@opengeni/config 0.16.4 → 0.19.1-canary.0

package/src/index.ts

@@ -4,12 +4,14 @@ import {
   DEFAULT_FIRST_PARTY_MCP_TOOLS,
   Entitlements,
   EntitlementsMode,
+  KnowledgeSourceSyncLimits,
   LatencyMode,
   MAX_NESTED_AGENT_DEPTH,
   ProductAccessMode,
   ReasoningEffort,
   FIRST_PARTY_MCP_TOOL_NAMES,
   FirstPartyMcpToolName,
+  OpenGeniSlackBotDisplayName,
   SandboxBackend,
   SessionMcpApprovalPolicy,
   SEEDANCE_2_5_MODEL_ID,
@@ -40,6 +42,7 @@ import {
   XAI_SUBSCRIPTION_MODEL_ID_PREFIX,
   XAI_SUBSCRIPTION_PROVIDER_ID,
   XAI_SUBSCRIPTION_PROXY_BASE_URL,
+  XAI_RESPONSE_STREAM_IDLE_TIMEOUT_MS,
 } from "@opengeni/xai-subscription";
 export { XAI_SUBSCRIPTION_MODEL_ID_PREFIX } from "@opengeni/xai-subscription";
 import { createHash } from "node:crypto";
@@ -55,6 +58,8 @@ export const SANDBOX_ARCHIVE_CAPTURE_MAX_TIMEOUT_MS = 60 * 60_000;
 export const SANDBOX_ARCHIVE_CAPTURE_SETTLEMENT_GRACE_MS = 10_000;
 export const SANDBOX_SNAPSHOT_MAX_TIMEOUT_MS =
   SANDBOX_ARCHIVE_CAPTURE_MAX_TIMEOUT_MS - SANDBOX_ARCHIVE_CAPTURE_SETTLEMENT_GRACE_MS;
+export const GOOGLE_DRIVE_PROVIDER_REQUEST_TIMEOUT_MAX_MS = 60_000;
+export const GOOGLE_DRIVE_PROVIDER_RETRY_DELAY_MAX_MS = 60_000;
 // Admission waits are observational: successful capture/teardown returns as
 // soon as the DB fence clears. This ceiling only covers the unhealthy path. It
 // allows one scheduled inventory and one complete successor claim without
@@ -79,6 +84,20 @@ const EnvBoolean = z.preprocess((value) => {
   return value;
 }, z.boolean());
 
