[duc15052006-dotcom]

Purpose

This is the aggregate release-candidate PR from verify/release-candidate to main. It contains the complete stacked implementation so the repository can be reviewed and verified as one product change instead of requiring more than twenty dependent merges before CI can see the final tree.

Included roadmap work

• per-Agent Model/API configuration, connection testing, encrypted credential references, runtime fallback
• per-Agent Instructions, Skills and bounded Knowledge
• Computer lifecycle: Start / Restart / Stop / Reset, metrics and governed persistent workspace files
• group channels with multiple coworkers, @mention routing through durable handoffs, shared files and delegation status
• security hardening: default-deny/fail-closed policy behavior, audit coverage, destructive reset confirmation, SSRF protections, write-only credentials, human handoff for login/MFA/CAPTCHA
• Windows desktop first-run flow with installer-first setup, provider/model Test connection, end-to-end Bot proof, first-coworker handoff and Computer quickstart
• diagnostics/recovery, native update checks, desktop shortcut lifecycle and uninstall acceptance
• signed Windows release gates, exact artifact identity verification and standard-user acceptance of the exact signed NSIS installer
• release preflight/static checks that pin the product and security contracts above

Verification lane

The head branch is under verify/**, so push-triggered CI is enabled as a fallback when pull-request events are suppressed. This PR itself also gives the final combined tree a normal pull_request target against main, which should trigger the standard CI and Desktop workflows.

Merge guidance

Do not merge this release-candidate PR until the full CI/Desktop workflows are green and the protected Windows signing/release acceptance required by the release process has been exercised where applicable.

The earlier stacked PRs remain useful as review-sized slices, but this aggregate PR is the authoritative final-tree verification target.

Final release blockers

Current release-candidate head: 1540552731a1a5982a069d965c693bd87b45e7cf.

PR #178 is now merged into RC. Its exact source head e4cf2c5d3ee59835dc71ba9a1cf157cf81537d39 passed PR CI 37433527425 and Desktop 37433527493. Full preview run 37433544751 passed all 57 jobs, including full container build/boot checks, the real preview Desktop build, all 17 owned runtime image publications, all 17 anonymous pulls and public bootstrap URL checks. The RC merge tree equals the tested preview tree. Post-integration CI 37435131534 passed on the exact current RC head; post-integration Desktop remains pending.

PR #177 is now merged into RC. Post-integration CI 37432250894 and Desktop 37432250919 passed on the previous RC head 96e4ca2cdaa819374c1a4de0ace31f0111386834. A signing regression workflow success does not prove protected certificate signing; that gate remains open.

PR #176 fixes smoke audit evidence correlation and credential-bearing HTTP error logs. Its exact PR head 565446ca88c5d77228e94829778d2a0a46e30429 passed CI run 37419816537, including aggregate verify, before integration. Post-integration CI run 37421238328 and Desktop run 37421242594 passed on the previous RC head de4ecdf0d985d6da4f92b4e4d5cacdef30639d6a. The previous CI/Desktop-tested head was 3528ad9ea55987b6ea9939452807962113cbf1f0; neither that evidence nor the fixture regressions close protected signing or the real Intelligence smoke gate.

1. Protected Windows signing — Azure federation remaining

   • GitHub-side signing bootstrap is now self-contained; no Azure subscription id or mandatory Environment variables are required.
   • Protected signing Fix grammar: fused sentence in pydantic-ai-bot README CopilotKit/OpenBot#243 reaches azure/login successfully with the expected client/tenant/vault/certificate configuration.
   • Azure currently rejects the OIDC assertion with AADSTS700213: no matching federated identity record exists for this repository's immutable windows-signing environment subject.
   • An authorized owner/administrator of the existing Entra application must add the federated credential from desktop/signing/azure-federation.json.
   • After that Azure-side trust exists, re-trigger protected signing on the exact current release head and require the full certificate/signature/installer verification path to pass.

2. Real Intelligence smoke

   • Run the documented real-deployment journey in docs/releasing.md / tests/smoke.
   • Keep authentication material local; record only sanitized PASS evidence on this PR.

3. Interactive Windows setup / close recovery

   • The user's Windows install reproduced an untracked podman-openbot WSL distribution while Podman machine listing returned [], blocking machine initialization. A local WSL export completed successfully before targeted cleanup was suggested; the later screenshot shows machine creation, startup and API 6.1.3 successfully completed.
   • Closing the setup window reproduced Windows OpenBot is not responding. PR #177 removes the blocking native close question from the event loop and adds callback regressions. Its exact head e819f696eb9c568d57f58c95c888921983c75663 passed CI 37429809690 and Desktop 37429809691, including both new native tests on Windows and installer/standard-user acceptance. The unsigned Windows test artifact is available. PR fix(desktop): keep close confirmation responsive on Windows #177 is merged into RC; require real Windows close/reopen/quit evidence before closing this gate.

4. Complete first-run distribution

   • The user's latest Windows screenshot reaches Deployment after engine setup passes, then /releases/latest returns 404: this repository has no stable release. Generic Desktop CI artifacts are shell-only and cannot complete first run in this state.
   • PR #178 prepares a separate unsigned Windows x64 prerelease with a compile-time exact runtime tag, all 17 owned digest-pinned component images and anonymous-pull checks. Local and full CI/Desktop tests passed, and the actual candidate installer metadata/hash was verified. The complete unsigned Windows x64 prerelease is published, its tag targets the full tested source SHA, and all 17 components passed anonymous pulls. This closes the missing-distribution defect for this preview; the real Windows journey remains pending. Generic RC Actions installers continue stable discovery and are not substitutes for this preview. Ordinary CI installers should not be presented as complete packages.

