@intentic/sandbox-contract 1.344.0 → 1.345.0

package/src/schemas/settings-savings.ts

@@ -0,0 +1,125 @@
+// settings-savings: what each token-reduction mechanism saved and how the turn-level ones are measured, as the
+// settings routes report them. Re-exported by settings.ts, whose routes carry them.
+import { z } from "zod";
+
+// What each token-reduction mechanism actually saved. Input-side: both sides of the comparison come off the same
+// command (raw in, emitted out), so the counterfactual is observed, not estimated — exact, per command.
+
+// Sequential attribution (sums exactly to raw − emitted, drawable as a stacked bar); not what disabling this stage
+// would save, since downstream would eat some of the same lines. Negative for `footer`, which adds cost back.
+export const SavingsStageSchema = z.object({ id: z.string(), commands: z.number(), savedTokens: z.number() });
+// Aggregated from historyRoot/logs/filter-stats.jsonl (one row per Bash command). Windowed on the ledger's own UTC-day
+// calendar, so the reader's date range and these figures agree.
+export const InputSavingsSchema = z.object({
+    // Epoch ms of the ledger's last command, so the card can show its age rather than implying freshness.
+    updatedAt: z.number().optional(),
+    commands: z.number(),
+    rawTokens: z.number(),
+    emittedTokens: z.number(),
+    savedPct: z.number(),
+    // Per-stage attribution, biggest first.
+    perCleaner: z.array(SavingsStageSchema),
+    // The measured control (raw vs. cleaned); the only real whole-pipeline counterfactual, not an estimate.
+    holdout: z.object({ cleaned: z.number(), heldOut: z.number(), measuredSavedPct: z.number().optional() }),
+    // Grouped by command text: worth a handler is judged by total tokens across runs, not one outlier's size.
+    gaps: z.array(z.object({ command: z.string(), commands: z.number(), tokens: z.number() })),
+});
+export type InputSavings = z.infer<typeof InputSavingsSchema>;
+// One arm of a turn-level experiment; mean is per turn, since the two arms never hold the same count.
+// `mean` is over samples capped at both arms' pooled 95th percentile, so one runaway conversation cannot carry an arm.
+// For a yes/no reading (`openedWithListing`) it is the share of yeses, 0 to 1, and uncapped.
+export const SavingsArmSchema = z.object({ turns: z.number(), mean: z.number() });
+// One metric's reading of a turn-level experiment (the two arms, plus the arithmetic over them). `metric` says what
+// `mean`/`deltaPct` count:
+// searchCalls: searches a turn ran (the search teaching).
+// openingSearches: same, narrowed to before the turn first touched a file.
+// openedWithListing: whether a turn listed directories to orient itself, as a share of turns (the project map).
+// callsBeforeTarget: how far a turn walked before touching a file it went on to edit.
+// failedCalls: tool calls that ended in error (the field notes, whose largest section is a failure taxonomy).
+// openingPrompt: tokens a turn's first request sent (cache reads plus cache writes), which is what every later call of
+// the turn reads again (tool search, which moves the tool schemas out of it).
+// openingWrite: tokens a follow-up turn's first request wrote to the cache instead of reading them (the stable prompt).
+// Every reading is the main agent's own: a subagent's calls are counted toward the turn and read for nothing.
+// Never cost: each mechanism moves one small part of a turn's work, inside the noise of the rest. The prompt's size is
+// the exception that proves it: it is the part every call pays again, so it is read directly rather than through cost.
+export const TurnMetricReadingSchema = z.object({
+    metric: z.enum(["searchCalls", "openingSearches", "openedWithListing", "callsBeforeTarget", "failedCalls", "openingPrompt", "openingWrite"]),
+    on: SavingsArmSchema,
+    off: SavingsArmSchema,
+    // Additional control turns to reach a fixed target resolution, not today's delta (which inherits noise and always
+    // promises "next week"). Absent means nothing to wait for: under `minTurns`, already published, or already resolved
+    // enough.
+    controlTurnsNeeded: z.number().optional(),
+    // ± percentage points at 95% (Welch); present once both arms clear `minTurns`, even when `deltaPct` is withheld —
+    // "smaller than ±35 points" is still a useful, true answer.
+    marginPct: z.number().optional(),
+    // Present only once the margin excludes zero — clearing `minTurns` alone isn't enough, or a wide, unresolved swing
+    // reads as a real number.
+    // deltaPct: change in the metric's mean per turn; negative is a saving.
