Local Alpha Verification

Current operating decision — 2026-10-08: responsibility owners and serial Integration, transition #496. Historical single-Execute/main-per-task-PR/old cadence statements below are retained evidence, not current execution instructions. Original product/release acceptance remains unchanged. Current task state lives in its Issue.

Local alpha verification and execution queue

Updated: 2026-10-01. Status: incomplete; external alpha is not approved or deployed. The acceptance tracker remains #322. This page records inspected local evidence and current owner decisions; it does not replace any original product or release criterion.

Current Planner additions — 2026-10-01

The proactive queue now includes #418 attached Slides connector persistence and #419 fresh durable local installation, after deduplicating212 existing open/closed Issues. Both are OPEN with source evidence, exclusions, dependencies and exact acceptance. Their creation is not completed functionality.

#406 is now verified CLOSED/COMPLETED. Exact candidate41d99f80f985cf79e09fbe3e2aca2688c3f61314 and local develop a1bb08b74c7c00fa205af6de122854372dcf7a0d have identical clean treeb8a372fe1fc3c5c8991f33fc93805e80bb08908e. Planner inspected all seven criteria, completed final preflight0 (Node22.22.0/pnpm8.15.0), candidate native35/shared66/affected standalone4/actual OIDC API PostgreSQL2 and integrated native35/Slides desktop11/actual2, with both actual JSON schedules passed+cleanup true and13 hash-bound final artifacts. Exploratory failures remain separate. This snapshot milestone rejects invalid attached-SID native files recoverably; it does not implement durable attachments or Yorkie.

NOW existing Execute has a confirmed new running #418 turn and an actual codex/418-slides-connector-native worktree from a1bb08b7. Its codec and copy-identity worktrees are separate. #408 was not claimed; no directory start is inferred from previous policy comments. #418 owns persistent connector targets, safe native compatibility and actual rendered/authenticated round trips, then #407 follows. A separate diagnostic1/1 proves the existing defect, not the completed fix. Preserve all completed406 evidence, native originals and serial integration gates.

#419 is WAIT_DEPENDENCY after native snapshots, directory/role/admin, private assets and #414 restoration. It provides an ordinary user-reachable loopback installation independent of the disposable test supervisor, with actual OIDC, restricted DB roles, durable restart and a repeat fresh local destination. Select it before optional #417. Two local reproducibility fixtures do not satisfy cloud/customer installation, collaboration or external alpha gates. No deployment or real-account provisioning is assigned.

The #407 actual nested-input handoff maps existing inner/outer flush fixtures, later input, failure/no partial write, fresh identity after await and protected departure into real server acceptance. No Site server test pass is claimed.

The #413 first research intake is received from the one existing temporary helper. It includes nine initial document categories and a hypothetical requirements/design/specification/test example, not a completed experiment or product schema. Planner directly checked OSLC RM2.1 vocabulary and PROV-O2013 Recommendation. The research proposal keeps item IDs/reference versions and separates a validation link from an executed test result, and revision/quotation/primary-source relationships from one another. Planner reconciled the current workspace-spec change in comment5925500547: it adds trash/unavailable-open preservation, not typed item relationships. Business-item lifecycle semantics and the manual comparison remain open. No enterprise-wide schema or customer validation is claimed.

Latest parent queue record. Existing #405/#415 closure proof and all full native/collaboration/privacy/admin/recovery/actual installation/release requirements remain unchanged.

Planner independently reproduced #418 on accepted a9bd1cce with actual editor insertRectangle/insertEllipse/insertConnector commands and native encode/read/fresh load. Both original endpoints resolve, but neither resolves in the fresh session; schema documentFaults is empty. The diagnostic1/1 asserts this defect, not a working preservation fix. No product sources or service fixtures were changed, and no browser-rendered movement/server/Yorkie acceptance is inferred. Execute received the exact external fixture/results/hash report without an active-turn restart.

Operating decision

Development and serial integration use local Git until final release. GitHub holds Issues, Wiki and Discussions. Normal Issue work does not create remote code PRs or push product branches. Local development is integrated into the designated local develop; main remains the release baseline. Final release still requires the established protected PR, CI, security and approval gates.

Planner owns priorities, deduplicated new goal-aligned Issues, acceptance, Wiki/Discussion and release evidence. It maintains a small actionable queue without waiting for another owner request to identify missing work in the established goal. Splitting a tracker assigns implementation exclusively to its child and preserves the parent's original acceptance.

