5144 lines
332 KiB
Plaintext
5144 lines
332 KiB
Plaintext
{
|
|
"schemaVersion": 1,
|
|
"updatedAt": "2026-07-13",
|
|
"policy": {
|
|
"maturityLevels": [
|
|
"experimental",
|
|
"soak",
|
|
"blocking",
|
|
"accepted-gap",
|
|
"deprecated"
|
|
],
|
|
"blockingPromotion": {
|
|
"minimumSoakRuns": 100,
|
|
"minimumSoakDays": 14,
|
|
"maximumUnexplainedFlakes": 0
|
|
}
|
|
},
|
|
"gates": [
|
|
{
|
|
"id": "git-worktree.refresh-event-semantics",
|
|
"title": "Index-only Git metadata cannot trigger structural worktree refresh fanout",
|
|
"maturity": "experimental",
|
|
"protection": "partial",
|
|
"owner": "terminal-runtime",
|
|
"layer": "main-preload-renderer-contract",
|
|
"surfaces": [
|
|
"terminal input availability",
|
|
"worktree discovery",
|
|
"Source Control status refresh"
|
|
],
|
|
"platforms": [
|
|
"macos",
|
|
"linux",
|
|
"windows"
|
|
],
|
|
"providers": [
|
|
"local",
|
|
"ssh"
|
|
],
|
|
"coveredPlatforms": [
|
|
"macos"
|
|
],
|
|
"coveredProviders": [
|
|
"local",
|
|
"ssh"
|
|
],
|
|
"coverageNotes": "Local deterministic evidence covers git-common classification, desktop watcher debounce counts, non-overlapping poller semantics, macOS native-watch fallback, preload cleanup, and Source Control active-visible repo filtering. Linux/Windows are covered at the shared poller layer by forcing the non-darwin path; live platform runs remain gaps.",
|
|
"motivatingLinks": [
|
|
"https://github.com/stablyai/orca/pull/7086"
|
|
],
|
|
"invariant": "Index-only Git activity below the common Git directory must not emit worktrees:changed, invalidate worktree caches, or trigger fetchWorktrees fanout; structural add/remove/HEAD/gitdir/locked/config.worktree changes must still refresh worktrees and nudge Source Control; external head moves (commit, amend, reset) must reach background worktree rows through spawn-free metadata reads, never through structural fanout.",
|
|
"oracle": "Classify exact git-common paths as structural, status-only, or ignored; count notifications from debounced watcher events; force the Linux/Windows poll path to emit allowlisted leaf events, detect linked HEAD rewrites independent of entry-directory mtime, and surface in-place index rewrites via the backstop re-stat; diff head identities from metadata-file reads and notify only real head moves; assert Source Control subscribes to both structural and status-only signals with active-repo and visibility filters.",
|
|
"commands": [
|
|
"pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/worktree-base-directory-event-filter.test.ts src/main/ipc/worktree-base-directory-watcher.test.ts src/main/ipc/worktree-base-directory-poller.test.ts src/main/ipc/worktree-head-identity-reader.test.ts src/renderer/src/hooks/worktree-head-identity-apply.test.ts src/renderer/src/components/right-sidebar/git-status-push-signal-refresh.test.ts src/renderer/src/hooks/useIpcEvents.test.ts"
|
|
],
|
|
"testFiles": [
|
|
"src/main/ipc/worktree-base-directory-event-filter.test.ts",
|
|
"src/main/ipc/worktree-base-directory-watcher.test.ts",
|
|
"src/main/ipc/worktree-base-directory-poller.test.ts",
|
|
"src/main/ipc/worktree-head-identity-reader.test.ts",
|
|
"src/renderer/src/hooks/worktree-head-identity-apply.test.ts",
|
|
"src/renderer/src/components/right-sidebar/git-status-push-signal-refresh.test.ts",
|
|
"src/renderer/src/hooks/useIpcEvents.test.ts"
|
|
],
|
|
"assertionRefs": [
|
|
{
|
|
"file": "src/main/ipc/worktree-base-directory-event-filter.test.ts",
|
|
"assertions": [
|
|
"primary HEAD and packed-refs classify as structural while primary index classifies as status-only",
|
|
"linked HEAD/gitdir/locked classify as structural while linked index classifies as status-only",
|
|
"HEAD reflog appends classify as status-only for linked and primary checkouts while per-ref reflogs stay ignored",
|
|
"config.worktree classifies as structural at both linked and primary levels",
|
|
"ignored common-dir churn, spaces, Windows separators, and outside-root paths do not match structurally"
|
|
]
|
|
},
|
|
{
|
|
"file": "src/main/ipc/worktree-base-directory-watcher.test.ts",
|
|
"assertions": [
|
|
"linked index bursts produce zero notifyWorktreesChanged calls and one debounced status-only notification",
|
|
"linked HEAD and locked metadata still produce a structural worktree notification",
|
|
"status-only head moves emit head identities without structural fanout and only when heads actually changed",
|
|
"structural notifications re-baseline head identities silently and SSH watches never read identities",
|
|
"SSH-shaped index renames are status-only while overflow remains conservatively structural"
|
|
]
|
|
},
|
|
{
|
|
"file": "src/main/ipc/worktree-base-directory-poller.test.ts",
|
|
"assertions": [
|
|
"non-darwin git-common polling emits entry create/delete and allowlisted HEAD/index leaf events",
|
|
"linked HEAD rewrites are detected even after restoring the entry-directory mtime",
|
|
"linked and primary HEAD reflog appends emit despite bumping no watched leaf or entry dir",
|
|
"in-place index rewrites surface through the periodic backstop re-stat",
|
|
"primary checkout HEAD changes and macOS narrow watch/fallback behavior still emit"
|
|
]
|
|
},
|
|
{
|
|
"file": "src/renderer/src/components/right-sidebar/git-status-push-signal-refresh.test.ts",
|
|
"assertions": [
|
|
"Source Control nudges only for the active visible repo on structural and status-only signals",
|
|
"preload subscriptions and terminal command-finished listeners are cleaned up"
|
|
]
|
|
},
|
|
{
|
|
"file": "src/main/ipc/worktree-head-identity-reader.test.ts",
|
|
"assertions": [
|
|
"loose-ref, packed-refs, detached, unborn, and relative-gitdir layouts resolve or skip without spawning Git",
|
|
"traversal-shaped or backslash/colon symrefs are rejected before any path join and only hex object ids are ever emitted"
|
|
]
|
|
},
|
|
{
|
|
"file": "src/renderer/src/hooks/worktree-head-identity-apply.test.ts",
|
|
"assertions": [
|
|
"head identities patch matching rows by path (including Windows separator/casing drift) and skip unknown rows"
|
|
]
|
|
},
|
|
{
|
|
"file": "src/renderer/src/hooks/useIpcEvents.test.ts",
|
|
"assertions": [
|
|
"renderer preload API fixtures include the status-metadata and head-identity subscription contracts"
|
|
]
|
|
}
|
|
],
|
|
"evidenceRuns": [
|
|
{
|
|
"date": "2026-07-12",
|
|
"runner": "local",
|
|
"platform": "macos",
|
|
"command": "pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/worktree-base-directory-event-filter.test.ts src/main/ipc/worktree-base-directory-watcher.test.ts src/main/ipc/worktree-base-directory-poller.test.ts src/main/ipc/worktree-head-identity-reader.test.ts src/renderer/src/hooks/worktree-head-identity-apply.test.ts src/renderer/src/components/right-sidebar/git-status-push-signal-refresh.test.ts src/renderer/src/hooks/useIpcEvents.test.ts",
|
|
"result": "passed",
|
|
"durationSeconds": 3.12,
|
|
"summary": "7 files and 130 tests passed locally, adding head-identity emit-on-change without structural fanout, reflog status triggers, config.worktree structural classification, the in-place index backstop, and the spawn-free head reader with symref traversal rejection and hex-object-id output validation."
|
|
}
|
|
],
|
|
"runtimeBudget": {
|
|
"p95Seconds": 10,
|
|
"scope": "focused main/preload/renderer unit and polling tests"
|
|
},
|
|
"flakeHistory": {
|
|
"status": "unknown",
|
|
"evidence": "New experimental deterministic gate with one local macOS run; needs CI soak before promotion."
|
|
},
|
|
"redGreenEvidence": {
|
|
"status": "partial",
|
|
"evidence": "The watcher count assertions fail against the old single-signal classifier because linked index events call notifyWorktreesChanged. Saved CI red/green artifacts are still needed before blocking promotion."
|
|
},
|
|
"performanceBudget": {
|
|
"required": true,
|
|
"evidence": "Index-only bursts produce zero structural notifications, so renderer fetchWorktrees and detected-worktree cache invalidation are not reached. The non-darwin poller stays bounded and non-overlapping, compares HEAD/gitdir/locked signatures every tick, and gates linked index inspection behind the entry-directory signature. A 30-second live Electron run with 2,000 external linked-status calls delivered 50 ordered input chunks and recorded zero Orca-owned git worktree spawns across six diagnostic windows; a locked create/delete positive control still caused structural refreshes."
|
|
},
|
|
"promotionCriteria": [
|
|
"Run in soak for at least 100 consecutive passes or 14 days across required CI platforms.",
|
|
"Attach live Electron main-thread diagnostic evidence for repeated linked-worktree index rewrites while typing.",
|
|
"Add Linux/Windows live watcher evidence if shared poller-layer coverage diverges from platform behavior."
|
|
],
|
|
"knownGaps": [
|
|
"The live Electron diagnostic and screenshot evidence must remain attached to the motivating PR for durable review.",
|
|
"Linux and Windows are forced through the shared non-darwin poller in unit tests but are not live-tested here.",
|
|
"Git loose ref watching remains outside this incident fix by design.",
|
|
"SSH watches classify head-move triggers but skip the metadata-read identity diff; remote background-worktree heads still wait on a structural event or activation."
|
|
],
|
|
"demotionRule": "Keep experimental or demote if the focused gate flakes without a product or harness bug, if index-only churn can emit worktrees:changed, or if structural add/remove/HEAD/lock changes fail to converge."
|
|
},
|
|
{
|
|
"id": "runtime.headless-desktop-promotion-continuity",
|
|
"title": "Headless serve opens its desktop without replacing live terminal sessions",
|
|
"maturity": "experimental",
|
|
"protection": "partial",
|
|
"owner": "runtime-platform",
|
|
"layer": "electron-runtime-contract",
|
|
"surfaces": [
|
|
"headless orca serve",
|
|
"single-instance desktop activation",
|
|
"CLI open",
|
|
"persistent terminal reattach"
|
|
],
|
|
"platforms": [
|
|
"macos",
|
|
"linux",
|
|
"windows"
|
|
],
|
|
"providers": [
|
|
"local",
|
|
"daemon",
|
|
"ssh"
|
|
],
|
|
"coveredPlatforms": [
|
|
"macos"
|
|
],
|
|
"coveredProviders": [
|
|
"local",
|
|
"daemon",
|
|
"ssh"
|
|
],
|
|
"coverageNotes": "Deterministic unit coverage exercises activation gating, single-instance ownership, quit policy, local/remote CLI status, headless binding persistence, local daemon identity, and SSH identity transfer. A macOS Electron journey starts one headless owner in an isolated profile, creates and writes to a daemon PTY, activates the GUI through a second process, and verifies the original owner/runtime/daemon/PTY identities plus pre- and post-promotion I/O. Live packaged, Linux, and Windows journeys remain uncollected.",
|
|
"motivatingLinks": [
|
|
"https://github.com/stablyai/orca/issues/8457"
|
|
],
|
|
"invariant": "A safely promotable headless serve process is the single app owner. Desktop activation opens a window in that same process only after the persistent PTY provider and runtime RPC are ready; every live persisted local or SSH terminal remains bound to the same PTY/session, and a committed Cmd+Q still exits the promoted app.",
|
|
"oracle": "Unit tests coalesce early activation, fail closed on a fallback local provider, preserve the production single-instance path for serve, expose explicit desktop window state to local and remote clients, persist headless tab/leaf bindings, transfer local and SSH reattach metadata, and retain quit intent. The Electron journey asserts one main-process PID, runtime id, daemon PID, and PTY id across activation; confirms output written before promotion is visible afterward; confirms new terminal input still works; and requires the activating second process to exit.",
|
|
"commands": [
|
|
"pnpm exec vitest run --config config/vitest.config.ts src/main/startup/serve-desktop-activation.test.ts src/main/startup/serve-desktop-activation-wiring.test.ts src/main/startup/single-instance-lock.test.ts src/main/startup/window-all-closed-quit-policy.test.ts src/cli/runtime-client.test.ts src/cli/runtime/websocket-transport.test.ts src/main/runtime/orca-runtime.test.ts",
|
|
"pnpm exec electron-vite build --mode e2e",
|
|
"pnpm run test:e2e -- tests/e2e/headless-serve-desktop-activation.spec.ts --workers=1"
|
|
],
|
|
"testFiles": [
|
|
"src/main/startup/serve-desktop-activation.test.ts",
|
|
"src/main/startup/serve-desktop-activation-wiring.test.ts",
|
|
"src/main/startup/single-instance-lock.test.ts",
|
|
"src/main/startup/window-all-closed-quit-policy.test.ts",
|
|
"src/cli/runtime-client.test.ts",
|
|
"src/cli/runtime/websocket-transport.test.ts",
|
|
"src/main/runtime/orca-runtime.test.ts",
|
|
"tests/e2e/headless-serve-desktop-activation.spec.ts"
|
|
],
|
|
"assertionRefs": [
|
|
{
|
|
"file": "src/main/startup/serve-desktop-activation.test.ts",
|
|
"assertions": [
|
|
"early activation requests coalesce until the persistent provider is ready",
|
|
"a blocked provider drops pending activation and never opens a window"
|
|
]
|
|
},
|
|
{
|
|
"file": "src/main/startup/serve-desktop-activation-wiring.test.ts",
|
|
"assertions": [
|
|
"second-instance and macOS app activation use the same safety gate",
|
|
"headless PTY registration waits for provider settlement and promotion waits for RPC startup"
|
|
]
|
|
},
|
|
{
|
|
"file": "src/main/startup/single-instance-lock.test.ts",
|
|
"assertions": [
|
|
"serve never skips the single-instance lock even in development",
|
|
"the isolated E2E profile can opt into the production ownership path"
|
|
]
|
|
},
|
|
{
|
|
"file": "src/main/startup/window-all-closed-quit-policy.test.ts",
|
|
"assertions": [
|
|
"a promoted serve owner remains alive after an ordinary window close but exits after a committed quit"
|
|
]
|
|
},
|
|
{
|
|
"file": "src/cli/runtime-client.test.ts",
|
|
"assertions": [
|
|
"local open activates a reachable headless owner and waits for a desktop window",
|
|
"unsafe promotion returns an explicit blocked error instead of launching a second owner"
|
|
]
|
|
},
|
|
{
|
|
"file": "src/cli/runtime/websocket-transport.test.ts",
|
|
"assertions": [
|
|
"remote-paired open reports remote desktop state without launching a local app"
|
|
]
|
|
},
|
|
{
|
|
"file": "src/main/runtime/orca-runtime.test.ts",
|
|
"assertions": [
|
|
"the headless sentinel transfers authority to the first real window",
|
|
"headless local and SSH PTY bindings are persisted on first promotion and later windowless reattach without changing ordinary desktop spawn persistence",
|
|
"status distinguishes available, openable, initializing, and blocked desktop states",
|
|
"desktop-only bell, command, and link scanners remain disabled until a real renderer graph is ready"
|
|
]
|
|
},
|
|
{
|
|
"file": "tests/e2e/headless-serve-desktop-activation.spec.ts",
|
|
"assertions": [
|
|
"desktop activation keeps the same main owner PID, runtime id, daemon PID, and PTY id",
|
|
"terminal output written before promotion remains visible and post-promotion input/output still works",
|
|
"the activating second process exits instead of becoming another owner"
|
|
]
|
|
}
|
|
],
|
|
"evidenceRuns": [
|
|
{
|
|
"date": "2026-07-13",
|
|
"runner": "local",
|
|
"platform": "macos",
|
|
"command": "pnpm exec vitest run --config config/vitest.config.ts src/main/startup/serve-desktop-activation.test.ts src/main/startup/serve-desktop-activation-wiring.test.ts src/main/startup/single-instance-lock.test.ts src/main/startup/window-all-closed-quit-policy.test.ts src/cli/runtime-client.test.ts src/cli/runtime/websocket-transport.test.ts src/main/runtime/orca-runtime.test.ts",
|
|
"result": "passed",
|
|
"durationSeconds": 13,
|
|
"summary": "Seven activation, ownership, quit, local/remote CLI, and runtime contract files passed with 704 tests, including first and repeated windowless reattach, local/SSH identity transfer, ordinary desktop persistence isolation, and dynamic side-effect scanner gating."
|
|
},
|
|
{
|
|
"date": "2026-07-13",
|
|
"runner": "local",
|
|
"platform": "macos",
|
|
"command": "pnpm run test:e2e -- tests/e2e/headless-serve-desktop-activation.spec.ts --workers=1",
|
|
"result": "passed",
|
|
"durationSeconds": 52,
|
|
"summary": "The isolated Electron journey passed repeatedly on the final source; the latest 51.6-second run retained the same main owner, runtime, daemon, and PTY, restored pre-promotion output, accepted post-promotion input, and observed the activating process exit."
|
|
}
|
|
],
|
|
"runtimeBudget": {
|
|
"p95Seconds": 120,
|
|
"scope": "focused unit contracts plus one isolated Electron headless-to-desktop journey"
|
|
},
|
|
"flakeHistory": {
|
|
"status": "unknown",
|
|
"evidence": "New deterministic contracts and two consecutive local macOS Electron passes; CI and cross-platform soak history are not yet available."
|
|
},
|
|
"redGreenEvidence": {
|
|
"status": "complete",
|
|
"evidence": "The first Electron red run proved that bypassing the dev single-instance lock created a second owner. After enforcing one owner, the next red run retained owner/runtime/daemon identity but exposed a new PTY because the headless tab/leaf binding was not persisted. The final implementation persists that binding before renderer hydration and both subsequent Electron runs kept the original PTY and transcript. Focused unit tests were also observed red before the activation gate, promotion metadata transfer, and headless spawn-persistence changes were added."
|
|
},
|
|
"performanceBudget": {
|
|
"required": false,
|
|
"evidence": "Activation adds no polling in the app owner and performs one bounded pass over live PTY records plus persisted terminal bindings only when a headless owner opens its first window. Desktop-only bell, command, PR-link, and mode scanners are rebuilt only while a real renderer graph is ready, preserving the prior pure-headless output path. CLI open keeps its existing 250ms bounded startup poll."
|
|
},
|
|
"promotionCriteria": [
|
|
"Collect at least 100 consecutive CI or soak passes or 14 days without an unexplained flake.",
|
|
"Add live packaged activation coverage on macOS plus representative Linux and Windows single-instance journeys.",
|
|
"Add an Electron SSH promotion journey in addition to the deterministic identity-transfer unit contract."
|
|
],
|
|
"knownGaps": [
|
|
"The Electron journey uses an isolated development bundle rather than the installed application so it cannot disturb a real user session.",
|
|
"Linux and Windows single-instance activation have unit coverage but no live Electron evidence yet.",
|
|
"SSH identity transfer is deterministic unit coverage only; the live Electron journey currently exercises the local daemon provider."
|
|
],
|
|
"demotionRule": "Quarantine the Electron journey only with a linked product or harness defect; demote if activation changes the owner/runtime/daemon/PTY identity, loses prior output, opens before provider readiness, or fails to honor a committed quit."
|
|
},
|
|
{
|
|
"id": "editor.live-log-append-stability",
|
|
"title": "Long live session logs retain their Monaco viewport while appending",
|
|
"maturity": "experimental",
|
|
"protection": "partial",
|
|
"owner": "editor-runtime",
|
|
"layer": "renderer-electron-contract",
|
|
"surfaces": ["Agent Session History View Log", "Monaco external-content reconciliation", "renderer crash containment"],
|
|
"platforms": ["macos", "linux", "windows"],
|
|
"providers": ["local"],
|
|
"coveredPlatforms": ["macos"],
|
|
"coveredProviders": ["local"],
|
|
"coverageNotes": "Focused tests and real-Monaco 9/50 MiB performance and undo-retention benchmarks are platform-independent. Local macOS Electron evidence opens a synthetic 9 MiB transcript through Agent Session History at fixed 900x720 viewport, 13px font, 1x zoom, and asserts the full 9 MiB model length loaded as a font-metric-independent containment check (word-wrap pixel geometry varies ~10% across runners, so a generous content-height floor is only a collapsed/truncated-render smoke check), then verifies three five-second-cadence watcher appends with Find open and closed. Live Windows/Linux evidence remains uncollected.",
|
|
"motivatingLinks": ["https://github.com/stablyai/orca/pull/8432"],
|
|
"invariant": "Append-only external file growth changes only Monaco's model suffix, retaining the viewport, selection, Find state, and renderer liveness above the append point; read-only live tails do not create undo history, while editable external updates remain undoable and arbitrary rewrites continue to replace the model content.",
|
|
"oracle": "Focused tests assert one post-mount content owner, actual outer lifecycle remount ordering across retained path models, exact end-of-model suffix edits with one model read, no-op equality, full replacement for non-appends, and real-Monaco undo behavior for read-only live tails versus editable files. With Node forced GC, real-Monaco benchmarks alternate 30 suffix and 30 replacement samples after five warmups on fresh equivalent models at 9 and 50 MiB, then compare exact Monaco undo-service and ArrayBuffer retention after five 10 MiB appends. The Electron scenario alternates an e2e-only legacy setValue red control and the fixed watcher append from restored equivalent model/geometry at the measured legacy-failure cadence, asserting that the control disrupts anchor state while the fixed path preserves visible ranges, selection, complete Find state, scroll offset, non-undoability, renderer survival, and forced-GC heap/native-memory budgets.",
|
|
"commands": [
|
|
"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/editor/monaco-content-sync.test.ts src/renderer/src/components/editor/MonacoEditor.content-owner.test.tsx src/renderer/src/components/editor/EditorContent.monaco-lifecycle.test.tsx",
|
|
"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/editor/monaco-content-sync.undo-history.test.ts",
|
|
"node --expose-gc ./node_modules/vitest/vitest.mjs bench src/renderer/src/components/editor/monaco-content-sync.bench.ts --pool=threads",
|
|
"node --expose-gc ./node_modules/vitest/vitest.mjs bench src/renderer/src/components/editor/monaco-content-sync.undo-retention.bench.ts --pool=threads",
|
|
"pnpm run test:e2e -- tests/e2e/agent-session-log-tail-stability.spec.ts --workers=1"
|
|
],
|
|
"testFiles": [
|
|
"src/renderer/src/components/editor/monaco-content-sync.test.ts",
|
|
"src/renderer/src/components/editor/monaco-content-sync.undo-history.test.ts",
|
|
"src/renderer/src/components/editor/MonacoEditor.content-owner.test.tsx",
|
|
"src/renderer/src/components/editor/EditorContent.monaco-lifecycle.test.tsx",
|
|
"src/renderer/src/components/editor/monaco-content-sync.bench.ts",
|
|
"src/renderer/src/components/editor/monaco-content-sync.undo-retention.bench.ts",
|
|
"tests/e2e/agent-session-log-tail-stability.spec.ts"
|
|
],
|
|
"assertionRefs": [
|
|
{
|
|
"file": "src/renderer/src/components/editor/monaco-content-sync.test.ts",
|
|
"assertions": [
|
|
"append-only drift reads the current model once and inserts only at the previous model end",
|
|
"identical content emits no edit and non-append drift retains full replacement plus undo stops",
|
|
"read-only live-tail appends, replacements, truncations, and stale retained-model remounts use non-undoing edits",
|
|
"a stale retained target model reconciles on mount without explicit undo stops while prior-path content and undo history remain isolated"
|
|
]
|
|
},
|
|
{
|
|
"file": "src/renderer/src/components/editor/monaco-content-sync.undo-history.test.ts",
|
|
"assertions": ["a real Monaco read-only live-tail append leaves canUndo false while an ordinary external update remains undoable"]
|
|
},
|
|
{
|
|
"file": "src/renderer/src/components/editor/MonacoEditor.content-owner.test.tsx",
|
|
"assertions": ["the Monaco wrapper receives defaultValue and no controlled value prop"]
|
|
},
|
|
{
|
|
"file": "src/renderer/src/components/editor/EditorContent.monaco-lifecycle.test.tsx",
|
|
"assertions": ["a same-pane path switch unmounts the prior outer Monaco before real mount reconciliation refreshes the stale target; the prior retained model content and undo sentinel remain untouched"]
|
|
},
|
|
{
|
|
"file": "src/renderer/src/components/editor/monaco-content-sync.bench.ts",
|
|
"assertions": ["with forced GC and deterministic settlement between every arm, fresh real-Monaco 9 MiB and 50 MiB models alternate 30 append and 30 replacement samples after five warmups; append p95 stays below 50/100ms and at least 2x faster"]
|
|
},
|
|
{
|
|
"file": "src/renderer/src/components/editor/monaco-content-sync.undo-retention.bench.ts",
|
|
"assertions": ["five 10 MiB read-only live-tail appends retain zero Monaco undo-service and ArrayBuffer bytes while the undoable control retains at least 50 MiB"]
|
|
},
|
|
{
|
|
"file": "tests/e2e/agent-session-log-tail-stability.spec.ts",
|
|
"assertions": [
|
|
"production Agent Session History opens a synthetic 9 MiB View Log and confirms the full model length loaded as font-metric-independent containment, with a generous content-height floor as a collapsed/truncated-render smoke check",
|
|
"an executable e2e-only legacy setValue control disrupts selection/Find/anchor state at each fixed-geometry five-second sample, then restores the equivalent model state before the fixed arm",
|
|
"three alternating watcher suffix appends preserve visible ranges, selection, scroll offset, Find open/query/active-match state, and exact suffix content",
|
|
"the production read-only live-tail model remains non-undoable before and after every watcher append",
|
|
"the renderer remains responsive with no render-process-gone event and forced-GC JS-heap/working-set/private-memory peak and retained budgets hold against paired legacy controls"
|
|
]
|
|
}
|
|
],
|
|
"evidenceRuns": [
|
|
{
|
|
"date": "2026-07-12",
|
|
"runner": "local",
|
|
"platform": "macos",
|
|
"command": "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/editor/monaco-content-sync.test.ts src/renderer/src/components/editor/MonacoEditor.content-owner.test.tsx src/renderer/src/components/editor/EditorContent.monaco-lifecycle.test.tsx",
|
|
"result": "passed",
|
|
"durationSeconds": 5,
|
|
"summary": "Focused editor ownership, edit-shape, mount reconciliation, lifecycle-key, and actual same-pane retained-model remount tests passed."
|
|
},
|
|
{
|
|
"date": "2026-07-12",
|
|
"runner": "local",
|
|
"platform": "macos",
|
|
"command": "node --expose-gc ./node_modules/vitest/vitest.mjs bench src/renderer/src/components/editor/monaco-content-sync.bench.ts --pool=threads",
|
|
"result": "passed",
|
|
"durationSeconds": 75,
|
|
"summary": "Forced-GC, settled, alternating fresh-model Monaco p95: 9 MiB append 4.02-5.51ms versus replacement 81.42-83.76ms; 50 MiB append 22.72-26.60ms versus replacement 445.11-449.21ms."
|
|
},
|
|
{
|
|
"date": "2026-07-12",
|
|
"runner": "local",
|
|
"platform": "macos",
|
|
"command": "pnpm run test:e2e -- tests/e2e/agent-session-log-tail-stability.spec.ts --workers=1",
|
|
"result": "passed",
|
|
"durationSeconds": 78,
|
|
"summary": "The production View Log journey alternated retained e2e-only legacy-red controls with fixed appends from restored equivalent state; every control detected instability while the fixed path retained viewport, selection, complete Find state, renderer liveness, and normalized forced-GC/native memory budgets."
|
|
},
|
|
{
|
|
"date": "2026-07-13",
|
|
"runner": "local",
|
|
"platform": "macos",
|
|
"command": "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/editor/monaco-content-sync.undo-history.test.ts",
|
|
"result": "passed",
|
|
"durationSeconds": 4,
|
|
"summary": "The real-Monaco undo-history test confirmed a read-only live-tail append leaves canUndo false while an ordinary external update remains undoable."
|
|
},
|
|
{
|
|
"date": "2026-07-13",
|
|
"runner": "local",
|
|
"platform": "macos",
|
|
"command": "node --expose-gc ./node_modules/vitest/vitest.mjs bench src/renderer/src/components/editor/monaco-content-sync.undo-retention.bench.ts --pool=threads",
|
|
"result": "passed",
|
|
"durationSeconds": 5,
|
|
"summary": "The undoable 50 MiB control retained 104,858,630 undo-service bytes and 104,857,790 ArrayBuffer bytes; the read-only live-tail arm retained zero of both and remained non-undoable."
|
|
},
|
|
{
|
|
"date": "2026-07-13",
|
|
"runner": "local",
|
|
"platform": "macos",
|
|
"command": "pnpm run test:e2e -- tests/e2e/agent-session-log-tail-stability.spec.ts --workers=1",
|
|
"result": "passed",
|
|
"durationSeconds": 78,
|
|
"summary": "The production View Log journey preserved viewport, selection, Find state, renderer liveness, and forced-GC/native budgets across three watcher appends while canUndo remained false."
|
|
}
|
|
],
|
|
"runtimeBudget": { "p95Seconds": 600, "scope": "local focused renderer tests plus one Electron production-journey scenario" },
|
|
"flakeHistory": { "status": "unknown", "evidence": "New deterministic gate with local macOS passes; CI soak history is not yet available." },
|
|
"redGreenEvidence": { "status": "complete", "evidence": "A fail-first real-Monaco test observed canUndo=true after one read-only live-tail append, and the forced-GC 50 MiB control retained 104,858,630 bytes in Monaco's undo service. After the fix the read-only arm retained zero undo-service bytes while the editable control stayed undoable. The retained Electron gate also proves each fixed watcher arm preserves viewport, selection, Find state, and non-undoability. Production builds never install its legacy setValue control." },
|
|
"performanceBudget": { "required": true, "evidence": "Every update retrieves the model value once and performs at most one equality-or-prefix comparison; a matching append submits only the suffix. The registered Node commands require --expose-gc and --pool=threads so worker GC is available. Current p95: 9 MiB append 5.93-7.12ms versus replacement 114.09-145.89ms; 50 MiB append 26.84-34.91ms versus replacement 602.36-699.21ms. The new 50 MiB retention arm measured 104,858,630 undo-service bytes and 104,857,790 ArrayBuffer bytes for the undoable control versus zero for read-only live-tail sync. Electron forced-GC JS-heap, renderer working-set, and OS-private-memory budgets also pass." },
|
|
"promotionCriteria": [
|
|
"Collect stable soak history on macOS, Linux, and Windows.",
|
|
"Accumulate 100 consecutive deterministic gate passes or 14 days without unexplained flakes."
|
|
],
|
|
"knownGaps": [
|
|
"No live Windows or Linux View Log evidence yet."
|
|
],
|
|
"demotionRule": "Quarantine the Electron scenario if it flakes without a product or harness bug; demote if viewport/Find drift, renderer loss, p95 regression, or memory retention exceeds the registered budgets."
|
|
},
|
|
{
|
|
"id": "terminal-session.snapshot-freshness",
|
|
"title": "Stale liveness snapshots cannot close newer PTY bindings",
|
|
"maturity": "experimental",
|
|
"protection": "partial",
|
|
"owner": "terminal-runtime",
|
|
"layer": "renderer-unit",
|
|
"surfaces": [
|
|
"terminal lifecycle",
|
|
"dead-session reconciliation",
|
|
"tab creation"
|
|
],
|
|
"platforms": [
|
|
"macos",
|
|
"linux",
|
|
"windows"
|
|
],
|
|
"providers": [
|
|
"local",
|
|
"daemon"
|
|
],
|
|
"coveredPlatforms": [
|
|
"macos"
|
|
],
|
|
"coveredProviders": [],
|
|
"coverageNotes": "Local macOS evidence over the reconcile guards that exist on main@1282f5c2d. Broader targeted-hasPty resume paths, no-hot listing counts, and live Electron survival arrive with the pending reliability stack.",
|
|
"motivatingLinks": [
|
|
"https://github.com/stablyai/orca/issues/6773",
|
|
"https://github.com/stablyai/orca/pull/6514",
|
|
"https://github.com/stablyai/orca/pull/6796",
|
|
"https://github.com/stablyai/orca/pull/6801"
|
|
],
|
|
"invariant": "A local or daemon liveness snapshot requested before a pane binds a PTY cannot prove that newer binding dead or route it through exit teardown.",
|
|
"oracle": "The decision layer rejects reconciliation when ptyBoundAt is greater than or equal to snapshotRequestedAt, still reconciles genuinely absent older local ids, and treats rejected provider listing as unknown.",
|
|
"commands": [
|
|
"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/terminal-dead-session-reconcile.test.ts"
|
|
],
|
|
"testFiles": [
|
|
"src/renderer/src/components/terminal-pane/terminal-dead-session-reconcile.test.ts"
|
|
],
|
|
"assertionRefs": [
|
|
{
|
|
"file": "src/renderer/src/components/terminal-pane/terminal-dead-session-reconcile.test.ts",
|
|
"assertions": [
|
|
"a newborn pane bound after the snapshot was requested is not reconciled (boundAt >= requestedAt freshness guard)",
|
|
"a rejected listSessions is treated as unknown and reconciles nothing",
|
|
"remote, SSH, and mid-spawn panes are skipped by the reconcile path",
|
|
"targeted liveness probes receive the request timestamp and resolved live-session ids"
|
|
]
|
|
}
|
|
],
|
|
"evidenceRuns": [
|
|
{
|
|
"date": "2026-07-03",
|
|
"runner": "local",
|
|
"platform": "macos",
|
|
"command": "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/terminal-dead-session-reconcile.test.ts",
|
|
"result": "passed",
|
|
"durationSeconds": 1.5,
|
|
"summary": "1 test file(s) passed, 17 tests passed on main@1282f5c2d in a clean checkout."
|
|
}
|
|
],
|
|
"runtimeBudget": {
|
|
"p95Seconds": 10,
|
|
"scope": "local unit test"
|
|
},
|
|
"flakeHistory": {
|
|
"status": "unknown",
|
|
"evidence": "Registered after existing targeted tests were found; needs soak history before blocking promotion."
|
|
},
|
|
"redGreenEvidence": {
|
|
"status": "partial",
|
|
"evidence": "Unit tests encode the stale snapshot/newborn race and fail if the freshness guard is removed. Needs saved CI or intentional-break artifact before blocking promotion."
|
|
},
|
|
"performanceBudget": {
|
|
"required": true,
|
|
"evidence": "The gate itself is cheap. Any PR changing reconciliation loops, hidden-pane scans, or provider polling must also run a terminal throughput or event-loop-delay measurement before blocking promotion."
|
|
},
|
|
"promotionCriteria": [
|
|
"Run in soak for at least 100 consecutive passes or 14 days across required CI platforms.",
|
|
"Attach red/green evidence from the freshness guard regression.",
|
|
"Add an integration/provider-contract follow-up that proves tab survival plus input/output after stale snapshot release."
|
|
],
|
|
"knownGaps": [
|
|
"Current command asserts the pure decision and orchestration timestamp forwarding, not a full Electron tab-survival/input echo flow.",
|
|
"SSH and remote providers are intentionally unknown-liveness paths and need separate provider-contract gates."
|
|
],
|
|
"demotionRule": "Demote or quarantine if the gate flakes once without a product bug or harness bug filed to the owner."
|
|
},
|
|
{
|
|
"id": "terminal-session.kill-all-surface-cleanup",
|
|
"title": "Kill all sessions removes only the confirmed terminal surfaces and current bindings",
|
|
"maturity": "experimental",
|
|
"protection": "partial",
|
|
"owner": "terminal-runtime",
|
|
"layer": "renderer-main-contract",
|
|
"surfaces": [
|
|
"terminal lifecycle",
|
|
"terminal tab cleanup",
|
|
"PTY shutdown",
|
|
"Manage Sessions",
|
|
"Resource Manager"
|
|
],
|
|
"platforms": [
|
|
"macos",
|
|
"linux",
|
|
"windows"
|
|
],
|
|
"providers": [
|
|
"local",
|
|
"daemon",
|
|
"ssh",
|
|
"wsl",
|
|
"remote-runtime",
|
|
"mobile-relay"
|
|
],
|
|
"coveredPlatforms": [
|
|
"macos"
|
|
],
|
|
"coveredProviders": [
|
|
"local",
|
|
"daemon",
|
|
"ssh"
|
|
],
|
|
"coverageNotes": "Local macOS deterministic evidence covers the renderer snapshot/coordinator, exact local and SSH-shaped PTY request settlement, active-last and pinned terminal-tab routing, component-unmount continuation, and the existing current/legacy daemon management contract. Windows Electron process absence, live SSH/WSL behavior, and remote-runtime/mobile host completion remain explicit gaps.",
|
|
"motivatingLinks": [
|
|
"https://github.com/stablyai/orca/issues/8001"
|
|
],
|
|
"invariant": "Every terminal surface confirmed in the invoking renderer is force-closed exactly once after daemon management settles, later-created surfaces and non-terminal tabs survive, and exact shutdown requests are limited to deduplicated current non-runtime PTY bindings of the confirmed surfaces.",
|
|
"oracle": "Snapshot terminal entity IDs before the first await; mutate ownership, active selection, bindings, and tab presence while daemon management is pending and between bounded close batches; then assert only the immutable targets disappear from both terminal stores, active targets close last with valid editor/browser/deactivated post-state, every captured exact PTY promise settles before callbacks, and no provider inventory sweep or late-tab kill occurs.",
|
|
"commands": [
|
|
"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/shared/kill-all-terminal-surfaces.test.ts src/renderer/src/components/shared/useDaemonActions.test.tsx src/renderer/src/components/terminal/terminal-tab-actions-kill-all.test.ts src/main/ipc/pty-management.test.ts"
|
|
],
|
|
"testFiles": [
|
|
"src/renderer/src/components/shared/kill-all-terminal-surfaces.test.ts",
|
|
"src/renderer/src/components/shared/useDaemonActions.test.tsx",
|
|
"src/renderer/src/components/terminal/terminal-tab-actions-kill-all.test.ts",
|
|
"src/main/ipc/pty-management.test.ts"
|
|
],
|
|
"assertionRefs": [
|
|
{
|
|
"file": "src/renderer/src/components/shared/kill-all-terminal-surfaces.test.ts",
|
|
"assertions": [
|
|
"snapshot deduplicates legacy, unified-only, split, multi-worktree, and floating terminal surfaces while excluding editor tabs",
|
|
"cleanup-time moves, active-worktree switches, rebinding, missing targets, and later-created tabs preserve the confirmation boundary and active-last order",
|
|
"current exact PTY bindings are deduplicated, remote runtime IDs and stale/late bindings are excluded, and all per-PTY settlements finish before completion",
|
|
"the production dependency path calls daemon management exactly once and never invokes listSessions for a post-kill sweep",
|
|
"management rejection and per-close/provider failures do not stop remaining cleanup and produce bounded count/latency diagnostics",
|
|
"a real 100-tab Zustand fixture records 100 close attempts and exact kills, at least 100 writes, and 49 event-loop yields; ownership is revalidated at most once after each yield when the store changed"
|
|
]
|
|
},
|
|
{
|
|
"file": "src/renderer/src/components/shared/useDaemonActions.test.tsx",
|
|
"assertions": [
|
|
"the hook snapshots before onKillAllStart and before coordinator work",
|
|
"unmounting the invoking component does not revoke cleanup while React callbacks remain mount-gated",
|
|
"error and settled callbacks run only after coordinator settlement",
|
|
"closed terminal tabs report success instead of the no-sessions informational state when daemon management reports zero"
|
|
]
|
|
},
|
|
{
|
|
"file": "src/renderer/src/components/terminal/terminal-tab-actions-kill-all.test.ts",
|
|
"assertions": [
|
|
"force closes pinned terminals without a second confirmation",
|
|
"closing the last active terminal preserves and activates editor or browser content, otherwise deactivates without auto-spawn"
|
|
]
|
|
},
|
|
{
|
|
"file": "src/main/ipc/pty-management.test.ts",
|
|
"assertions": [
|
|
"killAll fires one shutdown for each initial daemon session and polls those initial IDs until empty",
|
|
"freshly respawned session IDs are excluded from remainingCount",
|
|
"per-session shutdown rejection does not stop the daemon batch and refused initial sessions remain reported"
|
|
]
|
|
}
|
|
],
|
|
"evidenceRuns": [
|
|
{
|
|
"date": "2026-07-09",
|
|
"runner": "local",
|
|
"platform": "macos",
|
|
"command": "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/shared/kill-all-terminal-surfaces.test.ts src/renderer/src/components/shared/useDaemonActions.test.tsx src/renderer/src/components/terminal/terminal-tab-actions-kill-all.test.ts src/main/ipc/pty-management.test.ts",
|
|
"result": "passed",
|
|
"durationSeconds": 1.31,
|
|
"summary": "4 test files and 27 tests passed locally, including the existing daemon handler contract and a real 100-terminal Zustand cleanup fixture."
|
|
}
|
|
],
|
|
"runtimeBudget": {
|
|
"p95Seconds": 10,
|
|
"scope": "focused renderer/main unit and performance-count tests"
|
|
},
|
|
"flakeHistory": {
|
|
"status": "unknown",
|
|
"evidence": "The focused 27-test slice passed locally once; it needs CI and soak history before promotion."
