| 1 | # Codewhale v0.9.1 completion ledger |
| 2 | |
| 3 | > **Pre-publication packet.** This ledger authorizes no tag, GitHub Release, |
| 4 | > package publication, deployment, push, live-provider request, or customer |
| 5 | > communication. It binds the frozen runtime source and the additive evidence |
| 6 | > packet used to finish the local candidate. |
| 7 | |
| 8 | ## Candidate identity |
| 9 | |
| 10 | | Boundary | Exact state | |
| 11 | | --- | --- | |
| 12 | | Runtime source (`S`) | `4d197626d72b4bd27e1abf4eed92e86e914414a8` | |
| 13 | | Source branch | `codex/v091-final-integration-20260721` | |
| 14 | | Protected base at freeze | `origin/main` = `a7c00a1a8e48021daf2a9c78cfc1dbda8269e074` | |
| 15 | | Draft integration PR | #4675; its current remote head is an ancestor of `S`, so the approved update is a normal fast-forward | |
| 16 | | Evidence packet (`E`) | Additive screenshot, browser-QA, and receipt commits on top of `S`; the final landing receipt records their exact merged SHA | |
| 17 | | Public release state | No GitHub Release for v0.9.1; the pre-existing lightweight `v0.9.1` tag points to `d9fdee8aec469915cfdc07ab40aba5c40e9e9de4`, not this candidate | |
| 18 | |
| 19 | `S` is the exact source used for runtime, real-PTY, and canonical product-image |
| 20 | acceptance. It supersedes the earlier `fa46105a7183ce961f503996a7e746f763ffb29c` |
| 21 | freeze after #4684 exposed a real Full Access/global-skill boundary defect. |
| 22 | `E` changes only tracked evidence, generated public facts, and release records. |
| 23 | A tracked image cannot contain the hash of the commit that adds that image, so |
| 24 | the image and its receipt identify `S`; the final #4650 landing receipt |
| 25 | separately identifies `E` and the exact merged-main SHA used to rebuild and |
| 26 | install all three binaries. |
| 27 | |
| 28 | ## Finish/fix local evidence packet (2026-07-23) |
| 29 | |
| 30 | This additive packet records the v0.9.1 finish/fix work performed after the |
| 31 | original `S` freeze. It names the exact runtime source and its local evidence; |
| 32 | it does not substitute a local branch for protected-main or publication proof. |
| 33 | |
| 34 | | Boundary | Exact state | |
| 35 | | --- | --- | |
| 36 | | Finish/fix runtime source (`S2`) | `f6d606aab012f6dced2862ca9d135024d78e4e09` | |
| 37 | | Source branch | `agent/091-finish-fix-20260722` | |
| 38 | | Protected base at finish | `origin/main` = `88a158eaa2d6f1fa879bba1f1848a315b4dc6925` | |
| 39 | | Included dependency intake | `0dfe9170a10e081fe48b23239f22d33260f4fa24` (the verified #4714 lockfile intake) | |
| 40 | | Security hardening | `8c052e60f3eeae388d6690a0d791d713263b9fee`: runtime tokens leave the bridge through its environment rather than argv; explicit `CODEWHALE_HOME` does not import ambient legacy secrets; unsafe relative secret persistence is refused | |
| 41 | | TUI finish/fix | `634d9f692c68b99b3e0ed2d7125548d7083661fb`: interactive-TTY preflight, provider-neutral legacy fallback presentation, calmer evidence/reasoning rows, and exact multiline-paste regression coverage (#4716–#4719) | |
| 42 | | Dependency remediation | `f6d606aab012f6dced2862ca9d135024d78e4e09`: root and web lock graphs pin `sharp` `0.35.3`, eliminating the local libvips advisory path | |
| 43 | | Local runtime proof | Clean release build embeds `0.9.1 (f6d606aab012)` in `codewhale`, `codew`, and `codewhale-tui`; scripted dogfood receipt: `backups/dogfood-installs/20260723T040240Z-f6d606aab012.txt` | |
| 44 | | Local test and smoke proof | Locked full workspace tests; TUI real-PTY and release-runtime suites; app-server and npm-wrapper smokes; web clean-install tests/lint/facts/production build; VS Code compile; Feishu checks/tests | |
