Add private zero-tool Agent Host automation profile

.debt-scan.json

@@ -9,6 +9,9 @@
     ".ignored"
   ],
   "publicAPI": [
+    "src/daemon/schemas/packages.js",
+    "src/daemon/schemas/secrets.js",
+    "src/daemon/schemas/tools.js",
     "packages/core/src/deps.js",
     "packages/core/src/index.js",
     "packages/core/src/installer.js",

docs/frontier-agent-hosts.md

@@ -60,6 +60,77 @@ core the CLI calls directly. Groups are projections over
 independent child launches, preserving each provider's native session and each
 launch's own workspace, events, diff, promotion, and discard lifecycle.
 
+## Private automation profile
+
+`private-automation-v1` is the narrow inference-only surface for approved
+private data such as email classification. It is deliberately separate from
+normal Agent Host launches:
+
+```bash
+private-input-producer | rudi agent launch codex \
+  --private-automation \
+  --model gpt-5.6-luna \
+  --output-schema ./classification.schema.json \
+  --timeout-ms 130000 \
+  --json
+
+private-input-producer | rudi agent launch claude \
+  --private-automation \
+  --model claude-sonnet-5 \
+  --output-schema ./classification.schema.json \
+  --timeout-ms 130000 \
+  --json
+```
+
+Do not put the private prompt in the producer's argv or shell history. The
+profile accepts the prompt only from non-TTY stdin, and the provider receives
+it only through child stdin. It requires a canonical configured model ID and a
+self-contained, closed JSON object schema. Model defaults, aliases, fallback
+models, prompt files, detach/resume/groups, workspace selection, images,
+permission overrides, and native passthrough argv are rejected.
+
+Each launch gets a fresh empty workspace with no write bits. Codex and Claude
+run without tools, MCP, browser, shell, project instructions, plugins, skills,
+or session persistence. The profile has a 165-second hard maximum (160 seconds
+by default), a 2-MiB raw provider-stream ceiling, and a 64-KiB final structured
+result ceiling. Provider stderr is suppressed, native session IDs are not
+stored, and launch artifacts receive only event/usage/status metadata. The one
+structured result is returned transiently on stdout to the invoking process
+only after the provider-specific exact-model contract succeeds. Codex is
+command-pinned with `-m`, ignores user configuration, exposes no fallback-model
+input in this profile, and rejects any contradictory model field if one appears
+in its JSONL stream; Codex JSONL does not otherwise echo the selected model.
+Claude must report terminal model usage containing only the requested exact
+model. Missing or different Claude model identity fails closed.
+
+Claude structured output is enforced by RUDI after the provider returns JSON.
+RUDI accepts either plain JSON or exactly one JSON Markdown fence, rejects any
+surrounding prose, and validates the parsed object against the caller's closed
+schema. The private profile deliberately does not pass Claude `--json-schema`,
+because that CLI surface materializes a provider `StructuredOutput` tool. The
+launcher disables all Claude tools and nonessential/auxiliary model traffic,
+pins classifier and subagent model variables to the requested model, and
+rejects terminal model-usage metadata unless it names only that exact model.
+Claude `thinking_tokens` progress and synthetic provider-control events are
+accepted only as closed, bounded shapes; their content, session identifiers,
+and token estimates are not persisted.
+
+Private use still requires an organization-approved provider/model egress
+contract and a synthetic no-tool launch for each exact installed provider and
+model. Use this same command with a fixed benign prompt and a closed probe
+schema while the empty workspace and metadata-only artifacts are inspected;
+flag/help discovery alone is not activation evidence. The profile never
+chooses a provider or model and never falls back to another one.
+
+Codex private automation currently requires Codex CLI `0.147.0` or newer. The
+launcher checks that version, executes an empty-stdin strict-config sentinel to
+prove the no-web configuration and `view_image` feature disable are accepted,
+verifies all named feature controls, and checks the required `exec` flags before
+it creates a workspace or delivers the real stdin. Claude is similarly
+capability-probed with an exact
+empty-stdin flag-parse sentinel after normal installation/authentication
+preflight.
+
 ## Install and update
 
 Claude and Antigravity use their vendors' native installers and update mechanisms. RUDI detects and registers those executables. Codex and Gemini CLI are RUDI-managed npm agents.