+/** Default pacing between consecutive no-input goal continuations. */
+export const DEFAULT_GOAL_IDLE_BACKOFF_MS: readonly number[] = [3_000, 30_000, 120_000, 300_000];
+export const DEFAULT_GOAL_IDLE_BACKOFF_MAX_MS = 600_000;
+
+const EnvGoalIdleBackoffMs = z.preprocess((value) => {
+  if (typeof value !== "string") return value;
+  const source = value.trim();
+  if (!source) return undefined;
+  return source.split(",").map((entry) => {
+    const trimmed = entry.trim();
+    return trimmed === "" ? Number.NaN : Number(trimmed);
+  });
+}, z.array(z.number().int().nonnegative()).min(1, "OPENGENI_GOAL_IDLE_BACKOFF_MS must list at least one delay in milliseconds").readonly());
+
 const EnvFirstPartyMcpTools = z.preprocess(
   (value) => {
     if (typeof value !== "string") return value;
@@ -321,7 +340,7 @@ const SettingsSchema = z.object({
   agentStableVersion: z
     .string()
     .regex(/^(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)$/u)
-    .default("0.1.14"),
+    .default("0.1.16"),
   // Optional independent beta-channel pointer. When unset, the beta update
   // manifest route is unavailable rather than silently serving stable.
   agentBetaVersion: z
@@ -329,6 +348,26 @@ const SettingsSchema = z.object({
     .regex(/^(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)$/u)
     .optional(),
   productAccessMode: ProductAccessMode.default("local"),
+  // --- canonical organization-tenancy authority activation, default OFF ---
+  // The named PRE-ACTIVATION opt-out for the organization-tenancy program. FALSE (the
+  // default, and the value an operator leaves in place to decline or defer) means
+  // this deployment stays on the reversible legacy workspace-owned lane: no phase-F
+  // subsystem may switch its access decision to organization/membership authority
+  // ids. TRUE is an operator's explicit statement that the activation preconditions
+  // in docs/organization-tenancy.md have been proven for this deployment and that
+  // the one-way boundary is accepted.
+  //
+  // This is NOT a kill switch and NOT a rollback: once an activation migration has
+  // committed, setting it back to false does not restore the legacy authority - only
+  // forward recovery is available. It also grants and revokes nothing by itself;
+  // every individual authorization decision keeps its own fences.
+  //
+  // No runtime path reads it yet: canonical activation (phase F) is unshipped, so
+  // the flag exists to reserve the name, pin the safe default, and give every future
+  // activation slice one gate to consult. EnvBoolean (NOT z.coerce.boolean(), which
+  // coerces "false" -> true and would activate the moment an operator wrote the
+  // variable out to disable it).
+  organizationTenancyCanonicalActivationEnabled: EnvBoolean.default(false),
   billingMode: BillingMode.default("disabled"),
   entitlementsMode: EntitlementsMode.default("none"),
   usageLimitsMode: UsageLimitsMode.default("none"),
@@ -347,7 +386,6 @@ const SettingsSchema = z.object({
   // holder of stream:control gets 403 until this flips. Keeps stream:control a
   // declared-but-inert permission so later hardening is a flag flip.
   streamControlEnabled: EnvBoolean.default(false),
-  codemodeMaxCallsPerTurn: z.coerce.number().int().positive().default(200),
   // Optional release-coherent bootstrap hint for custom rigs/connected machines
   // that do not carry the stock-image ogtool binary. Exact stable versions only:
   // the agent must never guess a tag or silently install `latest`.
@@ -360,12 +398,53 @@ const SettingsSchema = z.object({
   integrationsStateSecret: z.string().optional(),
   integrationsAllowPrivateNetworkTargets: EnvBoolean.default(false),
   integrationsOauthClientsJson: z.string().default("{}"),
-  gmailRestAdapterEnabled: EnvBoolean.default(false),
   slackClientId: z.string().optional(),
   slackClientSecret: z.string().optional(),
   slackSigningSecret: z.string().optional(),
+  slackBotDisplayName: OpenGeniSlackBotDisplayName.default("OpenGeni"),
+  slackCommand: z
+    .string()
+    .trim()
+    .regex(/^\/[a-z0-9_-]{1,31}$/u)
+    .default("/opengeni"),
   googleDriveClientId: z.string().optional(),
   googleDriveClientSecret: z.string().optional(),
+  googleDriveSyncMaxItems: z.coerce.number().int().positive().max(10_000).default(500),
+  googleDriveSyncMaxBytes: z.coerce
+    .number()
+    .int()
+    .positive()
+    .max(5_000_000_000)
+    .default(500_000_000),
+  googleDriveSyncMaxFileBytes: z.coerce
+    .number()
+    .int()
+    .positive()
+    .max(5_000_000_000)
+    .default(100_000_000),
+  googleDriveSyncMaxProviderRequests: z.coerce.number().int().positive().max(10_000).default(1_000),
+  googleDriveSyncMaxElapsedSeconds: z.coerce.number().int().positive().max(3_600).default(300),
+  googleDriveSyncMaxFailureDetails: z.coerce.number().int().positive().max(100).default(25),
+  googleDriveProviderRequestTimeoutMs: z.coerce
+    .number()
+    .int()
+    .min(1_000)
+    .max(GOOGLE_DRIVE_PROVIDER_REQUEST_TIMEOUT_MAX_MS)
+    .default(30_000),
+  googleDriveProviderRetryAttempts: z.coerce.number().int().min(1).max(5).default(3),
+  googleDriveProviderRetryInitialDelayMs: z.coerce
+    .number()
+    .int()
+    .positive()
+    .max(30_000)
+    .default(250),
+  googleDriveProviderRetryMaxDelayMs: z.coerce
+    .number()
+    .int()
+    .positive()
+    .max(GOOGLE_DRIVE_PROVIDER_RETRY_DELAY_MAX_MS)
+    .default(5_000),
+  googleDriveProviderRetryBudgetMs: z.coerce.number().int().positive().max(120_000).default(15_000),
   fikenClientId: z.string().optional(),
   fikenClientSecret: z.string().optional(),
   googleDriveWorkspaceEventsEnabled: EnvBoolean.optional(),
@@ -378,24 +457,60 @@ const SettingsSchema = z.object({
   // id ("x", "reddit"): {"x":{"clientId":"...","clientSecret":"..."}}.
   socialOauthClientsJson: z.string().default("{}"),
   // Session goal guard rails. Goals are designed for runs that legitimately
-  // span days, so length is bounded by pathology detection (no-progress
-  // streaks, budget exhaustion), never by count. goalMaxAutoContinuations is
-  // therefore UNSET by default (no cap); deployments may configure one, and
-  // it then acts as a hard ceiling that per-goal overrides can only lower.
+  // span days, so length is bounded by explicit completion/pause and budget
+  // exhaustion, never by count. goalMaxAutoContinuations is therefore UNSET
+  // by default (no cap); deployments may configure one, and it then acts as a
+  // hard ceiling that per-goal overrides can only lower.
   goalMaxAutoContinuations: z.coerce.number().int().positive().optional(),
-  goalNoProgressLimit: z.coerce.number().int().positive().default(3),
+  // Idle backoff between CONSECUTIVE no-input goal continuations. This is
+  // pacing, not a cap: the first continuation after a turn that consumed any
+  // external input is immediate, the n-th consecutive no-input continuation
+  // waits schedule[min(n - 1, last)] ms after the previous one finished, and
+  // any new input (machine input, human/API prompt, Steer) wakes the session
+  // immediately. The delay never exceeds goalIdleBackoffMaxMs.
+  goalIdleBackoffMs: EnvGoalIdleBackoffMs.default(DEFAULT_GOAL_IDLE_BACKOFF_MS),
+  goalIdleBackoffMaxMs: z.coerce
+    .number()
+    .int()
+    .positive()
+    .default(DEFAULT_GOAL_IDLE_BACKOFF_MAX_MS),
+  // Child lifecycle notices: a child session's requires_action freeze, its
+  // resolution, a direct Pause, a provider-capacity wait, and goal progress
+  // become typed `session_system_updates` rows for the parent (in addition to
+  // `child_terminal_result`). Rolling hazard: a pre-notice worker throws on an
+  // unknown update kind, so enable only once the whole fleet runs an image
+  // that understands the new kinds. Once the flag has produced rows, a
+  // pre-notice image must never restart while any new-kind row is still
+  // pending (session_system_updates or session_system_update_outbox); turning
+  // the flag back off stops production but does not drain already committed
+  // rows. Default off. The API and both workers install the validated value
+  // into @opengeni/db once at boot.
+  // Env: OPENGENI_CHILD_LIFECYCLE_NOTICES_ENABLED.
+  childLifecycleNoticesEnabled: EnvBoolean.default(false),
+  // Per-channel and per-DM Slack workspace routing. Default ON. A channel does
+  // not count a personal workspace as a candidate, so an organization with one
+  // shared workspace resolves it as the sole candidate and never asks; the
+  // visible change is confined to organizations that genuinely have more than
+  // one - plus one case worth knowing before an upgrade: a person who has lost
+  // live authority now receives a posted refusal where the pre-routing code
+  // failed silently. Set the env var to `false` to restore the short-circuit
+  // to the installation's own workspace.
+  // Env: OPENGENI_SLACK_WORKSPACE_ROUTING_ENABLED.
+  slackWorkspaceRoutingEnabled: EnvBoolean.default(true),
   // Per-segment ceiling on agent loop turns (model calls) within a single
   // session turn. Effectively unbounded by default for the same reason as
   // above; the graceful max-turns valve (idle + goal continuation, never a
   // session failure) remains as inert safety should a deployment set a cap.
   agentMaxModelCallsPerTurn: z.coerce.number().int().positive().default(1_000_000),
-  // The model family's real context window in tokens. OpenGeni always performs
-  // one durable, portable plaintext compaction transition; there is no
-  // provider/server/off mode ladder.
+  // Deployment fallback for models that do not declare their own window.
+  // Built-in billed GPT-5.6 Sol/Terra/Luna pin Codex's 272k catalog instead.
+  // OpenGeni always performs one durable, portable plaintext compaction
+  // transition; there is no provider/server/off mode ladder.
   contextWindowTokens: z.coerce.number().int().positive().default(1_050_000),
-  // Optional model-catalog effective input ceiling. Codex models expose this as
-  // raw context_window * effective_context_window_percent; when absent, retain
-  // the deployment-level window-minus-reserved-output behavior.
+  // Optional model-catalog effective input ceiling. Codex and billed GPT-5.6
+  // models expose this as raw context_window * effective_context_window_percent;
+  // when absent, retain the deployment-level window-minus-reserved-output
+  // behavior.
   contextEffectiveWindowTokens: z.coerce.number().int().positive().optional(),
   // Proactive compaction threshold as a ratio of the model context window.
