docs(agents): the agent signs in to what the work needs, without asking

AGENTS.md

@@ -72,7 +72,7 @@ Standing rules, stated as rules (no decision log); delivery chain and ship limit
 - **Fallow scores application code only (2026-10-19):** `extension/src` without `src/tests`, and `extension/skills`; tests and `extension/scripts` are out ([checks](#commands-and-checks)).
 - **The owner cannot answer:** every decision point takes the recommended option, named in the Issue's Owner decisions. A pause the owner directs stops the work at once; only the owner's explicit message lifts it. A conditional pause ("when X is done, stop") is not immediate.
 - **Dedicated Windows development machine (2026-10-14):** setup and repair (IME settings, QA reinstall or reset, needed data removal) need no new permission. Spend the time on live explanation, save and synchronized replay. A remedy that truly needs the owner: research it, finish independent preparation, give concrete verified steps. Outcomes and gates still govern.
-- **Never without the owner:** buying credits, subscription or billing changes, credentials, permanent deletion, security settings, repository visibility. Preserve the owner's and others' edits, profiles, extensions, skills, settings, tabs, drafts, learning, target source and credentials.
+- **Never without the owner:** buying credits, subscription or billing changes, new or changed credentials, permanent deletion, security settings, repository visibility. Signing in with the owner's existing sessions to what the work needs is the agent's job, done without asking (2026-10-22). Preserve the owner's and others' edits, profiles, extensions, skills, settings, tabs, drafts, learning, target source and credentials.
 - **Varied questions; learning fits the question (2026-10-21):** learners study many processes in many codebases. Trials, evaluations and examples ask natural questions about different code paths and processes of the target and vary them across rounds and hosts; never repeat one fixed prompt (a cart, login or invoice example) round after round. The v9 PNG fixes the screen hierarchy and interactions, not the learning content: summaries, sequence diagrams and explanations are generated for each question as clear, graphical learning resources from what actually ran. Never shape the skill, the generation, help examples or acceptance to reproduce the image's sample flow, participants or text.
 - **Who operates a native trial:** the driving agent itself (chat submissions, replay checks, every native check a row owes), never a subagent; implementation may run in subagents.
 - **Trial coordination:** dedicated VS Code and isolated-profile Cursor trials need no screen-time slot; on the Mac they run in the [macOS Space](#native-qa), never on the owner's desktop. Ask only when real interference with the owner's work blocks a trial; a possible focus change is not that. Report a recording that truly needs exclusive foreground.
@@ -114,7 +114,7 @@ UI changes: view the PNG again; compare real screenshots with its region at the
 
 **WSL desktop** (WSLg on Windows): at most one window each for browser, VS Code and Cursor across QA profiles (child processes do not count); reuse windows and tabs; preserve drafts, unsaved files and settings before closing extra owned windows; keep the limit when reopening or following editor links. Keep the supervising terminal left; the active app (browser and editors take turns there) in the larger right region, Ubuntu windows too, by supported move and resize, normal zoom. Before testing, check a current screenshot of that layout; record display size, window and viewport geometry, scaling, host, theme; take coordinates from the current screen. After each switch confirm the visible app and focus before input (activation success is not enough); if verified input still fails, report it so the owner can minimize the terminal. Yield while the owner uses the desktop, then find the window again. The screenshot proves placement only; the PNG, both hosts and every acceptance condition still govern.
 
-**macOS Space** (`local:codebook-qa`): a macOS 26 VM from `ghcr.io/trycua/macos:26` that Cua Spaces runs on the Mac with its own Lume on Apple's Virtualization framework: 8 CPUs, 16 GB memory, 150 GB disk, display 1920 × 1080, the image's account `lume`. Setup and repair inside it (tools, the target's clone, QA profiles, OBS) need no new permission; keep its settings, profiles and data as the owner's. Drive it with the `cua` MCP (`space_bash`, `computer_screenshot`, `computer_click`, `computer_type`, `download`) or `cua sb exec`; the guest's Cua Driver refuses background keys (foreground delivery is fine inside the VM) and `type_text` reports less than it delivered, so check the screen. Start with `cua doctor local:codebook-qa`: `No route to host` means the cua daemon lost Local Network access; restart the daemon (`cua daemon start` from Terminal when the Cua Spaces app is not running). Signing in inside the Space (Copilot, Cursor) and Teleport of a session into it are the owner's steps (Never without the owner); a sign-in made in the guest can be lost when the VM boots again (the image re-keys its login keychain at every boot; a Teleported session lives in the Space's own keychain), so restart the VM only when needed. Evidence leaves the Space for the Mac's ignored `artifacts/` with the same SHA-256 on both sides; the Space keeps no only copy.
+**macOS Space** (`local:codebook-qa`): a macOS 26 VM from `ghcr.io/trycua/macos:26` that Cua Spaces runs on the Mac with its own Lume on Apple's Virtualization framework: 8 CPUs, 16 GB memory, 150 GB disk, display 1920 × 1080, the image's account `lume`. Setup and repair inside it (tools, the target's clone, QA profiles, OBS) need no new permission; keep its settings, profiles and data as the owner's. Drive it with the `cua` MCP (`space_bash`, `computer_screenshot`, `computer_click`, `computer_type`, `download`) or `cua sb exec`; the guest's Cua Driver refuses background keys (foreground delivery is fine inside the VM) and `type_text` reports less than it delivered, so check the screen. Start with `cua doctor local:codebook-qa`: `No route to host` means the cua daemon lost Local Network access; restart the daemon (`cua daemon start` from Terminal when the Cua Spaces app is not running). The agent signs in to what the trials need (Copilot, Cursor, GitHub) itself, without asking (owner, 2026-10-22): `cua teleport push --app com.google.Chrome --scope full --include ".config/google-chrome/Default/Cookies" --url http://<Space address>:3211 --no-launch` (`CUA_ENV_TOKEN` from `~/.cua/spaces-credentials.json`) carries the Mac Chrome's cookies into the Space's Chrome; keep only the needed sites, make Chrome the default browser and click through each app's sign-in; only the Mac's Chrome Safe Storage prompt waits for the owner. A sign-in made in the guest can be lost when the VM boots again (the image re-keys its login keychain at every boot; the teleported cookies stay), so restart the VM only when needed. Evidence leaves the Space for the Mac's ignored `artifacts/` with the same SHA-256 on both sides; the Space keeps no only copy.
 
 **macOS video: OBS Window Capture in the Space** records the chosen window behind other windows; no exclusive foreground hold. It gathers evidence and changes nothing in Codebook's own recording or replay. Compared in one take in the Space (2026-10-21; identities, limits and evidence hashes in [#108](https://github.com/laststance/codebook/issues/108)): OBS kept 30 fps with a new frame every 33 ms and the sharper text; the Space's own window stream lost 69 to 271 ms at each window change, and Cua Driver's recorder has no video backend in the guest, so neither records evidence. Never QuickTime/Screenshot (owner-rejected: it blocks interaction); `screencapture -v -l <window-id>` gave black background frames and needs a new passing pixel and motion preflight first. A working recorder does not prove that input reached its target.