sync(desktop): propagate finalized packaging runtime into UX epic - #2030
Merged
integry merged 100 commits intoSep 1, 2026
Conversation
added 30 commits
August 29, 2026 17:56
![propr-dev[bot]](https://github.githubassets.com/images/gravatars/gravatar-user-420.png){kind=avatar}
…updates, and Implemented by ProPR AI using gpt-5.6-sol model. Implementation completed successfully.
…7/gpt-5.6-sol-add-cross-platform-deskto-20260829-1735-0gu Automatically resolved merge conflicts after merging target branch into PR branch. Resolved conflicts in: - .github/workflows/desktop-release-guard.yml - apps/desktop/package.json - apps/desktop/vite.renderer.config.ts PR: #1972 Model: gpt-5.6-sol
Implemented the PR follow-ups. - DEB and RPM makers now explicitly use `bin: 'propr-desktop'` in [forge.config.ts](/tmp/git-processor/worktrees/integry/propr/pr-1972-followup-2026-08-29T18-16-06/apps/desktop/forge.config.ts). - Added a real Forge-config regression in [release-config.test.ts](/tmp/git-processor/worktrees/integry/propr/pr-1972-followup-2026-08-29T18-16-06/apps/desktop/src/release-config.test.ts), verifying both makers match `packagerConfig.executableName` and never resolve `@propr/desktop`. - Removed only the requested five EOF blank lines. - Preserved the native x64/arm64 workflow matrix. Verification passed: - Desktop typecheck - Desktop tests: 37/37 - Native Linux x64 DEB, RPM, and ZIP creation - `dpkg-deb`, `rpm`, and `unzip` inspection - DEB/RPM both contain `/usr/bin/propr-desktop -> ../lib/propr-desktop/propr-desktop` - All three artifacts staged with checksums successfully - Working-tree and PR-base `git diff --check` The temporary staging output was removed afterward to avoid committing ~300 MB of generated binaries; artifacts remain reproducible under the ignored `apps/desktop/out/make` directory. No commit was created. PR: #1972 Comment by: @integry (ID: 5464034777) Comment by: @integry (ID: 5464059305) Model: gpt-5.6-sol
Implemented F1–F4 without committing. Key changes: - PR finalization is unsigned and never receives the update private key. - Signing moved behind the `desktop-release` environment, restricted to trusted tag/publish events and pinned tag SHA. - Signed schema now binds manifest URL, target, version, feed bytes, artifact URL/size/SHA-256, and actual native signer evidence. - macOS Team ID/designated requirement and Windows Authenticode subjects are verified from produced/downloaded packages. - Runtime is safely check-only; Electron `autoUpdater` is never initialized. - Manifest query strings are rejected. - Added all requested security regression tests. Verification passed: - `npm run desktop:test` — 45 tests - `npm run desktop:typecheck` - `npm run desktop:package` - `npm run desktop:smoke:inspect` - `git diff --check` The local host lacks `fakeroot`, `rpm`, and `zip`, so native DEB/RPM/ZIP creation and macOS/Windows verification remain for the six-runner CI matrix after the changes are committed. PR: #1972 Comment by: @integry (ID: 5464067090) Model: gpt-5.6-sol
…ng or merging. Implemented the runtime download hardening without committing or merging. Key changes: - Added streaming limits: 512 KiB manifest, 1 KiB signature, 1 MiB feed, and 1 GiB artifact maximum. - Added 30-second metadata and 10-minute artifact abort timeouts. - Rejects oversized `Content-Length`, chunked overflow, signed-size mismatches, and cross-origin final redirects. - Streams artifacts directly to private temporary files with incremental SHA-256 verification. - Cleans temporary files/directories on download, hash, and signer failures. - Preserved check-only behavior, Ed25519 verification, exact feed/artifact hashes, and native signer validation. Files changed: - [main.ts](/tmp/git-processor/worktrees/integry/propr/pr-1972-followup-2026-08-29T18-46-20/apps/desktop/src/main.ts:252) - [signed-updates.ts](/tmp/git-processor/worktrees/integry/propr/pr-1972-followup-2026-08-29T18-46-20/apps/desktop/src/signed-updates.ts:49) - [signed-updates.test.ts](/tmp/git-processor/worktrees/integry/propr/pr-1972-followup-2026-08-29T18-46-20/apps/desktop/src/signed-updates.test.ts:264) Validation passed: - Desktop typecheck - All 52 desktop tests - Runtime and packaging audits: 0 vulnerabilities - Linux x64 native packaging and fuse/executable inspection - `git diff --check` The full six-target native matrix cannot run locally on this Linux x64 host; it must rerun in CI after the follow-up is committed and pushed. PR: #1972 Comment by: @integry (ID: 5464201037) Model: gpt-5.6-sol
…/tmp/git-processor/worktrees/integry/propr/pr-1972-followup-2026-08-29T18-56-24/propr-ui/src/desktop/DesktopExperience.tsx). The keyboard listener now uses `useLayoutEffect`, ensuring it is current before the connected UI becomes interactive. Fixed the CI-only shortcut race in [DesktopExperience.tsx](/tmp/git-processor/worktrees/integry/propr/pr-1972-followup-2026-08-29T18-56-24/propr-ui/src/desktop/DesktopExperience.tsx). The keyboard listener now uses `useLayoutEffect`, ensuring it is current before the connected UI becomes interactive. Validation passed: - Focused tests: 21/21 - Full UI suite: 496/496 across 69 files - UI typecheck - ESLint - Whitespace check No commit was created. The file appears untracked because it originates from the newer target branch; merging that target was blocked by root-owned Git metadata (`ORIG_HEAD.lock: Permission denied`). Its content differs from the target version by exactly the two intended lines. PR: #1972 Comment by: @github-actions[bot] (ID: 5464233471) Model: gpt-5.6-sol
…7/gpt-5.6-sol-add-cross-platform-deskto-20260829-1735-0gu Automatically resolved merge conflicts after merging target branch into PR branch. Resolved conflicts in: - apps/desktop/README.md - apps/desktop/scripts/smoke-packaged.mjs - apps/desktop/vite.renderer.config.ts - propr-ui/src/desktop/DesktopExperience.tsx PR: #1972 Model: gpt-5.6-sol
…into 1957/gpt-5.6-sol-add-cross-platform-deskto-20260829-1735-0gu
…`f94a38d11563a49157cb5feb8cbcb0eaedeee46b` without committing. Implemented all requested follow-up blockers on exact head `f94a38d11563a49157cb5feb8cbcb0eaedeee46b` without committing. Key changes: - Split secretless PR validation from preflight-gated production signing in [desktop-release-guard.yml](/tmp/git-processor/worktrees/integry/propr/pr-1972-followup-2026-08-29T20-26-58/.github/workflows/desktop-release-guard.yml:24). - Added protected-main, immutable-tag, existing-release, reviewer, and tag-policy validation in [release-preflight.mjs](/tmp/git-processor/worktrees/integry/propr/pr-1972-followup-2026-08-29T20-26-58/apps/desktop/scripts/release-preflight.mjs:54), using GitHub’s documented environment protection fields ([GitHub documentation](https://docs.github.com/en/rest/deployments/environments)). - Made macOS signing/notarization, Windows Authenticode, Ed25519 signing, signer pins, and signed publication mandatory for production. - Added repeatable ELF, PE, Mach-O, DEB, RPM, ZIP/NuGet, DMG, and package-payload architecture inspection in [release-architecture.mjs](/tmp/git-processor/worktrees/integry/propr/pr-1972-followup-2026-08-29T20-26-58/apps/desktop/scripts/release-architecture.mjs:27). - Staging and finalization now independently reject wrong-architecture artifacts and invalid Squirrel metadata. - Corrected the AUMID to `com.squirrel.propr_desktop.propr-desktop`, tied to `executableName`. - Restored canonical `useEffect`, made UI tests deterministic through the title bar, and removed only the requested EOF blank line. Verification passed: - Desktop tests: 66 - UI tests: 500 - Desktop/UI typechecks - Runtime and packaging audits - Production Linux x64 package - Packaged executable/fuse smoke inspection - Workflow YAML parsing - `git diff --check` The six native CI targets and aggregate checksum job remain configured, but cannot run locally because this host is Linux x64-only and lacks `sudo` for the required native package tools. They will execute when the updated workflow runs in CI. PR: #1972 Comment by: @integry (ID: 5464706108) Model: gpt-5.6-sol
