Merge pull request #39 from devswha/codex/complete-followups

feat(gjc): complete managed workflows and session worktrees

Author: devswha

.github/workflows/release.yml

@@ -144,12 +144,9 @@ jobs:
     needs: release-policy
     timeout-minutes: 90
     runs-on: macos-14
-    # The `release` environment holds the Developer ID certificate and the
-    # notarization credentials. With them the job signs, notarizes and staples
-    # the app and the image exactly as docs/DESKTOP-TAURI-VERIFICATION.md
-    # § "Signed release procedure" does locally; without them it builds the
-    # ad-hoc image it always has, so a fork or a checkout without the secrets
-    # still produces a testable DMG.
+    # Published desktop assets require Developer ID signing and notarization.
+    # Local ad-hoc builds remain available through the packaging scripts.
+    # See scripts/release/SIGNING-READINESS.md for read-only readiness checks.
     environment: release
     permissions:
       contents: read
@@ -195,6 +192,9 @@ jobs:
             echo "release_tag=v$RELEASE_VERSION"
           } >> "$GITHUB_OUTPUT"
 
+      - name: Require release signing credentials
+        run: node scripts/release/check-signing-readiness.mjs --mode ci
+
       - name: Set up Rust
         run: |
           set -euo pipefail
@@ -216,22 +216,13 @@ jobs:
         id: identity
         run: |
           set -euo pipefail
-          if [ -z "${APPLE_CERTIFICATE_P12:-}" ]; then
-            echo "No APPLE_CERTIFICATE_P12 in the release environment; building the ad-hoc image."
-            echo "signed=false" >> "$GITHUB_OUTPUT"
-            exit 0
-          fi
-          for name in APPLE_CERTIFICATE_PASSWORD APPLE_ID APPLE_TEAM_ID APPLE_APP_PASSWORD; do
-            if [ -z "${!name:-}" ]; then
-              echo "APPLE_CERTIFICATE_P12 is set but $name is not; refusing a half-configured signing lane." >&2
-              exit 1
-            fi
-          done
           KEYCHAIN="$RUNNER_TEMP/gajae-signing.keychain-db"
           KEYCHAIN_PASSWORD="$(openssl rand -hex 24)"
           CERT="$RUNNER_TEMP/developer-id.p12"
           printf '%s' "$APPLE_CERTIFICATE_P12" | base64 --decode > "$CERT"
           security create-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN"
+          # Make cleanup run even if unlock/import/identity selection fails.
+          echo "GAJAE_SIGNING_KEYCHAIN=$KEYCHAIN" >> "$GITHUB_ENV"
           security set-keychain-settings -lut 21600 "$KEYCHAIN"
           security unlock-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN"
           security import "$CERT" -k "$KEYCHAIN" -P "$APPLE_CERTIFICATE_PASSWORD" -T /usr/bin/codesign -T /usr/bin/security
@@ -244,7 +235,6 @@ jobs:
             exit 1
           fi
           echo "APPLE_SIGNING_IDENTITY=$IDENTITY" >> "$GITHUB_ENV"
-          echo "GAJAE_SIGNING_KEYCHAIN=$KEYCHAIN" >> "$GITHUB_ENV"
           echo "signed=true" >> "$GITHUB_OUTPUT"
           echo "Signing as: $IDENTITY"
 
@@ -441,6 +431,16 @@ jobs:
     permissions:
       contents: write
     steps:
+      - name: Require signed desktop before publication
+        env:
+          DESKTOP_SIGNED: ${{ needs.desktop-macos.outputs.signed }}
+        run: |
+          set -euo pipefail
+          if [ "$DESKTOP_SIGNED" != "true" ]; then
+            echo "Refusing to publish a desktop artifact without the signing and notarization lane." >&2
+            exit 1
+          fi
+
       - name: Download canonical server release assets
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:

