Four providers, chosen per mission.
A mission names the provider that runs it. codex and claude are cloud providers with their own accounts and explicit network approval. localmodel is on-device: network policy none, no credentials. offline-media is the only provider for deterministic media exports. Where more than one provider is ready for the capability a mission asks for, the mission refuses to guess and --provider is required.
A granted credential's value is placed in the sandbox environment, so anything a cloud provider's agent starts can read it. That is one reason to run work that does not need the network on localmodel instead.
Grok Bot, Codex, Claude Code, Grok Build and Cursor Agent remain separate vendor desktops with their own setup and sign-in.
What runs on the device.
localmodel carries the code_change and sourced_report capabilities and runs with network policy none. Its sandbox gets its own network namespace, as every sandbox now does in both postures, so it reaches neither the internet nor the host's loopback services and abstract AF_UNIX sockets. It reaches the model over a unix domain socket that Firebreak bind-mounts into the sandbox read-only.
That socket is a deliberate opening in an otherwise networkless sandbox: the model service on the other side runs outside the sandbox, as your desktop user. The sandbox uid is the desktop uid, so root inside the user namespace is not a different principal outside it.
No model weights ship on the image. Until you supply a model service, the installation reports its local AI state as installed-unavailable; it reports available only when a registered on-device provider is actually available. The provider is built and shipped, but it is not usable end to end until you supply that model.
Keep working offline.
Project workspaces, local files, creative applications and deterministic media exports remain available without any AI provider. Ice starts sandboxed sessions without an external network; with localmodel pointed at a model service you run yourself, a code-change or sourced-report mission can now run in that posture too.
What changes for existing installations?
4.0.0's packages were never published to the APT suite, so most machines upgrade 3.5.0 to 4.1.0 directly (the suite now serves 4.1.0-1). That upgrade retires Shadowfetch's Buzz integration and its managed relay startup. It preserves user data and does not uninstall a separately installed vendor desktop. Buzz setup, model download and local inference verification do not come back with localmodel: it expects a model service you install and run yourself.
Earlier model measurements remain historical records of one card and one runner, not performance claims for 4.1.0.