Browser Home
Home presents durable work independently of the process that most recently worked on it. The organization is fixed by the installation; browser input cannot select another organization's inventory or grant authority.
- Code:
src/core/organization/service.ts,src/channels/organizationAuthentication.ts,src/core/budgets.ts,src/channels/homeHost.ts,src/channels/homeAccessEpoch.ts,src/channels/homeThreadProjection.ts,src/channels/workViewScope.ts,src/config.ts,src/config/validate.ts,src/channels/homeRuntime.ts,src/channels/homeRepositories.ts,src/core/home/service.ts,src/core/home/live.ts,src/core/home/conditions.ts,src/core/home/week.ts,src/core/home/historyKey.ts,src/core/unitRuns.ts,src/core/coordinator/inventory.ts,src/channels/homeView.ts,src/channels/homeSeed.ts,src/channels/webAssets.ts,scripts/web-green-fixtures.ts,web/src/lib/githubLinks.ts,web/green/,src/channels/browserHomeInstallation.ts,src/channels/originalUnitRecipient.ts,src/channels/legacySlackAudience.ts,src/channels/browserHomeWiring.ts,src/channels/slackEmoji.ts. ;src/core/coordinator/unitProgress.ts,src/core/coordinator/driver.ts,src/channels/adminCoordinator.ts;src/channels/homeAttachedContext.ts;src/core/nativeMedia.ts,src/core/dispatch/originalOrganizationInput.ts,src/core/references/contextDependencies.ts,src/core/dispatch/contextAccess.ts - Tests:
src/core/organization/service.test.ts,src/channels/organizationAuthentication.test.ts,src/core/coordinator/instanceStore.test.ts,src/core/resumeLaunch.test.ts,web/green/components/readonlyThread.test.ts,src/channels/homeHost.test.ts,src/channels/homeAccessEpoch.test.ts,src/channels/homeThreadProjection.test.ts,src/channels/workViewScope.test.ts,src/config.test.ts,src/channels/homeRuntime.test.ts,src/channels/homeRepositories.test.ts,web/green/app.test.ts(actual app hash navigation),src/core/home/service.test.ts,src/core/home/live.test.ts,src/core/home/conditions.test.ts,src/core/home/week.test.ts,src/core/home/historyKey.test.ts,src/core/coordinator/inventory.test.ts,deploy/cloudflare-memory/inventory.test.ts,src/channels/homeView.test.ts,src/channels/webAssets.test.ts,web/green/frontend.test.ts,web/green/pages/workViews.test.ts,web/green/pages/pipeline.test.ts,web/src/lib/githubLinks.test.ts,web/green/pages/reportStates.test.ts,web/green/lib/homeSession.test.ts,web/green/lib/virtualRows.test.ts,web/green/components/threadSearch.test.ts,web/green/components/confirmationPrompt.test.ts,web/green/components/conversationDock.test.ts,web/green/components/unitList.test.ts,web/green/pages/pullRequest.test.ts,web/green/pages/discovery.test.ts,web/green/lib/pullRequest.test.ts,web/green/pages/homeActions.test.ts,web/green/pages/identities.test.ts,web/green/pages/personalReports.test.ts,src/channels/browserHomeInstallation.test.ts,src/channels/originalUnitRecipient.test.ts,src/channels/legacySlackAudience.test.ts,src/channels/browserHomeWiring.test.ts,src/channels/slackEmoji.test.ts. ;src/core/coordinator/driver.test.ts,src/channels/adminCoordinator.test.ts;src/channels/homeAttachedContext.test.ts;src/core/dispatch/originalOrganizationInput.test.ts,src/core/references/contextDependencies.test.ts,src/core/dispatch/contextAccess.test.ts
Behavior
Mine groups readable work by the current provider email, with surrounding spaces removed and case ignored. A current human browser or Slack proof supplies the email; the Slack directory supplies its matching human account. Operator-configured HTTP and MCP subjects with that same email join the owner filter. A subject with conflicting or missing email entries stays unclaimed. This read projection does not change grants, authenticated source attribution, durable account links or private conversation ownership. Missing email or failed lookup retains only independently proved owners.
Optional email enrichment returns within 1.5 seconds. A stalled source retains the independently proved owner set and reports timed_out; a late result cannot mutate that scope. All people skips optional enrichment and reports not_needed. Discovery-only Slack checks share pending reads and reuse completed results for 30 seconds, with at most 1000 issuer/tenant/subject entries. Strict private-source checks do not use this cache.
All people is available to a current human operator with all actions, all channels and read access to the current organization. A finite repository scope does not hide this option. Each row still needs the operator's existing read permission. Viewing as a different person remains restricted to sessions with every grant.
Work-view resolution emits one closed diagnostic with the selected mode, Slack email lookup outcome, owner count and broad-scope flags. It carries no emails, account identifiers, repository names or exception data. A provider miss and an unavailable lookup share one outcome when the provider cannot distinguish them. A failed diagnostic sink does not change the selected scope or the returned history.
A completed person-merge review records its exact PR, reviewed head and recipient as attention, without opening a human question or restarting its driver. An owned Merge card uses the current viewer’s existing command grant and GitHub binding. It offers a saved-ID confirmation, pins the recorded head, and leaves unauthorized viewers the PR link.
Durable discovery. Home reads paginated coordinator records and their unit rows, rather than discovering work through recent runs. Held work, missing verdicts, spent budgets and stopped runs remain unresolved until durable completion or the confirmed pipeline stop settles them. Merged and already-landed units appear in separate history. Seeded dependencies and existing unit owners remain intact.
Current authorization. Every instance is admitted with the same requester, channel, repository and unknown-visibility predicate as the existing unit listing. Denied instances contribute no identifiers, text or counts. Private workers retain redacted facts unless a fresh exact original-source recipient proof permits their title, thread and recorded question. Private rounds and endings still omit report and failure text. The host rechecks every disclosed private unit and its access epoch before emission; read-only views receive no answer controls.
Honest completeness. A failed inventory page, unit read, condition read, repeated cursor or read bound yields partial data, or unavailable when nothing could be read. A failed, malformed, foreign or ambiguous condition read retains even an apparently completed unit as unresolved with unknown next action; incomplete conditions never prove absence of an obligation. Empty authorized data and a fully filtered read are distinct. Supported local proof includes more than one thousand unresolved units. A complete inventory census is not a simultaneous transaction over every unit's changing state.
Personal attention. Only an open durable condition explicitly assigned to the current actor or its current proved source identities enters personal attention. Mine can include that readable assigned question without admitting the requester's other work. A recorded accepted answer, including its consumed event, removes that same question from attention. Original requester attribution, an idle outcome and run health never invent that assignment. Automation, another person, external dependencies and unknown conditions remain visible without personal urgency. Condition reads do not change unit ownership or authorize an answer.
Live work and next action. A supplied current-authorized live-unit read identifies moving work. Absent recorded conditions, the next action is unknown. The projection never invents a retry, recovery or continuation instruction from a display status.
Separate history. Completed history is independently paginated and re-authorized on every read. Browser history uses Sunday–Saturday boundaries in the selected time zone, sorts saved completion times across the complete bounded inventory, and binds continuation to organization, reader, global owner scope, week and zone. Its next arrow never opens future history. Incomplete inventory stays explicit. The legacy service path remains ordered by stable unit key. The ordered inventory preserves its original insertion watermark; a continuation resumes the inventory page, instance and last scanned unit, so unresolved prefixes and read bounds cannot make later completed work unreachable. The cursor encrypts those internal positions with a persistent installation-owned 32-byte AES-GCM key and authenticates the organization and reader. It contains no transcript or grants and cannot be used by another reader or organization. The service never generates a startup key. If continuation is needed without a configured key or a fixed-census resume position, the result is partial with no continuation. A pending, uncertain condition or active unit effect keeps even a merged record unresolved until that obligation settles.
Canonical pipeline reads. A known pipeline is read independently of the unresolved Home scan and includes its completed units. Current access and private redaction apply to every result. Failed lookup, condition reads and per-entity bounds remain unavailable or partial rather than proving absence.
