TST Desk 0.1.0

Unsigned first public build. v0.1 ships without code signing; first launch needs the per-platform click-through in the README (Installing an unsigned build) and docs/signing.md.

Download the artifact for your platform, check it against SHA256SUMS.txt, then install.

Platform	File
macOS (Apple silicon)	TST.Desk_0.1.0_aarch64.dmg
macOS (Intel)	TST.Desk_0.1.0_x64.dmg
Linux (x86_64)	TST.Desk_0.1.0_amd64.AppImage and TST.Desk_0.1.0_amd64.deb
Linux (ARM64)	TST.Desk_0.1.0_aarch64.AppImage and TST.Desk_0.1.0_arm64.deb
Windows	TST.Desk_0.1.0_x64_en-US.msi

These installers were produced by Package run 33147408105 at 4330c37 (Windows process-group kill). The tag tstdesk-v0.1.0 points at 451ac6f, which adds events.jsonl seq-order on persist. GitHub Actions spending-limit blocked a rebuild of that SHA (Release 33177767804 — empty jobs, runner_id: 0). Raise the org Actions budget and re-run Release to refresh installers from the tag.

What changed

TD-102

• tst-cua audit and reuse report (2118cff)

TD-103

• repository scaffold (3c120ef)

TD-104

• Python toolchain under core/ (f99b927)

TD-105

• Tauri and frontend toolchain (608b8b4)

TD-106

• CI pipeline (839ef45)

TD-107

• pre-commit hooks (04127c6)

TD-201

• daemon process skeleton (b9858b6)

TD-202

• local WebSocket server (bce2437)

TD-203

• connection handshake and local auth (adc606b)

TD-204

• protocol schema (f6106f0)

TD-208

• accept rule_activated in parse_daemon_event (7bc4d1a)

TD-301

• add keychain module and tests (48980e1)
• provider client, keychain, and tests (6c2ab2d)

TD-302

• model configuration schema (e68b9c1)

TD-303

• tier routing policy (e7c596a)
• tier routing policy (66ffa83)

TD-304

• cost and token accounting (87da0a8)

TD-305

• cache-aware prompt assembly (fdc64ba)
• track merge cleanup — jsonschema type stubs + merge decisions (e2d4a79)

TD-306

• resilience — retry with backoff, Retry-After, actionable errors, stream interruption (913e52d)

TD-307

• mock provider for offline, deterministic testing (be8a49f)

TD-401

• port agent loop core — plan→act→record with 3-tier routing (86d9bb7)

TD-402

• tool dispatch — ToolDispatcher, loop integration, mock sequences (029897d)

TD-403

• turn lifecycle events — event emission, typed status, ordering tests (02722a4)

TD-404

• cancellation — in-flight stream interruption, tool dispatch abort, tests (69930d1)

TD-405

• context window guard — compact older turns at user boundaries, ContextCompacted timeline event (d3b6e55)

TD-501

• steering file discovery and precedence (a600170)

TD-502

• CLAUDE.md fallback for steering discovery (525bbb6)

TD-503

• touch-tracking — dispatch records successful path targets on the session, loop assembles with matched_paths and announces RuleActivated once per rule, stack handler reports the true scoped verdict; UI renders activations as steering timeline entries (8641a52)
• path-scoped rules with frontmatter appliesTo (60a0f30)

TD-504

• import resolution for steering files (48c8c17)

TD-505

• import-approval follow-ups — tool_result pairs the synthetic approval id so cards clear, malformed config tolerated at load and save, doctor and stack panel forward the durable allowlist (2fd90d8)
• comment-only config toleration in approved-imports load/save (TD-1103 scaffold) (b6c46dd)
• external import approval — gate, approve/deny, persisted allowlist (83259d9)

TD-506

• token counting and instruction stack (88f35ad)

TD-507

• workspace manifest generation (0372d0f)

TD-508

• per-tier context routing (8f8f0c5)

TD-509

• hot reload (1a1ee09)

TD-510

• strip frontmatter at every steering level (d568ace)

TD-511

• anchor a bare-name appliesTo at the basename (93db2d6)

TD-601

• tool registry — Tool model, ToolRegistry, built-in tools (0d6773a)

TD-602

• path boundary enforcement — canonical, traversal, steering, Windows-unsafe (b93899f)

TD-603

• filesystem read tools — fs_read (numbered lines, binary/encoding refusal) + fs_list (glob, ignore-aware) (da1f2db)

TD-604

• filesystem write tools — fs_write/fs_edit, atomic writes, diffs (ba48f78)

TD-605

• daemon-restart integration test tolerates the OS kill veto — crash SIGKILL and clean-shutdown SIGTERM skip guarded on EPERM (never masking a body failure), cleanup kills suppress and leave the child to its --parent-pid watchdog (f98630a)
• parent-watchdog test tolerates the OS kill veto — skip on EPERM instead of failing; the vetoed round never exercises the product code (fdfc30f)
• kill honesty under OS veto — report EPERM refusals instead of claiming the group died; shield spawn against mid-spawn cancel; tests key veto tolerance on the product's report (3b5ff1b)
• shell execution — streaming output, group kill, sanitized env, allowlist (5c10689)

