blitzdotdev · pythonlearner1025 · Aug 29, 2026 · Aug 28, 2026 · Aug 28, 2026 · Aug 28, 2026
diff --git a/CLAUDE.md b/CLAUDE.md
@@ -64,23 +64,71 @@ conformance tests on BOTH sides. Never hand-edit one side of a contract.
 | MICROVM_HOSTS | runtime + deploy share ONE parser | n/a (shared code) | `core/compute/microvm-hosts.js` imported by both |
 | dufs WebDAV listing | `core/files/sync.ts` parser ↔ dufs in the box image | `fixtures/dav-listing/` | `test/dav-listing-fixtures.test.ts` (TS side; guest side revalidates at box-image rebuild) |
 | public preview links | box CLI state ↔ Go gateway ↔ browser | `fixtures/previews/` | `gateway/main_test.go`, `webapp/test/preview-v2.test.ts` |
-| workspace environment | `core/environment.ts` route ↔ `broker/internal/workspace/environment.go` ↔ `box/actor/src/credentials.ts` (`env` only) | `fixtures/workspace-environment/` | `test/workspace-environment-conformance.test.ts`, `broker` `environment_test.go`, `actor/test/workspace-environment.test.ts` |
 | preview-focus | `blitz teenyapp open` CLI (`blitz preview` stays a silent alias; wire unchanged) ↔ Go gateway (`/preview-focus`) ↔ browser (`webapp/src/preview.ts` consumer, auto-opens the focus) | `fixtures/preview-focus/` | `box/actor/test/preview-focus-conformance.test.ts` (producer), `gateway/main_test.go` (reader), `webapp/test/preview-focus.test.ts` (browser consumer) |
 | connections-focus | `blitz connections open <provider>` CLI ↔ Go gateway (`/connections-focus`) ↔ browser (`webapp/src/connections-focus.ts` consumer via `use-workspace-connections-focus.ts`, opens the workspace connections panel with the provider selected) | `fixtures/connections-focus/` | `box/actor/test/connections-focus-conformance.test.ts` (producer), `gateway/main_test.go` (reader), `webapp/test/connections-focus.test.ts` (browser consumer) |
 | webApp ticket v1 | `core/webapp-tickets.ts` mint/verify ↔ `box/gateway/main.go` ↔ `box/actor/src/auth.ts` | `fixtures/webapp-ticket/` | `test/webapp-ticket-conformance.test.ts`, `gateway/main_test.go` (ticket_conformance_test.go), `actor/test/auth-conformance.test.ts` |
 | schema ↔ wire copy | `packages/schema/src` ↔ `control-plane/core/wire.ts` | n/a | `test/wire-drift.test.ts` (full field coverage) |
 | microVM agent protocol | `microvm-host/types.go` ↔ `core/compute/microvm-agent.ts` | none yet — add fixtures before changing either side | — |
 | webApp box surface | `core/webapp-surface.ts` ↔ `schema/src/webapp-surface.ts` (webApp resolver) | n/a | `test/webapp-surface-drift.test.ts`, `webapp/test/webapp-surface.test.ts` |
 | agent rules | CP `core/agent-rules.ts` producer (`GET /workspaces/self/agent-rules`) ↔ box `blitz-rules sync` consumer (`box/rootfs/usr/local/bin/blitz-rules`); `AGENT_RULES_DOC` mirrors the canonical `box/rootfs/opt/blitz/skel/agent-rules.md` | `fixtures/agent-rules/` | `test/agent-rules-conformance.test.ts` + `test/agent-rules-drift.test.ts` (CP), `box/actor/test/agent-rules-conformance.test.ts` (box) |
-| connection pull v1 | CP producer `core/connections/pull-wire.ts` (`GET /workspaces/self/connections`, `POST /workspaces/self/connections/:name/token`) ↔ Go consumer `broker/internal/workspace/connections.go`, printed by `blitz-cred list\|get\|env` | `fixtures/connection-pull/` | `test/connection-pull-conformance.test.ts` + `test/pull-credentials.test.ts` (CP), `broker/internal/workspace/connections_test.go` + `broker/cmd/blitz-cred/main_test.go` (box) |
+| connection pull v1 | CP producer `core/connections/pull-wire.ts`, routes in `core/connections/pull-routes.ts` (`GET /workspaces/self/connections`, `POST /workspaces/self/connections/:name/token`) ↔ Go consumer `broker/internal/workspace/connections.go`, printed by `blitz-cred list\|get\|env`. Carries BOTH credential planes: the member's own connection grant and the workspace credential store (plans/MEMBER-MACHINES.md §4) | `fixtures/connection-pull/` | `test/connection-pull-conformance.test.ts` + `test/pull-credentials.test.ts` + `test/member-machines.test.ts` (CP), `broker/internal/workspace/connections_test.go` + `broker/cmd/blitz-cred/main_test.go` (box) |
 | entitlements | CP `core/entitlements.ts` (`PUT /orgs/:id/entitlements` writer, `GET /orgs/:id/usage`, the 402 seat-limit refusal and its HS256 handoff token) ↔ the PRIVATE billing service, which owns plans, writes the integers, and verifies the token — core never learns a plan name | `fixtures/entitlements/` | `test/entitlements-fixtures.test.ts` (CP); the billing service copies the corpus and pins it on its side |
 | recipe invocation files | `core/bootstrap.ts` writer (recipe launches emit `/var/lib/blitz/recipe/prompt.txt` + `invocation.env`) ↔ guest readers: `blitz-term` through the shared parser `box/rootfs/usr/local/libexec/blitz-recipe-invocation`, plus the bootstrap-emitted chat sender's raw `prompt.txt` read (the sender never parses `invocation.env` — model/effort/permission are interpolated into its source at render time) | `fixtures/recipe-invocation/` | `test/recipe-invocation-fixtures.test.ts` (CP), `box/actor/test/recipe-invocation-guest.test.ts` (guest: shared parser vs corpus + blitz-term delivery semantics) |
 | box config v1 | CP `core/box-config.ts` producer (`GET /workspaces/self/box-config`) and consumer (`POST /workspaces/self/box-update-result`) ↔ host updater bash/python emitted by `core/bootstrap.ts` (`blitz-box-update`; cloud-VM path only — the microVM provider has its own guest lifecycle and no update path yet) | `fixtures/box-config/` | `test/box-config-conformance.test.ts` (CP), `test/box-update-conformance.test.mjs` (runs real `python3` over the emitted parser/producer, `bash -n` over the emitted scripts), `test/box-update-host.test.mjs` (runs the emitted updater in real bash against a live CP over real curl) |
 
