catalog: Windows GUI Runtime Connector 0.0.8 with initial-owner release fix

catalog/packages/io.github.desolate-jix.gui-runtime/0.0.8.json

@@ -0,0 +1,24 @@
+{
+  "publisher": {
+    "evidence": "https://github.com/Desolate-Jix/agent-gui-runtime/releases/tag/amadeus-extension-v0.0.8",
+    "id": "Desolate-Jix",
+    "maintainers": [
+      "Desolate-Jix"
+    ],
+    "package_ids": [
+      "io.github.desolate-jix.gui-runtime"
+    ]
+  },
+  "review": {
+    "date": "2026-11-05",
+    "evidence": "https://github.com/Code-Amadeus/Amadeus-Extensions/pull/11",
+    "policy": "curated-v1",
+    "reviewer": "Lucas1479",
+    "sha256": "2f532faf152faf2e1e3ab3140e1097487689be34d638e4ee86539e06886cbcaf"
+  },
+  "wheel": {
+    "sha256": "2f532faf152faf2e1e3ab3140e1097487689be34d638e4ee86539e06886cbcaf",
+    "url": "https://github.com/Desolate-Jix/agent-gui-runtime/releases/download/amadeus-extension-v0.0.8/amadeus_agent_gui_runtime-0.0.8-py3-none-any.whl"
+  },
+  "withdrawal": null
+}

catalog/review-candidates/io.github.desolate-jix.gui-runtime/0.0.5/AUTHOR_VALIDATION.json

@@ -0,0 +1,199 @@
+{
+  "schema": "amadeus.connector.author-validation.v1",
+  "connector_version": "0.0.5",
+  "status": "bounded_checks_passed_with_observation",
+  "review_status": "not_reviewed",
+  "independent_store_review": "pending",
+  "new_installed_pi_gui_acceptance": "not_run",
+  "packaging": {
+    "two_offline_builds_byte_identical": true,
+    "wheel_record_and_source_match": true,
+    "readme_embedded_in_metadata": true,
+    "source_zip_verified": true
+  },
+  "host_contract": {
+    "fixed_host": "1840c8e4f646992ddaebea3139c8895f29743a8f",
+    "current_host": "b6616a166925963ad6de4ab0a02f4eef2dccd657",
+    "python": "3.12.10",
+    "checks_per_host": 2,
+    "skipped": 0,
+    "cases": [
+      "installed manifest/Skill validation",
+      "native HTTP projection and secret binding"
+    ]
+  },
+  "preflight": {
+    "host_commit": "1840c8e4f646992ddaebea3139c8895f29743a8f",
+    "environment": {
+      "platform": "win32",
+      "python": "3.12.10"
+    },
+    "checks": {
+      "catalog_policy": "passed",
+      "human_and_runtime_review": "pending",
+      "package_format": "passed",
+      "target_host": "passed"
+    },
+    "review_status": "not_reviewed"
+  },
+  "source_http": {
+    "runtime_version": "0.1.8",
+    "runtime_source_base": "654fe148c0492feed2b01ec643597ea006b6a8c6",
+    "python": "3.12.10",
+    "recognition_source": "external_api",
+    "model_endpoint": "closed loopback fixture; no external model service",
+    "protocol_and_host_exit_checks_passed": true,
+    "initialize_version": "0.1.8",
+    "security_cases": [
+      {
+        "case": "missing_token",
+        "status": 401,
+        "error_code": "authentication_required",
+        "rejected_before_owner_creation": true
+      },
+      {
+        "case": "wrong_token",
+        "status": 401,
+        "error_code": "authentication_required",
+        "rejected_before_owner_creation": true
+      },
+      {
+        "case": "untrusted_host",
+        "status": 421,
+        "error_code": "host_forbidden",
+        "rejected_before_owner_creation": true
+      },
+      {
+        "case": "wrong_loopback_host_port",
+        "status": 421,
+        "error_code": "host_forbidden",
+        "rejected_before_owner_creation": true
+      },
+      {
+        "case": "untrusted_origin",
+        "status": 403,
+        "error_code": "origin_forbidden",
+        "rejected_before_owner_creation": true
+      },
+      {
+        "case": "loopback_browser_origin",
+        "status": 403,
+        "error_code": "origin_forbidden",
+        "rejected_before_owner_creation": true
+      },
+      {
+        "case": "duplicate_authorization",
+        "status": 401,
+        "rejected_before_owner_creation": true
+      }
+    ],
+    "owner_isolation": [
+      {