TD-606

• an empty allowed_commands means unrestricted (cb87c52)

TD-607

• return dispatch_many results in input order (a638774)

TD-610

• web_fetch pages; tell the model to fan out then compile (b03fc1e)

TD-701

• decision class model and static rule table (d8cc3a2)

TD-702

• decision classifier chokepoint on every tool dispatch (7468c74)

TD-703

• sync TypeScript protocol with classifier_cost (cbe281f)
• worker-tier classifier for ambiguous decisions (18aabfd)

TD-704

• decisions ledger — §12.3 markdown, atomic locked append, Class A requires commit, decision_logged event (41572ab)

TD-705

• checkpoint commits — session-branch snapshots via git plumbing (0a84b01)

TD-706

• workspace boundary configuration — .tst/config.yaml, defaults, validation, boundary_update event (e33205c)

TD-707

• cap enforcement — spend/wall-clock/iteration caps pause the session as a fault report, resume reloads the boundary (e548b9e)

TD-801

• policy model — (tool, argument pattern) → auto/ask/never (af69f92)

TD-802

• approval flow — park, approve/deny, timeout, resumable (dfb0820)

TD-803

• record Class B decisions — rule lifecycle via daemon API, (tool, args) identity (c975ee0)
• always-allow — narrow rule, proposal on card, list/revoke, Class C refused (52f5943)

TD-804

• add a real Skip all approvals setting (7431915)

TD-806

• skip-all is skip everything (1087b87)

TD-901

• append-only audit store in SQLite (41a5186)

TD-902

• audit writer — event-fed, non-blocking, loud on failure (f5f9827)

TD-903

• cost aggregation over the costs view + JSONL/CSV export (f322e13)

TD-1001

• application shell — window state, split pane, tokens, themes (51d8529)

TD-1002

• daemon supervision — host spawn/port-file connect, crash restart, clean shutdown, parent watchdog (cb14821)

TD-1003

• protocol client — typed WS client w/ reconnect+backoff, from_seq replay, connection-state banner, tolerant unknown events (d3e10d1)
• protocol client — typed WS client w/ reconnect+backoff, from_seq replay, connection-state banner, tolerant unknown events (ee2258e)

TD-1004

• chat pane — composer, streaming markdown, virtualized history, auto-scroll, cancel (b8ee844)

TD-1005

• activity timeline — virtualized daemon event stream, inline expansion, live shell output, diff/decision highlighting (ca48d68)

TD-1006

• title bar — workspace picker, tier chips, live cost meter, state + wall indicators; tier_state event, per-tier cost breakdown, set_tier dispatch (e73acdd)

TD-1007

• approval-store behavior tests — stream add/remove, reattach replay shapes, approve/deny/always-allow wire messages (c7e427f)
• record always-allow card decisions and tick AC #2 (25ca0dd)
• approval cards — approve/deny over client send(), error_code on tool_result, approval timeline kind with in-place resolve (ffd1a46)

TD-1008

• errors and notifications — typed turn failures on the wire, copy table, toast/banner store, copy diagnostics (752380d)

TD-1009

• scope the activity timeline to the bound session (897c64d)

TD-1010

• the client's event gate was dropping the usage panel's events (212b911)

TD-1011

• end a split-pane drag even when pointer capture is lost (bfad924)

TD-1012

• stop the message-list virtualizer from freezing the window (714ba94)

TD-1014

• bind-and-clear approval cards; dismiss on send (15484b7)

TD-1101

• first-run wizard — setup-state wire, keychain store+validate, preset persist, wizard UI (09783da)

TD-1102

• tick acceptance boxes — credential storage integrated (dc9af4d)
• credential storage — Windows Credential Manager backend via ctypes, delete_api_key verb acked by fresh setup_state (key_delete_failed typed error), wizard key step gains Remove stored key, all key-fix copy points at the title-bar gear (phantom tstd keychain CLI dropped), websockets frame logger capped at INFO under debug (raw frame dumps carried set_api_key payloads), end-to-end hygiene canary asserted absent from disk/logs/audit.db/wire (5ddc704)

TD-1103

• workspace management — refuse non-directory opens, scaffold commented .tst/config.yaml, recents menu with switch/remove (0b914c2)

TD-1104

• diagnostics — run_diagnostics wire, daemon checks (one shared key/provider probe, path-scrubbed rows), doctor pane with copyable redacted report (f2c58f3)

TD-1105

• bound hung keychain CLIs and keep tests off the host keyring (525edc0)
• tick acceptance boxes — keychain locked/drift surface integrated (03e9113)
• keychain locked/drift surface — stderr classified at the CLI boundary into KeychainLockedError, daemon maps it to keychain_locked, UI banner names the unlock + retry path (574a8ad)

TD-1106

• tick acceptance boxes — validate entered key integrated (93ead64)
• validate the entered key — validate_api_key takes an optional api_key probed directly (keychain never consulted), wizard Validate enabled for typed input, typed-key verdicts don't flip has_api_key (af2985a)

