Skip to content

feat(home): paint house URUX onto freeze contracts - #23

Closed
SashaMIT wants to merge 15 commits into
feat/home-agent-harness-rebuildfrom
feat/home-urux-on-freeze
Closed

SashaMIT wants to merge 15 commits into
feat/home-agent-harness-rebuildfrom
feat/home-urux-on-freeze

Conversation

@SashaMIT

@SashaMIT SashaMIT commented Aug 19, 2026 •

Copy link
Copy Markdown
Contributor

Summary

  • House look for first-party capsules and Home chrome, painted onto freeze contracts — not merged into feat/home-agent-harness.
  • One launch path, one clipboard host, Studio via model offers. No /creative HTTP, no capsule navigator.clipboard, no #agent-harness as host chrome.
  • First-run welcome sheet is Recovery Kit required, then Profile. Host already refuses the first Profile without a completed kit; the sheet matches that fact via identity.recovery_readiness + identity.profile_readiness. No skip. Close/Escape leaves a session History reminder. Ceremony stays on System Security and People.
  • CI now also pins token vendor check + clipboard source gate. Home entropy pins Agent-not-chrome, setup sheet (recovery-then-profile), Quick open, Chat 52px, and no window-chrome-safe-top in Chat/Inbox.

UX review, not merge of the whole branch. Store, Get, and model selection stay out of this PR.

Merge target if the live pass is good: feat/home-agent-harness-rebuild only. That does not fast-forward review/collaboration-candidate or upstream/0.7-dev. Integration of those is a later, separate review.

Recovery rule (Anders)

recovery_readiness and the first-Profile POST gate now share recovery_rule_is_ready(root_encrypted, recovery_configured).

  • Unit: recovery_readiness_ready_iff_first_profile_gate_allows
  • HTTP: test_recovery_readiness_and_first_profile_gate_use_the_same_recovery_rule

Windows (non-blocking — Anders 25 Aug)

Windows is not an accepted target for this slice. The experimental job stays in CI, stays continue-on-error, and must not block merge. It is evidence of Unix assumptions in elastos-guest (POSIX serial/PTY). Track separately. Near-term: Linux VPS / NVIDIA + our localhosts; WSL or skip on Windows; native Windows kernel later. Long-term: one Runtime contract, host differences behind adapters, claim only platforms with evidence (ROADMAP.md).

Named gaps (not bugs)

  • Studio playback / clip list / stitch — no artifact-byte door yet.
  • First-run step 3 local-model scan/install — no host fact; do not fake a capsule installer.
  • Character / Ref2VA — not an offer.
  • Anders live pass still his: he wants to walk fresh + existing + restart + Chat/Inbox/wallet/Agent/Studio/boundaries/logs himself before merge.
  • Sash dogfood (25 Aug): fresh Home first-run worked (Kit then Profile). Existing Home: passkey unlock, no welcome sheet.

Test plan

  • Host test: recovery_readiness and first-Profile gate use the same recovery rule
  • Required CI: source-gate / source-home-linux / source-macos — were green before the lockstep test; entropy-string fix on 5e546ef4f (Windows not a bar)
  • Windows experimental: non-blocking, tracked — not a feat(home): paint house URUX onto freeze contracts #23 fix
  • Sash: fresh Home first-run (Kit first, then Profile) — worked 25 Aug
  • Existing Profile users should not see the welcome sheet (dogfood, 25 Aug)
  • Anders live pass (he will walk the same flow plus Chat/Inbox/wallet/Agent/Studio/restart/logs)
  • Agent Live uses text offer + runs_*; Studio uses offer:h3-video:2x
  • Capsules still opaque frames; Home GUI projects only
  • Phone Control Centre Quick open: Spotlight / Inbox rail / Wallet rail (visible ≤640px)
  • Chat: 220px desktop rail; 72px icon rail only when 2+ conversations; local 52px top, no window-chrome-safe-top

SashaMIT and others added 11 commits August 19, 2026 23:55
House look for first-party capsules and Home chrome, without a second launch, clipboard, or /creative path.

Co-authored-by: Cursor <cursoragent@cursor.com>
Run principles and cargo on windows-latest without blocking merge. Source-home stays Linux/Darwin until that door exists.

Co-authored-by: Cursor <cursoragent@cursor.com>
Do not loosen vendor-ui for CRLF. Checkout LF on windows-latest so the same files match Linux.

Co-authored-by: Cursor <cursoragent@cursor.com>
Keep WCI checks looking for the real routes. Do not loosen the gate.

Co-authored-by: Cursor <cursoragent@cursor.com>
The allowed host is still only home-clipboard-host.js. Normalize slashes so the gate does not treat the same file as a stranger.

Co-authored-by: Cursor <cursoragent@cursor.com>
Mode-bit heal is a Unix host fact. Do not allow(dead_code) on Windows.

Co-authored-by: Cursor <cursoragent@cursor.com>
Honor the join deadline instead of sleeping past it, and keep the unfinished worker alive longer than CI sleep overshoot. Join evidence is unchanged: unfinished is not joined.

Co-authored-by: Cursor <cursoragent@cursor.com>
Keep Chat held on profile_readiness. Recovery ceremony stays on System; Profile stays on People. No second identity path.

Co-authored-by: Cursor <cursoragent@cursor.com>
Lock talks to Home. Wallpaper, clock, and person start the same passkey. The OS dialog is the ceremony, not the first screen.

Co-authored-by: Cursor <cursoragent@cursor.com>
The freeze lock face was a stand-in. Project the July picker look and the front-door account name from passkey status without a browser identity cache.

Co-authored-by: Cursor <cursoragent@cursor.com>
The lock face was cutting to Home and treating the profile name as the passkey control. Dissolve the overlay over the desktop and leave the name as a label.

Co-authored-by: Cursor <cursoragent@cursor.com>
The welcome sheet was Profile-first with a skippable kit. Host already
refuses the first Profile without a completed kit; the sheet now matches
that fact, ticks recovery_readiness, and leaves a History reminder if
closed early.

Co-authored-by: Cursor <cursoragent@cursor.com>
SashaMIT and others added 2 commits August 24, 2026 20:43
Co-authored-by: Cursor <cursoragent@cursor.com>
… rule

Anders asked for one test that the kit-ready predicate cannot drift between the Home fact and the Profile POST refuse.
@SashaMIT

Copy link
Copy Markdown
Contributor Author

Recorded your review:

  • This PR stays UX-only. Store / Get / models stay out.
  • Added the shared recovery rule plus one host test (test_recovery_readiness_and_first_profile_gate_use_the_same_recovery_rule) so recovery_readiness and the first-Profile POST cannot drift.
  • Windows experimental is tracked, not fixed here: elastos-guest POSIX serial/PTY (as_raw_fd / tcsetattr) under cfg(not(wasi)). Pre-existing, continue-on-error. Required Linux/macOS jobs are the merge bar for this slice.
  • Manual first-run on a fresh Home is still open — needs the operator passkey ceremony.

First extra gba-* is a separate branch from upstream/0.7-dev: #26

The dummy localhost_root in the lockstep unit test tripped source-gate and source-macos.
@SashaMIT

SashaMIT commented Sep 4, 2026

Copy link
Copy Markdown
Contributor Author

Superseded by #55 (stacked on #54). The URUX harness has been re-cut to the 0.7.1 standard there: Home GUI owns the Shelf morph and the Agent Space, the harness is its own capsule on the typed model contract (offers_list / runs_create / runs_events / runs_cancel), the workspace is a Runtime object, and nothing that this Runtime does not back (mock provider, grants, tools, Studio, Usage) is in it. Closing this so the design is reviewed in one place.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant