@intentic/sandbox-contract 1.344.0 → 1.346.0

package/README.md

@@ -33,6 +33,15 @@ flowchart LR
   own build, so a route an older daemon lacks shows as a missing feature instead of a 404. The desktop app's folder
   sidecar sends the same frame with `surface: "folder"` and only the few routes it serves, which the browser offers
   and never reads as out of date.
+- Every file the daemon keeps says whether it travels in an environment bundle (`carry`, `secret`, `identity` or
+  `derived`, `src/state/state-portability.ts`). The contract holds the tables for the two roots other programs read:
+  `WORKSPACE_STATE_FILES`, and `AUTH_STATE_FILES` for the auth root of provider logins, secret vaults and trust files.
+  `/history` is the daemon's alone, so its table lives there: each stored document declares its class on its own
+  definition, and the daemon lists the paths no document claims (`src/store/evolution/history-state.ts` in
+  `_sandbox/sandbox`). In the auth root, the owner's restrictions (credential gates, host guards, the privacy shield)
+  travel without secrets, and this sandbox's own keys, pairings and the yeses its owner gave never travel. A path no
+  entry names keeps the directory's own class: `carry` on the workspace, `derived` on `/history`, `secret` in the auth
+  root.
 - The oldest daemon the editor supports is declared here, `OLDEST_SUPPORTED_DAEMON` in `src/state/daemon-floor.ts`,
   with a dated line for why it is that release. The editor reads a daemon's version off the head of the hello's
   `build` (`<version>:<mtime>`) and draws a single "needs an update" page below it. The floor's test freezes the fields
@@ -44,16 +53,20 @@ flowchart LR
   A turn refused for an unsupported or unreadable protected policy carries `agent-domain-refused`, an admission
   refusal: its queued words remain owed, not consumed as an executed failure.
 - Some rules live here as code, not only shapes, because both ends must reach the same answer. The main one is
-  whether an account can serve a turn: `serviceState` in `src/models/plan-pools.ts` turns a revoked sign-in, a lost
-  seat, a translator bench, a standing refusal and the plan limits into one `AccountState` (`ready` · `spent` ·
-  `blocked` with its `fix` · `unknown`), and `SPENT_UTILIZATION` is the only spent line. The daemon runs it for every
-  picker and publishes it as `state` on each account row. The editor reads that field and never judges a row itself: a
-  row without it (a daemon from before v1.313) reads as `unknown`, and the editor says the sandbox needs an update.
+  whether an account can serve a turn: `serviceStates` in `src/models/plan-pools.ts` turns a revoked sign-in, a lost
+  seat, a translator bench, every refusal still standing and the plan limits into one `AccountState` (`ready` · `spent`
+  · `blocked` with its `fix` · `unknown`), and `fleetCapacity` folds a provider's accounts into one answer per model
+  (`serving` · `spent` until when · `unknown`). `SPENT_UTILIZATION` is the only spent line. The daemon and the editor both
+  run it, on the same account rows and the same refusals on file (`ProviderRefusalsSchema`, every refusal per provider);
+  no account row carries a verdict, so no surface can read a stale one.
 - So is which lane the board files a conversation in and what of a fleet calls the person (`src/models/agent-standing.ts`,
   `src/models/agent-lanes.ts`, `src/models/agent-starter.ts`, moved from the editor on 2026-10-16): the editor draws
   the board by them and re-exports them where it always imported them, and the daemon counts `GET /agents/attention`
   by `fleetAttention` (the Attention lane's cards plus held wakes, and the turns producing something), which the
-  desktop app's status bar reads through `ic sandbox attention`, so the bar and the board cannot disagree.
+  desktop app's status bar reads through `ic sandbox attention`, so the bar and the board cannot disagree. Whether a
+  conversation carries on by itself, and when, is one field the daemon derives on every card, `next`
+  (`src/schemas/agent-next.ts`): the lane, the card's corner and the chat read it rather than the hold, the queue or an
+  answer it came from (2026-10-20).
 - So are the rules the daemon and a device must agree on about the owner's machine. `DEVICE_PROGRAM_TOOLS` in
   `src/policy/device-programs.ts` says which device tools carry a program and how to read it, and
   `sandboxPowerCommands` in `src/policy/sandbox-power.ts` recognises a command that starts, stops or replaces a
@@ -62,6 +75,10 @@ flowchart LR
   (`src/state/update-probation.ts`), the one shape of `restart-intent.json` (`src/schemas/restart-intent.ts`), the
   answer of `ic sandbox swaps --json` (`src/schemas/device-swaps.ts`), and what `ic os status --json` and
   `ic os update --check --json` answer, with the argv of every `ic os` verb (`src/schemas/intentic-os.ts`).
