[Desolate-Jix]

Current audit revision — 2026-10-26

Audit target: 65626b3fcc2d1c4e3ec98e185ff562ec21b0fe02.

The backend startup and observer-preserving shutdown repair is in 3413e883; the latest commit addresses two hosted CI failures without changing that production implementation:

• The new Windows startup fixture now explicitly passes win32 to the real cleanup module on every host. Its missing platform argument caused three Linux failures. All assertions remain, including the separate POSIX routing cases; focused local validation is 10 passed, 0 skipped.
• The Windows jobs now pin the same SDK that 8.0.x resolved: 8.0.427. The wildcard's aka.ms redirect targeted a storage account that denied public access with HTTP 409; retry reproduced it. Microsoft's public SDK URL returns 200, and the official installer dry-run confirms that an exact-version request uses it. All three Windows setup steps retain their existing tests and gates.

Production-change validation at 3413e883: 701 Electron tests, 0 skipped; 96 focused Python tests; build, changed Python lint and diff checks passed. Native Windows tests covered failed shutdown and the full 15-second deadline with a live descendant and surviving outside observer. Four real built-app profiles (ordinary, zero-filled index, missing index with receipts, parent junction) each passed 15 application checks plus evidence preservation/verification.

Repair details, CI diagnosis, reproducible commands and limits. Hosted CI for this exact head completed on 2026-10-26 (Pacific/Auckland): 18/18 checks passed, including Windows Electron build, Linux core, source-archive qualification, packaged catalog publication/recovery, all Python shards and the final cpu-model-less gate. CI checks. No assertions, test gates, timeouts or skips were relaxed. Independent re-review remains pending.

What and why

Plugin updates need an explicit delivery boundary and a retained recovery version. Add opt-in daily catalog checks that notify only, exact-version selection, and native installation confirmation. Runtime and extension releases remain independent; this adds no wheel self-updater.

On Windows, catalog packages and native local-wheel imports (including first installation) are queued for the next app start. Installation holds the backend launch boundary, rechecks official catalog/security/digest facts where applicable, and requires native confirmation. Existing backend owners must have physical exit proof: root PID creation identity and an out-of-Job observer confirming all owned descendants exited, or a positively observed later Windows boot. Verified history is compacted without deleting receipts; live or unverified process ownership refuses installation. Provider/Work outcome reconciliation remains independent.

On Linux/macOS, the existing immediate, version-isolated installation path is preserved. Backend contributions apply after a backend restart; standalone themes apply immediately. These platforms do not register Windows cleanup owners or create pending-update rollback journals. Daily notification-only catalog checks remain available.

Windows updates retain the previous wheel/environment, configuration, and OS-encrypted secrets in a durable journal. Startup health is tied to the exact target revision and complete contribution set; keeping the update is a separate user action. Within the same desktop session, users can complete required configuration and retry validation. Configuration writes invalidate earlier health evidence before settings advance and record the resulting encrypted target revision. Persistence failures, failed backend starts, and unconfirmed updates carried across app launches still require explicit recovery/rollback. Rollback preserves explicit disable intent and never replays Work. Restoring retained records uses a separate stopped-root recovery boundary and does not require historical child-exit proof or delete either installation.

The update UI uses the existing settings cards, switch, buttons, typography, and theme tokens. Automatic and manual checks occupy separate rows; scheduled installation and recovery are grouped in a status card, with package digests and detailed explanations available in disclosures.

Change class and compatibility

• Host-owned workflow/persisted-state proposal for maintainer review; no mainline release or stable public-contract commitment is claimed.
• Automatic checking defaults off and never installs packages.
• Scheduled installation, retained-version recovery, and descendant cleanup proof are currently Windows-only. Linux/macOS retain their prior installation and shutdown contracts; this does not claim POSIX descendant containment.
• Missing/unknown Windows process evidence blocks installation and file deletion until physical exit or a later boot is proven. Corrupt, missing-index or interrupted-index evidence is preserved and remains fenced rather than being reset to fresh. Forced termination alone is not proof. Cleanup setup failures warn and allow core backend startup, with maintenance fenced. Legacy installations without the ledger still require an operator migration check; a closed port does not prove old orphan processes stopped.
• Record recovery remains available after a hard crash even when file cleanup is blocked. If observation evidence was lost, a later verified Windows boot can release old owners. Legacy indexes without a boot binding first acquire one conservatively. Arbitrary third-party data-migration rollback and physical-power-loss durability are not guaranteed.
• The three maintainer follow-up commits add no dependencies or version changes. The broader PR already includes the setuptools 84.2.1 updates and filelock constraint/lock refresh.

