FLAGSHIP_IMPLEMENTATION.md

Flagship implementation ledger

Goal: a dependable, easy-to-use native workspace combining supported vendor login/session routes and compatible local models, with trustworthy execution, review, recovery, and releases. Popularity is an aspiration, not an engineering acceptance result.

Baseline: e371baaa4c690527173a322f7e0e1cfae4db329a. Implementation branch: flagship/reliability-foundation. Preserve the existing architecture and provider integrations. The complete acceptance specification remains in scope; this ledger is not a narrowed definition of completion.

Current release checkpoint (October 17, 2026): 2.2.0 is published and installed (run 39059462934, attempt 1: all 15 gates on x86_64 and aarch64, signing, publication and the signed APT repository passed from 444e75f; macOS .dmg for Apple silicon and Intel and the Flatpak bundles attached by their release workflows; installed here with the authenticated installer, first-window check passed). Earlier pending statements below describe their historical checkpoints. Broader physical desktop, GPU endurance and live provider lifecycle acceptance remain open.

1.0.1 window fix

Checkpoint (September 30, 2026). Shadowfetch Linux 5.0 QA found two window defects in the installed 1.0.0 (KDE Plasma on Wayland, in a VM):

• The window grew on every launch, by about 52 px in width and 99 px in height (1380 px wide at the first launch, 1484 px at the third, then pinned to the top of the screen). On Wayland tao gives the window a GTK header bar (client-side decorations). tauri-plugin-window-state 2.4.1 saved the inner size from GTK's configure event, which includes the header bar and the shadow margins, and restoring it through gtk_window_resize added them again. The plugin now keeps every flag but SIZE (window_size::REMEMBERED) on every desktop: maximized, full screen, visibility, decorations and position are still restored, the position only on X11 (GDK ignores gtk_window_move for a Wayland toplevel, so the compositor places the window). A size saved by 1.0.0 is ignored, so a window that already grew recovers at the next launch.
• The default window (1380x920) was larger than a 1366x768 screen, so the composer and status bar sat under the panel. The main window (create: false, built in code) now takes its first size from the screens it opens on (window_size::opening and fit_config): at most 90% of the screen, never more than its work area. On X11 48 px are kept for the window manager's title bar, which is outside the inner size: 1229x643 on 1366x768 with a 46 px panel. On Wayland GTK's header bar is inside the size the window asks for (1.0.0's 1380x920 window measured 920 px with its 47 px header bar on Plasma; under Weston a 1380x920 window has 873 px of content), so nothing is taken off: 1229x691 on 1366x768, about 644 px of content. 1920x1080 keeps 1380x920. On X11 the screen is the one the window-state plugin moves the window back to (its saved record, read with the plugin's own rule), or else the primary monitor where Tauri centers it, and right after the plugin's move a window that would cross that screen's work area is moved inside it. On Wayland the compositor places the window, so it fits every screen and opens maximized only when none of them holds the 520x640 minimum. The size is set before the window exists and the plugin restores a saved maximized state afterwards, so the fit never undoes it.

Verification before tagging 1.0.1 (first round, on 45b0d53): cargo test --workspace --locked (as the native-source gate runs it) 1469 passed / 0 failed / 14 ignored, including 10 new window_size tests; clippy clean except vendored glib; UI 715 unit and 111 Playwright tests; release, publisher, signing, release-auth, installer and packaging script suites 300 tests (299 passed; one packaging-environment test skipped: no cached linuxdeploy) plus test-install-appimage.sh; appstreamcli validate --strict passes, and the widened trust policy parses with the verifier's own parser (same key and epoch, range 0.33.0–1.0.1). The debug binary under Xvfb, with private home, XDG directories and D-Bus so the window-state plugin was active, opened at 1229x643 centered on a 1366x768 screen in three launches in a row, with the position kept and no size saved; on 1920x1080 it opened at 1380x920 although a saved 1.0.0 state said 1484x1019. That round ran no Wayland launch; the review round below did.

1.0.1 review round

A review of 45b0d53 raised ten findings, all confirmed against the code and fixed:

• The X11 fit used the primary monitor (two findings), while the plugin then restores the window onto the screen it was closed on, which can be a smaller one (a docked laptop's 1366x768 panel). Fixed as described above, with the move inside the work area.
• The smallest Wayland screen forced a maximized window everywhere, which the user could not undo (the plugin only ever maximizes). Now only when no screen holds the minimum.
• The title bar room was taken twice on Wayland (header bar inside the size). Fixed; the old a_1366x768_screen_fits_above_its_panel test had built in the wrong model.
• Wording: the changelog and release notes promised position memory on Wayland and the notes' heading said the window keeps its size; NATIVE_DESKTOP said window geometry is retained. Reworded: no size on any desktop, maximized and full screen everywhere, the place on X11 only.
• No 1.0.0 upgrade fixture although 1.0.0 is published. Generated by the 1.0.0 engine (node scripts/generate-upgrade-fixtures.mjs v1.0.0, schema 27, the same as 1.0.1); upgrade_fixtures 3 passed. Generator snippets for 1.0-era data (spending limits, the rulebook) are not added yet.
• Nothing tested that the app wires the plugin and the fit: unit tests passed with 1.0.0's plugin registration. test-native-desktop.mjs now plants the state a grown 1.0.0 window left (1536x1170, placed low), checks the fitted first window (and the X11 place, moved inside the screen), and after the quit relaunches and expects the same size although the window was left at 1360x860. Against a build that restores SIZE again it fails at its first check under both Xvfb and Weston (1536x1170).
• The ledger said this host has no Weston or WebKitWebDriver. Wrong: unpacked Weston 13 and WebKitWebDriver 2.52.6 (matching the system WebKit) work through SHADOW_WESTON, SHADOW_WESTON_LIBRARY_PATH, SHADOW_WESTON_MODULE_MAP and SHADOW_WEBKIT_DRIVER.

Verification after the review (fixes on 077930b; no VM running and load below 8 before every build and gate; Node 22.23.2, because the default node here is 22.11, older than the 22.12 the scripts need, and test-native-cli.mjs then stops at node:sqlite; window and Node gates with a private HOME and PATH reduced to that Node and the system directories): cargo fmt --check and clippy --workspace --all-targets -D warnings clean; cargo test --workspace --locked (the native-source run) 1475 passed / 0 failed / 14 ignored, with 16 window_size tests (run with the real home: a private home on a long path makes sandbox_isolation's socket path too long for a Unix socket); native-behavior (test-native-cli.mjs 21 scenario groups, test-native-stress.mjs 100/100, test-native-tui.mjs, the MCP server over stdio and HTTP); glib-backport 9/9 and 6/6; release-tests 176 + 2 and release-auth 59 with no secrets found; built-project-cleanup 1/1 (15,504 entries); native-window under run-native-x11.mjs: test-native-desktop.mjs 31 checks (first window 1296x920 on the 1440x1100 Xvfb screen at the saved place moved inside, 132 px from the top; the same after the relaunch) and test-native-markdown.mjs; native-endurance 100/100 with 32 checks; and run-native-wayland.mjs node scripts/test-native-desktop.mjs 31 checks on a private Weston (1380x873 content on 1600x1100, the same after the relaunch). Probes of three launches each from a planted 1536x1170 state (resized to 1000x700 before the second quit): a private Weston at 1600x1100 gives 1380x873 content every time, one at 1366x768 gives 1229x644 (a 1229x691 window), and Xvfb gives 1296x920 at the same place each time. Not run here: managed-runtime, packages, clean-host-packages and packaged-behavior (they need the Vulkan llama.cpp build and Docker; left to CI). The one remaining physical-desktop check is KDE Plasma (Wayland) in the Shadowfetch Linux 5.0 VM with the packaged 1.0.1.

1.0.1 on KDE Plasma

Checked on September 30, 2026 with a local, unsigned 1.0.1 .deb built from 8ffbd69 (the .deb leg of build-native.mjs; lintian reports no errors), installed with apt over the preinstalled 1.0.0 in the published Shadowfetch Linux 5.0.0 live ISO (KDE Plasma on Wayland, QEMU with 4 vCPUs and 6 GiB, throwaway disks). Each launch is systemd-run --user /usr/bin/shadowcode, 20 s, a screenshot, the window-state file, then systemctl --user stop. Window sizes come from KWin's frame geometry and, independently, from the screenshots' pixels; both agree. Evidence is in the Shadowfetch QA tree (work/qa-5.0.0/evidence/shadowcode-1.0.1-proof).

• Control, 1.0.0 on a 1920x1080 screen: 1380x920, then 1432x1019, then 1484x1118, off the screen and under the panel.
• 1.0.1, five launches from a fresh profile: 1380x920 at the same place every time, 57 px above the panel; the file saves no size (0x0) on each exit.
• A grown state: the 1536x1170 that 1.0.0 left in the control, and a planted 1700x1150 (two launches), each open at 1380x920.
• A 1366x768 screen (a second VM with a 1366x768 EDID): 1229x691, 16 px above the panel, on two fresh launches, after opening a project (the composer and the status bar are above the panel), and from a planted 1700x1150 state.
• A saved maximized window opens maximized, filling the work area (1920x1034).

1.0 program

Checkpoint (September 29, 2026). The owner asked for 1.0.0: research the pain points people have with coding agents and fix them, "easy for anyone to use but advanced for real work". A survey of 32 pain points (8 already solved, 21 partly, 3 missing) set the scope. Work ran in two waves on flagship/reliability-foundation, each change with tests:

• Wave A. One rulebook for every agent (user profile merged with project files, delivered to every vendor CLI through its own per-run option, never writing vendor home folders; Settings › Rules & skills, skill checker, starter skills). Second opinions (review staged changes or a task with another read-only model; Ask another model). Roles (a model or vendor per plan/implement/review step). Hardening: failures before streaming (RUN-02), GPU memory exhaustion recovery (LOC-03), vendor usage on failed turns, rewind of a vendor turn keeps the user's saves, reconnect and duplicate rows, a render-error screen, a private Wayland session for the window test. Stability: upgrade tests from every release since 0.28, backup/restore/repair/reset, the checked docs/API_CONTRACT.md.
• Wave B. B1 spending limits, estimates, visible retries, Resume at, Try on…, run records and a rotating redacted app log. B2 approvals explained by a tree-sitter-bash reading (risk tag, undo), Always allow here, precious ignored files saved before each step. B3 secret checks before commit/push/PR, project hooks asked once, package lookups (existence, age, lookalikes), lockfile summaries, the Secret Service keyring. B4 heads-ups (tests skipped or deleted, CI changes), stuck detection, Only change these, /compact [focus] with pins and folder rules re-sent, tool-call repair for local models. B5 a persistent code index (up to 250,000 files, focus folder), review triage and Explain this change, worktree setup/teardown/PORT/base branch, beginner help (What went wrong, glossary, local models first) and a test capping the first request's size.

Integration found and fixed: B4's text tool-call repair also ran on the bundled llamacpp runtime, where a <tool_call> in plain text is not a call (the runtime already parses each model's call format through its verified template); repair now applies only to other local servers, and the Hermes "prose XML never executes" test passes again. The real-window test expects the free local group first on a host with no ready subscription. The review's group titles are h3 (axe heading order).

Before tagging, a read-only review of everything since 0.34.2 (eight reviewers by subsystem, each claim checked by a skeptic) confirmed 97 defects: 2 high (the secret scan's Git calls lacked the fsmonitor/signature hardening every other Git call has; Plan → Implement → Review tasks on a subscription conversation escaped the spending limits), 24 medium, 71 low. All were fixed on per-area branches with regression tests and independently reviewed; one low item (a descriptor duplicated by an earlier exec) is only partly closed: such commands still ask, tagged Changes files. A second, cross-cutting review of the merged fixes found that the merge had given one unattended flag two meanings (automation runs then failed at a spending limit instead of stopping or waiting as set) plus two approval gaps (programs started by reader options, variables that change what runs) and continuations after a plan limit losing Only change these; all fixed with tests. The local gate run also caught a Debian changelog whose newest entry was not dated after the previous one (lintian), now checked by scripts/test-native-deb.mjs, which the packages gate and CI run.

Integrated verification before tagging 1.0.0: cargo test --workspace --locked 1459 passed / 0 failed / 15 ignored; clippy clean except vendored glib; UI 715 unit and 111 Playwright tests; release, publisher, signing, installer and packaging script suites 277 tests. The first request's own overhead is capped by tests/request_overhead.rs (system prompt 2,173 bytes, tools 11,522–12,613 bytes, plus 10%).

Deferred past 1.0: multiple accounts per vendor, rpm/Flatpak/AUR packages, CUDA/ROCm runtimes, an automatic approval classifier, a browser-driving tool.

0.34 consolidation and consumer-readiness pass

Checkpoint (September 28, 2026). main had stayed at 0.32.0 while 0.33.1 was published from this branch; an unrelated uncommitted "calmer workspace" draft sat in another checkout and 12 uncommitted files (batch verification refresh) in this branch's working copy. All three were consolidated: the draft is preserved as wip/calmer-workspace-draft, its More menu and AppStream enrichment were ported, the batch refresh was committed (b800c1f), and main fast-forwarded to it (1072 Rust / 524 UI unit / 76 e2e passed).

Six parallel review branches then ran, each fix with a regression test that fails on the prior code:

• Engine (Q1), 21 fixes: rewind/undo could delete files ignored or absent before a task, and never restored chmod; automation cleanup and write subagents could discard live worktrees; subagent usage was not counted and subagent conversations were orphaned; provider refusals hid the provider's reason; long local streams were cut at 10 minutes; a taken port moved a model to the CPU; cross-project local queues blocked each other; plan-limit fallback ran inside Compare lanes; hung language servers, runtime wrapper probes, stalled downloads and cancelled logins could hang or leak processes. shadowcode acp follows push events; the voice model unloads after five idle minutes. New native tests close RUN-02, PRV-01, LOC-04 and LOC-05 (the engine-panic path of RUN-02 is still not forced).
• UI (Q2): plain-sentence errors with retry, Escape and focus ownership in every dialog, "Not connected" status, a keyboard-reachable Tasks panel, sidebar restoration, /new race, raw state labels, axe clean on every screen in both themes (real window: 23 checks, 36 axe reports).
• First run (Q3): onboarding model step and five pinned Apache-2.0 GGUF downloads (commit + SHA-256 + size, resumable, disk/offline checks). Real downloads of Granite 4.2 3B, Gemma 4 E4B and gpt-oss 20B were hash-verified and completed a tool-using task on the GPU; test-native-first-run.mjs passes 8 checks with no accounts. The pinned llama.cpp supports all five architectures; the old gpt-oss failure was Ollama's blob format.
• Distribution (Q4): update notice (no identifiers; distro/policy/user switches), Settings › About, a lintian-clean .deb (copyright/NOTICE, changelog, man page, completions, icons, libc floor, purge keeps data), docs/DISTRIBUTING.md; the AppImage bundle now uses the pinned source-built runtime (upstream continuous had moved and would have failed release packaging).
• Vendors (Q5), 9 fixes, verified live: Codex 0.158.0, Claude Code 2.1.284, Cursor Agent 2026.09.26, Grok 1.0.41, Antigravity agent server 1.2.1 (details in SUBSCRIPTIONS.md). Cursor tool/image/MCP and Claude prompt caching via OpenRouter could not be exercised live (Free-plan allowance; negative OpenRouter balance).
• Security (Q6): secret-file read bypasses, stored-output redaction, task-grant scope (wrappers, interpreters, git -c), repository Git filters and nested repositories, remote host-name checks, per-family remote decisions enforced by a test, Landlock socket/signal limits, IPv4-mapped IPv6 in the allow-list, local-only subagents. cargo audit and npm audit --omit=dev: no known vulnerabilities.

Integration fixes: the closed More menu is hidden explicitly (WebKit laid out its content); Q1/Q5 provider-error helpers were unified; loopback runtimes get 15 minutes for the first byte (CPU prompt processing) while the 120-second stall between bytes stays; the linuxdeploy GTK plugin is pinned by SHA-256; lintian is required in CI and release builds; Prettier debt cleared.

The first tag, v0.34.0 (run 36499751141), stopped in the native-source gate because two new opt-in network tests were not listed as optional; nothing was signed, and 0.34.1 listed them. v0.34.1 (run 36507326107) then stopped in native-window: on the clean CI host no model is ready, and the window test only expected "Choose a model". 0.34.2 checks both welcome states; all 14 gates were rerun locally with the vendor CLIs hidden from PATH to match the CI host before tagging. Integrated verification before tagging: cargo test --workspace --locked 1169 passed / 0 failed / 13 ignored; clippy clean except vendored glib; UI 576 unit and 88 Playwright tests; release-auth/installer/release script suites 176 tests. Package, real-window, first-run and installer results for the tagged candidate are recorded by the release workflow gates. Still open: Wayland and physical-desktop qualification, GPU allocation exhaustion (LOC-03), live Cursor tool/MCP and OpenRouter Claude caching, rewinding user edits made during a vendor turn, vendor usage lost when a vendor turn fails.

Implemented increments

• REMOTE-01 — remote background commands respect the terminal switch. Commit d488fd2. Real HTTP regression trusts the project, proves denied requests register no process and write no marker, then proves enabling the switch permits execution. All nine remote integration tests and seven remote policy unit tests pass. Installed release is unchanged; the new test exercises source-built core services.

• CLI-MCP-01 — distinguish enabled discovery from approved invocation. Commit 0286d36. Smoke verifies initialize/list, no tools/call unattended or while approval is pending, exactly one approved call with exact arguments, and process cleanup. All 21 CLI scenario groups pass against the baseline debug executable (32 scripted model requests). This is test correction, not a claim of live provider authentication.

• CONTEXT-01 — remove count-triggered compaction and the 20-byte keep-list truncation. Boundary checks cover 20, 69, 70, 71, and 200 messages. All 16 autonomy integration tests and ten model-quality tests pass, including real token-pressure fixtures, retained constraints, and summary fallback. Optional request excerpts are reduced when the summary itself exceeds the context budget. This is source-level verification, not an installed AppImage update.

• PRF foundation — versioned native receipts now distinguish commands from configured checks and bind passing evidence to content fingerprints. Engine completion, explicit check tasks, required goal milestones, Compare counts, and UI use the distinction. Source tests cover the original false-positive, stale post-check edits, same-check recovery, and unrelated failure retention. Semantics and remaining integration. Historical freshness now has a follow-up implementation described below; continuous invalidation remains open.

Verification checkpoint validation: broad source run passed 325 native tests (two pre-existing ignored), including engine, goals, Compare, service commands, and core unit tests. The final execution-failure addition passed all four receipt tests and eight goal tests. UI: 309 tests and production build passed. Core all-target Clippy with warnings denied and native desktop build passed on the final source. Native CLI passed all 21 scenario groups. The final rebuilt executable reproduced printf test with verified=false, status=not_run, and unverified_claim=true. All provider responses were local fixtures; no paid/live authentication or release package was exercised.

Historical freshness increment

Historical verification is reassessed without mutating original receipts. Visible UI summaries refresh on mount/focus/manual request and suppress prior passing status while checking or unavailable. Compare checks lane content before acceptance, requires explicit review of stale checks, and reserves the selected lane against new application-owned tasks. Explicit check tasks now select their session using the existing selection-generation guard so approval controls target the right task.

Recorded validation: six Compare and fourteen service tests pass; 312 UI tests and production build pass. These exercise fixture/native service behavior, not live provider authentication or packaged Wayland acceptance. Recovery journaling, cross-process exclusion, unsaved buffers, continuous freshness and efficient shared indexing remain unfinished.

Compare outcome and cleanup boundary

Keep now persists the applied result and scoreboard before removing lanes. Discard persists its logical outcome before disposal. An additive cleanup_pending field distinguishes a durable result from remaining cleanup. A stop failure retains all remaining lanes; each disposal also checks task state and reserves an existing lane against application-owned work. The UI reports retained copies and supports cleanup retry.

A native regression holds a lane reservation during Keep, restarts the service with cleanup pending, edits the applied file, then retries cleanup twice. The result survives, later edits remain, and the win is counted once. This covers the post-receipt recovery path, not a crash immediately after patch application. The full intent/preimage/postimage journal, per-lane durable checkpoints, process-tree exit proof, cross-process mutation coordination and lock-scope redesign remain required.

Compare durable intent foundation

Before source mutation, Keep captures the working-tree preimage using a temporary index, pins it under refs/shadowcode/recovery/<compare-id>, and persists an operation identity, selected model, result commit, source HEAD, changed paths and applying phase in the existing revision-checked record. The public state is needs_review until application succeeds and the applied outcome is persisted. A confirmed Git preflight refusal returns to done with not_applied; an uncertain failure retains recovery material and blocks Keep/Discard. The UI exposes the interrupted state and project Changes.

Native coverage includes preimage pin/content checks and restart from seeded interrupted records with unchanged and edited files. Seeded interruption is not an OS-crash injection demonstration. Full reconciliation, expected postimages, index identity, guided recovery resolution, cross-process project ownership, per-path bounds/redaction and bounded recovery retention are still required. Pins are intentionally retained in this increment to avoid destroying recovery evidence; they may retain nonignored source content just as the existing Compare snapshot does. Do not label this foundation complete crash recovery.

Compare exact-state reconciliation

New operations record the expected postimage tree (computed by applying the binary patch to an isolated index), source branch/ref and staged-content tree. The recovery action checks branch, HEAD and staged content, then compares current source content to the preimage and expected postimage. An exact postimage persists the applied outcome and win once; an exact preimage returns the comparison to a retryable state. Ambiguous content and incomplete legacy evidence stay blocked. No recovery action applies/reverts files or deletes lanes. The UI exposes Recheck recovery alongside Changes.

Validation: nine native Compare tests cover before/after/ambiguous/staged-change restart states and repeated assessment; ten Compare UI tests cover the action; strict Clippy and production UI build pass. Restart cases seed journal states rather than killing a live application. Full crash injection, simultaneous external edits, guided ambiguous-state resolution, bounded recovery retention and cross-process ownership remain open. Whole-tree comparison is conservative: unrelated edits also require review. Index comparison uses staged-content identity, not all index flags or unsaved editor buffers.

Actual Compare process-crash coverage

Linux integration tests now spawn an isolated service test process and intercept only the source Git apply/removal commands through a test-local PATH wrapper. The parent sends SIGKILL before patch application, after patch application, and after outcome persistence before the first worktree removal. Restart uses the actual journal written by Keep, not a seeded replacement. The test checks before/applied reconciliation without reapplication, preserved lane copies, binary bytes, rename/delete results and executable mode. Crash controls exist only in the test executable; production has no environment-triggered fault injection.

The Linux suite reports eleven passing tests, including the no-op child entry used by the parent harness. This covers three real process-crash boundaries, not every journal write, disk-full failure, power-loss/fsync behavior or concurrent external edit. Those acceptance cases, ambiguous recovery UX and cross-project synchronization remain open.

Compare project coordination

Compare metadata synchronization is now scoped to canonical project paths. A short registry mutex only manages weak lock references and is never held across async work. Start/Keep/Discard/recovery also acquire a nonblocking OS file lock in Git's common directory, shared across app profiles/processes and related worktrees. Existing revision-checked persistence and engine reservations remain. Lock order is documented; the repository lock file is never unlinked. Unix opens reject symlinks, nonregular files, other owners and extra hard links.

The Compare suite covers ownership refusal before source changes and successful retry after release. The real-crash parent is a second process and verifies that it cannot acquire the child's repository ownership at all three mutation boundaries. A unit test holds project A's metadata lock while acquiring project B's. This establishes scoped-lock behavior, not a measured end-to-end UI latency target. Git/worktree subsystem locks, independent external editors, advisory-lock cooperation by older app versions and network-filesystem lock semantics remain limitations.

Release draft staging and immutable retry

The release workflow preserves all existing gates and delegates publication to scripts/publish-native-release.mjs. It stages a draft, uploads only missing assets without clobber, downloads all expected assets to verify SHA-256 bytes and completeness, then publishes. Published retries are read-only; changed bytes, unexpected assets, incomplete published releases and authorization failures are refused. A deterministic manifest binds tag/source commit, architecture, Cargo/UI lockfiles, runtime pin and package hashes. Per-tag workflow concurrency serializes cooperating release runs. Native PR CI and release CI run the publisher fixture suite.

