docs(protocols): make computer_use_runtime_v0 a machine-checkable contract

docs/integrations/runtime-connector-catalog.md

@@ -42,7 +42,7 @@ about the work.
 | `shell_worker` | Shell, cron, launchd, or service timer | Headless local command | Cron/service/manual shell wakeup | CLI writeback commands from the project checkout | Exit code, run id, and compact status | Obey local `scheduler_hint` backoff/reset; fail closed on missing goal or agent id | Quota slot for delivery; monitor-only polls stay no-spend | Logs or status command, not raw state files | Do not bake local paths, secrets, or project policy into reusable scripts | Command examples use global registry, `--agent-id`, and no-spend monitor behavior. |
 | `http_webhook` | HTTP webhook or local daemon | Request-driven bridge | Loopback callback, webhook, or host event | Adapter validates, then emits LoopX todo/gate/evidence events | Request log plus compact status export | Webhooks do not self-poll; scheduler hints are advisory unless a scheduler owns the retry | Quota spend only after accepted writeback | Dashboard/status feed | Loopback by default; write endpoints require explicit dry-run/preview and CLI-equivalent fallback | Loopback smoke rejects remote status/write authority and proves preview-gated writes. |
 | `worker_bridge` | Worker bridge | External executor, task container, or remote worker bridge | Worker event, bridge message, or runner sidecar | Bridge emits compact public-safe state, todo, or evidence | Worker heartbeat/status and compact counter trace | Host-specific stop/reset maps back to scheduler hints and outcome policy | Quota event for accepted work; bridge evidence grants no task-score authority | Dashboard/frontstage projection and compact evidence timeline | Strip raw logs, local paths, private traces, task text, and credentials | Worker bridge install/status smoke proves source mount, counter trace, and private-boundary stripping. |
-| `computer_use_runtime` | Browser, desktop, or app automation runtime | Visible or replayable UI execution surface | Approved connector plan, bounded todo, host replay event, or user takeover handoff | Compact action plan, observation, receipt, gate, and evidence-handle writeback | Host-owned replay/screenshot pointer plus compact receipt fields | Stop at unknown modal, privacy ambiguity, or final external action; scheduler hints still come from LoopX quota | Quota spend only after validated receipt and LoopX writeback; readiness/profile checks stay no-spend | Review card with intended action, forbidden actions, evidence handle, and takeover path | Do not copy credentials, cookies, raw screenshots, private UI bodies, or perform sends/purchases/production mutations without exact gate | Synthetic capability/action/receipt smokes prove gate-before-write, raw-evidence stripping, and concrete user-question projection. |
+| `computer_use_runtime` | Browser, desktop, or app automation runtime (a provider/runtime execution surface, not a LoopX product capability or a `value-connectors` connector) | Visible or replayable UI execution surface | Bounded action request from an owning capability, host replay event, or user takeover handoff | Compact typed receipt (facts only) handed back to the owning capability's domain-local reducer, which proposes the LoopX gate/evidence writeback for Kernel validation | Host-owned replay/screenshot pointer plus compact receipt fields | Stop at unknown modal, privacy ambiguity, or final external-write action; scheduler hints still come from LoopX quota | Quota spend only after the owning capability's reducer proposal is accepted by the Kernel; readiness/profile checks stay no-spend | Review card with intended action, forbidden effect classes, evidence handle, and takeover path | Do not copy credentials, cookies, raw screenshots, private UI bodies, or perform sends/purchases/production mutations without exact gate; a provider must never author the Kernel writeback itself | Synthetic runtime-profile/action-request/receipt smokes prove gate-before-write, raw-evidence stripping, and rejection of provider-authored writeback fields. |
 | `deepseek_harness_loop` | DeepSeek Harness | Isolated headless bounded execution through LoopX Turn | `loopx turn run-once` with `scripts/dsh_turn_host_adapter.py` | Same CLI todo/refresh/spend path after validated dsh result | Compact Turn receipt plus local dsh session pointer | Outer controller obeys scheduler hints; preview/failed validation stays no-spend | Quota slot only after validated writeback | Operator sees typed result, validator receipt, and next preview command | Do not copy dsh JSONL sessions, raw transcripts, credentials, local paths, or model tool logs | Adapter smoke, fake-dsh e2e, and real-dsh e2e prove typed result shaping, real dsh runtime startup, writeback, and replay idempotence. |
 | `loopx_turn` | LoopX Turn host adapter | Isolated headless bounded execution | `loopx host-mode-plan` selects the mode, then `loopx turn plan` previews one typed decision | `loopx turn run-once --execute` writes back only after independent validation | Compact Turn receipt and scheduler execution context | Outer controller obeys scheduler hints; cadence-only/preview work stays no-spend | Quota slot only after validated writeback | Operator sees selected host, execution mode, validator requirement, and next preview command | Do not publish opaque session handles, raw transcripts, local paths, credentials, or host-local logs | Host-mode-plan smoke proves host-mode selection, scoped identity, Turn mapping, and visible/headless/hybrid handoff readiness. |
 
@@ -133,7 +133,7 @@ maintainer's local automation:
 - [LoopX Turn v0](../reference/protocols/loopx-turn-v0.md)
 - [Heartbeat automation prompt](../heartbeat-automation-prompt.md)
 - [Host integration surface v0](../reference/protocols/host-integration-surface-v0.md)
-- [Computer-use runtime connector v0](../reference/protocols/computer-use-runtime-connector-v0.md)
+- [Computer-use runtime v0](../reference/protocols/computer-use-runtime-v0.md)
 - [Value connectors](../../loopx/capabilities/value_connectors/README.md)
 - [Session runtime to LoopX projection v0](../reference/protocols/session-runtime-loopx-projection-v0.md)
 - [Worker bridge install contract](worker-bridge-install-contract.md)

docs/reference/protocols/README.md

@@ -51,7 +51,7 @@ scanning a chronological list.
 - [`ark_managed_agent_goal_continuity_qualification_v0`](ark-managed-agent-goal-continuity-qualification-v0.md): Ark Managed Agent goal continuity qualification v0
 - [`ark_managed_agent_issue_fix_qualification_v0`](ark-managed-agent-issue-fix-qualification-v0.md): Ark Managed Agent issue-fix qualification v0
 - [`codex_app_host_command_registry_v0`](codex-app-host-command-registry-v0.md): Codex App host command registry v0
-- [`computer_use_runtime_connector_v0`](computer-use-runtime-connector-v0.md): Computer-use runtime connector v0
+- [`computer_use_runtime_v0`](computer-use-runtime-v0.md): Computer-use runtime v0
 - [`host_integration_plugin_plan_v0`](host-integration-plugin-plan-v0.md): Host integration plugin plan v0
 - [`host_integration_surface_v0`](host-integration-surface-v0.md): Host integration surface v0
 - [`host_mode_plan_v0`](host-mode-plan-v0.md): Host mode plan v0