• Browser: untrusted presentation surface. It can create a request but cannot approve it.
• ONEVibe API: task coordinator and event authority; must authenticate users and minimize browser-visible data.
• Agent runtime: untrusted workload. It receives scoped capabilities, not ambient credentials.
• ONEComputer gateway: policy enforcement point for network, connector, package, and secret actions.
• OpenVTC/VTI Wallet: independent approval authority and private-key custody boundary.
• Evidence plane: append-only audit outside the mutable workload.

The Claude SDK runtime is unavailable until the server has a configured ONEVIBE_LITELLM_URL and ONEVIBE_LITELLM_API_KEY. ONEVibe exposes only a readiness boolean and a generic setup message to the browser; it never renders, stores in task evidence, or forwards the relay credential to a workspace except as a server-controlled, LiteLLM-compatible child-process configuration. A child SDK ANTHROPIC_BASE_URL must point to LiteLLM, never to a first-party Anthropic endpoint. In a hosted deployment, inject and rotate the relay credential with the platform secret manager, then restart the API process. Direct first-party Anthropic traffic is prohibited; the current adapter does not implement Anthropic Workload Identity Federation, so it must not claim federation-backed authentication.

• random server-generated task IDs;
• workspace path resolution checked against the configured root;
• no shell execution;
• no task/browser approval endpoint; the separate wallet namespace requires a server-held bearer credential;
• preview uses generated static files only;
• ordered events include previousHash and eventHash;
• runtime mode and non-production limitations are visible in the UI.
• local wallet decisions produce HMAC receipts for integration testing; each pending approval is bound to a SHA-256 digest of its task, action, expiry, and current evidence head, and that digest is carried into the receipt. The wallet secret is never serialized into task state or evidence. This is still not an OpenVTC asymmetric proof.
• pending local approval requests are reconciled as expired before task or wallet review when their deadline passes. Expiry appends immutable non-decision evidence and never creates a receipt, share, or browser approval path.
• both preview publication and creation of a read-only external share pass an explicit default-deny policy evaluation before a wallet request is created. The policy decision travels in the approval-request evidence; a browser cannot bypass or replace it.
• the separately authenticated wallet listing exposes only a bounded intent-review document (title, action, expiry, evidence head, and intent digest). It never exposes the browser session, raw prompt, sandbox handle, connector credential, or mutable workspace capability.
• ONEComputer mode executes Claude through the sandbox API, rejects unsafe artifact paths, and caps extraction at 100 files/10 MiB. One durable conversation owns one fenced development-sandbox lease across turns; another conversation cannot share it. Teardown is explicit through the server-only lifecycle API, and ambiguous create/delete outcomes remain fenced as unknown instead of risking duplicate allocation.
• The ONEComputer POC can inject a server-configured LiteLLM base URL, model alias, and key into the sandbox Claude process without projecting them into task evidence or browser state. The current exec API still transports that environment setup through the trusted ONEComputer control plane; production promotion requires short-lived scoped credentials and provider-native secret injection plus residue/log scanning.
• Theme diagnostics are metadata-only: the authenticated owner scope may see bounded tenant/event counts and the latest operation timestamp, but never raw theme JSON, actor identifiers, uploaded bytes, or package contents. Local SQLite diagnostics report theme persistence as unavailable rather than implying durable audit storage.
• Reference theme previews are exact-ID, checked-in fixtures only. ONEVIBE_TENANT_ID is ignored in production, returns non-persistent preview metadata, and cannot influence mutations, model routing, credentials, approvals, evidence, or sandbox policy.
• ONEComputer readiness performs a short server-side authenticated health probe with a 15-second cache. The browser sees only generic reachability; it never receives the configured endpoint, service token, project header, or provider error response. Direct sandbox task and schedule dispatch reject a provider that is known unreachable.
• Optional generated-project build validation is disabled by default and requires both ONEVIBE_SANDBOX_BUILD_VALIDATION=true and gateway attestation. It runs only inside the disposable sandbox; dependency lifecycle scripts are disabled during install, and a successful build may return a bounded (≤1 MiB) generated package-lock.json plus a browser-safe report. This is not treated as dependency-provenance or deployment proof.
• ONEComputer-mode Claude journals remain in the disposable sandbox. ONEVibe stores only bounded projections of tool and transcript events after redacting credential-like fields; the raw stream-json journal is excluded from artifact extraction.
• The managed sandbox journal is capped at 4 MiB and must write a terminal exit code. ONEVibe fails the task rather than ingesting an oversized or indeterminate journal; sandbox teardown remains the cancellation backstop.
• A ONEComputer sandbox is not presented as gateway-enforced unless ONECOMPUTER_GATEWAY_ENFORCED=true is explicitly configured after deployment verification.
• Visual-runtime capture is pull-only: ONEVibe requests a sandbox-owned headless X11 PNG over the authenticated service channel, stores the resulting frame as evidence, and proxies it to the browser. It does not expose VNC, X11, Chrome DevTools Protocol, or sandbox tokens to the browser.
• Browser automation is disabled by default. When explicitly enabled, it permits only a small Playwright MCP tool set inside a gateway-attested ONEComputer sandbox; the web client still has no browser-control, CDP, or session-cookie capability. Browser egress policy, credential behavior, and screenshot redaction require independent deployment attestation.
• Schedules are constrained to a 15-minute minimum and only dispatch ordinary task creation. They do not carry approval authority, bypass policy, or gain direct publication/connector credentials.
• Website references are user-supplied context, not server-side fetch instructions. Inputs are bounded and reject embedded userinfo and common secret query parameters; evidence records only origin/path while retaining the full reference in task storage for the user-authorized agent context.
• Task attachments are capped at four files/256 KiB each/1 MiB total, receive sanitized names, and are written only under the task inputs/ directory. Evidence records names, paths, MIME types, and sizes—not file bytes. Agents are instructed to treat them as untrusted input.

Before production, replace or verify:

1. local workspace with a disposable VM/microVM or approved ONEComputer sandbox;
2. unrestricted host networking with gateway-enforced default-deny egress;
3. local JSON persistence with authenticated database/object storage;
4. local bearer/HMAC wallet service with OpenVTC Trust Task delivery and asymmetric signed-proof verification;
5. unsigned local evidence with externally anchored OpenVTC evidence receipts;
6. unauthenticated local API with enterprise identity, tenant isolation, CSRF protection, rate limits, and authorization;
7. generic iframe preview with authenticated, non-indexed, time-limited isolated origins and strict Permissions Policy.
8. visual capture with an attested microVM image, a private/loopback-only display and CDP endpoint, redaction before durable evidence storage, per-tenant retention, and explicit policy over when screenshots may be collected.
9. asynchronous sandbox provisioning that persists an ID before long bootstrap work and supports idempotent cancellation/deletion. A caller must never lose the ability to clean up an ephemeral provider resource after a timeout or disconnect.
10. dependency review: the vulnerable nested esbuild copy in the Better Auth → Drizzle Kit toolchain is pinned to patched 0.25.12 through the reviewed npm override in package.json/package-lock.json. npm audit --omit=dev --audit-level=moderate returns zero findings, and CI enforces the same check. Revalidate the override whenever Drizzle Kit or Better Auth changes; do not run npm audit fix --force as a release action.