| 45 | | Security proof | `cargo audit`: zero vulnerabilities with one documented allowed unmaintained `ttf-parser` warning; root, web, VS Code, and Feishu lockfile audits: zero vulnerabilities | |
| 46 | | Deep-scan boundary | The #4713 deep-scan preflight was refreshed against the actual native-v2 capacity: four total threads means three usable workers, while a completed deep-discovery round requires six. It is therefore **blocked**, not replaced by a smaller batch or claimed complete. The local alert/audit reconciliation is useful no-publish evidence only; a session with at least six usable worker slots must still run the canonical deep workflow before #4713 can close. | |
| 47 | | Visual proof | Foreground Cursor terminal (a real TTY) reaches onboarding and the composer; an unsent three-line path/SHA draft stays intact. Direct Terminal.app capture remains the human dogfood check because Computer Use cannot operate that app in this environment. | |
| 48 | | Remote/public state | No branch landing, tag move, release, package publication, artifact upload, or deploy. Code and secret scanning are currently zero open; Dependabot still shows 11 alerts on remote `main` until the normally landed candidate is rescanned. | |
| 49 | |
| 50 | The #4713, #4716, #4719, #4720, and #4721 issue comments record the same |
| 51 | source boundary and explicitly remain non-closure receipts until normal |
| 52 | landing. |
| 53 | |
| 54 | ## UI coherence follow-up local evidence (2026-07-23) |
| 55 | |
| 56 | This second additive packet records the small, existing-shell-contract fixes |
| 57 | accepted from the v0.9.1 UI coherence audit. It leaves the audit's broader |
| 58 | motion, classic-footer, setup, and configuration redesign for ordinary |
| 59 | post-release main work; it does not create a public issue or change the |
| 60 | publication boundary. |
| 61 | |
| 62 | | Boundary | Exact state | |
| 63 | | --- | --- | |
| 64 | | UI coherence runtime source (`S3`) | `d242dd85e8eb9e5210fceb362f4030f2142eeb87` | |
| 65 | | Included UI contract | Tool-details hints derive from the routed platform-aware Alt/Option+V chord; a new draft outranks stale completed state; a running tool owns its elapsed clock; `/cost` and the legacy DeepSeek base-URL route label are truthful and provider-neutral | |
| 66 | | Localization | The existing `CmdCostReport` value was refreshed in every complete pack (en, es-419, ja, ko, pt-BR, vi, zh-Hans); zh-Hant has no such key because it is intentionally partial | |
| 67 | | Source proof | Locked TUI binary suite (`8,071` passed, `4` ignored); real-PTY suite (`25` passed, `1` ignored); release-runtime suite (`7` passed, `1` ignored); strict workspace clippy; and the locked workspace suite all passed from `S3` | |
| 68 | | Exact runtime proof | One uninterrupted locked release build completed in `7m59s`; `codewhale`, `codew`, and `codewhale-tui` each report `0.9.1 (d242dd85e8eb)` | |
| 69 | | Dogfood proof | Atomic local install receipt: `backups/dogfood-installs/20260723T044813Z-d242dd85e8eb.txt`; the receipt records all three binary hashes and fresh-shell paths | |
| 70 | | Provider-free smoke | Installed app-server stdio smoke: `6` passed, `0` failed; npm-wrapper smoke assembled local assets and its packaged `codew --version` reports `d242dd85e8eb` | |
| 71 | | TTY acceptance | Foreground Cursor terminal reaches the fresh composer; an unsent three-line path/SHA draft is visually intact, then the session exits through the documented two-tap Ctrl+C confirmation. A non-TTY launch exits `1` with the explicit interactive-terminal guidance | |
| 72 | | Remaining human device proof | Computer Use is safety-blocked from Terminal.app, so Hunter must still perform the real Terminal.app foreground launch before public release. This is not a source regression and does not authorize publication | |
