xiaoxue_admin
/
orca
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
orca/config/reliability-gates.jsonc

7398 lines
500 KiB
Plaintext
Raw Blame History

{
"schemaVersion": 1,
"updatedAt": "2026-07-28",
"policy": {
"maturityLevels": [
"experimental",
"soak",
"blocking",
"accepted-gap",
"deprecated"
],
"blockingPromotion": {
"minimumSoakRuns": 100,
"minimumSoakDays": 14,
"maximumUnexplainedFlakes": 0
}
},
"gates": [
{
"id": "mobile-relay.endpoint-recovery",
"title": "Mobile relay recovery retries offline hosts and races direct endpoints",
"maturity": "experimental",
"protection": "partial",
"owner": "mobile-runtime",
"layer": "shared-mobile-transport-contract",
"surfaces": [
"paired mobile reconnect",
"cloud relay host-offline recovery",
"LAN direct endpoint",
"Tailscale direct endpoint"
],
"platforms": [
"ios",
"android",
"macos",
"linux",
"windows"
],
"providers": [
"lan",
"tailscale",
"cloud-relay"
],
"coveredPlatforms": [
"macos"
],
"coveredProviders": [
"lan",
"tailscale",
"cloud-relay"
],
"coverageNotes": "Deterministic TypeScript tests cover shared close-code policy, foreground retry timers, direct-winner cancellation, and concurrent LAN/Tailscale authentication. Physical iOS/Android radios, GFE, and production relay recovery remain live-test gaps.",
"motivatingLinks": [
"https://github.com/stablyai/orca-cloud/pull/96"
],
"invariant": "A foregrounded paired phone must recover from relay HOST_OFFLINE without a foreground or network-change signal, while direct recovery must select the first authenticated configured LAN or Tailscale endpoint without serial timeout delays. Backgrounding, direct success, or stop must cancel pending work, and losing probes must close without affecting the winner.",
"oracle": "Inject deterministic relay close codes, random bytes, fake timers, and independently controlled direct clients. Require HOST_OFFLINE to replace any faster transport timer with one 5-15 second retry, require no retry before the selected delay, race all unique non-relay endpoints, select the first authenticated path, close every loser exactly once, and retain no retry after direct connectivity wins.",
"commands": [
"pnpm --dir mobile exec vitest run --root .. mobile/src/transport/mobile-direct-endpoint-probe.test.ts mobile/src/transport/mobile-relay-reconnect-controller.test.ts mobile/src/transport/mobile-endpoint-supervisor.test.ts",
"pnpm exec vitest run --config config/vitest.config.ts src/shared/mobile-relay-close-codes.test.ts --reporter=dot"
],
"testFiles": [
"mobile/src/transport/mobile-direct-endpoint-probe.test.ts",
"mobile/src/transport/mobile-relay-reconnect-controller.test.ts",
"mobile/src/transport/mobile-endpoint-supervisor.test.ts",
"src/shared/mobile-relay-close-codes.test.ts"
],
"assertionRefs": [
{
"file": "mobile/src/transport/mobile-direct-endpoint-probe.test.ts",
"assertions": [
"a reachable Tailscale endpoint authenticates without waiting for a stale primary LAN timeout",
"the stale direct candidate closes while the authenticated winner stays open"
]
},
{
"file": "mobile/src/transport/mobile-relay-reconnect-controller.test.ts",
"assertions": [
"HOST_OFFLINE replaces a pending capacity retry with the bounded host-offline delay",
"direct connectivity cancels the pending relay retry"
]
},
{
"file": "mobile/src/transport/mobile-endpoint-supervisor.test.ts",
"assertions": [
"a foregrounded supervisor retries HOST_OFFLINE without an external lifecycle signal"
]
},
{
"file": "src/shared/mobile-relay-close-codes.test.ts",
"assertions": [
"HOST_OFFLINE maps to self-healing full-jitter recovery"
]
}
],
"evidenceRuns": [
{
"date": "2026-07-25",
"runner": "local",
"platform": "macos",
"command": "pnpm --dir mobile exec vitest run --root .. mobile/src/transport/mobile-direct-endpoint-probe.test.ts mobile/src/transport/mobile-relay-reconnect-controller.test.ts mobile/src/transport/mobile-endpoint-supervisor.test.ts",
"result": "passed",
"durationSeconds": 0.89,
"summary": "Three focused mobile transport files passed with 39 assertions."
},
{
"date": "2026-07-25",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/shared/mobile-relay-close-codes.test.ts --reporter=dot",
"result": "passed",
"durationSeconds": 0.19,
"summary": "The shared close-code contract passed with five assertions."
}
],
"runtimeBudget": {
"p95Seconds": 5,
"scope": "focused shared and mobile transport unit tests"
},
"flakeHistory": {
"status": "unknown",
"evidence": "Two deterministic local runs exist; CI and soak history are not yet available."
},
"redGreenEvidence": {
"status": "complete",
"evidence": "The prior external-signal HOST_OFFLINE policy fails the retry oracle, and the prior serial direct probe fails the first-authenticated-endpoint timing oracle. Both pass with the candidate behavior."
},
"performanceBudget": {
"required": true,
"evidence": "All configured direct candidates start in one turn, the first authenticated candidate wins after 100 ms in the deterministic test, and every losing client is closed. A physical-device radio and battery budget is still required before promotion."
},
"promotionCriteria": [
"Collect 100 consecutive CI passes or 14 days of soak history.",
"Run paired iOS and Android recovery through production-like GFE HOST_OFFLINE responses.",
"Measure reconnect radio and battery impact for the 5-15 second foreground retry window."
],
"knownGaps": [
"No physical iOS or Android device was exercised.",
"The deterministic transport seam does not measure production GFE, carrier NAT, DNS, TLS, or Cloud SQL latency.",
"Background-to-foreground recovery remains covered by existing supervisor tests but lacks a physical sleep/wake run."
],
"demotionRule": "Keep experimental or demote if focused tests flake, HOST_OFFLINE can park indefinitely, direct probes serialize configured endpoints, loser cleanup leaks clients, or physical-device radio cost exceeds the measured budget."
},
{
"id": "desktop-relay.assignment-backpressure",
"title": "Desktop relay drain recovery cannot amplify a director outage",
"maturity": "experimental",
"protection": "partial",
"owner": "desktop-runtime",
"layer": "main-relay-state-machine",
"surfaces": [
"desktop relay drain recovery",
"director assignment overload",
"relay broker shutdown"
],
"platforms": [
"macos",
"linux",
"windows"
],
"providers": [
"cloud-relay"
],
"coveredPlatforms": [
"macos"
],
"coveredProviders": [
"cloud-relay"
],
"coverageNotes": "Deterministic main-process tests cover duplicate drain notifications, full-jitter backoff, Retry-After during initial setup and drain recovery, successful recovery, and broker-close cleanup. Packaged desktop, mixed-version fleets, GFE, and production Cloud SQL remain live-test gaps.",
"motivatingLinks": [
"https://github.com/stablyai/orca-cloud/actions/runs/30223521062"
],
"invariant": "One relay host may have at most one assignment attempt or retry timer per recovery path. Sustained director failure must increase the retry window up to five minutes, a bounded Retry-After must be respected during initial setup and drain recovery, shutdown must cancel pending work, and recovery must activate the authoritative assigned origin.",
"oracle": "Inject duplicate drain events, deterministic randomness, fake time, repeated assignment failures, a 30-second Retry-After during initial setup and drain recovery, broker close, and eventual director recovery. Count every assignment call, require 500 ms then 1,000 ms retry windows, reject duplicate fanout, require no pre-hint retry or post-close work, and prove the recovered cell becomes authoritative.",
"commands": [
"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/relay/relay-session-broker.test.ts src/main/runtime/relay/relay-http-client.test.ts src/main/runtime/relay/relay-auth-coordinator-recovery.test.ts --reporter=dot"
],
"testFiles": [
"src/main/runtime/relay/relay-session-broker.test.ts",
"src/main/runtime/relay/relay-http-client.test.ts",
"src/main/runtime/relay/relay-auth-coordinator-recovery.test.ts"
],
"assertionRefs": [
{
"file": "src/main/runtime/relay/relay-session-broker.test.ts",
"assertions": [
"duplicate drain notifications share one exponentially backed-off retry schedule",
"Retry-After suppresses early assignment requests",
"broker close prevents retry resurrection",
"a later successful assignment activates the new origin"
]
},
{
"file": "src/main/runtime/relay/relay-http-client.test.ts",
"assertions": [
"assignment overload preserves a bounded Retry-After hint"
]
},
{
"file": "src/main/runtime/relay/relay-auth-coordinator-recovery.test.ts",
"assertions": [
"initial relay setup does not retry before Retry-After expires"
]
}
],
"evidenceRuns": [
{
"date": "2026-07-26",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/relay/relay-session-broker.test.ts src/main/runtime/relay/relay-http-client.test.ts src/main/runtime/relay/relay-auth-coordinator-recovery.test.ts --reporter=dot",
"result": "passed",
"durationSeconds": 0.49,
"summary": "Three focused relay files passed with 25 assertions."
}
],
"runtimeBudget": {
"p95Seconds": 5,
"scope": "focused desktop relay state-machine tests"
},
"flakeHistory": {
"status": "unknown",
"evidence": "One deterministic local run exists; CI and soak history are not yet available."
},
"redGreenEvidence": {
"status": "complete",
"evidence": "The prior fixed-delay implementation issued a duplicate assignment within 499 ms and ignored Retry-After, while the candidate passes the byte-identical timer and call-count oracle."
},
"performanceBudget": {
"required": true,
"evidence": "One host retains at most one assignment attempt or retry timer, retry windows grow to a five-minute cap, duplicate drain events add no calls, and close leaves no timer-driven work."
},
"promotionCriteria": [
"Collect 100 consecutive CI passes or 14 days of soak history.",
"Run a mixed-version load test with at least the incident-scale desktop population.",
"Verify production director request rate decays during an injected assignment outage."
],
"knownGaps": [
"No packaged desktop or physical phone was exercised.",
"The deterministic seam does not measure production GFE, carrier NAT, DNS, TLS, or Cloud SQL behavior.",
"Legacy desktop versions remain dependent on server-side overload protection."
],
"demotionRule": "Keep experimental or demote if assignment calls overlap, duplicate drain events bypass backoff, Retry-After is ignored, close resurrects work, or mixed-version request rate exceeds the reviewed director budget."