Crash-recovery follow-up — 2026-10-26

Recovery implementation revision: 15bc3995d2409d3db2aa18b98ae799a752c9c393.

External review identified two additional P1 failures at 019c79b: an unconfirmed update could deadlock backend startup against the rollback cleanup gate, and unresolved cleanup owners/unknown state had no recovery path. The composition probe reproduced both the abnormal-exit failure and the successful normal-exit control. The earlier green CI did not cover this combination.

• Record-only recovery: rollback holds the stopped-root/startup mutex and rechecks the retained wheel and native confirmation, but does not require historical child-exit proof, apply frontend changes, or collect either installation. A live backend still blocks recovery, and recovery scope cannot authorize a new installation.
• Physical cleanup: an outside Windows Job observer can certify root/descendant exit even without graceful approval. A durable marker written only after root assignment prevents an empty, never-assigned Job from becoming evidence. Live descendants, invalid identities and missing containment evidence remain blocked. Work outcomes and replay authority stay in their existing ledger; cleanup retirement does not mark them successful.
• Lost evidence: a positively observed later Windows BootId can retire old process owners and unknown state while retaining archived evidence. Same-boot, unavailable/backward identity and a later clean app launch do not silently clear them. Older PR indexes without BootId first acquire a conservative binding; missing old exit evidence may require restarting Windows after opening the updated app.
• Shutdown: Windows query/session-end events request best-effort cleanup without vetoing shutdown or leaving a cancelled query in quit intent. Linux/macOS regain their original 2.5-second graceful-stop deadline.

Local validation on this commit:

• Full Electron tests: 685 passed, 0 skipped.
• Build: configuration/SDK/Pi/TypeScript/Vite checks passed; the existing large-chunk warning remains.
• Focused Python cleanup/lifecycle/smoke-probe tests: 96 passed.
• Offline real-wheel author journey: 12 checks passed.
• Real Windows application: 14 normal extension checks + 23 failure/recovery checks, including 13 app restarts, forced termination of the owned pending-update backend, successful rollback/old-runtime startup, and confirmed final Electron/backend exit.
• Changed Python lint, JavaScript syntax and git diff --check passed.

Implementation, reproduction, test commands and limits.

Limits: no physical Windows reboot/logoff or new native Linux/macOS install roundtrip was performed. Boot transitions were injected at the OS-read boundary; the real Windows BootId reader and native process/Job checks ran. Catalog transport and native confirmation use isolated test fixtures. The full packaged-executable publication journey was not rerun locally for this follow-up. No dependency, version, CI workflow, skip or audit exemption was changed.

CI for the current PR head must be evaluated separately from the historical results below. Independent external re-review is pending; this follow-up does not resolve the review threads or approve/merge the PR.

Earlier review recheck — 2026-10-25

Historical head: 019c79bfdab664cea3a8555a42877dc362ed8abe. These results predate the two additional P1 findings described above. All 18 hosted checks passed, including the dependency audit, all Python shards, real store/author journeys, model-less failure recovery, packaged startup and packaged catalog publication/recovery. Windows qualification.

1. Cold recovery: startup validates both retained records with a fresh trusted helper before strict reads. Independent actual-Python-helper cases passed cold scheduled installation, fresh-process rollback and rejection of invalid previous/target records. This follow-up also distinguishes unavailable validation from invalid data; both still fail closed and preserve settings, backup, journal and both installations.
2. Platforms: normal Linux/macOS installs retain the previous immediate version-isolated route without Windows cleanup owners/journals. Windows surviving-descendant and unknown-proof controls remain strict. Platform/cleanup regressions passed; no new native POSIX installation journey is claimed.
3. Required configuration: actual-helper cases passed required secret/nonsecret repair, persisted encrypted target/revision binding, stale-health rejection, rollback preserving disable intent, and persistence/fresh-owner negative controls. These supplemental checks simulate safeStorage and Host health receipts.

The failed smoke assertion was corrected to test the actual invariant: an exact unhealthy pending target is unconfirmable, a real confirm-update request is rejected, recovery remains unchanged, and explicit rollback succeeds. It no longer equates every same-session unhealthy projection with forced rollback. Nine new probe regressions cover false-success/lost-recovery counterexamples.