Eight local Node tests exercise failure/retry and corruption paths; both workflow YAML files parse. No GitHub draft or public release was created to test this change. Remote tag protection, platform signing/authenticated updates and full workflow execution remain unverified. Manual concurrent repository edits are outside workflow concurrency. Draft discovery follows GitHub's authenticated List releases API; publication commands were checked against installed gh help.

Provider runtime capability enforcement

The ACP execution adapter now checks the live initialize response before starting a session: only supported protocol version 1 is accepted, and queued image prompts require explicitly advertised image support. Follow-up images are checked at send time too. Missing, false or malformed image declarations cannot silently send attachments or trigger a provider/billing fallback. The image capability resets at process startup; cached catalog/vendor-name assumptions cannot authorize actual image transmission.

Parameterized fixtures cover Cursor, Antigravity and Grok with queued/follow-up images and true/false/missing/malformed declarations, plus unsupported/missing protocol versions. Existing Antigravity Google authentication and session/model-switch fixtures remain exercised. This is protocol conformance evidence, not a live login test or a change to the supported vendor login routes. The existing Grok early vision restriction and broader capability/UI synchronization remain separate work. Reference: ACP v1 initialization.

Managed local runtime admission foundation

Different-model requests now wait cancellably for active model leases instead of failing immediately. The last lease wakes waiting requests, and notification registration precedes the lease check to avoid lost wakeups. Existing same-model sharing remains. Cancellation and runtime shutdown prevent a waiting request from starting another model. All existing callers of managed runtime acquisition share this boundary.

The local-engine fixture suite checks no second launch while a lease is active, cancelled waiting requests, release-triggered switching, same-model sharing and shutdown with a queued request. This is not yet a FIFO multi-GGUF Compare scheduler: lineup restrictions remain until ordered scheduling, queue UI, timing/configuration evidence and actual offline acceptance are implemented. Long-lived same-model sharing can delay a different model. Existing CPU fallback behavior still needs an explicit Compare policy before benchmark use.

Ordered managed job scheduling

Top-level managed-model jobs register in submission order across project workspaces and remain in persisted queued status until admitted. Admission precedes the general worker semaphore, avoiding worker exhaustion by local waiters. Completion/cancellation wakes the next eligible entry; weak references prevent completed task retention. A cancelled middle entry cannot start or let a later job overtake the active predecessor. Nested tasks continue to share the parent's model; a nested model/context switch while the runtime is leased is refused to avoid a parent-child wait cycle.

A cross-project native fixture holds a runtime lease, submits three tasks, cancels the middle one, and verifies queued states, model launch counts, terminal states and start-after-predecessor-finish ordering. This is job scheduling, not yet the complete multi-GGUF Compare feature: setup-only runtime callers still use lease admission, ordered Compare launch metadata/timing and fallback policy remain, and real offline model acceptance has not run.

Sequential multi-GGUF Compare integration

The native and picker one-GGUF restriction is removed. Two or three installed compatible local models now use the ordered managed-job scheduler from one comparison snapshot. Offline mode remains authoritative. Compare preparation disables automatic CPU fallback and rejects reuse of an automatically-fallen-back runtime; normal non-Compare fallback behavior remains unchanged. Each local lane records runtime ID, reported backend, effective context size, preparation duration and fallback policy; the lane card displays the useful runtime details. Preparation includes readiness/wait work and is not a measured time-to-first-token.

End-to-end managed-runtime fixtures run two GGUF lanes in offline mode, verify sequential completion and shared snapshot, and cancel a three-model lineup while another lease occupies the runtime, proving no queued model is loaded. A failed-GPU fixture proves comparison policy does not launch a CPU retry. The full UI suite passes 314 tests and the production build. These simulated model/runtime files do not prove real inference or absence of external packets; actual two-model offline acceptance, complete model file/quantization/template identity, separated timing metrics and native UI acceptance remain required. Earlier entries describing the one-GGUF restriction are superseded by this increment.

Next implementation work

1. Complete Compare journal/recovery and immutable preview binding; add project-scoped check configuration UI. The original arbitrary-command false verification is fixed in source with a native regression.
2. Immutable draft release staging and required gates, preserving all current checks; dependency advisory remedy.
3. Compare fault injection, durable journal, process-exit cleanup checks, cross-project synchronization.
4. Provider capability/conformance and real coding evaluations, extending existing login integrations using supported vendor mechanisms.
5. Shared local-resource scheduling and actual offline multiple-GGUF acceptance.
6. UX, diagnostic export, measured performance, Wayland and package/recovery qualification.

No paid/live provider turns, billing changes, release publication, or destructive Git repairs are authorized by the reference document itself. No new required hosted backend or account. Tests use isolated scratch profiles and projects.

Real single-model offline acceptance

The opt-in live_local_acceptance_from_explicit_models harness accepts one to three explicit installed GGUF paths, creates an isolated profile/project and downloads nothing. On 2026-09-26 the one-model case completed on the installed Qwen2.5 0.5B Q4_K_M (491,400,032 bytes) and llama.cpp 0.4.1-dev / 18f9f7bef. A Linux user/network namespace exposed only loopback; a strace -f -e trace=connect trace observed ten connections to 127.0.0.1 and no nonloopback connects. The runtime reported Vulkan / RTX 5060 Ti and no CPU fallback.

The supplied addition-function explanation completed in about 1.99 seconds, including 1.63 seconds of runtime preparation. This is one inference observation, not TTFT, a coding benchmark, independent GPU-offload measurement or multi-model acceptance. Verification correctly remained not_run. The real test and all-target Clippy with warnings denied pass. LOC-01 remains open: only one installed GGUF was found; the two-model scheduler is currently covered by fixtures. No installed app, model or account profile was modified.

Live subscription text/resume and Claude duplication fix

After the user offered existing subscriptions for testing, source-built live_vendor_turn runs used isolated profiles/projects and installed official CLI logins. Codex 0.158.0-alpha.2.1 (ChatGPT Pro, GPT-6-Luna), Claude Code 2.1.278 (Claude.ai Max, Default), Cursor 2026.09.15-d2fe57e (Auto), Antigravity ACP 1.2.1 (Gemini 3.8 Flash High) and Grok 1.0.41 (Grok 4.7) each completed an initial one-word answer and native-session resume. Cursor's CLI reported Free; paid entitlement remains unconfirmed. Unknown plan allowance remains unknown.

The real Claude run initially returned ALPHAALPHA twice. Its per-message streaming marker reset before result, allowing repeated final text. A separate per-turn emitted-text marker now suppresses that duplicate and resets on follow-up. Regression fixtures cover streamed and complete-message paths, later result-only turns, genuine repeated chunks, multiple messages and tool-then-result fallback. The real Claude recheck returned exactly ALPHA on both turns. The live example now fails on a wrong/duplicate answer and cancels timed-out jobs before shutdown.

All 19 adapter tests and core all-target Clippy with warnings denied pass. These live tests establish basic text and resume behavior, not full provider conformance or coding-quality acceptance. No tool action, image, quota exhaustion or auth-expiry case was exercised live in this increment. The installed app and billing settings were not changed. Codex subscription authentication was cross-checked with official OpenAI documentation.

Bounded provider transport and split-frame correctness

A native subprocess reproduction confirmed that the runner's 250 ms polling timeout discarded bytes already consumed into a temporary line buffer. A frame split across that boundary completed with missing reply text. A second reproduction sent more than 4,000,000 bytes without a newline; the old size check could not run until line completion, and the job failed the five-second acceptance deadline. Both regressions failed before the fix and passed afterwards. No actual out-of-memory incident is claimed.

A shared bounded line reader retains partial bytes across cancelled polls and enforces the protocol limit while reading. Oversized protocol frames now fail the run or discovery probe immediately, rather than silently dropping a possibly essential event. Codex and ACP discovery use the same reader. Diagnostic lines have a separate 64 KiB bound; an oversized line is omitted entirely, then reading resumes at the following line. Stderr tasks are tied to the owning run/probe through abort-on-drop handles.

Tests cover fragmented UTF-8, CRLF/EOF and exact size boundaries, cancellation of pending reads, oversized-line resynchronization, whole-line diagnostic omission, native job/terminal persistence and overflowing process reaping. A live readiness check caught a closed oneshot being polled again in the revised ACP probe; the corrected code disables that branch after channel closure, and a normal ACP handshake now has a regression test. Final validation: 24 provider unit tests plus 39 integration tests pass, with one opt-in live installer test ignored; all-target Clippy with warnings denied passes. Read-only discovery against all five installed provider versions reports Ready after the fix. No model turn was sent in this increment. This does not complete all transport conformance: stdin backpressure, aggregate retained output, absolute deadlines amid continuous irrelevant output, request-queue limits and the full shutdown/permission matrix remain to be qualified.

Responsive provider streaming and cancellable input

Native fixtures reproduced two user-visible problems before correction: a short text delta stayed buffered until the provider finished, and cancelling a task waited for a vendor that had stopped reading its input pipe. Both regressions now pass. The provider runner flushes pending text on a 50 ms cadence during quiet and continuous streams; existing size, tool, approval and completion flushes remain immediate. A burst fixture verifies text is coalesced without duplication and arrives before the corresponding permission request. This is not a measured UI frame-rate or p95 input-latency result.

Protocol writes now observe task cancellation and have a 30-second per-batch deadline. Partial writes are never retried. Stop and plan-limit interrupt delivery have a 250 ms best-effort budget before the existing process cleanup path. An interrupted prompt write exits through owned-process cleanup; the Linux regression checks both persisted cancelled state and process reaping. Codex readiness is recorded before attempting the prompt write, preventing an input failure from launching an exec fallback after a prompt may have begun. A deliberately closed pipe verifies prompt failure is immediate and no fallback runs.

Validation: 26 provider unit tests and 46 focused integration tests pass (72 total), including native streaming/approval order, blocked input cancellation, write deadlines, cancellation-before-write, native steering, account/limit handling and existing adapters. One opt-in live installer test remains ignored. Core all-target Clippy with warnings denied passes. An initial unrelated ACP fixture launch returned Linux ETXTBSY; its isolated rerun and subsequent complete focused runs passed. Tests used fake CLIs/local fixtures, with no paid provider turns. Actual native UI latency, full descendant shutdown cases, aggregate output bounds and overall deadlines during continuous irrelevant output remain open.

Local startup status and current-turn Compare evidence

Managed local tasks now record catalog preparation, runtime waiting and model loading before the existing runtime-ready receipt. Waiting is emitted only when the runtime lock or a different model's lease prevents acquisition; loading starts when the task can actually replace/start the runtime. Reusing an already loaded model does not invent a loading step. Existing non-task preparation callers retain their API and behavior. Compare still disables automatic CPU fallback.

The conversation consumes these events before agent.started, promotes its queued job to running, and displays the recorded startup phase. Compare shows a queued local lane as “Queued for local model” and consumes the current task's startup events. Stop, Pause, pending approvals and terminal outcomes take precedence over startup labels. A follow-up now clears the prior turn's runtime metadata when its own runtime-ready receipt does not yet exist. Previously, it could retain the previous turn's backend/context/preparation details.

Validation: 12 Compare and 9 local-engine native integration tests pass; two opt-in real-model tests remain ignored. The held-lease fixture asserts preparing → waiting → loading → ready, and no preparation event for the queued successor. A Compare follow-up fixture asserts its new job ID, waiting phase, cleared old receipt and persisted cancellation. All 318 UI tests pass. One browser fixture verifies the visible preparation/wait/loading/reading progression before and after agent.started; its loading screenshot was inspected. Production UI build and core all-target Clippy with warnings denied pass. Initial test-only corrections were a missing Rust import and an expectation of an empty active-task string instead of undefined. The Vite bundle-size warning remains.

This is task-startup status, not a complete generation/check timing matrix, native Wayland verification, p95 latency measurement or a new real-model benchmark. No paid provider turns, installed-app replacement or remote publication occurred. Next: finish separated task timings and model provenance, then qualify the same user flows against real models and packaged desktop builds.

Observed task timings and warm-start disclosure

CONFIRMED: Compare's prior duration excluded queue time, while local preparation combined catalog work, runtime waiting and model loading. The existing output did not separate those costs. Added versioned, monotonic timing observations on jobs, terminal events and Compare lanes. A finished conversation and each Compare lane expose one expandable timing section. Task acceptance does not depend on these metrics.

Measurements distinguish queue/active/total time, local preparation and its wait/load subsets, whether the model was already loaded, foreground native model attempts, first returned text, tool batches, completion assessment and configured-check processes. First text is explicitly not TTFT: the callback can receive a buffered JSON reply and tool-only requests produce no text value. Model-request time includes request/transport/decoding rather than pure generation. Native process time is retained in configured-check receipts and excludes approval waiting and file fingerprinting; it overlaps tool/completion time. Unobserved vendor-internal measurements and old history stay absent. The API contract documents the boundaries and overlaps.

Final timing evidence is persisted with the terminal job/event and survives restart. Live observations are partial. Crash recovery does not infer downtime or invent missing timing history. Cancel-before-admission has queue time without fake execution/load activity. A waiting follow-up cannot inherit a prior turn's timing snapshot. Warm model reuse is identified explicitly and carries no model-load interval.

Validation across focused runs: 69 native integration cases (engine tasks, managed local runtime, Compare, subagents and service commands), 3 timing unit tests, all 322 UI tests, 2 browser cases, production UI build and core all-target Clippy with warnings denied passed. The affected engine/local/explicit-check paths were rerun after the final provenance and warm-reuse additions. The browser timing card was inspected and its final wording rechecked. One initial UI test found timing details missing from the compact no-files-changed summary; the component was corrected. Existing bundle-size warnings remain.

One opt-in real single-model run also passed in a loopback-only Linux network namespace, with isolated profile/project and existing Qwen2.5 0.5B Q4_K_M weights (SHA256 74a4da8c9fdbcd15bd1f6d01d621410d31c6fc00986f5eb687824e7b93d7a9db). It recorded total 1.6959 s, queue 0.0024 s, preparation 1.4345 s, load phase 1.4261 s, model request 0.1922 s and first text 0.1019 s from that request. No verification command ran; verification remained not_run and process-check time stayed null. All 9 observed INET connect calls targeted 127.0.0.1. Runtime-reported backend was Vulkan with no automatic CPU fallback; independent GPU-offload measurement was not performed. This single short explanation task is not a throughput, coding-quality or repeatability benchmark. Two opt-in real-model tests remain ignored in ordinary fixture runs; the single-model acceptance test was invoked separately here.

Remaining Phase 4 work includes true token-level latency/pure-generation measurements where supported, complete model-file/runtime/template/sampling provenance, and real two-model offline acceptance. Full provider, recovery, native UI and release qualification remain open. No paid provider turns, downloads, installed-app replacement or remote publication occurred in this increment.

Full acceptance register

Each ID records the inspected test evidence and its limits. “Mapping pending” is not an assertion that functionality is missing. Unless an increment explicitly records a fresh run, mapping existing tests does not newly certify current source. Passing broad suites do not automatically prove each invariant.

• RUN-01 — Very fast hermetic task: Partial native/fixture evidence: engine_tasks::concurrent_sessions_and_repeated_followups_survive_restart_without_duplicate_completions, CLI run/watch/events scenarios, and UI durable-page draining pass at prior checkpoints. A deliberate completion-before-observer-registration barrier and packaged replay remain open.
• RUN-02 — Engine throws before streaming: Partial: model_routing::provider_failure_does_not_silently_retry_against_the_default_endpoint covers failed endpoint propagation. A forced pre-stream panic/preparation failure through the actual conversation spinner remains open.
• RUN-03 — Cancel before startup: Partial: engine_tasks::queued_cancel_is_immediate_and_shutdown_cancels_a_stalled_provider, control_owned::dropping_an_owner_cancels_queued_jobs_without_waiting_for_an_unrelated_task, and managed local queue tests cover no execution after queued cancellation. Exact admission-race and reopened-store assertions remain open.
• RUN-04 — Cancel during output: Background output-flood Stop and TERM-handler exit-zero cases preserve cancellation; blocked provider input cancellation reaps its process. A new conversation-hook regression streams partial text, loads the authoritative cancelled job, then delivers a late completed event from the old stream; cancellation and the partial output remain, with no completion callback. This verifies stale-stream rejection after cancellation is observed, not the full native Stop-click-to-cancellation-acknowledgement race or provider process behavior.
• RUN-05 — Two sessions and duplicate events: Partial: native concurrent session/restart tests plus transcript deduplication and obsolete-session navigation tests pass at prior checkpoints. The combined native-window cross-session/reconnect case is not yet qualified.
• RUN-06 — Owned child ignores graceful stop: Partial Linux native evidence: background_processes::completion_failure_graceful_stop_and_forced_child_cleanup_are_truthful, hook cancellation and process stress prove bounded stubborn-child termination. Unrelated PID protection is tested separately; a concurrent unrelated sentinel during escalation and all-provider parity remain open.
• CMP-01 — Crash before project mutation: Native SIGKILL coverage: compare::real_process_crash_before_and_after_apply_recovers_without_reapplication kills before source apply and recovers the actual journal. This is one mutation boundary, not every journal-write/disk-full/fsync failure.
• CMP-02 — Crash after apply before applied receipt: Native SIGKILL coverage: the same Compare crash test kills after apply before receipt, checks the postimage and reconciles without reapplication. Ambiguous external edits and every persistence boundary remain open.
• CMP-03 — Crash after receipt before cleanup: Native SIGKILL plus restart coverage: the crash test kills before first cleanup after receipt; applied_outcome_survives_pending_cleanup_and_restart_without_rescoring preserves later user edits and scores once. Per-lane crash checkpoints remain open.
• CMP-04 — Failure deleting one lane: Linux service regression now injects a real filesystem permission failure after quarantine relocation: Git partially removes the lane and unregisters it, while the applied winner, original index/user edits and once-only scores survive. A bounded ownership journal retains the exact Git administration/index and surviving lane identity; reopening and repairing permissions permits cleanup without reapplication/rescoring. Readonly-root relocation refusal, original-path replacement, symbolic branch aliases and crash recovery have separate regressions. Full package/UI and all persistence-failure boundaries remain open.
• CMP-05 — Other lane refuses to stop: Partial: cancel_keeps_lanes_and_discard_stops_running_lanes covers cancellation of a cooperative slow lane. A resistant lane that cannot be proved stopped remains a required case.
• CMP-06 — Duplicate Keep or Keep/Discard race: Four Linux native service races deliberately overlap at real Git apply/removal barriers: same-lane Keep/Keep, different-lane Keep/Keep, Keep/Discard and Discard/Keep. Source apply counts are 1/1/1/0; source HEAD, staged content, unrelated working files, winner and once-only scores survive reopening and cleanup retries. This is same-process dispatch concurrency; separate-app ownership has its own tests and packaged UI qualification remains open.
• CMP-07 — Project edited after preview: Native fixtures: keep_refuses_conflicts_and_discard_removes_every_lane preserves an external conflicting edit; stale-check acceptance requires explicit review. External edits during the final apply window remain open.
• CMP-08 — Staged/unstaged changes and unsaved buffer: Native fixtures preserve staged content and unrelated untracked/unstaged work. snapshot_captures_flagged_files_and_preserves_the_source_index additionally checks assume-unchanged, present/absent skip-worktree paths, intent-to-add, split indexes and a real sparse checkout without modifying source index bytes or timestamp. The full-service compare_preserves_flagged_index_and_captures_hidden_working_edits verifies both lane snapshots, Keep and reopening with the original index intact. UI-started Compare now blocks and names dirty editor drafts, verified by requires open editor drafts to be saved before Compare snapshots the project; direct native/API starts cannot inspect those in-memory buffers. Sparse-index extensions and packaged UI parity remain separate.
• CMP-09 — Binary, rename, delete, executable bit: Native Linux crash fixture checks binary bytes, rename/delete results and executable mode through actual Keep and recovery. Full visual review/package parity remains separate.
• CMP-10 — Separate app processes target one project: Native process/lock evidence: the real-crash parent cannot acquire the child repository lock at all three boundaries; repository_ownership_refuses_keep_before_source_changes permits retry after release. Noncooperating editors and network filesystems are outside this lock guarantee.
• CMP-11 — Project A shutdown stalls: One actual Engine/Store serves two Git projects while A's owned fallback shell holds its TERM shutdown barrier. B's status/cancellation completed in 45/112 ms during the full Compare suite, within the unchanged one-second combined bound; A remained stopping and later exited. This is a bounded Linux core-service check of the fallback process path, not a percentile benchmark, Bubblewrap-enforcement or native-window qualification.
• LOC-01 — Two installed GGUF models offline: real Qwen3 4B Instruct 2507 Q6_K and Qwen3 14B Q4_K_M completed sequential Compare lanes with valid addition explanations in a loopback-only Linux network namespace. All 37 observed INET connects targeted loopback; no automatic CPU fallback. This verifies basic two-model offline inference and sequencing, not coding quality or full desktop/package acceptance.
• LOC-02 — Three-model queue cancelled mid-run: Native runtime fixture: compare_runs_two_installed_gguf_models_sequentially_in_offline_mode proves pending models do not load after cancellation. The opt-in live_three_model_compare_cancels_queued_models test additionally exercises installed Qwen3 4B, 8B and 14B GGUF files in an isolated profile and loopback-only network namespace. It waits for the first model's actual stream, cancels Compare, requires all three jobs to finish cancelled, and checks that the queued models have zero requests, no loading phase and no runtime-ready event. This is real local-runtime cancellation evidence, not a packaged GUI or broader model-quality result.
• LOC-03 — Local model exceeds safe allocation: Preparation fixture memory_too_large_is_marked_unavailable_and_refused covers refusal. Actual GPU allocation exhaustion with responsive desktop and unchanged project remains open.
• LOC-04 — Runtime crashes or port is occupied: Partial fixtures cover early runtime exit, cancellation during load and CPU fallback policy. Full runtime-crash/restart and occupied-port native-window matrix remains open.
• LOC-05 — One model fails in Compare: Other lane results and verification stay intact. Status: mapping pending.
• PRF-01 — Model claims tests passed without execution: engine/receipt/UI regressions pass; final native executable reproduction passes. No paid provider used.
• PRF-02 — Configured checks pass, then source changes: post-check edits before task completion and uncommitted-content/rename unit tests pass. Native service tests cover external edits after completion and restart; Compare tests cover acceptance refresh and explicit stale-evidence review. The unreleased UI now invalidates visible summaries on successful editor saves, revisions observed by the open editor, and relevant same-session engine wake-ups. Generation-guarded reads discard an old passing response when another edit arrives. This does not continuously watch every file or another session mutating the same project; those cases still require focus/manual reassessment.
• PRF-03 — No checks configured: native arbitrary-command reproduction returns not_run; UI displays verification not run and preserves command exit evidence.
• PRF-04 — Required check cancelled/skipped: typed-state unit tests prevent passing; failed/cancelled task aggregation and goal gating are implemented. Terminal receipt regressions now cover budget exhaustion, malformed provider response, cancellation and seeded interrupted-job recovery without losing command evidence or cross-task isolation. Historical reassessment cannot restore verified/red-green claims for unsuccessful tasks. Complete cancellation-boundary native matrix remains open.
• PRF-05 — Provider self-reports an external result: Provenance differs from locally observed evidence. Status: mapping pending.
• PRV-01 — Expired auth or unavailable quota: Clear status; no fabricated usage or fallback billing. Status: mapping pending.
• PRV-02 — Malformed/out-of-order protocol data: Native regressions now cover split/oversized framing, continuous valid traffic deadlines, aggregate text/protocol bounds, malformed limits and pre-ready no-fallback behavior. Request ordering, session isolation, discovery-helper retention and live updated-provider conformance remain open.
• PRV-03 — Unsupported image/tool capability: Existing acp_negotiated_image_capabilities_guard_queued_and_followup_prompts covers absent/false/malformed/true negotiated image declarations for three ACP adapters. Unsupported queued/followup images fail before sending an image prompt; an intentional later text-only prompt remains possible. Managed llama.cpp vision uses prepared runtime/projector capability. The general cloud-name heuristic, full tool-capability matrix and native UI path remain unqualified.
• PRV-04 — Vendor runtime updates capabilities: The catalog now compares the configured executable's selected path, length, modification time and (on Unix) device/inode before using a cached probe. Installation or atomic replacement bypasses the five-minute freshness window and failure backoff. A fake Codex runtime test atomically replaces the executable while keeping its bytes the same, changes the next model-list reply from image-capable to text-only, and proves the next catalog/picker request removes Vision from every affected row. The browser refreshes its picker on focus, and an already-open picker offers Refresh models to force a read-only reprobe. Capability changes are not pushed into an open picker automatically. Real updated-provider and native UI acceptance remain open.
• SEC-01 — Strict sandbox unavailable: Native command-tool subprocess fixtures verify refusal when bubblewrap is missing or its probe fails, and no unsandboxed replay after launch failure. Settings and background approvals disclose the execution boundary. Native-window/package qualification and the wider execution-policy matrix remain open; these fixtures do not prove kernel containment.
• SEC-02 — Approval parameters change: Two actual subprocess regressions reproduced a stale allow while changed command/edit frames waited unread. The runner now continues protocol processing during approval, reconciles readable complete frames before replying, waits for observed partial frames, and refuses stale/duplicate/retired requests. Seventeen Linux approval subprocess cases passed, alongside ACP state and private-identity units. This verifies observed protocol-state binding; fresh live Cursor and native-window qualification remain separate.
• SEC-03 — Secret-containing logs/diagnostics: Complete private-key PEM payload redaction is integrated in b66bb0e; six failing baseline regressions now pass among 12 redaction tests. Truncated recognized armor hides the uncertain remainder. The Health screen now has a previewable Doctor status export: a fixed allowlist of check IDs/labels/statuses is projected before the renderer sees it, and the saved JSON is retrieved by immutable, ten-minute snapshot ID. Paths, configured model names, detail/fix strings, project maps, prompts and raw logs are excluded. The feature's pure projection/cache, remote exact-byte download, UI preview and native Doctor integration tests pass locally; native file-dialog and packaged-app qualification remain open. This is not a crash-report export or proof that arbitrary secret formats cannot escape elsewhere. No arbitrary model-supplied ID is exempted from redaction.
• SEC-04 — Repository text requests broader permissions: The native engine integration fixture now puts a false owner authorization in AGENTS.md, confirms it reaches the model's system context with the non-authority label, then has the model request write_file during Plan mode. The tool produces a recorded read-only denial, no approval prompt and no file; the task can still finish with an honest plan. This proves the native tool boundary for that prompt-injection case. Vendor-owned tools, other repository instruction formats and policy changes during a live task remain separate.
• SEC-05 — Symlink/path/remote destination changes: On Unix, workspace write, delete, move, mkdir, mode-change and empty-directory removal resolve mutation parents using directory handles with O_DIRECTORY|O_NOFOLLOW; mutation leaf reads use O_NOFOLLOW. Write hashes and atomic replacement share the pinned parent. Tests cover parent swaps with both parent-creation modes, leaf symlink/FIFO refusal, existing mkdir leaves, and stale write/invalid move refusal before destination directories are created. Foundations22, workspace unit3, and the broader full-undo6/native-tools19/service-commands18 suites pass. This is partial scope: noncooperating external writers can still change a leaf between a type/hash check and rename/unlink; this is not atomic compare-and-swap. Broader approval/UI, non-Unix and concurrent real-directory replacement qualification remain open.
• UI-01 — Long transcript plus active stream: Two matched Chromium fixtures with 10,000 messages and a streaming 64 KiB response improved the paint-opportunity p95 proxy from 102.6/109.3 ms to 39.9/40.5 ms, without main-thread long tasks. Actual native input latency and remote worker fallback remain open. Native X11 WebKit confirmed the bundled worker and semantic output under the real CSP.
• UI-02 — Event gap, duplicate event, reconnect: UI fixtures in jobEvents.test.ts, transcript.test.ts and useConversation.test.ts cover durable polling gaps, duplicate event replay, page draining, obsolete session response rejection and reattachment. Native-window reconnect/duplicate tool-effects acceptance remains open.
• UI-03 — 100 sequential fixture tasks (partial: native engine): The sustained-stress gate retains the 200-task four-project concurrent workload and adds 100 serial tasks, awaiting each task before the next. The current native binary run on 2026-09-28 passed 301 completed rows including warm-up, 100/100 distinct persisted serial completions, five cancellations, ten bounded output floods, no active jobs/owned children and SQLite integrity ok. Sequential RSS rose 2,740 KiB (121,296→124,036 KiB), descriptors stayed at 14, and threads stayed at 24. Both workloads assert thread-growth and absolute RSS limits. The receipt binds /proc/<pid>/exe bytes to SHA-256 93e33e395f8f2d56ed64257099b5e3b9fab4a2fcf6b8ce8e699f26682cb18da2. Wired through native CI and native-behavior. This verifies the engine with a scripted provider, not 100 desktop WebKit tasks, GPU/model-server memory or a release package. Desktop resource qualification remains open.
• UI-04 — Keyboard and Wayland native session: Clean fd39f5a desktop SHA-256 4186ce5ef05c810d8f7cc4e26b67530d9146e272e883c51202c25490082070bb passed all eight private Weston/Xvfb virtual-seat checks: native Wayland connection, worker/CSP, 18 keyboard/focus observations, same-WebView copy/paste, 1380→520→1380 resize, themes, one-time approval/keyboard cancellation and clean quit. Live/reloaded cancellation shows one prompt and neutral check status. All owned processes exited. This does not certify physical COSMIC input, IME, compositor shortcuts, cross-app clipboard, mixed DPI, performance or installed packages. Original COSMIC tiled-resize limitation, seatless clipboard SIGSEGV and first nested-display readiness failure remain preserved; the passing virtual-seat run supports but does not prove the missing-seat crash hypothesis.
• REL-01 — Asset upload fails: Publisher fixtures prove interrupted upload remains draft and resumes without overwrites. Actual release 0.33.1 stopped on an unavailable draft listing, leaving an empty unpublished draft; the frozen publisher resumed after the draft appeared, verified all seven remote assets, then published. This exercises real safe publication recovery, but is not a deliberately interrupted GitHub upload experiment.
• REL-02 — Retry same version with different binary: Publisher fixtures refuse changed draft/published bytes; installer fixture refuses changed bytes under an installed version and preserves the old AppImage. Remote tag protection remains unverified.
• REL-03 — Checksum/signature mismatch: Offline verifiers and refusal regressions bind release identity, metadata and artifact bytes to independently trusted Ed25519 keys. Actual protected signing and seven-asset publication are complete for 0.33.1; fresh public downloads match the immutable signed artifact. The authenticated AppImage installer retained a durable accepted-state receipt, and the authenticated Debian snapshot passed fresh isolated installation. Independent trust-bootstrap distribution and future key rotation remain separate; older releases are not authenticated retroactively.
• REL-04 — Interrupted replacement or failed first launch: Installer fixtures cover failed rename, SIGTERM, rollback failure and actual SIGKILL preservation. The versioned journal supports exact recorded pre-activation recovery through retry or --recover; schema3 additionally permits recovery at the activation marker only while the old link and all recorded launcher/desktop identities remain unchanged. An edited desktop entry and a crash after active-link replacement still refuse automatic recovery. Older schema2 activation intents remain manual. Full desktop metadata rollback after mutation and first-window/database downgrade qualification remain open.
• REL-05 — Fresh packaged install without dev tools: Release 0.33.1 passed its required offline clean-host first-launch gate for both packages. Separately, the downloaded published Debian package was authenticated against the reviewed trust/source, then installed from its private verified snapshot in a network-disabled Debian runtime-only container without Node/Rust/Cargo. Package version/metadata, CLI status, MCP stdio discovery, visible first GUI window and owned-container cleanup passed. Debian SHA-256 is 4f93c63092e0a2e832839e5796afc1a208b29ea5dd18adbaae7cc9c6b17d30af. The installed AppImage separately passed 20 native-window interaction groups on this machine. These scopes do not establish physical Wayland or GPU inference acceptance.
• REL-06 — Required integration test is skipped: Required scoped receipts reject missing, failed, skipped, stale or mismatched gates before signing and GitHub calls. All 15 required build gates were verified for release 0.33.1, followed by successful protected signing. The later publication-listing failure remains recorded; publication recovery did not bypass receipt validation. Built-project cleanup has its own required gate. Explicit optional live-provider/model/microphone exclusions are retained and are not counted as passes.

