@intentic/sandbox-contract 1.360.0 → 1.362.0

package/src/schemas/automations.ts

@@ -4,6 +4,8 @@ import { AgentOriginSchema, ModelPinSchema } from "./agent.js";
 import { entryId } from "./internal.js";
 import { IssuesConfigSchema } from "./issues.js";
 import { ZoneSchema } from "../time/zone.js";
+import { WorkspaceEventKindSchema } from "./automation-events.js";
+export { WorkspaceEventKindSchema, WorkspaceEventSchema, type WorkspaceEventKind, type WorkspaceEvent } from "./automation-events.js";
 // An automation wakes the agent: the daemon fires each enabled one on its trigger, runs the optional guard command
 // (non-zero exit skips the wake), then runs one turn with the prompt. The manifest is user config; run history is
 // daemon-recorded.
@@ -23,39 +25,6 @@ import { ZoneSchema } from "../time/zone.js";
 // pushes one branch per agent
 // workspace: fires from the sandbox's own codebase (WorkspaceEventKindSchema)
 
-// What the daemon emits as the fleet works, for a code chore to react to; no token or route, since only the daemon
-// reads these.
-// turn.settled: fires once per isolated turn regardless of outcome, while the diff is still on screen
-// agent.landed: fires only once work reaches the main tree, including a later manual Land
-// deps.broken/deps.fixed: retired with the check that ran after every land (2026-09-27). Nothing emits them any more;
-// they stay so an automation written for them still reads, and it never fires. Main's failing CI is the `ci` listener's.
-export const WorkspaceEventKindSchema = z.enum(["turn.settled", "agent.landed", "deps.broken", "deps.fixed"]);
-export type WorkspaceEventKind = z.infer<typeof WorkspaceEventKindSchema>;
-// Payload of a workspace-triggered wake, delivered as JSON in $AUTOMATION_PAYLOAD and appended to the prompt.
-// `repos[].from` is each repo's state before the turn; the span runs to the working tree, not a commit, so an errored
-// turn's uncommitted work still shows.
-export const WorkspaceEventSchema = z.object({
-    event: WorkspaceEventKindSchema,
-    agentId: z.string(),
-    title: z.string().optional(),
-    branch: z.string(),
-    // `ready` is a clean turn held on the branch (auto-land off): the moment right before a deliberate Land, when a
-    // pre-land review wants to run.
-    outcome: z.enum(["landed", "conflict", "ready", "idle", "error"]),
-    repos: z.array(z.object({ repo: z.string(), from: z.string(), dir: z.string() })),
-    // Present only for `deps.*` events: which project broke, the command and exit code, a bounded log tail, and
-    // `attempt` counting consecutive failures since the last pass.
-    deps: z
-        .object({
-            project: z.string(),
-            command: z.string(),
-            exitCode: z.number(),
-            attempt: z.number(),
-            logTail: z.string(),
-        })
-        .optional(),
-});
-export type WorkspaceEvent = z.infer<typeof WorkspaceEventSchema>;
 export const TriggerSchema = z.discriminatedUnion("kind", [
     z.object({
         kind: z.literal("schedule").describe("On a clock."),
@@ -446,6 +415,16 @@ export const AutomationSchema = z.object({
         .boolean()
         .optional()
         .describe("This automation is a maintenance job, which is what files it under chores rather than among ordinary automations."),
+    // Pure filing, like `chore`: the daemon never reads it. Absent, the panel files it by its persona instead, so a set
+    // of jobs one role runs reads as one shelf without anybody naming it.
+    group: z
+        .string()
+        .min(1)
+        .max(40)
+        .optional()
+        .describe(
+            "Which shelf of the Automations panel it is filed on, like 'Marketing' or 'Releases'. Automations naming the same group are listed together. Absent files it under its persona, or with the code chores.",
+        ),
     enabled: z.boolean().describe("Whether it fires at all."),
 });
 export type Automation = z.infer<typeof AutomationSchema>;

package/src/schemas/device-commands.ts

@@ -1,21 +1,9 @@
 import { z } from "zod";
 