+    // saved: what that delta was worth over the turns that ran with it, in the metric's own unit.
+    deltaPct: z.number().optional(),
+    saved: z.number().optional(),
+});
+export type TurnMetricReading = z.infer<typeof TurnMetricReadingSchema>;
+// One coin flip, several readings: `metrics` is a list since splitting readings into separate entries would duplicate
+// the arm assignment. Screens read `metrics[0]` as the headline, the rest as supporting lines.
+export const TurnExperimentSchema = z.object({
+    // A head and a tail, not a plain array, so "always a headline" is a type fact, not a check every screen repeats.
+    // `.nonempty()` doesn't do this in zod 4 (a runtime check, still typed as a plain array).
+    metrics: z.tuple([TurnMetricReadingSchema], TurnMetricReadingSchema),
+    // Carried on the wire so "measuring…" reflects the daemon's real threshold, not a guess; shared across every
+    // reading, since they're the same turns.
+    minTurns: z.number(),
+    // Turn mechanisms randomize by turn; session-loaded teaching randomizes whole conversations; a once-sent treatment
+    // (the map) samples one turn per conversation, not an average, or its effect divides by the conversation's length.
+    sampleUnit: z.enum(["turns", "conversations", "opening turns"]).optional(),
+    // Content-addressed treatment version; the reader filters to the latest so two instruction revisions don't blur
+    // into one experiment.
+    cohort: z.string().optional(),
+    // The latest earlier cohort that reached an answer, with only its answered readings (a margin, with or without a
+    // delta), so restarting a comparison does not wipe a finding off the screen while the new one is early. `from` and
+    // `to` are its first and last measured turn inside the window read, epoch ms. Absent when no earlier one answered.
+    previous: z
+        .object({ from: z.number(), to: z.number(), cohort: z.string().optional(), metrics: z.array(TurnMetricReadingSchema) })
+        .optional(),
+    // Whether the treatment was taken up at all, which no reading above can tell: the share, 0 to 1, of each group's
+    // searches that ran iq, pooled over the turns of this cohort that recorded it. `turns` is the treated group's count;
+    // absent until it reaches `minTurns`. The search teaching only.
+    uptake: z.object({ on: z.number(), off: z.number(), turns: z.number() }).optional(),
+});
+export type TurnExperiment = z.infer<typeof TurnExperimentSchema>;
+// What the settings row can say about the brief without opening it: whether there is one, how much of it this budget
+// reaches, and whether anything is scheduled to rewrite it. Read off the file and the automation store, never stored.
+export const FieldNotesStatusSchema = z.object({
+    // False means the automation has never run (or was never set up) — the ordinary state before the first month.
+    present: z.boolean(),
+    // Epoch ms the file was last written. Absent when there is no file.
+    writtenAt: z.number().optional(),
+    // How many ranked sections the current budget reaches, out of how many the file holds. The pair is the point: "5"
+    // alone cannot tell a generous budget from a short file.
+    ranksSent: z.number().optional(),
+    ranksTotal: z.number().optional(),
+    // What the brief costs the prompt, in characters, at the current budget.
+    chars: z.number().optional(),
+    // The monthly rewrite: absent until the owner creates it from the offered template, since an automation names the
+    // models it spends and nothing chooses those for them.
+    automation: z.enum(["missing", "enabled", "disabled"]),
+    // When it next runs, epoch ms; absent when there is nothing scheduled.
+    nextRunAt: z.number().optional(),
+    // Said out loud rather than shown as "no file": a brief that exists and cannot be read is a broken automation.
+    unreadable: z.string().optional(),
+    // Blocks of the file its priority table does not rank, so no limit ever sends them. Absent when there are none.
+    unlisted: z.array(z.string()).optional(),
+});
+export type FieldNotesStatus = z.infer<typeof FieldNotesStatusSchema>;
+export const SavingsReportSchema = z.object({
+    input: InputSavingsSchema,
+    search: TurnExperimentSchema.optional(),
+    // Same absence rule as `search`: not measured, never zero.
+    map: TurnExperimentSchema.optional(),
+    notes: TurnExperimentSchema.optional(),
+    toolSearch: TurnExperimentSchema.optional(),
+    stablePrompt: TurnExperimentSchema.optional(),
+    coldTrim: TurnExperimentSchema.optional(),
+});
+export type SavingsReport = z.infer<typeof SavingsReportSchema>;

