@intentic/sandbox-contract 1.333.1 → 1.335.0

package/src/models/provider-specs.ts

@@ -1,5 +1,6 @@
 import type { ProviderBrand } from "@intentic/constants";
-import { type AgentCapabilities, CLAUDE_CODE, CODEX, CURSOR, DEVIN, OPENCODE, OPENCODE_GEMINI } from "./agent-runtimes.js";
+import type { AgentLoop } from "../schemas/agent.js";
+import { type AgentCapabilities, CLAUDE_CODE, CODEX, CURSOR, DEVIN, GROK_BUILD, KIMI_CLI, MUSE, OPENCODE, OPENCODE_GEMINI } from "./agent-runtimes.js";
 
 // Every fact about a provider more than one surface needs, one row each, replacing lists that drifted out of sync.
 // `access` (cost) and `auth` (connection) stay separate: conflating them mis-describes Z.ai, a prepaid plan spent
@@ -43,8 +44,47 @@ export interface MintedVariant {
     readonly flow: "device" | "redirect";
     // ANTHROPIC_BASE_URL for a turn minted here; no version segment, the harness appends /v1/messages itself.
     readonly anthropicBase: string;
-    // Where this estate's catalog is read from: an OpenAI-compatible root, with its version segment.
+    // Where this estate's catalog is read from: an OpenAI-compatible root, with its version segment. Also the Chat
+    // Completions root a loop speaking that wire (OpenCode) sends its turns to.
     readonly catalogBase: string;
+    // The estate's OpenAI Responses root, with its version segment, for a loop that speaks only that wire (Codex); absent
+    // where the vendor publishes none, which keeps such a loop off this estate.
+    readonly responsesBase?: string;
+}
+
+// What a vendor's own terms say about one loop serving its subscription, when there is something worth saying. Shown
+// quietly (an icon and its hover card, never a banner): the owner keeps these routes by choice, and the note is there so
+// nobody runs one without being able to find out.
+// - unlisted: the vendor names the clients it supports and this loop is not among them; nothing on record forbids it.
+// - against-terms: the vendor's terms forbid it, and have been enforced against accounts.
+export interface LoopTerms {
+    readonly status: "unlisted" | "against-terms";
+    // The vendor's position in one sentence, for the hover card.
+    readonly note: string;
+    // Where the vendor says it.
+    readonly source: string;
+}
+
+// One loop a provider can run on: what that pair can do, and what the vendor says about it when there is anything to say.
+export interface LoopOffer {
+    readonly capabilities: AgentCapabilities;
+    // Absent where the vendor sanctions this loop or says nothing about it.
+    readonly terms?: LoopTerms;
+    // What a chip calls this loop when the provider's own name would not say which program runs it: the `vendor` loop of
+    // a provider whose other loops also carry its name (Grok Build beside Grok on OpenCode). Absent: loopLabel's own.
+    readonly label?: string;
+    // The variant the provider's own account door (/accounts/{provider}) signs this loop in under, for a loop whose
+    // credential is a sign-in of its own rather than the one the provider's other loops spend: a vendor CLI's login. An
+    // account the door lists carries the same word as its `variant`, which is how a picker knows which loop it serves.
+    // Absent: the loop spends the provider's default credential.
+    readonly door?: string;
+}
+
+// The loops a provider runs on. `default` is what `native` (and a turn naming no loop) resolves to, and must be one of
+// `offered`; offering a provider a new loop is one more entry in `offered`, plus the adapter that runs it.
+export interface ProviderLoops {
+    readonly default: AgentLoop;
+    readonly offered: Partial<Record<AgentLoop, LoopOffer>>;
 }
 
 export interface ProviderSpec {
@@ -63,10 +103,17 @@ export interface ProviderSpec {
     readonly auth: ProviderAuth;
     // Whether a plan-limit reading is obtainable, so a blank meter is told apart from a plan that publishes none.
     readonly planLimits: boolean;
-    // The two runtimes this provider runs on; equal records here mean the harness is not a real choice for it.
-    readonly runtimes: { readonly native: AgentCapabilities; readonly claudeCode: AgentCapabilities };
+    // The loops it runs on; one offered loop means the loop is not a choice for it.
+    readonly loops: ProviderLoops;
 }
 
