@rosthq/cli 0.7.71 → 0.7.73

package/dist/index.js

@@ -38281,10 +38281,10 @@ var CATALOG_ENTRIES = [
     title: "Run a script (sandbox)",
     provider: "rost",
     description: "Call this to run a short program (shell/node/python) in an isolated, network-disabled microVM for pure computation \u2014 parsing, transforming, calculating, or validating data the agent already holds. The sandbox has NO credentials and NO network access; it cannot read files, call APIs, or reach the internet. Use it for compute, never to fetch or send data. Every run is metered and audited; availability is a per-account entitlement and each call is confirmed by default (arbitrary code execution).",
-    // Compute-only: the microVM produces a structured, size-capped result and has
-    // no durable or external effect, so the narrowest useful tier is `read`.
-    default_scope_tier: "read",
-    scope_tiers: ["read"],
+    // Compute-only, but still arbitrary code execution. In the capability UI this
+    // belongs to the action-capable "Read & act" posture, never read-only.
+    default_scope_tier: "draft",
+    scope_tiers: ["draft"],
     // v1 injects ZERO credentials (secret grants are DER-1585) — never a vault ref.
     credential_required: false,
     // Conservative by default (invariant #10): arbitrary code execution routes to the
@@ -38410,10 +38410,20 @@ var CATALOG_ENTRIES = [
     default_access_policy: "always_ask"
   },
   {
-    id: "web.research",
+    id: "web.search",
     title: "Web research",
     provider: "web",
-    description: "Call this to research public company and role information from the open web. Read-only; escalate paid data sources or sensitive personal data.",
+    description: "Call this to search public web sources with citations. Read-only; it uses the server-side Exa provider, never exposes provider keys, and escalates paid data sources or sensitive personal data.",
+    default_scope_tier: "read",
+    scope_tiers: ["read"],
+    credential_required: false,
+    default_access_policy: "always_allow"
+  },
+  {
+    id: "web.fetch",
+    title: "Read public web page",
+    provider: "web",
+    description: "Call this to fetch and extract text from one public HTTPS page. It validates DNS, redirects, content type, size, and private-network boundaries before reading.",
     default_scope_tier: "read",
     scope_tiers: ["read"],
     credential_required: false,
@@ -38655,7 +38665,7 @@ function accessLevelForScope(scopeTier) {
 }
 function providerRequirementFor(entry) {
   if (!entry.credential_required) {
-    return entry.provider === "rost" ? "platform_managed" : "none";
+    return entry.provider === "rost" || entry.provider === "web" ? "platform_managed" : "none";
   }
   return entry.id === "secret.broker" ? "vault_ref" : "connection";
 }
@@ -38682,7 +38692,7 @@ function enrichCatalogEntry(entry) {
     access_levels: accessLevels,
     default_access_level: accessLevelForScope(entry.default_scope_tier),
     provider_requirement: providerRequirementFor(entry),
-    cost_class: entry.id === "script.run" || entry.id === "secret.broker" ? "metered_standard" : "included",
+    cost_class: entry.id === "script.run" || entry.id === "secret.broker" ? "metered_standard" : entry.id === "web.search" || entry.id === "web.fetch" || entry.id === "browser.read" ? "metered_low" : "included",
     lane_support: ["cloud", "runner", "mcp"],
     trusted_required_metadata: trustedRequiredMetadataFor(entry)
   };
@@ -39405,6 +39415,27 @@ var agentCreateFromTemplateOutputSchema = agentSetupStateSchema.extend({
   occupancy_created: external_exports.boolean()
 }).strict();
 
+// ../../packages/protocol/src/provider-costs.ts
+var providerCostKinds = ["managed_llm", "exa", "browser", "sandbox"];
+var providerCostKindSchema = external_exports.enum(providerCostKinds);
+var keySourceSchema = external_exports.enum(["rost_managed", "tenant_byok"]);
+var atSchema = external_exports.union([external_exports.date(), external_exports.string().datetime()]).optional();
+var providerCostEntrySchema = external_exports.object({
+  kind: providerCostKindSchema,
+  effectiveFrom: external_exports.string().datetime(),
+  estimatedCents: external_exports.number().int().nonnegative(),
+  provider: external_exports.string().min(1)
+}).strict();
+var PROVIDER_COST_REGISTRY = Object.freeze([
+  { kind: "exa", provider: "exa", effectiveFrom: "2026-07-11T00:00:00.000Z", estimatedCents: 30 },
+  { kind: "exa", provider: "exa", effectiveFrom: "2026-07-15T00:00:00.000Z", estimatedCents: 35 },
+  { kind: "browser", provider: "browser", effectiveFrom: "2026-07-11T00:00:00.000Z", estimatedCents: 60 },
+  { kind: "sandbox", provider: "sandbox", effectiveFrom: "2026-07-11T00:00:00.000Z", estimatedCents: 120 }
+]);
+for (const entry of PROVIDER_COST_REGISTRY) {
+  providerCostEntrySchema.parse(entry);
+}
+
 // ../../packages/protocol/src/agent-builder.ts
 var uuidSchema4 = external_exports.string().uuid();
 var singleLineSchema = external_exports.string().trim().min(1).max(500).regex(/^[^\n\r]+$/, "Value must be a single line.");
@@ -39715,6 +39746,116 @@ var toolGrantsAgentUpdateOutputSchema = external_exports.object({
     permission_manifest: external_exports.array(compiledCapabilityManifestEntrySchema)
   }).strict().nullable()
 }).strict();
+var scopeDigestSchema = external_exports.string().regex(/^sha256:[0-9a-f]{64}$/);
+var classifierVersionSchema = external_exports.string().regex(/^[a-z][a-z0-9_.-]{0,79}$/);
+var agentActivationReceiptInputSchema = external_exports.object({
+  agent_id: uuidSchema5,
+  proposed_budget_cents: external_exports.number().int().nonnegative().max(1e7).optional()
+}).strict();
+var agentActivationReceiptCapabilitySchema = external_exports.object({
+  capability_id: external_exports.string().min(1),
+  access_level: capabilityGrantAccessLevelSchema,
+  compile_status: capabilityGrantCompileStatusSchema,
+  connection: capabilityGrantConnectionSchema
+}).strict();
+var agentActivationReceiptDiffSchema = external_exports.object({
+  added: external_exports.array(external_exports.string().min(1)),
+  removed: external_exports.array(external_exports.string().min(1)),
+  changed: external_exports.array(external_exports.object({
+    capability_id: external_exports.string().min(1),
+    from_access_level: capabilityGrantAccessLevelSchema.nullable(),
+    to_access_level: capabilityGrantAccessLevelSchema
+  }).strict())
+}).strict();
+var agentActivationReceiptOutputSchema = external_exports.object({
+  agent_id: uuidSchema5,
+  seat_id: uuidSchema5,
+  steward_seat_id: uuidSchema5,
+  steward_label: external_exports.string().min(1).max(160),
+  lane: external_exports.enum(["cloud", "runner", "mcp_session"]),
+  cadence: external_exports.string().min(1).max(120).nullable(),
+  budget_cents: external_exports.number().int().nonnegative().max(1e7),
+  currency: external_exports.literal("USD"),
+  scope_digest: scopeDigestSchema,
+  compiler_version: classifierVersionSchema,
+  classifier_version: classifierVersionSchema,
+  trusted_boundary: external_exports.object({
+    eligible_command_count: external_exports.number().int().nonnegative(),
+    always_human: external_exports.array(external_exports.string().min(1)).min(1)
+  }).strict(),
+  capabilities: external_exports.array(agentActivationReceiptCapabilitySchema),
+  diff: agentActivationReceiptDiffSchema
+}).strict().superRefine((value, ctx) => {
+  if (hasSecretShapedValue(value)) {
+    ctx.addIssue({
+      code: external_exports.ZodIssueCode.custom,
+      message: "Activation receipt cannot contain secret-shaped content."
+    });
+  }
+});
+var agentActivationSignInputSchema = external_exports.object({
+  agent_id: uuidSchema5,
+  expected_scope_digest: scopeDigestSchema,
+  budget_cents: external_exports.number().int().nonnegative().max(1e7),
+  reason: external_exports.string().trim().min(1).max(500).optional()
+}).strict();
+var agentActivationSignOutputSchema = external_exports.object({
+  agent_id: uuidSchema5,
+  seat_id: uuidSchema5,
+  scope_digest: scopeDigestSchema,
+  decision_id: uuidSchema5,
+  event_id: uuidSchema5,
+  activated: external_exports.boolean()
+}).strict();
+var agentTrustGrantDtoSchema = external_exports.object({
+  grant_id: uuidSchema5,
+  agent_id: uuidSchema5,
+  seat_id: uuidSchema5,
+  granted_by_user_id: uuidSchema5,
+  scope_digest: scopeDigestSchema,
+  classifier_version: classifierVersionSchema,
+  budget_cents: external_exports.number().int().nonnegative(),
+  reserved_cents: external_exports.number().int().nonnegative(),
+  spent_cents: external_exports.number().int().nonnegative(),
+  currency: external_exports.literal("USD"),
+  status: external_exports.enum(["active", "revoked", "superseded", "expired"]),
+  effective_at: external_exports.string().datetime({ offset: true }),
+  expires_at: external_exports.string().datetime({ offset: true }).nullable(),
+  revoked_at: external_exports.string().datetime({ offset: true }).nullable(),
+  supersedes_id: uuidSchema5.nullable()
+}).strict();
+var agentTrustGrantCreateInputSchema = external_exports.object({
+  agent_id: uuidSchema5,
+  expected_scope_digest: scopeDigestSchema,
+  budget_cents: external_exports.number().int().nonnegative().max(1e7),
+  expires_at: external_exports.string().datetime({ offset: true }).optional(),
+  reason: external_exports.string().trim().min(1).max(500).optional()
+}).strict();
+var agentTrustGrantInspectInputSchema = external_exports.object({
+  agent_id: uuidSchema5,
+  include_inactive: external_exports.boolean().optional()
+}).strict();
+var agentTrustGrantInspectOutputSchema = external_exports.object({
+  grants: external_exports.array(agentTrustGrantDtoSchema)
+}).strict();
+var agentTrustGrantMutationInputSchema = external_exports.object({
+  grant_id: uuidSchema5,
+  reason: external_exports.string().trim().min(1).max(500).optional()
+}).strict();
+var agentTrustGrantExpireInputSchema = external_exports.object({
+  agent_id: uuidSchema5
+}).strict();
+var agentTrustGrantSupersedeInputSchema = external_exports.object({
+  agent_id: uuidSchema5,
+  expected_scope_digest: scopeDigestSchema,
+  budget_cents: external_exports.number().int().nonnegative().max(1e7),
+  expires_at: external_exports.string().datetime({ offset: true }).optional(),
+  reason: external_exports.string().trim().min(1).max(500).optional()
+}).strict();
+var agentTrustGrantMutationOutputSchema = external_exports.object({
+  grant: agentTrustGrantDtoSchema,
+  event_id: uuidSchema5
+}).strict();
 var agentSetupCapabilitySuggestionsInputSchema = external_exports.object({
   seat_id: uuidSchema5.optional(),
   setup_id: uuidSchema5.optional()
@@ -39754,6 +39895,83 @@ var toolPolicyGetOutputSchema = external_exports.object({
   tool_policy: storedTenantToolPolicySchema
 }).strict();
 