package/src/schemas/settings.ts

@@ -6,7 +6,7 @@ import { claudeExperimentSettings, iqSearchSettings } from "./settings-experimen
 import { CommandJudgeModeSchema, ProjectInstallModeSchema } from "../policy/safety-policy.js";
 import { ModelRoleSchema } from "../models/model-roles.js";
 import { MODEL_SETUP_ID, ModelSetupSchema } from "../models/model-setups.js";
-import { AdmissionPolicySchema, AdmissionRuleSchema } from "./agent.js";
+import { AdmissionPolicySchema, AdmissionRuleSchema } from "./command-admission.js";
 import { KeepWarmSettingsSchema } from "./keep-warm.js";
 import { LimitHandoffSchema } from "./providers/handoff.js";
 import { SessionsPlacementSchema } from "./offload.js";
@@ -597,6 +597,11 @@ export const SandboxSettingsSchema = z.object({
         .max(10)
         .default(3)
         .describe("How many levels deep the delegation may go, since a subagent can start subagents of its own."),
+    // How far off a reset a spawned child's spent turn is booked to re-run by itself (classify-failure.ts); one with fallbacks
+    // keeps 90 minutes. 2026-10-18: was a fixed 90 minutes, which ended every child behind a five-hour window.
+    childRerunHorizonHours: z.number().int().min(0).max(24).default(6).describe(
+        "How long a subagent refused for a spent allowance waits for the provider's reset before it goes again by itself. Past it, or at 0, it stops and its parent hears where else the work can go. One spawned with fallbacks waits at most 90 minutes and then moves to them.",
+    ),
     // Width again, for a team-chat automation rather than a turn: each thread a message lands in is a conversation of
     // its own, and threads of one automation are worked on side by side up to this many (automations/scheduler.ts in
     // the daemon); one more waits, told it is queued, until a slot frees. Read per fire, so a change holds from the next
@@ -668,121 +673,8 @@ export type TimezoneState = z.infer<typeof TimezoneStateSchema>;
 // from, so a fork from an older build reads as a snapshot.
 export const BuiltinPromptTextSchema = z.object({ text: z.string(), version: z.string() });
 export type BuiltinPromptText = z.infer<typeof BuiltinPromptTextSchema>;
-// What each token-reduction mechanism actually saved. Input-side: both sides of the comparison come off the same
-// command (raw in, emitted out), so the counterfactual is observed, not estimated — exact, per command.
-
-// Sequential attribution (sums exactly to raw − emitted, drawable as a stacked bar); not what disabling this stage
-// would save, since downstream would eat some of the same lines. Negative for `footer`, which adds cost back.
-export const SavingsStageSchema = z.object({ id: z.string(), commands: z.number(), savedTokens: z.number() });
-// Aggregated from historyRoot/logs/filter-stats.jsonl (one row per Bash command). Windowed on the ledger's own UTC-day
-// calendar, so the reader's date range and these figures agree.
-export const InputSavingsSchema = z.object({
-    // Epoch ms of the ledger's last command, so the card can show its age rather than implying freshness.
-    updatedAt: z.number().optional(),
-    commands: z.number(),
-    rawTokens: z.number(),
-    emittedTokens: z.number(),
-    savedPct: z.number(),
-    // Per-stage attribution, biggest first.
-    perCleaner: z.array(SavingsStageSchema),
-    // The measured control (raw vs. cleaned); the only real whole-pipeline counterfactual, not an estimate.
-    holdout: z.object({ cleaned: z.number(), heldOut: z.number(), measuredSavedPct: z.number().optional() }),
-    // Grouped by command text: worth a handler is judged by total tokens across runs, not one outlier's size.
-    gaps: z.array(z.object({ command: z.string(), commands: z.number(), tokens: z.number() })),
-});
-export type InputSavings = z.infer<typeof InputSavingsSchema>;
-// One arm of a turn-level experiment; mean is per turn, since the two arms never hold the same count.
-// `mean` is over samples capped at both arms' pooled 95th percentile, so one runaway conversation cannot carry an arm.
-// For a yes/no reading (`openedWithListing`) it is the share of yeses, 0 to 1, and uncapped.
-export const SavingsArmSchema = z.object({ turns: z.number(), mean: z.number() });
-// One metric's reading of a turn-level experiment (the two arms, plus the arithmetic over them). `metric` says what
-// `mean`/`deltaPct` count:
-// searchCalls: searches a turn ran (the search teaching).
-// openingSearches: same, narrowed to before the turn first touched a file.
-// openedWithListing: whether a turn listed directories to orient itself, as a share of turns (the project map).
-// callsBeforeTarget: how far a turn walked before touching a file it went on to edit.
-// failedCalls: tool calls that ended in error (the field notes, whose largest section is a failure taxonomy).
-// openingPrompt: tokens a turn's first request sent (cache reads plus cache writes), which is what every later call of
-// the turn reads again (tool search, which moves the tool schemas out of it).
-// openingWrite: tokens a follow-up turn's first request wrote to the cache instead of reading them (the stable prompt).
-// Every reading is the main agent's own: a subagent's calls are counted toward the turn and read for nothing.
-// Never cost: each mechanism moves one small part of a turn's work, inside the noise of the rest. The prompt's size is
