Build Shadowfetch 4.0 Mission Control and featured Grok Bot setup

Author: Shadowfetch

.github/workflows/build-iso.yml

@@ -1,117 +1,63 @@
-name: Build & publish Shadowfetch Linux ISO
+name: Source and package checks
 
 on:
   push:
-    tags: ['v*']            # Tag push (v1.0.0, v1.0.1, ...) triggers full release pipeline
-  workflow_dispatch:        # Manual trigger for dry-run / test builds
-    inputs:
-      publish:
-        description: 'Publish to R2 + deploy Worker?'
-        required: true
-        default: 'false'
-        type: choice
-        options: ['true', 'false']
+    branches: [main, 'release/**']
+  pull_request:
+  workflow_dispatch:
 
-jobs:
-  build:
-    runs-on: ubuntu-latest
-    timeout-minutes: 180   # ISO build alone is ~30-60 min; with publish more
-    permissions:
-      contents: write       # for creating GitHub releases
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
+permissions:
+  contents: read
 
-      - name: Free up disk space
-        # Default ubuntu-latest gives ~14GB free; squashfs + chroot need more.
-        run: |
-          sudo rm -rf /usr/share/dotnet /usr/local/lib/android /opt/ghc /opt/hostedtoolcache/CodeQL
-          sudo docker image prune --all --force || true
-          df -h
+concurrency:
+  group: source-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
 
-      - name: Install build dependencies
+jobs:
+  source:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 30
+    env:
+      QT_QPA_PLATFORM: offscreen
+      PYTHONDONTWRITEBYTECODE: '1'
+    steps:
+      - uses: actions/checkout@v4
+      - name: Install source and package test dependencies
         run: |
           sudo apt-get update
-          sudo apt-get install -y \
-            live-build live-config live-boot \
-            debhelper devscripts equivs dh-python \
-            reprepro gnupg \
-            xorriso isolinux syslinux-common syslinux-utils \
-            grub-pc-bin grub-efi-amd64-bin mtools \
-            xz-utils python3 awscli
-
-      - name: Verify release version and source gates
-        run: |
-          VERSION=$(awk '/^VERSION[[:space:]]*\?=/{print $3; exit}' Makefile)
-          if [[ "$GITHUB_REF" == refs/tags/* && "${GITHUB_REF_NAME}" != "v${VERSION}" ]]; then
-            echo "::error::Tag ${GITHUB_REF_NAME} does not match Makefile VERSION ${VERSION}"
-            exit 1
-          fi
-          make test
-
-      - name: Import GPG signing key
-        env:
-          GPG_PRIVATE_KEY: ${{ secrets.SHADOWFETCH_GPG_PRIVATE_KEY }}
-        run: |
-          if [ -z "$GPG_PRIVATE_KEY" ]; then
-            echo "::error::SHADOWFETCH_GPG_PRIVATE_KEY secret not set; can't sign release"
-            exit 1
-          fi
-          echo "$GPG_PRIVATE_KEY" | gpg --batch --import
-          gpg --list-secret-keys
-
-      - name: Build packages + ISO
-        run: |
-          make iso
-
-      - name: Compute checksums (also done by Makefile; double-check)
-        run: |
-          ls -lh *.iso *.iso.sha256 *.iso.asc
-          cat *.iso.sha256
-
-      - name: Pre-release publication gate
-        run: |
-          make pre-release-check
-
-      - name: Upload ISO as workflow artifact (always)
-        uses: actions/upload-artifact@v4
+          sudo apt-get install -y debhelper dh-python devscripts fakeroot python3 python3-yaml python3-pyqt6 python3-dbus shellcheck desktop-file-utils bubblewrap ffmpeg
+      - name: Test behavior
+        run: make test
+      - name: Validate source syntax and desktop entries
+        run: |
+          python3 - <<'PY'
+          import ast, json, pathlib, subprocess
+          files = subprocess.check_output(['git', 'ls-files', '-z']).split(b'\0')
+          for name in filter(None, files):
+              p = pathlib.Path(name.decode())
+              if not p.is_file():
+                  continue
+              try:
+                  text = p.read_text()
+              except UnicodeError:
+                  continue
+              first = text.splitlines()[0] if text.splitlines() else ''
+              if p.suffix == '.py' or first.startswith('#!') and 'python' in first:
+                  ast.parse(text, filename=str(p))
+              if p.suffix == '.json':
+                  json.loads(text)
+              if p.suffix == '.desktop' and ('applications' in p.parts or 'autostart' in p.parts):
+                  subprocess.run(['desktop-file-validate', str(p)], check=True)
+          PY
+          git diff --check
+      - name: Build unsigned candidate packages
+        run: make packages
+      - uses: actions/upload-artifact@v4
         with:
-          name: shadowfetch-iso
-          path: |
-            *.iso
-            *.iso.sha256
-            *.iso.asc
-          retention-days: 30
+          name: unsigned-candidate-packages
+          path: build/*.deb
+          retention-days: 14
 