+        "case": "failed_initialize_releases_unowned_transport",
+        "passed": true
+      },
+      {
+        "round": 1,
+        "competing_initialize_rejected": true,
+        "wrong_owner_rejected": true,
+        "missing_owner_rejected": true,
+        "unsupported_sessionless_protocol_rejected": true,
+        "live_host_delete_rejected_without_stop": true
+      },
+      {
+        "round": 2,
+        "competing_initialize_rejected": true,
+        "wrong_owner_rejected": true,
+        "missing_owner_rejected": true,
+        "unsupported_sessionless_protocol_rejected": true,
+        "live_host_delete_rejected_without_stop": true
+      }
+    ],
+    "tools": {
+      "names": [
+        "instant_image",
+        "instant_recover_session",
+        "instant_recovery_preview",
+        "instant_result",
+        "instant_run",
+        "instant_start",
+        "instant_status",
+        "instant_stop",
+        "instant_submit"
+      ],
+      "public_generic_contract_markers": {
+        "step_decision_check_before_action_documented": true,
+        "action_review_input_property": true,
+        "field_evidence_mode_input_property": true,
+        "visual_field_proof_documented": true,
+        "agent_command_continue_enum": true,
+        "bound_review_and_explicit_continue_documented": true
+      },
+      "dedicated_packet_generation_exercised": false,
+      "note": "Schema/description discovery proves advertised generic review/continue and field-evidence surfaces; it does not prove dedicated packets were generated"
+    },
+    "rounds": [
+      {
+        "round": 1,
+        "ready": true,
+        "host_stopped": true,
+        "cleanup_verified": true,
+        "pending_count": 0,
+        "release_status": 200,
+        "tcp_reconnect_preserved_owner": true,
+        "old_owner_rejected": true
+      },
+      {
+        "round": 2,
+        "ready": true,
+        "host_stopped": true,
+        "cleanup_verified": true,
+        "pending_count": 0,
+        "release_status": 200,
+        "tcp_reconnect_preserved_owner": true,
+        "old_owner_rejected": true
+      }
+    ],
+    "all_hosts_exited": true,
+    "listeners_closed": true,
+    "desktop_commands": 0,
+    "screenshots": 0,
+    "model_triggering_commands": 0,
+    "queue_command_kinds": [
+      "close"
+    ],
+    "dedicated_review_packets_exercised": false,
+    "explicit_test_host_start_authorization": true
+  },
+  "maintenance_registration_observation": {
+    "first_stopped_registration_immediately_retired": false,
+    "live_host_or_unsettled_input_retained": false,
+    "maintenance_admission_or_update_attempt_tested": false,
+    "blocked_update_reproduced": false,
+    "source_behavior": "Maintenance independently verifies original settlement evidence and may retire settled registrations.",
+    "final_test_cleanup": "Only exact test-owned sessions were verified and cleared using the production ledger API.",
+    "remaining_test_registrations": 0,
+    "limit": "Manual test cleanup is not proof of immediate automatic retirement; no complete lifecycle or maintenance qualification is claimed.",
+    "explanation": "Different Windows venv wrapper/runner identities are a source-based hypothesis, not a captured child-side error."
+  },
+  "retained_nonpasses": [
+    "First HTTP attempt stopped on a Windows closed-port ConnectTimeout not handled by the original probe; corrected probe rerun passed within the stated scope.",
+    "Initial host contract run used an API environment missing PyYAML; qualified minimal-checker reruns passed two checks per Host.",
+    "Initial build readback compared undecoded/CRLF METADATA to LF Unicode source; UTF-8/line-ending-aware readback and a fresh two-build run passed.",
+    "Immediate retirement of all stopped maintenance registrations was not observed; subsequent maintenance admission was not tested."