| 73 | | Remote/public state | Still no branch landing, tag move, release, package publication, artifact upload, or deploy. Remote scanners and hosted CI remain evidence for the normally landed commit, not this local packet | |
| 74 | |
| 75 | ## Manual high-impact security audit (2026-07-23) |
| 76 | |
| 77 | This is a bounded, parent-performed review of the security-critical candidate |
| 78 | surfaces. It is useful local evidence, but it is **not** the six-worker Codex |
| 79 | Security deep-scan required by #4713 and does not close that gate. |
| 80 | |
| 81 | | Boundary | Evidence | |
| 82 | | --- | --- | |
| 83 | | Reviewed runtime source | `d242dd85e8eb9e5210fceb362f4030f2142eeb87` (no runtime source changes occur in the additive documentation commits that follow it) | |
| 84 | | Threat model | The repository policy's prompt/model-response RCE, sandbox escape, credential leakage, path escape, SSRF, and unauthorized-MCP boundaries | |
| 85 | | Source review | Runtime/app-server authentication and token handoff; tool authority, path/symlink, sandbox, and exec-policy enforcement; MCP stdio/SSE/streamable-HTTP launch and redaction; web fetch/open/click DNS pinning and redirect validation; workflow-JS host isolation; and bridge allowlists, pairing, approval, and private-state handling | |
| 86 | | Focused Rust verification | `codewhale-tools` 27 passed; `codewhale-execpolicy` 80 passed plus 1 doctest; `codewhale-mcp` 40 passed; `codewhale-workflow-js` 56 passed; `codewhale-app-server` 71 passed | |
| 87 | | Bridge verification | `bridge-core` 11 passed; WeCom 16 passed; Weixin 3 passed; Telegram 39 passed; Feishu 19 passed | |
| 88 | | Dependency and secret checks | `cargo audit --ignore RUSTSEC-2026-0192` found no active Rust advisory among 751 dependencies; the allowed warning is the documented unmaintained `ttf-parser` path. Fresh package-lock audits for root, web, VS Code, WeCom, Telegram, and Feishu were zero-vulnerability. Redacted Gitleaks source scans of `crates/`, `web/`, VS Code, `scripts/`, and bridge implementation sources found no committed secret. The initial web scan's ten matches were confirmed to be ignored local `.next` build artifacts, then excluded from the source scan. | |
| 89 | | Result | No reportable new candidate vulnerability was found within this manual coverage. This is an evidence statement, not a claim of exhaustive security assurance or #4713 completion. | |
| 90 | |
| 91 | ## Public-web boundary cutover (2026-07-23) |
| 92 | |
| 93 | The reviewed FR016 public-web patch was revalidated against this candidate and |
| 94 | integrated as `a2c08393b716f7333708c85f2ff24a4f2889f5bb`. Its earlier |
| 95 | triage/PR namespace correction was already present through the later |
| 96 | content-watch identity work; the cutover preserves that work's `linkcheck` and |
| 97 | `semantic-drift` draft types while adding the remaining bounds and validation. |
| 98 | |
| 99 | | Boundary | Evidence | |
| 100 | | --- | --- | |
| 101 | | Draft authority | Canonical type/key parsing plus schema and key/object-identity validation gate reads, listings, and deletes; authenticated admin discard rejects every non-draft namespace before KV access | |
| 102 | | Credential boundary | The public GitHub feed is static with ten-minute revalidation and calls GitHub anonymously; it cannot forward or spend the server-held token | |
| 103 | | Input boundary | Maintainer login accepts only bounded URL-encoded forms, rejects bad media types and declared/streamed oversize bodies before token comparison, and caps decoded token length | |
| 104 | | Local verification | Focused boundary tests: 27 passed. Full web test suite: 136 passed. Type check, lint, facts/docs checks, and the 40-page production build all passed; the build reports `/api/github/feed` as static with ten-minute revalidation and admin routes as dynamic | |