|
|
},
|
|
"redGreenEvidence": {
|
|
"status": "partial",
|
|
"evidence": "The initial 100-tab implementation exposed an oversized close batch; two-close event-loop batching fixed the structural issue. The gate now uses deterministic batch instrumentation because full-suite CPU saturation made wall-clock assertions flaky; saved CI artifacts and intentional-break evidence are still needed."
|
|
},
|
|
"performanceBudget": {
|
|
"required": true,
|
|
"evidence": "The coordinator performs one management sweep, builds an initial live-owner index, and revalidates at most once after each two-close yield when the Zustand state changed (at most 49 replans for the 100-tab fixture). It closes each present unique target once and sends at most one exact kill per unique current non-runtime PTY not already settled by daemon management. The fixture asserts 100 close attempts, 100 local kill calls, at least 100 store writes, and 49 yields; planner-level tests prove each individual plan build scans terminal and unified ownership stores once. Production diagnostics report measured close-batch duration, while the deterministic gate makes no machine-load-sensitive latency claim."
|
|
},
|
|
"promotionCriteria": [
|
|
"Run the focused gate for at least 100 consecutive passes or 14 days across required CI platforms.",
|
|
"Attach Windows Electron evidence for both entry points, empty and established terminals, later-tab survival, xterm removal, and initial PTY absence after settlement.",
|
|
"Exercise the SSH fixture and WSL when available, or keep their live process-absence gaps explicit.",
|
|
"Propagate and align runtime-host tab-close completion before claiming verified remote-runtime shutdown."
|
|
],
|
|
"knownGaps": [
|
|
"Windows Electron screenshots and live process/xterm absence evidence were not produced by this local macOS run.",
|
|
"Live SSH and WSL process absence, Linux local/daemon behavior, and mobile/relay shutdown remain unproved.",
|
|
"Runtime-host terminal close is best-effort because closeTerminalTab still discards the existing async host result and its close-intent lifetime is shorter than the possible RPC flow.",
|
|
"Daemon adapter listing failures remain suppressed by the existing management API, so reported daemon counts are not authoritative verification of every process."
|
|
],
|
|
"demotionRule": "Keep experimental or demote to protection none if the gate flakes, permits a late-created tab or unrelated PTY to close, duplicates provider shutdown, or performs more than one ownership replan per bounded yield."
|
|
},
|
|
{
|
|
"id": "terminal-session.explicit-close-retirement",
|
|
"title": "Explicit terminal close retires parked PTYs and agent authority exactly once",
|
|
"maturity": "experimental",
|
|
"protection": "partial",
|
|
"owner": "terminal-runtime",
|
|
"layer": "main-preload-renderer-electron-contract",
|
|
"surfaces": [
|
|
"terminal tab close",
|
|
"split pane close and detach",
|
|
"hidden terminal parking",
|
|
"agent resume authority"
|
|
],
|
|
"platforms": [
|
|
"macos",
|
|
"linux",
|
|
"windows"
|
|
],
|
|
"providers": [
|
|
"local",
|
|
"daemon",
|
|
"ssh",
|
|
"runtime"
|
|
],
|
|
"coveredPlatforms": [
|
|
"macos"
|
|
],
|
|
"coveredProviders": [
|
|
"local",
|
|
"daemon",
|
|
"ssh",
|
|
"runtime"
|
|
],
|
|
"coverageNotes": "Live macOS Electron tests prove exact local PTY disappearance after parked-tab close and detached-pgid descendant death after agent close. Deterministic tests cover daemon and SSH routing, local/daemon pending-snapshot ownership across natural exit, stale-root descendant-signal suppression, graceful-to-immediate kill upgrades, duplicate-kill completion sharing, locale-stable bounded/fresh/coalesced process-table reads, deadline-safe successor scans, cycle-safe linear descendant traversal, target-only escalation indexing, 32-wide bulk teardown, source-scan timestamp identity, same-second PID ambiguity, ordinary runtime close ownership, unified-only hydration, split ownership, pane detach transfer, restart alias hydration, and late-hook suppression; live Linux, Windows, WSL, SSH, and remote-runtime process evidence remains pending.",
|
|
"motivatingLinks": [
|
|
"https://github.com/stablyai/orca/pull/8628",
|
|
"https://github.com/stablyai/orca/pull/8706"
|
|
],
|
|
"invariant": "Close permanently removes the owned provider session, agent descendants, and resume authority even when no TerminalPane is mounted; a terminating id remains reserved through natural exit, duplicate callers await the same completion, and immediate teardown upgrades any graceful request without signalling a recycled PID or a descendant tree after root ownership is lost; process-table work is locale-stable, bounded, fresh for each post-start request, same-turn coalesced, and begins within the requesting caller's deadline, including bulk worktree cleanup; detach and park preserve ownership; aliases prevent a detached agent's immutable physical pane key from being retired with its former tab.",
|
|
"oracle": "Capture the exact PTY before parking, prove it remains listed while the view is absent, close through the product state boundary, and poll the provider inventory until that exact ID disappears; an agent-marked PTY's detached-pgid child is alive before close and absent afterward; unit tests keep a naturally exited id reserved without re-killing its PID or signalling its captured tree, upgrade pending and post-snapshot graceful kills to immediate, force ps into the C locale, coalesce each bounded bulk-shutdown batch, share duplicate teardown completion, coalesce 20 same-turn process-table requests, start one shared successor without waiting for the prior scan, terminate cyclic-looking traversal, retain the source scan's timestamp, bound both read phases, avoid ambiguous SIGKILL, and assert canonical owner dedupe, exact pane tombstones, chained detach transfer, and restart alias restoration.",
|
|
"commands": [
|
|
"pnpm dlx node@24 ./node_modules/vitest/vitest.mjs run --config config/vitest.config.ts src/main/agent-hooks/server-pane-authority.test.ts src/main/ipc/agent-hooks.test.ts src/main/ipc/agent-pane-authority-ownership.test.ts src/main/ipc/pty-management.test.ts src/main/persistence.test.ts src/renderer/src/store/slices/agent-pane-authority.test.ts src/renderer/src/store/slices/terminal-pane-detach-agent-identity.test.ts src/renderer/src/store/slices/terminal-tab-retirement.test.ts src/renderer/src/store/slices/terminal-tab-retirement-store.test.ts src/renderer/src/components/shared/kill-all-terminal-surfaces.test.ts",
|
|
"pnpm exec vitest run --config config/vitest.config.ts src/main/pty-descendant-termination.test.ts src/main/daemon/session.test.ts src/main/daemon/terminal-host.test.ts src/main/providers/local-pty-provider.test.ts src/main/runtime/worktree-teardown.test.ts",
|
|
"pnpm run test:e2e -- tests/e2e/terminal-parked-close-retirement.spec.ts --workers=1",
|
|
"pnpm run test:e2e -- tests/e2e/agent-descendant-process-kill.spec.ts --workers=1"
|
|
],
|
|
"testFiles": [
|
|
"src/main/agent-hooks/server-pane-authority.test.ts",
|
|
"src/main/ipc/agent-hooks.test.ts",
|
|
"src/main/ipc/agent-pane-authority-ownership.test.ts",
|
|
"src/main/ipc/pty-management.test.ts",
|
|
"src/main/persistence.test.ts",
|
|
"src/main/pty-descendant-termination.test.ts",
|
|
"src/main/daemon/session.test.ts",
|
|
"src/main/daemon/terminal-host.test.ts",
|
|
"src/main/providers/local-pty-provider.test.ts",
|
|
"src/main/runtime/worktree-teardown.test.ts",
|
|
"src/renderer/src/store/slices/agent-pane-authority.test.ts",
|
|
"src/renderer/src/store/slices/terminal-pane-detach-agent-identity.test.ts",
|
|
"src/renderer/src/store/slices/terminal-tab-retirement.test.ts",
|
|
"src/renderer/src/store/slices/terminal-tab-retirement-store.test.ts",
|
|
"src/renderer/src/components/shared/kill-all-terminal-surfaces.test.ts",
|
|
"tests/e2e/terminal-parked-close-retirement.spec.ts",
|
|
"tests/e2e/agent-descendant-process-kill.spec.ts"
|
|
],
|
|
"assertionRefs": [
|
|
{
|
|
"file": "tests/e2e/terminal-parked-close-retirement.spec.ts",
|
|
"assertions": [
|
|
"a long-lived exact PTY remains alive after its terminal view is parked",
|
|
"closing the parked tab removes the exact PTY from the provider inventory and the visible tab model"
|
|
]
|
|
},
|
|
{
|
|
"file": "src/main/ipc/agent-pane-authority-ownership.test.ts",
|
|
"assertions": [
|
|
"pane authority transfer accepts only the PTY bound to the physical local pane or the canonical legacy/scoped runtime handle"
|
|
]
|
|
},
|
|
{
|
|
"file": "src/renderer/src/store/slices/agent-pane-authority.test.ts",
|
|
"assertions": [
|
|
"exact pane retirement removes resume and launch authority while preserving siblings",
|
|
"chained detach keeps physical hooks and resume authority routed to the current owner until that owner closes"
|
|
]
|
|
},
|
|
{
|
|
"file": "src/main/pty-descendant-termination.test.ts",
|
|
"assertions": [
|
|
"20 same-turn process-table requests execute one fresh scan while later arrivals start one shared successor inside their own deadline",
|
|
"snapshot and escalation readers stop at their deadline",
|
|
"production ps reads force locale-independent C timestamps",
|
|
"the source scan timestamp survives request resolution and capture-second identities are never escalated with SIGKILL",
|
|
"cyclic-looking duplicate PID rows terminate with each descendant visited once and duplicate escalation identities stay unsignalled",
|
|
"descendant signals are suppressed after the caller loses root ownership"
|
|
]
|
|
},
|
|
{
|
|
"file": "src/main/daemon/terminal-host.test.ts",
|
|
"assertions": [
|
|
"agent immediate kill rejects reattach while descendant capture is pending",
|
|
"a naturally exited session id remains reserved until capture finishes without force-killing its retired PID",
|
|
"graceful teardown upgrades to immediate both during and after descendant capture",
|
|
"duplicate immediate kill starts one descendant sweep"
|
|
]
|
|
},
|
|
{
|
|
"file": "src/main/runtime/worktree-teardown.test.ts",
|
|
"assertions": [
|
|
"owned provider shutdowns start together so process-table snapshots can coalesce within a batch",
|
|
"inventories above 32 sessions never exceed 32 concurrent provider shutdowns"
|
|
]
|
|
},
|
|
{
|
|
"file": "tests/e2e/agent-descendant-process-kill.spec.ts",
|
|
"assertions": [
|
|
"a detached-pgid descendant is alive before agent PTY kill and absent afterward"
|
|
]
|
|
}
|
|
],
|
|
"evidenceRuns": [
|
|
{
|
|
"date": "2026-07-13",
|
|
"runner": "local",
|
|
"platform": "macos",
|
|
"command": "pnpm run test:e2e -- tests/e2e/terminal-parked-close-retirement.spec.ts --workers=1",
|
|
"result": "passed",
|
|
"durationSeconds": 40.3,
|
|
"summary": "A fresh E2E build launched an isolated Electron profile, parked a live terminal, closed it through closeTab, and observed its exact PTY disappear."
|
|
},
|
|
{
|
|
"date": "2026-07-14",
|
|
"runner": "local",
|
|
"platform": "macos",
|
|
"command": "pnpm run test:e2e -- tests/e2e/agent-descendant-process-kill.spec.ts --workers=1",
|
|
"result": "passed",
|
|
"durationSeconds": 37.7,
|
|
"summary": "A current-main integrated fresh-build run proved a detached-pgid child was alive before agent PTY kill and absent afterward on the deadline-safe, root-ownership-gated implementation."
|
|
},
|
|
{
|
|
"date": "2026-07-15",
|
|
"runner": "local",
|
|
"platform": "macos",
|
|
"command": "pnpm run test:e2e -- tests/e2e/agent-descendant-process-kill.spec.ts --workers=1",
|
|
"result": "passed",
|
|
"durationSeconds": 78,
|
|
"summary": "The cycle-safe, target-indexed, bounded-fanout review head passed from a cold full build; the live detached-pgid descendant test body completed in 4.8 seconds."
|
|
}
|
|
],
|
|
"runtimeBudget": {
|
|
"p95Seconds": 60,
|
|
"scope": "fresh E2E build plus isolated local Electron parked-close and descendant-kill tests"
|
|
},
|
|
"flakeHistory": {
|
|
"status": "unknown",
|
|
"evidence": "The Electron gate passed three times locally, including the final review-fix head through the registered fresh-build command; CI and soak history are not yet available."
|
|
},
|
|
"redGreenEvidence": {
|
|
"status": "partial",
|
|
"evidence": "The test exercises the original parked-view failure shape and passed with the retirement boundary; an archived intentional-break run is not yet attached."
|
|
},
|
|
"performanceBudget": {
|
|
"required": true,
|
|
"evidence": "The close path is user-triggered and bounded by canonical live-owner indexing. Production ps has a 1s kill timeout; 20 same-turn requests execute one fresh process-table read, while requests arriving after a scan starts immediately share one successor so their deadline is not consumed waiting and no unusable ps starts after timeout. Completed tables are never reused. Bulk worktree shutdown runs in 32-wide batches so each batch can coalesce its initial scan without unbounded provider fanout. Descendant traversal uses a visited set and index cursor; a Node 24 local 100,000-wide synthetic tree fell from 861ms to 16.7ms, and escalation indexes only the requested descendant PIDs instead of duplicating the full process table. Escalation uses the same bounded coordinator, and kill-all store scale remains covered by terminal-session.kill-all-surface-cleanup."
|
|
},
|
|
"promotionCriteria": [
|
|
"Accumulate 100 clean runs or 14 days on required CI platforms.",
|
|
"Add live Windows/ConPTY, Linux, WSL, SSH, and ordinary runtime process-absence evidence.",
|
|
"Add restart/no-resurrection and repeated park-close soak coverage."
|
|
],
|
|
"knownGaps": [
|
|
"The live Electron proof currently covers macOS local PTYs only.",
|
|
"Disconnected SSH relay death still requires reconnect-aware provider ownership.",
|
|
"Daemon owner leases and durable retry inventory remain follow-up hardening.",
|
|
"Windows ConPTY, SSH-hosted PTYs, app-quit killAll, and daemon dispose retain foreground-tree-only teardown.",
|
|
"A process born in the capture second is SIGTERMed but not SIGKILLed because ps cannot prove its recycled-PID identity.",
|
|
"A descendant orphaned before or during root ownership loss requires the separate crash-orphan sweep and is not recovered from a stale kill-time snapshot."
|
|
],
|
|
"demotionRule": "Keep experimental or demote to protection none if exact PTY disappearance flakes, a sibling/detached pane is retired, or late hooks can recreate closed authority."
|
|
},
|
|
{
|
|
"id": "terminal-session.startup-cwd-missing-dir-recovery",
|
|
"title": "Fresh local terminal creation cannot be bricked by a deleted startup cwd",
|
|
"maturity": "experimental",
|
|
"protection": "partial",
|
|
"owner": "terminal-runtime",
|
|
"layer": "shared-main-renderer-contract",
|
|
"surfaces": [
|
|
"terminal lifecycle",
|
|
"tab creation",
|
|
"PTY spawn",
|
|
"startup cwd persistence"
|
|
],
|
|
"platforms": [
|
|
"macos",
|
|
"linux",
|
|
"windows",
|
|
"mobile"
|
|
],
|
|
"providers": [
|
|
"local",
|
|
"daemon",
|
|
"ssh",
|
|
"wsl",
|
|
"remote-runtime"
|
|
],
|
|
"coveredPlatforms": [
|
|
"macos"
|
|
],
|
|
"coveredProviders": [
|
|
"local",
|
|
"ssh",
|
|
"remote-runtime"
|
|
],
|
|
"coverageNotes": "Local macOS evidence covers the shared missing-dir fallback policy, main pty:spawn recovery and metadata, no-flag and reattach strictness, renderer IPC flag routing, SSH-tagged and remote-runtime omission, and the visibility-gated terminal notice. Daemon shares the same pre-provider main cwd decision but lacks a live daemon-provider run; WSL UNC paths are exempt from the probe by design and lack a live run; Linux/Windows and mobile/API strictness are gaps.",
|
|
"motivatingLinks": [
|
|
"https://github.com/stablyai/orca/issues/7239",
|
|
"https://github.com/stablyai/orca/pull/7750",
|
|
"https://github.com/stablyai/orca/pull/7678"
|
|
],
|
|
"invariant": "A fresh local renderer terminal spawn may recover from a saved startup cwd whose directory no longer exists only by spawning at the selected workspace root and printing a generic in-terminal notice; existing directories — including ones outside the worktree (#7685) — spawn as requested, and reattach, SSH, remote-runtime, runtime/API, and mobile callers keep exact cwd semantics.",
|
|
"oracle": "The shared resolver falls back to the workspace root only when the injected existence probe reports the resolved cwd missing and the workspace root present, and never probes floating terminals or a cwd equal to the root. The renderer sends cwdFallback only for fresh local IPC spawns, main honors it only when connectionId and sessionId are absent, WSL UNC paths never engage the probe-based fallback, main returns fallback metadata only after an actual fallback, the IPC transport preserves that metadata, and the connection layer writes a generic notice that omits the missing path.",
|
|
"commands": [
|
|
"pnpm exec vitest run --config config/vitest.config.ts src/shared/terminal-startup-cwd.test.ts",
|
|
"pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/pty.test.ts",
|
|
"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/pty-transport.test.ts",
|
|
"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/pty-connection.test.ts"
|
|
],
|
|
"testFiles": [
|
|
"src/shared/terminal-startup-cwd.test.ts",
|
|
"src/main/ipc/pty.test.ts",
|
|
"src/renderer/src/components/terminal-pane/pty-transport.test.ts",
|
|
"src/renderer/src/components/terminal-pane/pty-connection.test.ts"
|
|
],
|
|
"assertionRefs": [
|
|
{
|
|
"file": "src/shared/terminal-startup-cwd.test.ts",
|
|
"assertions": [
|
|
"a missing requested cwd falls back to the workspace root and reports the missing path to the callback",
|
|
"existing cwds — nested or outside the worktree (#7685) — are never remapped",
|
|
"no fallback happens when the workspace root is missing too",
|
|
"floating terminal cwds and root-equal requests are never probed",
|
|
"non-ASCII worktree roots and folder workspace roots are recovered verbatim"
|
|
]
|
|
},
|
|
{
|
|
"file": "src/main/ipc/pty.test.ts",
|
|
"assertions": [
|
|
"local pty:spawn with cwdFallback worktree spawns at the worktree root when the saved cwd is missing and returns fallback metadata",
|
|
"a missing cwd without the flag still surfaces the provider's missing-directory error",
|
|
"an existing outside-worktree cwd spawns as requested without fallback metadata",
|
|
"session reattach spawns ignore the fallback flag and keep exact cwd semantics"
|
|
]
|
|
},
|
|
{
|
|
"file": "src/renderer/src/components/terminal-pane/pty-transport.test.ts",
|
|
"assertions": [
|
|
"IPC transport sends cwdFallback only for local fresh spawns",
|
|
"SSH-tagged and session reattach spawns omit cwdFallback",
|
|
"IPC transport returns startup cwd fallback metadata to the connection layer"
|
|
]
|
|
},
|
|
{
|
|
"file": "src/renderer/src/components/terminal-pane/pty-connection.test.ts",
|
|
"assertions": [
|
|
"fresh local IPC worktree spawns are marked with cwdFallback worktree",
|
|
"startup cwd fallback metadata prints a generic in-terminal notice",
|
|
"remote-runtime worktree spawns are not marked with cwdFallback"
|
|
]
|
|
}
|
|
],
|
|
"evidenceRuns": [
|
|
{
|
|
"date": "2026-07-08",
|
|
"runner": "local",
|
|
"platform": "macos",
|
|
"command": "pnpm exec vitest run --config config/vitest.config.ts src/shared/terminal-startup-cwd.test.ts",
|
|
"result": "passed",
|
|
"durationSeconds": 0.2,
|
|
"summary": "1 test file passed, 21 tests passed; covers the missing-dir fallback policy, #7685 outside-worktree preservation, and root-missing/floating exemptions."
|
|
},
|
|
{
|
|
"date": "2026-07-08",
|
|
"runner": "local",
|
|
"platform": "macos",
|
|
"command": "pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/pty.test.ts",
|
|
"result": "passed",
|
|
"durationSeconds": 0.9,
|
|
"summary": "1 test file passed, 225 tests passed; covers main pty:spawn recovery, fallback metadata, and no-flag/reattach provider-error strictness."
|
|
},
|
|
{
|
|
"date": "2026-07-08",
|
|
"runner": "local",
|
|
"platform": "macos",
|
|
"command": "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/pty-transport.test.ts",
|
|
"result": "passed",
|
|
"durationSeconds": 0.4,
|
|
"summary": "1 test file passed, 58 tests passed; covers cwdFallback forwarding only for local fresh spawns and metadata handoff."
|
|
},
|
|
{
|
|
"date": "2026-07-08",
|
|
"runner": "local",
|
|
"platform": "macos",
|
|
"command": "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/pty-connection.test.ts",
|
|
"result": "passed",
|
|
"durationSeconds": 6.5,
|
|
"summary": "1 test file passed, 341 tests passed; covers local IPC marking, the generic terminal fallback notice, and remote-runtime omission."
|
|
}
|
|
],
|
|
"runtimeBudget": {
|
|
"p95Seconds": 30,
|
|
"scope": "focused unit and IPC contract tests"
|
|
},
|
|
"flakeHistory": {
|
|
"status": "unknown",
|
|
"evidence": "New experimental gate added with local deterministic evidence only; needs CI soak before promotion."
|
|
},
|
|
"redGreenEvidence": {
|
|
"status": "partial",
|
|
"evidence": "The main IPC missing-cwd tests fail with the provider's 'Working directory ... does not exist.' error when the fallback is removed and pass with it. Full live Electron reproduction from a production persisted session is not captured."
|
|
},
|
|
"performanceBudget": {
|
|
"required": true,
|
|
"evidence": "The runtime change adds at most two statSync probes on the fresh-local spawn path (the provider already stats the same paths during validation) and one bounded terminal write only when fallback actually occurs; no polling, provider listing, hidden-pane work, startup awaits, subprocesses, or render-loop work was added."
|
|
},
|
|
"promotionCriteria": [
|
|
"Attach CI evidence for all declared test files.",
|
|
"Add a live Electron regression that opens a local terminal whose persisted startupCwd was deleted and proves visible shell input/output at the workspace root.",
|
|
"Add WSL/mobile/API provider-contract coverage or explicitly narrow their risk scope."
|
|
],
|
|
"knownGaps": [
|
|
"No live Electron fixture seeds a persisted tab whose startupCwd directory was deleted.",
|
|
"Daemon coverage is via the shared pre-provider main cwd decision, not a live daemon provider spawn.",
|
|
"WSL UNC paths bypass the probe by design and have no live existence-recovery run; Linux, Windows, and mobile/API strictness are not directly exercised."
|
|
],
|
|
"demotionRule": "Demote or quarantine if the gate flakes without a product bug, if an existing directory is ever remapped away from the requested cwd, or if a reattach/remote/API caller can engage the fallback."
|
|
},
|
|
{
|
|
"id": "agent-status.pi-hook-liveness",
|
|
"title": "Pi status hooks cannot stall a turn or complete a live runtime",
|
|
"maturity": "experimental",
|
|
"protection": "partial",
|
|
"owner": "agent-session",
|
|
"layer": "main-provider-contract",
|
|
"surfaces": [
|
|
"Pi and OMP managed extensions",
|
|
"agent status hooks",
|
|
"runtime reload and session replacement",
|
|
"loopback restart and stall recovery"
|
|
],
|
|
"platforms": [
|
|
"macos",
|
|
"linux",
|
|
"windows"
|
|
],
|
|
"providers": [
|
|
"local",
|
|
"daemon",
|
|
"ssh",
|
|
"wsl",
|
|
"remote-runtime"
|
|
],
|
|
"coveredPlatforms": [
|
|
"macos"
|
|
],
|
|
"coveredProviders": [],
|
|
"coverageNotes": "Local macOS execution of the generated Pi/OMP extension plus the shared hook normalizer. WSL fallback behavior is covered with mocked native-fetch failure and Windows curl handoff. Daemon PTYs use the same generated extension without a distinct delivery path. SSH/relay ingest uses the shared normalizer, but no live remote Pi process is exercised.",
|
|
"motivatingLinks": [
|
|
"https://github.com/stablyai/orca/issues/7791",
|
|
"https://github.com/stablyai/orca/pull/7802",
|
|
"https://github.com/stablyai/orca/pull/7838"
|
|
],
|
|
"invariant": "Orca status reporting must return synchronously from every Pi/OMP extension handler, retain at most one active request and one latest pending snapshot, and abandon stalled loopback delivery within one second. A Pi session_shutdown event cannot mark a turn done because Pi also emits it for reload, new, resume, and fork while the PTY remains alive; only agent_end proves turn completion, while real process exit is cleared by PTY teardown.",
|
|
"oracle": "Execute the generated extension with a fetch that remains pending and assert the Pi handler returns before delivery; emit three statuses during the stall and assert exactly one request is active and only the latest pending status is sent next; advance fake time by one second and assert the active signal aborts and the latest status proceeds. Through the shared normalizer, assert session_shutdown yields no status while agent_end still yields done.",
|
|
"commands": [
|
|
"pnpm exec vitest run --config config/vitest.config.ts src/main/pi/agent-status-extension-source.test.ts src/main/agent-hooks/server.test.ts --maxWorkers=1"
|
|
],
|
|
"testFiles": [
|
|
"src/main/pi/agent-status-extension-source.test.ts",
|
|
"src/main/agent-hooks/server.test.ts"
|
|
],
|
|
"assertionRefs": [
|
|
{
|
|
"file": "src/main/pi/agent-status-extension-source.test.ts",
|
|
"assertions": [
|
|
"a pending loopback fetch does not keep the Pi event handler unresolved",
|
|
"three events during a stall produce one active request and one request for only the latest pending status",
|
|
"the one-second delivery deadline aborts the active request and advances the latest pending status",
|
|
"the managed status extension does not register session_shutdown as a completion event",
|
|
"WSL native-fetch failures still hand off to a detached Windows curl process"
|
|
]
|
|
},
|
|
{
|
|
"file": "src/main/agent-hooks/server.test.ts",
|
|
"assertions": [
|
|
"session_shutdown normalizes to no status instead of done",
|
|
"agent_end remains the authoritative Pi/OMP done event"
|
|
]
|
|
}
|
|
],
|
|
"evidenceRuns": [
|
|
{
|
|
"date": "2026-07-11",
|
|
"runner": "local",
|
|
"platform": "macos",
|
|
"command": "pnpm exec vitest run --config config/vitest.config.ts src/main/pi/agent-status-extension-source.test.ts src/main/agent-hooks/server.test.ts --maxWorkers=1",
|
|
"result": "passed",
|
|
"durationSeconds": 1.3,
|
|
"summary": "2 files and 238 tests passed, including executed generated-extension liveness, latest-only queue bounds, timeout abort, WSL fallback, and Pi shutdown normalization."
|
|
}
|
|
],
|
|
"runtimeBudget": {
|
|
"p95Seconds": 10,
|
|
"scope": "generated-extension and shared-normalizer unit gate"
|
|
},
|
|
"flakeHistory": {
|
|
"status": "unknown",
|
|
"evidence": "New deterministic gate with local fake-receiver and fake-timer evidence; needs CI soak before promotion."
|
|
},
|
|
"redGreenEvidence": {
|
|
"status": "partial",
|
|
"evidence": "Before the fix, the pending-fetch handler assertion remained false and session_shutdown normalized to done (2 focused failures, 233 passes). With the fix, both pass; the bounded count and deadline assertions additionally fail if latest-only coalescing or the timeout is removed. Needs saved CI evidence before blocking promotion."
|
|
},
|
|
"performanceBudget": {
|
|
"required": true,
|
|
"evidence": "Every Pi event does O(1) work and returns without awaiting I/O. Delivery retains at most one active request plus one latest pending object, uses one unref'd timer per active request, and creates no polling, provider scans, subprocesses outside the existing WSL failure fallback, or renderer work. The deterministic burst test proves three stalled events retain two delivery slots rather than an event-count-sized queue."
|
|
},
|
|
"promotionCriteria": [
|
|
"Run in soak for at least 100 consecutive passes or 14 days across required CI platforms.",
|
|
"Attach saved red/green evidence for both the unresolved-handler and false-done regressions.",
|
|
"Add a live Pi Electron test that stalls or restarts the hook listener during a running turn and proves terminal output continues."
|
|
],
|
|
"knownGaps": [
|
|
"No live model-backed Pi turn or Electron Running-view assertion is automated; the gate executes the exact generated extension and shared normalizer below those surfaces.",
|
|
"An already-running Pi process keeps its previously loaded extension until Pi reloads or restarts.",
|
|
"During receiver unavailability, intermediate status details may be coalesced to the latest snapshot; this is intentional and bounded, but no UI test measures the temporary detail loss.",
|
|
"SSH/remote and Windows are not exercised with live providers; relay ingest shares normalization and WSL fallback has mocked contract coverage."
|
|
],
|
|
"demotionRule": "Demote or quarantine if the gate flakes without a product or harness bug, if a Pi handler can again await receiver I/O, or if coalescing allows an older status to overwrite a newer one."
|
|
},
|
|
{
|
|
"id": "agent-session.provider-ownership",
|
|
"title": "Provider sessions are resumed once per workspace ownership claim",
|
|
"maturity": "experimental",
|
|
"protection": "partial",
|
|
"owner": "agent-session",
|
|
"layer": "renderer-state",
|
|
"surfaces": [
|
|
"agent launch",
|
|
"workspace activation",
|
|
"sleep and hibernate restore",
|
|
"provider session dedupe",
|
|
"sidebar and mobile identity"
|
|
],
|
|
"platforms": [
|
|
"macos",
|
|
"linux",
|
|
"windows"
|
|
],
|
|
"providers": [
|
|
"local",
|
|
"daemon",
|
|
"ssh",
|
|
"wsl",
|
|
"remote-runtime"
|
|
],
|
|
"coveredPlatforms": [
|
|
"macos"
|
|
],
|
|
"coveredProviders": [],
|
|
"coverageNotes": "Local macOS evidence over the ownership/dedupe suite on main@1282f5c2d. Queued/pending resume-claim indexing, same-session and wrong-session hook proofs, and Electron repeat-activation coverage arrive with the pending stack (#7008).",
|
|
"motivatingLinks": [
|
|
"https://github.com/stablyai/orca/pull/6800",
|
|
"https://github.com/stablyai/orca/pull/5240",
|
|
"https://github.com/stablyai/orca/pull/6411",
|
|
"https://github.com/stablyai/orca/pull/6833"
|
|
],
|
|
"invariant": "Workspace activation, launch, restore, sleep, hibernate, dedupe, clearing, and reconnect code must not replay or resume a provider session id already owned, queued, pending, or live in that workspace.",
|
|
"oracle": "The current renderer-state slice asserts provider-session claim keys are owned by preserved active tabs, inactive split leaves, visible non-focused split groups, live records, quit records, worktree-sleep records, queued startup payloads, time-bounded resume bridge claims, and same-session live hook evidence; duplicates clear without launching a second resume command. The provider list is the risk scope, not proof that every provider has a live integration gate.",
|
|
"commands": [
|
|
"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/lib/resume-sleeping-agent-session.test.ts"
|
|
],
|
|
"testFiles": [
|
|
"src/renderer/src/lib/resume-sleeping-agent-session.test.ts"
|
|
],
|
|
"assertionRefs": [
|
|
{
|
|
"file": "src/renderer/src/lib/resume-sleeping-agent-session.test.ts",
|
|
"assertions": [
|
|
"preserved panes claim their provider session and only stale duplicates are cleared",
|
|
"one launch per provider session: skipped duplicates are cleared instead of relaunched",
|
|
"active stable-pane records owned by preserved or visible panes are not resumed again",
|
|
"hibernated stable panes with cleared live PTY bindings are skipped"
|
|
]
|
|
}
|
|
],
|
|
"evidenceRuns": [
|
|
{
|
|
"date": "2026-07-03",
|
|
"runner": "local",
|
|
"platform": "macos",
|
|
"command": "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/lib/resume-sleeping-agent-session.test.ts",
|
|
"result": "passed",
|
|
"durationSeconds": 1.9,
|
|
"summary": "1 test file(s) passed, 30 tests passed on main@1282f5c2d in a clean checkout."
|
|
}
|
|
],
|
|
"runtimeBudget": {
|
|
"p95Seconds": 15,
|
|
"scope": "local renderer state test"
|
|
},
|
|
"flakeHistory": {
|
|
"status": "unknown",
|
|
"evidence": "Registered after targeted tests were found; needs soak history before blocking promotion."
|
|
},
|
|
"redGreenEvidence": {
|
|
"status": "partial",
|
|
"evidence": "Tests encode provider-session dedupe and ownership claims across active/inactive/visible split records, queued pendingStartupByTabId resume payloads, time-bounded runtime automaticAgentResumeClaimsByTabId bridge claims, live same-session hook evidence, wrong-session hook rejection, and a bounded queued-claim index over many records/tabs. Needs saved red/green artifact for the class-level replay invariant."
|
|
},
|
|
"performanceBudget": {
|
|
"required": true,
|
|
"evidence": "Current state tests are cheap and assert queued pending-startup provider-session ids are indexed once per activation. PRs adding new ownership scans must show bounded work over records and no hidden-pane wake loop before blocking promotion."
|
|
},
|
|
"promotionCriteria": [
|
|
"Run in soak for at least 100 consecutive passes or 14 days across required CI platforms.",
|
|
"Add bounded-work assertions for delayed hook/status ownership scans if those paths grow.",
|
|
"Attach red/green evidence that display/replay evidence alone cannot claim ownership."
|
|
],
|
|
"knownGaps": [
|
|
"Providers listed on this gate are affected identity surfaces; the current executable command is renderer-state coverage, not live local/daemon/SSH/WSL/remote-runtime coverage.",
|
|
"Current command models live same-session and wrong-session hook evidence, but does not run the real hook timing through Electron.",
|
|
"Current command does not run a real workspace activation loop repeatedly through Electron."
|
|
],
|
|
"demotionRule": "Demote or quarantine if failures are non-actionable or if a duplicate resume escape occurs outside the modeled matrix."
|
|
},
|
|
{
|
|
"id": "terminal-geometry.visible-convergence",
|
|
"title": "Visible desktop terminals converge across xterm, fit, PTY, shell, and runtime mirror size",
|
|
"maturity": "experimental",
|
|
"protection": "partial",
|
|
"owner": "terminal-rendering",
|
|
"layer": "renderer-provider-contract",
|
|
"surfaces": [
|
|
"PTY sizing",
|
|
"split layout",
|
|
"restore",
|
|
"hidden-to-visible transitions"
|
|
],
|
|
"platforms": [
|
|
"macos",
|
|
"linux",
|
|
"windows"
|
|
],
|
|
"providers": [
|
|
"local",
|
|
"daemon",
|
|
"ssh",
|
|
"remote-runtime"
|
|
],
|
|
"coveredPlatforms": [
|
|
"macos"
|
|
],
|
|
"coveredProviders": [],
|
|
"coverageNotes": "Local macOS evidence on main@1282f5c2d, including #7192's runtime-mirror geometry authority slice. Shell-visible size, SSH/remote geometry, Windows ConPTY readback, and resume-time reassertion coverage arrive with the pending stack and #7006.",
|
|
"motivatingLinks": [
|
|
"https://github.com/stablyai/orca/pull/6644",
|
|
"https://github.com/stablyai/orca/pull/6649",
|
|
"https://github.com/stablyai/orca/pull/6725",
|
|
"https://github.com/stablyai/orca/pull/6785",
|
|
"https://github.com/stablyai/orca/pull/6853",
|
|
"https://github.com/stablyai/orca/pull/6939",
|
|
"https://github.com/stablyai/orca/pull/7192"
|
|
],
|
|
"invariant": "A visible desktop-owned terminal cannot trust 0x0, stale requested size, or renderer-only size; xterm, fit/proposed size, applied PTY size, shell-visible size, and the runtime mirror's parse dimensions must converge or enter explicit degraded state, and mirror resize reflow must stay ordered with queued output writes.",
|
|
"oracle": "The current executable slice uses deterministic frame schedulers and fake providers to force 0x0 first fit, delayed layout settle, dropped resize/readback drift, and hidden-to-visible activation, then asserts the renderer forwards a usable size, pty:getSize reports applied rather than merely requested size where available, and visibility resume reasserts real drift without hot listSessions. Shell-visible stty/echo-wrap convergence remains a live-gate follow-up.",
|
|
"commands": [
|
|
"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/pty-size-reconcile.test.ts src/renderer/src/components/terminal-pane/split-right-white-screen.test.ts src/main/ipc/pty.test.ts src/main/runtime/orca-runtime.test.ts"
|
|
],
|
|
"testFiles": [
|
|
"src/renderer/src/components/terminal-pane/pty-size-reconcile.test.ts",
|
|
"src/renderer/src/components/terminal-pane/split-right-white-screen.test.ts",
|
|
"src/main/ipc/pty.test.ts",
|
|
"src/main/runtime/orca-runtime.test.ts"
|
|
],
|
|
"assertionRefs": [
|
|
{
|
|
"file": "src/renderer/src/components/terminal-pane/pty-size-reconcile.test.ts",
|
|
"assertions": [
|
|
"hidden delayed narrow settle is forwarded instead of stopping on a fixed frame budget",
|
|
"unmeasurable frames do not count as settled",
|
|
"applied-size readback divergence is re-forwarded before handoff"
|
|
]
|
|
},
|
|
{
|
|
"file": "src/renderer/src/components/terminal-pane/split-right-white-screen.test.ts",
|
|
"assertions": [
|
|
"0x0 split-right spawn recovers when the container becomes measurable",
|
|
"visible permanently-unmeasurable 0x0 pane gets a nonzero safe fallback",
|
|
"hidden 0x0 background spawn is not forced to phantom desktop size"
|
|
]
|
|
},
|
|
{
|
|
"file": "src/main/ipc/pty.test.ts",
|
|
"assertions": [
|
|
"accepted desktop resizes fan out to the runtime after provider resize",
|
|
"rejected desktop resizes do not fan out to the runtime"
|
|
]
|
|
},
|
|
{
|
|
"file": "src/main/runtime/orca-runtime.test.ts",
|
|
"assertions": [
|
|
"the headless mirror resizes after an accepted desktop PTY resize (#7192)",
|
|
"headless mirror resizes are ordered behind queued PTY writes (#7192)"
|
|
]
|
|
}
|
|
],
|
|
"evidenceRuns": [
|
|
{
|
|
"date": "2026-07-03",
|
|
"runner": "local",
|
|
"platform": "macos",
|
|
"command": "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/pty-size-reconcile.test.ts src/renderer/src/components/terminal-pane/split-right-white-screen.test.ts src/main/ipc/pty.test.ts src/main/runtime/orca-runtime.test.ts",
|
|
"result": "passed",
|
|
"durationSeconds": 8.4,
|
|
"summary": "4 test file(s) passed, 777 tests passed on main@1282f5c2d in a clean checkout."
|
|
}
|
|
],
|
|
"runtimeBudget": {
|
|
"p95Seconds": 60,
|
|
"scope": "provider-contract or focused Electron test"
|
|
},
|
|
"flakeHistory": {
|
|
"status": "unknown",
|
|
"evidence": "Deterministic Vitest slices passed locally; no CI soak history yet."
|
|
},
|
|
"redGreenEvidence": {
|
|
"status": "partial",
|
|
"evidence": "#7192 proved the mirror slice red before its fix (snapshot stayed 80x24, queued write parsed at the wrong width). The renderer 0x0/settle slices do not have recorded red runs."
|
|
},
|
|
"performanceBudget": {
|
|
"required": true,
|
|
"evidence": "Must include resize/throughput budget so convergence loops do not add frame or SIGWINCH churn."
|
|
},
|
|
"promotionCriteria": [
|
|
"Build deterministic fault hooks before adding broad E2E coverage.",
|
|
"Keep stress variants non-blocking until runtime and flake history are known."
|
|
],
|
|
"knownGaps": [
|
|
"No live Electron geometry command yet beyond the local live PTY resize slice.",
|
|
"The runtime mirror geometry slice is unregistered: #7192's red tests (orca-runtime.test.ts headless-mirror resize and ordering, pty.test.ts desktop resize fan-out) exist on fresh main but not at this branch's merge-base, so they can only be registered during the rebase.",
|
|
"Does not yet prove shell-visible size, provider-applied size, and xterm size converge across SSH/remote paths.",
|
|
"Does not yet prove Windows ConPTY geometry/readback.",
|
|
"Current command uses deterministic fake providers for the main/renderer contracts, not a real remote PTY."
|
|
],
|
|
"demotionRule": "Cannot promote without deterministic oracle and runtime history."
