Add private zero-tool Agent Host automation profile

.debt-scan.json

@@ -9,6 +9,9 @@
     ".ignored"
   ],
   "publicAPI": [
+    "src/daemon/schemas/packages.js",
+    "src/daemon/schemas/secrets.js",
+    "src/daemon/schemas/tools.js",
     "packages/core/src/deps.js",
     "packages/core/src/index.js",
     "packages/core/src/installer.js",

docs/frontier-agent-hosts.md

@@ -60,6 +60,77 @@ core the CLI calls directly. Groups are projections over
 independent child launches, preserving each provider's native session and each
 launch's own workspace, events, diff, promotion, and discard lifecycle.
 
+## Private automation profile
+
+`private-automation-v1` is the narrow inference-only surface for approved
+private data such as email classification. It is deliberately separate from
+normal Agent Host launches:
+
+```bash
+private-input-producer | rudi agent launch codex \
+  --private-automation \
+  --model gpt-5.6-luna \
+  --output-schema ./classification.schema.json \
+  --timeout-ms 130000 \
+  --json
+
+private-input-producer | rudi agent launch claude \
+  --private-automation \
+  --model claude-sonnet-5 \
+  --output-schema ./classification.schema.json \
+  --timeout-ms 130000 \
+  --json
+```
+
+Do not put the private prompt in the producer's argv or shell history. The
+profile accepts the prompt only from non-TTY stdin, and the provider receives
+it only through child stdin. It requires a canonical configured model ID and a
+self-contained, closed JSON object schema. Model defaults, aliases, fallback
+models, prompt files, detach/resume/groups, workspace selection, images,
+permission overrides, and native passthrough argv are rejected.
+
+Each launch gets a fresh empty workspace with no write bits. Codex and Claude
+run without tools, MCP, browser, shell, project instructions, plugins, skills,
+or session persistence. The profile has a 165-second hard maximum (160 seconds
+by default), a 2-MiB raw provider-stream ceiling, and a 64-KiB final structured
+result ceiling. Provider stderr is suppressed, native session IDs are not
+stored, and launch artifacts receive only event/usage/status metadata. The one
+structured result is returned transiently on stdout to the invoking process
+only after the provider-specific exact-model contract succeeds. Codex is
+command-pinned with `-m`, ignores user configuration, exposes no fallback-model
+input in this profile, and rejects any contradictory model field if one appears
+in its JSONL stream; Codex JSONL does not otherwise echo the selected model.
+Claude must report terminal model usage containing only the requested exact
+model. Missing or different Claude model identity fails closed.
+
+Claude structured output is enforced by RUDI after the provider returns JSON.
+RUDI accepts either plain JSON or exactly one JSON Markdown fence, rejects any
+surrounding prose, and validates the parsed object against the caller's closed
+schema. The private profile deliberately does not pass Claude `--json-schema`,
+because that CLI surface materializes a provider `StructuredOutput` tool. The
+launcher disables all Claude tools and nonessential/auxiliary model traffic,
+pins classifier and subagent model variables to the requested model, and
+rejects terminal model-usage metadata unless it names only that exact model.
+Claude `thinking_tokens` progress and synthetic provider-control events are
+accepted only as closed, bounded shapes; their content, session identifiers,
+and token estimates are not persisted.
+
+Private use still requires an organization-approved provider/model egress
+contract and a synthetic no-tool launch for each exact installed provider and
+model. Use this same command with a fixed benign prompt and a closed probe
+schema while the empty workspace and metadata-only artifacts are inspected;
+flag/help discovery alone is not activation evidence. The profile never
+chooses a provider or model and never falls back to another one.
+
+Codex private automation currently requires Codex CLI `0.147.0` or newer. The
+launcher checks that version, executes an empty-stdin strict-config sentinel to
+prove the no-web configuration and `view_image` feature disable are accepted,
+verifies all named feature controls, and checks the required `exec` flags before
+it creates a workspace or delivers the real stdin. Claude is similarly
+capability-probed with an exact
+empty-stdin flag-parse sentinel after normal installation/authentication
+preflight.
+
 ## Install and update
 
 Claude and Antigravity use their vendors' native installers and update mechanisms. RUDI detects and registers those executables. Codex and Gemini CLI are RUDI-managed npm agents.