+// ../../packages/protocol/src/web-research.ts
+var webResearchCitationSchema = external_exports.object({
+  id: external_exports.string().min(1).max(80),
+  url: external_exports.string().url(),
+  title: external_exports.string().min(1).max(300)
+}).strict();
+var webSearchInputSchema = external_exports.object({
+  query: external_exports.string().trim().min(1).max(500),
+  max_results: external_exports.number().int().min(1).max(10).default(5),
+  timeout_ms: external_exports.number().int().min(250).max(2e4).default(8e3)
+}).strict();
+var webSearchResultSchema = external_exports.object({
+  citation_id: external_exports.string().min(1).max(80),
+  title: external_exports.string().min(1).max(300),
+  url: external_exports.string().url(),
+  snippet: external_exports.string().min(1).max(1200),
+  published_at: external_exports.string().datetime().nullable()
+}).strict();
+var webSearchOutputSchema = external_exports.object({
+  ok: external_exports.literal(true),
+  provider: external_exports.literal("exa"),
+  query: external_exports.string().min(1).max(500),
+  results: external_exports.array(webSearchResultSchema).max(10),
+  citations: external_exports.array(webResearchCitationSchema).max(10),
+  cost: external_exports.object({
+    provider: external_exports.literal("exa"),
+    cost_class: external_exports.literal("metered_low"),
+    estimated_units: external_exports.number().nonnegative()
+  }).strict()
+}).strict();
+var webFetchInputSchema = external_exports.object({
+  url: external_exports.string().url().max(2048),
+  timeout_ms: external_exports.number().int().min(250).max(2e4).default(8e3),
+  max_bytes: external_exports.number().int().min(1024).max(1e6).default(25e4)
+}).strict();
+var webFetchOutputSchema = external_exports.object({
+  ok: external_exports.literal(true),
+  url: external_exports.string().url(),
+  final_url: external_exports.string().url(),
+  title: external_exports.string().max(300).nullable(),
+  text: external_exports.string().max(12e4),
+  content_type: external_exports.string().max(120),
+  bytes: external_exports.number().int().nonnegative(),
+  truncated: external_exports.boolean(),
+  provenance: external_exports.object({
+    fetched_at: external_exports.string().datetime(),
+    redirect_count: external_exports.number().int().min(0).max(5),
+    pinned_addresses: external_exports.array(external_exports.string().min(1)).min(1).max(6)
+  }).strict()
+}).strict();
+var browserReadOperationSchema = external_exports.enum(["navigate", "inspect", "screenshot", "extract_text"]);
+var browserReadInputSchema = external_exports.object({
+  url: external_exports.string().url().max(2048),
+  operation: browserReadOperationSchema.default("inspect"),
+  selector: external_exports.string().trim().min(1).max(240).optional(),
+  timeout_ms: external_exports.number().int().min(250).max(2e4).default(8e3)
+}).strict();
+var browserReadOutputSchema = external_exports.object({
+  ok: external_exports.literal(true),
+  operation: browserReadOperationSchema,
+  url: external_exports.string().url(),
+  final_url: external_exports.string().url(),
+  title: external_exports.string().max(300).nullable(),
+  text: external_exports.string().max(6e4).optional(),
+  screenshot_artifact: external_exports.object({
+    artifact_id: external_exports.string().min(1).max(160),
+    tenant_id: external_exports.string().min(1).max(120),
+    mime_type: external_exports.literal("image/png"),
+    bytes: external_exports.number().int().nonnegative()
+  }).strict().optional(),
+  provenance: external_exports.object({
+    fetched_at: external_exports.string().datetime(),
+    sandbox: external_exports.literal("ephemeral_read_only"),
+    persistent_state: external_exports.literal(false)
+  }).strict()
+}).strict();
+
 // ../../packages/protocol/src/agent-policy.ts
 var AUTONOMOUS_RISK_LEVELS = ["low", "medium", "high", "critical"];
 var autonomousRiskLevelSchema = external_exports.enum(AUTONOMOUS_RISK_LEVELS);
@@ -40477,6 +40695,54 @@ var charterSchema = charterPersistedObjectSchema.superRefine(refineAutonomousBou
 var charterDocSchema = charterDocObjectSchema.superRefine(refineAutonomousBoundaries);
 var charterDocEditsSchema = charterDocObjectSchema.omit({ payload_version: true }).partial().strict();
 