TD-1201

• scoped-rule chips show prompt membership not a match verdict until touch-tracking lands; daemon docstring + DECISIONS corrected to match shipped behavior; shadowed label styled as chip (cb83a0a)
• resolved stack panel — get_instruction_stack assembles on demand with cache state on the payload, additive entry fields (shadowed_path/applies_to/imports with depth/last_cached_tokens), StackPanel behind an Activity | Stack tab strip, tauri-plugin-opener (allow-open-path only) opens files in the system editor (d35e5dc)

TD-1202

• decisions ledger panel — decision_logged stream filter, class chips, derived git-revert copy, ledger link-out via zero-dep open_path command (409bb33)

TD-1203

• stop the decisions panel duplicating rows on re-attach (ffca925)

TD-1204

• deliver on-demand instruction_stack past the seq gate (7d0f735)
• keep the stack store subscribed for the window's life (c9da284)

TD-1301

• no-Python smoke verification — bare ubuntu container on Linux, PATH-scrubbed relaunch on macOS/Windows (f8627f2)
• externalBin injected at package time — tauri-build validates sidecar paths at compile time, so a committed entry breaks cargo test/clippy without the gitignored artifact; tauri:build passes it via --config, beforeBuildCommand builds the sidecar (0f91e1b)
• Python runtime bundling — PyInstaller onefile sidecar (tstd-), exe-sibling resolution ahead of PATH, build+smoke script (18.9 MB, 2.0 s to port.json) (f4e03bf)

TD-1302

• tick platform artifacts from green five-leg Package (5531f37)
• use macos-15-intel; macos-13 hosted images are retired (259cc49)
• Windows sidecar smoke — wmic parent walk and taskkill reap (f986c76)
• unsigned signingIdentity; pass --config JSON only on macOS CI (1817bf1)
• unsigned macOS identity in CI; install xdg-utils on Linux ARM (376e68d)
• set TAURI_APP_PATH via a Node wrapper so Windows Package can build (b96735a)
• prove Linux install on a Docker clean guest (66d88ce)
• stop packaging runs cancelling and hanging (eb1f5f1)
• platform builds — package.yml CI matrix (mac arm64+x86_64, linux, windows) with bundled-sidecar smoke per leg, unsigned-binary README section, v0.1 unsigned signing decision; Windows sidecar .exe suffix fix (b545005)

TD-1303

• fetch-depth 0 on release checkout — shallow clone would truncate the first-release changelog to the tip commit (8de0264)
• release workflow — tag-triggered publish reusing the package matrix, SHA256SUMS, changelog generated from TD-### commits, version-consistency test + tag gate (ui 0.0.1 → 0.1.0) (a7956a2)

TD-1304

• Windows parent-pid without wmic (Toolhelp32 + PowerShell) (153e455)
• tick the packaged-app attach verification (5e432e2)
• attach the onefile sidecar; reap leftover daemons (df552f2)

TD-1401

• drop stray merge marker from DECISIONS.md (1119a60)
• M1 headless harness — protocol-level e2e (workspace→steering→tool→classify→approve→execute→checkpoint→ledger→cost), daemon tools-stack wiring (9946708)

TD-1402

• activate env-sanitization tests against TD-605's sanitized_env + shell e2e (63c8560)
• tool-level coverage now that fs_write/fs_edit land (TD-604) — steering write battery goes live, escape dispatch refusals, positive control (29d15c8)
• security suite — path-escape battery, steering refusal, log redaction (args fix), bind refusal, chokepoint bypass (7a0d3e2)

TD-1403

• context assembler cross-cutting suite — fixture tree, goldens, determinism, prefix stability (ad4fb3c)

TD-1404

• timeline_render_1000 baseline — vitest gate under jsdom against the shared perf_baselines.json, UI-measured row preserved by core --record (cfc92d7)
• performance baselines — daemon cold start, large-repo session start, steering resolution, first-token pipeline latency; committed baselines with a 3x/+250ms regression gate; timeline render pending TD-1005 (355745d)

TD-1405

• audit/event surface redaction — SessionEventLog.add() is the chokepoint (arguments, output, diffs, shell chunks, error messages), build_error scrubs at construction, shared redact_structure; TD-1402's two skip shells are live tests (9371c24)

TD-1406

• keep events.jsonl in seq order under concurrent persist (75bf09b)
• tick Windows process-group kill from windows-latest CI (cfc1cd4)
• order revived events by seq; persist scheduler advance first (e5513fe)
• taskkill the tree before TerminateProcess on the leader (6625028)
• isolate embeddings sidecar in tests; run live Windows group-kill (d196c21)
• land the Windows tree-kill probe without claiming the host (45ca30c)
• offload the Windows tree kill on the timeout path (60c1168)
• expand 8.3 short names on Windows, document the permission no-op (e9d723f)
• decisions — every model-facing path surface speaks POSIX (0fc05d4)
• posix-stable path surfaces — discovery subtree labels, fs_list entries, and validator-subset matching render forward slashes on every platform (bc00ef7)
• win parity — daemon spawn without the script trampoline, boundary Windows path-form story, refusal tests on real loopback endpoints (dfe1ab7)
• win parity — security suite goes workspace-relative so refusal/success verdicts pin on both platforms (c9ec0a3)
• win parity — setup_state/diagnostics daemon teardown awaits shutdown so audit.db is closed before TemporaryDirectory cleanup (Windows cannot unlink an open sqlite handle) (5aac612)
• Windows CI parity — guard tests go workspace-relative (codes pin on both platforms), posix-separated prompt text, ledger/shell/signal/watchdog win32 fixes, chmod/POSIX-syntax skips pointed at TD-1406 (dc65e5a)
• signal-handler registration tolerate Windows (add_signal_handler is POSIX-only) + backlog entry for the parity story (2478402)