-// the exception that proves it: it is the part every call pays again, so it is read directly rather than through cost.
-export const TurnMetricReadingSchema = z.object({
-    metric: z.enum(["searchCalls", "openingSearches", "openedWithListing", "callsBeforeTarget", "failedCalls", "openingPrompt", "openingWrite"]),
-    on: SavingsArmSchema,
-    off: SavingsArmSchema,
-    // Additional control turns to reach a fixed target resolution, not today's delta (which inherits noise and always
-    // promises "next week"). Absent means nothing to wait for: under `minTurns`, already published, or already resolved
-    // enough.
-    controlTurnsNeeded: z.number().optional(),
-    // ± percentage points at 95% (Welch); present once both arms clear `minTurns`, even when `deltaPct` is withheld —
-    // "smaller than ±35 points" is still a useful, true answer.
-    marginPct: z.number().optional(),
-    // Present only once the margin excludes zero — clearing `minTurns` alone isn't enough, or a wide, unresolved swing
-    // reads as a real number.
-    // deltaPct: change in the metric's mean per turn; negative is a saving.
-    // saved: what that delta was worth over the turns that ran with it, in the metric's own unit.
-    deltaPct: z.number().optional(),
-    saved: z.number().optional(),
-});
-export type TurnMetricReading = z.infer<typeof TurnMetricReadingSchema>;
-// One coin flip, several readings: `metrics` is a list since splitting readings into separate entries would duplicate
-// the arm assignment. Screens read `metrics[0]` as the headline, the rest as supporting lines.
-export const TurnExperimentSchema = z.object({
-    // A head and a tail, not a plain array, so "always a headline" is a type fact, not a check every screen repeats.
-    // `.nonempty()` doesn't do this in zod 4 (a runtime check, still typed as a plain array).
-    metrics: z.tuple([TurnMetricReadingSchema], TurnMetricReadingSchema),
-    // Carried on the wire so "measuring…" reflects the daemon's real threshold, not a guess; shared across every
-    // reading, since they're the same turns.
-    minTurns: z.number(),
-    // Turn mechanisms randomize by turn; session-loaded teaching randomizes whole conversations; a once-sent treatment
-    // (the map) samples one turn per conversation, not an average, or its effect divides by the conversation's length.
-    sampleUnit: z.enum(["turns", "conversations", "opening turns"]).optional(),
-    // Content-addressed treatment version; the reader filters to the latest so two instruction revisions don't blur
-    // into one experiment.
-    cohort: z.string().optional(),
-    // The latest earlier cohort that reached an answer, with only its answered readings (a margin, with or without a
-    // delta), so restarting a comparison does not wipe a finding off the screen while the new one is early. `from` and
-    // `to` are its first and last measured turn inside the window read, epoch ms. Absent when no earlier one answered.
-    previous: z
-        .object({ from: z.number(), to: z.number(), cohort: z.string().optional(), metrics: z.array(TurnMetricReadingSchema) })
-        .optional(),
-});
-export type TurnExperiment = z.infer<typeof TurnExperimentSchema>;
-// What the settings row can say about the brief without opening it: whether there is one, how much of it this budget
-// reaches, and whether anything is scheduled to rewrite it. Read off the file and the automation store, never stored.
-export const FieldNotesStatusSchema = z.object({
-    // False means the automation has never run (or was never set up) — the ordinary state before the first month.
-    present: z.boolean(),
-    // Epoch ms the file was last written. Absent when there is no file.
-    writtenAt: z.number().optional(),
-    // How many ranked sections the current budget reaches, out of how many the file holds. The pair is the point: "5"
-    // alone cannot tell a generous budget from a short file.
-    ranksSent: z.number().optional(),
-    ranksTotal: z.number().optional(),
-    // What the brief costs the prompt, in characters, at the current budget.
-    chars: z.number().optional(),
-    // The monthly rewrite: absent until the owner creates it from the offered template, since an automation names the
-    // models it spends and nothing chooses those for them.
-    automation: z.enum(["missing", "enabled", "disabled"]),
-    // When it next runs, epoch ms; absent when there is nothing scheduled.
-    nextRunAt: z.number().optional(),
-    // Said out loud rather than shown as "no file": a brief that exists and cannot be read is a broken automation.
-    unreadable: z.string().optional(),
-});
-export type FieldNotesStatus = z.infer<typeof FieldNotesStatusSchema>;
-export const SavingsReportSchema = z.object({
-    input: InputSavingsSchema,
-    search: TurnExperimentSchema.optional(),
-    // Same absence rule as `search`: not measured, never zero.
-    map: TurnExperimentSchema.optional(),
-    notes: TurnExperimentSchema.optional(),
-    toolSearch: TurnExperimentSchema.optional(),
-    stablePrompt: TurnExperimentSchema.optional(),
-    coldTrim: TurnExperimentSchema.optional(),
-});
-export type SavingsReport = z.infer<typeof SavingsReportSchema>;
+// What each token-reduction mechanism saved, and the comparisons that measure the turn-level ones, in a file of their own.
+export * from "./settings-savings.js";
 