On this source: full Node 673 passed / 0 skipped, affected Python smoke/probe 32 passed, application build passed. Isolated actual Windows application qualification passed 14 normal extension checks + 21 failure/recovery checks, including 11 app restarts and confirmed Electron/backend exit. Other targeted groups overlap and are not summed.

No CI workflow, skip, audit exemption, dependency or version was changed by this follow-up. Previous UI captures below remain tied to their original revision. This verification does not replace maintainer review or resolve the review threads on the reviewer's behalf.

Earlier UI follow-up verification

Head: d509fcc0d0ec0ad06baafa4ed2692fe9a2ac234f.

• Full cd electron; npm test: 673 passed, 0 skipped.
• npm run build: config/catalog ownership, SDK digest, Pi type-checking, TypeScript, and Vite passed. The existing Vite large-chunk warning remains.
• Focused Python cleanup/lifecycle/smoke-launcher tests: 86 passed during the lifecycle repair; subsequent changes are UI presentation and test selectors.
• Existing Electron settings interaction smoke, launched through the CI Node wrapper: 12 checks passed.
• Isolated Windows model-less app smoke: startup, authentication, plugin/settings navigation, theme handling, and clean shutdown passed.
• Real Electron screenshots checked in Chinese, light/dark themes, default width, and narrow recovery state; no error banners or horizontal overflow in the final capture.
• git diff --check, updated store-smoke JavaScript syntax, and changed Python probe syntax checks passed.

Lifecycle repair evidence · UI evidence and reproducible real-app captures.

Linux/macOS routing is covered with explicit platform fixtures on Windows, not native Linux/macOS runs. The UI status screenshots use synthetic catalog replies inside the isolated real application; they do not certify completed plugin installations. The full packaged/store-install qualification was not rerun for these three follow-up commits. Current GitHub CI is tracked in the PR Checks tab; independent external audit is pending.

[Lucas1479]

Thanks for putting this together and for the detailed lifecycle tests. The opt-in update notifications, exact-version selection, native confirmation, and retained recovery state are useful additions. I support taking these features forward.

Requesting changes for three integration issues in a277d628948a58d1697bb775d84cd11522d9437c:

1. P1: Cold validation of the rollback journal can block both backend startup and recovery after a successful update.
2. P1: The Windows-only cleanup proof is required by installation paths on every platform, leaving Linux/macOS unable to complete subsequent installations.
3. P2: An enabled update that introduces required configuration cannot become healthy, while the pending-update guard also prevents supplying that configuration.

Each inline comment includes a reproduction scenario, the implementation cause, and the missing regression tests.

Validation on the reviewed snapshot: the five focused Electron test files passed 147 tests, and test_backend_cleanup.py, test_chat_ingress_lifecycle.py, and test_vts_worker_lifecycle.py passed 63 tests. Three additional synthetic probes reproduced the cold-validator and required-configuration issues. The cross-platform finding is based on the implementation paths; I did not run Linux/macOS or packaged Electron end-to-end tests.

Please add coverage for fresh helper/store/installer instances and the complete scheduled-install → startup → keep/rollback journey. Thanks again for the work on this feature.

[Lucas1479]

Thanks for the cold-start recovery fix and the additional restart coverage. We will take over the two remaining review items from the current head d17af14f853036cbce9c95bc025d0dd67c66a743 in a separate worktree:

• Repair the required-configuration update flow so users can complete setup, validate the resulting revision, and keep or roll back the update without losing the retained configuration or encrypted credentials.
• Scope the new scheduled-install/cleanup-proof workflow to Windows for now, preserving the existing Linux/macOS installation path. This follow-up will not treat a closed port as proof of descendant shutdown or add an unqualified cross-platform containment implementation.

We will add regression tests for both boundaries, run the relevant build/lifecycle checks, and review the resulting changes before proposing integration. This is to coordinate ownership and avoid overlapping edits to these two areas. Thank you for the feature work and the fixes already submitted.

[Lucas1479]

Thanks again for the feature work and the earlier cold-start fix. The three maintainer follow-up commits have now been pushed directly to this PR branch as a fast-forward from d17af14f:

• 31d3aa3f — Pending updates can complete required configuration and validate the new revision. Earlier health evidence is invalidated before persistence; write failures retain recovery state, and rollback preserves the original configuration/encrypted credentials and explicit disable intent.
• 895a7ce8 — Linux/macOS keep their existing immediate, version-isolated install path. Windows keeps scheduled installation and cleanup-proof enforcement. Platform routing, native/catalog IPC, version retention, and UI labels have regression coverage.
• d509fcc0 — The new update area now follows the existing settings UI: separate check rows, grouped scheduled/recovery state, concise actions, and expandable details. Existing theme and layout conventions are retained.