|
|
},
|
|
{
|
|
"id": "xterm-addon.boundary-containment",
|
|
"title": "xterm addon failures stay pane-scoped and input survives",
|
|
"maturity": "experimental",
|
|
"protection": "partial",
|
|
"owner": "terminal-rendering",
|
|
"layer": "renderer-unit",
|
|
"surfaces": [
|
|
"terminal search",
|
|
"links",
|
|
"WebGL",
|
|
"decorations",
|
|
"keyboard navigation"
|
|
],
|
|
"platforms": [
|
|
"macos",
|
|
"linux",
|
|
"windows"
|
|
],
|
|
"providers": [
|
|
"local",
|
|
"daemon",
|
|
"ssh",
|
|
"remote-runtime"
|
|
],
|
|
"coveredPlatforms": [
|
|
"macos"
|
|
],
|
|
"coveredProviders": [],
|
|
"coverageNotes": "Local macOS evidence over the WebGL/link/search containment suites on main@1282f5c2d, adopting the #6949 atlas-recovery rename and #7133's reveal hardening tests. Core addon-load throw containment and live typed-input survival arrive with #7004 and a live follow-up.",
|
|
"motivatingLinks": [
|
|
"https://github.com/stablyai/orca/pull/6852",
|
|
"https://github.com/stablyai/orca/pull/6872",
|
|
"https://github.com/stablyai/orca/pull/6855"
|
|
],
|
|
"invariant": "Search, link, WebGL, decoration, input-protocol, or keyboard-navigation errors must not unmount the terminal surface, crash React/window, break focus, or stop PTY input/output.",
|
|
"oracle": "The current executable slice injects a core addon load throw and asserts pane opening continues through later addons, covers link provider throws as pane-scoped no-link results, covers search decoration positive-integer failures as false results instead of renderer crashes, and covers WebGL attach/refresh/recovery containment. Focused typed input echo after addon failure still needs a live/component follow-up.",
|
|
"commands": [
|
|
"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/lib/pane-manager/terminal-link-provider-guard.test.ts src/renderer/src/components/terminal-search-safe-find.test.ts src/renderer/src/lib/pane-manager/pane-webgl-refresh-lifecycle.test.ts src/renderer/src/components/terminal-pane/terminal-webgl-atlas-recovery.test.ts src/renderer/src/lib/pane-manager/pane-webgl-context-recovery.test.ts src/renderer/src/lib/pane-manager/pane-webgl-renderer.test.ts src/renderer/src/lib/pane-manager/pane-reveal-repaint.test.ts src/renderer/src/components/terminal-pane/terminal-visibility-resume.test.ts"
|
|
],
|
|
"testFiles": [
|
|
"src/renderer/src/lib/pane-manager/terminal-link-provider-guard.test.ts",
|
|
"src/renderer/src/components/terminal-search-safe-find.test.ts",
|
|
"src/renderer/src/lib/pane-manager/pane-webgl-refresh-lifecycle.test.ts",
|
|
"src/renderer/src/components/terminal-pane/terminal-webgl-atlas-recovery.test.ts",
|
|
"src/renderer/src/lib/pane-manager/pane-webgl-context-recovery.test.ts",
|
|
"src/renderer/src/lib/pane-manager/pane-webgl-renderer.test.ts",
|
|
"src/renderer/src/lib/pane-manager/pane-reveal-repaint.test.ts",
|
|
"src/renderer/src/components/terminal-pane/terminal-visibility-resume.test.ts"
|
|
],
|
|
"assertionRefs": [
|
|
{
|
|
"file": "src/renderer/src/lib/pane-manager/terminal-link-provider-guard.test.ts",
|
|
"assertions": [
|
|
"link-provider throws are reproduced and contained without escaping the surface"
|
|
]
|
|
},
|
|
{
|
|
"file": "src/renderer/src/components/terminal-search-safe-find.test.ts",
|
|
"assertions": [
|
|
"the xterm positive-integers decoration crash is swallowed while unrelated errors re-throw"
|
|
]
|
|
},
|
|
{
|
|
"file": "src/renderer/src/lib/pane-manager/pane-webgl-refresh-lifecycle.test.ts",
|
|
"assertions": [
|
|
"WebGL teardown/refresh lifecycle stays pane-scoped and cancels on dispose"
|
|
]
|
|
},
|
|
{
|
|
"file": "src/renderer/src/components/terminal-pane/terminal-webgl-atlas-recovery.test.ts",
|
|
"assertions": [
|
|
"risky-output atlas recovery is bounded, coalesced, and survives a throwing manager"
|
|
]
|
|
},
|
|
{
|
|
"file": "src/renderer/src/lib/pane-manager/pane-webgl-context-recovery.test.ts",
|
|
"assertions": [
|
|
"failed attach backs off and context-lost panes recover on the next rendering resume"
|
|
]
|
|
},
|
|
{
|
|
"file": "src/renderer/src/lib/pane-manager/pane-webgl-renderer.test.ts",
|
|
"assertions": [
|
|
"attach bail disposes the addon instead of orphaning it (#7133 single-addon invariant)"
|
|
]
|
|
},
|
|
{
|
|
"file": "src/renderer/src/lib/pane-manager/pane-reveal-repaint.test.ts",
|
|
"assertions": [
|
|
"reveal repaint waits for a settled frame and keeps repainting when one pane throws (#7133)"
|
|
]
|
|
},
|
|
{
|
|
"file": "src/renderer/src/components/terminal-pane/terminal-visibility-resume.test.ts",
|
|
"assertions": [
|
|
"tab reveal, heavy reveal, and window wake schedule pane-scoped repaint (#7133)"
|
|
]
|
|
}
|
|
],
|
|
"evidenceRuns": [
|
|
{
|
|
"date": "2026-07-03",
|
|
"runner": "local",
|
|
"platform": "macos",
|
|
"command": "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/lib/pane-manager/terminal-link-provider-guard.test.ts src/renderer/src/components/terminal-search-safe-find.test.ts src/renderer/src/lib/pane-manager/pane-webgl-refresh-lifecycle.test.ts src/renderer/src/components/terminal-pane/terminal-webgl-atlas-recovery.test.ts src/renderer/src/lib/pane-manager/pane-webgl-context-recovery.test.ts src/renderer/src/lib/pane-manager/pane-webgl-renderer.test.ts src/renderer/src/lib/pane-manager/pane-reveal-repaint.test.ts src/renderer/src/components/terminal-pane/terminal-visibility-resume.test.ts",
|
|
"result": "passed",
|
|
"durationSeconds": 0.8,
|
|
"summary": "8 test file(s) passed, 33 tests passed on main@1282f5c2d in a clean checkout."
|
|
}
|
|
],
|
|
"runtimeBudget": {
|
|
"p95Seconds": 30,
|
|
"scope": "renderer unit or component test"
|
|
},
|
|
"flakeHistory": {
|
|
"status": "unknown",
|
|
"evidence": "Focused renderer-unit containment slice passed locally on 2026-07-02; needs soak history before promotion."
|
|
},
|
|
"redGreenEvidence": {
|
|
"status": "partial",
|
|
"evidence": "#7133 proved the reveal-hardening slice against live corrupted specimens; the link/search guards reproduce their original crashes in-test. No recorded red runs for the refresh-lifecycle slice."
|
|
},
|
|
"performanceBudget": {
|
|
"required": false,
|
|
"evidence": "Required only if containment adds retry loops, polling, or renderer fallback churn."
|
|
},
|
|
"promotionCriteria": [
|
|
"Add deterministic addon throw injection.",
|
|
"Prove input/output survives after boundary failure."
|
|
],
|
|
"knownGaps": [
|
|
"Current command is renderer-unit containment, not live Electron typed input/output survival after addon failure.",
|
|
"Does not yet inject WebGL dispose/reset throws and active/hidden/resumed pane focus recovery in one component-level oracle."
|
|
],
|
|
"demotionRule": "Cannot promote while it only checks visual rendering."
|
|
},
|
|
{
|
|
"id": "terminal-scroll.intent-preservation",
|
|
"title": "Scrollbar drag intent survives tab and visibility resume",
|
|
"maturity": "experimental",
|
|
"protection": "partial",
|
|
"owner": "terminal-rendering",
|
|
"layer": "renderer-unit",
|
|
"surfaces": [
|
|
"terminal lifecycle",
|
|
"hidden-to-visible resume",
|
|
"tab switching",
|
|
"xterm scrollbar DOM",
|
|
"scrollback"
|
|
],
|
|
"platforms": [
|
|
"macos",
|
|
"linux",
|
|
"windows"
|
|
],
|
|
"providers": [
|
|
"local",
|
|
"daemon",
|
|
"ssh",
|
|
"wsl",
|
|
"remote-runtime"
|
|
],
|
|
"coveredPlatforms": [
|
|
"macos"
|
|
],
|
|
"coveredProviders": [],
|
|
"coverageNotes": "Renderer-unit coverage proves the shared xterm DOM intent path. Live Electron evidence is PR validation evidence for local macOS only until the flow has stable automation; live SSH, WSL, Linux, and Windows paths remain unproved.",
|
|
"motivatingLinks": [
|
|
"STA-1341"
|
|
],
|
|
"invariant": "A user-driven xterm scrollbar thumb or track scroll updates the live terminal scroll intent before tab, visibility, or layout resume enforces intent, so resume preserves the latest dragged viewport instead of an older pinned line.",
|
|
"oracle": "Pointerdown on .xterm-scrollbar or .xterm-slider followed by xterm viewport movement records the new pinned viewport, and enforcing current intent restores that dragged line instead of stale top intent.",
|
|
"commands": [
|
|
"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/lib/pane-manager/terminal-scroll-intent.test.ts"
|
|
],
|
|
"testFiles": [
|
|
"src/renderer/src/lib/pane-manager/terminal-scroll-intent.test.ts"
|
|
],
|
|
"assertionRefs": [
|
|
{
|
|
"file": "src/renderer/src/lib/pane-manager/terminal-scroll-intent.test.ts",
|
|
"assertions": [
|
|
"pointer-driven .xterm-scrollbar and .xterm-slider scrolls update terminal scroll intent",
|
|
"a scrollbar-dragged viewport is restored instead of stale top intent",
|
|
"terminal body pointer activity is not treated as scrollbar intent"
|
|
]
|
|
}
|
|
],
|
|
"evidenceRuns": [
|
|
{
|
|
"date": "2026-07-05",
|
|
"runner": "local",
|
|
"platform": "macos",
|
|
"command": "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/lib/pane-manager/terminal-scroll-intent.test.ts",
|
|
"result": "passed",
|
|
"durationSeconds": 0.3,
|
|
"summary": "1 test file(s) passed, 17 tests passed in this worktree."
|
|
}
|
|
],
|
|
"runtimeBudget": {
|
|
"p95Seconds": 10,
|
|
"scope": "focused renderer unit test"
|
|
},
|
|
"flakeHistory": {
|
|
"status": "unknown",
|
|
"evidence": "New experimental gate; needs soak history before promotion."
|
|
},
|
|
"redGreenEvidence": {
|
|
"status": "partial",
|
|
"evidence": "The new scrollbar DOM target assertions fail when only .xterm-viewport pointerdown is recognized. Needs saved CI/intentional-break artifact before blocking promotion."
|
|
},
|
|
"performanceBudget": {
|
|
"required": true,
|
|
"evidence": "Runtime fix is limited to constant-time class/closest checks on pointerdown. It must not add polling, output parsing, PTY listing, hidden-pane wakeups, resize calls, or startup awaits."
|
|
},
|
|
"promotionCriteria": [
|
|
"Collect stable CI soak history for the renderer-unit gate.",
|
|
"Add stable live Electron automation for the scrollbar drag plus tab-switch repro.",
|
|
"Attach red/green evidence for stale intent restoring the wrong viewport."
|
|
],
|
|
"knownGaps": [
|
|
"Manifest command is deterministic renderer-unit coverage, not a live Electron scrollbar drag.",
|
|
"Live daemon, SSH, WSL, remote-runtime, Linux, and Windows validation is not covered by this gate.",
|
|
"Future xterm scrollbar DOM class changes are only caught if they break the currently modeled class contract."
|
|
],
|
|
"demotionRule": "Demote or quarantine if the unit gate flakes without a product bug or harness bug filed to the owner."
|
|
},
|
|
{
|
|
"id": "startup-upgrade.persisted-session-corpus",
|
|
"title": "Current Orca preserves or recovers old production persisted sessions",
|
|
"maturity": "experimental",
|
|
"protection": "none",
|
|
"owner": "startup-persistence",
|
|
"layer": "upgrade-fixture",
|
|
"surfaces": [
|
|
"startup",
|
|
"upgrade",
|
|
"session restore",
|
|
"daemon restore"
|
|
],
|
|
"platforms": [
|
|
"macos",
|
|
"linux",
|
|
"windows"
|
|
],
|
|
"providers": [
|
|
"local",
|
|
"daemon",
|
|
"ssh",
|
|
"wsl"
|
|
],
|
|
"coveredPlatforms": [],
|
|
"coveredProviders": [],
|
|
"coverageNotes": "Registered gap only; no executable coverage is wired yet.",
|
|
"motivatingLinks": [
|
|
"https://github.com/stablyai/orca/issues/5356",
|
|
"https://github.com/stablyai/orca/pull/5234",
|
|
"https://github.com/stablyai/orca/pull/5240"
|
|
],
|
|
"invariant": "Startup and restore fixes must preserve or explicitly recover sessions from the last affected production persisted-state schema, not only from state written by current code.",
|
|
"oracle": "Boot current Orca against immutable copied user-data fixtures from affected versions and reject blank replacement panes, duplicate resume tabs, silent session loss, or works-only-after-current-write behavior.",
|
|
"commands": [],
|
|
"testFiles": [],
|
|
"assertionRefs": [],
|
|
"evidenceRuns": [],
|
|
"runtimeBudget": {
|
|
"p95Seconds": 120,
|
|
"scope": "focused Electron upgrade fixture"
|
|
},
|
|
"flakeHistory": {
|
|
"status": "not-started",
|
|
"evidence": "Fixture corpus not implemented."
|
|
},
|
|
"redGreenEvidence": {
|
|
"status": "missing",
|
|
"evidence": "Needs immutable pre-fix persisted-state fixture."
|
|
},
|
|
"performanceBudget": {
|
|
"required": true,
|
|
"evidence": "Startup fixture must record startup latency and avoid adding blocking migration scans."
|
|
},
|
|
"promotionCriteria": [
|
|
"Land immutable old-version fixture with documented source version.",
|
|
"Run second restart after current code writes upgraded state.",
|
|
"Record startup timing and failure artifact."
|
|
],
|
|
"knownGaps": [
|
|
"No fixture corpus or command yet."
|
|
],
|
|
"demotionRule": "Cannot promote without old production fixture provenance."
|
|
},
|
|
{
|
|
"id": "terminal-platform.live-pty-liveness",
|
|
"title": "A real Electron local PTY accepts input, survives workspace restore, resizes, and exits cleanly",
|
|
"maturity": "experimental",
|
|
"protection": "none",
|
|
"owner": "terminal-runtime",
|
|
"layer": "electron-live-pty",
|
|
"surfaces": [
|
|
"active terminal PTY binding",
|
|
"xterm focus",
|
|
"keyboard input",
|
|
"PTY output",
|
|
"workspace hide and restore",
|
|
"resize",
|
|
"exit cleanup"
|
|
],
|
|
"platforms": [
|
|
"linux",
|
|
"macos"
|
|
],
|
|
"providers": [
|
|
"local"
|
|
],
|
|
"coveredPlatforms": [],
|
|
"coveredProviders": [],
|
|
"coverageNotes": "Registered gap on main. The live Electron Playwright slice exists only on the pending reliability stack. It registers here with its owning split PR.",
|
|
"motivatingLinks": [
|
|
"https://github.com/stablyai/orca/pull/6801",
|
|
"https://github.com/stablyai/orca/pull/6842",
|
|
"https://github.com/stablyai/orca/pull/6939",
|
|
"https://github.com/stablyai/orca/pull/6989"
|
|
],
|
|
"invariant": "An active local Electron terminal has one active PTY id listed exactly once, accepts real keyboard input through focused xterm, renders process output visibly, keeps the same live PTY across repeated workspace hide/restore cycles, applies an actual size change, and removes the old PTY from liveness state after exit.",
|
|
"oracle": "A deterministic raw-mode probe prints a ready marker, ordered key markers from real keyboard input, the active PTY id appears exactly once in pty:listSessions, remains bound to the same PTY id across two worktree switch-away/switch-back cycles, accepts more keyboard input after each restore, changes pty:getSize after viewport resize, prints the same process-visible size, and prints an exit marker; after shell exit, pty:listSessions no longer contains the old id.",
|
|
"commands": [],
|
|
"testFiles": [],
|
|
"assertionRefs": [],
|
|
"evidenceRuns": [],
|
|
"runtimeBudget": {
|
|
"p95Seconds": 75,
|
|
"scope": "focused Electron live PTY gate including e2e build/setup"
|
|
},
|
|
"flakeHistory": {
|
|
"status": "unknown",
|
|
"evidence": "Focused Playwright gate passed locally after adding two workspace hide/restore cycles, exact active-PTY listing, and actual resize convergence on 2026-07-02: 1 test passed, 8.6s test body, 58.6s full command including build/setup. Needs repeated CI/runtime history before promotion."
|
|
},
|
|
"redGreenEvidence": {
|
|
"status": "partial",
|
|
"evidence": "The gate asserts PTY binding, active PTY listed exactly once, real xterm keyboard delivery, same-PTY ownership across repeated workspace hide/restore cycles, post-restore input delivery, actual pty:getSize change, matching process-visible size, and listSessions cleanup after shell exit. Needs saved intentional-break evidence before promotion."
|
|
},
|
|
"performanceBudget": {
|
|
"required": true,
|
|
"evidence": "Must record key latencies, size snapshots, and final liveness state. The gate may use broad listing as a test oracle; product hot paths must not use broad provider listing as a synchronization primitive."
|
|
},
|
|
"promotionCriteria": [
|
|
"Implement without blind sleeps; wait only on PTY binding, probe markers, size marker, and liveness absence.",
|
|
"Run in soak on Linux before blocking; keep macOS as soak until stable.",
|
|
"Attach red/green evidence for focus, PTY write, resize, and exit cleanup failures."
|
|
],
|
|
"knownGaps": [
|
|
"No executable coverage on main yet; the slice lives on the pending fix-terminal-reliability stack.",
|
|
"Needs soak/runtime history before promotion.",
|
|
"Does not yet cover tab switch inside one worktree, scrollback after restore, or app restart persistence.",
|
|
"Does not cover Windows ConPTY, SSH, WSL, daemon, or remote-runtime providers."
|
|
],
|
|
"demotionRule": "Cannot promote without deterministic user-visible oracle, failure artifacts, and stable runtime history."
|
|
},
|
|
{
|
|
"id": "terminal-platform.windows-conpty-liveness",
|
|
"title": "Windows ConPTY terminals stay input-live, render-live, and geometry-live",
|
|
"maturity": "experimental",
|
|
"protection": "partial",
|
|
"owner": "terminal-platform",
|
|
"layer": "windows-electron-conpty",
|
|
"surfaces": [
|
|
"Windows ConPTY",
|
|
"PowerShell and cmd",
|
|
"keyboard protocol",
|
|
"CJK repaint",
|
|
"cursor and resize"
|
|
],
|
|
"platforms": [
|
|
"windows"
|
|
],
|
|
"providers": [
|
|
"local",
|
|
"daemon",
|
|
"wsl"
|
|
],
|
|
"coveredPlatforms": [
|
|
"windows"
|
|
],
|
|
"coveredProviders": [
|
|
"daemon"
|
|
],
|
|
"coverageNotes": "Issue #8048 now has deterministic wrapper and cold-restore re-anchor tests plus a Windows PR-CI harness that drives the built daemon through 25 real ConPTY workspace-close races while an unrelated witness PTY stays alive. Keyboard reset, CJK repaint, WSL, and full visible Electron coverage remain gaps.",
|
|
"motivatingLinks": [
|
|
"https://github.com/stablyai/orca/pull/6541",
|
|
"https://github.com/stablyai/orca/pull/6858",
|
|
"https://github.com/stablyai/orca/pull/6876",
|
|
"https://github.com/stablyai/orca/pull/6968",
|
|
"https://github.com/stablyai/orca/pull/6970",
|
|
"https://github.com/stablyai/orca/pull/6999",
|
|
"https://github.com/stablyai/orca/issues/8048"
|
|
],
|
|
"invariant": "Windows local and daemon terminals must spawn with the intended shell, survive overlapping graceful/forced workspace teardown without affecting unrelated PTYs, retain recovered scrollback across the fresh daemon's first checkpoint, accept normal Enter/Backspace/Arrow input after agent or TUI exit, render cursor/CJK/wide-glyph redraws without stale cells, and converge to nonzero applied size.",
|
|
"oracle": "The issue #8048 slice asserts one node-pty ConPTY close for a graceful-then-force sequence, atomically seeds recovered history before fresh shell output and re-anchoring, preserves recovery after seed failure plus adapter restart, and runs 25 built-daemon close races while checking victim session/PID reaping, a stable daemon PID, and a live witness PTY. A broader Windows live gate still needs shell input, resize, cursor, and CJK/wide-glyph pixel evidence.",
|
|
"commands": [
|
|
"pnpm vitest run src/main/daemon/pty-subprocess.test.ts src/main/daemon/daemon-pty-adapter.test.ts",
|
|
"pnpm build:electron-vite && node config/scripts/windows-daemon-workspace-close-repro.mjs",
|
|
"node config/scripts/windows-daemon-workspace-close-repro.mjs"
|
|
],
|
|
"testFiles": [
|
|
"src/main/daemon/pty-subprocess.test.ts",
|
|
"src/main/daemon/daemon-pty-adapter.test.ts",
|
|
"config/scripts/windows-daemon-workspace-close-repro.mjs"
|
|
],
|
|
"assertionRefs": [
|
|
{
|
|
"file": "src/main/daemon/pty-subprocess.test.ts",
|
|
"assertions": [
|
|
"graceful kill followed by force and dispose invokes Windows node-pty kill exactly once and never retries the dead child PID"
|
|
]
|
|
},
|
|
{
|
|
"file": "src/main/daemon/daemon-pty-adapter.test.ts",
|
|
"assertions": [
|
|
"the first checkpoint orders recovered scrollback before synchronously emitted fresh-shell startup output",
|
|
"a failed atomic history seed remains non-authoritative across adapter restart and cannot overwrite the recovery files"
|
|
]
|
|
},
|
|
{
|
|
"file": "config/scripts/windows-daemon-workspace-close-repro.mjs",
|
|
"assertions": [
|
|
"all 25 victim sessions and OS PIDs are reaped while the built daemon PID and an unrelated witness PowerShell remain alive"
|
|
]
|
|
}
|
|
],
|
|
"evidenceRuns": [
|
|
{
|
|
"date": "2026-07-10",
|
|
"runner": "local",
|
|
"platform": "windows",
|
|
"command": "node config/scripts/windows-daemon-workspace-close-repro.mjs",
|
|
"result": "passed",
|
|
"durationSeconds": 7.6,
|
|
"summary": "All 25 victim sessions and OS PIDs were reaped while the built daemon and witness PTY survived the real ConPTY workspace-close races. The double-close, history ordering, and seed-failure restart regressions produced intentional red failures before their fixes and passed afterward."
|
|
}
|
|
],
|
|
"runtimeBudget": {
|
|
"p95Seconds": 90,
|
|
"scope": "Windows focused Electron ConPTY gate"
|
|
},
|
|
"flakeHistory": {
|
|
"status": "unknown",
|
|
"evidence": "The built-daemon issue #8048 harness passed locally once and is wired into Windows PR CI; it needs repeated CI history before promotion."
|
|
},
|
|
"redGreenEvidence": {
|
|
"status": "partial",
|
|
"evidence": "The ConPTY double-close and cold-restore re-anchor assertions were each observed failing before the fix and passing afterward. Keyboard protocol, shell resolution, resize, and CJK repaint still need red/green proof."
|
|
},
|
|
"performanceBudget": {
|
|
"required": true,
|
|
"evidence": "Must include input latency and no broad session listing while typing or switching terminals."
|
|
},
|
|
"promotionCriteria": [
|
|
"Start as Windows nightly/soak because Windows Electron E2E has been flaky.",
|
|
"Use deterministic PTY markers for input/resize and reserve screenshots for repaint diagnostics.",
|
|
"Split shell parity, keyboard reset, and CJK repaint into smaller gates if a combined gate is flaky."
|
|
],
|
|
"knownGaps": [
|
|
"Real IME composition may require a separate lower-layer/native-text-forwarding gate.",
|
|
"The built-daemon harness proves process/session liveness but not renderer pixels; visible shell input, resize, cursor, and CJK repaint remain uncovered."
|
|
],
|
|
"demotionRule": "Cannot promote while Windows E2E is flaky, silently skipped, or screenshot-only."
|
|
},
|
|
{
|
|
"id": "terminal-performance.no-hot-list-sessions",
|
|
"title": "Hot terminal interactions do not call global PTY session listing",
|
|
"maturity": "experimental",
|
|
"protection": "none",
|
|
"owner": "terminal-performance",
|
|
"layer": "ipc-count-contract",
|
|
"surfaces": [
|
|
"typing",
|
|
"focus",
|
|
"tab switch",
|
|
"workspace switch",
|
|
"visibility resume",
|
|
"resize",
|
|
"render"
|
|
],
|
|
"platforms": [
|
|
"macos",
|
|
"linux",
|
|
"windows"
|
|
],
|
|
"providers": [
|
|
"local",
|
|
"daemon",
|
|
"ssh",
|
|
"wsl",
|
|
"remote-runtime"
|
|
],
|
|
"coveredPlatforms": [],
|
|
"coveredProviders": [],
|
|
"coverageNotes": "Registered gap on main. The targeted-hasPty product hardening and no-hot count assertions exist only on the pending reliability stack. It registers here with its owning split PR.",
|
|
"motivatingLinks": [
|
|
"https://github.com/stablyai/orca/pull/7002",
|
|
"https://github.com/stablyai/orca/pull/6858"
|
|
],
|
|
"invariant": "Typing, focus, terminal switch, workspace switch, visibility resume, resize, render, and per-pane liveness paths must not call global pty:listSessions; they must use targeted per-PTY APIs or cached provider-owned state.",
|
|
"oracle": "The current executable slice asserts targeted visibility/first-input liveness, resize re-assertion after visibility resume, light tab/active-state resume, SSH/remote skip behavior, and closed Resource Manager status badges avoid pty:listSessions; targeted hasPty/getSize calls are allowed for liveness/resize slices and forbidden for light tab/active-state resume. The full hot-path oracle still needs instrumentation around raw focus, split focus, workspace switch, render ticks, and high-session local/daemon/SSH fixtures.",
|
|
"commands": [],
|
|
"testFiles": [],
|
|
"assertionRefs": [],
|
|
"evidenceRuns": [],
|
|
"runtimeBudget": {
|
|
"p95Seconds": 20,
|
|
"scope": "unit or focused Electron count gate"
|
|
},
|
|
"flakeHistory": {
|
|
"status": "unknown",
|
|
"evidence": "Focused count tests now run locally; needs soak history before promotion."
|
|
},
|
|
"redGreenEvidence": {
|
|
"status": "partial",
|
|
"evidence": "Tests assert visibility resume prefers targeted hasPty over listSessions, first input after visibility resume calls targeted hasPty once, resize re-assertion after visibility resume uses getSize/resize without listSessions, light tab switches and visible active-state resume avoid listSessions/hasPty/getSize fanout while still allowing the active PTY scheduler hint, SSH/remote broad listing is skipped, Resource Manager broad session inventory polling is scoped to the open popover rather than its closed badge, and panes close only on authoritative false. Needs broader raw focus/workspace-switch/render/high-session count coverage before promotion."
|
|
},
|
|
"performanceBudget": {
|
|
"required": true,
|
|
"evidence": "This gate is the performance budget for global session listing in hot paths."
|
|
},
|
|
"promotionCriteria": [
|
|
"Add deterministic call-count instrumentation.",
|
|
"Cover typing, focus, switch, visibility resume, resize, and render separately.",
|
|
"Run with enough preserved sessions/providers to make a broad listing observable."
|
|
],
|
|
"knownGaps": [
|
|
"No executable coverage on main yet; the slice lives on the pending fix-terminal-reliability stack.",
|
|
"Current command covers targeted visibility/first-input liveness, resize re-assertion on visibility resume, light tab/active-state resume, SSH/remote skip behavior, and closed Resource Manager session-poll avoidance, but not every hot interaction listed in the invariant.",
|
|
"No Electron or IPC-level high-session counter gate yet proves raw focus, workspace switch, render, or high-session typing stay at zero global listSessions calls."
|
|
],
|
|
"demotionRule": "Cannot promote if the test allows broad listing in any hot interaction path."
|
|
},
|
|
{
|
|
"id": "terminal-observability.lifecycle-breadcrumbs",
|
|
"title": "Terminal lifecycle anomalies enter crash diagnostics as compact breadcrumbs",
|
|
"maturity": "experimental",
|
|
"protection": "none",
|
|
"owner": "terminal-runtime",
|
|
"layer": "renderer-observability",
|
|
"surfaces": [
|
|
"terminal lifecycle",
|
|
"reattach",
|
|
"restore",
|
|
"provider ownership",
|
|
"diagnostics bundle"
|
|
],
|
|
"platforms": [
|
|
"macos",
|
|
"linux",
|
|
"windows"
|
|
],
|
|
"providers": [
|
|
"local",
|
|
"daemon",
|
|
"ssh",
|
|
"wsl",
|
|
"remote-runtime"
|
|
],
|
|
"coveredPlatforms": [],
|
|
"coveredProviders": [],
|
|
"coverageNotes": "Registered gap on main. The crash-breadcrumb recording and its test exist only on the pending reliability stack. It registers here with its owning split PR.",
|
|
"motivatingLinks": [
|
|
"https://github.com/stablyai/orca/pull/6800",
|
|
"https://github.com/stablyai/orca/issues/6773"
|
|
],
|
|
"invariant": "Terminal lifecycle anomalies around reattach, restore, provider ownership, stale liveness, and fallback routing must leave compact, deduped, privacy-safe breadcrumbs in crash diagnostics so future reports can be attributed from evidence.",
|
|
"oracle": "The current executable slice calls warnTerminalLifecycleAnomaly with terminal identity, provider, PTY id, binding epoch, and reason, then asserts the existing console warning is preserved and a compact terminal_lifecycle_anomaly crash breadcrumb is recorded once per lifecycle identity. Full pane transition traces and diagnostics-bundle artifact proof remain follow-ups.",
|
|
"commands": [],
|
|
"testFiles": [],
|
|
"assertionRefs": [],
|
|
"evidenceRuns": [],
|
|
"runtimeBudget": {
|
|
"p95Seconds": 10,
|
|
"scope": "renderer observability unit test"
|
|
},
|
|
"flakeHistory": {
|
|
"status": "unknown",
|
|
"evidence": "Focused unit slice passed locally once; no CI soak history yet."
|
|
},
|
|
"redGreenEvidence": {
|
|
"status": "partial",
|
|
"evidence": "Tests would fail if lifecycle anomalies stopped recording crash breadcrumbs or stopped deduping repeated identities. Needs diagnostics-bundle artifact proof and full transition-trace evidence before promotion."
|
|
},
|
|
"performanceBudget": {
|
|
"required": true,
|
|
"evidence": "Breadcrumb recording is deduped and capped by the existing lifecycle anomaly guard; full trace buffers must include size and event-count caps before promotion."
|
|
},
|
|
"promotionCriteria": [
|
|
"Add full compact pane lifecycle trace buffer with event-count caps.",
|
|
"Prove diagnostics bundle includes recent terminal lifecycle breadcrumbs or traces.",
|
|
"Add forbidden-transition tests for stale close, unknown owner fallback, and stuck zero-size panes."
|
|
],
|
|
"knownGaps": [
|
|
"No executable coverage on main yet; the slice lives on the pending fix-terminal-reliability stack.",
|
|
"Current command records anomaly breadcrumbs only, not a full pane lifecycle state-machine trace.",
|
|
"Current command does not prove crash/diagnostics bundle export includes the breadcrumb.",
|
|
"Current command does not assert forbidden transitions across live Electron/provider flows."
|
|
],
|
|
"demotionRule": "Cannot promote if diagnostics are console-only, unbounded, or missing from support artifacts."
|
|
},
|
|
{
|
|
"id": "terminal-performance.output-backpressure-budget",
|
|
"title": "Terminal output backpressure stays bounded from daemon to renderer",
|
|
"maturity": "experimental",
|
|
"protection": "partial",
|
|
"owner": "terminal-performance",
|
|
"layer": "provider-ipc-renderer-perf",
|
|
"surfaces": [
|
|
"daemon stream",
|
|
"main PTY batching",
|
|
"runtime path provenance",
|
|
"runtime terminal wait detection",
|
|
"renderer ACK",
|
|
"xterm scheduler",
|
|
"hidden output"
|
|
],
|
|
"platforms": [
|
|
"macos",
|
|
"linux",
|
|
"windows"
|
|
],
|
|
"providers": [
|
|
"local",
|
|
"daemon",
|
|
"ssh",
|
|
"remote-runtime"
|
|
],
|
|
"coveredPlatforms": [
|
|
"macos"
|
|
],
|
|
"coveredProviders": [],
|
|
"coverageNotes": "Local macOS evidence covers the existing main-process pending-output caps plus deterministic runtime path-provenance history reuse and saturated-tail wait detection. Daemon stream write(false)/drain contracts, cross-session drain priority, and bounded queued tails arrive with the pending perf slice; live flood/latency artifacts remain gaps.",
|
|
"motivatingLinks": [
|
|
"https://github.com/stablyai/orca/pull/6836",
|
|
"https://github.com/stablyai/orca/pull/6858",
|
|
"https://github.com/stablyai/orca/pull/7002",
|
|
"https://github.com/stablyai/orca/pull/7054"
|
|
],
|
|
"invariant": "High-volume terminal output must stay bounded across daemon socket writes, main runtime metadata, detectors, and tail checks, main-to-renderer in-flight bytes, renderer scheduler queues, and hidden-output restore without starving focused input.",
|
|
"oracle": "The current executable slice injects main-process renderer backlog pressure, then asserts unchanged path-provenance history reuse for pathless output, ordinary terminal-wait detection without a joined-tail allocation and with full prompt-family continuity, per-PTY and total pending-output caps, preserved sequenced-tail metadata, active-pending protection ahead of background trimming, and ACK-gated in-flight bounds. The live Electron perf oracle adds hidden-output floods, renderer scheduler queue depth, dropped-output-zero normal scenarios, and active key latency budgets before promotion.",
|
|
"commands": [
|
|
"pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/pty.test.ts",
|
|
"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/orca-runtime-path-candidate-history.test.ts",
|
|
"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/orca-runtime.test.ts src/main/runtime/orca-runtime-tail-wait-memo.test.ts"
|
|
],
|
|
"testFiles": [
|
|
"src/main/ipc/pty.test.ts",
|
|
"src/main/runtime/orca-runtime-path-candidate-history.test.ts",
|
|
"src/main/runtime/orca-runtime.test.ts",
|
|
"src/main/runtime/orca-runtime-tail-wait-memo.test.ts"
|
|
],
|
|
"assertionRefs": [
|
|
{
|
|
"file": "src/main/ipc/pty.test.ts",
|
|
"assertions": [
|
|
"total renderer in-flight output is capped across many PTYs",
|
|
"active PTY pending output is prioritized during renderer backpressure",
|
|
"combined pending output exceeding the interactive size limit is batched"
|
|
]
|
|
},
|
|
{
|
|
"file": "src/main/runtime/orca-runtime-path-candidate-history.test.ts",
|
|
"assertions": [
|
|
"reuses path-candidate history across repeated pathless PTY output",
|
|
"copies history when new output adds a path candidate"
|
|
]
|
|
},
|
|
{
|
|
"file": "src/main/runtime/orca-runtime-tail-wait-memo.test.ts",
|
|
"assertions": [
|
|
"does not rebuild or repeatedly scan an ordinary saturated tail",
|
|
"memoized stamping matches recompute reference: blocked prompt split across chunks",
|
|
"stays equivalent across tail eviction beyond the retained cap"
|
|
]
|
|
},
|
|
{
|
|
"file": "src/main/runtime/orca-runtime.test.ts",
|
|
"assertions": [
|
|
"returns a blocked wait result for Codex update prompts",
|
|
"returns a blocked wait result for Codex workspace trust prompts",
|
|
"returns a blocked wait result for generic Codex interactive prompts",
|
|
"resolves tui-idle when a stale Codex prompt is followed by the ready header"
|
|
]
|
|
}
|
|
],
|
|
"evidenceRuns": [
|
|
{
|
|
"date": "2026-07-03",
|
|
"runner": "local",
|
|
"platform": "macos",
|
|
"command": "pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/pty.test.ts",
|
|
"result": "passed",
|
|
"durationSeconds": 1.5,
|
|
"summary": "1 test file(s) passed, 209 tests passed on main@1282f5c2d in a clean checkout."
|
|
},
|
|
{
|
|
"date": "2026-07-10",
|
|
"runner": "local",
|
|
"platform": "macos",
|
|
"command": "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/orca-runtime-path-candidate-history.test.ts",
|
|
"result": "passed",
|
|
"durationSeconds": 3.49,
|
|
"summary": "1 test file passed, 2 tests passed on the exact rebased tree based on main@dc468f0ded."
|
|
},
|
|
{
|
|
"date": "2026-07-10",
|
|
"runner": "local",
|
|
"platform": "macos",
|
|
"command": "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/orca-runtime.test.ts src/main/runtime/orca-runtime-tail-wait-memo.test.ts",
|
|
"result": "passed",
|
|
"durationSeconds": 21.33,
|
|
"summary": "2 test files passed, 609 tests passed on pushed commit 4fb14eac3897."
|
|
}
|
|
],
|
|
"runtimeBudget": {
|
|
"p95Seconds": 120,
|
|
"scope": "deterministic provider/IPC contract now; terminal perf soak/report gate before promotion"
|
|
},
|
|
"flakeHistory": {
|
|
"status": "unknown",
|
|
"evidence": "Focused main-process backlog tests are deterministic unit slices. The combined perf soak still needs runtime history before promotion."
|
|
},
|
|
"redGreenEvidence": {
|
|
"status": "partial",
|
|
"evidence": "Tests assert pathless runtime output reuses unchanged path-provenance history with zero old-candidate byte scans, ordinary saturated terminal tails retain no rebuilt wait text or repeated phrase scans while every blocked/ready prompt family remains live, main pending renderer output is capped per PTY and in total, total-pressure trimming prefers background pending output before active pending output, trimmed pending tails preserve seq/rawLength metadata, and ACK-gated in-flight output remains bounded. Intentionally restoring the old path-history shape failed the focused scale test after 774ms and 4,096 replacements; disabling the ordinary-tail branch failed with a retained 253,999-character waitText. The fixed shapes passed their focused suites. Existing renderer tests cover replay/backlog slices. Needs daemon-stream contract coverage and broader hidden-output/input-latency perf artifacts before promotion."
|
|
},
|
|
"performanceBudget": {
|
|
"required": true,
|
|
"evidence": "Suggested ceilings: renderer in-flight <=8MB total, <=512KB per PTY plus active reserve, renderer queued chars <=2MB, dropped backlogs 0, hidden restore <=1000ms, active key median/worst <=75ms/300ms in perf scenarios. With 1,024 retained provenance candidates, 4,096 pathless chunks dropped from 78.84ms and 4,096 array replacements to 1.74ms and zero replacements. Brace-free 1 KiB output dropped from 20.32/79.12/318.23ms to 0.31/0.64/2.35ms across 4,096/16,384/65,536 chunks. Repeated ordinary 252,000-character tail checks dropped from 96.34/464.20/941.79/3,796.70ms to 3.21/15.68/31.34/129.72ms across 100/500/1,000/4,096 updates."
|
|
},
|
|
"promotionCriteria": [
|
|
"Split daemon stream backpressure into a deterministic provider/IPC contract if full E2E is flaky.",
|
|
"Record JSON artifacts with bytes, dropped counts, queue depth, timer drift, and key latency.",
|
|
"Keep stress variants non-blocking until stable runtime history exists."
|
|
],
|
|
"knownGaps": [
|
|
"Daemon stream write(false)/drain/cleanup and bounded queued-tail contracts are not registered in the current command.",
|
|
"Runtime provenance coverage is deterministic and does not include a live high-throughput provider artifact.",
|
|
"Terminal-wait scale evidence is deterministic and does not yet include a live saturated-tail event-loop artifact.",
|
|
"Current command does not prove renderer parse pressure, scheduler queue depth, event-loop delay, or active key latency.",
|
|
"Live hidden-output pressure, active input latency, and full Electron perf artifacts remain unproved."
|
|
],
|
|
"demotionRule": "Cannot promote without metric artifacts and bounded-byte assertions."
|
|
},
|
|
{
|
|
"id": "terminal-provider.daemon-startup-degraded-contract",
|
|
"title": "Daemon startup reconcile and degraded fallback preserve provider identity",
|
|
"maturity": "experimental",
|
|
"protection": "none",
|
|
"owner": "terminal-provider",
|
|
"layer": "provider-contract",
|
|
"surfaces": [
|
|
"daemon startup",
|
|
"degraded daemon",
|
|
"fallback PTY",
|
|
"provider ownership",
|
|
"startup restore"
|
|
],
|
|
"platforms": [
|
|
"macos",
|
|
"linux",
|
|
"windows"
|
|
],
|
|
"providers": [
|
|
"daemon",
|
|
"local"
|
|
],
|
|
"coveredPlatforms": [],
|
|
"coveredProviders": [],
|
|
"coverageNotes": "Registered gap on main. The fail-closed degraded-daemon hardening and its contracts exist only on the pending reliability stack. It registers here with its owning split PR.",
|
|
"motivatingLinks": [
|
|
"https://github.com/stablyai/orca/pull/6830",
|
|
"https://github.com/stablyai/orca/pull/6866",
|
|
"https://github.com/stablyai/orca/pull/7002"
|
|
],
|
|
"invariant": "Daemon startup reconciliation must preserve valid live daemon sessions, reap only true orphans, and degraded mode must not route an existing-looking daemon session through local fallback unless the caller explicitly marks a fresh degraded-mode spawn.",
|
|
"oracle": "The current provider-contract corpus covers valid current-worktree ids, folder/floating workspace ids, invalid removed-worktree ids, mixed live/orphan dry-run reconciliation, hyphenated worktree ids, malformed ids, daemon sessions discovered after restart, router discovery before existing-session spawn, router fail-closed behavior when legacy ownership cannot be listed or a known session has exited, degraded daemon fallback for fresh sessions, fail-closed behavior for unknown restored ids, benign inspection defaults for unknown ownership, and synthetic exits on daemon restart. Prior-worktree aliases and renamed-worktree startup wiring are promotion gaps, not current proof.",
|
|
"commands": [],
|
|
"testFiles": [],
|
|
"assertionRefs": [],
|
|
"evidenceRuns": [],
|
|
"runtimeBudget": {
|
|
"p95Seconds": 20,
|
|
"scope": "provider contract unit/integration test"
|
|
},
|
|
"flakeHistory": {
|
|
"status": "unknown",
|
|
"evidence": "Focused provider contract tests now run locally; needs soak history before promotion."