Operator notices preserve the read result. Inventory RPC failures use a fixed phase and a closed error kind; exception text, names, causes, stacks and record identifiers are omitted. Home census, pipeline and history reads summarize only their first failed read, including unavailable conditions or invalid cursors. Normal pagination bounds do not emit failure notices. The existing readiness callback identifies its awaited phase (initialize, native_sources, reconcile or identity_notices) without logging private source data.
Validation criteria
| Criterion | Evidence |
|---|---|
Mine includes retained browser, Slack, HTTP and MCP runs for the same normalized email on /runs?all=1, including after refresh. A different email or ambiguous credential subject stays excluded. Email matches do not add read permission or change the authenticated source. | [unit] src/channels/browserHomeWiring.test.ts::browser production wiring::includes retained runs across email-matched browser, Slack and ingress identities in Mine, ::keeps unknown email matches unclaimed and never adds read permission or source authority |
| A repository-limited operator can select All people and keep that mode after refresh, while repository restrictions and the refusal to impersonate another person remain intact. | [unit] src/channels/workViewScope.test.ts::global work view scope::offers Everyone with full channel scope while preserving a finite repository limit, src/channels/viewAs.test.ts::the view-as routes::lets a repository-limited operator select Everyone without permission to view as another person, src/channels/browserHomeWiring.test.ts::browser production wiring::seeds All people for a repository-limited operator without offering person impersonation |
| Scope diagnostics report matching, missing and unmatched-or-unavailable email lookup states and repository-limited eligibility without identity data. Diagnostic failure preserves the same matched owner set. | [unit] src/channels/browserHomeWiring.test.ts::browser production wiring::includes retained runs across email-matched browser, Slack and ingress identities in Mine, ::keeps unknown email matches unclaimed and never adds read permission or source authority, ::seeds All people for a repository-limited operator without offering person impersonation, ::keeps matched history available when the work-view diagnostic sink throws |
| A stalled optional Slack proof, reverse email lookup or profile email read cannot hold a browser response beyond 1.5 seconds. All people skips enrichment; repeated refreshes share verification, completed results expire, and timed-out scopes retain their original owners. | [unit] src/channels/browserHomeWiring.test.ts::browser production wiring::returns independently proved owners within 1500 ms when optional %s stalls, ::does not wait for optional Slack enrichment when All people is selected, ::shares optional Slack verification across refreshes without mutating timed-out scopes |
Inventory RPC failures keep the 503 response and emit only home.read.failed, phase pipeline_inventory_list and a closed error kind. Type, syntax, other Error and non-Error throws cannot expose planted exception details. | [unit] deploy/cloudflare-memory/inventory.test.ts::durable pipeline census::keeps inventory failure responses and logs only a closed error kind %s |
| Snapshot, pipeline and history failures retain partial or unavailable results and emit one bounded phase/reason summary per read. A failed condition read across many units does not emit per-unit notices. Invalid history cursors remain refused; ordinary census bounds stay silent. | [unit] src/core/home/service.test.ts::Home durable fleet::summarizes failed condition reads once without private details in %s, ::reports failed inventory reads without changing unavailable %s output, ::reports invalid history cursors but does not log ordinary census bounds |
| Readiness notices carry only the fixed event, current awaited phase and closed error kind. Logging failure cannot stop later checks. | [gap] The inline callback in src/index.ts is source-checked and type-checked locally; its four asynchronous failure phases do not have a bootstrap behavior test. |
| A final retained-source scan rechecks the same signed receiver and then the current source-policy/access revisions before returning its access epoch. JWT expiry, current organization-read loss, or a concurrently observed retained-source revocation withholds the HTTP transcript; healthy unchanged proof keeps the readable snapshot. | [unit] src/channels/homeAccessEpoch.test.ts::complete Home access epoch::rechecks the signed receiver after the final peer scan before its HTTP snapshot:…, ::rechecks retained source revisions after the final receiver await before its HTTP snapshot:… |
| Registered Home movement reads the whole current durable live set as well as local runs. A normal recorded wait for the exact current working child remains Moving on Home and pipeline pages after complete condition and required private-metadata proof. Fresh lease/state, visibility and canonical question/held/ending facts qualify it; checks, retry delays, other children and a known local finish cannot substitute for that child. An unreadable or invalid condition cannot bypass a recorded wait. Missing, corrupt, incomplete or failed durable facts remain partial, with no owner change or private row disclosure. | [unit] src/core/home/live.test.ts::registered Home live work::* |
| Focused target revocation immediately hides its transcript, reply and saved intent. Only fresh broad proof for the same receiver, organization, stream, binding and access epoch restores the separate broad draft and scroll. Fresh read-only broad access keeps writes disabled. Failed or changed proof clears private state; late target frames and acknowledgments cannot restore its content or replay an action. Target reproof failure hides old page facts even when a malformed frame precedes its response; after successful reproof, an ordinary network error does not revoke the page or request focus. | [unit] web/green/lib/homeSession.test.ts::Home conversation destination::restores only freshly authorized broad draft and scroll after focused …, ::clears focused and broad private state when fresh broad proof is …, ::keeps only opaque original receipt recovery while a revoked target's late acknowledgment cannot consume the broad draft or repost; web/green/app.test.ts::Green App navigation::keeps freshly authorized broad conversation after focused … |
| Unknown browser outcomes retain only bounded opaque issued identifiers under the actual organization and credential principal. Revocation still removes text, offers and exact-body retries; restored proof or a reload can read original owner status without replaying. Everyone retains its actual viewer's own status; Person, view-as, foreign native identity and foreign realm cannot borrow it. Admission, handler bookkeeping and native action acknowledgment remain distinct; missing or unavailable evidence stays unknown. | [unit] src/core/organization/service.test.ts::organization authenticated service::reads only the exact current source's original receipt without replaying or returning its private body, ::holds receipt status when current source authorization changes during the read, src/channels/homeRuntime.test.ts::authenticated browser organization runtime::reads the exact opaque owner's admission without exposing a saved choice or replaying it, ::reports original handler bookkeeping without native success and withholds it on a mid-read proof loss, web/green/lib/homeSession.test.ts::Opaque earlier request recovery::*, web/green/components/conversationDock.test.ts::Conversation dock scroll::checks an earlier uncertain choice after a real reload without restoring its offer or sending it again |
| Home inline target loss withholds affected work and freshly reads the current work snapshot after verifying the same broad receiver and privacy scope. Unrelated readable work and original saved-choice recovery remain usable. A missing, redacted or unknown row cannot authorize a cached private label, offer or thread link, imply settlement, or create a replacement act. Thread links and Answer controls use current readable thread and recorded question facts; an old page seed cannot restore a redacted target. | [unit] web/green/pages/homeActions.test.ts::Home actions::reproves Home work and retains another original saved choice after inline target loss via … |
| The dock attaches the viewed pipeline or recorded pull request without retargeting replies. Explicit conversation revocation, including a current 401/403/404 send denial with JSON, plain-text, HTML or empty body, focuses a persistent permission-safe explanation. The status is handled before receipt decoding; focused recovery and broad access loss retain their separate privacy rules. A remounted composer cannot steal that focus; delayed proof failure keeps the explanation reachable. Read-only thread revocation retains its explanation focus; ordinary loading and network failures never request focus. | [unit] web/green/components/conversationDock.test.ts::Conversation dock scroll::attaches the viewed pipeline and recorded pull request without changing the reply destination, ::moves focus to the unavailable explanation only on explicit conversation revocation, ::focuses a persistent permission-safe explanation during focused …; web/green/lib/homeSession.test.ts::Home conversation destination::handles definite non-JSON denial for …; web/green/components/readonlyThread.test.ts::unfocused thread privacy::focuses the read-only unavailable explanation on explicit revocation without focusing network failures |
| A stale denial cannot clear a different current destination or its draft. An unreadable or unrecognized successful receipt, server failure or network failure remains unknown with its original issued key, exact retry and offer; it cannot imply acceptance or create another intent. Accepted late acknowledgments retain their original owner bookkeeping. | [unit] web/green/lib/homeSession.test.ts::Home conversation destination::ignores a late non-JSON target denial after navigation without clearing the current broad draft, ::keeps … uncertain with its exact original retry rather than a new intent, ::keeps the saved reply scroll when acceptance arrives after leaving its thread |
| Every cost breakdown retains daily comparisons and the group trend chart | [unit] web/green/pages/reportStates.test.ts::Green report states::keeps the daily comparisons and group trend visible on every cost breakdown |
| Delivery exposes an advancing snapshot age and the counted review and agent identities | [unit] web/green/pages/reportStates.test.ts::Green report states::keeps Delivery freshness visible and advancing while disclosing the counted identities |