},
{
"id": "git-worktree.refresh-event-semantics",
"title": "Index-only Git metadata cannot trigger structural worktree refresh fanout",
"maturity": "experimental",
"protection": "partial",
"owner": "terminal-runtime",
"layer": "main-preload-renderer-contract",
"surfaces": [
"terminal input availability",
"worktree discovery",
"Source Control status refresh",
"direct SSH detected-worktree scheduling",
"direct SSH reconnect telemetry",
"direct SSH host catalog authority",
"direct SSH generation-scope rollover"
],
"platforms": [
"macos",
"linux",
"windows"
],
"providers": [
"local",
"ssh"
],
"coveredPlatforms": [
"macos"
],
"coveredProviders": [
"local",
"ssh"
],
"coverageNotes": "Local deterministic evidence covers git-common classification, desktop watcher debounce counts, non-overlapping poller semantics, macOS native-watch fallback, preload cleanup, Source Control active-visible repo filtering, the direct SSH five-slot fair scheduler, timeout barrier, aggregate privacy schema, coordinator-to-renderer telemetry wiring, host-catalog provenance rejection, and process generation-scope rollover across sibling targets. A macOS Electron client completed a direct SSH disconnect/reconnect against an ephemeral Linux Docker target with exact host/authority hydration and remote proof-file verification. Linux/Windows desktop clients, multi-target live fanout, paired-client, and WSL runs remain gaps.",
"motivatingLinks": [
"https://github.com/stablyai/orca/pull/7086"
],
"invariant": "Index-only Git activity below the common Git directory must not emit worktrees:changed, invalidate worktree caches, or trigger fetchWorktrees fanout; structural add/remove/HEAD/gitdir/locked/config.worktree changes must still refresh worktrees and nudge Source Control; external head moves (commit, amend, reset) must reach background worktree rows through spawn-free metadata reads, never through structural fanout. Direct SSH reconnect discovery must stay host- and authority-qualified, reject contradictory main-catalog provenance without returning rows, admit at most five locally unsettled provider calls, retain a retrying timeout barrier, and emit one identifier-free aggregate product event per target operation. A process generation-scope rollover revokes every direct SSH target and old-scope provider request, not only the target whose counter exhausted.",
"oracle": "Classify exact git-common paths as structural, status-only, or ignored; count notifications from debounced watcher events; force the Linux/Windows poll path to emit allowlisted leaf events, detect linked HEAD rewrites independent of entry-directory mtime, and surface in-place index rewrites via the backstop re-stat; diff head identities from metadata-file reads and notify only real head moves; assert Source Control subscribes to both structural and status-only signals with active-repo and visibility filters. For direct SSH, reject catalog rows whose explicit and legacy host provenance contradict, roll one exhausted target into a fresh process generation scope while invalidating sibling target tokens, count locally unsettled attempts and round-robin admissions, keep lineage blocked through the first timeout retry, distinguish timeout/rejection/cancel/stale results, and reject telemetry properties carrying target, repo, host, path, label, user, request, lease, terminal, or raw-error data.",
"commands": [
"pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/worktree-base-directory-event-filter.test.ts src/main/ipc/worktree-base-directory-watcher.test.ts src/main/ipc/worktree-base-directory-poller.test.ts src/main/ipc/worktree-head-identity-reader.test.ts src/renderer/src/hooks/worktree-head-identity-apply.test.ts src/renderer/src/components/right-sidebar/git-status-push-signal-refresh.test.ts src/renderer/src/hooks/useIpcEvents.test.ts",
"pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/repos-remote.test.ts src/main/ssh/ssh-connection-generation.test.ts src/main/ssh/ssh-provider-authority.test.ts --reporter=dot",
"pnpm exec vitest run --config config/vitest.config.ts src/shared/direct-ssh-reconnect-telemetry-schema.test.ts src/renderer/src/lib/direct-ssh-reconnect-product-telemetry.test.ts src/renderer/src/hooks/direct-ssh-worktree-refresh-scheduler.test.ts src/renderer/src/hooks/direct-ssh-reconnect-coordinator.test.ts src/renderer/src/hooks/useIpcEvents.test.ts --reporter=dot",
"ORCA_E2E_SSH_DOCKER=1 SKIP_BUILD=1 pnpm exec playwright test tests/e2e/ssh-docker-relay-perf.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1"
],
"testFiles": [
"src/main/ipc/worktree-base-directory-event-filter.test.ts",
"src/main/ipc/worktree-base-directory-watcher.test.ts",
"src/main/ipc/worktree-base-directory-poller.test.ts",
"src/main/ipc/worktree-head-identity-reader.test.ts",
"src/renderer/src/hooks/worktree-head-identity-apply.test.ts",
"src/renderer/src/components/right-sidebar/git-status-push-signal-refresh.test.ts",
"src/renderer/src/hooks/useIpcEvents.test.ts",
"src/main/ipc/repos-remote.test.ts",
"src/main/ssh/ssh-connection-generation.test.ts",
"src/main/ssh/ssh-provider-authority.test.ts",
"src/shared/direct-ssh-reconnect-telemetry-schema.test.ts",
"src/renderer/src/lib/direct-ssh-reconnect-product-telemetry.test.ts",
"src/renderer/src/hooks/direct-ssh-worktree-refresh-scheduler.test.ts",
"src/renderer/src/hooks/direct-ssh-reconnect-coordinator.test.ts",
"tests/e2e/ssh-docker-relay-perf.spec.ts"
],
"assertionRefs": [
{
"file": "src/main/ipc/worktree-base-directory-event-filter.test.ts",
"assertions": [
"primary HEAD and packed-refs classify as structural while primary index classifies as status-only",
"linked HEAD/gitdir/locked classify as structural while linked index classifies as status-only",
"HEAD reflog appends classify as status-only for linked and primary checkouts while per-ref reflogs stay ignored",
"config.worktree classifies as structural at both linked and primary levels",
"ignored common-dir churn, spaces, Windows separators, and outside-root paths do not match structurally"
]
},
{
"file": "src/main/ipc/worktree-base-directory-watcher.test.ts",
"assertions": [
"linked index bursts produce zero notifyWorktreesChanged calls and one debounced status-only notification",
"linked HEAD and locked metadata still produce a structural worktree notification",
"status-only head moves emit head identities without structural fanout and only when heads actually changed",
"structural notifications re-baseline head identities silently and SSH watches never read identities",
"SSH-shaped index renames are status-only while overflow remains conservatively structural"
]
},
{
"file": "src/main/ipc/worktree-base-directory-poller.test.ts",
"assertions": [
"non-darwin git-common polling emits entry create/delete and allowlisted HEAD/index leaf events",
"linked HEAD rewrites are detected even after restoring the entry-directory mtime",
"linked and primary HEAD reflog appends emit despite bumping no watched leaf or entry dir",
"in-place index rewrites surface through the periodic backstop re-stat",
"primary checkout HEAD changes and macOS narrow watch/fallback behavior still emit"
]
},
{
"file": "src/renderer/src/components/right-sidebar/git-status-push-signal-refresh.test.ts",
"assertions": [
"Source Control nudges only for the active visible repo on structural and status-only signals",
"preload subscriptions and terminal command-finished listeners are cleaned up"
]
},
{
"file": "src/main/ipc/worktree-head-identity-reader.test.ts",
"assertions": [
"loose-ref, packed-refs, detached, unborn, and relative-gitdir layouts resolve or skip without spawning Git",
"traversal-shaped or backslash/colon symrefs are rejected before any path join and only hex object ids are ever emitted"
]
},
{
"file": "src/renderer/src/hooks/worktree-head-identity-apply.test.ts",
"assertions": [
"head identities patch matching rows by path (including Windows separator/casing drift) and skip unknown rows"
]
},
{
"file": "src/renderer/src/hooks/useIpcEvents.test.ts",
"assertions": [
"renderer preload API fixtures include the status-metadata and head-identity subscription contracts",
"direct SSH coordinator telemetry is wired through the fail-soft product adapter"
]
},
{
"file": "src/main/ipc/repos-remote.test.ts",
"assertions": [
"a host-qualified catalog rejects contradictory executionHostId and connectionId provenance without returning rows",
"local, sibling SSH, and runtime rows remain excluded from the exact direct SSH catalog"
]
},
{
"file": "src/main/ssh/ssh-connection-generation.test.ts",
"assertions": [
"one exhausted target rolls the process generation scope and invalidates every sibling target token",
"old-scope mutation expectations fail while the new-scope authority continues rotating"
]
},
{
"file": "src/main/ssh/ssh-provider-authority.test.ts",
"assertions": [
"generation-scope rollover invalidates every target authority before abort callbacks run",
"every registered old-scope provider request aborts exactly once"
]
},
{
"file": "src/renderer/src/hooks/direct-ssh-worktree-refresh-scheduler.test.ts",
"assertions": [
"coordinator-owned locally unsettled provider work never exceeds five and target lanes round-robin",
"the first timeout remains retrying and reports queue wait separately from provider execution",
"cancel debt admits at most two replacements and terminally distinguishes budget exhaustion"
]
},
{
"file": "src/renderer/src/hooks/direct-ssh-reconnect-coordinator.test.ts",
"assertions": [
"lineage and token creation remain blocked until a timed-out repo retry settles",
"exact overlapping preparation emits one aggregate with a join count",
"telemetry callback failure cannot affect reconnect completion"
]
},
{
"file": "src/shared/direct-ssh-reconnect-telemetry-schema.test.ts",
"assertions": [
"timeout, rejection, cancellation, and stale outcomes have independent fields",
"target, repo, host, path, label, user, request, lease, terminal, and raw-error fields are rejected"
]
},
{
"file": "src/renderer/src/lib/direct-ssh-reconnect-product-telemetry.test.ts",
"assertions": [
"one coordinator aggregate maps to one typed product event with queue and provider percentiles",
"adapter failure is swallowed before it can reach recovery"
]
},
{
"file": "tests/e2e/ssh-docker-relay-perf.spec.ts",
"assertions": [
"repo and worktree hydration use the exact direct SSH host and complete provider authority",
"terminal input remains live after disconnect/reconnect and writes a proof file visible inside the Linux target"
]
}
],
"evidenceRuns": [
{
"date": "2026-07-12",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/worktree-base-directory-event-filter.test.ts src/main/ipc/worktree-base-directory-watcher.test.ts src/main/ipc/worktree-base-directory-poller.test.ts src/main/ipc/worktree-head-identity-reader.test.ts src/renderer/src/hooks/worktree-head-identity-apply.test.ts src/renderer/src/components/right-sidebar/git-status-push-signal-refresh.test.ts src/renderer/src/hooks/useIpcEvents.test.ts",
"result": "passed",
"durationSeconds": 3.12,
"summary": "7 files and 130 tests passed locally, adding head-identity emit-on-change without structural fanout, reflog status triggers, config.worktree structural classification, the in-place index backstop, and the spawn-free head reader with symref traversal rejection and hex-object-id output validation."
},
{
"date": "2026-07-27",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/repos-remote.test.ts src/main/ssh/ssh-connection-generation.test.ts src/main/ssh/ssh-provider-authority.test.ts --reporter=dot",
"result": "passed",
"durationSeconds": 1.61,
"summary": "Three main-process catalog and authority files passed with 118 tests, including contradictory catalog provenance rejection and all-target generation-scope revocation."
},
{
"date": "2026-07-27",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/shared/direct-ssh-reconnect-telemetry-schema.test.ts src/renderer/src/lib/direct-ssh-reconnect-product-telemetry.test.ts src/renderer/src/hooks/direct-ssh-worktree-refresh-scheduler.test.ts src/renderer/src/hooks/direct-ssh-reconnect-coordinator.test.ts src/renderer/src/hooks/useIpcEvents.test.ts --reporter=dot",
"result": "passed",
"durationSeconds": 3.45,
"summary": "Five focused direct SSH scheduler, coordinator, telemetry, and hook-wiring files passed with 130 tests."
},
{
"date": "2026-07-27",
"runner": "local",
"platform": "macos",
"command": "ORCA_E2E_SSH_DOCKER=1 SKIP_BUILD=1 pnpm exec playwright test tests/e2e/ssh-docker-relay-perf.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
"result": "passed",
"durationSeconds": 66,
"summary": "Four Electron Docker SSH tests passed: two typing/performance paths, one concurrent file/Git load path, and exact-authority disconnect/reconnect with a container-visible remote proof file."
}
],
"runtimeBudget": {
"p95Seconds": 15,
"scope": "focused main/preload/renderer polling and direct SSH scheduler/telemetry tests"
},
"flakeHistory": {
"status": "unknown",
"evidence": "Three deterministic local macOS runs cover the original watcher lane, main catalog/authority lane, and direct SSH scheduler/telemetry lane; CI soak is still unavailable."
},
"redGreenEvidence": {
"status": "partial",
"evidence": "The watcher count assertions fail against the old single-signal classifier because linked index events call notifyWorktreesChanged. The direct SSH tests encode failures for unbounded admission, early lineage release, merged timeout/rejection/cancel/stale results, identifier-bearing telemetry, duplicate joined events, and telemetry exceptions, but no intentional-break artifact was run or claimed; saved red/green artifacts are still needed before blocking promotion."
