# Connections and the Siri inbox — credentials the agent can spend but never see > **Status.** Connections are **Production** in the Spaces app (attach in Settings, grant per Space under ⋯ → > Connections, one `connection_call` tool, every call proposed and approved). The **Siri inbox** is **Beta**: the door > is live and attested, the app collects drops, and the setup is one Shortcut; the end-to-end path from a phone is young. > Both run on the **standing Sentinel**, a measured AWS Nitro enclave described below. ## The problem this solves An assistant that can act on your behalf needs credentials — an API token, later an OAuth grant. Every way of giving it those is a way of leaking them: put the key in the room and every member can read it; put it in a server and the operator can read it; give it to the model and it can be talked out of it. Witbitz keeps the credential in a place that can **use** it and that nobody — not the member, not the model, not Witbitz — can **read** it from. ## The standing Sentinel A measured Sentinel image started in a **standing** role: an always-on Nitro enclave on its own small host that holds an **account's** long-lived credentials. Each credential is sealed to a key that only that measured image can open (AWS KMS, pinned to the enclave's PCR0), persisted sealed, and spent only inside the enclave. It answers calls made with a **handle**, not a secret: a room says "call host X with connection Y", the enclave attaches the secret, makes the request, strips the reply of anything credential-like, and returns the body. Every relay to it is **attested first**: the caller verifies a fresh Nitro attestation against the published PCR0 and refuses to talk to anything else. A proof of spend, an HMAC over the request with a per-connection key the enclave issued at attach time, rides every call, so a stolen request cannot be replayed onto another connection. ## Connections — what a member does 1. **Settings → Connections** is the vault: attach a connection, see them all, detach one everywhere. A connection today is a **bearer token for one host**: a label, the host, the key. OAuth connections (a Google account) are the next slice. 2. Attaching seals `{ host, secret, label }` to the attested Sentinel's share key and hands it over; the page keeps only the connection's id, label, host and a **call key**. That call key rides the account, so a second device or another Space can spend the connection without ever holding the secret. 3. **⋯ → Connections inside a Space** decides what *this* Space's assistant may spend. A connection is granted per Space and written into the Space's sealed configuration; nothing is granted by default. 4. **Detach** revokes the record in the enclave, which stops every room at once. The account a connection belongs to is the **verified sign-in email**, taken from the token, never from a page field; the Sentinel refuses a grant filed under any other account. ## What the assistant gets One tool, `connection_call`: method, path, headers, body, against the connection's host. It is **never auto-run**: the assistant proposes the call, a member approves it, and only then does the enclave make it. The model sees the status, content type and body of the reply (capped), and never the secret, never the call key. It refers to a connection by its label or host; an unknown one is refused with a message that points at the ⋯ menu. **Hosts are an allow-list, not the open internet.** The enclave and its host both enforce a measured list — GitHub, Google APIs, Tinfoil and the package registries today. A token for `api.example.com` attaches but cannot be spent until that host is on the list; the list is part of what the attestation measures. ## The Siri inbox "Hey Siri, Witbitz." A Shortcut dictates text and POSTs it to `https://siri.witbitz.chat/in`. **TLS terminates inside the enclave**: the certificate's private key was generated in the Sentinel, is persisted only sealed, and never leaves it. The enclave seals your words to the target Space's inbox key and holds the box until one of your devices opens the Space and collects it; the drop is then posted as **you**, prefixed 🎙, and the assistant answers it like any message. **Setup.** ⋯ → Siri in a Space picks an alias for that Space ("groceries") and, optionally, makes it the default for anything said without one. Settings → Siri shows the key, the endpoint and the Shortcut recipe: *Dictate Text → Get Contents of URL*, `POST`, JSON `{ key, text }`. One Shortcut covers every Space; the alias at the start of what you say ("tell groceries…") routes the drop. **What is verifiable.** The served certificate's public-key hash is carried inside every attestation the Sentinel produces, and `GET /trust` serves the document. A reader can check, from anywhere: the SPKI hash of the certificate `siri.witbitz.chat` presents equals the `siri` pin inside a genuine Nitro attestation whose PCR0 equals the published one, over a fresh nonce. The Witbitz Lambda relays only ciphertext both ways; the Shortcut's own POST never passes through it. The text is never stored or logged in clear; the key is looked up by hash. **Honest limits.** - Siri itself cannot check an attestation. The guarantee is reader-verifiable, not phone-enforced. - A drop lands when a device opens the Space. "Add milk" has not happened until you look. - The key is a capability: anyone holding it can drop words as you until you rotate it (Settings → Siri). - Limits: 4,000 characters per drop, 30 per minute, 200 uncollected, 30 days. ## What is deliberately not there yet - OAuth connections (Google Calendar, Gmail): designed, not built. Gmail waits on Google's security assessment. - A ledger line per credential call, so the room can see *that* a connection was spent, is not yet written. - In a confidential-tier room the turn enclave does not yet make the attested call itself; connections are a regular-room feature today. - Replacing a dead Sentinel host is a manual step. ## Read next - [The SDK — sign in, connections, and the Siri inbox](./sdk.md#account): the same door from your own app, with no accounts of your own. - [Trust model — delegated authority](./trust-model.md#delegated-authority): the propose → approve → execute gate every `connection_call` goes through. - [The attested tier](./the-attested-tier.md): how measurement and PCR pinning work, the same mechanism the standing Sentinel uses. - [Verify it yourself](./verify.md).