Before the merge, also confirm main branch protection requires aggregate verify and keep an independent source backup/mirror.

Do not merge this PR into main until all mandatory gates pass on the exact release head.

[duc15052006-dotcom]

Verification checkpoint — 2026-09-18

Current release-candidate head: 125a7821de56aaa99a3ef32fa0c258667afc7f29

Static/review work completed since the previous checkpoint:

• first-run model connection proof is mandatory and App integration coverage now follows it (fix(desktop): require model Test connection during first-run #46, test(desktop): align App flows with mandatory model connection proof #50)
• compatible endpoint metadata SSRF is blocked at both probe and persistence boundaries (fix(desktop): block cloud metadata in model connection probe #39, fix(desktop): reject metadata model endpoints before persistence #45)
• signed Windows release files are staged into the flat artifact layout consumed by publish, and both signed executable hashes are checked against signature evidence (fix(release): flatten signed Windows artifact before publish #48)
• an existing version tag must point exactly at the release commit before a GitHub Release can be refreshed (fix(release): bind existing version tag to exact release commit #49)

Hosted verification is not green or verified:

• GitHub Actions API for verify/release-candidate currently reports 0 workflow runs
• commit statuses for the current head are empty
• protected windows-signing has therefore not produced execution evidence on this final tree

Do not merge #30 until CI + Desktop + protected Windows signing/exact signed-installer acceptance provide actual workflow evidence.

[duc15052006-dotcom]

Actions blocker identified

The repository API confirms this repository is a public fork created 2026-09-17. GitHub Actions reports 0 workflow runs for verify/release-candidate.

GitHub's fork behavior explains this state: workflows in forked repositories do not run by default until Actions is enabled for the fork.

This is now the primary external verification blocker. The release-candidate must remain unmerged until Actions is enabled and the final head receives real CI/Desktop results; protected windows-signing still requires its environment/OIDC execution evidence as a separate release gate.

[duc15052006-dotcom]

Verification checkpoint update

Current head: 44b6d94ba9967426023fa8c1200ed7e8f4d26a86

Additional release blockers closed:

• fix(release): fail early on invalid or occupied versions #51: Create release PR now paginates all open PRs, validates stable/safe SemVer, and refuses an already-occupied next version tag.
• fix(release): refuse unsafe pre-existing GitHub Release state #52: refreshing an existing GitHub Release now fails closed on draft/prerelease state or unexpected stale assets.

Current aggregate size: 328 commits, 119 changed files.

Hosted verification remains blocked externally:

• Actions runs on verify/release-candidate: 0
• commit statuses on current head: none
• this repository is a public fork, and GitHub Actions must be enabled for the fork before these workflows can execute.

Keep #30 unmerged until a post-enable synchronize/push produces real CI + Desktop evidence and the protected Windows signing acceptance is exercised.

[duc15052006-dotcom]

Product checkpoint: local resource, browser, persistence, safety, and scheduled wake

Keep these requirements before final release:

• Each built-in Bot uses its own deployment-owned Chromium/browser profile and persistent workspace; never reuse the user's personal Chrome profile.
• Stop/Sleep must terminate the Bot computer process/container and release active CPU/RAM/GPU use while retaining browser profile/workspace for the next wake.
• A full Stop OpenBot / Gaming mode must stop every Bot computer and other nonessential local services so the host can reclaim resources for games; closing the desktop window alone must not be presented as equivalent to full stop.
• Restarting OpenBot must restore durable state (threads/memory, Bot configuration, browser profile, workspace, scheduled routines) without replaying destructive actions.
• Scheduled routines may wake the required Bot/computer at the due time while OpenBot's local background service is running; if the entire deployment/PC is powered off, missed windows follow the documented skip/grace behavior rather than pretending work ran.
• Browser downloads and untrusted files must stay inside the Bot's isolated persistent workspace/profile by default, not the user's personal Downloads/Desktop. No host-directory mounts, Docker socket, or privileged access from Bot computers. Add bounded storage/quota + quarantine/scanning policy where practical; Reset must be able to purge the Bot profile/workspace intentionally.
• Treat downloaded files/pages as untrusted. No CAPTCHA/MFA/login bypass; hand off to the user. Keep action policy fail-closed/default-deny.

User hardware target discussed for local-first acceptance: i5-12500H, RTX 3050 4GB, 16GB DDR4, 512GB SSD. Resource controls should make it practical to stop all Bots before gaming and resume later.

[duc15052006-dotcom]

Integrated teammate-orchestration improvements from PR #65 at 2b75d1da3a334b18a621a04323c565ed2fc65678.

What changed:

• selective group coordinator dispatch for unmentioned team requests
• verified/bounded peer roster with profile text treated as untrusted data
• explicit Team dispatch status in group conversations
• natural-language durable Routine behavior in both built-in model adapters
• no invented schedule/timezone and no false background-work promises
• regression coverage for coordinator routing and Routine guidance

Security/runtime boundaries were not widened: shell policy, Computer sandboxing, quarantine/ClamAV, credentials and resource controls are unchanged.

Verification on the integrated release-candidate SHA:

• CI fix(economy): fail closed on receipt corruption and converge retries #156: success
• CI fix(economy): revoke approval authority for deleted Agents #157: success
• Desktop security(workflows): cap autonomous concurrent steps #111: success (Linux/macOS/Windows, including Windows installer smoke + standard-user acceptance)
• Desktop Windows signing fix(workflows): resolve destination channel server-side #108: success
• Desktop Windows signing security(workflows): quarantine channel choice labels #109: success

A duplicate Desktop #110 was still running when this note was posted; Desktop #111 is the equivalent complete successful run on the same SHA.