+- Which build a sandbox is, and every comparison between two of them, is `src/state/sandbox-build.ts`: a pending
+  rebuild, runner parity, and (2026-10-20) whether a swap landed. `/info` reports what answers (`running`: the build
+  and when its daemon started), and `swapVerdict` says landed, came back unmoved, or still waiting. A page used to
+  tell an update by the version moving, which a checkout build (always 0.0.0) never does.
 - What a credential looks like is decided here too: `CREDENTIAL_ISSUERS` in `src/policy/credential-material.ts` (each
   issuer's prefix and token body, as data) and `SECRET_REFERENCE` in `src/schemas/needs.ts` (the `{{secret:name}}`
   pattern, non-global, so each site that scans derives its own `/g` copy). The terminal output filter
@@ -118,9 +135,10 @@ flowchart LR
   under `access:METHOD /path`: every reach field of its `RouteMeta` with the default filled in (`routeAccess`). A
   field is recorded even when a route leaves it out, so a lowered floor or a new `guest`, `agent` or `panel` grant is a
   changed value, which counts as a shrink, never as growth that passes. The lock test names the route and the field
-  that moved. Rewrite it by hand with `pnpm --filter @intentic/sandbox-contract lock`. A conversation that changed the
-  contract has it rewritten in its own worktree before it lands (the repository's fixers,
-  `_tools/scripts/verify/fixers.mjs`), so the lock rides the land that moved it. `src/state/contract-lock.test.ts`
+  that moved. It is `merge=derived` (`.gitattributes`): no land carries a copy of it, and the repository's fixers
+  (`_tools/scripts/verify/fixers.mjs`) write it again in the tree a land writes contract sources into, so two
+  conversations that both moved the contract never conflict on it. By hand, from source with no build first:
+  `pnpm --filter @intentic/sandbox-contract lock`. `src/state/contract-lock.test.ts`
   fails while the lock and the schemas disagree. `_tools/checks/contract-shrink.mjs` fails CI for a pushed branch
   that shrinks it with no commit declaring the break (`type!:` or `Breaking-Note:`); nothing checks the push itself.
 

package/dist/contracts/accounts.contract.d.ts

@@ -71,33 +71,19 @@ export declare const accountsContract: {
                     }, import("zod/v4/core").$strip>]>;
                     rounded: import("zod").ZodOptional<import("zod").ZodBoolean>;
                     lapsedAt: import("zod").ZodOptional<import("zod").ZodNumber>;
+                    missingSince: import("zod").ZodOptional<import("zod").ZodNumber>;
                 }, import("zod/v4/core").$strip>>;
                 measuredAt: import("zod").ZodNumber;
                 unread: import("zod").ZodOptional<import("zod").ZodObject<{
                     since: import("zod").ZodNumber;
                     reason: import("zod").ZodString;
                 }, import("zod/v4/core").$strip>>;
+                uncovered: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodString>>;
+                contradicted: import("zod").ZodOptional<import("zod").ZodObject<{
+                    at: import("zod").ZodNumber;
+                    model: import("zod").ZodString;
+                }, import("zod/v4/core").$strip>>;
             }, import("zod/v4/core").$strip>>;
-            state: import("zod").ZodOptional<import("zod").ZodDiscriminatedUnion<[import("zod").ZodObject<{
-                kind: import("zod").ZodLiteral<"ready">;
-                room: import("zod").ZodNumber;
-            }, import("zod/v4/core").$strip>, import("zod").ZodObject<{
-                kind: import("zod").ZodLiteral<"spent">;
-                reopensAt: import("zod").ZodOptional<import("zod").ZodNumber>;
-            }, import("zod/v4/core").$strip>, import("zod").ZodObject<{
-                kind: import("zod").ZodLiteral<"blocked">;
-                fix: import("zod").ZodEnum<{
-                    admin: "admin";
-                    reconnect: "reconnect";
-                    verify: "verify";
-                    wait: "wait";
-                }>;
-                reason: import("zod").ZodString;
-                until: import("zod").ZodOptional<import("zod").ZodNumber>;
-                url: import("zod").ZodOptional<import("zod").ZodString>;
-            }, import("zod/v4/core").$strip>, import("zod").ZodObject<{
-                kind: import("zod").ZodLiteral<"unknown">;