| An inventory census includes old runless pipelines, retains updates and excludes later insertions from the same cursor | [unit] src/core/coordinator/inventory.test.ts::durable pipeline inventory::keeps old pipelines discoverable without a run and excludes later insertions from its census, deploy/cloudflare-memory/inventory.test.ts::durable pipeline census::pages old runless pipelines through SQLite without admitting later insertions |
| Invalid and unauthorized inventory reads cannot imply an empty complete fleet | [unit] src/core/coordinator/inventory.test.ts::durable pipeline inventory::refuses malformed paging instead of reporting an empty complete inventory, deploy/cloudflare-memory/inventory.test.ts::durable pipeline census::refuses unauthenticated and malformed census requests |
| Authenticated organization admission precedes page reads; client actor and organization claims select no authority | [unit] src/channels/homeView.test.ts::authorized Home pages::ignores client actor and organization claims and paints the admitted organization, src/channels/homeView.test.ts::authorized Home pages::refuses absent and foreign tenant admission before building a page, src/channels/homeView.test.ts::authorized Home pages::uses the proved person for attention while retaining the credential's read authority |
| The requested frontend entry and its static styles are selected explicitly | [unit] src/channels/webAssets.test.ts::loadWebAssets::selects the requested frontend and includes its shared static styles, src/channels/webAssets.test.ts::loadWebAssets::refuses a missing frontend entry instead of switching the viewer to another build |
| An old held unit remains visible without recent or live runs | [unit] src/core/home/service.test.ts::Home durable fleet::keeps old unanswered work visible without any recent or live run |
| More than one thousand unresolved units remain discoverable across inventory pages | [unit] src/core/home/service.test.ts::Home durable fleet::collects more than one thousand unresolved units across inventory pages |
| A failed later page preserves rows and exposes partial completeness without upstream error details | [unit] src/core/home/service.test.ts::Home durable fleet::shows incomplete inventory as partial while keeping the rows already read |
| Denied records and private worker conversation fields never reach the projection | [unit] src/core/home/service.test.ts::Home durable fleet::never returns denied instance names or private worker conversation fields |
| Only the exact assigned actor receives personal urgency | [unit] src/core/home/service.test.ts::Home durable fleet::puts only an explicitly assigned question in personal attention |
| Current live evidence identifies moving work and missing next actions stay unknown | [unit] src/core/home/service.test.ts::Home durable fleet::uses live evidence for moving work and leaves unknown next actions unknown |
| Completed work has separate current-authorized pages while held and unconfirmed stopped work remain unresolved | [unit] src/core/home/service.test.ts::Home durable fleet::pages completed history separately and keeps held and stopped work unresolved |
| Uncertain condition reads keep apparently completed work unresolved, without invented personal urgency | [unit] src/core/home/service.test.ts::Home durable fleet::retains apparently completed work as unresolved when its condition read is * |
| The final metadata guard selects only private unit keys serialized in that response. Completed snapshot rows, filtered rows and history lookahead do not create an unrelated final permission or canonical-row failure. | [unit] src/channels/homeView.test.ts::authorized Home pages::selects only serialized unresolved private rows for the final request guard, src/channels/browserHomeInstallation.test.ts::browser installation::rechecks only serialized private rows after a bounded projection omits another owned unit |
| Non-calendar private history filters its saved cursor and remaining scan bound before source proof; each bounded batch includes at most the remaining result slots plus one terminal lookahead. Resumed pages reauthorize without proving the skipped pipeline prefix or exposing private fields after refusal. | [unit] src/core/home/service.test.ts::Home durable fleet::bounds private history proofs by cursor scan and result lookahead before reading a large pipeline |
| History advances beyond the unit scan bound, inventory page bound and an unresolved prefix | [unit] src/core/home/service.test.ts::Home durable fleet::continues completed history beyond its unit scan bound, src/core/home/service.test.ts::Home durable fleet::continues completed history beyond its inventory page bound, src/core/home/service.test.ts::Home durable fleet::advances through unresolved rows that exhaust the scan before completed history |
| Global unit-key ordering holds across reverse insertion order and overlapping instance prefixes | [unit] src/core/home/service.test.ts::Home durable fleet::preserves global unit-key order even when pipelines were inserted in reverse order, src/core/coordinator/inventory.test.ts::durable pipeline inventory::pages keys in order under the same census and fences cursor ordering, deploy/cloudflare-memory/inventory.test.ts::durable pipeline census::orders complete unit key prefixes and excludes later SQLite insertions |
| A terminal page and encrypted history continuation preserve the same census across service replacement and later insertions | [unit] src/core/home/service.test.ts::Home durable fleet::keeps an encrypted history census stable across service replacement and later insertions, src/core/coordinator/inventory.test.ts::durable pipeline inventory::can resume a terminal page without admitting later insertions, deploy/cloudflare-memory/inventory.test.ts::durable pipeline census::resumes a terminal SQLite page under the same insertion watermark |
| Reader and organization changes or ciphertext tampering refuse the cursor; current access still decides every resumed read | [unit] src/core/home/service.test.ts::Home durable fleet::binds encrypted history cursors to the reader and organization while reauthorizing every page |
| An absent installation key yields partial history without an unsafe or guessed continuation | [unit] src/core/home/service.test.ts::Home durable fleet::returns truthful partial history without a continuation when its installation key is absent |
| Cyclic pages terminate with partial data and initial read failure is unavailable | [unit] src/core/home/service.test.ts::Home durable fleet::bounds a cyclic inventory cursor and exposes failure before the first row |
| Foreign, malformed or ambiguous condition facts do not create personal urgency | [unit] src/core/home/service.test.ts::Home durable fleet::rejects foreign and ambiguous condition facts without inventing personal urgency |
| Personal attention names the assigned question's next action ahead of an unrelated external wait | [unit] src/core/home/service.test.ts::Home durable fleet::shows the assigned question's next action ahead of another wait on the same unit |
| Restricted reads disclose their scope even when every authorized row loaded | [unit] src/core/home/service.test.ts::Home durable fleet::labels a restricted fleet view without claiming the whole organization is caught up |
| Local presentation orders personal attention first and distinguishes partial, filtered and caught-up states | [unit] web/green/pages/workViews.test.ts::Green browser frontend::presents personal attention before moving work and other waits, web/green/pages/workViews.test.ts::Green browser frontend::distinguishes incomplete, filtered, and fully caught-up fleet states |
| All unresolved rows remain reachable without mounting a thousand DOM rows or clipping variable-height data | [unit] web/green/pages/workViews.test.ts::Green browser frontend::finds the last unresolved unit in a thousand-row list and shows its complete next action, web/green/lib/virtualRows.test.ts::Unresolved work viewport::keeps a thousand variable-height rows reachable without mounting the whole list |
| Explicit local focus preserves one composer, separate drafts and separate scroll positions | [unit] web/green/frontend.test.ts::Green browser frontend::mounts one composer and changes its announced destination only after explicit thread focus, web/green/lib/homeSession.test.ts::Home conversation destination::* |
| Private revocation removes text and view-as remains read-only even when the broad session can write | [unit] web/green/frontend.test.ts::Green browser frontend::removes the composer and transcript on an active private-feed revocation, web/green/frontend.test.ts::Green browser frontend::keeps view-as pages read-only even when the person's own broad session permits writes |
| Missing or partial private history cannot read as a complete empty conversation | [unit] web/green/frontend.test.ts::Green browser frontend::discloses more retained history and does not call an empty bounded page a complete conversation |
| The primary navigation contains only Home, Delivery, Costs and Metrics, with an advanced run link | [unit] web/green/pages/workViews.test.ts::Green browser frontend::keeps exactly the four primary destinations and a separate advanced run link |
| Thread search preserves the protected API and rejects late results from an earlier thread | [unit] web/green/components/threadSearch.test.ts::* |
| Saved actions require an explicit Confirm or Cancel; retries retain the issued key and offers cannot cross destination or identity scope | [unit] web/green/components/confirmationPrompt.test.ts::*, web/green/lib/homeSession.test.ts::Home conversation destination::* |
| Actual transcript scrolling is captured and restored for each authorized destination | [unit] web/green/components/conversationDock.test.ts::Conversation dock scroll::captures actual transcript scrolling and restores broad 420 and local 80 independently |
| Marked local Home fixtures identify the same fictional account and organization as their session; first-frame and already-loaded sessions keep the real Home cards visible without weakening the production privacy guard | [unit] web/green/frontend.test.ts::Green browser frontend::keeps marked preview Home work visible with its real fixture session loaded before mount:… |
| Pipeline navigation opens the durable context without inventing a live run capability | [unit] web/green/pages/workViews.test.ts::Green browser frontend::opens durable pipeline context without fabricating a live run capability |
| Recorded pull-request evidence opens contextually in the main pane and unknown evidence stays unknown | [unit] web/green/pages/pullRequest.test.ts::*, web/green/lib/pullRequest.test.ts::* |
| Report failures remain unknown rather than zero usage or billing | [unit] web/green/pages/workViews.test.ts::Green browser frontend::keeps missing model billing unknown while showing the known cloud total, web/green/pages/workViews.test.ts::Green browser frontend::keeps unavailable metrics distinct from a zero-usage report |