+// Kimi's word on the two loops it documents for an API key, reached here on the translator's sign-in.
+const KIMI_TRANSLATED: LoopTerms = {
+    status: "unlisted",
+    note: "Kimi documents OpenCode and Codex with a Kimi Code API key. Here they reach your plan through a translator's sign-in instead, which Kimi doesn't list.",
+    source: "https://www.kimi.com/en/help/kimi-code/third-party-agents",
+};
+
 // satisfies checks each row's shape; as const keeps ids/auth kinds literal, so NativeProvider stays a union.
 export const PROVIDER_SPECS = [
     {
@@ -79,8 +126,7 @@ export const PROVIDER_SPECS = [
         access: { kind: "subscription", requirement: "Claude subscription", runs: "Claude Code" },
         auth: { kind: "oauth" },
         planLimits: true,
-        // Claude has no second runtime: the harness axis is not a choice here.
-        runtimes: { native: CLAUDE_CODE, claudeCode: CLAUDE_CODE },
+        loops: { default: "claude-code", offered: { "claude-code": { capabilities: CLAUDE_CODE } } },
     },
     {
         id: "codex",
@@ -92,7 +138,29 @@ export const PROVIDER_SPECS = [
         access: { kind: "subscription", requirement: "ChatGPT subscription", runs: "Codex" },
         auth: { kind: "translator", cliProxy: "codex" },
         planLimits: true,
-        runtimes: { native: CODEX, claudeCode: CLAUDE_CODE },
+        loops: {
+            default: "codex",
+            offered: {
+                codex: { capabilities: CODEX },
+                "claude-code": {
+                    capabilities: CLAUDE_CODE,
+                    terms: {
+                        status: "unlisted",
+                        note: "OpenAI lets a ChatGPT plan run in Codex and in the apps it lists for Sign in with ChatGPT (OpenCode, Pi, T3 and others). Claude Code, reached here through a translator, isn't among them.",
+                        source: "https://help.openai.com/en/articles/20001542",
+                    },
+                },
+                // The plan through the bundled translator's Responses surface, not OpenCode's own sign-in.
+                opencode: {
+                    capabilities: OPENCODE,
+                    terms: {
+                        status: "unlisted",
+                        note: "OpenAI lists OpenCode among the apps a ChatGPT plan may sign in to, through OpenCode's own sign-in. Here OpenCode reaches the plan through a translator instead, which OpenAI doesn't list.",
+                        source: "https://help.openai.com/en/articles/20001542",
+                    },
+                },
+            },
+        },
     },
     {
         id: "grok",
@@ -105,7 +173,32 @@ export const PROVIDER_SPECS = [
         // The app says grok, CLIProxyAPI says xai; Grok alone also runs natively, not just through the translator.
         auth: { kind: "translator", cliProxy: "xai" },
         planLimits: false,
-        runtimes: { native: OPENCODE, claudeCode: CLAUDE_CODE },
+        loops: {
+            default: "opencode",
+            offered: {
+                opencode: { capabilities: OPENCODE },
+                // xAI's own CLI, signed in through its own device login (not OpenCode's), and free to run on a SuperGrok
+                // or X Premium plan: it is the client xAI ships for that subscription.
+                vendor: { capabilities: GROK_BUILD, label: "Grok Build", door: "grok-build" },
+                "claude-code": {
+                    capabilities: CLAUDE_CODE,
+                    terms: {
+                        status: "unlisted",
+                        note: "xAI turns SuperGrok sign-in on for OpenCode, Hermes, OpenClaw and Kilo Code. Claude Code, reached here through a translator, isn't among them.",
+                        source: "https://x.ai/news/grok-opencode",
+                    },
+                },
+                // The translator's xAI sign-in on its Responses surface, a sign-in of its own beside OpenCode's.