TD-1407

• tick the hammer — 30 consecutive full-suite runs, 0 failures (38b8e42)
• kill battery waits on conditions — pgid spawn-ack, killpg group-gone probe, 30s escapee window; the 0.3s/2.5s wall-clock arithmetic goes away (d12ec57)

TD-1408

• config tests read the shipped default from a fixture path — no-arg loads resolved the developer's own config; the suite now passes on a configured machine (8df2605)

TD-1409

• gate the cancel-escape marker on a file, not a sleep (fd9d224)

TD-1410

• confine the M10 harness the same way as the earlier ones (5c6ea0e)
• test that every outbound host traces to config (fdaf1ca)

TD-1411

• stub localStorage in the settings appearance tests (6898f89)

TD-1412

• migrate decisions.commit_sha so Class B can be NULL (2201e85)

TD-1501

• add a real window capture to the README (4b045da)
• rewrite the README as a user-facing front door (4ebb907)

TD-1502

• steering authoring guide (c21e5bf)

TD-1503

• configuration reference (33718cb)

TD-1504

• keep the suite honest after persist-revive and quit distill (b9aa584)
• architecture guide, checked against the architecture (c042159)

TD-1601

• warm-paper palette, radii, and whisper shadows (03b62d0)

TD-1602

• vendored Source Serif 4 and type-role tokens (6317d09)

TD-1603

• bubble-less assistant messages (9681239)

TD-1604

• composer card and centered column (0f249b1)

TD-1605

• greeting empty state (db0a200)

TD-1606

• hover message actions — copy markdown, retry last user message, hover timestamp (15dd96d)

TD-1607

• Working… shimmer between send and first delta; daemon-sourced duration line on turn end (8b4a159)

TD-1608

• shared icon map, emoji out of chrome, original favicon (1f7c510)

TD-1609

• token-driven code theme, Esc cancel, ⌘, wizard (2f62c1c)

TD-1701

• session sidebar — collapsible left rail (list/attach/new/filter, persisted collapse) + new_session verb (f697e86)

TD-1702

• OS notifications when the window is unfocused (3473bee)

TD-1703

• tick all five criteria, record the UI decisions (ff2bbb0)
• settings pane, gear and comma retargeted (47ce0da)
• settings store (3716afc)
• UI protocol types and a forceable theme (8304c62)
• set_tier_slug on the wire, and slugs as configured (a1e5227)
• write a tier slug back to the user config (566ea07)

TD-1704

• queue and steer UI (bb9f153)

TD-1705

• files pane — the session's writes, folded by path (6dfa012)

TD-1706

• usage and cost view (39b3c82)

TD-1707

• command palette (874d38d)

TD-1708

• fork edit/retry into conversation siblings (419c808)

TD-1709

• attachments v1 — text files on a user message (6459ec8)

TD-1710

• add browser computer-use tools and the Screen pane (df1a743)

TD-1711

• session liveness honesty — daemon refuses user_message to terminal/tombstone sessions with a typed session_not_running error; auto-bind skips dead sessions and stays unbound; rail New Session anchors on the newest listed row as the escape (1422b81)

TD-1712

• rail information architecture — sections + account anchor (8d588fb)

TD-1713

• working-state honesty and flavor — ProtocolClient attaches before any user_message to a session it isn't following (same socket, daemon order); 25s first-token watchdog swaps the shimmer for honest no-response copy with a live Cancel; verb rotation + elapsed on the existing shimmer; daemon logs turn started at dequeue with queue depth (17b2c26)

TD-1714

• turn-state semantics — daemon "running" is session-liveness, not a turn (9c417dd)

TD-1715

• archive, delete, and re-project sessions from the rail (cd7be3d)

TD-1716

• keep application pings out of settings-wire replies (15a75f0)
• heal the client on resume from webview suspension (d42c484)

TD-1717

• store multiple named API keys and bind them per model (0d94ea2)

TD-1718

• let a named API key own its host (f2b175c)

TD-1719

• put the provider retry budget in config (8838e2a)

TD-1720

• show the live slug and host in the title bar (4000eb2)

TD-1721

• persist the preset name on the session (c19edb3)

TD-1801

• resolve a loopback provider without a keychain entry (35e65e8)

TD-1802

• retarget the local preset and put zero-cost accounting under test (c9e8cba)

TD-1803

• add a live-provider leg to the headless harness (3118129)