-// Closed set of command names; the daemon builds argv from the name alone (hosts/device-commands.ts). Never a free-text
-// command: the same socket carries `run_command`, which would grant a shell on the user's machine.
-// `sync-unpair` runs the machine's own `sync uninstall --sandbox` (terminates both Mutagen sessions, drops the pairing,
-// self-revokes enrollment); revoking from the sandbox side is a different route.
-// `dev-restart`, `dev-rebuild` and `sync-install` are the three whose argv the daemon fills from what only it knows — the
-// dev checkout on that machine, a freshly minted pairing token — which is also why none takes a path or a token from the
-// caller. The two dev commands are also why a machine-side op is the wrong shape for them: this door carries a COMMAND
-// STRING to a tool every released agent already has, so a sandbox can drive a machine whose agent predates the feature.
-// `dev-rebuild-log` is the read side of `dev-rebuild`: the build is detached out there, so its log is the only place its
-// progress exists, and polling this is what turns a fired-and-forgotten command into something with a progress bar.
-// `sync-clean` removes the build output left in directories the sandbox has deleted, which is what stops those
-// deletions from ever landing. It deletes only content the session already ignores, so it is the one command here whose
-// worst outcome is a rebuild — which is why it is a button and not a turn.
-// `mirror-ignore`/`mirror-unignore` are `mirror-off`'s per-port form, and the reason they exist: a port number that is
-// permanently taken on one machine's localhost has no answer in an all-or-nothing switch, so the choice lives where the
-// conflict does — one port, one device, durable — instead of muting every port the pairing serves.
+// Closed names let the daemon build argv without granting arbitrary shell access; dev/sync commands never accept caller paths or tokens.
+// Use existing run_command for older-agent compatibility; poll dev-rebuild-log because rebuilds are detached.
+// sync-unpair terminates sessions/revokes enrollment; sync-clean removes ignored build residue only.
+// mirror-ignore/unignore persists per-device port choices without muting all mirrored ports.
 export const DeviceCommandSchema = z.enum([
     "mirror-off",
     "mirror-on",
@@ -55,7 +43,7 @@ export const DeviceLocalDirSchema = z
     .string()
     .min(1)
     .max(4096)
-    // The curly quotes as escapes: bun's transpiler rewrites a literal one in a regex to its escape and tsgo keeps it,
+    // The curly quotes as escapes: bun's transpiler rewrites a literal one in a regex to its escape and tsc keeps it,
     // so spelled literally the pattern reads differently from source and from dist, and contract.lock.json can match
     // only one of them.
     .regex(/^(?:~|\/|[A-Za-z]:[\\/])[^"'`$;|&\n\r\u201C\u201D\u201E\u2018\u2019\u201A\u201B]*$/);

package/src/schemas/hosts.ts

@@ -107,33 +107,10 @@ export const DeviceFactsSchema = z.object({
 });
 export type DeviceFacts = z.infer<typeof DeviceFactsSchema>;
 
-// The optional device ops, by what enables them:
-// - `reshape-later`: the old `reshape` op with `later`, saving the change for the next restart. An agent from before it
-//   strips `later` and reshapes NOW, which is why a later-reshape is never sent to one. Redundant with `set-shape`'s
-//   `when` for every current page; kept only for pages and daemons from before `set-shape` (v1.312.0 and older),
-//   which check it. REMOVE IN v1.314.0, with the old `reshape` op it gates.
-// - `set-shape`: the `set-shape`/`forget-shape` ops, and `start`/`restart` applying a saved shape, all through an `ic`
-//   whose `ic sandbox shape` takes the contract's own shape (`--set`); advertised only when the agent's `ic` does.
-//   Both features ride that verb, so an agent advertises both or neither.
-// - `rollback-to`: the `rollback` op's `to`, going back to an older version kept on the machine rather than the
-//   previous one; advertised only when the agent's `ic sandbox rollback` takes `--to`.
-// - `loopback-catch`: the `catchLoopback` procedure, a sign-in's loopback redirect caught on this machine
-//   (loopback-catch.ts); an agent without it rejects the call as an unknown procedure.
-// - `background-prepare`: the `prepare-background` op, the next update downloaded under the unattended rules of the
-//   agent's own timer (`ic sandbox prepare --auto`), which the update card sends when it opens; advertised only when
-//   the agent's `ic sandbox prepare` takes `--auto`.
-// - `programs`: the `stageArtifact` procedure and the app_* tools, a program this sandbox built pushed to the machine and
-//   run under the agent's supervision (device-artifacts.ts); an agent without it is told to update rather than sent one.
-// - `project-delivery`: the `deliverProject` procedure, landed work written into a folder attached to this computer's
-//   sandbox (project-delivery.ts); an agent without it is never sent one, and the land waits for Bring back.
-// - `keyring`: the keyring* procedures, intentic-keyring on this computer reached through the machine (keyring.ts);
-//   advertised only while a keyring is installed, so a sandbox never offers a computer without one as a place to keep or
-//   type a secret.
-// - `sleep`: the `sleep` op, a sandbox put to sleep now (`ic sandbox sleep <slug>`): stopped, and started again by
-//   itself when somebody opens it; advertised only when the agent's `ic` has `sandbox sleep`.
-// - `reachable-ways-back`: not an op but what a listing means: a sandbox's `rollbackTargets` are only the ways back a
-//   rollback can reach (ic 2026-10-19 on). Said by ic itself (`ic features`, golden/ic-features.json); without it the
-//   rows are an older ic's, which also listed pruned dev builds no download can bring back (state/ways-back.ts).
+// Optional device capabilities gate calls to older agents: never send an operation unless its advertised feature permits it.
+// set-shape, rollback-to, background-prepare and sleep depend on ic support; keyring also requires a local installation.
+// reshape-later protects legacy deferred reshapes from becoming immediate; project-delivery otherwise waits for Bring back.
+// reachable-ways-back means rollbackTargets excludes unrecoverable builds. Other features gate the procedures named below.
 export const DeviceFeatureSchema = z.enum([
     "reshape-later",
     "set-shape",

