From 9a59d7dbd7c74defb3a329d7d81875fb63b63b5f Mon Sep 17 00:00:00 2001
From: ymote <151983+ymote@users.noreply.github.com>
Date: Tue, 29 Sep 2026 18:39:21 -0700
Subject: [PATCH] An agent for every app that declares one, and a shell-drawn
 "Ask <app>"

ADR 0004 section 4. A live run found News (tools.json, no octos.*) with
no peer: the system agent's peer_list was empty, News's tools never
registered, Settings listed only Rinx, and the person had nowhere to
talk to an app's agent.

- Which apps: a native app granted agent.octos; a script app whose
  manifest declares octos.* or an agent block, or whose admitted bundle
  ships tools.json (App Hub's AgentBundle::load). Settings lists all.
- Peers once allowed: when the person allows an agent (first-use sheet,
  Settings) and at startup, the shell prepares its peer
  (contained::prepare -> OctosAppService::prepare -> peer/prepare, tools
  registered), so peer_list shows it. One peer per app, shared by the
  app, its cards, the panel and the system agent; the app's own context
  still holds only the octos.* services its manifest declares.
- The system agent is told about agents it cannot list: a note with the
  system chat's turn when the apps' agents changed, and host tools
  agents.list / agents.ask (the latter shows the first-use sheet).
- "Ask <app>": the system chat's pane in app mode (app_chat/): a sharing
  context via open_conversation, both lanes merged with speakers, a
  composer, Stop (both lanes), the app's questions; from the bar's
  "Ask <app>", Shift+F8 or Setup > Assistant; beside the system chat on
  a desktop, full screen on a phone.
- Revocation releases the peer and closes the panel's context.

Tests: News is listed; the panel opens a sharing context and sends
person turns there; allowed agents are prepared (fake peer); and on a
real kernel: prepared with News's tools, listed by the system agent's
peer_list, the panel's person turn seen by the system agent's peer/input
turn, revoked. Docs: ADR 0004 section 4 and a follow-up; architecture.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---
 crates/ai-host/src/contained.rs               |  81 ++-
 crates/ai-host/src/contained/tests.rs         |  65 ++-
 crates/ai-host/src/lib.rs                     |  12 +-
 crates/app-peers/src/broker.rs                |  18 +
 crates/app-peers/src/contract.rs              |   9 +
 crates/shell/src/agents.rs                    | 370 +++++++++++++
 crates/shell/src/app_chat/mod.rs              | 493 ++++++++++++++++++
 crates/shell/src/app_chat/model.rs            | 209 ++++++++
 crates/shell/src/app_chat/tests.rs            | 358 +++++++++++++
 crates/shell/src/approvals/consent.rs         |  13 +-
 crates/shell/src/approvals/mod.rs             |   5 +
 crates/shell/src/approvals/tests.rs           |   2 +-
 crates/shell/src/apps.rs                      |  40 +-
 .../shell/src/host_tools/real_kernel_tests.rs | 167 ++++++
 crates/shell/src/lib.rs                       |  83 ++-
 crates/shell/src/questions/tests.rs           |   2 +-
 crates/shell/src/shell/bar.rs                 |  17 +
 crates/shell/src/shell/menu.rs                |   9 +
 crates/shell/src/system_chat/mod.rs           |  42 +-
 crates/shell/src/system_chat/model.rs         |  19 +-
 crates/shell/src/system_chat/session.rs       |  31 +-
 crates/shell/src/system_chat/view.rs          | 168 +++++-
 .../adr/0004-native-apps-hosting-and-peers.md |  10 +-
 docs/architecture.md                          |   7 +-
 docs/architecture.zh-CN.md                    |   4 +-
 25 files changed, 2166 insertions(+), 68 deletions(-)
 create mode 100644 crates/shell/src/agents.rs
 create mode 100644 crates/shell/src/app_chat/mod.rs
 create mode 100644 crates/shell/src/app_chat/model.rs
 create mode 100644 crates/shell/src/app_chat/tests.rs

diff --git a/crates/ai-host/src/contained.rs b/crates/ai-host/src/contained.rs
index 7d5b0305..e14d7a91 100644
--- a/crates/ai-host/src/contained.rs
+++ b/crates/ai-host/src/contained.rs
@@ -30,6 +30,16 @@
 //! the `octos.*` services its manifest declares ([`declared`]), and turning
 //! its agent off in Settings releases the live peer at once ([`revoke`]).
 //!
+//! **An agent for every app that declares one** (ADR 0004 §4). A script
+//! app's peer does not wait for the app to call `octos`: once the person
+//! allowed its agent, the shell prepares it ([`prepare`]: `peer/prepare`,
+//! its tools registered), so the system agent's `peer_list` shows it and
+//! `peer_send_input` reaches it, and the shell's "Ask <app>" panel opens
+//! the app's conversation on it ([`conversation`]). The app's own `octos`
+//! calls use the same peer, still gated by the services its manifest
+//! declares; an app that declares none (News: it ships `tools.json` only)
+//! never calls it, and has its agent all the same.
+//!
 //! The logic does not need a kernel: peers come from a [`PeerFactory`]. The
 //! shell's factory (`cfg(kernel)`) launches them through
 //! `octosense_app_peers::hosted`; tests use a fake one.
@@ -96,6 +106,61 @@ pub fn declared(app_id: &str) -> Result<BTreeSet<String>, String> {
     Ok(services)
 }
 
+/// Where the shell's own preparations get peers ([`prepare`]): the factory
+/// the registered service uses (`register_contained`), or a test's.
+static FACTORY: Mutex<Option<Arc<dyn PeerFactory>>> = Mutex::new(None);
+
+/// The factory [`prepare`] launches peers with (the shell's, at startup).
+pub fn set_factory(factory: Arc<dyn PeerFactory>) {
+    *FACTORY.lock().unwrap_or_else(|e| e.into_inner()) = Some(factory);
+}
+
+/// The services a peer is launched with: all of them, for the shell's own
+/// surfaces (the "Ask <app>" panel reads history, starts turns and stops
+/// them). What the APP may call is still only what its manifest declares,
+/// twice over: [`ContainedOctos`] checks [`declared`] before any call
+/// reaches the peer, and the app's own context is opened with exactly
+/// those services (the broker checks every call against its context's).
+fn peer_services() -> BTreeSet<String> {
+    octosense_app_peers::OCTOS_SERVICES.iter().map(|s| s.to_string()).collect()
+}
+
+/// `app_id`'s live peer, or a new one from `factory` (kept live, so every
+/// caller shares ONE peer per app).
+fn obtain(app_id: &str, factory: &dyn PeerFactory) -> Result<Arc<dyn OctosAppService>, String> {
+    if let Some(service) = live(|l| l.get(app_id).cloned()) {
+        return Ok(service);
+    }
+    let peer = peer_id(app_id)?;
+    let service = factory.launch(&peer, app_id, &peer_services()).ok_or(UNAVAILABLE)?;
+    service.set_account(Some(ACCOUNT));
+    Ok(live(|l| l.entry(app_id.to_owned()).or_insert(service).clone()))
+}
+
+/// The shell prepares `app_id`'s agent (the person allowed it): its peer is
+/// created or resumed and its tools registered now, without a turn. Blocks
+/// (at most a minute): call it off the UI thread. Consent is the caller's
+/// check (the shell asks `approvals::consent_granted` first).
+pub fn prepare(app_id: &str) -> Result<(), String> {
+    let factory = FACTORY.lock().unwrap_or_else(|e| e.into_inner()).clone().ok_or(UNAVAILABLE)?;
+    let service = obtain(app_id, factory.as_ref())?;
+    service.prepare()
+}
+
+/// Whether `app_id` has a live peer (prepared, or opened by the app).
+pub fn is_live(app_id: &str) -> bool {
+    live(|l| l.contains_key(app_id))
+}
+
+/// The app's conversation for a shell surface (the "Ask <app>" panel, the
+/// person's lane): a new sharing context on the app's one peer, created if
+/// needed. Consent is the caller's check.
+pub fn conversation(app_id: &str, instance: &str) -> Result<Arc<dyn OctosContext>, String> {
+    let factory = FACTORY.lock().unwrap_or_else(|e| e.into_inner()).clone().ok_or(UNAVAILABLE)?;
+    let service = obtain(app_id, factory.as_ref())?;
+    service.open_conversation(ContextSpec { account: ACCOUNT.to_owned(), instance: instance.to_owned(), services: service.services() })
+}
+
 /// Every contained app's live peer, by app id, so turning its agent off
 /// revokes it at once ([`revoke`]).
 static LIVE: Mutex<Option<HashMap<String, Arc<dyn OctosAppService>>>> = Mutex::new(None);
@@ -104,6 +169,13 @@ fn live<R>(f: impl FnOnce(&mut HashMap<String, Arc<dyn OctosAppService>>) -> R)
     f(LIVE.lock().unwrap_or_else(|e| e.into_inner()).get_or_insert_with(HashMap::new))
 }
 
+/// Tests: forget every live peer and the factory (the maps are global).
+#[cfg(test)]
+pub(crate) fn reset_for_tests() {
+    live(|l| l.clear());
+    *FACTORY.lock().unwrap_or_else(|e| e.into_inner()) = None;
+}
+
 /// The person turned `app_id`'s agent off (Settings): its peer is released
 /// now, closing its contexts and any running turn. A later call needs
 /// consent again and then gets a fresh peer. True when one was live.
@@ -208,10 +280,9 @@ impl ContainedOctos {
             self.apps.remove(app_id);
         }
         if !self.apps.contains_key(app_id) {
+            // The peer the shell prepared, if it did: one peer per app.
             let peer = peer_id(app_id)?;
-            let service = self.factory.launch(&peer, app_id, services).ok_or(UNAVAILABLE)?;
-            service.set_account(Some(ACCOUNT));
-            live(|l| l.insert(app_id.to_owned(), service.clone()));
+            let service = obtain(app_id, self.factory.as_ref())?;
             self.apps.insert(app_id.to_owned(), AppPeer { peer, service, context: None, generation: 0 });
         }
         let app = self.apps.get_mut(app_id).expect("inserted above");
@@ -222,7 +293,9 @@ impl ContainedOctos {
         let context = app.service.open_conversation(ContextSpec {
             account: ACCOUNT.to_owned(),
             instance: format!("{}-g{}", app.peer, app.generation),
-            services: app.service.services(),
+            // The app's own handle: only what its manifest declares, even
+            // on a peer the shell launched with every service for its panel.
+            services: services.clone(),
         })?;
         app.context = Some(context.clone());
         Ok(context)
diff --git a/crates/ai-host/src/contained/tests.rs b/crates/ai-host/src/contained/tests.rs
index da05e8b5..6465b9db 100644
--- a/crates/ai-host/src/contained/tests.rs
+++ b/crates/ai-host/src/contained/tests.rs
@@ -88,6 +88,8 @@ struct FakeService {
     /// How many handles were the app's conversation (not a request context).
     conversations: AtomicUsize,
     released: AtomicBool,
+    /// How many times the shell prepared it.
+    prepared: AtomicUsize,
 }
 
 impl OctosAppService for FakeService {
@@ -124,6 +126,10 @@ impl OctosAppService for FakeService {
         self.conversations.fetch_add(1, Ordering::SeqCst);
         self.open_context(spec)
     }
+    fn prepare(&self) -> Result<(), String> {
+        self.prepared.fetch_add(1, Ordering::SeqCst);
+        Ok(())
+    }
     fn release(&self) {
         self.released.store(true, Ordering::SeqCst);
         for c in self.contexts.lock().unwrap().iter() {
@@ -172,6 +178,7 @@ impl PeerFactory for Peers {
             contexts: Mutex::default(),
             conversations: AtomicUsize::new(0),
             released: AtomicBool::new(false),
+            prepared: AtomicUsize::new(0),
         });
         self.launched.lock().unwrap().push((peer_id.to_owned(), service.clone()));
         Some(service)
@@ -204,7 +211,9 @@ fn ask(app: &str, service: &str, args: Value, from_sheet: bool) -> Result<Value,
 }
 
 fn serial() -> std::sync::MutexGuard<'static, ()> {
-    SERIAL.lock().unwrap_or_else(|e| e.into_inner())
+    let guard = SERIAL.lock().unwrap_or_else(|e| e.into_inner());
+    reset_for_tests();
+    guard
 }
 
 #[test]
@@ -428,9 +437,12 @@ fn contained_apps_get_only_the_octos_services_their_manifest_declares() {
     let peers = Peers::new(Turn::Reply(json!({"turn_id": "t1", "text": "ok"})));
     register(true, &peers);
     ask("com.example.reader", "octos.session.open", json!({}), false).expect("declared");
-    let granted = peers.granted.lock().unwrap().clone();
-    assert_eq!(granted.len(), 1);
-    assert_eq!(granted[0].1, ["octos.session.history", "octos.session.open"].iter().map(|s| s.to_string()).collect::<BTreeSet<_>>(), "never all four");
+    // The peer serves the shell's panel too; the app's own context holds
+    // only what its manifest declares, never all four.
+    assert_eq!(peers.granted.lock().unwrap().len(), 1);
+    let specs = peers.service("card.com.example.reader").specs.lock().unwrap().clone();
+    assert_eq!(specs.len(), 1);
+    assert_eq!(specs[0].services, ["octos.session.history", "octos.session.open"].iter().map(|s| s.to_string()).collect::<BTreeSet<_>>(), "never all four");
     let err = ask("com.example.reader", "octos.turn.start", json!({"text": "hi"}), false).unwrap_err();
     assert_eq!(err, NOT_DECLARED);
     let err = ask("com.example.unknown", "octos.session.open", json!({}), false).unwrap_err();
@@ -453,3 +465,48 @@ fn turning_an_agent_off_releases_its_live_peer_at_once() {
     ask(APP, "octos.turn.start", json!({"text": "again"}), false).expect("a reply");
     assert_eq!(peers.ids().len(), 2);
 }
+
+/// ADR 0004 §4, an agent for every app that declares one: the shell
+/// prepares a consented app's peer without the app calling `octos` (News
+/// ships tools.json and declares no `octos.*`); the app's own calls, the
+/// shell's panel and the preparation share ONE peer; the panel's
+/// conversation holds every service while the app's own context holds only
+/// what it declares; revoking releases the peer and a later preparation
+/// gets a fresh one.
+#[test]
+fn the_shell_prepares_a_consented_apps_peer_and_its_panel_shares_it() {
+    let _g = serial();
+    set_declared(manifests);
+    let peers = Peers::new(Turn::Reply(json!({"turn_id": "t1", "text": "ok"})));
+    register(true, &peers);
+    assert_eq!(prepare("os.news"), Err(UNAVAILABLE.to_string()), "no factory: nothing to prepare with");
+    set_factory(peers.clone());
+    prepare("os.news").expect("prepared");
+    assert!(is_live("os.news"));
+    assert_eq!(peers.ids(), vec!["card.os.news".to_string()]);
+    let news = peers.service("card.os.news");
+    assert_eq!(news.prepared.load(Ordering::SeqCst), 1, "bound now, before any turn");
+    assert_eq!(news.accounts.lock().unwrap().as_slice(), [Some(ACCOUNT.to_string())]);
+    // Preparing again is the same peer.
+    prepare("os.news").unwrap();
+    assert_eq!(peers.ids().len(), 1);
+    // The shell's panel: a conversation on the same peer, every service.
+    let panel = conversation("os.news", "shell-ask-1").expect("the person's lane");
+    assert!(panel.is_open());
+    assert_eq!(news.conversations.load(Ordering::SeqCst), 1);
+    assert_eq!(news.specs.lock().unwrap()[0].services.len(), OCTOS_SERVICES.len());
+    // An app that also calls `octos` itself uses that peer, with only what
+    // it declares.
+    prepare("com.example.reader").unwrap();
+    ask("com.example.reader", "octos.session.open", json!({}), false).expect("declared");
+    assert_eq!(peers.ids(), vec!["card.os.news".to_string(), "card.com.example.reader".to_string()], "no second peer");
+    let reader = peers.service("card.com.example.reader").specs.lock().unwrap().clone();
+    assert_eq!(reader[0].services, ["octos.session.history", "octos.session.open"].iter().map(|s| s.to_string()).collect::<BTreeSet<_>>());
+    // Turned off: released at once; allowed again, a fresh peer.
+    assert!(revoke("os.news"));
+    assert!(news.released.load(Ordering::SeqCst));
+    assert!(!panel.is_open(), "the panel's conversation closed with it");
+    assert!(!is_live("os.news"));
+    prepare("os.news").unwrap();
+    assert_eq!(peers.ids().iter().filter(|id| *id == "card.os.news").count(), 2);
+}
diff --git a/crates/ai-host/src/lib.rs b/crates/ai-host/src/lib.rs
index cc1ad5cb..56a1f336 100644
--- a/crates/ai-host/src/lib.rs
+++ b/crates/ai-host/src/lib.rs
@@ -43,8 +43,11 @@
 //!   interrupts its peer's running work; the kernel and other apps go on.
 //! - **The `octos` host service** ([`contained`]): contained apps the Card
 //!   runner hosts that declare `octos.*` get their own peer (`card.<app id>`)
-//!   under the same contract, while [`Policy::contained_apps`] is on. Tool
-//!   approvals are declined until the Card runner has an approval sheet.
+//!   under the same contract, while [`Policy::contained_apps`] is on. The
+//!   shell also prepares that peer for every app whose agent the person
+//!   allowed, whether or not the app calls `octos` (`contained::prepare`),
+//!   and opens the app's conversation on it for its "Ask <app>" panel
+//!   (`contained::conversation`). Approvals go to the shell's router.
 //! - **The system toolbox for app agents** (feature `toolbox-peers`, off by
 //!   default): the toolbox's grants and the executor the shell's host-tool
 //!   relay runs its calls on ([`toolbox_peers`]). Its results live in each
@@ -343,6 +346,11 @@ fn register_contained(kernel: bool, policy: &Policy) {
             gate,
             std::sync::Arc::new(contained::KernelPeers),
         )));
+        // The shell prepares consented apps' agents on the same peers
+        // (`contained::prepare`), unless contained apps are off.
+        if gate != ContainedGate::Off {
+            contained::set_factory(std::sync::Arc::new(contained::KernelPeers));
+        }
         log!("octos: contained apps' service registered ({gate:?})");
         return;
     }
diff --git a/crates/app-peers/src/broker.rs b/crates/app-peers/src/broker.rs
index 664005d6..a06ba181 100644
--- a/crates/app-peers/src/broker.rs
+++ b/crates/app-peers/src/broker.rs
@@ -387,6 +387,15 @@ pub fn interrupt_where(matches: impl Fn(&str) -> bool) -> Vec<String> {
     brokers.into_iter().filter(|b| matches(&b.cfg.app_id)).flat_map(|b| Broker(b).interrupt_running()).collect()
 }
 
+/// The live (not released) broker of the app whose id is `app_id`, if one
+/// runs: a shell surface opens the app's conversation on the same peer the
+/// app uses (the shell's "Ask <app>" panel).
+pub fn live(app_id: &str) -> Option<Broker> {
+    let mut all = BROKERS.lock().unwrap_or_else(|e| e.into_inner());
+    all.retain(|b| b.strong_count() > 0);
+    all.iter().rev().filter_map(Weak::upgrade).find(|b| b.cfg.app_id == app_id && !b.lock().released).map(Broker)
+}
+
 /// Whether a kernel refusal is `turn_in_progress` (the session runs another
 /// turn: the kernel queues nothing).
 fn turn_in_progress(error: &str) -> bool {
@@ -588,6 +597,11 @@ impl Broker {
         self.0.lock().generation
     }
 
+    /// The account the broker acts for now (`None`: signed out).
+    pub fn account(&self) -> Option<String> {
+        self.0.lock().account.clone()
+    }
+
     /// The bound peer's slug and session, once bound.
     pub fn peer(&self) -> Option<(String, String)> {
         self.0
@@ -2789,6 +2803,10 @@ impl OctosAppService for Broker {
         self.0.cfg.services.clone()
     }
 