TD-1804

• record stream usage independently of finish_reason (ca94105)

TD-1805

• resolve the slug before requiring it on every shipped path (4b731cd)
• resolve the local model from the endpoint (c519ad4)

TD-1806

• count a whole turn's tokens and duration in turn_complete (f69b2b3)

TD-1807

• select the harness's checked tool call by identity (f9b9e24)

TD-1808

• scope the execution check to the call it is checking (1369ed0)

TD-1809

• stop the doctor probe test depending on the developer's model list (cd1e618)

TD-1810

• refuse C1 control characters in the workspace root (5ff7646)
• close the six defects logged against the workspace-root block (9176433)
• state the absolute workspace root in the system prompt (c44fa6a)

TD-1811

• report only the cache reuse the provider reported (3144abc)

TD-1812

• split the workspace picker and cost meter out of TitleBar (1f6e407)

TD-1813

• cut session binding out of the chat store (84ee6d5)
• extract the first-token wait from chat-store (9d8ac11)

TD-1814

• scope cache_reported to the same turn as cache_ratio (83c3813)

TD-1815

• split the chat reducer and fork map out of the store (e28bfc6)

TD-1901

• carry reasoning deltas through to the window (4069071)

TD-1902

• fold tool calls in the transcript like thinking (a855ba6)
• fold a reasoning model's thinking behind a disclosure (e39205b)

TD-2001

• add an X11 backend for tst-cu-mcp (670b00b)

TD-2101

• scaffold .tst/memory/ templates on session start (045fde4)

TD-2102

• allow Class A writes under .tst/memory/ (b9b4830)

TD-2103

• cap memory files at config memory.max_lines (0bfa4d4)

TD-2104

• commit memory writes on HEAD as tst: memory update (7568bea)

TD-2105

• pin that .tst/memory is never steering (33a51f5)

TD-2201

• load MEMORY.md plus heading-matched topic files (5d599bd)

TD-2202

• OpenAI embeddings client with heading-match fallback (6119759)

TD-2203

• rank memory topics by embedding similarity and budget (79cd986)

TD-2204

• supervise an optional embeddings sidecar (68ea8bc)

TD-2301

• distill session memory on the worker without writing (3c459b9)

TD-2302

• run distill on End session and graceful quit (a3c3a85)

TD-2303

• accept memory proposals through the store, not tools (ad6b2d2)

TD-2401

• add memory_proposal protocol and accept/edit/reject verbs (0446d9f)

TD-2402

• show memory proposals as a bind-and-clear card (132c474)

TD-2403

• edit memory proposal markdown before accept (65ee6d8)

TD-2404

• treat an unanswered memory proposal as a reject (95fc74c)

TD-2501

• replace the brain memory placeholder when files load (cd2fcac)

TD-2502

• drop lowest-ranked memory until under the token cap (4b3462c)

TD-2503

• pin that memory sits after the cache prefix (bebb9e7)

TD-2601

• close the Memory rail leftover as the project-home column (bc98a06)
• list workspace memory on the project home (bf2361a)

TD-2602

• save Memory pane edits through the commit path (526ae1b)

TD-2603

• opt in to ~/.tstdesk/memory from Settings (fc85e92)

TD-2604

• name loaded and dropped memory on the stack (fb2a1bb)

TD-2701

• headless memory harness is the M4 exit (c4f5c99)

TD-2801

• rail Projects opens a project list and home (1c35d08)

TD-2802

• Instructions column on the project home (2ba16db)

TD-2803

• host distill proposals on the Memory column (3b77e43)

TD-2804

• pin workspace files on the project Context column (066d9e5)

TD-2805

• load pinned files on the brain after memory (a80ff40)

TD-2806

• pin workspaces on this machine, not in the repo (cfc8bcb)

TD-2807

• project home recents are this folder's sessions (2fc1bcf)

TD-2808

• pin the project home to real column stores (b137d2b)

TD-2901

• drop duplicate user_turn row after rebase (d64bf38)
• bound the durable session log and attach from disk (4e3ac09)

TD-2902

• stop claiming close still kills the daemon (1fb4b77)
• hide the window; leave tstd running (1687bcf)

TD-2903

• make Quit explicit; close is not shutdown (b5a46cc)

TD-2904

• tick the coworker-indicator acceptance criteria (1a9bb43)
• badge the dock while a hidden session is still working (06583be)

TD-2905

• tick the coworker Settings acceptance criteria (0f8baea)
• Settings toggle for keep-running-when-the-window-closes (7218299)

TD-3001

• title the rail from the first user message (97d6fe0)

TD-3002

• rename a session without touching the loop (47aed29)

TD-3003

• star sessions on this machine, not in the repo (83e3e79)

TD-3101

• add tst run as a second door to the same daemon (45b421a)

TD-3102

• tick the attach-CLI acceptance criteria (e5bfa34)
• attach from the CLI without owning the session (d762639)

TD-3103

• approve from a TTY; never always-allow Class C (b0c4b59)

TD-3201

• persist artifacts with the session, behind the workspace wall (cdce640)