package/src/schemas/organisation.ts

@@ -30,22 +30,10 @@ export type OrgSection = z.infer<typeof OrgSectionSchema>;
 export const OrgSectionModeSchema = z.enum(["open", "locked", "hidden"]);
 export type OrgSectionMode = z.infer<typeof OrgSectionModeSchema>;
 
-// What an organisation admin edits. A section left out is open, so a policy written before a section existed opens it
-// rather than guessing.
-//
-// `preset` PINS settings rather than locking a page: each named group of the public-office preset (compliance.ts
-// PRESET_GROUPS; which settings a group holds is the daemon's compliance/preset.ts) is applied to what the sandbox READS,
-// whatever its files say, and a change that would undo it is refused. Strings on the wire, not the enum: a group a newer
-// platform names and this daemon does not know is skipped and reported (`unenforced`), never a reason to refuse the
-// whole policy, which would stop every later edition reaching an older daemon. The platform validates the names an
-// admin saves.
-//
-// `membersOnly` makes the organisation's member list the outer fence of every bound sandbox's roster: a person the
-// organisation removes is taken off each sandbox's roster by its daemon at the next fetch, and a grant to someone who
-// is not a member is refused. The sandbox's owner is not on a roster, so this never reaches them.
-//
-// Both are optional rather than defaulted, so every policy written before them (a stored row, a held file, a literal)
-// still reads as the same type: absent is no pin and an open roster.
+// Omitted policy sections stay open. preset pins effective settings and refuses undoing writes, regardless of underlying files.
+// Unknown preset groups are skipped/reported as unenforced so newer policies still reach older daemons; the platform validates saved names.
+// membersOnly fences roster grants/removals by organisation membership, excluding the owner who is not a roster entry.
+// Both fields remain optional for stored-policy compatibility: absence means no pins and an open roster.
 export const OrgPolicyRulesSchema = z.object({
     sections: z
         .partialRecord(OrgSectionSchema, OrgSectionModeSchema)