| 105 | | Public state | No deployment, credential change, Cloudflare action, push, tag, package publication, or release action occurred | |
| 106 | |
| 107 | ## Completion crosswalk |
| 108 | |
| 109 | | Contract | Frozen-source evidence | |
| 110 | | --- | --- | |
| 111 | | Canonical runtime and empty Work | PR #4675 ancestry; canonical action-tool and hidden replay-alias gates; fresh sessions render no empty Work heading or reserved rows | |
| 112 | | Transcript, motion, and control grammar | `79d5d5397aba83a901ae47e672d8fcd269cb04ae`, `2b2cfe65afd6879da3dd0782d98c5d4d8c04b34e`, `637debe69324fe9989e41cecfe8304d8dbc4d8c5`, `09d171d15331b1bbe1aa71003c4608aa6489bb9f`, PTY stabilizers `166679ed2546b84635dbf0895881286625da27b2`, `88eeed286162dbe8651bb0afd68e8cd2fb7b8e4d`, `57fbf264a4d1bbe3a6ee12cac7c9ae15189c7d1d`, and the exact source freeze `4d197626d72b4bd27e1abf4eed92e86e914414a8`; real PTYs cover 40x12 through 140x40, exact 100x30 transcript lifecycle, the icy Plan → blue Act → violet Operate and amber Ask → gold Auto-Review → coral Full Access ramps, dark/light, Full/Reduced/Still motion, and ASCII safety (#4676, #4677) | |
| 113 | | Structured Agent activity/details | `307407c968f48bedd1488df8d0305e0c086f1809` and `16eeda430ca6cbeb9b03e8e5235278025f6aed75`; Paulo Aboim Pinto's direction remains credited from #2694/#2889, renderer substring inference is gone, and focused final-source receipts cover compact rows, fallback, redaction, hover, and the Agent Details route | |
| 114 | | Adaptive evidence | Merge `00c9156367c2934cbc3de33b5ee7ed3d2f09da2e`; session-owned exact bytes, bounded receipts, headless and real-PTY acceptance (#4619) | |
| 115 | | One Work projection and File receipts | Merge `f100e70c9da8436eaa7f6304af62a60f4aa3ffa0`; full/summary/off success-only diffs and real-PTY coverage (#4636) | |
| 116 | | Durable coordination | Merge `c39ec9a418f3219d87510d2297b68cbb860f6c02` plus surfaced/localized receipt follow-ups; replay-safe decisions, claims, contention, projection, and neutral fan-in (#4647) | |
| 117 | | Contributor intake | Fred's #4673 is in protected main; all six exact Sam #4679 commits and all three exact Nightt #4680 commits are ancestors; Paulo's exact `75e08e5c67f555b5cda8511742c824bb74bb6c1d` is preserved; TelecomJS and OpenCode Go harvests retain machine-readable human co-author trailers; credited issue follow-ups `97f1c88271b0c32e0031914ae7f5d976aaf1467b`, `b60b3fecdb3535a13180b74955f55b19cb5c9ab7`, `fa46105a7183ce961f503996a7e746f763ffb29c`, and Wenhao Hu's #4684 fix `4d197626d72b4bd27e1abf4eed92e86e914414a8` are included without overstating #4683's broader intermittent symptom | |
| 118 | | Full Access and global skills | `4d197626d72b4bd27e1abf4eed92e86e914414a8`; saved and cycled Full Access now activates workspace trust as documented, global skills load through the bounded `load_skill` host path, and `danger-full-access` remains an OS-sandbox setting rather than an implicit unbounded file-authority switch (#4684) | |
| 119 | | Public surfaces | `docs/public-surface-facts.json` is the source-backed matrix; tool count is 66 and provider count is 35. Final canonical screenshot, EN/ZH browser captures, README-width review, and deployed-drift receipt are recorded in the additive evidence packet (#4670, #4671, #4672) | |
| 120 | |
| 121 | Remote milestone issues stay open until `E` lands on protected `main`, hosted |
| 122 | checks are green, the exact main SHA is installed locally, and issue comments |
| 123 | receive those receipts. A local implementation is not used as evidence that a |
| 124 | remote issue has already landed. |
| 125 | |
| 126 | ## Contributor history and DCO decision |
| 127 | |
| 128 | No contributor commit is rewritten or flattened. The following exact commits |
| 129 | in `origin/main..S` lack a `Signed-off-by` trailer: |
| 130 | |
| 131 | ```text |
