diff --git a/investigation/ui-parity-matrix.md b/investigation/ui-parity-matrix.md index d8d710c4..a8861a01 100644 --- a/investigation/ui-parity-matrix.md +++ b/investigation/ui-parity-matrix.md @@ -113,6 +113,73 @@ not an extra to remove. The richer New Workspace preview/footer and Save Template scope options now have reference captures but remain unmatched by the bounded #808 geometry fix; its six whole claims remain open. +### 2026-10-15 additive companion qualification + +The dated intake table above preserves what was observed on 2026-10-14; it +is not rewritten with later recordings. The primary bundle remains +`C:\gc-ref\macos-groundtruth-2ccf303a`, source +`2ccf303a04f995184aae1d4b738a9eca0f71b79e`. The additive companion +`C:\gc-ref\macos-groundtruth-2ccf303a-gapfill-v2` is not a replacement or +blanket privacy clearance: retained metadata reports **543 files / 178 PNGs / +542 verified payload hashes / zero backend turns**. Independent review cleared +only **11 sampled images**; **167 unsampled images remain independently +uncleared**. This reconciliation reads metadata/hashes, not images, and adds +no privacy verdict. + +The companion adds distinct empty-global and empty-project scenes, separate +project/overview 100% scenes (not the primary project's 90% fitted frame), +native Open Folder and Project Settings, inline Reclaim/Keep, Goal/Composite +and menu-split references. Added recordings are not Windows acceptance. +The retained thirty-row pairing worksheet has **6 sampled components / +3 recorder-recorded but independently unsampled / 21 without a new exact +recording**. All 30 still require current Windows evidence; none is promoted. +Its metadata SHA-256 is +`DA0EA0C04F8C6BF0EA1F09A135FE0FE07E6B09031142AE53F6D24E2DD4405ED3`; +the retained independent spotcheck JSON SHA-256 is +`0A028A837832202055B0F7F50DD818540AD6C255188AFAC8A888DD845A1A5B61`. +The canonical kickoff retains the primary publication hold; companion intake +does not clear held originals or extend the 11-image sample to other files. + +### Merged A-E slices, not whole-issue closure + +Reconciliation against accepted main +`24209d2a70efee78be2a8214edf013e9b787ccd0` retains exactly the +[#821](https://github.com/scgopi/GraphCode/pull/821) row identities, order and +statuses: **98 rows / 6 Validated / 89 Partial / 3 Out of scope**. +All thirty demoted canonical rows stay `Partial`. These are approved source +slices, not whole issue completion; #768/#764/#767/#774/#778 remain open. + +| Slice / accepted merge | Bounded progress and evidence limit | +| --- | --- | +| A [#808](https://github.com/scgopi/GraphCode/pull/808), `9e6d13c04b4bc7cfd52c03e9c6e119db070588a4` | GraphCodeWindowsDialog text-prompt content/client-frame sizing, opaque viewport and fixed-footer scrolling only. Historical accepted 26 assets comprise 20 direct PrintWindow images and 6 actual-position composites at 96 DPI, not universal sheet parity. NativeForms migration, policy-tile overflow/extent and viewport/repaint/footer fitting remain unresolved follow-up per the [narrow approval](https://github.com/scgopi/GraphCode/issues/768#issuecomment-6171311452); rendered higher DPI, full styling/copy and all six whole criteria remain unverified. | +| E [#816](https://github.com/scgopi/GraphCode/pull/816), `112d458303891f87af6c1dc6beaf7e48073fd65c` | Supported native HMENU ordering/grouping and clicked-project reclaimable counts; background Create Edge removed while connector creation and the Loop-menu route remain. Original E root: 196 tests, including 6 states / 39 item observations / 12 negative controls. This is menu-build semantics, not a shown popup or action outcome. Export/import and unsupported conversions (including Change to Timed) remain absent; Edit Details, Wire it up, Mark as entry and Edit Edge remain deliberate Windows extras. Visual acceptance: NotExecuted (#826). | +| B [#814](https://github.com/scgopi/GraphCode/pull/814), `4fafbfb2275404cca7f5054e3db0c43c784897b4` | Shared compact 250x96 project/overview card body, measured title/state pill and separate live/detail/meta rows. Metadata is type, optional fitted branch, non-default backend display name and real age, not card token/model usage. Flow layout, entry/recovery/port/group furniture and other full criteria remain deferred. Visual acceptance: NotExecuted (#826). | +| D [#815](https://github.com/scgopi/GraphCode/pull/815), `2916099412659316ffd83aabc0de7193aa703fb1` | Quick Chat workspace chrome resolves stable chat identity and age, suppresses stale loop chrome, routes deleted chats away, and maps chat-specific actions/UIA. Restart session remains an approved enabled no-op, not a working restart/backend launch; saved pane-role labels do not prove an attached agent. Visual acceptance: NotExecuted (#826). | +| C [#817](https://github.com/scgopi/GraphCode/pull/817), `24209d2a70efee78be2a8214edf013e9b787ccd0` | Route-aware Graph/Quick Chats/open-project projection, Local Projects/Remote Repositories sections, matching paint/hit/UIA geometry and narrow project-context targeting. Global Graph is not a project-menu target; recents remain in Add Folder, not normal sidebar rows. Selection uses the existing rectangular Windows fill, not proven macOS blue rounded styling; Needs-you/Worktrees extras and tree/layout residuals are not fixed or removed. Visual acceptance: NotExecuted (#826). | + +Full **B8/C6/D2/E4** criteria stay unchecked. Code, unit/native-menu/UIA +coverage, offscreen capability and macOS-only references cannot promote a row. +No whole-wave, runtime, persistence or parity completion follows these merges. + +**Evidence routes remain gated.** The first seven-file offscreen scene is two +idle project cards and one edge at 1280x720, **real paint path, offscreen +component render**. Authority requires controlled post-C source freeze/review, +separate exact native, codec and converter grants, an actual source-bound run, +individual privacy review and different-vendor paired review before claims. +Actual artifact status belongs in the [issue/receipt](https://github.com/scgopi/GraphCode/issues/822), +not a predicted PNG/pass or a permanent worker-progress assertion. Its right +panel is hidden; no whole visual/parity acceptance is established here. +It can evidence only actual in-frame card/edge/panel/layout +pixels, not a real window/composition, popups, terminal, native controls, input, +accessibility, physical input or persistence. Never rebind old dirty +`4fafbfb2` pixels with conversion-time current hashes. Sidebar/right-panel/ +NativeForms slices require separate later approvals after the first proves out. +The selected stock-only real-window route under #822 requires #826 merge, +an accepted current plan and separate exact implementation/native/install/capture +grants. A reviewed plan alone is not an execution lease; no capture mechanics +are available by virtue of this ledger. No manual screenshots or +screenshot/golden/pixel-baseline CI fallback is authorized. + ## Preview delivery lanes The [Windows preview-readiness plan](windows-preview-release-plan.md) separates @@ -224,7 +291,7 @@ native keyboard/accelerator/window proof; the workspace row remains Partial. | Loop row presentation | Type stripe, title, elapsed time, state indicator | Rows now show a loop-type stripe, title, compact state indicator, and a compact elapsed value