+    fn prepare(&self) -> Result<(), String> {
+        self.bind()
+    }
+
     fn model(&self) -> Option<ModelInfo> {
         self.0.lock().model.clone()
     }
diff --git a/crates/app-peers/src/contract.rs b/crates/app-peers/src/contract.rs
index aeae49a9..aae35e8d 100644
--- a/crates/app-peers/src/contract.rs
+++ b/crates/app-peers/src/contract.rs
@@ -305,6 +305,15 @@ pub trait OctosAppService: Send + Sync {
     fn open_conversation(&self, spec: ContextSpec) -> Result<Arc<dyn OctosContext>, String> {
         self.open_context(spec)
     }
+    /// Create or resume the app's peer now, without a turn: `peer/prepare`,
+    /// its tools registered, its session open, so the system agent's
+    /// `peer_list` shows it and `peer_send_input` reaches it (ADR 0004 §4:
+    /// the shell prepares a consented app's agent). Blocks until done (at
+    /// most a minute); call it off the UI thread. A service without a peer
+    /// of its own has nothing to prepare.
+    fn prepare(&self) -> Result<(), String> {
+        Ok(())
+    }
     /// The app is closing: close every context and release subscriptions.
     /// Does not stop a shared kernel or other apps' work.
     fn release(&self);
diff --git a/crates/shell/src/agents.rs b/crates/shell/src/agents.rs
new file mode 100644
index 00000000..084f8339
--- /dev/null
+++ b/crates/shell/src/agents.rs
@@ -0,0 +1,370 @@
+//! An agent for every app that declares one (ADR 0004 §4, §6).
+//!
+//! **Which apps.** [`crate::apps::agent_apps`]: a native app whose
+//! `native-apps.json` entry grants `octos.*`; a script app whose manifest
+//! declares `octos.*` or an `agent` block, or whose admitted bundle ships
+//! `tools.json` (App Hub's `AgentBundle::load`). From manifests and grants,
+//! never names. Settings › Assistant lists every one of them.
+//!
+//! **Peers exist once allowed.** The person allows an app's agent on the
+//! first-use sheet (from the app's "Ask <app>" panel, the app's own `octos`
+//! call, or the system agent's `agents.ask`) or in Settings. From then on
+//! the shell PREPARES its peer ([`prepare`]: `peer/prepare`, its tools
+//! registered, its session open), at startup for the apps already allowed
+//! and at the moment one is allowed, so the system agent's `peer_list`
+//! shows it and `peer_send_input` reaches it. A script app's peer is the
+//! contained `octos` service's (`card.<app id>`), shared with the app's own
+//! calls and the panel. A native app's peer is its instance's (the module
+//! host offers it at `create`), so it exists while the app is open; a native
+//! app that keeps accounts cannot be prepared without its signed-in account.
+//! Turning an agent off releases its peer (`contained::revoke`, lib.rs
+//! `revoke_agents`); the shell refuses the system agent's input to it
+//! (`host_tools::ShellToolHost::admit_input`).
+//!
+//! **What the system agent is told.** octos lists only prepared peers, and
+//! has no hook for "this app has an agent you may not use yet". The shell
+//! says it in two places of its own: a short note with the system chat's
+//! turns whenever the apps' agents changed ([`system_note`]), and two host
+//! tools on the system session, `agents.list` and `agents.ask`
+//! ([`declarations`], answered by the system chat itself: [`call`]).
+//! `agents.ask` shows the first-use sheet (over the system chat); only the
+//! person answers it.
+
+use std::collections::{BTreeMap, BTreeSet};
+use std::sync::{Arc, Mutex};
+
+use serde_json::{json, Value};
+
+use crate::ai_host::app_peers::host_tools::ToolOutcome;
+use crate::ai_host::app_peers::OctosContext;
+use crate::apps::AgentApp;
+
+/// Tests that install the contained service's peer factory (it is global)
+/// hold this.
+#[cfg(test)]
+pub(crate) static FACTORY_TESTS: Mutex<()> = Mutex::new(());
+
+/// The host tools the system chat registers on the system session.
+pub const LIST_TOOL: &str = "agents.list";
+pub const ASK_TOOL: &str = "agents.ask";
+/// Their owner, as the kernel shows it.
+pub const OWNER: &str = "agents";
+
+/// Where one app's agent stands for the person.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum Access {
+    /// The person has not decided (the first use asks).
+    NotAsked,
+    Allowed,
+    /// Turned off (Settings, or denied on the first-use sheet).
+    Off,
+}
+
+impl Access {
+    pub fn as_str(self) -> &'static str {
+        match self {
+            Access::NotAsked => "not yet allowed",
+            Access::Allowed => "allowed",
+            Access::Off => "off",
+        }
+    }
+}
+
+/// `app`'s access: developer mode grants every agent (ADR 0004 §13).
+pub fn access(app: &str) -> Access {
+    if crate::approvals::consent_granted(app) {
+        return Access::Allowed;
+    }
+    match crate::approvals::with(|a| a.consent.state(app)) {
+        Some(crate::approvals::consent::State::Denied) => Access::Off,
+        _ => Access::NotAsked,
+    }
+}
+
+/// The peer id of an app's agent: a native app's id, a script app's
+/// `card.<app id>`.
+pub fn peer_of(app: &AgentApp) -> String {
+    if app.native {
+        app.id.clone()
+    } else {
+        format!("{}{}", crate::ai_host::contained::PEER_PREFIX, app.id)
+    }
+}
+
+/// Every app with an agent.
+pub fn all() -> Vec<AgentApp> {
+    crate::apps::agent_apps()
+}
+
+/// The app with an agent that `name` means: its id, its peer id, its
+/// display name (any case), or a launcher id (`news` for `os.news`,
+/// `hub:<id>` for an installed app).
+pub fn find(name: &str) -> Option<AgentApp> {
+    find_in(&all(), name)
+}
+
+pub fn find_in(apps: &[AgentApp], name: &str) -> Option<AgentApp> {
+    let name = name.trim();
+    let bare = name.strip_prefix("hub:").unwrap_or(name);
+    apps.iter()
+        .find(|a| a.id == bare || peer_of(a) == bare || a.name.eq_ignore_ascii_case(bare) || a.id == format!("os.{bare}"))
+        .cloned()
+}
+
+// ------------------------------------------------------------ peers
+
+/// What the shell knows of each preparation: running, done, or why not.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub enum Prepared {
+    Preparing,
+    Ready,
+    Failed(String),
+}
+
+static PREPARED: Mutex<BTreeMap<String, Prepared>> = Mutex::new(BTreeMap::new());
+
+fn set_prepared(app: &str, state: Option<Prepared>) {
+    let mut map = PREPARED.lock().unwrap_or_else(|e| e.into_inner());
+    match state {
+        Some(state) => map.insert(app.to_string(), state),
+        None => map.remove(app),
+    };
+    makepad_widgets::makepad_platform::thread::SignalToUI::set_ui_signal();
+}
+
+/// Where `app`'s preparation stands (`None`: never tried in this run).
+pub fn prepared(app: &str) -> Option<Prepared> {
+    PREPARED.lock().unwrap_or_else(|e| e.into_inner()).get(app).cloned()
+}
+
+/// Prepare `app`'s agent now, off the UI thread, if the person allowed it
+/// and it is not prepared or preparing. A native app's peer is its open
+/// instance's: nothing to prepare here.
+pub fn prepare(app: &AgentApp) {
+    if app.native || access(&app.id) != Access::Allowed {
+        return;
+    }
+    if matches!(prepared(&app.id), Some(Prepared::Preparing)) {
+        return;
+    }
+    if matches!(prepared(&app.id), Some(Prepared::Ready)) && crate::ai_host::contained::is_live(&app.id) {
+        return;
+    }
+    set_prepared(&app.id, Some(Prepared::Preparing));
+    let id = app.id.clone();
+    let spawned = std::thread::Builder::new().name(format!("prepare-{id}")).spawn(move || {
+        let outcome = crate::ai_host::contained::prepare(&id);
+        match &outcome {
+            Ok(()) => makepad_widgets::log!("agents: {id}'s agent is prepared (its peer is listed for the system agent)"),
+            Err(e) => makepad_widgets::log!("agents: {id}'s agent could not be prepared: {e}"),
+        }
+        // Turned off meanwhile: the revocation wins.
+        if access(&id) != Access::Allowed {
+            crate::ai_host::contained::revoke(&id);
+            set_prepared(&id, None);
+            return;
+        }
+        set_prepared(&id, Some(match outcome {
+            Ok(()) => Prepared::Ready,
+            Err(e) => Prepared::Failed(e),
+        }));
+    });
+    if spawned.is_err() {
+        set_prepared(&app.id, Some(Prepared::Failed("no thread".into())));
+    }
+}
+
+/// Every allowed app's agent (startup, and when the assistant comes up).
+pub fn prepare_allowed() {
+    for app in all() {
+        prepare(&app);
+    }
+}
+
+/// At startup, once the kernel is configured: prepare the agents the person
+/// already allowed.
+pub fn start() {
+    let _ = std::thread::Builder::new().name("agents-start".into()).spawn(prepare_allowed);
+}
+
+/// The apps the person just allowed (the first-use sheet, Settings) get
+/// their peer now; the ones turned off are forgotten (lib.rs revokes their
+/// services).
+pub fn pump(revoked: &[String]) {
+    for app in revoked {
+        set_prepared(app, None);
+    }
+    let allowed = crate::approvals::take_allowed();
+    if allowed.is_empty() {
+        return;
+    }
+    let apps = all();
+    for id in allowed {
+        if let Some(app) = find_in(&apps, &id) {
+            prepare(&app);
+        }
+    }
+}
+
+/// The app's conversation for a shell surface (the "Ask <app>" panel):
+/// the person's lane on the app's one peer. Only once the person allowed
+/// the agent. A native app's is its open instance's peer.
+pub fn conversation(app: &AgentApp, instance: &str) -> Result<Arc<dyn OctosContext>, String> {
+    if access(&app.id) != Access::Allowed {
+        return Err(format!("{}'s assistant is {}", app.name, access(&app.id).as_str()));
+    }
+    if !app.native {
+        let context = crate::ai_host::contained::conversation(&app.id, instance)?;
+        set_prepared(&app.id, Some(Prepared::Ready));
+        return Ok(context);
+    }
+    native_conversation(app, instance)
+}
+
+#[cfg(kernel)]
+fn native_conversation(app: &AgentApp, instance: &str) -> Result<Arc<dyn OctosContext>, String> {
+    use crate::ai_host::app_peers::{ContextSpec, OctosAppService};
+    let broker = crate::ai_host::app_peers::broker::live(&app.id).ok_or_else(|| format!("Open {} first: its assistant runs while it is open", app.name))?;
+    let account = broker.account().ok_or_else(|| format!("Sign in to {} to use its assistant", app.name))?;
+    let services = broker.services();
+    broker.open_conversation(ContextSpec { account, instance: instance.to_string(), services })
+}
+
+#[cfg(not(kernel))]
+fn native_conversation(app: &AgentApp, _instance: &str) -> Result<Arc<dyn OctosContext>, String> {
+    Err(format!("{}'s assistant is not available in this build", app.name))
+}
+
+/// Ask the person to allow `app`'s agent: the first-use sheet, once (only
+/// the person answers it). The state it is in now.
+pub fn ask(app: &AgentApp) -> Access {
+    if access(&app.id) == Access::Allowed {
+        return Access::Allowed;
+    }
+    let summary = crate::approvals::consent::AgentSummary::from_manifest(&app.id, &app.name, &app.manifest, &app.octos, "The model set in AI providers");
+    match crate::approvals::consent_ask(summary) {
+        crate::approvals::consent::State::Allowed => Access::Allowed,
+        _ => access(&app.id),
+    }
+}
+
+// ------------------------------------------------------------ the system agent
+
+/// One app's line for the system agent: its name, its peer and where it
+/// stands, and what to do.
+fn line(app: &AgentApp) -> Value {
+    let access = access(&app.id);
+    let peer = match (access, prepared(&app.id)) {
+        (Access::Allowed, Some(Prepared::Ready)) => "ready: in peer_list".to_string(),
+        (Access::Allowed, Some(Prepared::Preparing)) => "starting".to_string(),
+        (Access::Allowed, Some(Prepared::Failed(e))) => format!("could not start: {e}"),
+        (Access::Allowed, None) if app.native => format!("runs while {} is open", app.name),
+        (Access::Allowed, None) => "not started yet".to_string(),
+        _ => "none".to_string(),
+    };
+    let what = match access {
+        Access::Allowed => format!("Reach it with peer_send_input (its peer is named \"{} …\" in peer_list).", peer_label(app)),
+        Access::NotAsked => format!("{}'s assistant is not yet allowed. Call agents.ask to ask the person, or tell them to open {} and use Ask {}.", app.name, app.name, app.name),
+        Access::Off => format!("{}'s assistant is off. Only the person can turn it on (Settings › Assistant › Approvals); tell them.", app.name),
+    };
+    json!({"app": app.id, "name": app.name, "access": access.as_str(), "peer": peer, "what_to_do": what})
+}
+
+/// The name the kernel gives the app's peer (`<label> <account tag>`): the
+/// label is the peer's app id for a script app, the module's label for a
+/// native one.
+fn peer_label(app: &AgentApp) -> String {
+    if app.native {
+        app.name.clone()
+    } else {
+        app.id.clone()
+    }
+}
+
+/// `agents.list`'s answer.
+pub fn list() -> Value {
+    json!({"apps": all().iter().map(line).collect::<Vec<_>>()})
+}
+
+/// The note the system chat sends with a turn when the apps' agents
+/// changed since it last told the system agent (`None`: nothing to say).
+/// One line per app: its name and where it stands.
+pub fn system_note() -> Option<String> {
+    let apps = all();
+    if apps.is_empty() {
+        return None;
+    }
+    let mut parts = Vec::new();
+    for app in &apps {
+        let state = match access(&app.id) {
+            Access::Allowed => "allowed (its agent is in peer_list; reach it with peer_send_input)".to_string(),
+            Access::NotAsked => "not yet allowed (not in peer_list; say so, and call agents.ask or ask the person to allow it)".to_string(),
+            Access::Off => "off (not in peer_list; only the person can turn it on in Settings)".to_string(),
+        };
+        parts.push(format!("{} [{}]: {state}", app.name, app.id));
+    }
+    Some(format!("[OctoSense: apps with an agent: {}. Never guess a peer that peer_list does not show.]", parts.join("; ")))
+}
+
+/// Strip [`system_note`] from a message's text (the transcript keeps it; the
+/// person does not need to see it).
+pub fn strip_note(text: &str) -> &str {
+    match text.strip_prefix("[OctoSense: apps with an agent:") {
+        Some(rest) => match rest.find("]\n") {
+            Some(end) => rest[end + 2..].trim_start(),
+            None => text,
+        },
+        None => text,
+    }
+}
+
+/// The host tools for the system session.
+pub fn declarations() -> Vec<Value> {
+    vec![
+        json!({
+            "name": LIST_TOOL,
+            "app": OWNER,
+            "description": "List every app on this device that has an agent, whether the person allowed it, and whether its peer is ready (in peer_list). Use it before delegating to an app's agent, and when peer_list does not show the app you need.",
+            "input_schema": {"type": "object", "properties": {}, "additionalProperties": false},
+            "risk": "read",
+        }),
+        json!({
+            "name": ASK_TOOL,
+            "app": OWNER,
+            "description": "Ask the person to allow one app's agent (the shell shows its first-use sheet; only the person answers). Use it when you need an app's agent that is not yet allowed. Returns where it stands now; once allowed, its peer appears in peer_list.",
+            "input_schema": {"type": "object", "properties": {"app": {"type": "string", "description": "The app's name or id, e.g. News or os.news"}}, "required": ["app"], "additionalProperties": false},
+            "risk": "read",
+        }),
+    ]
+}
+
+/// Whether `tool` is one of [`declarations`].
+pub fn is_agents_tool(tool: &str) -> bool {
+    tool == LIST_TOOL || tool == ASK_TOOL
+}
+
+/// Answer the system agent's call of one of [`declarations`] (the system
+/// chat, on the UI thread).
+pub fn call(tool: &str, args: &Value) -> ToolOutcome {
+    match tool {
+        LIST_TOOL => ToolOutcome::Ok(list()),
+        ASK_TOOL => {
+            let name = args["app"].as_str().unwrap_or("");
+            let Some(app) = find(name) else {
+                let names: BTreeSet<String> = all().into_iter().map(|a| a.name).collect();
+                return ToolOutcome::error("no_such_agent", format!("No app with an agent is called {name:?}. Apps with an agent: {}.", names.into_iter().collect::<Vec<_>>().join(", ")));
+            };
+            let now = ask(&app);
+            let text = match now {
+                Access::Allowed => format!("{}'s assistant is allowed. Its peer is being prepared; it shows in peer_list shortly.", app.name),
+                Access::NotAsked => format!("{}'s assistant is not yet allowed: the person was asked on the first-use sheet. Wait for them; its peer shows in peer_list once they allow it.", app.name),
+                Access::Off => format!("{}'s assistant is off. Only the person can turn it on (Settings › Assistant › Approvals).", app.name),
+            };
+            if now == Access::Allowed {
+                prepare(&app);
+            }
+            ToolOutcome::Ok(json!({"app": app.id, "name": app.name, "access": now.as_str(), "text": text}))
+        }
+        other => ToolOutcome::error("unknown_tool", format!("{other} is not an agents tool")),
+    }
+}
diff --git a/crates/shell/src/app_chat/mod.rs b/crates/shell/src/app_chat/mod.rs
new file mode 100644
index 00000000..1e79957c
--- /dev/null
+++ b/crates/shell/src/app_chat/mod.rs
@@ -0,0 +1,493 @@
+//! "Ask <app>": the person's lane of an app agent's conversation, drawn by
+//! the shell (ADR 0004 §4, §6) for every app that has an agent
+//! ([`crate::agents`]), whether or not the app draws a chat of its own.
+//!
+//! | Part | Where |
+//! | --- | --- |
+//! | both lanes merged, with speakers | [`model::Conversation`] |
+//! | the pane (desktop column beside the system chat; phone: a full-screen sheet) | the system chat's pane ([`crate::system_chat::view`], `app_panel: true`) |
+//! | the handle | `agents::conversation`: a sharing context on the app's one peer (`open_conversation`) |
+//!
+//! - **Open** (the bar's "Ask <app>", Shift+F8, Setup › Assistant): the
+//!   app's agent must be allowed. Undecided, the first-use sheet shows and
+//!   the panel waits for the person; off, it says so. Allowed: the panel
+//!   opens a sharing context, follows both lanes ([`OctosContext::subscribe`])
+//!   and loads their merged history.
+//! - **Send**: a person turn in this context (`TurnTrigger::Person`), in
+//!   parallel with the system agent's lane. With a question of the app's
+//!   agent open, the text answers it instead.
+//! - **Stop** (#167): `approvals::stop_agent`: both lanes' running turns,
+//!   the app's open questions and the approvals the router holds for it.
+//! - **Questions** of the app's conversation (G11: turns the person or the
+//!   app started) are shown and answered here; the system agent's go to the
+//!   system chat. **Approvals** are the shell's sheets, as everywhere.
+//! - **Close** closes the context; the peer stays for the system agent.
+
+pub mod model;
+
+#[cfg(test)]
+mod tests;
+
+use std::sync::{Arc, Mutex};
+
+use makepad_widgets::*;
+
+use crate::ai_host::app_peers::{ContextEvent, ContextOp, EventSink, OctosContext, TurnTrigger};
+use crate::apps::AgentApp;
+use crate::system_chat::model::{ChatModel, Item, Phase};
+use model::Conversation;
+
+/// The id prefix of the app's questions in the panel.
+pub const ROUTED_PREFIX: &str = "routed:";
+
+/// Where the panel stands.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub enum Status {
+    /// Nothing open.
+    Idle,
+    /// The first-use sheet is up: the person decides.
+    NeedsConsent,
+    /// Turned off: only the person turns it on (Settings).
+    Off,
+    Connecting,
+    Ready,
+    Failed(String),
+}
+
+struct Shared {
+    conversation: Conversation,
+    context: Option<Arc<dyn OctosContext>>,
+    status: Status,
+    generation: u64,
+    /// The context this state belongs to (a reopen starts a new one; late
+    /// events of an old one are dropped).
+    epoch: u64,
+}
+
+struct Panel {
+    app: Option<AgentApp>,
+    open: bool,
+    /// The keyboard goes here (else to the system chat).
+    focused: bool,
+    draft: String,
+    scroll: f64,
+    ui_generation: u64,
+    shared: Arc<Mutex<Shared>>,
+}
+
+static PANEL: Mutex<Option<Panel>> = Mutex::new(None);
+static EPOCH: std::sync::atomic::AtomicU64 = std::sync::atomic::AtomicU64::new(0);
+
+fn with<R>(f: impl FnOnce(&mut Panel) -> R) -> R {
+    let mut guard = PANEL.lock().unwrap_or_else(|e| e.into_inner());
+    let panel = guard.get_or_insert_with(|| Panel {
+        app: None,
+        open: false,
+        focused: false,
+        draft: String::new(),
+        scroll: 0.0,
+        ui_generation: 0,
+        shared: Arc::new(Mutex::new(Shared { conversation: Conversation::new(""), context: None, status: Status::Idle, generation: 0, epoch: 0 })),
+    });
+    f(panel)
+}
+
+fn shared() -> Arc<Mutex<Shared>> {
+    with(|p| p.shared.clone())
+}
+
+fn lock(shared: &Mutex<Shared>) -> std::sync::MutexGuard<'_, Shared> {
+    shared.lock().unwrap_or_else(|e| e.into_inner())
+}
+
+fn changed(s: &mut Shared) {
+    s.generation += 1;
+    SignalToUI::set_ui_signal();
+}
+
+pub fn is_open() -> bool {
+    with(|p| p.open)
+}
+
+/// The app the panel is for.
+pub fn app() -> Option<AgentApp> {
+    with(|p| p.app.clone())
+}
+
+/// Whether the keyboard is the panel's.
+pub fn is_focused() -> bool {
+    with(|p| p.open && p.focused)
+}
+
+pub fn focus(on: bool) {
+    with(|p| {
+        if p.focused != on {
+            p.focused = on;
+            p.ui_generation += 1;
+        }
+    });
+}
+
+/// Open "Ask <app>" for the app with an agent `name` means (its id, its
+/// launcher id or its name). False when it has none.
+pub fn open(name: &str) -> bool {
+    let Some(app) = crate::agents::find(name) else { return false };
+    open_app(app);
+    true
+}
+
+pub fn open_app(app: AgentApp) {
+    let same = with(|p| p.app.as_ref().is_some_and(|a| a.id == app.id));
+    let live = same && lock(&shared()).context.as_ref().is_some_and(|c| c.is_open());
+    with(|p| {
+        p.open = true;
+        p.focused = true;
+        p.ui_generation += 1;
+    });
+    if live {
+        return;
+    }
+    close_context();
+    let epoch = EPOCH.fetch_add(1, std::sync::atomic::Ordering::Relaxed) + 1;
+    {
+        let shared = shared();
+        let mut s = lock(&shared);
+        s.conversation = Conversation::new(&app.name);
+        s.epoch = epoch;
+        s.status = Status::Idle;
+        changed(&mut s);
+    }
+    with(|p| {
+        p.app = Some(app.clone());
+        p.draft.clear();
+        p.scroll = 0.0;
+    });
+    begin(&app);
+}
+
+/// Ask for consent if needed, else connect.
+fn begin(app: &AgentApp) {
+    let status = match crate::agents::ask(app) {
+        crate::agents::Access::Allowed => {
+            connect(app);
+            return;
+        }
+        crate::agents::Access::NotAsked => Status::NeedsConsent,
+        crate::agents::Access::Off => Status::Off,
+    };
+    let shared = shared();
+    let mut s = lock(&shared);
+    s.status = status;
+    changed(&mut s);
+}
+
+/// Open the sharing context (off the UI thread: the peer may be prepared
+/// first), follow both lanes, and load the history.
+fn connect(app: &AgentApp) {
+    let shared = shared();
+    let epoch = {
+        let mut s = lock(&shared);
+        s.status = Status::Connecting;
+        changed(&mut s);
+        s.epoch
+    };
+    let app = app.clone();
+    let _ = std::thread::Builder::new().name("ask-app".into()).spawn(move || {
+        let instance = format!("shell-ask-{epoch}");
+        let context = match crate::agents::conversation(&app, &instance) {
+            Ok(context) => context,
+            Err(e) => {
+                let mut s = lock(&shared);
+                if s.epoch == epoch {
+                    s.status = Status::Failed(e);
+                    changed(&mut s);
+                }
+                return;
+            }
+        };
+        let follower = shared.clone();
+        context.subscribe(Some(Arc::new(move |event| {
+            if let ContextEvent::Data(data) = event {
+                let mut s = lock(&follower);
+                if s.epoch == epoch {
+                    s.conversation.apply(&data);
+                    changed(&mut s);
+                }
+            }
+        })));
+        {
+            let mut s = lock(&shared);
+            if s.epoch != epoch {
+                context.close();
+                return;
+            }
+            s.context = Some(context.clone());
+        }
+        let history = shared.clone();
+        let loaded: EventSink = Arc::new(move |event| {
+            if let ContextEvent::Complete(result) = event {
+                let mut s = lock(&history);
+                if s.epoch != epoch {
+                    return;
+                }
+                match result {
+                    Ok(value) => s.conversation.load_history(&value["messages"]),
+                    Err(e) => s.conversation.notice(format!("Could not load the conversation: {e}")),
+                }
+                s.status = Status::Ready;
+                changed(&mut s);
+            }
+        });
+        if let Err(e) = context.call(ContextOp::History, loaded) {
+            let mut s = lock(&shared);
+            s.status = Status::Failed(e);
+            changed(&mut s);
+        }
+    });
+}
+
+fn close_context() {
+    let context = lock(&shared()).context.take();
+    if let Some(context) = context {
+        context.subscribe(None);
+        context.close();
+    }
+}
+
+pub fn close() {
+    with(|p| {
+        p.open = false;
+        p.focused = false;
+        p.ui_generation += 1;
+    });
+    close_context();
+    let shared = shared();
+    let mut s = lock(&shared);
+    s.status = Status::Idle;
+    changed(&mut s);
+}
+
+/// On the UI thread, with the approvals tick and every signal: the person
+/// decided on the first-use sheet; the agent was turned off.
+pub fn pump() {
+    let Some(app) = with(|p| p.open.then(|| p.app.clone()).flatten()) else { return };
+    let status = lock(&shared()).status.clone();
+    let access = crate::agents::access(&app.id);
+    match (status, access) {
+        (Status::NeedsConsent | Status::Off, crate::agents::Access::Allowed) => connect(&app),
+        (Status::NeedsConsent, crate::agents::Access::Off) => {
+            let shared = shared();
+            let mut s = lock(&shared);
+            s.status = Status::Off;
+            changed(&mut s);
+        }
+        (Status::Ready | Status::Connecting, crate::agents::Access::Off | crate::agents::Access::NotAsked) => {
+            close_context();
+            let shared = shared();
+            let mut s = lock(&shared);
+            s.status = Status::Off;
+            s.conversation.notice(format!("{}'s assistant was turned off.", app.name));
+            changed(&mut s);
+        }
+        _ => {}
+    }
+}
+
+pub fn send_draft() {
+    let text = with(|p| {
+        p.ui_generation += 1;
+        p.scroll = 0.0;
+        std::mem::take(&mut p.draft)
+    });
+    send(&text);
+}
+
+/// The person's message: a turn in the person's lane (or the answer to the
+/// app agent's open question).
+pub fn send(text: &str) {
+    let text = text.trim().to_string();
+    if text.is_empty() {
+        return;
+    }
+    if let Some((question, _)) = snapshot().open_question().map(|(id, n)| (id.to_string(), n)) {
+        answer(&question, &text, false);
+        return;
+    }
+    let shared = shared();
+    let (context, epoch) = {
+        let s = lock(&shared);
+        (s.context.clone(), s.epoch)
+    };
+    let Some(context) = context else {
+        let mut s = lock(&shared);
+        s.conversation.notice("Not connected yet.");
+        changed(&mut s);
+        return;
+    };
+    let failed = shared.clone();
+    let sink: EventSink = Arc::new(move |event| {
+        if let ContextEvent::Complete(Err(e)) = event {
+            let mut s = lock(&failed);
+            if s.epoch == epoch {
+                s.conversation.notice(e);
+                changed(&mut s);
+            }
+        }
+    });
+    if let Err(e) = context.call(ContextOp::TurnFrom { text, trigger: TurnTrigger::Person }, sink) {
+        let mut s = lock(&shared);
+        s.conversation.notice(e);
+        changed(&mut s);
+    }
+}
+
+/// Stop (#167): both lanes, the app's open questions, the approvals held
+/// for it.
+pub fn stop() {
+    let Some(app) = app() else { return };
+    let stopped = crate::approvals::stop_agent(&app.id);
+    let shared = shared();
+    let mut s = lock(&shared);
+    s.conversation.notice(if stopped.is_empty() { "Nothing was running.".to_string() } else { "Stopped.".to_string() });
+    changed(&mut s);
+}
+
+pub fn answer_option(question: &str, _count: usize, label: &str) {
+    answer(question, label, true);
+}
+
+fn answer(question: &str, text: &str, option: bool) {
+    let Some(id) = question.strip_prefix(ROUTED_PREFIX).and_then(|n| n.parse::<u64>().ok()) else { return };
+    use crate::ai_host::app_peers::host_tools::QuestionReply;
+    let reply = if option { QuestionReply::option(text) } else { QuestionReply::text(text) };
+    if let Err(e) = crate::questions::answer(id, &[reply], &crate::questions::PersonAnswer::from_shell_surface()) {
+        log!("ask: question {id}: {e}");
+    }
+}
+
+/// The model as the pane draws it: the conversation, then the app agent's
+/// open questions (G11: the app's conversation).
+pub fn snapshot() -> ChatModel {
+    let (app, shared) = with(|p| (p.app.clone(), p.shared.clone()));
+    let s = lock(&shared);
+    let mut model = s.conversation.chat.clone();
+    let phase = match &s.status {
+        Status::Ready => model.phase().clone(),
+        Status::Failed(why) => Phase::NoKernel(why.clone()),
+        Status::Connecting | Status::Idle => Phase::Connecting,
+        Status::NeedsConsent | Status::Off => Phase::Idle,
+    };
+    model.phase = phase;
+    drop(s);
+    if let Some(app) = app {
+        for request in crate::questions::open(&crate::questions::Conversation::App(app.id.clone())) {
+            model.items.push(Item::Question {
+                id: format!("{ROUTED_PREFIX}{}", request.id),
+                turn: request.turn_id.clone(),
+                title: if request.title.is_empty() { request.asked_by() } else { format!("{}: {}", request.asked_by(), request.title) },
+                body: request.text().to_string(),
+                options: request.options(),
+                count: request.answer_count(),
+                answered: None,
+            });
+        }
+    }
+    model
+}
+
+pub fn status() -> Status {
+    lock(&shared()).status.clone()
+}
+
+/// The header's status line.
+pub fn status_text() -> String {
+    let name = app().map(|a| a.name).unwrap_or_default();
+    match status() {
+        Status::Idle | Status::Connecting => format!("Connecting to {name}'s agent\u{2026}"),
+        Status::NeedsConsent => format!("{name}'s assistant is not allowed yet: allow it on the sheet."),
+        Status::Off => format!("{name}'s assistant is off. Turn it on in Setup \u{203a} Assistant \u{203a} Approvals."),
+        Status::Failed(why) => format!("{name}'s assistant is not available: {why}"),
+        Status::Ready => {
+            if snapshot().phase().running_turn().is_some() {
+                "Working\u{2026} (you and the system agent share this conversation)".to_string()
+            } else {
+                format!("{name}'s agent \u{00b7} ready")