TD-3202

• make Artifacts a ready rail surface with a sandboxed preview (c7a5558)

TD-3203

• tick the Work-pane acceptance criteria (eed8565)
• show session diffs as a Work pane, not a Files fold (ee6f5a6)

TD-3204

• M5 exit harness — viewer leaves, the session does not (41e0082)

TD-3301

• tick the desktop-tool acceptance criteria (f6d5504)
• register desktop computer-use tools behind the classifier (e8ffe68)

TD-3302

• tick the macOS permission onboarding criteria (1443d18)
• explain macOS Screen Recording and Accessibility on first CU (0f91f67)

TD-3303

• explain Windows computer-use integrity on first CU (66d1d61)

TD-3304

• tick the grounding-honesty acceptance criteria (0e1e699)
• record click target vs landing and fail the eval on miss (12f4253)

TD-3401

• stream desktop frames on the same Screen pane as the browser (b426ee1)

TD-3402

• record the real-display ring in the backlog's completed note (0e3925d)
• show computer-use glow and agent cursor on the Screen pane (70d8c58)

TD-3403

• Design mode — point at the Screen pane instead of describing it (281b7d1)

TD-3404

• tick the in-window kill-switch criteria (f7a0d5d)
• expose the computer-use kill-switch in the window and palette (6b26d62)

TD-3405

• M6 exit harness — mock screenshot, refused click, approved click (1102348)

TD-3406

• resolve desktop Design picks through observe-only AX (d2a39a4)

TD-3407

• let cu_session through the client event gate (056ef27)
• keep the computer-use ring up for the whole episode (20bfc30)

TD-3601

• tick the Tailscale-bind acceptance criteria (fc51616)
• opt-in bind on a Tailscale address, never 0.0.0.0 (9f10d08)

TD-3602

• remote hello needs a rotating user-data-dir token (9bf3683)

TD-3603

• Settings toggle for Tailscale remote attach (64163a6)

TD-3701

• attach the existing client from a browser (3ad15ef)

TD-3702

• remote clients resolve parked approvals once (446ec10)

TD-3801

• tick the Slack webhook acceptance criteria (415b1b6)
• deliver approval-needed and turn-complete to a Slack webhook (02f96f9)

TD-3802

• optional ntfy send with the same shape as Slack (e96c053)

TD-3803

• tick the scheduler-store acceptance criteria (d00c1a4)
• persist scheduled jobs in the user data dir, do not run them (97d038a)

TD-3804

• wake due jobs, run one turn, deliver once (a4c76a1)

TD-3805

• make the Scheduled rail live (b47b5d8)

TD-3806

• list the M7 harness as a loopback client (8b26e90)
• add the M7 exit harness (c467e75)

TD-3901

• ship a vllm loopback preset for EZER and vLLM (22c2346)

TD-3902

• ground desktop clicks on a local vision model (dc044cb)

TD-3903

• pin CU-heavy worker to the local preset (efcfbf7)

TD-3904

• add the M8 exit harness against the vllm loopback (74d181f)

TD-4001

• the CHARTER.md schema and its start gate (fb76852)

TD-4002

• claim the charter editor in README Status (736d129)
• edit the charter as the human, not the agent (1ae6847)

TD-4003

• sign the charter and refuse start without a sandbox (6c2f8bd)

TD-4101

• iterate an unattended run without waiting on the user (4afeb56)

TD-4102

• commit autonomy writes on tst/auto/ (84244db)

TD-4103

• poll definition-of-done after each autonomy turn (87e1186)

TD-4201

• detect autonomy drift without spending a user turn (71f0982)

TD-4202

• revert drifted autonomy work to the last passing checkpoint (b50cd88)

TD-4203

• stop unattended runs on repeated faults without asking (83961f6)

TD-4204

• review interactive write turns on the validator (a2c5dec)

TD-4301

• refuse autonomy without a rootless container (9dab485)

TD-4302

• keep host credentials out of the sandbox mount (af628c6)

TD-4303

• persist a wake-up so a closed window still sees the run (17a79c4)

TD-4304

• pin the M9 exit as a headless mock autonomy run (f6e001b)

TD-4401

• load listed MCP servers without killing the daemon (81d1059)

TD-4402

• stop undeclared MCP tools from ever being Class A (42ba5b0)

TD-4403

• add and remove MCP servers from Settings without YAML or env (170b777)

TD-4501

• list slash commands without putting them in steering (8c9ff5a)

TD-4502

• keep skill bodies out of the cache prefix (0a85c2f)

TD-4601

• load third-party tools from entry points without replacing builtins (74ce6df)

TD-4602

• add a one-level worker child without a second session (11cb9eb)

TD-4603

• lock every turn to brain when Plan is on (7dd60a1)

TD-4604

• prove M10 with a headless mock exit harness (f8b1ea0)

TD-4701

• hold-to-talk dictation through a config-sourced STT endpoint (da84fda)

TD-4702

• macOS quick-entry overlay via global shortcut (bd8fb2e)

TD-4703

• tray running-count and multi-window session viewers (d12c247)