},
"performanceBudget": {
"required": true,
"evidence": "Index-only bursts produce zero structural notifications, so renderer fetchWorktrees and detected-worktree cache invalidation are not reached. The non-darwin poller stays bounded and non-overlapping. Direct SSH coordinator-owned detected-worktree work is capped at five locally unsettled calls with a two-call late-work allowance; terminal finalization precedes provider discovery, and queue wait and provider execution are reported separately. A 30-second live Electron run with 2,000 external linked-status calls delivered 50 ordered input chunks and recorded zero Orca-owned git worktree spawns across six diagnostic windows; no equivalent live direct SSH fanout benchmark is claimed."
},
"promotionCriteria": [
"Run in soak for at least 100 consecutive passes or 14 days across required CI platforms.",
"Attach live Electron main-thread diagnostic evidence for repeated linked-worktree index rewrites while typing.",
"Add Linux/Windows live watcher evidence if shared poller-layer coverage diverges from platform behavior."
],
"knownGaps": [
"The live Electron diagnostic and screenshot evidence must remain attached to the motivating PR for durable review.",
"Linux and Windows are forced through the shared non-darwin poller in unit tests but are not live-tested here.",
"Git loose ref watching remains outside this incident fix by design.",
"SSH watches classify head-move triggers but skip the metadata-read identity diff; remote background-worktree heads still wait on a structural event or activation.",
"The Docker/Linux journey covers one direct SSH target; a live multi-target fanout and large-catalog benchmark remains missing.",
"Paired web clients intentionally do not run the desktop direct SSH coordinator, and paired-close non-interference lacks a new live run.",
"WSL direct SSH fanout remains an explicit live-test gap rather than inferred coverage."
],
"demotionRule": "Keep experimental or demote if the focused gate flakes without a product or harness bug, if index-only churn can emit worktrees:changed, or if structural add/remove/HEAD/lock changes fail to converge."
},
{
"id": "runtime.headless-desktop-promotion-continuity",
"title": "Headless serve opens its desktop without replacing live terminal sessions",
"maturity": "experimental",
"protection": "partial",
"owner": "runtime-platform",
"layer": "electron-runtime-contract",
"surfaces": [
"headless orca serve",
"single-instance desktop activation",
"CLI open",
"persistent terminal reattach",
"update install handoff"
],
"platforms": [
"macos",
"linux",
"windows"
],
"providers": [
"local",
"daemon",
"ssh"
],
"coveredPlatforms": [
"macos"
],
"coveredProviders": [
"local",
"daemon",
"ssh"
],
"coverageNotes": "Deterministic unit coverage exercises activation gating, single-instance ownership, quit policy, local/remote CLI status, headless binding persistence, local daemon identity, SSH identity transfer, and the macOS serve update handoff from staged installer through atomic bundle replacement and target-version readiness. A macOS Electron journey covers headless promotion and persistent PTY identity. A disposable locally signed Electron canary exercised real ShipIt and a temporary LaunchAgent with the compiled production supervisor; full packaged Orca and Linux/Windows serve updates remain uncollected.",
"motivatingLinks": [
"https://github.com/stablyai/orca/issues/8457",
"https://github.com/stablyai/orca/issues/9563"
],
"invariant": "A safely promotable headless serve process is the single app owner. Desktop activation preserves its daemon-backed sessions. On macOS, a CLI-supervised serve update keeps the node-mode parent alive across ShipIt's atomic bundle swap, restarts with the original serve arguments only after the target bundle is present, and clears handoff state only after that target version reports runtime readiness. Unsupported or failed handoffs leave the current serving owner intact or recover it once without an install retry loop.",
"oracle": "Unit tests coalesce early activation, preserve daemon and SSH identity, and reproduce the update race with a staged target, old serving child, persistent CLI parent, atomic .app replacement, and replacement readiness message. They assert the parent does not exit for launchd to respawn the old app, the native updater does not launch an interactive GUI, the replacement version is verified before handoff completion, mismatches become durable failures without retries, and unsupported/preflight-failed installs do not invoke native quit or PTY cleanup. The Electron journey independently verifies headless promotion retains owner/runtime/daemon/PTY identity and terminal I/O.",
"commands": [
"pnpm exec vitest run --config config/vitest.config.ts src/cli/runtime/launch.test.ts src/main/serve-update-handoff.test.ts src/main/updater.headless-serve-install.test.ts src/main/updater.test.ts src/main/updater.mac-install.test.ts src/main/window/attach-main-window-services.test.ts src/main/startup/serve-desktop-activation-wiring.test.ts",
"pnpm exec vitest run --config config/vitest.config.ts src/main/startup/serve-desktop-activation.test.ts src/main/startup/serve-desktop-activation-wiring.test.ts src/main/startup/single-instance-lock.test.ts src/main/startup/window-all-closed-quit-policy.test.ts src/cli/runtime-client.test.ts src/cli/runtime/websocket-transport.test.ts src/main/runtime/orca-runtime.test.ts",
"pnpm exec electron-vite build --mode e2e",
"pnpm run test:e2e -- tests/e2e/headless-serve-desktop-activation.spec.ts --workers=1"
],
"testFiles": [
"src/main/updater.headless-serve-install.test.ts",
"src/main/serve-update-handoff.test.ts",
"src/cli/runtime/launch.test.ts",
"src/main/startup/serve-desktop-activation.test.ts",
"src/main/startup/serve-desktop-activation-wiring.test.ts",
"src/main/startup/single-instance-lock.test.ts",
"src/main/startup/window-all-closed-quit-policy.test.ts",
"src/cli/runtime-client.test.ts",
"src/cli/runtime/websocket-transport.test.ts",
"src/main/runtime/orca-runtime.test.ts",
"tests/e2e/headless-serve-desktop-activation.spec.ts"
],
"assertionRefs": [
{
"file": "src/main/updater.headless-serve-install.test.ts",
"assertions": [
"a ready update in headless serve is deferred before native install, paired-client disconnect, or active-session cleanup",
"a supervised serve persists handoff after checkpoints but before native quit and uses no native GUI relaunch",
"unsupported serve refuses updater staging and install-on-quit while preserving availability checks",
"a failed handoff preflight preserves the serving owner before native quit or PTY cleanup",
"macOS installer-readiness timeout cannot quit a headless serving owner",
"ordinary macOS app quit is not reinterpreted as an install request in headless serve mode",
"repeated requests emit one deterministic status and lifecycle diagnostic while interactive installs remain unchanged"
]
},
{
"file": "src/cli/runtime/launch.test.ts",
"assertions": [
"the CLI parent remains alive after the old serving child exits instead of letting launchd respawn it",
"an atomic app-bundle replacement starts one target-version serve child with the original arguments",
"handoff completes only after the replacement reports target-version runtime readiness",
"a replacement version mismatch or readiness timeout is persisted and exits without an in-process retry loop"
]
},
{
"file": "src/main/serve-update-handoff.test.ts",
"assertions": [
"install intent and failure state are written atomically under canonical user data",
"an injected handoff path outside canonical user data cannot authorize an update",
"a target-version startup clears stale failure state"
]
},
{
"file": "src/main/startup/serve-desktop-activation.test.ts",
"assertions": [
"early activation requests coalesce until the persistent provider is ready",
"a blocked provider drops pending activation and never opens a window"
]
},
{
"file": "src/main/startup/serve-desktop-activation-wiring.test.ts",
"assertions": [
"second-instance and macOS app activation use the same safety gate",
"headless PTY registration waits for provider settlement and promotion waits for RPC startup"
]
},
{
"file": "src/main/startup/single-instance-lock.test.ts",
"assertions": [
"serve never skips the single-instance lock even in development",
"the isolated E2E profile can opt into the production ownership path"
]
},
{
"file": "src/main/startup/window-all-closed-quit-policy.test.ts",
"assertions": [
"a promoted serve owner remains alive after an ordinary window close but exits after a committed quit"
]
},
{
"file": "src/cli/runtime-client.test.ts",
"assertions": [
"local open activates a reachable headless owner and waits for a desktop window",
"unsafe promotion returns an explicit blocked error instead of launching a second owner"
]
},
{
"file": "src/cli/runtime/websocket-transport.test.ts",
"assertions": [
"remote-paired open reports remote desktop state without launching a local app"
]
},
{
"file": "src/main/runtime/orca-runtime.test.ts",
"assertions": [
"the headless sentinel transfers authority to the first real window",
"headless local and SSH PTY bindings are persisted on first promotion and later windowless reattach without changing ordinary desktop spawn persistence",
"status distinguishes available, openable, initializing, and blocked desktop states",
"desktop-only bell, command, and link scanners remain disabled until a real renderer graph is ready"
]
},
{
"file": "tests/e2e/headless-serve-desktop-activation.spec.ts",
"assertions": [
"desktop activation keeps the same main owner PID, runtime id, daemon PID, and PTY id",
"terminal output written before promotion remains visible and post-promotion input/output still works",
"the activating second process exits instead of becoming another owner"
]
}
],
"evidenceRuns": [
{
"date": "2026-07-21",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/cli/runtime/launch.test.ts src/main/serve-update-handoff.test.ts src/main/updater.headless-serve-install.test.ts src/main/updater.test.ts src/main/updater.mac-install.test.ts src/main/window/attach-main-window-services.test.ts src/main/startup/serve-desktop-activation-wiring.test.ts",
"result": "passed",
"durationSeconds": 5,
"summary": "Seven focused files passed with 133 tests. The lifecycle harness keeps the CLI parent alive across an atomic .app replacement, starts one target-version serve replacement, and requires its bounded readiness message. Unsupported and failed-preflight paths make zero native install and PTY-cleanup calls; supervised native install leaves the modeled daemon session intact and suppresses native GUI relaunch."
},
{
"date": "2026-07-13",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/main/startup/serve-desktop-activation.test.ts src/main/startup/serve-desktop-activation-wiring.test.ts src/main/startup/single-instance-lock.test.ts src/main/startup/window-all-closed-quit-policy.test.ts src/cli/runtime-client.test.ts src/cli/runtime/websocket-transport.test.ts src/main/runtime/orca-runtime.test.ts",
"result": "passed",
"durationSeconds": 13,
"summary": "Seven activation, ownership, quit, local/remote CLI, and runtime contract files passed with 704 tests, including first and repeated windowless reattach, local/SSH identity transfer, ordinary desktop persistence isolation, and dynamic side-effect scanner gating."
},
{
"date": "2026-07-13",
"runner": "local",
"platform": "macos",
"command": "pnpm run test:e2e -- tests/e2e/headless-serve-desktop-activation.spec.ts --workers=1",
"result": "passed",
"durationSeconds": 52,
"summary": "The isolated Electron journey passed repeatedly on the final source; the latest 51.6-second run retained the same main owner, runtime, daemon, and PTY, restored pre-promotion output, accepted post-promotion input, and observed the activating process exit."
}
],
"runtimeBudget": {
"p95Seconds": 120,
"scope": "focused unit contracts plus one isolated Electron headless-to-desktop journey"
},
"flakeHistory": {
"status": "unknown",
"evidence": "New deterministic contracts and two consecutive local macOS Electron passes; CI and cross-platform soak history are not yet available."
},
"redGreenEvidence": {
"status": "complete",
"evidence": "The original updater regression was observed red with one native install call, one paired-client disconnect, one cleanup start, no replacement owner, and a stranded staged installer. The root-cause harness was then observed red because the Electron child received no handoff path and the CLI parent exited, allowing launchd to spawn the old version while ShipIt still required zero running target apps. A live canary then exposed MacUpdater ignoring quitAndInstall relaunch arguments and starting a second desktop owner; disabling its independent relaunch for supervised mode produced one stable LaunchAgent parent, one verified replacement, and a surviving session across the real ShipIt swap. The final deterministic harness keeps that parent, observes the atomic bundle swap, and verifies the new serving version before clearing state. Earlier activation evidence also fixed second-owner and replacement-PTY failures."