 // ---- what a REPOSITORY declares for itself, at `<repo>/.intentic/checks.json` ----
 // Here rather than in a file of its own because the line between these shapes and the settings above is authority, not

package/src/schemas/terminal.ts

@@ -219,6 +219,14 @@ export const SubagentVerificationSchema = z.object({
         ),
 });
 export type SubagentVerification = z.infer<typeof SubagentVerificationSchema>;
+// Where the Claude runtime keeps an in-process subagent's own record: beside the session it ran in, under the runtime's
+// own id for it. The daemon pairs the two while the subagent runs and writes them onto its delegation's card, so the
+// subagent's whole run reads back from that record after a restart, when nothing in memory still knows where it is.
+export const SubagentSdkRecordSchema = z.object({
+    sessionId: z.string().describe("The provider session the subagent ran in."),
+    agentId: z.string().describe("The runtime's own id for the subagent, which names its record beside that session."),
+});
+export type SubagentSdkRecord = z.infer<typeof SubagentSdkRecordSchema>;
 export const SubagentSessionSchema = z.object({
     id: z
         .string()

package/src/schemas/work-assurance.ts

@@ -0,0 +1,36 @@
+import { z } from "zod";
+
+// WHAT HAS LOOKED AT A CONVERSATION'S WORK, as its card says it: what its last turn checked of its own work, and the
+// latest code review it reported. Both written by a turn's settle from what the turn did, never asked of the model.
+// Re-exported by agents.ts, whose summary carries them.
+
+// What the last turn showed of its own work, read off its tool calls and never asked of the model: the record a card
+// badges instead of sending the turn back to prove anything. CI checks what the owner pushes (schemas/ci.ts).
+export const TurnProofSchema = z.object({
+    at: z.number().describe("When the turn that left this ended, in milliseconds."),
+    verification: z
+        .enum(["verified", "unproven", "failing", "no-code"])
+        .describe(
+            "Verified: a check it ran passed after its last edit to code. Failing: the last one it ran failed. Unproven: it changed code and ran nothing that checked it. No-code: it changed nothing a check could speak to.",
+        ),
+    check: z.string().optional().describe("The command that spoke, when one did, so a targeted test is never read as the whole suite."),
+    unviewed: z
+        .number()
+        .optional()
+        .describe("How many rendered files it changed (pages, components, styles) without looking at the result afterwards. Absent when none."),
+});
+export type TurnProof = z.infer<typeof TurnProofSchema>;
+// The latest code review a conversation reported (events/review.ts), counted rather than carried: the findings stay in
+// its chat, where the card that sends them to be fixed draws them. Kept until a later review replaces it, since a turn
+// that reviews nothing has not undone the one before.
+export const ReviewTallySchema = z.object({
+    at: z.number().describe("When the turn that reported it ended, in milliseconds."),
+    source: z.enum(["claude", "codex"]).describe("Which harness's reviewer reported it."),
+    findings: z.number().int().nonnegative().describe("How many findings it reported."),
+    open: z
+        .number()
+        .int()
+        .nonnegative()
+        .describe("How many of those no re-report has marked fixed or set aside yet. Equal to `findings` until the review is reported again with its fixes applied."),
+});
+export type ReviewTally = z.infer<typeof ReviewTallySchema>;

package/src/schemas/workspace/workspace-tree.ts

@@ -143,6 +143,38 @@ export const WorkspaceMediaTicketSchema = z.object({
     ticket: z.string().describe("Hand this to the streaming route in the query string. It buys exactly the one file it was minted for."),
     expiresAt: z.number().describe("When it stops working, in milliseconds, so a player can tell a dead ticket from a dead file."),
 });
+// The long edges a picture is re-encoded at for drawing (GET /workspace/thumb's `size=e<edge>`), smallest first. A reader
+// asks for the smallest one at least as long as the box the picture fills on its screen, device pixels counted, the
+// way a browser picks from a srcset. Steps of about one and a half, so a pick is never much larger than it needs, and
+// few enough that the pictures of a folder seen at several sizes share their renditions.
+export const PICTURE_EDGES = [384, 512, 768, 1024, 1536, 2048] as const;
+export type PictureEdge = (typeof PICTURE_EDGES)[number];
+
+// The box each picture or video is drawn in, asked of a folder's worth at once: a gallery lays its rows out from every
+// picture's shape before any of them has loaded, so a row never reflows under the reader as its pictures arrive.
+export const WORKSPACE_DIMENSIONS_MAX = 500;
+export const WorkspaceDimensionsQuerySchema = WorkspaceScopeSchema.extend({
+    paths: z
+        .array(z.string().min(1))
+        .min(1)
+        .max(WORKSPACE_DIMENSIONS_MAX)
+        .describe("The pictures and videos to measure, as workspace paths. Anything else, or anything unreadable, is left out of the answer."),
+});
+export const WorkspaceDimensionSchema = z.object({
+    path: z.string().describe("The path as it was asked for."),
+    width: z.number().describe("Width in pixels, as the picture is shown: a phone photo's or a phone video's rotation is already applied."),
+    height: z.number().describe("Height in pixels, as the picture is shown."),
+    duration: z.number().optional().describe("A video's running time in seconds, where its container says."),
+});
+export type WorkspaceDimension = z.infer<typeof WorkspaceDimensionSchema>;
+export const WorkspaceDimensionsSchema = z.object({
+    items: z
+        .array(WorkspaceDimensionSchema)
+        .describe(
+            "One entry per path that could be measured. A path missing here is not a picture this could read, which is an answer, not an error.",
+        ),
+});
+export type WorkspaceDimensions = z.infer<typeof WorkspaceDimensionsSchema>;
 // Credential for GET /workspace/download, which the browser navigates to so its own download manager streams the archive
 // to disk. The ticket carries the whole selection, resolved when minted, so however many entries it names the URL stays
 // short.