TD-4704

• opt-in release check in Settings About (4a66ad7)

TD-4705

• vision-gated image attachments on user turns (fa488e4)

TD-4706

• vendor mermaid and KaTeX without a CDN (8a56635)

TD-4707

• add Discord and Telegram as sibling notify send() modules (af774cb)

TD-4801

• close redaction key-shape gap and three one-line defects (3b32bb4)

TD-4802

• make the redaction chokepoint categorical (bc176f5)

TD-4805

• shell hardening — static steering C, B floor, wider env net (63ed2dd)

TD-4806

• route rendered markdown links through the OS opener (6eb767c)

TD-4807

• lock the webview CSP and forbid form tags in model HTML (f3227b8)

TD-4808

• wire the network rail and side_effect_class into the classifier (1337a83)

TD-4809

• release builds run only their bundled daemon (3eded69)
• sign dev bundles and allow the daemon's libpython (8e3c3ff)

TD-4810

• give supervision tests their own data dirs and argv (275ec81)

TD-4811

• make the README Status section claim what shipped (4481d18)

TD-4812

• close the process-debt quartet (6465b39)

TD-4813

• keep the macOS keychain write out of argv (ef4d459)

TD-4814

• pin web_fetch's connection to an address the wall checked (b07e229)

TD-4815

• actuation switch survives quoted booleans; bound click count (4a0c854)

TD-4816

• close the low-severity review follow-ups (58af5cf)

TD-4818

• skip-all approvals no longer promotes the shell floor (031862d)

TD-4820

• refuse trailing dot/space path components (237f333)

TD-4821

• un-block the repo's own gates (c2746f7)

TD-4825

• open the workspace picker when a new chat has no anchor (5648670)

TD-4826

• make the session rail width adjustable (1b4f7de)

TD-4901

• DECISIONS entry for Wayland split (b116f3b)
• record Wayland assessment in backlog and DECISIONS (7a40df4)
• Wayland CU portal and foreground_window assessment (c998720)

TD-4902

• add Linux aarch64 package matrix leg (85dea43)

TD-4903

• record v0.1 unsigned signing policy (45da154)

TD-4904

• document blocked Actions and filter package pushes (cfbca44)

TD-4905

• allow ~/.tstdesk sibling imports and fix stack badge (fc8c625)

TD-4906

• packaged stranger loop on macOS and Windows (e80a456)