Evidence boundaries

Prior baseline audit: 737 Rust tests passed across completed binaries after one isolated timing rerun; eight ignored. UI: 308 unit and 44 browser E2E tests passed. Sustained native stress: 200 completions, five cancellations, ten output floods. These are baseline measurements, not verification of subsequent edits. Full live-provider, Wayland, offline multi-model, and release-package qualification remain open.

At every checkpoint record changed commit, exact commands and results, fixture/native/live scope, unresolved risks, and the next dependency. Never mark a phase complete from a passing subset alone.

Parallel reliability and model qualification checkpoint

User authorized practical parallel agent work and explicitly requested the Rhea GGUF plus four other model classes. Three agents owned independent provider, local-runtime and release work; root reviewed/integrated the changes and ran real models. No extra app chats were created. The reference document itself was not treated as permission for account changes or publication.

• 4935ff4 fixes installer rollback intent before filesystem mutation, preserves the previous runtime/AppImage under rename errors and handled signals, excludes concurrent installers, refuses changed bytes at an installed version and preserves unresolved backups. Isolated fixtures include actual SIGKILL; recovery after SIGKILL still requires explicit action. The current installer fixture passes with its real packaged-runtime case explicitly skipped because the built bundle is absent. No installed app was replaced.
• 58790fd adds a configurable two-hour active provider budget, excluding explicit human waits, and aggregate protocol/text limits. Continuous valid/no-op traffic and a 9 MiB reply reproduced prior failures. Final adapter/config and native transport suites passed 19 + 15 cases; the prior focused unit/account/handoff/steering runs passed 30/12/4/3. Resource, framing and malformed-limit failures cannot cause exec fallback. Settings exposes the new limit. Discovery helper retention and complete transport conformance remain open.
• 6de8f34 binds local reuse to model/projector/runtime metadata and launch settings, freezes/revalidates preparation identities, checks cancellation around blocking probes and prevents same-ID incompatible nested leases. The before-fix replacement regression was reproduced on archived HEAD with a forced fresh rebuild. Receipts and the expandable UI record exact header/template hashes, quantization codes and observed runtime/context/sampling/launch settings. Metadata identity does not hash weights or dependent runtime libraries. Final agent runs passed 13 native integration/sanity cases, 16 local-filtered unit cases, 4 GGUF cases, 30 focused UI cases and one inspected two-viewport browser case. Explicit live/Whisper tests remain excluded from fixture runs.
• 28826c0 makes publication require per-stage receipts bound to commit, workflow attempt, command digest and package hashes. Twenty-five publication/gate fixtures pass, including missing/failed/skipped/stale evidence and changed bytes. Actual installer, runtime TAP, packaging TAP and Vitest 5 skip output was checked. Existing opt-in ignored Rust tests and cloud-consent scope are explicitly excluded rather than described as verified. No real GitHub mutation/full workflow/signing/fresh minimal-host installation was performed.

Integrated root validation: 60 native cases across cargo test -p shadowcode-core --test engine_tasks --test compare --test subagents --test service_commands passed. All 328 UI tests passed. Production TypeScript/Vite build and cargo clippy -p shadowcode-core --all-targets -- -D warnings passed. The existing bundle-size warning remains. Three evaluator-only tests pass for genuine five-case grading, import-shadow refusal and premature exit-zero rejection. These are meaningful regression checks, not proof of adversarial-proof Python grading.

User-requested installed models and real results

Ollama now contains Rhea 4B Coding Max Q6_K, Qwen3 8B Q8_0, Hermes 2 Pro Llama-3 8B Q6_K and Qwen3 4B Instruct 2507 Q6_K. Existing Qwen3 14B Q4_K_M was retained. Every full blob SHA-256 was independently checked against its content-addressed filename; the HF Q6_K blobs also match their published LFS digests. Exact tags, paths, sizes, hashes and receipts are in the user-facing inventory/evidence outputs. No model was installed as the application default.

The original Rhea Ollama command produced repetitive text until a 120-second cutoff, with plain {{ .Prompt }} template and an empty upstream tokenizer template. Native Compare then loaded Rhea but returned only <|im_end|>. The old nonempty-answer assertion wrongly accepted that as inference success; the opt-in harness now persists answer-valid flags and rejects control tokens/irrelevant text. The earlier Rhea run is recorded as transport success and answer failure, never successful inference qualification.

A new explicit-file live_local_coding example exercises actual service/catalog routing, separate temporary profiles/projects, required command sandbox and loopback-only network isolation. It asks each model to repair clamp, stable unique (including unhashable values), and chunks. It preserves evaluator-owned tests and independently copies only helpers.py into a fresh sandbox for five unittest cases. It bounds task/cancel/shutdown and retains failure/cleanup evidence. No paid provider or user project is used. Two initial harness errors (missing scratch trust and incorrect direct ModelConfig routing) ran no inference and are excluded from model results; switching to the actual service submission path corrected them.

One run per model at 8192 context, 14 steps and 50000 task tokens produced:

• Qwen3 4B Instruct 2507: successful edits and check, all five cases passed; total 38.17 s.
• Qwen3 14B: edited and ran tests, four cases passed; unhashable unique failed and the model stopped after promising a repair; total 50.08 s.
• Qwen3 8B: repeated read/search calls until token budget, no edit, zero cases passed; total 55.43 s.
• Hermes 2 Pro Llama-3 8B: prose/code in the reply without tool execution, unchanged file, zero cases passed; total 16.11 s. Its unsupported passing claim remained unverified in the application.
• Rhea 4B: response hit its length bound; incomplete tools were not executed, unchanged file, zero cases passed; total 48.75 s.

These are application/configuration observations from one small repair fixture, not general model rankings or matched-sampling throughput benchmarks. The short times of failed/no-edit tasks are not speed wins. Startup defaults/templates differ; source validation work also ran on the host. Machine-wide sampled GPU memory rose from 693 MiB baseline to 10606 MiB peak over the suite, including desktop use; this is not per-model VRAM. All 204 observed INET connects during the coding suite targeted loopback. App verification remained separate from this external evaluator because no project check configuration was added.

A subsequent stricter real two-model Compare with Qwen3 4B Instruct and Qwen3 14B passed both answer sanity checks in sequence with 4096 context, no CPU fallback and 37 loopback INET connections. LOC-01 now has real two-model basic inference evidence. A later isolated three-model run exercised live cancellation as recorded in LOC-02 above. Both current local packages subsequently passed one small-model inference task in the offline Debian runtime image, as recorded below. Native UI performance, runtime allocation/crash boundaries, full local-tool robustness and broader packaged inference qualification remain open.

Priority exposed by the model test: strengthen local agent follow-through after a failing check and after promised-but-unperformed actions; inspect template/tool compatibility for Hermes/Rhea before recommending them as defaults; expand Qwen3 4B evaluation across representative repositories and repeated tasks. Complete release signing, crash recovery, minimal-host package and native Wayland/performance acceptance in parallel with that work.

Bounded follow-through and native steering boundaries

The real Qwen3 14B repair failure motivated native regressions for unfinished edit promises. Three cases failed before correction: a failed check followed by a promise stopped before repair, a prose-only edit promise created no file, and repeated promises finished successfully. Native code tasks now request permitted follow-through within one cumulative max_fix_retries budget for edit and command promises. A harmless read cannot reset it. Persistent promises fail with existing command/check receipts retained; no command or edit is automatically replayed. Read-only planning, diagnosis of a failed check, quoted examples, conditions, deferrals and negative commands retain their intended behavior. This remains a conservative English heuristic, not proof that a model completed a task.

Separate native regressions reproduced final-answer steering being ignored, pending edits surviving a newer instruction, and completion-hook steering being missed. Pending tools are now paired with explicit non-execution results before the steering note; the next model request uses the new instruction. Checks occur before each tool batch and final acceptance, including quick resume and failing completion hooks with no automatic retries remaining. Already completed actions are retained without replay. Cancellation remains a failed/cancelled verification outcome.

Validation: 99 integration tests passed (35 engine, 12 Compare, 8 steering, 14 service-command, 8 subagent, 13 hook and 9 permission-mode), plus all 15 autonomy unit tests, 329 UI tests, production UI build and strict all-target core Clippy. These are source/fixture checks. Existing bundle-size warnings remain; packaged desktop acceptance and full live-provider conformance are still open.

The initial live recheck of Qwen3 14B and Hermes on an intermediate build did not pass independent grading: Qwen repaired repeatedly but still failed unhashable-list deduplication and reached its token budget; Hermes made an unsupported past-tense success claim with no file change. Those observations do not establish a coding-quality improvement or a general model ranking. The full flagship acceptance specification remains active.

Committed-build local coding recheck

The same isolated five-case Python fixture was rerun on clean source commit 89f97097a7f2234273035d8f5860efe69892c9f0, with recorded executable SHA-256 954e4272831f1d597292bc76fbcf00136b5fef2d7ce08e73fbf03ced56ad313a. Qwen3 14B passed all five independent cases after a failed model-requested check, a further edit and a successful check (7 steps, 58.67 s). Its action-promise guard did not fire, so this pass is not causal evidence that the new heuristic improved coding quality.

Qwen3 4B Instruct, which passed the initial run, now repeated read/search calls and hit the task-token budget without editing (10 steps, zero cases passed, 32.61 s). Hermes received one completion.retry, then made unsupported past-tense edit/test claims without tools; all five independent cases failed and its application answer remained unverified (2 steps, 18.67 s). These variations rule out promoting a default based on one successful fixture. Rhea and Qwen3 8B were not rerun in this increment; their original failures remain recorded.

All 79 observed INET connect calls in the committed-build suite targeted loopback. Sampled machine-wide GPU memory peaked at 10633 MiB including desktop use; this is not per-model VRAM. All three isolated services shut down without reported cleanup errors and no test inference server remained. Sampling defaults were unchanged and are not matched across models. The suite deliberately returned failure because two model cases failed; failed cases are retained rather than treated as harness validation success.

Next: improve repeatability and model/template/tool compatibility with varied tasks, explicit acceptance checks and recorded generation settings; compare supported subscription coding routes using the same fixture. General failure-path command-receipt aggregation, including token-budget exits, remains a separate gap from the new promise-refusal receipt preservation. Complete native-window, release and all original acceptance work remains in scope.

Terminal verification evidence preservation

The model evaluation exposed a failure path in which recorded checks survived in history but disappeared from the terminal job result. Finalization and interrupted-job recovery now share a task-scoped evidence snapshot: retain the last assessment verbatim unless later receipt events exist, append only those later receipts, preserve assessed stale states and output references, and mark an unfinished assessment unverified. No command is replayed and no filesystem scan is added to finalization. The UI distinguishes unfinished final verification from a failed individual check. Historical reassessment and non-success finalization also clear verified claims and red-green status.

Five native regressions cover actual failed/passing configured commands followed by budget exhaustion, malformed provider output or cancellation; same-session/different-session isolation; and seeded interrupted-job recovery with one durable terminal event across two reopens. Three Store unit tests cover stale-summary preservation, ordered new receipts and misfiled receipt rejection. Reassessment covers passing and fail-then-pass receipt sequences across completed, failed, cancelled, interrupted and limit-reached tasks. Seeded recovery is explicitly not a SIGKILL experiment.

Validation on this increment: 302 library tests passed (two prerequisite-dependent microphone/Whisper tests ignored), 104 integration tests passed (40 engine, 12 Compare, 8 steering, 14 service, 8 subagent, 13 hook, 9 permission-mode), all 331 UI tests passed, production UI build passed, and cargo clippy -p shadowcode-core --all-targets -- -D warnings passed. Existing bundle-size warnings remain. This source increment does not qualify the installed AppImage or complete the flagship acceptance matrix.

Live coding across supported vendor CLIs

A shared opt-in fixture now uses the same three-function Python repair task and five evaluator-owned tests for native local models and explicit subscription CLI routes. The vendor runner uses isolated projects and ShadowCode profiles, existing CLI authentication, narrow forwarded approvals, independent sandboxed grading, fixed deadlines/output bounds and retained failure evidence. It refuses detected API-key overrides and requests no route fallback. Vendor-owned tools retain the vendor's own sandbox and access; the isolated working directory does not contain them. ACP login success does not establish billing source. One small task is not a general coding benchmark.

The initial live suite exposed application and evaluator defects. Claude read files but Write/Edit were refused without a host permission request; the adapter had selected host prompts without registering the stdio permission tool. Codex completed the task, but the evaluator did not recognize its exact official shell wrapper. Cursor permission requests omitted typed input already sent in earlier updates. Antigravity's typed command fields differed from the common command field. Grok initially reported generic tool metadata that gained an execute kind later. All initial failures remain in the evidence.

Commit 1052fac registers Claude's stdio permission handler and returns the exact original input for one approved request, without persisting permission rules or widening modes. Six new tests include a subprocess fixture that writes only after approval, denial, read-only denial and request/input binding; five cases failed before correction. The implementation follows Anthropic's SDK subprocess transport and permission response protocol.

ACP now retains bounded current tool metadata, merging partial updates according to the ACP tool-call contract. Explicit values replace prior fields; omission/null preserves them. Completed calls/new prompts clear cached data, and mismatched supplied session IDs cannot mutate or borrow it. Completion records include the latest input and kind. Six unit tests cover changes, resets, redaction, limits, session mismatch and late kind discovery. Missing session IDs remain a compatibility path; this is not complete protocol conformance. The 128-entry/64 KB-per-entry cache limit measures serialized metadata, not total heap use.

The evaluator correlates exact command evidence by unique call ID and actual output, using current ACP completion metadata. It accepts only the observed finite Codex wrapper, preserves strict approvals, and uses stable report-only call aliases before secret redaction. Ten evaluator tests pass. Existing adapter tests (19), Antigravity fixture (1; one explicit live case ignored), transport (15), accounts (12), handoff (4), steering (8) and permission-mode (9) suites pass, as does strict all-target Clippy. Commit d663045 updates existing UI tool rows from completed typed inputs; it does not create duplicate starts. Focused UI transcript/activity regressions passed.

The next live suite used native source 1052fac and executable SHA-256 47f19963ca0f9688e770816915efa2661475608766b063aca8c61d01c2ba3b7f. Codex (gpt-6-luna), Claude (default), and Grok (grok-4.7) passed both observed-command and independent grading gates. Cursor (auto) and Antigravity (gemini-3.8-flash-high) produced code passing all five independent cases and their host approvals were accepted, but complete typed test output was absent/conflicting; their acceptance results remain failed. All five jobs completed, retained the original tests and shut down without reported cleanup errors. Claude and Codex reported subscription authentication; ACP routes reported existing login modes with the billing limitation above. Model prose is not used to fill missing execution evidence.

Current ACP output and offline receipt replay

Commit ffea0a8 retains redacted ACP rawOutput separately from approval metadata: at most 128 entries, each bounded to 8000 serialized bytes. Complete JSON stays typed; oversized output is explicitly marked as a truncated JSON-text preview. Null/omitted updates preserve the current value, explicit values replace it, and prompt/tool lifecycle boundaries clear it. Antigravity's observed normalized command_line/working_dir fields are also recognized. Nine ACP unit tests and eleven evaluator tests passed; strict all-target Clippy passed.

A new two-route live capture used source ffea0a8, executable SHA-256 f73b6e92ccbb9064ce7959cc1f2e27602ebce7b119a85a7426231c5fb92cb477. Both independent five-case graders passed, original tests remained unchanged, and jobs completed with no reported cleanup error. The original acceptance results remain failed because that evaluator did not yet support structured raw output. Antigravity's first no-cwd execution failed; its subsequent explicit-project execution returned matching exact command/cwd, two zero exit-code fields, and five-test output. The claimed default-directory cause appears only in model prose and is not established. Cursor returned structured exit zero and five-test stderr alongside retained Not in allowlist: python3 content; that contradiction remains unresolved.

Commit a7347f4 adds strict Antigravity-only grading for the observed six-field result, correlated to the expected session/task and a unique started/completed call. It rejects wrong commands/directories/statuses, conflicting content, truncation and unqualified output shapes. Fourteen evaluator tests pass. An explicit offline replay accepts Antigravity's saved receipt and rejects Cursor's while preserving both original live failures and the original source-capture SHA-256. Replay performs no provider calls or fresh independent Python grading. This does not turn the original live suite into a passing run or establish full provider conformance.