…into 1957/gpt-5.6-sol-add-cross-platform-deskto-20260829-1735-0gu
…98023adc0ac571cb82ede`. Implemented F5–F8 on synchronized head `db3d69a2788ece2273c98023adc0ac571cb82ede`. Key changes: - [release-preflight.mjs](/home/node/workspace/apps/desktop/scripts/release-preflight.mjs) now paginates repository rulesets, reads full rule definitions, and requires an active `refs/tags/desktop-v*` tag ruleset with update/deletion blocking, exact include/exclude semantics, and zero bypass actors. It re-reads the ruleset to detect mutation or deletion. - Environment deployment policies are fully paginated and must be exactly one enabled `tag: desktop-v*` policy with required reviewers and no protected-branch fallback. - [release-publish.mjs](/home/node/workspace/apps/desktop/scripts/release-publish.mjs) creates/reuses only an exact draft, uploads the checksum-derived allowlist, streams and hashes every remote asset, rejects duplicates/unexpected assets or tag drift, and publishes only after complete verification. Matching partial drafts are recoverable. - Final checksums now cover the signed manifest and signature. - Squirrel architecture validation derives the target from `propr-desktop.exe` inside the full NUPKG. Setup supports PE x86/x64/arm64 independently of payload architecture. - Added pagination, bypass/mutation/deletion, partial-upload recovery, digest mismatch, tag drift, and arm64 payload/bootstrap regressions. Verification: - `node --test ...release-preflight.test.mjs ...release-publish.test.mjs ...release-artifacts.test.mjs` — 21/21 passed. - `npm run desktop:typecheck` — passed desktop and UI. - `npm run desktop:test` — 78/78 passed. - Actionlint 1.7.12, checksum-verified, `-shellcheck=` — passed. - Targeted ESLint for changed scripts — passed. - `npm run desktop:package && npm run desktop:smoke:inspect` — Linux x64 package and fuse inspection passed. - `git diff --check` — passed. Repository prerequisites: - GitHub must expose a qualifying bypass-free tag ruleset to the preflight token; missing or ambiguous `bypass_actors` fails closed. - `desktop-release` must have required reviewers and exactly the `desktop-v*` tag deployment policy. - The genuine six-target matrix requires its native Linux/macOS/Windows x64/arm64 CI runners and signing/notarization configuration. - GUI sandbox launch smoke was unavailable locally because `xvfb-run` is absent and the packaged sandbox is not installed root-owned/setuid. Per the selected-record constraint, Linux payload layout, CRLF handling, README, and `DesktopExperience.test.tsx` were not changed. Consequently, `npm run lint -w propr-ui -- --max-warnings 0` still reports the pre-existing 401-line max-lines warning. No repository settings or real releases were created or modified. PR: #1972 Comment by: @integry (ID: 5464902997) Model: gpt-5.6-sol
…release-security files. Implemented all four follow-ups without modifying F5–F8 or release-security files. - Enforced explicit, format-aware DEB/RPM payload and launcher layouts in [release-architecture.mjs](/tmp/git-processor/worktrees/integry/propr/pr-1972-followup-2026-08-29T21-27-10/apps/desktop/scripts/release-architecture.mjs). - Added focused layout rejection tests in [release-architecture.test.mjs](/tmp/git-processor/worktrees/integry/propr/pr-1972-followup-2026-08-29T21-27-10/apps/desktop/scripts/release-architecture.test.mjs). - Normalized workflow text and added CRLF matrix coverage. - Extracted the connected-experience render helper; UI lint now passes with zero warnings. - Updated tag-triggered preflight/environment documentation. Validation passed: - `git diff --check` - actionlint 1.7.12 - UI lint with `--max-warnings 0` - Desktop/UI typechecks - Desktop tests: 84 passed - UI tests: 501 passed - Real Linux x64 DEB/RPM/ZIP make - Real archive inspection and architecture-verified staging - Executable/fuse smoke inspection Full GUI smoke was attempted but this unprivileged container cannot configure `chrome-sandbox` as root-owned mode `4755` and disallows user namespaces; Electron correctly failed closed. The native Linux jobs perform that setup. The full six-target native matrix remains for CI on the new head. PR: #1972 Comment by: @integry (ID: 5464979817) Model: gpt-5.6-sol
…itting. Implemented F9–F11 on the exact requested head without committing. - F9: Added a protected `desktop-release-preflight` environment, SHA-pinned GitHub App token action, explicit Administration/Contents read-only permissions, isolated preflight credentials, fail-closed bypass inspection, API-shaped tests, workflow assertions, and operator documentation. - F10: ZIP/NUPKG validation now checks every entry, local/central consistency, CRC, paths, collisions, overlaps, encryption, metadata limits, and canonical executable locations. DMGs require the exact application bundle layout. Windows Authenticode inspection now uses the canonical NUPKG executable. - F11: RELEASES parsing now requires the complete exact full-NUPKG set and verifies SHA-1 plus decimal size during staging, finalization, and signing. Validation passed: - actionlint - 93 desktop tests - 501 UI tests - Desktop and UI typechecks - Runtime and packaging audits: zero vulnerabilities - Linux production package and fuse inspection - Strict validation of a ZIP built from the real packaged Linux application - `git diff --check` Environment limitations: - Forge DEB/RPM/ZIP make is blocked by missing system tools: `dpkg`, `fakeroot`, `rpm/rpmbuild`, `cpio`, and `zip`. - The full suite reached 191/328 files without assertion failures, then blocked because Redis is not installed. - The six native CI jobs remain intact for rerun. - Windows thumbprint-policy changes were not included because the scope gate selected F9–F11 only. PR: #1972 Comment by: @integry (ID: 5465175214) Model: gpt-5.6-sol
…c1e0` follow-up without merging, syncing, or committing. Implemented the exact `ef737aacf73c77e4fa6c8a6d59dc3e5a16bbc1e0` follow-up without merging, syncing, or committing. Key changes: - Hardened DMG layout validation and added realistic Electron helper/install-link fixtures. - Added canonical Windows certificate/SPKI SHA-256 allowlists, signer equality checks, timestamp/chain validation, evidence propagation, and runtime enforcement. - Added missing, malformed, same-subject/different-key, mixed-signer, and tamper tests. - Preserved macOS Team ID/designated-requirement behavior and F9–F11. Passing locally: - Desktop typecheck - 97 desktop tests - 51 focused release/security tests - Runtime and packaging audits: 0 vulnerabilities - Linux package build and executable/fuse inspection - MJS syntax checks - `git diff --check` Host-limited gates: - Linux makers lack `fakeroot`, RPM, and ZIP tools. - Full suite reached 191/328 without failures, then stalled because Redis is unavailable. - Actionlint and six native matrix/aggregate finalization require CI; Docker and native runners are unavailable locally. No unrelated files changed. PR: #1972 Comment by: @integry (ID: 5465401089) Model: gpt-5.6-sol