   // Defaults to 90%: compact as late as possible — retained context beats early
@@ -430,6 +545,10 @@ const SettingsSchema = z.object({
   apiHost: z.string().default("0.0.0.0"),
   apiPort: z.coerce.number().int().positive().default(8000),
   workerHttpPort: z.coerce.number().int().positive().default(8001),
+  // Worker-side first-party MCP traffic stays on the deployment's internal
+  // network. OPENGENI_MCP_URL remains the sandbox/external route used by
+  // Codemode and remote placements.
+  opengeniMcpInternalUrl: z.string().url().optional(),
   opengeniMcpUrl: z.string().url().optional(),
   // Origins allowed to send browser cookies cross-origin. Other origins may
   // call the public API with bearer credentials, but never receive credentialed
@@ -564,18 +683,27 @@ const SettingsSchema = z.object({
   // SuperGrok/xAI connected subscription. This is a workspace-scoped OAuth
   // account pool and a distinct rail from the existing xai/* API-key provider.
   supergrokSubscriptionEnabled: EnvBoolean.default(false), // OPENGENI_SUPERGROK_SUBSCRIPTION_ENABLED
+  // Maximum silence between complete, valid SuperGrok SSE data events. This is
+  // not a request/run duration cap; every valid event resets the timer.
+  supergrokResponseStreamIdleTimeoutMs: z.coerce
+    .number()
+    .int()
+    .positive()
+    .max(24 * 60 * 60_000)
+    .default(XAI_RESPONSE_STREAM_IDLE_TIMEOUT_MS),
   // Expose the connected apps attached to a Codex subscription through the
   // synthetic codex_apps MCP server. Independent from subscription routing so
   // operators can use Codex models without exposing ChatGPT connectors.
   codexConnectedAppsEnabled: EnvBoolean.default(false), // OPENGENI_CODEX_CONNECTED_APPS_ENABLED
   codexProductSku: z.string().optional(), // OPENGENI_CODEX_PRODUCT_SKU (X-OpenAI-Product-Sku, apps only)
   // Progressive MCP disclosure (Codex-CLI-style tool_search): on a codex turn,
-  // flag non-mandatory selected MCP tools `defer_loading:true` (dropping their
+  // flag non-eager selected MCP tools `defer_loading:true` (dropping their
   // schemas from model context) and add one client-executed tool_search tool
-  // that BM25-discloses bounded matches. The mandatory OpenGeni tools stay
-  // eager. Default ON so selected connector catalogues do not consume every
-  // Codex turn's context. Operators may explicitly disable it for emergency
-  // compatibility diagnosis.
+  // that BM25-discloses bounded matches. Only an exact session tool ref with
+  // `eager:true` stays on the startup path; mandatory selection alone does not
+  // imply eagerness. Default ON so selected connector catalogues do not consume
+  // every Codex turn's context. Operators may explicitly disable it for
+  // emergency compatibility diagnosis.
   // OPENGENI_CODEX_TOOL_SEARCH_ENABLED
   codexToolSearchEnabled: EnvBoolean.default(true),
   // Provider-neutral progressive disclosure for direct OpenAI/Azure native
@@ -814,6 +942,39 @@ const SettingsSchema = z.object({
   vercelProjectId: z.string().optional(),
   vercelTeamId: z.string().optional(),
   vercelRuntime: z.string().optional(),
+  // --- OpenSandbox (optional Kubernetes-native provisioned sandbox) ---
+  openSandboxBaseUrl: z.string().url().optional(),
+  openSandboxApiKey: z.string().min(1).optional(),
+  // Release and preview profiles must provide an immutable OCI digest. The
+  // adapter refuses tag-only references when this backend is active.
+  openSandboxImage: z.string().min(1).optional(),
+  // Renewable provider TTL is a leak/backstop clock, not OpenGeni's idle
+  // policy. The pinned server accepts a one-minute minimum; ordinary
+  // deployments default to one hour.
+  openSandboxTtlSeconds: z.coerce.number().int().min(60).max(86_400).default(3_600),
+  openSandboxUseServerProxy: EnvBoolean.default(true),
+  // Channel B (browserd / noVNC / ttyd) uses OSEP-0011 signed URI-mode ingress.
+  // Exec/files stay on the private lifecycle server-proxy regardless of this flag.
+  openSandboxSignedEndpoints: EnvBoolean.default(false),
+  openSandboxSignedEndpointTtlSeconds: z.coerce.number().int().min(60).max(3_600).default(600),
+  openSandboxChannelBPublicBaseUrl: z.string().url().optional(),
+  // Emergency hatch only: force JPEG/RFB through the API frame-proxy even when
+  // signed endpoints are on (M2 subprotocol failure). Unset means OpenSandbox
+  // uses the frame-proxy unless signed endpoints are on.
+  openSandboxInteractionFrameProxy: EnvBoolean.optional(),
+  openSandboxPoolRef: z
+    .string()
+    .regex(/^[A-Za-z0-9](?:[A-Za-z0-9._-]*[A-Za-z0-9])?$/)
+    .optional(),
+  // Optional same-cluster, read-only observability projection. The application
+  // chart sets this only on the control worker and mounts a dedicated projected
+  // service-account token; non-Kubernetes and remote-provider deployments omit it.
+  openSandboxKubernetesInventoryNamespace: z
+    .string()
+    .min(1)
+    .max(63)
+    .regex(/^[a-z0-9](?:[-a-z0-9]*[a-z0-9])?$/)
+    .optional(),
   // --- sandbox ownership inversion (P1.2 rollout flag, default OFF) ---
   // The keystone flag for the stateless resume-by-id model. When FALSE the
   // agent-turn path is BYTE-FOR-BYTE today's build-and-discard behavior (no
@@ -858,7 +1019,7 @@ const SettingsSchema = z.object({
   // runner must ALSO advertise Capabilities.op_stream. Streaming is the default
   // because it is the only transport that can keep a command alive without an
   // arbitrary request/reply wall while still supporting replay and cancellation.
-  // Older runners remain usable when an explicit positive exec timeout is set.
+  // Exec fails closed when the deployment or runner does not provide op-stream.
   // EnvBoolean (NOT
   // z.coerce.boolean(), which coerces "false" -> true).
   agentOpStreamEnabled: EnvBoolean.default(true),
@@ -890,9 +1051,10 @@ const SettingsSchema = z.object({
   // nats-server is configured with AUTH CALLOUT: an external agent connects
   // presenting its `oge_` enrollment bearer as the connect auth-token; the server
   // issues an authorization request on $SYS.REQ.USER.AUTH to our responder, which
-  // validates the bearer and returns a SIGNED NATS user JWT scoped to pub/sub ONLY
-  // `agent.<ws>.>` (+ `_INBOX.>`). That per-subject scope IS the per-workspace
-  // isolation. These are deployment-level secrets in the opengeni-runtime secret
+  // validates the bearer, claims one daemon generation, and returns a SIGNED NATS
+  // user JWT scoped to that exact process subtree (+ `_INBOX.>`). The exact scope
+  // provides both workspace isolation and single-daemon routing authority. These
+  // are deployment-level secrets in the opengeni-runtime secret
   // (Helm-clobbered configmap avoided), all OPTIONAL: when the callout plane is not
   // configured the responder simply does not start (selfhosted agents cannot
   // connect — graceful, never a boot-fail).
@@ -904,7 +1066,7 @@ const SettingsSchema = z.object({
   // The TARGET ACCOUNT NAME the minted user is placed into (the server-config-mode
   // `auth_callout.account`, e.g. "APP"). The responder writes it as the minted user
   // JWT `aud` so nats-server binds the agent to this account — the SAME account the
-  // privileged control plane connects into, so `agent.<ws>.<id>.rpc` request/reply
+  // privileged control plane connects into, so exact process request/reply
   // routes. Optional; resolveNatsCalloutConfig defaults it to "APP".
   selfhostedNatsCalloutAccountName: z.string().optional(),
   // The callout RESPONDER's own NATS login (one of the `auth_callout.auth_users`
@@ -913,7 +1075,7 @@ const SettingsSchema = z.object({
   selfhostedNatsCalloutUser: z.string().optional(),
   selfhostedNatsCalloutPassword: z.string().optional(),
   // The PRIVILEGED control-plane login (api/worker): a static account user that may
-  // request `agent.*.rpc` + receive its inbox replies. The event bus + the
+  // request exact process RPC subjects + receive their inbox replies. The event bus + the
   // selfhosted control RPC ride THIS connection. Username/password; when unset the
   // bus connects anonymously (local dev / a NATS with no auth_callout).
   selfhostedNatsControlUser: z.string().optional(),
@@ -997,6 +1159,21 @@ const SettingsSchema = z.object({
   // (a liveness/reaper cadence), this bounds how long one turn waits for capacity
   // or provider creation before surfacing a clear turn.failed error.
   sandboxWarmingTimeoutMs: z.coerce.number().int().positive().default(600_000),
+  // Request-scoped workspace control-prefix budget: how long one HTTP-originated
+  // session/workspace mutation (Send, Steer, Pause/Resume/Cancel, queue
+  // move/edit/delete, composer draft, settings narrowing, quiescent tree
+  // deletion) may wait to enter the fair `workspace_inference_controls` prefix
+  // before failing with the retryable 503 `WORKSPACE_CONTROL_BUSY`. Worker
+  // settlement and claims never use it. The API installs the validated value
+  // into @opengeni/db once at app construction; nothing reads the env per
+  // request. Env: OPENGENI_WORKSPACE_CONTROL_LOCK_TIMEOUT_MS. Default 20 s.
+  workspaceControlLockTimeoutMs: z.coerce
+    .number({
+      message: "OPENGENI_WORKSPACE_CONTROL_LOCK_TIMEOUT_MS must be a positive integer (ms)",
+    })
+    .int("OPENGENI_WORKSPACE_CONTROL_LOCK_TIMEOUT_MS must be a positive integer (ms)")
+    .positive("OPENGENI_WORKSPACE_CONTROL_LOCK_TIMEOUT_MS must be a positive integer (ms)")
+    .default(20_000),
   // Rig setup-script budget (M3): the wall-clock timeout the rig-setup lifecycle
   // hook runs its script under, distinct from the 120s per-command lifecycle
   // default (a rig may compile/install heavy tooling on first cold create).
@@ -1056,6 +1233,11 @@ const SettingsSchema = z.object({
   githubAppId: z.string().optional(),
   githubClientId: z.string().optional(),
   githubClientSecret: z.string().optional(),
+  /** Default-off rollout for the in-process GitHub repository API tool surface. */
+  githubRestMcpEnabled: EnvBoolean.default(false),
+  githubPersonalOauthEnabled: EnvBoolean.default(false),
+  githubPersonalOauthClientId: z.string().optional(),
+  githubPersonalOauthClientSecret: z.string().optional(),
   githubAppSlug: z.string().optional(),
   githubWebhookSecret: z.string().optional(),
   githubAppPrivateKey: z.string().optional(),
@@ -1096,6 +1278,76 @@ const SettingsSchema = z.object({
 export type Settings = z.infer<typeof SettingsSchema>;
 export type McpServerConfig = Settings["mcpServers"][number];
 