+            }
+        }
+    }
+}
+
+pub fn draft() -> String {
+    with(|p| p.draft.clone())
+}
+
+pub fn scroll() -> f64 {
+    with(|p| p.scroll)
+}
+
+pub fn scroll_by(dy: f64, max: f64) {
+    with(|p| {
+        p.scroll = (p.scroll + dy).clamp(0.0, max.max(0.0));
+        p.ui_generation += 1;
+    });
+}
+
+/// One number for "redraw".
+pub fn generation() -> u64 {
+    let shared = shared();
+    let g = lock(&shared).generation;
+    with(|p| p.ui_generation) + g + crate::questions::generation()
+}
+
+/// The keyboard, while the panel is open and focused. True when it was the
+/// panel's.
+pub fn key(e: &KeyEvent) -> bool {
+    if !is_focused() {
+        return false;
+    }
+    let command_key = e.modifiers.logo || e.modifiers.control;
+    match e.key_code {
+        KeyCode::Escape => close(),
+        KeyCode::ReturnKey if !e.modifiers.shift => send_draft(),
+        KeyCode::Backspace => with(|p| {
+            p.draft.pop();
+            p.ui_generation += 1;
+        }),
+        KeyCode::Period if command_key => stop(),
+        other if !command_key => {
+            // Function keys (F8: the system chat) go on to the shell.
+            let Some(ch) = other.to_char(e.modifiers.shift) else { return false };
+            with(|p| {
+                p.draft.push(ch);
+                p.ui_generation += 1;
+            });
+        }
+        _ => return false,
+    }
+    true
+}
+
+/// Text from the platform's input method (phones), while focused.
+pub fn text_input(text: &str) -> bool {
+    if !is_focused() {
+        return false;
+    }
+    with(|p| {
+        p.draft.push_str(text);
+        p.ui_generation += 1;
+    });
+    true
+}
+
+/// `--test-action ask:<app>` (open the panel) and `ask-send:<text>` (send
+/// in the open panel), for hidden-window runs.
+pub fn test_action(name: &str) -> bool {
+    if let Some(app) = name.strip_prefix("ask:") {
+        return open(app);
+    }
+    if let Some(text) = name.strip_prefix("ask-send:") {
+        send(text);
+        return true;
+    }
+    false
+}
diff --git a/crates/shell/src/app_chat/model.rs b/crates/shell/src/app_chat/model.rs
new file mode 100644
index 00000000..75039037
--- /dev/null
+++ b/crates/shell/src/app_chat/model.rs
@@ -0,0 +1,209 @@
+//! An app's conversation as the "Ask <app>" panel draws it: both lanes of
+//! the app agent's conversation (ADR 0004 §6), merged, each message with
+//! who spoke. Built only from what the conversation handle delivers (its
+//! follower's events and its history), on the system chat's model
+//! ([`crate::system_chat::model::ChatModel`]), so both surfaces assemble
+//! streamed text, tools and approvals the same way. No drawing, no I/O.
+//!
+//! - **Lanes.** Every event carries its `lane`: `person` (this panel's
+//!   sharing context) or `system_agent` (the peer's own session, the
+//!   system agent's `peer/input` turns). Both run in parallel: the panel
+//!   is busy while either runs.
+//! - **Speakers.** A user message names who spoke (`speaker`, from the
+//!   kernel's origin marker or the broker's record): the person ("You"),
+//!   the system agent, or the app itself; the text shown is the text after
+//!   the marker (`display_text`). The agent's answers are "<App>'s agent",
+//!   and in the system agent's lane "<App>'s agent, to the system agent".
+//! - **Approvals** are the shell's: the router draws the sheet (the broker
+//!   hands every approval of the peer to it). Nothing here answers one.
+
+use std::collections::{BTreeSet, HashMap};
+
+use serde_json::Value;
+
+use crate::system_chat::model::{ChatModel, Item, Phase, Role};
+
+/// The person's lane (this panel's context) and the system agent's.
+pub const LANE_PERSON: &str = "person";
+pub const LANE_SYSTEM_AGENT: &str = "system_agent";
+
+/// One app's conversation, both lanes.
+#[derive(Clone, Debug, Default)]
+pub struct Conversation {
+    pub chat: ChatModel,
+    /// The app's display name ("News").
+    pub app: String,
+    /// The turns running now, in either lane.
+    running: BTreeSet<String>,
+    /// Each turn's lane, as its events said.
+    lanes: HashMap<String, String>,
+    /// Turns that ended (their late envelopes do not make them run again).
+    finished: Vec<String>,
+}
+
+impl Conversation {
+    pub fn new(app: &str) -> Self {
+        Conversation { app: app.to_string(), chat: ChatModel::new(), ..Conversation::default() }
+    }
+
+    /// Whether a turn runs in either lane.
+    pub fn busy(&self) -> bool {
+        !self.running.is_empty()
+    }
+
+    /// The label of a user message's speaker (`{"kind", "label"?}`).
+    pub fn speaker_label(&self, speaker: &Value) -> String {
+        match speaker["kind"].as_str().unwrap_or("") {
+            "system_agent" => "System agent".to_string(),
+            "app" => format!("{} (the app)", self.app),
+            // The person, in this panel or in the app's own UI.
+            _ => "You".to_string(),
+        }
+    }
+
+    /// The label of the agent's answers in `lane`.
+    pub fn agent_label(&self, lane: &str) -> String {
+        if lane == LANE_SYSTEM_AGENT {
+            format!("{}'s agent, to the system agent", self.app)
+        } else {
+            format!("{}'s agent", self.app)
+        }
+    }
+
+    /// One event of the conversation's follower: `{method, params, lane,
+    /// speaker?, display_text?}`.
+    pub fn apply(&mut self, data: &Value) {
+        let method = data["method"].as_str().unwrap_or("");
+        let params = &data["params"];
+        let lane = data["lane"].as_str().unwrap_or(LANE_PERSON).to_string();
+        let turn = params["turn_id"].as_str().unwrap_or("").to_string();
+        if !turn.is_empty() {
+            self.lanes.entry(turn.clone()).or_insert_with(|| lane.clone());
+        }
+        let kind = params["payload"]["type"].as_str().unwrap_or("");
+        match (method, kind) {
+            ("projection/envelope", "user_message") => {
+                // Who asked: the turn starts here, in its lane.
+                let text = data["display_text"]
+                    .as_str()
+                    .map(str::to_string)
+                    .or_else(|| params["payload"]["data"]["text"].as_str().map(|t| strip_marker(t).to_string()))
+                    .unwrap_or_default();
+                let speaker = self.speaker_label(&data["speaker"]);
+                let seq = params["cursor"]["seq"].as_u64().or_else(|| params["seq"].as_u64());
+                let known = self.chat.items.iter().any(|i| matches!(i, Item::Message { role: Role::User, turn: Some(t), .. } if *t == turn));
+                if !known && !text.trim().is_empty() {
+                    let item = Item::Message { role: Role::User, text, turn: Some(turn.clone()), segment: None, seq, speaker: Some(speaker) };
+                    self.chat.insert_ordered(item, seq);
+                }
+                if !self.ended(&turn) {
+                    self.running.insert(turn.clone());
+                }
+            }
+            ("turn/started", _) => {
+                if !self.ended(&turn) {
+                    self.running.insert(turn.clone());
+                }
+            }
+            _ => {}
+        }
+        let terminal = matches!(method, "turn/completed" | "turn/error") || kind == "turn_terminal";
+        // The approvals the model notes are the router's; its effects are
+        // never acted on here.
+        let _ = self.chat.apply(method, params);
+        if terminal && !turn.is_empty() {
+            self.running.remove(&turn);
+            self.finished.push(turn.clone());
+            if self.finished.len() > 256 {
+                self.finished.remove(0);
+            }
+        }
+        self.label_answers();
+        self.settle_phase();
+    }
+
+    fn ended(&self, turn: &str) -> bool {
+        self.finished.iter().any(|t| t == turn)
+    }
+
+    /// Name the agent's answers by their turn's lane.
+    fn label_answers(&mut self) {
+        let lanes = &self.lanes;
+        let person = format!("{}'s agent", self.app);
+        let system = format!("{}'s agent, to the system agent", self.app);
+        for item in &mut self.chat.items {
+            if let Item::Message { role: Role::Assistant, turn: Some(t), speaker: speaker @ None, .. } = item {
+                *speaker = Some(if lanes.get(t).is_some_and(|l| l == LANE_SYSTEM_AGENT) { system.clone() } else { person.clone() });
+            }
+        }
+    }
+
+    /// Busy while either lane runs; otherwise ready (the model's own phase
+    /// follows one turn at a time).
+    fn settle_phase(&mut self) {
+        let phase = match self.running.iter().next() {
+            Some(turn) => Phase::Running { turn: turn.clone() },
+            None => Phase::Ready,
+        };
+        self.chat.set_phase(phase);
+    }
+
+    /// The conversation's history (both transcripts merged by time; rows
+    /// `{role, content, lane, speaker?, display_text?, thread_id|turn_id?}`)
+    /// replaces what the panel showed.
+    pub fn load_history(&mut self, rows: &Value) {
+        let mut items = Vec::new();
+        for row in rows.as_array().into_iter().flatten() {
+            let lane = row["lane"].as_str().unwrap_or(LANE_PERSON);
+            let turn = row["turn_id"].as_str().or_else(|| row["thread_id"].as_str()).map(str::to_string);
+            if let Some(t) = &turn {
+                self.lanes.entry(t.clone()).or_insert_with(|| lane.to_string());
+            }
+            let content = row["content"].as_str().unwrap_or("");
+            match row["role"].as_str().unwrap_or("") {
+                "user" => {
+                    let text = row["display_text"].as_str().unwrap_or_else(|| strip_marker(content)).to_string();
+                    let speaker = if row["speaker"].is_object() {
+                        self.speaker_label(&row["speaker"])
+                    } else if lane == LANE_SYSTEM_AGENT {
+                        "System agent".to_string()
+                    } else {
+                        "You".to_string()
+                    };
+                    items.push(Item::Message { role: Role::User, text, turn, segment: None, seq: None, speaker: Some(speaker) });
+                }
+                "assistant" if !content.trim().is_empty() => {
+                    items.push(Item::Message { role: Role::Assistant, text: content.to_string(), turn, segment: None, seq: None, speaker: Some(self.agent_label(lane)) });
+                }
+                "tool" => items.push(Item::Tool {
+                    call_id: row["tool_call_id"].as_str().unwrap_or("").to_string(),
+                    name: row["name"].as_str().or_else(|| row["tool_name"].as_str()).unwrap_or("tool").to_string(),
+                    status: crate::system_chat::model::ToolStatus::Done,
+                    detail: String::new(),
+                    turn,
+                    seq: None,
+                }),
+                _ => {}
+            }
+        }
+        // What history cannot know stays: notices, and anything still open.
+        for item in std::mem::take(&mut self.chat.items) {
+            let keep = matches!(item, Item::Question { answered: None, .. } | Item::Notice(_))
+                || matches!(&item, Item::Message { turn: Some(t), .. } if self.running.contains(t));
+            if keep {
+                items.push(item);
+            }
+        }
+        self.chat.items = items;
+        self.settle_phase();
+    }
+
+    pub fn notice(&mut self, text: impl Into<String>) {
+        self.chat.notice(text);
+    }
+}
+
+/// The text after the kernel's origin marker, if it carries one.
+fn strip_marker(text: &str) -> &str {
+    crate::ai_host::app_peers::split_origin_marker(text).map(|(_, rest)| rest).unwrap_or(text)
+}
diff --git a/crates/shell/src/app_chat/tests.rs b/crates/shell/src/app_chat/tests.rs
new file mode 100644
index 00000000..26a240f6
--- /dev/null
+++ b/crates/shell/src/app_chat/tests.rs
@@ -0,0 +1,358 @@
+//! "Ask <app>" and an agent for every app (ADR 0004 §4, §6): which apps
+//! have an agent, the conversation's two lanes with their speakers, the
+//! panel on a fake peer (it opens a sharing context and sends the person's
+//! turns there; Stop; revocation), and what the system agent is told.
+
+use std::collections::BTreeSet;
+use std::sync::atomic::{AtomicBool, Ordering};
+use std::sync::{Arc, Mutex};
+use std::time::{Duration, Instant};
+
+use serde_json::{json, Value};
+
+use super::model::{Conversation, LANE_PERSON, LANE_SYSTEM_AGENT};
+use crate::ai_host::app_peers::{Availability, ContextEvent, ContextOp, ContextSpec, Deployment, EventSink, ModelInfo, OctosAppService, OctosContext, SettingsEntry, TurnTrigger, OCTOS_SERVICES};
+use crate::apps::AgentApp;
+use crate::system_chat::model::{Item, Role};
+
+fn labels(c: &Conversation) -> Vec<(String, String)> {
+    c.chat
+        .items
+        .iter()
+        .filter_map(|i| match i {
+            Item::Message { speaker, text, .. } => Some((speaker.clone().unwrap_or_default(), text.clone())),
+            _ => None,
+        })
+        .collect()
+}
+
+fn env(lane: &str, turn: &str, cursor: u64, kind: &str, data: Value) -> Value {
+    json!({"method": "projection/envelope", "lane": lane,
+        "params": {"turn_id": turn, "cursor": {"seq": cursor}, "payload": {"type": kind, "data": data}}})
+}
+
+// ---------------------------------------------------------------- which apps
+
+/// News ships `tools.json` (G3) and declares no `octos.*`: it has an agent.
+/// An app with neither tools nor an agent block has none; a manifest's
+/// `agent` block is enough.
+#[test]
+fn news_is_listed_as_having_an_agent() {
+    let dir = std::env::temp_dir().join(format!("octosense-ask-apps-{}", std::process::id()));
+    let _ = std::fs::remove_dir_all(&dir);
+    #[cfg(any(feature = "app-hub", native_mobile))]
+    let news = crate::host_tools::script_apps::tests::stamped_bundle("news", "ask", |_, _| {});
+    #[cfg(not(any(feature = "app-hub", native_mobile)))]
+    let news = {
+        let src = std::path::Path::new(env!("CARGO_MANIFEST_DIR")).join("../../apps/news/bundle");
+        let d = dir.join("news");
+        std::fs::create_dir_all(&d).unwrap();
+        for f in ["manifest.json", "tools.json"] {
+            std::fs::copy(src.join(f), d.join(f)).unwrap();
+        }
+        d
+    };
+    let app = crate::apps::script_agent_app(&news.join("manifest.json"), "os.news", "News").expect("News has an agent");
+    assert!(app.octos.is_empty(), "it declares no octos.* service");
+    assert!(!app.native);
+    assert_eq!(crate::agents::peer_of(&app), "card.os.news");
+    // No tools, no agent block, no octos.*: no agent.
+    let clock = dir.join("clock");
+    std::fs::create_dir_all(&clock).unwrap();
+    std::fs::write(clock.join("manifest.json"), r#"{"id":"org.example.clock","capabilities":["storage"]}"#).unwrap();
+    assert!(crate::apps::script_agent_app(&clock.join("manifest.json"), "org.example.clock", "Clock").is_none());
+    std::fs::write(clock.join("manifest.json"), r#"{"id":"org.example.clock","capabilities":["storage"],"agent":{"profile":"read-only"}}"#).unwrap();
+    assert!(crate::apps::script_agent_app(&clock.join("manifest.json"), "org.example.clock", "Clock").is_some(), "an agent block declares one");
+    // Found by what the shell knows of a window: its launcher id or name.
+    let apps = vec![app.clone()];
+    for name in ["os.news", "news", "News", "card.os.news", "hub:os.news"] {
+        assert_eq!(crate::agents::find_in(&apps, name).map(|a| a.id), Some("os.news".to_string()), "{name}");
+    }
+    // Native apps come from native-apps.json (Rinx's agent block).
+    assert!(crate::apps::agent_apps().iter().any(|a| a.id == "rinx" && a.native));
+    let _ = std::fs::remove_dir_all(&news);
+    let _ = std::fs::remove_dir_all(&dir);
+}
+
+/// The consent store tells the shell which agents were just allowed (it
+/// prepares their peers); turning one off takes it back.
+#[test]
+fn allowing_an_agent_queues_its_preparation() {
+    let mut store = crate::approvals::consent::ConsentStore::memory();
+    let tap = crate::approvals::rules::ApprovalGesture::sheet_tap();
+    store.set(&tap, "os.news", true, 1);
+    store.set(&tap, "org.example.trip", true, 1);
+    store.turn_off("org.example.trip", 2);
+    assert_eq!(store.take_allowed(), ["os.news".to_string()]);
+    assert!(store.take_allowed().is_empty(), "once");
+    assert_eq!(store.take_revoked(), ["org.example.trip".to_string()]);
+}
+
+// ---------------------------------------------------------------- the lanes
+
+/// Both lanes, merged, each message with who spoke: the person's turn in
+/// the panel, the system agent's `peer/input` turn, and the agent's
+/// answers in each lane. The panel is busy while either lane runs.
+#[test]
+fn both_lanes_show_with_their_speakers_and_run_in_parallel() {
+    let mut c = Conversation::new("News");
+    // The system agent asks for a digest (its lane).
+    c.apply(&json!({"method": "turn/started", "lane": LANE_SYSTEM_AGENT, "params": {"turn_id": "s1"}}));
+    c.apply(&json!({"method": "projection/envelope", "lane": LANE_SYSTEM_AGENT, "speaker": {"kind": "system_agent"}, "display_text": "Give me today's digest",
+        "params": {"turn_id": "s1", "cursor": {"seq": 10}, "payload": {"type": "user_message", "data": {"text": "[from the system agent] Give me today's digest"}}}}));
+    c.apply(&env(LANE_SYSTEM_AGENT, "s1", 11, "assistant_delta", json!({"assistant_segment_id": "s1:1", "text": "Working on the digest"})));
+    assert!(c.busy());
+    // Meanwhile the person asks in the panel (their lane).
+    c.apply(&json!({"method": "projection/envelope", "lane": LANE_PERSON, "speaker": {"kind": "person", "label": "News"},
+        "params": {"turn_id": "p1", "cursor": {"seq": 12}, "payload": {"type": "user_message", "data": {"text": "[from the person: News] what are you working on?"}}}}));
+    c.apply(&env(LANE_PERSON, "p1", 13, "assistant_persisted", json!({"assistant_segment_id": "p1:1", "text": "A digest for the system agent."})));
+    c.apply(&env(LANE_PERSON, "p1", 14, "turn_terminal", json!({"outcome": "completed"})));
+    assert!(c.busy(), "the system agent's lane still runs");
+    c.apply(&env(LANE_SYSTEM_AGENT, "s1", 15, "assistant_persisted", json!({"assistant_segment_id": "s1:1", "text": "Working on the digest: 3 stories."})));
+    c.apply(&env(LANE_SYSTEM_AGENT, "s1", 16, "turn_terminal", json!({"outcome": "completed"})));
+    assert!(!c.busy());
+    assert_eq!(
+        labels(&c),
+        [
+            ("System agent".to_string(), "Give me today's digest".to_string()),
+            ("News's agent, to the system agent".to_string(), "Working on the digest: 3 stories.".to_string()),
+            ("You".to_string(), "what are you working on?".to_string()),
+            ("News's agent".to_string(), "A digest for the system agent.".to_string()),
+        ]
+    );
+    // A late envelope of an ended turn does not make it run again.
+    c.apply(&json!({"method": "projection/envelope", "lane": LANE_PERSON, "speaker": {"kind": "person"},
+        "params": {"turn_id": "p1", "cursor": {"seq": 12}, "payload": {"type": "user_message", "data": {"text": "what are you working on?"}}}}));
+    assert!(!c.busy());
+}
+
+/// The merged history (both transcripts, by time) shows the same speakers.
+#[test]
+fn the_merged_history_names_its_speakers() {
+    let mut c = Conversation::new("News");
+    c.load_history(&json!([
+        {"role": "user", "content": "[from the system agent] digest please", "lane": "system_agent", "speaker": {"kind": "system_agent"}, "display_text": "digest please", "thread_id": "s1"},
+        {"role": "user", "content": "[from the person: News] focus on tech", "lane": "person", "speaker": {"kind": "person", "label": "News"}, "display_text": "focus on tech", "thread_id": "p1"},
+        {"role": "assistant", "content": "Tech it is.", "lane": "person", "thread_id": "p1"},
+        {"role": "assistant", "content": "Here is the tech digest.", "lane": "system_agent", "thread_id": "s1"},
+        {"role": "user", "content": "[from the app] refresh", "lane": "person", "thread_id": "a1"},
+    ]));
+    assert_eq!(
+        labels(&c),
+        [
+            ("System agent".to_string(), "digest please".to_string()),
+            ("You".to_string(), "focus on tech".to_string()),
+            ("News's agent".to_string(), "Tech it is.".to_string()),
+            ("News's agent, to the system agent".to_string(), "Here is the tech digest.".to_string()),
+            ("You".to_string(), "refresh".to_string()),
+        ]
+    );
+}
+
+// ---------------------------------------------------------------- the panel
+
+struct FakeContext {
+    ops: Mutex<Vec<ContextOp>>,
+    open: AtomicBool,
+    follower: Mutex<Option<EventSink>>,
+}
+
+impl OctosContext for FakeContext {
+    fn call(&self, op: ContextOp, sink: EventSink) -> Result<(), String> {
+        if !self.open.load(Ordering::SeqCst) {
+            return Err("closed".into());
+        }
+        self.ops.lock().unwrap().push(op.clone());
+        match op {
+            ContextOp::History => sink(ContextEvent::Complete(Ok(json!({"messages": [
+                {"role": "user", "content": "[from the system agent] earlier", "lane": "system_agent", "speaker": {"kind": "system_agent"}, "display_text": "earlier"},
+            ]})))),
+            ContextOp::TurnFrom { text, .. } => {
+                // The kernel's events reach the follower, then the answer.
+                if let Some(follower) = self.follower.lock().unwrap().clone() {
+                    follower(ContextEvent::Data(json!({"method": "projection/envelope", "lane": "person", "speaker": {"kind": "person"}, "display_text": text,
+                        "params": {"turn_id": "p9", "cursor": {"seq": 90}, "payload": {"type": "user_message", "data": {"text": text}}}})));
+                    follower(ContextEvent::Data(env("person", "p9", 91, "assistant_persisted", json!({"assistant_segment_id": "p9:1", "text": "Noted."}))));
+                    follower(ContextEvent::Data(env("person", "p9", 92, "turn_terminal", json!({"outcome": "completed"}))));
+                }
+                sink(ContextEvent::Complete(Ok(json!({"text": "Noted."}))));
+            }
+            _ => sink(ContextEvent::Complete(Ok(json!({})))),
+        }
+        Ok(())
+    }
+    fn close(&self) {
+        self.open.store(false, Ordering::SeqCst);
+    }
+    fn is_open(&self) -> bool {
+        self.open.load(Ordering::SeqCst)
+    }
+    fn subscribe(&self, sink: Option<EventSink>) {
+        *self.follower.lock().unwrap() = sink;
+    }
+}
+
+#[derive(Default)]
+struct FakePeer {
+    conversations: Mutex<Vec<(ContextSpec, Arc<FakeContext>)>>,
+    prepared: Mutex<usize>,
+    released: AtomicBool,
+}
+
+impl OctosAppService for FakePeer {
+    fn deployment(&self) -> Deployment {
+        Deployment::Hosted
+    }
+    fn availability(&self) -> Availability {
+        Availability::Ready
+    }
+    fn services(&self) -> BTreeSet<String> {
+        OCTOS_SERVICES.iter().map(|s| s.to_string()).collect()
+    }
+    fn model(&self) -> Option<ModelInfo> {
+        None
+    }
+    fn settings_entry(&self) -> SettingsEntry {
+        SettingsEntry::Host
+    }
+    fn set_account(&self, _account: Option<&str>) {}
+    fn open_context(&self, _spec: ContextSpec) -> Result<Arc<dyn OctosContext>, String> {
+        Err("the panel opens the app's conversation, never a plain context".into())
+    }
+    fn open_conversation(&self, spec: ContextSpec) -> Result<Arc<dyn OctosContext>, String> {
+        let context = Arc::new(FakeContext { ops: Mutex::default(), open: AtomicBool::new(true), follower: Mutex::default() });
+        self.conversations.lock().unwrap().push((spec, context.clone()));
+        Ok(context)
+    }
+    fn prepare(&self) -> Result<(), String> {
+        *self.prepared.lock().unwrap() += 1;
+        Ok(())
+    }
+    fn release(&self) {
+        self.released.store(true, Ordering::SeqCst);
+        for (_, c) in self.conversations.lock().unwrap().iter() {
+            c.close();
+        }
+    }
+    fn shutdown(&self) {}
+}
+
+#[derive(Default)]
+struct FakePeers(Mutex<Vec<(String, Arc<FakePeer>)>>);
+
+impl crate::ai_host::contained::PeerFactory for FakePeers {
+    fn launch(&self, peer_id: &str, _app_id: &str, _services: &BTreeSet<String>) -> Option<Arc<dyn OctosAppService>> {
+        let peer = Arc::new(FakePeer::default());
+        self.0.lock().unwrap().push((peer_id.to_string(), peer.clone()));
+        Some(peer)
+    }
+}
+
+fn wait(what: &str, done: impl Fn() -> bool) {
+    let deadline = Instant::now() + Duration::from_secs(10);
+    while !done() {
+        assert!(Instant::now() < deadline, "timed out waiting for {what}");
+        std::thread::sleep(Duration::from_millis(10));
+    }
+}
+
+/// The panel, end to end on a fake peer: it asks consent first; once the
+/// person allowed the agent it opens a SHARING context on the app's peer
+/// (`open_conversation`, never a plain context), follows both lanes, loads
+/// the merged history, and sends the person's words as a person turn in
+/// that context. The shell prepares an allowed agent's peer. Turning the
+/// agent off releases the peer and closes the panel's context.
+#[test]
+fn the_panel_opens_a_sharing_context_and_sends_person_turns_there() {
+    const APP: &str = "org.example.asktest";
+    let _factory = crate::agents::FACTORY_TESTS.lock().unwrap_or_else(|e| e.into_inner());
+    if crate::approvals::with(|_| ()).is_none() {
+        crate::approvals::init_memory();
+    }
+    crate::approvals::with(|a| a.consent.turn_off(APP, 1));
+    let peers = Arc::new(FakePeers::default());
+    crate::ai_host::contained::set_factory(peers.clone());
+    let app = AgentApp { id: APP.into(), name: "Ask Test".into(), octos: Vec::new(), manifest: json!({"capabilities": ["storage"]}), native: false };
+
+    // Off: the panel says so and opens nothing.
+    super::open_app(app.clone());
+    assert_eq!(super::status(), super::Status::Off);
+    assert!(peers.0.lock().unwrap().is_empty(), "no peer for an agent that is off");
+
+    // The person allows it (Settings, or the first-use sheet).
+    crate::approvals::with(|a| a.consent.set(&crate::approvals::rules::ApprovalGesture::sheet_tap(), APP, true, 2));
+    assert_eq!(crate::agents::access(APP), crate::agents::Access::Allowed);
+    super::pump();
+    wait("the conversation", || super::status() == super::Status::Ready);
+    let (spec, context) = {
+        let convs = &peers.0.lock().unwrap()[0].1;
+        let c = convs.conversations.lock().unwrap();
+        (c[0].0.clone(), c[0].1.clone())
+    };
+    assert_eq!(peers.0.lock().unwrap()[0].0, format!("card.{APP}"));
+    assert_eq!(spec.services.len(), OCTOS_SERVICES.len(), "the panel reads history, starts and stops turns");
+    assert_eq!(context.ops.lock().unwrap().as_slice(), [ContextOp::History]);
+    assert!(super::snapshot().items.iter().any(|i| matches!(i, Item::Message { speaker: Some(s), text, .. } if s == "System agent" && text == "earlier")), "the merged history");
+
+    // The person's words: a person turn in that context.
+    super::send("focus the digest on technology");
+    assert_eq!(context.ops.lock().unwrap().last(), Some(&ContextOp::TurnFrom { text: "focus the digest on technology".into(), trigger: TurnTrigger::Person }));
+    let model = super::snapshot();
+    let said: Vec<(Role, String, String)> = model.items.iter().filter_map(|i| match i {
+        Item::Message { role, text, speaker, .. } => Some((*role, speaker.clone().unwrap_or_default(), text.clone())),
+        _ => None,
+    }).collect();
+    assert!(said.contains(&(Role::User, "You".into(), "focus the digest on technology".into())), "{said:?}");
+    assert!(said.contains(&(Role::Assistant, "Ask Test's agent".into(), "Noted.".into())), "{said:?}");
+
+    // The shell prepares an allowed agent's peer: the panel's is the same
+    // one (nothing more to do); another allowed app's is bound now.
+    crate::agents::prepare(&app);
+    assert_eq!(crate::agents::prepared(APP), Some(crate::agents::Prepared::Ready));
+    assert_eq!(peers.0.lock().unwrap().len(), 1, "one peer per app");
+    const OTHER: &str = "org.example.asktest2";
+    crate::approvals::with(|a| a.consent.set(&crate::approvals::rules::ApprovalGesture::sheet_tap(), OTHER, true, 2));
+    let other = AgentApp { id: OTHER.into(), name: "Other".into(), ..app.clone() };
+    crate::agents::prepare(&other);
+    wait("the preparation", || crate::agents::prepared(OTHER) == Some(crate::agents::Prepared::Ready));
+    let prepared = peers.0.lock().unwrap().iter().find(|(id, _)| *id == format!("card.{OTHER}")).map(|(_, p)| *p.prepared.lock().unwrap());
+    assert_eq!(prepared, Some(1), "bound before any turn: the system agent's peer_list shows it");
+    crate::approvals::with(|a| a.consent.turn_off(OTHER, 3));
+    crate::ai_host::contained::revoke(OTHER);
+
+    // Turned off: the peer goes, the panel's context closes, and it says so.
+    crate::approvals::with(|a| a.consent.turn_off(APP, 3));
+    assert!(crate::ai_host::contained::revoke(APP));
+    assert!(peers.0.lock().unwrap().iter().find(|(id, _)| *id == format!("card.{APP}")).unwrap().1.released.load(Ordering::SeqCst));
+    super::pump();
+    assert_eq!(super::status(), super::Status::Off);
+    assert!(!context.is_open());
+    super::close();
+}
+
+// ---------------------------------------------------------------- the system agent
+
+/// The system agent hears which apps have an agent and where each stands,
+/// including the ones it cannot see in peer_list; the pane hides the note.
+#[test]
+fn the_system_agent_is_told_about_agents_it_cannot_list() {
+    let note = crate::agents::system_note().expect("Rinx has an agent in every build");
+    assert!(note.starts_with("[OctoSense: apps with an agent:"), "{note}");
+    assert!(note.contains("Rinx [rinx]"), "{note}");
+    let sent = format!("{note}\nask News for a digest");
+    assert_eq!(crate::agents::strip_note(&sent), "ask News for a digest");
+    assert_eq!(crate::agents::strip_note("ask News"), "ask News");
+    // The tools it can call, answered by the shell.
+    let names: Vec<String> = crate::agents::declarations().iter().map(|d| d["name"].as_str().unwrap().to_string()).collect();
+    assert_eq!(names, [crate::agents::LIST_TOOL, crate::agents::ASK_TOOL]);
+    match crate::agents::call(crate::agents::LIST_TOOL, &json!({})) {
+        crate::ai_host::app_peers::host_tools::ToolOutcome::Ok(v) => {
+            assert!(v["apps"].as_array().unwrap().iter().any(|a| a["app"] == "rinx" && a["what_to_do"].as_str().is_some()), "{v}");
+        }
+        other => panic!("{other:?}"),
+    }
+    match crate::agents::call(crate::agents::ASK_TOOL, &json!({"app": "no such app"})) {
+        crate::ai_host::app_peers::host_tools::ToolOutcome::Error { kind, .. } => assert_eq!(kind, "no_such_agent"),
+        other => panic!("{other:?}"),
+    }
+}
diff --git a/crates/shell/src/approvals/consent.rs b/crates/shell/src/approvals/consent.rs
index 718e5c7c..a469febf 100644
--- a/crates/shell/src/approvals/consent.rs
+++ b/crates/shell/src/approvals/consent.rs
@@ -106,12 +106,15 @@ pub struct ConsentStore {
     /// Apps whose agent was just turned off: the shell revokes their live
     /// services ([`ConsentStore::take_revoked`]).
     revoked: Vec<String>,
+    /// Apps whose agent was just allowed: the shell prepares their peer
+    /// ([`ConsentStore::take_allowed`], `crate::agents`).
+    allowed: Vec<String>,
     generation: u64,
 }
 