},
"performanceBudget": {
"required": true,
"evidence": "Normal serve and desktop paths add only constant-time mode checks plus one IPC listener on the macOS CLI child. During an actual install handoff only, the CLI watches the stable app parent directory and performs a bounded 250ms version-file poll for at most 120 seconds; there are no subprocesses, network calls, provider scans, or startup waits. Activation performance is unchanged."
},
"promotionCriteria": [
"Collect at least 100 consecutive CI or soak passes or 14 days without an unexplained flake.",
"Add live packaged activation coverage on macOS plus representative Linux and Windows single-instance journeys.",
"Add an Electron SSH promotion journey in addition to the deterministic identity-transfer unit contract."
],
"knownGaps": [
"The Electron journey uses an isolated development bundle rather than the installed application so it cannot disturb a real user session.",
"The live ShipIt/LaunchAgent canary used a disposable minimal Electron bundle plus the compiled production supervisor; a full packaged Orca update has not yet been run.",
"Linux and Windows single-instance activation have unit coverage but no live Electron evidence yet.",
"SSH identity transfer is deterministic unit coverage only; the live Electron journey currently exercises the local daemon provider."
],
"demotionRule": "Quarantine the Electron journey only with a linked product or harness defect; demote if activation changes the owner/runtime/daemon/PTY identity, loses prior output, opens before provider readiness, or fails to honor a committed quit."
},
{
"id": "editor.live-log-append-stability",
"title": "Long live session logs retain their Monaco viewport while appending",
"maturity": "experimental",
"protection": "partial",
"owner": "editor-runtime",
"layer": "renderer-electron-contract",
"surfaces": ["Agent Session History View Log", "Monaco external-content reconciliation", "renderer crash containment"],
"platforms": ["macos", "linux", "windows"],
"providers": ["local"],
"coveredPlatforms": ["macos"],
"coveredProviders": ["local"],
"coverageNotes": "Focused tests and real-Monaco 9/50 MiB performance and undo-retention benchmarks are platform-independent. Local macOS Electron evidence opens a synthetic 9 MiB transcript through Agent Session History at fixed 900x720 viewport, 13px font, 1x zoom, and asserts the full 9 MiB model length loaded as a font-metric-independent containment check (word-wrap pixel geometry varies ~10% across runners, so a generous content-height floor is only a collapsed/truncated-render smoke check), then verifies three five-second-cadence watcher appends with Find open and closed. Live Windows/Linux evidence remains uncollected.",
"motivatingLinks": ["https://github.com/stablyai/orca/pull/8432"],
"invariant": "Append-only external file growth changes only Monaco's model suffix, retaining the viewport, selection, Find state, and renderer liveness above the append point; read-only live tails do not create undo history, while editable external updates remain undoable and arbitrary rewrites continue to replace the model content.",
"oracle": "Focused tests assert one post-mount content owner, actual outer lifecycle remount ordering across retained path models, exact end-of-model suffix edits with one model read, no-op equality, full replacement for non-appends, and real-Monaco undo behavior for read-only live tails versus editable files. With Node forced GC, real-Monaco benchmarks alternate 30 suffix and 30 replacement samples after five warmups on fresh equivalent models at 9 and 50 MiB, then compare exact Monaco undo-service and ArrayBuffer retention after five 10 MiB appends. The Electron scenario alternates an e2e-only legacy setValue red control and the fixed watcher append from restored equivalent model/geometry at the measured legacy-failure cadence, asserting that the control disrupts anchor state while the fixed path preserves visible ranges, selection, complete Find state, scroll offset, non-undoability, renderer survival, and forced-GC heap/native-memory budgets.",
"commands": [
"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/editor/monaco-content-sync.test.ts src/renderer/src/components/editor/MonacoEditor.content-owner.test.tsx src/renderer/src/components/editor/EditorContent.monaco-lifecycle.test.tsx",
"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/editor/monaco-content-sync.undo-history.test.ts",
"node --expose-gc ./node_modules/vitest/vitest.mjs bench src/renderer/src/components/editor/monaco-content-sync.bench.ts --pool=threads",
"node --expose-gc ./node_modules/vitest/vitest.mjs bench src/renderer/src/components/editor/monaco-content-sync.undo-retention.bench.ts --pool=threads",
"pnpm run test:e2e -- tests/e2e/agent-session-log-tail-stability.spec.ts --workers=1"
],
"testFiles": [
"src/renderer/src/components/editor/monaco-content-sync.test.ts",
"src/renderer/src/components/editor/monaco-content-sync.undo-history.test.ts",
"src/renderer/src/components/editor/MonacoEditor.content-owner.test.tsx",
"src/renderer/src/components/editor/EditorContent.monaco-lifecycle.test.tsx",
"src/renderer/src/components/editor/monaco-content-sync.bench.ts",
"src/renderer/src/components/editor/monaco-content-sync.undo-retention.bench.ts",
"tests/e2e/agent-session-log-tail-stability.spec.ts"
],
"assertionRefs": [
{
"file": "src/renderer/src/components/editor/monaco-content-sync.test.ts",
"assertions": [
"append-only drift reads the current model once and inserts only at the previous model end",
"identical content emits no edit and non-append drift retains full replacement plus undo stops",
"read-only live-tail appends, replacements, truncations, and stale retained-model remounts use non-undoing edits",
"a stale retained target model reconciles on mount without explicit undo stops while prior-path content and undo history remain isolated"
]
},
{
"file": "src/renderer/src/components/editor/monaco-content-sync.undo-history.test.ts",
"assertions": ["a real Monaco read-only live-tail append leaves canUndo false while an ordinary external update remains undoable"]
},
{
"file": "src/renderer/src/components/editor/MonacoEditor.content-owner.test.tsx",
"assertions": ["the Monaco wrapper receives defaultValue and no controlled value prop"]
},
{
"file": "src/renderer/src/components/editor/EditorContent.monaco-lifecycle.test.tsx",
"assertions": ["a same-pane path switch unmounts the prior outer Monaco before real mount reconciliation refreshes the stale target; the prior retained model content and undo sentinel remain untouched"]
},
{
"file": "src/renderer/src/components/editor/monaco-content-sync.bench.ts",
"assertions": ["with forced GC and deterministic settlement between every arm, fresh real-Monaco 9 MiB and 50 MiB models alternate 30 append and 30 replacement samples after five warmups; append p95 stays below 50/100ms and at least 2x faster"]
},
{
"file": "src/renderer/src/components/editor/monaco-content-sync.undo-retention.bench.ts",
"assertions": ["five 10 MiB read-only live-tail appends retain zero Monaco undo-service and ArrayBuffer bytes while the undoable control retains at least 50 MiB"]
},
{
"file": "tests/e2e/agent-session-log-tail-stability.spec.ts",
"assertions": [
"production Agent Session History opens a synthetic 9 MiB View Log and confirms the full model length loaded as font-metric-independent containment, with a generous content-height floor as a collapsed/truncated-render smoke check",
"an executable e2e-only legacy setValue control disrupts selection/Find/anchor state at each fixed-geometry five-second sample, then restores the equivalent model state before the fixed arm",
"three alternating watcher suffix appends preserve visible ranges, selection, scroll offset, Find open/query/active-match state, and exact suffix content",
"the production read-only live-tail model remains non-undoable before and after every watcher append",
"the renderer remains responsive with no render-process-gone event and forced-GC JS-heap/working-set/private-memory peak and retained budgets hold against paired legacy controls"
]
}
],
"evidenceRuns": [
{
"date": "2026-07-12",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/editor/monaco-content-sync.test.ts src/renderer/src/components/editor/MonacoEditor.content-owner.test.tsx src/renderer/src/components/editor/EditorContent.monaco-lifecycle.test.tsx",
"result": "passed",
"durationSeconds": 5,
"summary": "Focused editor ownership, edit-shape, mount reconciliation, lifecycle-key, and actual same-pane retained-model remount tests passed."
},
{
"date": "2026-07-12",
"runner": "local",
"platform": "macos",
"command": "node --expose-gc ./node_modules/vitest/vitest.mjs bench src/renderer/src/components/editor/monaco-content-sync.bench.ts --pool=threads",
"result": "passed",
"durationSeconds": 75,
"summary": "Forced-GC, settled, alternating fresh-model Monaco p95: 9 MiB append 4.02-5.51ms versus replacement 81.42-83.76ms; 50 MiB append 22.72-26.60ms versus replacement 445.11-449.21ms."
},
{
"date": "2026-07-12",
"runner": "local",
"platform": "macos",
"command": "pnpm run test:e2e -- tests/e2e/agent-session-log-tail-stability.spec.ts --workers=1",
"result": "passed",
"durationSeconds": 78,
"summary": "The production View Log journey alternated retained e2e-only legacy-red controls with fixed appends from restored equivalent state; every control detected instability while the fixed path retained viewport, selection, complete Find state, renderer liveness, and normalized forced-GC/native memory budgets."
},
{
"date": "2026-07-13",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/editor/monaco-content-sync.undo-history.test.ts",
"result": "passed",
"durationSeconds": 4,
"summary": "The real-Monaco undo-history test confirmed a read-only live-tail append leaves canUndo false while an ordinary external update remains undoable."
},
{
"date": "2026-07-13",
"runner": "local",
"platform": "macos",
"command": "node --expose-gc ./node_modules/vitest/vitest.mjs bench src/renderer/src/components/editor/monaco-content-sync.undo-retention.bench.ts --pool=threads",
"result": "passed",
"durationSeconds": 5,
"summary": "The undoable 50 MiB control retained 104,858,630 undo-service bytes and 104,857,790 ArrayBuffer bytes; the read-only live-tail arm retained zero of both and remained non-undoable."
},
{
"date": "2026-07-13",
"runner": "local",
"platform": "macos",
"command": "pnpm run test:e2e -- tests/e2e/agent-session-log-tail-stability.spec.ts --workers=1",
"result": "passed",
"durationSeconds": 78,
"summary": "The production View Log journey preserved viewport, selection, Find state, renderer liveness, and forced-GC/native budgets across three watcher appends while canUndo remained false."
}
],
"runtimeBudget": { "p95Seconds": 600, "scope": "local focused renderer tests plus one Electron production-journey scenario" },
"flakeHistory": { "status": "unknown", "evidence": "New deterministic gate with local macOS passes; CI soak history is not yet available." },
"redGreenEvidence": { "status": "complete", "evidence": "A fail-first real-Monaco test observed canUndo=true after one read-only live-tail append, and the forced-GC 50 MiB control retained 104,858,630 bytes in Monaco's undo service. After the fix the read-only arm retained zero undo-service bytes while the editable control stayed undoable. The retained Electron gate also proves each fixed watcher arm preserves viewport, selection, Find state, and non-undoability. Production builds never install its legacy setValue control." },
"performanceBudget": { "required": true, "evidence": "Every update retrieves the model value once and performs at most one equality-or-prefix comparison; a matching append submits only the suffix. The registered Node commands require --expose-gc and --pool=threads so worker GC is available. Current p95: 9 MiB append 5.93-7.12ms versus replacement 114.09-145.89ms; 50 MiB append 26.84-34.91ms versus replacement 602.36-699.21ms. The new 50 MiB retention arm measured 104,858,630 undo-service bytes and 104,857,790 ArrayBuffer bytes for the undoable control versus zero for read-only live-tail sync. Electron forced-GC JS-heap, renderer working-set, and OS-private-memory budgets also pass." },
"promotionCriteria": [
"Collect stable soak history on macOS, Linux, and Windows.",
"Accumulate 100 consecutive deterministic gate passes or 14 days without unexplained flakes."