+export type GoogleDriveProviderRetryOptions = {
+  requestTimeoutMs: number;
+  attempts: number;
+  initialDelayMs: number;
+  maxDelayMs: number;
+  budgetMs: number;
+};
+
+/** Freeze one validated provider-neutral budget into every newly created or
+ * updated Google Drive knowledge-source schedule. Existing schedules retain
+ * their persisted limits until an authorized source save updates them. */
+export function configuredGoogleDriveSyncLimits(settings: Settings) {
+  return KnowledgeSourceSyncLimits.parse({
+    maxItems: settings.googleDriveSyncMaxItems,
+    maxBytes: settings.googleDriveSyncMaxBytes,
+    maxFileBytes: settings.googleDriveSyncMaxFileBytes,
+    maxProviderRequests: settings.googleDriveSyncMaxProviderRequests,
+    maxElapsedSeconds: settings.googleDriveSyncMaxElapsedSeconds,
+    maxFailureDetails: settings.googleDriveSyncMaxFailureDetails,
+  });
+}
+
+/** Bounded in-activity retry policy for individual Google Drive requests. The
+ * durable sync workflow remains authoritative after this local budget ends. */
+export function googleDriveProviderRetryOptions(
+  settings: Settings,
+): GoogleDriveProviderRetryOptions {
+  return {
+    requestTimeoutMs: settings.googleDriveProviderRequestTimeoutMs,
+    attempts: settings.googleDriveProviderRetryAttempts,
+    initialDelayMs: settings.googleDriveProviderRetryInitialDelayMs,
+    maxDelayMs: settings.googleDriveProviderRetryMaxDelayMs,
+    budgetMs: settings.googleDriveProviderRetryBudgetMs,
+  };
+}
+
+/** Return only a credential-free HTTP(S) origin. Reject path, user-info, query,
+ * and fragment input instead of reflecting it into callbacks or evidence. */
+export function canonicalPublicOrigin(publicBaseUrl: string | undefined): string | null {
+  if (!publicBaseUrl) return null;
+  let parsed: URL;
+  try {
+    parsed = new URL(publicBaseUrl);
+  } catch {
+    return null;
+  }
+  if (
+    !["http:", "https:"].includes(parsed.protocol) ||
+    parsed.username ||
+    parsed.password ||
+    parsed.search ||
+    parsed.hash ||
+    (parsed.pathname !== "" && parsed.pathname !== "/")
+  ) {
+    return null;
+  }
+  return parsed.origin;
+}
+
+export function googleDriveOAuthCallbackUrl(publicBaseUrl: string | undefined): string | null {
+  const origin = canonicalPublicOrigin(publicBaseUrl);
+  return origin ? `${origin}/v1/integrations/google-drive/callback` : null;
+}
+
+/** Exact callback registered on the environment-specific personal GitHub OAuth App. */
+export function personalGitHubOAuthCallbackUrl(publicBaseUrl: string | undefined): string | null {
+  const origin = canonicalPublicOrigin(publicBaseUrl);
+  return origin ? `${origin}/v1/integrations/github-personal/oauth/callback` : null;
+}
+
 /** Declarative voice-input transcription provider ids. */
 export type VoiceInputProviderId =
   | "openai"
@@ -1489,7 +1741,7 @@ export type ModelExecutionLimitsV1 = {
 };
 
 export type CredentialSourceV1 =
-  | { kind: "deployment"; mechanism: "api_key" | "azure_ad_bearer" }
+  | { kind: "deployment"; mechanism: "api_key" | "azure_ad_bearer" | "none" }
   | { kind: "connected_subscription"; provider: "codex" | "xai" }
   | { kind: "workspace_connection"; mechanism: "api_key" };
 
@@ -1508,13 +1760,23 @@ export type BillingAttributionV1 = {
 export const ModelProviderApi = z.enum(["responses", "chat"]);
 export type ModelProviderApi = z.infer<typeof ModelProviderApi>;
 
+/**
+ * Provider-specific request semantics that are independent of the endpoint's
+ * OpenAI-compatible wire API. Secondary Azure resources still speak the
+ * Responses API, but need Azure's stricter computer-call normalization.
+ */
+export const ModelProviderWireProfile = z.enum(["openai", "azure-openai"]);
+export type ModelProviderWireProfile = z.infer<typeof ModelProviderWireProfile>;
+
 /**
  * Registry provider kind. "api-key" providers carry their own static key/headers;
- * connected-subscription providers resolve a workspace account token at call
- * time and never carry a static key in the registry definition.
+ * "anonymous" providers intentionally send no credential and are externally
+ * metered; connected-subscription providers resolve a workspace account token
+ * at call time and never carry a static key in the registry definition.
  */
 export const RegistryProviderKind = z.enum([
   "api-key",
+  "anonymous",
   "codex-subscription",
   "xai-subscription",
   "vercel-gateway-managed",
@@ -1572,24 +1834,73 @@ const RegistryModelSchema = z
   });
 