…re.test.mjs](/tmp/git-processor/worktrees/integry/propr/pr-1972-followup-2026-08-29T23-31-51/apps/desktop/scripts/release-architecture.test.mjs:203). Implemented the narrow test-only fix in [release-architecture.test.mjs](/tmp/git-processor/worktrees/integry/propr/pr-1972-followup-2026-08-29T23-31-51/apps/desktop/scripts/release-architecture.test.mjs:203). - Split hostile DMG scenarios into independent tests and cleanup hooks. - Skip case-collision validation only when the filesystem returns `EEXIST`; unexpected errors still fail. - Production DMG validation, Windows signer-pin logic, workflows, and base remain untouched. Validation passed: - Focused architecture tests: 12/12 - Linux desktop suite: 101/101 - Desktop typecheck - Validate Changes’ Redis-free stages: release verification, 278 unit tests, 316 tunnel tests, 66 UI tests, CLI packaging - [actionlint v1.7.12](https://github.com/rhysd/actionlint/releases/tag/v1.7.12) - `git diff --check` The full suite reached 187/328 before Redis-dependent tests retried against unavailable Redis; this host has neither Redis nor Docker. The six native packaging jobs and native macOS x64/arm64 runs require CI runners and remain pending after the system commits the change. PR: #1972 Comment by: @integry (ID: 5465506808) Model: gpt-5.6-sol
…c5d0745785c4a43808d944764c6f0b00`; no base sync or merge. Implemented the two requested fixes on exact head `fb14a297c5d0745785c4a43808d944764c6f0b00`; no base sync or merge. - [release-architecture.mjs](/tmp/git-processor/worktrees/integry/propr/pr-1972-followup-2026-08-29T23-49-00/apps/desktop/scripts/release-architecture.mjs:332) now permits only bounded, strict-UTF-8 symlinks inside canonical macOS `.framework` internals. Resolution rejects traversal, cycles, missing/case-mismatched targets, alternate apps, helpers, canonical executables, duplicates, and all other special files—after ZIP metadata, size, CRC, overlap, and decompression validation. - [release-artifacts.test.mjs](/tmp/git-processor/worktrees/integry/propr/pr-1972-followup-2026-08-29T23-49-00/apps/desktop/scripts/release-artifacts.test.mjs:505) covers the real Electron framework link topology and all requested hostile cases. - [release-architecture.test.mjs](/tmp/git-processor/worktrees/integry/propr/pr-1972-followup-2026-08-29T23-49-00/apps/desktop/scripts/release-architecture.test.mjs:135) skips only the filesystem-backed DMG suite on Windows. Production `/Applications` validation is unchanged. - [release-workflow.test.ts](/tmp/git-processor/worktrees/integry/propr/pr-1972-followup-2026-08-29T23-49-00/apps/desktop/src/release-workflow.test.ts:149) proves both macOS architectures run the complete suite unconditionally. Passed locally: - Desktop typecheck and all 104 desktop tests - Focused archive/workflow tests - Windows-platform simulation confirms only the DMG suite skips - Desktop audits: zero vulnerabilities - Validate Changes host-runnable stages: release verification, 278 unit tests, 316 tunnel regressions, 66 UI tests, CLI package - Actionlint 1.7.12 from the [official releases](https://github.com/rhysd/actionlint/releases) - `git diff --check` Native six-target packaging/staging and real Forge DMG confirmation remain CI-only. This host lacks macOS/Windows runners, Docker/Redis, and Linux maker utilities without sudo. The full suite reached 190/328 files green before Redis-dependent tests blocked on `ECONNREFUSED`. The cached real Electron 44 Darwin ZIP confirms the accepted framework link payloads exactly. PR: #1972 Comment by: @integry (ID: 5465582041) Model: gpt-5.6-sol
…t `f088817cd9fc95581ffe665fcdceaf2064779c41`; no merge, sync, or commit performed. Implemented only the aggregate DMG finalization fix on exact `f088817cd9fc95581ffe665fcdceaf2064779c41`; no merge, sync, or commit performed. - Native macOS staging now mounts and validates final DMG bytes before emitting strict versioned evidence. - Linux aggregation verifies hashes, sizes, bindings, and Mach-O bytes while relying exclusively on native evidence for DMG filesystem semantics. - Added all requested tampering, cross-target, schema, duplicate, marker, sanitized-7z, and workflow regressions. - Existing signer pins, ZIP/NUPKG validation, publication permissions, and runtime verification remain unchanged. Key files: [release-artifacts.mjs](/tmp/git-processor/worktrees/integry/propr/pr-1972-followup-2026-08-30T00-21-53/apps/desktop/scripts/release-artifacts.mjs), [release-architecture.mjs](/tmp/git-processor/worktrees/integry/propr/pr-1972-followup-2026-08-30T00-21-53/apps/desktop/scripts/release-architecture.mjs), [desktop-release-guard.yml](/tmp/git-processor/worktrees/integry/propr/pr-1972-followup-2026-08-30T00-21-53/.github/workflows/desktop-release-guard.yml). Validation passed: - Desktop tests: 110/110 - Desktop typecheck - Validate Changes command set, including 278 fast tests and hosted-tunnel regressions - Full Suite: all 328 suites/files - Exact SHA-pinned actionlint - Sixteen-artifact `SHA256SUMS` verification - `git diff --check` The six real native package jobs require the post-commit CI matrix; this Linux runner cannot execute macOS and Windows native packaging. PR: #1972 Comment by: @integry (ID: 5465718687) Model: gpt-5.6-sol
…0fcc8cc9e2070921e0ffbc79a3e2b004c89da89`. Implemented the two requested DMG blockers on exact head `20fcc8cc9e2070921e0ffbc79a3e2b004c89da89`. - Added strict pre/post DMG identity, metadata, size, and SHA-256 verification around native inspection in [release-artifacts.mjs](/tmp/git-processor/worktrees/integry/propr/pr-1972-followup-2026-08-30T00-53-41/apps/desktop/scripts/release-artifacts.mjs:160). - Hardened mounted layouts to allow only bounded framework-internal symlinks and require real canonical bundle/executable ancestors in [release-architecture.mjs](/tmp/git-processor/worktrees/integry/propr/pr-1972-followup-2026-08-30T00-53-41/apps/desktop/scripts/release-architecture.mjs:803). - Added mutation/replacement, helper symlink, ancestor symlink, non-framework, escape/cycle/missing/case, real Electron framework, and complete SHA256SUMS regressions. Passed locally: - Focused staging/layout: 39/39 - Desktop suite: 115/115 - Desktop typecheck - Fast validation unit set: 278/278 - Release metadata verification - ESLint on all touched files - `git diff --check` Native macOS mounts, six native packaging jobs, full Redis-backed suite, and pinned-container actionlint require CI runners unavailable in this Linux environment. No commit was created; signer pins, evidence schema, six-target matrix, and Linux finalization remain unchanged. PR: #1972 Comment by: @integry (ID: 5465850564) Model: gpt-5.6-sol