-      - name: Publish to R2 (tag or manual-with-publish=true)
-        if: startsWith(github.ref, 'refs/tags/v') || (github.event_name == 'workflow_dispatch' && inputs.publish == 'true')
-        env:
-          AWS_ACCESS_KEY_ID:     ${{ secrets.R2_ACCESS_KEY_ID }}
-          AWS_SECRET_ACCESS_KEY: ${{ secrets.R2_SECRET_ACCESS_KEY }}
-        run: |
-          make publish
-
-      - name: Deploy Worker (tag or manual-with-publish=true)
-        if: startsWith(github.ref, 'refs/tags/v') || (github.event_name == 'workflow_dispatch' && inputs.publish == 'true')
-        env:
-          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
-        run: |
-          npm install -g wrangler
-          cd web/shadowfetch-linux-worker && wrangler deploy
-
-      - name: Create GitHub release on tag
-        if: startsWith(github.ref, 'refs/tags/v')
-        uses: softprops/action-gh-release@v2
-        env:
-          GITHUB_TOKEN: ${{ secrets.RELEASE_GITHUB_TOKEN }}
-        with:
-          name: ${{ github.ref_name }}
-          draft: true
-          generate_release_notes: true
-          body: |
-            The signed ISO is hosted on Shadowfetch's release storage because
-            GitHub release assets have a 2 GiB per-file limit. Verify the R2
-            download with the attached checksum and detached signature.
-          files: |
-            *.iso.sha256
-            *.iso.asc
+# The signed release is built, tested in installed VMs, and published from the
+# authorized Linux publisher. A tag must not rebuild and overwrite the tested
+# ISO or deploy an unrelated Worker. See RELEASE-4.0.0.md.

Makefile

@@ -10,7 +10,7 @@
 #   make distclean  Wipe everything regenerable
 
 SHELL := /bin/bash
-VERSION  ?= 3.5.0
+VERSION  ?= 4.0.0
 CODENAME ?= umbra
 ISO_NAME := shadowfetch-$(VERSION)-amd64.iso
 VERSION_TOKEN := $(subst .,_,$(VERSION))
@@ -34,7 +34,8 @@ PACKAGES := \
 	shadowfetch-control-center \
 	shadowfetch-fireproof \
 	shadowfetch-hwscan \
-	shadowfetch-fireline
+	shadowfetch-fireline \
+	shadowfetch-missions
 
 # GPG key the APT repo signs with. Override with `make REPO_KEY_ID=...` if
 # you've regenerated the key. The default matches the key on shadowfetch-linux.
@@ -79,7 +80,7 @@ R2_REGION   ?= auto
 
 # Used by sync-from-linux (Mac-side flow): host + path to the build box.
 LINUX_HOST ?= shadowfetch-linux
-LINUX_PATH ?= ~/projects/shadowfetch-3.5.0
+LINUX_PATH ?= ~/projects/shadowfetch-4.0.0
 
 .PHONY: all help test source-gate package-gate iso-gate acceptance-audit deps packages repo iso sign pre-release-check publish qemu clean distclean \
         sync-from-linux deploy-worker ship stamp-version
@@ -102,13 +103,16 @@ help:
 	@echo "  make distclean  Wipe all regenerable files"
 