 /** A non-built-in provider declared by the host via OPENGENI_MODEL_PROVIDERS_JSON. */
-const RegistryProviderSchema = z.object({
-  kind: RegistryProviderKind.default("api-key"),
-  id: z.string().min(1).regex(registryId), // stable provider id, e.g. "fireworks"
-  label: z.string().min(1).optional(),
-  api: ModelProviderApi.default("chat"),
-  baseUrl: z.string().url(),
-  apiKey: z.string().optional(), // inline key (pragmatic) ...
-  apiKeyEnv: z.string().optional(), // ... OR name of the env var holding the key (preferred)
-  defaultQuery: z.record(z.string(), z.string()).optional(),
-  defaultHeaders: z.record(z.string(), z.string()).optional(),
-  publicDefaultQueryNames: z.array(z.string().min(1)).optional(),
-  publicDefaultHeaderNames: z.array(z.string().min(1)).optional(),
-  // V1 derives these from provider kind. Workspace BYOK is deliberately not a
-  // registry switch and requires a separately reviewed encrypted broker.
-  credentialSource: z.never().optional(),
-  billing: z.never().optional(),
-  models: z.array(RegistryModelSchema).min(1),
-});
+const RegistryProviderSchema = z
+  .object({
+    kind: RegistryProviderKind.default("api-key"),
+    id: z.string().min(1).regex(registryId), // stable provider id, e.g. "fireworks"
+    label: z.string().min(1).optional(),
+    api: ModelProviderApi.default("chat"),
+    wireProfile: ModelProviderWireProfile.default("openai"),
+    baseUrl: z.string().url(),
+    apiKey: z.string().optional(), // inline key (pragmatic) ...
+    apiKeyEnv: z.string().optional(), // ... OR name of the env var holding the key (preferred)
+    defaultQuery: z.record(z.string(), z.string()).optional(),
+    defaultHeaders: z.record(z.string(), z.string()).optional(),
+    publicDefaultQueryNames: z.array(z.string().min(1)).optional(),
+    publicDefaultHeaderNames: z.array(z.string().min(1)).optional(),
+    // V1 derives these from provider kind. Workspace BYOK is deliberately not a
+    // registry switch and requires a separately reviewed encrypted broker.
+    credentialSource: z.never().optional(),
+    billing: z.never().optional(),
+    models: z.array(RegistryModelSchema).min(1),
+  })
+  .superRefine((provider, ctx) => {
+    if (provider.kind !== "anonymous") {
+      return;
+    }
+    if (provider.apiKey !== undefined) {
+      ctx.addIssue({
+        code: "custom",
+        path: ["apiKey"],
+        message: "anonymous providers must not declare apiKey",
+      });
+    }
+    if (provider.apiKeyEnv !== undefined) {
+      ctx.addIssue({
+        code: "custom",
+        path: ["apiKeyEnv"],
+        message: "anonymous providers must not declare apiKeyEnv",
+      });
+    }
+    if (provider.defaultHeaders !== undefined) {
+      ctx.addIssue({
+        code: "custom",
+        path: ["defaultHeaders"],
+        message: "anonymous providers must not declare defaultHeaders",
+      });
+    }
+    if (provider.defaultQuery !== undefined) {
+      ctx.addIssue({
+        code: "custom",
+        path: ["defaultQuery"],
+        message: "anonymous providers must not declare defaultQuery",
+      });
+    }
+    if (provider.publicDefaultHeaderNames !== undefined) {
+      ctx.addIssue({
+        code: "custom",
+        path: ["publicDefaultHeaderNames"],
+        message: "anonymous providers must not declare publicDefaultHeaderNames",
+      });
+    }
+    if (provider.publicDefaultQueryNames !== undefined) {
+      ctx.addIssue({
+        code: "custom",
+        path: ["publicDefaultQueryNames"],
+        message: "anonymous providers must not declare publicDefaultQueryNames",
+      });
+    }
+  });
 export type RegistryProvider = z.infer<typeof RegistryProviderSchema>;
 
 export const IntegrationOAuthClientConfigSchema = z.object({
@@ -1611,8 +1922,9 @@ export type IntegrationOAuthClientConfig = z.infer<typeof IntegrationOAuthClient
 export interface ResolvedModelProvider {
   id: string; // "openai" | "azure" | registry id
   label: string;
-  kind: RegistryProviderKind; // "api-key" (built-ins + most registry) | "codex-subscription"
+  kind: RegistryProviderKind; // "api-key" (built-ins + most registry) | "anonymous" | subscription
   api: ModelProviderApi;
+  wireProfile: ModelProviderWireProfile;
   builtin: boolean;
   baseUrl?: string | undefined;
   apiKey?: string | undefined;
@@ -1883,6 +2195,11 @@ export const SANDBOX_REQUIRED_ENV: Record<
     { field: "vercelToken", env: "OPENGENI_VERCEL_TOKEN" },
     { field: "vercelProjectId", env: "OPENGENI_VERCEL_PROJECT_ID" },
   ],
+  opensandbox: [
+    { field: "openSandboxBaseUrl", env: "OPENGENI_OPENSANDBOX_BASE_URL" },
+    { field: "openSandboxApiKey", env: "OPENGENI_OPENSANDBOX_API_KEY" },
+    { field: "openSandboxImage", env: "OPENGENI_OPENSANDBOX_IMAGE" },
+  ],
   // selfhosted needs NO per-box credentials: it is the user's own machine reached
   // over the agent's own enrollment. The enrollment-signing + relay-token secrets
   // are deployment-level (a single runtime secret, not per-active-backend creds),
@@ -1895,6 +2212,34 @@ export function requiredSandboxEnvForBackend(backend: z.infer<typeof SandboxBack
   return (SANDBOX_REQUIRED_ENV[backend] ?? []).map((entry) => entry.env);
 }
 