+// ../../packages/protocol/src/trusted-budget.ts
+var TRUSTED_BUDGET_FORMULA_VERSION = "trusted-budget.v1";
+var MODEL_TOKEN_PROXY = Object.freeze({
+  inputTokens: 12e3,
+  outputTokens: 3e3
+});
+var LANE_MULTIPLIERS = Object.freeze({
+  cloud: 1,
+  runner: 1.1,
+  mcp_session: 1.2
+});
+var CADENCE_MULTIPLIERS = Object.freeze({
+  daily: 0.8,
+  weekly: 1,
+  monthly: 1.25,
+  quarterly: 1.5
+});
+var CADENCE_BASE_RESERVES = Object.freeze({
+  daily: 25,
+  weekly: 50,
+  monthly: 100,
+  quarterly: 200
+});
+var TOOL_COST_HINT_CENTS = Object.freeze({
+  included: 0,
+  metered_low: 25,
+  metered_standard: 100,
+  metered_high: 250
+});
+var trustedBudgetCharterBudgetSchema = external_exports.object({
+  monthly_usd: external_exports.number().nonnegative().nullable(),
+  approval_required_over_usd: external_exports.number().nonnegative().nullable()
+}).strict();
+var trustedBudgetInputSchema = external_exports.object({
+  lane: external_exports.enum(["cloud", "runner", "mcp_session"]),
+  model: external_exports.string().trim().min(1).max(120),
+  cadence: external_exports.enum(["daily", "weekly", "monthly", "quarterly"]),
+  expected_turns: external_exports.number().int().positive().max(1e4),
+  tool_cost_hints: external_exports.array(external_exports.string().trim().min(1).max(120)).default([]),
+  charter_budget: trustedBudgetCharterBudgetSchema.optional()
+}).strict();
+var trustedBudgetSuggestionSchema = external_exports.object({
+  budget_cents: external_exports.number().int().nonnegative(),
+  money_authority_cents: external_exports.number().int().nonnegative(),
+  assumptions: external_exports.array(external_exports.string().min(1)).min(1),
+  formula_version: external_exports.literal(TRUSTED_BUDGET_FORMULA_VERSION)
+}).strict();
+
 // ../../packages/protocol/src/eos-intelligence.ts
 var uuid3 = external_exports.string().uuid();
 var frictionSeveritySchema = external_exports.enum(["low", "med", "high", "critical"]);
@@ -42965,6 +43231,101 @@ var errorLogSupersedeOutputSchema = external_exports.object({
   resolved_at: isoDateTime3
 }).strict();
 
+// ../../packages/protocol/src/working-files.ts
+var WORKING_FILE_MAX_PATH_CHARS = 512;
+var WORKING_FILE_MAX_CONTENT_CHARS = 16384;
+var isoDateTime4 = external_exports.string().datetime({ offset: true });
+var workingFileContentTypeSchema = external_exports.enum([
+  "text/plain",
+  "text/markdown",
+  "application/json",
+  "text/csv",
+  "text/yaml",
+  "application/yaml",
+  "text/x-typescript",
+  "text/typescript",
+  "text/javascript",
+  "application/javascript"
+]);
+var workingFileStateSchema = external_exports.enum(["ephemeral", "published"]);
+var workingFileRetentionClassSchema = external_exports.enum(["ephemeral_7d", "published_90d"]);
+function normalizeWorkingFilePath(value) {
+  return value.trim().replace(/\\/g, "/");
+}
+function isSafeWorkingFilePath(value) {
+  if (value.includes("\\")) {
+    return false;
+  }
+  const normalized = normalizeWorkingFilePath(value);
+  if (normalized.length === 0 || normalized.length > WORKING_FILE_MAX_PATH_CHARS) {
+    return false;
+  }
+  if (normalized.startsWith("/") || normalized.startsWith("./") || normalized.startsWith("../")) {
+    return false;
+  }
+  if (normalized.includes("\0") || normalized.includes("//")) {
+    return false;
+  }
+  const segments = normalized.split("/");
+  return segments.every((segment) => segment.length > 0 && segment !== "." && segment !== "..");
+}
+var workingFilePathSchema = external_exports.string().trim().min(1).max(WORKING_FILE_MAX_PATH_CHARS).refine(isSafeWorkingFilePath, "Working file paths must be tenant-local relative paths without traversal segments");
+var workingFileCreateInputSchema = external_exports.object({
+  path: workingFilePathSchema,
+  content_type: workingFileContentTypeSchema,
+  content: external_exports.string().min(1).max(WORKING_FILE_MAX_CONTENT_CHARS)
+}).strict();
+var workingFileReadInputSchema = external_exports.object({
+  path: workingFilePathSchema
+}).strict();
+var workingFileListInputSchema = external_exports.object({
+  state: workingFileStateSchema.optional()
+}).strict();
+var workingFilePublishInputSchema = external_exports.object({
+  path: workingFilePathSchema
+}).strict();
+var workingFilesReadToolInputSchema = external_exports.discriminatedUnion("operation", [
+  external_exports.object({
+    operation: external_exports.literal("read"),
+    path: workingFilePathSchema
+  }).strict(),
+  external_exports.object({
+    operation: external_exports.literal("list"),
+    state: workingFileStateSchema.optional()
+  }).strict()
+]);
+var workingFilesWriteToolInputSchema = external_exports.discriminatedUnion("operation", [
+  external_exports.object({
+    operation: external_exports.literal("create"),
+    path: workingFilePathSchema,
+    content_type: workingFileContentTypeSchema,
+    content: external_exports.string().min(1).max(WORKING_FILE_MAX_CONTENT_CHARS)
+  }).strict(),
+  external_exports.object({
+    operation: external_exports.literal("publish"),
+    path: workingFilePathSchema
+  }).strict()
+]);
+var workingFileSummarySchema = external_exports.object({
+  file_ref: external_exports.string().min(1),
+  path: workingFilePathSchema,
+  state: workingFileStateSchema,
+  content_type: workingFileContentTypeSchema,
+  content_chars: external_exports.number().int().nonnegative(),
+  published_ref: external_exports.string().min(1).nullable(),
+  published_at: isoDateTime4.nullable(),
+  expires_at: isoDateTime4,
+  created_at: isoDateTime4,
+  updated_at: isoDateTime4
+}).strict();
+var workingFileReadResultSchema = workingFileSummarySchema.extend({
+  content: external_exports.string(),
+  content_truncated: external_exports.boolean()
+}).strict();
+var workingFilesListOutputSchema = external_exports.object({
+  files: external_exports.array(workingFileSummarySchema)
+}).strict();
+
 // ../../packages/protocol/src/run-summary.ts
 var runSummaryOutputSchema = external_exports.object({
   summary: external_exports.string().min(1).max(140)
@@ -42972,7 +43333,7 @@ var runSummaryOutputSchema = external_exports.object({
 