…yncing, or committing. Implemented the exact-head DMG follow-up without merging, syncing, or committing. Key changes: - DMG validation now uses a private `O_RDONLY | O_NOFOLLOW` held capability; inspectors receive no mutable pathname. - `hdiutil` and Linux aggregate 7-Zip inspection read inherited `/dev/fd/3`. - Pre/post checks retain device, inode, mode, link count, size, and SHA-256 while excluding ctime/mtime. - Validated bytes are copied through private `O_EXCL` publication temps, atomically published, and revalidated. - Added swap/restore, permanent replacement, in-place mutation, and native xattr/ctime regressions. - Added fail-closed descriptor-backed `hdiutil` probes to both macOS matrices while preserving all six targets and evidence schema. Changed files include [release-artifacts.mjs](/home/node/workspace/apps/desktop/scripts/release-artifacts.mjs), [release-architecture.mjs](/home/node/workspace/apps/desktop/scripts/release-architecture.mjs), and [desktop-release-guard.yml](/home/node/workspace/.github/workflows/desktop-release-guard.yml). Passed locally: - Focused artifact/layout tests: 40 passed, native xattr fixture skipped on Linux - Desktop suite: 116 passed, 1 native-only skip - Desktop typecheck - Aggregate finalization/SHA256SUMS tests - Validate Changes components, fast unit tests, hosted-tunnel regressions, and CLI package verification - actionlint - `git diff --check` Full Suite reached 191/328 with changes green, then blocked because this host lacks the CI Redis/Docker service. Native macOS x64/arm64 mount probes and the six native packaging jobs require their CI runners. PR: #1972 Comment by: @integry (ID: 5465939422) Model: gpt-5.6-sol
…a67d2ff46758b6086faf40aac68619f9` without merging or committing. Implemented the two requested fixes on exact head `bcc73729a67d2ff46758b6086faf40aac68619f9` without merging or committing. - [release-artifacts.mjs](/tmp/git-processor/worktrees/integry/propr/pr-1972-followup-2026-08-30T01-45-33/apps/desktop/scripts/release-artifacts.mjs) now creates held, randomized private snapshots outside public output with strict mode/link/identity checks and atomic held-byte publication. - [release-architecture.mjs](/tmp/git-processor/worktrees/integry/propr/pr-1972-followup-2026-08-30T01-45-33/apps/desktop/scripts/release-architecture.mjs) mounts the internal private pathname with readonly hdiutil; `/dev/fd` hdiutil support and its probe were removed. - Both macOS workflow targets now run a real private-snapshot isolation probe that swaps original/public paths while mounted. - Added mutation/replacement and A/B evidence/publication regressions. - [release-workflow.test.ts](/tmp/git-processor/worktrees/integry/propr/pr-1972-followup-2026-08-30T01-45-33/apps/desktop/src/release-workflow.test.ts) normalizes all loaded fixtures to LF while retaining ordering and matrix assertions. Passed locally: - Desktop suite: 117 passed, 1 macOS-only skip - Fast unit suite: 278 passed - Desktop/UI typecheck - Focused artifact/layout/workflow tests - SHA256SUMS artifact verification regression - Changed-script ESLint and syntax checks - Workflow YAML parsing - `git diff --check` CI-only/infrastructure-blocked here: - Native macOS/Windows jobs and packaging - actionlint container: Docker/actionlint unavailable - Full Suite reached 167/328 with completed tests passing, then required unavailable Redis and was stopped. PR: #1972 Comment by: @integry (ID: 5466066908) Model: gpt-5.6-sol
Implemented F12 only. - macOS signer verification now targets exactly `extracted/propr-desktop.app`. - Rejects missing or symlinked canonical bundles. - Rejects additional top-level payloads, including signed decoy apps, before `codesign`. - Added regressions covering valid, decoy, symlink, and missing layouts. Changed: - [signed-updates.ts](/tmp/git-processor/worktrees/integry/propr/pr-1972-followup-2026-08-30T03-13-19/apps/desktop/src/signed-updates.ts:444) - [signed-updates.test.ts](/tmp/git-processor/worktrees/integry/propr/pr-1972-followup-2026-08-30T03-13-19/apps/desktop/src/signed-updates.test.ts:99) Verification passed: - Desktop tests: 118 passed, 1 skipped - Desktop typecheck - `git diff --check` No commit was created. PR: #1972 Comment by: @integry (ID: 5466411650) Model: gpt-5.6-sol
…d735085bdc57` without committing, merging, or syncing. Implemented F13 on exact head `f4cfdcd717be70804f435ef3955bd735085bdc57` without committing, merging, or syncing. - Added `permission-actions: read` beside administration/contents read in [desktop-release-guard.yml](/tmp/git-processor/worktrees/integry/propr/pr-1972-followup-2026-08-30T03-38-36/.github/workflows/desktop-release-guard.yml:268). - Updated exact least-privilege and endpoint fixtures in [release-workflow.test.ts](/tmp/git-processor/worktrees/integry/propr/pr-1972-followup-2026-08-30T03-38-36/apps/desktop/src/release-workflow.test.ts:20). - Preserved credential non-persistence, single redacted token consumption, all write-permission rejection, and rejection of `permission-environments`. - Confirmed both endpoints require Actions read in GitHub’s official [environment](https://docs.github.com/en/rest/deployments/environments) and [deployment branch policy](https://docs.github.com/en/rest/deployments/branch-policies) documentation. Passed: - Clean `npm ci` - Focused release/preflight/artifact/signed-update tests - Desktop tests, typecheck, and package - Actionlint 1.7.12 - Validate Changes’ non-container stages - Full Suite: all 327 files plus workspace suites - `git diff --check` The six native matrix jobs and real aggregate artifact finalization require their Linux ARM64, macOS, and Windows CI runners and could not run on this Linux x64 host. The configured Docker-based actionlint/Redis steps were unavailable; equivalent official binaries were used locally. Only the two intended F13 files are modified. PR: #1972 Comment by: @integry (ID: 5466511035) Model: gpt-5.6-sol
…ede8b18b` without committing, merging, syncing, or changing release workflows. Implemented on exact head `fe26f938c7ea8c2ae276f0abbb5079fdede8b18b` without committing, merging, syncing, or changing release workflows. Key changes: - Strict bounded Squirrel `RELEASES` parsing and canonical filename/version/size/SHA-1 validation. - SHA-1 and signed SHA-256 computed from the same held no-follow descriptor before signer verification and handoff. - Explicit `applySignedUpdate` path; startup remains check-only. - Owner-private, atomic, fsynced, ten-minute single-artifact cache keyed to origin/channel/version/manifest digest/artifact SHA-256. - Cache reauthentication, signer/notarization checks, serialization, expiry, corruption and partial cleanup, and safe redownload. - Redacted runtime update failures without paths or tokens. - Adversarial RELEASES, cache, request-count, concurrency, ABA, link, corruption, cancellation, Windows/macOS/Linux behavior tests. Changed files: - [signed-updates.ts](/tmp/git-processor/worktrees/integry/propr/pr-1972-followup-2026-08-30T04-21-41/apps/desktop/src/signed-updates.ts) - [signed-updates.test.ts](/tmp/git-processor/worktrees/integry/propr/pr-1972-followup-2026-08-30T04-21-41/apps/desktop/src/signed-updates.test.ts) - [main.ts](/tmp/git-processor/worktrees/integry/propr/pr-1972-followup-2026-08-30T04-21-41/apps/desktop/src/main.ts) Passed: - Clean `npm ci` - Focused signed-update tests: 37/37 - Desktop tests: 139 passed, 1 platform skip - Desktop and UI typecheck - Desktop production package and fuse inspection - Release-artifact, Squirrel, and workflow tests - Fast unit suite: 278/278 - Release verification and CLI package validation - `git diff --check` The six native runner jobs, aggregate native finalization, actionlint container, and Redis-backed Full Suite require CI/Docker/native environments unavailable on this host. All release workflow gates and protected production sign/publish jobs remain untouched. PR: #1972 Comment by: @integry (ID: 5466671929) Model: gpt-5.6-sol