docs/swe-compliance/2026-08-08-private-automation-profile.md

@@ -0,0 +1,107 @@
+# Private Agent Host Automation Profile
+
+## Phase 0: Baseline And Manual Lookup
+
+- Status: complete.
+- Scope: add a provider-neutral, stdin-only, metadata-only Agent Host profile
+  for bounded private classification through exact Codex and Claude models.
+- Files inspected: `AGENTS.md`, Agent Host CLI inputs, launch/workspace/event
+  flow, provider builders/config, artifacts/store tests, and frontier-host docs.
+- Relevant SWE manual sections: F5 trust boundaries, F12 security testing, F13
+  agent security, G4 side effects, H1 artifact integrity, and Testing Doctrine.
+- Current risk: normal provider plans can place prompts in argv and persist
+  normalized content events; private email cannot use that path.
+- Exit criteria: exact provider/model, prompt, workspace, tool, output,
+  persistence, timeout, and failure invariants are explicit before code.
+
+## Phase 1: Scope Lock
+
+- Status: complete.
+- In scope: provider-neutral profile `private-automation-v1`; exact canonical
+  configured Codex or Claude model; prompt stdin; explicit JSON schema; empty read-only
+  workspace; no tools/MCP/browser/shell; ephemeral execution; one bounded
+  attempt; metadata-only artifacts; 165-second maximum, 2-MiB raw-stream and
+  64-KiB final-result ceilings; no fallback.
+- Non-goals: sessions/resume, detached/group work, writable workspaces, images,
+  arbitrary provider args, provider selection, business retries, or storing
+  prompts/model output.
+- External inputs: CLI flags, stdin bytes, schema file, provider JSONL, stderr,
+  user/provider configuration, and provider/model catalogs.
+- Failure behavior: reject conflicting flags before workspace/process creation;
+  fail on tool events, output overflow, model mismatch, unknown events carrying
+  content, unconfirmed termination, or metadata persistence failure.
+- Exit criteria: one behavior test demonstrates the existing argv/content
+  persistence path fails the private contract.
+
+## Phase 2: Red Tests
+
+- Status: complete.
+- Test: `src/__tests__/unit/agent-host-private-automation.test.js`.
+- Red command: `node --test src/__tests__/unit/agent-host-private-automation.test.js`.
+- Observed failure: `ERR_MODULE_NOT_FOUND` for
+  `src/agent-host/private-automation-profile.js`, before the guarded launch path
+  existed.
+
+## Phase 3: Implementation
+
+- Status: complete.
+- Allowed files: the scope-locked Agent Host CLI, inputs, launch, event stream,
+  provider common/Codex/Claude builders/config, focused test/docs, and tracked
+  `dist/index.cjs` build output.
+- Implemented: canonical model/schema profile validation; stdin-only provider
+  plans; empty launch-owned read-only workspace; explicit Codex and Claude
+  no-tool controls; environment allowlist; metadata-only event projection;
+  raw/final output bounds; safe errors; suppressed private stderr and session
+  identity; foreground-only command guard.
+
+## Phase 4: Green Tests And Refactor
+
+- Status: complete for focused and adjacent regression suites.
+- Focused result: 18/18 passing, including pre-egress provider capability
+  gating and argv/stdin/env/workspace/artifact/DB
+  isolation, malformed output, closed provider event types, Claude
+  missing/different observed model identity, contradictory Codex model fields,
+  tool events, process-group termination, raw/final overflow, exact single-fence
+  parsing, schema rejection, timeout, and forbidden command surfaces.
+- Adjacent result: 42/42 passing across Agent Host command, launch, provider,
+  provider-environment, workspace, and model suites.
+
+## Phase 5: Full Verification
+
+- Status: complete for source; compatible authenticated
+  live providers remain a deployment prerequisite.
+- Required: focused test, full `pnpm test`, `pnpm build`, reproducible dist
+  check, changed-file debt scan, package dry-run, argv/artifact/log privacy
+  smoke tests, and exact provider probes with synthetic data.
+- Completed evidence:
+  - full test: 633/633 passing on the clean CLI 1.10.15 lineage outside the
+    network-bind sandbox; the initial
+    sandboxed run had only the expected localhost `EPERM` smoke-test failure;
+  - build: passing; two builds produced identical SHA-256 hashes
+    (`dist/index.cjs` =
+    `1897563de9ed112628979edc49de9f2f8e3bb875a64262e40df8f2116773faeb`);
+  - package dry-run: six expected package entries only;
+  - RUDI debt scan, `pr-review` profile: zero findings;
+  - integrated synthetic privacy tests: prompt absent from provider argv,
+    environment, stderr, database, native session field, and artifacts;
+  - Codex 0.147.0: its official release binary accepts `view_image` as an
+    explicitly disabled feature in the empty-stdin strict-config sentinel. A
+    direct benign probe returned the requested closed JSON and emitted only a
+    fail-closed diagnostic that Code Mode was unavailable because its host was
+    disabled. The Luna lane stays disabled until that exact binary is installed
+    and the integrated RUDI live probe repeats that result;
+  - Claude 2.1.226: authenticated through the RUDI secret-mediated wrapper. A
+    benign live provider probe with tools empty, nonessential traffic disabled,
+    no fallback, simple prompt mode, and post-response schema validation
+    reported no tools and only `claude-sonnet-5` model usage. Its stream also
+    emits numeric-only `thinking_tokens` progress metadata, now closed-shape
+    allowlisted without persistence. The installed RUDI profile must repeat that
+    probe after this source is packaged.
+
+## Phase 6: Docs, Contracts, And Closure
+
+- Status: complete for source; live provider probe and deployment evidence are
+  still gated.
+- Definition of Done: private prompts appear only on stdin; launch artifacts
+  and operational logs remain metadata-only; exact model/no-tool/schema/output
+  contracts are enforced for both providers; rollback material is recorded.

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@learnrudi/cli",
-  "version": "1.10.12",
+  "version": "1.10.15",
   "packageManager": "pnpm@10.22.0",
   "description": "RUDI CLI - Install and manage local MCP stacks, runtimes, daemon lifecycle, and agent router integrations",
   "type": "module",
@@ -23,6 +23,7 @@
     "test": "node scripts/run-tests.js"
   },
   "dependencies": {
+    "ajv": "^8.17.1",
     "better-sqlite3": "^12.5.0"
   },
   "devDependencies": {