 impl ConsentStore {
     pub fn memory() -> ConsentStore {
-        ConsentStore { path: None, decided: BTreeMap::new(), known: BTreeMap::new(), asking: Vec::new(), revoked: Vec::new(), generation: 0 }
+        ConsentStore { path: None, decided: BTreeMap::new(), known: BTreeMap::new(), asking: Vec::new(), revoked: Vec::new(), allowed: Vec::new(), generation: 0 }
     }
     pub fn in_home(home: &Path) -> ConsentStore {
         let path = home.join(CONSENT_FILE);
@@ -162,6 +165,8 @@ impl ConsentStore {
     pub fn set(&mut self, _gesture: &ApprovalGesture, app: &str, allowed: bool, now: u64) {
         if !allowed {
             self.revoke(app);
+        } else if !self.allowed.iter().any(|a| a == app) {
+            self.allowed.push(app.to_string());
         }
         self.decided.insert(app.to_string(), Record { allowed, at: now });
         self.asking.retain(|a| a != app);
@@ -176,7 +181,13 @@ impl ConsentStore {
         self.generation += 1;
         self.save();
     }
+    /// The apps whose agent was allowed since the last call: the shell
+    /// prepares their peer now (ADR 0004 §4).
+    pub fn take_allowed(&mut self) -> Vec<String> {
+        std::mem::take(&mut self.allowed)
+    }
     fn revoke(&mut self, app: &str) {
+        self.allowed.retain(|a| a != app);
         if !self.revoked.iter().any(|a| a == app) {
             self.revoked.push(app.to_string());
         }
diff --git a/crates/shell/src/approvals/mod.rs b/crates/shell/src/approvals/mod.rs
index f1f37d14..c3911aea 100644
--- a/crates/shell/src/approvals/mod.rs
+++ b/crates/shell/src/approvals/mod.rs
@@ -322,6 +322,11 @@ pub fn register_agents(a: &mut Approvals, apps: &[crate::apps::AgentApp]) {
 pub fn take_revoked() -> Vec<String> {
     with(|a| a.consent.take_revoked()).unwrap_or_default()
 }
+/// The apps whose agent the person just allowed: the shell prepares their
+/// peer (`crate::agents::pump`).
+pub fn take_allowed() -> Vec<String> {
+    with(|a| a.consent.take_allowed()).unwrap_or_default()
+}
 pub fn close_settings() {
     with(|a| a.settings_open = false);
 }
diff --git a/crates/shell/src/approvals/tests.rs b/crates/shell/src/approvals/tests.rs
index 0986aae2..24b9ae00 100644
--- a/crates/shell/src/approvals/tests.rs
+++ b/crates/shell/src/approvals/tests.rs
@@ -718,7 +718,7 @@ fn only_settings_and_the_sheet_make_a_person_gesture() {
     let src = std::path::Path::new(env!("CARGO_MANIFEST_DIR")).join("src");
     let mut files = Vec::new();
     walk(&src, &mut files);
-    let allowed = ["approvals/view.rs", "approvals/settings_page.rs", "approvals/rules.rs", "approvals/tests.rs", "system_chat/tests.rs", "host_tools/tests.rs", "host_tools/real_kernel_tests.rs", "host_tools/scenario_tests.rs"];
+    let allowed = ["approvals/view.rs", "approvals/settings_page.rs", "approvals/rules.rs", "approvals/tests.rs", "system_chat/tests.rs", "host_tools/tests.rs", "host_tools/real_kernel_tests.rs", "host_tools/scenario_tests.rs", "app_chat/tests.rs"];
     for f in files {
         let text = std::fs::read_to_string(&f).unwrap();
         let rel = f.strip_prefix(&src).unwrap().to_string_lossy().replace('\\', "/");
diff --git a/crates/shell/src/apps.rs b/crates/shell/src/apps.rs
index 91d89984..b91475d5 100644
--- a/crates/shell/src/apps.rs
+++ b/crates/shell/src/apps.rs
@@ -189,11 +189,15 @@ pub struct AgentApp {
     pub octos: Vec<String>,
     /// Its manifest, as the first-use sheet reads it.
     pub manifest: serde_json::Value,
+    /// A native app (`native-apps.json`); else a script app (App Hub).
+    pub native: bool,
 }
 