Other

• docs: CI unblocked at $20/mo budget; all nine legs green (2ac45bd)
• fix: scheduler revive test — assert job no longer due, not wall clock (cab7fdd)
• fix: Windows CI — skip flaky subprocess/hygiene tests, stabilize timing (a6f151e)
• fix: Windows CI — scheduler race in M7, audit handle release delay (a284ae8)
• fix: close audit writer on Windows daemon teardown in tests (ee5082e)
• fix: Windows teardown — audit checks before stop, close spawn logs (c3a0629)
• fix: Windows CI round 2 — path slashes, graceful daemon stop, spawn cwd (db7b593)
• fix: Windows CI — APPDATA isolation, sandbox fakes, path normalization (6e325e4)
• chore: ruff import order in test_session_persist (bc9c396)
• fix: Windows CI — UTF-8, file modes, sandbox paths, scheduler jobs (a454aaa)
• fix: ruff import order after content_as_text additions (e935870)
• fix: use content_as_text for multimodal MessageContent (TD-4705) (f3d4394)
• fix: ruff format core after smoke script edits (838ce2b)
• fix: CI green — ruff imports, box ChildWatch for Windows clippy (7a4768f)
• fix: rail tests include open-window action (TD-4703) (d90b115)
• docs: pin Actions failure to runner_id 0 billing block (4e7f1df)
• TD-4822, TD-4823: file reviewer diagnostics, reports, memory scaffolding (43e1ed4)
• TD-3402, TD-3403: light the real display while the agent drives (348cd9c)
• TD-4822, TD-4823: answer batched stdin past EOF; mypy clean on macOS (9a890b6)
• TD-4817, TD-4819: close the redirect-operator and credential-URL gaps (babdcf8)
• TD-4803, TD-4804: guard the policy file and case-fold steering checks (8ea4e63)
• File E48 — the 2026-08-21 review findings (5bafddf)
• TD-m6: record how the stacks became one branch (119a8df)
• TD-m5: pass title as the seventh sessionList tuple field (1d2c0e6)
• TD-m5: drop the leftover star_session architecture row (3b45264)
• TD-m5: record how the four stacks became one branch (c34918d)
• Revive sessions from a saved conversation after restart (3a0627c)
• M4: file E28 project home (Instructions / Memory / Context) (c0366d0)
• Plan M4: decompose v0.2 Memory into E21–E27 (0337713)
• TD-608/TD-609: join relative reads, name the next offset, add web_search (695d4e5)
• File TD-2001 and TD-2002 as E20 - Linux support for the MCP server (533a9b3)
• mcp: Windows backend for the computer-use MCP server (cc9969b)
• File TD-1011, TD-1012, TD-1204, and E19 as live-pass bugfixes (6c9e39f)
• File TD-1410 — the no-telemetry directive has no test behind it (a9dfab1)
• File TD-1409 — TD-1407's cancel race survives on a loaded machine (0903618)
• Retro-file TD-1812 and TD-1813, the two ids with no story (390b736)
• File TD-1203 — the decisions panel duplicates every row on re-attach (108413e)
• Add TD-1813 — cache_reported must share the scope of the ratio beside it (01f9b03)
• Correct AGENTS.md §6: the keychain is Python's, not the host's (a31bdcb)
• Note the embedding sidecar constraint under v0.2 Memory (9c74dd8)
• Add TD-1811 — do not report prefix reuse that did not happen (855496a)
• Record TD-1810's decisions and tick its criteria in the backlog (2cb4f25)
• Close out batch 2: tick six stories, file TD-510 and TD-511 (2c851b0)
• File TD-1009 — the activity timeline is never scoped to a session (74f48e6)
• File TD-606 — an empty allowed_commands refuses every command (65cbacc)
• TD-1407/TD-1408: tick acceptance boxes — conditions replace sleeps (hammer pending), config tests read shipped fixtures (7db6320)
• Record the Class B decisions for TD-1808, TD-1809 and TD-1703 (03214c5)
• Record TD-1703 progress in the backlog (58da6d2)
• File TD-1408 — the config suite asserts shipped defaults against the real user config (e672b49)
• Renumber the shell-cancel flake story to TD-1407 (a637341)
• File TD-1810 — the shell-cancel run times a race with fixed sleeps (3dc667d)
• Renumber the workspace-root story to TD-1810 (4f3b858)
• Add TD-1809 — tell the model the workspace root (a8c7146)
• Reconcile the Summary table against the story headings (5f7bb82)
• Untick TD-1807 AC-4 and file TD-1808 (87b6f73)
• Reconcile TD-1805, TD-1806 and TD-1807 against verification (ce4504f)
• Add TD-1807 — the live harness must not assume tool-call ordering (ff44550)
• Reconcile E18 acceptance criteria against independent validation (727a2c3)
• Add TD-1805 and TD-1806 (7651d7d)
• Add TD-1804 — record usage independently of finish_reason (c9683cf)
• Add Epic E18 and milestone M1.5 — local model support (e4edd8b)
• TD-1715/1716: extend rail-lifecycle story with move-to-project; file resume-healing story (82d4f41)
• Plan TD-1713 — Working-state honesty + flavor: attach-before-send invariant, first-token watchdog, rotating verbs, turn-start logging (f6fe06e)
• Plan TD-1712 — rail IA: sections + bottom account anchor (from reference-app rail review) (a2d7b64)
• Restore TD-1406 posix-stable path files clobbered by 856d044 (9438109)
• Post-v0.1: capture Tier 3's unversioned flourishes (voice, quick-entry overlay, tray/multi-window/auto-updater, web-search tool) (856d044)
• Plan TD-1711 — session liveness honesty: no auto-bind to terminal sessions, typed error on send to dead session (2e6582b)
• Plan E17 — familiarity II (TD-1701–1710, 34 pts): sidebar, notifications, settings, queue UI, files pane, usage view, palette, branching, attachments, browser-CU; E11 addendum TD-1105 keychain-drift surface, TD-1106 validate-before-store (1179c23)
• TD-1603/1604/1605/1606/1607: backlog ticks and completed notes (d06d68b)
• TD-1601/1602/1608/1609: backlog ticks, completed notes, decisions (f4447e3)
• Plan E16 — familiarity epic (TD-1601–1609, 15 pts): warm-paper identity, serif type, bubble-less chat, composer card, greeting, hover actions, shimmer, icons, dark code theme + first shortcuts (c3ed348)
• TD-503/TD-1201: backlog corrections from stack-panel verification — untick TD-503 boxes 3/4/6 (matched_paths never plumbed), tick TD-1201 7 of 8 (AC3 awaits touch-tracking) (cd1a2d0)
• docs: tick acceptance criteria for integrated stories TD-101..107, 201..207, 301..307, 401..405, 501..509, 601..605, 701..707, 801..803, 1001, 1002, 1004 (21a3f04)
• CI: windows mypy — platform-guard POSIX-only APIs (8b79a2e)
• docs: mark TD-1402 (security suite) and TD-1403 (context assembler suite) acceptance criteria complete (ff9095d)
• TD-1008 graft: transport/parse copy rows, interrupted tombstone banner, cap field names, diagnostics notifications + ui version + client-side redact (7e7b13f)
• main CI: fix three first-run failures — rust leg installs Linux webkit deps, typescript leg installs uv for the fixtures step, mypy scope matches the developer gate (tstd strict) (861915f)
• File TD-1405: audit/event surface redaction (gap found by TD-1402) (e341e77)
• Record M1 cross-track integration decisions (2791939)
• ignore stray development artifacts (darwin.py, files_*.zip) (60b3b3c)
• TD-205, TD-206, TD-207: session model, attach/detach, crash resilience (f47fb0e)
• docs: TST Desk spec, backlog, working contract (d939cbb)