Current live subscription coding recheck

A fresh five-route run used source commit 52d8b772adaba18ce7b8e22f60da4f371c4175e6 and executable SHA-256 503e63e53c645f4b7bbdac271b41f63a712d187fc0e681ddc2ac2cbb16032ead. It ran the same isolated task sequentially against Cursor, Antigravity, Grok, Codex and Claude, with no observed route fallback or event truncation. Cursor, Grok, Codex and Claude completed the task, produced accepted exact test-command receipts and passed all five independent cases. Cursor's earlier structured-output contradiction is now resolved by adapter-owned provenance that distinguishes the terminal output from a prior permission message.

Antigravity completed and passed all five independent cases, but acceptance remains failed: the exact test command's permission request omitted its working directory and its structured completion reported an empty working_dir/workingDir. The successful output is not enough to prove that this specific command ran in the isolated project. Earlier pwd calls in that task did reach the project, but are not treated as proof of the later command's cwd. Preserve this as a live adapter/evidence gap; do not infer the missing directory from model prose or neighboring calls. The report is /tmp/shadowcode-vendor-coding-current.json on the test host and contains redacted, bounded event evidence. Subscription auth modes for ACP routes still do not independently establish billing source; Cursor's CLI reports Free.

The fixture prompt now explicitly asks providers to set the project cwd when their tool accepts it. With that instruction, Antigravity ACP 1.2.1 passed a fresh isolated live run: the correlated antigravity.execute completion recorded exact command python3 -m unittest -q, matching project path in both normalized input and structured raw output, completed status, two zero exit-code fields, and all five tests passing. Its independent sandboxed grader also passed, with no fallback, truncation or cleanup error. The report is /tmp/shadowcode-antigravity-cwd-recheck.json. The same changed example passes all 18 local tests, including strict wrong-directory and conflicting-output rejection. This closes the observed working-directory receipt gap for this run; it does not establish broad Antigravity conformance or billing entitlement. The executable hash for this recheck is 5ff1d2275db6ac5e5856a018987647ef7639cf5413c39841975ba6c74322526e.

To restore a same-prompt comparison, the changed fixture then ran against all five routes: Cursor, Antigravity, Grok, Codex and Claude. All five passed the accepted command-receipt gate and independent five-case grader, completed without fallback or truncated events, and reported no cleanup error. Antigravity's exact command receipt again named its temporary project cwd. The bounded report is /tmp/shadowcode-vendor-coding-cwd-recheck.json; its executable SHA-256 is 5ff1d2275db6ac5e5856a018987647ef7639cf5413c39841975ba6c74322526e. These are five small live task observations, not a general quality ranking or proof of each subscription's billing source.

Responsive Markdown and native worker qualification

Commit d5f1fe7 moves complete-document Markdown parsing for long visible responses (at least 8 KiB) into one shared worker, retaining the existing renderer, safety behavior, complete-document references/GFM semantics, copy behavior and 512 KiB default preview. The queue retains one active parse and only the latest pending request per mounted response. Superseded documents and retired-worker errors cannot overwrite current state. Worker unavailability uses the existing synchronous formatted path; parser errors show readable source without immediately repeating the failed parse on the main thread.

Two matched Chromium control/worker pairs with 10,000 saved messages and a streaming 64 KiB response measured input p95 of 102.6/109.3 ms synchronously versus 39.9/40.5 ms with the worker. Long main-thread tasks fell from 202/201 to zero. Worker runs continued producing 134/136 visible updates; four fragments were pending at capture. This measures trusted key-event timestamp to a second animation-frame callback, a paint-opportunity proxy, not physical display latency. The synthetic producer shares the browser main thread; no independent native-producer throughput claim is made. Remote CSP still forbids workers and retains synchronous fallback.

All 356 UI unit tests and all 50 browser tests passed, along with production TypeScript/Vite build and the bundle check excluding test-only transport. The 10,000-message fixture traverses all 79 pages and preserves access to every saved ID with at most 128 rows per page. Exact desktop/remote CSP fixtures cover real worker execution or fallback and final formatted/copy correctness. Existing bundle-size warnings remain.

Commit a7347f4 also adds scripts/test-native-markdown.mjs. A fresh native build served the exact production worker through tauri://localhost, HTTP 200 JavaScript, 194730 bytes, SHA-256 1681fa324377db582410f5871a4dbebff3245e7d24ec19880afc668b5cbacd9b. The actual native CSP header retained self plus Tauri script hashes; the worker returned the expected heading/table/reference/code tree with no CSP violations or model jobs. Desktop executable SHA-256 was ddc2a7b97ab90a8972f3cce355b22fc6895c4a9e71427fb9c34fb131069ea87f. Matching WebKitGTK driver 2.52.6 was extracted into task tooling, not installed system-wide. A second normal run with hardened cleanup passed; focused SIGTERM and unowned-PID fixtures verified bounded process/profile cleanup and refusal to signal the unrelated process. The script isolates its profile/workspace, disables CLI agents, uses offline configuration and verifies PID ownership before signalling.

This native evidence covers Xvfb/X11 WebKitGTK worker compatibility only. Actual Wayland interaction, native input latency, AppImage/deb packaging, extended resource-growth qualification and all other original acceptance requirements remain open. These UI asset hashes describe the pre-branding build; later branding requires a fresh embedding check.

Recorded installer recovery before activation

Commit 8737291 adds a private, versioned intent record before destination replacement. It binds canonical install roots, prior/candidate AppImage hashes, the prior active link, runtime tree identities and an owned staging basename. Runtime fingerprints include names/types/modes/file bytes/symlink targets, excluding timestamps. The existing installer lock covers retry and --recover; the latter requires no original candidate or checksum file. Recovery mutates only fully identified prepared states, parks an owned candidate runtime before restoring the prior runtime, and retires the active journal by rename once restoration succeeds. Edited, malformed, legacy and activation-stage evidence remains preserved and refused. Custom nonstandard active symlink layouts are explicitly refused before replacement.

Bash syntax, ShellCheck and the installer suite passed. Eight actual SIGKILL paths cover interruption between/after runtime renames, interruption during recovery, repeated recovery, automatic retry, same-version reinstall and first-install absence restoration. Failure and tampering fixtures cover failed restoration, concurrent recovery/install, changed roots/links/files/runtime content and malformed or symlinked journal fields. The old --recover path failed before implementation. The real packaged-runtime fixture remains explicitly skipped because its built runtime bundle is absent. No user installation was touched.

This is a bounded REL-04 increment. Automatic recovery after activation starts, launcher/desktop metadata rollback, first-window/database downgrade behavior and power-loss qualification remain open. An interruption after journal retirement can leave harmless staging cleanup artifacts; no complete orphan-retention policy is claimed.

Approved branding

Commit 7f89a19 applies the user's final SHADOWCODE image, which superseded the earlier SHADOWFETCHCODE selection. The original PNG is preserved byte-for-byte in assets/branding/shadowcode-original.png (SHA-256 653b36e0273c06dfc9ad36489954a6f9dc9ea1aa27fbf1d40195e4a06686920f). A built-in image-generation extraction supplies the transparent emblem (SHA-256 3bdda4e1d0e8a7149d3aea358e08eea9d3338f345604c0da0344ae3f8a3fc573); its exact prompt/provenance is recorded alongside the sources. Deterministic ImageMagick resizing generates native/hicolor/web/PWA/Apple/favicon derivatives and self-contained raster SVG compatibility wrappers. Product, CLI and storage identifiers remain intact.

Production build and a targeted production-UI browser check passed for startup, sidebar, welcome, onboarding and remote pairing; six icon variants decoded with expected size/alpha and no page errors. The complete original is used in the README and social preview. No GitHub repository setting or installed desktop icon was changed; native embedding is rechecked after the final combined build.

Exact Hermes template confirmation

Commit b18fd8c selects the bundled Hermes tool template only for exact architecture/tokenizer/model-name/default-template metadata, preserves model files and Ollama configuration, and requires runtime template confirmation before publishing a usable lease. The UI distinguishes the original embedded template from the applied profile. The first real offline qualification failed before inference: the pinned runtime reported 5,003 bytes rather than the 5,004-byte upstream asset, producing zero model requests or tool calls. The failure and unchanged source/tests remain retained.

A separate loopback-only diagnostic made only health/props requests and proved the runtime removes exactly one final LF, matching the pinned llama.cpp Jinja lexer. Commit 098672f accepts only the two complete known identities, never generic whitespace equivalence. It records the unchanged source hash separately from the actual reported hash and exposes only hashes/sizes/types in mismatch errors. Four profile unit and seven Hermes integration cases pass, including an agent tool round-trip for the normalized identity and refusal/reaping for missing, wrong-type, altered or unavailable template reports. Fresh coding qualification remains required.

Source-verified GLib backport

Commit c180da0 remedies RUSTSEC-2024-0429 in the GTK3/WebKit-required GLib 0.18.5 using the upstream two-line mutable-out-pointer correction. The published crate checksum and complete 121-file inventory are pinned; all other published bytes, actual package version, MIT license and copyright remain unchanged. Cargo resolves exactly one verified local copy outside workspace membership. Independent review compared the downloaded archive with the source tree and exact upstream correction.

The original optimized iterator fixture crashed with SIGSEGV; the same fixture against the exact patched release library passed six cases. Thirty-five integrity, notice and release-gate tests passed with none skipped. Tampering with both source and adjacent hash manifest is refused by an independently pinned full inventory digest. Dependency notices include original archive identity, modified tree identity, patch provenance, license and copyright. Native and release workflows now require the backport integrity and optimized behavior gate.

This is a source backport, not a clean version-only scanner result. No synthetic version or advisory suppression was introduced. Final application/package builds and native package/window qualification remain separate.

Approval reconciliation and Cursor execution provenance

Commits 53fec09 and b49d930 bind forwarded approvals to retained typed operation identity and continue reading the vendor protocol while a decision is pending. The prior runner reproduced stale command and edit grants in two real subprocess tests. The corrected runner bounds queued approvals and readable-frame reconciliation, holds observed partial frames until completion or failure, and retires dialogs on matching tool completion, turn/session transitions and pause. Identity uses a private non-serialized digest of the raw tool ID rather than display-redacted fields. These checks concern observed protocol state; they cannot authenticate an external vendor's eventual execution.

Cursor completion now records host-owned field provenance and explicit command exit status separately from retained earlier approval reasons. Nonzero shell results fail even when the vendor labels the tool completed. Missing, evicted, reused or incomplete history cannot be reconstructed as a permission-free success. The strict coding grader requires an exact current command receipt with complete retained history and matching resolved approvals; historical ambiguous captures remain failed. This does not establish vendor sandbox enforcement or billing source.

The combined native integration run passed 82 cases: 17 approval subprocess, 15 transport, 6 Claude permission, 19 CLI adapter, 12 account, 4 handoff and 9 permission-mode tests, with none ignored. Final focused units passed 21 ACP, one private-identity and three framing cases. An earlier unchanged aggregate-text test exceeded its five-second outer deadline once; its isolated rerun passed in 3.12 seconds and the combined run passed without a timeout increase. The failure remains recorded. Review then reproduced a malformed-line streak not resetting on a valid approval; a two-line follow-up restores the existing protocol bookkeeping, and all 18 approval subprocess tests pass afterward.

The integrated UI passed 363 unit tests, production TypeScript/Vite build and production test-transport exclusion. A recent browser run passed all 50 cases; it predates the final vendor formatter additions. Production source at b49d930 built both coding examples and the desktop and passed workspace/all-target strict Clippy. The final malformed-streak follow-up requires its own rebuilt executable before live qualification. Dependency GLib emits its preserved upstream warnings; no application warning suppression was added. Fresh Cursor/Hermes calls, native windows, packages and GitHub checks remain distinct qualification steps.

Synchronized Compare acceptance

The additional tests at production source 5c7f30f exercise CMP-06 and CMP-11 through real services, Git repositories and owned subprocesses. Keep/Discard overlap is established by polling the second dispatch while the first is held at an actual source apply or worktree removal. Both project content and durable comparison/score records are checked after completion, profile reopen and two cleanup retries. The responsiveness case proves project B remains usable while project A has a genuinely live stopping process; it does not infer responsiveness solely from separate mutexes.

All 15 tests in the complete Compare binary passed, with no failures or ignored cases; the count includes child-entry harness tests. Strict Compare-target Clippy and formatting passed. Initial fixture failures are retained: a namespace-local PID was incorrectly interpreted as a host PID, then Bubblewrap teardown prevented a shell trap from holding the intended stop barrier. The final latency fixture runs in a separate test subprocess with an explicitly unavailable Bubblewrap probe and the existing fallback process path. Parent PATH, production source, timeouts and sandbox policy remain unchanged. No production defect was demonstrated by these failures. Unsaved external editor buffers, complete index flags/extensions, filesystem deletion faults and full native/package parity remain separate acceptance work.

Native integration fixture repairs and worker gate

GitHub native run 36293706998 on 5c7f30f passed source formatting, strict Clippy, desktop build and preceding test binaries before failing an obsolete ACP initialization fixture. Commit 0a78dc5 supplies the required protocol version and resume capability; the eight ecosystem and 19 CLI-adapter tests pass, including protocol-refusal checks. The full local workspace continuation then exposed another obsolete fixture: model_routing expected a successful file write and model prose to satisfy required verification without configuring a check. The corrected fixture records the write as ordinary command evidence and runs an exact nonmutating configured acceptance command. Its paired negative case proves the same commands and prose remain blocked/not_run without configuration. Ten routing and eight goals tests pass. Neither correction changes production verification rules or timeouts. The complete workspace and remaining downstream gates must still run on the integrated source.

Native and release workflows now require the actual embedded Markdown worker probe and preserve its diagnostics. Release receipts bind the changed command and explicitly limit this gate to the X11 source binary; it does not certify Wayland or packages. All 26 release-gate/publication fixtures pass. The probe validates assets before creating a private profile and retains cleanup evidence when launch ownership is unknown. Real ELF startup-failure fixtures reproduced and fixed an app leak before API readiness and a TERM-ignoring child leak after its detached parent exited. Final cleanup uses exact executable/profile/workspace and PID/start identity, with live process-group anchors. Matching app/child groups are reaped; unrelated sentinels survive; wrong-workspace and unknown launches are refused and their profiles preserved. These fixtures do not establish containment of descendants that escape into an unobserved session. The successful earlier real X11 probe preceded this final cleanup change; fresh native qualification remains pending.

Fresh desktop and publisher-authentication foundation

Clean c756f8a passed formatting, strict workspace/all-target Clippy and the desktop build; the pinned binary is SHA-256 914d99eee9a0ab92d69a8e837841f395765e7ca600588294a18afe9b5ac4586f. The final X11 embedded-worker probe passed against that binary and the current index-BBQpeuSA.js bundle; all tracked app/driver group members exited and its private profile was removed. The separate Wayland outcomes are recorded in UI-04. The full Rust suite initially stopped because the custom target directory was not supplied to its real-process fixtures; the corrected invocation explicitly supplies SHADOW_DESKTOP_BINARY. Preserve that invocation failure separately from application failures and require the complete rerun.

docs/RELEASE_AUTHENTICATION.md specifies the bounded signed envelope, canonical public-key policy, offline verifier and integration boundaries. Independent review reproduced Node accepting a private-key PEM where Bash accepted only public keys; both verification paths now require canonical public SPKI PEM and refuse appended/duplicate blocks, while signing retains private-key support. The integrated helper and release-gate/publication suites pass all 77 tests. The shell verifier needs Bash, OpenSSL 3 and GNU runtime utilities, never executes the candidate, and retains only exact verified snapshots in a new private directory. No production keys were generated or installed. The current installer/publisher still need explicit integration, durable replay state, trusted bootstrap and a separate protected signing job; these helper tests do not make a release authenticated or ready to publish.

The following secret-scanner review reproduced four Ed25519 leaks in disposable Git fixtures: the old PEM-body length threshold missed short private keys, and a zero-context staged diff omitted unchanged PEM delimiters. The scanner now recognizes the 64-character Ed25519 PKCS#8 body and inspects complete changed index blobs, even when the working file is sanitized or deleted. Eight regressions pass, preserving public SPKI/short fake fixture acceptance and checking that diagnostics never print key values. The combined scanner, authentication and existing release suites pass all 85 cases; normal and staged repository scans pass. These fixtures use ephemeral keys and persist no key material in this repository.

GitHub run 36295410486 and the explicit-binary local workspace run both reached the same final observed failure in tester_route_budget: another obsolete arbitrary-command-as-verification fixture. The local run passed 789 tests and failed that one, with seven ignored, before later binaries were skipped. Commit c1f436b configures and asserts a real nonmutating check while preserving the 4096-token limit and eight-second deadline; all five budget tests pass, including context overflow refusal. All four real-engine process/restart/resource tests passed after the desktop path was supplied correctly. A full rerun remains required; separately, the new CMP-04 filesystem-error regression demonstrates a cleanup retry defect that is under repair and is not part of these passing counts.

Explicit sandbox scope and refusal evidence

Settings now identify ShadowCode's built-in command tool as the scope of its sandbox. Background processes, lifecycle hooks, interactive terminals and vendor tools have their different boundaries stated explicitly. Every host-owned background-start approval, including special command classifications, adds the unsandboxed file/network disclosure. Native command results retain the historical requested network field and additionally report network_requested and network_enforcement. Landlock fallback reports TCP-only enforcement only when that restriction was requested and the kernel supports ABI 4 or newer; ShadowCode's V5 rules do not enforce UDP or process isolation. The settings no longer promise full network exclusion when fallback is allowed. This matches the kernel's TCP ABI boundary.

All 20 native-tools/background integration tests pass on the final sandbox source. A new actual ToolExecutor test uses separate subprocesses for missing bubblewrap, a failed availability probe and a failed launch; each refuses without writing the command marker, and the launch case proves only one attempt. Explicitly changing policy to permit unrestricted execution runs the same command once and reports requested network off with no enforcement. These stand-ins verify host refusal/reporting, not Linux namespace or Landlock containment. The initial launch fixture mistakenly relied on a test environment variable that the runner correctly removed; that failure is retained, and the wrapper now derives its marker from its own executable path. Two focused settings tests, production TypeScript/Vite build, formatting and test-transport exclusion pass. Fresh desktop/package and full integrated validation remain required after the concurrent cleanup repair stabilizes.

The subsequent GitHub native run 36296234022 on 985d48f passed the complete Rust workspace step, strict Clippy, desktop build, native CLI/stress/PTY checks, MCP transports and official-client interoperability, native window and embedded-worker checks. The workflow was still running its build/package stages at this checkpoint; it is not a complete green native workflow claim. UI and packaging-script workflow 36296233983 passed. This remote evidence precedes the new local sandbox and quarantine changes.

A separate authenticated-installer prototype passes 23 installer fixtures and 51 authentication fixtures, including actual SIGKILL recovery, legacy schema1 recovery and verified-snapshot execution. Its adapted original suite exercises 17 scenarios and explicitly skips the real-runtime scenario. Production installer/workflow integration, trust bootstrap, signing-key policy, native packages and post-activation/database recovery remain open. These scratch results do not authenticate a production release.

The reviewed Bash parser/signature routines are now shared through scripts/native-release-auth-lib.sh, loaded only from the verifier's trusted script directory. The production verifier retains its command-line interface and verification rules; the installer is not switched over by this extraction. Native CI triggers on changes to the library. All 85 authentication/scanner/release fixtures pass on the integrated helper, with Bash syntax and ShellCheck clean. Installer and publisher policy integration remain separate pending work.

Quarantined cleanup and authenticated publication checkpoint

Commit b4a6550 fixes actual Git disposal failure recovery on Linux. Compare/worktree/task integration passed 43 cases; focused cleanup checks, formatting and strict core/all-target Clippy pass. Independent review caught and corrected original-path replacement and symbolic-ref deletion hazards before integration. The journal retains bounded ownership, Git index/admin backup and surviving-entry evidence; retries never unconditionally delete ambiguous data. Actual subprocess crash recovery uses the journaled quarantine path.

An unchanged optimized full-project fixture passed on 22,501 entries and 4,099,897,035 logical bytes: 2.512 seconds preparation and 6.073 seconds disposal, excluding build/copy time. The final required CI UI scope passed separately on 16,751 entries and 240,440,462 bytes: 0.562 seconds preparation, 2.105 seconds disposal, exactly one executed test and no ignores. These are warm local disposable copies, not cold-disk or universal latency guarantees. The full debug run exceeded the existing 30-second per-walk deadline and safely retained the checkout; its failure remains recorded.

Cleanup still holds the process-global creation mutex during hashing, so unrelated repository creation can wait. Common-directory disposal locks do not yet cover every create/repair/remove caller. Each walk has cooperative cancellation/deadline checks and bounded content (8 GiB/131,072 entries), not an interruptible kernel-IO deadline. Oversized/slow/ambiguous cases remain pending for review. Same-user malicious modification of private quarantine is outside its guarantee. These limits are open work, not covered by the earlier two-project status/cancellation result.

The reviewed publisher implementation and separated release workflow now require authenticated private snapshots and current gate receipts before publication. All 112 integrated release, authentication and secret-scanner tests passed, including mocked interrupted uploads, immutable retries, signer/publication refusal of missing cleanup evidence, and real OpenSSL checks with ephemeral keys. The shared Bash verifier library is committed separately as cb9c880. No production key, public trust, protected environment, release version or published asset changed. Provisioning and tracked-installer integration remain open; the workflow fails closed until required owner configuration exists. Full source/desktop/package/Wayland qualification must use a fresh integrated commit and binary rather than the previous desktop build.

Integrated signed installer and approval reselection repair

The signed installer is now integrated with the reviewed verifier and durable accepted-release state. It resolves its actual trusted bundle directory before loading policy or helpers, rejects --unverified, rejects releases below the fixed authenticated-release boundary, and requires the signed AppImage artifact role before candidate execution. Signed historical receipts support interrupted-install recovery without lowering the highest accepted release. Production trust, private-key custody, public fingerprint distribution and the first signed release version remain unprovisioned; no published asset has changed.

The combined installer, authentication, publication and scanner fixture run passed 144 tests with none skipped. The adapted shell installer suite exercised 17 scenarios successfully and explicitly skipped its real bundled-runtime case because packaging/llama.cpp/bin is absent. That skip remains fatal in required release qualification. These fixtures do not establish clean-host installation, first-window/database rollback, activation-stage recovery or a production authenticated release. README and release notes document the compatibility change and source-build development path.

Fresh desktop source 4970345 passed formatting, strict workspace/all-target Clippy and desktop compilation. The full local Rust run completed 67 test binaries with 903 passing cases, one failure and nine ignored cases. The failure was a nondeterministic cleanup fixture: a newly created directory reused the deleted administration parent's inode, so the deeper content guard refused safely instead of the expected parent-identity guard. The corrected fixture retains a reused allocation before recreating its parent; all 24 worktree integration tests then passed. The original full run remains failed, and the combined source requires another complete run.

Two preserved Wayland runs against the pinned 4970345 binary passed backend connection, embedded-worker/CSP checks, keyboard focus and clean quit. The diagnostic run also passed persisted themes after allowing the actual React render to settle. Resize still returned unchanged dimensions. Cancellation could not begin because selecting the already-selected conversation cleared its pending approval until the 15-second refresh. This actual UI defect is fixed in 415bdcb: the feed owns session-scoped approval state, reselecting a conversation preserves its cards, and changing conversations hides old cards immediately. All 367 UI tests, production TypeScript/Vite build and test-transport exclusion pass. A fresh desktop must qualify the correction before native cancellation can be claimed; clipboard and resize remain open.

GitHub native workflow 36296234022 on the earlier 985d48f completed successfully, including its build/package stages. Checks workflow 36298819187 on 4970345 passed; its separate native workflow 36298819199 was still running when inspected. Neither remote checkpoint includes this installer/UI increment.

Complete source run, live model metadata and terminal readiness

Clean source 7aaea06 passes formatting, strict workspace/all-target Clippy and desktop build. Its complete local Rust run reports 916 passed, zero failed and nine intentional ignores across 67 binaries, with the actual built-project cleanup fixture transferred to its separately required optimized gate. Desktop SHA-256 is de572c94d67db4b42dd6d5234ecb7431f50ac29d3229a017cd57d8ca39acc3fb. The runtime-backed disposable installer fixture now also passes all 18 shell scenario groups with no skips; it uses verified copied runtime bytes, synthetic AppImages and ephemeral fixture keys, not a new production package or clean host.