+                codex: {
+                    capabilities: CODEX,
+                    terms: {
+                        status: "unlisted",
+                        note: "xAI turns SuperGrok sign-in on for OpenCode, Hermes, OpenClaw and Kilo Code. Codex, reached here through a translator, isn't among them.",
+                        source: "https://x.ai/news/grok-opencode",
+                    },
+                },
+            },
+        },
     },
     {
         id: "kimi",
@@ -117,8 +210,19 @@ export const PROVIDER_SPECS = [
         access: { kind: "subscription", requirement: "Kimi Code subscription", runs: "Kimi Code" },
         auth: { kind: "translator", cliProxy: "kimi" },
         planLimits: true,
-        // Kimi has no native runtime: it exists only under the Claude Code loop, on both harnesses.
-        runtimes: { native: CLAUDE_CODE, claudeCode: CLAUDE_CODE },
+        // Claude Code stays the default: the translator's subscription is what most sandboxes already hold. Kimi's own CLI signs
+        // in with its own device login, Kimi's sanctioned client for the plan. Kimi documents Claude Code, OpenCode and Codex
+        // with a Kimi Code API key; Codex and OpenCode here reach the plan through the translator's sign-in instead, which
+        // Kimi doesn't list, hence their note. Claude Code predates the note and stays as it was.
+        loops: {
+            default: "claude-code",
+            offered: {
+                "claude-code": { capabilities: CLAUDE_CODE },
+                vendor: { capabilities: KIMI_CLI, label: "Kimi CLI", door: "kimi-cli" },
+                codex: { capabilities: CODEX, terms: KIMI_TRANSLATED },
+                opencode: { capabilities: OPENCODE, terms: KIMI_TRANSLATED },
+            },
+        },
     },
     {
         // Labelled for the account (Google), not the model family: this channel vends Claude and GPT-OSS beside Gemini.
@@ -132,8 +236,20 @@ export const PROVIDER_SPECS = [
         // antigravity is Google's own agent product, the name CLIProxyAPI files this credential under.
         auth: { kind: "translator", cliProxy: "antigravity" },
         planLimits: true,
-        // The only routed provider that ignores harness: Google refuses any request announcing the Claude Code loop.
-        runtimes: { native: OPENCODE_GEMINI, claudeCode: OPENCODE_GEMINI },
+        // The only routed provider without Claude Code: Google refuses any request announcing that loop.
+        loops: {
+            default: "opencode",
+            offered: {
+                opencode: {
+                    capabilities: OPENCODE_GEMINI,
+                    terms: {
+                        status: "against-terms",
+                        note: "Google's Antigravity terms don't allow its sign-in in third-party clients such as OpenCode, and Google has suspended accounts for it.",
+                        source: "https://antigravity.google/terms/",
+                    },
+                },
+            },
+        },
     },
     {
         // Cursor's own runtime via Anysphere's SDK; labelled for the account since it vends several vendors' models.
@@ -147,8 +263,8 @@ export const PROVIDER_SPECS = [
         access: { kind: "subscription", requirement: "Cursor Pro subscription", runs: "Cursor Agent" },
         auth: { kind: "oauth" },
         planLimits: false,
-        // Cursor ignores harness too: there is no route to it but its own SDK.
-        runtimes: { native: CURSOR, claudeCode: CURSOR },
+        // There is no route to Cursor but its own SDK.
+        loops: { default: "vendor", offered: { vendor: { capabilities: CURSOR } } },
     },
     {
         // Cognition's Devin through its own CLI (`devin acp`); labelled for the account, since it vends many vendors'
@@ -165,10 +281,11 @@ export const PROVIDER_SPECS = [
         auth: { kind: "oauth" },
