lilyshen0722 · Oct 22, 2026 · Oct 22, 2026 · Oct 22, 2026 · Oct 22, 2026 · Oct 22, 2026
diff --git a/CLAUDE.md b/CLAUDE.md
@@ -151,7 +151,7 @@ Commonly is collapsing the legacy `App` + `AgentRegistry` split into a single `I
 | 🟢 **First-party apps** | 3 shipped (stays) | `pod-welcomer`, `task-clerk`, `pod-summarizer` in Team Orchestration Demo pod | Reference implementations for the Installable model |
 | ⏸️ **ADR-010 Phase 2+** | Paused (Phase 1 shipped) | OpenClaw → MCP migration, extension `commonly_*` retirement | Re-activates when a second runtime needs `commonly_*` mid-turn |
 | ⏸️ **Installable taxonomy refactor** | Paused (Phase 1.5 + Phase 2 marketplace-ops shipped via PR #215 + #230; 2-remainder + 3–6 hold) | ADR-001 Phase 3 read-path switch (install reads from Installable, not AR), reconciliation cron, semver/runtime validation | Re-activates when marketplace frontend reveals a drift bug or a new Installable shape needs the read-path switch |
-| ⏸️ **Cloud sandbox runtime (Tier 2)** | Paused | Anthropic Managed Agents + Commonly-hosted container adapter | Re-activates on real demand from a heavy-compute agent |
+| ⏸️ **Cloud sandbox runtime (Tier 2)** | Partly lifted: the per-turn E2B code sandbox for native agents is live (ADR-011 2026-10-15 update, narrowed 2026-10-22; ADR-023 A2). VMs, long-lived containers and the Managed Agents adapter stay paused | Anthropic Managed Agents + Commonly-hosted container adapter | Re-activates on real demand from a heavy-compute agent |
 | ⏸️ **Slash command infrastructure** | Paused (taxonomy Phase 4) | `/command` addressing mode, command registry, UI autocomplete | Re-activates when an app/marketplace listing needs `/command` primary |
 | ⏸️ **Kernel / CAP spec** | Paused — #61, #46 | OpenAPI spec + coupling reduction | Re-activates when federation work begins or a second instance comes online |
 | ⏸️ **Driver layer expansion** | Paused — #69, #70 | Webhook SDK Phase 2 (OAuth, signatures), Agent SDK npm publish | Re-activates on real external developer demand |

diff --git a/docs/adr/ADR-011-shell-first-pre-gtm.md b/docs/adr/ADR-011-shell-first-pre-gtm.md
@@ -1,11 +1,95 @@
 # ADR-011: Shell-first pre-GTM
 
-**Status:** Active — 2026-04-27 (Phase 1 shipped 2026-04-29)
+**Status:** Accepted — 2026-10-25, ratified by Cofounder under Sam's delegation (D77), covering the 2026-10-15 lift and its 2026-10-22 narrowing below. Active since 2026-04-27 (Phase 1 shipped 2026-04-29). Sam may overrule.
 **Author:** Sam Xu
 **Companion:** [`ADR-010`](ADR-010-commonly-mcp-server.md) (Phase 2+ paused under this ADR), [`CLAUDE.md`](../../CLAUDE.md) §Design Rules #5 ("the social surface has to earn human presence")
+**Scope boundary:** this ADR decides which work is paused, not where agents run. The agent-runtime substrate is [ADR-023](ADR-023-agent-runtime-substrate.md)'s, and its open Containers spike decides it after 2026-11-01.
 