derived from `createdAt`. `Sidebar.elapsedText` now has focused boundary coverage for every unit rollover (seconds/minutes/hours/days) and its invalid-input guards (`created_at<=0`, `now<=created_at`), reverified via `zig test` and the full `WindowsShell.Tests.ps1` suite. This is still text painted directly onto the sidebar's `HDC` with no UIA identity of its own (the same limitation `Sidebar.updateBannerAt` had before this change), so a live assertion that reads the *rendered pixels* of the elapsed column was not captured this session; only the formatting logic and the row's overall live-rendering-without-crashing are executable evidence today. The beta25 Dev Box qualification (`0.1.78-windows.beta25`, installed package, production `graphcoded`, 2560x1440 at 100%, injected `SendInput` and UIA; return bundle reviewed 2026-10-13) rendered the stripe, title, state and elapsed columns without overlap, and a fresh loop showed `6s` in the sidebar with the loop bar at `elapsed <1m` (`section6b-age-d.png`, `f2-sidebar-h820.png`, reviewed). The elapsed text still has no UIA identity of its own. **Reopened (visual) 2026-10-13:** the side-by-side review against the macOS reference found every type bar orange; state shown as text instead of a dot. **Tracked in [#767](https://github.com/scgopi/GraphCode/issues/767) (implementation gap).** | Partial | | Project context menu | Move, worktrees, settings, Explorer, remote info, close, remove, delete loops/project | Project rows expose the lifecycle actions plus the Windows Recycle Bin path for local folders. Move is deliberately **not** an Explorer `/select` alias: `GraphContextMenu.moveProjectMenuItem()` appends "Move Project... (unavailable: daemon support required)" with `MF_GRAYED` while `Wire.supportsProjectRelocation()` is false, and the stale command path surfaces that explicit reason instead of opening Explorer. The live UIA gate now drives the real `TrackPopupMenu` popup (`MainWindow.wm_uia_context_menu` -> the same `GraphContextMenu.show()` the mouse path calls) and asserts the live menu's ordered items, that Move is command 5149 with that exact text and a disabled state, that a remote project's menu omits Move/Recycle Bin/Explorer entirely, and that the popup dismisses without wedging the shell. Note the observation channel: a popup menu appears in the UIA tree only as an empty Pane with no `MenuItem` children, so item identity/text/enabled state are read through `MN_GETHMENU` and the Win32 menu API against the HMENU the shell handed to `TrackPopupMenu` — live evidence of what the shell actually renders, but not UIA-tree evidence. | Partial | | Loop context menu | Open, composite actions, rename, stop, delete | Sidebar and canvas loop rows share stable-ID Open, Rename, Stop, and Delete actions. Composite cards expose Open Group, Pilot Once, and Arm Schedule; the drilled-in canvas addresses mutations through the parent composite. The live UIA gate now opens and reads all three `wm_uia_context_menu` loop variants: target 3 (a plain wired loop) asserts Open/Rename/Stop/Delete are present and that every composite-only and unwired-only command is absent; target 6 (a composite, not-yet-piloted loop) asserts Open Group/Pilot Once/Arm Schedule are present with Arm Schedule rendered `MF_GRAYED` (not piloted), and that unwired-only commands are absent; target 7 (an unwired loop node, added live via the sidebar-reorder fixture mutation) asserts Wire it up/Mark as entry are present and composite-only commands are absent. As with the project context menu, item identity/text/enabled state are read through `MN_GETHMENU` and the Win32 menu API against the HMENU the shell handed to `TrackPopupMenu` — live evidence of what the shell actually renders, not UIA-tree evidence **Reopened (visual) 2026-10-13:** the side-by-side review against the macOS reference found no Export/Import or Change to…; Windows-only Edit Details; no separators. **Tracked in [#778](https://github.com/scgopi/GraphCode/issues/778) (implementation gap).** | Partial | -| Recent projects | Reachable from Add Folder menu | Recent and currently-open projects are now exposed as distinct sidebar rows, with unopened recents remaining under the LOCAL/REMOTE sections while open workspaces use separate `open-project` identities. The deterministic UIA gate verifies the split presentation and section behavior. The live gate now also walks the Recent Folders submenu reachable from Add Folder end-to-end: it sends a real `WM_INITMENUPOPUP` (the message `App.zig` uses to refresh `recent_folders` from the live model before a popup shows, so the read reflects the fixture's recent projects rather than pre-fixture placeholder state), reads the submenu's live items in fixture order with their stable `recent_folder_command_base`-derived command IDs, and invokes the second entry through the real `WM_COMMAND` route, confirming the shell routes it without crashing | Partial | +| Recent projects | Reachable from Add Folder menu | Historical evidence covered separate recent/open sidebar rows and the live Recent Folders submenu: `WM_INITMENUPOPUP` refreshed fixture entries, native HMENU readback confirmed ordered labels/command IDs, and `WM_COMMAND` invoked the second entry without crashing. Merged [#817](https://github.com/scgopi/GraphCode/pull/817) now omits unopened recents from the normal sidebar while retaining File > Add Folder > Recent Folders. The historical sidebar presentation is not current evidence; current paired visual acceptance is NotExecuted (#826). | Partial | | Add Folder menu | Open Folder, Clone, Add Remote, recents | File now groups Open Folder, Clone Repository, Add Remote Repository, and Add Codespace under Add Folder and adds a dedicated Recent Folders submenu with its own command range; that submenu is now located rather than positionally indexed, so a new ingress entry can no longer silently retarget the rebuild. Focused MainWindow coverage validates the native menu structure and recent-folder command wiring. The live UIA gate now reads the Add Folder submenu directly off the live `HMENU` (`GetMenu`/`GetSubMenu`, not `TrackPopupMenu`, since this is the persistent menu bar) and asserts all four action labels plus the Recent Folders submenu; see the Recent projects row above for the live Recent Folders walkthrough this shares | Partial | | Sidebar update banner | Available version and click-to-install action | A persistent footer banner now shows the retained offered version and reopens the native update offer when clicked. The banner now also has its own UIA element (`sidebar-update-banner-*`, name "Update available", invokable button, bounds equal to the drawn rect, opening the same update offer as a click); App tests cover that bounds/name/invoke routing, but the live gate has not been changed to use it, so the next sentence still describes the gate's pixel-click path. On a viewport too short to leave two rows of sidebar content beside it, the banner (like the inline error footer, which collapses first) is not painted, published, or clickable; only the status line remains. A native provider test shows COM `IInvokeProvider::Invoke` posts exactly the dynamic-invoke command for the banner identity, and an App test shows that command and a banner click open the same offer (version and release URL); these are two linked tests, not one test spanning