| Phone, desktop and light/dark appearance use the registered production-bundle capture profiles | [agent] Run npm run screenshots:gen and inspect each green Home, unit, run, runtime and pull-request capture in both themes at the desktop and phone profiles. Confirm one writable composer, complete fields, visible focus and usable touch controls. |
| Actual adapters, unfocused target-access revocation, identity ceremonies, original-owner effects and staging acceptance | [gap] Source and fixture proofs do not establish these live outcomes. The execution-model scope decision precedes cutover. |
| Every attempted submission key stays reserved for its original intent, including uncertain results and later edited sends | [unit] web/green/lib/homeSession.test.ts::Home conversation destination::reserves an uncertain key after an edited intent succeeds before a third message |
| Revocation clears the active transcript during a pending focus and its late response cannot restore access | [unit] web/green/lib/homeSession.test.ts::Home conversation destination::clears the active transcript when access is revoked during a pending focus and refuses its late response |
| Display entries preserve proved authorship without requiring private storage fields or inferring authors from roles | [unit] web/green/lib/homeSession.test.ts::Home conversation destination::accepts display entries without private storage fields and refuses malformed attribution frames, web/green/components/conversationDock.test.ts::Conversation dock scroll::uses proved authorship for You and preserves other people, unknown authors and service labels |
| A reply accepted after navigation clears only its sent text and attachments, preserves its saved scroll, and leaves the broad draft and position unchanged. | [unit] web/green/lib/homeSession.test.ts::Home conversation destination::keeps the saved reply scroll when acceptance arrives after leaving its thread |
| Urgency never labels another person's condition as the viewer's | [unit] web/green/components/unitList.test.ts::Home condition ownership::labels only the exact proved attention recipient as You in a multi-owner urgent row, web/green/pages/workViews.test.ts::Green browser frontend::labels only the exact attention recipient as You on a unit with mixed person conditions |
| Transient confirmation failures preserve the offer and the original issued choice for retry | [unit] web/green/components/confirmationPrompt.test.ts::Scoped saved action confirmation::preserves confirm after a transient server response and retries its exact issued choice, web/green/components/confirmationPrompt.test.ts::Scoped saved action confirmation::preserves cancel after a transient server response and retries its exact issued choice |
| Unpriced model usage is visibly excluded on every cost breakdown | [unit] web/green/pages/reportStates.test.ts::Green report states::warns that unpriced model usage is excluded from the shown estimate on every breakdown |
| Delivery exports use the resolved repository and preserve range filters on trailing-slash routes | [unit] web/green/pages/reportStates.test.ts::Green report states::exports trailing-slash delivery pages through the resolved repository and keeps the report filters |
| Unavailable schedule reads never imply no schedules or no prior firing | [unit] web/green/pages/reportStates.test.ts::Green report states::distinguishes unavailable schedule data from a successfully empty registry, web/green/pages/reportStates.test.ts::Green report states::keeps a missing last firing unknown when firing history is unavailable |
| Focused shared threads preserve other authors and source provenance | [unit] web/green/frontend.test.ts::Green browser frontend::preserves other authors and source provenance when the dock focuses a shared thread |
| Moving pipeline rows use projected evidence while unknown states and explicit waits stay honest | [unit] web/green/components/unitList.test.ts::Home condition ownership::shows Working only for a projected moving row while retaining unknown state and explicit waits |
| Known completed and runless pipelines remain readable after they leave Home | [unit] src/core/home/service.test.ts::Home durable fleet::reads a completed runless pipeline directly after it leaves Home, src/core/home/service.test.ts::Home durable fleet::reads a known pipeline beyond the global Home scan without inheriting another pipeline's bound |
| Direct pipeline reads retain completed and unresolved units with honest bounds, uncertain conditions and moving facts | [unit] src/core/home/service.test.ts::Home durable fleet::keeps a directly found pipeline readable when its unit bound is incomplete, src/core/home/service.test.ts::Home durable fleet::keeps uncertain completed-looking units unresolved while preserving known moving facts |
| Canonical pipeline denial returns no metadata and failed lookup cannot imply absence | [unit] src/core/home/service.test.ts::Home durable fleet::returns no pipeline metadata for unknown or currently denied entities, src/core/home/service.test.ts::Home durable fleet::does not turn an incomplete fallback census into a missing pipeline, src/core/home/service.test.ts::Home durable fleet::keeps pipeline lookup and live-source failures distinct from missing entities |
| Direct pipeline projections retain private worker redaction | [unit] src/core/home/service.test.ts::Home durable fleet::redacts private worker metadata from the direct pipeline and its units |
| HTTP pipeline pages preserve completed links, moving projection and unavailable lookup status | [unit] src/channels/homeView.test.ts::authorized Home pages::keeps completed pipeline links readable and preserves proven moving activity, src/channels/homeView.test.ts::authorized Home pages::returns unavailable rather than not found when canonical pipeline lookup is incomplete |
| Pipeline views keep completed units and distinguish partial, unknown and complete coverage | [unit] web/green/frontend.test.ts::Green browser frontend::keeps completed pipeline units visible beside proven moving preview work, web/green/pages/workViews.test.ts::Green browser frontend::distinguishes partial and unknown pipeline coverage from a complete unit read |
| Pipeline rows classify completion only from a successful current condition and private-metadata read. Active and unknown rows stay visible; completed rows have separate keyboard navigation. Recorded recipient attention and a bounded next-action summary retain the original unit/thread/PR/Changes links; the virtualized unit lists keep every loaded row reachable by keyboard; plan links require a recorded safe repository/base/path and private plan redaction remains | [unit] src/core/home/service.test.ts::Home durable fleet::classifies pipeline completion only after known conditions and readable private facts; web/green/pages/pipeline.test.ts::Pipeline work navigation::*; web/src/lib/githubLinks.test.ts::githubLinks::builds recorded file links from safe repository, ref and path values without adding a revision |
| Missing runtime and billing data remain unavailable; confirmed empty data may show zero or no snapshot | [unit] web/green/pages/reportStates.test.ts::Green report states::keeps missing runtime data unavailable while a confirmed empty runtime shows zero counts, web/green/pages/reportStates.test.ts::Green report states::distinguishes unavailable billing data from a confirmed absent first snapshot |
| Thread discovery declares its loaded browser scope and does not imply complete retained history | [unit] web/green/pages/reportStates.test.ts::Green report states::limits thread discovery and filtering to the loaded browser list without implying full history coverage |
| Missing run data cannot imply an empty live registry | [unit] web/green/pages/discovery.test.ts::Run discovery availability::shows unavailable data instead of claiming that no runs are live |
| Replies preserve full authorized thread keys and qualify only short browser conversation ids | [unit] web/green/frontend.test.ts::Green browser frontend::replies to … through the exact authorized thread destination |
| A missing repository environment remains unavailable rather than supplying empty runtime facts | [unit] web/green/pages/discovery.test.ts::Run discovery availability::keeps a missing repository environment unavailable instead of inventing empty runtime facts |
| Grouped children retain their selected parent while independent runs remain top-level on both sides of the retention divider | [unit] web/green/pages/discovery.test.ts::Run discovery availability::keeps children associated with their selected group head across both retention branches |
| An ended run stops waiting for a missing diff while retaining any recorded artifact | [unit] web/green/pages/pullRequest.test.ts::Pull request main pane::stops waiting for a missing reading diff when the live run ends and preserves any recorded diff |
| Unit spend distinguishes unavailable reads from an empty range and labels retained spending against the original cap | [unit] web/green/pages/reportStates.test.ts::Green report states::distinguishes missing unit spend from an empty range and labels retained spending against the original cap |
| Delivery refresh keeps weeks and since filters without URL fragments | [unit] web/green/pages/reportStates.test.ts::Green report states::keeps Delivery refresh ranges independent of URL fragments |
| Missing or denied thread reads remain unavailable and offer no local reply; separately authenticated broad composing and valid empty threads remain available | [unit] web/green/frontend.test.ts::Green browser frontend::keeps missing or denied thread reads unavailable without local reply while preserving the authenticated broad dock |
| Hash-only navigation preserves the selected thread reply and its draft; changing pages restores the separate broad draft | [unit] web/green/app.test.ts::Green App navigation::keeps the focused reply and local draft through hash navigation, while a new page restores the broad draft |
Authenticated browser conversation protocol
This support layer supplies the protected HTTP and live conversation contract. The installation provides current authentication, source epoch, thread projection and original admission callbacks. The server registers the runtime through the same dashboard verification and current source checks as the work pages. Each send captures a server-issued key and destination revision; an exact retry returns the original receipt. Missing current proof or a changed source epoch closes the private stream. An unfocused thread observer does not move the composer. Saved choices retain their exact server action and reject attached context. Explicit repository context uses current public repository choices and the actual actor's existing code policy; unrelated readable attachments never select the execution repository.
