[luvs01]

Summary

Bind desktop compatibility trial consent to fresh observations of the registered package manifest App entry and executable. An observed identity change or failed proof clears consent, exhaustion observations and corrected outputs; returning to the previous identity does not restore consent. Reject reparse ancestry, fence late probes after runtime replacement, and keep private package proof out of public status.

This implements only the package-proof safety portion of #7587. The supported version 26.924.2738.0, default-off behavior, maximum three-minute trial, fresh exhaustion and explicit account-wide consent remain unchanged. Provider isolation remains unavailable. Launcher, trust and authentication behavior are unchanged.

Head a75e94abbee20896e171d337e5402e6708031213 normally merges dev 8ebe46b2076445d100cef1e52af4d98d78f8f1e1 into the previous public head 999b63ff. The seven child-specific blobs remain byte-identical; the merged registration/layout state was checked separately.

Verification

On this exact head, official Windows Bun 1.4.4 with isolated test homes and the existing CI timeout contract:

• Build-probe, runtime and native-identity test files: 99 passed / 0 skipped / 0 failed, in separate processes.
• Both layout guards: 29 passed / 579 assertions.
• TypeScript, structure/index, seven-file privacy/size and committed-diff checks passed.
• Every native unit exited 0 with both output streams complete, no remaining direct child and verified fixture cleanup. No dependency installation was performed.

The tests use synthetic package proof/identity data, temporary junction fixtures, loopback CONNECT/TLS/SSE and in-memory certificates. No live Appx query, certificate-store change, installed-app launch or real account trial was performed. Exact-head automatic CI 40229067628 passed; conditional platform skips are not live integration evidence.

Metadata walks are observations, not held-handle identity, signature verification or process attestation. They cannot exclude transient replacement between observations or a reinstall preserving all observed metadata. Actual Appx/consumer/cache/native-turn behavior and OS trust remain unverified.

Checklist

• B scope and unchanged consent/version boundaries reviewed.
• Named regression files and source gates passed on the merged head.
• Synthetic evidence and live integration limits distinguished.
• Exact-head automatic CI.
• Maintainer B/security review.

This PR remains Draft for B/security review; broader compatibility work in #7587 remains open. No activation, deployment or merge decision is claimed.

[coderabbitai]

Caution

Review failed

The pull request is closed.

Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

✅ Deterministic PR hygiene checks passed.

[lidge-jun]

Maintainer integration decision for v2.93.0 release prep: MERGED into dev (squash; dev maintainer-integration path under MAINTAINERS.md). This also records the maintainer B/security review that the checklist asked for.

Independent security/correctness review: gpt-6.1-sol (high reasoning), task rel293-lb-review-d7709-r1, on head a75e94abbee20896e171d337e5402e6708031213 merged onto origin/dev c2f3d8b42be. Verdict PASS, 0 blocking / 0 non-blocking findings. It reviewed all seven changed files plus the activation, response, management API and startup callers, and found no fail-open consent path, private package-proof exposure, stale-probe crossover or default-off regression. The documented limit stands: metadata walks are observations, so a transient replace-and-restore or a reinstall that preserves identical metadata is not fully detectable.

Exact-head CI on a75e94ab

• lane=all workflow_dispatch run 40275158740 (dispatched through ci/pr-7709-laneall-a75e94ab, same SHA): success, including all nine Windows shards and macOS. Attempt 2 re-ran only the aggregate ci job after it stalled in the runner queue; no job failed in either attempt.
• PR Cross-platform CI run 40229067628 and Catalog async contracts run 40229067727: success. hygiene and enforce-target: pass.

Combined tree (this head merged with current origin/dev 852bf9d02), Bun 1.4.4: desktop-compatibility build-probe/runtime, management desktop-compatibility runtime routes, desktop-compatibility startup, both layout guards and file-size ratchet: 129 pass / 0 fail. tsc --noEmit, structure:check, skill:surface:check and privacy:scan pass, and the merge is clean.

Scope stays as described: package-proof binding only. The supported version, default-off behavior, the three-minute trial bound and explicit consent are unchanged, and the broader #7587 work remains open.

NOT RUN: full local suite (resource exception; parallel release lanes), live Appx/installed-package proof, real Codex App trial.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-26T10:12:34.716697Z	a75e94a	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.