],
"knownGaps": [
"No live Windows or Linux View Log evidence yet."
],
"demotionRule": "Quarantine the Electron scenario if it flakes without a product or harness bug; demote if viewport/Find drift, renderer loss, p95 regression, or memory retention exceeds the registered budgets."
},
{
"id": "terminal-session.snapshot-freshness",
"title": "Stale liveness snapshots cannot close newer PTY bindings",
"maturity": "experimental",
"protection": "partial",
"owner": "terminal-runtime",
"layer": "renderer-unit",
"surfaces": [
"terminal lifecycle",
"dead-session reconciliation",
"tab creation"
],
"platforms": [
"macos",
"linux",
"windows"
],
"providers": [
"local",
"daemon"
],
"coveredPlatforms": [
"macos"
],
"coveredProviders": [],
"coverageNotes": "Local macOS evidence over the reconcile guards that exist on main@1282f5c2d. Broader targeted-hasPty resume paths, no-hot listing counts, and live Electron survival arrive with the pending reliability stack.",
"motivatingLinks": [
"https://github.com/stablyai/orca/issues/6773",
"https://github.com/stablyai/orca/pull/6514",
"https://github.com/stablyai/orca/pull/6796",
"https://github.com/stablyai/orca/pull/6801"
],
"invariant": "A local or daemon liveness snapshot requested before a pane binds a PTY cannot prove that newer binding dead or route it through exit teardown.",
"oracle": "The decision layer rejects reconciliation when ptyBoundAt is greater than or equal to snapshotRequestedAt, still reconciles genuinely absent older local ids, and treats rejected provider listing as unknown.",
"commands": [
"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/terminal-dead-session-reconcile.test.ts"
],
"testFiles": [
"src/renderer/src/components/terminal-pane/terminal-dead-session-reconcile.test.ts"
],
"assertionRefs": [
{
"file": "src/renderer/src/components/terminal-pane/terminal-dead-session-reconcile.test.ts",
"assertions": [
"a newborn pane bound after the snapshot was requested is not reconciled (boundAt >= requestedAt freshness guard)",
"a rejected listSessions is treated as unknown and reconciles nothing",
"remote, SSH, and mid-spawn panes are skipped by the reconcile path",
"targeted liveness probes receive the request timestamp and resolved live-session ids"
]
}
],
"evidenceRuns": [
{
"date": "2026-07-03",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/terminal-dead-session-reconcile.test.ts",
"result": "passed",
"durationSeconds": 1.5,
"summary": "1 test file(s) passed, 17 tests passed on main@1282f5c2d in a clean checkout."
}
],
"runtimeBudget": {
"p95Seconds": 10,
"scope": "local unit test"
},
"flakeHistory": {
"status": "unknown",
"evidence": "Registered after existing targeted tests were found; needs soak history before blocking promotion."
},
"redGreenEvidence": {
"status": "partial",
"evidence": "Unit tests encode the stale snapshot/newborn race and fail if the freshness guard is removed. Needs saved CI or intentional-break artifact before blocking promotion."
},
"performanceBudget": {
"required": true,
"evidence": "The gate itself is cheap. Any PR changing reconciliation loops, hidden-pane scans, or provider polling must also run a terminal throughput or event-loop-delay measurement before blocking promotion."
},
"promotionCriteria": [
"Run in soak for at least 100 consecutive passes or 14 days across required CI platforms.",
"Attach red/green evidence from the freshness guard regression.",
"Add an integration/provider-contract follow-up that proves tab survival plus input/output after stale snapshot release."
],
"knownGaps": [
"Current command asserts the pure decision and orchestration timestamp forwarding, not a full Electron tab-survival/input echo flow.",
"SSH and remote providers are intentionally unknown-liveness paths and need separate provider-contract gates."
],
"demotionRule": "Demote or quarantine if the gate flakes once without a product bug or harness bug filed to the owner."
},
{
"id": "terminal-session.kill-all-surface-cleanup",
"title": "Kill all sessions removes only the confirmed terminal surfaces and current bindings",
"maturity": "experimental",
"protection": "partial",
"owner": "terminal-runtime",
"layer": "renderer-main-contract",
"surfaces": [
"terminal lifecycle",
"terminal tab cleanup",
"PTY shutdown",
"Manage Sessions",
"Resource Manager"
],
"platforms": [
"macos",
"linux",
"windows"
],
"providers": [
"local",
"daemon",
"ssh",
"wsl",
"remote-runtime",
"mobile-relay"
],
"coveredPlatforms": [
"macos"
],
"coveredProviders": [
"local",
"daemon",
"ssh"
],
"coverageNotes": "Local macOS deterministic evidence covers the renderer snapshot/coordinator, exact local and SSH-shaped PTY request settlement, active-last and pinned terminal-tab routing, component-unmount continuation, and the existing current/legacy daemon management contract. Windows Electron process absence, live SSH/WSL behavior, and remote-runtime/mobile host completion remain explicit gaps.",
"motivatingLinks": [
"https://github.com/stablyai/orca/issues/8001"
],
"invariant": "Every terminal surface confirmed in the invoking renderer is force-closed exactly once after daemon management settles, later-created surfaces and non-terminal tabs survive, and exact shutdown requests are limited to deduplicated current non-runtime PTY bindings of the confirmed surfaces.",
"oracle": "Snapshot terminal entity IDs before the first await; mutate ownership, active selection, bindings, and tab presence while daemon management is pending and between bounded close batches; then assert only the immutable targets disappear from both terminal stores, active targets close last with valid editor/browser/deactivated post-state, every captured exact PTY promise settles before callbacks, and no provider inventory sweep or late-tab kill occurs.",
"commands": [
"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/shared/kill-all-terminal-surfaces.test.ts src/renderer/src/components/shared/useDaemonActions.test.tsx src/renderer/src/components/terminal/terminal-tab-actions-kill-all.test.ts src/main/ipc/pty-management.test.ts"
],
"testFiles": [
"src/renderer/src/components/shared/kill-all-terminal-surfaces.test.ts",
"src/renderer/src/components/shared/useDaemonActions.test.tsx",
"src/renderer/src/components/terminal/terminal-tab-actions-kill-all.test.ts",
"src/main/ipc/pty-management.test.ts"
],
"assertionRefs": [
{
"file": "src/renderer/src/components/shared/kill-all-terminal-surfaces.test.ts",
"assertions": [
"snapshot deduplicates legacy, unified-only, split, multi-worktree, and floating terminal surfaces while excluding editor tabs",
"cleanup-time moves, active-worktree switches, rebinding, missing targets, and later-created tabs preserve the confirmation boundary and active-last order",
"current exact PTY bindings are deduplicated, remote runtime IDs and stale/late bindings are excluded, and all per-PTY settlements finish before completion",
"the production dependency path calls daemon management exactly once and never invokes listSessions for a post-kill sweep",
"management rejection and per-close/provider failures do not stop remaining cleanup and produce bounded count/latency diagnostics",
"a real 100-tab Zustand fixture records 100 close attempts and exact kills, at least 100 writes, and 49 event-loop yields; ownership is revalidated at most once after each yield when the store changed"
]
},
{
"file": "src/renderer/src/components/shared/useDaemonActions.test.tsx",
"assertions": [
"the hook snapshots before onKillAllStart and before coordinator work",
"unmounting the invoking component does not revoke cleanup while React callbacks remain mount-gated",
"error and settled callbacks run only after coordinator settlement",
"closed terminal tabs report success instead of the no-sessions informational state when daemon management reports zero"
]
},
{
"file": "src/renderer/src/components/terminal/terminal-tab-actions-kill-all.test.ts",
"assertions": [
"force closes pinned terminals without a second confirmation",
"closing the last active terminal preserves and activates editor or browser content, otherwise deactivates without auto-spawn"
]
},
{
"file": "src/main/ipc/pty-management.test.ts",
"assertions": [
"killAll fires one shutdown for each initial daemon session and polls those initial IDs until empty",
"freshly respawned session IDs are excluded from remainingCount",
"per-session shutdown rejection does not stop the daemon batch and refused initial sessions remain reported"
]
}
],
"evidenceRuns": [
{
"date": "2026-07-09",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/shared/kill-all-terminal-surfaces.test.ts src/renderer/src/components/shared/useDaemonActions.test.tsx src/renderer/src/components/terminal/terminal-tab-actions-kill-all.test.ts src/main/ipc/pty-management.test.ts",
"result": "passed",
"durationSeconds": 1.31,
"summary": "4 test files and 27 tests passed locally, including the existing daemon handler contract and a real 100-terminal Zustand cleanup fixture."
}
],
"runtimeBudget": {
"p95Seconds": 10,
"scope": "focused renderer/main unit and performance-count tests"
},
"flakeHistory": {
"status": "unknown",
"evidence": "The focused 27-test slice passed locally once; it needs CI and soak history before promotion."
},
"redGreenEvidence": {
"status": "partial",
"evidence": "The initial 100-tab implementation exposed an oversized close batch; two-close event-loop batching fixed the structural issue. The gate now uses deterministic batch instrumentation because full-suite CPU saturation made wall-clock assertions flaky; saved CI artifacts and intentional-break evidence are still needed."
},
"performanceBudget": {
"required": true,
"evidence": "The coordinator performs one management sweep, builds an initial live-owner index, and revalidates at most once after each two-close yield when the Zustand state changed (at most 49 replans for the 100-tab fixture). It closes each present unique target once and sends at most one exact kill per unique current non-runtime PTY not already settled by daemon management. The fixture asserts 100 close attempts, 100 local kill calls, at least 100 store writes, and 49 yields; planner-level tests prove each individual plan build scans terminal and unified ownership stores once. Production diagnostics report measured close-batch duration, while the deterministic gate makes no machine-load-sensitive latency claim."
},
"promotionCriteria": [
"Run the focused gate for at least 100 consecutive passes or 14 days across required CI platforms.",
"Attach Windows Electron evidence for both entry points, empty and established terminals, later-tab survival, xterm removal, and initial PTY absence after settlement.",
"Exercise the SSH fixture and WSL when available, or keep their live process-absence gaps explicit.",
"Propagate and align runtime-host tab-close completion before claiming verified remote-runtime shutdown."
],
"knownGaps": [
"Windows Electron screenshots and live process/xterm absence evidence were not produced by this local macOS run.",
"Live SSH and WSL process absence, Linux local/daemon behavior, and mobile/relay shutdown remain unproved.",
"Runtime-host terminal close is best-effort because closeTerminalTab still discards the existing async host result and its close-intent lifetime is shorter than the possible RPC flow.",
"Daemon adapter listing failures remain suppressed by the existing management API, so reported daemon counts are not authoritative verification of every process."
],
"demotionRule": "Keep experimental or demote to protection none if the gate flakes, permits a late-created tab or unrelated PTY to close, duplicates provider shutdown, or performs more than one ownership replan per bounded yield."