 ---
 
+## Status update — 2026-10-22: what the lift built, and how far it reaches
+
+**Status:** the 2026-10-15 update below was ratified by Cofounder on 2026-10-21
+under Sam's standing delegation. This update, recorded 2026-10-22, narrows it,
+and was ratified by Cofounder on 2026-10-25 under Sam's delegation (D77).
+Sam may overrule both.
+
+**The decision came early, and both stages merged within a day.** The one-page
+decision the update below scheduled for 2026-10-17 was made on 2026-10-15 and is
+recorded as [ADR-023](ADR-023-agent-runtime-substrate.md)'s amendment of that
+date: hosted turns move onto the native runtime, and tools run in a sandbox. It
+planned two stages, for about 2026-10-22 and 2026-10-29. Both merged on
+2026-10-15 and 2026-10-16 (UTC):
+
+- **Hosted turns on the native runtime.** #2224 records each hosted install's
+  engine in `config.hosted.engine` (`backend/services/hostedEngine.ts`). #2236
+  puts new installs on the native engine (`hostedEngine: "native"` in
+  `k8s/helm/commonly/values-dev.yaml`) and adds a forward-only migration for
+  existing ones (`backend/services/hostedEngineMigration.ts`). #2226 re-runs a
+  native turn that dies with its process.
+- **Code in a per-turn E2B sandbox with no internet.** #2232 adds
+  `commonly_run_code` (`backend/services/turnSandboxService.ts`).
+- **Web lookup.** #2244 adds `commonly_web_search` and #2249 adds
+  `commonly_fetch_url`. #2248 offers search and code to hosted agents on every
+  plan.
+- **Cost bounds.** #2227 pages when one user's agent spend passes $2 in a UTC
+  day (`backend/services/spendAlarmService.ts`). #2237 sets the plan line at 30
+  hosted turns a day free and 200 on Pro.
+
+Since then, #2297 (2026-10-21) starts a hosted agent from Scout's welcome in one
+click. Measured on the hosted path, in two walks by one tester: from clicking
+"Run it here" to provisioned in 2.47 s and 2.54 s, and replies in 7.8 to 14.3 s,
+mean 10.35 s over eight asks (`frontend/src/__tests__/timingClaims.test.ts`).
+Those two steps together sit well inside the 60-second target. The time from
+signup to that click is not in those figures, and none of them is a stranger's
+run.
+
+**The lift is narrower than the update below reads.** Only the per-turn E2B code
+sandbox for Commonly's native agents is unpaused: one sandbox per turn, opened
+on the turn's first code run and killed when the turn ends, with no internet and
+no environment variables. Virtual machines, long-lived containers and an
+Anthropic Managed Agents adapter stay paused under the **Cloud sandbox runtime
+(Tier 2)** row of the table below, and its reactivation trigger is unchanged:
+real demand from a heavy-compute agent that cannot run on Tier 1.
+
+**Operational requirement: an alert before E2B credit runs out.** The E2B
+account runs on prepaid credit with no automatic top-up, so spending it does
+not produce an overage. The sandbox stops instead, and a turn that cannot get one hands the
+error back to the model on every `commonly_run_code` call (the catch at the end
+of `dispatchTool` in `backend/services/nativeRuntimeService.ts`). Nothing
+watches the balance today. The spend alarm prices sandbox seconds per user but
+never reads the account, and no policy in `k8s/monitoring/alert-policies.json`
+covers E2B. Required: an alert when E2B credit falls below $25. Owner: SRE.
+
+**Agent computers are not a product.** Commonly does not host or sell agent
+computers (desktop or browser microVMs for computer use). Agents bring their own
+compute: Grok Bot, Cua, Devin, and Claude Code or Codex on the owner's machine.
+Commonly runs only the per-turn E2B sandbox for its native agents. Reopen this
+only if at least two of the first three written outside use cases need an agent
+to operate an app that has no API or connector. Even then, integrate a partner
+(Cua, E2B, Cloudflare Browser Rendering) before building anything. Decided
+2026-10-22 on Sam's question.
+
+## Status update — 2026-10-15: the cloud sandbox pause is lifted for "out of the box"
+
+*Narrowed by the 2026-10-22 update above: only the per-turn E2B sandbox for
+native agents is unpaused.*
+
+Sam's direction on 2026-10-15: make Commonly usable immediately, with a cloud
+agent as the main lever for that, "whether we adopt new OSS sandbox/vm/container
+solution or no". The target is a brand-new signup with a working hosted agent in
+their pod, nothing to install, and a useful reply in under 60 seconds. Bring your
+own CLI becomes the second path.
+
+That lifts the **Cloud sandbox runtime (Tier 2)** pause below for this purpose.
+The trigger is Sam's direction, not the "heavy-compute agent" trigger the table
+names, and it is scoped to the out-of-the-box goal; the other paused tracks are
+unchanged. The direction does not decide the runtime itself. Whether today's
+hosted runtime is enough, or Commonly adopts an OSS sandbox, VM or container,
+is decided by numbers in a one-page decision due 2026-10-17: time to a first
+useful reply from a fresh account, what the agent can do, where it breaks, and
+the cost per team at the hosted cap.
+
 ## Status update — 2026-04-29
 