 // ../../packages/protocol/src/runner-settings.ts
 var uuid8 = external_exports.string().uuid();
-var isoDateTime4 = external_exports.string().datetime({ offset: true });
+var isoDateTime5 = external_exports.string().datetime({ offset: true });
 var runnerHealthSchema = external_exports.enum(["online", "stale", "offline", "revoked", "unpaired"]);
 var runnerExecutionStateSchema = external_exports.enum([
   "ready",
@@ -42992,8 +43353,8 @@ var runnerExecutionReadinessSchema = external_exports.object({
   due_queued_work_orders: external_exports.number().int().nonnegative(),
   claimed_work_orders: external_exports.number().int().nonnegative(),
   running_work_orders: external_exports.number().int().nonnegative(),
-  recent_completed_at: isoDateTime4.nullable(),
-  recent_failed_at: isoDateTime4.nullable()
+  recent_completed_at: isoDateTime5.nullable(),
+  recent_failed_at: isoDateTime5.nullable()
 }).strict();
 var runnerSandboxPostureSchema = external_exports.enum(["guard", "strict", "off", "none", "unknown"]);
 var runnerPostureSchema = external_exports.object({
@@ -43010,10 +43371,10 @@ var runnerSummarySchema = external_exports.object({
   cli_version: external_exports.string().nullable(),
   posture: runnerPostureSchema,
   execution: runnerExecutionReadinessSchema,
-  paired_at: isoDateTime4.nullable(),
-  last_heartbeat_at: isoDateTime4.nullable(),
-  revoked_at: isoDateTime4.nullable(),
-  created_at: isoDateTime4
+  paired_at: isoDateTime5.nullable(),
+  last_heartbeat_at: isoDateTime5.nullable(),
+  revoked_at: isoDateTime5.nullable(),
+  created_at: isoDateTime5
 }).strict();
 var runnerListInputSchema = external_exports.object({
   include_revoked: external_exports.boolean().optional()
@@ -43032,7 +43393,7 @@ var runnerPairingStartOutputSchema = external_exports.object({
   pairing_session_id: uuid8,
   user_code: external_exports.string(),
   verification_uri: external_exports.string(),
-  expires_at: isoDateTime4,
+  expires_at: isoDateTime5,
   expires_in: external_exports.number().int().nonnegative()
 }).strict();
 var runnerRevokeInputSchema = external_exports.object({
@@ -43050,9 +43411,9 @@ var workOrderSummarySchema = external_exports.object({
   lane: external_exports.enum(["cloud", "runner"]),
   status: workOrderStatusSchema,
   claimed_by_runner_id: uuid8.nullable(),
-  scheduled_for: isoDateTime4,
-  grace_deadline: isoDateTime4,
-  created_at: isoDateTime4
+  scheduled_for: isoDateTime5,
+  grace_deadline: isoDateTime5,
+  created_at: isoDateTime5
 }).strict();
 var workOrderListInputSchema = external_exports.object({
   status: workOrderStatusSchema.optional(),
@@ -43065,7 +43426,7 @@ var workOrderListOutputSchema = external_exports.object({
 }).strict();
 var workOrderEnqueueInputSchema = external_exports.object({
   agent_id: uuid8,
-  scheduled_for: isoDateTime4.optional(),
+  scheduled_for: isoDateTime5.optional(),
   task_id: uuid8.optional()
 }).strict();
 var agentRunNowInputSchema = external_exports.object({
@@ -43092,8 +43453,8 @@ var runnerDiagnoseOutputSchema = external_exports.object({
   platform: external_exports.string(),
   health: runnerHealthSchema,
   capabilities: runnerCapabilityDetailSchema,
-  last_heartbeat_at: isoDateTime4.nullable(),
-  paired_at: isoDateTime4.nullable(),
+  last_heartbeat_at: isoDateTime5.nullable(),
+  paired_at: isoDateTime5.nullable(),
   revocation_state: external_exports.enum(["active", "revoked", "unpaired"]),
   repair_guidance: external_exports.array(external_exports.object({
     action: external_exports.string(),
@@ -43154,7 +43515,7 @@ var notificationErrorSummarySchema = external_exports.object({
   source: external_exports.enum(["run", "llm", "tool", "mcp", "runner", "integration", "job", "web"]).nullable(),
   seat_id: uuid8.nullable(),
   run_id: uuid8.nullable(),
-  created_at: isoDateTime4
+  created_at: isoDateTime5
 }).strict();
 var notificationListErrorsOutputSchema = external_exports.object({
   errors: external_exports.array(notificationErrorSummarySchema)
@@ -43271,7 +43632,7 @@ var integrationSummarySchema = external_exports.object({
   id: uuid8,
   provider: external_exports.string(),
   status: external_exports.enum(["connected", "error", "disconnected"]),
-  last_synced_at: isoDateTime4.nullable()
+  last_synced_at: isoDateTime5.nullable()
 }).strict();
 var settingsGetInputSchema = external_exports.object({}).strict();
 var settingsGetOutputSchema = external_exports.object({
@@ -43307,7 +43668,7 @@ var tenantRenameOutputSchema = external_exports.object({
 
 // ../../packages/protocol/src/system-health.ts
 var uuidSchema14 = external_exports.string().uuid();
-var isoDateTime5 = external_exports.string().datetime({ offset: true });
+var isoDateTime6 = external_exports.string().datetime({ offset: true });
 var systemHealthCallerKindSchema = external_exports.enum(["tenant_admin", "member", "seat_token"]);
 var systemHealthCallerSchema = external_exports.object({
   kind: systemHealthCallerKindSchema,
@@ -43397,7 +43758,7 @@ var systemHealthConnectivitySectionSchema = external_exports.object({
   failed_notification_count: external_exports.number().int().nonnegative()
 }).strict();
 var systemHealthSyncSectionSchema = external_exports.object({
-  latest_brief_at: isoDateTime5.nullable(),
+  latest_brief_at: isoDateTime6.nullable(),
   missing_latest_brief: external_exports.boolean(),
   flagged_gap_count: external_exports.number().int().nonnegative()
 }).strict();
@@ -43417,7 +43778,7 @@ var systemHealthCheckInputSchema = systemHealthInputSchema.extend({
   caller: systemHealthCallerSchema
 }).strict();
 var systemHealthOutputSchema = external_exports.object({
-  generated_at: isoDateTime5,
+  generated_at: isoDateTime6,
   scope: systemHealthScopeSchema,
   verdict: systemHealthVerdictSchema,
   top_actions: external_exports.array(systemHealthActionSchema),
@@ -45020,16 +45381,16 @@ var syncBriefSchema = external_exports.object({
 }).strict();
 
 // ../../packages/protocol/src/usage.ts
-var isoDateTime6 = external_exports.string().datetime({ offset: true });
+var isoDateTime7 = external_exports.string().datetime({ offset: true });
 var periodKeySchema = external_exports.string().regex(/^\d{4}-\d{2}-\d{2}$/);
 var countSchema = external_exports.number().int().nonnegative();
 var usdSchema = external_exports.string();
 var bigCountSchema = external_exports.string();
 var usagePeriodSchema = external_exports.object({
   period: periodKeySchema,
-  period_start: isoDateTime6,
-  period_end: isoDateTime6,
-  captured_at: isoDateTime6,
+  period_start: isoDateTime7,
+  period_end: isoDateTime7,
+  captured_at: isoDateTime7,
   run_count: countSchema,
   agent_count: countSchema,
   succeeded_run_count: countSchema,
@@ -45081,7 +45442,7 @@ var usageSnapshotInputSchema = external_exports.object({
   // current month. Normalized to the first of that month server-side.
   period: external_exports.union([
     external_exports.string().regex(/^\d{4}-\d{2}-\d{2}$/),
-    isoDateTime6
+    isoDateTime7
   ]).optional()
 }).strict();
 var usageSnapshotOutputSchema = external_exports.object({
@@ -46677,7 +47038,7 @@ There is exactly one way to give a connected tool its credential, and it is the
     order: 47,
     title: "Available tools guide",
     summary: "How to think about tool categories available to seats and what each category should be used for.",
-    version: "2026-07-13.1",
+    version: "2026-07-13.3",
     public: true,
     audiences: ["human", "cli", "mcp", "in_app_agent"],
     stages: ["staffing"],
@@ -46715,7 +47076,7 @@ Start from the seat's responsibility, not the tool list. If a tool does not dire
 
 Skills are reusable procedures a seat can learn from; they are not tools and they never grant authority. A skill package may declare required or optional tool dependencies so setup can identify blockers before assignment. Those dependencies are checked against the discoverable \`tool.catalog\` ids, scope tiers, and provider-neutral access levels, then compared to the seat's Charter permission manifest. Missing required tools block approval; optional tools produce setup warnings. A published skill version is immutable, so later corrections create a new version instead of rewriting what a run may have used.
 
-The catalog covers both the platform verbs (status, escalation, Signal readings) and the business tools the stock-agent templates grant \u2014 accounts-payable and receivable reads, AP-inbox and collections drafts, helpdesk triage, CRM reads, and content-calendar, release-artifact, and issue drafts. Each is listed with a conservative scope tier (read for the reads, draft for the drafts, where a draft never sends), a provider-neutral access level, a provider requirement, cost class, lane support, and any Trusted-mode metadata that must be present before a standing authorization can apply. Business tools are credential-gated. Because a skill's required tool id is matched against these ids, a skill that requires one of them resolves against the catalog rather than reporting an unknown tool. Catalog membership is configuration only: it still confers no authority, and a listed id runs only once a live handler exists behind the seat's signed permission manifest, the server guard, and any required credential \u2014 the manifest and guard remain the control plane. Unknown tool ids or unsupported access levels fail closed.
+The catalog covers both the platform verbs (status, escalation, Signal readings) and the business tools the stock-agent templates grant \u2014 accounts-payable and receivable reads, AP-inbox and collections drafts, helpdesk triage, CRM reads, web search, public-page fetch, browser read, working files, script execution, content-calendar, release-artifact, and issue drafts. Each is listed with a conservative scope tier (read for the reads, draft for the drafts and action-capable internal workbench tools), a provider-neutral access level, a provider requirement, cost class, lane support, and any Trusted-mode metadata that must be present before a standing authorization can apply. Business tools are credential-gated unless they are {{brand}}-managed generic workbench tools. Because a skill's required tool id is matched against these ids, a skill that requires one of them resolves against the catalog rather than reporting an unknown tool. Catalog membership is configuration only: it still confers no authority, and a listed id runs only once a live handler exists behind the seat's signed permission manifest, the server guard, and any required credential \u2014 the manifest and guard remain the control plane. Unknown tool ids or unsupported access levels fail closed.
 