package/src/state/auth-state.ts

@@ -0,0 +1,89 @@
+import { STATE_DIR } from "@intentic/constants";
+import type { StateFile } from "./state-portability.js";
+import type { WorkspaceStatePath } from "./workspace-state.js";
+
+// The auth root holds AI-provider logins, the sandbox's secret vaults and the trust files a turn must not edit (mode
+// 0600, off the file routes, tree walk and search index). It lives at `.intentic/secrets/auth/` unless AGENT_AUTH_DIR
+// moved it, and the workspace table names it once, as a `secret` directory. This table classifies what is inside, so
+// an export does not carry this sandbox's own keys and pairings with the credentials, and does not drop the owner's
+// restrictions with them either. auth-state-coverage.test.ts in the daemon keeps it complete.
+//
+// The default for a path no entry claims is `secret`, the class of the directory itself: a provider home (`claude/`,
+// `codex/`, `cliproxy/`, `opencode/`…) is a login, and a new provider lands secret by construction.
+//
+// The classes follow the history table's precedent. A restriction the owner set is `carry`: a secret that travels must
+// not arrive ungated. A yes the owner gave (a grant, a release, a widened rule) is `identity`, like the hook and extension
+// approvals there: a trust decision the target's owner makes again.
+
+// Where the auth root sits inside the workspace when AGENT_AUTH_DIR does not move it; a declared workspace path.
+export const AUTH_ROOT_IN_WORKSPACE = `${STATE_DIR}/secrets/auth/` as const satisfies WorkspaceStatePath;
+
+// Auth-root-relative paths, forward-slash, matched by prefix; a directory keeps its trailing slash.
+export const AUTH_STATE_FILES: readonly StateFile[] = [
+    /* ---- the owner's restrictions: no credential in them, and loosened if left behind ---- */
+
+    // Which credentials need a named person's click (secrets/credential-gates.ts).
+    { path: "credential-gates.json", portability: "carry" },
+    // Where each secret may be sent (secrets/guards/host-guards.ts).
+    { path: "secret-hosts.json", portability: "carry" },
+    // The privacy shield's policy: whether it masks, what it looks for, which providers it trusts.
+    { path: "privacy-shield.json", portability: "carry" },
+    // The execution boundary agents run in (workload/domain/agent-domain-policy.ts).
+    { path: "agent-domain.json", portability: "carry" },
+
+    /* ---- credentials and what holds their values ---- */
+
+    { path: "sandbox-secrets.json", portability: "secret" },
+    { path: "capability-secrets.json", portability: "secret" },
+    { path: "extension-secrets.json", portability: "secret" },
+    // The personal data the shield masked, by token, and the pictures it painted over.
+    { path: "privacy-vault.json", portability: "secret" },
+    { path: "privacy-images/", portability: "secret" },
+    { path: "ssh-keys/", portability: "secret" },
+    // An update's pre-images of the files above; a vault's copy is a vault.
+    { path: "converting/", portability: "secret" },
+
+    /* ---- yeses the owner gave here: decided again on the target ---- */
+
+    // Sandbox-wide permissions ("Always: <line>") and each conversation's own (personas/owner-grants.ts,
+    // conversation-grants.ts); a conversation's card simply asks again, so only the sandbox-wide ones carry a note.
+    { path: "owner-grants.json", portability: "identity", note: "Give sandbox-wide permissions again from the Access tab." },
+    { path: "conversation-grants.json", portability: "identity" },
+    // An approver's release of a gated credential for one conversation.
+    { path: "credential-releases.json", portability: "identity" },
+    // Programs a secret may be typed into unasked; unset, every typing asks.
+    { path: "secret-programs.json", portability: "identity", note: "Allow programs to receive secrets again from Secrets." },
+    // Per-card credential rules and raw delivery, the owner's widening of a connector's own rules.
+    { path: "credential-policy.json", portability: "identity", note: "Set a connection's credential rules and delivery again from Capabilities." },
+
+    /* ---- this sandbox's own keys, and what it is paired with ---- */
+
+    // The keyring keypair the owner's computers pinned their shares to; only the public halves ever leave.
+    { path: "keyring-keys.json", portability: "identity", note: "Passwords shared from your computers are shared again with the new sandbox." },
+    // What each connected computer's keyring said, the entries copied to this sandbox's key, deliveries waiting for a
+    // computer, and the needs raised to them.
+    { path: "keyring-devices.json", portability: "identity" },
+    { path: "keyring-copies.json", portability: "identity" },
+    { path: "keyring-sync-mailbox.json", portability: "identity" },
+    { path: "keyring-needs.json", portability: "identity" },
+    // The credential broker's signing key and the privacy gateway's token key, each minted on first use.
+    { path: "broker-session.key", portability: "identity" },
+    { path: "privacy-gateway.key", portability: "identity" },
+    // The organisation policy the platform hands this sandbox; the target's platform hands its own.
+    { path: "org-policy.json", portability: "identity" },
+
+    /* ---- regenerated by the target ---- */
+
+    // Seat refusals the provider answered, and the model catalogs fetched for each runtime.
+    { path: "claude/seats.json", portability: "derived" },
+    { path: "claude/models.json", portability: "derived" },
+    { path: "cursor/models.json", portability: "derived" },
+    { path: "devin/models.json", portability: "derived" },
+    { path: "gemini/models.json", portability: "derived" },
+    // Each custom endpoint's last discovered model list, fetched again from the endpoint.
+    { path: "endpoints/", portability: "derived" },
+    // Values a computer released for one use each, for masking only; never outlive the process handed them.
+    { path: "keyring-released.json", portability: "derived" },
+    // The shell script and socket OpenCode runs commands through, written at boot.
+    { path: "opencode-shell/", portability: "derived" },
+];

