# Guest tools
No fleet/admin tools, host credentials, SSH relay aliases, or secretz dependencies.
- `kev`: original yesno/ask/choose interface via own revocable gateway key. Host injects GPU credential; gateway cap applies.
- `recall [text] [--with peer] [--recent N]`: only this guest's own a2a history.
- `osmike-publish FILE`: commits a <=10MiB artifact to context/published in this guest's private repo and returns an owner-login link. No public share is implied.
- `osmike-cron add --after SECONDS COMMAND ...`, `list`, `remove ID`: local guest jobs. Due jobs execute on the next awake poll. They cannot wake sleeping containers or schedule fleet work.
Tools are fetched read-only from osmike/guest-tools. Guest credentials are limited to its bus identity, repo-only deploy key and revocable gateway key.