 ## How agents should request tools
 
@@ -46725,14 +47086,14 @@ Agents should explain the job, the required tool category, the minimum permissio
 
 Every tool call passes the server-side guard first: the guard checks the call against the seat's signed permission manifest and records a tool-call audit row for **every** call \u2014 allowed, denied, or escalated. Tool selection is never authorization. An explicitly declined manifest entry is enforced as denied, even when the tool exists and the client asks for it. Only an allowed call reaches its handler. A connected credential is bound into the handler for the duration of the call only; the secret never appears in the result, the audit summary, logs, or the model's context.
 
-External connectors are being rolled out provider by provider, conservatively (read and draft before send; write behind approval). A selected tool is only a permission until a live handler exists and the seat has the required credential or binding. Today the built-in execution path supports internal status reporting, the generic REST GET connector when a signed host/path allowlist and credential exist, \`slack.post_message\` for a bound Slack channel, and Google handlers for \`gmail.read\`, \`gmail.draft\`, \`sheets.read\`, and approval-held \`sheets.write\` when Google is connected. \`gmail.send\` remains held for approval and live external send stays gated on Google verification. Before that verification is complete, partner demos should show sandbox dry runs, setup previews, and approval-held examples rather than claim production Google readiness. Other provider entries remain configuration-only until their connector ships, so nothing runs silently.`
+External connectors are being rolled out provider by provider, conservatively (read and draft before send; write behind approval). A selected tool is only a permission until a live handler exists and the seat has the required credential or binding. Today the built-in execution path supports internal status reporting, the generic REST GET connector when a signed host/path allowlist and credential exist, \`slack.post_message\` for a bound Slack channel, Google handlers for \`gmail.read\`, \`gmail.draft\`, \`sheets.read\`, and approval-held \`sheets.write\` when Google is connected, plus the governed workbench tools \`web.search\`, \`web.fetch\`, \`browser.read\`, \`files.read\`, \`files.write\`, and \`script.run\`. \`web.search\` uses a server-side Exa provider and returns normalized cited results without exposing provider keys. \`web.fetch\` reads one public HTTPS page only after scheme, DNS/IP, redirect, content-type, size, and timeout checks pass. \`browser.read\` opens an ephemeral read-only public-network browser session for navigation, inspection, screenshot, or extraction; it does not submit forms, persist authenticated state, execute downloads, or expose cross-tenant artifacts. \`files.read\` and \`files.write\` operate on bounded tenant-scoped working files and published \`rost://working-files/<id>\` references; they reject traversal, cap text payloads, retain ephemeral files briefly, and never execute file contents. \`script.run\` is compute-only and network-denied by default, but arbitrary code execution is action-capable, so read-only posture does not grant it; it still requires the \`agent.script_run\` entitlement and returns size-capped output. \`gmail.send\` remains held for approval and live external send stays gated on Google verification. Before that verification is complete, partner demos should show sandbox dry runs, setup previews, and approval-held examples rather than claim production Google readiness. Other provider entries remain configuration-only until their connector ships, so nothing runs silently.`
   },
   {
     slug: "mcp-and-cli-guide",
     order: 48,
     title: "CLI and MCP installation guide",
     summary: "Install the public CLI, register remote token-backed MCP clients, and find the full command and tool catalog.",
-    version: "2026-07-13.2",
+    version: "2026-07-13.4",
     public: true,
     audiences: ["human", "cli", "mcp", "in_app_agent"],
     stages: ["company_setup", "staffing"],
@@ -46833,6 +47194,10 @@ The MCP server is remote and token-backed. There is no local MCP daemon to insta
 
 AICOS MCP mode is deliberately seat-scoped. In Settings, the AICOS panel can create a token for the canonical AI Chief of Staff seat and then marks MCP selectable only while a non-revoked, unexpired AICOS seat token exists. Do not use a tenant-admin MCP token to staff or test AICOS; it should operate as its own governed seat, with the web panel remaining the readiness monitor and transcript surface.
 
+MCP clients may also expose their own native browser, search, file, or shell tools. Those native client actions are outside {{brand}} receipts, cost accounting, and audit. Treat them as ungoverned scratch work until the source is fetched or recorded through a {{brand}} MCP tool such as \`web.fetch\`, \`web.search\`, \`browser.read\`, a work-log evidence call, or another governed command. Only the {{brand}} tool call creates the permission receipt and evidence record.
+
+Managed Runner turns use a generated {{brand}} MCP configuration instead of the operator's local MCP/client config. Ordinary business-agent runner turns are MCP-only, run in a read-only sandbox, and do not receive local provider keys such as Exa or browser-provider credentials. Codex runner turns ignore user config/rules, run ephemerally, and disable native search, browser, and computer-use features; Forge developer profiles keep their separate local-code workspace behavior.
+
 ## Prerequisite: a human approver in a browser
 
