Checkpoint via cy-loop-tasks (iteration 7, phase B mode=tasks).

Co-Authored-By: Codex <[email protected]>

* feat: Generated SDK contracts + publishing groundwork (Phase A) #1

Checkpoint via cy-loop-tasks (iteration 2, phase B mode=tasks).

Co-Authored-By: Codex <[email protected]>

* feat: Manifest v2, permissions, config consolidation + hook source (Pha…

Checkpoint via cy-loop-tasks (iteration 3, phase B mode=tasks).

Focused Phase B gates passed; full make verify remains reserved for final program completion.

Co-Authored-By: Codex <[email protected]>

* feat: Code-first toolchain: describe mode, build/validate/init (Phase C…

Checkpoint via cy-loop-tasks (iteration 4, phase B mode=tasks).

Scoped Phase C gates passed; the single monorepo make verify remains reserved for final program completion.

Co-Authored-By: Codex <[email protected]>

* feat: Dev lane: links, instance-keyed reload, logs, watch (Phase D) #4

Checkpoint via cy-loop-tasks (iteration 5, phase B mode=tasks).

Co-Authored-By: Codex <[email protected]>

* feat: Distribution: source union, gitsrc, sidecars, publish, search, up…

Checkpoint via cy-loop-tasks (iteration 6, phase B mode=tasks).

Co-Authored-By: Codex <[email protected]>

* feat: Contributed commands surface (ADR-008, fixture-proven) #6

Checkpoint via cy-loop-tasks (iteration 7, phase B mode=tasks).

Co-Authored-By: Codex <[email protected]>

* feat: CLI UX & operability: diagnostics, status, doctor, events matrix…

Checkpoint via cy-loop-tasks (iteration 8, phase B mode=tasks).

Co-Authored-By: Codex <[email protected]>

* feat: Web surfaces: update affordance, install forms, dev badge, logs p…

Checkpoint via cy-loop-tasks (iteration 9, phase B mode=tasks).

Visual recapture was explicitly waived by the operator; functional browser and focused gates passed.

Co-Authored-By: Codex <[email protected]>

* feat: Docs, official skill, examples, QA scenario flags (Phase G) #9

Checkpoint via cy-loop-tasks (iteration 10, phase B mode=tasks).

Co-Authored-By: Codex <[email protected]>

* feat: QA Plan and Session Charters #10

Checkpoint via cy-loop-tasks (iteration 11, phase B mode=tasks).

QA planning checkpoint: six targeted extension charters, one Marketplace/Skills canary, 676 materialized scenarios, and explicit coverage of Safety Invariants 1-17 plus ADRs 001-008.

Co-Authored-By: Codex <[email protected]>

* fix: close extension QA defects

* fix: remediate extension deep review

* fix: review round

* fix: resolve post-rebase integration defects

---------

Co-authored-by: Codex <[email protected]>

Checkpoint via cy-loop-tasks (iteration 9, phase B mode=tasks).

Co-Authored-By: Codex <[email protected]>

Checkpoint via cy-loop-tasks (iteration 7, phase B mode=tasks).

Planning-only QA checkpoint: 13 APP scenarios, five desktop journeys, and 17 isolated per-platform charters. No QA lab or product process was started.

Co-Authored-By: Codex <[email protected]>

Checkpoint via cy-loop-tasks (iteration 7, phase B mode=tasks).

Planning-only QA checkpoint: 13 APP scenarios, five desktop journeys, and 17 isolated per-platform charters. No QA lab or product process was started.

Co-Authored-By: Codex <[email protected]>

* feat: Tauri shell: windows, native integration, runtime resolution #1

Checkpoint via cy-loop-tasks (iteration 2, phase B mode=tasks).

Co-Authored-By: Codex <[email protected]>

* feat: add desktop app CLI and runtime contracts

* feat: Update system: provisioning, runtime apply, app auto-update, cont…

Checkpoint via cy-loop-tasks (iteration 4, phase B mode=tasks).

Co-Authored-By: Codex <[email protected]>

* feat: Product language + docs: brand hard cut, site pages, official ski…

Checkpoint via cy-loop-tasks (iteration 5, phase B mode=tasks).