…547fce67974f351d929c14de350ae2` without merging, syncing, or committing. Implemented the follow-up changes on exact head `a0470086c6547fce67974f351d929c14de350ae2` without merging, syncing, or committing. Key changes: - Added Windows-native SID/DACL/reparse/link-count/full `FILE_ID_128` authority inspection and protected cache creation in [windows-update-authority.ts](/tmp/git-processor/worktrees/integry/propr/pr-1972-followup-2026-08-30T04-47-41/apps/desktop/src/windows-update-authority.ts). - Replaced security-sensitive numeric identities with bigint/canonical lossless identifiers. - Replaced raw installer path handoff with a one-shot held-byte capability. Windows retains a no-write/delete-share reader; signer verification uses private held snapshots; unsupported apply adapters fail closed. - Added serialized crash-stale cleanup, exact namespace allowlisting, case-collision detection, one-artifact enforcement, and total-byte quotas. - Added Windows-native owner/ACE/junction/lock tests and portable identity, quota, redownload, and swap/delete/hardlink/reparse/ABA fixtures. Local verification passed: - Clean `npm ci` - Desktop tests: 157 tests, 0 failures - Desktop and UI typecheck - Linux desktop package - Focused signed-update/Squirrel/cache/race tests - `git diff --check` Not claiming completion yet: - Windows x64/arm64 native tests, macOS native snapshot tests, six native package jobs, and 16-artifact aggregation require CI runners. - Actionlint was unavailable locally. - Full Suite passed through 192/329 files, then was stopped because this runner lacks the configured Redis service and Docker. PR: #1972 Comment by: @integry (ID: 5466767959) Model: gpt-5.6-sol
… is not claimed until native CI passes. Implemented the requested follow-up changes, but completion is not claimed until native CI passes. Key changes: - Added explicit Windows-hosted DMG fixture authority while retaining real Darwin UID and 0700/0600 enforcement in [release-artifacts.mjs](/tmp/git-processor/worktrees/integry/propr/pr-1972-followup-2026-08-30T05-22-58/apps/desktop/scripts/release-artifacts.mjs). - Replaced the split Windows reader/inspector with one `CreateFileW` exact-handle broker in [windows-update-authority.ts](/tmp/git-processor/worktrees/integry/propr/pr-1972-followup-2026-08-30T05-22-58/apps/desktop/src/windows-update-authority.ts). It verifies reparse state, owner SID, protected DACL/ACEs, link/type/size, volume and full `FILE_ID_128`, SHA-1/SHA-256, no-share locking, challenges, and final identity. - Removed brittle unsafe `Add-Type` compilation and added bounded enumerated diagnostics and native smoke/crash-restart coverage. - Bound apply-time consumption to broker-held bytes with fresh pre/post-launch challenges and no raw path. - Added bounded `opendir` inspection, whole-cache quarantine, capped cleanup, and overflow/depth/name/symlink-loop/restart tests in [signed-updates.ts](/tmp/git-processor/worktrees/integry/propr/pr-1972-followup-2026-08-30T05-22-58/apps/desktop/src/signed-updates.ts). Passed locally: - Clean `npm ci` — 0 vulnerabilities - Desktop/UI typecheck - Desktop suite — 166 tests, 157 passed, 9 native-platform skips - Desktop Linux package and packaged fuse/executable smoke - Focused release, cache, Squirrel and signed-update suites - `git diff --check` Outstanding mandatory CI gates: - Actual Windows x64 and arm64 broker/handoff/adversarial tests - Native macOS x64/arm64 held-snapshot tests - Six native unsigned packaging jobs and aggregate finalization - Actionlint, unavailable locally - Full Suite remainder: reached test file 188/329 with completed tests green, then blocked by missing Redis/Docker No merge, runtime sync, commit, or PR creation was performed. PR: #1972 Comment by: @integry (ID: 5466899230) Model: gpt-5.6-sol
…ing, merging, or syncing runtime: Implemented the requested follow-up changes without committing, merging, or syncing runtime: - Replaced Windows `-EncodedCommand` with bounded stdin transport to absolute System32 PowerShell, strict protocol parsing, output/runtime caps, and fail-closed stderr/exit handling. - Added pre-suite Windows broker smoke coverage and deterministic pre-`CreateFileW` acquisition barriers. - Added A→B→A, deletion, reparse, and hardlink acquisition tests preventing signer, reader, or installer exposure. - Added ordered macOS private-DMG authority codes and native mode/owner/link/type/symlink tests. - Added fixed-slot, cursor-based incremental quarantine collection with global backlog limits and eventual-cleanup tests. Local validation passed: - Clean `npm ci` - Desktop tests: 172 tests, 161 passed, 11 platform skips - Desktop typecheck and Linux package - Release verification - Unit tests: 278 passed - `git diff --check` I am not claiming full completion: this Linux host cannot execute the Windows/macOS native cases or six-job/16-artifact matrix. Docker is also unavailable, blocking actionlint and isolated Redis; the local full-suite runner reached all 329 files, but `llmMetrics.test.ts` timed out waiting for Redis. The native matrix must now run and pass on both Windows and macOS architectures. PR: #1972 Comment by: @integry (ID: 5467069180) Model: gpt-5.6-sol
…41282e0e` without merging, syncing, or committing. Implemented on exact head `8556ed513fc516839e99a6deb04b263241282e0e` without merging, syncing, or committing. Key changes: - Replaced per-entry PowerShell compilation with a process-wide persistent Windows authority broker. - Added bounded startup/compile deadline, strict ready/native-smoke frame, 10-second request deadlines, FIFO serialization, AbortSignal support, protocol/byte/frame caps, one-time restart, and shutdown reaping. - Preserved same-handle authority, hashing, held reads/apply, final verification, and no-share locking. - Added compileCount=1, warm aggregate latency, queueing, cancellation, crash/restart, framing, compile-failure, and leak tests. - Fixed Darwin assertions to compare exact `error.message`; fixtures now use the native x64/arm64 architecture. Changed files: - [windows-update-authority.ts](/tmp/git-processor/worktrees/integry/propr/pr-1972-followup-2026-08-30T06-49-51/apps/desktop/src/windows-update-authority.ts) - [windows-update-authority.test.ts](/tmp/git-processor/worktrees/integry/propr/pr-1972-followup-2026-08-30T06-49-51/apps/desktop/src/windows-update-authority.test.ts) - [release-artifacts.test.mjs](/tmp/git-processor/worktrees/integry/propr/pr-1972-followup-2026-08-30T06-49-51/apps/desktop/scripts/release-artifacts.test.mjs) - [release-workflow.test.ts](/tmp/git-processor/worktrees/integry/propr/pr-1972-followup-2026-08-30T06-49-51/apps/desktop/src/release-workflow.test.ts) Passed locally after clean `npm ci`: - Desktop tests: 176 tests, 162 passed, 14 native-platform skips - Desktop/UI typecheck - Linux desktop package - Workspace preparation - Docs typecheck/build - `git diff --check` Completion remains pending CI evidence: this host cannot run Windows/macOS native jobs, and Docker is unavailable, preventing the pinned actionlint container and Docker-backed Redis Full Suite. Therefore I am not claiming the Windows x64/arm64 compile-once latency gate or six native jobs have passed. PR: #1972 Comment by: @integry (ID: 5467234747) Model: gpt-5.6-sol