| 132 | 75e08e5c67f555b5cda8511742c824bb74bb6c1d |
| 133 | c9010ec4e18bf7a2b9d38ef46679301e53a819c9 |
| 134 | cd24aacb3a60fd546ef98c5e93c7749f1eb48240 |
| 135 | 677ef4d4ffa375928bbd29aa340eecd7b17204af |
| 136 | 5c3eb8245512cf790a933484453d3e300eb4c7af |
| 137 | 5087269606fc8847487b0a8b51ef6adffa8eb2ca |
| 138 | e37df06caeb3064b2bb9263c1c98a903738f3a0a |
| 139 | 74862148a5a39b07c84952a0b28acf0f6f056dd3 |
| 140 | 54c8916d3c0a55dbf992191ba7e21b6e7ff75d6e |
| 141 | f8e79479a9e520e0796452aff7ec72b10bf29842 |
| 142 | bf45d1273577341a4ba992688816278249b1c633 |
| 143 | f06333bcaef4797f49cc0df16e1ecf10e8c826f2 |
| 144 | 1a1e958f68ffc9e6232c2873bcf509ef74a839cf |
| 145 | aa0b5f89e437736dc5d3326d8bca1726eea12056 |
| 146 | b489acca1b728625164fce9fa0f88a7752e1e028 |
| 147 | e3a4f96768be178c6439594875ea9d540a9930c7 |
| 148 | e2208815e51cdc42830cec8c78d4db1fff00d490 |
| 149 | c7e87533aaf43f010bfe6c316500c47b8f6c95a8 |
| 150 | c89094226cf18b79375f2bacc9a6536c78e30f26 |
| 151 | ee5f7298cc701bae0a0bf2f71b4a884a6ada4a8c |
| 152 | e06a4fd7271b88db346cec32095e94c35b6bea49 |
| 153 | 31dac05209e8636d6f2f7e8ff70507886bff45b7 |
| 154 | ``` |
| 155 | |
| 156 | The repository DCO workflow is explicitly advisory and exits successfully |
| 157 | after reporting this list. Rewriting would destroy exact PR ancestry and the |
| 158 | machine-readable credit exceptions for the public-surface and Paulo evidence |
| 159 | commits. The release decision is therefore to preserve history, report the |
| 160 | advisory exception exactly, require sign-off on every additive follow-up, and |
| 161 | keep `scripts/check-coauthor-trailers.py` green. This is not a claim that an |
| 162 | unsigned contributor commit carries a signature it does not have. |
| 163 | |
| 164 | ## Exact verification ledger |
| 165 | |
| 166 | The following receipts must be attached to `S` or, for evidence-only drift |
| 167 | checks, to `E` before #4675 is updated: |
| 168 | |
| 169 | - [x] Full locked real-PTY suite, including wide, narrow, dark, light, |
| 170 | reduced-motion, ASCII-safe, semantic motion, Work, Agent Details, evidence, |
| 171 | File mutation, coordination, resize, scroll, and restart states. |
| 172 | - [x] Locked TUI binary tests and `release_runtime_qa`. |
| 173 | - [x] Locked workspace check, strict all-target/all-feature clippy, and full |
| 174 | all-feature workspace tests. |
| 175 | - [x] Version, changelog, lockfile, provider-registry, co-author, workflow, |
| 176 | platform, release-script, and branch-hygiene checks. |
| 177 | - [x] Web facts (`66` tools / `35` providers), docs parity, tests, lint, |
| 178 | TypeScript, production build, deploy-env preflight, deployed-facts comparison, |
| 179 | and OpenNext build without deployment. |
| 180 | - [x] Real 120x32 PTY capture from `S`, rasterized with VHS and optimized to one |
| 181 | byte-identical 1280x720 README/website PNG, plus EN/ZH desktop/mobile and |
| 182 | README-width review artifacts. |
| 183 | - [x] Finish/fix local packets `S2` and `S3`: exact-token and secret-path |
| 184 | hardening, #4716–#4719 TUI regressions, dependency remediation, the narrow |
| 185 | UI coherence contract pass, full locked workspace tests, provider-free |
| 186 | smokes, and an exact-SHA dogfood install. |
| 187 | - [ ] Hosted CI green at the approved exact PR head with zero unresolved review |
| 188 | threads. |
| 189 | - [ ] After normal merge, `scripts/release/install-dogfood.sh` rebuilds and |
| 190 | installs `codewhale`, `codew`, and `codewhale-tui` from one exact protected |
| 191 | `main` SHA; all three versions and digests are recorded in #4650. |
| 192 | |
| 193 | ## Safe Kimi K3 handoff |
| 194 | |
| 195 | These provider-free tests exercise direct Moonshot K3, Kimi Code K3, request |
| 196 | dialect isolation, MFJS-safe schemas, context limits, and read-only diagnostics. |