package/src/schemas/personas.ts

@@ -253,6 +253,33 @@ export const personaModels = (card: Pick<Persona, "models">, sources: readonly M
 // The one stock persona id; lives here because the daemon and the automations form are separate packages that must
 // agree on it exactly, or a Visitor chat pins to a card nobody creates.
 export const VISITOR_CHAT_PERSONA = "visitor-chat";
+// THE TWO BUILT-IN PERSONAS. Every turn acts as somebody: a turn naming no card wears one of these, picked by whether a
+// person is watching (personas.ts `turnPersona` in the daemon). They are constants rather than cards in personas.json:
+// that file is tracked in git, and "every account" is not something a card's account list can say, since the list is
+// written once and accounts are connected later. Neither can be edited or removed, and no card may take either id.
+// Full access: every tool and every signed-in account, what a chat a person starts without picking anyone acts as.
+export const FULL_ACCESS_PERSONA = "full-access";
+// No accounts: every tool but no signed-in account, what a run nobody watches acts as when it names no one, since
+// whatever woke it may have put somebody else's words in its prompt.
+export const NO_ACCOUNTS_PERSONA = "no-accounts";
+export type BuiltInPersonaId = typeof FULL_ACCESS_PERSONA | typeof NO_ACCOUNTS_PERSONA;
+export interface BuiltInPersona {
+    readonly id: BuiltInPersonaId;
+    // English, for the daemon's own words (a turn's standing, its notes); every screen says it through its own catalog.
+    readonly label: string;
+    // Whether its turns reach the sandbox's signed-in accounts: all of them, or none.
+    readonly accounts: "all" | "none";
+}
+const FULL_ACCESS: BuiltInPersona = { id: FULL_ACCESS_PERSONA, label: "Full access", accounts: "all" };
+const NO_ACCOUNTS: BuiltInPersona = { id: NO_ACCOUNTS_PERSONA, label: "No accounts", accounts: "none" };
+export const BUILT_IN_PERSONAS: readonly BuiltInPersona[] = [FULL_ACCESS, NO_ACCOUNTS];
+export const isBuiltInPersona = (id: string | undefined): id is BuiltInPersonaId => id === FULL_ACCESS_PERSONA || id === NO_ACCOUNTS_PERSONA;
+export const builtInPersona = (id: BuiltInPersonaId): BuiltInPersona => (id === FULL_ACCESS_PERSONA ? FULL_ACCESS : NO_ACCOUNTS);
+// Who a turn naming no card acts as: Full access with a person watching, No accounts without.
+export const defaultPersona = (unattended: boolean): BuiltInPersonaId => (unattended ? NO_ACCOUNTS_PERSONA : FULL_ACCESS_PERSONA);
+// An unwatched run's persona pick with No accounts read as no pick: an unwatched turn naming none wears No accounts
+// anyway, so the two are one choice, and a form shows them as one row.
+export const unwatchedPick = (actsAs: string | undefined): string | undefined => (actsAs === NO_ACCOUNTS_PERSONA ? undefined : actsAs);
 // One phrase describing how bounded a card is, shared so the Personas page and the automation picker can't grow
 // different vocabularies for the same card. "Read-only"/"no shell" are named; everything else collapses to a count.
 export const personaBounds = (persona: Persona): string => {

package/src/schemas/providers/plan-limits.ts

@@ -387,10 +387,10 @@ export const ResumeRoutingSchema = z.object({
         .describe(
             "Which of that provider's accounts pays for it. Leave it out to keep the account the conversation runs on, or, on another provider, to take whichever of its accounts can serve with the most room. Moving to another account of the same provider is `switchAccount`'s job; naming one here still works.",
         ),
-    // A client whose catalog hasn't loaded has nothing to send; the turn's own model is the better fallback.
-    model: z.string().optional().describe("Which model. Leave it out to keep the one the refused turn named."),
+    // An unloaded catalog keeps the held model only on its own provider.
+    model: z.string().optional().describe("Which model. Leave it out to keep the refused turn's model on the same provider, or use the new provider's default."),
     // A tier named for one model may mean nothing on another, so a move onto a ladder rung carries that rung's own.
-    effort: z.string().optional().describe("How hard the model should think on the re-run. Leave it out to keep the refused turn's."),
+    effort: z.string().optional().describe("How hard the model should think on the re-run. Leave it out to keep the refused turn's on the same provider and model, or use the new model's default."),
     // A session is a file the daemon keeps; a credential is an env var. That's what lets a same-provider account switch
     // resume the existing session instead of opening a fresh one.
     carry: z