+function objectStorageConfiguredForWorkspaceArchives(settings: Settings): boolean {
+  switch (settings.objectStorageBackend) {
+    case "azure-blob":
+      return Boolean(
+        settings.objectStorageAzureConnectionString ||
+        (settings.objectStorageAzureAccountName && settings.objectStorageAzureAccountKey),
+      );
+    case "gcs":
+      return Boolean(
+        settings.objectStorageGcsCredentialsJson ||
+        settings.objectStorageGcsKeyFilename ||
+        settings.objectStorageGcsProjectId,
+      );
+    case "aws-s3":
+      return true;
+    case "s3-compatible":
+      return Boolean(
+        settings.objectStorageEndpoint &&
+        settings.objectStorageAccessKeyId &&
+        settings.objectStorageSecretAccessKey,
+      );
+    default: {
+      const _exhaustive: never = settings.objectStorageBackend;
+      return _exhaustive;
+    }
+  }
+}
+
 function optional(name: string): string | undefined {
   const value = process.env[name];
   return value && value.trim().length > 0 ? value : undefined;
@@ -1955,6 +2300,9 @@ export function getSettings(): Settings {
     agentStableVersion: optional("OPENGENI_AGENT_STABLE_VERSION"),
     agentBetaVersion: optional("OPENGENI_AGENT_BETA_VERSION"),
     productAccessMode: optional("OPENGENI_PRODUCT_ACCESS_MODE"),
+    organizationTenancyCanonicalActivationEnabled: optional(
+      "OPENGENI_ORGANIZATION_TENANCY_CANONICAL_ACTIVATION_ENABLED",
+    ),
     billingMode: optional("OPENGENI_BILLING_MODE"),
     entitlementsMode: optional("OPENGENI_ENTITLEMENTS_MODE"),
     usageLimitsMode: optional("OPENGENI_USAGE_LIMITS_MODE"),
@@ -1965,7 +2313,6 @@ export function getSettings(): Settings {
     allowedFirstPartyMcpTools: optional("OPENGENI_ALLOWED_FIRST_PARTY_MCP_TOOLS"),
     streamTokenSecret: optional("OPENGENI_STREAM_TOKEN_SECRET"),
     streamControlEnabled: optional("OPENGENI_STREAM_CONTROL_ENABLED"),
-    codemodeMaxCallsPerTurn: optional("OPENGENI_CODEMODE_MAX_CALLS_PER_TURN"),
     ogtoolPackageSpec: optional("OPENGENI_OGTOOL_PACKAGE_SPEC"),
     environmentsEncryptionKey: optional("OPENGENI_ENVIRONMENTS_ENCRYPTION_KEY"),
     integrationsEnabled: optional("OPENGENI_INTEGRATIONS_ENABLED"),
@@ -1974,12 +2321,32 @@ export function getSettings(): Settings {
       "OPENGENI_INTEGRATIONS_ALLOW_PRIVATE_NETWORK_TARGETS",
     ),
     integrationsOauthClientsJson: optional("OPENGENI_INTEGRATIONS_OAUTH_CLIENTS_JSON"),
-    gmailRestAdapterEnabled: optional("OPENGENI_GMAIL_REST_ADAPTER_ENABLED"),
     slackClientId: optional("OPENGENI_SLACK_CLIENT_ID"),
     slackClientSecret: optional("OPENGENI_SLACK_CLIENT_SECRET"),
     slackSigningSecret: optional("OPENGENI_SLACK_SIGNING_SECRET"),
+    slackBotDisplayName: optional("OPENGENI_SLACK_BOT_DISPLAY_NAME"),
+    slackCommand: optional("OPENGENI_SLACK_COMMAND"),
     googleDriveClientId: optional("OPENGENI_GOOGLE_DRIVE_CLIENT_ID"),
     googleDriveClientSecret: optional("OPENGENI_GOOGLE_DRIVE_CLIENT_SECRET"),
+    googleDriveSyncMaxItems: optional("OPENGENI_GOOGLE_DRIVE_SYNC_MAX_ITEMS"),
+    googleDriveSyncMaxBytes: optional("OPENGENI_GOOGLE_DRIVE_SYNC_MAX_BYTES"),
+    googleDriveSyncMaxFileBytes: optional("OPENGENI_GOOGLE_DRIVE_SYNC_MAX_FILE_BYTES"),
+    googleDriveSyncMaxProviderRequests: optional(
+      "OPENGENI_GOOGLE_DRIVE_SYNC_MAX_PROVIDER_REQUESTS",
+    ),
+    googleDriveSyncMaxElapsedSeconds: optional("OPENGENI_GOOGLE_DRIVE_SYNC_MAX_ELAPSED_SECONDS"),
+    googleDriveSyncMaxFailureDetails: optional("OPENGENI_GOOGLE_DRIVE_SYNC_MAX_FAILURE_DETAILS"),
+    googleDriveProviderRequestTimeoutMs: optional(
+      "OPENGENI_GOOGLE_DRIVE_PROVIDER_REQUEST_TIMEOUT_MS",
+    ),
+    googleDriveProviderRetryAttempts: optional("OPENGENI_GOOGLE_DRIVE_PROVIDER_RETRY_ATTEMPTS"),
+    googleDriveProviderRetryInitialDelayMs: optional(
+      "OPENGENI_GOOGLE_DRIVE_PROVIDER_RETRY_INITIAL_DELAY_MS",
+    ),
+    googleDriveProviderRetryMaxDelayMs: optional(
+      "OPENGENI_GOOGLE_DRIVE_PROVIDER_RETRY_MAX_DELAY_MS",
+    ),
+    googleDriveProviderRetryBudgetMs: optional("OPENGENI_GOOGLE_DRIVE_PROVIDER_RETRY_BUDGET_MS"),
     fikenClientId: optional("OPENGENI_FIKEN_OAUTH_CLIENT_ID"),
     fikenClientSecret: optional("OPENGENI_FIKEN_OAUTH_CLIENT_SECRET"),
     googleDriveWorkspaceEventsEnabled: optional("OPENGENI_GOOGLE_DRIVE_WORKSPACE_EVENTS_ENABLED"),
@@ -1988,7 +2355,10 @@ export function getSettings(): Settings {
     maxNestedAgentDepth: optional("OPENGENI_MAX_NESTED_AGENT_DEPTH"),
     socialOauthClientsJson: optional("OPENGENI_SOCIAL_OAUTH_CLIENTS_JSON"),
     goalMaxAutoContinuations: optional("OPENGENI_GOAL_MAX_AUTO_CONTINUATIONS"),
-    goalNoProgressLimit: optional("OPENGENI_GOAL_NO_PROGRESS_LIMIT"),
+    goalIdleBackoffMs: optional("OPENGENI_GOAL_IDLE_BACKOFF_MS"),
+    goalIdleBackoffMaxMs: optional("OPENGENI_GOAL_IDLE_BACKOFF_MAX_MS"),
+    childLifecycleNoticesEnabled: optional("OPENGENI_CHILD_LIFECYCLE_NOTICES_ENABLED"),
+    slackWorkspaceRoutingEnabled: optional("OPENGENI_SLACK_WORKSPACE_ROUTING_ENABLED"),
     agentMaxModelCallsPerTurn: optional("OPENGENI_AGENT_MAX_MODEL_CALLS_PER_TURN"),
     contextWindowTokens: optional("OPENGENI_CONTEXT_WINDOW_TOKENS"),
     contextEffectiveWindowTokens: optional("OPENGENI_CONTEXT_EFFECTIVE_WINDOW_TOKENS"),
@@ -2003,6 +2373,7 @@ export function getSettings(): Settings {
     apiHost: optional("OPENGENI_API_HOST"),
     apiPort: optional("OPENGENI_API_PORT"),
     workerHttpPort: optional("OPENGENI_WORKER_HTTP_PORT"),
+    opengeniMcpInternalUrl: optional("OPENGENI_MCP_INTERNAL_URL"),
     opengeniMcpUrl: optional("OPENGENI_MCP_URL"),
     corsAllowOriginRegex: optional("OPENGENI_CORS_ALLOW_ORIGIN_REGEX"),
     openaiProvider: optional("OPENGENI_OPENAI_PROVIDER"),
@@ -2059,6 +2430,9 @@ export function getSettings(): Settings {
     modelProvidersJson: optional("OPENGENI_MODEL_PROVIDERS_JSON"),
     codexSubscriptionEnabled: optional("OPENGENI_CODEX_SUBSCRIPTION_ENABLED"),
     supergrokSubscriptionEnabled: optional("OPENGENI_SUPERGROK_SUBSCRIPTION_ENABLED"),
+    supergrokResponseStreamIdleTimeoutMs: optional(
+      "OPENGENI_SUPERGROK_RESPONSE_STREAM_IDLE_TIMEOUT_MS",
+    ),
     codexConnectedAppsEnabled: optional("OPENGENI_CODEX_CONNECTED_APPS_ENABLED"),
     codexToolSearchEnabled: optional("OPENGENI_CODEX_TOOL_SEARCH_ENABLED"),
     lazyToolSearchEnabled: optional("OPENGENI_LAZY_TOOL_SEARCH_ENABLED"),
@@ -2148,6 +2522,21 @@ export function getSettings(): Settings {
     vercelProjectId: optional("OPENGENI_VERCEL_PROJECT_ID"),
     vercelTeamId: optional("OPENGENI_VERCEL_TEAM_ID"),
     vercelRuntime: optional("OPENGENI_VERCEL_RUNTIME"),
+    openSandboxBaseUrl: optional("OPENGENI_OPENSANDBOX_BASE_URL"),
+    openSandboxApiKey: optional("OPENGENI_OPENSANDBOX_API_KEY"),
+    openSandboxImage: optional("OPENGENI_OPENSANDBOX_IMAGE"),
+    openSandboxTtlSeconds: optional("OPENGENI_OPENSANDBOX_TTL_SECONDS"),
+    openSandboxUseServerProxy: optional("OPENGENI_OPENSANDBOX_USE_SERVER_PROXY"),
+    openSandboxSignedEndpoints: optional("OPENGENI_OPENSANDBOX_SIGNED_ENDPOINTS"),
+    openSandboxSignedEndpointTtlSeconds: optional(
+      "OPENGENI_OPENSANDBOX_SIGNED_ENDPOINT_TTL_SECONDS",
+    ),
+    openSandboxChannelBPublicBaseUrl: optional("OPENGENI_OPENSANDBOX_CHANNEL_B_PUBLIC_BASE_URL"),
+    openSandboxInteractionFrameProxy: optional("OPENGENI_OPENSANDBOX_INTERACTION_FRAME_PROXY"),
+    openSandboxPoolRef: optional("OPENGENI_OPENSANDBOX_POOL_REF"),
+    openSandboxKubernetesInventoryNamespace: optional(
+      "OPENGENI_OPENSANDBOX_KUBERNETES_INVENTORY_NAMESPACE",
+    ),
     sandboxOwnershipEnabled: optional("OPENGENI_SANDBOX_OWNERSHIP_ENABLED"),
     rigVerificationLeaseOwnershipEnabled: optional(
       "OPENGENI_RIG_VERIFICATION_LEASE_OWNERSHIP_ENABLED",
@@ -2179,6 +2568,7 @@ export function getSettings(): Settings {
     sandboxLeaseTtlMs: optional("OPENGENI_SANDBOX_LEASE_TTL_MS"),
     sandboxLeaseWarmingTtlMs: optional("OPENGENI_SANDBOX_LEASE_WARMING_TTL_MS"),
     sandboxWarmingTimeoutMs: optional("OPENGENI_SANDBOX_WARMING_TIMEOUT_MS"),
+    workspaceControlLockTimeoutMs: optional("OPENGENI_WORKSPACE_CONTROL_LOCK_TIMEOUT_MS"),
     rigSetupTimeoutMs: optional("OPENGENI_RIG_SETUP_TIMEOUT_MS"),
     sandboxWarmRateMicrosPerSecondJson: optional(
       "OPENGENI_SANDBOX_WARM_RATE_MICROS_PER_SECOND_JSON",
@@ -2225,6 +2615,10 @@ export function getSettings(): Settings {
     githubAppId: optional("OPENGENI_GITHUB_APP_ID"),
     githubClientId: optional("OPENGENI_GITHUB_CLIENT_ID"),
     githubClientSecret: optional("OPENGENI_GITHUB_CLIENT_SECRET"),
+    githubRestMcpEnabled: optional("OPENGENI_GITHUB_REST_MCP_ENABLED"),
+    githubPersonalOauthEnabled: optional("OPENGENI_GITHUB_PERSONAL_OAUTH_ENABLED"),
+    githubPersonalOauthClientId: optional("OPENGENI_GITHUB_PERSONAL_OAUTH_CLIENT_ID"),
+    githubPersonalOauthClientSecret: optional("OPENGENI_GITHUB_PERSONAL_OAUTH_CLIENT_SECRET"),
     githubAppSlug: optional("OPENGENI_GITHUB_APP_SLUG"),
     githubWebhookSecret: optional("OPENGENI_GITHUB_WEBHOOK_SECRET"),
     githubAppPrivateKey: optional("OPENGENI_GITHUB_APP_PRIVATE_KEY"),
@@ -2244,11 +2638,11 @@ export function getSettings(): Settings {
   const settings = {
     ...parsed,
     sandboxIdleGraceMs:
-      raw.sandboxIdleGraceMs === undefined
+      raw.sandboxIdleGraceMs === undefined && parsed.sandboxBackend === "modal"
         ? Math.min(900_000, Math.floor((parsed.modalTimeoutSeconds * 1000) / 2))
         : parsed.sandboxIdleGraceMs,
     sandboxRotationLeadMs:
-      raw.sandboxRotationLeadMs === undefined
+      raw.sandboxRotationLeadMs === undefined && parsed.sandboxBackend === "modal"
         ? Math.min(3_600_000, Math.floor((parsed.modalTimeoutSeconds * 1000) / 2))
         : parsed.sandboxRotationLeadMs,
     mcpServers: ensureBuiltInMcpServers(parsed),
@@ -2321,6 +2715,45 @@ export function effectiveModalIdleTimeoutSeconds(settings: Settings): number {
   return settings.modalIdleTimeoutSeconds ?? settings.modalTimeoutSeconds;
 }
 
+export type EffectiveSandboxLifecycle = {
+  hardLifetimeMs: number | null;
+  renewableTtlSeconds: number | null;
+  providerIdleTimeoutMs: number | null;
+  rotationLeadMs: number | null;
+};
+
+/** Resolve provider lifecycle clocks without teaching generic callers Modal or
+ * OpenSandbox field names. Modal's returned values are exactly the pre-existing
+ * hard/idle/rotation values; OpenSandbox instead exposes a renewable TTL and no
+ * finite-deadline rotation. */
+export function effectiveSandboxLifecycle(
+  settings: Settings,
+  backend: z.infer<typeof SandboxBackend> = settings.sandboxBackend,
+): EffectiveSandboxLifecycle {
+  if (backend === "modal") {
+    return {
+      hardLifetimeMs: settings.modalTimeoutSeconds * 1000,
+      renewableTtlSeconds: null,
+      providerIdleTimeoutMs: effectiveModalIdleTimeoutSeconds(settings) * 1000,
+      rotationLeadMs: settings.sandboxRotationLeadMs,
+    };
+  }
+  if (backend === "opensandbox") {
+    return {
+      hardLifetimeMs: null,
+      renewableTtlSeconds: settings.openSandboxTtlSeconds,
+      providerIdleTimeoutMs: null,
+      rotationLeadMs: null,
+    };
+  }
+  return {
+    hardLifetimeMs: CAPABILITY_DESCRIPTORS[backend].lifetime.hardLifetimeMs ?? null,
+    renewableTtlSeconds: null,
+    providerIdleTimeoutMs: null,
+    rotationLeadMs: null,
+  };
+}
+
 /**
  * One shared upper bound for the durable provider-capture claim and for command
  * admission waiting behind it. The SDK request itself is bounded by
@@ -2733,6 +3166,7 @@ function gatewayRegistryProvider(
     // Model-specific compatibility stays at the reviewed request fence rather
     // than downgrading the whole provider wire.
     api: "responses",
+    wireProfile: "openai",
     baseUrl: VERCEL_AI_GATEWAY_BASE_URL,
     ...(input.apiKey ? { apiKey: input.apiKey } : {}),
     models,
@@ -2841,18 +3275,37 @@ export function productShortLabelForModelId(modelId: string): string | null {
   }
 }
 