-            }, import("zod/v4/core").$strip>], "kind">>;
         }, import("zod/v4/core").$strip>>;
     }, import("zod/v4/core").$strip>, Record<never, never>, import("../protocol/route-meta.js").RouteMeta & Record<never, never>>;
     status: import("@orpc/contract").ContractProcedureBuilderWithInputOutput<import("zod").ZodObject<{
@@ -139,33 +125,19 @@ export declare const accountsContract: {
                     }, import("zod/v4/core").$strip>]>;
                     rounded: import("zod").ZodOptional<import("zod").ZodBoolean>;
                     lapsedAt: import("zod").ZodOptional<import("zod").ZodNumber>;
+                    missingSince: import("zod").ZodOptional<import("zod").ZodNumber>;
                 }, import("zod/v4/core").$strip>>;
                 measuredAt: import("zod").ZodNumber;
                 unread: import("zod").ZodOptional<import("zod").ZodObject<{
                     since: import("zod").ZodNumber;
                     reason: import("zod").ZodString;
                 }, import("zod/v4/core").$strip>>;
+                uncovered: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodString>>;
+                contradicted: import("zod").ZodOptional<import("zod").ZodObject<{
+                    at: import("zod").ZodNumber;
+                    model: import("zod").ZodString;
+                }, import("zod/v4/core").$strip>>;
             }, import("zod/v4/core").$strip>>;
-            state: import("zod").ZodOptional<import("zod").ZodDiscriminatedUnion<[import("zod").ZodObject<{
-                kind: import("zod").ZodLiteral<"ready">;
-                room: import("zod").ZodNumber;
-            }, import("zod/v4/core").$strip>, import("zod").ZodObject<{
-                kind: import("zod").ZodLiteral<"spent">;
-                reopensAt: import("zod").ZodOptional<import("zod").ZodNumber>;
-            }, import("zod/v4/core").$strip>, import("zod").ZodObject<{
-                kind: import("zod").ZodLiteral<"blocked">;
-                fix: import("zod").ZodEnum<{
-                    admin: "admin";
-                    reconnect: "reconnect";
-                    verify: "verify";
-                    wait: "wait";
-                }>;
-                reason: import("zod").ZodString;
-                until: import("zod").ZodOptional<import("zod").ZodNumber>;
-                url: import("zod").ZodOptional<import("zod").ZodString>;
-            }, import("zod/v4/core").$strip>, import("zod").ZodObject<{
-                kind: import("zod").ZodLiteral<"unknown">;
-            }, import("zod/v4/core").$strip>], "kind">>;
         }, import("zod/v4/core").$strip>>;
     }, import("zod/v4/core").$strip>, import("zod").ZodObject<{
         status: import("zod").ZodLiteral<"error">;
@@ -223,33 +195,19 @@ export declare const accountsContract: {
                     }, import("zod/v4/core").$strip>]>;
                     rounded: import("zod").ZodOptional<import("zod").ZodBoolean>;
                     lapsedAt: import("zod").ZodOptional<import("zod").ZodNumber>;
+                    missingSince: import("zod").ZodOptional<import("zod").ZodNumber>;
                 }, import("zod/v4/core").$strip>>;
                 measuredAt: import("zod").ZodNumber;
                 unread: import("zod").ZodOptional<import("zod").ZodObject<{
                     since: import("zod").ZodNumber;
                     reason: import("zod").ZodString;
                 }, import("zod/v4/core").$strip>>;
+                uncovered: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodString>>;
+                contradicted: import("zod").ZodOptional<import("zod").ZodObject<{
+                    at: import("zod").ZodNumber;
+                    model: import("zod").ZodString;
+                }, import("zod/v4/core").$strip>>;
             }, import("zod/v4/core").$strip>>;
-            state: import("zod").ZodOptional<import("zod").ZodDiscriminatedUnion<[import("zod").ZodObject<{
-                kind: import("zod").ZodLiteral<"ready">;
-                room: import("zod").ZodNumber;
-            }, import("zod/v4/core").$strip>, import("zod").ZodObject<{
-                kind: import("zod").ZodLiteral<"spent">;
-                reopensAt: import("zod").ZodOptional<import("zod").ZodNumber>;
-            }, import("zod/v4/core").$strip>, import("zod").ZodObject<{
-                kind: import("zod").ZodLiteral<"blocked">;