package/src/schemas/repo-checks.ts

@@ -0,0 +1,81 @@
+// Checks a repository declares; sandbox settings decide whether the owner adopts them.
+import { STATE_DIR } from "@intentic/constants";
+import { z } from "zod";
+
+// Where a repository declares them, under the same `.intentic/` folder a directory already uses for its own UI. One
+// spelling for the daemon that reads it, the screen that names it and the demo that mimics it.
+export const REPO_CHECKS_FILE = `${STATE_DIR}/checks.json`;
+
+// Named for the occasion as a repository would say it: `edit` is `file.edited` and `turn` is `turn.ending`
+// (rules/repo-checks.ts maps them). `edit` runs on one file (`{file}`) and its output rides back in the edit's own
+// response, so a command declared there is paid per edit and has to take the file. `turn` runs once when an isolated
+// turn is about to stop, on the whole tree, and what it prints when it fails is said back to the model once, which may
+// fix it or say why not. `land` is retired: nothing runs after work lands any more (CI checks what the owner pushes), and
+// a declaration naming it still reads but runs nothing. No check refuses a land, a commit or a push.
+export const RepoCheckMomentSchema = z.enum(["edit", "turn", "land"]);
+export type RepoCheckMoment = z.infer<typeof RepoCheckMomentSchema>;
+
+export const RepoCheckSchema = z.object({
+    when: RepoCheckMomentSchema.describe(
+        "When to run it: `edit` on each file as it is written (`{file}` is its path); `turn` once when an isolated turn is about to stop, for at most three minutes, with what it prints on failure said back to the model once. Neither holds or refuses anything. `land` is retired and runs nothing, since CI checks what is pushed.",
+    ),
+    run: z.string().min(1).max(500).describe("The command, run in this repository's own directory, so it reads as it would in a terminal there."),
+    label: z.string().min(1).max(80).optional().describe("What to call it on screen. Absent names it after the command."),
+    // Same ceiling as a rule's own command; past it the process group is killed and the run is a failure.
+    timeoutMs: z.number().min(60_000).max(3_600_000).optional().describe("How long it may take before it is killed and counted as failed."),
+    // Repo-relative; the daemon prefixes the repo id before matching, since a rule's globs are workspace-relative.
+    paths: z
+        .array(z.string().min(1))
+        .max(20)
+        .optional()
+        .describe("Only run it when the change touches these paths, written relative to this repository. Absent runs it on every change here."),
+});
+export type RepoCheck = z.infer<typeof RepoCheckSchema>;
+
+// The file itself. One key, so a second concern can be added later without breaking a file anyone has written.
+export const RepoChecksFileSchema = z.object({
+    checks: z
+        .array(RepoCheckSchema)
+        .max(10)
+        .default([]),
+});
+export type RepoChecksFile = z.infer<typeof RepoChecksFileSchema>;
+
+// One repository, as a screen reads it: what it declares, and where that stands with the owner.
+export const RepoChecksSummarySchema = z.object({
+    repo: z.string().describe('Which repository, by its workspace id ("root" is the workspace itself).'),
+    path: z.string().describe("Where the declaration lives, relative to the workspace, whether or not the file exists yet."),
+    checks: z.array(RepoCheckSchema).describe("What it declares, in the order the file lists them."),
+    fired: z
+        .array(z.number().nullable())
+        .describe(
+            "When each declared check last reported something, in the file's order, as epoch milliseconds; null for one that never has, or for a retired one, which runs nothing.",
+        ),
+    adopted: z
+        .boolean()
+        .describe("Whether these are running. False means declared and inert: nothing a repository writes runs until the owner switches it on."),
+    changed: z
+        .boolean()
+        .describe(
+            "Whether the declaration gained or rewrote a check since it was adopted. What changed waits until the owner looks again; the checks the owner already agreed to, word for word, keep running (`held` says which is which). True only for a repository that was adopted before.",
+        ),
+    held: z
+        .array(z.boolean())
+        .optional()
+        .describe(
+            "For a changed declaration, which of its checks wait for the owner, in the file's order: true for one that is new or rewritten since they agreed, false for one still running as agreed, or retired. Absent when nothing changed, and from a sandbox that holds a changed declaration whole.",
+        ),
+    error: z.string().optional().describe("Why the file could not be read, when it exists but does not parse. The checks list is empty in that case."),
+});
+export type RepoChecksSummary = z.infer<typeof RepoChecksSummarySchema>;
+export const RepoChecksListSchema = z.object({
+    repos: z.array(RepoChecksSummarySchema).describe("Every repository that declares checks, in id order."),
+});
+export type RepoChecksList = z.infer<typeof RepoChecksListSchema>;
+export const RepoChecksAdoptSchema = z.object({
+    repo: z.string().min(1).describe("Which repository's declaration to switch."),
+    on: z
+        .boolean()
+        .describe("On adopts what it declares as it stands now; off stops running it. Adopting again is how a changed declaration is accepted."),
+});
+export type RepoChecksAdopt = z.infer<typeof RepoChecksAdoptSchema>;

package/src/schemas/run-targets.ts

@@ -2,25 +2,9 @@ import { STATE_DIR } from "@intentic/constants";
 import { z } from "zod";
 import { ArtifactNameSchema } from "./device-artifacts.js";
 
