Publish tiny_computer_agent_app.py from marimo

tiny_computer_agent_app.py

@@ -303,7 +303,8 @@ def readme():
     accepts injected input. Trigger it from the Actions tab. The repo needs a GitHub mirror -
     Hugging Face does not run GitHub Actions.
 
-    **2. A local QEMU VM without KVM.** Measured on the headless container above:
+    **2. A local QEMU VM without KVM.** Measured on the headless container above - this is
+    what the box actually reported, not what the docs claim:
 
     ```
     /dev/kvm absent                     -> no hardware virtualization
@@ -312,19 +313,43 @@ def readme():
     qemu-system-x86_64 -accel tcg       -> boots (reached "No bootable device.")
     ```
 
-    So a Windows guest is *possible* with no KVM at all, but entirely under software
-    emulation. TCG runs roughly 10-50x slower than native, which turns a 20-minute Windows
-    install into many hours - and the harness's OCR would then run on an emulated CPU inside
-    the guest. Use this only when no CI runner and no cloud box is available:
+    The rest of the Windows 11 ingredient list was then checked rather than assumed - UEFI
+    firmware and a TPM 2.0, both under pure TCG:
+
+    ```
+    apt-get install -y ovmf swtpm       -> /usr/share/OVMF/OVMF_CODE_4M.fd + swtpm 0.7.1
+    swtpm socket --tpm2 --tpmstate dir=/tmp/tpmstate \
+          --ctrl type=unixio,path=/tmp/swtpm-sock &
+    qemu-system-x86_64 -accel tcg -machine q35 -m 4G -smp 4 \
+          -drive if=pflash,format=raw,readonly=on,file=/usr/share/OVMF/OVMF_CODE_4M.fd \
+          -drive if=pflash,format=raw,file=/tmp/OVMF_VARS.fd \
+          -chardev socket,id=chrtpm,path=/tmp/swtpm-sock \
+          -tpmdev emulator,id=tpm0,chardev=chrtpm -device tpm-tis,tpmdev=tpm0 -nographic
+
+      -> UEFI Interactive Shell v2.2
+         EDK II
+         UEFI v2.70 (Debian distribution of EDK II, 0x00010000)
+    ```
+
+    So the whole stack works here: UEFI boot, an emulated TPM 2.0, and software-only
+    emulation. A Windows 11 guest is genuinely installable - just slow, because TCG runs
+    roughly 10-50x slower than native, turning a 20-minute install into many hours, after
+    which the harness's OCR would run on an emulated CPU inside the guest. Use it only when
+    no CI runner and no cloud box is available:
 
     ```bash
     qemu-img create -f qcow2 win.qcow2 64G
-    qemu-system-x86_64 -accel tcg -m 8G -smp 4 \
+    qemu-system-x86_64 -accel tcg -m 8G -smp 4 -machine q35 \
+      -drive if=pflash,format=raw,readonly=on,file=/usr/share/OVMF/OVMF_CODE_4M.fd \
+      -drive if=pflash,format=raw,file=/tmp/OVMF_VARS.fd \
+      -chardev socket,id=chrtpm,path=/tmp/swtpm-sock \
+      -tpmdev emulator,id=tpm0,chardev=chrtpm -device tpm-tis,tpmdev=tpm0 \
       -drive file=win.qcow2,format=qcow2,if=virtio \
       -cdrom Win11_Eval_x64.iso -boot d \
-      -device virtio-vga -vnc :1     # then RDP/VNC in, pip install the harness inside
+      -device virtio-vga -vnc :1     # VNC/RDP in, then pip install the harness inside
     ```
 
+
     **3. A cloud Windows box.** Any Windows VM reachable over RDP gives a native desktop, a
     real `SendInput` path and real DPI scaling. Untested here; it is the closest thing to
     "a user's actual laptop".
@@ -390,6 +415,7 @@ def readme():
     - [x] Blind-grid-click guard, echo detection, no-progress guard
     - [ ] Make the VLM reliable on a live screen (it echoes the prompt instead of choosing)
     - [ ] Windows run of the live test - workflow committed; needs a GitHub mirror with Actions on
+    - [x] Windows VM ingredients verified locally (UEFI + TPM 2.0 boot under TCG; no KVM here)
     - [ ] Accessibility-tree detector (AT-SPI on Linux, UI Automation on Windows)
     - [ ] Score episodes: replay a trace and count how often the choice was right
     - [ ] marimo console: live screen preview, action log, pause / resume / step