… or committing. Implemented the follow-up changes without merging, syncing, or committing. Key changes: - Added an exact-production C# compile probe with bounded stages and legacy Windows PowerShell/C# 5 compatibility in [windows-update-authority.ts](/tmp/git-processor/worktrees/integry/propr/pr-1972-followup-2026-08-30T07-19-20/apps/desktop/src/windows-update-authority.ts). - Added strict setup/artifact purpose binding, zero-length setup support, exact positive artifact size/identity/SHA-256 enforcement, and live broker fault injection. - Replaced `cmd mklink` fixtures with native Node junction APIs and reparse assertions. - Added compile/startup, framing, cancellation, queued failure, restart, lock-release, and stale-state tests. - Hardened DMG detach cleanup and added a single bounded `hdiutil create` resource-busy retry using fresh private staging/output paths. - Added the compile probe before both Windows x64/arm64 suites in [desktop-release-guard.yml](/tmp/git-processor/worktrees/integry/propr/pr-1972-followup-2026-08-30T07-19-20/.github/workflows/desktop-release-guard.yml). Local validation passed: - Clean `npm ci` - Desktop typecheck and all 180 desktop tests - Desktop package and fuse inspection - Focused cache, signed-update, Squirrel, release, DMG, and workflow tests - Runtime/desktop audits - Release verification, fast unit tests, tunnel regressions, CLI packaging, workspace build, and docs build - [actionlint v1.7.12](https://github.com/rhysd/actionlint/releases/tag/v1.7.12) - `git diff --check` Completion is not claimed yet: this host cannot execute Windows or macOS native jobs, the six-target artifact matrix, aggregate checksum job, or Redis-backed Full Suite. Both real Windows architectures must still report probe `ready`, production `compileCount=1`, and pass their complete native suites; Darwin x64/arm64 packaging must also rerun successfully. PR: #1972 Comment by: @integry (ID: 5467351315) Model: gpt-5.6-sol
…merging, syncing, or committing. Implemented the Windows broker bootstrap follow-up without merging, syncing, or committing. Key changes: - Replaced double-base64/double-bootstrap with one fixed PowerShell `EncodedCommand`. - Added fixed-width length prefix plus bounded raw strict UTF-8 C# transport. - Preserved stdin for the persistent serialized request protocol and compile-once child. - Added all requested stages, bounded stderr stage/index reporting, startup failure classification, deadlines, backpressure, and structured post-READY errors. - Added native stage injection, byte-at-a-time production-source fragmentation, multibyte UTF-8, partial/oversize/trailing source, and early-exit tests. - Preserved existing authority, purpose, junction, quarantine, Squirrel, and native workflow assertions. Changed: - [windows-update-authority.ts](/tmp/git-processor/worktrees/integry/propr/pr-1972-followup-2026-08-30T07-52-03/apps/desktop/src/windows-update-authority.ts:65) - [windows-update-authority.test.ts](/tmp/git-processor/worktrees/integry/propr/pr-1972-followup-2026-08-30T07-52-03/apps/desktop/src/windows-update-authority.test.ts:36) - [release-workflow.test.ts](/tmp/git-processor/worktrees/integry/propr/pr-1972-followup-2026-08-30T07-52-03/apps/desktop/src/release-workflow.test.ts:263) Local verification passed: - Clean `npm ci` — zero vulnerabilities - Release metadata verification - Fast unit suite — 278 passed - Desktop focused and complete tests - Desktop and UI typechecks - Linux desktop production package - `git diff --check` The hosted Windows x64/arm64 READY probes, full native suites, Darwin gates, and aggregate artifact jobs remain to be proven by CI. Containerized actionlint and configured Full Suite could not run locally because this host has neither Docker nor Redis, so I am not claiming hosted/native completion. PR: #1972 Comment by: @integry (ID: 5467483975) Model: gpt-5.6-sol
…8d20c9bb` without merging, syncing, or committing. Implemented on exact head `b6fcd421a809713157826f736f69bb118d20c9bb` without merging, syncing, or committing. Key changes: - Replaced PowerShell stdin bootstrap with a directly spawned AnyCPU broker executable from committed [C# source](/tmp/git-processor/worktrees/integry/propr/pr-1972-followup-2026-08-30T08-20-18/apps/desktop/src/native/propr-windows-authority.cs). - Added trusted-SystemRoot bounded compilation, held-output verification, deterministic manifest generation, packaged-helper inspection, and direct READY probes. - Added length-prefixed persistent binary framing, helper/process-image authentication, job-object cleanup, DACL/reparse/full identity/hash checks, and requested fault tests. - Packaged the helper and manifest as Windows extra resources and added exact NUPKG/layout inspection. - Updated the six-target workflow so Windows x64/arm64 build and directly exercise both source-built and packaged helpers. Local verification: - Desktop tests: 189 total, 168 passed, 21 platform-native skipped, 0 failed. - Desktop/UI typecheck: passed. - Linux production package and packaged smoke: passed. - Workflow YAML parse: passed. - `git diff --check`: passed. I am not claiming release completion yet: Windows x64/arm64 direct-helper execution, all six native artifacts, actionlint, Full Suite, and aggregate release gates still require the configured CI runners. Actionlint/docker were unavailable on this host. PR: #1972 Comment by: @integry (ID: 5467602785) Model: gpt-5.6-sol
…cc3d48df01fd126e6ecbe2ae07`. Implemented MSI correction F2 on exact head `e1b318ffa2c139cc3d48df01fd126e6ecbe2ae07`. - Kept `ProgramMenuFolder`. - Restored the shortcut marker KeyPath to HKCU. - Removed `Win64="yes"` from `ApplicationStartMenuShortcutComponent`. - Preserved per-machine scope and HKLM protocol/App Paths registration. - Retained the ordinary-user common Start Menu presence/removal proof. - Removed obsolete native checks for the superseded HKLM shortcut marker. - Updated assertions to enforce the ICE-valid arrangement and reject `CommonProgramMenuFolder`. Changed only: - [build-windows-machine-installer.mjs](/tmp/git-processor/worktrees/integry/propr/pr-2034-followup-2026-08-31T21-00-00/apps/desktop/scripts/build-windows-machine-installer.mjs) - [build-windows-machine-installer.test.mjs](/tmp/git-processor/worktrees/integry/propr/pr-2034-followup-2026-08-31T21-00-00/apps/desktop/scripts/build-windows-machine-installer.test.mjs) - [test-installed-windows-app.ps1](/tmp/git-processor/worktrees/integry/propr/pr-2034-followup-2026-08-31T21-00-00/apps/desktop/scripts/test-installed-windows-app.ps1) - [release-workflow.test.ts](/tmp/git-processor/worktrees/integry/propr/pr-2034-followup-2026-08-31T21-00-00/apps/desktop/src/release-workflow.test.ts) Validation: - Installer tests: 7/7 passed - Release-workflow tests: 16/16 passed - Desktop/UI typechecks: passed - Desktop tests: 155 passed, 6 platform-specific skipped - `git diff --check`: passed No commit, merge, or synchronization performed. PR: #2034 Comment by: @integry (ID: 5484490917) Model: gpt-5.6-sol
…cd45d4fa6714a153fe`. Implemented F3 and F1 on exact head `83aecdf4db2ea68c7d6eeecd45d4fa6714a153fe`. - [Proof harness](/tmp/git-processor/worktrees/integry/propr/pr-2034-followup-2026-08-31T21-16-59/apps/desktop/scripts/test-installed-windows-app.ps1:84): fixed environment-path handoff, profileless probe, ownership tracking, exact-file cleanup, and non-recursive empty-folder removal. - [Source assertions](/tmp/git-processor/worktrees/integry/propr/pr-2034-followup-2026-08-31T21-16-59/apps/desktop/src/release-workflow.test.ts:544): covers all requested invariants and rejects recursive Start Menu cleanup. - MSI authoring remains unchanged. Validation: - Focused installer/release tests: 24 passed. - Desktop tests: 156 passed, 6 platform-specific skipped. - Desktop and UI typechecks passed. - `git diff --check` passed. - Only the two requested proof-related files changed; no commit created. PR: #2034 Comment by: @integry (ID: 5484717700) Model: gpt-5.6-sol