-// WHAT A REPOSITORY SAYS IT CAN BE RUN AS, ON ONE OF THE OWNER'S COMPUTERS (`<repo>/.intentic/run.json`). Beside the
-// build scripts it names and tracked with them, like `.intentic/checks.json`. One file serves two doors that must do the
-// same thing: an agent's `devices run <target>` in its own shell, and the editor's "Run on <device>" button, which runs
-// that very command in a terminal the owner watches. Each run builds in the sandbox, carries the build to the device
-// (`devices push`), opens the device ports the target says the sandbox needs (`devices reach`), and starts the program
-// there (the device's app_start). Nothing here runs by itself: a target runs when someone runs it.
-//
-//   {
-//     "targets": [{
-//       "name": "desktop",
-//       "device": "rog",
-//       "build": "bash _tools/scripts/desktop/build-desktop.sh 0.0.0 --windows-only",
-//       "artifact": {
-//         "intentic-desktop.exe": "_editor/desktop-app/src-tauri/target/x86_64-pc-windows-msvc/release/intentic-desktop.exe",
-//         "intentic-files.exe": "_editor/desktop-app/src-tauri/binaries/intentic-files-x86_64-pc-windows-msvc.exe"
-//       },
-//       "program": "intentic-desktop.exe"
-//     }]
-//   }
+// <repo>/.intentic/run.json declares tracked targets shared by devices run <target> and the editor's Run on <device> terminal command.
+// Each explicit run builds in the sandbox, pushes artifacts, reaches the declared device ports and starts the program via app_start.
+// Targets name device, build, artifact mappings and program; declaring one never starts it automatically.
 
 export const RUN_TARGETS_FILE = `${STATE_DIR}/run.json`;
 

package/src/schemas/settings.ts

@@ -1,6 +1,4 @@
-// settings: per-sandbox agent settings (.intentic/config/settings.json), plus the checks a repository declares for
-// itself, which those settings adopt.
-import { STATE_DIR } from "@intentic/constants";
+// Per-sandbox agent settings (.intentic/config/settings.json) and the repository checks they adopt.
 import { z } from "zod";
 import { claudeExperimentSettings, iqSearchSettings } from "./settings-experiments.js";
 import { CommandJudgeModeSchema, ProjectInstallModeSchema } from "../policy/safety-policy.js";
@@ -197,11 +195,17 @@ export const SkillIdSchema = z.object({
             "Which skill. It travels in the query rather than the address, because an id can name the owner it came from and that will not fit in a path.",
         ),
 });
+// The trigger line rides every turn's skill list, so it is capped; the form counts against the same number.
+export const SKILL_DESCRIPTION_MAX = 1024;
 // Three fields because a skill is three things: name, when to reach for it, what to do. The daemon assembles
 // frontmatter from the first two, so a saved skill can never be one the loader skips.
 export const SkillDraftSchema = z.object({
     name: SkillNameSchema.describe("What to call it. Saving over an existing name rewrites it, which is also how one is renamed."),
-    description: z.string().min(1).max(1024).describe("What it is for, which is what the agent reads to decide whether to reach for it."),
+    description: z
+        .string()
+        .min(1)
+        .max(SKILL_DESCRIPTION_MAX)
+        .describe("What it is for, which is what the agent reads to decide whether to reach for it."),
     body: z.string().min(1).describe("The skill itself."),
 });
 export type SkillDraft = z.infer<typeof SkillDraftSchema>;
@@ -678,87 +682,4 @@ export type BuiltinPromptText = z.infer<typeof BuiltinPromptTextSchema>;
 // What each token-reduction mechanism saved, and the comparisons that measure the turn-level ones, in a file of their own.
 export * from "./settings-savings.js";
 