COM to the dialog, and the real dialog is still only opened by the live gate's click path. The live UIA gate now drives this through the real click path rather than the `GRAPHCODE_UIA_SHOW_UPDATE` bypass: the gate computes the banner's live pixel geometry from the shell's real client height (matching the same viewport-bottom formula the paint code uses) and posts a genuine synthetic `WM_LBUTTONDOWN`/`WM_LBUTTONUP` at that point, then verifies the real `GraphCode Update Available` dialog opens with the offered `GraphCode 9.9.9-test` version text, dismisses it via the live Later command, and confirms the shell survives. **In-app install remains deliberately Blocked** — the offer still hands installation off to the verified release page, and this row's evidence does not claim otherwise | Partial | | Sidebar error footer | Persistent, scoped project-ingress error | Folder, clone, remote, and daemon-open failures now persist in a dedicated red sidebar footer independently of transient status. Successful project ingress clears it, wrapped layout preserves long messages, and the deterministic UIA gate verifies the dedicated footer identity plus multi-line bounds below the update offer. | Partial | @@ -246,7 +313,7 @@ native keyboard/accelerator/window proof; the workspace row remains Partial. | Node positioning | Persisted positions and direct card movement where supported | Project cards can be dragged directly, with movement transformed correctly at non-default zoom, shared geometry/hit testing updated during the drag, and capture-loss cancellation restoring the prior position. Offsets are keyed to stable node identity, remapped across daemon reorder, and atomically persisted under the configured GraphCode support directory. Focused reorder/reload regressions and a real physical drag capture validate the complete flow | Partial | | Connector handles | Hover handles and drag-to-connect | The right-edge connector tracks hover, paints a visible handle and plus affordance, and preserves the drag-to-connect path. Focused rendering/input coverage passes, and the Windows shell toolchain blocker is now resolved: `Tools\windows\uia-live-gate.ps1` synthesizes real `WM_MOUSEMOVE` hover messages at the source card's outgoing connector position and confirms the live `0x7ACDFF` hover handle pixel actually appears on screen (`Test-ScreenPixelNear`), then drives a full `WM_LBUTTONDOWN`/`WM_MOUSEMOVE`/`WM_LBUTTONUP` drag from that connector onto a second card and confirms the resulting native "Create or edit edge" dialog locks its From/To fields to the exact dragged source and dropped target loop IDs, all passing across many consecutive live runs | Partial | | Loop card identity | Loop-type stripe, title, state pill, entry/cycle role | Project and overview cards now use loop-type-colored stripes while retaining lifecycle state text, START, UNWIRED, and attention labels. Focused color regression coverage passes; live evidence remains blocked. Narrowed 2026-10-13 to macOS scope (requirements macOS lacks were dropped; see the issue). **Tracked in [#727](https://github.com/scgopi/GraphCode/issues/727) (implementation gap).** | Partial | -| Loop card live detail | Goal/prompt/check line, progress, metric change, elapsed/backend/model/worktree metadata | Cards prioritize goal, trigger, or check detail, retain current activity, and add metric pass/change text, elapsed age, backend identity, token usage, model tier, and worktree/branch metadata from the same decoded daemon fields used by the workspace loop bar. Focused card metadata tests (`GraphCanvas.zig`: "loop card metadata includes backend elapsed and token usage when reported") pass, and the `windows-shell` CI job's live UIA gate exercises the populated card fixture end to end (run https://github.com/scgopi/GraphCode/actions/runs/35638849754, passing, merged as PR #399) **Reopened (visual) 2026-10-13:** the side-by-side review against the macOS reference found raw state and backend ids on a sparse 250x106 card instead of the compact macOS card with a state pill and meta line. **Tracked in [#764](https://github.com/scgopi/GraphCode/issues/764) (implementation gap).** | Partial | +| Loop card live detail | Goal/prompt/check line, progress/metric change, type/optional branch/backend/age metadata matching the macOS compact card | Merged [#814](https://github.com/scgopi/GraphCode/pull/814) shares the compact project/overview body. `GraphCanvas.zig` `cardLiveLine` prioritizes activity, otherwise goal/trigger/check content, or Composite loop-count/pilot status; activity may include a metric pass prefix. `cardMetricDetail` supplies metric change separately. `nodeMetadata` emits type, optional worktree branch, non-default backend display name and age from createdAt; `cardMetaForWidth` elides the branch to preserve fixed metadata, and `drawCardBody` paints the distinct rows. Compact cards show **not token usage or model tier**; loop bar/right-panel fields are separate surfaces and cannot substantiate card rendering. Current source coverage explicitly excludes card progress/token metadata; no stale test-name or historical #399 UIA claim proves the new pixels. Visual acceptance is NotExecuted (#826); full #764 criteria remain open. | Partial | | Loop card attention | Reason-aware amber presentation and primary action | NEEDS YOU cards render a card-level reason-specific primary button: `Reply` for reported awaiting-input sessions and `Inspect` for other attention reasons, both routed through the normal loop-opening path. Focused action-label tests (`GraphCanvas.zig`: "attention cards expose reason-specific primary actions") pass, and the live UIA gate's `attention-action-*` assertion for the deterministic awaiting-input card passed on `windows-shell` (run https://github.com/scgopi/GraphCode/actions/runs/35638849754, merged as PR #399) **Reopened (visual) 2026-10-13:** the side-by-side review against the macOS reference found no NEEDS YOU pill, glow or Inspect on cards that need attention. **Tracked in [#764](https://github.com/scgopi/GraphCode/issues/764) (implementation gap).** | Partial | | Unwired card recovery | Explanation, Wire it up, Mark as entry | Cards with no inbound or outbound edge now show an explicit UNWIRED warning and recovery explanation. Their native context menu exposes Wire it up, which enters the existing drag-to-connect flow, and Mark as entry, which changes the card to START for the session. Focused role/action tests plus live menu and post-action captures validate the flow **Reopened (visual) 2026-10-13:** the side-by-side review against the macOS reference found a text hint instead of the on-card Wire it up / Mark as entry controls. **Tracked in [#764](https://github.com/scgopi/GraphCode/issues/764) (implementation gap).