-                fix: import("zod").ZodEnum<{
-                    admin: "admin";
-                    reconnect: "reconnect";
-                    verify: "verify";
-                    wait: "wait";
-                }>;
-                reason: import("zod").ZodString;
-                until: import("zod").ZodOptional<import("zod").ZodNumber>;
-                url: import("zod").ZodOptional<import("zod").ZodString>;
-            }, import("zod/v4/core").$strip>, import("zod").ZodObject<{
-                kind: import("zod").ZodLiteral<"unknown">;
-            }, import("zod/v4/core").$strip>], "kind">>;
         }, import("zod/v4/core").$strip>>;
     }, import("zod/v4/core").$strip>, Record<never, never>, import("../protocol/route-meta.js").RouteMeta & Record<never, never>>;
     rename: import("@orpc/contract").ContractProcedureBuilderWithInputOutput<import("zod").ZodObject<{
@@ -288,33 +246,19 @@ export declare const accountsContract: {
                 }, import("zod/v4/core").$strip>]>;
                 rounded: import("zod").ZodOptional<import("zod").ZodBoolean>;
                 lapsedAt: import("zod").ZodOptional<import("zod").ZodNumber>;
+                missingSince: import("zod").ZodOptional<import("zod").ZodNumber>;
             }, import("zod/v4/core").$strip>>;
             measuredAt: import("zod").ZodNumber;
             unread: import("zod").ZodOptional<import("zod").ZodObject<{
                 since: import("zod").ZodNumber;
                 reason: import("zod").ZodString;
             }, import("zod/v4/core").$strip>>;
+            uncovered: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodString>>;
+            contradicted: import("zod").ZodOptional<import("zod").ZodObject<{
+                at: import("zod").ZodNumber;
+                model: import("zod").ZodString;
+            }, import("zod/v4/core").$strip>>;
         }, import("zod/v4/core").$strip>>;
-        state: import("zod").ZodOptional<import("zod").ZodDiscriminatedUnion<[import("zod").ZodObject<{
-            kind: import("zod").ZodLiteral<"ready">;
-            room: import("zod").ZodNumber;
-        }, import("zod/v4/core").$strip>, import("zod").ZodObject<{
-            kind: import("zod").ZodLiteral<"spent">;
-            reopensAt: import("zod").ZodOptional<import("zod").ZodNumber>;
-        }, import("zod/v4/core").$strip>, import("zod").ZodObject<{
-            kind: import("zod").ZodLiteral<"blocked">;
-            fix: import("zod").ZodEnum<{
-                admin: "admin";
-                reconnect: "reconnect";
-                verify: "verify";
-                wait: "wait";
-            }>;
-            reason: import("zod").ZodString;
-            until: import("zod").ZodOptional<import("zod").ZodNumber>;
-            url: import("zod").ZodOptional<import("zod").ZodString>;
-        }, import("zod/v4/core").$strip>, import("zod").ZodObject<{
-            kind: import("zod").ZodLiteral<"unknown">;
-        }, import("zod/v4/core").$strip>], "kind">>;
     }, import("zod/v4/core").$strip>, Record<never, never>, import("../protocol/route-meta.js").RouteMeta & Record<never, never>>;
     disconnect: import("@orpc/contract").ContractProcedureBuilderWithInputOutput<import("zod").ZodObject<{
         id: import("zod").ZodString;

package/dist/contracts/accounts.contract.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"accounts.contract.d.ts","sourceRoot":"","sources":["../../src/contracts/accounts.contract.ts"],"names":[],"mappings":"AAqBA,eAAO,MAAM,gBAAgB;IACzB,KAAK;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAUL,QAAQ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAUR,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAUN,MAAM;;;;;;;;;;;;;;;;IAUN,QAAQ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAUR,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IASN,UAAU;;;;;;;;;;;;;;;;CASb,CAAC"}
+{"version":3,"file":"accounts.contract.d.ts","sourceRoot":"","sources":["../../src/contracts/accounts.contract.ts"],"names":[],"mappings":"AAqBA,eAAO,MAAM,gBAAgB;IACzB,KAAK;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAUL,QAAQ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAUR,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAUN,MAAM;;;;;;;;;;;;;;;;IAUN,QAAQ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAUR,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IASN,UAAU;;;;;;;;;;;;;;;;CASb,CAAC"}