- Status: accepted for Task 6.5 evidence
- Date: 2026-09-09
- Owners: Eve computer-use, Security, host provisioning, Evaluation
- Scope: Phase 6 Task 6.5 only
Context#
Task 6.4 proved that the native Rust/N-API X11 path can observe and operate a known desktop fixture. It deliberately did not authorize a run. The agent loop still accepted a package-level step limit, trusted the current screenshot after planning, lacked exact app/window and effect authority, had no enforceable network or task-file confinement, and could accept the planning model's claim of completion.
Task 6.5 requires a fail-closed control plane around every native run. The control plane must be useful to later admission work without itself admitting the feature to Drawer or to member desktops.
Decision#
Every ComputerUseAgent.run call now requires a versioned
ComputerUseRunPolicy and owning-host ComputerUseRunControlHooks.
Construction fails when the hooks are absent. The policy binds one run to:
- exact application identifiers and
(application, OS window id, exact title)tuples; - an explicit set of native action types;
- canonical HTTP(S) origins, where an empty list denies all task network access;
- canonical absolute task-file read and write entries, with file versus directory semantics; and
- explicit step, action, per-minute action, minimum action interval, duration, total token, per-call output token, frame age, thinking-time, and interrupt latency ceilings.
The host must observe the real foreground target and attest independently enforced process confinement before the run preview is admitted. Attestations are bound to the run, policy digest, process, deadline, and exact effective allowlists. A logical-only attestation is invalid. The production agent forces a fresh native capture before every active action; a byte-level frame change or age violation refuses the action and returns only the newly governed frame for replanning. Target and focus are observed before and after each capture and again after any confirmation. The control layer never steals focus and has no API that changes it.
Run previews contain the complete authority and budgets. Observational runs do not require confirmation; interactive or externally effectful runs require an explicit actor-bound decision. Every external-side-effect action requires a new explicit decision, and destructive or irreversible actions require step-up. Preview sequence nonces and digests prevent reuse of a decision for an identical later action. Raw typed text is represented by its length and hash in the action preview and is not retained in control receipts.
An action admission binds an exact single-attempt executable primitive. The agent executes the returned action with retries disabled; retrying requires a new observation and admission rather than replaying native input behind one preview and one budget unit.
Action effects come from a trusted host resolver, never model text. The resolver must completely enumerate network origins and task-file reads/writes, which are checked again against policy before admission. Completion requires a fresh target-bound frame and a non-model verifier with named passing checks and valid evidence digests. A model's end-turn response alone cannot complete the run.
Cancellation aborts provider waits, capture/control waits, and the action executor's outward wait; no later action in a sequence is dispatched. The receipt measures acknowledgement against the per-run ceiling. A platform primitive already accepted by the operating system cannot be transactionally retracted, so hosts must keep individual native actions bounded and use the pre-dispatch checks.
Native evidence boundary#
The dated Task 6.5 fixture runs a new GTK3 target inside bubblewrap on a private, TCP-disabled Xvfb display. The target has a distinct network namespace, no task-network route, a separate mount namespace, a fixed read-only OS runtime, one read-only task input, and one writable task-output directory. Active target probes demonstrate network denial, an unmounted task-data read denial, read-only input and runtime writes, and the allowlisted output write. The OS runtime image is trusted substrate and not task-data authority.
A separate X11 observer reads _NET_WM_NAME, _NET_WM_PID, and
_NET_WM_WINDOW_ROLE and uses XGetInputFocus plus ancestry traversal. It
never calls a focus-changing API. The live fixture changes pixels after planning
to prove stale-frame refusal, maps a real focus-stealing GTK occluder to prove
no-action focus refusal, restores focus only after an explicit fixture operator
signal handled by the target, proves minimum-interval refusal and recovery,
executes the allowed paste/commit transaction through the production native
action executor, and verifies target-produced result hashes outside the planning
model. A separate blocked operation proves interrupt acknowledgement without
dispatching an action.
The retained receipt is pixel-free. It records policy and control digests, non-secret frame hashes, namespace identities, denial-probe outcomes, preview and confirmation facts, budget use, refusal codes, target-side result hashes, independent checks, source hashes, and complete cleanup.
Consequences and honest boundary#
Task 6.5 establishes the execution-control contract and one real Linux X11 runtime proof. Wayland portals, macOS TCC, Windows UIA/UIPI, physical displays, and member desktops remain unobserved. The task-file mount allowlists do not pretend that a process can run without reading a fixed operating-system image.
Native computer use remains unexposed in Drawer and unadmitted for members or leased work. Task 6.6 owns leased-work admission and the surrounding service gate. Task 6.7 owns diverse benchmark and failure breadth. Task 6.8 owns the cross-surface prompt-injection matrix. Phase 6 and G6/G10/G14 therefore remain open.