},
{
"id": "terminal-session.explicit-close-retirement",
"title": "Explicit terminal close retires parked PTYs and agent authority exactly once",
"maturity": "experimental",
"protection": "partial",
"owner": "terminal-runtime",
"layer": "main-preload-renderer-electron-contract",
"surfaces": [
"terminal tab close",
"split pane close and detach",
"hidden terminal parking",
"agent resume authority"
],
"platforms": [
"macos",
"linux",
"windows"
],
"providers": [
"local",
"daemon",
"ssh",
"runtime"
],
"coveredPlatforms": [
"macos"
],
"coveredProviders": [
"local",
"daemon",
"ssh",
"runtime"
],
"coverageNotes": "Live macOS Electron tests prove exact local PTY disappearance after parked-tab close and detached-pgid descendant death after agent close. Deterministic tests cover daemon and SSH routing, local/daemon pending-snapshot ownership across natural exit, stale-root descendant-signal suppression, graceful-to-immediate kill upgrades, duplicate-kill completion sharing, locale-stable bounded/fresh/coalesced process-table reads, deadline-safe successor scans, cycle-safe linear descendant traversal, target-only escalation indexing, 32-wide bulk teardown, source-scan timestamp identity, same-second PID ambiguity, ordinary runtime close ownership, unified-only hydration, split ownership, pane detach transfer, restart alias hydration, and late-hook suppression; live Linux, Windows, WSL, SSH, and remote-runtime process evidence remains pending.",
"motivatingLinks": [
"https://github.com/stablyai/orca/pull/8628",
"https://github.com/stablyai/orca/pull/8706"
],
"invariant": "Close permanently removes the owned provider session, agent descendants, and resume authority even when no TerminalPane is mounted; a terminating id remains reserved through natural exit, duplicate callers await the same completion, and immediate teardown upgrades any graceful request without signalling a recycled PID or a descendant tree after root ownership is lost; process-table work is locale-stable, bounded, fresh for each post-start request, same-turn coalesced, and begins within the requesting caller's deadline, including bulk worktree cleanup; detach and park preserve ownership; aliases prevent a detached agent's immutable physical pane key from being retired with its former tab.",
"oracle": "Capture the exact PTY before parking, prove it remains listed while the view is absent, close through the product state boundary, and poll the provider inventory until that exact ID disappears; an agent-marked PTY's detached-pgid child is alive before close and absent afterward; unit tests keep a naturally exited id reserved without re-killing its PID or signalling its captured tree, upgrade pending and post-snapshot graceful kills to immediate, force ps into the C locale, coalesce each bounded bulk-shutdown batch, share duplicate teardown completion, coalesce 20 same-turn process-table requests, start one shared successor without waiting for the prior scan, terminate cyclic-looking traversal, retain the source scan's timestamp, bound both read phases, avoid ambiguous SIGKILL, and assert canonical owner dedupe, exact pane tombstones, chained detach transfer, and restart alias restoration.",
"commands": [
"pnpm dlx node@24 ./node_modules/vitest/vitest.mjs run --config config/vitest.config.ts src/main/agent-hooks/server-pane-authority.test.ts src/main/ipc/agent-hooks.test.ts src/main/ipc/agent-pane-authority-ownership.test.ts src/main/ipc/pty-management.test.ts src/main/persistence.test.ts src/renderer/src/store/slices/agent-pane-authority.test.ts src/renderer/src/store/slices/terminal-pane-detach-agent-identity.test.ts src/renderer/src/store/slices/terminal-tab-retirement.test.ts src/renderer/src/store/slices/terminal-tab-retirement-store.test.ts src/renderer/src/components/shared/kill-all-terminal-surfaces.test.ts",
"pnpm exec vitest run --config config/vitest.config.ts src/main/pty-descendant-termination.test.ts src/main/daemon/session.test.ts src/main/daemon/terminal-host.test.ts src/main/providers/local-pty-provider.test.ts src/main/runtime/worktree-teardown.test.ts",
"pnpm run test:e2e -- tests/e2e/terminal-parked-close-retirement.spec.ts --workers=1",
"pnpm run test:e2e -- tests/e2e/agent-descendant-process-kill.spec.ts --workers=1"
],
"testFiles": [
"src/main/agent-hooks/server-pane-authority.test.ts",
"src/main/ipc/agent-hooks.test.ts",
"src/main/ipc/agent-pane-authority-ownership.test.ts",
"src/main/ipc/pty-management.test.ts",
"src/main/persistence.test.ts",
"src/main/pty-descendant-termination.test.ts",
"src/main/daemon/session.test.ts",
"src/main/daemon/terminal-host.test.ts",
"src/main/providers/local-pty-provider.test.ts",
"src/main/runtime/worktree-teardown.test.ts",
"src/renderer/src/store/slices/agent-pane-authority.test.ts",
"src/renderer/src/store/slices/terminal-pane-detach-agent-identity.test.ts",
"src/renderer/src/store/slices/terminal-tab-retirement.test.ts",
"src/renderer/src/store/slices/terminal-tab-retirement-store.test.ts",
"src/renderer/src/components/shared/kill-all-terminal-surfaces.test.ts",
"tests/e2e/terminal-parked-close-retirement.spec.ts",
"tests/e2e/agent-descendant-process-kill.spec.ts"
],
"assertionRefs": [
{
"file": "tests/e2e/terminal-parked-close-retirement.spec.ts",
"assertions": [
"a long-lived exact PTY remains alive after its terminal view is parked",
"closing the parked tab removes the exact PTY from the provider inventory and the visible tab model"
]
},
{
"file": "src/main/ipc/agent-pane-authority-ownership.test.ts",
"assertions": [
"pane authority transfer accepts only the PTY bound to the physical local pane or the canonical legacy/scoped runtime handle"
]
},
{
"file": "src/renderer/src/store/slices/agent-pane-authority.test.ts",
"assertions": [
"exact pane retirement removes resume and launch authority while preserving siblings",
"chained detach keeps physical hooks and resume authority routed to the current owner until that owner closes"
]
},
{
"file": "src/main/pty-descendant-termination.test.ts",
"assertions": [
"20 same-turn process-table requests execute one fresh scan while later arrivals start one shared successor inside their own deadline",
"snapshot and escalation readers stop at their deadline",
"production ps reads force locale-independent C timestamps",
"the source scan timestamp survives request resolution and capture-second identities are never escalated with SIGKILL",
"cyclic-looking duplicate PID rows terminate with each descendant visited once and duplicate escalation identities stay unsignalled",
"descendant signals are suppressed after the caller loses root ownership"
]
},
{
"file": "src/main/daemon/terminal-host.test.ts",
"assertions": [
"agent immediate kill rejects reattach while descendant capture is pending",
"a naturally exited session id remains reserved until capture finishes without force-killing its retired PID",
"graceful teardown upgrades to immediate both during and after descendant capture",
"duplicate immediate kill starts one descendant sweep"
]
},
{
"file": "src/main/runtime/worktree-teardown.test.ts",
"assertions": [
"owned provider shutdowns start together so process-table snapshots can coalesce within a batch",
"inventories above 32 sessions never exceed 32 concurrent provider shutdowns"
]
},
{
"file": "tests/e2e/agent-descendant-process-kill.spec.ts",
"assertions": [
"a detached-pgid descendant is alive before agent PTY kill and absent afterward"
]
}
],
"evidenceRuns": [
{
"date": "2026-07-13",
"runner": "local",
"platform": "macos",
"command": "pnpm run test:e2e -- tests/e2e/terminal-parked-close-retirement.spec.ts --workers=1",
"result": "passed",
"durationSeconds": 40.3,
"summary": "A fresh E2E build launched an isolated Electron profile, parked a live terminal, closed it through closeTab, and observed its exact PTY disappear."
},
{
"date": "2026-07-14",
"runner": "local",
"platform": "macos",
"command": "pnpm run test:e2e -- tests/e2e/agent-descendant-process-kill.spec.ts --workers=1",
"result": "passed",
"durationSeconds": 37.7,
"summary": "A current-main integrated fresh-build run proved a detached-pgid child was alive before agent PTY kill and absent afterward on the deadline-safe, root-ownership-gated implementation."
},
{
"date": "2026-07-15",
"runner": "local",
"platform": "macos",
"command": "pnpm run test:e2e -- tests/e2e/agent-descendant-process-kill.spec.ts --workers=1",
"result": "passed",
"durationSeconds": 78,
"summary": "The cycle-safe, target-indexed, bounded-fanout review head passed from a cold full build; the live detached-pgid descendant test body completed in 4.8 seconds."
}
],
"runtimeBudget": {
"p95Seconds": 60,
"scope": "fresh E2E build plus isolated local Electron parked-close and descendant-kill tests"
},
"flakeHistory": {
"status": "unknown",
"evidence": "The Electron gate passed three times locally, including the final review-fix head through the registered fresh-build command; CI and soak history are not yet available."
},
"redGreenEvidence": {
"status": "partial",
"evidence": "The test exercises the original parked-view failure shape and passed with the retirement boundary; an archived intentional-break run is not yet attached."
},
"performanceBudget": {
"required": true,
"evidence": "The close path is user-triggered and bounded by canonical live-owner indexing. Production ps has a 1s kill timeout; 20 same-turn requests execute one fresh process-table read, while requests arriving after a scan starts immediately share one successor so their deadline is not consumed waiting and no unusable ps starts after timeout. Completed tables are never reused. Bulk worktree shutdown runs in 32-wide batches so each batch can coalesce its initial scan without unbounded provider fanout. Descendant traversal uses a visited set and index cursor; a Node 24 local 100,000-wide synthetic tree fell from 861ms to 16.7ms, and escalation indexes only the requested descendant PIDs instead of duplicating the full process table. Escalation uses the same bounded coordinator, and kill-all store scale remains covered by terminal-session.kill-all-surface-cleanup."
},
"promotionCriteria": [
"Accumulate 100 clean runs or 14 days on required CI platforms.",
"Add live Windows/ConPTY, Linux, WSL, SSH, and ordinary runtime process-absence evidence.",
"Add restart/no-resurrection and repeated park-close soak coverage."
],
"knownGaps": [
"The live Electron proof currently covers macOS local PTYs only.",
"Disconnected SSH relay death still requires reconnect-aware provider ownership.",
"Daemon owner leases and durable retry inventory remain follow-up hardening.",
"Windows ConPTY, SSH-hosted PTYs, app-quit killAll, and daemon dispose retain foreground-tree-only teardown.",
"A process born in the capture second is SIGTERMed but not SIGKILLed because ps cannot prove its recycled-PID identity.",
"A descendant orphaned before or during root ownership loss requires the separate crash-orphan sweep and is not recovered from a stale kill-time snapshot."
],
"demotionRule": "Keep experimental or demote to protection none if exact PTY disappearance flakes, a sibling/detached pane is retired, or late hooks can recreate closed authority."