docs/GJC-DELEGATION-CONTRACT.md

@@ -0,0 +1,56 @@
+# App delegation and native workflows
+
+`server/gjc-delegation-executor.ts` owns the app's `task` and `subagent`
+tools. The raw SDK task executor remains excluded: the offline regression in
+`server/gjc-sdk-contract.bun.test.ts` demonstrates its parent-permission bypass
+on SDK 0.16.4. Do not remove that regression or enable raw children to satisfy a
+workflow requirement.
+
+Ordinary tasks use `executionMode: "default"`; omission and `null` also select
+ordinary execution. `"ultragoal-red-team"` requires the Executor role. Unused
+control fields and optional repository metadata accept `null` for strict
+provider schemas. Bindings are validated through the SDK's exported repository
+contract before approval and again at child startup/resume; they do not select
+a different child cwd. A different repository or escaping relative subdirectory
+is rejected.
+
+Children retain the actual parent model, effort, credentials, permissions and
+tool allowlist. The direct owner's and root's native mutation/Ultragoal ask
+guards also apply to child tool calls. Each child has a distinct session ID and
+keeps GOAL disabled; the root adapter owns GOAL lifecycle and turn disposal.
+For AUTO credentials, the child pins the opaque stored row selected by the
+parent's authenticated request in its own credential scope. Resume reevaluates
+the current account and any new explicit pin; credential values never enter
+delegation receipts.
+
+A rejected SDK abort is an unconfirmed cancellation. `cancel` and `dispose`
+return a sanitized failure and permit retry; disposal keeps new work fenced.
+Concurrent abort attempts share one pending SDK call. An owner remains open
+until its descendants actually stop, including after a descendant abort fails.
+
+The `gajae-app.delegation.v1` transcript entries record child ownership and
+bounded result text. They are not native workflow completion receipts. Workflow
+assignments must carry their authoritative owner `session_id`, `run_id` and
+repository binding. Child prompts identify the app delegation ID, direct owner
+and root, and instruct writers to use the assignment's owner/run IDs explicitly.
+
+The offline tests in `server/gjc-delegation-executor.bun.test.ts` exercise SDK
+0.16.4 public exports with real sessions, tools, transcripts and temporary Git
+repositories. A deterministic transport stands in for the model; it asserts
+`openai-codex/gpt-6-astra` with `xhigh` on every request and makes no network model
+calls. They establish these contracts:
+
+- Ralplan: Planner artifacts and independent Architect/Critic reads flow through
+  `gjc ralplan --write`; native receipts bind the actual child IDs and hashes.
+  Resumed lanes retain their IDs. Native overwrite and user-approval/Stop guards
+  remain effective after the review passes.
+- Ultragoal: independent lanes read a CLI fixture, execute it and provide real
+  replay evidence. The owner joins their results and the Critic independently
+  checks that join. Native validation rejects wrapper-only results, unjoined
+  evidence and a false replay expectation. Only the native checkpoint writes
+  the final aggregate completion receipt, verified by the durable-state guard.
+
+These tests qualify the app-to-runtime contracts for the small fixtures; they
+do not establish live model orchestration, product QA quality, browser E2E,
+root GOAL lifecycle or packaged-app completion. Those require the parent
+integration's live runs and repository promotion gate.

docs/GJC-WORKER-PROTOCOL.md

@@ -115,6 +115,8 @@ scope is fixed by this specification, and a frame that gets it wrong is rejected
 | `turn.start` | scoped | Run a turn in an existing conversation. |
 | `turn.abort` | scoped | Stop the running turn. |
 | `turn.steer` | scoped | Inject input into the running turn without ending it. |
+| `goal.inspect` | scoped | Read the exact persisted provider session's goal for an authenticated owner and resolved project cwd; refuses an active run. |
+| `goal.control` | scoped | Read or control a goal on the exact worker `runId`; requires matching app session, owner, cwd, and expected goal ID. The trusted server may pass literal `stopAfterMutation: false` for pause/drop so the enclosing native worktree job owns cancellation. |
 | `ask.reply` | scoped | Answer a question the worker raised with `ask.presented`. |
 