-/// Every app that declares an agent: native apps whose `native-apps.json`
-/// entry grants `octos.*`, and script apps (system and installed) whose
-/// manifest declares `octos.*`, whether or not they have asked yet.
+/// Every app that declares an agent (ADR 0004 §4): native apps whose
+/// `native-apps.json` entry grants `octos.*`, and script apps (system and
+/// installed) whose manifest declares `octos.*` or an `agent` block, or
+/// whose admitted bundle ships `tools.json` ([`script_agent_app`]), whether
+/// or not they have asked yet.
 pub fn agent_apps() -> Vec<AgentApp> {
     let mut out: Vec<AgentApp> = crate::native_apps::APPS
         .iter()
@@ -203,6 +207,7 @@ pub fn agent_apps() -> Vec<AgentApp> {
             name: crate::approvals::sheet::app_label(a.id),
             octos: a.octos.iter().map(|s| s.to_string()).collect(),
             manifest: serde_json::json!({ "agent": { "octos": a.octos } }),
+            native: true,
         })
         .collect();
     out.extend(script_agent_apps());
@@ -261,11 +266,32 @@ fn script_agent_apps() -> Vec<AgentApp> {
     Vec::new()
 }
 
-/// One script app's agent, from its admitted manifest.
-pub fn script_agent_app(manifest: &Path, id: &str, name: &str) -> Option<AgentApp> {
-    let manifest: serde_json::Value = serde_json::from_slice(&std::fs::read(manifest).ok()?).ok()?;
+/// One script app's agent, from its admitted manifest and bundle (the
+/// manifest's directory): it has one when the manifest declares `octos.*`
+/// or an `agent` block, or the bundle ships its own tools (`tools.json`,
+/// loaded as App Hub admits it: `AgentBundle::load`, digest and every gate
+/// rule checked). News ships tools and declares no `octos.*`: it has an
+/// agent all the same.
+pub fn script_agent_app(manifest_path: &Path, id: &str, name: &str) -> Option<AgentApp> {
+    let text = std::fs::read_to_string(manifest_path).ok()?;
+    let manifest: serde_json::Value = serde_json::from_str(&text).ok()?;
     let octos = octos_of(&manifest["capabilities"]);
-    (!octos.is_empty()).then(|| AgentApp { id: id.to_string(), name: name.to_string(), octos, manifest })
+    let agent_block = manifest.get("agent").is_some_and(serde_json::Value::is_object);
+    let declares = !octos.is_empty() || agent_block || bundle_ships_agent(manifest_path.parent()?, &text);
+    declares.then(|| AgentApp { id: id.to_string(), name: name.to_string(), octos, manifest, native: false })
+}
+
+/// Whether the bundle beside a manifest ships an agent App Hub admits.
+#[cfg(any(feature = "app-hub", native_mobile))]
+fn bundle_ships_agent(bundle: &Path, manifest: &str) -> bool {
+    let Ok(parsed) = octosense_app_policy::AppManifest::parse(manifest) else { return false };
+    matches!(octosense_app_policy::AgentBundle::load(bundle, &parsed), Ok(Some(_)))
+}
+
+/// Without App Hub nothing admits a bundle: its `tools.json` is enough.
+#[cfg(not(any(feature = "app-hub", native_mobile)))]
+fn bundle_ships_agent(bundle: &Path, _manifest: &str) -> bool {
+    bundle.join("tools.json").is_file()
 }
 
 /// Card apps App Hub installed: each is an app of its own in the launcher,
diff --git a/crates/shell/src/host_tools/real_kernel_tests.rs b/crates/shell/src/host_tools/real_kernel_tests.rs
index fec4429d..146559c7 100644
--- a/crates/shell/src/host_tools/real_kernel_tests.rs
+++ b/crates/shell/src/host_tools/real_kernel_tests.rs
@@ -148,3 +148,170 @@ fn real_kernel_an_app_agents_turn_calls_news_list_through_the_shells_relay() {
     }
     assert!(!tools.contains(&"read_file"), "News's manifest grants no kernel tools, so its peer keeps none: {tools:?}");
 }
+
+/// Brokers for the contained service's factory, on the test's kernel.
+struct TestPeers {
+    core: Core,
+    state: PathBuf,
+    made: Mutex<Vec<Broker>>,
+}
+
+impl crate::ai_host::contained::PeerFactory for TestPeers {
+    fn launch(&self, peer_id: &str, app_id: &str, services: &std::collections::BTreeSet<String>) -> Option<Arc<dyn OctosAppService>> {
+        let mut cfg = BrokerConfig::new(Deployment::Hosted, "_main", "_main:api:octosense#system", peer_id, app_id, services.clone());
+        cfg.state_dir = Some(self.state.clone());
+        cfg.tool_host = Some(ToolHostHandle(Arc::new(super::ShellToolHost) as Arc<dyn ToolHost>));
+        let broker = Broker::new(cfg, Arc::new(CoreConnector::shared(self.core.clone())));
+        self.made.lock().unwrap().push(broker.clone());
+        Some(Arc::new(broker))
+    }
+}
+
+/// ADR 0004 §4 on a REAL kernel: News (tools.json, no `octos.*`) has an
+/// agent; once the person allowed it the shell prepares its peer with News's
+/// tools registered, before any turn; the system agent's `peer_list` shows
+/// it; the "Ask News" panel's conversation is a sharing context on that
+/// peer whose person turns the system agent's `peer/input` turn then sees
+/// (the shared history); turning the agent off releases the peer.
+#[test]
+fn real_kernel_an_allowed_apps_agent_is_prepared_listed_and_shares_its_conversation() {
+    let Some(program) = kernel() else { return };
+    let _factory = crate::agents::FACTORY_TESTS.lock().unwrap_or_else(|e| e.into_inner());
+    let dir = std::env::temp_dir().join(format!("octosense-shell-agents-{}", std::process::id()));
+    let _ = std::fs::remove_dir_all(&dir);
+    std::fs::create_dir_all(&dir).unwrap();
+    let offered_log = dir.join("offered.jsonl");
+    let model = start_model(&offered_log);
+    let core_dir = dir.join("octos-home/.octos");
+    write_profile(&core_dir, model.1);
+    let core = Core::new(Options::default().core_dir(&core_dir).program(&program));
+    let home = dir.join("home");
+    std::fs::create_dir_all(&home).unwrap();
+    if crate::approvals::with(|_| ()).is_none() {
+        crate::approvals::init(&home);
+    }
+    // News's tools, from its bundle as App Hub admits it.
+    let host_dir = dir.join("apps/.host");
+    std::fs::create_dir_all(&host_dir).unwrap();
+    octosense_news_service::register_with(octosense_news_service::Options::default().host_dir(&host_dir).timer(false));
+    let bundle = super::script_apps::tests::stamped_bundle("news", "agents", |_, _| {});
+    let news = crate::apps::script_agent_app(&bundle.join("manifest.json"), "os.news", "News").expect("News has an agent");
+    super::script_apps::install("os.news", super::script_apps::from_bundle(&bundle).unwrap(), host_dir.clone());
+    let peers = Arc::new(TestPeers { core: core.clone(), state: dir.join("host-state"), made: Mutex::default() });
+    crate::ai_host::contained::set_factory(peers.clone());
+
+    // Not allowed yet: nothing is prepared.
+    crate::approvals::with(|a| a.consent.turn_off("os.news", crate::approvals::now()));
+    crate::agents::prepare(&news);
+    assert!(peers.made.lock().unwrap().is_empty(), "no peer before the person allows it");
+    // The person allows it: the shell prepares the peer, tools registered.
+    crate::approvals::with(|a| a.consent.set(&crate::approvals::rules::ApprovalGesture::sheet_tap(), "os.news", true, crate::approvals::now()));
+    crate::agents::prepare(&news);
+    let deadline = Instant::now() + Duration::from_secs(90);
+    while crate::agents::prepared("os.news") != Some(crate::agents::Prepared::Ready) {
+        super::pump();
+        assert!(Instant::now() < deadline, "not prepared: {:?}", crate::agents::prepared("os.news"));
+        std::thread::sleep(Duration::from_millis(50));
+    }
+    let broker = peers.made.lock().unwrap()[0].clone();
+    let (slug, _) = broker.peer().expect("bound before any turn");
+
+    // The system agent lists its peers.
+    let mut chat = crate::system_chat::session::Driver::new(Box::new(SystemLink(core.clone())));
+    chat.command(crate::system_chat::session::Command::Open);
+    let turn_text = |chat: &mut crate::system_chat::session::Driver, prompt: &str, want: &str| -> String {
+        chat.command(crate::system_chat::session::Command::Send(prompt.into()));
+        let deadline = Instant::now() + Duration::from_secs(120);
+        loop {
+            chat.step(Duration::from_millis(50));
+            super::pump();
+            let answers: Vec<String> = chat.model.items.iter().filter_map(|i| match i {
+                crate::system_chat::model::Item::Message { role: crate::system_chat::model::Role::Assistant, text, .. } => Some(text.clone()),
+                _ => None,
+            }).collect();
+            if let Some(found) = answers.iter().find(|t| t.contains(want)) {
+                if chat.model.phase().running_turn().is_none() {
+                    return found.clone();
+                }
+            }
+            assert!(Instant::now() < deadline, "no {want:?} in {:?} ({:?})", chat.model.items, chat.model.phase());
+        }
+    };
+    let deadline = Instant::now() + Duration::from_secs(60);
+    while chat.model.phase() != &crate::system_chat::model::Phase::Ready {
+        chat.step(Duration::from_millis(50));
+        assert!(Instant::now() < deadline, "the system session did not open: {:?}", chat.model.phase());
+    }
+    let listed = turn_text(&mut chat, "CALL_TOOL:peer_list:{}", "TOOL SAID");
+    eprintln!("[real-kernel] peer_list: {listed}");
+    assert!(listed.contains(&slug), "the system agent's peer_list shows News's peer {slug}: {listed}");
+
+    // The "Ask News" panel: a sharing context on the same peer; the
+    // person's turn runs there, with who spoke.
+    let panel = crate::agents::conversation(&news, "shell-ask-real").expect("the person's lane");
+    let seen: Arc<Mutex<Vec<Value>>> = Arc::default();
+    let s = seen.clone();
+    panel.subscribe(Some(Arc::new(move |e| {
+        if let ContextEvent::Data(d) = e {
+            s.lock().unwrap().push(d);
+        }
+    })));
+    let (tx, rx) = std::sync::mpsc::channel();
+    let tx = Mutex::new(tx);
+    panel.call(ContextOp::TurnFrom { text: "focus the digest on technology".into(), trigger: crate::ai_host::app_peers::TurnTrigger::Person }, Arc::new(move |e| {
+        if let ContextEvent::Complete(r) = e {
+            let _ = tx.lock().unwrap().send(r);
+        }
+    })).unwrap();
+    let answer = loop {
+        super::pump();
+        if let Ok(r) = rx.recv_timeout(Duration::from_millis(50)) {
+            break r.expect("the person's turn");
+        }
+    };
+    assert!(answer["text"].as_str().unwrap_or("").contains("focus the digest on technology"), "{answer}");
+    assert_eq!(answer["lane"], "person");
+    assert!(seen.lock().unwrap().iter().any(|d| d["lane"] == "person" && d["speaker"]["kind"] == "person"), "the follower hears the person's lane with its speaker");
+    assert_eq!(peers.made.lock().unwrap().len(), 1, "the panel uses the prepared peer");
+
+    // The system agent's turn on News's agent sees the person's lane.
+    let shared = turn_text(&mut chat, &format!("TELL_PEER_SHOW:{slug}"), "message sent");
+    eprintln!("[real-kernel] system agent: {shared}");
+    let deadline = Instant::now() + Duration::from_secs(90);
+    loop {
+        super::pump();
+        let sys_lane = seen.lock().unwrap().iter().filter(|d| d["lane"] == "system_agent").map(|d| d.to_string()).collect::<Vec<_>>().join("\n");
+        if sys_lane.contains("SHARED") {
+            assert!(sys_lane.contains("focus the digest on technology"), "News's agent, asked by the system agent, sees the person's turn: {sys_lane}");
+            break;
+        }
+        assert!(Instant::now() < deadline, "the panel never heard the system agent's lane: {sys_lane}");
+        std::thread::sleep(Duration::from_millis(50));
+    }
+
+    // The prepared peer's turns are offered News's own tools.
+    let requests: Vec<Value> = std::fs::read_to_string(&offered_log).unwrap().lines().map(|l| serde_json::from_str(l).unwrap()).collect();
+    let peer_turn = requests.iter().find(|r| r["user"].as_str().unwrap_or("").contains("SHOW_SHARED")).expect("the peer's turn asked the model");
+    let tools: Vec<&str> = peer_turn["tools"].as_array().unwrap().iter().filter_map(Value::as_str).collect();
+    assert!(tools.contains(&"news_list") && tools.contains(&"news_read"), "News's tools are registered on its prepared peer: {tools:?}");
+
+    // Turned off: the peer is released and the panel cannot reopen.
+    crate::approvals::with(|a| a.consent.turn_off("os.news", crate::approvals::now()));
+    assert!(crate::ai_host::contained::revoke("os.news"));
+    assert!(!crate::ai_host::contained::is_live("os.news"));
+    assert!(!panel.is_open());
+    assert!(crate::agents::conversation(&news, "again").is_err());
+
+    drop(chat);
+    let _ = std::fs::remove_dir_all(&bundle);
+    core.shutdown_within(Duration::from_secs(5));
+    let _ = std::fs::remove_dir_all(&dir);
+    drop(model);
+}
+
+struct SystemLink(Core);
+impl crate::system_chat::session::Connector for SystemLink {
+    fn connect(&mut self) -> Result<Box<dyn crate::system_chat::session::Link>, crate::system_chat::session::Unavailable> {
+        self.0.connect().map(crate::system_chat::link::link).map_err(|e| crate::system_chat::session::Unavailable::Failed(e.to_string()))
+    }
+}
diff --git a/crates/shell/src/lib.rs b/crates/shell/src/lib.rs
index fedb42b8..d2dab061 100644
--- a/crates/shell/src/lib.rs
+++ b/crates/shell/src/lib.rs
@@ -9,7 +9,9 @@
 