-// ---- what a REPOSITORY declares for itself, at `<repo>/.intentic/checks.json` ----
-// Here rather than in a file of its own because the line between these shapes and the settings above is authority, not
-// subject matter: a repository may declare WHAT to run, because the command belongs beside the scripts it names and
-// travels with the checkout; only the sandbox owner decides whether it runs at all (`adoptedChecks` above) and what
-// happens when it fails, and that stays in settings.json. Both halves of that one decision read together here, and the
-// routes that carry them are the settings routes.
-
-// Where a repository declares them, under the same `.intentic/` folder a directory already uses for its own UI. One
-// spelling for the daemon that reads it, the screen that names it and the demo that mimics it.
-export const REPO_CHECKS_FILE = `${STATE_DIR}/checks.json`;
-
-// Named for the occasion as a repository would say it: `edit` is `file.edited` and `turn` is `turn.ending`
-// (rules/repo-checks.ts maps them). `edit` runs on one file (`{file}`) and its output rides back in the edit's own
-// response, so a command declared there is paid per edit and has to take the file. `turn` runs once when an isolated
-// turn is about to stop, on the whole tree, and what it prints when it fails is said back to the model once, which may
-// fix it or say why not. `land` is retired: nothing runs after work lands any more (CI checks what the owner pushes), and
-// a declaration naming it still reads but runs nothing. No check refuses a land, a commit or a push.
-export const RepoCheckMomentSchema = z.enum(["edit", "turn", "land"]);
-export type RepoCheckMoment = z.infer<typeof RepoCheckMomentSchema>;
-
-export const RepoCheckSchema = z.object({
-    when: RepoCheckMomentSchema.describe(
-        "When to run it: `edit` on each file as it is written (`{file}` is its path); `turn` once when an isolated turn is about to stop, for at most three minutes, with what it prints on failure said back to the model once. Neither holds or refuses anything. `land` is retired and runs nothing, since CI checks what is pushed.",
-    ),
-    run: z.string().min(1).max(500).describe("The command, run in this repository's own directory, so it reads as it would in a terminal there."),
-    label: z.string().min(1).max(80).optional().describe("What to call it on screen. Absent names it after the command."),
-    // Same ceiling as a rule's own command; past it the process group is killed and the run is a failure.
-    timeoutMs: z.number().min(60_000).max(3_600_000).optional().describe("How long it may take before it is killed and counted as failed."),
-    // Repo-relative; the daemon prefixes the repo id before matching, since a rule's globs are workspace-relative.
-    paths: z
-        .array(z.string().min(1))
-        .max(20)
-        .optional()
-        .describe("Only run it when the change touches these paths, written relative to this repository. Absent runs it on every change here."),
-});
-export type RepoCheck = z.infer<typeof RepoCheckSchema>;
-
-// The file itself. One key, so a second concern can be added later without breaking a file anyone has written.
-export const RepoChecksFileSchema = z.object({
-    checks: z
-        .array(RepoCheckSchema)
-        .max(10)
-        .default([]),
-});
-export type RepoChecksFile = z.infer<typeof RepoChecksFileSchema>;
-
-// One repository, as a screen reads it: what it declares, and where that stands with the owner.
-export const RepoChecksSummarySchema = z.object({
-    repo: z.string().describe('Which repository, by its workspace id ("root" is the workspace itself).'),
-    path: z.string().describe("Where the declaration lives, relative to the workspace, whether or not the file exists yet."),
-    checks: z.array(RepoCheckSchema).describe("What it declares, in the order the file lists them."),
-    fired: z
-        .array(z.number().nullable())
-        .describe(
-            "When each declared check last reported something, in the file's order, as epoch milliseconds; null for one that never has, or for a retired one, which runs nothing.",
-        ),
-    adopted: z
-        .boolean()
-        .describe("Whether these are running. False means declared and inert: nothing a repository writes runs until the owner switches it on."),
-    changed: z
-        .boolean()
-        .describe(
-            "Whether the declaration gained or rewrote a check since it was adopted. What changed waits until the owner looks again; the checks the owner already agreed to, word for word, keep running (`held` says which is which). True only for a repository that was adopted before.",
-        ),
-    held: z
-        .array(z.boolean())
-        .optional()
-        .describe(
-            "For a changed declaration, which of its checks wait for the owner, in the file's order: true for one that is new or rewritten since they agreed, false for one still running as agreed, or retired. Absent when nothing changed, and from a sandbox that holds a changed declaration whole.",
-        ),
-    error: z.string().optional().describe("Why the file could not be read, when it exists but does not parse. The checks list is empty in that case."),
-});
-export type RepoChecksSummary = z.infer<typeof RepoChecksSummarySchema>;
-export const RepoChecksListSchema = z.object({
-    repos: z.array(RepoChecksSummarySchema).describe("Every repository that declares checks, in id order."),
-});
-export type RepoChecksList = z.infer<typeof RepoChecksListSchema>;
-export const RepoChecksAdoptSchema = z.object({
-    repo: z.string().min(1).describe("Which repository's declaration to switch."),
-    on: z
-        .boolean()
-        .describe("On adopts what it declares as it stands now; off stops running it. Adopting again is how a changed declaration is accepted."),
-});
-export type RepoChecksAdopt = z.infer<typeof RepoChecksAdoptSchema>;
+export * from "./repo-checks.js";

package/src/state/daemon-floor.ts

@@ -1,20 +1,9 @@
 import { compareVersions, DEV_VERSION, parseVersion } from "./versions.js";
 