 ### Events

docs/V2-SESSION-HANDOFF.md

@@ -478,10 +478,10 @@ after the reconcile fetch replaces realtime timestamps with disk ones.
   [`plans/adversarial-skills-e2e-2026-09-05.md`](plans/adversarial-skills-e2e-2026-09-05.md).
   DNS deployments now require explicit `ALLOWED_HOSTS`; see `SELF-HOST.md`.
   The app avoids the SDK workflow-ID defect by omitting the redundant explicit
-  provider ID, and restores skill requests from transcript metadata. Delegation
-  remains disabled because an offline real-SDK test proved that children bypass
-  their parent's permission policy. Research/file artifacts do not mean that
-  `ralplan`, `ultragoal` or the autoresearch goal lifecycle completed.
+  provider ID, and restores skill requests from transcript metadata. The raw
+  SDK delegation path remains unsafe. The follow-up implementation replaces
+  it with app-owned children that inherit permissions, account, model/effort,
+  workflow guards and cancellation; see `GJC-DELEGATION-CONTRACT.md`.
 - The parallel correctness pass is recorded in
   [`plans/code-review-2026-09-05.md`](plans/code-review-2026-09-05.md), including
   session/queue isolation, transcript turns and transport, scratch startup,
@@ -499,18 +499,29 @@ after the reconcile fetch replaces realtime timestamps with disk ones.
   response/abort smoke passed. The existing redundant-ID mitigation stays in
   place. The real-SDK child permission-bypass regression still reproduces on
   0.16.4; the identity fix does not qualify unrestricted delegation.
-- **Issue #3 now has a live matrix, with unresolved capability blockers.** The bundled `gjc`
-  shim is already in the app; the issue's older "shim in progress" comment
-  is no longer current. Nine skills were actually invoked, including user
-  skills. The interview produced its pending-approval spec; mandatory
-  delegation and goal-mode restrictions still prevent complete execution of
-  the other bundled workflows. Keep #3 open for those recorded limitations.
+- **Issue #3 has a follow-up implementation and renewed live qualification.**
+  Goal state now comes from the SDK transcript, with authenticated, scoped
+  pause/resume/cancel controls and app-owned delegation. The initial 20-step
+  lease stopped ordinary workflow preparation; the visible limit is now 200
+  model steps or 120 minutes. Model-facing goal operations do not reset that lease. The interview
+  and independently reviewed Ralplan plan reached their requested approval
+  stopping points; autoresearch persisted its verdict, completed the goal and
+  retired the mission. Ultragoal also passed native aggregate evidence and
+  completed its real goal. Final acceptance is recorded in
+  `plans/followup-acceptance.md`. #3 remains open for original Cursor/Anthropic
+  live qualification and upstream workflow/CLI efficiency, outside the
+  requested Astra-only test lane.
 - **CI signing awaits owner-provided credentials.** `gh secret list --env
   release` returned no environment secrets on September 5. The workflow
   and the five required names are documented in
   `DESKTOP-TAURI-VERIFICATION.md`; the first signed CI dispatch remains
-  unverified. This is separate from the locally signed releases that shipped.
-- Session worktree selection still depends on the runtime's Slice 3.
+  unverified. Local signing readiness and exact-draft asset verification are
+  available in `scripts/release/SIGNING-READINESS.md` and
+  `scripts/release/LOCAL-RELEASE.md`, without exporting signing credentials.
+- Managed session worktree selection is implemented on the existing native job
+  runtime, including persisted project/cwd identity, per-run validation and
+  cancellation. It does not await a future SDK Slice 3. See
+  `plans/session-worktree-goal-acceptance.md`.
   Conversation forks and split-pane workspaces remain deferred product
   decisions, not missing implementations from the completed plans.
 