Native coder requests now retain content-free request/response observations and account complete reported usage from failed attempts once before retry/budget admission. The 74 focused tests and strict core Clippy pass. A fresh bounded Hermes run on the same source reported two 2048-token-capped requests, 10,417 prompt tokens and 43 generated tokens; both responses were accepted, so the failed-attempt accounting branch remains fixture-tested rather than live-qualified. The only tool was system_info, followed by progress-only prose. No file changed and zero of five independent coding cases passed. Stored verification correctly stayed not_run/verified=false. Source review separately identifies a missed progress-only phrase and host information incorrectly counting as workspace inspection; their draft regressions are not implemented or run yet. No model default, template or budget changed.

The fresh COSMIC/Wayland run passed exact UI approval and keyboard cancellation, with one cancelled terminal event and owned-child exit. Instrumentation observed all requested resize calls reach GTK while its window was tiled on all four edges. Matching GTK Wayland source retains fixed dimensions in that state. A separate private Weston 13 headless/Pixman session then passed all seven executed native checks together: backend, worker/CSP, focus, resize 1380→520→1380 with no overflow, themes, approval/cancellation and native quit. All owned app/driver/compositor/bus/helper processes exited. Clipboard remains intentionally skipped, so the full checklist still reports failure; physical desktop input, IME, mixed DPI, performance and packages remain separate. The first floating run's missing-sidebar setup failure and the original quit-parser SIGCHLD false positive remain preserved; neither historical report was relabeled.

GitHub Checks on 7aaea06 passed. Native workflow 36300303104 passed its Rust suite but failed waiting for the real-PTY approval dialog. CI output and an accelerated Node 22.22.3 reproduction show the fixture pressing F4 before the terminal displays its backend-visible approval; the terminal polls every 350ms. The accelerated before/after pair on CI's Node 22.23.2 both passed because readiness could catch up before key handling, so the failure is timing-dependent rather than deterministic. The fixture now waits for the actual rendered pending indicator within its unchanged 15-second deadline, using owned-PTY width changes to request complete ANSI frames. It retains backend identity/no-grant checks and the explicit Deny→Allow→Enter flow. Normal and accelerated corrected runs pass all existing assertions with eight loopback fixture requests using CI's Node 22.23.2 and the pinned desktop. The applied repository script also passes locally with seven fixture model requests on that exact binary and Node version. A new GitHub run must still validate this correction.

A separate timeline presentation fix has 389 passing scratch UI tests and TypeScript validation: cancelled/stale/incomplete checks no longer receive green completion icons, and ordinary successful commands remain unverified without configured-check receipts. It is not yet integrated or natively qualified. The reviewed worktree-lock refactor also remains scratch-only and uncompiled. These prepared changes and the full original acceptance specification remain open work.

Truthful execution evidence and fresh native qualification

Commits e9f6a1d and e66f356 integrate neutral cancelled/stale/unverified timeline states, retained failed tool attempts, and separate host/workspace inspection evidence. An arbitrary successful command cannot establish configured-check verification. A reproduced current-action progress phrase no longer completes authorized coding work; cumulative retry limits remain bounded, and prior shell commands are not replayed. Baseline completion regressions failed before correction; 389 UI tests, production TypeScript/Vite build and bundle exclusion pass.

The complete local workspace at e66f356 passed 929 tests, zero failures and ten ignores across 67 binaries. The actual built-project cleanup ignore belongs to its separately required optimized gate. Later production fixes e804e83 and b66bb0e remove duplicate command-job user prompts and redact complete recognized private-key PEM payloads. The command regression verifies one stored/rendered prompt per job through history/reopen, while two explicit jobs still execute twice. Later combined validation passes 421 native tests with three ignores, plus five real-process recovery tests without ignores, formatting and strict workspace/all-target Clippy. This is scoped later validation, not a full-workspace pass on the latest source.

GitHub d295a03 Checks passed but Native failed a crash-fixture counter assertion compatible with a request-observation race. d832dfc makes the concurrent bounded fixture observe the complete held request before SIGKILL and includes a third-request replay negative control. All five real-process tests pass against the fresh desktop. GitHub e66f356 Checks failed one stale browser expectation after the other 49 passed; fd39f5a requires the correct neutral unverified status while preserving command-output assertions. The corrected complete browser suite passes all 50 cases. Remote Native 36302732737 was still building release examples when last inspected; no full latest GitHub success is claimed.

The fresh desktop at d832dfc, rebuilt unchanged at fd39f5a, has SHA-256 4186ce5ef05c810d8f7cc4e26b67530d9146e272e883c51202c25490082070bb; main UI hash is fda7a6726a7958fcaceef5e4b599a77c682d7c54b38248ae8d949108b46e52d4. The headless Weston copy action caused a real SIGSEGV following missing-keyboard-seat GTK warnings; no usable backtrace was available. A separate run with clipboard skipped passed seven executed stages and proved neutral cancellation status and one user prompt both live and after reload. Its full checklist remains failed.

A subsequent private authenticated Xvfb/Weston-X11 setup supplies a virtual keyboard/pointer seat while the app remains an actual Wayland client with DISPLAY/XAUTHORITY removed. Its first readiness attempt failed before app launch because xdpyinfo emitted 83,619 bytes beyond the fixture's 65,536-byte bound. A private-display-only diagnostic reproduced ENOBUFS; a bounded 1MiB capture passed unchanged display assertions. The corrected full run run-R7ZOLG/probe/run-8nwk66 passed all eight stages including the original keyboard clipboard round-trip. Pins remained unchanged; app/driver/compositor/bus/Xvfb/helper cleanup completed, authentication bytes and private profiles were removed, and logs were bounded/drained. The prior failures were not relabeled. This qualifies only the documented private virtual-seat setup and does not complete UI-04.

One unchanged-budget/template Hermes coding run on clean d832dfc made two accepted requests with caps 2048 and 1740. Usage was 11,790 prompt plus 1,388 completion tokens, 13,178 total. Three edits failed; one real command ran five tests with five failures. Successful system_info and search_code correctly produced both inspection scopes. Files/tests stayed unchanged and independent grading passed zero of five cases. Final prose falsely claimed edits and misstated counts while acknowledging failure; durable verification remains not_run/false with execution_failed=true. All 26 INET connections were loopback; three host system-bus AF_UNIX connections are recorded separately. Normal runtime shutdown and prior artifact preservation passed. This run exercised neither follow-through retry nor failed-attempt accounting, and does not establish model quality improvement or eligibility as a default.

That run exposed a further deterministic defect: redaction collapses distinct provider tool IDs to one placeholder. Synthetic replay proves wrong receipt output and swapped path/output association for reverse-completing reads; source inspection also finds TUI upsert collisions. Native executions now receive fresh engine-owned IDs for events, approval decisions and receipts, while model replies preserve their protocol IDs. Receipts bind directly to the emitted completion event. New identity cannot reconstruct missing historical associations. The worktree/task lock refactor and diagnostics preview/export remain in preparation. Production trust/signing, clean-host artifacts, database/activation rollback, complete provider conformance and all remaining original acceptance cases are still open; the flagship goal remains active.

The identity repair reproduces two native correlation failures before correction and passes a combined 463 native tests with three existing ignores across six binaries: core library, engine tasks, model streams, native tools, permission modes and MCP application. Tests cover secret-bearing/reused provider IDs, concurrent reads, restart, manual/automatic alias approvals, and exact receipt completion ownership. Provider IDs still belong in the private model protocol tape; no claim is made that all stored data omits those IDs. Vendor CLI identity and ACP permission association remain separately scoped.

Decoder review additionally reproduced two malformed-response execution paths: distinct indexed calls sharing an ID wrote both files before later context rejection; unindexed object arguments sharing an ID coalesced and wrote only the second file. The decoder now refuses duplicate response groups before exposing any executable calls. Same-array detection is retained until finish so later usage frames remain chargeable; valid continuation fragments and cross-turn ID reuse remain supported. Regressions preserve the original failures and prove zero writes, unchanged unrelated files, one charged failed attempt and durable restart evidence.

Browser commit 38d677a retains completion event IDs and resolves receipts only to an exact same-task exec completion. Missing/invalid explicit references cannot fall back to a possibly reused call ID; legacy fallback requires one non-redacted candidate. Historical ambiguous completions stay separate from unmatched starts rather than inheriting a false path. Event-derived row keys remain stable through streaming and unique on replay. Seven failing baseline UI assertions now pass. All 401 UI tests and production build/bundle checks pass; the full 50-case browser suite passed before the final non-string-reference guard, whose three additional tests and later production build pass. Historical TUI/ACP placeholder damage is not retroactively repaired.

At clean 3ea99d3, the fresh desktop SHA-256 2c402008be00650b66e6b1f1ab4504018f388949d93de5653463114075de8e60 passed five real-process recovery tests, the actual PTY suite and all eight private virtual-seat Wayland checks. The final native run retains same-WebView clipboard success, neutral cancellation through reload, unchanged pins and complete owned-process cleanup. It does not qualify physical desktop or packaged behavior. GitHub Checks on 3ea99d3 passed; the earlier complete Native workflow on e66f356 also passed including packages.

The subsequent full local 3ea99d3 Rust run passed 376 cases and failed one, with four ignores across six completed binaries; later binaries were not reached. autonomy_021::provider_chaos_does_not_invent_output still expected a response with duplicate IDs to succeed. An isolated execution reproduced that exact stale assertion. Its correction requires duplicate rejection and explicitly verifies that a distinct two-call response, valid fragmentation and missing-ID synthesis still work. The corrected exact test, strict target Clippy and formatting pass. Only this test and the ledger changed after the fresh desktop qualification; production bytes are unchanged. A new full-workspace run remains required; the failed aggregate is preserved.

Repository-scoped worktree ownership and live task boundaries

Core worktree mutations now serialize by canonical Git common directory, with a stable advisory lock shared across processes. Short profile admission retains the 64-record bound while allowing unrelated repositories to proceed. Creating/failed records remain durable recovery reservations. Task metadata uses repository-then-record locks; record-only reads and stopping remain possible when a source disappears. Failed startup cleanup retains its task/recovery link for retry.

Discard reserves engine admission before cancelling and joining every unfinished job in the checkout, including queued turns and child jobs. Child admission honors the same reservation. The reservation remains held through filesystem cleanup and session relocation. Background processes are separately checked and reserved; a live background process keeps its checkout until stopped. Missing checkout reservations use a canonical existing parent and normalized final component. Compare cleanup and result application use the same background boundary.

Keep/Apply validate live source, checkout root, common directory, Git administrative directory, registered branch and managed base before staging. A switched user branch or foreign Git pointer is refused without changing its index or HEAD. This covers observed pre-existing identity changes and cooperating app jobs; it does not make external Git/editor activity obey ShadowCode's reservations.

Validation at this increment: core and task global-lock regressions each failed before their respective fixes. Five additional before failures reproduced task/Compare commits on a changed branch, a foreign Git directory commit, active-A/queued-B removal, and active-background removal. Afterward 27 worktree unit tests passed (one separately required optimized cleanup case ignored), plus 19 Compare, 3 task and 26 worktree integration tests. Held original-checkout scans prove new command/background admission is refused before rename; failed initial admission → failed abandonment → cleanup retry is exercised. Strict workspace/all-target Clippy and formatting pass; the 34 existing vendored GLib warnings remain. A Compare recovery test failed once in the first aggregate and passed in the subsequent full integration run. A separate deterministic index-timestamp experiment reproduces missed same-stat file edits; its production correction is the next increment. These results do not replace fresh whole-workspace, optimized built-project, native-window or package qualification.

Preserve Git's racy-index detection when capturing a working tree

Snapshot creation now copies the index from one open source handle and retains its original modification time. Git uses that timestamp to decide whether cached file metadata is trustworthy; a fresh timestamp on the temporary copy could hide a same-size edit and produce a stale snapshot. Copy/timestamp failures now fail rather than quietly claiming a captured source index. The existing split-index fallback remains unchanged.

A deterministic regression configures coarse stat comparison, creates a racily-clean index entry, edits bytes while retaining size/mtime, and includes a force-added ignored file. Before correction the captured content was before instead of after!; afterward the exact edit and force-added content are present, while source index bytes/mtime, HEAD and working bytes are unchanged. This reproduces the stale snapshot defect independently of the earlier intermittent recovery assertion; it does not prove the precise timing of that historical failure. Fresh combined workspace and optimized cleanup qualification follow this commit.

Manual file editing with live revision review

The Files panel previously rendered only a 12,000-character read-only preview. It now opens complete UTF-8 files within the existing 4 MB workspace limit for manual editing. A save requires the exact hash returned when the file was opened or explicitly reviewed, plus the project's existing trust, permission and mutation reservation. The native route preserves executable mode and does not stage or commit. Its revision read uses a nonblocking, no-follow confined file inspection; a symlink or nonregular replacement cannot make the editor's polling read hang. A deleted file can be recreated only through an explicit action using the missing revision, which fails if another writer has recreated it first.

Open files keep separate drafts in app memory across drawer tabs and project switches. The active editor checks disk revision periodically and on focus. If an agent or external editor changes the file, the draft remains intact and Save is disabled until the user reviews the original and current disk versions and chooses the disk version or explicitly adopts its revision as the new save base. Files that are deleted or become unreadable have separate states. Closing a dirty file hides its editor but keeps its draft; browser navigation or native window close asks before losing unsaved work. Tab indents text or selected lines without replacing them, Shift+Tab outdents lines, Escape returns keyboard focus to the editor controls, and Ctrl/Command+S saves.

The new native integration test proves stale-save refusal, read-only and trust gates, missing-file recreation, no staged-index change, executable-bit preservation and no-follow revision reads. The browser fixture exercises the rendered conflict/review/save path; the complete UI run passed 402 unit tests and 51 Playwright cases, with production build and test-bundle exclusion also passing. This is a functional first editor, not yet a full IDE-grade editing surface: syntax support, long-file latency, crash/restart draft recovery, physical-desktop qualification and the rest of CMP-08's index flags remain open. External processes that ignore ShadowCode's workspace reservation can still race a filesystem write after its last hash check.

The broad Rust workspace pass started before the final editor read-path revision and was not accepted as final qualification. It exposed one response discrepancy in a concurrent worktree discard fixture: the first response carried an in-memory timestamp while a repeated acknowledgement had traversed JSON persistence and differed by one f64 ULP. Discard now reloads the persisted record before returning, preserving the strict whole-record idempotence assertion. Three real-process fixtures also failed to start because the local qualification command omitted SHADOW_DESKTOP_BINARY while using a custom Cargo target directory. Those are command-environment failures, not demonstrated application regressions. Fresh exact-source native qualification is required before claiming a complete workspace pass.

Profile-backed editor draft recovery

The next increment adds bounded editor recovery records to the existing profile SQLite store (schema 27). A record contains the project-relative path, original text and hash, current unsaved text, a random record revision and timestamp. It does not write source files or stage Git changes. The profile database is private to the local app; remote clients cannot call the recovery routes. Records are limited to 32 per project, 32 MB of text per project, and the editor's existing 4 MB limit for each original/draft. Writes and deletes require the previous record revision, so a second window's newer draft cannot be silently replaced or removed. Requests also carry the selected project identity, preventing a queued write from following a project switch.

The UI restores acknowledged drafts after window reload, keeps the existing disk-revision conflict review, and reports whether the latest recovery copy has finished saving or failed. A new rendered browser case proves a draft survives reload and is cleared after a successful file save; the existing rendered conflict/save case also passes. The native service test closes and reopens the profile to prove the draft survives restart without touching project bytes, refuses stale overwrites and deletes, and checks project separation and path confinement. A migration fixture starts at schema 26 and opens the new table; the remote policy has a focused refusal test. These are focused passing results pending full current-source qualification.

Recovery is acknowledged per completed write, not per keystroke: an in-flight edit at a hard crash can be lost. A failed recovery write remains in UI memory with a visible warning. Discard waits for an in-flight recovery write and confirms record deletion before clearing the visible draft; the rendered delayed-write fixture exercises this ordering. Closing a clean file also waits for pending recovery cleanup, keeping its retry control visible on failure. A crash between an actual file save and deletion of its recovery record can leave a stale copy to reconcile on reopening; the active editor detects identical disk content and clears such a copy when opened. A failed post-save cleanup is visible and retryable. At this earlier increment, multi-window review after a CAS refusal and exact preservation of the last in-flight keystroke remained open; the later UI increment below addresses the reviewed CAS path. This increment does not close all editor recovery or CMP-08 acceptance work.

Queued recovery snapshots now skip a write if a newer edit or deletion superseded them while an earlier write was in flight. The last draft still writes through the revision-checked API, and discard still waits for the write chain. A rendered test delays the first request, makes two more edits, and confirms that only the first and final drafts are sent and that the final recovery record is saved. The complete UI run passes 405 unit tests and 55 browser cases, plus production build and fake-transport exclusion. This reduces redundant full-file writes; it does not promise that every keystroke is durable or remove the need for measured large-file latency testing.

A competing window's recovery-record revision now opens an explicit saved-draft conflict in the editor. The local text remains in place while the other saved text can be inspected. Choosing the local copy refreshes the record revision before retrying its CAS write; choosing the saved copy adopts its text and base. If the other record changes again during review, the choice is deferred and the newer version is shown. Disk Save and Discard wait for this decision. A rendered test exercises both choices and the second-change race. At this source, 405 UI unit tests and all 56 browser cases pass, along with production build, bundle exclusion, type checking and formatting. This resolves the tested multi-window recovery conflict path; simultaneous filesystem edits remain subject to the separate disk-revision review, and physical multi-window desktop behavior has not yet been qualified.

Recovery revision after file Save

An exact-source private Wayland/WebKit check of the preceding editor change exposed a false saved-draft conflict: after a successful file Save removed its recovery record, the next edit reused the removed record's old revision. The retained failed run showed the local text and a message that the other saved copy had been removed; the private profile database contained no recovery record. The editor now starts a newly created recovery entry with the required missing revision, and a completed deletion clears the obsolete buffer revision without clearing a newer in-flight draft. A rendered save-then-edit regression proves a new recovery record is saved without a conflict. The complete local UI pass is 405 unit tests and 57 browser cases, plus production build, test-bundle exclusion and formatting.

At commit 99cbdc0, a rebuilt native desktop (SHA-256 509dec40fe87d1535d6ae17bca4f7b62e67c3c452c8aad60c32ae50456ec9f0f) passed twelve pinned private Weston/Xvfb Wayland checks. The new check starts with a file Save, edits again, then uses the real native API to act as a competing profile writer while the WebKit editor is open. It proves the saved competing text is visible, Save is blocked pending review, keeping the local draft writes through the new record revision, adopting the second competing draft preserves its text, and explicit Discard removes the record. The earlier repaired-code attempt stopped on a fixture JavaScript selector typo after a screenshot confirmed the actual conflict; the corrected one-time fixture passed with unchanged source/binary/probe pins and complete private-process cleanup. This is native single-window UI plus a competing service writer, not a two-window or installed-package demonstration.

Runtime-only clean-host package gate

The native CI workflow and required release verification now build a pinned Debian 13 image with the package runtime libraries, Git and a virtual X11/DBus test display, then run both built packages with container networking disabled and no repository, Node, Rust or compiler. The new gate checks the generated SHA256SUMS before mounting either artifact. It extracts the AppImage as an unprivileged user, installs the .deb with dpkg into a disposable container, checks its launcher/icon metadata, and runs each packaged CLI against a fresh isolated project/profile. The JSON status must show the exact project, offline policy and no jobs. Each exact package also performs an MCP stdio initialize/tool-discovery round trip with the fixture client waiting for the initialize reply before requesting tools. Each package opens a visible ShadowCode window in an isolated first-run profile within 55 seconds; the probe checks that the app process is still alive and the window has nonzero width. The release receipt binds this check to the exact package hashes and fails if a required clean-host check is omitted or fails. These steps supplement the existing in-runner package, CLI, native window, MCP, runtime and installer gates. On 2026-09-28 the gate passed against AppImage SHA-256 6721739fac7ed22a4d4daf071ab68904379a20a32da9210e76a5b489dcce3e40 and Debian SHA-256 475ad89b93c1528c0856a6ee0a30145e92f5b7e64f5c94a71762e9d77b457fc7. Those local packages predate the current uncommitted source edits, so current-source packaging and frozen-commit release receipts remain outstanding.

The gate was exercised locally against the immutable 61fbf7b Native workflow artifact: AppImage SHA-256 11e0fbd4befe9d7ffe6ccaa6b54e1e4e66603b00edd29fe7865bcd85d0da1a25, .deb SHA-256 f41acea7e467ccab0ad78588e240685d1f1127c152ce0126b42809bcda01f431. Both passed the offline CLI and visible first-window checks in the pinned Debian 13 container. The first bare-image attempt failed at missing ALSA, and an ALSA-only image then failed at missing FriBidi; installing the declared runtime stack closed those environmental dependencies. This demonstrates packaged CLI startup, metadata and a first X11 window on one clean runtime distribution, not GUI interaction, physical Wayland, local inference, model downloads, activation rollback, or a current-head signed release.

The later pushed 417326f Native workflow completed successfully, including its packaged CLI, terminal, native window and MCP checks. Its downloaded AppImage SHA-256 535c41d74193323a6e5db888422cb6c4f09e0c2dec0ffde52a92fdfff5537d3c and .deb SHA-256 510d6eb0cc477b35190129db984917ff92a32784d6546db931faba4a2b1e0a75 both passed the newer offline clean-host CLI and first-window gate locally. The gate itself was added after 417326f, so that GitHub run did not execute it; local-only commits still require exact-source CI and package qualification.

A visual inspection of that older packaged AppImage showed the real first-run project/permission screen and, after an isolated “Trust and open” click, the main workspace and composer. With no model selected, the welcome screen now offers a direct “Choose a model” action into the existing unified picker. The App integration and rendered browser paths open the picker, select a ready Codex row and enable Send; 405 UI unit tests, the focused browser case, production bundle exclusion and the TypeScript/Vite build pass. This local source change has not yet been qualified in an installed package, and it does not provision any provider login.

An open picker now offers Refresh models, forcing a read-only vendor reprobe while keeping the search available. A component test covers pending state and focus, and an App integration test confirms the exact /api/picker?refresh=1 request. The manual file editor now indents selected lines with Tab and outdents them with Shift+Tab without destroying selected code. Its component and rendered-browser tests pass. At local commit aad3b4e, the complete UI suite passes 408 tests, the production build and fake-transport exclusion pass, and the focused browser indentation case passes. These source changes have not yet been pushed or qualified in an installed package; syntax-aware editing and measured large-file performance remain open.

Real three-model Compare cancellation

The opt-in live_three_model_compare_cancels_queued_models test used the installed Qwen3 4B Instruct Q6_K, Qwen3 8B Q8_0 and Qwen3 14B Q4_K_M files with the pinned real llama-server. A temporary user/network namespace had loopback as its only enabled interface; the test used an isolated profile and Git project. It observed the first model stream, cancelled the comparison, and recorded all three jobs as cancelled. The queued models each recorded zero model requests, no loading phase and no local.runtime_ready event. The final local receipt is artifacts/live-local/three-model-cancel.json (ignored build evidence). The focused live test passed in 5.94 seconds. The full local_engine integration binary passed 20 fixture tests with three opt-in real-model tests ignored when rerun with loopback access; its first sandboxed attempt failed 13 tests because port reservation was denied before application behavior could run. This qualifies cancellation of an active three-model local Compare, not complete generation by all three, packaged-app inference, an independently traced network audit, or repeated hardware-resource measurement.

Real packaged inference without development tools

scripts/probe-clean-host-gguf.mjs APPIMAGE DEB INSTALLED_GGUF is an opt-in Podman qualification for an already installed small model. It binds that model read-only and runs the exact packages in separate disposable Debian runtime containers with --network=none. The AppImage runs unprivileged; the .deb is installed with dpkg before its CLI runs unprivileged. Both containers check that Node, Cargo and Rust are absent. A fresh isolated profile enables only offline local routing, then the probe inspects the model catalog, executes one read-only explanation task, and requires one local.runtime_ready event from the package's bundled CPU runtime with no fallback, one local model request, a completed result and honest not_run verification. It saves each event stream and a hash-bound summary under ignored artifacts/live-local/clean-host-gguf-*.

