy-command rule an agent's command matched (workload/heavy-commands.ts), each naming a runner id. A
     // runner that is offline, outdated or full hands the work back here, which the command's output says. Never pushed
-    // to a runner itself (portability/definition.ts), which must not pass work on again.
+    // to a runner itself (definition/definition.ts), which must not pass work on again.
     offload: z
         .object({
             commands: z.record(z.string().min(1), z.string().min(1)).default({}),
@@ -654,7 +653,7 @@ export const SavingsArmSchema = z.object({ turns: z.number(), mean: z.number() }
 // openingListings: directory listings a turn ran to orient itself (the project map).
 // callsBeforeTarget: how far a turn walked before touching a file it went on to edit.
 // failedCalls: tool calls that ended in error (the field notes, whose largest section is a failure taxonomy).
-// roundTrips: model calls a turn took (the guidance form, whose batching and context-reuse paragraphs exist to save them).
+// roundTrips: model calls a turn took (tool-result clearing, whose lost results could cost re-runs).
 // contextPerCall: prompt tokens per model call, cached or not (tool-result clearing, which exists to shrink it).
 // Never cost: each mechanism moves one small part of a turn's work, inside the noise of the rest. Round trips are the
 // nearest a reading comes to it, and still a count of calls, not of tokens or money; the prompt a call carries is the
@@ -723,7 +722,6 @@ export const SavingsReportSchema = z.object({
     // Same absence rule as `search`: not measured, never zero.
     map: TurnExperimentSchema.optional(),
     notes: TurnExperimentSchema.optional(),
-    guidance: TurnExperimentSchema.optional(),
     clearing: TurnExperimentSchema.optional(),
 });
 export type SavingsReport = z.infer<typeof SavingsReportSchema>;