Hard-cut public product language to CompozyOS, ship desktop documentation and official-skill routing, and enforce the boundary with UT-113.

Co-Authored-By: Codex <[email protected]>

* feat: Release pipeline: build matrix, signing, feeds, gates, custody ru…

Checkpoint via cy-loop-tasks (iteration 6, phase B mode=tasks).

Co-Authored-By: Codex <[email protected]>

* feat: qa-report: plan the desktop QA cycle in docs/qa #6

Checkpoint via cy-loop-tasks (iteration 7, phase B mode=tasks).

Planning-only QA checkpoint: 13 APP scenarios, five desktop journeys, and 17 isolated per-platform charters. No QA lab or product process was started.

Co-Authored-By: Codex <[email protected]>

* fix: initialize the desktop updater in development

* fix: start the desktop runtime through the current daemon contract

* fix: support runtime launchers with child processes

* fix: bind desktop probes to runtime identity fields

* fix: accept the current beta runtime in desktop handshakes

* fix: frame desktop control requests by newline

* fix: make desktop recovery state safe to retry

* test: verify desktop release candidate

* fix: peer-review round 1 remediation

Checkpoint via cy-loop-tasks (iteration 10, phase D review round 1).

Co-Authored-By: Codex <[email protected]>

* fix: preserve product language after main rebase

* fix: review round

* build: desktop dev command

---------

Co-authored-by: Codex <[email protected]>

Checkpoint via cy-loop-tasks (iteration 7, phase B mode=tasks).

Co-Authored-By: Codex <[email protected]>

* feat: Update Operation, single command, and daemon surfaces #1

Checkpoint via cy-loop-tasks (iteration 2, phase B mode=tasks).

Co-Authored-By: Codex <[email protected]>

* feat: Web update surface (settings two-track + menubar indicator) #2

Checkpoint via cy-loop-tasks (iteration 3, phase B mode=tasks).

Claude Opus implementation reviewed and accepted by the controller; visual and browser QA evidence remains owned by the tail tasks.

Co-Authored-By: Codex <[email protected]>

* feat: Electron shell at parity #3

Checkpoint via cy-loop-tasks (iteration 4, task mode).

Co-Authored-By: Codex <[email protected]>

* feat: add desktop release authority

* feat: Cutover and docs truth pass #5

Checkpoint via cy-loop-tasks (iteration 6, phase B mode=tasks).

Hard cut the legacy desktop shell and feed, retire the external bucket and alias, and align docs, skill, QA tracking, and release guidance with Electron.

Co-Authored-By: Codex <[email protected]>

* feat: QA Plan and Session Charters #6

Checkpoint via cy-loop-tasks (iteration 7, phase B mode=tasks).

Co-Authored-By: Codex <[email protected]>

* fix: remediate electron shell review findings

* fix: scope desktop notarization to macOS

* fix: use configured macOS notarization credentials

* fix: run desktop release builder from app workspace

* fix: execute release builder in desktop workspace

* fix: harden desktop release artifact contracts

* fix: complete Linux and DMG package metadata

* fix: preserve desktop release identity

* fix: normalize signed x64 runtime digest

* fix: synchronize web assets for explicit releases

* fix: pass release fallback to web assets sync

* build: sync web assets for explicit release

* fix: refresh finalized dmg integrity

* build: sync web assets for explicit release

* build: sync web assets for explicit release

* fix: exclude dmg files from update channel

* build: sync web assets for explicit release

* fix: exclude deb files from update channel

* build: sync web assets for explicit release

* fix: isolate desktop release smoke

* docs: record electron shell QA closeout

* fix: final adjusts

* fix: update icon

* fix: close buttons

* fix: resolve pull request lint failures

---------

Co-authored-by: Codex <[email protected]>
Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>

Checkpoint via cy-loop-tasks (iteration 7, phase B mode=tasks).

Co-Authored-By: Codex <[email protected]>

Checkpoint via cy-loop-tasks (iteration 7, phase B mode=tasks).