…cdd42b67a3fa2c8c11b365`. Implemented diagnostic F4 on exact head `9c6e1d43c30fe296c9cdd42b67a3fa2c8c11b365`. - Added fixed child exit-code/category parity and redacted parent probe tokens. - Added PRESENT/ABSENT success, spawn, timeout, and UNKNOWN handling. - Suppressed child stdout/stderr while preserving the 30-second bound and process-tree cleanup. - Added fixed uninstall/cleanup substage diagnostics. - Preserved primary failures when cleanup also fails. - Kept ownership-aware shortcut cleanup and CommonPrograms non-recursion unchanged. - MSI authoring was not modified. Changed: - [test-installed-windows-app.ps1](/tmp/git-processor/worktrees/integry/propr/pr-2034-followup-2026-08-31T21-34-44/apps/desktop/scripts/test-installed-windows-app.ps1:89) - [release-workflow.test.ts](/tmp/git-processor/worktrees/integry/propr/pr-2034-followup-2026-08-31T21-34-44/apps/desktop/src/release-workflow.test.ts:543) Validation: - Focused installer/release tests: 26 passed - Desktop/UI typechecks: passed - Desktop tests: 158 passed, 6 platform-specific skipped - `git diff --check`: clean - Only the two intended files changed Native Windows execution was unavailable in this Linux workspace. No commit was created. PR: #2034 Comment by: @integry (ID: 5484947274) Model: gpt-5.6-sol
…154b6ba8808e5b28be5b5e`. Implemented functional F5 on exact head `33889bd36bbdb9aae2154b6ba8808e5b28be5b5e`. - Set shortcut probe `LoadUserProfile = $true` in [test-installed-windows-app.ps1](/tmp/git-processor/worktrees/integry/propr/pr-2034-followup-2026-08-31T21-55-56/apps/desktop/scripts/test-installed-windows-app.ps1:453). - Updated focused assertions in [release-workflow.test.ts](/tmp/git-processor/worktrees/integry/propr/pr-2034-followup-2026-08-31T21-55-56/apps/desktop/src/release-workflow.test.ts:698). - No MSI, environment, cleanup, shortcut semantics, or unrelated files changed. Validation passed: - Installer tests: 7/7 - Release-workflow tests: 19/19 - Desktop/UI typecheck - Desktop tests: 158 passed, 6 platform skips - `git diff --check` - Changed-file scope audit: exactly two intended files No commit created. PR: #2034 Comment by: @integry (ID: 5485215604) Model: gpt-5.6-sol
…69159331347b0ac022d613`. Implemented functional F6 on exact head `f916c794e5d399524169159331347b0ac022d613`. - Added the isolated, ACL-validated probe profile/environment in [test-installed-windows-app.ps1](/tmp/git-processor/worktrees/integry/propr/pr-2034-followup-2026-08-31T22-07-48/apps/desktop/scripts/test-installed-windows-app.ps1:391). - Passed the smoke directory to both presence and absence probes. - Added focused containment, ACL/reparse, idempotence, path-separation, seven-key allowlist, and environment-isolation assertions in [release-workflow.test.ts](/tmp/git-processor/worktrees/integry/propr/pr-2034-followup-2026-08-31T22-07-48/apps/desktop/src/release-workflow.test.ts:698). - MSI authoring and unrelated files were untouched. Validation: - Installer tests: 7/7 passed - Release workflow tests: 20/20 passed - Desktop/UI typechecks: passed - Desktop tests: 159 passed, 6 platform-specific skipped - `git diff --check`: passed Changes remain uncommitted as requested. PR: #2034 Comment by: @integry (ID: 5485352611) Model: gpt-5.6-sol
…8934ff55cbb212bd8967df`. Implemented diagnostic F7 on exact head `5ec88c0835c58628b78934ff55cbb212bd8967df`. - Added allowlisted Win32 spawn mappings and `UNKNOWN` fallback in [test-installed-windows-app.ps1](/tmp/git-processor/worktrees/integry/propr/pr-2034-followup-2026-08-31T22-19-18/apps/desktop/scripts/test-installed-windows-app.ps1:549). - Preserved plain `SPAWN_FAILED` for non-Win32 failures. - Added exact-source, mapping behavior, fallback, and sentinel-redaction tests in [release-workflow.test.ts](/tmp/git-processor/worktrees/integry/propr/pr-2034-followup-2026-08-31T22-19-18/apps/desktop/src/release-workflow.test.ts:625). - No MSI authoring or F6 probe containment/environment/process semantics changed. Validation passed: - Packaging tests: 7/7 - Release workflow tests: 21/21 - `git diff --check` passed No commit created. PR: #2034 Comment by: @integry (ID: 5485498108) Model: gpt-5.6-sol
…c18e4ae8365`. Implemented F8 on exact head `1b3a179a4f39f45deafe3e487abebc18e4ae8365`. - Updated the spawn catch to accept only direct Win32 exceptions or an exact `MethodInvocationException` with an immediate Win32 inner exception. No deeper traversal or other wrappers are accepted: [test-installed-windows-app.ps1](/tmp/git-processor/worktrees/integry/propr/pr-2034-followup-2026-08-31T22-33-22/apps/desktop/scripts/test-installed-windows-app.ps1:550) - Preserved the existing category allowlist and bare fallback behavior. - Added wrapper-depth/type, mapping, UNKNOWN, and sentinel-redaction coverage, plus a Windows-only PowerShell catch execution: [release-workflow.test.ts](/tmp/git-processor/worktrees/integry/propr/pr-2034-followup-2026-08-31T22-33-22/apps/desktop/src/release-workflow.test.ts:626) - Corrected the test mapping type to `Record<number, string>`. Validation: - Focused release-workflow tests: 21 passed, 1 Windows-only test skipped on Linux. - Desktop typecheck: passed. - `git diff --check`: passed. - Only the two requested files changed; no commit created. PR: #2034 Comment by: @integry (ID: 5485619615) Comment by: @integry (ID: 5485644642) Model: gpt-5.6-sol
…af64ef09e59`. Implemented F9 on exact head `2a008f7461250bc514e15118d2ce4af64ef09e59`. - Changed `$spawnFailureCategories` to a normal PowerShell hashtable in [test-installed-windows-app.ps1](/home/node/workspace/apps/desktop/scripts/test-installed-windows-app.ps1:561). - Replaced the reflection-based deeper-wrapper fixture with explicit nested `MethodInvocationException` objects. - Added real PowerShell coverage for code 87 → `INVALID_PARAMETER`. - Preserved all existing selection, redaction, fallback, MSI, environment, ACL, process, and cleanup behavior. Validation: - Desktop typecheck passed. - Focused release workflow tests passed: 21 passed, 1 expected Windows-only skip. - `git diff --check` passed. - No commit created. PR: #2034 Comment by: @integry (ID: 5485801525) Model: gpt-5.6-sol
…b986453225de560ae483c4e`. Implemented diagnostic F10 on exact head `86faa47925fdaf288b986453225de560ae483c4e`. - Added all 16 requested fixed Win32 categories in [test-installed-windows-app.ps1](/tmp/git-processor/worktrees/integry/propr/pr-2034-followup-2026-08-31T23-01-22/apps/desktop/scripts/test-installed-windows-app.ps1:561). - Updated exact 23-entry mapping/cardinality, native Windows lookup coverage, UNKNOWN handling, and sentinel redaction tests in [release-workflow.test.ts](/tmp/git-processor/worktrees/integry/propr/pr-2034-followup-2026-08-31T23-01-22/apps/desktop/src/release-workflow.test.ts:674). - Preserved wrapper selection, numeric hashtable lookup, fallbacks, redaction, and process behavior. Validation: - Focused release workflow: 21 passed, 1 Windows-only test skipped on Linux. - Desktop typecheck: passed. - `git diff --check`: passed. - Only the two intended files changed; no commit created. PR: #2034 Comment by: @integry (ID: 5485923810) Model: gpt-5.6-sol
Implemented F3 only.