Execute owns one assigned Issue at a time: exact-baseline feature branch, implementation, focused verification, required .nvmrc Node/pnpm preflight, local commit, serial integration and affected integration verification. Author and committer are easylogic <cyberuls@gmail.com>. Valid unchanged-code evidence can be reused; tests expand when changed shared boundaries or release scope justify it.

The separate Review Work is retired from the current local workflow. Historical PR/Review/specialist instructions below or in older Issues do not create a current gate. Required tests and final-release protection remain. A task that actually stops before completion is resumed through its existing assignment after reconciling its live process/session handles. An observation timeout alone is not a reason to duplicate a run.

Inspected Note milestones

These commits are local-only development identities, not published GitHub release tags or a designated release candidate.

Durable save recovery

#357 candidate 709de311d8f7d4d15c6ac42b7a350a02d47a3068 was integrated at local develop 2a7f9de6976987c28a11a9d8dd29ed2f19b9d4e9.

The inspected exact integrated evidence is focused units16/16, mocked desktop auth/Note41/41 and real OIDC/API/private PostgreSQL4/4. Final candidate preflight exited0 under Node22.22.0/pnpm8.15.0. This milestone provides independent scoped drafts, deliberate recovery selection, fixed original request/body/key across reload, fresh permission checks and last-input protection when local storage fails.

Four real cases cover login/roles, account entry, one writer with a viewer and Note save/reopen. They do not prove two writers, full process restart or all fault/privacy schedules.

Explicit local-to-server C-copy

Candidate efcc775d1e06e2e2cb8d031341fd7d81c7977f3b was integrated at local develop cb3f8cc7e3f0d3994b519535b3328522635b8f1a. Candidate and integration trees are identical; the integration checkout was clean at the audit.

Final candidate preflight exited0. Exact integrated focused units17/17, affected mocked desktop copy/recovery/account13/13 and real PostgreSQL Note/save/copy2/2 passed. Structured source selection retains the whole local IndexedDB row, uses new server document/page IDs and transforms self-reference, confirms through same-account server readback and shows residual source/request locations. No automatic local library upload or source deletion occurs.

The real structured fixture checks paragraph/self-reference/codeBlock. Mocked before/after-commit retry cases are useful evidence for request lineage, but do not count as real fault injection. Native full-schema and real matrix requirements remain. Runbooks in the integrated source are docs/verification/note-durable-recovery-357.md and docs/verification/note-local-copy-357.md.

Completed Note snapshot acceptance

Execute's #357 recovery matrix candidate e499df5368b0c49ff56862c6d9d1b7ca7ee46fbd was integrated at d30a6be23ca62c62d0f5ee94dec58796166ea15e. Required preflight0, existing real smoke2/2 and exact integrated recovery/privacy/input4/4 passed with no skips. The unchanged evidence covers actual same-DB API/browser process restarts, before/after response loss, DB outage, two writers/stale revisions, ACL/cross-tenant denial, same-profile account/late-callback isolation, immediate-input recovery and quota handling.

The two destination identity/occupied fixed-key receipt schedules now also pass: candidate 15ae3a7d4f9fec68f76fe38daa818dc76eabcd74, local develop f16ce4a95ad63302d87d36a410fb1f66f0bfce72, identical clean trees. Required preflight0 and exact integrated real7/7 (29.0s, no skips) include both new cases and five existing real-local regressions. Original rows, existing destination and immutable attempt/source/body/key are preserved; a mismatching receipt cannot confirm a save or rotate a key. These are snapshot proofs, not collaboration.

#357 is now completed and closed on local develop ec918d77dd0c49acb346bde1972520d11335bdaf, candidate 3ffcee09ddc03249396fb904911b615b998cc98e, identical clean trees. Required preflight0 and exact integrated real2/2 (no skips) complete original criterion4 after successful and failed/retried migration. Actual IdP A→B switching, B's verified subject, direct full IndexedDB-original/raw pending equality and the existing A residual-location notice were inspected. B has no automatic A editor opening, copy POST, recovery control or confirmation. Unencrypted origin storage remains physically readable under B; this is documented exposure, not solved device confidentiality. Planner's six-criterion closure binds the prior unchanged recovery/conflict evidence and final runbook. No broad rerun, encryption, source cleanup or release occurred. Word #405 is also completed below; full four-product/Yorkie/admin/privacy gates stay open.

The opt-in private Unix test controls preserve the test DB and use actual API children. They do not add product HTTP control routes. A draft harness or partially progressed matrix is not a passed test. Required matrix runs must actually enable the protected control descriptor and synthetic-account fixture; a smoke run that skips the matrix is not matrix acceptance.