+  ],
+  "not_run": [
+    "new Pi native 0.0.5/Runtime 0.1.8 GUI task",
+    "real model quality/cost/speed",
+    "dedicated pre-action/field-review packet generation in this HTTP-only run",
+    "new Host disable/uninstall integration",
+    "physical reboot/power loss",
+    "arbitrary third-party data migration",
+    "independent catalog review/publication"
+  ],
+  "historical_evidence": {
+    "combination": "installed Runtime 0.1.6 + connector 0.0.4",
+    "url": "https://github.com/Desolate-Jix/agent-gui-runtime/blob/instant-v0.1.6/docs/verification/MAIN_PRE_ACTION_REVIEW_20261023.md",
+    "reuse_limit": "Scoped assisted TEST double-refusal/Main continuation evidence; not new 0.0.5/0.1.8 acceptance."
+  }
+}

catalog/review-candidates/io.github.desolate-jix.gui-runtime/0.0.5/README.md

@@ -0,0 +1,88 @@
+# Author resubmission — Windows GUI Runtime Connector 0.0.5
+
+Follow-up to [submission #7](https://github.com/Code-Amadeus/Amadeus-Extensions/pull/7)
+and [author revision request #4](https://github.com/Desolate-Jix/agent-gui-runtime/issues/4).
+The prior 0.0.4 candidate evidence is retained. This directory supplies author
+materials, **not catalog approval or a live catalog entry**. Please make all
+further revisions in the new submission PR.
+
+- **Versioned wheel and preflight:** [0.0.5 wheel](https://github.com/Desolate-Jix/agent-gui-runtime/releases/download/amadeus-extension-v0.0.5/amadeus_agent_gui_runtime-0.0.5-py3-none-any.whl),
+  **24,635 bytes**, SHA-256
+  `9727889c378354ee6b24648c94b2276b8ed30d986b49d1dd4b0f5c3c188774dd`.
+  The attached `preflight.json` is the actual fixed Windows/CPython 3.12.10/
+  Host `1840c8e` report. Format, Host and curated policy passed; independent
+  human/runtime review remains pending and `review_status` is `not_reviewed`.
+- **Source/build and usage:** [Exact source ZIP](https://github.com/Desolate-Jix/agent-gui-runtime/releases/download/amadeus-extension-v0.0.5/extension-source-0.0.5.zip),
+  **48,737 bytes**, SHA-256
+  `93e78d5a008df6d4c5fbb35a237fc9517269d5ebbc6c461beabdc667095cd53f`;
+  [English setup](https://github.com/Desolate-Jix/agent-gui-runtime/blob/amadeus-extension-v0.0.5/integrations/amadeus/agent-review-instant/README.md),
+  [中文指南](https://github.com/Desolate-Jix/agent-gui-runtime/blob/amadeus-extension-v0.0.5/integrations/amadeus/agent-review-instant/README.zh-CN.md),
+  [build verification](https://github.com/Desolate-Jix/agent-gui-runtime/releases/download/amadeus-extension-v0.0.5/BUILD_VERIFICATION.json),
+  [author validation and limits](https://github.com/Desolate-Jix/agent-gui-runtime/blob/amadeus-extension-v0.0.5/docs/verification/AMADEUS_CONNECTOR_005_20261026.md).
+  Two offline wheel builds were byte-identical. Inventory and the full
+  candidate-to-candidate 0.0.4 diff are attached; the older candidate was not an
+  approved catalog package.
+- **Ownership and rights:** namespace `io.github.desolate-jix.gui-runtime`;
+  [source repository](https://github.com/Desolate-Jix/agent-gui-runtime),
+  [release history](https://github.com/Desolate-Jix/agent-gui-runtime/releases),
+  [connector ISC license](https://github.com/Desolate-Jix/agent-gui-runtime/blob/amadeus-extension-v0.0.5/integrations/amadeus/agent-review-instant/LICENSE).