 A headless agent cannot complete setup unattended. Two things always require a human, so plan to announce the handoff rather than stall silently:
@@ -47202,6 +47567,7 @@ The signed-in app exposes the same Skill command surface at **Skills**, linked f
 | \`{{cli}} command tenant.model_gateway_policy.update\` | \`tenant.model_gateway_policy.update\` | Unlock or relock managed models that lack a zero-retention (ZDR) tier (ADR-0019). Locked (default) restricts the AI Gateway to zero-retention-eligible managed models. Owner-only and human-gated; unlocking establishes an ADR-0018 \xA76 standing authorization and surfaces a per-model retention disclosure. | Tenant-admin | \`{{cli}} command tenant.model_gateway_policy.update --json '{"allow_non_zdr_models":true}'\` |
 | \`{{cli}} member invite|update|remove\` | \`member.invite\`, \`member.update\`, \`member.remove\` | Manage tenant members; execution requires an owner or admin membership. | Tenant | \`{{cli}} member invite --email ops@example.com --role member\` |
 | \`{{cli}} agent templates|create|setup|tools|dry-run|go-live|status|run-now|fleet-digest|get-run|show\` | \`agent_template.list\`, \`agent.create_from_template\`, \`agent.create_custom\`, \`agent_setup.get\`, \`agent_setup.update\`, \`agent.configure_tools\`, \`agent.run_dry_run\`, \`agent.go_live\`, \`agent.status\`, \`agent.run_now\`, \`agent.fleet_digest\`, \`agent.get_run\`, \`agent.show_markdown\` | Run the full agent setup and operation flow: list templates, create a draft from a template or guided custom answers (with \`--model\` and \`--effort\`), read or answer setup state, connect or decline tools, dry-run, go live, run on demand, capture the fleet-health digest, read one run's transcript/error diagnostics, and show a markdown readout. Human CLI dry-runs print the rehearsal transcript and, when present, the per-tool preview labels (\`Would run\`, \`Blocked\`, \`Escalated\`) before go-live. Create and go-live stop at human gates; the dry-run is ungated by human approval but requires a signed manifest first. | Tenant and seat | \`{{cli}} agent fleet-digest --json\` |
+| \`{{cli}} command agent.activation_receipt|agent.activation_sign|agent.trust.*\` | \`agent.activation_receipt\`, \`agent.activation_sign\`, \`agent.trust.create\`, \`agent.trust.inspect\`, \`agent.trust.revoke\`, \`agent.trust.expire\`, \`agent.trust.supersede\` | Build a secret-free activation receipt, sign the exact current digest, and create/inspect/revoke/expire/supersede bounded Trusted execution grants. Receipt and inspect are reads; sign and grant lifecycle writes are human steward/admin only and refuse stale receipt digests. | Seat read; tenant write | \`{{cli}} command agent.activation_receipt --json '{"agent_id":"<agent-id>"}'\`; \`{{cli}} command agent.trust.create --json '{"agent_id":"<agent-id>","expected_scope_digest":"sha256:...","budget_cents":2500}'\` |
 | \`{{cli}} tools list\` | \`tool.catalog\` | List the discoverable tool catalog the builder reads (id, scope tiers, access levels, provider requirement, cost class, lane support, credential requirement, access policy, Trusted metadata, and execution-boundary guidance). | Tenant | \`{{cli}} tools list --json\` |
 | \`{{cli}} skills list|get|file|assigned|check-dependencies\` | \`skill.list\`, \`skill.get\`, \`skill.file.get\`, \`skill.assigned.list\`, \`skill.check_dependencies\` | Discover reusable Skills, read descriptors and stored package files, list approved Seat assignments, and compare required/optional tool dependencies with a Seat's signed Charter manifest. Skills are instructions, not authority. | Tenant-admin; seat-scoped reads for assigned Skills | \`{{cli}} skills list --json\`; \`{{cli}} skills file --slug invoice-review --path SKILL.md\` |
 | \`{{cli}} skills catalog|enable|install|sync\` | \`skill.catalog\`, \`skill.enable_catalog\`, \`skill.install_local\`, \`skill.sync_local\` | Discover entitled {{brand}} catalog Skills, enable a catalog Skill into the company library with human confirmation, and install or sync approved Skill files locally from {{brand}} APIs. Private catalog source URLs and GitHub tokens never go to local agents. | Tenant-admin for catalog enablement; seat-scoped sync for assigned Skills | \`{{cli}} skills sync --seat-id <id> --client codex\`; \`{{cli}} skills install rost/ap-review --seat-id <id> --client codex\` |
@@ -47444,6 +47810,13 @@ Several rows here are seat-operating commands (\`task.create\`, the \`signal.*\`
 | \`rost_list_tenant_capability_grants\` | \`tool_grants.tenant.list\` | List tenant capability ceilings/defaults with connection, availability, source, and compile status. | Tenant | Call with \`{}\`; no secrets or vault refs. |
 | \`rost_list_agent_effective_capability_grants\` | \`tool_grants.agent.effective\` | Read one agent's effective capability grants after tenant ceilings, agent selections, and compile availability are applied. | Tenant | Call with \`{"agent_id":"<agent-id>"}\`. |
 | \`rost_update_agent_capability_grants\` | \`tool_grants.agent.update\` | Compile a Charter supersession proposal for agent capability grant reductions or expansions. | Tenant | Human steward/admin only; call with \`{"agent_id":"<agent-id>","grants":[{"tool_grant_id":"<grant-id>","access_level":"read"}]}\`; active authority changes only after the signed Charter is superseded. |
+| \`rost_build_agent_activation_receipt\` | \`agent.activation_receipt\` | Build the current activation receipt for an agent: capabilities, connection metadata, digest, budget, and always-human boundary. | Seat or tenant-admin | Call with \`{"agent_id":"<agent-id>"}\`; rebuild after Charter, connection, lane, schedule, or grant changes. |
+| \`rost_sign_agent_activation_receipt\` | \`agent.activation_sign\` | Human steward/admin sign-off for the exact activation receipt digest. | Tenant | Human-gated; call with \`{"agent_id":"<agent-id>","expected_scope_digest":"sha256:...","budget_cents":2500}\`. |
+| \`rost_create_agent_trusted_grant\` | \`agent.trust.create\` | Create a bounded Trusted execution grant for a live agent after receipt review. | Tenant | Human steward/admin only; call with \`{"agent_id":"<agent-id>","expected_scope_digest":"sha256:...","budget_cents":2500}\`. |
+| \`rost_inspect_agent_trusted_grants\` | \`agent.trust.inspect\` | Inspect active or historical Trusted grants for one agent. | Seat or tenant-admin | Call with \`{"agent_id":"<agent-id>","include_inactive":true}\`; metadata only. |
+| \`rost_revoke_agent_trusted_grant\` | \`agent.trust.revoke\` | Revoke an active Trusted grant while preserving history. | Tenant | Human steward/admin only; call with \`{"grant_id":"<grant-id>","reason":"..."}\`; non-interactive callers receive a confirmation handoff. |
+| \`rost_expire_agent_trusted_grants\` | \`agent.trust.expire\` | Mark overdue active Trusted grants expired and append audit events. | Tenant | Human steward/admin only; call with \`{"agent_id":"<agent-id>"}\`. |
+| \`rost_supersede_agent_trusted_grant\` | \`agent.trust.supersede\` | Replace the active Trusted grant with a fresh digest and budget. | Tenant | Human steward/admin only; call with \`{"agent_id":"<agent-id>","expected_scope_digest":"sha256:...","budget_cents":2500}\`. |
 | \`rost_suggest_setup_capability_grants\` | \`agent_setup.capability_suggestions\` | Suggest deterministic minimum capability grants from the current setup/template and tenant grant availability. | Tenant | Call with \`{"seat_id":"<seat-id>"}\` or \`{"setup_id":"<agent-id>"}\`; no model call and no mutation. |
 | \`rost_list_skills\` | \`skill.list\` | List tenant Skills with application descriptors, dependency metadata, source status, latest version, and assigned Seat count. Seat-scoped reads are available through \`rost://skills\`. | Tenant-admin | Call with \`{}\` or \`{"query":"invoice"}\`. |
 | \`rost_list_rost_skill_catalog\` | \`skill.catalog\` | List entitled {{brand}} catalog Skills. Private catalog source URLs and credentials stay server-side. | Tenant-admin | Call with \`{}\`; use \`{"include_unentitled":true}\` only to inspect tier availability. |
@@ -48422,7 +48795,7 @@ Stop before: approving a Charter, signing a manifest, connecting a tool or crede
     order: 71,
     title: "Billing and pricing guide",
     summary: "How {{brand}} packages company-wide access, Stripe billing, and governed-agent usage without per-human-seat pricing.",
-    version: "2026-07-02.5",
+    version: "2026-07-13.1",
     public: true,
     audiences: ["human", "cli", "mcp", "in_app_agent"],
     stages: ["company_setup", "staffing", "operating_rhythm"],
@@ -48478,6 +48851,14 @@ The first meter is billable-successful-agent-run based because the current platf
 
 Billable true-up is service-owned and runs after a period is closed. The tenant-facing \`usage.snapshot\` command is an ROI/reporting tool; an early current-period snapshot must not become, replace, or block the final billable close. The billing close records a separate \`billing_usage_true_ups\` row keyed by tenant and period with the source kind, included allowance, billable overage, status, and Stripe meter event identifier. A closed usage snapshot is preferred only when it was captured after the period ended; otherwise the service close uses a live rollup for that closed period so an early ROI snapshot cannot undercount the invoice true-up.
 
+## Launch credits and recovery access
+
+Eligible launch tenants can receive one configured launch credit for {{brand}}-managed variable costs. Managed LLM, Exa, browser, and sandbox costs are estimated before the provider call, reserved atomically against the active launch credit, and then settled to actual usage or released if the call does not complete. BYOK model calls do not draw down launch credit, but they still keep their ordinary audit and usage records.
+
+Launch-credit notifications are informational and idempotent: owners may see threshold, exhaustion, or expiry notices with recovery actions when the remaining credit drops or the credit approaches its expiry window.
+
+When an unsubscribed tenant's launch credit expires, {{brand}} enters a recovery-safe posture instead of deleting the workspace or letting agents continue spending. Billing, BYOK setup, export, cancel, and delete/recovery routes stay reachable so a human can restore or leave cleanly. Operational writes, schedules, cloud agent runs, and other cost-creating actions pause until the tenant has an active subscription or active launch credit again.
+
 ## Stripe boundary
 
 Stripe owns payment collection, payment methods, invoices, and hosted customer self-service.
@@ -49663,7 +50044,7 @@ This worked document **omits** \`unanswered_boundaries\` and \`seat_type_recomme
     order: 43,
     title: "Agent builder guide",
     summary: "The full agent setup sequence on the CLI/MCP path \u2014 seat, steward, job, boundaries, tools, credentials, model, schedule, dry-run, go-live \u2014 with the structured model config and access tiers.",
-    version: "2026-07-10.1",
+    version: "2026-07-13.1",
     public: true,
     audiences: ["cli", "mcp", "in_app_agent"],
     stages: ["staffing"],
@@ -49752,7 +50133,7 @@ Conservative by default: anything beyond read/draft defaults to \`always_ask\`.
 
 - **Finance clerk (AP/AR).** Tight read + draft scopes (\`ap.invoices.read\`, \`accounting.bills.draft_update\`); posting and payment escalate; measurables track drafted-on-time and discrepancies caught. Balanced model.
 - **Inbox / scheduling assistant.** \`gmail.read\` + draft + \`calendar.propose_hold\`; sends and confirmed meetings are approval-gated; sensitive messages escalate. Triage or balanced model.
-- **Research / SDR.** \`web.research\` + \`crm.contacts.draft_update\` (draft only); outreach and paid data escalate. Balanced model.
+- **Research / SDR.** \`web.search\` + \`crm.contacts.draft_update\` (draft only); outreach and paid data escalate. Balanced model.
 - **Reviewer / QA.** Read release artifacts + draft issues; release approval and production changes escalate. Complex model for judgment.
 