| Criterion | Evidence |
|---|---|
| Server-issued thread event URLs preserve authorized read-only and explicit observer mode; writable focus still revokes on write loss, observers revoke on read or privacy loss, and broad streams retain read-only access | [unit] src/channels/homeRuntime.test.ts::authenticated browser organization runtime::follows server event URLs for authorized read-only threads and view-as; ::keeps explicit observation in every emitted session and reopened stream; ::revokes a writable focused stream when write permission is lost; ::preserves broad event URLs and reads when key issuance is unavailable; ::revokes observer streams on current thread read or privacy loss |
| Browser sessions, sends, issued keys, history windows, protected deletion, exact question retries and source revocation obey the authenticated conversation contract | [unit] src/channels/homeRuntime.test.ts::authenticated browser organization runtime::* |
| Repository choices and selected source use only current public capability and code policy; attachment context does not retarget the selected repository | [unit] src/channels/homeRepositories.test.ts::Home repository selection::* |
Current-source host and focused thread readers
The registered production host composes these factories with current native authentication, original-owner callbacks and IO. These unit proofs do not establish deployed availability.
| Criterion | Proof |
|---|---|
| A browser worker audience retains its original source and refuses saved model input and output after the captured private-source policy changes | [unit] src/channels/homeHost.test.ts::Home authenticated host::binds its private worker audience to the captured source policy before model input or delivery |
| A resumed private input must match its retained original owner, body and source; replies attach to that input's receipt and current proof must still pass | [unit] src/channels/homeHost.test.ts::Home authenticated host::rehosts only the retained original input and sends its reply to that input's receipt, src/channels/homeHost.test.ts::Home authenticated host::refuses private history and delivery when the source loses its private audience proof |
| Mine includes work credited to the viewer while relayed service input retains its actual author | [unit] src/channels/homeThreadProjection.test.ts::focused browser thread projection::keeps credited work in Mine without calling a relayed service request You |
| The authenticated host admits an HTTP message once, retains its original run, and preserves prototype-backed channel methods | [unit] src/channels/homeHost.test.ts::Home authenticated host::admits through HTTP once, keeps its original run, and preserves prototype-backed IO |
| Deleted private content is excluded from the next owned input; a late private reply is refused after current source revocation | [unit] src/channels/homeHost.test.ts::Home authenticated host::removes private content from the next owned input and refuses a late reply after revocation |
| Every delayed source delivery rechecks current organization permission, including status edits, upload completion and child-thread output | [unit] src/channels/homeHost.test.ts::Home authenticated host::refuses delayed source delivery after organization read permission is removed |
| Older exact credential revocation changes the epoch even outside the latest 100 entries, while same-source new messages keep it stable | [unit] src/channels/homeAccessEpoch.test.ts::complete Home access epoch::* |
| New valid credentials and threads preserve the epoch across host replacement; more than 200 authorized scopes remain readable through complete pages | [unit] src/channels/homeAccessEpoch.test.ts::complete Home access epoch::keeps an existing draft and accepted owner epoch when new valid credential and thread scopes are added; src/channels/homeAccessEpoch.test.ts::complete Home access epoch::checks more than 200 distinct retained authorized scopes without refusing Home or discarding its epoch |
| An accepted owner can reply after a scope is added, but revocation and partial native permission loss still fence it | [unit] src/channels/homeAccessEpoch.test.ts::complete Home access epoch::delivers an already accepted owner reply after another valid scope is added and fences it after revocation; src/channels/homeAccessEpoch.test.ts::complete Home access epoch::fences a partial retained native policy loss even while the source can still read the organization |
| An incomplete later catalogue page holds the frame instead of certifying its first 200 scopes | [unit] src/channels/homeAccessEpoch.test.ts::complete Home access epoch::refuses an incomplete second catalogue page instead of certifying the first 200 scopes |
| A focused answer target includes the canonical full saved-question digest; unrelated transcript changes do not replace its target | [unit] src/channels/homeThreadProjection.test.ts::focused browser thread projection::keeps the question revision stable across transcript changes and changes it with the complete owner question |
| A canonical accepted answer stays answered after consumption and clearing; a changed original-owner question becomes actionable | [unit] src/channels/homeThreadProjection.test.ts::focused browser thread projection::keeps a consumed canonical answer from reopening the same saved question and offers a changed question |
| A protected delegated MCP source retains its actual service credential and exact credited person in its private audience; changed source policy fences delivery | [unit] src/channels/homeHost.test.ts::Home authenticated host::supplies only the exact delegated MCP private audience and fences it after current source policy changes |
Conversation retention
The registered host and thread-reader factories require the production integration's current-source policy and original-owner callbacks. Retention proofs below qualify those source paths; deployment remains a separate gate.
conversationRetention configures private message content, bounded original source snapshots, and noncontent receipts independently. Defaults are 90, 30 and 365 days. The loader refuses unknown fields and day counts that are not positive safe durations. Source snapshot expiry is anchored to the original admission time, not the time an owner consumes or resumes it. Private history keeps its 90-day content period and receipts keep their 365-day replay and attribution period. The dispatcher rereads the exact original retained ledger body before starting a delayed task; deletion or snapshot expiry refuses that task without a new model run. Bodyless original attribution does not restore deleted input bytes.
| Criterion | Proof |
|---|---|
| Default and configured conversation retention remain separate; invalid or unknown fields refuse loading | [unit] src/config.test.ts::conversation retention config::* |
| Snapshot expiry refuses original-owner consumption while private history and the original replay receipt remain retained | [unit] src/core/organization/runtime.test.ts::organization runtime::expires the original source snapshot before consuming an owner while private history and replay receipts remain retained |
| A delayed launch after the original snapshot deadline, or after explicit body deletion, refuses before model execution | [unit] src/core/organization/runtime.test.ts::organization runtime::refuses a delayed launch after its original snapshot deadline and refuses an explicitly cleared snapshot before executing |
Proved history authors
User history carries only its protected original source author. Assistant turns have no user author; current permission loss during the read holds the entire private context.
| Criterion | Proof |
|---|---|
| Private model history preserves the protected original user and never stamps the current viewer on assistant text | [unit] src/channels/homeHost.test.ts::Home authenticated host::preserves original user authors in private history and fences a policy change during the read |
| Read projections overwrite false author stamps after current source proof, without persisting them | [unit] src/core/organization/service.test.ts::organization authenticated service::projects only protected source authors and discards supplied read author stamps |
| Opened child threads retain local replies and native history; current source loss still refuses publication, and the broad stream receives no child reply | [unit] src/channels/homeHost.test.ts::Home authenticated host::keeps opened thread replies and history local while preserving current source checks |
Scoped Home read projection
The original-source proof permits owned metadata only. Thread and private worker log reads retain their separate current authorization. Calendar history uses at most 100 rows per page. The persistent cursor key is derived for this organization and purpose, never generated at startup. Native fleet latency and request-budget qualification remain unproved.