         // Devin publishes its quota only on its own pages and in its CLI's interactive view, nothing a key can read.
         planLimits: false,
-        // The CLI is the only door, so harness is not a choice: both axes are Devin's own runtime.
-        runtimes: { native: DEVIN, claudeCode: DEVIN },
+        // The CLI is the only door, so the loop is not a choice.
+        loops: { default: "vendor", offered: { vendor: { capabilities: DEVIN } } },
     },
-    // The two minted providers need no new runtime or translator hop: each has its own Anthropic Messages endpoint.
+    // The two minted providers need no translator hop: each has its own endpoint for the minted key. Meta's key is a Muse
+    // Code key, so its own loop is Muse Code; Z.ai's runs under Claude Code against its Anthropic Messages endpoint.
     {
         id: "meta",
         label: "Meta",
@@ -177,7 +294,7 @@ export const PROVIDER_SPECS = [
         destination: "Meta",
         brand: "meta",
         // A subscription like the rest: the device sign-in mints a plan key, and the plan is what a turn spends.
-        access: { kind: "subscription", requirement: "Muse Code subscription", runs: "Muse Spark under Claude Code" },
+        access: { kind: "subscription", requirement: "Muse Code subscription", runs: "Muse Spark in Muse Code" },
         auth: {
             kind: "minted",
             // Preserve the minted variant id because stored accounts reference it.
@@ -197,7 +314,21 @@ export const PROVIDER_SPECS = [
         },
         // No quota surface a minted key can read: the row shows no meter and says so, not an empty one reading as zero.
         planLimits: false,
-        runtimes: { native: CLAUDE_CODE, claudeCode: CLAUDE_CODE },
+        // Muse Code is the use Meta's terms sanction for the key, so it says nothing; Claude Code stays on offer, quietly noted.
+        loops: {
+            default: "muse",
+            offered: {
+                muse: { capabilities: MUSE },
+                "claude-code": {
+                    capabilities: CLAUDE_CODE,
+                    terms: {
+                        status: "against-terms",
+                        note: "Meta's terms say a Muse Code subscription key is for use with Muse Code only. Here it runs under Claude Code.",
+                        source: "https://dev.meta.ai/docs/muse-code/subscriptions",
+                    },
+                },
+            },
+        },
     },
     {
         id: "zai",
@@ -221,6 +352,8 @@ export const PROVIDER_SPECS = [
                     flow: "device",
                     anthropicBase: "https://api.z.ai/api/anthropic",
                     catalogBase: "https://api.z.ai/api/coding/paas/v4",
+                    // Z.ai's dedicated Responses endpoint for Codex (docs.z.ai/devpack/tool/codex).
+                    responsesBase: "https://api.z.ai/api/v1",
                 },
                 {
                     id: "bigmodel",
@@ -230,11 +363,18 @@ export const PROVIDER_SPECS = [
                     flow: "redirect",
                     anthropicBase: "https://open.bigmodel.cn/api/anthropic",
                     catalogBase: "https://open.bigmodel.cn/api/coding/paas/v4",
+                    // BigModel's equivalent (docs.bigmodel.cn/cn/coding-plan/tool/codex).
+                    responsesBase: "https://open.bigmodel.cn/api/v1",
                 },
             ],
         },
         planLimits: false,
-        runtimes: { native: CLAUDE_CODE, claudeCode: CLAUDE_CODE },
+        // The GLM Coding Plan lists Claude Code, Codex and OpenCode among its tools, each on the minted key aimed at the
+        // estate's own endpoints: Anthropic Messages, Responses and Chat Completions respectively.
+        loops: {
+            default: "claude-code",
+            offered: { "claude-code": { capabilities: CLAUDE_CODE }, codex: { capabilities: CODEX }, opencode: { capabilities: OPENCODE } },
+        },
     },
 ] as const satisfies readonly ProviderSpec[];
 