** | Partial | | Worktree reclaim offer | Reclaim and Keep actions on resolved card | Safe resolved cards with a matching landed, clean, pushed worktree expose separate Reclaim and Keep targets. Reclaim revalidates safety and Keep suppresses the offer for the session. Canvas Reclaim/Keep descendants are now emitted through the UIA provider and invoke the same fail-closed paths. Focused geometry/safety coverage passes, and `Tools\windows\uia-live-gate.ps1` now asserts the live Reclaim/Keep descendants under the Graph fragment (name, non-empty bounds, InvokePattern, and correct RawView/ControlView sibling linkage) via the `windows-shell` CI job (PR #385, run 35422364203, passing) | Partial | diff --git a/investigation/windows-parity-lane-kickoff.md b/investigation/windows-parity-lane-kickoff.md index 7e8526cc..fc9ab3c4 100644 --- a/investigation/windows-parity-lane-kickoff.md +++ b/investigation/windows-parity-lane-kickoff.md @@ -18,8 +18,9 @@ Each issue gets two workers, in order (operator decision, 2026-10-14): ### If you are the planning worker -Produce the plan from evidence, not memory. Read-only on the repository; you may build, and -you may run focused hidden-window tests, to confirm current behaviour. Don't use the desktop. +Produce the plan from evidence, not memory. Read-only on the repository. Build, +test or desktop execution requires the per-issue command grant in Environment; +planning permission alone authorizes none of them. 1. **Read** the issue, its comments (including earlier attempts' findings), the ledger rows, the macOS captures and the macOS source. @@ -94,9 +95,22 @@ References on this machine: Fitted canvas pixels are not authored card dimensions or 100% zoom. - **Publication hold:** consult the local notice `C:\gc-ref\macos-groundtruth-2ccf303a.DO-NOT-PUBLISH.txt` by path only; do not - copy the notice or held images. Every other image needs individual visual privacy + open or quote its contents. Held originals + `issue-722\722-menus-split-round3@1x-srgb.png` and + `issue-722\722-menus-split-round3@2x.png`: **NEVER open, copy or upload**. + Every other image needs individual visual privacy clearance before upload. A sample review, correct masks or matching hashes do not clear unreviewed images, especially masked terminal captures. +- **Companion, not replacement:** `C:\gc-ref\macos-groundtruth-2ccf303a-gapfill-v2`, + same source, adds exact empty-global/project, project/overview 100%, native + Open Folder/Project Settings, inline Reclaim/Keep and Goal/Composite/menu + splits. Retained metadata reports 543 files / 178 PNGs / 542 verified payload + hashes / zero backend turns. Independent clearance covers only 11 sampled + images; 167 unsampled remain independently uncleared. The thirty-row pairing + worksheet records 6 sampled components / 3 recorded unsampled / 21 none; + all 30 need current Windows evidence and none is promoted. The primary + `764-final-fixtures-fitted` remains project 90%, not global/intrinsic 100%. + Preserve the ledger's dated original intake, with this additive qualification. - **Historical macOS fallback:** Run A is secondary, only for a state the primary lacks. Keep its source, fixture and evidence limits distinct. - **Windows beta26 "before" captures:** `C:\GraphCode-DevBox-Return\media\`. @@ -108,6 +122,14 @@ References on this machine: ## Scope +The batched coordinator reconciliation records merged A/#808, E/#816, B/#814, +D/#815 and C/#817 source slices, not whole issue closure. #768/#778/#764/#774/#767 +remain open, full B8/C6/D2/E4 criteria stay unchecked and B/C/D/E visual +acceptance is NotExecuted (#826). Preserve all 98 ledger identities/order and +**6 Validated / 89 Partial / 3 Out of scope**; thirty demoted rows stay Partial. +The orchestration plan's current execution/evidence authority governs J5, +parked adapters and the separately gated stock-only real-window route. + - **One issue, one PR, one coherent slice.** The first PR fixes the issue's primary defect. Leave remaining acceptance boxes unticked and list them. Small PRs merge; large ones loop through review. @@ -117,6 +139,33 @@ References on this machine: ## Environment: do exactly this +**Execution admission overrides the examples below.** Every worker needs a +**per-issue exact local command allow-list** and **fresh owned roots** before +execution. Repository bootstrap/build/test examples are **not blanket permission**. +No local full `Tools\windows\Tests\ValidationRunner.Tests.ps1`, +no `validate.ps1 -Task windows-shell` unit/integration, and +no GraphCode/daemon/zmx/provider build or launch unless separately explicitly +granted. CI owns broad/native regression. Narrow harmless-process, offscreen +or capture exceptions remain separately reviewed and command-bound; they do +not authorize adjacent suites or general product execution. + +No source changes in flight; keep failures immutable and positive executed +counts (zero-executed is not a pass). At five failures of the same kind, stop +and escalate to the operator; no owner rotation, root rename or reset without +an explicit user decision. Routine approval waits use a coordinator message and idle, +not a blocking `ask_user`. Check live `awaiting_input` before starting a capture +lease clock: message acceptance is not admitted permission. +No manual screenshots, screenshot/golden/pixel-baseline CI or fallback. +Unrelated-product PRs excluding all four capture-core files may receive at most +two failed-job reruns per exact head, globally across workflows, citing +[#826](https://github.com/scgopi/GraphCode/issues/826) and preserving failures. +The four files are `Tools\windows\UiCaptureDriver.psm1`, +`Tools\windows\Invoke-UiCaptureWorker.ps1`, `Tools\windows\Invoke-UiCapture.ps1` +and `Tools\windows\Tests\UiCaptureDriver.Tests.ps1`; core-changing repairs +do not get this exception. + +The following root/tool setup applies **only when the exact commands are +separately granted**; do not bootstrap, seed or build merely to start a lane. Replace `` with your lane id, for example `c4`. | What | Where | @@ -143,12 +192,13 @@ Replace `` with your lane id, for example `c4`. 5. **Tests:** - A `--test-filter` that matches nothing exits 0. Quote the executed count, which must be positive. - Register new Zig test roots in `Tools/windows/Tests/WindowsShell.Tests.ps1`. - - The native UIA provider suite (`Tools\windows\Tests\AccessibilityProvider.Native.Tests.ps1`) - runs hidden and needs no desktop. + - Hidden-window or native UIA labels do not exempt a command from admission; + native suites belong to CI unless explicitly granted. 6. **GitHub, done by you.** Use the GitHub access described in your issue block. Account and credential details are deliberately not kept in this repository. - - Push your branch, create your PR as a draft, edit its body and mark it ready yourself. The app's PR tools fail on - this repository, so don't use them. + - Push your branch and create one draft PR using the app-native PR tool. + Report tool failure rather than silently switching creation paths. + The coordinator owns admission, readiness and merge; do not self-approve. - Sign off every commit (`git commit -s`) and add the trailer `Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>`. 7. **Rebase hygiene:** @@ -160,8 +210,9 @@ Replace `` with your lane id, for example `c4`. - Edit it only with approval. - Assert on **named** elements; don't count broad sets. In wave 1 a canvas held loop cards, worktree cards and a banner. - - Add positive and negative functional cases to `Tools/windows/Tests/ValidationRunner.Tests.ps1`, - and run that file locally before pushing. + - Add positive and negative functional cases within an approved file lease. + Full local ValidationRunner execution is not authorized by a script edit; + any focused exception needs its exact command approved first. ## Order of work (the per-PR gate) @@ -173,15 +224,13 @@ Report each step's result, or NotExecuted with the reason. - Layout criteria are testable as geometry: rects lie inside the client area and above the footer, text bounds come from the container, and nothing overlaps. - A compile error is not RED. -3. **GREEN.