Co-Authored-By: Codex <[email protected]>

Checkpoint via cy-loop-tasks (iteration 8, phase B mode=tasks).

Claude Opus implementation reviewed and corrected by Codex; Playwright execution and Visual Contract evidence remain re-phased to the final QA task.

Co-Authored-By: Codex <[email protected]>

Checkpoint via cy-loop-tasks (iteration 8, phase B mode=tasks).

Claude Opus implementation reviewed and corrected by Codex; Playwright execution and Visual Contract evidence remain re-phased to the final QA task.

Co-Authored-By: Codex <[email protected]>

Checkpoint via cy-loop-tasks (iteration 7, phase B mode=tasks).

Co-Authored-By: Codex <[email protected]>

Checkpoint via cy-loop-tasks (iteration 7, phase B mode=tasks).

Co-Authored-By: Codex <[email protected]>

Checkpoint via cy-loop-tasks (iteration 7, phase B mode=tasks).

Co-Authored-By: Codex <[email protected]>

Checkpoint via cy-loop-tasks (iteration 7, phase B mode=tasks).

Co-Authored-By: Codex <[email protected]>

Checkpoint via cy-loop-tasks (iteration 7, phase B mode=tasks).

Co-Authored-By: Codex <[email protected]>

Checkpoint via cy-loop-tasks (iteration 7, phase B mode=tasks).

Co-Authored-By: Codex <[email protected]>

Checkpoint via cy-loop-tasks (iteration 7, phase B mode=tasks).

Co-Authored-By: Codex <[email protected]>

Checkpoint via cy-loop-tasks (iteration 7, phase B mode=tasks).

Co-Authored-By: Codex <[email protected]>

#490)

* feat: Terminal core and PTY substrate #1

Checkpoint via cy-loop-tasks (iteration 2, phase B mode=tasks).

Co-Authored-By: Codex <[email protected]>

* feat: Wire protocol and transport #2

Checkpoint via cy-loop-tasks (iteration 3, phase B mode=tasks).

Co-Authored-By: Codex <[email protected]>

* feat: Persistence, journal and observability #3

Checkpoint via cy-loop-tasks (iteration 4, phase B mode=tasks).

Co-Authored-By: Codex <[email protected]>

* feat: Agent surfaces exec tools and write path #4

* feat: Web terminal system #5

Checkpoint via cy-loop-tasks (iteration 6, phase B mode=tasks).

Co-Authored-By: Codex <[email protected]>

* feat: Public activation tranche #6

Checkpoint via cy-loop-tasks (iteration 7, phase B mode=tasks).

Co-Authored-By: Codex <[email protected]>

* feat: render agent-reported terminal output

* feat: Windows ConPTY adapter #8

Checkpoint via cy-loop-tasks (iteration 9, phase B mode=tasks).

Co-Authored-By: Codex <[email protected]>

* fix: satisfy integrated terminal gate policies

* fix: normalize local gate classification

* fix: resolve integrated terminal review findings

* feat: QA Plan and Session Charters #9

Checkpoint via cy-loop-tasks (iteration 10, phase B mode=tasks).