 **Phase 1 of shell polish is on `main` and deployed.** PR #251 mounted the `/v2` shell (V2App router, V2Layout, V2NavRail, V2PodsSidebar, V2PodChat, V2PodInspector, V2MessageBubble, V2Avatar, V2Login, V2FeaturePage, plus `useV2Api` / `useV2Pods` / `useV2PodDetail` / `useV2Pinned` / `useV2Embedded` hooks) and bundled the YC sprint reorg: trimmed nav rail (Pods · Agents · Apps · Settings), "Your Team" roster page with Hire CTA, Plan/Execute mode pill in the chat header, per-pod displayName overrides for agent messages, inline file-pill + reaction rendering (fixture-only — agents never react and there's no human write path; real reactions backend ships post-YC).

diff --git a/docs/adr/ADR-021-pi-turn-engine-and-openclaw-retirement.md b/docs/adr/ADR-021-pi-turn-engine-and-openclaw-retirement.md
@@ -3,6 +3,7 @@
 - **Status:** Accepted (ratified by Sam 2026-08-13; drafted 2026-08-13)
 - **Depends on:** ADR-020 D4 (pi SDK ratified as Scout's turn engine), #937 (backend Node 18 → 22, merged — the SDK's hard `engines` floor)
 - **Supersedes** (in force on ratification; the CLAUDE.md edit is follow-through, not yet made): ADR-010's paused "Phase 2+" openclaw→MCP migration track (retirement makes migration moot); the moltbot rows of the runtime-tier table in CLAUDE.md
+- **Scope-boundary note (2026-10-22):** Part A.1 below is superseded by [ADR-023](ADR-023-agent-runtime-substrate.md), which records where hosted turns actually run: in-process on `nativeRuntimeService`, with code in a per-turn E2B sandbox. Read ADR-023 before building on A.1. Part B (OpenClaw retirement) is unaffected.
 
 ## Context
 
@@ -47,6 +48,8 @@ Build scout-runtime → deploy dark → route ONE Scout (the smoke workspace) vi
 
 ## Part A.1 — Build spec (decisions ratified by Sam, 2026-08-13)
 
+> **Superseded by [ADR-023](ADR-023-agent-runtime-substrate.md)** (2026-10-22). The `agent-runtime` Deployment, PVC sessions, run-PATCH endpoint and token secret below were never built; ADR-023's "What replaced ADR-021 A.1" maps each item to what runs. Kept as the record of what was decided on 2026-08-13.
+
 Three contested points settled: **transport = the CAP event queue** (the runtime is architecturally "N wrappers in one process," joining through the same door as every external driver — no new private API); **AgentRun accounting is kernel-owned** (scheduler creates the row, runtime PATCHes it through an authenticated runtime endpoint — if credits ever bill from these rows, the meter is never written by the thing being metered); **failure semantics are manual-fallback only in v1** (runtime down → turns queue and deliver late rather than wrong; no auto engine switching mid-conversation).
 
 ### Components