** Run the focused tests and quote "All N tests passed", with N positive. -4. **Push a draft PR; exact-head CI is your regression gate.** - - Don't run the full unit or integration part locally. They need the desktop, and CI runs - them in parallel and authoritatively. - - Run locally only what doesn't need the desktop: focused roots, `ValidationRunner.Tests.ps1` - when scripts change, and `-Task visual-baseline` when tokens, palette, fonts or visual - contracts change. - - Every workflow on the exact head must be green. Cite run and job IDs, with counts, in - the `REGRESSION:` line. +3. **GREEN.** Run only admitted focused commands and quote the positive executed count. +4. **Push a draft PR; exact-head CI owns broad/native regression.** + - Execute locally only the approved exact allow-list. A focused root, script + edit or hidden-window label grants no exception. No visual-baseline task. + - Report nonempty exact-head run/job inventories and failures honestly. + Configured path skips are not executed tests; a dispatch is not a PR check. + Cite actual regression commands/results, not predicted CI outcomes. 5. **Code review.** - Start a `rubber-duck` agent with the reviewer model named in your issue block. It must be from a different vendor than you. @@ -189,34 +238,30 @@ Report each step's result, or NotExecuted with the reason. - It must open each log it cites, confirm every RED, GREEN and REGRESSION line, check that no unrelated file changed, and check the rebase diff. - Fix or answer every finding. -6. **Screenshots, once, last.** Only after steps 4 and 5 pass on the final head: - - send `LEASE REQUEST lane= purpose= est=<15 at most>`, and wait for `LEASE GRANTED`; - - capture before (main) and after (your head) at 100%, with `PrintWindow(hwnd, hdc, 2)` plus - pixel verification. For owned popups that `PrintWindow` omits, use an ownership-checked - screen capture (`WindowFromPoint` at the centre and on a 40 px grid); - - don't call `ActivateWindow` from `uia-live-gate.ps1` (#797); - - end the shell with File > Exit, stop by PID every process you own, including `zmx.exe` - daemons, and verify that none remain; - - send `LEASE RELEASED`. -7. **Visual review: a local agent review, not CI.** Screenshot verification is a judgement made by an agent. It - isn't a CI pipeline and it isn't a pixel baseline (operator decision, 2026-10-14). - - Start a vision-capable reviewer from a different vendor than you. Give it the screenshots, the PR description, - the diff and the paired macOS captures. - - It opens every image and decides whether each one shows what the PR claims was built and matches the macOS - reference. It confirms or rejects each acceptance box, citing what it saw. - - **Neighbouring screens:** when your change touches shared paint or layout code (`GraphCanvas.zig`, - `DesignTokens.zig`, `AppFont.zig`, `Sidebar.zig`, or the paint and layout paths in `App.zig`), the same desktop - slot also captures the sidebar, the Graph overview, a project canvas and a loop workspace. The reviewer checks - them for unintended changes against the last accepted captures on the issue. - - Upload privacy-safe fixture images with the github-pr-media skill, and add a table to the PR: macOS capture, - Windows before, Windows after, and the boxes each row shows. +6. **Capture is gated, not an instruction to run.** Follow the orchestration + plan's current #826/#822 authority. B/C/D/E visual acceptance is + **NotExecuted (#826)**. A merged code slice is not visual acceptance. + A later real-window route needs core merge, reviewed plan and exact commands; + only an admitted dedicated LAST slot of at most 15 minutes may be used. + No inherited lease, manual capture, automatic neighbouring-screen expansion + or fallback follows this gate. +7. **Privacy review precedes paired visual review/publication.** Admitted actual + images may undergo initial individual privacy review/scan. Paired visual + review and publication use only individually privacy-cleared actual images; + the held issue-722 originals remain NEVER open/copy/upload and outside scope. + Visual review remains local and scoped, not CI. A different-vendor + reviewer records the exact paired surfaces/criteria and leaves every + unsupported box unticked. An offscreen result is + **real paint path, offscreen component render**, not window, popup, native-control, terminal, input, + accessibility, physical-input or persistence evidence. Its first scene hides + the right panel; later surfaces need separate approval. Never bind historical + pixels to current source using conversion-time hashes. 8. **Hand over.** - Fill in `.github/PULL_REQUEST_TEMPLATE.md`, add a **Not verified** list, and use `Refs #`, never `Fixes`. - Check the body with `pwsh -NoProfile -File Tools\tdd\Test-TddEvidence.ps1 -BodyPath `. - - Run `gh pr ready `, and wait for exact-head CI to be green again (DCO re-runs). - - Message the coordinator with `PR READY #`, the head SHA and a five-line evidence summary. - Don't merge. + - Message the coordinator with the draft PR URL, exact head and bounded + evidence/NotExecuted summary. Wait idle for admission; don't mark ready or merge. ## Evidence honesty @@ -234,8 +279,8 @@ Report each step's result, or NotExecuted with the reason. - an exact-head CI failure that you caused. - After **5 failed iterations of the same kind**, stop and send `STUCK` with a handoff note: what you tried, the failing output, the reviewer findings, and what's worth keeping. -- Before that, keep iterating in this session. Waiting for the desktop, CI or review is not - a failure. +- Before that, iterate only within admitted commands. Waiting for approval, + desktop, CI or review is not a failure; it grants no execution permission. ## Communication diff --git a/investigation/windows-parity-orchestration-plan.md b/investigation/windows-parity-orchestration-plan.md index a87ba923..c23d0a8d 100644 --- a/investigation/windows-parity-orchestration-plan.md +++ b/investigation/windows-parity-orchestration-plan.md @@ -47,24 +47,25 @@ truth for status. The issues carry the acceptance criteria and the priority. | Cause | Fix | | --- | --- | -| Every lane's full unit and integration runs went through the one desktop, and were re-run each time a head moved. The queue dominated elapsed time. | Exact-head CI is the regression gate, and the desktop is for screenshots only: one slot of 15 minutes at most per PR, taken last (see below). | +| Every lane's full unit and integration runs went through the one desktop, and were re-run each time a head moved. The queue dominated elapsed time. | Exact-head CI owns broad/native regression. Historical screenshot-slot instructions are superseded by the execution/capture gates below. | | Escalation thresholds of 2 or 3 restarted sessions, which lost bootstrap, builds and context. Every lane escalated at least once. | Escalate only after 5 failed iterations (operator decision; see "Abandon and escalate"). | | Kickoffs were hand-copied per lane, and drifted: an 8-character validation root that failed the 81-character preflight, a wrong `Refs` line, the wrong reviewer model. | One canonical