# ADR-0080: Eve native desktop per-run execution controls

- Status: accepted for Task 6.5 evidence
- Date: 2026-09-09
- Owners: Eve computer-use, Security, host provisioning, Evaluation
- Scope: Phase 6 Task 6.5 only

## Context

Task 6.4 proved that the native Rust/N-API X11 path can observe and operate a
known desktop fixture. It deliberately did not authorize a run. The agent loop
still accepted a package-level step limit, trusted the current screenshot after
planning, lacked exact app/window and effect authority, had no enforceable
network or task-file confinement, and could accept the planning model's claim of
completion.

Task 6.5 requires a fail-closed control plane around every native run. The
control plane must be useful to later admission work without itself admitting
the feature to Drawer or to member desktops.

## Decision

Every `ComputerUseAgent.run` call now requires a versioned
`ComputerUseRunPolicy` and owning-host `ComputerUseRunControlHooks`.
Construction fails when the hooks are absent. The policy binds one run to:

1. exact application identifiers and `(application, OS window id, exact title)`
   tuples;
2. an explicit set of native action types;
3. canonical HTTP(S) origins, where an empty list denies all task network
   access;
4. canonical absolute task-file read and write entries, with file versus
   directory semantics; and
5. explicit step, action, per-minute action, minimum action interval, duration,
   total token, per-call output token, frame age, thinking-time, and interrupt
   latency ceilings.

The host must observe the real foreground target and attest independently
enforced process confinement before the run preview is admitted. Attestations
are bound to the run, policy digest, process, deadline, and exact effective
allowlists. A logical-only attestation is invalid. The production agent forces a
fresh native capture before every active action; a byte-level frame change or
age violation refuses the action and returns only the newly governed frame for
replanning. Target and focus are observed before and after each capture and
again after any confirmation. The control layer never steals focus and has no
API that changes it.

Run previews contain the complete authority and budgets. Observational runs do
not require confirmation; interactive or externally effectful runs require an
explicit actor-bound decision. Every external-side-effect action requires a new
explicit decision, and destructive or irreversible actions require step-up.
Preview sequence nonces and digests prevent reuse of a decision for an identical
later action. Raw typed text is represented by its length and hash in the action
preview and is not retained in control receipts.

An action admission binds an exact single-attempt executable primitive. The
agent executes the returned action with retries disabled; retrying requires a
new observation and admission rather than replaying native input behind one
preview and one budget unit.

Action effects come from a trusted host resolver, never model text. The resolver
must completely enumerate network origins and task-file reads/writes, which are
checked again against policy before admission. Completion requires a fresh
target-bound frame and a non-model verifier with named passing checks and valid
evidence digests. A model's end-turn response alone cannot complete the run.

Cancellation aborts provider waits, capture/control waits, and the action
executor's outward wait; no later action in a sequence is dispatched. The
receipt measures acknowledgement against the per-run ceiling. A platform
primitive already accepted by the operating system cannot be transactionally
retracted, so hosts must keep individual native actions bounded and use the
pre-dispatch checks.

## Native evidence boundary

The dated Task 6.5 fixture runs a new GTK3 target inside bubblewrap on a
private, TCP-disabled Xvfb display. The target has a distinct network namespace,
no task-network route, a separate mount namespace, a fixed read-only OS runtime,
one read-only task input, and one writable task-output directory. Active target
probes demonstrate network denial, an unmounted task-data read denial, read-only
input and runtime writes, and the allowlisted output write. The OS runtime image
is trusted substrate and not task-data authority.

A separate X11 observer reads `_NET_WM_NAME`, `_NET_WM_PID`, and
`_NET_WM_WINDOW_ROLE` and uses `XGetInputFocus` plus ancestry traversal. It
never calls a focus-changing API. The live fixture changes pixels after planning
to prove stale-frame refusal, maps a real focus-stealing GTK occluder to prove
no-action focus refusal, restores focus only after an explicit fixture operator
signal handled by the target, proves minimum-interval refusal and recovery,
executes the allowed paste/commit transaction through the production native
action executor, and verifies target-produced result hashes outside the planning
model. A separate blocked operation proves interrupt acknowledgement without
dispatching an action.

The retained receipt is pixel-free. It records policy and control digests,
non-secret frame hashes, namespace identities, denial-probe outcomes, preview
and confirmation facts, budget use, refusal codes, target-side result hashes,
independent checks, source hashes, and complete cleanup.

## Consequences and honest boundary

Task 6.5 establishes the execution-control contract and one real Linux X11
runtime proof. Wayland portals, macOS TCC, Windows UIA/UIPI, physical displays,
and member desktops remain unobserved. The task-file mount allowlists do not
pretend that a process can run without reading a fixed operating-system image.

Native computer use remains unexposed in Drawer and unadmitted for members or
leased work. Task 6.6 owns leased-work admission and the surrounding service
gate. Task 6.7 owns diverse benchmark and failure breadth. Task 6.8 owns the
cross-surface prompt-injection matrix. Phase 6 and G6/G10/G14 therefore remain
open.