 #![allow(dead_code)] // shell surface (icons, OSD, panels) built ahead of the flows that use it
 
+pub mod agents;
 pub mod ai_bus;
+pub mod app_chat;
 pub mod app_storage;
 pub mod dev_mode;
 pub mod approvals;
@@ -217,6 +219,9 @@ script_mod! {
                         // conversation with the system agent, F8. Under the
                         // approval sheets, which answer its approvals.
                         shell_system_chat := ShellSystemChat{}
+                        // "Ask <app>" (app_chat/): an app agent's
+                        // conversation, both lanes, beside the system chat.
+                        shell_app_chat := ShellSystemChat{ app_panel: true }
                         shell_approvals := ShellApprovals{}
                         shell_approvals_settings := ShellApprovalsSettings{}
                         // Developer mode's banner (dev_mode.rs): over
@@ -3091,6 +3096,11 @@ impl App {
     /// What a menu row does. The ids are the jsonc's dotted paths, with
     /// `apps.<id>` and `style.theme[.import].<name>` from the providers.
     fn shell_menu_activate(&mut self, cx: &mut Cx, target: &str) {
+        if target == shell::menu::ASK_APP_ROW {
+            self.close_shell_menu(cx);
+            self.ask_focused_app(cx);
+            return;
+        }
         if target == shell::menu::SYSTEM_CHAT_ROW {
             self.close_shell_menu(cx);
             system_chat::open();
@@ -3244,7 +3254,11 @@ impl App {
     /// Agents the person turned off since the last tick: their live services
     /// go now (ADR 0004 §4), whichever way the app is hosted.
     fn revoke_agents(&mut self) {
-        for app in approvals::take_revoked() {
+        let revoked = approvals::take_revoked();
+        // Agents just allowed get their peer; revoked ones are forgotten.
+        agents::pump(&revoked);
+        app_chat::pump();
+        for app in revoked {
             let modules = self.module_host.revoke_assistant(&app);
             peer_link::revoke(&app);
             let contained = crate::ai_host::contained::revoke(&app);
@@ -3256,8 +3270,9 @@ impl App {
     /// one of its approvals): hand approvals on, and redraw.
     fn system_chat_changed(&mut self, cx: &mut Cx) {
         system_chat::pump();
+        app_chat::pump();
         self.host_tools_pump(cx);
-        let generation = system_chat::generation();
+        let generation = system_chat::generation().wrapping_add(app_chat::generation());
         if generation != self.system_chat_generation {
             self.system_chat_generation = generation;
             self.redraw_all(cx);
@@ -3296,6 +3311,44 @@ impl App {
         }
     }
 
+    /// "Ask <app>" for the focused window's app, when it has an agent
+    /// (the bar's button, Shift+F8, Setup › Assistant).
+    fn ask_focused_app(&mut self, cx: &mut Cx) {
+        let app = self.focused_agent_app();
+        match app {
+            Some(app) => {
+                log!("ask: {}'s agent", app.id);
+                app_chat::open_app(app);
+            }
+            None => self.notify(cx, "No app agent here", "The focused app has no agent to ask. The system agent (F8) can help instead."),
+        }
+        self.system_chat_changed(cx);
+    }
+
+    /// The focused window's app, when it has an agent.
+    fn focused_agent_app(&mut self) -> Option<apps::AgentApp> {
+        let state = self.state.as_ref()?;
+        let client = state.layout.focused_client()?;
+        let app = state.clients.get(&client)?.app.clone();
+        agents::find(&app)
+    }
+
+    /// "Ask <app>"'s pane owns the pointer inside its rect while open.
+    fn app_chat_pointer(&mut self, cx: &mut Cx, event: &Event) -> bool {
+        if !app_chat::is_open() {
+            return false;
+        }
+        let pane = self.ui.widget(cx, ids!(shell_app_chat));
+        let outcome = pane.borrow_mut::<system_chat::view::ShellSystemChat>().map(|mut p| p.pointer(cx, event)).unwrap_or(system_chat::view::Outcome::Ignored);
+        match outcome {
+            system_chat::view::Outcome::Ignored => false,
+            _ => {
+                self.system_chat_changed(cx);
+                true
+            }
+        }
+    }
+
     /// The system chat's pane owns the pointer inside its rect while open.
     fn system_chat_pointer(&mut self, cx: &mut Cx, event: &Event) -> bool {
         if !system_chat::is_open() {
@@ -3474,6 +3527,7 @@ impl App {
         data.style = self.state_mut().style.target;
         data.dark = self.state_mut().style.dark;
         data.active_window = (!title.is_empty()).then_some(title);
+        data.ask_agent = self.focused_agent_app().map(|a| a.name);
         data.open_panel = self.shell_panel_open;
         // The middle window control reads "restore" while maximized.
         data.maximized = self.ui.window(cx, ids!(main_window)).is_fullscreen(cx);
@@ -4493,7 +4547,8 @@ impl App {
                     // approval-sheet, approval-batch, approval-consent,
                     // approvals-settings (approvals/mod.rs).
                     // system-chat, system-chat-send:<text> (system_chat/).
-                    if system_chat::test_action(name) {
+                    // ask:<app>, ask-send:<text> (app_chat/).
+                    if system_chat::test_action(name) || app_chat::test_action(name) {
                         log!("wm: --test-action {}", name);
                         self.system_chat_changed(cx);
                         i += 2;
@@ -4853,6 +4908,10 @@ impl MatchEvent for App {
         // The system agent's grants (Setup > Assistant > Command execution),
         // handed to the kernel before it first starts.
         system_chat::init(std::path::Path::new(&octosense::paths::home()));
+        // An agent for every app that declares one (ADR 0004 §4): the ones
+        // the person already allowed get their peer now, so the system
+        // agent's peer_list shows them.
+        agents::start();
         // CLI: --import-theme <name> pulls an omarchy theme and converts
         // it to splash before the desktop appears.
         let mut args = std::env::args();
@@ -5106,6 +5165,7 @@ impl MatchEvent for App {
                             self.focus_client(cx, focus);
                         }
                     }
+                    BarModule::AskAgent => self.ask_focused_app(cx),
                     control @ (BarModule::WindowMin | BarModule::WindowMax | BarModule::WindowClose) => {
                         // The gallery's bar is a picture of one: its
                         // controls log (shell/gallery.rs), never close or
@@ -5439,6 +5499,7 @@ impl App {
                 || self.shell_menu_pointer(cx, event)
                 || self.shell_panel_pointer(cx, event)
                 || self.shell_glance_pointer(cx, event)
+                || self.app_chat_pointer(cx, event)
                 || self.system_chat_pointer(cx, event))
         {
             return;
@@ -5544,6 +5605,18 @@ impl App {
                     self.alt_armed = false;
                     return;
                 }
+                // "Ask <app>"'s prompt, while its pane has the keyboard.
+                if app_chat::key(e) {
+                    self.alt_armed = false;
+                    self.system_chat_changed(cx);
+                    return;
+                }
+                // Shift+F8: ask the focused app's agent.
+                if e.key_code == KeyCode::F8 && e.modifiers.shift && !e.modifiers.logo && !e.modifiers.control && !e.modifiers.alt {
+                    self.alt_armed = false;
+                    self.ask_focused_app(cx);
+                    return;
+                }
                 // The system chat's prompt, while its pane is open.
                 if system_chat::key(e) {
                     self.alt_armed = false;
@@ -5554,6 +5627,8 @@ impl App {
                 if e.key_code == KeyCode::F8 && bare_key(&e.modifiers) {
                     self.alt_armed = false;
                     system_chat::toggle();
+                    // The system chat takes the keyboard when it opens.
+                    app_chat::focus(!system_chat::is_open());
                     self.system_chat_changed(cx);
                     return;
                 }
@@ -5630,7 +5705,7 @@ impl App {
         }
         // The phone's input method types into the system chat's prompt.
         if let Event::TextInput(t) = event {
-            if cfg!(native_mobile) && self.state.is_some() && system_chat::text_input(&t.input) {
+            if cfg!(native_mobile) && self.state.is_some() && (app_chat::text_input(&t.input) || system_chat::text_input(&t.input)) {
                 self.system_chat_changed(cx);
                 return;
             }
diff --git a/crates/shell/src/questions/tests.rs b/crates/shell/src/questions/tests.rs
index 3d83e00c..c525fbac 100644
--- a/crates/shell/src/questions/tests.rs
+++ b/crates/shell/src/questions/tests.rs
@@ -140,7 +140,7 @@ fn the_system_chat_shows_the_system_agents_questions_and_answers_them_through_th
 #[test]
 fn only_the_shells_surfaces_answer_questions() {
     let root = std::path::Path::new(env!("CARGO_MANIFEST_DIR")).join("src");
-    let allowed = ["questions/mod.rs", "questions/tests.rs", "system_chat/mod.rs", "approvals/view.rs"];
+    let allowed = ["questions/mod.rs", "questions/tests.rs", "system_chat/mod.rs", "approvals/view.rs", "app_chat/mod.rs"];
     let mut found = Vec::new();
     let mut stack = vec![root.clone()];
     while let Some(dir) = stack.pop() {
diff --git a/crates/shell/src/shell/bar.rs b/crates/shell/src/shell/bar.rs
index 874dda3e..84a43932 100644
--- a/crates/shell/src/shell/bar.rs
+++ b/crates/shell/src/shell/bar.rs
@@ -37,6 +37,9 @@ pub enum BarModule {
     /// `widgets/ActiveWindow.qml` — not in the stock `shell.json` center
     /// list, but our bar carries it right after the workspaces.
     ActiveWindow,
+    /// "Ask <app>" beside the active window's title, when the focused app
+    /// has an agent (ADR 0004 §4): opens the shell's panel for it.
+    AskAgent,
     Indicator(usize),
     Clock,
     KeyboardLayout,
@@ -86,6 +89,9 @@ pub struct BarData {
     pub indicators: Vec<Indicator>,
     /// The focused window's title (`ActiveWindow.qml`).
     pub active_window: Option<String>,
+    /// The focused app's name, when it has an agent: the bar offers
+    /// "Ask <name>".
+    pub ask_agent: Option<String>,
     /// Already formatted — `dddd HH:mm`, or the alt `d MMMM 'W'ww yyyy`.
     pub clock: String,
     pub keyboard_layout: Option<String>,
@@ -148,6 +154,7 @@ impl BarData {
             ],
             indicators: default_indicators(),
             active_window: Some("terminal — ~/makepad".into()),
+            ask_agent: None,
             clock: "Thursday 21:34".into(),
             keyboard_layout: Some("en".into()),
             weather: None,
@@ -712,6 +719,15 @@ impl ShellBar {
                 &title,
             );
             self.hits.push((BarModule::ActiveWindow, cell));
+            x += w;
+        }
+        // "Ask <app>": the focused app's agent, in the shell's panel.
+        if let Some(name) = self.data.ask_agent.clone() {
+            let label = format!("Ask {name}");
+            let w = self.d.measure(cx, false, tok.font.body, &label) + tok.spacing.control_padding_x * 2.0;
+            let cell = rect(x, r.pos.y, w, r.size.y);
+            self.d.label(cx, cell, false, tok.font.body, accent, super::ui::HAlign::Center, &label);
+            self.hits.push((BarModule::AskAgent, cell));
         }
 
         // ---- center: the clock is the anchor, centered on the bar itself
@@ -879,6 +895,7 @@ impl ShellBar {
                 .active_window
                 .clone()
                 .unwrap_or_default(),
+            BarModule::AskAgent => format!("Talk to {}'s agent (Shift+F8)", self.data.ask_agent.clone().unwrap_or_default()),
             BarModule::Clock => "Calendar".into(),
             BarModule::KeyboardLayout => "Keyboard layout".into(),
             BarModule::Weather => "Weather".into(),
diff --git a/crates/shell/src/shell/menu.rs b/crates/shell/src/shell/menu.rs
index 288ea4a0..9aa18d1b 100644
--- a/crates/shell/src/shell/menu.rs
+++ b/crates/shell/src/shell/menu.rs
@@ -788,6 +788,9 @@ const DEVELOPER_ON: &str = "setup.developer.on";
 /// The Approvals page's row (lib.rs opens `approvals::open_settings`).
 pub const APPROVALS_ROW: &str = "setup.assistant.approvals";
 
+/// "Ask <app>" for the focused app (lib.rs `ask_focused_app`).
+pub const ASK_APP_ROW: &str = "setup.assistant.ask";
+
 /// The system chat's row (lib.rs opens `system_chat::open`).
 pub const SYSTEM_CHAT_ROW: &str = "setup.assistant.chat";
 /// Setup → Assistant → Command execution (system_chat/grants.rs).
@@ -818,6 +821,12 @@ fn assistant_items(existing: &[MenuItem]) -> Vec<MenuItem> {
             .aliases(&["chat", "system agent", "assistant chat", "ask"])
             .describe("Talk to the system agent (F8)"),
     );
+    items.push(
+        MenuItem::new(ASK_APP_ROW, "Ask this app's agent", MenuKind::Action)
+            .icon(Ico::Cpu)
+            .aliases(&["ask", "app agent", "ask app"])
+            .describe("Talk to the focused app's agent (Shift+F8)"),
+    );
     items.extend(command_items());
     items
 }
diff --git a/crates/shell/src/system_chat/mod.rs b/crates/shell/src/system_chat/mod.rs
index 1d775e6e..1ab9bb44 100644
--- a/crates/shell/src/system_chat/mod.rs
+++ b/crates/shell/src/system_chat/mod.rs
@@ -85,6 +85,11 @@ struct Chat {
     pub scroll: f64,
     /// App agents' questions routed here ([`crate::questions`]), by id.
     routed: Vec<(u64, model::Item)>,
+    /// What the shell told the system agent about the apps' agents last
+    /// ([`crate::agents::system_note`]): said again only when it changed.
+    told: Option<String>,
+    /// The shell's own lines in the conversation (an agents.ask sheet).
+    notes: Vec<model::Item>,
 }
 
 /// The id prefix of a routed question in the conversation.
@@ -139,6 +144,8 @@ fn with<R>(f: impl FnOnce(&mut Chat) -> R) -> R {
         worker: None,
         scroll: 0.0,
         routed: Vec::new(),
+        told: None,
+        notes: Vec::new(),
     });
     f(chat)
 }
@@ -267,7 +274,22 @@ pub fn send(text: &str) {
     let question = snapshot().open_question().map(|(id, n)| (id.to_string(), n));
     match question {
         Some((question, count)) => answer(&question, count, text, false),
-        None => command(Command::Send(text.to_string())),
+        None => {
+            // The apps' agents, when they changed since the system agent
+            // was last told (it cannot see an agent that is not allowed).
+            let note = crate::agents::system_note();
+            let fresh = with(|c| {
+                let fresh = note.is_some() && c.told != note;
+                if fresh {
+                    c.told = note.clone();
+                }
+                fresh
+            });
+            let note = if fresh { note.unwrap_or_default() } else { String::new() };
+            // Allowed agents get their peer before the system agent looks.
+            crate::agents::prepare_allowed();
+            command(Command::SendNoted { text: text.to_string(), note });
+        }
     }
 }
 
@@ -305,6 +327,10 @@ pub fn sync_host_tools() {
 }
 
 pub fn new_conversation() {
+    with(|c| {
+        c.told = None;
+        c.notes.clear();
+    });
     command(Command::NewConversation);
 }
 
@@ -314,6 +340,7 @@ pub fn snapshot() -> ChatModel {
     with(|c| {
         let mut model = c.shared.lock().unwrap_or_else(|e| e.into_inner()).model.clone();
         model.items.extend(c.routed.iter().map(|(_, item)| item.clone()));
+        model.items.extend(c.notes.iter().cloned());
         model
     })
 }
@@ -353,6 +380,19 @@ pub fn pump() {
                 }
             }
             Effect::ApprovalGone(_) => {}
+            // `agents.list` / `agents.ask`: the shell's own answer (the
+            // sheet `agents.ask` shows is the person's to answer).
+            Effect::ToolCall { call, reply } if crate::agents::is_agents_tool(&call.name) => {
+                let outcome = crate::agents::call(&call.name, &call.args);
+                if call.name == crate::agents::ASK_TOOL {
+                    let app = call.args["app"].as_str().unwrap_or("an app").to_string();
+                    with(|c| {
+                        c.notes.push(model::Item::Notice(format!("The system agent asks to use {app}'s assistant: allow or deny it on the sheet.")));
+                        c.ui_generation += 1;
+                    });
+                }
+                reply.finish(outcome);
+            }
             Effect::ToolCall { call, reply } => crate::host_tools::system_call(call, reply),
             Effect::ToolCancel(call_id) => crate::host_tools::system_cancel(&call_id),
         }
diff --git a/crates/shell/src/system_chat/model.rs b/crates/shell/src/system_chat/model.rs
index 234307f5..a92e11d7 100644
--- a/crates/shell/src/system_chat/model.rs
+++ b/crates/shell/src/system_chat/model.rs
@@ -58,6 +58,10 @@ pub enum Item {
         /// The ledger position (`cursor.seq`) of the envelope that made it:
         /// envelopes may arrive out of order, items stay in ledger order.
         seq: Option<u64>,
+        /// Who spoke, when the surface names speakers (an app's
+        /// conversation: "You", "System agent", "News's agent"); `None`:
+        /// the role's own label.
+        speaker: Option<String>,
     },
     Tool {
         call_id: String,
@@ -206,7 +210,7 @@ impl ChatModel {
 
     /// The person sent `text` as turn `turn`.
     pub fn start_turn(&mut self, turn: &str, text: &str) {
-        self.items.push(Item::Message { role: Role::User, text: text.to_string(), turn: Some(turn.to_string()), segment: None, seq: None });
+        self.items.push(Item::Message { role: Role::User, text: text.to_string(), turn: Some(turn.to_string()), segment: None, seq: None, speaker: None });
         self.prompts.push((turn.to_string(), text.to_string()));
         self.own_turns.insert(turn.to_string());
         self.phase = Phase::Running { turn: turn.to_string() };
@@ -261,7 +265,7 @@ impl ChatModel {
                 return;
             }
         }
-        self.items.push(Item::Message { role: Role::Assistant, text: delta.to_string(), turn: Some(turn.to_string()), segment: None, seq: None });
+        self.items.push(Item::Message { role: Role::Assistant, text: delta.to_string(), turn: Some(turn.to_string()), segment: None, seq: None, speaker: None });
         self.changed();
     }
 