kickoff, `investigation/windows-parity-lane-kickoff.md`. The coordinator sends only an issue block. | | Environment traps were rediscovered lane by lane: a junction root, the root length, a stale profile log, `onboarding-seen`, `CopyFromScreen` capturing the wrong app, the `ActivateWindow` Alt tap (#797), `zmx` daemons left running, `vcvars`, the PR tool failing on forks. | They are listed once, in the kickoff's "Environment" section. | | The coordinator relayed every PR creation and body edit. | Lanes create and edit their own PRs, using the access details in their issue block (not kept in the repository). | | A rebase conflict resolution silently reverted #789's geometry helpers. | After each rebase, the lane and its reviewer read `git diff origin/main...HEAD`. | -| Broad new assertions in `uia-live-gate.ps1` (counting every canvas card) failed CI twice. | Gate edits assert on named elements, with local `ValidationRunner.Tests.ps1` cases. | -| Screenshots were taken before review, then retaken after each fix. | Code review first; screenshots once, on the final head; then an image-only review. | +| Broad new assertions in `uia-live-gate.ps1` (counting every canvas card) failed CI twice. | Gate edits assert on named elements, with scoped contract cases; full local ValidationRunner is no longer authorized by a script edit. | +| Screenshots were taken before review, then retaken after each fix. | Review first; any future capture requires separate admission. Manual screenshots and visual CI were canceled. | **Coordinator rules (added 2026-10-14):** - **Verify before ruling.** Check a scope or parity ruling against the macOS source before sending it. Two wave-1 rulings were reversed (a historical baseline pin, and a Restart button macOS does show). -- **Run harness changes end to end locally first.** A coordinator PR that changes - a validation script runs that script locally before merge. #802 merged with a - known local failure, and #805 had to fix it. -- **Answer every lane message within one turn**, and keep the desktop queue - moving. An undeliverable grant goes to the next lane at once. +- **Do not treat a harness edit as execution permission.** #802 merged with a + known local failure, and #805 had to fix it. A local reproduction now needs a + per-issue exact command grant; CI owns broad/native regression. +- **Answer actionable lane messages promptly.** Routine approval waits use + message plus idle. Check live awaiting-input and execution admission before a + lease clock; delivery of a grant is not evidence that it was admitted. ## Wave 2 (started 2026-10-14) @@ -78,21 +79,107 @@ through four steps: approves its file scope (including any out-of-lease files, up front), and records `Plan approved` on the issue. 3. **Implement.** An implementation worker (`gpt-6-luna`, high; `gpt-6.1-sol`, high, long_context, for highly complex features) executes the approved plan under the - per-PR gate. Exact-head CI is the regression gate, screenshots are taken once - at the end, and escalation comes only after 5 failed iterations. -4. **Merge.** The coordinator merges on exact-head CI, after the code and image - reviews. + per-PR gate and exact command allow-list. CI owns broad/native regression; + capture is separately gated, and five failures trigger an operator stop. +4. **Merge.** The coordinator owns admission/readiness/merge on accepted source + review and exact-head CI, explicitly recording any deferred visual criteria. + A code-slice merge does not close those criteria. Planning runs in parallel for all lanes. Implementation stays one per lane. | Lane | Issue | Planner | Implementer | Reviewer | | --- | --- | --- | --- | --- | -**Desktop lease.** Screenshots of a running shell, Windows Sandbox runs and any -local integration run take the desktop. One session holds it at a time, and the -coordinator hands it out. Focused hidden-window `zig test` runs in parallel, -each in its own scratch roots. Full unit and integration validation run in -exact-head CI (see below). +### Current execution and evidence authority + +Every worker needs a **per-issue exact local command allow-list** and +**fresh owned roots** before execution. Repository bootstrap/build/test examples +are **not blanket permission**. No local full `Tools\windows\Tests\ValidationRunner.Tests.ps1`, +no `validate.ps1 -Task windows-shell` unit/integration, and +no GraphCode/daemon/zmx/provider build or launch unless separately explicitly +granted. CI owns broad/native regression. Narrow harmless-process/offscreen/ +capture exceptions remain separately reviewed and command-bound. + +No source changes in flight; keep failures immutable. Zero-executed is not a +pass. At five failures of the same kind, stop for the operator; +no owner rotation, root rename or reset without an explicit user decision. Routine approval waits +use a coordinator message and idle, not blocking `ask_user`. Check live +`awaiting_input` before starting any capture lease clock: +message acceptance is not admitted permission. +No manual screenshots, screenshot/golden/pixel-baseline CI +or fallback. No automatically granted local execution follows a green workflow. + +For unrelated-product PRs excluding `Tools\windows\UiCaptureDriver.psm1`, +`Tools\windows\Invoke-UiCaptureWorker.ps1`, `Tools\windows\Invoke-UiCapture.ps1` +and `Tools\windows\Tests\UiCaptureDriver.Tests.ps1`, the #826 exception permits +at most **two failed-job reruns per exact head, globally across workflows**, +citing #826 and preserving the original failures. **Core-changing repairs do +not get this exception.** + +**Capture core.** [#826](https://github.com/scgopi/GraphCode/issues/826) remains +open, no longer under its former blocked-title/no-new-owner ruling. The +[explicit user override](https://github.com/scgopi/GraphCode/issues/826#issuecomment-6186430845) +appoints J5 (GPT-6.1 Sol/high) as sole owner of only the two Phase A fixture +defects: validAbsentWQL and StrictMode whole-array wrapping, with a fresh +five-failure budget. Phase A requires accepted static review, the exact positive +5-case decision driver followed by the 51-case direct suite (original 49 plus +2), and accepted current-head CI. Execution commands remain separately granted; +these gates are not worker-progress or runtime-acceptance claims. +This is not authority for other edits. J4's fifth failure +(**5 executed / 3 passed / 2 failed**) stays frozen historical evidence, not an +accepted lifecycle repair. The pure 12-row decision matrix and three mutant +distinctions are not a full endpoint pass. Phase B immutable numbered journal +work may be planned only after Phase A review plus green CI is accepted, then +requires its own plan/review before implementation. Cap and the D adapter stay +parked until #826 merges and explicit ordered resumption; no automatic capture +authority follows a core merge. + +**Offscreen route.