Validation: 673 Electron tests passed with no skips; build/config/SDK/Pi/TypeScript checks passed; 86 focused Python tests passed for the lifecycle fixes; the existing Electron settings smoke passed 12 interaction checks; and the isolated real-app model-less smoke and final light/dark/narrow UI captures passed. The initial GUI test launch's broken-pipe failure was treated as a test-launch failure and rerun using the CI wrapper; no production exception suppression was added.

Limits for audit: Linux/macOS behavior was exercised through explicit platform fixtures on Windows, not native OS runs. Scheduled/ready/recovery screenshots use synthetic catalog state in the real isolated app. The full packaged/store-install journey was not requalified for these three commits.

Evidence: lifecycle repair, real-app UI captures.

The external audit should target d509fcc0d0ec0ad06baafa4ed2692fe9a2ac234f. The PR description has been refreshed to match the Windows-only scheduled-update scope and current validation. I am checking the CI runs for this head; the independent audit remains to be done.

[Lucas1479]

Thanks for the feature work and for the external review that caught the recovery deadlock. I reproduced the abnormal-exit failure at 019c79b; my earlier re-review missed the composition between rollback and the cleanup gate.

The maintainer fix 15bc3995 is now pushed to this PR branch.

Fixes

1. An unconfirmed update can restore its retained version after an unclean exit. Recovery holds the stopped-root mutex and still verifies the wheel/native confirmation, but does not require historical child-exit proof or collect either installation. It cannot authorize installation; a live backend still blocks it.
2. Process ownership has a recovery path: the Job observer certifies actual root/descendant exit independently of graceful teardown/Work outcomes, with a post-assignment containment marker. If observation evidence is lost, a positively observed later Windows BootId can retire old owners/unknown state without changing Work records. Live descendants and unavailable/invalid evidence remain blocked.
3. Windows query/session-end cleanup is best effort, with cancelled-query handling; Linux/macOS retain the original 2.5-second graceful-stop deadline.

Validation

• Electron: 685 passed, 0 skipped; application build passed.
• Focused Python cleanup/lifecycle/probe suite: 96 passed.
• Offline real-wheel author journey: 12 checks passed.
• Real Windows application: 14 normal + 23 failure/recovery checks, 13 app restarts. The pending-update backend was forcibly terminated through its owned ChildProcess handle, rollback restored the previous runtime, and final Electron/backend exit was confirmed.
• Lint, script syntax and diff checks passed. The initial added crash-injection attempt failed in the test instrument because the inspector could not access a private module variable; the corrected isolated fixture captures the owned spawn handle. No production test API or exception suppression was added.

Audit limits

No physical Windows reboot/logoff or new native Linux/macOS roundtrip was performed. Boot transitions are injected at the OS-read boundary; real BootId reads and native Windows Job/process tests ran. The full packaged-executable publication journey was not rerun locally. Legacy PR state without a boot binding may need a Windows restart after first opening the updated app when old exit evidence is missing.

Evidence, commands and implementation boundaries. No dependencies, versions, workflows, skips or audit exemptions changed.

Please target 15bc3995d2409d3db2aa18b98ae799a752c9c393 for the next independent audit. The PR description now reflects these semantics. CI for this new head is being checked separately; the previous head's 18 green checks are not validation of this commit. Review threads and approval remain for re-review.

[Lucas1479]

CI follow-up pushed: c7a0c1a0.

The failed Electron Windows job reported 684 passed / 1 failed. The new native BootId assertion required an integer even though production permits an unavailable result and must keep ownership fenced. The failed read took approximately the 10-second query budget; the log does not distinguish timeout from missing registry evidence.

The reader now uses a direct bounded reg.exe query instead of starting PowerShell. Tests explicitly reject missing/time-out, empty, wrong-type, out-of-range and duplicate results, verify unavailable results are not cached and do not clear ownership, and check valid DWORD caching. The native test exercises the supported available/unavailable contract; it is not skipped on Windows.

Local validation: 686 tests passed, 0 skipped, application build and git diff --check passed. No workflow or timeout increase, fallback boot estimate, or cleanup bypass was added.

The PR description now points the next audit at c7a0c1a0a166e473629f0159fb19d66e75216ff4. New CI is running; the previous head's green checks are not being reused as evidence. Updated validation notes.