| Criterion | Evidence |
|---|---|
| The source epoch is captured before any inventory projection, including pages without private rows; a changed policy before emission refuses the frame. | [unit] src/channels/browserHomeInstallation.test.ts::browser installation::starts the request source fence before projecting an inventory with no private rows |
| Metadata phases retain exact device credentials and native addresses; current grants are rebuilt and a new phase sees credential revocation. No metadata proof releases private history, and source or canonical changes during asynchronous final proof refuse the page. | [unit] src/channels/organizationAuthentication.test.ts::current organization authentication::keeps metadata phase credential and native address proofs separate and rebuilds current policy, src/channels/browserHomeInstallation.test.ts::browser installation::fences private metadata after exact source or canonical ownership changes without releasing history |
| Private Home reads group full canonical unit keys and bound native proof concurrency within disposable metadata phases; a fresh canonical/source phase and epoch fence output. A generated thousand-pipeline shared/distinct-source fixture qualifies read counts, not production latency. | [unit] src/channels/browserHomeInstallation.test.ts::browser installation::reads a thousand private generated pipelines with bounded fresh metadata phases* |
| Home/history/pipeline projection rechecks every exact private instance/unit whose source proof allowed disclosure before emitting, then rechecks the host epoch. Native legacy source loss during answer enrichment returns 404 without private text even when that epoch stays unchanged. | [unit] src/channels/homeView.test.ts::authorized Home pages::fences private Home text when source permission changes during answer enrichment |
| An authorized private unit thread opens an observer shell without copied input; unknown targets and permission loss remain non-revealing | [unit] src/channels/homeView.test.ts::authorized Home pages::opens an authorized private unit thread without seeding private input and fences permission loss before emission |
| Mine includes a currently readable question explicitly assigned to the viewer without including the requester's other work | [unit] src/core/home/service.test.ts::Home durable fleet::keeps a readable assigned question in Mine without including its requester's other work |
| Completed work uses the viewer's Sunday–Saturday calendar boundaries, including DST, and week arrows never invent future history | [unit] src/core/home/week.test.ts::Home calendar week::converts both DST boundaries separately and keeps week arrows on local Sundays |
| The weekly timeline sorts saved completion times across the complete bounded inventory and binds continuation to its week and viewer | [unit] src/core/home/service.test.ts::Home durable fleet::pages a weekly completion timeline by saved ending time across inventory order |
| Persistent history keys remain stable across restarts, separate from credential encryption and scoped to the organization; missing keys stay unavailable | [unit] src/core/home/historyKey.test.ts::Home history key::* |
| Home uses only recorded question assignment; legacy questions stay unknown and private worker text stays hidden | [unit] src/core/home/conditions.test.ts::Home recorded condition projection::puts only the recorded assignee in You and keeps a legacy question unknown, src/core/home/conditions.test.ts::Home recorded condition projection::does not expose a private worker's question or invent an empty read after store failure |
| A thousand canonical questions require one unit-collection read per pipeline, and the next snapshot shows the new assignee | [unit] src/core/home/conditions.test.ts::Home recorded condition projection::reads a thousand canonical questions once per pipeline and observes a changed assignment on the next snapshot |
| Canonical row reuse refuses foreign keys; standalone reads still observe current assignment | [unit] src/core/home/conditions.test.ts::Home recorded condition projection::uses only the matching canonical projection row and keeps standalone question reads fresh |
| Native first-attention and full-list reads meet their budgets at twice the observed retained fleet, including accepted-event reads per pending question | [gap] Requires a native Worker/browser receipt; local thousand-row tests do not qualify network latency or request limits. |
| A consumed original answer suppresses only that recorded question; a new question remains actionable | [unit] src/core/home/conditions.test.ts::Home recorded condition projection::keeps a consumed answer out of attention while a new recorded question remains actionable |
| All people retains the actual viewer's server-proved answers; Person cannot acquire an answer | [unit] src/channels/homeView.test.ts::authorized Home pages::includes server-proved own answers in All people while Person cannot acquire an answer |
| A new question revision or recorded action on the same thread enables a fresh reply after an accepted answer; an unknown original reply keeps its exact retry body before the new question can be answered | [unit] web/green/components/conversationDock.test.ts::Conversation dock scroll::enables a new question on the same thread after an accepted reply and captures a distinct reply; ::keeps an unknown first reply immutable when a new question arrives and enables that new question after checking it |
| A saved command uses its trusted action label, while a text reply remains an explicit disclosure | [unit] web/green/components/confirmationPrompt.test.ts::Scoped saved action confirmation::uses the trusted saved action label with a collapsed typed reply and never infers Merge from prose |
| Mine/All Reply uses a same-viewer current target-session write proof without changing the composer. Observer frames grant no write, unavailable private targets show no Reply, and revocation invalidates a delayed proof | [unit] web/green/components/readonlyThread.test.ts::unfocused thread privacy::offers All people Reply only after the actual viewer's target session proves write access and holds unavailable private targets; ::does not restore private All people content or Reply after a late target proof loses its observer |
| A reply accepted after navigation clears only its sent text and attachments, preserves its saved scroll, and leaves the broad draft and position unchanged. | [unit] web/green/lib/homeSession.test.ts::Home conversation destination::keeps the saved reply scroll when acceptance arrives after leaving its thread | | Opening an inline answer moves keyboard focus to its visible primary action; the typed-reply disclosure focuses the visible editor | [unit] web/green/pages/homeActions.test.ts::Home actions::moves keyboard focus from the opened attention row to its visible primary answer; ::expands the original attention row in place with one question and shows preservation only for a real draft |
| A recorded question action appears before the editor and an unknown result checks the exact captured answer | [unit] web/green/pages/homeActions.test.ts::Home actions::shows a recorded action before the editor and checks the same captured answer after an unknown result |
| An unknown typed answer remains visible and its immutable retry cannot acquire another action label | [unit] web/green/pages/homeActions.test.ts::Home actions::keeps an unknown typed answer visible and never labels its immutable retry as Merge |
| Global person changes remove pagination from the old data scope while retaining the chosen week and range | [unit] web/green/pages/homeActions.test.ts::Home actions::drops old-scope pagination after switching the global person while preserving the selected week and range |
| An unknown retry retains the selected repository in the immutable original message | [unit] web/green/pages/homeActions.test.ts::Home actions::captures a chosen repository in the broad message and retains it unchanged during an unknown retry |
| An unavailable repository catalogue differs from confirmed empty eligibility | [unit] web/green/pages/homeActions.test.ts::Home actions::keeps an unavailable repository catalog distinct from a known empty eligible list |
| Mounted All Home keeps one collapsed specific action and sends its original key/revision/thread as the unchanged viewer; foreign work metadata gains no Answer control | [unit] web/green/pages/homeActions.test.ts::Home actions::answers its own All people question as the unchanged current sender while foreign metadata has no answer control |
| Weekly completed work shows its selected zone, relative time and bounded navigation | [unit] web/green/pages/homeActions.test.ts::Home actions::shows the selected Sun–Sat week with honest completion times and no future-week arrow |
| Custom Slack emoji resolves only allowlisted local assets in prose, with code and unknown names unchanged | [unit] web/green/pages/homeActions.test.ts::Home actions::renders only catalog-backed local Slack emoji in safe prose and preserves code and unknown names |
| Pipeline cards retain real thread, repository, branch, PR and Changes links | [unit] web/green/pages/homeActions.test.ts::Home actions::offers original thread, repository, branch, pull request and Changes links from pipeline work |
| Global mode changes clear private state before the request settles, and All is offered only from its trusted capability | [unit] web/green/pages/homeActions.test.ts::Home actions::offers All people only from the trusted global capability and hides personal data while switching |
| Virtualized inline answers replace the original attention row and preserve a bounded list | [unit] web/green/pages/homeActions.test.ts::Home actions::measures the expanded answer inside its virtual row and keeps the rest of the list bounded |
| Accepted questions remain accepted while a lost acknowledgment keeps its exact saved reply reachable outside attention | [unit] web/green/pages/homeActions.test.ts::Home actions::checks the immutable saved reply after a winning answer makes the thread read-only and keeps it reachable outside attention |
Production composition seams
These factories compose the current execution owners and authenticated source proofs. The installation composes them at its production HTTP routes. Private-unit metadata permission is distinct from private transcript and execution permission; a read projection cannot create an actor alias or lend a source grant.