|
|
},
|
|
"redGreenEvidence": {
|
|
"status": "partial",
|
|
"evidence": "Tests assert discovered daemon sessions route to the daemon, fresh degraded-mode PTYs route to fallback only when marked new, router spawn discovers uncached existing sessions before choosing an adapter, router spawn fails closed instead of falling through to current when legacy listing fails or a known session has exited, targeted hasPty discovery caches legacy ownership before later write/resize-style operations, real daemon adapter listProcesses discovery seeds targeted hasPty liveness, folder and floating terminal workspace ids survive startup reconcile when valid, restored worktree-scoped and legacy/non-scoped ids do not fall back through spawn after ownership is lost or unknown, operations on unknown or exited existing ids fail closed, startup reconcile can dry-run orphan detection without killing live sessions, and process inspection returns benign defaults for unknown ownership. Production startup reconcile wiring remains unproven."
|
|
},
|
|
"performanceBudget": {
|
|
"required": true,
|
|
"evidence": "Reconcile must not add startup-blocking scans beyond the explicit daemon session inventory and must not leak global listing into hot paths."
|
|
},
|
|
"promotionCriteria": [
|
|
"Wire reconcileOnStartup or mark the production wiring gap explicitly.",
|
|
"Cover priorWorktreeIds so renamed worktrees are not falsely reaped."
|
|
],
|
|
"knownGaps": [
|
|
"No executable coverage on main yet; the slice lives on the pending fix-terminal-reliability stack.",
|
|
"Production startup reconcile wiring remains unproven.",
|
|
"Prior-worktree aliases and renamed-worktree startup reconcile are not covered by the current executable corpus.",
|
|
"Real daemon restart behavior is still covered only by lower-level synthetic exit and provider-contract tests."
|
|
],
|
|
"demotionRule": "Cannot promote while restored daemon ids or routing operations can silently route to local fallback."
|
|
},
|
|
{
|
|
"id": "terminal-provider.ssh-remote-reattach-contract",
|
|
"title": "SSH and remote terminal restore never turn unknown liveness into destructive cleanup",
|
|
"maturity": "experimental",
|
|
"protection": "partial",
|
|
"owner": "terminal-provider",
|
|
"layer": "provider-contract",
|
|
"surfaces": [
|
|
"SSH deferred restore",
|
|
"remote-runtime mirror polling",
|
|
"provider listing",
|
|
"reattach",
|
|
"unknown liveness"
|
|
],
|
|
"platforms": [
|
|
"macos",
|
|
"linux",
|
|
"windows"
|
|
],
|
|
"providers": [
|
|
"ssh",
|
|
"remote-runtime",
|
|
"wsl"
|
|
],
|
|
"coveredPlatforms": [
|
|
"macos"
|
|
],
|
|
"coveredProviders": [
|
|
"ssh"
|
|
],
|
|
"coverageNotes": "Deterministic renderer coverage proves startup publishes the state returned by ssh.connect, remote or unresolved hosts cannot enter local-daemon cold activation deferral, and stale cleanup cannot unregister a replacement runtime terminal. A macOS Electron journey connects to a real Linux SSH relay in Docker, persists six terminals, reloads the renderer, and verifies all six original relay PTYs remount eagerly and still execute remote input. Linux and Windows desktop clients, WSL, and remote-runtime restore remain gaps.",
|
|
"motivatingLinks": [
|
|
"https://github.com/stablyai/orca/pull/6951",
|
|
"https://github.com/stablyai/orca/pull/6955",
|
|
"https://github.com/stablyai/orca/pull/6979",
|
|
"https://github.com/stablyai/orca/pull/7009",
|
|
"https://github.com/stablyai/orca/pull/8597"
|
|
],
|
|
"invariant": "SSH, WSL, and remote-runtime restore paths must treat provider listing failures and unknown liveness as unknown, not dead, while still avoiding duplicate spawn and clearing expired relay leases exactly once. Snapshot-backed cold activation deferral is local-daemon-only; every restored remote terminal must mount a manager eagerly and preserve its provider PTY identity.",
|
|
"oracle": "Deterministic tests assert startup publishes ssh.connect's authoritative state before terminal reconnect, only an explicit local execution host can defer cold activation, host ownership changes clear old restrictions, and replacement runtime registrations survive stale cleanup. The live Docker SSH journey commits six terminal records to the relay, reloads Electron, requires the exact six manager ids with no parked tabs, compares all restored PTY ids to their pre-reload identities, and sends a marker through the restored terminal to a proof file on the Linux host.",
|
|
"commands": [
|
|
"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/startup/ssh-startup-reconnect.test.ts src/renderer/src/lib/resolved-worktree-execution-host.test.ts src/renderer/src/components/terminal/background-terminal-worktree-mount.test.ts src/renderer/src/runtime/sync-runtime-graph-scheduling.test.ts src/renderer/src/components/terminal-pane/use-terminal-pane-lifecycle.test.ts src/renderer/src/components/terminal-pane/pty-connection.test.ts",
|
|
"pnpm exec electron-vite build --mode e2e",
|
|
"SKIP_BUILD=1 pnpm exec playwright test tests/e2e/terminal-cold-activation-deferral.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
|
|
"ORCA_E2E_SSH_DOCKER=1 SKIP_BUILD=1 pnpm exec playwright test tests/e2e/ssh-cold-activation-restore.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1"
|
|
],
|
|
"testFiles": [
|
|
"src/renderer/src/startup/ssh-startup-reconnect.test.ts",
|
|
"src/renderer/src/lib/resolved-worktree-execution-host.test.ts",
|
|
"src/renderer/src/components/terminal/background-terminal-worktree-mount.test.ts",
|
|
"src/renderer/src/runtime/sync-runtime-graph-scheduling.test.ts",
|
|
"src/renderer/src/components/terminal-pane/use-terminal-pane-lifecycle.test.ts",
|
|
"src/renderer/src/components/terminal-pane/pty-connection.test.ts",
|
|
"tests/e2e/terminal-cold-activation-deferral.spec.ts",
|
|
"tests/e2e/ssh-cold-activation-restore.spec.ts"
|
|
],
|
|
"assertionRefs": [
|
|
{
|
|
"file": "src/renderer/src/startup/ssh-startup-reconnect.test.ts",
|
|
"assertions": [
|
|
"the state returned by ssh.connect is published before persisted terminals reconnect"
|
|
]
|
|
},
|
|
{
|
|
"file": "src/renderer/src/components/terminal/background-terminal-worktree-mount.test.ts",
|
|
"assertions": [
|
|
"only an explicit local execution host can defer cold activation",
|
|
"SSH, remote-runtime, and unresolved owners remain eager"
|
|
]
|
|
},
|
|
{
|
|
"file": "tests/e2e/ssh-cold-activation-restore.spec.ts",
|
|
"assertions": [
|
|
"six relay-backed tabs retain the same six PTY ids across renderer reload",
|
|
"all six SSH managers mount eagerly and none is parked",
|
|
"restored terminal input reaches a proof file on the Linux SSH host"
|
|
]
|
|
}
|
|
],
|
|
"evidenceRuns": [
|
|
{
|
|
"date": "2026-07-14",
|
|
"runner": "local",
|
|
"platform": "macos",
|
|
"command": "ORCA_E2E_SSH_DOCKER=1 SKIP_BUILD=1 pnpm exec playwright test tests/e2e/ssh-cold-activation-restore.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
|
|
"result": "passed",
|
|
"durationSeconds": 128,
|
|
"summary": "Six focused files and 475 tests passed; the local cold-activation journey passed; the Docker/Linux SSH journey restored six of six original relay PTYs, mounted six of six managers without parking, and executed remote input through the restored terminal."
|
|
}
|
|
],
|
|
"runtimeBudget": {
|
|
"p95Seconds": 45,
|
|
"scope": "provider contract plus optional SSH soak"
|
|
},
|
|
"flakeHistory": {
|
|
"status": "unknown",
|
|
"evidence": "Focused renderer contracts and one clean Docker/Linux SSH Electron run pass locally; the live journey needs CI soak history before promotion."
|
|
},
|
|
"redGreenEvidence": {
|
|
"status": "partial",
|
|
"evidence": "Tests assert SSH attach uses relay pty.attach for saved sessions, expired relay attach does not fresh-spawn in the provider, a failed SSH listProcesses observation does not clear previously learned ownership, a rejected SSH hasPty probe resolves as unknown liveness, deferred SSH passphrase cancellation does not auto-reconnect, deferred attach uses saved leaf/tab session ids once connected, transient deferred reattach failure preserves the saved session id without clearing pane/tab bindings or fresh-spawning, deferred SSH no-result cleanup clears the pending serializer without clearing pane/tab bindings or consuming the saved restore id, disconnected SSH relay ids are retained as deferred reconnect metadata and sidebar wake hints rather than attached PTY proof, and expired deferred relay state clears stale pane/tab bindings before one fresh replacement spawn. Needs WSL, remote-runtime mirror polling, live SSH, and saved intentional-break artifacts before promotion."
|
|
},
|
|
"performanceBudget": {
|
|
"required": true,
|
|
"evidence": "Host eligibility is resolved from existing store metadata during activation and adds no provider listing or polling. The local journey preserves cold deferral, while SSH eagerly mounts six managers as required; no work is added to typing or terminal-output hot paths."
|
|
},
|
|
"promotionCriteria": [
|
|
"Use deterministic fake providers for failure and unknown-liveness cases.",
|
|
"Keep environment-dependent live SSH tests as soak until stable.",
|
|
"Include reconnect/polling artifacts that identify provider, connection id, and lease state."
|
|
],
|
|
"knownGaps": [
|
|
"Current command covers store wake-hint metadata, main-process SSH provider failure semantics, provider attach/expired-attach behavior, and renderer deferred SSH reconnect/transient-failure/expired-relay fallback with mocked transports.",
|
|
"The live SSH journey is environment-dependent and currently runs from a macOS Electron client against a Linux Docker host.",
|
|
"WSL and remote-runtime mirror polling contracts are not wired yet.",
|
|
"Linux and Windows desktop-client journeys are not yet collected."
|
|
],
|
|
"demotionRule": "Cannot promote if provider failure can close panes or if the oracle is screenshot-only."
|
|
},
|
|
{
|
|
"id": "terminal-provider.wsl-restore-contract",
|
|
"title": "WSL terminals preserve launch identity, liveness, and restore boundaries",
|
|
"maturity": "experimental",
|
|
"protection": "none",
|
|
"owner": "terminal-provider",
|
|
"layer": "windows-provider-contract",
|
|
"surfaces": [
|
|
"WSL",
|
|
"Windows host boundary",
|
|
"cwd identity",
|
|
"startup command",
|
|
"provider liveness",
|
|
"restore"
|
|
],
|
|
"platforms": [
|
|
"windows"
|
|
],
|
|
"providers": [
|
|
"wsl"
|
|
],
|
|
"coveredPlatforms": [],
|
|
"coveredProviders": [],
|
|
"coverageNotes": "Registered gap only; no executable coverage is wired yet.",
|
|
"motivatingLinks": [
|
|
"https://github.com/stablyai/orca/pull/6801",
|
|
"https://github.com/stablyai/orca/pull/6830",
|
|
"https://github.com/stablyai/orca/pull/6866",
|
|
"https://github.com/stablyai/orca/pull/6951"
|
|
],
|
|
"invariant": "WSL terminal restore must preserve Windows-host and Linux-guest path/cwd identity, shell launch args, startup command delivery, provider liveness semantics, and saved session ownership without being treated as ordinary local Windows ConPTY or generic SSH.",
|
|
"oracle": "No executable slice yet. Promotion needs a Windows provider contract plus one focused live WSL smoke proving cwd/path mapping, shell echo, startup command delivery, targeted liveness unknown handling, and restore without duplicate panes or destructive false-dead cleanup.",
|
|
"commands": [],
|
|
"testFiles": [],
|
|
"assertionRefs": [],
|
|
"evidenceRuns": [],
|
|
"runtimeBudget": {
|
|
"p95Seconds": 90,
|
|
"scope": "Windows WSL provider contract plus focused live smoke"
|
|
},
|
|
"flakeHistory": {
|
|
"status": "not-started",
|
|
"evidence": "WSL is split out from SSH/remote planning so it cannot be mistaken for covered provider behavior."
|
|
},
|
|
"redGreenEvidence": {
|
|
"status": "missing",
|
|
"evidence": "Needs intentional-break evidence for path/cwd mapping, startup command delivery, liveness unknown handling, and restore ownership."
|
|
},
|
|
"performanceBudget": {
|
|
"required": true,
|
|
"evidence": "WSL restore and liveness checks must avoid broad provider scans on typing, focus, switch, render, or resize hot paths."
|
|
},
|
|
"promotionCriteria": [
|
|
"Start with deterministic provider contracts for path/cwd mapping and launch args.",
|
|
"Add one focused Windows live WSL smoke after provider contracts are stable.",
|
|
"Keep WSL separate from SSH and local ConPTY evidence in PR descriptions."
|
|
],
|
|
"knownGaps": [
|
|
"No manifest command yet.",
|
|
"No live Windows WSL CI evidence.",
|
|
"No provider contract yet separates Windows host paths from Linux guest cwd identity."
|
|
],
|
|
"demotionRule": "Cannot promote while WSL restore is inferred from SSH, local ConPTY, or remote-runtime gates."
|
|
},
|
|
{
|
|
"id": "terminal-output.scrollback-replay-fifo",
|
|
"title": "Replay, scrollback, and hidden-output restore preserve ordering and clear semantics",
|
|
"maturity": "experimental",
|
|
"protection": "none",
|
|
"owner": "terminal-rendering",
|
|
"layer": "renderer-unit-provider-contract",
|
|
"surfaces": [
|
|
"snapshot replay",
|
|
"scrollback restore",
|
|
"hidden output",
|
|
"metadata-only replay",
|
|
"WebGL recovery"
|
|
],
|
|
"platforms": [
|
|
"macos",
|
|
"linux",
|
|
"windows"
|
|
],
|
|
"providers": [
|
|
"local",
|
|
"daemon",
|
|
"ssh",
|
|
"remote-runtime"
|
|
],
|
|
"coveredPlatforms": [],
|
|
"coveredProviders": [],
|
|
"coverageNotes": "Registered gap on main. The replay FIFO/burst coalescing product change and its tests exist only on the pending reliability stack; main still uses a single pendingReplayData slot. It registers here with its owning split PR.",
|
|
"motivatingLinks": [
|
|
"https://github.com/stablyai/orca/pull/7012",
|
|
"https://github.com/stablyai/orca/pull/7054",
|
|
"https://github.com/stablyai/orca/pull/6949"
|
|
],
|
|
"invariant": "Multiple replay notifications, metadata-only eager replays, hidden-output restores, and WebGL recovery must preserve FIFO ordering, apply clear-before-replay only when intended, and never overlay stale bytes on newer terminal output.",
|
|
"oracle": "The current executable slice injects overlapping replay notifications while async replay drains and asserts pre-parse coalescing, in-flight replay preservation, FIFO draining after xterm parsing starts, and bounded burst-tail coalescing. Metadata-only replay, hidden output chunks, live output interleaving, clear semantics, and stale-overlap checks remain promotion-scope gaps.",
|
|
"commands": [],
|
|
"testFiles": [],
|
|
"assertionRefs": [],
|
|
"evidenceRuns": [],
|
|
"runtimeBudget": {
|
|
"p95Seconds": 20,
|
|
"scope": "renderer unit or provider-contract test"
|
|
},
|
|
"flakeHistory": {
|
|
"status": "unknown",
|
|
"evidence": "Focused remote replay tests now run locally; needs soak history before promotion."
|
|
},
|
|
"redGreenEvidence": {
|
|
"status": "partial",
|
|
"evidence": "Focused tests assert pre-parse replay coalescing, in-flight replay preservation, FIFO draining for multiple replay notifications accepted after xterm parsing starts, and bounded burst-tail coalescing that keeps the newest snapshot. Needs saved red/green evidence and broader clear/metadata/hidden-output cases before promotion."
|
|
},
|
|
"performanceBudget": {
|
|
"required": true,
|
|
"evidence": "Replay fixes must not add unbounded renderer parsing, hidden-pane wakeups, or retry loops."
|
|
},
|
|
"promotionCriteria": [
|
|
"Extend deterministic multi-replay coverage before changing replay code.",
|
|
"Prove metadata-only replay does not clear restored scrollback.",
|
|
"Keep long-table/golden visual tests as supporting evidence, not the primary oracle."
|
|
],
|
|
"knownGaps": [
|
|
"No executable coverage on main yet; the slice lives on the pending fix-terminal-reliability stack.",
|
|
"Current command covers remote replay overlap, in-flight preservation, FIFO ordering for multiple in-progress replay notifications, and bounded burst-tail coalescing only.",
|
|
"Does not yet cover clearBeforeReplay metadata on the fresh main implementation.",
|
|
"Does not yet cover hidden-output restore plus live-output interleaving."
|
|
],
|
|
"demotionRule": "Cannot promote without ordered replay and clear-semantics assertions."
|
|
},
|
|
{
|
|
"id": "terminal-input.ime-and-synthetic-forwarding",
|
|
"title": "IME, native text, and synthetic input commit exactly once and do not leak preedit bytes",
|
|
"maturity": "experimental",
|
|
"protection": "partial",
|
|
"owner": "terminal-input",
|
|
"layer": "renderer-unit-platform-soak",
|
|
"surfaces": [
|
|
"IME",
|
|
"native text forwarding",
|
|
"synthetic input",
|
|
"paste",
|
|
"keyboard bypass",
|
|
"JIS yen"
|
|
],
|
|
"platforms": [
|
|
"macos",
|
|
"linux",
|
|
"windows"
|
|
],
|
|
"providers": [
|
|
"local",
|
|
"daemon",
|
|
"ssh",
|
|
"remote-runtime"
|
|
],
|
|
"coveredPlatforms": [
|
|
"macos",
|
|
"linux"
|
|
],
|
|
"coveredProviders": [],
|
|
"coverageNotes": "Local macOS and containerized Linux evidence, deterministic renderer-unit coverage for the Linux/Sogou candidate-key policy including the legacy orphaned-keyup fallback, and Electron/CDP live-PTY Sogou-style repros. Real Linux/Sogou OS IME automation, Windows ConPTY post-agent reset, and the CJK/Vietnamese/Arabic matrix remain registered gaps.",
|
|
"motivatingLinks": [
|
|
"https://github.com/stablyai/orca/pull/6699",
|
|
"https://github.com/stablyai/orca/pull/6682",
|
|
"https://github.com/stablyai/orca/pull/6513",
|
|
"https://github.com/stablyai/orca/pull/6999"
|
|
],
|
|
"invariant": "Composition, native text forwarding, synthetic input, paste, and platform keyboard bypass paths must not send preedit/control bytes before commit and must commit text exactly once to the intended PTY.",
|
|
"oracle": "The current renderer-unit slice asserts native text commits route to the intended PTY once, composition/preedit bookkeeping does not leak premature text, input-source classification handles synthetic/native paths, paste/runtime forwarding avoids duplicate terminal payloads for covered fixtures, and Linux/Sogou candidate Space/digit selectors do not leak keydown/keypress/keyup while ordinary and long-held letter-to-digit typing remains available. The Electron/CDP live-PTY repro verifies Sogou-style Space and digit selectors submit only the committed Chinese text, while the legacy orphaned-letter-keyup sequence sends no selector byte to the PTY. Real legacy IME commit preservation and the full CJK/Vietnamese/Arabic/JIS-yen matrix run in follow-up platform soak where automation is possible.",
|
|
"commands": [
|
|
"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/terminal-ime-native-text-forwarder.test.ts src/renderer/src/components/terminal-pane/terminal-ime-input-source.test.ts src/renderer/src/components/terminal-pane/terminal-paste-runtime.test.ts src/renderer/src/components/terminal-pane/terminal-ime-composition-tracker.test.ts src/renderer/src/components/terminal-pane/terminal-ime-candidate-key-release-guard.test.ts src/renderer/src/components/terminal-pane/xterm-bypass-policy-non-mac.test.ts src/renderer/src/components/terminal-pane/xterm-bypass-policy.test.ts",
|
|
"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/terminal-ime-linux-candidate-state.test.ts",
|
|
"pnpm run test:e2e -- tests/e2e/chinese-ime-chat-input-repro.spec.ts"
|
|
],
|
|
"testFiles": [
|
|
"src/renderer/src/components/terminal-pane/terminal-ime-native-text-forwarder.test.ts",
|
|
"src/renderer/src/components/terminal-pane/terminal-ime-input-source.test.ts",
|
|
"src/renderer/src/components/terminal-pane/terminal-paste-runtime.test.ts",
|
|
"src/renderer/src/components/terminal-pane/terminal-ime-composition-tracker.test.ts",
|
|
"src/renderer/src/components/terminal-pane/terminal-ime-candidate-key-release-guard.test.ts",
|
|
"src/renderer/src/components/terminal-pane/terminal-ime-linux-candidate-state.test.ts",
|
|
"src/renderer/src/components/terminal-pane/xterm-bypass-policy-non-mac.test.ts",
|
|
"src/renderer/src/components/terminal-pane/xterm-bypass-policy.test.ts",
|
|
"tests/e2e/chinese-ime-chat-input-repro.spec.ts"
|
|
],
|
|
"assertionRefs": [
|
|
{
|
|
"file": "src/renderer/src/components/terminal-pane/terminal-ime-native-text-forwarder.test.ts",
|
|
"assertions": [
|
|
"native text commits route once to the intended PTY",
|
|
"composition/preedit bookkeeping does not leak premature text"
|
|
]
|
|
},
|
|
{
|
|
"file": "src/renderer/src/components/terminal-pane/terminal-ime-input-source.test.ts",
|
|
"assertions": [
|
|
"synthetic and native input-source paths are classified for covered fixtures"
|
|
]
|
|
},
|
|
{
|
|
"file": "src/renderer/src/components/terminal-pane/terminal-paste-runtime.test.ts",
|
|
"assertions": [
|
|
"paste/runtime forwarding avoids duplicate terminal payloads"
|
|
]
|
|
},
|
|
{
|
|
"file": "src/renderer/src/components/terminal-pane/terminal-ime-composition-tracker.test.ts",
|
|
"assertions": [
|
|
"empty Sogou-style compositionupdate keeps composition active",
|
|
"stale composition state expires so editing keys cannot stay suppressed indefinitely",
|
|
"post-composition candidate guard is armed only by Sogou-style empty updates and clears after real typing"
|
|
]
|
|
},
|
|
{
|
|
"file": "src/renderer/src/components/terminal-pane/terminal-ime-candidate-key-release-guard.test.ts",
|
|
"assertions": [
|
|
"suppressed candidate keydown arms only the matching keypress/keyup release guard",
|
|
"held-key repeat keydowns stay guarded until their keyup, even past expiry",
|
|
"fresh keydowns, other keys, modified keys, and expired keypresses are not guarded, and a fresh press drops a stale pending release"
|
|
]
|
|
},
|
|
{
|
|
"file": "src/renderer/src/components/terminal-pane/terminal-ime-linux-candidate-state.test.ts",
|
|
"assertions": [
|
|
"an orphaned plain-letter keyup arms exactly the next bare digit guard",
|
|
"ordinary, overlapping, shifted, and long-held letter keydowns keep following digits available",
|
|
"physical letter tracking survives cross-pane focus handoff and clears on renderer-window blur"
|
|
]
|
|
},
|
|
{
|
|
"file": "src/renderer/src/components/terminal-pane/xterm-bypass-policy-non-mac.test.ts",
|
|
"assertions": [
|
|
"standalone Linux 229 keydowns reach xterm while Windows 229 keydowns stay suppressed",
|
|
"candidate Space/digit selectors are suppressed only while candidate guards are active"
|
|
]
|
|
},
|
|
{
|
|
"file": "src/renderer/src/components/terminal-pane/xterm-bypass-policy.test.ts",
|
|
"assertions": [
|
|
"macOS standalone Process key behavior and composition-owned key suppression stay intact"
|
|
]
|
|
},
|
|
{
|
|
"file": "tests/e2e/chinese-ime-chat-input-repro.spec.ts",
|
|
"assertions": [
|
|
"Sogou-style Space candidate selection submits only the committed Chinese character",
|
|
"Sogou-style digit candidate selection submits only the committed Chinese phrase",
|
|
"Post-composition Sogou-style digit selection stays out of the PTY after compositionend",
|
|
"Legacy orphaned-letter-keyup digit selection submits no selector byte to the PTY; real legacy candidate commit preservation remains a platform gap"
|
|
]
|
|
}
|
|
],
|
|
"evidenceRuns": [
|
|
{
|
|
"date": "2026-07-11",
|
|
"runner": "local",
|
|
"platform": "macos",
|
|
"command": "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/terminal-ime-linux-candidate-state.test.ts",
|
|
"result": "passed",
|
|
"durationSeconds": 0.619,
|
|
"summary": "1 state test file and 10 tests passed on macOS, including orphan-keyup, shifted/modifier-changed releases, intervening-key cancellation, cross-pane focus handoff, window/terminal blur cleanup, and long-held-letter coverage; the complete 8-file slice also passed 158 tests."
|
|
},
|
|
{
|
|
"date": "2026-07-11",
|
|
"runner": "local",
|
|
"platform": "linux",
|
|
"command": "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/terminal-ime-linux-candidate-state.test.ts",
|
|
"result": "passed",
|
|
"durationSeconds": 0.747,
|
|
"summary": "1 state test file and 10 tests passed in Debian 12 arm64 Docker under Node 24, including orphan-keyup, shifted/modifier-changed releases, intervening-key cancellation, cross-pane focus handoff, window/terminal blur cleanup, and long-held-letter coverage; the complete 8-file slice also passed 158 tests."
|
|
},
|
|
{
|
|
"date": "2026-07-11",
|
|
"runner": "local",
|
|
"platform": "linux",
|
|
"command": "pnpm run test:e2e -- tests/e2e/chinese-ime-chat-input-repro.spec.ts",
|
|
"result": "passed",
|
|
"durationSeconds": 30.3,
|
|
"summary": "Debian 12 arm64 Docker with Node 24 and Xvfb passed both live Electron/PTY IME scenarios; the orphaned-letter-keyup candidate digit submitted no selector byte, and the real-Codex opt-in scenario was skipped."
|
|
},
|
|
{
|
|
"date": "2026-07-07",
|
|
"runner": "local",
|
|
"platform": "macos",
|
|
"command": "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/terminal-ime-native-text-forwarder.test.ts src/renderer/src/components/terminal-pane/terminal-ime-input-source.test.ts src/renderer/src/components/terminal-pane/terminal-paste-runtime.test.ts src/renderer/src/components/terminal-pane/terminal-ime-composition-tracker.test.ts src/renderer/src/components/terminal-pane/terminal-ime-candidate-key-release-guard.test.ts src/renderer/src/components/terminal-pane/xterm-bypass-policy-non-mac.test.ts src/renderer/src/components/terminal-pane/xterm-bypass-policy.test.ts",
|
|
"result": "passed",
|
|
"durationSeconds": 0.7,
|
|
"summary": "7 test file(s) passed, 144 tests passed on the Linux/Sogou candidate-key branch (includes held-key repeat guard coverage)."
|
|
},
|
|
{
|
|
"date": "2026-07-07",
|
|
"runner": "local",
|
|
"platform": "macos",
|
|
"command": "pnpm run test:e2e -- tests/e2e/chinese-ime-chat-input-repro.spec.ts",
|
|
"result": "passed",
|
|
"durationSeconds": 72.0,
|
|
"summary": "Electron/CDP IME repro passed: Sogou candidate selection, post-composition candidate selection, and existing Chinese IME harness passed; real Codex IME test was skipped behind ORCA_E2E_REAL_CODEX_IME."
|
|
}
|
|
],
|
|
"runtimeBudget": {
|
|
"p95Seconds": 90,
|
|
"scope": "renderer unit plus focused Electron/CDP IME repro"
|
|
},
|
|
"flakeHistory": {
|
|
"status": "unknown",
|
|
"evidence": "Focused renderer input tests and the Electron/CDP Sogou-style repro are now registered; needs soak history and true platform IME evidence before promotion."
|
|
},
|
|
"redGreenEvidence": {
|
|
"status": "partial",
|
|
"evidence": "Focused tests cover existing native-text, input-source, paste/runtime forwarding, Linux/Sogou candidate selector, post-composition guard contracts, and live-PTY Sogou-style candidate commits. Needs intentional-break proof for duplicate native text forwarding and composition preedit leakage, plus the broader language/platform matrix."
|
|
},
|
|
"performanceBudget": {
|
|
"required": true,
|
|
"evidence": "Terminal IME hot-path audit clean on 2026-07-11: candidate guards add O(1) boolean checks plus bounded per-pane Space/digit state and one renderer-scoped currently pressed physical-letter set; ref-counted renderer and pane blur listeners are disposed with pane lifecycle; no per-pane keyboard-event fan-out, polling, IPC, subprocess work, or SSH/remote transport cost added."
|
|
},
|
|
"promotionCriteria": [
|
|
"Cover deterministic byte/cell oracles first.",
|
|
"Mark true OS IME automation gaps explicitly by platform.",
|
|
"Pair with Windows ConPTY keyboard reset for Windows standard-key behavior."
|
|
],
|
|
"knownGaps": [
|
|
"Current commands include renderer-unit coverage and a CDP-driven Electron repro; real OS IME automation may need manual or soak evidence.",
|
|
"Backspace/Enter during composition, JIS yen, Arabic/RTL, paste edge cases, and Windows ConPTY post-agent key reset still need representative gate coverage."
|
|
],
|
|
"demotionRule": "Cannot promote if success is based only on DOM text without PTY byte/cell evidence."
|
|
},
|
|
{
|
|
"id": "terminal-input.windows-conpty-keyboard-reset",
|
|
"title": "Windows ConPTY resets keyboard protocol state after agents and TUIs exit",
|
|
"maturity": "experimental",
|
|
"protection": "none",
|
|
"owner": "terminal-platform",
|
|
"layer": "windows-electron-conpty",
|
|
"surfaces": [
|
|
"Windows ConPTY",
|
|
"keyboard protocol",
|
|
"agent exit",
|
|
"TUI exit",
|
|
"standard key input"
|
|
],
|
|
"platforms": [
|
|
"windows"
|
|
],
|
|
"providers": [
|
|
"local",
|
|
"daemon",
|
|
"wsl"
|
|
],
|
|
"coveredPlatforms": [],
|
|
"coveredProviders": [],
|
|
"coverageNotes": "Registered gap only; no executable coverage is wired yet.",
|
|
"motivatingLinks": [
|
|
"https://github.com/stablyai/orca/pull/6999",
|
|
"https://github.com/stablyai/orca/pull/6858"
|
|
],
|
|
"invariant": "After an agent or TUI exits on Windows ConPTY, ordinary Enter, Backspace, Arrow, paste, and printable keys must be delivered as standard shell input, not stale Kitty/CSI-u or application-mode bytes.",
|
|
"oracle": "A Windows gate records PTY input bytes before and after agent/TUI exit, submits real shell commands, and proves standard keys work without protocol leakage.",
|
|
"commands": [],
|
|
"testFiles": [],
|
|
"assertionRefs": [],
|
|
"evidenceRuns": [],
|
|
"runtimeBudget": {
|
|
"p95Seconds": 60,
|
|
"scope": "Windows provider-contract or focused Electron gate"
|
|
},
|
|
"flakeHistory": {
|
|
"status": "not-started",
|
|
"evidence": "Gate is registered as a known Windows ConPTY gap; no command is wired."
|
|
},
|
|
"redGreenEvidence": {
|
|
"status": "missing",
|
|
"evidence": "Needs intentional-break proof for stale keyboard-protocol mode after agent/TUI exit."
|
|
},
|
|
"performanceBudget": {
|
|
"required": true,
|
|
"evidence": "Must not add per-key global session listing or repeated protocol reset work on the typing hot path."
|
|
},
|
|
"promotionCriteria": [
|
|
"Use byte-level PTY input evidence, not only screenshots.",
|
|
"Start as Windows soak until skip and flake behavior is known.",
|
|
"Fail promotion on silent Windows environment skips."
|
|
],
|
|
"knownGaps": [
|
|
"No manifest command yet.",
|
|
"Real Windows ConPTY execution is not covered by macOS/Linux CI."
|
|
],
|
|
"demotionRule": "Cannot promote if standard-key behavior is inferred without PTY byte evidence."