** The seven-file first project scene requires controlled +post-C source freeze/review, separate exact native, codec and converter grants, +and an actual source-bound run. It is **real paint path, offscreen component render**: +two idle cards, one edge, 1280x720; the first scene hides the right panel. +Admitted actual images may undergo individual privacy review; claims require +individually privacy-cleared actual images and different-vendor paired review. +Actual artifact status is linked from the [issue/receipt](https://github.com/scgopi/GraphCode/issues/822), +not hardcoded as worker progress here. No PNG/pass or current whole visual/parity +acceptance is predicted or established by this policy. +Only actual in-frame card/edge/panel/layout pixels can support a later scoped +claim, never window/composition, popups, terminal, native controls, input, +accessibility, physical input or persistence. Do not rebind old dirty +`4fafbfb2` pixels with conversion-time current hashes. Sidebar, right-panel and +NativeForms slices need separate later approvals after the first proves out. + +**Selected real-window option 1: stock-only route, execution separately gated.** +The [earlier proposal](https://github.com/scgopi/GraphCode/issues/822#issuecomment-6186605912) +records route provenance, not execution authority. The selected route requires +#826 merge, an accepted current plan and separate exact implementation, native, +install and capture grants. A reviewed plan alone is not an execution lease; +ungranted execution is **UNAPPROVED**. The operator steer prohibits any fork, +patch or derivative of WinAppCli or another external +repository: **stock pinned WinAppCli 0.5.0 only**. Restore/foreground are +acceptable and must be recorded inside the dedicated **LAST, at most 15-minute** +desktop slot when explicitly granted; they are not forbidden in that route. +Backend may remain unattested. Correct-pixel fallback may be admitted only +with all postchecks: per-capture success, target DWM-frame dimensions within +DPI rounding, a single window with no non-target owned popups/composite, +nonblank variance, unchanged pre/post roster and identity, privacy review and +then local vision review. Variance proves neither backend nor absence of fallback. +The first proposed slice is only the GraphCode main window plus authentic Clone +dialog, with minimal GraphCode profile generalisation only if source hardcodes +require it. No implementation, install, probe or execution before #826 merges, +plan review and explicit new commands. Menus retain semantic HMENU evidence; +terminal/tray remain deferred. This is not a new visual CI or manual-capture grant. + +**Merged slices, deferred claims.** A/#808, E/#816, B/#814, D/#815 and C/#817 +are all merged; accepted main for this reconciliation is +`24209d2a70efee78be2a8214edf013e9b787ccd0`. The ledger's merged-slice table +records their exact merges and bounded source progress. #768/#778/#764/#774/#767 +remain open; full B8/C6/D2/E4 criteria stay unchecked, and B/C/D/E visual +acceptance is NotExecuted (#826). A's historical 26 assets are text-prompt +evidence, not a NativeForms/policy-overflow repair. The 98 canonical identities, +order and statuses remain **6 Validated / 89 Partial / 3 Out of scope**, including +all thirty demoted rows still Partial. No worker may promote rows from code, +unit/UIA/native-menu/offscreen capability or macOS-only references. **Short validation root.** The UIA live-gate preflight refuses sandbox paths longer than 81 UTF-16 characters, and `validate.ps1` appends @@ -105,42 +192,32 @@ resolved path. That breaks the `WorktreeGitProcess` unit fixtures, and very probably caused local `ScrubbedShellStartup` `registered-project` failures that exact-head CI did not reproduce. -**The desktop is for screenshots only (since 2026-10-14).** One machine has one -desktop, and wave 1 showed that serialising every lane's full unit and -integration runs through it, and re-running them each time a head moved, -dominated elapsed time: three product PRs merged in about ten hours. So: - -- **Exact-head CI is the regression gate.** Its three unit shards, the - integration job (the live UIA gate) and packaging run in parallel on hosted - runners, and they're authoritative. A `REGRESSION:` line may cite the exact-head - CI run and job IDs, with their counts. -- **Don't run the full unit or integration part locally in a desktop slot**, - except to debug a CI failure you can't reproduce otherwise; ask first. Some - App and WindowsNativeDialogs unit roots call `ShowWindow`, `SetForegroundWindow` - or `SetFocus`, so they can't run outside a lease. -- **Focused hidden-window `zig test` roots, `-Task visual-baseline` and - `ValidationRunner.Tests.ps1` run freely**, without the desktop. -- **Desktop slots are 15 minutes at most, and one per PR.** Take one only after - the code review has accepted the code and exact-head CI is green, so that the - screenshots are taken once, on the final head. - -**Captures.** +**CI and desktop separation.** Hosted exact-head workflows own broad/native +regression. Report a nonempty run/job inventory, actual positive executed counts +and configured skips separately; a manual dispatch is not a PR required check. +Some App/WindowsNativeDialogs unit roots show or focus windows: "unit" or +"hidden" does not establish harmlessness or authorize local execution. +Only the separately admitted final capture route can consume a desktop slot; +the old screenshot queue does not grant a lease. + +**Historical capture environment notes, not execution permission.** - Seed `onboarding-seen` in the fixture's `GRAPHCODE_SUPPORT_DIR`; `WindowsOnboarding.Store` reads it there, not from `LOCALAPPDATA`. - Windows Sandbox clamps the guest screen to about 1520x823 and failed `EnumDisplaySettings` with vGPU disabled. Use it for clean-install and first-run flows, not for 1440x900 visual captures. -**Creating PRs.** Workers create and edit their own PRs. The GitHub access details -come with the issue block and are not kept in the repository. The app's PR tool -tries a fork push and fails. +**Creating PRs.** Workers create one draft with the app-native PR tool and the +complete repository template; report failure rather than switching creation +paths. The coordinator owns readiness, admission and merge. Access details +remain outside the repository. -**Provider checkouts.** Seed `winghostty` and `zmx` under the lane's +**Provider checkouts, only when command-granted.** Seed `winghostty` and `zmx` under the lane's `-ProviderRoot` from the read-only local mirrors in `C:\gc-cache\git\*.git`. Check out the pinned commit, point `origin` back at GitHub, then run bootstrap: it verifies the pin. -**Toolchain.** Each session bootstraps its own tool, provider and scratch +**Toolchain, only when command-granted.