| Criterion | Proof |
|---|---|
| Unavailable target proof retains a pending canonical answer and its key; current proof records one original unit event. Known target policy denial stays closed. | [unit] src/channels/browserHomeInstallation.test.ts::browser installation::holds a pending canonical answer through target-proof outage and answers once after fresh proof |
| An unavailable GitHub directory cannot become a known repository denial; a fresh successful read selects the original authorized repository. | [unit] src/channels/homeRepositories.test.ts::Home repository selection::keeps an unavailable directory distinct from a confirmed empty eligible set |
| A saved proposal keeps source A context distinct from the new choice B receipt and execution owner. | [unit] src/channels/browserHomeInstallation.test.ts::browser installation::keeps saved source A context separate from choice B receipt and exact execution owner |
| Current unmarked personal registry offers use the exact active credential, approved Access subject and both current policy ceilings for browser consent only. A foreign viewer or a revoked original key cannot borrow another active key with the same subject. No historical input or source owner is fabricated. | [unit] src/channels/browserHomeInstallation.test.ts::browser installation::approves an own unmarked personal registry offer through current native proof without lending a foreign viewer consent |
| Production source setup uses the installation's fixed organization and current native realm while each admitted source keeps its original owner and native address. | [unit] src/channels/browserHomeWiring.test.ts::browser production wiring::keeps shared Slack threads local and admits a proved private DM with its configured repository and exact native address | | A native DM addressed to an existing unit or child stays in its local thread for output and history, never the broad private stream. Exact source retries keep the original destination and owner after ownership changes; a changed source thread conflicts. Unavailable or ambiguous ownership cannot become broad input. | [unit] src/channels/browserHomeInstallation.test.ts::browser installation::keeps an existing unit DM destination and addressed output out of the broad stream across exact retries, ::keeps an existing child DM destination and addressed output out of the broad stream across exact retries, ::holds an unknown DM ownership read instead of copying its reply into broad history | | Known-person and All projections retain the actual authenticated actor and apply current read ceilings; they cannot fabricate the selected person's browser proof. | [unit] src/channels/browserHomeWiring.test.ts::browser production wiring::projects a known person's work without their browser proof or changing the actual authentication | | Slack emoji image assets use verified hosts, bounded downloads and hashed bytes; aliases share one image, and installed assets remain readable after restart without Slack. | [unit] src/channels/slackEmoji.test.ts::Slack emoji assets::downloads custom images once across aliases and serves only hashed verified image bytes, ::refuses unknown hosts, unsafe redirects, alias cycles and non-image bodies, ::keeps installed image bytes and catalog after restart when Slack is unavailable |
| Completed organization intake can rehost its still-live canonical pipeline under the original run ID and guarded sink, without a model dispatch; completed intake cannot restart an ordinary model run | [unit] src/core/resumeLaunch.test.ts::launchResumes — the rehost branch (record 0060)::rehosts a completed organization admission under its original hosted owner through the guarded sink without redispatch |
| Original-owner progress records expose GitHub checks waits, original worker waits and retry delays as informational next acts; exact replay is stable, clear removes a wait and foreign or stale owners cannot overwrite it | [unit] src/channels/adminCoordinator.test.ts::recorded unit progress reaches Home::records an original checks wait, replays it once, clears it and refuses old or foreign progress |
| Recorded runtime failures remain attached to their original unresolved work; their owner and next act stay unknown without recorded assignment or an existing inspection thread | [unit] src/core/home/conditions.test.ts::Home recorded condition projection::shows a recorded runtime failure with its work and keeps the next act unknown when no inspection thread exists | | Progress recording surrounds the original wait and cannot fail execution during a store outage | [unit] src/core/coordinator/driver.test.ts::the plan runner's driver — the Workflow body over the step runner (item 9)::records and clears each actual worker wait before and after the original wait, while progress outages do not fail work | | SQLite preserves the winning progress revision and rejects stale CAS or malformed rows; changing canonical facts makes old progress inert | [unit] deploy/cloudflare-memory/inventory.test.ts::durable pipeline census::persists only the winning original progress CAS and refuses malformed progress rows |
| Wait diagnostics use a separate recordedProgress field; old opaque publication or execution evidence remains readable and prevents replacement | [unit] src/core/coordinator/instanceStore.test.ts::WorkerCoordinatorInstanceStore (over a state Worker double)::replacement retains existing publication or execution evidence:… |
Quoted attached work metadata
Broad messages materialize their retained work references from current authorized reads. Only canonical links and recorded metadata enter the bounded model seed. Private input/output, work briefs, logs, artifacts, credentials and actor claims are excluded. The request's literal text, author, destination, receipt and repository selection remain unchanged. Empty initial histories use an explicitly quoted, uncredited server-context preface so the existing conversation builder preserves the separate real user turn. Neither helper turn enters the private stream or canonical original-source history. A queued input uses its own retained references and guarded receiver; current permission loss holds it before a model call.
| Criterion | Evidence |
|---|---|
| Real Core receives current unit/run/PR/pipeline facts on an empty initial history while the actual request and receiver remain literal; private stream and canonical source history contain no synthetic context | [unit] src/channels/browserHomeInstallation.test.ts::browser installation::gives real Core current quoted attached work metadata without changing the authored request or broad receiver |
| A real Core-created private unit exposes only current proved metadata, without its private work-brief fields or another execution owner | [unit] src/channels/browserHomeInstallation.test.ts::browser installation::quotes only current owned private-unit facts through real Core without reading its work brief |
| Queued input B reads its own references through guarded original IO; input A metadata never becomes B's context, and canonical source history stays raw | [unit] src/channels/browserHomeInstallation.test.ts::browser installation::reads queued input B's exact attachments through its guarded IO without inheriting input A metadata |
| Permission loss during the referenced read holds the original accepted owner with no model invocation | [unit] src/channels/browserHomeInstallation.test.ts::browser installation::holds the accepted original request if an attached entity loses read permission during metadata loading |
| Quoting admits only metadata fields, breaks hostile delimiters, marks clipped display facts, and refuses oversized windows | [unit] src/channels/homeAttachedContext.test.ts::quoted attached work metadata::* |
| A real merge-ready producer records attention; Home shows it to the saved recipient, and Merge uses the viewer’s existing command and exact saved choice, never a model answer | [unit] src/channels/adminCoordinator.test.ts::the plan runner's steps — plan, unit-start, branch, round, unit-end, finish (item 9)::unit-end records a real person-merge target that Home shows to its saved recipient, src/channels/browserHomeInstallation.test.ts::browser installation::offers a merge command only to the current saved recipient with their own grants in Mine or All, web/green/pages/homeActions.test.ts::Home actions::merges an owned completed review through its exact saved command choice without opening a reply composer |
| A supervised bounded native read observes only the exact merge-ready PR/head under current source/read permission; a verified merge resolves attention at its actual time without changing the original ending/report or waking its driver. Lost proof or a concurrent canonical write holds observation; repeat observation is a no-op | [unit] src/channels/browserHomeInstallation.test.ts::browser installation::observes a manual merge with no watch or live driver and holds changed, revoked or raced source proof, src/core/home/conditions.test.ts::Home recorded condition projection::moves a verified external merge to completion at its real merge time without changing the review ending, web/green/pages/homeActions.test.ts::Home actions::shows a verified external merge at its actual completion time while preserving the finished review |
| Native merge observations use a global installed-runtime concurrency cap across refreshes and advance fairly when slots clear; actual merge time may precede delayed attention settlement, and the unit keeps its original review report | [unit] src/channels/browserHomeInstallation.test.ts::browser installation::bounds simultaneous merge reads across refreshes and advances the next owned units after slots clear, ::observes a manual merge with no watch or live driver and holds changed, revoked or raced source proof, web/green/frontend.test.ts::Green browser frontend::shows an observed merge on the unit while keeping its original reviewed-head report |
| Owned merge affordances reread each canonical pipeline once per request, without a cross-request cache or native PR wait in the initial frame | [unit] src/channels/browserHomeInstallation.test.ts::browser installation::projects a hundred owned merge actions from one current canonical pipeline read |
| A metadata refresh preserves the completed producer’s recorded merge attention alongside canonical research pointers | [unit] src/core/coordinator/instanceStore.test.ts::durable reconciliation store seam::keeps recorded merge attention through an unfenced metadata refresh | | Production browser composition forwards the actual viewer’s GitHub binding and canonical native merge facts; completion preserves the original ending and starts no model | [unit] src/channels/browserHomeWiring.test.ts::browser production wiring::offers an owned reviewed-head merge and observes native completion through installation callbacks without a model | | Home schedules bounded merge observation after its page or snapshot response has been sent | [unit] src/channels/homeView.test.ts::authorized Home pages::schedules merge observation only after sending the current Home response |
Entry replacement and retained reading behavior
The cutover bundle has one green entry. Old page and shell modules are removed; shared run, transcript, settings, chart, theme, and native consent components stay. This source proof does not activate the candidate or replace live parity approval.