package/src/state/history-state.ts

@@ -25,6 +25,14 @@ export const HISTORY_STATE_FILES: readonly StateFile[] = [
     // The tasks this sandbox's conversations handed to linked sandboxes (links/linked-children.ts), followed until they
     // settle: part of the conversations' own record, so it goes where they go.
     { path: "links/linked-children.json", portability: "carry" },
+    // One file per agent a conversation spawned (agent/subagents/spawned-children.ts): what its parent supervises it by
+    // (its run, session, last report and result), read back at boot so a restart does not orphan it. Part of the
+    // conversations' own record, so it goes where they go.
+    { path: "spawned-children/", portability: "carry" },
+    // One file per workflow run a conversation started (agent/subagents/workflows/script-runs.ts): its script, its calls and what
+    // each handed back, so a restart picks it up where it was and a later run can resume from its finished calls. Part of
+    // the conversations' own record, so it goes where they go.
+    { path: "script-runs/", portability: "carry" },
     // The long tool outputs those transcripts name rather than hold, stored once by content for every record naming
     // them; a transcript without them keeps only each output's start.
     { path: "blobs/", portability: "carry" },
@@ -48,6 +56,10 @@ export const HISTORY_STATE_FILES: readonly StateFile[] = [
     { path: "audit/", portability: "carry" },
     { path: "usage.jsonl", portability: "carry" },
     { path: "account-usage.json", portability: "carry" },
+    // What each provider's usage answers have been made of (their paths, and one redacted sample), so an answer that
+    // changes is noticed. Carried: the provider answers the same wherever the sandbox runs, and a fresh record would
+    // take the next changed answer as the first one.
+    { path: "provider-answers.json", portability: "carry" },
     // Per-account stay-away for a provider's usage endpoint. Carried, not re-earned: earning one costs the very read it
     // holds off, and is answered with a deadline measured from that moment. Entries past their instant are inert.
     { path: "usage-parks.json", portability: "carry" },
@@ -71,6 +83,14 @@ export const HISTORY_STATE_FILES: readonly StateFile[] = [
     { path: "apply-events.ndjson", portability: "carry" },
     { path: "check-events/", portability: "carry" },
 
+    // User-started operator panels resume on this sandbox after a restart; a moved sandbox starts inert.
+    { path: "panels.json", portability: "derived" },
+    // Receipts name kept commands lost with container-local capture storage; never replay arbitrary commands.
+    { path: "kept-jobs/", portability: "derived" },
+    // The last hour's turns `agents message` and each link started (the daemon's store/start-window.ts), so a restart does
+    // not reopen their hourly ceilings; a moved sandbox starts its hour afresh.
+    { path: "turn-starts.json", portability: "derived" },
+
     /* ---- regenerated by the target ---- */
 