The local run against AppImage SHA-256 958d65b843cef1da4ea7d6363c319f4374973601613e86c4194848822d660d45 and .deb SHA-256 096929664238a3818a2fa040bd486af2f097ee19c99c1e2288e262a0f30ebc0a passed using Qwen2.5 0.5B Q4_K_M (491,400,032 bytes; SHA-256 74a4da8c9fdbcd15bd1f6d01d621410d31c6fc00986f5eb687824e7b93d7a9db). Both responses correctly described addition. The first probe implementation rejected the valid wording return a + b; its sanity check was corrected to accept that form, and the complete rerun passed. This is actual packaged CPU inference on one Debian 13 container image, not a production signed release, real tool-using coding evaluation, installed GUI inference, or physical COSMIC acceptance. The model is user-installed and is not downloaded by the probe or bundled in the packages.

Three-model offline Compare completion

The opt-in live_local_acceptance_from_explicit_models test now requires each completed local lane to record its own runtime-ready event, exactly one model request, the selected model file's provenance, no automatic CPU fallback, and an unchanged source project. In a temporary user/network namespace with only loopback enabled, the source-built test binary used the pinned llama-server (SHA-256 667fa3f95bf534e85cdbab337b4b7c2f528de67e4ec1f643d5871c2b19e59df8) and three previously installed files: Qwen3 4B Instruct Q6_K (cd7b21b38b3e71400587c184b6a9b04d3beb4d13fdae6464d4075dee4f1bc5ad), Qwen3 8B Q8_0 (d87f4a5a2f1a6051d9fac010c12f76f3ba2137b137d413ba8f4d3a3d06b3a25b), and Qwen3 14B Q4_K_M (a8cc1361f3145dc01f6d77c6c82c9116b9ffe3c97b34716fe20418455876c40e). The full-content SHA-256 checks matched those file identities. All three jobs completed a simple Python addition-function explanation with one request each. Their recorded execution windows were sequential, each reported Vulkan with a 4,096-token context and no CPU fallback, and the test completed in 17.58 seconds. The ignored local report is artifacts/live-local/three-model-compare-strong.json (SHA-256 88cf29b47e113384cde8f03c5b3e424e182984e62dbea6dbba07f0e69d2d4699). This proves one source-built, offline, three-lane inference run and the tested invariants; it does not establish coding/tool-use quality, repeated performance, packaged GUI inference, or production release readiness.

Redundant inspection during local coding

A fresh run of the existing five-case Python repair evaluator on Qwen3 8B Q8_0 with current source failed without editing: nine successful read/search observations consumed the 50,000-token task budget, no model-run check occurred, and all five independent cases failed. The engine correctly recorded failed and verified=false. The ignored report is artifacts/live-local/qwen8b-coding-current.json (SHA-256 6c002e0a5e6d3dc5a2942428b45cf4d01ed93fd8fb7fd6b05d214a2b8142070d).

The engine now gives one bounded process note after three consecutive redundant reads or searches of a file it already read completely. It still executes and records every requested tool; successful mutations reset the observation record. In one repeat of the same isolated, loopback-only evaluator, the note was recorded and Qwen3 8B made one successful edit. Four independent cases then passed, while the unhashable-list case errored; the model still exhausted the task budget before running its own check. That ignored report is artifacts/live-local/qwen8b-coding-observation-note.json (SHA-256 760f32097c11478774abf745b4140cf24f3a58ab463bcac95df0a487e1d461d7). This pair of stochastic model runs does not establish that the note caused the improvement, that Qwen3 8B is qualified for coding, or that the app should change its default model. The focused observation-state test, 12 fake-provider model-quality tests and strict all-target core Clippy passed; the first model-quality attempt failed at sandbox-denied loopback socket creation before application behavior, and its authorized rerun passed.

Composer controls fit at ordinary desktop widths

CONFIRMED: reviewing the real packaged WebKit screenshots at 1360 pixels exposed Compare and Send extending beyond the composer panel, with the model and effort controls competing for space. The old layout forced one row whenever the composer exceeded 700 pixels; the existing compact-page overflow check did not detect this. A new rendered regression failed on the original CSS because Compare and Send were outside the panel.

The composer now wraps according to available space at every width, hides its shortcut hint below 1000 pixels of composer width, and keeps the final action aligned to the right. The existing compact picker row and permission labels retain their behavior. Two browser cases check control containment and pairwise overlap for local and subscription rows at 520, 760, 900, 1024, 1280, 1360 and 1440 pixels. The native desktop fixture now also checks idle, running/Stop and compact control bounds.

Validation: all 408 UI unit tests and 60 browser tests pass, the production build excludes the fake transport, and the rebuilt native WebKit app passes its 16 desktop scenario groups including the new bounds assertions, accessibility, consent cancellation and owned-child cleanup. The corrected native running-task screenshot was inspected. No live cloud task ran. Packages at preceding commit 0445783 passed the full packaged-behavior gate after supplying the missing matching WebKitWebDriver, including CLI, TUI, desktop and official TypeScript v1/v2 MCP clients over stdio/HTTP; those package bytes do not include this CSS fix. Full source and installer gate attempts made during concurrent disk-heavy checks hit existing deadlines; the two worktree cases passed in their unchanged 12-test focused suite, and the timed-out installer fixture passed alone in 39.5 seconds with its unchanged 120-second deadline. Full isolated gate reruns and new package qualification remain required.

The subsequent isolated native-source and installer gates both passed at 2dce4b6, including the default Rust suites with zero required skips and all 34 installer authentication/recovery cases. Ten explicitly optional live/hardware tests remained excluded. No deadlines were increased. Final package qualification still remains open.

Live pause and resume state

CONFIRMED: the conversation classified paused tasks as active, but its durable event reader omitted paused from that classification, emitted job.done, and closed the stream. The hook also ignored saved active-job status changes, so Pause/Resume controls could remain stale. Three new unit regressions failed on the original behavior.

The reader now shares the active-state classification with the conversation and checkout queueing. It emits status changes from the saved job snapshot separately from durable transcript rows; paused tasks retain polling and notification recovery. Snapshot cursors do not advance transcript replay. The conversation accepts matching active snapshots, rejects completion messages for active or different jobs/sessions/tasks, and completes only after the stream drains the terminal task's events. New conversations in a checkout with a paused task continue to queue behind it.

Validation: all 411 UI unit tests, all 61 browser tests, the production build and fake-transport exclusion pass. The browser suite includes the paused-checkout queue regression. The rebuilt native WebKit app passes 17 scenario groups, including actual engine Pause → Resume → Stop transitions with saved-job and visible-control assertions, accessibility and owned-child cleanup. The paused screenshot was inspected. This native fixture uses a scripted local runtime; no live vendor task ran. These source changes are not in the previously qualified package bytes.

Complete working-file capture with Git index flags

CONFIRMED: the new snapshot regression captured base instead of a user's working edit when the tracked file had Git's assume-unchanged flag. Compare and write subagents share this capture path, so their isolated checkout could start from stale bytes. The source index copy carried optimization flags into git add --all.

Capture now clears assume-unchanged in the temporary index and clears skip-worktree only for paths present on disk. Absent sparse paths retain their indexed contents. Git stages the temporary snapshot with sparse updates enabled. After flag normalization, the temporary index retains the original timestamp so same-stat edits still receive Git's racy-index checks. A failed copied-index operation no longer silently rebuilds from HEAD and loses staged state. The source working files, index and HEAD are preserved.

Validation: two focused snapshot tests pass, covering ordinary/split/sparse configurations, present hidden edits, absent sparse content, intent-to-add, staged versus unstaged bytes, force-added ignored files and same-stat edits after temporary flag normalization. All 20 Compare integration tests, eight subagent tests and strict all-target core Clippy pass. The new full-service case checks both lanes, Keep, and reopening with byte-identical source index and unchanged HEAD. Its first run reached the reopen check while the test still held the first service's profile lock; releasing that service fixed the harness, and the full rerun passed. These are Linux core-service fixtures, not new packaged-window, unsaved-buffer or live-provider qualification.

Fresh AppDir launcher normalization and current package evidence

GitHub Native run 36347913222 at approved source 2dce4b6 compiled and bundled its first AppImage, then failed because desktop-entry normalization called readlink on a regular file. A new regression reproduced that EINVAL. Normalization now accepts either the expected relative symlink or a regular copy with identical launcher contents, then produces the reverse-DNS launcher/link. Unexpected links, differing files and directories are rejected before modifying either launcher. Six metadata regressions and all 18 focused packaging/runtime tests pass. A complete fresh bundle and GitHub rerun of this fix remain required.

Packages built at 5eed56e passed the offline Debian 13 clean-host gate and full packaged-behavior gate with no required skips: 21 CLI groups, terminal PTY, 17 native desktop groups (including pause/resume), MCP HTTP and official TypeScript v1/v2 clients over stdio/HTTP. The packaged paused screenshot was inspected. Both package formats also completed real CPU inference with the installed Qwen2.5 0.5B GGUF in network-disabled runtime-only containers, with bundled runtime origin and no CPU fallback. Evidence: artifacts/live-local/clean-host-gguf-vcljnH/result.json. This small explanation probe proves packaged inference, not tool-using coding quality, physical Wayland or GPU behavior.

Exact AppImage SHA-256: 4de32d0ef2a2e40b379a3bbfc49ce77c90331705408f53fdbe93eb62e647e3cb; Debian SHA-256: 9e7e06bee4f0288622209a57be3c724992a9f3f63d450d612abd2a83f6cf991f. These bytes predate the launcher-source correction and subsequent provider work. The required packages gate still failed: eight simultaneous private extractions exceeded its unchanged 20-second deadline, including an isolated rerun. A separate diagnostic found correct output/exit from all eight after 33.6–34.5 seconds. It does not replace the failed gate. No concurrency, timeout or host dirty-page setting was weakened. Release readiness remains unproven.

Refuse incomplete AppImage extraction after output errors

The pinned runtime ignored fwrite, fflush and fclose failures and could proceed toward payload execution after incomplete extraction. The new fault harness passed only two of nine scenarios before correction. Patchset isolated-extraction-v2 checks all three results, closes the stream exactly once, and returns through existing owned-directory cleanup on failure. It retains private extraction ownership and signal behavior.

The required native/release package checks now compile mechanically extracted functions from the hash-verified, patched upstream source. Nine scenarios pass: normal payload execution, short/zero writes, flush/close errors, combined errors, actual /dev/full output in two buffering modes, and cancellation. Failure cases attempt no payload, remove their owned directory and preserve a sibling sentinel. This is a synthetic SquashFS reader with real stdio, not a complete disk-full AppImage acceptance case.

The full pinned Docker/musl runtime builds successfully: SHA-256 a21842c1c0dd594f9dd3b7cae7eae8d8ff6884400395e7cd0de213353a763669, input hash 2d3b95515f0a81da0cb2224a3446e7d5cececfcd25d10b8deebb882c4a5f1e2b. All nine fault scenarios also pass against the built image's actual patched functions and musl library in a network-disabled, read-only container. All 54 release-verification/staging/signing tests pass; workflow YAML parses. Full packages have not been rebuilt with this runtime. The separate concurrent-extraction performance failure remains unresolved.

Bound login output draining after the CLI exits

A browser/helper retaining a login CLI's output pipes could keep sign-in running indefinitely: the old post-exit drain restarted a 300 ms timeout for every line and did not observe cancellation or the original deadline. Three fake-CLI regressions failed before the correction; ordinary delayed tail output already passed.

The drain now has one fixed 300 ms budget, prioritizes cancellation and the original login deadline, and closes its owned output readers afterward. It does not signal an independently opened browser. Four final fake-CLI cases pass, checking parent reaping, continuous inherited output, cancellation/deadline, redacted delayed tail output, closed readers, surviving helper and exactly one terminal event. The tail fixture uses an explicit release barrier after parent reaping to avoid a timing race found in independent review. The combined auth/account suites pass 19 tests and scoped strict Clippy passes. No real account was used.

This bounds output draining only. The existing subsequent catalog refresh remains separately timed and uncancellable; Antigravity's separate authentication path is unchanged. Packaged login and real-provider acceptance remain open.

Keep unknown CLI billing distinct from subscriptions

Two fake-Codex regressions proved that a successful boolean login-status fallback after structured app-server failure was labeled as a subscription, including reuse of an earlier account's plan allowance. Authentication alone now establishes only readiness. Missing or unrecognized Codex account modes produce explicit unknown billing and no current plan percentage; confirmed ChatGPT and API-key modes retain their existing behavior.

An additive billing field reaches picker and account responses. The UI displays unknown/API-key warnings in rows, selected model badges, Accounts and the matching pending consent destination. Mixed vendor groups use a neutral heading rather than claiming every CLI login is a subscription. Routing, the existing direct-API route classifier and explicit Cancel/Send actions remain unchanged. This is a cached account observation, not fresh-at-send billing authorization; a removed catalog row cannot supply warning metadata.

Validation: 15 fake vendor-account tests and four login tests pass, with scoped strict Clippy. Five UI regressions failed before the display correction; all 49 focused UI tests and the complete 416-test UI suite now pass, along with TypeScript, the production build and fake-transport exclusion. Independent source review confirmed consent uses its stored destination model rather than the current composer selection. No real login, paid request or billing fallback ran. Complete package qualification of these source changes remains open.

The full native-source gate at 71e694a passed strict workspace Clippy and desktop compilation, then exposed an older quota unit fixture that supplied rate-limit numbers without an account identity. That fixture now explicitly identifies its known ChatGPT subscription and also checks that absent/unrecognized account modes cannot expose the same quota. All 371 default core unit tests pass afterward, with two optional voice exclusions and the built-project-cleanup fixture still assigned to its separate required gate. The failed full-gate receipt is retained; the remaining workspace integration suites are not covered by this focused recovery run.

Match ACP discovery to execution protocol support

Discovery previously accepted missing or unsupported ACP versions and could show Ready/Vision even though execution rejected the same runtime. Three new fake-provider regressions failed before the fix; two authentication/fallback controls already passed. Discovery and execution now share the exact supported integer-version check. Discovery rejects incompatible initialize responses before accepting capabilities or sending authentication/session requests. A typed incompatibility also prevents Grok's model-list fallback from restoring Ready; ordinary probe failures retain their existing fallback behavior.

Validation: 55 focused tests pass across the new five catalog cases, existing adapters, accounts, transport and fake Antigravity flow; one pre-existing live Antigravity opt-in remains excluded. The checks include invalid/missing/string/float versions, stale Ready/Vision removal, authentication-required versus unavailable states, and no fallback invocation after observed incompatibility. Scoped strict Clippy passes. This is protocol-fixture evidence, not a live provider update or new package qualification. Catalog freshness/backoff, historical model names and Grok's separate image restrictions remain unchanged.

Preserve native inspection evidence after task failure

Five new regressions reproduced lost workspace observations when a model failed before its final verification summary or an active task was recovered after restart. The live engine and durable assessment now share the existing inspection-tool allowlist. Recovery projects only successful allowlisted tool names and latest event IDs for the same outer task, after its latest host-generated native start. Vendor tool reports, string/numeric success values, forged payload task IDs, and observations from other tasks cannot supply this evidence. Host inspection remains distinct from workspace inspection.

A later completed summary is preserved unless newer evidence requires reconstruction. Reconstructed unfinished results retain command receipts and custom fields but remain unverified, with no red/green claim. Historical saved terminal results are not migrated. Validation reproduced five failing baselines, then passed 375 core unit tests, 54 engine-task tests and 20 foundation tests, plus formatting and strict all-target core Clippy. Three existing core exclusions remain: microphone capture, a Whisper model, and the built-project-cleanup fixture assigned to its separate required release gate. The loopback integration confirms successful map/read/search before a model error, persistence across reopening, and no evidence leakage to a follow-up task. No real-model or package qualification is claimed for this increment.

Distinguish local template hints from runtime observations

Generic GGUF catalog entries previously claimed tool-call support based on a template substring, even when the only match was a comment or literal. The existing schema-offering policy now has an explicit basis and calls such matches file hints. Runtime receipts separately retain strictly typed, allowlisted capability observations: false, missing and malformed remain distinct. Default and named tool-use templates have separate full-byte hashes; raw template text and arbitrary runtime properties are not retained. The existing model-details panel and local settings show these distinctions without claiming successful tool execution or coding quality.

Five UI regressions and two corrected native integration regressions failed before production changes. The final source passed all 422 UI tests, TypeScript/production build and test-transport exclusion on Node 22.23.2. Fifty focused native tests passed with four existing live/model-dependent exclusions, plus scoped strict Clippy and formatting. Fake-runtime evidence covers three separate tasks, original false reports, warm reuse retaining the launch report, and changed model-file identity causing a fresh true report. It also checks a named template longer than 64 KiB and retained tool schemas on unknown/false reports. The first baseline's session-continuation request-count mismatch is retained and was corrected before reproducing the actual missing-field failures. Exact Hermes template selection, Rhea policy and schema routing are unchanged; hard capability enforcement, real coding quality and current package qualification remain open.

Refuse release receipts for changed source

The release recorder previously checked only the HEAD label against the workflow commit. Seven disposable-Git CLI regressions reproduced passing receipts for staged, unstaged, untracked and hidden-index edits, or source/HEAD changes during an otherwise successful check. The recorder now checks the expected commit and source before and after each gate. Hidden index flags are refused. A private index seeded from the expected commit compares actual tracked content without rewriting the caller's index; ignored build outputs remain permitted.

Independent review reproduced two additional gaps in the first implementation: an ordinary Git status under core.trustctime=false could cache a same-size, restored-mtime edit as clean, and a HEAD mismatch before recorder entry could retain an older successful receipt. The private-index comparison handles the former; moving HEAD validation inside the recorder invalidates the old receipt before the latter failure. The first private-index attempt rejected clean files until the private stat entries were refreshed; that failed run is retained. Final validation passes all 65 release staging, verification, authentication and signing fixtures with zero skips, including 11 actual CLI source cases and shared-index byte preservation. Seven independent review cases also meet their expected outcomes. This observes Git source content before and after a gate; it is not an atomic checkout lease against transient concurrent edits or qualification of the entire release. All current-source gates and packages still need their own results.

Keep available models usable during slow provider discovery

The composer previously waited for every provider probe before receiving any model rows; one stalled provider hid ready local models and other providers. An additive cached picker request now returns local metadata and existing vendor/OpenRouter observations without starting vendor or network probes. The UI publishes those rows while its original full refresh remains pending, polls snapshots serially for at most 60 seconds, and retires obsolete responses on completion, reload or unmount. The full request remains responsible for completion and errors; retiring a UI response does not cancel a backend process.

Catalog publication now checks a probe's revision and configured executable identity. Disconnect, status invalidation, offline mode and provider settings changes prevent older probes from restoring stale Ready or persisted usage. A successful settings save updates that authority immediately. Full responses project one current vendor snapshot after the provider/local/OpenRouter waits, preventing an older per-probe result from overwriting a newer observation. Billing distinctions and existing explicit refresh/backoff behavior remain intact. These are cached observations, not fresh-at-send account authorization; local metadata work can still launch its existing runtime inspection helpers.

Native baselines reproduced blocked cached reads, late publication after invalidation, an unwanted OpenRouter fetch and mismatched final target/account observations. Actual PUT-config tests also reproduced three failures until save-time invalidation was added. Final focused native validation passes 445 tests, including nine picker/race cases and existing account, auth, ACP and transport suites; scoped strict Clippy also passes. Three existing core exclusions remain microphone, Whisper model and the separately required built-project-cleanup gate. The UI baseline had nine failures; final validation passes all 431 UI tests, typecheck, production build and bundle exclusion. All 62 rendered browser cases pass without skips; the new explicit-barrier case selects and submits a cached local model before the full response is released and retains the exact selected ID afterward. These are source and fixture results; current packaged, live-provider and physical desktop qualification remain separate.

The combined native-source gate at 9adeff4 exposed a missed call to the renamed template-hint method in the probe_local example. The example now uses the new method and labels its diagnostic field tools_template_hint. A scan of all tracked files found no remaining old-method references, and strict all-target core Clippy passes after the correction. The failed full-gate receipt is retained; its remaining desktop/workspace test stages still require a complete rerun. At 9adeff4, the separate required release-tests and release-auth gates passed 65 and 59 tests plus the secret scan, with no exclusions; those receipts remain bound to that commit.

Bound release-recorder output after the command exits

The complete native-source gate at 3fcc143 passed strict workspace Clippy, desktop compilation and 1,013 tests, with ten explicitly optional exclusions and the built-project cleanup fixture assigned to its separate required gate. Native behavior checks also passed. The subsequent native-window run completed 17 desktop assertions and the Markdown worker checks, but a private D-Bus portal retained an inherited diagnostic stream after the command exited. That run was interrupted before fixture cleanup and has no passing receipt.

The recorder now permits one fixed 1,000 ms output drain after direct-child exit. Incomplete output fails the gate; continuing output cannot extend the deadline. It closes only its own read handles and does not signal descendants. Complete late tails still reach the required-skip parser. Two real-process fixtures reproduced indefinite waits before the change, while short-tail and exit-status controls passed. All four focused fixtures and all 69 release-script tests now pass without skips. A first after-run exposed an ESRCH race in the fixture's process observation; that log is retained, and treating an already-exited process correctly did not change the production deadline. This bounds the recorder, while private native-window session cleanup still needs qualification.

Keep sign-in cancellation pending until the engine finishes

Accounts previously showed cancellation immediately after its request and stopped reading progress. A delayed response could also overwrite a terminal result or another vendor's login, and a successful command exit displayed “Signed in” even when the account probe reported signed out or unknown. Cancellation now shows “Stopping sign-in” with duplicate cancellation and reconnect disabled until a terminal observation arrives. Progress remains active, attempt identities reject obsolete responses, failed cancellation restores its controls, and authenticated success requires a Ready account observation.

The terminal UI reads the existing cached accounts route instead of launching another provider check. Failed, cancelled and unconfirmed results also avoid the global catalog reload, so a user cancellation cannot immediately trigger another slow discovery and block retry. Successful Ready observations still refresh the picker. The fake backend preserves cancelled terminal records to exercise the same polling contract.

Seven initial regressions failed with one passing control. Independent review found that the first UI correction still launched a fresh account probe after cancellation and that the fake backend erased the terminal record; four follow-up failures reproduced those gaps. Final validation passes 25 focused settings checks, all 442 UI tests, TypeScript/production build and production test-transport exclusion on Node 22.23.2. The actual fake account handlers are exercised by a rendered cancellation control. Independent source review found no remaining blocker in these four UI files. These results qualify the UI changes; backend login cancellation, explicit probe reaping and current package/native-window qualification remain separate work in progress.

Own the private X11 test session through process exit

The source-window gate at 3fcc143 passed its app and Markdown assertions but remained open because an activated private D-Bus portal retained a diagnostic pipe. The earlier recorder correction makes incomplete output fail; the new X11 supervisor also fixes the test-session ownership boundary. It selects X11 before starting D-Bus, creates a private runtime directory with mode 0700, and preserves HOME and existing account configuration/data/state/cache paths. No particular GTK portal backend is required.

Both native window probes validate their direct private launcher, daemon and bus socket, then clean only newly activated services with matching session markers and process identity. Bounded cleanup refuses changed or unrelated processes. After command/output closure, the outer supervisor verifies recorded session processes have exited and checks for surviving late activations before removing its runtime directory. Incomplete output, failed commands, missing reports or residual services fail qualification and retain diagnostics. Required source/package workflow calls use this wrapper, install their D-Bus prerequisites explicitly and upload diagnostics from both stages.

Validation: all 29 focused session checks and all 98 combined release tests pass with zero skips; syntax, workflow YAML and diff checks pass. The real private-D-Bus fixture uses a generated service and a substituted Xvfb launcher, so it exercises session cleanup without opening a display. Independent review reproduced and closed a signal-time identity race, a late inventory deadline failure and missing package diagnostic retention. This is cooperative Linux process validation, not atomic pidfd protection against a hostile same-user race. Actual native-window and package qualification remain required; the original interrupted run has not been relabeled as passing. Evidence is retained in work/native-x11-session-prep/ and work/private-session-review/ outside the tracked source.