| Criterion | Evidence |
|---|---|
| The default server asset loader selects the sole green manifest entry and includes its shared styles; a missing requested entry refuses startup | [unit] src/channels/webAssets.test.ts::loadWebAssets::* |
| Recorded schedule ID and exact firing times remain visible even without a run link | [unit] web/green/pages/reportStates.test.ts::Green report states::retains the recorded schedule run without a live link and exposes exact next and last times |
| Costs uses the global selected owner scope without a second me checkbox | [unit] web/green/pages/reportStates.test.ts::Green report states::keeps the global owner selection on a user cost breakdown without a second me filter |
| Final candidate captures and authenticated live parity match the published replacement inputs before activation | [gap] Parent-owned staging and final capture regeneration remain pending. |
| A known successful merge reads its current authorized target through the existing snapshot route, verifies completion before direct History navigation, and preserves the finished review. Both metadata phases begin from fresh current source proof; already-recorded completion is read without another native effect. An already-completed item remains readable to its saved assignee or creator under current read permission. Person, foreign and malformed targets refuse before native lookup; source loss refuses the final frame. Direct reads share the installed observer slots | [unit] src/channels/homeView.test.ts::authorized Home pages::observes a known registry merge through the existing targeted snapshot before direct History navigation, ::reads a background-completed merge for its saved assignee rather than only its creator, src/channels/browserHomeInstallation.test.ts::browser installation::bounds simultaneous merge reads across refreshes and advances the next owned units after slots clear |
| A known merge refresh replaces only Home work data while private drafts and exact unknown submissions remain; unknown sibling choices remain outside Needs you. The first chat frame and an already-loaded session must match the page’s actual account and organization. Permission or view loss hides old work and choices; late frames cannot restore them | [unit] web/green/pages/homeActions.test.ts::Home actions::refreshes only work after a known merge and preserves the original private draft and unknown submission, ::keeps an unknown sibling saved choice outside Needs you after a known merge refresh, ::ignores a late work response after…, ::hides old work when the targeted read loses permission instead of retaining private rows, ::keeps owned work visible when the first chat frame matches the page account and organization, ::hides work and saved choices for a mismatched… |
Opaque client tracking holds at most one existing reconciliation batch of identifiers per organization and credential principal. Each expires under the configured receipt retention duration. If storage is blocked, only the current tab keeps the identifier and the dock reports that limitation. Status reads return no historical body, offer, target, free-text reason or native completion claim. Forgetting an identifier changes browser tracking only.
| The production gate and Home runtime share exact endpoint selection. An authenticated opaque receipt reaches its protected handler; neighboring, extra-segment and foreign-realm requests cannot expose it | [unit] src/channels/homeRuntime.test.ts::authenticated browser organization runtime::routes an authenticated receipt through the production endpoint gate and refuses neighboring paths |
Original native media
| Criterion | Evidence |
|---|---|
| Native private media admission stores source references and representation hashes instead of inline bytes in the original request. Current source and identity proof restores the same owner's media. An exact admitted retry reads its original receipt without another download or effect; bodyless provenance retains only the digest. | [unit] src/channels/browserHomeInstallation.test.ts::browser installation::admits a source-bound image larger than the retained request ceiling without storing its bytes and retries only its receipt |
| Accepted image and text-document representations reach the existing model owner without substitution. | [unit] src/channels/browserHomeInstallation.test.ts::browser installation::delivers the exact source-bound … representation to the existing model owner |
| A confirmed media proposal keeps source A as a read dependency while distinct B owns the approved text, execution and output. Original and confirmed media dependencies persist in canonical context through archive, history, merging and compaction. A later reader uses its own current permissions; changed, expired, deleted or missing required source evidence prevents model entry. Human stream text keeps its existing retention contract. | [unit] src/channels/browserHomeInstallation.test.ts::browser installation::executes a saved small … proposal with A as its read source and distinct B as its model and output owner, ::holds saved proposal B before its first model prompt when source A is deleted during launch, ::delivers the exact source-bound … representation to the existing model owner; src/core/references/contextDependencies.test.ts::whole-context dependencies::retains a saved native read dependency through merge, hash and checkpoint containment without accepting a downgrade; src/core/dispatch/contextAccess.test.ts::saved native read provenance::requires the canonical completed B leaf and a fresh current-consumer source check |
| Reading or cancelling a saved native action checks current ownership and permissions without downloading its media. Typed execution conservatively checks the original source because validated arguments can have been derived from media. | [unit] src/channels/browserHomeInstallation.test.ts::browser installation::reads and cancels a saved native media action without redownloading source A, and rechecks A for typed execution |
| A router rechecks required original attachments and adopted history after loading its context and before each model call. Ordinary routing and model selection remain unchanged. | [unit] src/core/dispatch/operator.test.ts::explicit PR directives at the operator stage::rechecks required … after tail loading before the operator model |
| A queued native input without a durable receiver sequence retains its original uncertain ingress owner after the receiver ends. Reconciliation and an exact admitted retry create no second task. | [unit] src/channels/browserHomeInstallation.test.ts::browser installation::keeps queued native media without a durable receiver sequence uncertain after that receiver ends and reconciliation runs; the receiver's unknown acknowledgment is simulated at the harness boundary. |
| Native attachment delivery through deployed Memory, authenticated browser and native harnesses, including large documents, matches the source-bound local contract. | [gap] Real local Memory tests prove bounded text/PDF storage and reconstruction; in-memory model fixtures prove only their exercised input path. Live deployment, native image normalization and provider consumption remain unproved. The existing pi PDF limitation remains separate. |
| Registered page seeds bind the actual viewer and configured organization, never the selected person or supplied seed facts. Foreign first frames and established source loss hide cached entity content and titles; explicit target revocation also removes matching attached context while preserving an independently authorized broad draft and the read-only Person mode. Initial unavailable private chat does not discard authorized page facts. | [unit] src/channels/webShell.test.ts::makePageSender — the shell for a document request, the seed for the app's own::stamps the actual viewer and configured organization…; web/green/app.test.ts::Green App navigation::hides old private unit metadata…, ::removes every old page seed…, ::removes revoked unit metadata…, ::keeps an authorized… | | A revoked standalone thread moves keyboard focus to its permission-safe explanation while its independently authorized broad destination and draft remain. An initially unavailable observer does not steal focus. | [unit] web/green/frontend.test.ts::Green browser frontend::moves focus to the revoked thread explanation while preserving the broad destination and draft, ::keeps initial unavailable thread reads from stealing focus from the broad draft | | Empty retained child-run evidence does not claim an unstarted unit. Recorded merge facts remain Merged; other absent lifecycle facts stay explicit. | [unit] web/green/frontend.test.ts::Green browser frontend::shows an observed merge on the unit while keeping its original reviewed-head report; web/green/app.test.ts::Green App navigation::removes revoked unit metadata…; web/src/pages/unitPage.test.ts::UnitPage — the unit is the reading unit (item 28)::a unit with one thread lists its runs by agent… |