@@ -446,7 +450,7 @@ impl ChatModel {
                     None if text.trim().is_empty() => return,
                     None => {
                         placed_by_delta(self);
-                        let item = Item::Message { role: Role::Assistant, text: text.to_string(), turn: Some(turn.to_string()), segment: Some(segment), seq };
+                        let item = Item::Message { role: Role::Assistant, text: text.to_string(), turn: Some(turn.to_string()), segment: Some(segment), seq, speaker: None };
                         self.insert_ordered(item, seq);
                     }
                 }
@@ -502,7 +506,7 @@ impl ChatModel {
     /// Add an item made from the envelope at ledger position `seq`: before
     /// the trailing items that came from later envelopes, never before
     /// anything the shell added itself (the person's prompt, a notice).
-    fn insert_ordered(&mut self, item: Item, seq: Option<u64>) {
+    pub fn insert_ordered(&mut self, item: Item, seq: Option<u64>) {
         let mut at = self.items.len();
         if let Some(seq) = seq {
             while at > 0 {
@@ -565,11 +569,12 @@ impl ChatModel {
     pub fn load_history(&mut self, messages: &Value) {
         let mut items = Vec::new();
         for row in messages.as_array().into_iter().flatten() {
-            let text = row.get("content").and_then(Value::as_str).unwrap_or("").to_string();
+            // The shell's note to the system agent is not the person's words.
+            let text = crate::agents::strip_note(row.get("content").and_then(Value::as_str).unwrap_or("")).to_string();
             let turn = row.get("turn_id").and_then(Value::as_str).map(str::to_string);
             match row.get("role").and_then(Value::as_str).unwrap_or("") {
-                "user" => items.push(Item::Message { role: Role::User, text, turn, segment: None, seq: None }),
-                "assistant" if !text.trim().is_empty() => items.push(Item::Message { role: Role::Assistant, text, turn, segment: None, seq: None }),
+                "user" => items.push(Item::Message { role: Role::User, text, turn, segment: None, seq: None, speaker: None }),
+                "assistant" if !text.trim().is_empty() => items.push(Item::Message { role: Role::Assistant, text, turn, segment: None, seq: None, speaker: None }),
                 "tool" => items.push(Item::Tool {
                     call_id: row.get("tool_call_id").and_then(Value::as_str).unwrap_or("").to_string(),
                     name: row.get("name").or_else(|| row.get("tool_name")).and_then(Value::as_str).unwrap_or("tool").to_string(),
diff --git a/crates/shell/src/system_chat/session.rs b/crates/shell/src/system_chat/session.rs
index 10813c7d..aae91b8f 100644
--- a/crates/shell/src/system_chat/session.rs
+++ b/crates/shell/src/system_chat/session.rs
@@ -100,13 +100,17 @@ pub struct ShellSystemHost;
 
 impl SystemHost for ShellSystemHost {
     fn declarations(&self) -> Vec<Value> {
-        super::grants::host_tools()
+        let mut decls: Vec<Value> = super::grants::host_tools()
             .into_iter()
             .filter_map(|tool| {
                 let owner = tool.split('.').next().unwrap_or(&tool).to_string();
                 crate::host_tools::declaration(&owner, &tool)
             })
-            .collect()
+            .collect();
+        // Which apps have an agent, and asking the person to allow one
+        // (ADR 0004 §4; answered by the chat itself, `crate::agents`).
+        decls.extend(crate::agents::declarations());
+        decls
     }
     fn host_token(&self) -> Option<String> {
         #[cfg(kernel)]
@@ -124,6 +128,10 @@ pub enum Command {
     /// Let the connection go when nothing runs (the pane closed).
     Close,
     Send(String),
+    /// The person's message, with the shell's note for the system agent
+    /// in front of it (`crate::agents::system_note`): the kernel gets both,
+    /// the pane shows the person's words.
+    SendNoted { text: String, note: String },
     Interrupt,
     NewConversation,
     /// Answer the open question with one option or free text.
@@ -166,6 +174,9 @@ pub struct Driver {
     registered: Option<Vec<String>>,
     /// A registration is on its way.
     registering: bool,
+    /// The set the kernel refused on this link: not asked again until the
+    /// set changes or the link does.
+    refused: Option<Vec<String>>,
     /// The credential the registration used (results carry it).
     token: Option<String>,
     /// `peer/tool/result` fields from the relay's answers, for this link.
@@ -197,6 +208,7 @@ impl Driver {
             system_host: Box::new(ShellSystemHost),
             registered: None,
             registering: false,
+            refused: None,
             token: None,
             outbox: Arc::new(Mutex::new(Vec::new())),
             waker: None,
@@ -230,6 +242,9 @@ impl Driver {
         }
         let decls = self.system_host.declarations();
         let names: Vec<String> = decls.iter().filter_map(|d| d["name"].as_str().map(str::to_string)).collect();
+        if self.refused.as_ref() == Some(&names) {
+            return;
+        }
         match &self.registered {
             Some(held) if *held == names => return,
             // Nothing registered and nothing to register.
@@ -238,7 +253,9 @@ impl Driver {
         }
         let Some(token) = self.system_host.host_token() else {
             let told = self.model.items.iter().any(|i| matches!(i, super::model::Item::Notice(n) if n == NO_CREDENTIAL));
-            if !names.is_empty() && !told {
+            // Only command execution needs saying: the agents tools wait
+            // quietly for the first app agent (the note says the same).
+            if names.iter().any(|n| n == super::grants::COMMAND_TOOL) && !told {
                 self.model.notice(NO_CREDENTIAL);
             }
             return;
@@ -360,7 +377,8 @@ impl Driver {
                     self.try_connect();
                 }
             }
-            Command::Send(text) => {
+            Command::Send(text) => self.command(Command::SendNoted { text, note: String::new() }),
+            Command::SendNoted { text, note } => {
                 let text = text.trim().to_string();
                 if text.is_empty() {
                     return;
@@ -375,7 +393,8 @@ impl Driver {
                 self.sync_tools();
                 let turn = new_turn_id();
                 self.model.start_turn(&turn, &text);
-                let params = json!({"session_id": SYSTEM_SESSION, "turn_id": turn, "input": [{"kind": "text", "text": text}]});
+                let input = if note.is_empty() { text } else { format!("{note}\n{text}") };
+                let params = json!({"session_id": SYSTEM_SESSION, "turn_id": turn, "input": [{"kind": "text", "text": input}]});
                 self.request("turn/start", params, Pending::Turn { turn });
             }
             Command::Interrupt => {
@@ -432,6 +451,7 @@ impl Driver {
         // A host session set lives as long as its connection.
         self.registered = None;
         self.registering = false;
+        self.refused = None;
         self.outbox.lock().unwrap_or_else(|e| e.into_inner()).clear();
         self.end_calls();
     }
@@ -612,6 +632,7 @@ impl Driver {
                     None => self.registered = Some(tools),
                     Some(why) => {
                         self.registered = None;
+                        self.refused = Some(tools.clone());
                         self.model.notice(format!("The assistant could not be offered its granted tools ({}): {why}", tools.join(", ")));
                     }
                 }
diff --git a/crates/shell/src/system_chat/view.rs b/crates/shell/src/system_chat/view.rs
index 561fb4bb..2e891aa1 100644
--- a/crates/shell/src/system_chat/view.rs
+++ b/crates/shell/src/system_chat/view.rs
@@ -10,6 +10,12 @@
 //!
 //! The shell gives it pointer events first while it is open
 //! ([`ShellSystemChat::pointer`]) and the keyboard (`super::key`).
+//!
+//! The same pane is the "Ask <app>" panel (`app_panel: true`,
+//! [`crate::app_chat`]): an app agent's conversation, both lanes with their
+//! speakers, its composer and Stop. On a desktop it stands left of the
+//! system chat when both are open, so the two lanes show side by side; on a
+//! phone it is a full-screen sheet.
 
 use makepad_widgets::*;
 
@@ -100,6 +106,9 @@ pub struct ShellSystemChat {
     d: ShellDraw,
     #[live]
     tokens: ShellTokens,
+    /// The "Ask <app>" panel ([`crate::app_chat`]) instead of the system chat.
+    #[live]
+    app_panel: bool,
     #[rust]
     area: Area,
     #[rust]
@@ -119,19 +128,108 @@ pub struct ShellSystemChat {
     pub shown: Vec<String>,
 }
 
+/// The conversation a pane shows: the system chat's or an app's.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+enum Source {
+    System,
+    App,
+}
+
+impl Source {
+    fn is_open(self) -> bool {
+        match self {
+            Source::System => super::is_open(),
+            Source::App => crate::app_chat::is_open(),
+        }
+    }
+    fn snapshot(self) -> ChatModel {
+        match self {
+            Source::System => super::snapshot(),
+            Source::App => crate::app_chat::snapshot(),
+        }
+    }
+    fn draft(self) -> String {
+        match self {
+            Source::System => super::draft(),
+            Source::App => crate::app_chat::draft(),
+        }
+    }
+    fn scroll(self) -> f64 {
+        match self {
+            Source::System => super::scroll(),
+            Source::App => crate::app_chat::scroll(),
+        }
+    }
+    fn scroll_by(self, dy: f64, max: f64) {
+        match self {
+            Source::System => super::scroll_by(dy, max),
+            Source::App => crate::app_chat::scroll_by(dy, max),
+        }
+    }
+    fn title(self) -> String {
+        match self {
+            Source::System => "Assistant".into(),
+            Source::App => format!("Ask {}", crate::app_chat::app().map(|a| a.name).unwrap_or_default()),
+        }
+    }
+    fn status(self, model: &ChatModel) -> String {
+        match self {
+            Source::System => phase_text(model.phase()),
+            Source::App => crate::app_chat::status_text(),
+        }
+    }
+    fn placeholder(self, question: bool) -> String {
+        if question {
+            return "Answer the question\u{2026}".into();
+        }
+        match self {
+            Source::System => "Ask the system agent\u{2026}".into(),
+            Source::App => format!("Ask {}\u{2026}", crate::app_chat::app().map(|a| a.name).unwrap_or_default()),
+        }
+    }
+    fn hint(self) -> String {
+        match self {
+            Source::System => "Ask the system agent anything: it can read and write its own workspace, search the web and brief your apps' agents. It asks you before anything outward.".into(),
+            Source::App => {
+                let name = crate::app_chat::app().map(|a| a.name).unwrap_or_default();
+                format!("Talk to {name}'s agent. The system agent can ask it things too: both show here, each with who spoke, and each side sees the other's recent turns. Stop stops both.")
+            }
+        }
+    }
+    fn assistant_label(self) -> &'static str {
+        "Assistant"
+    }
+    /// The composer is usable.
+    fn usable(self, model: &ChatModel) -> bool {
+        match self {
+            Source::System => matches!(model.phase(), Phase::Ready | Phase::Running { .. }),
+            Source::App => crate::app_chat::status() == crate::app_chat::Status::Ready,
+        }
+    }
+}
+
 impl ShellSystemChat {
+    fn source(&self) -> Source {
+        if self.app_panel {
+            Source::App
+        } else {
+            Source::System
+        }
+    }
+
     fn hit_at(&self, p: Vec2d) -> Option<Hit> {
         self.hits.iter().find(|(r, h)| *h != Hit::Pane && contains(*r, p)).or_else(|| self.hits.iter().find(|(r, _)| contains(*r, p))).map(|(_, h)| h.clone())
     }
 
     /// The shell's pointer hook: the pane's own rect is its own while open.
     pub fn pointer(&mut self, cx: &mut Cx, event: &Event) -> Outcome {
-        if !super::is_open() || self.pane.size.x <= 0.0 {
+        let source = self.source();
+        if !source.is_open() || self.pane.size.x <= 0.0 {
             return Outcome::Ignored;
         }
         match event {
             Event::Scroll(e) if contains(self.pane, e.abs) => {
-                super::scroll_by(e.scroll.y, self.max_scroll);
+                source.scroll_by(e.scroll.y, self.max_scroll);
                 self.redraw(cx);
                 return Outcome::Taken;
             }
@@ -159,6 +257,8 @@ impl ShellSystemChat {
                 return Outcome::Ignored;
             }
             self.down = self.hit_at(p);
+            // A press in a pane gives it the keyboard.
+            crate::app_chat::focus(source == Source::App);
             if self.down == Some(Hit::Field) {
                 cx.show_text_ime(self.area, dvec2(self.pane.pos.x + PAD, self.pane.pos.y + self.pane.size.y - PAD - FIELD_H));
             }
@@ -170,7 +270,7 @@ impl ShellSystemChat {
             if hit.is_none() || hit != pressed {
                 return if contains(self.pane, p) { Outcome::Taken } else { Outcome::Ignored };
             }
-            let outcome = act(hit.unwrap());
+            let outcome = act(source, hit.unwrap());
             self.redraw(cx);
             return outcome;
         }
@@ -196,10 +296,11 @@ impl ShellSystemChat {
         };
         for (i, item) in model.items.iter().enumerate() {
             match item {
-                Item::Message { role, text, .. } => {
-                    let who = match role {
-                        Role::User => "You",
-                        Role::Assistant => "Assistant",
+                Item::Message { role, text, speaker, .. } => {
+                    let who = match (speaker, role) {
+                        (Some(name), _) => name.as_str(),
+                        (None, Role::User) => "You",
+                        (None, Role::Assistant) => self.source().assistant_label(),
                     };
                     lines.push(Line { text: who.into(), bold: true, small: true, dim: *role == Role::User, accent: false, gap_before: 12.0 });
                     let mut text = text.clone();
@@ -247,7 +348,8 @@ impl ShellSystemChat {
     fn draw_pane(&mut self, cx: &mut Cx2d, screen: Rect) {
         self.hits.clear();
         self.shown.clear();
-        if !super::is_open() {
+        let source = self.source();
+        if !source.is_open() {
             self.pane = Rect::default();
             return;
         }
@@ -257,7 +359,9 @@ impl ShellSystemChat {
             screen
         } else {
             let gap = tok.spacing.gaps_out;
-            rect(screen.pos.x + screen.size.x - gap - PANE_W, screen.pos.y + gap, PANE_W, (screen.size.y - gap * 2.0).max(240.0))
+            // "Ask <app>" stands left of the system chat when both are open.
+            let beside = if source == Source::App && super::is_open() { PANE_W + gap } else { 0.0 };
+            rect(screen.pos.x + screen.size.x - gap - PANE_W - beside, screen.pos.y + gap, PANE_W, (screen.size.y - gap * 2.0).max(240.0))
         };
         self.pane = pane;
         self.d.card(cx, pane, &tok.popups);
@@ -269,8 +373,8 @@ impl ShellSystemChat {
         let cw = pane.size.x - PAD * 2.0;
         let mut hits = Vec::new();
         let mut shown = Vec::new();
-        let model = super::snapshot();
-        let draft = super::draft();
+        let model = source.snapshot();
+        let draft = source.draft();
         let hover = self.hover;
 
         // Header.
@@ -280,14 +384,18 @@ impl ShellSystemChat {
             let close_w = b.width(cx, "Close");
             let close = b.draw(cx, x + cw - close_w, y, close_w, "Close", false);
             hits.push((close, Hit::Close));
-            let new_w = b.width(cx, "New conversation");
-            let new = b.draw(cx, close.pos.x - 8.0 - new_w, y, new_w, "New conversation", false);
-            hits.push((new, Hit::New));
-            b.d.label_elided(cx, rect(x, y, new.pos.x - x - 8.0, 24.0), true, tok.font.heading, ink, HAlign::Left, "Assistant");
+            let mut left = close.pos.x;
+            if source == Source::System {
+                let new_w = b.width(cx, "New conversation");
+                let new = b.draw(cx, close.pos.x - 8.0 - new_w, y, new_w, "New conversation", false);
+                hits.push((new, Hit::New));
+                left = new.pos.x;
+            }
+            b.d.label_elided(cx, rect(x, y, left - x - 8.0, 24.0), true, tok.font.heading, ink, HAlign::Left, &source.title());
         }
-        shown.push("Assistant".to_string());
+        shown.push(source.title());
         y += 30.0;
-        let status = phase_text(model.phase());
+        let status = source.status(&model);
         self.d.label_elided(cx, rect(x, y, cw, 16.0), false, tok.font.body_small, dim, HAlign::Left, &status);
         shown.push(status);
         y += 22.0;
@@ -299,15 +407,15 @@ impl ShellSystemChat {
         let field_y = bottom - FIELD_H;
         let running = model.phase().running_turn().is_some();
         let (label, hit) = if running { ("Stop", Hit::Stop) } else { ("Send", Hit::Send) };
-        let usable = matches!(model.phase(), Phase::Ready | Phase::Running { .. });
+        let usable = source.usable(&model);
         {
             let mut b = Buttons { d: &mut self.d, tok, hover };
             let bw = b.width(cx, label);
             let button = b.draw(cx, x + cw - bw, field_y + (FIELD_H - 28.0) * 0.5, bw, label, usable && (running || !draft.trim().is_empty()));
             hits.push((button, hit));
             let field = rect(x, field_y, cw - bw - 8.0, FIELD_H);
-            let placeholder = if model.open_question().is_some() { "Answer the question\u{2026}" } else { "Ask the system agent\u{2026}" };
-            b.d.text_field(cx, field, &tok, &draft, placeholder, true, hover == Some(field), ink);
+            let placeholder = source.placeholder(model.open_question().is_some());
+            b.d.text_field(cx, field, &tok, &draft, &placeholder, true, hover == Some(field), ink);
             hits.push((field, Hit::Field));
         }
         shown.push(format!("prompt: {draft}"));
@@ -334,7 +442,7 @@ impl ShellSystemChat {
         }
 
         // No provider: say so, with the way to fix it.
-        if model.phase() == &Phase::NoProvider {
+        if source == Source::System && model.phase() == &Phase::NoProvider {
             let mut b = Buttons { d: &mut self.d, tok, hover };
             let w = b.width(cx, "Open AI providers");
             let r = b.draw(cx, x, top + 12.0, w, "Open AI providers", true);
@@ -348,7 +456,7 @@ impl ShellSystemChat {
         let total: f64 = heights.iter().sum();
         let room = (list_bottom - top).max(0.0);
         self.max_scroll = (total - room).max(0.0);
-        let scroll = super::scroll().min(self.max_scroll);
+        let scroll = source.scroll().min(self.max_scroll);
         let mut ly = list_bottom - total + scroll;
         for (line, h) in lines.iter().zip(&heights) {
             let line_top = ly + line.gap_before;
@@ -361,8 +469,8 @@ impl ShellSystemChat {
             self.d.label_elided(cx, rect(x, line_top, cw, h - line.gap_before), line.bold, px, color, HAlign::Left, &line.text);
         }
         if model.items.is_empty() && usable {
-            let hint = "Ask the system agent anything: it can read and write its own workspace, search the web and brief your apps' agents. It asks you before anything outward.";
-            let wrapped = self.d.wrap(cx, false, tok.font.body_small, hint, cw, 6);
+            let hint = source.hint();
+            let wrapped = self.d.wrap(cx, false, tok.font.body_small, &hint, cw, 6);
             let mut hy = top + 12.0;
             for l in wrapped {
                 self.d.label_elided(cx, rect(x, hy, cw, 18.0), false, tok.font.body_small, dim, HAlign::Left, &l);
@@ -376,7 +484,17 @@ impl ShellSystemChat {
 }
 
 /// What a press does.
-fn act(hit: Hit) -> Outcome {
+fn act(source: Source, hit: Hit) -> Outcome {
+    if source == Source::App {
+        match hit {
+            Hit::Close => crate::app_chat::close(),
+            Hit::Send => crate::app_chat::send_draft(),
+            Hit::Stop => crate::app_chat::stop(),
+            Hit::Option { question, count, label } => crate::app_chat::answer_option(&question, count, &label),
+            Hit::New | Hit::OpenProviders | Hit::Field | Hit::Pane => {}
+        }
+        return Outcome::Taken;
+    }
     match hit {
         Hit::Close => super::close(),
         Hit::New => super::new_conversation(),
diff --git a/docs/adr/0004-native-apps-hosting-and-peers.md b/docs/adr/0004-native-apps-hosting-and-peers.md
index 5171c66b..1c1bad5d 100644
--- a/docs/adr/0004-native-apps-hosting-and-peers.md
+++ b/docs/adr/0004-native-apps-hosting-and-peers.md
@@ -1,7 +1,7 @@
 # ADR 0004: Native apps, app agents and cross-app work: one manifest, hosting per target, an agent for every app, approvals by the person
 
 - **Date:** 2026-09-28
-- **Status:** Accepted (2026-09-28); amended 2026-09-29 (section 6: `host.ask` dropped for octos's `ask_user_question`; sections 10 and 12: `terminal.run` only where the Terminal runs as a process; factual corrections from the gap review, marked where made; sections 4 and 8: interactive app cards; section 6: one shared conversation per app agent, then the same day two parallel lanes that share history; follow-ups from the 2026-09-29 code review); **Implemented** (2026-09-29): every plan step and every gap from the 2026-09-28 review is on `main`, and the full CI (Desktop, Phone, Apps and services, ROM) passed on `74e1d713`. The follow-ups below remain open work, not part of this decision's implementation.
+- **Status:** Accepted (2026-09-28); amended 2026-09-29 (section 6: `host.ask` dropped for octos's `ask_user_question`; sections 10 and 12: `terminal.run` only where the Terminal runs as a process; factual corrections from the gap review, marked where made; sections 4 and 8: interactive app cards; section 6: one shared conversation per app agent, then the same day two parallel lanes that share history; follow-ups from the 2026-09-29 code review; section 4: which apps have an agent, peers prepared at consent, the shell's "Ask <app>" panel); **Implemented** (2026-09-29): every plan step and every gap from the 2026-09-28 review is on `main`, and the full CI (Desktop, Phone, Apps and services, ROM) passed on `74e1d713`. The follow-ups below remain open work, not part of this decision's implementation.
 - **Scope:** How OctoSense declares, links, hosts, isolates and trusts its bundled native Rust apps on each target; where every app keeps its data and what its agent may read; how every bundled app, native or script, owns an octos app agent; how the system agent and app agents work across apps; and how the person approves what they do, live or in advance.
 - **Relates to:** [ADR 0001](0001-one-octosense-repository.md); [ADR 0002](0002-event-driven-app-agents.md) (app agents; amended by this ADR); [Home ADR 0002](home/0002-agentic-app-security-model.md) and [Home ADR 0004](home/0004-system-apps-are-contained-script-apps.md) (amended); Rinx [ADR 0007](https://github.com/hagency-org/Rinx/blob/main/docs/adr/0007-host-owned-octos-app-peers.md); octos UPCR-2026-034 (host-owned app peers, merged), UPCR-2026-035 ([octos#2567](https://github.com/octos-org/octos/pull/2567), host tools per app peer, merged; OctoSense pins its follow-ups, now octos e045c727 with octos#2621 and #2626) and UPCR-2026-036 (`serve --host-managed`, [octos#2591](https://github.com/octos-org/octos/pull/2591), merged); [octos#2601](https://github.com/octos-org/octos/pull/2601) (tool origin, per-connection ownership); [ADR 0003](0003-shared-octos-client-access.md) (Talk to Octos, OctoSense [#98](https://github.com/OctoSense-org/OctoSense/pull/98): external clients never reach app agents).
 