 test:
+	python3 -m unittest discover -s packages/shadowfetch-missions/tests -v
+	QT_QPA_PLATFORM=offscreen python3 -m unittest discover -s packages/shadowfetch-control-center/tests -v
 	python3 -m unittest discover -s packages/shadowfetch-defaults/tests -v
 	python3 -m unittest discover -s packages/shadowfetch-firewatchd/tests -v
 	python3 -m unittest discover -s packages/shadowfetch-fireproof/tests -v
 	python3 -m unittest discover -s packages/shadowfetch-hwscan/tests -v
 	python3 packages/shadowfetch-fireline/tests/test_ai_ignition.py
 	python3 packages/shadowfetch-fireline/tests/test_fireline_mcp.py
 	python3 packages/shadowfetch-fireline/tests/test_checkpoint_roundtrip.py
+	python3 packages/shadowfetch-fireline/tests/test_firebreak_4.py
 	python3 -m unittest discover -s tools/tests -v
 
 source-gate:
@@ -145,13 +149,7 @@ packages: $(PACKAGES_STAMP)
 # was itself stale. A single source of truth that a human maintains is the same
 # bug with one fewer copy, so the build stamps it now.
 stamp-version:
-	@printf '%s\n' '$(VERSION)' > $(ROOT)/packages/shadowfetch-branding/data/usr/share/shadowfetch/version
-	@sed -i -E 's/[0-9]+\.[0-9]+\.[0-9]+/$(VERSION)/g' \
-		$(ROOT)/packages/shadowfetch-branding/data/usr/share/shadowfetch/os-release.shadowfetch
-	@for f in $(ROOT)/packages/shadowfetch-themes/data/usr/share/sddm/themes/umbra/metadata.desktop $(ROOT)/packages/shadowfetch-defaults/data/usr/share/doc/shadowfetch/LICENSES.md $(ROOT)/packages/shadowfetch-defaults/data/usr/share/doc/shadowfetch/SOURCES.md $(ROOT)/packages/shadowfetch-defaults/data/usr/bin/shadowfetch-element $(ROOT)/packages/shadowfetch-fireline/data/usr/bin/shadowfetch-firebreak; do \
-		sed -i -E 's/\b[0-9]+\.[0-9]+\.[0-9]+\b/$(VERSION)/g' "$$f"; \
-	done
-	@echo ">>> stamped version $(VERSION) into branding, themes, docs and CLI surfaces"
+	python3 tools/stamp_version.py "$(VERSION)"
 
 $(PACKAGES_STAMP): stamp-version
 	@mkdir -p $(BUILD_DIR)