+  These are independently verifiable control/rights references, not author-issued
+  approval. The wheel includes no Runtime executable, artwork, model weights,
+  provider credentials or user data; external component licenses remain separate.
+- **Changes/migration:** 0.0.5 updates installation disclosures, manifest
+  homepage/repository, package metadata and synchronized README/Skill instructions.
+  Existing `runtime_url`, secret `connection_token`, permissions and native HTTP
+  connection semantics are unchanged; no 0.0.3/0.0.4 configuration migration.
+  Runtime code, thresholds and model defaults are unchanged. Old 0.0.4 bytes and
+  URLs are not replaced.
+
+## Installation commitment and compatibility
+
+This is a **connector**. Users separately install, configure, start, update and
+stop Windows GUI Runtime. Recommend released **Runtime 0.1.8**; the minimum
+HTTP/pre-action-review route was introduced in **0.1.6**, and the active service
+must expose the required authentication, original-command and review/continue
+capabilities. Version numbers and successful initialization alone do not certify
+the entire integration. Runtime 0.1.5 has no HTTP entry point. Later versions need
+manual capability qualification; no automatic version detector is claimed.
+
+Install the [Runtime separately](https://github.com/Desolate-Jix/agent-gui-runtime/releases/tag/instant-v0.1.8),
+then import this wheel into a compatible Amadeus with native HTTP MCP/Skill
+support and Python 3.12. Configure a trusted loopback `runtime_url` and a
+separately generated `connection_token`, bind both contributions to Pi, enable,
+apply the Host restart and create a new Work. Provider API keys stay in Runtime;
+they are different from the local connection token. External model calls may
+incur charges. The API route requires no local GPU/model weights. Uninstalling
+or disabling the connector does not stop/uninstall Runtime or delete its data.
+
+## Evidence boundaries and reviewer handoff
+
+Fixed and current Host `b6616a1` static manifest/Skill and secret-projection
+checks passed two cases each. Source Runtime 0.1.8 HTTP checks passed version/tool
+discovery, seven security negatives, ownership controls and two actual child-host
+start/stop/release/reconnect rounds with no GUI/model commands. A stopped first
+session's maintenance registration was not immediately retired; exact test-owned
+cleanup proof was later accepted. Maintenance admission/update was not tested,
+and an update blockage was not reproduced. The attached `AUTHOR_VALIDATION.json`
+retains this observation and the narrower pass scope.
+
+The prior installed 0.0.4/0.1.6 controlled Pi/Main-review evidence remains
+historical. The exact new Host/Pi/0.0.5/Runtime combination still needs independent
+installation, the documented minimal navigation task, failure/credentials,
+cancellation/disconnection, session release/reconnect, disable/uninstall review.
+The supplied setup guides include concrete troubleshooting and no-replay recovery.
+This is not a new accuracy, performance or token benchmark.
+
+The independent maintainer adds real `catalog/packages` ownership/review facts
+after review in the submission PR, then prepares and verifies a separate
+publication PR. This author submission does not edit `catalog/packages`, the
+official index, security decisions, policy or workflows. Candidate-only CI may
+report `publication: false`; that is not package approval. Please keep the
+submission open until the exact version's review is complete.
+
+中文：按 #4 新投 0.0.5，补齐连接器安装承诺和包内说明，旧 #7 的 0.0.4 证据保留。
+用户需独立安装、配置和启动 Runtime；推荐 0.1.8，最低 HTTP／前置审核能力起于 0.1.6，
+实际版本和必要能力须人工核对。本机连接 token 与模型 API Key 不同，模型调用可能收费。
+配置键／权限／执行逻辑不变，停用或卸载连接器不会停止、卸载 Runtime 或删除其数据。
+固定预检和有限作者联调不是独立批准；新组合 GUI、异常和生命周期验收由维护者完成。
+收录事实、非作者批准和另一次索引发布均待完成，不自填 reviewer 或正式索引。