epic(ide): Codewhale Studio — VS Code fork as the canonical desktop (IDE stage 3)

[Hmbown]

Stage 3 of the ratified IDE program (founder 2026-09-02; PRD §6 "IDE direction"). Epic — break into slices as work starts; this issue is the program anchor.

Decision

Codewhale Studio is a VS Code fork that becomes the canonical Codewhale desktop application, replacing the thin Tauri shell (codewhale-apps/clients/desktop-shell) once its native services are ported. One canonical desktop implementation (PRD §6); the web app remains the web workbench.

Ground rules (from the ratified direction)

• VSCodium patch base: start from the VSCodium patch set (strips Microsoft branding/telemetry/marketplace, MIT binaries, tracks upstream monthly). New repo codewhale-studio with microsoft/vscode upstream via VSCodium; monthly rebase cadence.
• Open VSX only as the marketplace; Microsoft Marketplace and Microsoft proprietary extensions are never used.
• Extension-first discipline: all agent UX is extension code (reuse the extension upgrade issue). Workbench patches exist only where the VS Code extension API provably cannot deliver — the known case is diff/merge-view replacement. Every patch not written is a patch Microsoft can't break on their schedule.
• One Engine, many clients: the bundled extension spawns codewhale app-server --http --port <ephemeral> with a runtime token (same contract as the desktop shell's local_runtime.rs) and drives everything over the Runtime API; ACP remains the outbound interop story for third-party editors.
• Tideline theming + canonical whale mark; telemetry off by default (opt-in).

Task list

• Create codewhale-studio repo from VSCodium base; brand/product.json; CI producing unsigned macOS + Windows builds
• Bundle + Ed25519-verify the codewhale engine binary (port runtime_bundle.rs slot pattern into the fork's updater)
• Bundled extension preinstalled and connected to the bundled engine (depends on the extension upgrade issue)
• Tideline workbench theme + canonical mark; telemetry default-off verified
• Native diff/approval surface for agent edits (the one sanctioned fork-patch area)
• Port Tauri native services: keyring auth, deep links, paired-host relay, companion window (apps-side retirement tracked separately)
• Code signing + notarization gates; release preflight parity with current desktop checks
• Prove the monthly upstream rebase twice before general availability
• Retire the Tauri shell per PRD one-canonical-desktop rule (apps issue; separate acceptance)

Acceptance (epic-level)

• Signed macOS + Windows Studio builds in CI that run a real agent session end to end: prompt → approvals → diffs, against a bundled engine.
• Two consecutive monthly upstream rebases landed without breaking the agent UX.
• Tauri shell retirement issue closed by ported parity, not deletion of capability.