|
|
},
|
|
{
|
|
"id": "terminal-input.windows-modified-enter-routing",
|
|
"title": "Windows modified Enter routes agent-compatible bytes to the active pane",
|
|
"maturity": "experimental",
|
|
"protection": "partial",
|
|
"owner": "terminal-input",
|
|
"layer": "main-provider-renderer-unit-and-windows-electron",
|
|
"surfaces": [
|
|
"terminal input",
|
|
"Windows modified Enter",
|
|
"agent identity",
|
|
"split panes",
|
|
"SSH",
|
|
"WSL",
|
|
"remote runtime"
|
|
],
|
|
"platforms": [
|
|
"macos",
|
|
"linux",
|
|
"windows"
|
|
],
|
|
"providers": [
|
|
"local",
|
|
"daemon",
|
|
"ssh",
|
|
"wsl",
|
|
"remote-runtime"
|
|
],
|
|
"coveredPlatforms": [
|
|
"macos"
|
|
],
|
|
"coveredProviders": [],
|
|
"coverageNotes": "Deterministic main/renderer tests run on macOS and exercise simulated Windows plus POSIX/Linux process-confirmation behavior. They cover exact local-ConPTY membership, detached-child rejection, SSH and paired-runtime host-platform routing including legacy runtime PTY IDs, active-PTY ownership after worktree host changes, Windows-to-WSL routing, unknown-metadata fallback, production handler composition, KKP authorization on every host, process-confirmed Droid routing and launch-triggered confirmation, typed-alias and forged-OSC isolation, shells without OSC 133, split/detach ownership with preserved shell classification, stale PTY exit/rebind rejection, command-generation revocation, daemon v21 warm-reattach identity, unavailable inspection, and lazy subprocess/RPC callback counts. A live linux-arm64 Docker target additionally proved real relay deployment, SSH PTY host detection, and exact inactive/active KKP bytes. The Electron byte test runs only on Windows; live Windows evidence remains uncollected. Test failures report exact expected bytes; no product telemetry or raw terminal logging is added.",
|
|
"motivatingLinks": [
|
|
"https://github.com/stablyai/orca/issues/7620",
|
|
"https://github.com/stablyai/orca/pull/7668"
|
|
],
|
|
"invariant": "Shift+Enter key recognition follows the client OS, while emitted bytes follow the active application and PTY host: active Kitty keyboard protocol authorizes CSI-u on every host; otherwise Windows hosts use Esc+CR except when allowlisted Droid ownership or fresh routing-trusted Droid process evidence authorizes CSI-u, and non-Windows hosts use Esc+CR. The active SSH connection, remote-runtime PTY owner, or live local session outranks later worktree ownership changes, and missing host-platform metadata falls back to the client. Every new command and PTY replacement revokes stale agent routing until current evidence settles; split or reused panes cannot inherit sibling or prior-PTY authority; unrelated keys perform no host, agent, protocol, or ConPTY lookup.",
|
|
"oracle": "Renderer tests assert exact bytes across client/PTY-host combinations, including Kitty keyboard protocol active and inactive on Windows and non-Windows hosts, and prove SSH identity, the environment encoded in an active remote-runtime PTY id, and live local-session identity outrank current worktree ownership, while unavailable platform metadata falls back to the client. A live linux-arm64 SSH PTY independently captured Esc+CR with KKP inactive and CSI-u with KKP active. Fresh Windows process evidence authorizes Droid bytes only after a recognized global candidate is intersected with the exact ConPTY console process list; detached descendants, helper failure/timeout/root-only fallback, stale PTY exit/rebind results, typed text, and hook/OSC output fail closed. A new OSC 133;C immediately publishes a routing-neutral generation, including during D-to-C races. In cmd.exe/Git Bash/custom shells without OSC 133, accepted inferred commands start the same fresh generation; accepted submit/interrupt, title exit, focus, and visibility revoke trusted Droid bytes while one bounded confirmation runs. Detach preserves the live PTY's source shell override so WSL/native classification cannot change with the current default. Ordinary fast shell commands use cached/no-scan paths; routing-relevant confirmation bypasses cached process snapshots and keeps the bounded three-read ladder. Daemon protocol v21 persists only an allowlisted launchAgent; warm reattach uses it as a display/confirmation hint and restores routing only after current process proof. The Windows Electron test focuses the real xterm textarea and records exact renderer-to-main PTY writes.",
|
|
"commands": [
|
|
"pnpm exec vitest run --config config/vitest.config.ts src/main/daemon/daemon-foreground-confirmation-protocol.test.ts src/main/daemon/daemon-pty-adapter.test.ts src/main/daemon/daemon-pty-router.test.ts src/main/daemon/daemon-server.test.ts src/main/daemon/degraded-daemon-pty-provider.test.ts src/main/daemon/pty-subprocess-foreground-scan-cadence.test.ts src/main/daemon/pty-subprocess.test.ts src/main/ipc/pty.test.ts src/main/providers/agent-foreground-process.test.ts src/main/providers/local-pty-provider.test.ts src/main/providers/windows-conpty-process-membership.test.ts src/renderer/src/components/terminal-pane/pane-foreground-agent-tracker.test.ts src/renderer/src/components/terminal-pane/pty-connection.test.ts src/renderer/src/components/terminal-pane/pty-transport.test.ts src/renderer/src/components/terminal-pane/terminal-pane-tab-detach.test.ts src/renderer/src/components/terminal-pane/terminal-shortcut-policy.test.ts src/renderer/src/components/terminal-pane/terminal-windows-shift-enter.test.ts src/renderer/src/store/slices/store-cascades.test.ts src/renderer/src/store/slices/terminal-pane-detach-agent-identity.test.ts src/shared/agent-process-recognition.test.ts src/shared/process-table-snapshot.test.ts tests/e2e/terminal-foreground-confirmation.unit.test.ts",
|
|
"pnpm run test:e2e -- tests/e2e/terminal-shortcuts.spec.ts",
|
|
"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/keyboard-handlers.test.ts src/renderer/src/components/terminal-pane/remote-runtime-pty-transport.test.ts src/renderer/src/components/terminal-pane/terminal-input-host-platform.test.ts"
|
|
],
|
|
"testFiles": [
|
|
"src/main/daemon/daemon-foreground-confirmation-protocol.test.ts",
|
|
"src/main/daemon/daemon-pty-adapter.test.ts",
|
|
"src/main/daemon/daemon-pty-router.test.ts",
|
|
"src/main/daemon/daemon-server.test.ts",
|
|
"src/main/daemon/degraded-daemon-pty-provider.test.ts",
|
|
"src/main/daemon/pty-subprocess-foreground-scan-cadence.test.ts",
|
|
"src/main/daemon/pty-subprocess.test.ts",
|
|
"src/main/ipc/pty.test.ts",
|
|
"src/main/providers/agent-foreground-process.test.ts",
|
|
"src/main/providers/local-pty-provider.test.ts",
|
|
"src/main/providers/windows-conpty-process-membership.test.ts",
|
|
"src/renderer/src/components/terminal-pane/pane-foreground-agent-tracker.test.ts",
|
|
"src/renderer/src/components/terminal-pane/keyboard-handlers.test.ts",
|
|
"src/renderer/src/components/terminal-pane/pty-connection.test.ts",
|
|
"src/renderer/src/components/terminal-pane/pty-transport.test.ts",
|
|
"src/renderer/src/components/terminal-pane/remote-runtime-pty-transport.test.ts",
|
|
"src/renderer/src/components/terminal-pane/terminal-pane-tab-detach.test.ts",
|
|
"src/renderer/src/components/terminal-pane/terminal-input-host-platform.test.ts",
|
|
"src/renderer/src/components/terminal-pane/terminal-shortcut-policy.test.ts",
|
|
"src/renderer/src/components/terminal-pane/terminal-windows-shift-enter.test.ts",
|
|
"src/renderer/src/store/slices/store-cascades.test.ts",
|
|
"src/renderer/src/store/slices/terminal-pane-detach-agent-identity.test.ts",
|
|
"src/shared/agent-process-recognition.test.ts",
|
|
"src/shared/process-table-snapshot.test.ts",
|
|
"tests/e2e/terminal-foreground-confirmation.unit.test.ts",
|
|
"tests/e2e/terminal-shortcuts.spec.ts"
|
|
],
|
|
"assertionRefs": [
|
|
{
|
|
"file": "src/shared/process-table-snapshot.test.ts",
|
|
"assertions": [
|
|
"a fresh request bypasses a same-tick TTL cache and any scan already in flight before the request",
|
|
"same-turn fresh requests and ordinary cache misses share one later scan while requests arriving after it starts queue behind it"
|
|
]
|
|
},
|
|
{
|
|
"file": "src/main/providers/agent-foreground-process.test.ts",
|
|
"assertions": [
|
|
"successful root-present Windows enumeration and failed, blank, malformed, or root-missing enumeration remain distinct evidence states",
|
|
"an observed shell root with no children is authoritative while a snapshot omitting that root is unavailable",
|
|
"an attached Droid candidate is authorized only when exact ConPTY membership contains it, while a detached Start-Process descendant is rejected",
|
|
"a Windows process-table scan with no recognized agent performs zero ConPTY membership helper forks",
|
|
"fresh POSIX scan failure or a snapshot missing the PTY root is unavailable rather than shell proof",
|
|
"the compatibility process-name API still preserves its existing fallback contract for other consumers"
|
|
]
|
|
},
|
|
{
|
|
"file": "src/main/providers/windows-conpty-process-membership.test.ts",
|
|
"assertions": [
|
|
"the fixed node-pty helper returns validated integer console membership containing the PTY root",
|
|
"root-only fallback, malformed/missing-root messages, spawn errors, and a silent helper timeout all fail closed",
|
|
"the bounded timeout kills the child helper exactly once"
|
|
]
|
|
},
|
|
{
|
|
"file": "src/main/providers/local-pty-provider.test.ts",
|
|
"assertions": [
|
|
"a delayed foreground confirmation is discarded after the owning PTY exits"
|
|
]
|
|
},
|
|
{
|
|
"file": "src/main/daemon/daemon-pty-adapter.test.ts",
|
|
"assertions": [
|
|
"new daemon sessions and warm reattach results carry the same minimal allowlisted launchAgent"
|
|
]
|
|
},
|
|
{
|
|
"file": "src/main/daemon/daemon-server.test.ts",
|
|
"assertions": [
|
|
"daemon protocol v21 persists allowlisted launchAgent across reattach and drops unknown identity strings"
|
|
]
|
|
},
|
|
{
|
|
"file": "src/main/daemon/pty-subprocess.test.ts",
|
|
"assertions": [
|
|
"Windows daemon foreground lookup can return PowerShell synchronously before async process-tree enrichment resolves the agent",
|
|
"the enriched agent result is served by a later foreground read",
|
|
"fresh confirmation awaits a post-request scan instead of serving cached PowerShell and returns null when inspection is unavailable"
|
|
]
|
|
},
|
|
{
|
|
"file": "tests/e2e/terminal-foreground-confirmation.unit.test.ts",
|
|
"assertions": [
|
|
"the real daemon handle and pane tracker keep restored Droid identity when confirmation resolves after the old cache window",
|
|
"one fresh command-finish scan confirms real shell exit, while unavailable inspection performs exactly three bounded reads and never claims shell"
|
|
]
|
|
},
|
|
{
|
|
"file": "src/renderer/src/components/terminal-pane/keyboard-handlers.test.ts",
|
|
"assertions": [
|
|
"the production keyboard-policy boundary requires active-host routing and composes macOS Shift+Enter with Windows PTY bytes"
|
|
]
|
|
},
|
|
{
|
|
"file": "src/renderer/src/components/terminal-pane/remote-runtime-pty-transport.test.ts",
|
|
"assertions": [
|
|
"a legacy remote PTY id retains the transport's captured runtime environment identity"
|
|
]
|
|
},
|
|
{
|
|
"file": "src/renderer/src/components/terminal-pane/terminal-input-host-platform.test.ts",
|
|
"assertions": [
|
|
"SSH terminals use remote-platform metadata and execution-host identity when the active transport has not captured a connection id",
|
|
"encoded and legacy active remote-runtime PTY identities plus a live local PTY session outrank later worktree host changes",
|
|
"a live WSL session normalizes to a Linux terminal host",
|
|
"missing SSH/runtime platform metadata and local terminals fall back to the client platform"
|
|
]
|
|
},
|
|
{
|
|
"file": "src/renderer/src/components/terminal-pane/terminal-shortcut-policy.test.ts",
|
|
"assertions": [
|
|
"Windows defaults and non-Droid agents preserve Esc+CR while explicit Droid capability selects CSI-u",
|
|
"Windows and non-Windows PTYs reached cross-OS use CSI-u only with active Kitty keyboard protocol unless trusted Windows Droid evidence independently authorizes it",
|
|
"unrelated keys invoke neither host, agent, nor protocol callbacks"
|
|
]
|
|
},
|
|
{
|
|
"file": "src/renderer/src/components/terminal-pane/terminal-windows-shift-enter.test.ts",
|
|
"assertions": [
|
|
"only routing-trusted current process identity overrides launch evidence and confirmed shell foreground clears stale identity",
|
|
"a newer untrusted or neutral command generation blocks stale launch ownership until confirmation",
|
|
"only allowlisted fresh process or pane-scoped launch ownership selects Droid's CSI-u capability",
|
|
"forged hook or OSC-derived Droid status cannot change the Windows byte encoding",
|
|
"after split and original-pane close, a sole surviving sibling cannot inherit the original pane's Droid launch identity"
|
|
]
|
|
},
|
|
{
|
|
"file": "src/renderer/src/components/terminal-pane/pane-foreground-agent-tracker.test.ts",
|
|
"assertions": [
|
|
"manual and restored local agent identity is published from bounded foreground-process reads",
|
|
"a delayed read cannot publish after the pane rebinds to a replacement PTY id",
|
|
"every new command publishes a routing-neutral generation before confirmation",
|
|
"typed agent text only widens the confirmation window and never becomes published or routable identity",
|
|
"unavailable typed-command confirmation stays on legacy routing through the three-read ladder and then fails closed",
|
|
"ordinary fast OSC 133;C-to-D command pairs publish shell without a fresh confirmation scan",
|
|
"command-start and visible launch recovery use at most three reads across the bounded 350 ms, 1.2 s, and 6 s ladder",
|
|
"null and rejected reads participate in the same bounded known-identity ladder",
|
|
"command-finished accepts one fresh recognized shell scan when agent evidence exists, while unavailable final evidence retires routing without claiming shell"
|
|
]
|
|
},
|
|
{
|
|
"file": "src/renderer/src/components/terminal-pane/pty-connection.test.ts",
|
|
"assertions": [
|
|
"after detach remount, pane-key launch/process identity forces a leaked nested OSC 133;D through foreground confirmation",
|
|
"a still-running Droid process republishes Droid instead of being overwritten with shell-foreground evidence",
|
|
"typing droid does not route CSI-u until fresh process evidence confirms Droid",
|
|
"null and rejected command-start reads never promote typed Droid text to process evidence",
|
|
"typed Droid input cannot replace live Antigravity process or pane-scoped launch identity inside another TUI",
|
|
"typed Droid input on SSH or remote-runtime panes never writes local process evidence",
|
|
"Droid routing survives a fresh command-finish scan that still sees Droid and retires after one fresh shell result",
|
|
"a D-to-C transition immediately routes legacy bytes while the new command generation is pending",
|
|
"an identityless visible-read versus OSC 133;D race cancels stale sampling and fails closed to shell",
|
|
"a manually typed Droid in a shell without OSC 133 gains routing only after accepted-input fresh confirmation",
|
|
"accepted no-OSC exit or interrupt input immediately revokes trusted Droid bytes and confirms the returned shell",
|
|
"unavailable command-finish evidence resolves deferred cleanup, returns legacy routing, and does not assert shell foreground",
|
|
"daemon-returned allowlisted launchAgent requests warm-reattach confirmation without restoring stale byte authority or the original args/env payload, while missing identity fails closed",
|
|
"an unknown persisted wrapper cannot spoof launch identity and confirmed shell state prevents repeat focus scans"
|
|
]
|
|
},
|
|
{
|
|
"file": "src/renderer/src/components/terminal-pane/pty-transport.test.ts",
|
|
"assertions": [
|
|
"allowlisted daemon launchAgent reaches PtyConnectResult on reattach",
|
|
"unknown launch identity is dropped at the renderer transport boundary"
|
|
]
|
|
},
|
|
{
|
|
"file": "src/renderer/src/store/slices/terminal-pane-detach-agent-identity.test.ts",
|
|
"assertions": [
|
|
"pane-to-tab detach moves only the detached leaf's launch and process identity to its new pane key",
|
|
"pane-to-tab detach preserves the source PTY shell override across native PowerShell and WSL classifications",
|
|
"the source hook snapshot is retired rather than copied to a key the running PTY cannot emit",
|
|
"the detached Droid keeps CSI-u while the source sibling keeps its own legacy encoding"
|
|
]
|
|
},
|
|
{
|
|
"file": "src/shared/agent-process-recognition.test.ts",
|
|
"assertions": [
|
|
"Droid's process name resolves to the allowlisted Droid agent identity without substring matching"
|
|
]
|
|
},
|
|
{
|
|
"file": "tests/e2e/terminal-shortcuts.spec.ts",
|
|
"assertions": [
|
|
"on Windows the focused terminal sends CSI-u bytes for a Droid pane and Esc+CR bytes after switching that same pane to Antigravity identity",
|
|
"the byte oracle observes the real renderer-to-main PTY write path rather than terminal DOM state"
|
|
]
|
|
}
|
|
],
|
|
"evidenceRuns": [
|
|
{
|
|
"date": "2026-07-10",
|
|
"runner": "local",
|
|
"platform": "macos",
|
|
"command": "pnpm exec vitest run --config config/vitest.config.ts src/main/daemon/daemon-foreground-confirmation-protocol.test.ts src/main/daemon/daemon-pty-adapter.test.ts src/main/daemon/daemon-pty-router.test.ts src/main/daemon/daemon-server.test.ts src/main/daemon/degraded-daemon-pty-provider.test.ts src/main/daemon/pty-subprocess-foreground-scan-cadence.test.ts src/main/daemon/pty-subprocess.test.ts src/main/ipc/pty.test.ts src/main/providers/agent-foreground-process.test.ts src/main/providers/local-pty-provider.test.ts src/main/providers/windows-conpty-process-membership.test.ts src/renderer/src/components/terminal-pane/pane-foreground-agent-tracker.test.ts src/renderer/src/components/terminal-pane/pty-connection.test.ts src/renderer/src/components/terminal-pane/pty-transport.test.ts src/renderer/src/components/terminal-pane/terminal-pane-tab-detach.test.ts src/renderer/src/components/terminal-pane/terminal-shortcut-policy.test.ts src/renderer/src/components/terminal-pane/terminal-windows-shift-enter.test.ts src/renderer/src/store/slices/store-cascades.test.ts src/renderer/src/store/slices/terminal-pane-detach-agent-identity.test.ts src/shared/agent-process-recognition.test.ts src/shared/process-table-snapshot.test.ts tests/e2e/terminal-foreground-confirmation.unit.test.ts",
|
|
"result": "passed",
|
|
"durationSeconds": 8.71,
|
|
"summary": "Twenty-two focused test files passed (1206 tests) on current main, covering fresh-scan ordering/deduplication, exact ConPTY membership and detached-child rejection, stale PTY guards, daemon v21 launch ownership with current-process confirmation, no-OSC command/exit recovery, preserved detach shell classification, unavailable evidence, routing-neutral command generations, exact shortcut bytes, and the composed daemon-plus-tracker contract; the Windows Electron byte test remains platform-gated and is not counted as local macOS evidence."
|
|
}
|
|
],
|
|
"runtimeBudget": {
|
|
"p95Seconds": 90,
|
|
"scope": "focused renderer units plus the Windows Electron terminal-shortcut spec"
|
|
},
|
|
"flakeHistory": {
|
|
"status": "unknown",
|
|
"evidence": "The deterministic units are stable locally; the Windows-only Electron byte path needs CI or nightly soak history before promotion."
|
|
},
|
|
"redGreenEvidence": {
|
|
"status": "partial",
|
|
"evidence": "Reverting to the previous unconditional Windows Esc+CR branch fails the Droid byte assertion, while resolving launch metadata from any key other than the active pane fails the split-survivor isolation assertion. Saved intentional-break artifacts and live Windows history are still missing."
|
|
},
|
|
"performanceBudget": {
|
|
"required": true,
|
|
"evidence": "Callback-count tests prove unrelated ordinary keys invoke neither host, agent, nor Kitty-protocol resolution. Host and agent callbacks are created once per keyboard effect, so printable input adds no per-key allocations or store reads. Shift+Enter performs bounded synchronous active-transport and indexed store lookups, plus at most one pane-keyed protocol-mode lookup when trusted Windows Droid evidence does not already authorize CSI-u, with no IPC, RPC, subprocess, polling, listener, or timer. Typed text performs no routing write. Ordinary fast OSC 133;C-to-D shell commands perform no fresh confirmation RPC or process scan. An accepted submit/interrupt while trusted Droid is current, a typed allowlisted agent command, title exit, focus, visibility transition, or an idle burst after trusted Droid Shift+Enter can schedule the bounded confirmation ladder; each event cancels/deduplicates prior work and no timer recurs after settling. Windows confirmation performs one fresh process-table scan and forks exact ConPTY membership only after a recognized agent candidate appears; no recognized candidate makes zero helper calls. Same-turn fresh requests share one scan and later arrivals queue at most one successor. Recovery remains three bounded one-shot reads (350 ms, 1.2 s, 6 s). No polling loop, provider fanout, persistent listener, hidden-pane wake loop, or per-printable-key work is added."
|
|
},
|
|
"promotionCriteria": [
|
|
"Run the exact PTY-byte Electron oracle on Windows without silent platform skips.",
|
|
"Collect stable runtime and flake history for local and daemon Windows ConPTY while retaining deterministic host-routing assertions for SSH, WSL, and remote runtime.",
|
|
"Attach saved intentional-break evidence for Droid capability removal and split-sibling identity leakage."
|
|
],
|
|
"knownGaps": [
|
|
"No Windows runner or live Windows PTY evidence is attached; the Electron byte test skips on macOS and Linux, while a live Linux SSH PTY covers only the remote Linux host path.",
|
|
"Droid agent-specific CSI-u authorization is available only from trusted pane evidence; without it, Windows and non-Windows PTY hosts depend on the application's Kitty keyboard protocol state.",
|
|
"The Electron test injects allowlisted pane identity rather than launching the real Droid and Antigravity binaries.",
|
|
"If both Windows process-enumeration backends remain unavailable through the bounded ladder, routing fails closed to the legacy Esc+CR path; no live Droid artifact covers that degraded host configuration.",
|
|
"Protocol v21 restarts older daemons because the minimal persisted launchAgent is a new contract; sessions preserved by pre-v21 daemons cannot supply warm-reattach launch ownership and fail closed until current process confirmation or restart.",
|
|
"No live daemon, WSL, remote-runtime, paired-web, or restore/replay byte artifact has been collected; SSH is covered only by a macOS-client-to-Linux-host relay run.",
|
|
"A running PTY keeps its spawn-time ORCA_PANE_KEY after pane-to-tab detach. This change transfers launch/process routing evidence and retires the stale hook snapshot, but does not redesign future hook reattribution across tab IDs."
|
|
],
|
|
"demotionRule": "Keep non-blocking or demote to protection none if the Windows byte test silently skips, flakes without an actionable artifact, routes bytes using tab/title/terminal-output heuristics, or adds any ordinary-key lookup, IPC, polling, scan, or lifecycle leak."
|
|
},
|
|
{
|
|
"id": "terminal-input.guarded-agent-send-authorization",
|
|
"title": "Guarded agent sends authorize only the confirmed exact PTY",
|
|
"maturity": "experimental",
|
|
"protection": "partial",
|
|
"owner": "terminal-input",
|
|
"layer": "runtime-provider-contract",
|
|
"surfaces": [
|
|
"terminal input",
|
|
"guarded note sends",
|
|
"agent status",
|
|
"PTY identity",
|
|
"foreground process confirmation"
|
|
],
|
|
"platforms": [
|
|
"macos",
|
|
"linux",
|
|
"windows"
|
|
],
|
|
"providers": [
|
|
"local",
|
|
"daemon",
|
|
"ssh",
|
|
"wsl",
|
|
"remote-runtime"
|
|
],
|
|
"coveredPlatforms": [
|
|
"macos"
|
|
],
|
|
"coveredProviders": [
|
|
"local",
|
|
"daemon"
|
|
],
|
|
"coverageNotes": "Runtime and provider-contract tests on macOS cover exact-PTY authorization, local/daemon fresh confirmation, exact ConPTY membership, and unsupported-provider fail-closed behavior. Physical Windows, live Linux, SSH, WSL, and remote-runtime validation remain explicit gaps; providers without confirmation preserve conservative refusal on a shell conflict.",
|
|
"motivatingLinks": [
|
|
"https://github.com/stablyai/orca/issues/8303"
|
|
],
|
|
"invariant": "A guarded note send writes only to the exact PTY binding checked by the guard and only while permission/wait evidence allows input; fresh hook state conflicting with an ordinary shell foreground requires fresh provider confirmation of a recognized agent in that PTY.",
|
|
"oracle": "Fresh explicit state plus ordinary PowerShell plus confirmed recognized agent is sendable on the same PTY. Confirmed shell/non-agent, unavailable confirmation, PTY exit, handle rebind, or a callback PTY mismatch returns a refusal or not-writable result and writes zero bytes.",
|
|
"commands": [
|
|
"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/orca-runtime.test.ts src/main/runtime/rpc/terminal-send.test.ts src/main/ipc/pty.test.ts src/main/providers/agent-foreground-process.test.ts src/main/providers/local-pty-provider.test.ts src/main/providers/windows-conpty-process-membership.test.ts src/main/daemon/daemon-foreground-confirmation-protocol.test.ts src/main/daemon/pty-subprocess.test.ts src/renderer/src/lib/active-agent-note-send.test.ts src/renderer/src/components/browser-pane/BrowserAnnotationSendMenuContent.test.tsx"
|
|
],
|
|
"testFiles": [
|
|
"src/main/runtime/orca-runtime.test.ts",
|
|
"src/main/runtime/rpc/terminal-send.test.ts",
|
|
"src/main/ipc/pty.test.ts",
|
|
"src/main/providers/agent-foreground-process.test.ts",
|
|
"src/main/providers/local-pty-provider.test.ts",
|
|
"src/main/providers/windows-conpty-process-membership.test.ts",
|
|
"src/main/daemon/daemon-foreground-confirmation-protocol.test.ts",
|
|
"src/main/daemon/pty-subprocess.test.ts",
|
|
"src/renderer/src/lib/active-agent-note-send.test.ts",
|
|
"src/renderer/src/components/browser-pane/BrowserAnnotationSendMenuContent.test.tsx"
|
|
],
|
|
"assertionRefs": [
|
|
{
|
|
"file": "src/main/runtime/orca-runtime.test.ts",
|
|
"assertions": [
|
|
"a recognized fresh provider confirmation authorizes explicit hook state over an ordinary shell result",
|
|
"shell, non-agent, null, thrown, and missing confirmation remain fail-closed",
|
|
"title blockers and ordinary recognized agent evidence add no confirmation call",
|
|
"PTY exit or handle rebind during either foreground read rejects evidence bound to the original PTY",
|
|
"controller-less yields preserve stale-handle errors and confirmation methods retain their controller receiver"
|
|
]
|
|
},
|
|
{
|
|
"file": "src/main/runtime/rpc/terminal-send.test.ts",
|
|
"assertions": [
|
|
"a handle rebind during guarded status evaluation returns not writable and writes zero bytes",
|
|
"the callback's actual PTY must equal the handle binding before status can authorize a write"
|
|
]
|
|
},
|
|
{
|
|
"file": "src/main/ipc/pty.test.ts",
|
|
"assertions": [
|
|
"runtime confirmation reaches the provider owning the captured PTY",
|
|
"unsupported or missing providers return unavailable confirmation"
|
|
]
|
|
},
|
|
{
|
|
"file": "src/main/providers/agent-foreground-process.test.ts",
|
|
"assertions": [
|
|
"recognized Windows candidates require exact ConPTY membership and detached descendants are rejected",
|
|
"unavailable process inspection is distinct from authoritative shell evidence"
|
|
]
|
|
},
|
|
{
|
|
"file": "src/main/providers/local-pty-provider.test.ts",
|
|
"assertions": [
|
|
"fresh confirmation is discarded when its owning local PTY exits"
|
|
]
|
|
},
|
|
{
|
|
"file": "src/main/providers/windows-conpty-process-membership.test.ts",
|
|
"assertions": [
|
|
"exact ConPTY console membership comes from the fixed node-pty helper",
|
|
"malformed, incomplete, timed-out, and spawn-error membership reads fail closed"
|
|
]
|
|
},
|
|
{
|
|
"file": "src/main/daemon/daemon-foreground-confirmation-protocol.test.ts",
|
|
"assertions": [
|
|
"daemons from before the fresh-confirmation RPC are rejected by protocol version"
|
|
]
|
|
},
|
|
{
|
|
"file": "src/main/daemon/pty-subprocess.test.ts",
|
|
"assertions": [
|
|
"fresh confirmation bypasses cached PowerShell and waits for a post-request process scan"
|
|
]
|
|
},
|
|
{
|
|
"file": "src/renderer/src/lib/active-agent-note-send.test.ts",
|
|
"assertions": [
|
|
"selected active-agent note sends retain guarded paste and submit routing"
|
|
]
|
|
},
|
|
{
|
|
"file": "src/renderer/src/components/browser-pane/BrowserAnnotationSendMenuContent.test.tsx",
|
|
"assertions": [
|
|
"browser annotation send content routes through review-notes send so existing agent sessions remain selectable",
|
|
"both browser annotation send surfaces wire the shared menu content"
|
|
]
|
|
}
|
|
],
|
|
"evidenceRuns": [
|
|
{
|
|
"date": "2026-07-11",
|
|
"runner": "local",
|
|
"platform": "macos",
|
|
"command": "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/orca-runtime.test.ts src/main/runtime/rpc/terminal-send.test.ts src/main/ipc/pty.test.ts src/main/providers/agent-foreground-process.test.ts src/main/providers/local-pty-provider.test.ts src/main/providers/windows-conpty-process-membership.test.ts src/main/daemon/daemon-foreground-confirmation-protocol.test.ts src/main/daemon/pty-subprocess.test.ts src/renderer/src/lib/active-agent-note-send.test.ts src/renderer/src/components/browser-pane/BrowserAnnotationSendMenuContent.test.tsx",
|
|
"result": "passed",
|
|
"durationSeconds": 9.58,
|
|
"summary": "Ten focused test files passed (1183 tests), covering runtime confirmation and PTY revalidation, guarded RPC zero-write behavior, PTY controller routing, local/daemon fresh scans, exact ConPTY membership, and unchanged renderer note routing."
|
|
}
|
|
],
|
|
"runtimeBudget": {
|
|
"p95Seconds": 45,
|
|
"scope": "focused runtime, RPC, PTY provider, and renderer routing units"
|
|
},
|
|
"flakeHistory": {
|
|
"status": "unknown",
|
|
"evidence": "Deterministic units have local coverage only; promotion requires repeated CI and platform history."
|
|
},
|
|
"redGreenEvidence": {
|
|
"status": "partial",
|
|
"evidence": "Removing strong confirmation fails the shell-conflict success oracle, while removing either exact-binding comparison fails zero-write rebind coverage; saved intentional-break and physical Windows evidence remain missing."
|
|
},
|
|
"performanceBudget": {
|
|
"required": true,
|
|
"evidence": "Confirmation is invoked at most once per status evaluation and only for fresh explicit hook state whose ordinary foreground result is a shell. Count tests prove permission/title blockers and ordinary recognized-agent evidence add zero confirmations; no polling, retry, session listing, provider fanout, or runtime-global cache is added, and existing provider snapshot dedup remains authoritative."
|
|
},
|
|
"promotionCriteria": [
|
|
"Run the browser annotation existing-agent and repeat-send path in Electron on Windows ConPTY without a recognition refusal.",
|
|
"Collect stable CI and flake history across local and daemon providers on Windows plus representative macOS/Linux coverage.",
|
|
"Attach saved intentional-break evidence for confirmation removal and exact-PTY revalidation removal."
|
|
],
|
|
"knownGaps": [
|
|
"Physical Windows validation is unavailable on the current macOS host; exact ConPTY membership is covered deterministically.",
|
|
"Electron annotation golden-path, repeat-send, adjacent-menu evidence, and screenshots are left to coordinator validation.",
|
|
"SSH, WSL, legacy daemon, and remote-runtime providers without confirmation remain intentionally fail-closed on an ordinary-shell conflict; no live artifacts cover those degraded paths.",
|
|
"No live Linux PTY, paired-web, mobile/relay, restore/replay, or multi-window artifact is attached; those surfaces receive no renderer, persistence, or protocol change."
|
|
],
|
|
"demotionRule": "Keep non-blocking or demote to protection none if provider confirmation becomes unconditional, exact-PTY mismatch can write bytes, unsupported providers fail open, or the focused gate flakes without an actionable product or harness defect."
|
|
},
|
|
{
|
|
"id": "terminal-input.agent-prompt-injection",
|
|
"title": "Orchestration agent prompts arrive as bracketed paste before submit",
|
|
"maturity": "experimental",
|
|
"protection": "partial",
|
|
"owner": "terminal-input",
|
|
"layer": "runtime-contract-and-cli-repro",
|
|
"surfaces": [
|
|
"terminal input",
|
|
"agent prompt injection",
|
|
"orchestration dispatch",
|
|
"PTY writes",
|
|
"bracketed paste"
|
|
],
|
|
"platforms": [
|
|
"macos",
|
|
"linux",
|
|
"windows"
|
|
],
|
|
"providers": [
|
|
"local",
|
|
"daemon",
|
|
"ssh",
|
|
"remote-runtime"
|
|
],
|
|
"coveredPlatforms": [
|
|
"macos"
|
|
],
|
|
"coveredProviders": [
|
|
"local"
|
|
],
|
|
"coverageNotes": "Local macOS evidence covers the runtime PTY write contract and a live dev-runtime CLI repro. SSH, daemon, remote-runtime, Linux, and Windows remain provider/platform gaps; the product path stays provider-owned and does not add local filesystem or process assumptions.",
|
|
"motivatingLinks": [
|
|
"https://github.com/stablyai/orca/issues/7226"
|
|
],
|
|
"invariant": "Injected orchestration task prompts for recognized agent CLIs must send the prompt body inside one bracketed-paste frame, sanitize embedded ESC bytes, preserve chunk boundaries without losing the frame, and send Enter only after the paste frame completes.",
|
|
"oracle": "Runtime tests assert the exact PTY write sequence and failure cleanup; orchestration tests assert dispatch/coordinator use the agent prompt path; the live CLI harness dispatches a 32KB task to a fake Codex-like TUI and requires marker present, bracketed paste present, zero unframed line breaks, and submit observed.",
|
|
"commands": [
|
|
"pnpm exec vitest run --config config/vitest.config.ts src/shared/agent-prompt-injection.test.ts src/main/runtime/orca-runtime.test.ts src/main/runtime/rpc/methods/orchestration.test.ts src/main/runtime/orchestration/coordinator.test.ts",
|
|
"node tools/repro-orchestration-long-prompt.mjs --cli out/bin/orca-dev --mode codex-like --size-kb 32 --timeout-ms 20000"
|
|
],
|
|
"testFiles": [
|
|
"src/shared/agent-prompt-injection.test.ts",
|
|
"src/main/runtime/orca-runtime.test.ts",
|
|
"src/main/runtime/rpc/methods/orchestration.test.ts",
|
|
"src/main/runtime/orchestration/coordinator.test.ts",
|
|
"tools/repro-orchestration-long-prompt.mjs"
|
|
],
|
|
"assertionRefs": [
|
|
{
|
|
"file": "src/shared/agent-prompt-injection.test.ts",
|
|
"assertions": [
|
|
"agent prompts are always framed as bracketed paste",
|
|
"submit stays separate from the paste frame",
|
|
"embedded ESC bytes are made inert before framing",
|
|
"chunk reconstruction preserves the paste frame"
|
|
]
|
|
},
|
|
{
|
|
"file": "src/main/runtime/orca-runtime.test.ts",
|
|
"assertions": [
|
|
"runtime writes bracketed paste before a delayed submit",
|
|
"large prompt frames are chunked and reconstructed before submit",
|
|
"partial prompt write failure closes the paste frame and does not submit"
|
|
]
|
|
},
|
|
{
|
|
"file": "src/main/runtime/rpc/methods/orchestration.test.ts",
|
|
"assertions": [
|
|
"orchestration.dispatch uses the agent prompt path for injected preambles",
|
|
"raw terminal.send is not called for injected task prompts",
|
|
"failed prompt injection rolls back the active dispatch"
|
|
]
|
|
},
|
|
{
|
|
"file": "src/main/runtime/orchestration/coordinator.test.ts",
|
|
"assertions": [
|
|
"coordinator dispatch failures from prompt injection circuit-break through the DB",
|
|
"silent-skip paths do not attempt prompt injection"
|
|
]
|
|
},
|
|
{
|
|
"file": "tools/repro-orchestration-long-prompt.mjs",
|
|
"assertions": [
|
|
"fake Codex-like worker observes submit after long orchestration dispatch",
|
|
"32KB task marker survives before submit",
|
|
"prompt bytes include a bracketed-paste frame with zero unframed line breaks"
|
|
]
|
|
}
|
|
],
|
|
"evidenceRuns": [
|
|
{
|
|
"date": "2026-07-07",
|
|
"runner": "local",
|
|
"platform": "macos",
|
|
"command": "pnpm exec vitest run --config config/vitest.config.ts src/shared/agent-prompt-injection.test.ts src/main/runtime/orca-runtime.test.ts src/main/runtime/rpc/methods/orchestration.test.ts src/main/runtime/orchestration/coordinator.test.ts",
|
|
"result": "passed",
|
|
"durationSeconds": 7.4,
|
|
"summary": "4 test files passed, 697 tests passed; covers framing, runtime PTY writes, orchestration RPC dispatch, and coordinator dispatch behavior."
|
|
},
|
|
{
|
|
"date": "2026-07-07",
|
|
"runner": "local",
|
|
"platform": "macos",
|
|
"command": "node tools/repro-orchestration-long-prompt.mjs --cli out/bin/orca-dev --mode codex-like --size-kb 32 --timeout-ms 20000",
|
|
"result": "passed",
|
|
"durationSeconds": 2.2,
|
|
"summary": "Live dev-runtime repro passed: expectedSpecBytes=32830, hasSubmit=true, rawContainsMarker=true, hasBracketedPasteFrame=true, unframedLineBreaks=0, contractOk=true."
|
|
}
|
|
],
|
|
"runtimeBudget": {
|
|
"p95Seconds": 30,
|
|
"scope": "runtime contract tests plus optional local dev-runtime CLI repro"
|
|
},
|
|
"flakeHistory": {
|
|
"status": "unknown",
|
|
"evidence": "First local macOS evidence only; needs repeated dev-runtime harness runs and provider matrix evidence before promotion."
|
|
},
|
|
"redGreenEvidence": {
|
|
"status": "partial",
|
|
"evidence": "The live harness reproduced the unsafe raw multiline contract before the fix and passes after the fix; intentional-break evidence is local only and not yet in CI."
|
|
},
|
|
"performanceBudget": {
|
|
"required": true,
|
|
"evidence": "Agent prompt dispatch remains O(prompt bytes), uses the existing 16KB terminal input chunking and one existing 500ms submit delay, and adds no polling, provider listing, subprocess churn, hidden-pane wakeups, or renderer work."
|
|
},
|
|
"promotionCriteria": [
|
|
"Run the live harness in soak with a self-starting dev runtime or provider-contract fixture.",
|
|
"Add daemon, SSH, remote-runtime, Linux, and Windows evidence or mark narrower provider scope.",
|
|
"Capture stable red/green intentional-break evidence in CI before blocking promotion."
|
|
],
|
|
"knownGaps": [
|
|
"Live harness command currently expects an already-running dev runtime and generated out/bin/orca-dev wrapper.",
|
|
"No Windows ConPTY, Linux PTY, SSH, daemon, or remote-runtime live evidence yet.",
|
|
"Push-on-idle orchestration message banners remain outside this dispatch-prompt gate."
|
|
],
|
|
"demotionRule": "Demote or quarantine if the live harness flakes without a product bug or harness bug filed to the terminal-input owner."
|
|
},
|
|
{
|
|
"id": "terminal-render.windows-cjk-repaint",
|
|
"title": "Windows ConPTY wide glyphs and cursor rewrites repaint without stale cells",
|
|
"maturity": "experimental",
|
|
"protection": "none",
|
|
"owner": "terminal-rendering",
|
|
"layer": "windows-electron-conpty",
|
|
"surfaces": [
|
|
"Windows ConPTY",
|
|
"CJK",
|
|
"emoji",
|
|
"wide glyphs",
|
|
"cursor repaint",
|
|
"rewrite output"
|
|
],
|
|
"platforms": [
|
|
"windows"
|
|
],
|
|
"providers": [
|
|
"local",
|
|
"daemon",
|
|
"wsl"
|
|
],
|
|
"coveredPlatforms": [],
|
|
"coveredProviders": [],
|
|
"coverageNotes": "Registered gap only; no executable coverage is wired yet.",
|
|
"motivatingLinks": [
|
|
"https://github.com/stablyai/orca/pull/6876",
|
|
"https://github.com/stablyai/orca/pull/6968",
|
|
"https://github.com/stablyai/orca/pull/6970"
|
|
],
|
|
"invariant": "Windows terminal repaint must not leave stale cells, clipped wide glyphs, or hidden cursor state after CJK, emoji, or cursor-rewrite output.",
|
|
"oracle": "A Windows gate combines xterm buffer assertions with bounded screenshot/canvas evidence for representative CJK, emoji, and rewrite sequences.",
|
|
"commands": [],
|
|
"testFiles": [],
|
|
"assertionRefs": [],
|
|
"evidenceRuns": [],
|
|
"runtimeBudget": {
|
|
"p95Seconds": 90,
|
|
"scope": "Windows focused Electron render gate"
|
|
},
|
|
"flakeHistory": {
|
|
"status": "not-started",
|
|
"evidence": "Gate is registered as a known Windows rendering gap; no command is wired."
|
|
},
|
|
"redGreenEvidence": {
|
|
"status": "missing",
|
|
"evidence": "Needs intentional-break proof for stale wide-glyph repaint or cursor restore."
|
|
},
|
|
"performanceBudget": {
|
|
"required": true,
|
|
"evidence": "Must record refresh count or frame budget so repaint fixes do not mask excessive redraw churn."
|
|
},
|
|
"promotionCriteria": [
|
|
"Use buffer/cell evidence as the primary oracle and screenshots as diagnostics.",
|
|
"Keep stress cases non-blocking until Windows runtime history is stable.",
|
|
"Fail promotion on silent Windows environment skips."
|
|
],
|
|
"knownGaps": [
|
|
"No manifest command yet.",
|
|
"No Windows CJK/emoji repaint command is wired."
|
|
],
|
|
"demotionRule": "Cannot promote if the oracle is screenshot-only or environment-skipped."
|
|
},
|
|
{
|
|
"id": "terminal-shell.windows-resolution-parity",
|
|
"title": "Windows local and daemon providers resolve shells and startup commands consistently",
|
|
"maturity": "experimental",
|
|
"protection": "none",
|
|
"owner": "terminal-platform",
|
|
"layer": "provider-contract-windows",
|
|
"surfaces": [
|
|
"shell resolution",
|
|
"startup command",
|
|
"cwd",
|
|
"environment",
|
|
"local provider",
|
|
"daemon provider"
|
|
],
|
|
"platforms": [
|
|
"windows"
|
|
],
|
|
"providers": [
|
|
"local",
|
|
"daemon",
|
|
"wsl"
|
|
],
|
|
"coveredPlatforms": [],
|
|
"coveredProviders": [],
|
|
"coverageNotes": "Registered gap only; no executable coverage is wired yet.",
|
|
"motivatingLinks": [
|
|
"https://github.com/stablyai/orca/pull/6541",
|
|
"https://github.com/stablyai/orca/pull/6858"
|
|
],
|
|
"invariant": "Windows local and daemon terminals must resolve equivalent shell paths, args, cwd, env, startup command delivery, and fallback behavior for PowerShell 5/7, cmd, Git Bash, WSL, and missing pwsh.",
|
|
"oracle": "Provider-contract fixtures compare resolved command descriptors and live shell markers for supported Windows shells across local and daemon providers.",
|
|
"commands": [],
|
|
"testFiles": [],
|
|
"assertionRefs": [],
|
|
"evidenceRuns": [],
|
|
"runtimeBudget": {
|
|
"p95Seconds": 60,
|
|
"scope": "Windows provider-contract gate"
|
|
},
|
|
"flakeHistory": {
|
|
"status": "not-started",
|
|
"evidence": "Gate is registered as a known Windows shell parity gap; no command is wired."
|
|
},
|
|
"redGreenEvidence": {
|
|
"status": "missing",
|
|
"evidence": "Needs intentional-break proof for mismatched daemon/local shell resolution or lost startup command."
|
|
},
|
|
"performanceBudget": {
|
|
"required": false,
|
|
"evidence": "Required if resolution adds probing or PATH scans on hot startup paths."
|
|
},
|
|
"promotionCriteria": [
|
|
"Start with provider-contract fixtures before live Electron coverage.",
|
|
"Cover missing-shell fallback explicitly.",
|
|
"Fail promotion on silent Windows environment skips."
|
|
],
|
|
"knownGaps": [
|
|
"No manifest command yet.",
|
|
"No local-vs-daemon Windows shell parity command is wired."
|
|
],
|
|
"demotionRule": "Cannot promote if local and daemon provider behavior are tested separately without parity assertions."
|
|
},
|
|
{
|
|
"id": "terminal-performance.input-throughput",
|
|
"title": "Terminal input latency and throughput stay inside explicit budgets",
|
|
"maturity": "experimental",
|
|
"protection": "none",
|
|
"owner": "terminal-performance",
|
|
"layer": "electron-perf",
|
|
"surfaces": [
|
|
"typing latency",
|
|
"output throughput",
|
|
"hidden output",
|
|
"renderer CPU",
|
|
"resize churn"
|
|
],
|
|
"platforms": [
|
|
"macos",
|
|
"linux",
|
|
"windows"
|
|
],
|
|
"providers": [
|
|
"local",
|
|
"daemon",
|
|
"ssh",
|
|
"remote-runtime"
|
|
],
|
|
"coveredPlatforms": [],
|
|
"coveredProviders": [],
|
|
"coverageNotes": "Registered gap only; no executable coverage is wired yet.",
|
|
"motivatingLinks": [
|
|
"https://github.com/stablyai/orca/pull/7002",
|
|
"https://github.com/stablyai/orca/pull/6858"
|
|
],
|
|
"invariant": "Terminal typing, paste, resize, and output rendering must stay within latency and throughput budgets under realistic active and hidden-output load.",
|
|
"oracle": "Perf artifacts record median/p95/max key latency, event-loop delay, renderer CPU, output bytes/sec, resize count, hidden restore latency, queue depth, and dropped-output counts.",
|
|
"commands": [],
|
|
"testFiles": [],
|
|
"assertionRefs": [],
|
|
"evidenceRuns": [],
|
|
"runtimeBudget": {
|
|
"p95Seconds": 120,
|
|
"scope": "focused terminal perf report gate"
|
|
},
|
|
"flakeHistory": {
|
|
"status": "not-started",
|
|
"evidence": "Existing terminal perf scripts exist, but this gate is not wired with budgets or artifacts."
|
|
},
|
|
"redGreenEvidence": {
|
|
"status": "missing",
|
|
"evidence": "Needs intentional-break proof for hot-path listing, unbounded scheduler work, and input starvation."
|
|
},
|
|
"performanceBudget": {
|
|
"required": true,
|
|
"evidence": "Suggested initial budgets: active key median <=75ms, worst <=300ms in perf scenarios, dropped output 0, and bounded queue depths recorded per run."
|
|
},
|
|
"promotionCriteria": [
|
|
"Wire existing perf scripts to emit machine-readable artifacts.",
|
|
"Make budgets platform-aware before blocking.",
|
|
"Do not promote stress variants until runtime history is stable."
|
|
],
|
|
"knownGaps": [
|
|
"No manifest command yet.",
|
|
"Existing perf scripts are not registered with explicit budgets or flake history."
|
|
],
|
|
"demotionRule": "Cannot promote without metric artifacts and stable p95 runtime history."
|
|
},
|
|
{
|
|
"id": "terminal-performance.daemon-stream-backpressure",
|
|
"title": "Daemon terminal streams respect socket backpressure under output floods",
|
|
"maturity": "experimental",
|
|
"protection": "none",
|
|
"owner": "terminal-performance",
|
|
"layer": "daemon-provider-contract",
|
|
"surfaces": [
|
|
"daemon stream",
|
|
"socket write",
|
|
"drain",
|
|
"hidden output",
|
|
"input starvation"
|
|
],
|
|
"platforms": [
|
|
"macos",
|
|
"linux",
|
|
"windows"
|
|
],
|
|
"providers": [
|
|
"daemon"
|
|
],
|
|
"coveredPlatforms": [],
|
|
"coveredProviders": [],
|
|
"coverageNotes": "Registered gap on main. The daemon batcher write(false)/drain contracts exist only on the pending reliability stack. It registers here with its owning split PR.",
|
|
"motivatingLinks": [
|
|
"https://github.com/stablyai/orca/pull/6836",
|
|
"https://github.com/stablyai/orca/pull/6858"
|
|
],
|
|
"invariant": "Daemon terminal output floods must pause when socket writes return false, resume on drain, keep buffered bytes bounded, and not starve focused input.",
|
|
"oracle": "The current executable slice injects a slow socket and asserts write(false)/drain ordering, bounded queued daemon stream bytes, close/error listener cleanup, newest-tail preservation under sustained pressure, and flush-immediate cross-session priority ahead of unrelated background backlog on drain. Active input latency remains part of the broader perf gate.",
|
|
"commands": [],
|
|
"testFiles": [],
|
|
"assertionRefs": [],
|
|
"evidenceRuns": [],
|
|
"runtimeBudget": {
|
|
"p95Seconds": 60,
|
|
"scope": "daemon provider-contract gate"
|
|
},
|
|
"flakeHistory": {
|
|
"status": "unknown",
|
|
"evidence": "Focused daemon stream backpressure contract runs locally; needs soak history before promotion."