+const BUILTIN_GPT56_MODEL_IDS = ["gpt-5.6-sol", "gpt-5.6-terra", "gpt-5.6-luna"] as const;
+
+function isBuiltinGpt56ModelId(modelId: string): boolean {
+  return (BUILTIN_GPT56_MODEL_IDS as readonly string[]).includes(modelId);
+}
+
+/** Billed GPT-5.6 uses the same raw/effective/auto-compact catalog as Codex. */
+function builtinContextLimitsForModel(
+  settings: Settings,
+  modelId: string,
+): Pick<
+  ConfiguredModel,
+  "contextWindowTokens" | "effectiveContextWindowTokens" | "autoCompactTokenLimit"
+> {
+  if (isBuiltinGpt56ModelId(modelId)) {
+    return {
+      contextWindowTokens: CODEX_MODEL_CONTEXT_WINDOW_TOKENS,
+      effectiveContextWindowTokens: CODEX_MODEL_EFFECTIVE_CONTEXT_WINDOW_TOKENS,
+      autoCompactTokenLimit: CODEX_MODEL_AUTO_COMPACT_TOKEN_LIMIT,
+    };
+  }
+  return { contextWindowTokens: settings.contextWindowTokens };
+}
+
 function builtinLatencyModesForModel(modelId: string): Array<{
   id: z.infer<typeof ModelLatencyModeV1>;
   upstream: "supported" | "unsupported" | "unknown";
   runnable: boolean;
   billingMultiplierBps?: number;
 }> {
-  if (
-    modelId === "gpt-5.6-sol" ||
-    modelId === "gpt-5.6-terra" ||
-    modelId === "gpt-5.6-luna" ||
-    modelId.startsWith("codex/gpt-5.6-")
-  ) {
+  if (isBuiltinGpt56ModelId(modelId) || modelId.startsWith("codex/gpt-5.6-")) {
     return [
       { id: "standard", upstream: "supported", runnable: true },
       {
@@ -2882,7 +3335,7 @@ function builtinHostedImageGenerationForModel(settings: Settings, modelId: strin
   return (
     settings.openaiProvider === "openai" &&
     isDirectOpenAiApiBaseUrl(settings.openaiBaseUrl) &&
-    ["gpt-5.6-sol", "gpt-5.6-terra", "gpt-5.6-luna"].includes(modelId)
+    isBuiltinGpt56ModelId(modelId)
   );
 }
 
@@ -2966,6 +3419,9 @@ function assertLatencyModeRunnable(
 }
 
 function registryCredentialSource(provider: RegistryProvider): CredentialSourceV1 {
+  if (provider.kind === "anonymous") {
+    return { kind: "deployment", mechanism: "none" };
+  }
   if (provider.kind === "codex-subscription") {
     return { kind: "connected_subscription", provider: "codex" };
   }
@@ -2979,6 +3435,9 @@ function registryCredentialSource(provider: RegistryProvider): CredentialSourceV
 }
 
 function registryBilling(provider: RegistryProvider): BillingAttributionV1 {
+  if (provider.kind === "anonymous") {
+    return { upstreamPayer: "deployment", metering: "external" };
+  }
   if (provider.kind === "codex-subscription" || provider.kind === "xai-subscription") {
     return { upstreamPayer: "connected_subscription", metering: "external" };
   }
@@ -3060,6 +3519,7 @@ function definitionVersionFor(
     provider: {
       adapterKind: provider.kind,
       wireApi: provider.api,
+      wireProfile: provider.wireProfile,
       baseUrl: provider.baseUrl ?? null,
       defaultHeaders: requestMetadata.headers,
       defaultQuery: requestMetadata.query,
@@ -3107,6 +3567,7 @@ export function configuredProviders(settings: Settings): ResolvedModelProvider[]
     label: builtinProviderLabel(settings),
     kind: "api-key",
     api: "responses",
+    wireProfile: settings.openaiProvider === "azure" ? "azure-openai" : "openai",
     builtin: true,
     credentialSource,
     billing: { upstreamPayer: "deployment", metering: "opengeni_credits" },
@@ -3127,6 +3588,7 @@ export function configuredProviders(settings: Settings): ResolvedModelProvider[]
       label: provider.label ?? provider.id,
       kind: provider.kind,
       api: provider.api,
+      wireProfile: provider.wireProfile,
       builtin: false,
       baseUrl: provider.baseUrl,
       apiKey: resolveProviderApiKey(provider),
@@ -3157,6 +3619,7 @@ export function withCodexCatalogProvider(settings: Settings): Settings {
     id: CODEX_PROVIDER_ID,
     label: "Codex (ChatGPT subscription)",
     api: "responses",
+    wireProfile: "openai",
     baseUrl: CODEX_PROVIDER_BASE_URL,
     models: CODEX_FALLBACK_MODEL_SLUGS.map((slug) => {
       const capabilities = {
@@ -3214,11 +3677,13 @@ export function withXaiSubscriptionCatalogProvider(settings: Settings): Settings
     id: XAI_SUBSCRIPTION_PROVIDER_ID,
     label: "SuperGrok (xAI subscription)",
     api: "responses",
+    wireProfile: "openai",
     baseUrl: XAI_SUBSCRIPTION_PROXY_BASE_URL,
     models: XAI_SUBSCRIPTION_MODEL_SLUGS.map((slug) => {
       const capabilities = legacyModelCapabilities(settings, {
         reasoningEffort: true,
         hostedWebSearch: true,
+        vision: true,
       });
       capabilities.reasoning.efforts = ["low", "medium", "high", "xhigh"];
       capabilities.reasoning.defaultEffort = "high";
@@ -3430,7 +3895,7 @@ export function configuredModels(settings: Settings): ConfiguredModel[] {
         billing: builtinProvider.billing,
         capabilities,
         ...(pricingSchedules[id] === undefined ? {} : { pricing: pricingSchedules[id] }),
-        contextWindowTokens: settings.contextWindowTokens,
+        ...builtinContextLimitsForModel(settings, id),
         toolOutputTruncationTokens: settings.modelToolOutputTruncationTokens,
         reasoningEffort: capabilities.reasoning.runnable,
         hostedWebSearch: capabilities.hostedTools.webSearch.runnable,
@@ -4678,18 +5143,11 @@ function ensureBuiltInMcpServers(settings: Settings): Settings["mcpServers"] {
 }
 
 /**
- * The base URL of OpenGeni's own first-party MCP endpoint, as a `{workspaceId}`
- * template — the SINGLE source of truth for the `opengeniMcpUrl`-or-loopback
- * decision. Every site that needs the first-party MCP base (config's tool
- * registry here, and the worker-side `firstPartyMcpServerUrlForRun` /
- * `firstPartyMcpUrls` in @opengeni/runtime) MUST route through this so the
- * default lives in exactly one place.
+ * The sandbox/external base URL of OpenGeni's first-party MCP endpoint, as a
+ * `{workspaceId}` template. Codemode and remote placements use this route.
  *
  * BINDING CONTRACT (`opengeniMcpUrl`):
- *   - STANDALONE (unset): falls back to the loopback default
- *     `http://127.0.0.1:${apiPort}/v1/workspaces/{workspaceId}/mcp` — the worker
- *     and API are in/next to the same host:port, so loopback resolves the
- *     workspace-scoped MCP. Byte-for-byte today's behavior.
+ *   - STANDALONE (unset): falls back to the loopback default.
  *   - EMBEDDED / MOUNTED (must set): when OpenGeni's API is mounted as a host
  *     sub-app under a prefix (e.g. `https://host/og/v1/...`), the loopback
  *     default is WRONG — the worker runs in the host process and `127.0.0.1:
@@ -4705,8 +5163,19 @@ export function firstPartyMcpBaseUrl(settings: Settings): string {
   );
 }
 
-export function firstPartyMcpWorkspaceUrl(settings: Settings, workspaceId: string): string {
-  const raw = firstPartyMcpBaseUrl(settings);
+/**
+ * Worker-side first-party MCP base. It never inherits the public/tunnel URL:
+ * an operator may intentionally expose that route to Modal or a Connected
+ * Machine, while the worker should still use loopback or cluster service DNS.
+ */
+export function firstPartyMcpInternalBaseUrl(settings: Settings): string {
+  return (
+    settings.opengeniMcpInternalUrl ??
+    `http://127.0.0.1:${settings.apiPort}/v1/workspaces/{workspaceId}/mcp`
+  );
+}
+
+function scopedFirstPartyMcpUrl(raw: string, workspaceId: string): string {
   if (raw.includes("{workspaceId}")) {
     return raw.replaceAll("{workspaceId}", workspaceId);
   }
@@ -4717,6 +5186,14 @@ export function firstPartyMcpWorkspaceUrl(settings: Settings, workspaceId: strin
   return url.toString();
 }
 
+export function firstPartyMcpWorkspaceUrl(settings: Settings, workspaceId: string): string {
+  return scopedFirstPartyMcpUrl(firstPartyMcpBaseUrl(settings), workspaceId);
+}
+
+export function firstPartyMcpInternalWorkspaceUrl(settings: Settings, workspaceId: string): string {
+  return scopedFirstPartyMcpUrl(firstPartyMcpInternalBaseUrl(settings), workspaceId);
+}
+
 export function codemodeWorkspaceUrl(settings: Settings, workspaceId: string): string {
   if (settings.opengeniMcpUrl) {
     const url = new URL(firstPartyMcpWorkspaceUrl(settings, workspaceId));
@@ -4757,8 +5234,23 @@ function firstPartyFilesMcpServerUrl(mcpUrl: string): string {
   return `${mcpUrl.replace(/\/+$/, "")}/files`;
 }
 