- Changed `$shortcutProbeExitCategories` from `[ordered]@{}` to ordinary `@{}` for numeric-key lookup.
- Updated the corresponding source-structure assertion.
- Focused test passed: 21 passed, 1 Windows-only skipped.
- `git diff --check` passed.
- No commit created.
PR: #2034
Comment by: @integry (ID: 5485956015)
Model: gpt-5.6-sol
…178cd975fcb40057`. Implemented F4 only on exact head `fe67899ebe7f1c98b0819a9c178cd975fcb40057`. - Replaced the failing shortcut `Process.Start` proof with `LogonUserW(LOGON32_LOGON_NETWORK)` and `WindowsIdentity.RunImpersonated`. - Added exact ordinary-user SID verification, bounded shortcut metadata/read checks, and secure password buffer zero/free cleanup. - Disposes identities, streams, and `SafeAccessTokenHandle`. - Preserved fixed redacted outcomes, canonical CommonPrograms path, and ownership-aware cleanup. - Removed obsolete shortcut child-process/profile/exit-code machinery and tests. - MSI/WiX authoring and workflows remain untouched. Files changed: - [test-installed-windows-app.ps1](/tmp/git-processor/worktrees/integry/propr/pr-2034-followup-2026-08-31T23-16-01/apps/desktop/scripts/test-installed-windows-app.ps1:90) - [release-workflow.test.ts](/tmp/git-processor/worktrees/integry/propr/pr-2034-followup-2026-08-31T23-16-01/apps/desktop/src/release-workflow.test.ts:541) Validation: - Desktop/UI typecheck: passed - Focused release-workflow/installer tests: 28 passed - Full desktop tests: 160 passed, 6 platform-specific skipped - `git diff --check`: passed - Only the two scoped files are modified - No commit, merge, base sync, or additional native diagnostic run performed Fresh x64 and ARM64 installed-package validation remains for the native Windows CI runners. PR: #2034 Comment by: @integry (ID: 5486062025) Model: gpt-5.6-sol
…si-start-me-20260831-2021-uou [2032 by GPT-5.6 Sol] Make Windows MSI Start Menu shortcut machine-wide
Owner
Author
|
/review |
Contributor
|
✅ AI Code Review Complete requested by @integry Posted 1 review: |
Contributor
🔍 AI Code Review — codex:gpt-5.6-solOverall EvaluationThis PR substantially expands desktop packaging, smoke validation, signed-update policy, and release publication. The supplied diff is explicitly truncated, so this is necessarily a partial review. The visible implementation needs minor but required corrections before merge; 46 checks also remain pending. ✅ Strong smoke isolation — Packaged smoke mode requires independent argument and environment authorization, isolates profile paths, and emits bounded allowlisted evidence. ✅ Defensive release publication — Publication uses recoverable drafts, verifies tag identity repeatedly, validates the exact checksum-controlled asset set, and hashes downloaded assets before publishing. ✅ Windows MVP boundary — The visible configuration consistently disables Windows self-update and rejects deferred update-authority resources from Windows MVP packages. Merge blockersEvery finding below was introduced by this PR and must be resolved before merging. F2: 🔴 Window contract is not implemented
F3: 🔴 MSI accepts unsupported versions
SuggestionsThese are optional follow-ups and are not sent to S1: 🟢 Pin recoverable draft metadata
S2: 🟢 Share window-size constantsThe preferred and minimum sizes are duplicated between ScoreThe PR demonstrates unusually thorough defensive testing and release-integrity work, but the native window validator currently requires behavior the application does not implement, and Windows version validation permits invalid MSI versions. The explicitly omitted diff ranges and pending checks also leave material validation outstanding. Score: 6/10 🤖 Review Details
Files omitted from review diff11 files were omitted because patch content was unavailable from GitHub or did not fit the review context budget. Large, binary, generated, and lockfile changes are deprioritized.
🤖 Review by ProPR |
This was referenced Aug 31, 2026
…on numeric b Implemented by ProPR AI using gpt-5.6-sol model. Implementation completed successfully.
…ive display Implemented by ProPR AI using gpt-5.6-sol model. Implementation completed successfully.
…`57bfef695e4428611fcf7a152f344ac58f076d12`. Implemented the Windows validation-order fix on exact head `57bfef695e4428611fcf7a152f344ac58f076d12`. - [release-config.ts](/tmp/git-processor/worktrees/integry/propr/pr-2038-followup-2026-08-31T23-57-32/apps/desktop/src/release-config.ts:40) now validates canonical stable SemVer before applying Windows MSI bounds. - [release-config.test.ts](/tmp/git-processor/worktrees/integry/propr/pr-2038-followup-2026-08-31T23-57-32/apps/desktop/src/release-config.test.ts:54) explicitly covers Windows malformed/prerelease/build diagnostics, canonical numeric overflow, and unchanged macOS/Linux behavior. - Direct installer-builder validation remains unchanged. Validation passed: - Focused release-config: 13 passed - Installer-builder: 9 passed - Desktop typecheck - Full desktop suite: 166 passed, 6 platform-specific skipped - `git diff --check` Only the two release-config files were modified; no commit was created. PR: #2038 Comment by: @integry (ID: 5486469236) Model: gpt-5.6-sol
…s-installer-20260831-2347-o25 [2037 by GPT-5.6 Sol] Enforce Windows Installer ProductVersion numeric bounds
…window-sizi-20260831-2347-ql3 [2036 by GPT-5.6 Sol] Clamp desktop window sizing to the active display work area
Owner
Author
|
/review |
Contributor
|
✅ AI Code Review Complete requested by @integry Posted 1 review: |
Contributor
🔍 AI Code Review — codex:gpt-5.6-solOverall EvaluationThis PR substantially advances desktop packaging, release integrity, smoke validation, window sizing, and update security. No merge-blocking defect is verified in the visible ranges, but the supplied diff explicitly omits files/ranges and 48 authoritative checks remain pending, so the PR is not yet demonstrably merge-ready. ✅ Fail-closed update policy — Windows update configuration returns an unsupported state before processing endpoints or credentials, with tests confirming zero network, signer, authority, or installation calls. ✅ Atomic release publication — ✅ Isolated packaged smoke execution — Smoke mode requires dual authorization, uses a private profile and allowlisted child environment, and records bounded event-only evidence. Merge blockersNo merge blockers. SuggestionsThese are optional follow-ups and are not sent to S1: 🟢 Bound DMG creation
S2: 🟢 Complete omitted-range validationA follow-up review should cover the explicitly omitted release, native Windows authority, signing, and workflow ranges and allow the pending native-package matrix to complete. This is a verification gap rather than evidence of a defect in the supplied code. ScoreNo blocker is verified in the visible ranges, but the explicit diff omissions create a material assurance gap, while 48 checks are still pending and none currently fail. That prevents a merge-ready assessment on the supplied evidence. Score: 7/10 🤖 Review Details
Files omitted from review diff11 files were omitted because patch content was unavailable from GitHub or did not fit the review context budget. Large, binary, generated, and lockfile changes are deprioritized.
🤖 Review by ProPR |
integry
merged commit Sep 1, 2026
0ec9394
into
1951-epic-desktop-experience-uxs
82 of 89 checks passed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Propagates the fully reviewed and native-matrix-validated runtime/packaging head into the desktop UX epic. Includes merged #1972. This targets the UX epic branch only and must not target main.