docs/plans/followup-acceptance.md

@@ -0,0 +1,95 @@
+# Remaining-work integration and acceptance
+
+This follows PRs #30, #35 and #38, all merged after their required checks.
+All implementation/review agents and actual model requests used Astra with
+xhigh reasoning. Offline tests use controlled transports rather than another
+model. Final promotion checks are recorded below; live tests distinguish
+workflow completion from a turn merely ending.
+
+## Changes and reproduced defects
+
+| Area | Result |
+| --- | --- |
+| SDK identity | Pin 0.16.4, preserve the original regression input, update both native platform closures and generated command/notices data. Issue #18 closed through #30. |
+| Provider variants | Keep provider-qualified choices and test canonical collapse, account routing, cache migration and restart. #35 merged. |
+| Linux | #38 adds native deb/AppImage builds, Ubuntu 22.04/24.04 package/GUI/install checks, terminal ownership and AppImage environment fixes. Review additionally fixed stale socket reclamation and symlinked packaging entrypoints. |
+| Delegation | Replace unsafe SDK task/subagent executors with app-owned sessions; preserve actual AUTO account selection, model/effort, permissions, tools, native workflow guards, owned resume and retryable cancellation. Raw SDK bypass coverage remains. |
+| Goals | Project persisted SDK goal state; enforce owner/run/goal identity; show status, objective, usage and controls. Disk failures fence continuation. Stop remains retryable. Worktree controls use worker IDs while native job tickets own cancellation. |
+| Worktrees | Create an owned native job for a new isolated session; preserve parent project permissions/grouping and actual cwd through later turns, restart, files, skills, exports and Git views. Reject changed/foreign worktrees and conflicting transcript identities. |
+| Search | Search decoded GJC transcripts with bounded lines, identity/root checks and project filtering before result limits. Search concise skill requests, not expanded prompts. |
+| Replay | Scope cursors to run generations; reject obsolete/repeated frames; preserve navigation-time deltas; reconcile persisted answers/thinking even when reasoning separates them or the user anchor is outside the window. |
+| Cleanup | A branded unconfirmed cleanup fault quarantines the shared GJC worker. Node waits for verified whole-worker reaping before terminal settlement; failed reaping retains uncertainty and blocks new dispatch. Provider text cannot spoof the fault. |
+| UI | Stabilized picker remains from #37. Goal controls survive view/StrictMode lifecycle changes. Settings uses the owned dialog with named dismissal, focus restoration and Escape ownership. Live message counts do not claim stale totals. |
+| Release | Check signing prerequisites before publication, verify exact local draft assets and signatures, and retain mount directories if detachment cannot be confirmed. No signing private key is exported. |
+
+Root goals have a cumulative **200 model-step / 120-minute** run lease.
+Tool-calling SDK turns count as steps. Explicit user resume starts a new run;
+model pause/resume does not reset that run's lease. Delegation retains four
+active children, depth two, 32 launches per run and a five-minute child limit.
+Observed Ralplan children completed within that child limit; the restrictive
+root 20-step limit, rather than a child timeout, interrupted the initial goal
+drills. Limits do not waive permissions or native completion evidence.
+
+## Live skill outcomes
+
+Tests use disposable Git projects, an isolated app database and session roots.
+The ordinary catalog consists of four bundled skills and five user skills.
+The QA OAuth connection was renewed through the existing browser sign-in flow.
+Sign-in values stayed outside application conversation transcripts and model
+prompts; credentials were not copied back into the normal app store.
+
+| Skill | Evidence and disposition |
+| --- | --- |
+| deep-interview | Structured questions and approval UI worked; a short specification was saved pending approval with 1.6% final ambiguity. No implementation/handoff. `--quick` still yields the native pre-resolved 5% threshold. |
+| ralplan | Actual Planner, resumed Planner, independent Architect and Critic produced native validated artifacts. The operator selected Stop at the requested approval boundary. Source remained unchanged. |