package/src/policy/reserved-servers.ts

@@ -9,7 +9,7 @@ import { contributedServerMintingKinds } from "@intentic/extension-manifest";
 // - outside: the server carries content from beyond the container (a web page, a provider's verbatim sentence)
 export type ServerProvenance = "control" | "outside";
 
-// Every server agent/run/agent.ts and agent/run/harness/harness-servers.ts mount themselves, plus the browser router's two
+// Every server agent/run/agent.ts, agent/run/harness/harness-servers.ts and runtimes/daemon-tools/daemon-servers.ts mount themselves, plus the browser router's two
 // names (web, browser) and the virtual desktop's (desktop), which a turn mounts on its lease at the daemon's MCP door
 // (browser-tools.ts, desktop/desktop-tools.ts) and which the text scan reads from their constants. A server added anywhere else without a row here fails the conformance test in the sandbox guard package.
 export const DAEMON_MCP_SERVERS: Readonly<Record<string, ServerProvenance>> = {
@@ -23,6 +23,7 @@ export const DAEMON_MCP_SERVERS: Readonly<Record<string, ServerProvenance>> = {
     watch: "control", // harness: condition watches
     deps: "control", // harness: dependency readiness
     diagnostics: "outside", // harness: two tools relay a provider's own sentence verbatim
+    gate: "control", // daemon-servers: the policy gate a runtime's own hooks call through the door (runtimes/daemon-tools/policy-gate-server.ts)
     web: "outside", // the turn's mounts: the anonymous browser router; the page is the internet
     browser: "outside", // the turn's mounts: the signed-in browser router; the page is the internet
     desktop: "outside", // the turn's mounts: the sandbox's own virtual desktop; whatever its windows show is outside content

package/src/policy/sandbox-power.ts

@@ -8,8 +8,12 @@ import type { CommandSpan } from "./command-classes.js";
 // working (hosts/host-restart-guard.ts), and the device agent, whose "Manage sandboxes" switch decides whether anything
 // may do this at all (the machine's tools/shell.ts). The same verbs and the same wording, so a command and the tool
 // that does the same job cannot drift apart.
+//
+// (2026-10-13) On Intentic OS the machine itself is managed the same way: `ic os update|rollback|reboot|channel`, and the
+// `bootc upgrade|switch|rollback` under it, change what the whole box boots, and the ones that reboot it stop every
+// sandbox on it at once. They are read here as the os_* device tools' twins, under the same switch.
 
-/** The sandbox operations a command can name, in the words `ic sandbox` spells them. */
+/** The sandbox operations a command can name, in the words `ic sandbox` spells them, and the OS ones in `ic os`'s. */
 export type SandboxPowerOp =
     | "start"
     | "stop"
@@ -23,7 +27,12 @@ export type SandboxPowerOp =
     | "dev"
     | "resize"
     | "restore"
-    | "connect";
+    | "connect"
+    // The machine's OS (Intentic OS), in `ic os`'s verbs; a bootc spelling reads as the same op.
+    | "os-update"
+    | "os-rollback"
+    | "os-reboot"
+    | "os-channel";
 
 /** The owner's own word for an operation, as a card or a refusal says it ("<doing> this sandbox now?"). */
 export const SANDBOX_POWER_DOING = {
@@ -40,17 +49,23 @@ export const SANDBOX_POWER_DOING = {
     resize: "Restart with new resources",
     restore: "Restore a backup over",
     connect: "Reinstall",
+    // The OS ops stop a sandbox only when they reboot, which takes every sandbox on the machine with it.
+    "os-update": "Update and reboot the machine running",
+    "os-rollback": "Roll back and reboot the machine running",
+    "os-reboot": "Reboot the machine running",
+    "os-channel": "Switch images and reboot the machine running",
 } as const satisfies Record<SandboxPowerOp, string>;
 
 /** One command that manages a sandbox container, and what it aims at. */
 export interface SandboxPowerCommand {
-    readonly via: "ic" | "docker";
+    /** `ic` for `ic sandbox` and `ic os`, `bootc` for the OS's own tool under `ic os`. */
+    readonly via: "ic" | "docker" | "bootc";
     readonly op: SandboxPowerOp;
     /** Whether it ends the turns of a sandbox that is running; false for a start, a download, a resource ask saved for later. */
     readonly stops: boolean;
     /** The slugs (`ic`) or container names (`docker`) it names, as written; an expansion (`$x`, `$(…)`, `*`) stays as typed. */
     readonly targets: readonly string[];
-    /** Names none: `ic sandbox restart` alone (the only sandbox the device runs), `remove --all`, `docker stop` fed from a pipe. */
+    /** Names none: `ic sandbox restart` alone (the only sandbox the device runs), `remove --all`, `docker stop` fed from a pipe, and every OS op, which is the whole machine's. */
     readonly unnamed: boolean;
     /** The fragment, so a card can point at it. */
     readonly span: CommandSpan;
@@ -63,6 +78,10 @@ const IC_INVOCATION = /(?<![\w.$-])ic(?:\.exe)?["']?\s+sandbox\s+([a-z][a-z-]*)(
 // `docker stop`, `docker container rm`, podman alike. A global option between the program and the verb
 // (`docker -H host stop x`) is not read: the verb then follows an option, and the command is left unrecognised.
 const DOCKER_INVOCATION = /(?<![\w.$-])(?:docker|podman)(?:\.exe)?["']?\s+(?:container\s+)?(stop|restart|rm|remove|kill)(?![\w-])/gi;
+// `ic os <verb>` and `bootc <verb>`, the machine's OS. Only the verbs that change what it boots; `status`, `health`,
+// `record` and `pair` read or set up and are left alone, as is a `--check` that only asks the registry.
+const IC_OS_INVOCATION = /(?<![\w.$-])ic(?:\.exe)?["']?\s+os\s+([a-z][a-z-]*)(?![\w-])/gi;
+const BOOTC_INVOCATION = /(?<![\w.$-])bootc["']?\s+([a-z][a-z-]*)(?![\w-])/gi;
 