-// THE OLDEST SANDBOX DAEMON THIS EDITOR SUPPORTS. The hosted editor deploys from every green push to main, and a
-// sandbox runs whatever release it last took, so the editor always talks to daemons older than itself. Above this
-// floor an older daemon is met feature by feature (the route list and shape fingerprints on its /events hello, read by
-// the editor's useDaemonRoutes). Below it the editor draws one page saying the sandbox is too old and offering the
-// update, instead of the faults that page would otherwise be built from.
-//
-// Raise it deliberately, with a dated line below naming what the editor now depends on and the first release that has
-// it (`git tag --contains <sha> | sort -V | head -1`). COMPATIBILITY.md quotes the current value.
-//
-// 2026-10-15: 1.249.0, the first release whose /events stream carries everything the editor reads off it. The hello's
-// route list and its `build`, which opens with the version (1.0.0), the hello's shape fingerprints (1.187.0), and the
-// roster revision on every heartbeat (`rev`, 1.249.0). Against a daemon without `rev`, every heartbeat reads as a
-// missed roster snapshot, so the editor reads GET /agents again every two seconds and logs `fleet.roster-behind`
-// each time. Since 1.249.0 every frame has only gained optional fields and new kinds, which daemon-floor.test.ts
-// holds to.
+// Below this floor, show the update page; above it, use hello route/shape fingerprints to negotiate individual features.
+// Raise deliberately with a dated dependency reason and first supporting release; keep COMPATIBILITY.md aligned.
+// 2026-10-15: 1.249.0 supplies heartbeat roster rev, avoiding a full agents refetch every two seconds on older streams.
+// daemon-floor.test.ts checks that later frames remain additive.
 export const OLDEST_SUPPORTED_DAEMON = `1.249.0`;
 
 // The version a hello's `build` names. The daemon's build id is `<version>:<newest mtime of its compiled tree>`

package/src/text/preview-guide.ts

@@ -1,21 +1,9 @@
 import { z } from "zod";
 
-// What the daemon puts first in a workspace web page it serves for a preview (GET /workspace/preview/{ticket}/*), and
-// what that page may say to the editor framing it. The page runs as it would on a static file server, in a frame
-// sandboxed without `allow-same-origin`, so its origin is opaque: it cannot read the editor, the daemon's API or any
-// storage. This script is what keeps a page written for an ordinary origin working there, and what lets the editor
-// print it, show a Copy button over it, and say which of its files are missing:
-// - `localStorage`, `sessionStorage` and `document.cookie` throw in an opaque origin, and a page that touches them at
-//   load stops dead; each is stood in for by one held in memory for the page's life.
-// - A Vite build whose base is an absolute path preloads chunks from the server's root, outside the ticket; its
-//   `vite:preloadError` is cancelled, so the import itself, which is relative, goes ahead.
-// - `new Worker(url)` refuses any script an opaque origin did not make, which is every one; a worker is started from a
-//   script made here that loads the real one, its own relative imports and fetches resolved against where it lives.
-// - A link to another site opens in a new tab (most refuse to be framed); a link within the page's own files is
-//   followed in the frame, as a browser would.
-// - Every file it loads from beside itself is told, so the editor redraws it when one changes, and every one that
-//   fails, so the editor can name it.
-// - `intenticPrint` is answered with the page as it stands, addresses made absolute and canvases drawn as pictures.
+// Inject into opaque-origin previews: in-memory storage/cookies, cancelled Vite preload errors and worker wrappers keep static pages working.
+// Worker-relative imports/fetches resolve from the real script; external links open tabs and internal links stay framed.
+// Report loaded/missing adjacent files for refresh/error UI; intenticPrint returns current DOM with absolute URLs and rasterized canvases.
+// Keep allow-same-origin off so previews cannot reach editor/daemon storage or APIs.
 export const PREVIEW_GUIDE_SCRIPT = `(() => {
     const say = (message) => parent.postMessage({ intenticHtmlPreview: message }, "*");
     const memory = () => {