+| autoresearch | Existing benchmark yielded baseline 11.5, candidate 8.5 and 26.09% reduction. Native verdict, matching goal completion and mission cleanup were observed. Small-sample limitations were retained. Initial unsupported CLI flags were corrected during the run. |
+| ultragoal | The exact 18-byte output and unchanged acceptance files were independently checked. Existing tests passed. Actual independent implementation/review/QA and terminal Critic evidence passed native validation; the durable aggregate receipt and real goal completion were observed. Earlier leases paused the workflow; explicit resume retained its identity and completed it. |
+| no-english (user) | Korean rewriting preserved paths, identifiers and executable commands. Passed. |
+| insane-search (user) | Public Example Domain read succeeded through the normal reader; no fallback engine was needed. Earlier private-target refusal was a separate negative test. |
+| gpt-image (user) | Image-generation lane cannot establish Astra-only generation. Initial isolated binding absence and a corrected-binding retry are recorded; no image success is claimed. |
+| insane-review (user) | Required Sol Pro lane conflicts with Astra-only execution. Refusal was verified; local checks are not an external review result. |
+| extragoal (user) | Correctly refused missing feature-branch/diff evidence and the unavailable cross-family reviewer. No fabricated approval or remote publication. |
+
+Actual parent/child assistant records inspected so far contain only
+`openai-codex/gpt-6-astra` and `xhigh` thinking changes. Generic live Planner
+delegation returned the fixture heading through task/subagent.
+
+## Verification and external prerequisites
+
+- SDK update passed full `npm run verify`, eight GJC E2Es, credentialed response/
+  abort smoke, and Node 22/24 CI before #30 merged.
+- Latest #38 source passed Node 22/24 CI, Linux package build and package/GUI
+  checks on both Ubuntu versions before merge.
+- Full integrated `npm run verify` passed at `a69facd` and again at `b07394c`,
+  including the cleanup-reaping correction. The initial CI failure came from
+  expensive DOM-object assertion formatting in focus waits; boolean assertions
+  preserved behavior coverage without raising the timeout.
+- Node 22/24 and all Linux package/GUI checks passed on `b07394c`. Final-head
+  CI disposition is recorded on PR #39.
+- Final GJC/browser/clone/native E2E invocation passed 17 tests without skips;
+  native integration tests in the full gate cover the remaining test suites.
+- Real browser acceptance created a managed worktree, wrote only its proof
+  file, retained the original project binding after reload, completed a second
+  read-only goal in the same worktree, and cancelled an approved running wait.
+  The native job returned to ready with its lease cleared and an `aborted`
+  terminal in replay. The REST replay helper was corrected to `/events`.
+- The Developer ID-signed macOS candidate built from `b07394c` (identical tree
+  `c6a91510690f043e9ed51790e064ef6833d5d197`) passed strict signatures, 7/7
+  out-of-tree packaged checks and the separate data-survival smoke. No new
+  notarization or release publication was performed.
+- GitHub-hosted signing still needs `APPLE_CERTIFICATE_P12`,
+  `APPLE_CERTIFICATE_PASSWORD`, `APPLE_ID`, `APPLE_TEAM_ID` and
+  `APPLE_APP_PASSWORD`. Local identity/profile readiness does not configure CI.
+- Windows execution and full interactive GNOME/KDE sessions are not claimed.
+  Conversation forks and split panes remain separately deferred product scope.
+- Fresh macOS GUI acceptance requires a disposable macOS account: existing
+  environment overrides do not isolate the WebKit data store. Browser UI and
+  package/signature checks are separate evidence.
+- Issue #3 remains open for the original Cursor/Anthropic live qualification
+  and native skill/CLI efficiency. The requested Astra-only lane now completes
+  the bundled workflows; it does not establish those other-provider results or
+  eliminate their large workflow/receipt overhead.
+
+Local evidence during this run is under `/tmp/gajae-followups-e2e/`; the final
+report records results so it does not depend on temporary credentials or live
+test processes remaining on disk.