Apple built a complete agent platform inside iOS — a planner, an executor that taps the screen, an eval harness, a model catalog. At WWDC 2026 they shipped third parties the doorway and kept the building. Here it is, reconstructed from the shipped iOS 26 / 27 binaries.
Decrypted arm64e private frameworks, iPhone 16 on iOS 26.4 → 27.0. Every row is grounded in shipped symbol names, project tags, and entitlement strings — not speculation. Third parties get App Intents and, since WWDC 26, the on-device 3B model. They do not get the planner, the executor, the eval harness, or the sealed-execution substrate.
This is the layer that actually drives the screen, and it's the one Clank rebuilds from the outside. Apple's version does on-device vision-action prediction (VisualActionPredictionCore), routes intents through a capability selector, harvests interaction telemetry into Biome, and injects touches over RemoteControl + HID.
It's gated by com.apple.private.hid.client.event-dispatch.internal — an Apple-internal entitlement no third-party app can hold. That single string is why "an app that drives other apps" is structurally impossible on-device for anyone but Apple, and why the only third-party path is a paired host doing the taps from outside the sandbox. Clank is that host.
App Intents became the mandatory way apps expose actions to Siri; SiriKit got a deprecation clock. The agentic Siri that uses them ships this fall with iOS 27 — opt-in apps only, and not in the EU or China.
Here's the part that matters: Siri acts by calling App Intents — structured actions an app declares in code. It is not driving the screen. So it can only do the narrow set of things each developer chose to wire up, on the apps that bothered to. The long tail — banking, dating, fintech, every unmaintained app — stays dark. The executor that actually drives a screen stayed private.
Clank is the third-party version of the same architecture — planner, executor, eval harness — for every app, no cooperation required. The planner is a VLM fine-tuned on real-iPhone traces. The executor is a paired-host XCUITest runner doing from outside the taps Apple's UIControlTool does from inside. The eval harness is ClankBench.
The whole difference in one line: Apple's Siri calls the actions an app declares; Clank drives the screen every app already has. One needs the developer to opt in. The other just needs the pixels — which is why Clank works on the app that shipped in 2019 and never updated again.
Apple building the identical stack internally validates the design. Apple refusing to open it is the moat.
Static analysis of Apple's own shipped, decrypted frameworks (Xcode iOS Symbols, arm64e). Symbol names and project tags strongly imply behavior; they don't prove runtime semantics, and a few codenames are pattern-matched. No private data, no Apple source, no device exploit — just the binaries Apple ships to every Mac with Xcode, read closely.