@@ -126,6 +126,12 @@ In-process modules (all of mobile, and Linux without Vulkan) must meet the bar a
 
 An app that declares `agent.octos` (native) or `octos.*` capabilities (script) and is granted them gets ONE host-owned app peer on the shell's one kernel, per (app, account). No app starts a kernel of its own. **The person consents at first use**: the first time an app asks for its agent, the shell shows what the agent may read and use and where the model runs; Settings lists every app's agent with an off switch.
 
+**Which apps have an agent (amended 2026-09-29).** From the manifests and grants, never from names (`crates/shell/src/agents.rs`, `apps::agent_apps`): a native app whose `native-apps.json` entry grants `agent.octos`; a script app whose manifest declares `octos.*` or an `agent` block, **or whose admitted bundle ships `tools.json`** (App Hub's `AgentBundle::load`). News ships `tools.json` (`news.list`, `news.read`) and declares no `octos.*`: it has an agent. Settings › Assistant › Approvals lists every one of them ("Not asked yet", on, off) before any has asked. An app's own `host.request("octos.*")` stays limited to the services its manifest declares.
+
+**Peers exist once the person allows them.** The first use that asks may be the person opening the app's "Ask <app>" panel, the app's own `octos` call, or the system agent's `agents.ask` (the first-use sheet then shows over the system chat); developer mode asks nobody (section 13), and there is no other bypass. From the moment an agent is allowed (and at startup for the ones allowed before), the shell **prepares its peer**: `peer/prepare`, its tools and `generic_tools` registered (G3), its session open, so the system agent's `peer_list` lists it and `peer_send_input` reaches it without the app ever calling `octos`. A script app's peer is the contained service's `card.<app id>`, one per app, shared by the app, its cards, the panel and the system agent. A native app's peer is its instance's and exists while the app is open (a native app with accounts cannot be prepared without its signed-in account). Turning the agent off releases the peer and its contexts at once; the shell refuses the system agent's input to it (the kernel may still list the retired peer). octos lists only prepared peers and offers no hook for an app whose agent is not allowed, so the shell tells the system agent itself: a short note with the system chat's turn whenever the apps' agents changed (each app, and whether it is allowed, not yet allowed or off), and two host tools on the system session, `agents.list` and `agents.ask`, answered by the shell (registered once a host credential exists, that is, once one app's agent has been prepared).
+
+**"Ask <app>" (the person's lane, drawn by the shell).** For every app with an agent the shell draws a panel with the app's conversation (section 6): it opens a sharing context with `open_conversation` (the contained service's for a script app), shows both lanes merged with their speakers ("You", "System agent", "<App>'s agent", "<App>'s agent, to the system agent"), has a composer and Stop (both lanes, section 6), shows and answers the app's own questions (G11), and leaves approvals to the shell's sheets. It opens from the bar's "Ask <app>" beside the focused window's title, Shift+F8, or Setup › Assistant › Ask this app's agent; on a desktop it stands beside the system chat, on a phone it is a full-screen sheet. It is the system chat's pane (`crates/shell/src/system_chat/view.rs`) in its app mode (`crates/shell/src/app_chat/`).
+
 Three flows:
 
 | Flow | Native module | Native app in its own process | Script app |
@@ -345,6 +351,8 @@ How it is turned on and kept from leaking into normal use:
 
 ### Follow-ups
 
+- [x] **An agent for every app that declares one** (section 4, 2026-09-29): a live run on `625d6cc` found News (tools.json, no `octos.*`) without a peer, an empty `peer_list` for the system agent, Settings listing only Rinx, and no place for the person to talk to an app's agent. Now the shell lists every app with an agent, prepares a consented app's peer, tells the system agent about the ones it cannot list, and draws "Ask <app>". Still open: a native app's peer exists only while the app is open; the speaker label of a script app's person turns is its app id (the peer's name, kept for resume), not its display name; prepared peers hold a kernel connection, so the kernel's idle stop waits for them.
+
 *Still open after the implementation (2026-09-29):* the Windows AppContainer sandbox ([#137](https://github.com/OctoSense-org/OctoSense/issues/137)); the Linux sandbox has run only in CI; process apps see the system agent's lane only through history until Makepad's peer client reads `conversation` frames; a second message on one conversation handle is refused rather than queued; Rinx still has to send turn triggers and hand over its send sheet; the OpenHarmony build with octos#2619's BoringSSL (`btls-sys`) is untested.
 
 Gaps between this decision and `main` found after it was accepted (2026-09-28; see [the architecture overview](../architecture.md#where-the-code-and-the-adrs-disagree)):
diff --git a/docs/architecture.md b/docs/architecture.md
index ccee3166..5a952080 100644
--- a/docs/architecture.md
+++ b/docs/architecture.md
@@ -165,7 +165,7 @@ flowchart TB
 | Agent | What it is | Status |
 | --- | --- | --- |
 | **The system agent** | the session `_main:api:octosense#system` on the `_main` profile (`SYSTEM_SESSION` in `crates/kernel/src/network.rs`). It owns every app peer and supervises them. The person reaches it in the shell's **system chat** (`crates/shell/src/system_chat/`, [#132](https://github.com/OctoSense-org/OctoSense/pull/132): Setup → Assistant → Assistant chat or F8; a side panel on the desktop, full screen on a phone), or through a paired Talk to Octos client | On main |
-| **An app agent** | one host-owned octos **peer** per (app, account), owned by the system agent (octos UPCR-2026-034, Rinx [ADR 0007](https://github.com/hagency-org/Rinx/blob/main/docs/adr/0007-host-owned-octos-app-peers.md)) | On main for Rinx (native) and for script apps behind a switch; see below |
+| **An app agent** | one host-owned octos **peer** per (app, account), owned by the system agent (octos UPCR-2026-034, Rinx [ADR 0007](https://github.com/hagency-org/Rinx/blob/main/docs/adr/0007-host-owned-octos-app-peers.md)). The person talks to it in the app's own UI, or in the shell's **"Ask <app>" panel** (`crates/shell/src/app_chat/`: the bar's "Ask <app>", Shift+F8; beside the system chat on a desktop, a full-screen sheet on a phone), which shows both lanes with their speakers, a composer and Stop | On main for Rinx (native) and every script app with an agent, after first-use consent; see below |
 
 Each app peer has, separately from every other:
 
@@ -178,7 +178,7 @@ Each app peer has, separately from every other:
 Who gets a peer today (`crates/ai-host/src/lib.rs`, `Policy::shipped()`; `crates/app-peers/src/hosted.rs`, `effective_services` = declared ∩ supported ∩ policy):
 
 - **Rinx**, the only native app granted the assistant (the four `octos.*` services, from its `native-apps.json` `agent.octos`, generated into `crates/ai-host/src/native_agents.rs`), after first-use consent.
-- **Script apps** that declare `octos.*`: one peer `card.<app id>` each, account `device` (`crates/ai-host/src/contained.rs`, [#106](https://github.com/OctoSense-org/OctoSense/pull/106)), only while `Policy::contained_apps` is on (off in the shipped policy; `OCTOSENSE_CONTAINED_APPS=1` turns it on) and the person consented at first use.
+- **Script apps with an agent**: a manifest that declares `octos.*` or an `agent` block, or a bundle that ships `tools.json` (News). One peer `card.<app id>` each, account `device` (`crates/ai-host/src/contained.rs`, [#106](https://github.com/OctoSense-org/OctoSense/pull/106)), once the person allowed it at first use (the shipped gate; `OCTOSENSE_CONTAINED_APPS=1` asks nobody, `0` turns it off). The shell prepares it as soon as it is allowed, and at startup (`crates/shell/src/agents.rs`, `contained::prepare`), so the system agent's `peer_list` shows it even when the app never calls `octos`; the app's own `host.request("octos.*")` stays limited to what its manifest declares.
 - **AppCard** (opt-in) takes its own kernel connection and sessions, not a peer.
 - **Process apps** whose `native-apps.json` entry grants `agent.octos` services reach their peer through the **peer link** (`crates/shell/src/peer_link/`, [#130](https://github.com/OctoSense-org/OctoSense/pull/130)), after first-use consent. None does yet: the Terminal, the only process app, grants none.
 
@@ -231,6 +231,7 @@ The kernel speaks the **octos UI protocol** (OUP; `octos-ui/v1alpha1`, JSON-RPC
 octos's peer mechanism, depth 1 (peers cannot create, steer or close peers). **On main** in octos; the tools are in octos `crates/octos-agent/src/tools/`.
 
 - **System agent → app agent.** `peer_send_input` (originator only, at most 64 KB) delivers text as the peer's next user turn, through the peer's inbox (a durable queue in serve, drained every few seconds, at least once).
+- **Which apps' agents the system agent can reach.** `peer_list` lists the prepared peers: the shell prepares every allowed app's agent. For the ones it cannot list (not yet allowed, or off) the shell tells it: a note with the system chat's turn whenever the apps' agents changed, and the host tools `agents.list` and `agents.ask` on the system session (`crates/shell/src/agents.rs`; `agents.ask` shows the first-use sheet, which only the person answers).
 - **App agent → system agent: the blackboard.** Each peer turn writes `peers/<slug>/result.md` (plus `result-<n>.md`) and a line in `turns.txt`; the system agent reads them with `peer_gather` and `peer_list` (`awaiting_input` shows a peer waiting on a question). It is the only cross-peer channel.
 - **Questions.** A peer asks with `ask_user_question`; the system agent answers with `peer_respond`. `peer_respond` never answers approvals (octos refuses). octos keeps `ask_user_question` on host-driven turns (`generic_tools` is an exact list the host sets, and omitted keeps the whole roster). ADR 0004 §6 (decided 2026-09-29) has the shell route each question to the right conversation: the app's own conversation, or the system chat for system-agent turns, `peer/input` turns included; there is no `host.ask`. **On main**: the system chat answers the system agent's own questions on its session; the broker hands an app peer's `user_question/requested` (its own session, a request context, a `peer/input` turn) to the shell's request model (`crates/shell/src/questions/`) with the turn's origin (reported by octos once it carries it, else derived: the turns the broker started for `peer/input` are the system agent's), and the model routes it by that origin: a person's or the app's turn to the app's conversation (the shell's overlay), a system-agent turn to the system chat. Only the person answers, on a shell surface (`user_question/respond` on the broker's link); the app's context hears `user_question/handled_by_host`, and the broker refuses an app's attempt to answer an id the host holds. A question closes when its turn ends.
 - **Two parallel lanes per app agent, sharing history read-only.** ADR 0004 §6 (decided 2026-09-29, replacing the same day's single queued conversation of [#166](https://github.com/OctoSense-org/OctoSense/pull/166) and octos [#2626](https://github.com/octos-org/octos/pull/2626)): the system agent talks to the peer's own session (`peer/input`), and the person (the app's UI, its cards, a process app without a `client`) in a request context the broker opens with `share_history` (octos [#2636](https://github.com/octos-org/octos/pull/2636), UPCR-2026-034), a new context id per handle. The two run in parallel: a person's message waits only for its own context's previous turn, and `peer/input` keeps its own queue on the peer's session. At each turn's start the kernel shows the model the other lane's last user/assistant text rows (20 by default, at most 50, within 16 KiB; tool rows dropped) as a read-only block that is never written into the reader's transcript; there is no shared transcript. Every turn keeps its `origin` (`person`, `system_agent`, `app`; the kernel's `[from …]` marker; the host cannot relabel a system-agent turn), and a person's turn leaves a round on the blackboard (`origin: person`, `context: <id>`) that the system agent reads with `peer_gather` and that fires no fleet synthesis on its own. `OctosAppService::open_conversation` is the person's lane; `open_context(client)` stays a plain request context (Rinx's mini apps). The app's follower (`OctosContext::subscribe`; `conversation` frames on the peer link) gets both lanes' events, each with `lane` and `speaker`; `octos.session.history` is both transcripts merged by `persisted_at`, each row with `lane` and, for a marked user message, `speaker` and `display_text`. Accepted hazards: file edits are not locked across lanes (each lane edits its own folder, a context's is `contexts/<id>`), the unknown-outcome marks are shared, and parallel turns can overshoot the peer's token budget slightly.
@@ -244,7 +245,7 @@ For a host-owned peer, a plain `peer_send_input` runs as a kernel continuation w
 | Hosting | Channel | Status |
 | --- | --- | --- |
 | In-process native module (Rinx) | the **injected service**: `ai_host::offer` before `create`, `octosense_app_peers::injection::claim` inside it, giving a scoped `OctosAppService` (`Open`, `History`, `Turn`, `Interrupt`, `Approval`); the module never sees the protocol | On main |
-| Script app | `host.request("octos.session.open" / "octos.session.history" / "octos.turn.start" / "octos.turn.interrupt", …)` to the `octos` host service (`crates/ai-host/src/contained.rs`); gated by the manifest, `Policy::contained_apps` and first-use consent (`consent_for_contained`); tool approvals its peer raises are declined and listed in `denied_approvals` | On main ([#106](https://github.com/OctoSense-org/OctoSense/pull/106), consent from [#120](https://github.com/OctoSense-org/OctoSense/pull/120)) |
+| Script app | `host.request("octos.session.open" / "octos.session.history" / "octos.turn.start" / "octos.turn.interrupt", …)` to the `octos` host service (`crates/ai-host/src/contained.rs`); gated by the manifest, `Policy::contained_apps` and first-use consent (`consent_for_contained`); tool approvals its peer raises go to the shell's router. An app that draws no chat (News) is talked to in the shell's "Ask <app>" panel, on the same peer | On main ([#106](https://github.com/OctoSense-org/OctoSense/pull/106), consent from [#120](https://github.com/OctoSense-org/OctoSense/pull/120)) |
 | Native app in its own process | the **peer link**: its own channel on the app's hub connection (`PeerRequest`, `PeerReply`, `PeerToolCall` with the identity and caller stamped by the shell), never registered with the AI bus; client API in Makepad's `makepad-ai-services` | Shell side on main ([#130](https://github.com/OctoSense-org/OctoSense/pull/130), `crates/shell/src/peer_link/`, frames routed from the hub connection in `lib.rs`); no process app is granted an agent yet |
 
 ### Makepad's AI services bus vs OctoSense's app agents
diff --git a/docs/architecture.zh-CN.md b/docs/architecture.zh-CN.md
index 519bade5..edc8ba3e 100644
--- a/docs/architecture.zh-CN.md
+++ b/docs/architecture.zh-CN.md
@@ -165,7 +165,7 @@ flowchart TB
 | Agent | 是什么 | 状态 |
 | --- | --- | --- |
 | **系统 Agent** | `_main` profile 上的会话 `_main:api:octosense#system`（`crates/kernel/src/network.rs` 中的 `SYSTEM_SESSION`）。它拥有并监督所有应用 peer。目前用户通过 Talk to Octos 客户端与它对话；Shell 还没有为它绘制对话界面 | 已在 main |
-| **应用 Agent** | 每个（应用，账号）一个由宿主拥有的 octos **peer**，归系统 Agent 所有（octos UPCR-2026-034，Rinx [ADR 0007](https://github.com/hagency-org/Rinx/blob/main/docs/adr/0007-host-owned-octos-app-peers.md)） | Rinx（原生）已在 main；脚本应用在开关后可用；见下文 |
+| **应用 Agent** | 每个（应用，账号）一个由宿主拥有的 octos **peer**，归系统 Agent 所有（octos UPCR-2026-034，Rinx [ADR 0007](https://github.com/hagency-org/Rinx/blob/main/docs/adr/0007-host-owned-octos-app-peers.md)） 用户可在应用自己的界面中，或在 Shell 的 **"Ask <app>" 面板**（`crates/shell/src/app_chat/`：状态栏的 "Ask <app>"、Shift+F8；桌面上位于系统聊天旁，手机上为全屏面板）与它对话，面板显示两条通道及发言者、输入框和停止按钮 | Rinx（原生）和每个带 Agent 的脚本应用已在 main，需首次使用同意；见下文 |
 
 每个应用 peer 都独立拥有：
 
@@ -178,7 +178,7 @@ flowchart TB
 目前谁有 peer（`crates/ai-host/src/lib.rs`，`Policy::shipped()`；`crates/app-peers/src/hosted.rs`，`effective_services` = 声明 ∩ 支持 ∩ 策略）：
 
 - **Rinx**，唯一获授权使用助手的原生应用（四个 `octos.*` 服务），需首次使用时的同意。
-- 声明了 `octos.*` 的**脚本应用**：每个应用一个 peer `card.<app id>`，账号为 `device`（`crates/ai-host/src/contained.rs`，[#106](https://github.com/OctoSense-org/OctoSense/pull/106)），前提是 `Policy::contained_apps` 开启（发布策略中默认关闭；`OCTOSENSE_CONTAINED_APPS=1` 可开启）且用户在首次使用时同意。
+- **带 Agent 的脚本应用**：清单声明了 `octos.*` 或 `agent` 块，或应用包带有 `tools.json`（如 News）。每个应用一个 peer `card.<app id>`，账号为 `device`（`crates/ai-host/src/contained.rs`，[#106](https://github.com/OctoSense-org/OctoSense/pull/106)），在用户首次使用同意后可用（发布策略；`OCTOSENSE_CONTAINED_APPS=1` 不再询问，`0` 关闭）。用户一旦同意（以及启动时对已同意的应用），Shell 就会准备其 peer（`crates/shell/src/agents.rs`），因此即使应用从不调用 `octos`，系统 Agent 的 `peer_list` 也能看到它；对尚未同意或已关闭的应用，Shell 通过系统聊天中的提示以及 `agents.list` / `agents.ask` 宿主工具告知系统 Agent。
 - **AppCard**（可选）使用自己的内核连接和会话，而不是 peer。
 - 进程应用目前没有 Agent：只有 `ModuleHost::create` 中才会提供服务（peer link 规划中，步骤 8）。