Co-Authored-By: Codex <[email protected]>

* fix: preserve terminal workspace registration identity

* fix: complete integrated terminal QA remediation

* refactor: remove unused terminal exports

* fix: ui improvements

* fix: improvs

* fix: complete rebase integration

* fix: align product language

* fix: resolve Windows terminal executables

* test: stabilize Windows terminal reads

* test: drain Windows terminal startup output

* test: align reported terminal E2E contract

* fix: bind terminal browser ownership

* fix: stabilize terminal browser attachments

* fix: retry empty Windows terminal reads

* fix: preserve terminal sessions after creation

* fix: preserve terminal clipboard shortcuts

* test: align daemon harness profile resolution

* fix: harden terminal process shutdown

* fix: harden terminal approvals and agent guidance

* fix: harden terminal runtime lifecycle

* fix: unify terminal transport contracts

* fix: complete integrated terminal lifecycle

* build: regenerate integrated terminal contracts

* feat: rebuild integrated terminal window

Co-authored-by: Cursor <[email protected]>

* feat: rebuild integrated terminal journal

Co-authored-by: Cursor <[email protected]>

* feat: rebuild terminal input attention

Co-authored-by: Cursor <[email protected]>

* feat: rebuild terminal approval surfaces

Co-authored-by: Cursor <[email protected]>

* feat: rebuild session terminal blocks

Co-authored-by: Cursor <[email protected]>

* feat: rebuild terminal quote and settings

Co-authored-by: Cursor <[email protected]>

* docs: clarify estimated terminal journal boundaries

Co-authored-by: Cursor <[email protected]>

* fix: close integrated terminal host gaps

Co-authored-by: Cursor <[email protected]>

* fix: complete integrated terminal remediation

* fix: final review

* fix: close integrated terminal QA gaps

* fix: repair integrated terminal CI

* fix: stabilize integrated terminal CI

* fix: close integrated terminal web CI gaps

* fix: stabilize terminal detach chord

* test: stabilize loop event resume E2E

* ci: parallelize e2e lanes

* fix: close final web e2e races

* fix: close exact-head web e2e races

* fix: close exact-head e2e races

* test: stabilize terminal e2e fixtures

* fix: preserve semantic identity during retarget

* test: stabilize loop read E2E

* fix: stabilize integrated terminal and remove in-app tabs

Close is idempotent (exited terminals answer their recorded exit), the
stream client settles as closed instead of reconnecting a dead terminal,
size votes made before the socket opened are delivered on open, and the
fish shim rides vendor_conf.d without hiding the user's config. The web
terminal is window-native: one terminal per OS window, an id-less route
that adopts or creates, head-level Journal/New/Close verbs, and window
close never signals the PTY.

Co-Authored-By: Claude Fable 5 <[email protected]>

* fix: repair zsh markers and resolve terminals from fresh catalog truth

The zsh marker hooks shadowed zsh's read-only status parameter, killing the
precmd hook on every prompt and dropping every finish marker; a live zsh test
now pins the clean hook. The id-less terminal route waits for a catalog fetch
from this mount before adopting or creating, so a terminal opened moments
before the window cannot be missed and duplicated. Browser journeys walk the
window-native flow end to end, and the QA tracker records the walked verdicts.

Co-Authored-By: Claude Fable 5 <[email protected]>

* fix: dedupe worktrees spec imports after rebase

Co-Authored-By: Claude Fable 5 <[email protected]>

* fix: split protocol client wiring and align desktop terminal flow

Co-Authored-By: Claude Fable 5 <[email protected]>

* test: assert reattach liveness on the focused restored terminal

Co-Authored-By: Claude Fable 5 <[email protected]>

* fix: terminal fonts

* fix: render agent-internal commands as plain session output

Pull ADR-012 door 3 (`_meta.terminal_output`): the daemon no longer opts
into agent-reported terminal output, and the whole reported pipeline goes
with it — ACP ingestion and suppression, the `agent_reported` origin,
contract/stream payload fields, transcript codec/replay, acpmock steps,
and the web "reported by agent" xterm blocks. Agent-internal commands
render as plain command output again; the deliberate S3 supervised block
and the ACP pipe door stay untouched.

Co-Authored-By: Claude Fable 5 <[email protected]>

* feat: materialize agent-opened terminals as desktop windows

A daemon bridge observes terminal opened events and, for agent-actor
interactive PTY terminals (terminal_open, terminal_exec visible:true),
opens a managed Terminal window in the workspace window model — on the
desktop showing the bound session, never moving focus, one-shot per
terminal, deduped by instance key, and never failing the tool call.
Pipe terminals and human actors materialize nothing.

The transcript now recognizes real agent traffic: hosted-MCP tool names
(mcp__<server>__compozy__*) normalize to their native ids for the S3
supervised block and row labels, MCP string envelopes decode so
terminal_id reaches the block, and the remaining terminal tools carry
registered labels. E2E-003 asserts the window materializes without
stealing focus.