+const MODAL_DESKTOP_IMAGE_DIGEST_REF = /@sha256:[0-9a-f]{64}$/i;
+
+function isDigestPinnedModalDesktopImage(settings: Settings): boolean {
+  if (settings.modalImageId) return true;
+  return (
+    typeof settings.modalImageRef === "string" &&
+    MODAL_DESKTOP_IMAGE_DIGEST_REF.test(settings.modalImageRef)
+  );
+}
+
 function validateSettings(settings: Settings): void {
   temporalConnectionOptions(settings);
+  if (settings.goalIdleBackoffMs.some((delayMs) => delayMs > settings.goalIdleBackoffMaxMs)) {
+    throw new Error(
+      `OPENGENI_GOAL_IDLE_BACKOFF_MS entries must not exceed OPENGENI_GOAL_IDLE_BACKOFF_MAX_MS (${settings.goalIdleBackoffMaxMs})`,
+    );
+  }
   const allowedFirstPartyMcpTools = new Set(
     settings.allowedFirstPartyMcpTools ?? FIRST_PARTY_MCP_TOOL_NAMES,
   );
@@ -4847,6 +5339,59 @@ function validateSettings(settings: Settings): void {
       "OPENGENI_GOOGLE_DRIVE_CLIENT_ID and OPENGENI_GOOGLE_DRIVE_CLIENT_SECRET must be configured together",
     );
   }
+  if (
+    Boolean(settings.githubPersonalOauthClientId) !==
+    Boolean(settings.githubPersonalOauthClientSecret)
+  ) {
+    throw new Error(
+      "OPENGENI_GITHUB_PERSONAL_OAUTH_CLIENT_ID and OPENGENI_GITHUB_PERSONAL_OAUTH_CLIENT_SECRET must be configured together",
+    );
+  }
+  if (settings.githubPersonalOauthEnabled) {
+    if (!settings.integrationsEnabled) {
+      throw new Error(
+        "OPENGENI_INTEGRATIONS_ENABLED=true is required when personal GitHub OAuth is enabled",
+      );
+    }
+    if (settings.productAccessMode !== "managed") {
+      throw new Error(
+        "OPENGENI_GITHUB_PERSONAL_OAUTH_ENABLED=true requires OPENGENI_PRODUCT_ACCESS_MODE=managed",
+      );
+    }
+    if (!settings.githubPersonalOauthClientId || !settings.githubPersonalOauthClientSecret) {
+      throw new Error(
+        "personal GitHub OAuth requires OPENGENI_GITHUB_PERSONAL_OAUTH_CLIENT_ID and OPENGENI_GITHUB_PERSONAL_OAUTH_CLIENT_SECRET",
+      );
+    }
+    if (settings.githubPersonalOauthClientId === settings.githubClientId) {
+      throw new Error(
+        "personal GitHub OAuth must use a different OAuth App client from the OpenGeni GitHub App",
+      );
+    }
+    if (!personalGitHubOAuthCallbackUrl(settings.publicBaseUrl)) {
+      throw new Error(
+        "OPENGENI_PUBLIC_BASE_URL must be a credential-free origin without a path, query, or fragment when personal GitHub OAuth is enabled",
+      );
+    }
+    if (
+      !settings.publicBaseUrl?.startsWith("https://") &&
+      !["local", "test"].includes(settings.environment)
+    ) {
+      throw new Error(
+        "OPENGENI_PUBLIC_BASE_URL must use https when personal GitHub OAuth is enabled outside local/test",
+      );
+    }
+    if (!settings.integrationsStateSecret) {
+      throw new Error(
+        "OPENGENI_INTEGRATIONS_STATE_SECRET is required when personal GitHub OAuth is enabled",
+      );
+    }
+    if (!settings.environmentsEncryptionKey) {
+      throw new Error(
+        "OPENGENI_ENVIRONMENTS_ENCRYPTION_KEY is required when personal GitHub OAuth is enabled",
+      );
+    }
+  }
   if (Boolean(settings.fikenClientId) !== Boolean(settings.fikenClientSecret)) {
     throw new Error(
       "OPENGENI_FIKEN_OAUTH_CLIENT_ID and OPENGENI_FIKEN_OAUTH_CLIENT_SECRET must be configured together",
@@ -4873,11 +5418,21 @@ function validateSettings(settings: Settings): void {
     }
   }
   if (settings.googleDriveClientId) {
+    if (!settings.integrationsEnabled) {
+      throw new Error(
+        "OPENGENI_INTEGRATIONS_ENABLED=true is required when the Google Drive integration is configured",
+      );
+    }
     if (!settings.publicBaseUrl) {
       throw new Error(
         "OPENGENI_PUBLIC_BASE_URL is required when the Google Drive integration is configured",
       );
     }
+    if (!googleDriveOAuthCallbackUrl(settings.publicBaseUrl)) {
+      throw new Error(
+        "OPENGENI_PUBLIC_BASE_URL must be a credential-free origin without a path, query, or fragment when the Google Drive integration is configured",
+      );
+    }
     if (
       !settings.publicBaseUrl.startsWith("https://") &&
       !["local", "test"].includes(settings.environment)
@@ -4892,6 +5447,23 @@ function validateSettings(settings: Settings): void {
       );
     }
   }
+  if (settings.googleDriveSyncMaxFileBytes > settings.googleDriveSyncMaxBytes) {
+    throw new Error(
+      "OPENGENI_GOOGLE_DRIVE_SYNC_MAX_FILE_BYTES must not exceed OPENGENI_GOOGLE_DRIVE_SYNC_MAX_BYTES",
+    );
+  }
+  if (
+    settings.googleDriveProviderRetryInitialDelayMs > settings.googleDriveProviderRetryMaxDelayMs
+  ) {
+    throw new Error(
+      "OPENGENI_GOOGLE_DRIVE_PROVIDER_RETRY_INITIAL_DELAY_MS must not exceed OPENGENI_GOOGLE_DRIVE_PROVIDER_RETRY_MAX_DELAY_MS",
+    );
+  }
+  if (settings.googleDriveProviderRetryInitialDelayMs > settings.googleDriveProviderRetryBudgetMs) {
+    throw new Error(
+      "OPENGENI_GOOGLE_DRIVE_PROVIDER_RETRY_INITIAL_DELAY_MS must not exceed OPENGENI_GOOGLE_DRIVE_PROVIDER_RETRY_BUDGET_MS",
+    );
+  }
   if (Boolean(settings.atlassianClientId) !== Boolean(settings.atlassianClientSecret)) {
     throw new Error(
       "OPENGENI_ATLASSIAN_CLIENT_ID and OPENGENI_ATLASSIAN_CLIENT_SECRET must be configured together",
@@ -5120,6 +5692,18 @@ function validateSettings(settings: Settings): void {
   sandboxLifecycleHookIds(settings);
   // Fail fast on a malformed warm-rate table (P2.1).
   parseSandboxWarmRateJson(settings.sandboxWarmRateMicrosPerSecondJson);
+  if (settings.sandboxBackend === "opensandbox") {
+    if (!/@sha256:[0-9a-f]{64}$/i.test(settings.openSandboxImage ?? "")) {
+      throw new Error(
+        "OPENGENI_OPENSANDBOX_IMAGE must be an immutable OCI reference ending in @sha256:<64 hex characters>",
+      );
+    }
+    if (!objectStorageConfiguredForWorkspaceArchives(settings)) {
+      throw new Error(
+        "OPENGENI_SANDBOX_BACKEND=opensandbox requires configured object storage for portable /workspace archives",
+      );
+    }
+  }
   const serverIds = new Set<string>();
   for (const server of settings.mcpServers) {
     if (serverIds.has(server.id)) {
@@ -5128,30 +5712,13 @@ function validateSettings(settings: Settings): void {
     serverIds.add(server.id);
   }
   // --- sandbox lease cadence invariant (fail fast at boot) ---
-  // reaperPeriod (30s) < viewerHolderTTL (90s), and reaperPeriod + idleGrace must
-  // be strictly less than the provider lifetime (modalTimeoutSeconds*1000):
-  //   - the reaper must run more often than the TTL it polices; and
-  //   - the reaper must terminate a genuinely-idle box (after the full drain grace,
-  //     observed on the NEXT sweep) BEFORE the provider's hard lifetime reclaims it
-  //     out from under us — the provider lifetime is the backstop, not the
-  //     warm-window controller. idleGrace counts from the user's last release;
-  //     the provider clock counts from the preceding resume, so we leave the
-  //     active-turn headroom in modalTimeoutSeconds (default 86400s).
+  // Holder TTLs are provider-neutral. Modal's finite hard/idle clocks and
+  // deadline rotation are validated only when Modal is active; renewable-TTL
+  // providers such as OpenSandbox do not enter that deadline model.
   {
     const reaperPeriod = settings.sandboxLeaseReaperPeriodMs;
     const viewerTtl = settings.sandboxViewerHolderTtlMs;
     const interactionTtl = settings.sandboxInteractionHolderTtlMs;
-    const idleGraceMs = settings.sandboxIdleGraceMs;
-    const providerLifetimeMs = settings.modalTimeoutSeconds * 1000;
-    const rotationLeadMs = settings.sandboxRotationLeadMs;
-    // The EFFECTIVE box lifetime when it sits idle between turns is the Modal IDLE
-    // timeout, NOT the hard lifetime (sandbox-file-persistence): a box with no
-    // active connection is idle-reaped at idleTimeout. effectiveModalIdleTimeout
-    // defaults to the hard lifetime (so the idle-reap never beats the OpenGeni
-    // reaper), but an operator can pin it shorter — the invariants below bind the
-    // reaper cadence + drain grace to the idle timeout (the REAL ceiling), so a
-    // drained box always survives long enough for the reaper to snapshot it.
-    const idleTimeoutMs = effectiveModalIdleTimeoutSeconds(settings) * 1000;
     if (!(reaperPeriod < viewerTtl)) {
       throw new Error(
         `OPENGENI_SANDBOX_LEASE_REAPER_PERIOD_MS (${reaperPeriod}) must be strictly less than ` +
@@ -5166,54 +5733,57 @@ function validateSettings(settings: Settings): void {
           `more often than the controller-heartbeat horizon.`,
       );
     }
-    if (!(idleTimeoutMs <= providerLifetimeMs)) {
-      throw new Error(
-        `OPENGENI_MODAL_IDLE_TIMEOUT_SECONDS*1000 (${idleTimeoutMs}) must not exceed the hard provider ` +
-          `lifetime (OPENGENI_MODAL_TIMEOUT_SECONDS*1000 = ${providerLifetimeMs}): the idle timeout is a ` +
-          `floor under the hard lifetime, not above it.`,
-      );
-    }
-    if (!(rotationLeadMs < providerLifetimeMs)) {
-      throw new Error(
-        `OPENGENI_SANDBOX_ROTATION_LEAD_MS (${rotationLeadMs}) must be strictly less than ` +
-          `OPENGENI_MODAL_TIMEOUT_SECONDS*1000 (${providerLifetimeMs}).`,
-      );
-    }
-    // This is provider-hard-deadline headroom, not a retry delay. Rotation is
-    // admitted immediately before the same sweep's drain inventory, so only the
-    // worst-case time until that sweep plus the complete durable capture window
-    // is required. No second schedule period belongs in the availability path.
-    const captureTimeoutMs = sandboxArchiveCaptureTimeoutMs(settings);
-    if (!(rotationLeadMs > captureTimeoutMs + reaperPeriod)) {
-      throw new Error(
-        `OPENGENI_SANDBOX_ROTATION_LEAD_MS (${rotationLeadMs}) must exceed the durable capture ` +
-          `timeout plus one reaper period (${captureTimeoutMs + reaperPeriod}).`,
-      );
-    }
-    if (!(viewerTtl < idleTimeoutMs)) {
-      throw new Error(
-        `OPENGENI_SANDBOX_VIEWER_HOLDER_TTL_MS (${viewerTtl}) must be strictly less than the effective box ` +
-          `idle timeout (${idleTimeoutMs}): a viewer holder must be reapable before the box idles out from ` +
-          `under it (the provider idle-timeout is the backstop).`,
-      );
-    }
-    if (!(interactionTtl < idleTimeoutMs)) {
-      throw new Error(
-        `OPENGENI_SANDBOX_INTERACTION_HOLDER_TTL_MS (${interactionTtl}) must be strictly less than ` +
-          `the effective box idle timeout (${idleTimeoutMs}): a dead browser controller must be ` +
-          `reapable before the provider reclaims its placement.`,
-      );
-    }
-    if (!(reaperPeriod + idleGraceMs < idleTimeoutMs)) {
-      throw new Error(
-        `OPENGENI_SANDBOX_LEASE_REAPER_PERIOD_MS + OPENGENI_SANDBOX_IDLE_GRACE_MS ` +
-          `(${reaperPeriod} + ${idleGraceMs} = ${reaperPeriod + idleGraceMs}) must be strictly less than the ` +
-          `effective box idle timeout (${idleTimeoutMs}): a drained box must SURVIVE its full warm window so ` +
-          `the reaper can resume + snapshot /workspace + terminate it on the sweep AFTER the drain grace ` +
-          `elapses — Modal's idle-reap must NOT fire first (or /workspace is lost). Raise ` +
-          `OPENGENI_MODAL_IDLE_TIMEOUT_SECONDS (defaults to OPENGENI_MODAL_TIMEOUT_SECONDS) or lower ` +
-          `OPENGENI_SANDBOX_IDLE_GRACE_MS.`,
-      );
+    if (settings.sandboxBackend === "modal") {
+      const idleGraceMs = settings.sandboxIdleGraceMs;
+      const lifecycle = effectiveSandboxLifecycle(settings, "modal");
+      const providerLifetimeMs = lifecycle.hardLifetimeMs!;
+      const rotationLeadMs = lifecycle.rotationLeadMs!;
+      const idleTimeoutMs = lifecycle.providerIdleTimeoutMs!;
+      if (!(idleTimeoutMs <= providerLifetimeMs)) {
+        throw new Error(
+          `OPENGENI_MODAL_IDLE_TIMEOUT_SECONDS*1000 (${idleTimeoutMs}) must not exceed the hard provider ` +
+            `lifetime (OPENGENI_MODAL_TIMEOUT_SECONDS*1000 = ${providerLifetimeMs}): the idle timeout is a ` +
+            `floor under the hard lifetime, not above it.`,
+        );
+      }
+      if (!(rotationLeadMs < providerLifetimeMs)) {
+        throw new Error(
+          `OPENGENI_SANDBOX_ROTATION_LEAD_MS (${rotationLeadMs}) must be strictly less than ` +
+            `OPENGENI_MODAL_TIMEOUT_SECONDS*1000 (${providerLifetimeMs}).`,
+        );
+      }
+      const captureTimeoutMs = sandboxArchiveCaptureTimeoutMs(settings);
+      if (!(rotationLeadMs > captureTimeoutMs + reaperPeriod)) {
+        throw new Error(
+          `OPENGENI_SANDBOX_ROTATION_LEAD_MS (${rotationLeadMs}) must exceed the durable capture ` +
+            `timeout plus one reaper period (${captureTimeoutMs + reaperPeriod}).`,
+        );
+      }
+      if (!(viewerTtl < idleTimeoutMs)) {
+        throw new Error(
+          `OPENGENI_SANDBOX_VIEWER_HOLDER_TTL_MS (${viewerTtl}) must be strictly less than the effective box ` +
+            `idle timeout (${idleTimeoutMs}): a viewer holder must be reapable before the box idles out from ` +
+            `under it (the provider idle-timeout is the backstop).`,
+        );
+      }
+      if (!(interactionTtl < idleTimeoutMs)) {
+        throw new Error(
+          `OPENGENI_SANDBOX_INTERACTION_HOLDER_TTL_MS (${interactionTtl}) must be strictly less than ` +
+            `the effective box idle timeout (${idleTimeoutMs}): a dead browser controller must be ` +
+            `reapable before the provider reclaims its placement.`,
+        );
+      }
+      if (!(reaperPeriod + idleGraceMs < idleTimeoutMs)) {
+        throw new Error(
+          `OPENGENI_SANDBOX_LEASE_REAPER_PERIOD_MS + OPENGENI_SANDBOX_IDLE_GRACE_MS ` +
+            `(${reaperPeriod} + ${idleGraceMs} = ${reaperPeriod + idleGraceMs}) must be strictly less than the ` +
+            `effective box idle timeout (${idleTimeoutMs}): a drained box must SURVIVE its full warm window so ` +
+            `the reaper can resume + snapshot /workspace + terminate it on the sweep AFTER the drain grace ` +
+            `elapses — Modal's idle-reap must NOT fire first (or /workspace is lost). Raise ` +
+            `OPENGENI_MODAL_IDLE_TIMEOUT_SECONDS (defaults to OPENGENI_MODAL_TIMEOUT_SECONDS) or lower ` +
+            `OPENGENI_SANDBOX_IDLE_GRACE_MS.`,
+        );
+      }
     }
   }
   // --- stream-token secret: required-when-desktop, but GRACEFULLY DEGRADE (stream-token availability contract) ---
@@ -5224,6 +5794,20 @@ function validateSettings(settings: Settings): void {
   // negotiateCapabilities degrades the desktop cell). This keeps a desktop-
   // configured deployment bootable (headless + Channel-A still work) instead of
   // crashing the whole API on a missing secret.
+  if (
+    settings.sandboxDesktopEnabled &&
+    settings.sandboxBackend === "modal" &&
+    !["local", "test"].includes(settings.environment)
+  ) {
+    if (!isDigestPinnedModalDesktopImage(settings)) {
+      throw new Error(
+        "OPENGENI_MODAL_IMAGE_REF must be digest-pinned (registry/name@sha256:…) when " +
+          "OPENGENI_SANDBOX_BACKEND=modal and OPENGENI_SANDBOX_DESKTOP_ENABLED=true. " +
+          "Computer/Browser need docker/desktop.Dockerfile, not the official headless " +
+          "opengeni-sandbox image. Helm desktop.imageRef writes this pin.",
+      );
+    }
+  }
   if (settings.sandboxDesktopEnabled && resolveStreamTokenSecret(settings) === undefined) {
     console.warn(
       "[opengeni] OPENGENI_SANDBOX_DESKTOP_ENABLED=true but neither OPENGENI_STREAM_TOKEN_SECRET nor " +
@@ -5235,10 +5819,12 @@ function validateSettings(settings: Settings): void {
   // Model provider registry: parse it here so JSON/zod errors surface at boot,
   // reject a registry id colliding with the built-in provider id (it would
   // shadow the built-in in configuredProviders), reject duplicate registry
-  // ids, and require a resolvable API key for every registry provider (a
-  // provider with no usable key can never serve a turn). Registry models flow
-  // through configuredAllowedModels, so the managed-billing pricing check above
-  // already covers them.
+  // ids, and preserve the existing key requirement for every registry provider
+  // except connected Codex and the explicit anonymous opt-in. Anonymous
+  // providers are externally metered; a missing key on every other ordinary
+  // provider remains a boot error.
+  // Registry models flow through configuredAllowedModels, so the managed-billing
+  // pricing check above already covers the OpenGeni-credit providers.
   const registryProviders = parseModelProvidersJson(settings.modelProvidersJson);
   const builtinId = builtinProviderId(settings);
   const providerIds = new Set<string>();
@@ -5263,7 +5849,11 @@ function validateSettings(settings: Settings): void {
       );
     }
     providerIds.add(provider.id);
-    if (provider.kind !== "codex-subscription" && !resolveProviderApiKey(provider)) {
+    if (
+      provider.kind !== "codex-subscription" &&
+      provider.kind !== "anonymous" &&
+      !resolveProviderApiKey(provider)
+    ) {
       throw new Error(
         `OPENGENI_MODEL_PROVIDERS_JSON provider ${provider.id} requires a resolvable API key (set apiKey or apiKeyEnv)`,
       );
@@ -5373,7 +5963,7 @@ export function resolveNatsCalloutConfig(settings: Settings): NatsCalloutConfig
  * The PRIVILEGED control-plane NATS login (api/worker). Present only when BOTH a
  * user and password are set; otherwise null and the bus connects anonymously (local
  * dev / a NATS without auth_callout). When the callout plane is on, this is the
- * static account user permitted to request `agent.*.rpc`.
+ * static account user permitted to request exact generation-fenced agent RPC subjects.
  */
 export interface NatsControlPlaneAuth {
   user: string;