|
|
},
|
|
"redGreenEvidence": {
|
|
"status": "partial",
|
|
"evidence": "Tests assert daemon stream writes pause after socket write(false), later stream data queues behind the pressured socket, flush-immediate output from another session is prioritized ahead of unrelated queued background backlog on drain while preserving per-session order, queued lines resume on drain, global cleanup and close/error clear pending drain listeners, and queued bytes are bounded by preserving priority output plus the newest tail. Needs intentional-break artifact plus active-input latency proof before promotion."
|
|
},
|
|
"performanceBudget": {
|
|
"required": true,
|
|
"evidence": "Must record queued bytes, drain count, write(false) count, dropped output, and active input latency."
|
|
},
|
|
"promotionCriteria": [
|
|
"Keep deterministic socket mocks as the blocking candidate only after soak.",
|
|
"Record byte and drain artifacts on failure.",
|
|
"Pair with the broader output-backpressure budget before blocking."
|
|
],
|
|
"knownGaps": [
|
|
"No executable coverage on main yet; the slice lives on the pending fix-terminal-reliability stack.",
|
|
"Current command is daemon batcher contract coverage, not live daemon/Electron perf.",
|
|
"Active input latency is not proven in live daemon/Electron perf."
|
|
],
|
|
"demotionRule": "Cannot promote if backpressure is inferred only from renderer output success."
|
|
},
|
|
{
|
|
"id": "terminal-performance.store-and-git-hot-paths",
|
|
"title": "Terminal-adjacent store and git polling work stays off hot interaction paths",
|
|
"maturity": "experimental",
|
|
"protection": "none",
|
|
"owner": "terminal-performance",
|
|
"layer": "renderer-main-perf-contract",
|
|
"surfaces": [
|
|
"store selectors",
|
|
"git polling",
|
|
"startup hydration",
|
|
"terminal focus",
|
|
"tab switch",
|
|
"workspace switch",
|
|
"agent status"
|
|
],
|
|
"platforms": [
|
|
"macos",
|
|
"linux",
|
|
"windows"
|
|
],
|
|
"providers": [
|
|
"local",
|
|
"daemon",
|
|
"ssh",
|
|
"remote-runtime"
|
|
],
|
|
"coveredPlatforms": [],
|
|
"coveredProviders": [],
|
|
"coverageNotes": "Registered gap on main. The boot-hydration counters and their tests exist only on the pending reliability stack. It registers here with its owning split PR.",
|
|
"motivatingLinks": [
|
|
"https://github.com/stablyai/orca/pull/7002"
|
|
],
|
|
"invariant": "Terminal typing, focus, resize, tab/workspace switch, and agent/session restore must not trigger unbounded store projection, git status, provider listing, or per-pane polling work.",
|
|
"oracle": "The current executable slice instruments boot-time local PTY registry hydration with repo counts, local-vs-remote repo skips, worktree enumeration counts, adapter/session listing counts, registration/skipped-session counts, duration, and failure phase. The broader oracle still needs instrumentation that counts store selector recomputes, git status requests, provider listings, and session scans during scripted hot interactions with many worktrees and terminal panes.",
|
|
"commands": [],
|
|
"testFiles": [],
|
|
"assertionRefs": [],
|
|
"evidenceRuns": [],
|
|
"runtimeBudget": {
|
|
"p95Seconds": 60,
|
|
"scope": "renderer-main perf/count gate"
|
|
},
|
|
"flakeHistory": {
|
|
"status": "unknown",
|
|
"evidence": "Focused boot-hydration counter slice passed locally once; needs CI/runtime history before promotion."
|
|
},
|
|
"redGreenEvidence": {
|
|
"status": "partial",
|
|
"evidence": "Tests would fail if boot hydration enumerated SSH worktrees, stopped recording provider-unavailable retry state, lost the startup counter surface, stopped recording fatal hydration failures, or missed router adapter fanout/list-failure counters. Needs intentional-break proof for git/status polling or store scans triggered by terminal hot paths."
|
|
},
|
|
"performanceBudget": {
|
|
"required": true,
|
|
"evidence": "Current slice records boot-hydration repo, worktree, adapter, session, skip, register, and duration counters. Promotion still requires count budgets for listSessions, git status, provider scans, store recomputes, and elapsed hot-interaction time."
|
|
},
|
|
"promotionCriteria": [
|
|
"Use deterministic counters before broad perf scenarios.",
|
|
"Cover high-session and high-worktree fixtures.",
|
|
"Keep stress variants non-blocking until stable."
|
|
],
|
|
"knownGaps": [
|
|
"No executable coverage on main yet; the slice lives on the pending fix-terminal-reliability stack.",
|
|
"Current command covers boot hydration counters only, not interactive terminal hot paths.",
|
|
"No Electron count gate yet proves focus, typing, tab switch, workspace switch, render, or high-session provider fanout avoids broad store/git/provider scans."
|
|
],
|
|
"demotionRule": "Cannot promote without count budgets and actionable artifacts."
|
|
},
|
|
{
|
|
"id": "terminal-output.scrollback-restore",
|
|
"title": "Scrollback restore, hidden output, and replay clear semantics do not overlap stale bytes",
|
|
"maturity": "experimental",
|
|
"protection": "partial",
|
|
"owner": "terminal-rendering",
|
|
"layer": "renderer-provider-contract",
|
|
"surfaces": [
|
|
"scrollback",
|
|
"hidden output",
|
|
"snapshot replay",
|
|
"metadata-only replay",
|
|
"clear semantics"
|
|
],
|
|
"platforms": [
|
|
"macos",
|
|
"linux",
|
|
"windows"
|
|
],
|
|
"providers": [
|
|
"local",
|
|
"daemon",
|
|
"ssh",
|
|
"remote-runtime"
|
|
],
|
|
"coveredPlatforms": [
|
|
"macos"
|
|
],
|
|
"coveredProviders": [],
|
|
"coverageNotes": "Local macOS evidence over the merged #7133/#7173 restore and hidden-output ordering tests on main@1282f5c2d. The dirty-state exactness contract, normal-buffer clear semantics, and metadata-only replay remain pending-stack work.",
|
|
"motivatingLinks": [
|
|
"https://github.com/stablyai/orca/pull/7173",
|
|
"https://github.com/stablyai/orca/pull/7133",
|
|
"https://github.com/stablyai/orca/pull/7012",
|
|
"https://github.com/stablyai/orca/pull/7054",
|
|
"https://github.com/stablyai/orca/pull/6949"
|
|
],
|
|
"invariant": "Hidden-output restore, snapshot replay, metadata-only replay, and clear-before-replay must preserve order and never overlay stale bytes on newer live terminal output; restoring a snapshot onto an already-dirty pane must yield a buffer exactly equal to the snapshot frame.",
|
|
"oracle": "Apply snapshots onto adversarially dirty pane states (already on the alternate screen, stale content occupying cells the new frame leaves blank, scrollback present, wide glyphs, revived sessions with restarted PTY seq counters) and assert exact buffer equality with the snapshot frame; fault injection interleaves hidden chunks, live output, metadata-only replay, and clear-before-replay, then asserts ordered terminal buffer content, clear decisions, and replay diagnostics. Marker-presence checks are not acceptable evidence on restore paths.",
|
|
"commands": [
|
|
"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/pty-connection.test.ts"
|
|
],
|
|
"testFiles": [
|
|
"src/renderer/src/components/terminal-pane/pty-connection.test.ts"
|
|
],
|
|
"assertionRefs": [
|
|
{
|
|
"file": "src/renderer/src/components/terminal-pane/pty-connection.test.ts",
|
|
"assertions": [
|
|
"restoring an alternate-screen snapshot clears only the alternate screen (#7133)",
|
|
"hidden Codex output is restored when the pty seq counter restarts, with or without an observed exit (#7173)",
|
|
"pending hidden restore chunks are not replayed after a terminal clear",
|
|
"a scrolled-up viewport is preserved after hidden-backlog snapshot replay"
|
|
]
|
|
}
|
|
],
|
|
"evidenceRuns": [
|
|
{
|
|
"date": "2026-07-03",
|
|
"runner": "local",
|
|
"platform": "macos",
|
|
"command": "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/pty-connection.test.ts",
|
|
"result": "passed",
|
|
"durationSeconds": 8.4,
|
|
"summary": "1 test file(s) passed, 311 tests passed on main@1282f5c2d in a clean checkout."
|
|
}
|
|
],
|
|
"runtimeBudget": {
|
|
"p95Seconds": 45,
|
|
"scope": "renderer provider-contract gate"
|
|
},
|
|
"flakeHistory": {
|
|
"status": "not-started",
|
|
"evidence": "Remote replay FIFO has a focused slice, but the broader scrollback restore gate is not wired."
|
|
},
|
|
"redGreenEvidence": {
|
|
"status": "partial",
|
|
"evidence": "#7133 and #7173 each proved their slices red before fix (stale alt-screen bleed-through; stale background chunk written after restore; frozen revived seq counters). The broader dirty-state exactness contract has no red runs yet."
|
|
},
|
|
"performanceBudget": {
|
|
"required": true,
|
|
"evidence": "Must keep hidden restore bounded and avoid unbounded renderer parsing or wake loops."
|
|
},
|
|
"promotionCriteria": [
|
|
"Start every restore case from adversarially dirty pane state, never only fresh terminals.",
|
|
"Assert frame exactness or stale-content absence, never marker presence.",
|
|
"Build deterministic lower-layer clear and interleaving tests before broad golden E2E.",
|
|
"Use long-table/golden visual tests only as supporting evidence.",
|
|
"Record ordered buffer diagnostics on failure."
|
|
],
|
|
"knownGaps": [
|
|
"No manifest command yet.",
|
|
"The existing replay FIFO command is narrower than this broader scrollback restore invariant.",
|
|
"#7133's merged alt-only-clear restore tests exist on main but are not yet registered as this gate's command.",
|
|
"#7173's ordered-seq interleaving and session-revival tests in pty-connection.test.ts on main are the seed for the hidden/live interleaving slice and are unregistered until the rebase."
|
|
],
|
|
"demotionRule": "Cannot promote without clear-semantics and hidden/live interleaving assertions."
|
|
},
|
|
{
|
|
"id": "terminal-capability.startup-color-query",
|
|
"title": "Startup color capability queries do not leak into shell or terminal streams",
|
|
"maturity": "experimental",
|
|
"protection": "none",
|
|
"owner": "terminal-rendering",
|
|
"layer": "renderer-provider-contract",
|
|
"surfaces": [
|
|
"OSC 10/11",
|
|
"startup capability query",
|
|
"shell stream",
|
|
"renderer stream",
|
|
"terminal colors"
|
|
],
|
|
"platforms": [
|
|
"macos",
|
|
"linux",
|
|
"windows"
|
|
],
|
|
"providers": [
|
|
"local",
|
|
"daemon",
|
|
"ssh",
|
|
"remote-runtime"
|
|
],
|
|
"coveredPlatforms": [],
|
|
"coveredProviders": [],
|
|
"coverageNotes": "Registered gap only; no executable coverage is wired yet.",
|
|
"motivatingLinks": [
|
|
"https://github.com/stablyai/orca/pull/6949"
|
|
],
|
|
"invariant": "Startup OSC 10/11 color queries are answered out of band at startup only, never leak into shell/provider output streams, and ordinary runtime OSC color queries remain renderer-handled.",
|
|
"oracle": "A provider-contract fixture records startup query replies, shell-visible bytes, renderer-visible bytes, and later runtime OSC behavior to prove no query leakage or color deadlock.",
|
|
"commands": [],
|
|
"testFiles": [],
|
|
"assertionRefs": [],
|
|
"evidenceRuns": [],
|
|
"runtimeBudget": {
|
|
"p95Seconds": 30,
|
|
"scope": "renderer provider-contract gate"
|
|
},
|
|
"flakeHistory": {
|
|
"status": "not-started",
|
|
"evidence": "Gate is registered as a capability/startup gap; no command is wired."
|
|
},
|
|
"redGreenEvidence": {
|
|
"status": "missing",
|
|
"evidence": "Needs intentional-break proof for leaked startup OSC replies or disabled runtime OSC handling."
|
|
},
|
|
"performanceBudget": {
|
|
"required": false,
|
|
"evidence": "Required if capability probing adds retry loops or startup polling."
|
|
},
|
|
"promotionCriteria": [
|
|
"Assert shell/provider byte streams directly.",
|
|
"Cover startup-only and runtime OSC paths separately.",
|
|
"Keep screenshot evidence diagnostic only."
|
|
],
|
|
"knownGaps": [
|
|
"No manifest command yet.",
|
|
"No startup color-query contract is wired."
|
|
],
|
|
"demotionRule": "Cannot promote if success is based only on absence of visible artifacts."
|
|
},
|
|
{
|
|
"id": "terminal-query.mobile-view-authority",
|
|
"title": "Mobile xterm answers live terminal queries exactly once without replay or floor side effects",
|
|
"maturity": "experimental",
|
|
"protection": "partial",
|
|
"owner": "terminal-runtime",
|
|
"layer": "mobile-runtime-rpc-contract",
|
|
"surfaces": [
|
|
"mobile terminal WebView",
|
|
"terminal query authority",
|
|
"runtime RPC",
|
|
"mobile subscription replay",
|
|
"multi-mobile input floor"
|
|
],
|
|
"platforms": [
|
|
"macos",
|
|
"linux",
|
|
"windows",
|
|
"mobile"
|
|
],
|
|
"providers": [
|
|
"local",
|
|
"daemon",
|
|
"ssh",
|
|
"remote-runtime"
|
|
],
|
|
"coveredPlatforms": [
|
|
"macos"
|
|
],
|
|
"coveredProviders": [],
|
|
"coverageNotes": "Deterministic local tests execute the exact injected mobile replay/generation gate, the React Native query classifier, stale-subscription sender, server-side single-responder election, query-reply RPC semantics, and live-output capture during async mobile fit. The provider write path is shared, but no live iOS/Android, SSH, WSL, or multi-device run is registered yet.",
|
|
"motivatingLinks": [
|
|
"https://github.com/stablyai/orca/issues/8128",
|
|
"https://github.com/stablyai/orca/pull/8206"
|
|
],
|
|
"invariant": "Snapshot and replacement-terminal replay answer no terminal queries; every live query delivered to subscribed mobile views has at most one current responder; a live query queued behind replay is answered after the replay boundary; terminal-generated replies never transfer the user-input floor.",
|
|
"oracle": "The injected gate emits zero replies during replay, exactly one after its live boundary, and ignores a superseded generation; native routing rejects ordinary input; the sender rejects disconnected or unsubscribed handles; runtime election accepts only the earliest active mobile subscriber and promotes its survivor; terminal.send writes only validated query grammar without mobileTookFloor; legacy binary subscribe captures a query while phone-fit is still pending and emits it after the snapshot.",
|
|
"commands": [
|
|
"pnpm --dir mobile exec vitest run --root .. mobile/src/terminal/terminal-webview-query-reply.test.ts mobile/src/terminal/terminal-webview-query-reply-routing.test.ts mobile/src/terminal/mobile-terminal-query-reply.test.ts",
|
|
"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/rpc/terminal-send.test.ts src/main/runtime/rpc/terminal-subscribe-buffer.test.ts src/main/runtime/mobile-presence-lock.test.ts src/shared/terminal-query-reply.test.ts src/shared/terminal-reply-query-scan.test.ts",
|
|
"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/pty-connection.test.ts"
|
|
],
|
|
"testFiles": [
|
|
"mobile/src/terminal/terminal-webview-query-reply.test.ts",
|
|
"mobile/src/terminal/terminal-webview-query-reply-routing.test.ts",
|
|
"mobile/src/terminal/mobile-terminal-query-reply.test.ts",
|
|
"src/main/runtime/rpc/terminal-send.test.ts",
|
|
"src/main/runtime/rpc/terminal-subscribe-buffer.test.ts",
|
|
"src/main/runtime/mobile-presence-lock.test.ts",
|
|
"src/shared/terminal-query-reply.test.ts",
|
|
"src/shared/terminal-reply-query-scan.test.ts",
|
|
"src/renderer/src/components/terminal-pane/pty-connection.test.ts"
|
|
],
|
|
"assertionRefs": [
|
|
{
|
|
"file": "mobile/src/terminal/terminal-webview-query-reply.test.ts",
|
|
"assertions": [
|
|
"snapshot replay emits no terminal-data message before the replay boundary",
|
|
"a live query after the boundary emits exactly one terminal-data message",
|
|
"a superseded terminal generation cannot regain reply authority",
|
|
"xterm parser replies remain enabled while its DOM textarea and hardware-key path stay inert"
|
|
]
|
|
},
|
|
{
|
|
"file": "src/main/runtime/rpc/terminal-send.test.ts",
|
|
"assertions": [
|
|
"only the elected mobile subscriber can write a claimed query reply",
|
|
"valid replies skip mobileTookFloor",
|
|
"ordinary bytes and reply payloads combined with enter, interrupt, or guarded-send semantics are rejected"
|
|
]
|
|
},
|
|
{
|
|
"file": "src/main/runtime/rpc/terminal-subscribe-buffer.test.ts",
|
|
"assertions": [
|
|
"live terminal data and view authority register before asynchronous mobile fit",
|
|
"a query received during that await is retained and emitted after the snapshot"
|
|
]
|
|
},
|
|
{
|
|
"file": "src/renderer/src/components/terminal-pane/pty-connection.test.ts",
|
|
"assertions": [
|
|
"desktop xterm onData replies are dropped while mobile owns the terminal driver",
|
|
"desktop capability-handler replies outside onData honor the same mobile authority lock"
|
|
]
|
|
}
|
|
],
|
|
"evidenceRuns": [
|
|
{
|
|
"date": "2026-07-10",
|
|
"runner": "local",
|
|
"platform": "macos",
|
|
"command": "pnpm --dir mobile exec vitest run --root .. mobile/src/terminal/terminal-webview-query-reply.test.ts mobile/src/terminal/terminal-webview-query-reply-routing.test.ts mobile/src/terminal/mobile-terminal-query-reply.test.ts",
|
|
"result": "passed",
|
|
"durationSeconds": 1,
|
|
"summary": "10 mobile bridge, routing, replay/generation, and stale-subscription tests passed. Before implementation, the WebView listener, native route, and sender tests failed."
|
|
},
|
|
{
|
|
"date": "2026-07-10",
|
|
"runner": "local",
|
|
"platform": "macos",
|
|
"command": "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/rpc/terminal-send.test.ts src/main/runtime/rpc/terminal-subscribe-buffer.test.ts src/main/runtime/mobile-presence-lock.test.ts src/shared/terminal-query-reply.test.ts src/shared/terminal-reply-query-scan.test.ts",
|
|
"result": "passed",
|
|
"durationSeconds": 4,
|
|
"summary": "69 shared/runtime tests passed. Before implementation, terminal.send took the floor for claimed replies and accepted ordinary claimed bytes."
|
|
},
|
|
{
|
|
"date": "2026-07-10",
|
|
"runner": "local",
|
|
"platform": "macos",
|
|
"command": "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/pty-connection.test.ts",
|
|
"result": "passed",
|
|
"durationSeconds": 11,
|
|
"summary": "421 renderer terminal connection tests passed, including desktop onData and capability-handler suppression while mobile owns query authority."
|
|
}
|
|
],
|
|
"runtimeBudget": {
|
|
"p95Seconds": 20,
|
|
"scope": "mobile and runtime deterministic unit gate"
|
|
},
|
|
"flakeHistory": {
|
|
"status": "unknown",
|
|
"evidence": "New deterministic gate; no soak history yet. Tests use no timing sleeps or external services."
|
|
},
|
|
"redGreenEvidence": {
|
|
"status": "partial",
|
|
"evidence": "Observed red before implementation for the missing WebView listener/native route/sender and for RPC floor-taking plus unvalidated claims; all are green after the fix. The later multi-mobile and pre-fit race assertions have green deterministic coverage but no saved intentional-break artifact yet."
|
|
},
|
|
"performanceBudget": {
|
|
"required": true,
|
|
"evidence": "No polling, scans, timers, or output fanout were added. The WebView adds one disposable onData listener; native/RPC work occurs only for xterm data and is grammar-filtered; responder election is O(1) from Map insertion order; pre-fit output uses the existing capped pending-output queue."
|
|
},
|
|
"promotionCriteria": [
|
|
"Attach an intentional-break artifact for the pre-fit capture and multi-mobile election assertions.",
|
|
"Run live iOS and Android WebViews against a real querying TUI and verify no software-keyboard regression.",
|
|
"Exercise two physical/virtual mobile clients on one PTY and observe one reply per query.",
|
|
"Accumulate the normal soak window with zero unexplained flakes."
|
|
],
|
|
"knownGaps": [
|
|
"No live iOS or Android WebView run is registered.",
|
|
"No real SSH, WSL, daemon, or two-device provider-contract run is registered.",
|
|
"Mixed-version pairing is gated by the terminal.query-reply-input.v1 capability (mobile drops replies unless the host advertises it), but no live old-binary pairing run is registered.",
|
|
"A desktop-to-mobile driver handoff has a bounded double-reply window: the server elects the mobile responder synchronously while the desktop renderer's cached driver map updates via an async event, so an in-flight query can be answered by both until the driver-change event lands."
|
|
],
|
|
"demotionRule": "Keep experimental or disable mobile forwarding if the gate flakes without a product bug, live WebView input isolation regresses, or duplicate replies appear under multi-mobile use."
|
|
},
|
|
{
|
|
"id": "terminal-runtime.mobile-stream-budget",
|
|
"title": "Runtime and mobile terminal streams keep snapshot and live-output bytes bounded",
|
|
"maturity": "experimental",
|
|
"protection": "partial",
|
|
"owner": "terminal-runtime",
|
|
"layer": "runtime-rpc-contract",
|
|
"surfaces": [
|
|
"mobile terminal",
|
|
"native-chat terminal overlay",
|
|
"runtime RPC",
|
|
"binary multiplex",
|
|
"JSON subscribe fallback",
|
|
"snapshot buffering"
|
|
],
|
|
"platforms": [
|
|
"macos",
|
|
"linux",
|
|
"windows",
|
|
"mobile"
|
|
],
|
|
"providers": [
|
|
"remote-runtime",
|
|
"ssh",
|
|
"local",
|
|
"daemon"
|
|
],
|
|
"coveredPlatforms": [
|
|
"macos"
|
|
],
|
|
"coveredProviders": [],
|
|
"coverageNotes": "Local macOS evidence over the runtime-RPC stream budgets on main@1282f5c2d. PR #5824 adds a platform-neutral mobile decision gate proving chat-covered terminal streams pause and resume only after the mounted WebView is ready; live Android restore evidence remains required. The pending stack adds byte-exact 512KB/2MB/256KB/48KB budget assertions; legacy JSON subscribe parity remains undecided.",
|
|
"motivatingLinks": [
|
|
"https://github.com/stablyai/orca/pull/6951",
|
|
"https://github.com/stablyai/orca/pull/6955",
|
|
"https://github.com/stablyai/orca/pull/7009"
|
|
],
|
|
"invariant": "Runtime and mobile terminal subscriptions must cap initial snapshots, live output buffered while snapshots load, chunk sizes, and batch sizes; a terminal covered by native chat must have no live output subscription and must restore from fresh scrollback when revealed, while preserving output order, input locks, resize/driver events, and fallback parity or explicit fallback deprecation.",
|
|
"oracle": "The current executable slice asserts mobile initial snapshots downgrade until they fit <=512KB, requested binary snapshots downgrade until they fit <=2MB, binary live output queued while the initial snapshot loads stays <=256KB while preserving the newest tail, large binary output is split into <=48KB frames, output bursts are coalesced before emit, aborts do not register stale listeners, and stale mobile resize re-stream completions are dropped. The mobile native-chat decision test asserts an active stream pauses while covered and resumes only for a ready active terminal. JSON fallback parity and live Android scrollback restoration remain explicit gaps.",
|
|
"commands": [
|
|
"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/rpc/terminal-subscribe-buffer.test.ts src/main/runtime/rpc/terminal-output-batching.test.ts src/main/runtime/rpc/terminal-multiplex.test.ts",
|
|
"pnpm --dir mobile exec vitest run --root .. mobile/src/session/mobile-native-chat-terminal-stream.test.ts",
|
|
"pnpm --dir mobile exec vitest run --root .. mobile/src/session/use-mobile-native-chat-terminal-stream.test.ts"
|
|
],
|
|
"testFiles": [
|
|
"src/main/runtime/rpc/terminal-subscribe-buffer.test.ts",
|
|
"src/main/runtime/rpc/terminal-output-batching.test.ts",
|
|
"src/main/runtime/rpc/terminal-multiplex.test.ts",
|
|
"mobile/src/session/mobile-native-chat-terminal-stream.test.ts",
|
|
"mobile/src/session/use-mobile-native-chat-terminal-stream.test.ts"
|
|
],
|
|
"assertionRefs": [
|
|
{
|
|
"file": "src/main/runtime/rpc/terminal-subscribe-buffer.test.ts",
|
|
"assertions": [
|
|
"legacy binary output queued during initial snapshot serialization stays bounded",
|
|
"stale mobile resize re-stream completions are dropped for legacy binary streams",
|
|
"aborted stream signals do not register stale listeners"
|
|
]
|
|
},
|
|
{
|
|
"file": "src/main/runtime/rpc/terminal-output-batching.test.ts",
|
|
"assertions": [
|
|
"desktop output bursts coalesce before stream emission",
|
|
"large binary output is encoded lazily before the first output frame"
|
|
]
|
|
},
|
|
{
|
|
"file": "src/main/runtime/rpc/terminal-multiplex.test.ts",
|
|
"assertions": [
|
|
"requested snapshots fall back smaller when serialized data exceeds the send budget",
|
|
"oversized live output frames are bounded for subscribed binary streams",
|
|
"multibyte live output flushes when encoded bytes reach the batch budget"
|
|
]
|
|
},
|
|
{
|
|
"file": "mobile/src/session/mobile-native-chat-terminal-stream.test.ts",
|
|
"assertions": [
|
|
"an active terminal stream pauses while native chat covers its WebView",
|
|
"the stream resumes only for the ready active terminal after chat closes",
|
|
"non-terminal and already-settled stream states perform no lifecycle work"
|
|
]
|
|
},
|
|
{
|
|
"file": "mobile/src/session/use-mobile-native-chat-terminal-stream.test.ts",
|
|
"assertions": [
|
|
"a late WebView-ready transition converts a cold-start lease-only stream back to output",
|
|
"ordinary WebView readiness does not rerender the mobile session route"
|
|
]
|
|
}
|
|
],
|
|
"evidenceRuns": [
|
|
{
|
|
"date": "2026-07-03",
|
|
"runner": "local",
|
|
"platform": "macos",
|
|
"command": "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/rpc/terminal-subscribe-buffer.test.ts src/main/runtime/rpc/terminal-output-batching.test.ts src/main/runtime/rpc/terminal-multiplex.test.ts",
|
|
"result": "passed",
|
|
"durationSeconds": 3.8,
|
|
"summary": "3 test file(s) passed, 28 tests passed on main@1282f5c2d in a clean checkout."
|
|
},
|
|
{
|
|
"date": "2026-07-12",
|
|
"runner": "local",
|
|
"platform": "macos",
|
|
"command": "pnpm --dir mobile exec vitest run --root .. mobile/src/session/mobile-native-chat-terminal-stream.test.ts",
|
|
"result": "passed",
|
|
"durationSeconds": 0.2,
|
|
"summary": "The focused mobile native-chat suite passed with 3 terminal-stream lifecycle assertions in the staged PR #5824 worktree."
|
|
}
|
|
],
|
|
"runtimeBudget": {
|
|
"p95Seconds": 20,
|
|
"scope": "runtime RPC contract test"
|
|
},
|
|
"flakeHistory": {
|
|
"status": "unknown",
|
|
"evidence": "Focused runtime RPC contract tests passed locally on 2026-07-02; needs soak history before promotion."
|
|
},
|
|
"redGreenEvidence": {
|
|
"status": "partial",
|
|
"evidence": "Tests cover mobile initial snapshot byte downgrade, requested binary snapshot byte downgrade, pending live-output cap while snapshot loads, output chunk size, output coalescing, abort cleanup, and stale resize re-stream suppression. Needs intentional-break proof plus JSON fallback coverage before promotion."
|
|
},
|
|
"performanceBudget": {
|
|
"required": true,
|
|
"evidence": "This gate is the byte and batching budget for runtime/mobile terminal streaming."
|
|
},
|
|
"promotionCriteria": [
|
|
"Gate binary multiplex first.",
|
|
"Decide whether JSON fallback is supported, gated, or deprecated.",
|
|
"Record byte counts and order/cursor artifacts on failure."
|
|
],
|
|
"knownGaps": [
|
|
"The pure mobile decision gate does not yet prove live Android WebView scrollback restore after a chat toggle.",
|
|
"Legacy JSON subscribe parity is undecided."
|
|
],
|
|
"demotionRule": "Cannot promote while a supported stream path has uncapped snapshot or live-output buffering."
|
|
},
|
|
{
|
|
"id": "terminal-mirror.parser-parity",
|
|
"title": "Renderer xterm and main headless mirror parse identical bytes into identical cells",
|
|
"maturity": "experimental",
|
|
"protection": "partial",
|
|
"owner": "terminal-rendering",
|
|
"layer": "renderer-main-parity-contract",
|
|
"surfaces": [
|
|
"main mirror buffer",
|
|
"snapshot restore",
|
|
"terminal reads",
|
|
"mobile streams",
|
|
"unicode width",
|
|
"parser configuration"
|
|
],
|
|
"platforms": [
|
|
"macos",
|
|
"linux",
|
|
"windows"
|
|
],
|
|
"providers": [
|
|
"local",
|
|
"daemon",
|
|
"ssh",
|
|
"remote-runtime"
|
|
],
|
|
"coveredPlatforms": [
|
|
"macos"
|
|
],
|
|
"coveredProviders": [],
|
|
"coverageNotes": "Local macOS evidence over #7148's width-parity oracle on main@1282f5c2d. A broader byte corpus, a shared parser-construction assertion over terminal-unicode-provider.ts/pane-terminal-options.ts, and recorded agent-session corpora remain gaps.",
|
|
"motivatingLinks": [
|
|
"https://github.com/stablyai/orca/pull/7148",
|
|
"https://github.com/stablyai/orca/pull/7133"
|
|
],
|
|
"invariant": "The main-process headless terminal mirror and the renderer xterm must parse identical byte streams into cell-identical buffers (unicode width tables, joining behavior, modes, and addon-visible semantics), so snapshots, restores, reads, and mobile streams never encode a frame the renderer would not have produced.",
|
|
"oracle": "Feed identical byte corpora (emoji/ZWJ/wide glyphs, positioned overwrites after wide characters, alternate-screen transitions, wrapped lines) to both parser configurations and assert cell-identical visible buffers; both parsers must be constructed from one shared configuration module so one-sided drift fails the gate.",
|
|
"commands": [
|
|
"pnpm exec vitest run --config config/vitest.config.ts src/main/daemon/headless-emulator-unicode-width.test.ts"
|
|
],
|
|
"testFiles": [
|
|
"src/main/daemon/headless-emulator-unicode-width.test.ts"
|
|
],
|
|
"assertionRefs": [
|
|
{
|
|
"file": "src/main/daemon/headless-emulator-unicode-width.test.ts",
|
|
"assertions": [
|
|
"emoji advance two cells in the headless mirror so positioned writes land like the renderer (#7148)",
|
|
"ZWJ emoji join into one wide pair like the renderer provider (#7148)"
|
|
]
|
|
}
|
|
],
|
|
"evidenceRuns": [
|
|
{
|
|
"date": "2026-07-03",
|
|
"runner": "local",
|
|
"platform": "macos",
|
|
"command": "pnpm exec vitest run --config config/vitest.config.ts src/main/daemon/headless-emulator-unicode-width.test.ts",
|
|
"result": "passed",
|
|
"durationSeconds": 0.7,
|
|
"summary": "1 test file(s) passed, 2 tests passed on main@1282f5c2d in a clean checkout."
|
|
}
|
|
],
|
|
"runtimeBudget": {
|
|
"p95Seconds": 30,
|
|
"scope": "shared parser-parity unit gate"
|
|
},
|
|
"flakeHistory": {
|
|
"status": "not-started",
|
|
"evidence": "Deterministic unit-layer corpus; no timing dependence expected."
|
|
},
|
|
"redGreenEvidence": {
|
|
"status": "partial",
|
|
"evidence": "#7148 proved this red before its fix (positioned overwrite after emoji landed shifted in the mirror). Intentional-drift proof for the shared provider is still missing."
|
|
},
|
|
"performanceBudget": {
|
|
"required": true,
|
|
"evidence": "Shared parser construction must not add renderer or emulator startup cost; the corpus stays a bounded unit fixture."
|
|
},
|
|
"promotionCriteria": [
|
|
"Register #7148's merged width test (src/main/daemon/headless-emulator-unicode-width.test.ts) plus a shared-construction assertion over src/shared/terminal-unicode-provider.ts and pane-terminal-options.ts as the first command during the stack rebase.",
|
|
"Extend the corpus with recorded real agent-session byte streams.",
|
|
"Promote only on aggregated reliability-gates CI history."
|
|
],
|
|
"knownGaps": [
|
|
"No manifest command yet; the seed test exists on fresh main but not at this branch's merge-base.",
|
|
"Width parity is protected only by #7148's single test; no broader corpus or shared-construction assertion covers the other parser-config axes.",
|
|
"Corpus does not yet include recorded live agent sessions.",
|
|
"Parity at identical configuration cannot catch state-synchronization divergence such as #7192's stale-width mirror; geometry fan-out and reflow ordering are owned by terminal-geometry.visible-convergence."
|
|
],
|
|
"demotionRule": "Cannot promote without cell-exact parity assertions over a wide-glyph corpus and shared-construction proof."
|
|
},
|
|
{
|
|
"id": "terminal-observability.restore-convergence-selfcheck",
|
|
"title": "Post-restore convergence self-check flags renderer/mirror divergence as an anomaly",
|
|
"maturity": "experimental",
|
|
"protection": "none",
|
|
"owner": "terminal-rendering",
|
|
"layer": "renderer-observability",
|
|
"surfaces": [
|
|
"hidden-output restore",
|
|
"snapshot replay",
|
|
"anomaly breadcrumbs",
|
|
"telemetry"
|
|
],
|
|
"platforms": [
|
|
"macos",
|
|
"linux",
|
|
"windows"
|
|
],
|
|
"providers": [
|
|
"local",
|
|
"daemon",
|
|
"ssh",
|
|
"remote-runtime"
|
|
],
|
|
"coveredPlatforms": [],
|
|
"coveredProviders": [],
|
|
"coverageNotes": "Registered gap only; the anomaly-breadcrumb machinery exists in this branch but no convergence probe is implemented.",
|
|
"motivatingLinks": [
|
|
"https://github.com/stablyai/orca/pull/7133",
|
|
"https://github.com/stablyai/orca/pull/7054"
|
|
],
|
|
"invariant": "After every hidden-to-visible reveal settles — whether or not a restore was triggered — the renderer buffer must converge with the current main-mirror state; divergence is recorded as a compact, content-free terminal_lifecycle_anomaly breadcrumb and counted in telemetry instead of failing silently. Restore-scoped checking is insufficient: #7173's frozen-output variant restores faithfully and then silently drops later hidden output, so it never triggers another restore.",
|
|
"oracle": "Deterministic tests inject forced divergence in both shapes — stale bytes written after a faithful restore, and a frozen pane whose reveal triggers no restore — and assert exactly one deduped breadcrumb with row-hash evidence and no terminal content; the production probe is a bounded row-hash sample comparison against current mirror rows that runs once per reveal with no polling and a strict time budget.",
|
|
"commands": [],
|
|
"testFiles": [],
|
|
"assertionRefs": [],
|
|
"evidenceRuns": [],
|
|
"runtimeBudget": {
|
|
"p95Seconds": 30,
|
|
"scope": "renderer observability unit gate"
|
|
},
|
|
"flakeHistory": {
|
|
"status": "not-started",
|
|
"evidence": "Probe and tests not yet implemented."
|
|
},
|
|
"redGreenEvidence": {
|
|
"status": "missing",
|
|
"evidence": "Needs an intentionally divergent restore fixture proving the probe fires, dedupes, and stays silent on faithful restores."
|
|
},
|
|
"performanceBudget": {
|
|
"required": true,
|
|
"evidence": "One bounded comparison per reveal; no polling, no hot-path work, no content serialization beyond hashed row samples."
|
|
},
|
|
"promotionCriteria": [
|
|
"Prove the probe is content-free and privacy-safe (hashes and indices only).",
|
|
"Prove zero false positives across the existing restore test corpus before enabling telemetry counting.",
|
|
"Watch anomaly telemetry after each terminal release as the in-production regression signal."
|
|
],
|
|
"knownGaps": [
|
|
"No manifest command yet.",
|
|
"Probe not implemented; #7133-class and #7173-class corruption is currently silent in production.",
|
|
"Pixel-level divergence is out of scope for this probe (see terminal-render.pixel-refresh-repair).",
|
|
"Renderer-vs-mirror comparison cannot see corruption upstream of the mirror itself (#7192's stale-width mirror); mirror-vs-PTY truth is owned by terminal-geometry.visible-convergence."
|
|
],
|
|
"demotionRule": "Disable the probe if it exceeds its per-reveal budget or produces false-positive anomaly noise."
|
|
},
|
|
{
|
|
"id": "terminal-render.pixel-refresh-repair",
|
|
"title": "Forced repaint does not change revealed pane pixels",
|
|
"maturity": "experimental",
|
|
"protection": "none",
|
|
"owner": "terminal-rendering",
|
|
"layer": "electron-visual-golden",
|
|
"surfaces": [
|
|
"WebGL rendering",
|
|
"tab reveal",
|
|
"worktree resume",
|
|
"window wake",
|
|
"render model"
|
|
],
|
|
"platforms": [
|
|
"macos",
|
|
"linux",
|
|
"windows"
|
|
],
|
|
"providers": [
|
|
"local",
|
|
"daemon"
|
|
],
|
|
"coveredPlatforms": [],
|
|
"coveredProviders": [],
|
|
"coverageNotes": "Registered gap only; the live repro harness with a refresh-repair oracle exists but is not productized into the release-blocking terminal-rendering-golden suite.",
|
|
"motivatingLinks": [
|
|
"https://github.com/stablyai/orca/pull/7133",
|
|
"https://github.com/stablyai/orca/pull/7054"
|
|
],
|
|
"invariant": "After any reveal, restore, or wake, the pixels a pane displays must equal what a forced full model-invalidating repaint would draw from the buffer; a material refresh-repair diff means stale rendering escaped, whatever the mechanism.",
|
|
"oracle": "Screenshot the revealed pane, force a model-invalidating full repaint, screenshot again, and assert the bounded pixel diff is immaterial; pair with a JS-level render-model-vs-buffer comparison. Compositor screenshots only, because WebGL canvas readback is blank with preserveDrawingBuffer disabled.",
|
|
"commands": [],
|
|
"testFiles": [],
|
|
"assertionRefs": [],
|
|
"evidenceRuns": [],
|
|
"runtimeBudget": {
|
|
"p95Seconds": 300,
|
|
"scope": "release-blocking golden Electron visual test"
|
|
},
|
|
"flakeHistory": {
|
|
"status": "not-started",
|
|
"evidence": "Runs nightly only while the per-platform diff threshold stabilizes; the destination is the release-blocking terminal-rendering-golden suite in release-cut.yml."
|
|
},
|
|
"redGreenEvidence": {
|
|
"status": "missing",
|
|
"evidence": "Needs an intentionally fossilized render model (skip the model invalidation on reveal) proving the refresh-repair diff fires."
|
|
},
|
|
"performanceBudget": {
|
|
"required": true,
|
|
"evidence": "Soak-only; must not add product-path repaints beyond the existing reveal hardening."
|
|
},
|
|
"promotionCriteria": [
|
|
"Productize the existing stale-render repro harness with the refresh-repair oracle and failure artifacts.",
|
|
"Establish a stable material-diff threshold across platforms via nightly runs.",
|
|
"Promotion means membership in the release-blocking terminal-rendering-golden suite that release-cut.yml runs against every release tag; never PR-blocking.",
|
|
"Register the gate command as a direct spec-file invocation; the checker rejects --grep tag selectors, so do not reuse the existing --grep-based golden script as the command."
|
|
],
|
|
"knownGaps": [
|
|
"No manifest command yet.",
|
|
"Buffer-clean, pixels-stale variants are otherwise invisible to every buffer oracle in the manifest."
|
|
],
|
|
"demotionRule": "Drop from the golden suite back to nightly diagnostic if diff thresholds cannot be kept stable across CI runners."