Co-Authored-By: Claude Fable 5 <[email protected]>

* fix: steer agents to the integrated terminal and refresh its truth surfaces

Terminal tool descriptors now lead with the desktop-window capability,
the official skill documents the windows contract and the
write-wait-read loop, and the site docs replace the agent-reported
block section with the plain-output and window-materialization truth.
QA tracker updated for ADR-019: the reported-terminal scenario is
deleted, affected scenarios were reset and re-walked with a real Haiku
agent in an isolated lab, and a new materialization scenario records
the walk (docs/qa/reports/2026-09-01-terminal-rework.md).

Co-Authored-By: Claude Fable 5 <[email protected]>

* ci: retrigger PR checks for the terminal rework head

Co-Authored-By: Claude Fable 5 <[email protected]>

* fix: renumber terminal migration and settle generated artifacts after rebase

Main's loop work took 00098/00099, so the workspace-deletion-intents
migration moves to the next gap-free version (00100), atlas.sum is
rehashed for the unpublished tail, and the SDK contract chunks
regenerate to the merged truth.

Co-Authored-By: Claude Fable 5 <[email protected]>

* fix: reconcile pointer actor and ahead sentinel after second rebase

Main's new loop tests construct ActionExecutionInput with a value actor
while this branch moved the field to *task.ActorContext; the merged call
sites now take the pointer. The global ahead-schema fixtures pinned
version 100, which the renumbered terminal migration just occupied —
they use the 999 sentinel the other streams already use.

Co-Authored-By: Claude Fable 5 <[email protected]>

* docs: increase deep review limits

* fix: remediate integrated terminal review

* test: align rebased suites with main contracts

* fix: repair rebased CI regressions

* fix: skill triggering

---------

Co-authored-by: Codex <[email protected]>
Co-authored-by: Cursor <[email protected]>
Co-authored-by: Claude Fable 5 <[email protected]>

* feat: establish unified marketplace catalog and extension data contracts

* feat: add unified marketplace browse and installed views

* fix: reconcile unified marketplace reads and retained links

* feat: One marketplace surface on today's catalog #1

Checkpoint via cy-loop-tasks (iteration 6, phase B mode=tasks).

Focused routing tests34, Web typecheck and changed-file lint pass. Final QA, visual evidence and heavy gates remain pending under the user-directed final validation boundary.

Co-Authored-By: Codex <[email protected]>

* refactor: remove marketplace installer compatibility workarounds

Remove requested runtime names and manual MCP secret imports; require explicit owners for extension management and diagnostics. Preserve automatic allocation rollback, existing references and discovered resource execution. Consolidate CLI preflight selection and keep canonical catalog requests on their source.

* refactor: remove fallback to retired marketplace feeds

* refactor: remove retired MCP catalog installer

* refactor: remove remote skill acquisition surfaces

* refactor: use canonical marketplace discovery for native tools

* refactor: use canonical marketplace routes in CLI

* refactor: remove kind-based marketplace APIs

* refactor: remove retired marketplace feed decoders

* refactor: address marketplace storage and refresh by source

* refactor: remove marketplace source kind selectors

* refactor: remove marketplace kind identity and storage

* refactor: retire remote skill acquisition settings

* feat: Client plugin grammars load through adapters #6

Checkpoint via cy-loop-tasks (iteration 20, phase B mode=tasks).

Client grammar adapters preserve authored bytes and record layout through managed and HTTP install. Focused race/integration, direct syntax lint and generated Web typecheck pass. Live QA, heavy gates and final review remain deferred by session instruction.

Co-Authored-By: Codex <[email protected]>

* docs: align marketplace migration and configuration guidance

* feat: publish only the current marketplace feed

Checkpoint via cy-loop-tasks (iteration 22, phase B mode=tasks).

Remove production v2 adapter/decoder and preserve existing extension artifact identities. Publisher, real CLI publication and approved 17-package conformance pass focused checks. Site root-feed consumers and remaining task02 contracts stay in progress.

Co-Authored-By: Codex <[email protected]>

* feat: switch site catalog data and routes to v3

Checkpoint via cy-loop-tasks (iteration 22, phase B mode=tasks).