Retain login cancellation ownership through account discovery

A successful login CLI could hand off to an uncancellable account check. Cancellation or the original deadline then failed to stop that check, and engine shutdown could return while its process was still alive. Antigravity setup/read failures could also strand an admitted login without its final outcome. Ten deterministic lifecycle cases failed before correction, while two controls already passed.

Login admission now reserves a tracked worker before launch. Shutdown closes admission, cancels admitted operations and waits for their ownership to end. The final account observation shares the original cancellation token and deadline. Its Codex, ACP and short-command helpers retain each child outside cancellable I/O, explicitly stop and reap it, and finish their owned readers before returning. Cancelled or failed logins do not start another account probe. Antigravity handshake/read failures use the same tracked worker and publish exactly one terminal result; independently opened browsers are not signaled.

Independent review also reproduced a cancellation accepted while refresh waited for the catalog lock, followed by a Ready cache entry and persisted quota. A per-login publication gate now orders that synchronous commit against cancellation acknowledgement. Cancellation winning the gate prevents publication; a commit that wins first completes before cancellation is acknowledged. Original-deadline eligibility is checked after waiting for the lock. No await is held under that gate, and catalog publication never acquires the login registry in reverse order.

Validation: all 463 targeted native checks pass, with zero failures and four pre-existing optional exclusions. This includes all 12 lifecycle cases, actual held-lock cancellation/deadline regressions, account/auth/protocol/transport/picker controls, browser-helper survival and redacted output. Strict all-target core Clippy and pinned Rust formatting pass. Two older cancellation expectations now correctly require unavailable rather than a fresh sign-in probe. Exact source hashes and baseline/final evidence are retained in work/provider-readiness-next/, with independent review in work/auth-refresh-review/. These are fixture and source checks; fresh complete-source, native-window, live-provider and package qualification remain separate.

Notice repeated search results without requiring a path argument

The retained Qwen coding attempt made six successful searches over files it had already read, but the progress warning relied on the optional search path argument. Five searches omitted that argument and reset the warning counter. A tests-only baseline reproduced the missing advisory and a separate error that counted a read starting at line eight as a complete file read.

The advisory now evaluates actual nonempty search result paths and records only complete first-line reads from the bounded, redacted tool message sent to the model. Potential mutations invalidate historical coverage even when they fail. Tool messages remain unchanged, and the note explicitly permits rereading files after compaction, truncation or changes. It remains advice: no inspection is blocked, mutation authorized or result fabricated.

Validation: 388 core tests and all 55 engine tests pass, with three existing optional exclusions, plus strict all-target core Clippy and pinned formatting. The new engine fixture observes one advisory, then successfully rereads, edits, executes one real shell assertion and reopens its task-owned verification receipt; all earlier tool results remain intact. The two-failure baseline and a separate sandbox socket-permission failure are preserved. Evidence is in work/qwen-observation-loop-followup/. No model inference was repeated, so the earlier Qwen coding failure remains a failure and model quality is not claimed improved by these fixtures.

Bind Codex task events and approvals to their active thread and turn

Codex task notifications previously reached the current host job without checking their stored thread and turn identities. A fake-CLI regression reproduced a previous-turn completion ending the current task before its own completion was released. Foreign text, tool records, token usage and permission requests could likewise be attributed to the current job.

The adapter now checks task-affecting identity envelopes against the matching start/resume responses. Valid early events wait in a bounded queue of 128 frames or 1 MiB until the turn/start response establishes ownership. Responses are consumed once, continuation clears prior item and approval state, and invalid start, overflow, completion or replacement retires pending approvals. A duplicate outstanding server request ID also retires approval authority before scope handling. Account-wide notices retain their existing behavior. Legacy approval messages provide only a conversation ID, so they require that conversation and a bound active turn but cannot independently prove exact upstream turn identity.

The tests-only baseline preserved 25 passing existing controls and reproduced nine failures among ten new cases. After correction, all 77 focused Codex, composer, steering, account, handoff and transport tests pass with zero failures or exclusions. The real subprocess case remains running at its explicit barrier, retains only the owned nonestimated 3 input and 2 output tokens, completes exactly once and reaps its fixture process. Strict all-target core Clippy, pinned formatting and independent review pass. Existing fixtures were corrected to the installed CLI schema without weakening assertions. Evidence is retained in work/provider-readiness-next/codex-scope-review/ and work/codex-schema-fixture-prep/. These are protocol and fake-CLI results; fresh full-source, desktop, live-provider and package qualification remain separate.

Qualify the current packages and correct the native picker expectation

At ddc97d1, fresh source qualification passes 1,046 Rust tests, strict workspace Clippy, desktop compilation, 442 UI tests, native behavior/stress, 17 X11 desktop checks and the embedded Markdown worker. The four package gates also pass with no required or optional skips: packages, clean-host packages, packaged behavior and installer. The original disk-backed eight-client/20-second AppImage extraction check passes, as do actual extraction-output error controls and the offline rebuild of shipped runtime sources. The previous older-package failures remain preserved; this result does not establish a causal extraction-speed improvement.

The AppImage SHA-256 is a079d18b2b3a5b08b40453cbb71e3fc01916bb7a7c44de0ec71fd024f623b5c2; Debian SHA-256 is 3702fc21822a3f412b2eb9d8b97b30604afdd96a1a5cb4b89d7dc7b84384f221. Both open a first GUI window and answer offline CLI requests in a disposable Debian 13 runtime container. Packaged behavior passes CLI, PTY, all 17 desktop checks, HTTP MCP and official TypeScript v1/v2 clients over stdio/HTTP. All 16 recorded packaged-window process identities are subsequently absent. Installer qualification passes 34 authentication/recovery tests and the isolated-home shell scenarios, including the actual bundled managed runtime. These development 0.32.0 packages do not replace the published version or establish production signing, physical desktop acceptance or full provider conformance. Exact copies, logs and receipts are retained in artifacts/qualification-ddc97d1/.

GitHub Native run 36361395826 then exposed a stale desktop assertion: it always expected “Subscriptions,” while the existing UI correctly showed “Vendor CLIs” for unconfirmed billing. The harness now reads the settled cached picker after manual refresh and requires the exact billing-derived heading for both the section and its vendor rows. Local/API rows cannot change that heading. Product billing behavior is unchanged. All 17 focused picker tests and 12 extracted assertion controls pass; the original assertion controls reproduce three failures. Syntax, formatting and TypeScript checks pass.

A targeted native run with vendor CLIs absent from its private PATH passed the corrected “Vendor CLIs” boundary and the remaining desktop behaviors, with the existing explicit optional cloud-consent exclusion. That run remains failed overall: its private-session cleanup exceeded the unchanged five-second deadline. Output closed and all recorded processes subsequently exited, but this does not turn the cleanup failure into a pass. Evidence is retained in work/native-picker-heading-prep/; investigation of the cleanup inventory remains separate. No test deadline or ownership check was relaxed.

Bound parallel discovery in private-session cleanup

Process discovery previously read every /proc entry sequentially, consuming a material part of the fixed cleanup budget on this host. Discovery now overlaps at most eight process-reader pipelines, preserves the complete inventory and input order, and joins admitted reads before reporting an error. Anchor validation, identity checks, signals, the 32-service cap and the five-second cleanup deadline remain unchanged. The original timeout did not identify its exact operation, so this change does not establish its precise cause.

Validation passes all 104 combined release-fixture tests with zero skips, including held discovery reads, late resolutions, inventory completeness, ordering, errors and the service cap. One actual X11 recheck also passes with the older pinned ddc97d1 desktop binary: the vendor heading and applicable desktop checks pass, with one explicit optional cloud-consent skip because no vendor CLI is available in the private PATH. Output closes, cleanup finishes within the unchanged deadline, all 16 recorded process identities are absent and the private runtime directory is removed. Before/after source and binary hashes match. This qualifies the changed helper against that binary; it is not qualification of newer runtime source or a clean release receipt. The original failed run is preserved. Evidence is in work/native-session-inventory-diagnosis/.

Expose an exited local runtime on the next status read

A managed local runtime that exited after becoming ready remained marked Loaded until another acquisition. Three tests reproduced stale state through independent first observers: the catalog API, loaded() and the cached picker API. Status reads now try the existing runtime slot and inspect only its retained child handle. A confirmed exit clears the loaded snapshot and retains the bounded error output. Reads do not signal or restart the process; the next explicit load follows the existing replacement path and clears the old error after readiness succeeds. A busy slot is not awaited, while the existing state mutexes remain synchronous.

All three tests failed before the fix. Afterward, 25 ordinary local-engine tests and five runtime unit tests pass, with three existing live-model exclusions; strict all-target core Clippy and workspace formatting also pass. The regressions check an actual fake runtime reaching readiness, explicit child exit, exactly one requested restart, unchanged project/index bytes and survival of an unrelated same-executable process. Independent review found no blocker. Evidence is in work/local-runtime-post-ready-prep/. This is status-read and service-API qualification, not a background exit notification, active-stream crash, real GPU/OOM or current-package qualification.

Refuse invalid local-runtime readiness responses

An occupied-port regression reproduced false readiness: the managed child remained alive behind a pre-bind barrier while a separate listener answered health with 200 and the authenticated props request with 401. The public load succeeded, and the catalog and cached picker incorrectly reported Loaded. The runtime now requires successful HTTP and a JSON object from props before publishing readiness. Failed requests, invalid JSON and nonobject responses produce category/status-only diagnostics, then stop and reap the owned child through existing cleanup. They do not trigger CPU fallback. Successful objects with absent or null optional capability fields remain valid; existing template and context checks still apply.

The regression fails before the change and passes afterward. All 26 ordinary local-engine tests and eight runtime unit tests pass, with three existing live-model exclusions. The port case verifies the rejected child is already gone before fixture unload, the unrelated listener survives, one explicit retry works, no inference occurs, and model/project/index bytes remain unchanged. Actual loopback HTTP controls cover status errors, malformed/nonobject JSON, private-response redaction and optional-field compatibility. The existing Hermes 503 case now expects the earlier readiness error; its remaining template, one-launch and cleanup assertions remain. Independent review, strict all-target core Clippy and workspace formatting pass. Evidence is in work/local-runtime-port-readiness-prep/, work/local-runtime-props-readiness-prep/ and work/provider-port-review/. This rejects observed invalid readiness responses; a successful props object alone does not prove listener ownership. Real GPU/OOM, active-stream failure and new package qualification remain separate.

Preserve a checked Compare result when another candidate fails

LOC-05 now has a direct regression through the public Compare API. One candidate edits files and runs a real configured Python check while the other writes partial work and waits behind an explicit request barrier. Releasing that barrier produces a nonretryable HTTP 400. The successful candidate's files, check summary and exact task-owned command completion remain intact through the failure, reopening, Keep and repeated cleanup. The failed candidate's partial work stays available until the user keeps the winner. The original Git HEAD/index and unrelated staged/working bytes remain unchanged; the result is scored once, and successful generation is not replayed.

The first coverage test passed without changing Compare production. Independent review strengthened the receipt-to-command link and made fixture cleanup run before assertion panics propagate. The final complete Compare suite passes all 21 tests with zero exclusions; strict all-target core Clippy and formatting pass. The check receipt resolves to the exact task/session, command start, successful completion and Python output, and that evidence is preserved after reopening and Keep. Evidence is retained in work/compare-lane-failure-prep/. This qualifies admitted loopback-provider generation failure; managed-GGUF crash/OOM, admission failures and live model behavior remain separate. No Compare production defect was established by this case.

Managed-runtime failure during an active task

A Linux fake managed runtime now completes a real file write, streams partial text and an incomplete tool call, then exits behind an observed barrier. The task reaches one durable failed terminal state with disconnected/unfinished response evidence, preserves the earlier file edit and model/project/index bytes, and never executes the incomplete tool or claims verification. Reopening preserves the failure. A separately requested retry starts one new runtime and completes a real Python check; both runtime children are reaped and an unrelated process survives. Production execution code is unchanged.

The original focused case passed once in 8.37 seconds; independent review added explicit retry-child reaping proof. The final local-engine binary passes 27 tests with three existing live-model exclusions. Strict core all-target Clippy passes; formatting passes after correcting the expanded diagnostic layout in a separate provider fixture. This covers a controlled runtime process exit through the service API, not a real GPU/OOM event, native editor/window interaction or rebuilt release packages. Evidence: work/local-runtime-active-exit-prep/ and work/provider-readiness-1ba135f/native-after.log.

ACP account billing observations

A ready Cursor, Antigravity or Grok ACP connection no longer implies subscription billing. Their protocol does not supply a billing observation, so account and picker billing remains unknown while readiness, discovered models, image capability, route grouping and provider-specific usage notes remain unchanged. Authentication metadata records the method actually accepted by authenticate, rather than the first advertised option. No advertised method leaves that identity absent. Known Codex/Claude subscription and API-key observations remain distinct. The UI unknown notice asks users to check their provider account; it does not assert an API charge from missing ACP evidence.

The original fake-ACP regression failed with selected cursor_login, an unrelated first advertised auth label and invented subscription billing. After correction, catalog7 + accounts15 + cli_agent59 tests pass, including actual/no-method controls, per-provider usage notes and known billing controls. The first combined after-run passed the new cases but failed an older fixture before process spawn completed; its OS cause was hidden by the old error formatting. The failure remains retained, diagnostic output now includes the error chain, and the complete catalog/accounts/adapter recheck passes without a retry/sleep workaround. Antigravity's existing ordinary integration passes with its one existing live exclusion. The integrated UI passed459 tests/78files and typecheck; strict core all-target Clippy and formatting pass. Evidence: work/provider-readiness-1ba135f/{baseline.log,native-after.log,native-recheck.log,clippy.log} and work/editor-upgrade-prep/ui-all.log. No real provider request, account change or billing transaction was performed.

Context inventory, native editor, and current source qualification

The composer now offers an inspector for explicit @ file and folder attachments. Its preview shares the bounded attachment builder used by native task context and reports included/excluded paths, line and byte bounds, folder entries and truncation without returning file contents. It explicitly says vendor CLI context remains opaque and that the task rereads files when it starts. The editor now has a CodeMirror-based editing surface, language modes, find/replace, undo/redo and a plain-text fallback for mixed newline files. Draft saves preserve original CRLF/CR bytes when possible. A delayed-save regression verifies that typing made after submission survives the successful response, remains dirty across an editor remount, and can be saved against the returned disk revision. Larger settings, compare, review and drawer tabs load on demand while keyboard-critical overlays remain eager.

Compare now reads the current project's app-owned file drafts before launch. When any open buffer differs from its saved base, the dialog names those files, explains that Compare snapshots disk content, and disables Start; the handler also refuses a direct start while that state remains. Component coverage checks the disabled action and warning, and Playwright drives the app from an edited file through the blocked Compare dialog, saves the draft, and confirms launch becomes available. This protects UI-started comparisons; native/API callers do not own or receive the desktop editor's in-memory drafts.

The native X11 smoke fixture initially failed before backend setup because it canonicalized isolated XDG roots that the fixture had not created. After creating config, data, state and cache roots, the real app reached the editor checks. That exposed a second test-only defect: the fixture assumed the open-file tab's accessible label used a basename, while the UI correctly uses the workspace-relative/absolute item path. The fixture now switches through the visible Files list. The rebuilt source desktop passes all 19 native window checks, including TypeScript highlighting, actual keyboard edits, undo, guarded save, exact CRLF persistence, reload recovery, accessibility, compact layout and owned child cleanup. The independent native Markdown worker/CSP run also passes with no CSP violations. Both use the controlled X11 source binary and do not qualify physical Wayland/COSMIC or installed packages.

On this dirty source checkout, UI unit tests pass 477/477, including delayed-save, unsaved-draft Compare, and stale-completion-after-cancellation regressions; the Playwright suite passes 72/72, including the editor-draft Compare guard. Production and E2E builds pass, core context-bound tests pass, formatting and diff checks pass, and strict workspace/all-target Clippy passes. cargo test --workspace --locked now passes end to end when run with the installed Rust 1.95 toolchain first on PATH and local socket access; the default sandbox run had failed 13 loopback/socket cases with Operation not permitted, and the first rerun's doctest stage used a system rustdoc that could not load its pinned LLVM library. Some explicitly live provider/model and external-network tests remain ignored. No real vendor task, billing probe or account change was performed. The local edits remain uncommitted and these results are not GitHub CI receipts.

Still required for release: live, user-authorized qualification of each provider's official sign-in/refresh/cancel/expiry path; real model quality and long-task checks on supported local/cloud routes; physical Wayland/COSMIC and GPU behavior; clean-host packaged install, upgrade/rollback and uninstall; release signing/key ceremony and protected GitHub workflows; and final candidate CI/package receipts on one frozen commit. Until those checks pass, the flagship application and release remain incomplete.

Cross-window draft guard and context estimate follow-up

The context preview now exposes an approximate token count derived from the exact bounded attachment prompt bytes, and the UI labels it as an estimate alongside attached bytes. Native coverage confirms the reported estimate formula. Compare checks persisted app-owned editor draft paths while holding the project mutation lock immediately before snapshot creation; if another editor window has persisted an unsaved recovery draft, Compare refuses with its path rather than launching against stale disk content. The two focused browser scenarios for bounded context and a recovery draft saved by another window pass (2/2); the native context-preview and pending-draft tests pass (3 total); all UI unit tests pass (478/478), and UI typecheck passes. Changed-file Prettier, workspace Rust formatting, and git diff --check pass. These checks verify the covered API and UI paths, not arbitrary external editor buffers or a rebuilt package containing this follow-up. Full provider, physical Wayland/GPU, and frozen signed release gates remain open.

Coordinate app-owned workspace mutations across ShadowCode processes

The prior in-process mutex did not serialize two application processes. The same repository advisory lock used by Compare now covers recovery-draft writes/deletes, source-file saves, project instructions and skills, attachments, saved project maps, and Git hunk/stage/commit actions; ownership is retained through each mutation. Mutations capture the selected project before waiting and reject a stale generation after admission rather than redirecting a queued write to a different project. This prevents a cooperating ShadowCode process from changing the source tree or index while Compare takes a snapshot or applies its selected result. Standalone folders continue to support local drafts and writes without a repository lock because Compare cannot operate there; only Git's explicit “not a Git repository” response takes that path, while other probe failures refuse the mutation. Terminal commands remain outside this short-mutation lock because they are arbitrary and can be long-running; unrelated programs that do not honor ShadowCode's lock are not covered.

The service regression holds the repository lock from a separate file handle, confirms draft save, file save and git add are refused without changing file bytes, then releases the lock and confirms file and draft saves succeed. Core coverage checks the same lock boundary and standalone-folder behavior. All 18 service-command integration tests and all 10 project-inspection tests pass with local socket access, including saved project-map behavior. Strict core all-target Clippy, workspace formatting and git diff --check pass. This closes the app-owned short-write race covered here; it does not detect another application's unsaved buffers or protect against noncooperating external writes.

Current 0.32.0 development packages from the dirty flagship checkout

Using the already pinned managed runtime, AppImage runtime and packaging tools, both Linux formats were rebuilt from the source tree described above. The package checker passed all declared package-content, runtime-origin, notice, metadata and checksum checks. The network-disabled Debian 13 clean-host gate passed offline CLI/status and first GUI-window launch for both AppImage and Debian packages. AppImage extraction/lifetime tests pass; its packaged CLI passes all 21 scenario groups with 32 fixture-model requests; packaged TUI passes its PTY checks with eight fixture requests; packaged native desktop passes all 19 WebKit/editor/accessibility/cleanup checks; packaged MCP stdio and HTTP each pass with six fixture-model requests; and independent official TypeScript MCP SDK v1/v2 clients pass over both transports. Nine runtime write/error cases pass, and a no-network rebuild of the included AppImage runtime source archive reproduces the pinned runtime hash. The artifact hashes are AppImage 22bb272cd0145e9c699f3cb3cdb14bf359cbc84ce7a13684d4db740f33c6d570, Debian 5f168ddb9b3c8ab53a400290766f8dcde54e7346c8dc7e14f1ea3ebfe64b36e1, and AppImage runtime sources 5ac573be7979f615894b10c99a1091698ce9b02c2768750ec4387aa8f948d131.

The separate native Markdown WebDriver probe cannot qualify an AppImage as currently written: it requires /proc/<pid>/exe to equal the configured application path, but the AppImage wrapper launches a temporary extracted executable. Its failure occurred at that ownership assertion, before Markdown worker/CSP assertions, so it is neither a CSP failure nor a packaged Markdown pass. The source-binary Markdown/CSP gate passed separately. Package qualification above is local development-package evidence from a dirty checkout, not a signed or published release; version remains 0.32.0, no release key was used, and no GitHub CI receipt is bound to these bytes. The first interactive AppImage WebDriver attempt did not reach UI checks because the host lacked a system-installed driver; the clean-host container did open first windows for both formats, which is narrower evidence. The later fresh-package result below supersedes that initial limitation.

Fresh current-source package run (2026-09-28)

Rebuilt the 0.32.0 AppImage and Debian package from commit 52d8b77 plus the uncommitted worktree. check-native-package.mjs passed for both: managed runtime pin and Vulkan+CPU metadata, bundled library closure, notice digests, matching binary/version, desktop/AppStream metadata and AppImage runtime-source identity. The network-disabled Debian 13 gate passed offline CLI status and first GUI-window launch for both formats. Against the exact fresh AppImage, packaged CLI passed 21 scenario groups/32 fixture model requests, TUI passed its PTY checks/eight requests, MCP stdio and HTTP each passed six fixture requests, and official TypeScript SDK v1/v2 clients passed over stdio/HTTP. The first interactive window attempt did not reach WebDriver startup; after pointing the test at the existing extracted WebKit driver, this exact AppImage passed all 19 interactive native desktop checks: first-run trust, welcome/picker/provider state, local-model task approval and execution, editor/highlighting/undo/save/CRLF, change review, reload, settings, consent cancellation, pause/resume/stop, compact layout, light/dark accessibility, and child-process cleanup. Screenshots and the test receipt are in artifacts/native-appimage-desktop-current/. AppImage SHA-256 is 6721739fac7ed22a4d4daf071ab68904379a20a32da9210e76a5b489dcce3e40; Debian is 475ad89b93c1528c0856a6ee0a30145e92f5b7e64f5c94a71762e9d77b457fc7; runtime source archive is unchanged at 5ac573be7979f615894b10c99a1091698ce9b02c2768750ec4387aa8f948d131. These unsigned local artifacts are not release candidates. Clean signed build, installer upgrade/rollback/uninstall, physical Wayland/COSMIC/GPU, provider lifecycle/long-task qualification, protected GitHub workflow, and frozen-commit receipts remain open.

On the same source, bash scripts/test-install-appimage.sh passed its fake publisher/checksum refusal, runtime validation, interruption and rollback/recovery cases, including the real bundled runtime. The authenticated installer suite initially failed because its helpers rejected Node 22.11's post-reap EPERM diagnostics and intentional SIGKILL results (status: null, signal: SIGKILL) before evaluating exit/signal evidence. The helpers now distinguish those cases: successful commands require exit status zero; refused commands require a nonzero exit or an observed signal, so a spawn error alone cannot satisfy refusal. The full installer-auth suite passes 34/34 tests with no skips under local process access, including signature checks, actual SIGKILL recovery, and the nested runtime/rollback suite. This is local test evidence; release receipts on a frozen commit remain outstanding.

Explicit checks without another model turn (2026-09-28)

Completed-task summaries now offer Run a check…. The user enters a fresh command against the current project files; the desktop starts the existing native command-job API without choosing or invoking a model. Normal trust and command approval controls apply. The composer draft remains intact, output and a fresh check receipt appear in a new task, and earlier evidence remains in history. Historical receipt text is never reused as executable input. A shared submission guard prevents duplicate starts; workspace/session and navigation-generation checks keep a delayed response out of a different conversation, including navigation away and back. Once the command is admitted, a list-refresh failure cannot present it as a retryable submission failure.

Integrated validation passes 490 UI tests across 81 files, TypeScript/production build, and all 74 Chromium browser scenarios. The new App/browser cases exercise an unset model, exact workspace/session request, approval before output, draft preservation and completion. The production bundle check confirms test transport/fake engine code is absent. These UI results alone do not prove native execution.