 const IC_VERBS = new Map<string, SandboxPowerOp>([
     ["start", "start"],
@@ -90,6 +109,21 @@ const DOCKER_VERBS = new Map<string, SandboxPowerOp>([
     ["remove", "remove"],
 ]);
 
+const IC_OS_VERBS = new Map<string, SandboxPowerOp>([
+    ["update", "os-update"],
+    ["rollback", "os-rollback"],
+    ["reboot", "os-reboot"],
+    ["channel", "os-channel"],
+]);
+
+// `bootc switch` is what `ic os channel` runs, to any image; `update` is read as `upgrade`'s other spelling.
+const BOOTC_VERBS = new Map<string, SandboxPowerOp>([
+    ["upgrade", "os-update"],
+    ["update", "os-update"],
+    ["switch", "os-channel"],
+    ["rollback", "os-rollback"],
+]);
+
 // The flags of each program that take their value as the next word, so the value is not read as a slug.
 const IC_VALUE_FLAGS: ReadonlySet<string> = new Set([
     "--channel",
@@ -110,6 +144,7 @@ const IC_VALUE_FLAGS: ReadonlySet<string> = new Set([
     "--tail",
 ]);
 const DOCKER_VALUE_FLAGS: ReadonlySet<string> = new Set(["-t", "--time", "-s", "--signal"]);
+const OS_VALUE_FLAGS: ReadonlySet<string> = new Set(["--wait", "--transport", "--target-imgref"]);
 
 // The simple command that starts the text: up to the first `|`, `;`, `&` or newline outside quotes. A `&` right after
 // `>` or `<` is a redirection (`2>&1`), which ends nothing.
@@ -194,8 +229,27 @@ const icAim = (op: SandboxPowerOp, { positionals, flags }: Operands): Aim => {
     return { stops: true, targets: positionals, all };
 };
 
+// Whether an OS op reboots the machine now, which stops every sandbox on it; undefined for a check that only asks the
+// registry, which manages nothing. A reboot always does; the rest stage for the next boot unless told `--apply`.
+const osStops = (op: SandboxPowerOp, { flags }: Operands): boolean | undefined => {
+    if (op === "os-update" && flags.has("--check")) {
+        return undefined;
+    }
+    return op === "os-reboot" || flags.has("--apply");
+};
+
+// The OS ops in `command`, through `ic os` or bootc. Each names the whole machine, so none names a target.
+const osPowerCommands = (command: string, via: "ic" | "bootc", regions: readonly CommandSpan[]): SandboxPowerCommand[] =>
+    [...command.matchAll(via === "ic" ? IC_OS_INVOCATION : BOOTC_INVOCATION)].flatMap((invocation) => {
+        const op = (via === "ic" ? IC_OS_VERBS : BOOTC_VERBS).get((invocation[1] ?? "").toLowerCase());
+        const span = { start: invocation.index, end: invocation.index + invocation[0].length };
+        const stops = op === undefined ? undefined : osStops(op, operandsOf(wordsOf(command.slice(span.end)), OS_VALUE_FLAGS));
+        return op === undefined || stops === undefined ? [] : [{ via, op, stops, targets: [], unnamed: true, span, live: isLive(span, regions) }];
+    });
+
 /**
- * Every command in `command` that starts, stops or replaces a sandbox container, through `ic sandbox` or `docker`.
+ * Every command in `command` that starts, stops or replaces a sandbox container, through `ic sandbox` or `docker`, or
+ * changes what an Intentic OS machine boots, through `ic os` or `bootc`.
  * A scan for the programs by name, not a shell parse: it is meant to over-include, since a caller that mistakes
  * a mention for a command asks the owner once, and one that misses a command cuts a fleet's turns unasked.
  */
@@ -210,6 +264,7 @@ export const sandboxPowerCommands = (command: string): SandboxPowerCommand[] =>
             found.push({ via: "ic", op, stops: aim.stops, targets: aim.targets, unnamed: aim.targets.length === 0 || aim.all, span, live: isLive(span, regions) });
         }
     }
+    found.push(...osPowerCommands(command, "ic", regions), ...osPowerCommands(command, "bootc", regions));
     for (const invocation of command.matchAll(DOCKER_INVOCATION)) {
         const op = DOCKER_VERBS.get((invocation[1] ?? "").toLowerCase());
         if (op !== undefined) {
@@ -240,8 +295,12 @@ export const mayReachSandbox = (hit: SandboxPowerCommand, own: OwnSandbox): bool
 