Data boundary and public index tests pass. Retired root feeds, kind schemas and kind routes are removed. UI consumers are the next assigned Fable slice; full site rendering/typecheck is still pending and no compatibility aliases are added.

Co-Authored-By: Codex <[email protected]>

* feat: publish one extension catalog on the public site

* refactor: name current extension input behavior directly

* feat: preserve requested scope during managed package acquisition

* feat: bind extension installs to requested workspace and profile

* feat: honor manifest defaults when selecting install scope

* feat: preserve scoped inputs through extension updates

* feat: reinstall published extensions through the update transaction

* fix: pin extension confirmation to the previewed artifact

* fix: require fresh confirmation when marketplace artifacts change

* feat: expose candidate input definitions for extension recovery

* feat: wire marketplace input forms and update recovery

* feat: complete marketplace input configuration UI

* fix: isolate MCP publication for unconfigured profiles

* test: verify catalog secret inputs through public transports

* fix: preserve direct extension update origins and rollback

* test: verify curated install update and artifact integrity

* test: verify v3 publication through the daemon

* fix: start extension runtimes in their workspace profiles

* fix: run published workspace extensions with scoped ownership

* fix: restore profile runtimes across overlay transitions

* fix: compensate package allocations across workspace updates

* test: verify complete marketplace upgrade preservation

* fix: require logical names for public extension MCP operations

* fix: reuse owner registration for MCP token refresh

* fix: remove runtime aliases from MCP detail lookup

* fix: preserve scoped extension attachment lifecycle

* feat: prepare owner-scoped MCP management controllers

* feat: expose extension-owned MCP management

* feat: add verified marketplace package cache

* feat: read bounded plugin marketplace documents

* feat: pin GitHub marketplace reads to commits

* feat: retain verified Git checkouts for acquisition

* feat: share canonical tar serialization for marketplace packages

* feat: install verified canonical tar packages

* feat: capture confined marketplace packages in cache

* feat: acquire pinned marketplace repository snapshots

* feat: acquire Git and folder marketplace snapshots

* feat: resolve and acquire pinned marketplace packages

* feat: project marketplace plugins through install loaders

* feat: install marketplace plugin acquisitions through lifecycle

* feat: configure marketplace plugin sources and preset choices

* feat: persist marketplace source identity and diagnostics

* feat: compose marketplace plugin source refreshes

* feat: aggregate marketplace sources with transactional refresh fences

* refactor: retire embedded Marketplace skill MCP authorization

* feat: compose plugin catalog sources and persist feed presets

* feat: install and update pinned marketplace plugins

* feat: retain marketplace packages and source identities

* feat: manage marketplace sources across agent surfaces

* feat: Sources surface: routes, CLI, tool, Settings page, sections #8

Checkpoint via cy-loop-tasks (iteration 74, phase B mode=tasks).

Source management UI and current Marketplace scenarios. Focused checks passed; live QA and final delivery gates remain task_10 by user direction.

Co-Authored-By: Codex <[email protected]>

* fix: peer-review round 1 remediation

Checkpoint via cy-loop-tasks (iteration 81, phase D review round 1).

Co-Authored-By: Codex <[email protected]>

* fix: repair marketplace scope and final validation failures

* test: complete retired MCP selector removal

* test: enforce scoped inventory and retain restart diagnostics

* fix: remove Repository Orientation from the official catalog

* fix: address marketplace catalog review findings

* ci: verify marketplace publication integrations on Linux

* test: align marketplace fixtures with required install references

* fix: preserve marketplace error and hook scope contracts

* fix: resolve remaining marketplace lint findings

* fix: prepare all plugin layouts for development reload

* fix: rewrite configured credential references on profile rename

* fix: reject invalid MCP credential owners before replacement

* fix: allow MCP repairs when prior authentication fails

* fix: align profile credential repairs with CI style checks

* docs: record completed marketplace review QA

* refactor: resolve marketplace React Doctor diagnostics

* fix: return the selected skills scope label

---------

Co-authored-by: Codex <[email protected]>