|
|
},
|
|
{
|
|
"id": "pty-delivery.renderer-lifecycle-accounting-reset",
|
|
"title": "Renderer lifecycle reset clears leaked PTY delivery accounting so surviving PTYs cannot freeze",
|
|
"maturity": "experimental",
|
|
"protection": "partial",
|
|
"owner": "terminal-runtime",
|
|
"layer": "main-unit",
|
|
"surfaces": [
|
|
"terminal output delivery",
|
|
"renderer reload / crash recovery",
|
|
"surviving daemon and local PTYs"
|
|
],
|
|
"platforms": [
|
|
"macos",
|
|
"linux",
|
|
"windows"
|
|
],
|
|
"providers": [
|
|
"local",
|
|
"daemon"
|
|
],
|
|
"coveredPlatforms": [
|
|
"macos"
|
|
],
|
|
"coveredProviders": [],
|
|
"coverageNotes": "Local macOS unit evidence over the shared main-process delivery pipeline in registerPtyHandlers. The oracle drives a local mock PTY, but the in-flight/pending accounting is provider-agnostic and daemon PTYs ride the identical pipeline (the manual dev repro that proved the freeze was daemon-backed). SSH is a separate relay/credit path and never enters these counters; mobile/relay ride unaffected paths; WSL terminals ride this same local/daemon pipeline and are covered by the same accounting (no dedicated provider-contract test yet). Motivated by a production incident on v1.4.131 (three frozen/broken terminal panes in one desktop session) diagnosed to leaked in-flight/pending accounting across a renderer reload (rendererGraphEpoch 3). Live validation of the fix on a rebuilt dev instance surfaced a second leak mode (the boot window): after the reset ran, main resumed flushing a flooding PTY into the still-booting page before its pty:data listener re-registered, so those sends were dropped yet counted and re-pinned rendererInFlightChars at 524288. The gate now also covers holding sends until the renderer's pty:rendererDispatcherReady handshake. A watchdog self-heals a lost handshake: on each reset a one-shot ~10s timer arms and, if the handshake never arrives, force-opens the gate (rendererDispatcherReadyForcedCount increments) so a dropped handshake degrades to pre-handshake behavior instead of a permanent hold; the real handshake or a re-registration cancels it. Two new diagnostics — rendererPtyDispatcherReady and rendererDispatcherReadyForcedCount — expose the otherwise-invisible boot-window hold, which early-returns before ackGatedFlushSkipCount increments.",
|
|
"motivatingLinks": [
|
|
// #5787 introduced the renderer-reload delivery-accounting path this gate hardens;
|
|
// kept for lineage, not the primary motivation. THIS fix is motivated by the
|
|
// v1.4.131 three-frozen-panes incident (see coverageNotes).
|
|
"https://github.com/stablyai/orca/pull/5787",
|
|
"https://github.com/stablyai/orca/pull/8034"
|
|
],
|
|
"invariant": "After a renderer lifecycle reset (did-start-loading / render-process-gone / destroyed), no surviving PTY remains delivery-gated by pre-reset unacked bytes: main's in-flight counters and pending backlog equal the true state of the new page (zero in-flight, zero pending). Delivery then resumes only once the reloaded page's pty:data dispatcher re-registers and signals pty:rendererDispatcherReady; during the boot window before that handshake main holds all sends (data accrues losslessly in the capped pending backlog) so bytes cannot be dropped into a listener-less page and re-pin the gate. The hold itself cannot become a permanent freeze: a one-shot ~10s watchdog armed on each reset force-opens the gate (incrementing rendererDispatcherReadyForcedCount) if the handshake is lost, and the real handshake or a re-registration cancels it. The reset fires only for a main-frame load: did-start-loading also fires for in-page subframe loads (sandboxed srcDoc iframes in notebook HTML output), which are filtered out via isLoadingMainFrame() so a subframe load never clears accounting or holds the gate on the still-alive page. If a lifecycle-reset edge is missed entirely — a main-frame reload overlapped by an in-page subframe load emits no did-start-loading at all — a backstop still recovers: because the handshake is one-shot per page load, receiving pty:rendererDispatcherReady while the gate is already open proves a reset was missed (or the watchdog force-opened the gate), so the handler reconciles by clearing the stale accounting before re-opening. The renderer sends that handshake exactly once per page load, after its pty:data listener registers.",
|
|
"oracle": "Ingest more than 512 KB of PTY output with no renderer ACKs and assert the per-PTY gate closes (sends stop at the 512 KB high-water, remainder accrues as pending). Fire the registered did-start-loading listener and assert rendererInFlightChars and pendingChars are zero and the new diagnostics record the reset (rendererLifecycleResetCount 1, lastLifecycleResetClearedChars 512 KB). Then, before any dispatcher-ready handshake, ingest another chunk and assert it is NOT sent and NOT counted in-flight (held for the boot window, accruing in pending). Finally fire the pty:rendererDispatcherReady handshake and assert the held chunk is delivered to the renderer. Counters-zero without proving both the boot-window hold and that delivery resumes is insufficient. Additional cases prove the boot-window hold also covers the interactive direct-send fast path (input-primed keystroke echo is held, not sent, until the handshake) and that the self-heal watchdog force-opens the gate (rendererDispatcherReadyForcedCount 1) when no handshake arrives, while a timely handshake cancels the watchdog and leaves no orphaned timer. A further case fires did-start-loading with isLoadingMainFrame() false (a subframe/iframe load) and asserts accounting is untouched (rendererLifecycleResetCount stays 0, pending preserved, ready stays true) and delivery still drains on ACK — proving an in-page iframe load cannot trigger a spurious freeze. A backstop case saturates the gate, then fires pty:rendererDispatcherReady while the gate is still open (ready true) with no preceding reset — modeling a missed lifecycle edge — and asserts the handler reconciles: in-flight and pending clear, rendererLifecycleResetCount increments, and fresh output flows immediately (a straggler ACK is clamped and cannot underflow). A renderer-side case (pty-dispatcher-pi-routing.test.ts) asserts ensurePtyDispatcher() sends pty:rendererDispatcherReady exactly once across two attach calls — proving the send fires (it is optional-chained) and the one-shot guard holds.",
|
|
"commands": [
|
|
"pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/pty.test.ts src/renderer/src/components/terminal-pane/pty-dispatcher-pi-routing.test.ts"
|
|
],
|
|
"testFiles": [
|
|
"src/main/ipc/pty.test.ts",
|
|
"src/renderer/src/components/terminal-pane/pty-dispatcher-pi-routing.test.ts"
|
|
],
|
|
"assertionRefs": [
|
|
{
|
|
"file": "src/main/ipc/pty.test.ts",
|
|
"assertions": [
|
|
"a PTY saturated past the 512 KB per-PTY high-water with no ACKs stops sending and accrues pending output (gate closed)",
|
|
"firing the registered did-start-loading listener zeroes rendererInFlightChars and pendingData and records rendererLifecycleResetCount and lastLifecycleResetClearedChars",
|
|
"after the reset, output ingested during the boot window is NOT sent and NOT counted in-flight until the pty:rendererDispatcherReady handshake fires (held in pending)",
|
|
"firing the pty:rendererDispatcherReady handshake releases the held backlog and delivery resumes (delivery gated on the handshake, not just counters cleared)",
|
|
"interactive input-primed keystroke echo is also held during the boot window (interactive fast path gated on the handshake) and delivered once it fires",
|
|
"when no handshake arrives, the ~10s watchdog force-opens the gate (rendererDispatcherReadyForcedCount 1) and the held backlog drains; a timely handshake cancels the watchdog and leaves no orphaned timer",
|
|
"a did-start-loading with isLoadingMainFrame() false (in-page subframe/iframe load) does NOT reset accounting (rendererLifecycleResetCount stays 0, pending and in-flight preserved, rendererPtyDispatcherReady stays true) and delivery still drains on ACK",
|
|
"a pty:rendererDispatcherReady handshake arriving while the gate is still open (ready true, no preceding reset — a missed lifecycle edge) reconciles the stale accounting: in-flight and pending clear, rendererLifecycleResetCount increments, fresh output flows, and a straggler ACK is clamped",
|
|
"re-registering handlers (macOS re-activate / new window) cancels the prior registration's armed dispatcher-ready watchdog via the cross-registration bridge, leaving no orphaned ~10s timer to force-open a dead window's gate"
|
|
]
|
|
},
|
|
{
|
|
"file": "src/renderer/src/components/terminal-pane/pty-dispatcher-pi-routing.test.ts",
|
|
"assertions": [
|
|
"ensurePtyDispatcher() sends pty:rendererDispatcherReady exactly once across two attach calls (the optional-chained send fires, and the ptyDispatcherAttached one-shot guard prevents a re-signal)"
|
|
]
|
|
}
|
|
],
|
|
"evidenceRuns": [
|
|
{
|
|
"date": "2026-07-09",
|
|
"runner": "local",
|
|
"platform": "macos",
|
|
"command": "pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/pty.test.ts src/renderer/src/components/terminal-pane/pty-dispatcher-pi-routing.test.ts",
|
|
"result": "passed",
|
|
"durationSeconds": 1,
|
|
"summary": "243 tests passed (232 main-process + 11 renderer dispatcher) including the lifecycle-reset, boot-window (dispatcher-ready handshake), interactive-gate hold, watchdog self-heal, main-frame-filter (subframe did-start-loading is ignored), missed-reset reconcile backstop (handshake-while-open), cross-registration watchdog-cancel, and renderer-side one-shot handshake-send regressions. Removing the reset call reproduces the reload freeze (rendererInFlightChars stays 524288); removing the send-hold reproduces the boot-window leak; removing the interactive-path flag check sends keystroke echo into the not-yet-ready page; removing the watchdog arm leaves the gate held forever; removing the watchdog cancel leaves an orphaned timer after the handshake; removing the isLoadingMainFrame filter lets a subframe iframe load run a spurious reset; removing the handshake-while-open reconcile leaves the survivors pinned at 524288 after a missed lifecycle edge."
|
|
}
|
|
],
|
|
"runtimeBudget": {
|
|
"p95Seconds": 10,
|
|
"scope": "local main-process unit test"
|
|
},
|
|
"flakeHistory": {
|
|
"status": "unknown",
|
|
"evidence": "Newly registered with this fix; needs soak history before any promotion. The oracle is deterministic (fake timers, mock webContents)."
|
|
},
|
|
"redGreenEvidence": {
|
|
"status": "partial",
|
|
"evidence": "Locally verified red/green on every load-bearing branch: (1) reset call removed -> rendererInFlightChars stays 524288 after did-start-loading; (2) boot-window send-hold removed -> post-reload output is sent into the not-yet-ready page ('NOT sent until handshake' fails); (3) interactive-path flag check removed -> input-primed keystroke echo is sent during the hold; (4) watchdog arm removed -> the gate is never force-opened and the held backlog never drains; (5) watchdog cancel removed -> an orphaned ~10s timer survives the handshake (getTimerCount 1); (6) isLoadingMainFrame filter removed -> a subframe did-start-loading runs a spurious reset (rendererLifecycleResetCount 1, pending cleared, ready dropped) — locally verified red; (7) handshake-while-open reconcile removed -> a pty:rendererDispatcherReady arriving after a missed lifecycle edge leaves the gate pinned (rendererInFlightChars stays 524288, pending 90112, rendererLifecycleResetCount 0) — locally verified red; (8) cross-registration bridge cancel removed (top-of-registerPtyHandlers clearRendererDispatcherReadyWatchdog) -> a prior registration's armed watchdog survives re-registration as an orphaned timer (getTimerCount 1 instead of 0) — locally verified red. With the full fix all eight are green. The performance budget below still holds: the watchdog is a single unref'd one-shot per reset, not per-chunk. Needs a saved CI or intentional-break artifact before blocking promotion."
|
|
},
|
|
"performanceBudget": {
|
|
"required": true,
|
|
"evidence": "The reset is an O(#ptys) map clear on rare lifecycle events (reload/crash) plus one unref'd one-shot ~10s watchdog timer per reset (cancelled by the handshake or a re-registration); no polling and no per-chunk work. Any PR changing the delivery gate, in-flight accounting, or flush loop must re-measure terminal throughput before promotion."
|
|
},
|
|
"promotionCriteria": [
|
|
"Run in soak for at least 100 consecutive passes or 14 days across required CI platforms.",
|
|
"Attach saved red/green evidence from removing the lifecycle-reset accounting clear.",
|
|
"Add an Electron-level reload survival test that proves a saturated pane resumes rendering and input after Cmd+R / crash recovery."
|
|
],
|
|
"knownGaps": [
|
|
"The unit oracle drives a local mock PTY; daemon and WSL coverage rides the same pipeline but has no dedicated provider-contract test yet.",
|
|
"The dev repro covers the output-delivery freeze only; the arrow-key input symptom and mouse-mode flood observed in the same incident are out of scope and need their own repros.",
|
|
"No live Electron reload-survival assertion yet — the gate proves the main-side accounting reset, not the full renderer reattach paint."
|
|
],
|
|
"demotionRule": "Demote or quarantine if the gate flakes once without a product bug or harness bug filed to the owner."
|
|
},
|
|
{
|
|
"id": "runtime-files.watcher-process-isolation",
|
|
"title": "Runtime and SSH relay watcher faults stay process-isolated without disrupting host services",
|
|
"maturity": "experimental",
|
|
"protection": "partial",
|
|
"owner": "runtime-platform",
|
|
"layer": "process-rpc-contract",
|
|
"surfaces": [
|
|
"headless orca serve",
|
|
"paired file explorer",
|
|
"runtime editor external-change detection",
|
|
"desktop filesystem watcher",
|
|
"SSH relay filesystem watcher and live PTYs"
|
|
],
|
|
"platforms": [
|
|
"macos",
|
|
"linux",
|
|
"windows"
|
|
],
|
|
"providers": [
|
|
"local",
|
|
"remote-runtime",
|
|
"ssh"
|
|
],
|
|
"coveredPlatforms": [
|
|
"macos"
|
|
],
|
|
"coveredProviders": [
|
|
"local",
|
|
"remote-runtime",
|
|
"ssh"
|
|
],
|
|
"coverageNotes": "Deterministic tests cover one shared healthy child per runtime process plus at most four bounded fault-quarantine children, native desktop, paired-runtime, and WSL snapshot processes sharing the same eight-physical-child reservation with typed serialized event-driven capacity recovery, including recursive re-wait when crash recovery reclaims an announced slot, one quarantine attempt per watch lifetime, generation-scoped cancellation, bounded termination with removable deadline waiters, replacement-crawl errors that cannot be blessed by a late readiness ack, pre-ready paired-web cancellation registered before an unbounded capacity wait, already-resolved and late physical-exit retry of a rejected paired-web teardown, physical desktop-install and local/SSH PTY teardown, stale-generation rejection, per-child stat bounds, final-overflow RPC delivery, and renderer eviction before terminal callbacks can retry. Destructive local and SSH removal fences both ID-derived and resolved-cwd terminal roots, including sibling-root/cwd combinations with reverse admission rollback, closes descendant relay watches before parent deletion, enumerates authoritative provider/cwd ownership, falls back to daemon spawn cwd before OSC 7, and keeps daemon/relay immediate shutdown pending until native exit or a bounded fail-closed error; a dead relay PID discovered during attach also settles concurrent shutdown before its stale entry is reaped, while Windows runtime watcher deadlines retain one removable physical-close waiter, treat Node's error-close path as positive physical-exit proof, and clear root ownership on late close. The relay policy test maps a standard repository's base, Git common directory, and worktree roots to one healthy supervisor, then proves a shared-child failure recovers those roots in separate quarantine supervisors with overflow and resumed events. Abortable capacity, quarantine, runtime-root, relay, SSH, and relay pre-install setup waits attach one reaction to each shared promise and explicitly remove 10,000 cancelled caller closures while one anchor remains. Built-entry macOS harnesses kill the desktop/runtime and SSH relay watcher children, then require automatic resubscription and later events while the host process and relay PTY survive. SSH bundles the child boundary beside relay.js, requires both artifacts for install completeness, and preserves registration-owned same-root cancellation.",
|
|
"motivatingLinks": [
|
|
"https://github.com/stablyai/orca/issues/5308",
|
|
"https://github.com/stablyai/orca/issues/7547",
|
|
"https://github.com/stablyai/orca/issues/8212"
|
|
],
|
|
"invariant": "Local runtime and SSH relay roots share one watcher child per host process while healthy and use at most four quarantine children after shard failure; native desktop, paired-runtime, and direct WSL snapshot children consume the same process-wide eight-child reservation and retry transient exhaustion without permanently disabling a root. Cancellation remains owned by its child generation and settles only after acknowledgement or bounded physical exit; paired-web retains cleanup ownership and can cancel before readiness even while capacity is exhausted, retries a failed unwatch after already-resolved or late physical exit without duplicating stream termination, replacements never overlap a still-retiring generation, and aborted or timed-out callers detach immediately even while queued behind same-root relay teardown. Destructive local and SSH cleanup holds one containment-aware watcher/terminal removal fence through descendant watcher and PTY physical exit plus parent Git/filesystem deletion; daemon and relay kill requests retain ownership until the actual subprocess exit callback or an equivalent positive dead-PID proof and propagate rejected signals or a bounded failure otherwise. A crash-fused shared shard moves affected roots into the bounded quarantine pool, a second fused quarantine ends those watch lifetimes, interrupted setup emits overflow after recovery, metadata work stays bounded, and the SSH relay, PTYs, Git, and other filesystem operations never load the watcher native addon or share its fault boundary.",
|
|
"oracle": "Fill the global watcher-child reservation, require native desktop, paired-runtime, and WSL setup to retain typed transient capacity and retry after one serialized release, then cancel pending desktop and paired-client watches and require no retry. Hold one live anchor while aborting 10,000 callers at the capacity, quarantine-assignment, runtime-root, relay-setup, and SSH-registration layers; require exactly one explicit waiter and one base-promise reaction to remain, then zero after settlement. Hold an old relay unsubscribe, queue one same-root setup leader and one anchor, then abort 10,000 joiners; require every cancellation to settle before teardown releases, exactly one anchor waiter, and only one later physical install. Advance the former paired-web callback deadline while capacity remains full, require cancellation ownership to stay live, publish the server token before ready, and require files.unwatch to abort setup before a later slot release can install a native root. Reject the first ready-watch unwatch with a physical-exit promise, resolve that exit later, and require a fresh physical unwatch attempt, registry release, and exactly one stream end. Fill one healthy shared child with multiple roots, map a standard SSH repository's base, Git common directory, and worktree roots to one relay supervisor, then inject IPC disconnect-before-exit, queued and active cancellation, operations during termination, kill-without-exit, repeated unkillable generations, initial and recovery timeouts, and shard failure. During local and SSH deletion, attempt a late terminal spawn whose worktree identity and cwd name different roots, enumerate a non-prefix remote PTY by authoritative worktree ownership, withhold daemon/relay exit callbacks, make attach positively prove a concurrent-shutdown PID dead, and make the provider unavailable; require every acquired admission to roll back on rejection, dead-PID proof to settle physical exit before reaping, timeout to retain ownership, and Git/filesystem deletion never to start. Require bounded watcher process count, physical-exit settlement, healthy-root recovery, stale-generation rejection, overflow plus later events, and fail-closed destructive cleanup. Verify relay build hashes and remote install probes require both relay.js and relay-watcher.js. Launch the built relay with a real PTY and Parcel watch, kill only the watcher child, and require the same relay PID and PTY to answer before a replacement child delivers overflow and a post-crash event.",
|
|
"commands": [
|
|
"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/rpc/methods/files-watch-cleanup.test.ts --reporter=dot",
|
|
"pnpm exec vitest run --config config/vitest.config.ts src/relay/relay-watcher-pending-setup-waiters.test.ts --reporter=dot",
|
|
"pnpm exec vitest run --config config/vitest.config.ts src/relay/relay-watcher-parent-removal.test.ts --reporter=dot",
|
|
"pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/parcel-watcher-unsubscribe-timeout.test.ts --reporter=dot",
|
|
"pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/filesystem-watcher.test.ts src/main/ipc/filesystem-watcher-native-capacity.test.ts src/main/ipc/parcel-watcher-child-registry.test.ts src/main/ipc/parcel-watcher-child-launch.test.ts src/main/ipc/parcel-watcher-process.test.ts src/main/ipc/parcel-watcher-supervisor-capacity-wait.test.ts src/main/ipc/parcel-watcher-supervisor-capacity.test.ts src/main/ipc/parcel-watcher-disconnect-termination.test.ts src/main/ipc/runtime-watcher-pending-assignment.test.ts src/main/ipc/runtime-watcher-process-pool.test.ts src/main/ipc/parcel-watcher-process-entry.test.ts src/main/ipc/parcel-watcher-event-delivery.test.ts src/main/ipc/filesystem-watcher-local-unsubscribe.test.ts src/main/ipc/filesystem-watcher-wsl.test.ts src/main/ipc/worktrees.test.ts src/main/ipc/watcher-removal-gate.test.ts src/main/runtime/file-watcher-host.test.ts src/main/runtime/orca-runtime-files-watch.test.ts src/main/runtime/worktree-teardown.test.ts src/main/runtime/orca-runtime.test.ts src/main/runtime/rpc/methods/files.test.ts src/main/runtime/rpc/methods/files-watch-cancellation.test.ts src/main/providers/ssh-filesystem-provider-watch-waiters.test.ts src/main/providers/ssh-filesystem-provider.test.ts src/renderer/src/runtime/runtime-file-client.test.ts src/renderer/src/web/web-runtime-client.test.ts src/shared/cross-platform-path.test.ts src/shared/physical-exit-tracker.test.ts src/shared/promise-settlement-waiters.test.ts src/main/ipc/pty.test.ts src/main/providers/local-pty-provider.test.ts src/main/daemon/daemon-pty-adapter.test.ts src/main/daemon/pty-subprocess.test.ts src/main/daemon/session.test.ts src/main/daemon/terminal-host.test.ts src/main/daemon/terminal-host-session-reaping-leak.test.ts src/main/providers/ssh-pty-provider.test.ts src/relay/relay-watcher-setup-wait.test.ts src/relay/pty-handler.test.ts --reporter=dot",
|
|
"pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/filesystem-watcher.test.ts src/main/ipc/filesystem-watcher-native-capacity.test.ts src/main/ipc/parcel-watcher-child-registry.test.ts src/main/ipc/parcel-watcher-child-launch.test.ts src/main/ipc/parcel-watcher-process.test.ts src/main/ipc/parcel-watcher-supervisor-capacity.test.ts src/main/ipc/parcel-watcher-disconnect-termination.test.ts src/main/ipc/runtime-watcher-process-pool.test.ts src/main/ipc/parcel-watcher-process-entry.test.ts src/main/ipc/parcel-watcher-event-delivery.test.ts src/main/ipc/filesystem-watcher-local-unsubscribe.test.ts src/main/ipc/filesystem-watcher-wsl.test.ts src/main/ipc/worktrees.test.ts src/main/ipc/watcher-removal-gate.test.ts src/main/runtime/file-watcher-host.test.ts src/main/runtime/orca-runtime-files-watch.test.ts src/main/runtime/worktree-teardown.test.ts src/main/runtime/orca-runtime.test.ts src/main/runtime/rpc/methods/files.test.ts src/main/runtime/rpc/methods/files-watch-cancellation.test.ts src/main/providers/ssh-filesystem-provider.test.ts src/renderer/src/runtime/runtime-file-client.test.ts src/renderer/src/web/web-runtime-client.test.ts src/shared/cross-platform-path.test.ts src/shared/physical-exit-tracker.test.ts src/main/ipc/pty.test.ts src/main/providers/local-pty-provider.test.ts src/main/daemon/daemon-pty-adapter.test.ts src/main/daemon/pty-subprocess.test.ts src/main/daemon/session.test.ts src/main/daemon/terminal-host.test.ts src/main/daemon/terminal-host-session-reaping-leak.test.ts src/main/providers/ssh-pty-provider.test.ts src/relay/pty-handler.test.ts --reporter=dot",
|
|
"pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/filesystem-watcher.test.ts src/main/ipc/parcel-watcher-process.test.ts src/main/ipc/parcel-watcher-disconnect-termination.test.ts src/main/ipc/runtime-watcher-process-pool.test.ts src/main/ipc/parcel-watcher-process-entry.test.ts src/main/ipc/parcel-watcher-event-delivery.test.ts src/main/ipc/filesystem-watcher-local-unsubscribe.test.ts src/main/ipc/filesystem-watcher-wsl.test.ts src/main/ipc/worktrees.test.ts src/main/ipc/watcher-removal-gate.test.ts src/main/runtime/file-watcher-host.test.ts src/main/runtime/orca-runtime-files-watch.test.ts src/main/runtime/worktree-teardown.test.ts src/main/runtime/orca-runtime.test.ts src/main/runtime/rpc/methods/files.test.ts src/main/providers/ssh-filesystem-provider.test.ts src/renderer/src/runtime/runtime-file-client.test.ts src/renderer/src/web/web-runtime-client.test.ts src/shared/cross-platform-path.test.ts src/main/ipc/pty.test.ts src/main/providers/local-pty-provider.test.ts src/main/daemon/pty-subprocess.test.ts src/main/daemon/session.test.ts src/main/daemon/terminal-host.test.ts src/main/daemon/terminal-host-session-reaping-leak.test.ts src/main/providers/ssh-pty-provider.test.ts src/relay/pty-handler.test.ts --reporter=dot",
|
|
"pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/parcel-watcher-process.test.ts src/main/ipc/parcel-watcher-disconnect-termination.test.ts src/main/ipc/runtime-watcher-process-pool.test.ts src/main/ipc/parcel-watcher-process-entry.test.ts src/main/ipc/parcel-watcher-event-delivery.test.ts src/main/ipc/filesystem-watcher-local-unsubscribe.test.ts src/main/ipc/filesystem-watcher-wsl.test.ts src/main/ipc/worktrees.test.ts src/main/ipc/watcher-removal-gate.test.ts src/main/runtime/file-watcher-host.test.ts src/main/runtime/orca-runtime-files-watch.test.ts src/main/runtime/worktree-teardown.test.ts src/main/runtime/orca-runtime.test.ts src/main/runtime/rpc/methods/files.test.ts src/main/providers/ssh-filesystem-provider.test.ts src/renderer/src/runtime/runtime-file-client.test.ts src/renderer/src/web/web-runtime-client.test.ts src/shared/cross-platform-path.test.ts src/main/ipc/pty.test.ts src/main/providers/local-pty-provider.test.ts src/main/daemon/pty-subprocess.test.ts src/main/daemon/session.test.ts src/main/daemon/terminal-host.test.ts src/main/daemon/terminal-host-session-reaping-leak.test.ts src/main/providers/ssh-pty-provider.test.ts src/relay/pty-handler.test.ts",
|
|
"pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/parcel-watcher-process.test.ts src/main/ipc/parcel-watcher-disconnect-termination.test.ts src/main/ipc/runtime-watcher-process-pool.test.ts src/main/ipc/parcel-watcher-process-entry.test.ts src/main/ipc/parcel-watcher-event-delivery.test.ts src/main/ipc/filesystem-watcher-local-unsubscribe.test.ts src/main/ipc/filesystem-watcher-wsl.test.ts src/main/ipc/worktrees.test.ts src/main/ipc/watcher-removal-gate.test.ts src/main/runtime/file-watcher-host.test.ts src/main/runtime/orca-runtime-files-watch.test.ts src/main/runtime/worktree-teardown.test.ts src/main/runtime/orca-runtime.test.ts src/main/runtime/rpc/methods/files.test.ts src/main/providers/ssh-filesystem-provider.test.ts src/renderer/src/runtime/runtime-file-client.test.ts src/renderer/src/web/web-runtime-client.test.ts src/shared/cross-platform-path.test.ts src/main/ipc/pty.test.ts src/main/providers/local-pty-provider.test.ts src/main/daemon/session.test.ts src/main/daemon/terminal-host.test.ts src/main/daemon/terminal-host-session-reaping-leak.test.ts src/main/providers/ssh-pty-provider.test.ts src/relay/pty-handler.test.ts",
|
|
"pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/parcel-watcher-process.test.ts src/main/ipc/parcel-watcher-disconnect-termination.test.ts src/main/ipc/runtime-watcher-process-pool.test.ts src/main/ipc/parcel-watcher-process-entry.test.ts src/main/ipc/parcel-watcher-event-delivery.test.ts src/main/ipc/filesystem-watcher-local-unsubscribe.test.ts src/main/ipc/filesystem-watcher-wsl.test.ts src/main/ipc/worktrees.test.ts src/main/ipc/watcher-removal-gate.test.ts src/main/runtime/file-watcher-host.test.ts src/main/runtime/orca-runtime-files-watch.test.ts src/main/runtime/worktree-teardown.test.ts src/main/runtime/orca-runtime.test.ts src/main/runtime/rpc/methods/files.test.ts src/main/providers/ssh-filesystem-provider.test.ts src/renderer/src/runtime/runtime-file-client.test.ts src/renderer/src/web/web-runtime-client.test.ts src/shared/cross-platform-path.test.ts src/main/ipc/pty.test.ts src/main/daemon/terminal-host.test.ts src/main/daemon/terminal-host-session-reaping-leak.test.ts src/main/providers/ssh-pty-provider.test.ts src/relay/pty-handler.test.ts",
|
|
"pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/parcel-watcher-process.test.ts src/main/ipc/parcel-watcher-disconnect-termination.test.ts src/main/ipc/runtime-watcher-process-pool.test.ts src/main/ipc/parcel-watcher-process-entry.test.ts src/main/ipc/parcel-watcher-event-delivery.test.ts src/main/ipc/filesystem-watcher-local-unsubscribe.test.ts src/main/ipc/filesystem-watcher-wsl.test.ts src/main/ipc/worktrees.test.ts src/main/ipc/watcher-removal-gate.test.ts src/main/runtime/file-watcher-host.test.ts src/main/runtime/orca-runtime-files-watch.test.ts src/main/runtime/worktree-teardown.test.ts src/main/runtime/orca-runtime.test.ts src/main/runtime/rpc/methods/files.test.ts src/main/providers/ssh-filesystem-provider.test.ts src/renderer/src/runtime/runtime-file-client.test.ts src/renderer/src/web/web-runtime-client.test.ts src/shared/cross-platform-path.test.ts",
|
|
"pnpm run build:electron-vite",
|
|
"node config/scripts/runtime-file-watcher-resource-probe.mjs",
|
|
"node config/scripts/runtime-file-watcher-fault-harness.mjs",
|
|
"ELECTRON_RUN_AS_NODE=1 pnpm exec electron config/scripts/runtime-file-watcher-fault-harness.mjs",
|
|
"pnpm exec vitest run --config config/vitest.config.ts src/relay/relay-watcher-setup-wait.test.ts src/relay/relay-filesystem-watch-registry.test.ts src/relay/fs-handler.test.ts src/relay/git-handler.test.ts src/relay/subprocess.test.ts src/main/ssh/ssh-relay-versioned-install.test.ts config/scripts/package-electron-runtime-contract.test.mjs",
|
|
"pnpm exec vitest run --config config/vitest.config.ts src/relay/relay-filesystem-watch-registry.test.ts src/relay/fs-handler.test.ts src/relay/git-handler.test.ts src/relay/subprocess.test.ts src/main/ssh/ssh-relay-versioned-install.test.ts config/scripts/package-electron-runtime-contract.test.mjs",
|
|
"pnpm run build:relay",
|
|
"node config/scripts/relay-watcher-fault-harness.mjs"
|
|
],
|
|
"testFiles": [
|
|
"src/main/daemon/daemon-pty-adapter.test.ts",
|
|
"src/main/ipc/filesystem-watcher.test.ts",
|
|
"src/main/ipc/filesystem-watcher-native-capacity.test.ts",
|
|
"src/main/ipc/parcel-watcher-child-registry.test.ts",
|
|
"src/main/ipc/parcel-watcher-child-launch.test.ts",
|
|
"src/main/ipc/parcel-watcher-process.test.ts",
|
|
"src/main/ipc/parcel-watcher-unsubscribe-timeout.test.ts",
|
|
"src/main/ipc/parcel-watcher-supervisor-capacity-wait.test.ts",
|
|
"src/main/ipc/parcel-watcher-supervisor-capacity.test.ts",
|
|
"src/main/ipc/parcel-watcher-disconnect-termination.test.ts",
|
|
"src/main/ipc/runtime-watcher-pending-assignment.test.ts",
|
|
"src/main/ipc/runtime-watcher-process-pool.test.ts",
|
|
"src/main/ipc/parcel-watcher-process-entry.test.ts",
|
|
"src/main/ipc/parcel-watcher-event-delivery.test.ts",
|
|
"src/main/ipc/filesystem-watcher-local-unsubscribe.test.ts",
|
|
"src/main/ipc/filesystem-watcher-wsl.test.ts",
|
|
"src/main/ipc/worktrees.test.ts",
|
|
"src/main/ipc/watcher-removal-gate.test.ts",
|
|
"src/main/ipc/pty.test.ts",
|
|
"src/main/providers/local-pty-provider.test.ts",
|
|
"src/main/daemon/pty-subprocess.test.ts",
|
|
"src/main/daemon/session.test.ts",
|
|
"src/main/daemon/terminal-host.test.ts",
|
|
"src/main/daemon/terminal-host-session-reaping-leak.test.ts",
|
|
"src/main/runtime/file-watcher-host.test.ts",
|
|
"src/main/runtime/orca-runtime-files-watch.test.ts",
|
|
"src/main/runtime/worktree-teardown.test.ts",
|
|
"src/main/runtime/orca-runtime.test.ts",
|
|
"src/main/runtime/rpc/methods/files.test.ts",
|
|
"src/main/runtime/rpc/methods/files-watch-cancellation.test.ts",
|
|
"src/main/runtime/rpc/methods/files-watch-cleanup.test.ts",
|
|
"src/main/providers/ssh-filesystem-provider.test.ts",
|
|
"src/main/providers/ssh-filesystem-provider-watch-waiters.test.ts",
|
|
"src/main/providers/ssh-pty-provider.test.ts",
|
|
"src/renderer/src/runtime/runtime-file-client.test.ts",
|
|
"src/renderer/src/web/web-runtime-client.test.ts",
|
|
"src/shared/cross-platform-path.test.ts",
|
|
"src/shared/physical-exit-tracker.test.ts",
|
|
"src/shared/promise-settlement-waiters.test.ts",
|
|
"config/scripts/runtime-file-watcher-fault-harness.mjs",
|
|
"config/scripts/runtime-file-watcher-resource-probe.mjs",
|
|
"src/relay/relay-filesystem-watch-registry.test.ts",
|
|
"src/relay/relay-watcher-pending-setup-waiters.test.ts",
|
|
"src/relay/relay-watcher-parent-removal.test.ts",
|
|
"src/relay/relay-watcher-setup-wait.test.ts",
|
|
"src/relay/fs-handler.test.ts",
|
|
"src/relay/pty-handler.test.ts",
|
|
"src/relay/git-handler.test.ts",
|
|
"src/relay/subprocess.test.ts",
|
|
"src/main/ssh/ssh-relay-versioned-install.test.ts",
|
|
"config/scripts/package-electron-runtime-contract.test.mjs",
|
|
"config/scripts/relay-watcher-fault-harness.mjs"
|
|
],
|
|
"assertionRefs": [
|
|
{
|
|
"file": "src/main/ipc/filesystem-watcher.test.ts",
|
|
"assertions": [
|
|
"a transient WSL child-capacity rejection automatically retries on release and renderer unwatch cancels the wait",
|
|
"failed SSH worktree removal restores every live renderer listener, emits overflow, and resumes precise events"
|
|
]
|
|
},
|
|
{
|
|
"file": "src/main/ipc/filesystem-watcher-native-capacity.test.ts",
|
|
"assertions": [
|
|
"typed native child-capacity exhaustion automatically retries after a serialized slot release",
|
|
"renderer unwatch cancels a pending native capacity retry before subscription restarts"
|
|
]
|
|
},
|
|
{
|
|
"file": "src/main/ipc/parcel-watcher-child-registry.test.ts",
|
|
"assertions": [
|
|
"capacity notification closes the release-before-listen race, supports cancellation, fires at most once, and serializes reserving waiters per released slot"
|
|
]
|
|
},
|
|
{
|
|
"file": "src/main/ipc/parcel-watcher-child-launch.test.ts",
|
|
"assertions": [
|
|
"native launcher reports typed transient capacity exhaustion without forking another child"
|
|
]
|
|
},
|
|
{
|
|
"file": "src/shared/physical-exit-tracker.test.ts",
|
|
"assertions": [
|
|
"timed-out physical-exit waiters detach while active and later retries still settle on exact exit"
|
|
]
|
|
},
|
|
{
|
|
"file": "src/shared/promise-settlement-waiters.test.ts",
|
|
"assertions": [
|
|
"one shared-promise reaction serves an anchor plus 10,000 abortable callers, and all cancelled closures detach immediately",
|
|
"timeout and already-aborted paths remove timers, listeners, and ownership while preserving the active anchor"
|
|
]
|
|
},
|
|
{
|
|
"file": "src/main/daemon/daemon-pty-adapter.test.ts",
|
|
"assertions": [
|
|
"daemon process enumeration falls back to spawn cwd before OSC 7 reports a live cwd",
|
|
"force-killed keep-history sleep remains cold-restorable across repeated wake cycles after physical exit"
|
|
]
|
|
},
|
|
{
|
|
"file": "src/main/ipc/parcel-watcher-process.test.ts",
|
|
"assertions": [
|
|
"initial-subscribe crashes complete with an interruption refresh",
|
|
"watch errors before readiness reject setup and physically cancel the native crawl",
|
|
"watch errors during replacement crawl terminate recovery and a late readiness ack cannot revive the failed root",
|
|
"IPC disconnect recovery restores every existing root before accepting new setup",
|
|
"queued abort removes one request without restarting healthy roots, while active abort or crawl-scoped timeout restores the shard",
|
|
"a crash-resubscribe crawl deadline and concurrent unsubscribe settle only after physical shard exit, or report physical-exit failure at the termination deadline",
|
|
"a close-only asynchronous spawn failure settles physical termination without waiting for the exit deadline",
|
|
"production runtime-pool disposal rejects later subscriptions without forking an overlapping child",
|
|
"Vitest cleanup resets rather than re-disposes the reusable runtime pool",
|
|
"native child launch preserves typed transient capacity exhaustion instead of reporting permanent process unavailability",
|
|
"missing built entries fail closed and unavailable canary storage remains optional",
|
|
"fault-harness PID reporting cannot clobber an existing filesystem path"
|
|
]
|
|
},
|
|
{
|
|
"file": "src/main/ipc/parcel-watcher-unsubscribe-timeout.test.ts",
|
|
"assertions": [
|
|
"a canary-independent native-unsubscribe deadline restarts the shard and restores healthy siblings after physical child exit",
|
|
"an unkillable child rejects the native unsubscribe with its retained physical-exit promise only at the bounded exit deadline"
|
|
]
|
|
},
|
|
{
|
|
"file": "src/main/ipc/parcel-watcher-supervisor-capacity-wait.test.ts",
|
|
"assertions": [
|
|
"10,000 cancelled capacity callers leave exactly one live anchor and zero waiters after the released slot settles"
|
|
]
|
|
},
|
|
{
|
|
"file": "src/main/ipc/parcel-watcher-supervisor-capacity.test.ts",
|
|
"assertions": [
|
|
"one released physical slot launches one shared supervisor child for every waiting root, while partial/all cancellation and disposal remove the shared capacity barrier",
|
|
"a waiter recursively re-enters the event-driven barrier when crash recovery reclaims its announced slot"
|
|
]
|
|
},
|
|
{
|
|
"file": "src/main/ipc/parcel-watcher-disconnect-termination.test.ts",
|
|
"assertions": [
|
|
"pending-crawl cancellation after disconnect remains pending until the exact child exits",
|
|
"ready and pending-crawl cancellation force disconnected-child exit even while a healthy sibling root remains",
|
|
"a cancellation deadline joins active disconnect termination without duplicate sibling resubscription",
|
|
"an exit-deadline failure replaces the early cancellation and remains visible to synchronous unsubscribe until physical exit"
|
|
]
|
|
},
|
|
{
|
|
"file": "src/main/ipc/runtime-watcher-pending-assignment.test.ts",
|
|
"assertions": [
|
|
"10,000 cancelled quarantine-assignment callers leave exactly one live anchor and zero waiters after grant",
|
|
"an already-aborted first caller synchronously releases pending assignment ownership"
|
|
]
|
|
},
|
|
{
|
|
"file": "src/main/ipc/runtime-watcher-process-pool.test.ts",
|
|
"assertions": [
|
|
"healthy roots share one supervisor until a fault requires quarantine",
|
|
"a supervisor-scoped failure spreads affected roots across at most four quarantine supervisors",
|
|
"a second fused quarantine creates no further replacement for that watch lifetime",
|
|
"a root-specific failure preserves healthy shard assignments",
|
|
"a live root whose crash-resubscribe times out moves to quarantine",
|
|
"an older same-root teardown cannot erase a newer watch lease's assignment",
|
|
"test reset explicitly reopens the production-disposed pool",
|
|
"a zero-waiter aborted assignment cannot poison a same-turn replacement subscribe"
|
|
]
|
|
},
|
|
{
|
|