+Retired: the `workspace environment` contract (`GET /workspaces/self/environment`
+→ `creds/env.d/00-workspace.sh`). Workspace credentials serve through
+`blitz-cred` alone — see `plans/MEMBER-MACHINES.md` §1. The route stays only for
+box images already in the field, which tolerate an empty answer.
+
 Legacy phone-home shapes are accepted ONLY inside
 `adaptLegacyPhoneHomeRequestForInFlightImages` in `core/workspaces.ts`.
 Do not add aliases anywhere else.
 
+## Member machines: what a workspace is now
+
+`plans/MEMBER-MACHINES.md` landed in migrations 0041-0044. Two invariants an
+agent must not undo:
+
+- **A workspace is configuration; a `machines` row is the VM.** The workspace
+  has no phase, no `vm_id`, and no environment. `WorkspaceView.phase` and
+  `.ssh` survive as a projection of the REQUESTING member's machine, so old
+  pollers keep converging — do not start storing them again.
+- **The acting principal is resolved at call time** from
+  `machines.membership_id` (`core/oauth.ts`, `core/connections/mint.ts`).
+  Nothing about who a guest acts as is stored beside its credential. The row
+  that used to hold it pinned the workspace owner, and that is the bug the
+  structure now prevents.
+
+Three compatibility surfaces are load-bearing and have no expiry date yet:
+`GET /boxes/:id/feed` (served from `machines`),
+`GET /workspaces/:id/environment` (a constant `{env:{}, startupScript:null,
+filesReady:true}`, because deployed brokers poll it every second at boot and
+wait for exactly those three fields), and the token families migration 0041
+copied hash-for-hash so no deployed guest had to re-enrol.
+
+The `workspace environment` cross-runtime contract is retired with its fixtures
+and both conformance tests: no runtime reads the route any more, so what remains
+is that constant three-field shim, pinned alone by
+`control-plane/test/workspace-environment.test.ts`.
+
+Every field of `WorkspaceView` is required, including `members`,
+`credentials`, `myRole`, `defaultMachineTypeId` and `autoProvision`. The only
+client is `packages/webapp`, built from `packages/schema` in this tree, so a
+server that drops a field fails `test/wire-drift.test.ts` rather than the
+browser. Do not make one optional to spare a fixture.
+
+Templates and Recipes are disabled product-wide (2026-08-29), on both sides:
+
+- Control plane: the two registrations are commented out in `core/app.ts`.
+- Webapp: the `/templates*` and `/recipes*` branches are commented out in
+  `sessions-page-state.ts`, so those addresses fall through to Drive, and
+  `shell/SecondaryRoutes.tsx` no longer renders them.
+
+The page components (`TemplatesHome`, `RecipesHome`, `CreateTemplateScreen`,
+`CreateRecipeScreen`), the client methods and the recipe rows are untouched
+and unreachable. Restoring a surface means restoring both branches.
+
 ## VM provider architecture (do not regress)
 
 - The plugin contract is `VmProvider` in `core/compute/types.ts`:

diff --git a/README.md b/README.md
@@ -4,7 +4,7 @@
 
 <p align="center">
   <a href="#features">Features</a> •
-  <a href="#architecture">Architecture</a> •
+  <a href="#about">About</a> •
   <a href="#packages">Packages</a>
 </p>
 
