…lowlists

The remaining itx-next.md roadmap, one PR (with the ProjectWorker
forwarder already on this branch):

- url refs (§1): UrlDial loopback entrypoint dials remote Cap'n Web
  servers — ONE WebSocket session per call, terminating in the stateless
  worker (Law 7). Handshake headers pass through the same getSecret()
  substitution as project egress, resolved via the SecretsCapability
  loopback, so credentials never appear in registry rows. Never an HTTP
  batch: new lint rule iterate/no-capnweb-http-batch bans
  newHttpBatchRpcSession repo-wide.
- code-context defaults (§8): defineCodeContext is the authoring surface;
  ContextRegistryHost.defaults is the chain's final fallthrough link. Own
  rows shadow, describe() reports owner "platform:project", child
  contexts inherit through the existing parent delegation. First default:
  ai (BindingCapability over env.AI).
- addressing (§3): itx.streams.get takes "/path", "ns:/path", and
  { namespace?, path } — absolute forms are sugar through ItxStreams
  .namespace, whose access check now admits named access sets and masks
  refusals as NOT_FOUND like projects.get. Global registry node stays
  descoped (§8 gives it a cheap birth when something needs it).
- config allowlists (§2): APP_CONFIG_ITX dialableBindings/Loopbacks merge
  with the hardcoded defaults via resolveDialableTargets — widen-only, so
  a misconfigured deployment never loses first-party caps.

e2e (all green against a live dev server): url cap dials this
deployment's own /api/itx back over the network; platform default ai is
inherited and shadowable; absolute stream refs round-trip and a project
handle cannot fully-qualify its way out.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

… protocol

No backcompat (prd data is erasable): the tombstone DO class, its
namespace/bindings, every executeCodemodeFunctionCall method, and the
legacy wire type are gone. AgentToolsCapability now dials a clean
AgentDurableObject.callAgentTool; the ingress test entry upserts secrets
through OrpcCapability.call; packages/shared/src/codemode is renamed to
type-tree with codemode identifiers neutralized (context-proxy deleted —
its only importer was a deleted legacy test provider).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

# Conflicts:
#	apps/os/src/itx/e2e/itx.e2e.test.ts

Bugbot: revoke on a default-only cap returned ok and emitted capRevoked
while invoke/describe kept serving it through the code context. Defaults
cannot be revoked, only shadowed — say so. (A shadowing own row still
deletes normally; the default resurfaces.)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

# Conflicts:
#	apps/os/package.json

…misdiagnosis

- Registry legacy compat deleted: define() requires target; codeId,
  worker/facet stored kinds, source_json column+sync, and read-side
  normalization are gone. All callers (browser REPL examples, e2e suites)
  spell rpc/source targets directly.
- Nested itx.workspace.git.* RpcTarget deleted — nested RpcTargets from
  entrypoint getters don't survive RPC boundaries; the flat
  gitClone/gitAdd/gitCommit/gitPush/gitStatus methods are the surface.
  Agent preset guidance updated (it was teaching the broken spelling).
- allowedHosts debt closed as misdiagnosis: config is allowedHosts: true;
  the 403/502 came from a wedged vite process behind the live tunnel.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

# Conflicts:
#	apps/os/docs/itx-next.md
#	apps/os/package.json
#	apps/os/src/itx/protocol.ts
#	apps/os/src/itx/registry.ts