 /**
  * Whether `hit` manages a sandbox that a device's "Manage sandboxes" switch covers, whichever sandbox it is: any
- * `ic sandbox` verb here, and a `docker` verb aimed at a container whose name starts with `containerPrefix` (a sandbox's
- * own, or its tunnel's). A docker target worked out at run time is not read: the device cannot know what it will be.
+ * `ic sandbox` or `ic os` verb here and any bootc one (the OS is every sandbox's ground), and a `docker` verb aimed at a
+ * container whose name starts with `containerPrefix` (a sandbox's own, or its tunnel's). A docker target worked out at
+ * run time is not read: the device cannot know what it will be.
  */
 export const managesSandbox = (hit: SandboxPowerCommand, containerPrefix: string): boolean =>
-    hit.via === "ic" || hit.targets.some((target) => target.startsWith(containerPrefix));
+    hit.via !== "docker" || hit.targets.some((target) => target.startsWith(containerPrefix));
+
+/** Whether `hit` acts on the machine's OS (`ic os`, `bootc`) rather than on one sandbox. */
+export const isOsPower = (hit: Pick<SandboxPowerCommand, "op">): boolean => hit.op.startsWith("os-");

package/src/policy/tests/sandbox-power.test.ts

@@ -1,4 +1,4 @@
-import { managesSandbox, mayReachSandbox, SANDBOX_POWER_DOING, type SandboxPowerCommand, sandboxPowerCommands } from "../sandbox-power.js";
+import { isOsPower, managesSandbox, mayReachSandbox, SANDBOX_POWER_DOING, type SandboxPowerCommand, sandboxPowerCommands } from "../sandbox-power.js";
 
 const OWN = { slug: "work", container: "intentic-sandbox-work" };
 const PREFIX = "intentic-sandbox-";
@@ -128,6 +128,63 @@ describe("docker", () => {
     });
 });
 