RELEASE-4.0.0.md

@@ -0,0 +1,46 @@
+# Shadowfetch Linux 4.0.0 — Mission Control
+
+Status: implementation and validation in progress. This file is a release contract, not a claim that 4.0 has shipped. The public 3.5 image remains the current release until publication verification passes.
+
+## Release objective
+
+Deliver the complete Mission Control desktop: persistent tasks, visible scopes, real code/document/media workflows, reviewed results, cancellation/retry/recovery, hardware-aware local AI and resource management. Integrate the official Grok Bot Linux desktop app as a featured installation choice alongside the existing agents. Publish the signed ISO, corresponding source, GitHub release, updated shadowfetchlinux.org, actual screenshots and a reviewer letter after stress and acceptance testing.
+
+## Product requirements
+
+1. Native Mission Control is a first-class desktop surface. It creates and tracks real jobs, shows allowed files/tools/network, progress, artifacts, test output, failure details and results ready for review.
+2. Mission state persists across service and computer restarts. Cancellation stops the task's process group. Retry checks state and does not blindly replay external effects.
+3. Firebreak gives agents a private home and explicitly scoped filesystem access. A required recovery checkpoint must exist before a mission mutates files. Permission and receipt state stays outside the agent-writable project.
+4. Fire offers explicit connected execution; Ice provides local execution with external networking disabled. Local inference crosses only a narrow local broker boundary.
+5. Software missions run a supported coding runtime, verify the requested tests and present the actual patch. Document missions generate a report from selected sources with citations using actual local inference. Media missions produce validated exports without overwriting originals.
+6. CPU, memory, process and heavy-job admission limits preserve a responsive desktop. Local model setup records the model, actual hardware and a measured successful inference result.
+7. The desktop launcher and file manager can send selected projects or files into Mission Control. GUI and CLI share the same engine.
+8. Grok Bot is the official native desktop product, separate from Grok Build CLI. Its package comes from the official vendor download source with a pinned digest and reviewed metadata. Setup shows download, disk, network and account requirements; native account sign-in remains with the provider. A cloud service is never labeled as Ice/local inference.
+9. Grok Bot has prominent first-boot presentation, a dedicated Control Center surface and desktop launch entry. Screenshots must include the actual vendor application and its real setup/launch state.
+10. BIOS and UEFI fresh installs boot from disk. A 3.5-to-4.0 upgrade preserves selected user data and has a documented recovery path. Btrfs and non-Btrfs recovery limits remain explicit.
+11. At least 45 minutes of concurrent CPU, memory, storage, container and mission/UI load complete with clean kernel, service, package and filesystem audits.
+12. Screenshots come from the built release desktop at 1366×768 and 1920×1080. Capture Fire, Ice, Welcome, Mission Control, Grok Bot, installation, results/recovery and under-load states. Do not substitute design mockups.
+13. The signed ISO, APT binaries and corresponding source, package manifest, SBOM, evidence bundle, Git tag/release, website and reviewer letter all describe the same verified release.
+
+## Build identity
+
+- Version: 4.0.0; codename/repository suite: Umbra / `umbra`.
+- Architecture: amd64; desktop: KDE Plasma 6; installer: Calamares.
+- Source: `/home/rtx5060ti/projects/shadowfetch-4.0.0`, branch `release/4.0.0`.
+- Development mirror: task-owned Mac workspace; builds and publishing execute on Linux.
+- Base snapshot is inherited from 3.5 pending package/build validation; no unsupported claim of a base-OS migration.
+- Exact source commit, ISO size/hash/signature and release date are recorded only after the final build.
+
+## Evidence
+
+`qa/4.0.0/acceptance.json` contains the complete gate inventory. Every case starts pending with no inherited 3.5 evidence. A test manifest is an index into actual logs, artifacts and runtime captures; its status alone is insufficient to prove a feature works.
+
+## Publication boundaries
+
+The user authorized end-to-end GitHub and website publication for 4.0. Publish only after the tested release is concrete. Native vendor apps retain their licenses and account requirements. Never embed keys, credentials, private operating data or account state in source, packages, screenshots or the ISO.
+
+The public distro Worker is `shadowfetch-linux-site`, published by `rtx5060ti` from `/home/rtx5060ti/.sfbuild/release-sources/shadowfetch-linux-site`. Artifacts/APT remain on the established `.com/linux` routes. Worker `shadowfetch-astro` may ship only through the designated Linux release cycle; preserve `/news`. No broad R2 pruning or unrelated service changes are part of this release.
+
+## Reviewer deliverables
+
+After acceptance, generate a ready-to-send reviewer letter in editable Word, PDF and plain text, a screenshot gallery with a prominent actual Grok Bot capture, verification instructions, exact release links, test results and known limitations. The letter is prepared for the user to send; this task does not authorize unsolicited outreach.

live-build/config/includes.chroot/etc/calamares/branding/debian/show.qml

@@ -43,7 +43,7 @@ Presentation
             anchors.margins: 24; height: 82
             color: "#FFFFFF"; wrapMode: Text.WordWrap; textFormat: Text.RichText
             font.pixelSize: 17; horizontalAlignment: Text.AlignLeft
-            text: qsTr("<b>Shadowfetch Linux 3.5.0</b><br/>Fire keeps connected production work close. Ice starts agent sessions offline. Both retain the same KDE desktop and recovery tools.")
+            text: qsTr("<b>Shadowfetch Linux 4.0.0</b><br/>Mission Control brings plans, scoped work and results together. Fire keeps connected production work close. Ice starts agent sessions offline. Both retain the same KDE desktop and recovery tools.")
         }
     }
 
@@ -79,7 +79,7 @@ Presentation
             anchors.margins: 24; height: 82
             color: "#FFFFFF"; wrapMode: Text.WordWrap; textFormat: Text.RichText
             font.pixelSize: 17; horizontalAlignment: Text.AlignLeft
-            text: qsTr("<b>AI with visible boundaries</b><br/>Buzz, local models, Codex, Claude Code, Grok Build and Cursor remain optional. No model, account or credential is bundled or downloaded without consent.")
+            text: qsTr("<b>Meet Grok Bot after installation</b><br/>Welcome features the official Grok Bot desktop alongside Buzz and coding agents. Choose its verified native installation, then sign in with an eligible account and plan. Ice keeps this cloud setup paused.")
         }
     }
 