** Each session bootstraps its own tool, provider and scratch roots: `C:\gct\`, `C:\gcp\` and `C:\gcs\`. To skip the slow Zig download, seed the tool root from the checksum-verified, read-only cache in `C:\gc-cache\zig`. @@ -253,6 +330,10 @@ same kind: | The rubber duck or the visual sign-off rejects the PR with substantive findings (not wording) | 5 rejections | | Exact-head CI fails for a reason the session caused | 5 times | +This threshold is a **stop/operator gate**, not permission to rotate owners or +reset roots/counters. The following handoff procedure requires an explicit user +decision before appointing a replacement; it does not automatically restart work. + Everything else is **corrected in place, not escalated**: - A contradicted evidence claim (overclaiming) is fixed in the PR body, and the reviewer re-checks it. @@ -309,41 +390,39 @@ silently. - no two control rects overlap. Use the existing `RealShellWindow` and form-geometry test patterns. -3. **Implement**, then run the focused Zig tests and paste their output - counts. Assert a positive executed-test count, because a filter that matches - nothing still exits 0. -4. **Full validation is exact-head CI**: push, and wait for every workflow on - the exact head to be green. Locally, run only what doesn't need the desktop: - the focused roots, `ValidationRunner.Tests.ps1` when gate or runner scripts - change, `-Task packaging` when packaging changes, and `-Task visual-baseline` when - `DesignTokens.zig`, palette, font or visual-contract files change. That task - runs `VisualBaseline.Tests.ps1` and `PaletteParity.Tests.ps1`, which the shell - suites don't. `windows-spikes` is a CI workflow job, not a `validate.ps1` - task, and every exact-head workflow must be green before merge. Report - every failure, including +3. **Implement**, then run only the admitted focused commands and paste actual + output counts. Assert a positive executed-test count, because a filter that + matches nothing still exits 0. +4. **Broad/native regression is exact-head CI.** Local execution is limited to + the admitted per-issue exact allow-list; script changes, focused/hidden roots + and packaging changes do not grant new commands. No visual-baseline task. + `windows-spikes` is a CI workflow job, not a `validate.ps1` task. + Every exact-head workflow must be green before merge. Report every failure, including flakes, with the rerun result next to it. Never replace a failing log with a passing one. -5. **Visual evidence (local), last.** Capture once, after steps 4 and 6 pass on - the final head, in one desktop slot of 15 minutes at most. Use the shared - reference fixture, and capture the surface **before and after** at 100%, with - `PrintWindow(hwnd, hdc, 2)` plus pixel verification. Don't use `ActivateWindow` - from `uia-live-gate.ps1` (#797). Afterwards, check that no processes you own remain, - including `zmx.exe` daemons. Windows Sandbox can't do 1440x900 captures. The PR - includes a table: macOS capture, Windows before, Windows after, and the - acceptance boxes each pair shows. -6. **Rubber duck, before the screenshots.** A reviewer from a different vendor - receives the diff, the PR body and the evidence folder; it sees the screenshots - in a final, image-only pass after step 5. It must check: +5. **Visual evidence is separately gated.** No manual screenshots or automatic + neighbouring-screen batch. The current authority above controls any future + final desktop slot. B/C/D/E visual acceptance is **NotExecuted (#826)**, + not silently waived by merge. Record exact paired scenes, source binding and + limitations only after an admitted run; historical pixels cannot acquire + current provenance during conversion. +6. **Source/evidence review, before any admitted capture.** A reviewer from a + different vendor receives the diff, PR body and evidence folder. Only an + admitted capture proceeds to a final privacy-cleared image pass. It checks: - every RED/GREEN/REGRESSION line matches a log it opened; - every screenshot it cites shows the claimed state; - no criterion is claimed from a UIA readback or unit test alone; - no unrelated file changed; - - the behaviour of neighbouring surfaces didn't regress (it opens their - captures as well). + - neighbouring-surface evidence within the admitted scope, explicitly + listing unexecuted checks rather than manufacturing a new capture grant. Its findings are fixed or answered in the PR before merge. -7. **Visual sign-off.** The visual model ticks each acceptance box with a crop - reference, or leaves it unticked with a reason. +7. **Privacy review, then visual sign-off.** Admitted actual images may undergo + individual privacy review/scan first. Paired visual review and publication + use only individually privacy-cleared actual images; held originals remain + outside admission. Only accepted pairs can support the named criteria; + otherwise leave boxes unticked with a reason. Offscreen component evidence + cannot stand in for whole-window/native behavior. 8. **Merge.** Only the coordinator merges, after exact-head CI is green, using `gh pr merge --squash --match-head-commit `. Ledger rows change only in a coordinator ledger PR, after the evidence is accepted. @@ -363,6 +442,10 @@ silently. ## Local testing (no Dev Box) +This table describes evidence classes, **not executable permission**. CI owns +the broad/native rows. Any local exception needs the exact allow-list and +fresh owned roots above; manual screenshots remain canceled. + | Lane | What it proves | How | | --- | --- | --- | | L0: unit | Pure logic and geometry | `zig test` on the touched roots, with a positive count asserted | @@ -408,6 +491,27 @@ Use the separately recorded global overview for that context. Likewise, a disabled global menu command is not evidence that a similarly named workspace bar button is disabled. +### Additive companion qualification (2026-10-15) + +The original primary remains `C:\gc-ref\macos-groundtruth-2ccf303a`. +`C:\gc-ref\macos-groundtruth-2ccf303a-gapfill-v2` is additive, not a +replacement or blanket clearance: **543 files / 178 PNGs / 542 verified payload +hashes / zero backend turns** in the retained metadata. Independent review +cleared only **11 sampled images**; **167 unsampled remain independently +uncleared**. This documentation reconciliation reads metadata/hashes only and +adds no image privacy verdict. The primary's two held issue-722 originals and +path-only hold notice remain governed by the canonical kickoff. + +New macOS references include exact empty global/project scenes, separate +project/overview 100% scenes, native Open Folder/Project Settings, inline +Reclaim/Keep, Goal/Composite and menu splits. The primary fitted-project 90% +frames are not relabelled as global or intrinsic 100%. The read-only thirty-row +worksheet records 6 sampled components / 3 recorded but independently unsampled / +21 without a new exact recording; all 30 require current Windows evidence, +with zero promotions. Worksheet and spotcheck metadata hashes are retained in +the ledger. Preserve its dated 2026-10-14 table as historical observation; +companion qualification is a later update, not retroactive provenance. + The ledger's dated intake recovers all 30 previously unassessed row identities. Pair only exact states that were actually recorded. The retained Windows bundle is **Windows beta26 (pre-wave-1)**; a historical pair is not a verdict @@ -425,11 +529,10 @@ baseline CI lane is revived by this intake. - **Wave 1 (P1).** Lanes A–E start in parallel. Calibrate the models on the first issue in each lane. -- **After each wave:** - 1. cut a local unpublished candidate; - 2. run the L1 and L2 qualification; - 3. re-run the paired captures on the surfaces that changed; - 4. promote ledger rows only where the gate evidence is complete; - 5. publish a prerelease only with operator approval. +- **After each wave:** review the accepted source slices, exact-head hosted + regression and outstanding criteria. Candidate builds, local L1/L2 execution + and paired capture each require their own explicit commands and admission; + they do not run automatically. Promote ledger rows only after complete + accepted evidence, and publish a prerelease only with operator approval. - **Wave 2 (P2)** and **wave 3 (P3)** follow the same loop. The testing-gap verification in lane F runs throughout.