},
{
"id": "terminal-session.daemon-generation-reconnect-safety",
"title": "Negotiated close intent protects live daemon-generation terminals",
"maturity": "experimental",
"protection": "partial",
"owner": "terminal-runtime",
"layer": "renderer-runtime-rpc-daemon-contract",
"surfaces": [
"runtime session reconnect",
"legacy daemon adoption",
"mixed-version paired viewer close",
"terminal lifecycle close",
"app relaunch and profile reconnect"
],
"platforms": ["macos", "linux", "windows"],
"providers": ["daemon", "runtime", "ssh", "wsl"],
"coveredPlatforms": ["linux", "macos", "windows"],
"coveredProviders": ["daemon", "runtime"],
"coverageNotes": "Recorded native Windows evidence covers the v21/v22/v23/v24/v25 named-pipe matrix. The deterministic daemon harness covers capable and legacy paired-runtime request shapes against live v25/v26 PTYs in separate worktrees, plus an unrelated control. Host/renderer tests cover old servers, missing liveness, stale publications, reused claims, split parents, explicit user intent, cross-profile isolation, remote runtime clients, SSH-provider routing, and WSL boundaries. A headed host paired to a separate live client, headless serve parity, Linux, SSH, and WSL remain explicit gaps.",
"motivatingLinks": [
"https://github.com/stablyai/orca/issues/9749",
"https://github.com/stablyai/orca/issues/9949",
"https://github.com/stablyai/orca/issues/8871",
"https://github.com/stablyai/orca/issues/9138",
"https://github.com/stablyai/orca/issues/9229"
],
"invariant": "Reconnect, replay, or lifecycle observations from a viewer that negotiated explicit close intent must never kill a live PTY. A capable reasonless close must keep and republish; a legacy paired viewer must retain current-main behavior because its intentional close and cleanup echo are wire-identical. Lifecycle close requires the exact observed publication, terminal, environment, and authoritative liveness, never signals a process, and leaves renderer-owned or partial-split retirement to its owner. Legacy daemon hello and warm reattachment remain non-destructive.",
"oracle": "Start isolated v25 and v26 daemon generations with one capable-viewer PTY and one legacy-viewer PTY per generation in four target worktrees plus an unaddressed control PTY in a fifth worktree. Route them through the production desktop scanner, runtime, RPC dispatcher, renderer-close relay, and daemon router. First issue sequential reasonless closes from an authenticated capable connection and require refusal, snapshot republish, zero shutdown calls, exact process survival, and post-close I/O. Then issue the byte-identical requests without the negotiated capability and require current-main behavior: two ordered immediate shutdowns, session-killed events, and exact root/descendant death, while capable and control PTYs survive. An observer lists all targets before, between, and after while issuing zero closes. Unit contracts also require in-process reasonless refusal, legacy runtime/mobile compatibility, explicit user closes, encrypted client-auth advertisement, and old-server lifecycle calls never to fall back.",
"commands": [
"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/orca-runtime.test.ts src/main/runtime/remote-runtime-request-connection.integration.test.ts src/main/runtime/rpc/methods/session-tabs.test.ts src/main/runtime/rpc/methods/session-tabs-schemas.test.ts src/main/runtime/rpc/e2ee-channel.test.ts src/main/runtime/rpc/e2ee-channel-v2.test.ts src/main/runtime/rpc/mobile-socket-wiring.test.ts src/main/runtime/rpc/runtime-client-capabilities.test.ts src/shared/remote-runtime-client.test.ts src/shared/remote-runtime-request-connection.test.ts src/shared/remote-runtime-shared-control-connection.test.ts src/cli/runtime/websocket-transport.test.ts src/renderer/src/web/web-runtime-client.test.ts src/renderer/src/runtime/web-runtime-session.test.ts src/renderer/src/runtime/web-session-close-intent.test.ts src/renderer/src/runtime/web-session-tabs-sync.test.ts src/renderer/src/components/terminal/terminal-tab-actions.test.ts src/renderer/src/components/terminal/terminal-close-incarnation.test.ts src/renderer/src/components/terminal-pane/terminal-parked-tab-watchers.test.ts",
"pnpm exec playwright test tests/e2e/daemon-generation-reconnect-safety.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
"pnpm exec playwright test tests/e2e/daemon-generation-legacy-close-safety.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1"
],
"testFiles": [
"src/main/runtime/orca-runtime.test.ts",
"src/main/runtime/remote-runtime-request-connection.integration.test.ts",
"src/main/runtime/rpc/methods/session-tabs.test.ts",
"src/main/runtime/rpc/methods/session-tabs-schemas.test.ts",
"src/main/runtime/rpc/e2ee-channel.test.ts",
"src/main/runtime/rpc/e2ee-channel-v2.test.ts",
"src/main/runtime/rpc/mobile-socket-wiring.test.ts",
"src/main/runtime/rpc/runtime-client-capabilities.test.ts",
"src/shared/remote-runtime-client.test.ts",
"src/shared/remote-runtime-request-connection.test.ts",
"src/shared/remote-runtime-shared-control-connection.test.ts",
"src/cli/runtime/websocket-transport.test.ts",
"src/renderer/src/web/web-runtime-client.test.ts",
"src/renderer/src/runtime/web-runtime-session.test.ts",
"src/renderer/src/runtime/web-session-close-intent.test.ts",
"src/renderer/src/runtime/web-session-tabs-sync.test.ts",
"src/renderer/src/components/terminal/terminal-tab-actions.test.ts",
"src/renderer/src/components/terminal/terminal-close-incarnation.test.ts",
"src/renderer/src/components/terminal-pane/terminal-parked-tab-watchers.test.ts",
"tests/e2e/daemon-generation-reconnect-safety.spec.ts",
"tests/e2e/daemon-generation-legacy-close-safety.spec.ts"
],
"assertionRefs": [
{
"file": "src/main/runtime/remote-runtime-request-connection.integration.test.ts",
"assertions": [
"the real encrypted WebSocket handshake binds close-intent capability through authenticated socket state and RPC context to reasonless-close refusal"
]
},
{
"file": "tests/e2e/daemon-generation-legacy-close-safety.spec.ts",
"assertions": [
"one identified capable viewer and one legacy viewer issue byte-identical sequential reasonless closes while a third viewer lists every target before, between, and after but issues zero closes",
"capable v25/v26 PTY root/descendant incarnations in separate worktrees survive, answer post-close input, and produce zero shutdown calls and zero daemon session-killed events",
"legacy v25/v26 PTY root/descendant incarnations die through ordered immediate shutdown calls with one daemon session-killed event each, matching current-main behavior",
"an unaddressed fifth-worktree PTY root and descendant survive with zero kill events, excluding global fanout",
"the JSON reconstruction records request order, negotiated capabilities, viewer connection, worktree/tab/PTY ids, daemon PID/protocol, call site, and exact before/after process liveness"
]
},
{
"file": "tests/e2e/daemon-generation-reconnect-safety.spec.ts",
"assertions": [
"the production scanner discovers v21/v22/v23/v24/v25 from v26 and every generation accepts repeated client hellos while every exact daemon, PTY-root, and descendant incarnation remains alive",
"desktop and two remote profiles repeat lifecycle closes before and after client relaunch with zero session-killed events",
"shutdown-dispose-failed drops named-pipe authority within the deadline and exact fixture cleanup leaves no process tree"
]
},
{
"file": "src/main/runtime/rpc/mobile-socket-wiring.test.ts",
"assertions": [
"the optional client capability is captured from legacy encrypted authentication and bound to the authenticated runtime-scoped socket identity"
]
},
{
"file": "src/main/runtime/rpc/e2ee-channel.test.ts",
"assertions": [
"runtime capabilities are accepted only from encrypted authentication metadata, not the unauthenticated hello"
]
},
{
"file": "src/main/runtime/rpc/e2ee-channel-v2.test.ts",
"assertions": [
"mobile E2EE v2 continues to reject additive runtime capability metadata"
]
},
{
"file": "src/main/runtime/rpc/runtime-client-capabilities.test.ts",
"assertions": [
"the authenticated capability parser accepts only bounded string arrays and rejects malformed or oversized input"
]
},
{
"file": "src/shared/remote-runtime-client.test.ts",
"assertions": [
"one-shot and subscription runtime clients remain compatible while sending encrypted client authentication"
]
},
{
"file": "src/shared/remote-runtime-request-connection.test.ts",
"assertions": [
"the cached paired-desktop request connection advertises close-intent support in encrypted authentication while reusing one socket"
]
},
{
"file": "src/shared/remote-runtime-shared-control-connection.test.ts",
"assertions": [
"the reconnecting shared-control client advertises close-intent support in encrypted authentication"
]
},
{
"file": "src/cli/runtime/websocket-transport.test.ts",
"assertions": [
"updated paired runtime clients advertise close-intent support in encrypted auth fields ignored by legacy servers"
]
},
{
"file": "src/renderer/src/web/web-runtime-client.test.ts",
"assertions": [
"the browser paired-runtime client advertises close-intent support inside encrypted authentication"
]
},
{
"file": "src/main/runtime/orca-runtime.test.ts",
"assertions": [
"live, unknown, stale, missing-intent, non-owner, and inventory-proven but not yet pane-bound lifecycle closes invoke neither PTY kill nor renderer close",
"dead whole-headless retirement removes stale state without signalling a retained PTY id"
]
},
{
"file": "src/main/runtime/rpc/methods/session-tabs.test.ts",
"assertions": [
"in-process and capable-runtime reasonless closes refuse while legacy runtime/mobile and explicit current user closes retain current-main destructive semantics"
]
},
{
"file": "src/renderer/src/runtime/web-runtime-session.test.ts",
"assertions": [
"lifecycle close uses the additive method with publication and terminal evidence",
"old-server method_not_found never falls back to destructive legacy close"
]
},
{
"file": "src/renderer/src/runtime/web-session-close-intent.test.ts",
"assertions": [
"identical worktree and tab ids in another runtime cannot suppress, reconcile, or clear this profile's intent"
]
},
{
"file": "src/renderer/src/components/terminal-pane/terminal-parked-tab-watchers.test.ts",
"assertions": [
"parked lifecycle closes carry the exact exiting PTY and cannot borrow a replacement or sibling incarnation"
]
}
],
"evidenceRuns": [
{
"date": "2026-07-27",
"runner": "ci",
"platform": "linux",
"command": "pnpm exec playwright test tests/e2e/daemon-generation-legacy-close-safety.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
"result": "passed",
"durationSeconds": 5.1,
"summary": "Current-head capability-gated oracle passed in E2E run https://github.com/stablyai/orca/actions/runs/30250731941/job/89928386794: capable v25/v26 roots and descendants survived with snapshot republish and post-close I/O, byte-identical legacy closes retained current-main shutdown behavior, and the unrelated fifth-worktree control survived."
},
{
"date": "2026-07-21",
"runner": "local",
"platform": "windows",
"command": "pnpm exec playwright test tests/e2e/daemon-generation-reconnect-safety.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
"result": "passed",
"durationSeconds": 137.1,
"summary": "The full command, including a fresh Electron E2E build, passed. Production desktop discovery found v21/v22/v23/v24 from v25; all five daemons and all ten exact PTY-root/descendant canaries survived six repeated lifecycle attempts per stale mirror with zero session-killed events. Bounded shutdown-dispose-failed dropped pipe authority while its refusing daemon/root/descendant remained alive until exact fixture cleanup; no fixture directory remained."
}
],
"runtimeBudget": {
"p95Seconds": 180,
"scope": "isolated native-Windows generation reconnect plus two-generation mixed-version close adjudication and fresh E2E build"
},
"flakeHistory": {
"status": "unknown",
"evidence": "Local deterministic Windows evidence includes the final two-scenario pass and a separate 25-burst stress pass; CI and 14-day soak history are absent."
},
"redGreenEvidence": {
"status": "complete",
"evidence": "Current main and PR #10013 route both reasonless viewer sequences to immediate shutdown, while the prior global-refusal candidate incorrectly preserves the legacy sequence. The capability-gated candidate passed the combined GitHub oracle: capable v25/v26 PTYs survive and answer input, legacy PTYs retain current-main shutdown behavior, and the unrelated control survives. Existing Windows red/green evidence separately covers evidence-bearing lifecycle closes."
},
"performanceBudget": {
"required": true,
"evidence": "Production adds one bounded client-capability parse during the authenticated connection handshake and one constant-time membership branch per close. It adds no polling, subprocess, provider listing, retry, timer, or process-per-session work. Refusal reuses the existing single-worktree snapshot republish. Test-only inventory and cleanup are bounded."
},
"promotionCriteria": [
"Collect 100 clean native-Windows runs over 14 days with zero unexplained flakes.",
"Add packaged Electron update/relaunch evidence with the same exact PTY survival oracle.",
"Add live Linux SSH-relay and Windows WSL reconnect artifacts without weakening keep-on-unknown."
],
"knownGaps": [
"The strongest proof is Electron-as-Node over real daemon PTYs, not a packaged headed Orca host paired to a separate old client; that is the primary live E2E still required.",
"Headless orca serve parity, live Linux, Linux SSH relay, and Windows WSL reconnect are not exercised; Docker SSH would cover only the SSH provider and cannot substitute for paired Orca-server evidence.",
"A topology containing any pre-contract paired desktop viewer remains vulnerable to that viewer's stale reasonless close storm; preserving its intentional-close behavior makes this unavoidable until the viewer upgrades.",
"Cross-profile daemon inventory and generation handoff/retirement remain the separate #9138/#9229 design.",
"A dead split leaf stays with its authoritative owner rather than being remotely pruned."