     // Deliberately omitted: the branch lives in gits/, the registry in conversations.db; regenerated on the next turn.
@@ -185,7 +205,11 @@ export const HISTORY_STATE_FILES: readonly StateFile[] = [
         portability: "identity",
         note: "Re-invite collaborators from the Access tab, a grant is the platform's record, and the target enforces its own copy.",
     },
-    { path: "identity/control-tokens.json", portability: "identity", note: "Mint fresh control tokens, the old ones authenticate against the source sandbox." },
+    {
+        path: "identity/control-tokens.json",
+        portability: "identity",
+        note: "Mint fresh control tokens, the old ones authenticate against the source sandbox.",
+    },
     // The links other sandboxes hand this one tasks through (links/inbound-links.ts): hashed tokens like the control
     // tokens, each minted here, and the tasks filed under them; elsewhere they would let the paired sandboxes reach the
     // target in this one's name.
@@ -223,6 +247,9 @@ export const HISTORY_STATE_FILES: readonly StateFile[] = [
     { path: "phone-enrollments.json", portability: "identity", note: "Pair your phone again from its card: the app is still installed." },
     { path: "phone-pair-consumed.json", portability: "identity" },
     { path: "phone-wake.json", portability: "identity" },
+    // Which computers' keyrings each phone paired with for Passwords (phones/phone-pairings.ts): a shortcut over the
+    // keyrings' own pinned keys, keyed by phones paired to this sandbox, so it stays with the pairings above.
+    { path: "phone-pairings.json", portability: "identity" },
     // Setup-device pairing burn list; carrying it would mark another sandbox's fresh pairing as spent.
     { path: "host-pair-consumed.json", portability: "identity" },
     // Lands waiting for the computer whose folder they go to, and which computer last held each attached folder
@@ -256,6 +283,11 @@ export const HISTORY_STATE_FILES: readonly StateFile[] = [
     // person, since the key that signed it stays behind.
     { path: "automation-holds/", portability: "carry" },
     { path: "automation-holds.key", portability: "identity", note: "A held wake that was counting down arrives waiting for your yes instead." },
+    // What waits for an automation fire not journalled yet (the daemon's automations/durable/inbox-store.ts): a channel
+    // message in its debounce or behind a running fire, a workspace event behind its chore. Travels with the turn journal
+    // in conversations.db, which names the rows a fire already took.
+    { path: "automation-listener-inbox.json", portability: "carry" },
+    { path: "automation-workspace-inbox.json", portability: "carry" },
     { path: "local-cert/", portability: "identity" },
 
     /* ---- the state engine's own bookkeeping (the daemon's store/evolution/state-journal.ts) ---- */
@@ -267,4 +299,15 @@ export const HISTORY_STATE_FILES: readonly StateFile[] = [
     // Every conversation the import of the pre-1.308 layout settled (the daemon's conversations/registry/pre-1308-import.ts),
     // so one deleted after its import is not brought back from the old files still on disk. About this volume only.
     { path: "pre-1308-import.json", portability: "derived" },
+
+    /* ---- written beside the daemon, by the image, the host's ic and the package manager ---- */
+
+    // The terminal's typed history (the image's HISTFILE, made by docker-entrypoint.sh): the owner's own, kept so its
+    // suggestions survive a rebuild. `secret`, since a typed line can hold a pasted token.
+    { path: "shell/", portability: "secret" },
+    // ic's copy of its records for this sandbox (ic's sandbox/mirror.rs): its channel and rollback target, the machine
+    // that keeps it, its backups and repairs. About the machine it runs on, so the target's ic writes its own.
+    { path: ".ic/", portability: "identity" },
+    // pnpm's package store for installs in a checkout under /history, kept at the top of the mount pnpm finds it on.
+    { path: ".pnpm-store/", portability: "derived" },
 ];

package/src/state/runtime-state.ts

@@ -53,10 +53,11 @@ const RUNTIME_DOMAINS = [
     // Commit subject drafted after landing; arrives too late for the turn-end refresh, needs its own push.
     { domain: "landings", invalidates: [["git", "changes"]] },
 
-    // A pipeline run reached its end (webhook delivery, or the REST poll for a repo with no hook). The board's own
-    // poll is the freshness floor, not the answer: somebody watching a run finish must not wait out a poll interval.
-    // Runs only: the frame doesn't name which run moved, and re-reading every open row's job graph would cost a
-    // vendor call per row. The row re-reads its own graph off the status this invalidation lands (useRunJobs.ts).
+    // A pipeline run or one of its jobs moved: every webhook delivery, in flight or ended (2026-10-20), or the REST poll
+    // for a repo with no hook. The board's own poll is the freshness floor, not the answer: somebody watching a run
+    // must not wait out a poll interval. Runs only: the frame doesn't name which run moved, and re-reading every open
+    // row's job graph would cost a vendor call per row. An open in-flight row re-reads its own graph when the board's
+    // runs land (useRunJobs.ts); the daemon's CI-shaped watches recheck on it too (watchers.ts).
     { domain: "ci", invalidates: [["ci-runs"]] },
 
     // An engine install starting or ending, whoever started it; the card's only feed, since a read costs registry calls.