+// On Intentic OS the machine's own OS is changed through `ic os` (and bootc under it): what reboots it stops every
+// sandbox on it, and what only stages for the next boot stops none, like a sandbox's prepare.
+describe("ic os and bootc", () => {
+    const WHOLE_MACHINE = { targets: [], unnamed: true };
+
+    test("reads every verb that changes what the machine boots, as the whole machine's", () => {
+        expect(first("ic os update")).toEqual({ via: "ic", op: "os-update", stops: false, ...WHOLE_MACHINE });
+        expect(first("ic os update --apply")).toEqual({ via: "ic", op: "os-update", stops: true, ...WHOLE_MACHINE });
+        expect(first("ic os rollback")).toEqual({ via: "ic", op: "os-rollback", stops: false, ...WHOLE_MACHINE });
+        expect(first("ic os rollback --apply")).toEqual({ via: "ic", op: "os-rollback", stops: true, ...WHOLE_MACHINE });
+        expect(first("ic os reboot")).toEqual({ via: "ic", op: "os-reboot", stops: true, ...WHOLE_MACHINE });
+        // The channel is the verb's operand, not a sandbox it names.
+        expect(first("ic os channel beta")).toEqual({ via: "ic", op: "os-channel", stops: false, ...WHOLE_MACHINE });
+    });
+
+    test("reads bootc's own spelling of the same ops", () => {
+        expect(first("sudo bootc upgrade")).toEqual({ via: "bootc", op: "os-update", stops: false, ...WHOLE_MACHINE });
+        expect(first("sudo -n /usr/bin/bootc upgrade --apply")).toEqual({ via: "bootc", op: "os-update", stops: true, ...WHOLE_MACHINE });
+        expect(first("bootc switch ghcr.io/intentic/os:beta")).toEqual({ via: "bootc", op: "os-channel", stops: false, ...WHOLE_MACHINE });
+        expect(first("bootc switch --apply --transport registry ghcr.io/intentic/os:beta")?.stops).toBe(true);
+        expect(first("bootc rollback")).toEqual({ via: "bootc", op: "os-rollback", stops: false, ...WHOLE_MACHINE });
+        expect(first("bootc rollback --apply")?.stops).toBe(true);
+    });
+
+    test("leaves alone what only reads or sets up", () => {
+        for (const command of [
+            "ic os status --json",
+            "ic os update --check --json",
+            "ic os health --wait 600",
+            "ic os record",
+            "ic os pair",
+            "bootc status --json",
+            "bootc upgrade --check",
+            "magic os reboot",
+            "echo cosmic os update",
+        ]) {
+            expect(sandboxPowerCommands(command), command).toEqual([]);
+        }
+    });
+
+    test("a reboot may reach this sandbox and is the switch's, wherever this sandbox runs", () => {
+        const reboot = sandboxPowerCommands("ic os reboot")[0];
+        expect(reboot !== undefined && mayReachSandbox(reboot, OWN)).toBe(true);
+        expect(reboot !== undefined && managesSandbox(reboot, PREFIX)).toBe(true);
+        expect(reboot !== undefined && isOsPower(reboot)).toBe(true);
+        const staged = sandboxPowerCommands("sudo bootc upgrade")[0];
+        expect(staged !== undefined && managesSandbox(staged, PREFIX)).toBe(true);
+        expect(isOsPower({ op: "restart" })).toBe(false);
+    });
+
+    test("is found beside a sandbox verb in the same line, in the order written, and quoted it is not live", () => {
+        expect(sandboxPowerCommands("ic sandbox stop work && ic os reboot").map((hit) => hit.op)).toEqual(["stop", "os-reboot"]);
+        expect(sandboxPowerCommands("echo 'ic os reboot'")[0]?.live).toBe(false);
+        expect(sandboxPowerCommands("ic os reboot")[0]?.span).toEqual({ start: 0, end: "ic os reboot".length });
+    });
+});
+
 describe("whether a command may reach this sandbox", () => {
     const reaches = (command: string): boolean => sandboxPowerCommands(command).some((hit) => mayReachSandbox(hit, OWN));
 
@@ -178,4 +235,5 @@ test("every operation has the owner's word for it", () => {
     expect(SANDBOX_POWER_DOING.restart).toBe("Restart");
     expect(SANDBOX_POWER_DOING.resize).toBe("Restart with new resources");
     expect(SANDBOX_POWER_DOING.rollback).toBe("Roll back");
+    expect(`${SANDBOX_POWER_DOING["os-reboot"]} this sandbox now?`).toBe("Reboot the machine running this sandbox now?");
 });

package/src/policy/turned-away.ts

@@ -20,6 +20,8 @@ const TURNED_AWAY: ReadonlySet<string> = new Set([
     // The privacy shield found personal data in instructions a runtime loads itself, where it could not mask them.
     "privacy-instructions",
     "sandbox-memory-low",
+    // The conversation's own view of the workspace could not be set up in time: nothing was started in it.
+    "workspace-setup",
     "trial-unavailable",
     "trial-model-unavailable",
     "trial-exhausted",