packages/shadowfetch-branding/data/usr/share/shadowfetch/os-release.shadowfetch

@@ -1,9 +1,9 @@
 NAME="Shadowfetch Linux"
-PRETTY_NAME="Shadowfetch Linux 3.1.0 Backfire (Umbra)"
+PRETTY_NAME="Shadowfetch Linux 4.0.0 (Umbra)"
 ID=shadowfetch
 ID_LIKE=debian
-VERSION="3.1.0 Backfire (Umbra)"
-VERSION_ID="3.1.0"
+VERSION="4.0.0 (Umbra)"
+VERSION_ID="4.0.0"
 VERSION_CODENAME=umbra
 HOME_URL="https://www.shadowfetchlinux.org/"
 SUPPORT_URL="https://www.shadowfetchlinux.org/known-issues"

packages/shadowfetch-branding/data/usr/share/shadowfetch/version

@@ -1 +1 @@
-3.1.0
+4.0.0

packages/shadowfetch-branding/debian/changelog

@@ -1,3 +1,10 @@
+shadowfetch-branding (4.0.0-1) umbra; urgency=medium
+
+  * Shadowfetch Linux 4.0 Mission Control release.
+  * Integrate persistent missions, scoped execution and featured Grok Bot setup.
+
+ -- Shadowfetch Project <signing@shadowfetch.com>  Sat, 05 Sep 2026 03:00:00 +0000
+
 shadowfetch-branding (3.5.0-1) umbra; urgency=medium
 
   * Shadowfetch Linux 3.5.0 flagship Fire and Ice Workbench release.

packages/shadowfetch-control-center/data/usr/bin/shadowfetch-control

@@ -1,8 +1,8 @@
 #!/usr/bin/env python3
 """Shadowfetch Control Center - one window runs the machine.
 
-3.5.0 "Fire and Ice": eight fixed sections - Guide, Element Workbench, Ignite
-(Ember Mode), Watch (Firewatch), Recover (Phoenix), Local AI, Drivers, and
+4.0.0 Mission Control: persistent missions, featured Grok Bot, Guide,
+Element Workbench, Ignite, Watch, Recover, Local AI, Drivers, and
 Software & Updates.
 The system tools (Safe Update, System Health, AI Workspaces, Local AI Tools,
 First-run Setup, Graphics & Recovery) all remain reachable inside their
@@ -22,10 +22,14 @@ if any(_a in ("-h", "--help") for _a in _sfsys.argv[1:]):
 USAGE
   shadowfetch-control                    open the control centre
   shadowfetch-control --page SECTION     open a section directly
+  shadowfetch-control --workspace PATH   create a mission for a project folder
   shadowfetch-control --cli              text-mode menu (no graphics needed)
 
 SECTIONS (for --page; a tab may follow after a colon)
-  guide      Private, read-only System Passport (aliases: passport)
+  missions    Persistent mission queue, results, changes and review
+  grok-bot    Official Grok Bot desktop installation and launch
+  workbench   Project profiles and scoped workspaces
+  guide       Private, read-only System Passport (aliases: passport)
   ignite      Ember Mode - one switch for speed, always returns to Balanced
   watch       Firewatch - live sensors, the heat map, local model telemetry
   recover     Phoenix - restore Points, repair tools, recovery report

packages/shadowfetch-control-center/data/usr/share/applications/shadowfetch-control.desktop

@@ -1,7 +1,7 @@
 [Desktop Entry]
 Type=Application
 Name=Shadowfetch Control Center
-Comment=Ignite, Watch, Recover, Local AI, Drivers and Software & Updates
+Comment=Mission Control, Grok Bot, local AI and system care
 Exec=shadowfetch-control
 Icon=shadowfetch
 Terminal=false

packages/shadowfetch-control-center/data/usr/share/applications/shadowfetch-grok-bot-setup.desktop

@@ -0,0 +1,11 @@
+[Desktop Entry]
+Type=Application
+Name=Grok Bot · Setup & launch
+GenericName=Official Cloud Teammate
+Comment=Install the verified official Grok Bot desktop and open native account sign-in
+Exec=shadowfetch-control --page grok-bot
+Icon=shadowfetch
+Terminal=false
+Categories=Utility;
+Keywords=grok;bot;agents;teammate;cloud;shadowfetch;
+StartupNotify=true