 ## The full JSON shape
@@ -50640,6 +51021,8 @@ var COMMAND_MANIFEST = [
   { "id": "agent_setup.start", "namespace": "agent_setup", "action": "start", "title": "Start agent setup", "description": "Start (or resume) a draft agent setup for a seat in template, custom, or existing mode.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "seat_id", "flag": "seat-id", "type": "string", "required": true }, { "name": "mode", "flag": "mode", "type": "enum", "required": true, "enumValues": ["template", "custom", "existing"] }, { "name": "template_slug", "flag": "template-slug", "type": "string", "required": false }], "hasComplexInput": false, "help": "Start a draft agent setup from a template, custom, or existing mode; the setup resumes from the draft agent and Charter, not a fresh start." },
   { "id": "agent_setup.update", "namespace": "agent_setup", "action": "update", "title": "Update agent setup", "description": "Update the draft agent's parent, steward, lane, schedule, operational answers, and tool decisions.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "seat_id", "flag": "seat-id", "type": "string", "required": true }, { "name": "parent_seat_id", "flag": "parent-seat-id", "type": "string", "required": false }, { "name": "steward_seat_id", "flag": "steward-seat-id", "type": "string", "required": false }, { "name": "lane", "flag": "lane", "type": "enum", "required": false, "enumValues": ["cloud", "mcp_session", "runner"] }, { "name": "schedule_cron", "flag": "schedule-cron", "type": "string", "required": false }, { "name": "answers", "flag": "answers", "type": "array", "required": false, "itemType": "string" }, { "name": "skill_discovery_enabled", "flag": "skill-discovery-enabled", "type": "boolean", "required": false }], "hasComplexInput": true, "help": "Update parent, steward, lane, schedule, answers, or tool decisions on the draft; steward and parent changes keep the no-orphan chain explicit." },
   { "id": "agent_template.list", "namespace": "agent_template", "action": "list", "title": "List agent templates", "description": "List stock agent templates and their responsibilities, default tools, and dry-run rehearsal.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [], "hasComplexInput": false, "help": "List stock agent templates and their default tools and safety boundaries before starting a template setup." },
+  { "id": "agent.activation_receipt", "namespace": "agent", "action": "activation_receipt", "title": "Build agent activation receipt", "description": "Read the compiled authority receipt for one agent: effective capabilities, connection metadata, stale-scope digest, budget, and always-human boundary.", "requiredScope": "seat", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "agent_id", "flag": "agent-id", "type": "string", "required": true }, { "name": "proposed_budget_cents", "flag": "proposed-budget-cents", "type": "integer", "required": false }], "hasComplexInput": false, "help": "Build the current compiled activation receipt before signing or creating a Trusted grant. Rebuild it after any Charter, capability, connection, schedule, or lane change." },
+  { "id": "agent.activation_sign", "namespace": "agent", "action": "activation_sign", "title": "Sign agent activation receipt", "description": "Human steward/admin activation sign-off for the current compiled receipt digest. Refuses stale receipts and records a human decision plus append-only event.", "requiredScope": "tenant", "confirmation": "human_required", "exposeOverMcp": true, "fields": [{ "name": "agent_id", "flag": "agent-id", "type": "string", "required": true }, { "name": "expected_scope_digest", "flag": "expected-scope-digest", "type": "string", "required": true }, { "name": "budget_cents", "flag": "budget-cents", "type": "integer", "required": true }, { "name": "reason", "flag": "reason", "type": "string", "required": false }], "hasComplexInput": false, "help": "Human steward/admin sign-off for the exact activation receipt digest. Agents can surface the pending confirmation but cannot sign their own authority." },
   { "id": "agent.configure_tools", "namespace": "agent", "action": "configure_tools", "title": "Configure agent tools", "description": "Save tool proposals, declines, and credential-ingress requests for a draft agent. Never stores or echoes secret material; vault refs only.", "requiredScope": "seat", "confirmation": "credential_flow", "exposeOverMcp": true, "fields": [{ "name": "seat_id", "flag": "seat-id", "type": "string", "required": true }], "hasComplexInput": true, "help": "Connect or decline proposed tools and stage credential-ingress requests; never place raw secrets here \u2014 secrets flow through vault-backed credential.ingress as vault refs only.", "example": { "seat_id": "0190aaaa-aaaa-7aaa-8aaa-aaaaaaaaaaaa", "tool_decisions": [{ "tool": "ap.invoices.read", "decision": "connect" }, { "tool": "email.draft", "decision": "connect" }] } },
   { "id": "agent.create_custom", "namespace": "agent", "action": "create_custom", "title": "Create custom agent", "description": "Create a draft custom agent shell and a draft Charter seed from operational answers (what it owns, success, never-do-alone, steward).", "requiredScope": "tenant", "confirmation": "human_required", "exposeOverMcp": true, "fields": [{ "name": "seat_id", "flag": "seat-id", "type": "string", "required": true }, { "name": "steward_seat_id", "flag": "steward-seat-id", "type": "string", "required": false }, { "name": "lane", "flag": "lane", "type": "enum", "required": false, "enumValues": ["cloud", "mcp_session", "runner"] }, { "name": "what_it_owns", "flag": "what-it-owns", "type": "string", "required": false }, { "name": "what_success_looks_like", "flag": "what-success-looks-like", "type": "string", "required": false }, { "name": "what_it_must_never_do_alone", "flag": "what-it-must-never-do-alone", "type": "string", "required": false }], "hasComplexInput": true, "help": "Create a draft custom agent from operational answers (what it owns, success, never-do-alone, steward); the Charter Builder owns the contract and go-live stays human-gated.", "example": { "seat_id": "0190aaaa-aaaa-7aaa-8aaa-aaaaaaaaaaaa", "steward_seat_id": "0190bbbb-bbbb-7bbb-8bbb-bbbbbbbbbbbb", "lane": "cloud", "what_it_owns": "Drafting AP invoice entries from inbound vendor emails for human review.", "what_success_looks_like": "Every inbound invoice is drafted within one business day with the correct GL coding.", "what_it_must_never_do_alone": "Never send payment or approve an invoice without a human sign-off." } },
   { "id": "agent.create_from_template", "namespace": "agent", "action": "create_from_template", "title": "Create agent from template", "description": "Create a draft stock agent and draft Charter from a stock template. Creates the agent occupancy only when a human steward chain resolves; the agent stays draft until a signed manifest, a passed dry run, and human go-live.", "requiredScope": "tenant", "confirmation": "human_required", "exposeOverMcp": true, "fields": [{ "name": "seat_id", "flag": "seat-id", "type": "string", "required": true }, { "name": "template_slug", "flag": "template-slug", "type": "string", "required": true }, { "name": "expected_template_version", "flag": "expected-template-version", "type": "string", "required": false }], "hasComplexInput": false, "help": "Create a draft stock agent and draft Charter from a template; the agent occupancy is created only when a human steward chain resolves, and the agent stays draft until a signed manifest, a passed dry run, and human go-live." },
@@ -50656,6 +51039,11 @@ var COMMAND_MANIFEST = [
   { "id": "agent.run_now", "namespace": "agent", "action": "run_now", "title": "Run agent now", "description": "Queue and dispatch an immediate work order for a live cloud or runner agent on a seat.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "seat_id", "flag": "seat-id", "type": "string", "required": true }, { "name": "task_id", "flag": "task-id", "type": "string", "required": false }], "hasComplexInput": false, "help": "Queue and dispatch an immediate live agent run without changing the agent's saved schedule." },
   { "id": "agent.show_markdown", "namespace": "agent", "action": "show_markdown", "title": "Show agent setup as markdown", "description": "Compose a seat's agent setup, steward, model, tools, and Charter into a clean, human-skimmable markdown card for review.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "seat_id", "flag": "seat-id", "type": "string", "required": true }], "hasComplexInput": false, "help": "Render a seat's agent setup, model, steward, tools, and Charter as a clean markdown card to show your human a quick review." },