"file": "src/main/ipc/parcel-watcher-process-entry.test.ts",
|
|
"assertions": [
|
|
"queued cancellation removes the request before Parcel starts its crawl",
|
|
"active cancellation requests one host restart and emits no stale subscribed acknowledgement",
|
|
"runtime batches receive directory metadata before child IPC",
|
|
"an FSEvents dropped-events error is reported as recoverable and later events continue",
|
|
"batches above the configured event limit become one overflow before stat or IPC fanout",
|
|
"while process.send is backpressured, later bursts retain at most one bounded pending batch and collapse excess paths to overflow",
|
|
"unsubscribe discards pending delivery before it can perform stale stat work"
|
|
]
|
|
},
|
|
{
|
|
"file": "src/main/ipc/parcel-watcher-event-delivery.test.ts",
|
|
"assertions": [
|
|
"eight concurrent root batches never exceed eight active directory metadata stats within one child"
|
|
]
|
|
},
|
|
{
|
|
"file": "src/main/ipc/filesystem-watcher-local-unsubscribe.test.ts",
|
|
"assertions": [
|
|
"worktree deletion physically aborts pending native setup and settles before its crawl resolves",
|
|
"app shutdown physically aborts pending native setup and releases a late native handle",
|
|
"a cancelled pending install retains physical-exit failure across an immediate second destructive close",
|
|
"desktop terminal failure remains root-owned even when the cleared subscription later unsubscribes cleanly",
|
|
"Windows drive and UNC watcher ownership is found across path casing and separator variants",
|
|
"Windows event payloads retain the physical root spelling instead of the comparison key",
|
|
"failed local worktree removal restores every live renderer listener and emits overflow"
|
|
]
|
|
},
|
|
{
|
|
"file": "src/main/ipc/filesystem-watcher-wsl.test.ts",
|
|
"assertions": [
|
|
"unsubscribe and startup abort remain pending until the WSL watcher process physically closes",
|
|
"a termination timeout or rejected kill retains the WSL watcher owner for later physical-exit proof",
|
|
"WSL watcher processes consume the shared eight-child reservation until physical close, including synchronous startup-write cleanup"
|
|
]
|
|
},
|
|
{
|
|
"file": "src/main/ipc/worktrees.test.ts",
|
|
"assertions": [
|
|
"desktop IPC deletion never starts Git removal when physical PTY teardown cannot be proven",
|
|
"normal and orphan/leftover deletion paths perform strict PTY teardown before local or SSH Git/filesystem removal",
|
|
"SSH deletion fails closed before Git when the remote PTY provider is unavailable",
|
|
"failed IPC deletion finishes the watcher fence as aborted so logical subscriptions can recover"
|
|
]
|
|
},
|
|
{
|
|
"file": "src/main/ipc/watcher-removal-gate.test.ts",
|
|
"assertions": [
|
|
"Windows-equivalent spellings share one removal fence while distinct POSIX backslash roots do not",
|
|
"desktop and runtime removal entry points cannot own overlapping destructive roots concurrently",
|
|
"parent removal waits descendant terminal spawns and rejects later descendant installs"
|
|
]
|
|
},
|
|
{
|
|
"file": "src/main/ipc/pty.test.ts",
|
|
"assertions": [
|
|
"renderer PTY spawn is rejected before provider creation while destructive worktree removal holds the shared terminal gate",
|
|
"renderer and runtime spawns fence both the worktree-ID root and resolved cwd, including cross-worktree cwd ownership with rollback",
|
|
"manual and runtime-controller local PTY shutdown retain listener and provider ownership until physical exit",
|
|
"did-finish-load orphan cleanup disposes data delivery but retains the onExit listener and tracker through physical exit",
|
|
"a failed local PTY kill retains retryable provider ownership until a later physical exit"
|
|
]
|
|
},
|
|
{
|
|
"file": "src/main/providers/local-pty-provider.test.ts",
|
|
"assertions": [
|
|
"local shutdown remains pending and owned until node-pty reports physical exit",
|
|
"local process enumeration retains the spawn cwd for destructive ownership fallback",
|
|
"destructive cleanup escalates an existing graceful shutdown without losing its shared exit proof",
|
|
"POSIX graceful shutdown escalates to one bounded SIGKILL when the child ignores SIGTERM",
|
|
"Windows graceful-to-destructive cleanup treats the first ConPTY kill as final and never double-closes the handle",
|
|
"orphan cleanup racing immediate shutdown shares one kill and remains owned until the queued physical exit",
|
|
"timeout and kill failure preserve ownership for a later successful retry"
|
|
]
|
|
},
|
|
{
|
|
"file": "src/main/daemon/pty-subprocess.test.ts",
|
|
"assertions": [
|
|
"rejected graceful and force kills propagate without marking the wrapper dead so retries can signal the same child"
|
|
]
|
|
},
|
|
{
|
|
"file": "src/main/daemon/session.test.ts",
|
|
"assertions": [
|
|
"graceful daemon termination force-kills after its deadline but retains session ownership and late output until physical exit",
|
|
"rejected graceful and force kills reopen termination state for a later retry"
|
|
]
|
|
},
|
|
{
|
|
"file": "src/main/daemon/terminal-host.test.ts",
|
|
"assertions": [
|
|
"immediate daemon kill remains pending and listed until the subprocess exit callback",
|
|
"an unconfirmed immediate kill rejects at the bounded deadline, retains ownership, and blocks same-id replacement"
|
|
]
|
|
},
|
|
{
|
|
"file": "src/main/daemon/terminal-host-session-reaping-leak.test.ts",
|
|
"assertions": [
|
|
"immediate daemon kill reaps the emulator and session only after physical exit"
|
|
]
|
|
},
|
|
{
|
|
"file": "src/main/runtime/file-watcher-host.test.ts",
|
|
"assertions": [
|
|
"same-root clients share one physical watch and one client abort cannot cancel another owner's setup",
|
|
"concurrent pre-ready cancellations join one native root release before an immediate replacement subscribes",
|
|
"10,000 cancelled runtime-root callers detach while one setup anchor remains",
|
|
"root-scoped destructive cleanup joins an in-progress subscriber teardown",
|
|
"shard failure preserves existing subscribers through isolated recovery and rejects stale-generation events",
|
|
"only failed isolated recovery ends subscribers, after a conservative overflow",
|
|
"initial setup failure remains discoverable by root-scoped destructive cleanup until physical exit"
|
|
]
|
|
},
|
|
{
|
|
"file": "src/main/runtime/orca-runtime-files-watch.test.ts",
|
|
"assertions": [
|
|
"Windows runtime cleanup waits for the native close event, fails closed at a bounded deadline, and clears retained ownership on late close without retry listeners",
|
|
"a Windows watcher error before cleanup uses Node's proven native error-close as physical-exit proof, emits final overflow and terminal error, and releases deletion ownership",
|
|
"pre-publication local runtime setup failure remains owned through destructive cleanup",
|
|
"failed deletion re-arms runtime watches immediately after ordinary teardown or after delayed physical exit, without reviving a logically stopped watch"
|
|
]
|
|
},
|
|
{
|
|
"file": "src/main/runtime/worktree-teardown.test.ts",
|
|
"assertions": [
|
|
"overlapping runtime, provider, and registry sweeps stay behind one physical PTY-stop promise",
|
|
"destructive teardown rejects instead of releasing deletion when physical stop misses its deadline",
|
|
"cwd-owned and floating PTYs are swept while legacy rows without cwd retain prefix ownership",
|
|
"remote provider enumeration matches authoritative worktree ownership without touching the local-only registry"
|
|
]
|
|
},
|
|
{
|
|
"file": "src/main/runtime/orca-runtime.test.ts",
|
|
"assertions": [
|
|
"destructive worktree teardown awaits controller stopAndWait instead of treating fire-and-forget kill as physical exit",
|
|
"runtime worktree deletion never starts Git removal when a known PTY cannot be physically stopped",
|
|
"SSH runtime deletion shuts down an authoritatively owned remote PTY before remote Git removal",
|
|
"a delayed physical-exit retry remains scoped to its registered cleanup owner and cannot tear down a same-id replacement",
|
|
"failed CLI worktree deletion restores watcher ownership after releasing the install fence",
|
|
"cross-layer teardown failure joins every bounded watcher close before restoration begins"
|
|
]
|
|
},
|
|
{
|
|
"file": "src/main/runtime/rpc/methods/files.test.ts",
|
|
"assertions": [
|
|
"pre-ready transport abort reaches RuntimeFileCommands as the owning AbortSignal",
|
|
"terminal watcher loss flushes a final overflow change before error/end and unregisters cleanup"
|
|
]
|
|
},
|
|
{
|
|
"file": "src/main/runtime/rpc/methods/files-watch-cancellation.test.ts",
|
|
"assertions": [
|
|
"the server publishes a cleanup token before ready and files.unwatch aborts pending setup without delivering queued crawl events"
|
|
]
|
|
},
|
|
{
|
|
"file": "src/main/runtime/rpc/methods/files-watch-cleanup.test.ts",
|
|
"assertions": [
|
|
"a failed paired-web unwatch retries after already-resolved or late physical exit and emits stream end exactly once"
|
|
]
|
|
},
|
|
{
|
|
"file": "src/main/providers/ssh-filesystem-provider-watch-waiters.test.ts",
|
|
"assertions": [
|
|
"10,000 cancelled SSH callers detach while one registration-owned setup anchor remains"
|
|
]
|
|
},
|
|
{
|
|
"file": "src/main/providers/ssh-filesystem-provider.test.ts",
|
|
"assertions": [
|
|
"an SSH caller abort rejects promptly without cancelling another same-root subscriber's shared setup",
|
|
"the physical relay request is cancelled when the last pending subscriber leaves",
|
|
"provider disposal cancels pending setup and sends one remote unwatch",
|
|
"equivalent Windows spellings share one provider generation and terminal failure reaches the surviving owner"
|
|
]
|
|
},
|
|
{
|
|
"file": "src/main/providers/ssh-pty-provider.test.ts",
|
|
"assertions": [
|
|
"remote process enumeration preserves authoritative worktree ownership while scoping relay PTY ids to the SSH connection"
|
|
]
|
|
},
|
|
{
|
|
"file": "src/shared/cross-platform-path.test.ts",
|
|
"assertions": [
|
|
"comparison keys preserve literal POSIX backslashes while folding Windows drive and UNC spellings"
|
|
]
|
|
},
|
|
{
|
|
"file": "src/renderer/src/runtime/runtime-file-client.test.ts",
|
|
"assertions": [
|
|
"terminal error evicts the shared renderer watch before an error callback can synchronously retry",
|
|
"the old stream's later end cannot evict or orphan the replacement stream",
|
|
"the end response releases retained preload and main-process subscription bookkeeping",
|
|
"a later same-root listener opens a fresh server subscription instead of reusing a dead stream"
|
|
]
|
|
},
|
|
{
|
|
"file": "src/relay/relay-watcher-parent-removal.test.ts",
|
|
"assertions": [
|
|
"POSIX and Windows parent deletion closes and terminally notifies descendant watches before removal while preserving path siblings",
|
|
"parent deletion waits for descendant setup publication and already-retiring descendant teardown before removal"
|
|
]
|
|
},
|
|
{
|
|
"file": "src/relay/relay-watcher-pending-setup-waiters.test.ts",
|
|
"assertions": [
|
|
"10,000 aborted relay setup callers detach while one same-root teardown anchor remains and only one replacement installs"
|
|
]
|
|
},
|
|
{
|
|
"file": "src/relay/relay-watcher-setup-wait.test.ts",
|
|
"assertions": [
|
|
"10,000 cancelled relay setup callers leave exactly one explicit anchor and one base-promise reaction"
|
|
]
|
|
},
|
|
{
|
|
"file": "src/relay/relay-filesystem-watch-registry.test.ts",
|
|
"assertions": [
|
|
"each SSH host keeps its own healthy watcher supervisor while a standard repository's three distinct roots share that one child",
|
|
"shared-child failure moves those roots into separate quarantine supervisors with overflow and resumed events",
|
|
"replacement emits overflow before later ordered events",
|
|
"terminal shard failure preserves same-root clients through recovery",
|
|
"pending setup aborts only after the last same-root client leaves",
|
|
"relay-side removal sends every client a terminal failure, closes every watch, and fences new same-root watcher or PTY setup even when deletion fails",
|
|
"a missing child fails closed even if the relay inherits a VITEST environment"
|
|
]
|
|
},
|
|
{
|
|
"file": "src/relay/fs-handler.test.ts",
|
|
"assertions": [
|
|
"shared watches retain the twenty-root budget and release after every client leaves",
|
|
"recursive relay deletion closes and terminally notifies same-root watches before removing the directory"
|
|
]
|
|
},
|
|
{
|
|
"file": "src/relay/pty-handler.test.ts",
|
|
"assertions": [
|
|
"immediate relay shutdown stays pending with the PTY map entry retained until onExit",
|
|
"a missing exit rejects at the bounded deadline, preserves the physical owner, and a retry joins without duplicate SIGKILL",
|
|
"Windows relay graceful, fallback, immediate, stale-spawn, exit-dispose, and handler-dispose paths issue at most one ConPTY kill",
|
|
"relay PTY admission succeeds when post-Node-18 array copy methods are unavailable",
|
|
"attach dead-PID proof settles a concurrent immediate shutdown before the stale PTY entry is reaped",
|
|
"concurrent spawn and revive admission is atomic, capped at fifty physical PTYs, and same-id revive is deduplicated",
|
|
"worktree removal waits explicit and default-cwd PTY creation, rejects later creation, and physically stops only authoritative matching PTYs before deletion",
|
|
"relay spawn and revive fence distinct worktree-ID and cwd roots, rolling back earlier admissions in reverse when either root is removing"
|
|
]
|
|
},
|
|
{
|
|
"file": "src/renderer/src/web/web-runtime-client.test.ts",
|
|
"assertions": [
|
|
"a stopped pre-ready paired-web watch retains its callback beyond the former deadline and uses the early server token to unwatch",
|
|
"transient shared-socket loss replays an active file watch under a new transport id while preserving its logical handle and never revives a stopped watch"
|
|
]
|
|
},
|
|
{
|
|
"file": "src/relay/git-handler.test.ts",
|
|
"assertions": [
|
|
"remote Git worktree removal executes inside the relay filesystem watcher fence"
|
|
]
|
|
},
|
|
{
|
|
"file": "src/relay/subprocess.test.ts",
|
|
"assertions": [
|
|
"the real relay bundle serves PTY, filesystem, and Git requests with its adjacent watcher child",
|
|
"the Node-18-targeted relay bundle contains no unsupported array copy methods"
|
|
]
|
|
},
|
|
{
|
|
"file": "src/main/ssh/ssh-relay-versioned-install.test.ts",
|
|
"assertions": [
|
|
"remote completeness requires relay.js, relay-watcher.js, and the install sentinel"
|
|
]
|
|
},
|
|
{
|
|
"file": "config/scripts/package-electron-runtime-contract.test.mjs",
|
|
"assertions": [
|
|
"every release platform packages and gates the hashed watcher child"
|
|
]
|
|
},
|
|
{
|
|
"file": "config/scripts/runtime-file-watcher-resource-probe.mjs",
|
|
"assertions": [
|
|
"five healthy roots share one exact watcher PID within the per-child RSS budget",
|
|
"four quarantine roots use exactly four child PIDs and remain within the global eight-child reservation cap",
|
|
"CPU and RSS are sampled for every exact child PID and every PID exits during cleanup",
|
|
"per-child and aggregate RSS and sampled CPU ceilings fail the probe before the physical child cap can hide excess resource use"
|
|
]
|
|
},
|
|
{
|
|
"file": "config/scripts/runtime-file-watcher-fault-harness.mjs",
|
|
"assertions": [
|
|
"the built watcher entry delivers an event before fault injection",
|
|
"the harness parent survives watcher-child SIGSEGV",
|
|
"the real supervisor automatically replaces the child, resubscribes, and delivers a post-crash event"
|
|
]
|
|
},
|
|
{
|
|
"file": "config/scripts/relay-watcher-fault-harness.mjs",
|
|
"assertions": [
|
|
"the built relay and existing PTY survive watcher-child fault injection",
|
|
"replacement emits overflow and a precise post-crash event"
|
|
]
|
|
}
|
|
],
|
|
"evidenceRuns": [
|
|
{
|
|
"date": "2026-07-13",
|
|
"runner": "local",
|
|
"platform": "macos",
|
|
"command": "pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/filesystem-watcher.test.ts src/main/ipc/filesystem-watcher-native-capacity.test.ts src/main/ipc/parcel-watcher-child-registry.test.ts src/main/ipc/parcel-watcher-child-launch.test.ts src/main/ipc/parcel-watcher-process.test.ts src/main/ipc/parcel-watcher-supervisor-capacity-wait.test.ts src/main/ipc/parcel-watcher-supervisor-capacity.test.ts src/main/ipc/parcel-watcher-disconnect-termination.test.ts src/main/ipc/runtime-watcher-pending-assignment.test.ts src/main/ipc/runtime-watcher-process-pool.test.ts src/main/ipc/parcel-watcher-process-entry.test.ts src/main/ipc/parcel-watcher-event-delivery.test.ts src/main/ipc/filesystem-watcher-local-unsubscribe.test.ts src/main/ipc/filesystem-watcher-wsl.test.ts src/main/ipc/worktrees.test.ts src/main/ipc/watcher-removal-gate.test.ts src/main/runtime/file-watcher-host.test.ts src/main/runtime/orca-runtime-files-watch.test.ts src/main/runtime/worktree-teardown.test.ts src/main/runtime/orca-runtime.test.ts src/main/runtime/rpc/methods/files.test.ts src/main/runtime/rpc/methods/files-watch-cancellation.test.ts src/main/providers/ssh-filesystem-provider-watch-waiters.test.ts src/main/providers/ssh-filesystem-provider.test.ts src/renderer/src/runtime/runtime-file-client.test.ts src/renderer/src/web/web-runtime-client.test.ts src/shared/cross-platform-path.test.ts src/shared/physical-exit-tracker.test.ts src/shared/promise-settlement-waiters.test.ts src/main/ipc/pty.test.ts src/main/providers/local-pty-provider.test.ts src/main/daemon/daemon-pty-adapter.test.ts src/main/daemon/pty-subprocess.test.ts src/main/daemon/session.test.ts src/main/daemon/terminal-host.test.ts src/main/daemon/terminal-host-session-reaping-leak.test.ts src/main/providers/ssh-pty-provider.test.ts src/relay/relay-watcher-setup-wait.test.ts src/relay/pty-handler.test.ts --reporter=dot",
|
|
"result": "passed",
|
|
"durationSeconds": 11.98,
|
|
"summary": "Thirty-nine watcher, cancellation, desktop/serve, paired-web, WSL, SSH/relay, removal, and PTY physical-exit files passed with 2,008 tests. Capacity, quarantine, runtime-root, relay, and SSH setup layers each prove that 10,000 aborted callers detach while one anchor remains and zero waiters remain after settlement."
|
|
},
|
|
{
|
|
"date": "2026-07-13",
|
|
"runner": "local",
|
|
"platform": "macos",
|
|
"command": "pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/filesystem-watcher.test.ts src/main/ipc/filesystem-watcher-native-capacity.test.ts src/main/ipc/parcel-watcher-child-registry.test.ts src/main/ipc/parcel-watcher-child-launch.test.ts src/main/ipc/parcel-watcher-process.test.ts src/main/ipc/parcel-watcher-supervisor-capacity.test.ts src/main/ipc/parcel-watcher-disconnect-termination.test.ts src/main/ipc/runtime-watcher-process-pool.test.ts src/main/ipc/parcel-watcher-process-entry.test.ts src/main/ipc/parcel-watcher-event-delivery.test.ts src/main/ipc/filesystem-watcher-local-unsubscribe.test.ts src/main/ipc/filesystem-watcher-wsl.test.ts src/main/ipc/worktrees.test.ts src/main/ipc/watcher-removal-gate.test.ts src/main/runtime/file-watcher-host.test.ts src/main/runtime/orca-runtime-files-watch.test.ts src/main/runtime/worktree-teardown.test.ts src/main/runtime/orca-runtime.test.ts src/main/runtime/rpc/methods/files.test.ts src/main/runtime/rpc/methods/files-watch-cancellation.test.ts src/main/providers/ssh-filesystem-provider.test.ts src/renderer/src/runtime/runtime-file-client.test.ts src/renderer/src/web/web-runtime-client.test.ts src/shared/cross-platform-path.test.ts src/shared/physical-exit-tracker.test.ts src/main/ipc/pty.test.ts src/main/providers/local-pty-provider.test.ts src/main/daemon/daemon-pty-adapter.test.ts src/main/daemon/pty-subprocess.test.ts src/main/daemon/session.test.ts src/main/daemon/terminal-host.test.ts src/main/daemon/terminal-host-session-reaping-leak.test.ts src/main/providers/ssh-pty-provider.test.ts src/relay/pty-handler.test.ts --reporter=dot",
|
|
"result": "passed",
|
|
"durationSeconds": 11.59,
|
|
"summary": "Thirty-four watcher, cancellation, desktop/serve, paired-web, WSL, removal, PTY physical-exit, provider, renderer, and path files passed with 1,999 tests; paired-web cancellation now owns a server token before ready and aborts pending setup without a late native install."
|
|
},
|
|
{
|
|
"date": "2026-07-13",
|
|
"runner": "local",
|
|
"platform": "macos",
|
|
"command": "node config/scripts/runtime-file-watcher-resource-probe.mjs",
|
|
"result": "passed",
|
|
"durationSeconds": 0.58,
|
|
"summary": "Five healthy roots shared one child at 50,688 KiB RSS and 4.9% sampled CPU; four quarantine children totaled 202,368 KiB RSS and 29.5% sampled CPU, all budgets and the eight-child cap passed, and exact-PID cleanup was true."
|
|
},
|
|
{
|
|
"date": "2026-07-13",
|
|
"runner": "local",
|
|
"platform": "macos",
|
|
"command": "pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/filesystem-watcher.test.ts src/main/ipc/parcel-watcher-process.test.ts src/main/ipc/parcel-watcher-disconnect-termination.test.ts src/main/ipc/runtime-watcher-process-pool.test.ts src/main/ipc/parcel-watcher-process-entry.test.ts src/main/ipc/parcel-watcher-event-delivery.test.ts src/main/ipc/filesystem-watcher-local-unsubscribe.test.ts src/main/ipc/filesystem-watcher-wsl.test.ts src/main/ipc/worktrees.test.ts src/main/ipc/watcher-removal-gate.test.ts src/main/runtime/file-watcher-host.test.ts src/main/runtime/orca-runtime-files-watch.test.ts src/main/runtime/worktree-teardown.test.ts src/main/runtime/orca-runtime.test.ts src/main/runtime/rpc/methods/files.test.ts src/main/providers/ssh-filesystem-provider.test.ts src/renderer/src/runtime/runtime-file-client.test.ts src/renderer/src/web/web-runtime-client.test.ts src/shared/cross-platform-path.test.ts src/main/ipc/pty.test.ts src/main/providers/local-pty-provider.test.ts src/main/daemon/pty-subprocess.test.ts src/main/daemon/session.test.ts src/main/daemon/terminal-host.test.ts src/main/daemon/terminal-host-session-reaping-leak.test.ts src/main/providers/ssh-pty-provider.test.ts src/relay/pty-handler.test.ts --reporter=dot",
|
|
"result": "passed",
|
|
"durationSeconds": 10.01,
|
|
"summary": "Twenty-seven watcher, WSL, desktop/serve removal, local/daemon/SSH PTY physical-exit, provider ownership, RPC, renderer, relay PTY admission, and cross-platform path files passed with 1,886 tests. The suite includes nested removal fencing, renderer/runtime cwd-only admission, legacy provider rows, rejected kill retries, transient WSL capacity, and synchronous-startup reservation cleanup."
|
|
},
|
|
{
|
|
"date": "2026-07-13",
|
|
"runner": "local",
|
|
"platform": "macos",
|
|
"command": "node config/scripts/runtime-file-watcher-resource-probe.mjs",
|
|
"result": "passed",
|
|
"durationSeconds": 0.56,
|
|
"summary": "Five healthy roots shared one child at 50,176 KiB RSS and 6.0% sampled CPU; four quarantine children totaled 200,112 KiB RSS and 18.0% sampled CPU. The global eight-child cap and all per-child/aggregate budgets passed, and exact-PID cleanup was true."
|
|
},
|
|
{
|
|
"date": "2026-07-13",
|
|
"runner": "local",
|
|
"platform": "macos",
|
|
"command": "pnpm exec vitest run --config config/vitest.config.ts src/relay/relay-filesystem-watch-registry.test.ts src/relay/fs-handler.test.ts src/relay/git-handler.test.ts src/relay/subprocess.test.ts src/main/ssh/ssh-relay-versioned-install.test.ts config/scripts/package-electron-runtime-contract.test.mjs",
|
|
"result": "passed",
|
|
"durationSeconds": 10.01,
|
|
"summary": "Six relay registry, filesystem/Git handler, bundled subprocess, install, and package contract files passed with 226 tests."
|
|
},
|
|
{
|
|
"date": "2026-07-13",
|
|
"runner": "local",
|
|
"platform": "macos",
|
|
"command": "pnpm run build:electron-vite",
|
|
"result": "passed",
|
|
"durationSeconds": 24.41,
|
|
"summary": "The production Electron main, preload, renderer, daemon, and watcher child entries built successfully."
|
|
},
|
|
{
|
|
"date": "2026-07-13",
|
|
"runner": "local",
|
|
"platform": "macos",
|
|
"command": "node config/scripts/runtime-file-watcher-fault-harness.mjs",
|
|
"result": "passed",
|
|
"durationSeconds": 0.1,
|
|
"summary": "The Node host survived watcher-child SIGSEGV, replaced and resubscribed the child, and delivered a post-crash event."
|
|
},
|
|
{
|
|
"date": "2026-07-13",
|
|
"runner": "local",
|
|
"platform": "macos",
|
|
"command": "ELECTRON_RUN_AS_NODE=1 pnpm exec electron config/scripts/runtime-file-watcher-fault-harness.mjs",
|
|
"result": "passed",
|
|
"durationSeconds": 0.46,
|
|
"summary": "The Electron-as-Node host survived watcher-child SIGSEGV, replaced and resubscribed the child, and delivered a post-crash event."
|
|
},
|
|
{
|
|
"date": "2026-07-13",
|
|
"runner": "local",
|
|
"platform": "macos",
|
|
"command": "pnpm run build:relay",
|
|
"result": "passed",
|
|
"durationSeconds": 0.38,
|
|
"summary": "Relay and adjacent watcher artifacts built for Linux, macOS, and Windows on x64 and arm64, plus the WSL hook relay."
|
|
},
|
|
{
|
|
"date": "2026-07-13",
|
|
"runner": "local",
|
|
"platform": "macos",
|
|
"command": "node config/scripts/relay-watcher-fault-harness.mjs",
|
|
"result": "passed",
|
|
"durationSeconds": 0.12,
|
|
"summary": "The relay and existing PTY survived watcher-child SIGSEGV; replacement delivered overflow and a precise post-crash event."
|
|
},
|
|
{
|
|
"date": "2026-07-13",
|
|
"runner": "local",
|
|
"platform": "macos",
|
|
"command": "pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/parcel-watcher-process.test.ts src/main/ipc/parcel-watcher-disconnect-termination.test.ts src/main/ipc/runtime-watcher-process-pool.test.ts src/main/ipc/parcel-watcher-process-entry.test.ts src/main/ipc/parcel-watcher-event-delivery.test.ts src/main/ipc/filesystem-watcher-local-unsubscribe.test.ts src/main/ipc/filesystem-watcher-wsl.test.ts src/main/ipc/worktrees.test.ts src/main/ipc/watcher-removal-gate.test.ts src/main/runtime/file-watcher-host.test.ts src/main/runtime/orca-runtime-files-watch.test.ts src/main/runtime/worktree-teardown.test.ts src/main/runtime/orca-runtime.test.ts src/main/runtime/rpc/methods/files.test.ts src/main/providers/ssh-filesystem-provider.test.ts src/renderer/src/runtime/runtime-file-client.test.ts src/renderer/src/web/web-runtime-client.test.ts src/shared/cross-platform-path.test.ts src/main/ipc/pty.test.ts src/main/providers/local-pty-provider.test.ts src/main/daemon/session.test.ts src/main/daemon/terminal-host.test.ts src/main/daemon/terminal-host-session-reaping-leak.test.ts src/main/providers/ssh-pty-provider.test.ts src/relay/pty-handler.test.ts",
|
|
"result": "passed",
|
|
"durationSeconds": 9.12,
|
|
"summary": "Twenty-five watcher, WSL, desktop/serve removal, local/daemon/SSH PTY physical-exit, provider ownership, RPC, renderer, relay PTY admission, and cross-platform path files passed with 1,762 tests. The suite covers operations joining in-flight termination, kill failures retaining ownership, bounded timeouts, atomic relay spawn/revive caps, and PTY-removal admission."
|
|
},
|
|
{
|
|
"date": "2026-07-13",
|
|
"runner": "local",
|
|
"platform": "macos",
|
|
"command": "node config/scripts/runtime-file-watcher-resource-probe.mjs",
|
|
"result": "passed",
|
|
"durationSeconds": 0.56,
|
|
"summary": "Five healthy roots shared one child at 50,096 KiB RSS and 3.4% sampled CPU; four quarantine children totaled 200,576 KiB RSS and 25.0% sampled CPU. The eight-child physical cap and every per-child/aggregate CPU and RSS budget passed, and exact-PID cleanup was true."
|
|
},
|
|
{
|
|
"date": "2026-07-13",
|
|
"runner": "local",
|
|
"platform": "macos",
|
|
"command": "pnpm exec vitest run --config config/vitest.config.ts src/relay/relay-filesystem-watch-registry.test.ts src/relay/fs-handler.test.ts src/relay/git-handler.test.ts src/relay/subprocess.test.ts src/main/ssh/ssh-relay-versioned-install.test.ts config/scripts/package-electron-runtime-contract.test.mjs",
|
|
"result": "passed",
|
|
"durationSeconds": 10.69,
|
|
"summary": "Six relay registry, filesystem/Git handler, bundled subprocess, install, and package contract files passed with 226 tests, including watcher/PTY removal fencing and recursive deletion failure behavior."
|
|
},
|
|
{
|
|
"date": "2026-07-13",
|
|
"runner": "local",
|
|
"platform": "macos",
|
|
"command": "pnpm run build:electron-vite",
|
|
"result": "passed",
|
|
"durationSeconds": 24,
|
|
"summary": "The production Electron main, preload, renderer, daemon, and watcher child entries built successfully."
|
|
},
|
|
{
|
|
"date": "2026-07-13",
|
|
"runner": "local",
|
|
"platform": "macos",
|
|
"command": "node config/scripts/runtime-file-watcher-fault-harness.mjs",
|
|
"result": "passed",
|
|
"durationSeconds": 0.01,
|
|
"summary": "The Node host survived watcher-child SIGSEGV, replaced and resubscribed the child, and delivered a post-crash event."
|
|
},
|
|
{
|
|
"date": "2026-07-13",
|
|
"runner": "local",
|
|
"platform": "macos",
|
|
"command": "ELECTRON_RUN_AS_NODE=1 pnpm exec electron config/scripts/runtime-file-watcher-fault-harness.mjs",
|
|
"result": "passed",
|
|
"durationSeconds": 0.46,
|
|
"summary": "The Electron-as-Node host survived watcher-child SIGSEGV, replaced and resubscribed the child, and delivered a post-crash event."
|
|
},
|
|
{
|
|
"date": "2026-07-13",
|
|
"runner": "local",
|
|
"platform": "macos",
|
|
"command": "pnpm run build:relay",
|
|
"result": "passed",
|
|
"durationSeconds": 0.39,
|
|
"summary": "Relay and adjacent watcher artifacts built for Linux, macOS, and Windows on x64 and arm64, plus the WSL hook relay."
|
|
},
|
|
{
|
|
"date": "2026-07-13",
|
|
"runner": "local",
|
|
"platform": "macos",
|
|
"command": "node config/scripts/relay-watcher-fault-harness.mjs",
|
|
"result": "passed",
|
|
"durationSeconds": 0.12,
|
|
"summary": "The relay and existing PTY survived watcher-child SIGSEGV; replacement delivered overflow and a precise post-crash event."
|
|
},
|
|
{
|
|
"date": "2026-07-13",
|
|
"runner": "local",
|
|
"platform": "macos",
|
|
"command": "pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/parcel-watcher-process.test.ts src/main/ipc/parcel-watcher-disconnect-termination.test.ts src/main/ipc/runtime-watcher-process-pool.test.ts src/main/ipc/parcel-watcher-process-entry.test.ts src/main/ipc/parcel-watcher-event-delivery.test.ts src/main/ipc/filesystem-watcher-local-unsubscribe.test.ts src/main/ipc/filesystem-watcher-wsl.test.ts src/main/ipc/worktrees.test.ts src/main/ipc/watcher-removal-gate.test.ts src/main/runtime/file-watcher-host.test.ts src/main/runtime/orca-runtime-files-watch.test.ts src/main/runtime/worktree-teardown.test.ts src/main/runtime/orca-runtime.test.ts src/main/runtime/rpc/methods/files.test.ts src/main/providers/ssh-filesystem-provider.test.ts src/renderer/src/runtime/runtime-file-client.test.ts src/renderer/src/web/web-runtime-client.test.ts src/shared/cross-platform-path.test.ts src/main/ipc/pty.test.ts src/main/daemon/terminal-host.test.ts src/main/daemon/terminal-host-session-reaping-leak.test.ts src/main/providers/ssh-pty-provider.test.ts src/relay/pty-handler.test.ts",
|
|
"result": "passed",
|
|
"durationSeconds": 9.03,
|
|
"summary": "Twenty-three watcher, desktop/serve removal, terminal-spawn gate, daemon/SSH physical PTY exit, provider ownership, RPC, renderer, and cross-platform path files passed with 1,630 tests. The suite includes same-turn watcher replacement, authoritative SSH teardown before Git, bounded kill-without-exit failures that retain ownership, and local/SSH deletion fail-closed behavior."
|
|
},
|
|
{
|
|
"date": "2026-07-13",
|
|
"runner": "local",
|
|
"platform": "macos",
|
|
"command": "node config/scripts/runtime-file-watcher-resource-probe.mjs",
|
|
"result": "passed",
|
|
"durationSeconds": 0.55,
|
|
"summary": "Five healthy roots shared one child at 50,160 KiB RSS and 5.6% sampled CPU; four quarantine children totaled 199,968 KiB RSS and 16.7% sampled CPU, hard per-child and aggregate RSS/CPU budgets passed, the eight-child reservation cap rejected the next launch, and every exact PID exited during cleanup."
|
|
},
|
|
{
|
|
"date": "2026-07-13",
|
|
"runner": "local",
|
|
"platform": "macos",
|
|
"command": "pnpm exec vitest run --config config/vitest.config.ts src/relay/relay-filesystem-watch-registry.test.ts src/relay/fs-handler.test.ts src/relay/git-handler.test.ts src/relay/subprocess.test.ts src/main/ssh/ssh-relay-versioned-install.test.ts config/scripts/package-electron-runtime-contract.test.mjs",
|
|
"result": "passed",
|
|
"durationSeconds": 9.79,
|
|
"summary": "Six relay registry, filesystem/Git handler, bundled subprocess, install, and package contract files passed with 225 tests, including terminal removal notification and recursive deletion fencing."
|
|
},
|
|
{
|
|
"date": "2026-07-12",
|
|
"runner": "local",
|
|
"platform": "macos",
|
|
"command": "node config/scripts/relay-watcher-fault-harness.mjs",
|
|
"result": "passed",
|
|
"durationSeconds": 0.61,
|
|
"summary": "The relay PID and existing PTY survived watcher-child SIGSEGV; overflow and precise events resumed from a replacement child."
|
|
},
|
|
{
|
|
"date": "2026-07-13",
|
|
"runner": "local",
|
|
"platform": "macos",
|
|
"command": "pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/parcel-watcher-process.test.ts src/main/ipc/parcel-watcher-disconnect-termination.test.ts src/main/ipc/runtime-watcher-process-pool.test.ts src/main/ipc/parcel-watcher-process-entry.test.ts src/main/ipc/parcel-watcher-event-delivery.test.ts src/main/ipc/filesystem-watcher-local-unsubscribe.test.ts src/main/ipc/filesystem-watcher-wsl.test.ts src/main/ipc/worktrees.test.ts src/main/ipc/watcher-removal-gate.test.ts src/main/runtime/file-watcher-host.test.ts src/main/runtime/orca-runtime-files-watch.test.ts src/main/runtime/worktree-teardown.test.ts src/main/runtime/orca-runtime.test.ts src/main/runtime/rpc/methods/files.test.ts src/main/providers/ssh-filesystem-provider.test.ts src/renderer/src/runtime/runtime-file-client.test.ts src/renderer/src/web/web-runtime-client.test.ts src/shared/cross-platform-path.test.ts",
|
|
"result": "passed",
|
|
"durationSeconds": 8.85,
|
|
"summary": "18 focused supervisor, disconnect termination, pool, child-entry, delivery, desktop/WSL cleanup and IPC removal, removal-gate, runtime-host/commands and physical PTY teardown, RPC, SSH ownership, renderer/paired-web clients, and cross-platform path files passed with 1,193 tests."
|
|
},
|
|
{
|
|
"date": "2026-07-12",
|
|
"runner": "local",
|
|
"platform": "macos",
|
|
"command": "node config/scripts/runtime-file-watcher-fault-harness.mjs",
|
|
"result": "passed",
|
|
"durationSeconds": 5,
|
|
"summary": "All 26 built-entry SIGSEGV injections preserved the parent, replaced and resubscribed the child, and delivered a post-crash event; watcher-canary temp-directory count remained 6 before and after the final five-run leak check."
|
|
},
|
|
{
|
|
"date": "2026-07-11",
|
|
"runner": "local",
|
|
"platform": "macos",
|
|
"command": "node config/scripts/runtime-file-watcher-fault-harness.mjs",
|
|
"result": "passed",
|
|
"durationSeconds": 0.3,
|
|
"summary": "The source-bundled real supervisor delivered through the built child before and after SIGSEGV; the parent survived and automatic resubscription used a replacement PID."
|
|
},
|
|
{
|
|
"date": "2026-07-11",
|
|
"runner": "local",
|
|
"platform": "macos",
|
|
"command": "node config/scripts/runtime-file-watcher-fault-harness.mjs",
|
|
"result": "passed",
|
|
"durationSeconds": 2.2,
|
|
"summary": "Ten consecutive invocations survived, automatically replaced and resubscribed the child, and delivered a post-crash event. The watcher-canary temp-directory count remained 8 before and after the loop."
|
|
}
|
|
],
|
|
"runtimeBudget": {
|
|
"p95Seconds": 60,
|
|
"scope": "focused process/RPC contract tests plus built child fault harness"
|
|
},
|
|
"flakeHistory": {
|
|
"status": "unknown",
|
|
"evidence": "New deterministic unit coverage and ten consecutive local built-entry harness passes; still below the CI and soak history required for promotion."
|
|
},
|
|
"redGreenEvidence": {
|
|
"status": "partial",
|
|
"evidence": "Red tests reproduced the reviewed failures: IPC disconnect-before-exit orphaned existing roots, queue-admission deadlines cascaded shard replacement, a fused shard created one child per root, a standard SSH repository created three healthy watcher supervisors, destructive desktop cleanup waited indefinitely for native setup, and synchronous renderer retry joined a terminal stream. Earlier red coverage also reproduced missing-entry fail-open, terminal recovery loss, stale same-root lease deletion, and unbounded per-child stat lanes. The bounded quarantine and cancellation rewrite passes those contracts, the relay-specific healthy width test reduces the three-root case to one supervisor, and the real-supervisor built-entry harness survives SIGSEGV with automatic replacement. CI/soak history is still absent."
|
|
},
|
|
"performanceBudget": {
|
|
"required": true,
|
|
"evidence": "The committed resource probe reproducibly measures five healthy roots sharing one child (50,160 KiB RSS, 5.6% sampled CPU) and four quarantine children (199,968 KiB total RSS, 16.7% sampled CPU), enforces 128 MiB/50% per-child and 512 MiB/100% quarantine aggregate budgets, derives a 1 GiB/400% ceiling across the global eight-physical-child cap, and waits for every exact PID during cleanup. A relay policy test separately proves a standard SSH repository's three roots share one healthy child. Shared pending setup attaches one base-promise reaction per generation; quantitative owner tests abort 10,000 callers at each affected layer and require exactly one anchor, then zero explicit waiters after settlement. The shared supervisor capacity barrier is event-driven, one-shot, abortable, and serialized per released physical slot, waking every same-child desktop, paired-runtime, or SSH relay root without consuming crash-recovery attempts; direct WSL capacity retains the same event-driven desktop retry. Relay PTY admission adds at most two deduplicated path checks per spawn/revive and releases both without polling or retained listeners, while dead-PID reaping settles an existing tracker without allocating another timer. Fault quarantine distributes affected roots by least load, disposes empty slots, and permits no replacement after a quarantine shard itself fuses. Each child caps directory stats at eight across its assigned roots (at most eight healthy or 32 quarantined operations), each subscription retains at most one active plus one bounded pending batch, and no additional polling or serve-process stat fanout is added."
|
|
},
|
|
"promotionCriteria": [
|
|
"Run the built-entry SIGSEGV harness in soak for at least 100 consecutive passes or 14 days on macOS.",
|
|
"Add an eight-root/six-writer event-loop-delay soak artifact with an explicit latency budget.",
|
|
"Add a packaged orca serve pairing scenario that proves a connected client refreshes after child replacement."
|
|
],
|
|
"knownGaps": [
|
|
"The fault harness bundles the real source supervisor and drives the built child, but it does not launch a packaged orca serve pairing session or exercise app.asar path resolution.",
|
|
"The committed resource probe covers the one-child healthy pool, four-child fault-quarantine ceiling, RSS/CPU sampling, global physical-child cap, and exact-PID cleanup, but sustained six-writer event-loop-delay and CPU soak evidence is still absent.",
|
|
"Linux native watcher fault containment is source-equivalent but not live fault-injected in this evidence run.",
|
|
"Windows native runtime watches bypass this child path; WSL reservation/release is deterministic-contract tested but not live fault-injected, and SSH registration ownership is not live-relay fault-injected."
|
|
],
|
|
"demotionRule": "Demote or quarantine if the fault harness flakes without a product or harness bug, if healthy operation exceeds one runtime watcher child, if total physical operation exceeds eight children including retiring generations, if quarantine children outlive their roots or repeat after fusing, if event delivery becomes unbounded, or if metadata/stat work returns to the serve process."
|
|
}
|
|
]
|
|
}
|