[Lucas1479]

Thanks for the additional audit and concrete probes. Both the new backend-startup regression and the forced-stop observer issue are addressed in 3413e88342f8ab520f0b83a4cc87a85744ff8610, now pushed to this PR.

Reproduction and repair

1. A zero-filled cleanup index, receipts without their index, a failed registration/root probe, or failed marking of an already authenticated backend used to abort startup. Cleanup setup is now isolated from core startup: warn, omit cleanup credentials, retain the session maintenance fence, and try to persist unknown ownership. Invalid evidence is preserved. Interrupted write-through transactions also prevent a later process from trusting the old empty index. Foreign-backend and normal authentication/readiness checks still reject as before.
2. A junction above user-data is now accepted consistently by desktop and Python. Links at the data root or inside it, including receipt paths, remain rejected.
3. Electron's escalation now terminates the registered tracking Job after checking its bound owner, process creation identity and Job membership. The outside observer survives to prove root/descendant exit. If the Job cannot be used, the existing owned-tree taskkill fallback remains and may lose the observer. Neither successful termination call is a cleanup receipt.

Validation on this revision

• Full Electron: 701 passed, 0 skipped.
• Affected Python cleanup/lifecycle/smoke tests: 96 passed.
• Build (config/SDK/Pi/TypeScript/Vite), changed Python lint, and diff checks passed.
• Native Windows tests exercised the actual forced-stop function after a failed shutdown request and after the full 15-second graceful timeout, with a live child and an unrelated process. Wrong creation evidence was denied; the correct Job stopped, the unrelated process survived, and the observer supplied an exited receipt that the real ledger verifier accepted.
• Real built Electron + normal authenticated backend: four isolated profiles (ordinary, zero-filled index, missing index with receipts, parent junction), each passing the 15 standard application checks + 1 evidence check. No chat/model/provider turn was sent.

Checked-in evidence and reproducible startup probe.

CI update: the Windows Electron build failed twice (including a retry) at actions/setup-dotnet before dependencies or project tests ran. The Microsoft .NET Runtime/SDK download endpoints returned HTTP 409. Retry job. Hosted validation is incomplete; other checks are still running. No real Windows reboot/logoff/fast-startup/hibernate qualification or native POSIX application rerun is claimed. The remaining nonblocking observations (including cancelled shutdown queries) are recorded in the evidence limits. I have not resolved review threads, changed the review decision or merged; this is ready for independent re-review once CI finishes.

[Lucas1479]

CI follow-up pushed as 65626b3fcc2d1c4e3ec98e185ff562ec21b0fe02.

The Linux failure was my fixture wiring error: the extracted desktop startup simulated Windows, but the real cleanup module defaulted to the Linux runner's platform and correctly returned its POSIX no-op. The fixture now passes win32 explicitly. The same assertions and the separate POSIX routing tests remain; the focused startup suite is 10/10 passing, 0 skipped locally.

The Windows Electron and source-archive failures were in .NET setup before project tests. The wildcard resolved SDK 8.0.427 but followed an aka.ms redirect to a blob account returning HTTP 409 (public access disabled). I verified the same SDK in Microsoft release metadata and its working public download URL (HTTP 200), then ran the official installer in exact-version dry-run mode. All three Windows setup steps now pin 8.0.427, which uses that URL. This retains the intended SDK and all existing test/build/package gates.

Production startup/shutdown code is unchanged by this follow-up. Fresh CI is running; the earlier 701 Electron / 96 Python / four real-app profile results remain evidence for the production repair at 3413e883. Updated evidence.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota.

An organization owner can choose the repository organization as the billing source for reviews requested by members with a paid Copilot license. Learn about Copilot code review billing.

[Lucas1479]

The three findings in my original review at a277d628 are resolved at 65626b3fcc2d1c4e3ec98e185ff562ec21b0fe02. I have rechecked the final code and corresponding regression coverage, replied to each original discussion, and resolved all three threads. Cold recovery validation, Windows-only scheduled maintenance with preserved POSIX behavior, and required-configuration repair now address the original concerns. All 18 CI checks passed for this exact head.

Updating my review to approve, superseding the earlier request for changes. Thank you for the fixes and regression tests.

原 a277d628 审查的三项问题已在 65626b3f 解决。我已核对最终代码及对应回归覆盖，逐条回复并解决讨论。冷启动恢复校验、仅 Windows 启用的定时维护及保留的 POSIX 行为、必填配置修复均已处理原问题；当前提交 CI 18/18 通过。现更新为批准，替代旧的请求变更结论。感谢修复和回归测试。