[unlockdigital]

This update adds explicit private model workflows while preserving ordinary Tinfoil selection in Standard threads. Private work stays bound to its approved route across background generation, context reads, forwarding, and scheduled tasks. Reviewed helper packets use a stateless completion interface and return artifacts for inspection.

The integration also includes provider usage and browser-bound billing, on-demand skill discovery, privacy-aware workflow reviews, and Home activity improvements. Credentials stay in host-managed storage, and examples use synthetic data. Upstream attribution and the existing fork maintenance structure are preserved.

Validation:

• 1,420 tests across 76 files; 32 affected-package typechecks; formatting, lint, unused-code and generated-file checks passed.
• Desktop build and synthetic private-provider/helper workflow passed.
• Independent source-boundary reviews and exact-tree/commit privacy scans found no unresolved findings. Scanner matches were traced to unchanged upstream content or independently verified synthetic fingerprints.
• Runtime activation and saved-state integrity verified for the initial integration.
• Release Smoke passes after pinning node-pty to its existing patch target. Migration and usage regressions pass; focused React Compiler coverage passes for both web and mobile PrivateControls, with each failure reproduced before repair.
• Fourteen synthetic component interaction/layout cases pass, including review-before-approval, read-only controls, error cleanup, and 390px/320px layouts. State and command boundaries were mocked. The maintainer reviewed the synthetic fixture and approved merging. Screenshot capture remains unavailable, and full-composer visual coverage is limited to the stated component scope.

Reviewed head: add20038ba63aa38537c429ebcc7ddbf98772e74.
Reviewed tree: 1be0367ab0804c3dc186a6ed44477c23acd82927.

Implementation: GPT-6.1 Sol through the Codex harness. Independent integration review: GPT-6 Astra through the Codex harness.

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	5.0 KiB	5.0 KiB	0 B (0.0%)	6.8 KiB	✅
Codex	Thread snapshot wire	3.8 KiB	3.8 KiB	0 B (0.0%)	4.9 KiB	✅
Codex	Live turn WebSocket wire	1.2 KiB	1.2 KiB	0 B (0.0%)	2.0 KiB	✅
Codex	Live turn WebSocket decoded	20.9 KiB	20.9 KiB	0 B (0.0%)	29.3 KiB	✅
Codex	Live turn messages	2	2	0 (0.0%)	8	✅
Claude	Total thread wire	5.0 KiB	5.0 KiB	−7 B (−0.1%)	6.8 KiB	✅
Claude	Thread snapshot wire	3.8 KiB	3.8 KiB	0 B (0.0%)	4.9 KiB	✅
Claude	Live turn WebSocket wire	1.2 KiB	1.2 KiB	−7 B (−0.6%)	2.0 KiB	✅
Claude	Live turn WebSocket decoded	21.2 KiB	21.2 KiB	0 B (0.0%)	29.3 KiB	✅
Claude	Live turn messages	2	2	0 (0.0%)	8	✅

Baseline: 353cec5 · PR result: add2003 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 108.5 KiB
• Claude decoded thread snapshot: 108.8 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.