Only test-owned synthetic data/services may be changed. Shared PostgreSQL, existing IdP accounts and customer data are not test targets. Tokens, passwords and protected fixture contents are not published in this Wiki, Issues or logs.

Physical local originals/drafts remain unencrypted. Account UI gating and a permission notice do not provide device confidentiality. Automatic retention/deletion and external shared-device support remain separate unresolved privacy/release decisions. Do not silently delete original data or redefine these limits as solved.

Executable queue

Latest owner correction: office-ui is already independent pure UI. #410 kept visual design, existing component states, desktop usability and accessibility only, and is now closed with evidence. No adapter/model separation, editor/viewer integration or package extraction is assigned. Proposed #411 was withdrawn as not planned before implementation; it is neither a ready queue item nor a completed feature.

The owner's pure UI priority #410 is now completed on local integrated develop 89eb7bc93f0e029d9c4c56f18c55cca1776fc4e9, candidate 548700f93d6e6ff9a40bf92575838a671e77545c, identical trees and clean integration. Required preflight0 and exact integrated Office desktop21/21, Word3/3, shared tokens14/14 pass. Planner inspected source/logs, actual paired screenshots and light/dark contrast. Closure evidence. A legacy Word clipboard test fails on base and candidate; that debt is retained and not reported fixed.

Execute delivered the first #415 representative modern controls checkpoint on local integration d40b585c4dc986b4a47783001f8b8745dccbb9c9, candidate 0de0d676494b51351fcfc58d03b18a77778b4b16. Actual integrated UI22/22, Word3/3 and token14/14 terminal results were inspected; paired actual light/dark screenshots are available in the first implementation comparison. Planner acceptance and closure are now recorded; #415 was completed for its first checkpoint, then reopened for narrow input feedback. That new correction is now verified and CLOSED/COMPLETED: candidate 713d42b041fb224d8721570e1e250bbbcfab0f3e, local develop a9bd1cce610d0433c0fde67ee9ac8d6730a9c43c, identical clean tree 8055ab2d62d69681472fe667bc7019b76501964d. Required preflight0, candidate appearance6/focused9/consumer2/token14 and exact integrated17/17 pass.20 new image hashes match20 distinct accessible Library identities; a fresh full Page sequence7 includes the new comparisons first, both SHAs and every reference. Actual computed state geometry/padding/contrast and representative normal/keyboard-focus/focused-error images were inspected. The upload connector exposes canonical file references, not separate ID fields; none were fabricated. No broader owner aesthetic approval/cloud-render certification is claimed. NOW existing Execute owns #406 full native Slides snapshot from accepted a9bd1cce, then #407 Site. The existing snapshot children proceed against then-current integration and actual dependencies:

The existing sample is apps/gallery: / shows DesignSystem; /?catalogue shows the full inventory. Integrated Office provides /design-system/index.html. Do not create a duplicate gallery or redesign product editors first. #410 owns shared tokens/control styling, restrained visual hierarchy/density and minimal existing sample layout changes. Existing state, accessibility, keyboard/focus, input and downstream selection/save/undo contracts remain. Closure includes the actual local URL, before/after light/dark/focus screenshots, exact local SHAs and affected test/preflight evidence. The candidate preview was confirmed live at http://127.0.0.1:5285/#buttons after completion. This is a local design sample, not the authenticated Office service or an external release. Retained report: wonffice-execute-410/report.md.

1. #405 Word snapshot workspace, save and recovery is CLOSED/COMPLETED. Parent #371 retains Word collaboration acceptance.

2. #406 Slides snapshot workspace, save and recovery is CLOSED/COMPLETED on a1bb08b7. #418 is the current native connector assignment before #407. Parent #372 retains deck collaboration acceptance.

3. #407 Site snapshot workspace and nested-content flush/recovery, after #406/#405. Parent #373 retains Site collaboration acceptance.

4. #408 tenant member directory identification/provenance, the separately scoped admin foundation required by #377 and consumed by #378. UUID-only identification does not authorize a human-targeted role-change UI. The bounded directory label is a company-approved label, not proof of legal identity or verified email; authorization stays with the verified identity and current membership.

5. #412 private document assets, queued after the ready product/admin priorities. Current service explicitly excludes S3 bytes from its DB-only recovery; this bounded child owns private object bytes/metadata, fixed upload recovery and current document ACL with real local OIDC/PostgreSQL/S3-compatible evidence. Product-native asset consumption, sharing/publication, retention and complete backup remain open parent scope. No external storage provisioning or parallel implementation.