   { "id": "agent.status", "namespace": "agent", "action": "status", "title": "Get agent status", "description": "Return the agent occupancy, lane, schedule, live/offline state, steward chain, dry-run result, and Runner availability for a seat.", "requiredScope": "seat", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "seat_id", "flag": "seat-id", "type": "string", "required": true }], "hasComplexInput": false, "help": "Check an agent's lane, live state, steward chain, dry-run result, and Runner availability before relying on it." },
+  { "id": "agent.trust.create", "namespace": "agent", "action": "trust.create", "title": "Create agent Trusted grant", "description": "Create a bounded Trusted execution grant for a live agent after a human steward/admin signs the current activation receipt digest.", "requiredScope": "tenant", "confirmation": "human_required", "exposeOverMcp": true, "fields": [{ "name": "agent_id", "flag": "agent-id", "type": "string", "required": true }, { "name": "expected_scope_digest", "flag": "expected-scope-digest", "type": "string", "required": true }, { "name": "budget_cents", "flag": "budget-cents", "type": "integer", "required": true }, { "name": "expires_at", "flag": "expires-at", "type": "string", "required": false }, { "name": "reason", "flag": "reason", "type": "string", "required": false }], "hasComplexInput": false, "help": "Create a bounded Trusted execution grant only after reviewing the activation receipt digest, budget, and always-human boundary. Human steward/admin only." },
+  { "id": "agent.trust.expire", "namespace": "agent", "action": "trust.expire", "title": "Expire agent Trusted grants", "description": "Human steward/admin maintenance command that marks overdue active Trusted grants expired and appends an event for each expired grant.", "requiredScope": "tenant", "confirmation": "human_required", "exposeOverMcp": true, "fields": [{ "name": "agent_id", "flag": "agent-id", "type": "string", "required": true }], "hasComplexInput": false, "help": "Mark overdue active Trusted grants expired and append audit events. Human steward/admin only." },
+  { "id": "agent.trust.inspect", "namespace": "agent", "action": "trust.inspect", "title": "Inspect agent Trusted grants", "description": "Read active or historical Trusted execution grants for one agent. Returns metadata only, never secrets.", "requiredScope": "seat", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "agent_id", "flag": "agent-id", "type": "string", "required": true }, { "name": "include_inactive", "flag": "include-inactive", "type": "boolean", "required": false }], "hasComplexInput": false, "help": "Inspect active or historical Trusted grants for one agent. Metadata only; no secrets or vault refs." },
+  { "id": "agent.trust.revoke", "namespace": "agent", "action": "trust.revoke", "title": "Revoke agent Trusted grant", "description": "Human steward/admin revocation for an active Trusted execution grant. Preserves the historical grant row and appends an event.", "requiredScope": "tenant", "confirmation": "human_required", "exposeOverMcp": true, "fields": [{ "name": "grant_id", "flag": "grant-id", "type": "string", "required": true }, { "name": "reason", "flag": "reason", "type": "string", "required": false }], "hasComplexInput": false, "help": "Revoke an active Trusted grant while preserving history. Human steward/admin only." },
+  { "id": "agent.trust.supersede", "namespace": "agent", "action": "trust.supersede", "title": "Supersede agent Trusted grant", "description": "Human steward/admin replacement for an active Trusted grant. Refuses stale receipt digests and links the new grant to the superseded grant.", "requiredScope": "tenant", "confirmation": "human_required", "exposeOverMcp": true, "fields": [{ "name": "agent_id", "flag": "agent-id", "type": "string", "required": true }, { "name": "expected_scope_digest", "flag": "expected-scope-digest", "type": "string", "required": true }, { "name": "budget_cents", "flag": "budget-cents", "type": "integer", "required": true }, { "name": "expires_at", "flag": "expires-at", "type": "string", "required": false }, { "name": "reason", "flag": "reason", "type": "string", "required": false }], "hasComplexInput": false, "help": "Replace the active Trusted grant with a fresh digest and budget. Rebuild the receipt first; stale digests are refused." },
   { "id": "agent.update_schedule", "namespace": "agent", "action": "update_schedule", "title": "Update agent schedule", "description": "Set or clear the scheduled execution cron for a draft or live agent on a seat.", "requiredScope": "tenant", "confirmation": "human_required", "exposeOverMcp": true, "fields": [{ "name": "seat_id", "flag": "seat-id", "type": "string", "required": true }, { "name": "schedule_cron", "flag": "schedule-cron", "type": "string", "required": true }], "hasComplexInput": false, "help": "Set or clear an agent's scheduled execution; a live scheduled agent must keep a steward chain resolving to a human." },
   { "id": "aicos.brain_settings.get", "namespace": "aicos", "action": "brain_settings.get", "title": "Get AICOS brain settings", "description": "Read the AICOS run lane and brain selection. Returns labels and enum settings only; no secrets or vault refs.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [], "hasComplexInput": false, "help": "Read the AICOS lane and brain selection labels without returning provider keys, vault refs, or runner secrets." },
   { "id": "aicos.brain_settings.update", "namespace": "aicos", "action": "brain_settings.update", "title": "Update AICOS brain settings", "description": "Update the AICOS lane and cloud/runner brain preferences. Owner-only and audited.", "requiredScope": "tenant_admin", "confirmation": "human_required", "exposeOverMcp": true, "fields": [{ "name": "lane", "flag": "lane", "type": "enum", "required": false, "enumValues": ["cloud", "runner", "mcp"] }, { "name": "cloud_brain", "flag": "cloud-brain", "type": "enum", "required": false, "enumValues": ["managed", "byok"] }, { "name": "runner_brain", "flag": "runner-brain", "type": "enum", "required": false, "enumValues": ["claude-cli", "codex-cli"] }, { "name": "cloud_model_slug", "flag": "cloud-model-slug", "type": "string", "required": false }], "hasComplexInput": false, "help": "Owner-only update for AICOS cloud managed/BYOK and runner Claude/Codex preferences; BYOK requires an active tenant Anthropic key." },
@@ -55358,6 +55746,20 @@ var RUNNER_AICOS_TURN_TOOLS = [
   "mcp__rost__rost_aicos_turn_load_context",
   "mcp__rost__rost_get_tasks"
 ];
+var CODEX_NATIVE_TOOL_ISOLATION_CONFIG_ARGS = [
+  "--config",
+  'web_search="disabled"',
+  "--config",
+  "features.browser_use=false",
+  "--config",
+  "features.in_app_browser=false",
+  "--config",
+  "features.browser_use_external=false",
+  "--config",
+  "features.browser_use_full_cdp_access=false",
+  "--config",
+  "features.computer_use=false"
+];
 var CLAUDE_WORKSPACE_WRITE_LOCAL_TOOLS = ["Read", "Write", "Edit", "Glob", "Grep", "Bash"];
 var CLAUDE_READ_LOCAL_TOOLS = ["Read", "Glob", "Grep"];
 var READ_STUB_TIMEOUT_MS = 18e4;
@@ -56124,7 +56526,8 @@ function resolveTurnPlan(input) {
       codexSandbox: "read-only",
       outputFormat: input.kind === "turn_execution" ? "json" : "text",
       repoDir: null,
-      timeoutMs: READ_STUB_TIMEOUT_MS
+      timeoutMs: READ_STUB_TIMEOUT_MS,
+      isolateCodexNativeTools: input.kind === "work_order"
     };
   }
   const execution = input.execution;
@@ -56142,7 +56545,8 @@ function resolveTurnPlan(input) {
     // Only a Forge workspace grants a repo cwd; a needs_repo contract with no prepared
     // workspace (broker/clone failed upstream) falls back to tmpdir rather than a bad cwd.
     repoDir: execution.needs_repo ? input.repoDir : null,
-    timeoutMs: resolveExecutionTimeoutMs(execution)
+    timeoutMs: resolveExecutionTimeoutMs(execution),
+    isolateCodexNativeTools: execution.profile === "seat_work"
   };
 }
 function buildTurnCommand(input) {
@@ -56159,7 +56563,13 @@ function buildTurnCommand(input) {
         plan.codexSandbox,
         // Skip the git-repo check only when the cwd is NOT a checkout (read stub in
         // tmpdir); a prepared Forge workspace IS a repo, so drop the flag there.
-        ...plan.repoDir === null ? ["--skip-git-repo-check"] : []
+        ...plan.repoDir === null ? ["--skip-git-repo-check"] : [],
+        ...plan.isolateCodexNativeTools ? [
+          "--ignore-user-config",
+          "--ignore-rules",
+          "--ephemeral",
+          ...CODEX_NATIVE_TOOL_ISOLATION_CONFIG_ARGS
+        ] : []
       ]
     };
   }