| 197 | They use sealed loopback/process fixtures and no account or provider request: |
| 198 | |
| 199 | ```bash |
| 200 | CARGO_NET_OFFLINE=true cargo test -p codewhale-tui --bin codewhale-tui \ |
| 201 | --locked create_message_request_json_honors_exact_k3_route_boundaries |
| 202 | CARGO_NET_OFFLINE=true cargo test -p codewhale-tui --bin codewhale-tui \ |
| 203 | --locked create_message_request_sends_mfjs_compatible_apply_patch_schema |
| 204 | CARGO_NET_OFFLINE=true cargo test -p codewhale-tui --bin codewhale-tui \ |
| 205 | --locked direct_moonshot_k3_route_uses_documented_1m_limits_with_provenance |
| 206 | CARGO_NET_OFFLINE=true cargo test -p codewhale-tui \ |
| 207 | --test diagnostic_read_only --locked kimi_code |
| 208 | ``` |
| 209 | |
| 210 | Expected receipt: each command exits zero; each named unit filter runs exactly |
| 211 | one test; the diagnostic filter runs the invalid-alias and valid-context tests; |
| 212 | no provider credential or outbound request is used. |
| 213 | |
| 214 | The human Kimi Code entitlement check is a separate approval boundary. Do not |
| 215 | run it from this packet. After Hunter explicitly approves a live-provider test, |
| 216 | create an isolated config with `provider = "moonshot"`, the exact |
| 217 | `https://api.kimi.com/coding/v1` base URL, `model = "k3"`, and a Kimi Code plan |
| 218 | API key supplied only through `KIMI_API_KEY`; then run the installed binary: |
| 219 | |
| 220 | ```bash |
| 221 | codewhale --config /path/to/isolated-kimi-code.toml \ |
| 222 | --provider moonshot --model k3 exec --reasoning-effort low --json \ |
| 223 | "Reply exactly K3-ENTITLEMENT-OK and do not call tools." |
| 224 | ``` |
| 225 | |
| 226 | Acceptance requires an exit-zero JSON response, the exact phrase, and a route |
| 227 | receipt naming `moonshot` / `k3`. It must not use `k3[1m]`, infer 1M entitlement |
| 228 | from provider-free tests, enable tools, read Kimi CLI credentials, or persist |
| 229 | the key in this repository. |
| 230 | |
| 231 | ## Manual web workflow handoff — do not run |
| 232 | |
| 233 | Push and pull-request events execute only the `lint` job in |
| 234 | `.github/workflows/web.yml`. Deployment additionally requires both a manual |
| 235 | `workflow_dispatch` event and `refs/heads/main`; therefore an ordinary green |
| 236 | push is not deployment evidence. |
| 237 | |
| 238 | After the final merge, and only with separate deployment approval, bind the |
| 239 | manual run to the intended protected-main SHA immediately before dispatch: |
| 240 | |
| 241 | ```bash |
| 242 | EXPECTED_SHA=<exact-merged-main-sha> |
| 243 | test "$(gh api repos/Hmbown/CodeWhale/git/ref/heads/main --jq .object.sha)" = "$EXPECTED_SHA" |
| 244 | gh workflow run web.yml --repo Hmbown/CodeWhale --ref main |
| 245 | # Identify the new workflow_dispatch run, then verify its immutable receipt: |
| 246 | gh run view <run-id> --repo Hmbown/CodeWhale \ |
| 247 | --json headSha,event,headBranch,url |
| 248 | # Accept only headSha == EXPECTED_SHA, event == workflow_dispatch, |
| 249 | # and headBranch == main before treating the run as bound to this candidate. |
| 250 | ``` |
| 251 | |
| 252 | `web.yml` has no SHA input and its deploy guard requires the `main` ref, so the |
| 253 | pre-dispatch equality check and post-dispatch run receipt are both mandatory. |
| 254 | This packet stops before the dispatch command. |
| 255 | |
| 256 | ## Stop line |
| 257 | |
| 258 | Completion of this ledger means one reviewed, hosted-green, normally merged, |
| 259 | exactly rebuilt and locally installed v0.9.1 dogfood candidate with truthful |
| 260 | receipts. It does **not** authorize a tag, GitHub Release, crates/npm publish, |
| 261 | artifact upload, Cloudflare deployment, DNS or billing change, live xAI/Kimi |
| 262 | request, customer communication, or public release. |
| 263 |