6. #416 authenticated Site raster assets, WAIT_DEPENDENCY after #407/#412. This is the first bounded product image insertion/resolution/reopen/local-export binding, preserving originals, private document ACL, fixed retry and self-contained export. It reuses #412 backend assets, not a duplicate upload protocol. Other product media/public sharing/publication remain open scope.

7. #414 local DB/private-asset recovery, after #412/#416 so restoration includes one real Site media fixture. A versioned recovery bundle and actual fresh-destination DB/object/hash/state/ACL verification are implementation prerequisites for existing release recovery. They do not complete Yorkie, IdP/key custody, scheduled retention or actual SaaS/internal-install disaster recovery. No production traffic switch is assigned.

Concrete product source handoffs are prepared for #405 Word, #406 Slides and #407 Site. Their runtime/native-content/local-authority boundaries are source evidence, not passed integration tests. #405 is now verified and closed. Candidate 6faa26e01449c4ad1e58acbbd25a97f71dfe55a4 and accepted local develop cb96b76b89216964ae78324fdf640cc2ac839140 have identical clean trees. Actual OIDC/UI/API/private PostgreSQL runs pass2/2 on candidate and integration; shared auth55/55, runtime/native13/13, transport/codec26/26, standalone3/3, real Note boundary1/1 and integrated Word11/11/unit26/26 pass, with required Node/pnpm preflight exit0 and11 independently matched manifest hashes. Seven-criterion closure evidence and committed docs/verification/word-authenticated-snapshot-405.md bind native content, real failures/retry, same-DB API/browser restart, two writers/conflict, viewer refusal, A→B→A scope and preserved originals. Retained failed exploratory runs are not passes. These are snapshot-mode proofs, not Yorkie convergence or device confidentiality.

The #408 directory handoff maps current bounded member-list DTO, private owner provisioning, immutable migrations and transaction boundaries. Execute implements #408's directory contract first, then #377's actual stale-identification guard, then #378's visible confirmation and both administrator scopes. Reading a directory row before a separate role mutation does not prove a race-safe guard. No duplicate role API, invitation or parallel assignment is created.

#413 semantic company-document research is tracked separately as research intake. It is not an assigned implementation, new alpha gate or authorization for another data platform. Current product and backend priorities remain unchanged.

Existing #331, #332 and #343 are bounded core/UI fallbacks or later release cleanup. Their retained old group fixes differ from the current integration; branch existence or old isolated passes cannot close them. No parallel active assignment is created.

Goal and release boundary

Yorkie upstream/parser work remains paused under the owner direction. Snapshot persistence can progress while it is paused, but is not realtime collaboration. #366, #367, #368 and all four product collaboration parents keep their original requirements. Preserve all existing Note features and supported native content; a plain-text-only diagnostic does not satisfy alpha.

External alpha still requires actual local PostgreSQL/API/product UI/Yorkie integration and two authorized users for Note, Word, Slides and Site, including convergence, reconnect/restart, actor-safe undo, current ACL/revocation and protection against stale snapshot overwrite. Company admin and whole-service operator requirements remain separate. A liveness response or SDK demo does not prove the stack ready; current readiness, installation/recovery, privacy and final release evidence must be validated within their existing scope.

Close an Issue only after its own acceptance passes on a local integrated commit, recording exact local SHAs and verification. Keep partial foundations, full product parents and #322 open for their remaining requirements. Do not infer release/deployment authorization from local test success or this page.

Proactive queue maintenance

The owner requires Planner to discover missing goal-aligned implementation Issues without waiting for a repeated request. Compare exact integrated source with open/closed Issues, then define bounded scope, evidence, dependencies, priority, acceptance and verification. New children do not interrupt active work or count as completed requirements. Close only acceptance proven on local integration. #416 was deduplicated against210 existing Issues; its dependencies are still pending.

The real Slides/Site test handoff identifies current Note-only integrated DB inspection and the preserved Word-only extension. #406/#407 must extend the same private test-owned product inspection, null pageId semantics and explicit real-test selection after #405 integrates. Actual DB/receipt/native hash/current ACL/same-DB restart evidence remains required; no extra privileged product API or new test platform is assigned.

#417 local Site publication is a newly deduplicated WAIT_DEPENDENCY goal milestone after #407/#416, selected after #419, which follows existing #414. It reuses native export/assets and owns immutable saved-revision files, explicit publication authority, isolated loopback visitor origin, atomic activation and previous-version recovery. It does not authorize external hosting, publish customer content or add a first-alpha gate. Planner inspected accepted cb96b76 and211 prior open/closed Issues before creation. Current #406/next #407 ownership is unchanged; completed #415 evidence is preserved.