The rebuilt debug desktop additionally passes all 20 real X11/WebKit smoke checks, including the new action. Its command verifies the actual working directory's device/inode, reads the existing project file and prints a known result. The test observes that exact stdout and exit code in the displayed receipt, one command task, zero engine/server model requests, preserved draft/model selection/earlier summary/file bytes, and clean exit of the app and children. Evidence: artifacts/native-current-run-check-3/native-run-check.json, screenshots, desktop result.json, and the outer artifacts/native-x11/run-iShhjp/result.json. Initial attempts are retained: one could not find the installed driver on PATH; another reached successful execution but incorrectly required an unredacted receipt path. Durable receipt paths intentionally pass through generic secret redaction, so the corrected fixture verifies directory identity in the executing process and exact job.workspace, while allowing only the actual or redacted displayed path. No redaction policy was weakened. This is source-built X11 evidence, not physical Wayland or a package containing this new action.

Clean-host gate response validation and bounded container cleanup

The shell MCP probe previously used string matching that could accept an error response containing a tool name. It now emits raw tagged replies for structural validation on the host: JSON-RPC envelopes/IDs, negotiated protocol, server identity/capability, all 17 expected tools and their schema structure. The shell handshake has a hard kill deadline for an uncooperative server. Eighteen regression tests cover these cases without adding Node to the clean runtime image.

The package runner now assigns each container a private name and ownership label. After the attached client returns or times out, bounded commands enumerate that label, verify name/label/full immutable ID, remove only the owned ID and check disappearance. Auto-removal between enumeration and inspection is accepted only after a successful empty ownership query. Twelve regressions cover timeouts, malformed/foreign identities, unrelated-container preservation and cleanup failures. A real Docker timeout experiment also removed the test container while preserving a separately created sentinel. Runs use the already-built image with --pull=never; an empty query after client termination observes daemon state but cannot prove that an already-submitted create will never finish later. Timeout diagnostics preserve the invocation identity for that case.

Native CI and the required release-test gate include both new suites; path filters cover their helpers and native smoke fixtures. The complete wired release fixtures pass 134 tests with zero skips, followed by both executable-ownership tests. The ordinary sandbox attempt failed/stalled in subprocess fixtures; its identified wrapper was stopped before the successful local-process run. The rebuilt clean runtime image and final ownership-aware runner pass offline CLI/MCP and first-window checks for both exact package hashes listed above. Those package bytes predate the new checks UI and native mutation fixes: no current-source package, signed candidate or published release is claimed. Current changes remain local and uncommitted; final source freeze, rebuilt artifact receipts, live provider/long-task, physical Wayland/GPU and release trust/workflow qualification remain required.

Recover provider sign-in and bound native event listeners (2026-09-28)

Accounts restores each vendor's active sign-in from the native progress API after navigation, keeps concurrent provider attempts separate, and shows cancellation as Stopping until terminal acknowledgement. Unknown progress cannot trigger automatic account probing. Catalog refresh waits for all active sign-ins and pending Connect requests to settle; stale replies cannot overwrite newer attempts. The native progress response exposes cancellation_requested only for a still-active cancelled attempt. Four native authentication units, 64 focused UI cases, the integrated 507-test UI suite, production build/typecheck and all 75 Chromium browser scenarios pass. These recovery fixtures do not establish real expired-token or browser-login lifecycle behavior.

A real native 100-task run exposed retained Tauri event metadata growing from 11 to 211 records. The frontend now shares one document-lifetime registration for each of four fixed channels, with removable subscriber identities, retry after registration failure and isolated callback errors. It does not mutate Tauri's private registries. Fourteen focused event/job tests pass. A second real 100-task run retained exactly three registered records throughout and preserved database integrity, but failed its unchanged thread-growth allowance because its early baseline preceded a rise from 58 to roughly 75–76 threads. Both failed receipts remain in artifacts/native-endurance-baseline and artifacts/native-endurance-fixed; neither is an overall endurance pass.

The endurance fixture now records actual per-process named thread identities, requires bounded warm-up convergence before 100 distinct qualification tasks, and applies memory/descriptor/listener limits during warm-up. The post-baseline thread-growth allowance remains eight. Native and release workflows both require this gate and retain its diagnostics. The corrected real run passes all 100 post-warm-up tasks after 25 warm-up tasks, with SQLite integrity intact and all 21 surrounding desktop checks plus private-session cleanup passing. The main samples retain 75 threads, 146 descriptors and three native listener records throughout; owned-tree PSS ranges from 481,232 to 529,360 KiB and finishes at 514,063 KiB. Evidence is in artifacts/native-endurance-final, bound to executable SHA-256 6b75228f6362f3b7cc4280dfa228da35fa86d7258e3540e58cc49b5921311aa7. This does not establish long-stream input latency, physical Wayland, GPU inference endurance or packaged-window endurance.

The full current native workspace suite passed 1,069 tests with zero failures, ten ignored tests and one explicit built-project-cleanup exclusion; the latter remains a separate release gate. Strict core Clippy passed. Source and test evidence remains from an uncommitted development checkout, not a frozen release commit.

Live subscription coding and stricter installer evidence (2026-09-28)

Official Codex and Claude adapters each completed one isolated five-case Python repair task. Before each turn, observed official authentication confirmed ChatGPT or claude.ai routing; no API fallback was allowed. Exact-workspace metadata resolved gpt-6-astra and claude-opus-5 respectively. Codex completed in 22.39 seconds and Claude in 30.32 seconds. Both preserved the fixture tests, produced the exact test-command receipt, and passed the independent offline five-case grader with no truncation, timeout, cancellation or cleanup error. Reports and unchanged input hashes are in artifacts/live-subscription-current. An initial custom Codex preflight timed out; the established native adapter subsequently confirmed authentication before any turn. These two small tasks are not a model ranking, real login-expiry test or full provider lifecycle qualification.

The installer-auth refusal helper now requires a normal nonzero exit, excluding timeout/spawn-error and unrelated signal termination as false success. Intentional crash cases separately require SIGKILL and the exact expected interruption boundary. The updated suite passes all 37 tests, including actual timeout and signal controls. This supersedes the broader refusal classification described earlier in this ledger. Production publisher signing and frozen-commit release receipts remain outstanding.

Final development package qualification (2026-09-28)

The final package build succeeds with all 770 recorded product/build inputs unchanged throughout. AppImage SHA-256 is 079ad39e92718f5041360e5cd12f2c6e547b816ac520cc916d85656b04e3341a; Debian is 9f1a3c25a619d622dcfd9bf1083e0a6d85e61bd3f0e420c458003783e33c3766. Package content/runtime/notices checks pass. Both exact artifacts pass offline CLI/MCP and fresh-profile first-window checks in the network-disabled runtime-only Debian 13 container. The exact AppImage also passes the real Markdown worker/CSP check and private X11 cleanup. This closes the earlier wrapper-executable mismatch limitation. The exact AppImage additionally passes all 20 interactive desktop checks and cleanup, nine runtime write/error cases, extraction/process-lifetime checks, and a no-network source rebuild reproducing its AppImage runtime hash. Workspace formatting and strict workspace/all-target Clippy pass. Final package CLI passes 21 scenario groups, TUI passes its PTY checks, MCP stdio and HTTP pass, and independent official SDK v1/v2 clients pass all four transport/version combinations. AppImage bytes remain unchanged before and after the batch. These are still unsigned development artifacts built before the subsequent local commits.

Close the observed CI packaging mismatch and built-project gate

GitHub Native desktop run 36366642769 at 1ba135f failed during packaging because CI's exported VERSION caused linuxdeploy to append X-AppImage-Version=0.32.0 to the AppDir root launcher. The normalizer required byte-identical launchers and rejected that exact additional field. It now permits only one trailing field matching the checked-in Tauri package version; incorrect versions, duplicates, extra fields and changed Exec remain refused. The normalized shipped launcher remains canonical. The original behavior reproduced in a fixture, then all 11 focused metadata tests passed. This corrects the observed build-input variant; a new remote workflow receipt remains required.

The separately required release-profile built-project cleanup test also passes on actual installed/built UI content: 17,661 entries, 261,762,614 logical bytes, 0.625 seconds to prepare and 1.704 seconds to dispose. The copied lane and quarantine are both removed; no source dependencies are deleted. Evidence: artifacts/final-built-project-cleanup.log. Final release-auth fixtures pass 59/59, installer-auth passes 37/37, executable-ownership checks pass 2/2, and the actual installer shell exercises the real bundled runtime. A final session-fixture run passed 34/35 with one fixed-deadline D-Bus cleanup failure during parallel compilation; that failure is retained. After compilation ended, the exact isolated case passed in 4.16 seconds with no deadline change. This recheck supports the observed scope; it does not erase the intermittent failure or establish its precise cause. The original 134-test batch passed 133 cases and failed only the stale workflow wrapper-count assertion. The corrected 35-test session suite passed that assertion and 33 other cases, with only the D-Bus failure described here. Together the targeted reruns exercise the failed cases; no all-green repeated full-batch receipt is claimed.

Explicit Wayland selection and physical COSMIC interaction evidence

The original qualified AppImage could not start with Wayland explicitly selected and X11 unavailable: its bundled GTK hook unconditionally reset GDK_BACKEND to x11. The custom AppRun now saves an explicit caller choice before sourcing that hook and restores it afterward; unset/empty choices retain the upstream X11 default. Four actual-shell fixtures verify backend behavior, the caller working directory and literal argument preservation. All 37 combined launcher/release-verification tests pass, and the new launcher fixture is required by native/release checks. The previously qualified AppImage bytes remain unchanged and do not yet include this launcher correction.

The revised native probe explicitly opts into physical Wayland, validates the user-owned compositor socket, removes DISPLAY fallback, verifies the launched app's GDK_BACKEND and records executable identity. The socket peer was /usr/bin/cosmic-comp; the active local seat was seat0 (logind reports the containing login as tty, so that observation alone is not used to infer Wayland). With the corrected launcher in the existing AppDir, 18 real interaction groups pass: onboarding, picker refresh, model settings, synthetic local task approvals, native keyboard editing/Undo/save/CRLF, change review, reload, Run a check, Accounts/permissions, cloud consent cancellation without a paid turn, Pause/Resume/Stop and owned-process cleanup. The app executable hash is 647cd740e23e09284d231bf4d0c2bc6a420a74217b05c7319ff6f454180d1a76. No DMA-BUF disable override was applied. These checks use a synthetic inference runtime and do not qualify GPU model inference.

The run remains failed overall: both requested 1360-pixel and 520-pixel window widths remained 1280×673 under COSMIC, although the display reports 1920×1080 at scale1. Initial interpretation as insufficient screen width was contradicted by that measurement. Compact-layout assertions are not counted as passes when resizing fails, and the full result exits nonzero. No compositor settings were changed. Physical floating-window resize, broader keyboard/clipboard/IME/DPI acceptance and a rebuilt AppImage containing the launcher correction remain open. Evidence and all failed attempts are retained under artifacts/physical-wayland/.

Version 0.33.0 and protected signing preparation (2026-09-28)

The owner authorized pushing the update, updating current version documentation and replacing the local app after verification. Version 0.32.0 is already published, so the new candidate is 0.33.0. Workspace/package metadata, lockfiles, launcher metadata and current integration examples now agree on 0.33.0; historical evidence retains its original version and scope. Locked Cargo metadata and all 15 focused launcher/desktop-metadata tests pass. This version change has not yet produced a qualified 0.33.0 package.

GitHub environment release-signing was applied and read back with Shadowfetchapps (user ID 209457103) as required reviewer, self-review allowed and exactly one deployment rule, tag v0.33.0. GitHub's default administrator override remains unchanged. A new Ed25519 private key is stored outside Git with owner-only permissions and uploaded only as that environment's NATIVE_RELEASE_SIGNING_KEY_PEM secret. Repository variable NATIVE_RELEASE_SIGNING_ENVIRONMENT names the environment. The reviewed tooling commit pin is pending the final committed/pushed source. No tag, signature or release was created by this configuration step.

The repository now supplies public trust for key ID f0c60ff8228314616985712f8918c9798c0ecf72b7271e19343a041c25663b7f, epoch 1, valid only for version 0.33.0. The immutable first-authenticated-install boundary is 0.33.0, allowing an existing unsigned 0.32.0 installation to migrate through the authenticated installer. Public policy is not proof that a candidate has passed gates or been signed.

Read-only inventory found the installed AppImage at version 0.32.0, SHA-256 5c02e9e6f1938a9cf9264cd3f04d872c3ad98a039a7e3a5647b783762854954d, without authenticated receipts. Replacement remains pending a verified signed candidate. Projects, settings, conversation history and model stores are preserved; only superseded application files are eligible for removal after successful replacement.

Frozen 0.33.0 package preflight and GitHub submission (2026-09-28)

Commit 7a38fcc6196f04cae846ed0dbb6cc2a14a3afb4b was pushed to flagship/reliability-foundation and confirmed as draft PR #4's head. GitHub's NATIVE_RELEASE_TOOLING_COMMIT was set to that exact reviewed remote commit and read back. The PR description now states the configured signing controls, scoped evidence and remaining work. The Checks workflow 36397403434 passed both interface and packaging-script jobs. Native workflow 36397403388 passed its Rust suite and reached its separately required built-project cleanup gate; it is not recorded as complete.

The local 0.33.0 release build completed with all 961 recorded tracked inputs unchanged from that commit. AppImage SHA-256 is cab6f61c5c4667c67dd8c9cd04969d6f349d42bce1ca198878e6f9be08429c62; Debian is 741e700bbf49fe892cad2d696ed1dafd254d3fd1cc3094a5f0735250bdc32c46; runtime-source archive is 5ac573be7979f615894b10c99a1091698ce9b02c2768750ec4387aa8f948d131. Both packages pass contents/runtime/notices checks, offline CLI/MCP and first-window checks in the isolated runtime container. The exact AppImage passes all 20 X11/WebKit interaction groups and owned cleanup, native Markdown worker/CSP checks, all 21 CLI scenario groups, runtime write/error cases, concurrent extraction/process lifetime checks and the network-disabled runtime-source rebuild. AppImage and Debian hashes remain unchanged after the batch. Evidence is under artifacts/release-0.33.0/.

These are unsigned local preflight packages. They include the explicit Wayland launcher fix but do not establish full physical Wayland acceptance, GPU endurance or the complete protected GitHub release workflow. Production signing/publication and the requested installed-app replacement remain pending; the existing 0.32.0 installation and all user data remain intact. A documentation-only follow-up corrects the GitHub Action README's default to match its already-updated 0.33.0 action metadata.

Correct a reproduced process-exit race in CI ownership discovery

Native run 36399332104 at documentation head f14287b failed 1 of 138 release/session fixtures: the real isolated D-Bus test observed EACCES reading a candidate environment during cleanup discovery. The original failure remains in artifacts/release-0.33.0/ci-f14287b-failure.log. A bounded local kernel probe reproduced two cases where an initially live process returned EACCES from /proc/PID/environ, followed by either disappearance or the same PID/start/UID in zombie state. This establishes a real exit race; the original CI log did not record the denied PID's subsequent state.

Discovery now rechecks basic identity after EACCES/EPERM and disregards only a missing process or the same PID/start/UID in terminal Z/X state. Live unreadable candidates, changed identities, failed rechecks and other IO errors remain fatal before any signal. The new read uses the existing fixed-deadline client; no retry loop, deadline extension or ownership relaxation was added. Seventeen deterministic cases produced six expected failures before the fix and all 17 passed afterward. The complete required release/session fixture set then passed all 155 tests with no skips, including the real D-Bus activation and external wrapper boundary; both separate executable-ownership tests passed. Independent diff review found no actionable issue. Evidence is in artifacts/release-0.33.0/proc-race/.

The already-built 0.33.0 AppImage additionally passes native TUI, MCP stdio/HTTP and all four official TypeScript v1/v2 transport combinations. This helper/test correction does not change those package bytes; their original build identity remains 7a38fcc. A new current-head CI receipt is required. The earlier proposed release tag at f14287b must be superseded by the corrected source before release; no tag has been created.

Controlled long-stream keyboard latency on the local 0.33.0 package

On 2026-09-28, the exact ShadowCode 0.33.0 AppImage SHA-256 cab6f61c5c4667c67dd8c9cd04969d6f349d42bce1ca198878e6f9be08429c62 passed a controlled native WebKit/Xvfb long-stream keyboard probe on an AMD Ryzen 7 5700G host with approximately 64 GiB RAM. A retained 88,810-byte Markdown/code answer preceded a 90.25-second, 1,200-chunk, 120,330-byte SSE answer from an isolated authenticated llama-server test double. During 70 seconds of the active stream, all 329 trusted WebDriver keyboard events produced input and preserved the draft. Event-timestamp-to-second-animation-frame p95 was 42 ms (max 52 ms), compared with 24 ms baseline across 40 keys; the prior independent run measured 44 ms p95 across 328 keys. WebKit Event Timing separately reported 88 keydowns meeting its 16 ms observation threshold: reported-event p95 was 24 ms, maximum 32 ms. The full-population figure uses two animation frames as a next-paint-opportunity proxy; the Event Timing distribution covers only browser-reported events, so these are not identical metrics. This supports the 100 ms target for this controlled workload; it does not prove physical keyboard-to-display latency, final 20 seconds of the stream, GPU/Wayland behavior, other hardware, or full UI acceptance. App, owned children, private D-Bus activations, and external X11 cleanup all passed. Both complete raw receipts and the failed undersized-context attempt remain under artifacts/release-0.33.0/stream-latency/. The probe changed no tracked source, tests or tags. This ledger entry subsequently records its result; it does not qualify a 0.33.1 package.

Failed v0.33.0 release and next 0.33.1 candidate

Release run 36414378697 at 9e385cb / v0.33.0 failed the managed-runtime source-integrity check. The runtime built and six runtime tests passed, but the builder rewrote tracked timestamps in tools/llama.cpp.pin and packaging/llama.cpp/COMMIT. Signing and publication were skipped. This is a failed, unpublished release attempt; the existing tag remains unchanged.

Version 0.33.1 is the next candidate. Authoritative manifests, lockfiles and current documentation are being updated independently of historical 0.33.0 package/evidence identities. The source-integrity fix and regression are tracked separately. The existing public trust range and protected deployment rule authorize only 0.33.0; reviewed changes plus a new exact tooling pin are required before signing 0.33.1. No new candidate build, signature, publication or local installation is claimed here.

0.33.1 runtime build correction

The ordinary and notices-only builder paths now leave tracked source pins and reference metadata unchanged. Actual compile time/backend remain in ignored generated bin/COMMIT; notices-only retains the existing compile time. Three isolated real-shell regressions reproduce the previous behavior (two failures before the fix) and pass after it. The tests run early in packaging CI, native CI and the release receipt gate. The source-integrity guard is unchanged. Public trust is prepared for the same key through 0.33.1, with repository identity, epoch and installation floor preserved; remote deployment-rule/tooling updates and the new tag still require review.

Focused local validation passed 164 release/runtime/session tests, 107 authentication/installer/metadata/scanner tests and two executable-ownership tests, with no skips. A fresh real Vulkan/CPU runtime build is separate pending evidence; these fixture passes do not claim a completed 0.33.1 package, signed publication or installation.

Signed 0.33.1 publication and installed-app verification

On September 28, 2026, v0.33.1 was published from frozen commit e15c4480e65db5650af012bb2a9773dbe89acf84. Current-source Checks and Native desktop CI passed. Release run 36427024374, attempt 1, passed all 15 required build gates and protected signing after owner approval. Signed artifact 10987931982 has archive SHA-256 eedf78bf720daef56e3e1228a5e45f004fed9d38099e58bf0ae05dd8986cf7e1.

The publication job failed because its newly created draft was absent from the immediate authenticated listing. That failed workflow remains visible. Once the same draft became visible, publication resumed locally using the exact frozen publisher, original run/attempt receipts and signed artifact. It verified repository/tag identity, uploaded missing assets without replacement, downloaded and compared all seven assets, then published. A fresh public download independently matched every signed-artifact file, and offline AppImage verification confirmed publisher signature, version and full source commit. Neither tag nor package bytes changed. A subsequent tooling-only fix bounds retries of successful empty listings after draft creation; it never repeats creation or retries API errors. All 70 focused publisher/signing/verification tests passed, including delayed visibility, retry exhaustion and authorization failure.

Published package SHA-256 values:

• AppImage: 434853525c1df842d5b8a749989dccd32d3b8ff3df34bdee94c857f26646519b.
• Debian: 4f93c63092e0a2e832839e5796afc1a208b29ea5dd18adbaae7cc9c6b17d30af.
• Runtime sources: 909ee4d387f09e587be3d7a48bfa13ad6e5277b01c2d75d701c22cf1a53a5ec7.

The reviewed installer from the frozen release commit authenticated the public AppImage and replaced this machine's 0.32.0 installation while holding the native profile lock. The active ~/Applications/ShadowCode.AppImage link now selects ShadowCode-0.33.1-x86_64.AppImage with the exact published hash. The normal launcher reports 0.33.1; desktop version/source metadata and the durable accepted-signature receipt match. The superseded AppImage, prior runtime backup and installation journal are absent after successful activation.

Both user databases pass integrity checks; all protected original identities and immutable history rows remain. Four saved settings files are unchanged. Existing model-directory entries and profile-directory identities are preserved. Private backups remain outside Git. The installed AppImage passes all 20 isolated X11/WebKit interaction groups and owned-process/private-session cleanup. Its normal desktop launcher also opens a visible window with the existing user profile, after which the preservation check still passes. No paid provider task was run by this installation check.

This establishes one authenticated local upgrade and installed-window qualification. It does not establish physical Wayland resizing, broader clipboard/IME/DPI acceptance, GPU inference endurance, complete live provider lifecycle conformance, or universal upgrade/rollback behavior. Evidence is retained locally in artifacts/release-0.33.1/; the release workflow, tag and public assets provide the public release identities.

Authenticated published Debian installation

The public 0.33.1 Debian package was verified offline with the trusted installer bundle from e15c448, requiring the exact version, full source commit and publisher signature before retaining a private snapshot. Only that verified snapshot was mounted into a disposable Podman container, with --network=none, --pull=never and no-new-privileges. Runtime image ID was 1caaf41a912300bc41c3728bef96a3884f794300d9f696fcdcfbc089d8800998; current reviewed smoke helpers were mounted read-only. No host package installation occurred.

The actual package is named shadow-code, version 0.33.1. Package metadata, installed launcher/icon, CLI version/status, isolated project with network disabled, MCP stdio initialization/discovery, and a visible first X11 window all passed. Node, Rust and Cargo were absent. Exact Debian bytes remained unchanged; invocation-owned container cleanup passed. Earlier probe setup failures (an assumed package name, an absent cached-image helper, and non-executable mounted GUI helper) were retained, then corrected using inspected package metadata and explicit Bash execution. None was relabelled as a product failure or passing attempt.

Evidence: artifacts/release-0.33.1/authenticated-debian-result.json, the probe and retained logs. This is fresh authenticated installation and first-window evidence, not Debian upgrade/rollback, paid provider use, physical Wayland or GPU inference qualification.

Unreleased live verification refresh after editor saves

A new integration regression against d4d9aa8 reproduced a misleading visible verdict: the actual FileEditor save completed, but TaskSummary retained “Configured checks passed” without another focus/manual refresh. The editor now emits a project-scoped invalidation after successful saves and after observing changed disk revisions. Task summaries also use the existing shared native event transport for relevant same-session mutation/completion wake-ups, excluding token events.

Invalidation immediately clears the prior passing display. An edit during an unresolved backend assessment advances a generation and coalesces one follow-up read; the older response cannot restore green. Project/session/read-function identity is checked before displaying cached results. Hidden summaries defer backend reads and subscribers are removed on unmount. This adds local subscribers to the existing shared native registration, not one backend event registration per summary.

Five new regressions cover editor integration, in-flight invalidation, project/session changes, hidden/unmounted summaries and token-event filtering. All 512 UI tests across 83 files passed, along with TypeScript checking, production build and production test-transport exclusion. The original-code failing reproduction and final logs are retained under artifacts/prf-02-live-evidence/.

This is an unreleased source change, absent from signed 0.33.1 packages. It is not a general filesystem watcher: another session modifying the same workspace and external edits outside the open editor still require focus/manual reassessment. Rebuilt native/package qualification remains pending.