@@ -14,22 +14,23 @@
 
 # Features
 
-**BYO agent and run them on any cloud** 
+**BYO agent and run them on any cloud**
 
 - **Agent workspaces** Shareable, sandboxed cloud computers holding only the credentials and data AI agents need.
-- **Workspace templates** Create agent workspace templates defining what repos, credentials, machine environment, etc. are put in the agent workspace. Set up once and share with everyone. 
-- **Recipes** Like skills but on steroids: define the runtime of a successful agent workflow (AI model, machine env, data + credentials) and trigger it with a webhook from Slack, GitHub, etc.
+- **A machine for every member** Join a workspace like you join a Discord server: your own machine is already running, preloaded with the team's repos, rules, and keys. Nobody files a ticket for a VM.
+- **Workspace credentials** Sealed, workspace-scoped API keys that agents fetch at the moment of use with `blitz-cred`. Nothing ambient, nothing in a dotfile, revocation that actually revokes.
+- **Everyone acts as themselves** Your GitHub and your agent subscriptions stay yours on your machine. Commits carry your name, tokens spend your identity — even in a workspace the whole team shares.
 - **Teenyapps** Mini apps you can vibe-code to build internal tools like dashboards, CRMs, and task managers — each comes with a backend, auth, and a URL.
 
 # About
 
 An operating system turns a bare machine into a standard environment where programs just run. BlitzOS does the same for AI: it turns the context, credentials, and workflows your fast adopters have dialed in into reusable, standardized workspaces that the rest of the company can just use, without learning the agent setup themselves.
 
-When a new AI agent drops, a developer tests it in a fresh "daily driver" workspace from a company template. That template preconfigures the repos, API keys, and agent skill library, and nothing else. The clean boundary keeps the agent safe to run on real work in the cloud, unlike a local machine where every other project's credentials and configs are reachable.
+When a new AI agent drops, a developer tests it on their own machine inside the team workspace. The workspace preconfigures the repos, API keys, and agent rules, and nothing else. The clean boundary keeps the agent safe to run on real work in the cloud, unlike a local machine where every other project's credentials and configs are reachable.
 
-If the agent does something interesting, developers share the workspace like a Google Doc. If it's genuinely better but needs config tweaks, one developer publishes an updated template and everyone rolls it out.
+If the setup is genuinely better, spreading it is one action: add a teammate, and a machine with the same repos, rules, and keys is theirs before their first click. A workspace **is** its own template — when a configuration is worth keeping, clone the workspace and the next team starts where this one left off.
 
-BlitzOS helps companies digest AI advancements as fast as they happen. Workspaces, templates, and recipes enable **faster experimentation** and **workflow sharing**, and features like automatic evals build on them to optimize AI cost.
+BlitzOS helps companies digest AI advancements as fast as they happen. Workspaces and member machines enable **faster experimentation** and **workflow sharing**, and features like automatic evals build on them to optimize AI cost.
 
 # Installation
 
@@ -49,7 +50,7 @@ Follow the [self-host guide](docs/SELF-HOST.md).
 # Packages
 
 - [`box`](packages/box/README.md) the complete workspace runtime: SSH, Docker, agent harnesses, terminal, chat, files, and previews.
-- [`control-plane`](packages/control-plane/README.md) workspace lifecycle, sessions, access, credential injection, volumes, and compute providers.
+- [`control-plane`](packages/control-plane/README.md) workspaces, member machines, roles, credential injection, volumes, and compute providers.
 - [`microvm-host`](packages/microvm-host/README.md) the Go host agent that runs and networks Firecracker workspaces.
 - [`webApp`](packages/webapp/README.md) the browser webApp for creating, configuring, sharing, and working inside workspaces.
 - [`broker`](packages/broker/README.md) short-lived Claude and Codex credential delivery for workspace fleets.
@@ -68,6 +69,7 @@ Follow the [self-host guide](docs/SELF-HOST.md).
 
 # Roadmap
 
+- [ ] sessions
 - [ ] recipes
 - [ ] evals
 - [ ] policy

diff --git a/packages/box/actor/src/actor.ts b/packages/box/actor/src/actor.ts
@@ -178,13 +178,6 @@ class SessionActor {
         stopReason = "cancelled";
         return { stopReason };
       }
-      // Workspace variables are optional configuration: this call degrades to
-      // the actor's own environment rather than failing the prompt.
-      const environment = await this.credentials.environment();
-      if (abort.signal.aborted) {
-        stopReason = "cancelled";
-        return { stopReason };
-      }
       try {
         const output = await this.adapter.runTurn({
           sessionId: this.id,
@@ -194,7 +187,9 @@ class SessionActor {
           resumeId: this.resumeId,
           signal: abort.signal,
           token,
-          environment,
+          // The actor's own environment, and nothing added. Every credential a
+          // turn may use is pulled at the moment of use with `blitz-cred get`.
+          environment: process.env,
           config: this.config,
           emit: (update) => this.emit(update, identity),
           requestPermission: (request) => this.requestPermission(request, identity),