],
"demotionRule": "Keep experimental or quarantine if reconnect emits session-killed for a live canary, an exact root/descendant dies, an old server receives fallback destructive close, cleanup leaks a fixture process/pipe, or the gate flakes without a proven harness defect."
},
{
"id": "terminal-session.startup-cwd-missing-dir-recovery",
"title": "Fresh local terminal creation cannot be bricked by a deleted startup cwd",
"maturity": "experimental",
"protection": "partial",
"owner": "terminal-runtime",
"layer": "shared-main-renderer-contract",
"surfaces": [
"terminal lifecycle",
"tab creation",
"PTY spawn",
"startup cwd persistence"
],
"platforms": [
"macos",
"linux",
"windows",
"mobile"
],
"providers": [
"local",
"daemon",
"ssh",
"wsl",
"remote-runtime"
],
"coveredPlatforms": [
"macos"
],
"coveredProviders": [
"local",
"ssh",
"remote-runtime"
],
"coverageNotes": "Local macOS evidence covers the shared missing-dir fallback policy, main pty:spawn recovery and metadata, no-flag and reattach strictness, renderer IPC flag routing, SSH-tagged and remote-runtime omission, and the visibility-gated terminal notice. Daemon shares the same pre-provider main cwd decision but lacks a live daemon-provider run; WSL UNC paths are exempt from the probe by design and lack a live run; Linux/Windows and mobile/API strictness are gaps.",
"motivatingLinks": [
"https://github.com/stablyai/orca/issues/7239",
"https://github.com/stablyai/orca/pull/7750",
"https://github.com/stablyai/orca/pull/7678"
],
"invariant": "A fresh local renderer terminal spawn may recover from a saved startup cwd whose directory no longer exists only by spawning at the selected workspace root and printing a generic in-terminal notice; existing directories — including ones outside the worktree (#7685) — spawn as requested, and reattach, SSH, remote-runtime, runtime/API, and mobile callers keep exact cwd semantics.",
"oracle": "The shared resolver falls back to the workspace root only when the injected existence probe reports the resolved cwd missing and the workspace root present, and never probes floating terminals or a cwd equal to the root. The renderer sends cwdFallback only for fresh local IPC spawns, main honors it only when connectionId and sessionId are absent, WSL UNC paths never engage the probe-based fallback, main returns fallback metadata only after an actual fallback, the IPC transport preserves that metadata, and the connection layer writes a generic notice that omits the missing path.",
"commands": [
"pnpm exec vitest run --config config/vitest.config.ts src/shared/terminal-startup-cwd.test.ts",
"pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/pty.test.ts",
"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/pty-transport.test.ts",
"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/pty-connection.test.ts"
],
"testFiles": [
"src/shared/terminal-startup-cwd.test.ts",
"src/main/ipc/pty.test.ts",
"src/renderer/src/components/terminal-pane/pty-transport.test.ts",
"src/renderer/src/components/terminal-pane/pty-connection.test.ts"
],
"assertionRefs": [
{
"file": "src/shared/terminal-startup-cwd.test.ts",
"assertions": [
"a missing requested cwd falls back to the workspace root and reports the missing path to the callback",
"existing cwds — nested or outside the worktree (#7685) — are never remapped",
"no fallback happens when the workspace root is missing too",
"floating terminal cwds and root-equal requests are never probed",
"non-ASCII worktree roots and folder workspace roots are recovered verbatim"
]
},
{
"file": "src/main/ipc/pty.test.ts",
"assertions": [
"local pty:spawn with cwdFallback worktree spawns at the worktree root when the saved cwd is missing and returns fallback metadata",
"a missing cwd without the flag still surfaces the provider's missing-directory error",
"an existing outside-worktree cwd spawns as requested without fallback metadata",
"session reattach spawns ignore the fallback flag and keep exact cwd semantics"
]
},
{
"file": "src/renderer/src/components/terminal-pane/pty-transport.test.ts",
"assertions": [
"IPC transport sends cwdFallback only for local fresh spawns",
"SSH-tagged and session reattach spawns omit cwdFallback",
"IPC transport returns startup cwd fallback metadata to the connection layer"
]
},
{
"file": "src/renderer/src/components/terminal-pane/pty-connection.test.ts",
"assertions": [
"fresh local IPC worktree spawns are marked with cwdFallback worktree",
"startup cwd fallback metadata prints a generic in-terminal notice",
"remote-runtime worktree spawns are not marked with cwdFallback"
]
}
],
"evidenceRuns": [
{
"date": "2026-07-08",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/shared/terminal-startup-cwd.test.ts",
"result": "passed",
"durationSeconds": 0.2,
"summary": "1 test file passed, 21 tests passed; covers the missing-dir fallback policy, #7685 outside-worktree preservation, and root-missing/floating exemptions."
},
{
"date": "2026-07-08",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/pty.test.ts",
"result": "passed",
"durationSeconds": 0.9,
"summary": "1 test file passed, 225 tests passed; covers main pty:spawn recovery, fallback metadata, and no-flag/reattach provider-error strictness."
},
{
"date": "2026-07-08",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/pty-transport.test.ts",
"result": "passed",
"durationSeconds": 0.4,
"summary": "1 test file passed, 58 tests passed; covers cwdFallback forwarding only for local fresh spawns and metadata handoff."
},
{
"date": "2026-07-08",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/pty-connection.test.ts",
"result": "passed",
"durationSeconds": 6.5,
"summary": "1 test file passed, 341 tests passed; covers local IPC marking, the generic terminal fallback notice, and remote-runtime omission."
}
],
"runtimeBudget": {
"p95Seconds": 30,
"scope": "focused unit and IPC contract tests"
},
"flakeHistory": {
"status": "unknown",
"evidence": "New experimental gate added with local deterministic evidence only; needs CI soak before promotion."
},
"redGreenEvidence": {
"status": "partial",
"evidence": "The main IPC missing-cwd tests fail with the provider's 'Working directory ... does not exist.' error when the fallback is removed and pass with it. Full live Electron reproduction from a production persisted session is not captured."
},
"performanceBudget": {
"required": true,
"evidence": "The runtime change adds at most two statSync probes on the fresh-local spawn path (the provider already stats the same paths during validation) and one bounded terminal write only when fallback actually occurs; no polling, provider listing, hidden-pane work, startup awaits, subprocesses, or render-loop work was added."
},
"promotionCriteria": [
"Attach CI evidence for all declared test files.",
"Add a live Electron regression that opens a local terminal whose persisted startupCwd was deleted and proves visible shell input/output at the workspace root.",
"Add WSL/mobile/API provider-contract coverage or explicitly narrow their risk scope."
],
"knownGaps": [
"No live Electron fixture seeds a persisted tab whose startupCwd directory was deleted.",
"Daemon coverage is via the shared pre-provider main cwd decision, not a live daemon provider spawn.",
"WSL UNC paths bypass the probe by design and have no live existence-recovery run; Linux, Windows, and mobile/API strictness are not directly exercised."
],
"demotionRule": "Demote or quarantine if the gate flakes without a product bug, if an existing directory is ever remapped away from the requested cwd, or if a reattach/remote/API caller can engage the fallback."
},
{
"id": "agent-status.pi-hook-liveness",
"title": "Pi status hooks cannot stall a turn or complete a live runtime",
"maturity": "experimental",
"protection": "partial",
"owner": "agent-session",
"layer": "main-provider-contract",
"surfaces": [
"Pi and OMP managed extensions",
"agent status hooks",
"runtime reload and session replacement",
"loopback restart and stall recovery"
],
"platforms": [
"macos",
"linux",
"windows"
],
"providers": [
"local",
"daemon",
"ssh",
"wsl",
"remote-runtime"
],
"coveredPlatforms": [
"macos"
],
"coveredProviders": [],
"coverageNotes": "Local macOS execution of the generated Pi/OMP extension plus the shared hook normalizer. WSL fallback behavior is covered with mocked native-fetch failure and Windows curl handoff. Daemon PTYs use the same generated extension without a distinct delivery path. SSH/relay ingest uses the shared normalizer, but no live remote Pi process is exercised.",
"motivatingLinks": [
"https://github.com/stablyai/orca/issues/7791",
"https://github.com/stablyai/orca/pull/7802",
"https://github.com/stablyai/orca/pull/7838"
],
"invariant": "Orca status reporting must return synchronously from every Pi/OMP extension handler, retain at most one active request and one latest pending snapshot, and abandon stalled loopback delivery within one second. A Pi session_shutdown event cannot mark a turn done because Pi also emits it for reload, new, resume, and fork while the PTY remains alive; only agent_end proves turn completion, while real process exit is cleared by PTY teardown.",
"oracle": "Execute the generated extension with a fetch that remains pending and assert the Pi handler returns before delivery; emit three statuses during the stall and assert exactly one request is active and only the latest pending status is sent next; advance fake time by one second and assert the active signal aborts and the latest status proceeds. Through the shared normalizer, assert session_shutdown yields no status while agent_end still yields done.",
"commands": [
"pnpm exec vitest run --config config/vitest.config.ts src/main/pi/agent-status-extension-source.test.ts src/main/agent-hooks/server.test.ts --maxWorkers=1"
],
"testFiles": [
"src/main/pi/agent-status-extension-source.test.ts",
"src/main/agent-hooks/server.test.ts"
],
"assertionRefs": [
{
"file": "src/main/pi/agent-status-extension-source.test.ts",
"assertions": [
"a pending loopback fetch does not keep the Pi event handler unresolved",
"three events during a stall produce one active request and one request for only the latest pending status",
"the one-second delivery deadline aborts the active request and advances the latest pending status",
"the managed status extension does not register session_shutdown as a completion event",
"WSL native-fetch failures still hand off to a detached Windows curl process"
]
},
{
"file": "src/main/agent-hooks/server.test.ts",
"assertions": [
"session_shutdown normalizes to no status instead of done",
"agent_end remains the authoritative Pi/OMP done event"
]
}
],
"evidenceRuns": [
{
"date": "2026-07-11",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/main/pi/agent-status-extension-source.test.ts src/main/agent-hooks/server.test.ts --maxWorkers=1",
"result": "passed",
"durationSeconds": 1.3,
"summary": "2 files and 238 tests passed, including executed generated-extension liveness, latest-only queue bounds, timeout abort, WSL fallback, and Pi shutdown normalization."
}
],
"runtimeBudget": {
"p95Seconds": 10,
"scope": "generated-extension and shared-normalizer unit gate"
},
"flakeHistory": {
"status": "unknown",
"evidence": "New deterministic gate with local fake-receiver and fake-timer evidence; needs CI soak before promotion."
},
"redGreenEvidence": {
"status": "partial",
"evidence": "Before the fix, the pending-fetch handler assertion remained false and session_shutdown normalized to done (2 focused failures, 233 passes). With the fix, both pass; the bounded count and deadline assertions additionally fail if latest-only coalescing or the timeout is removed. Needs saved CI evidence before blocking promotion."
},
"performanceBudget": {
"required": true,
"evidence": "Every Pi event does O(1) work and returns without awaiting I/O. Delivery retains at most one active request plus one latest pending object, uses one unref'd timer per active request, and creates no polling, provider scans, subprocesses outside the existing WSL failure fallback, or renderer work. The deterministic burst test proves three stalled events retain two delivery slots rather than an event-count-sized queue."
},
"promotionCriteria": [
"Run in soak for at least 100 consecutive passes or 14 days across required CI platforms.",
"Attach saved red/green evidence for both the unresolved-handler and false-done regressions.",
"Add a live Pi Electron test that stalls or restarts the hook listener during a running turn and proves terminal output continues."
],
"knownGaps": [
"No live model-backed Pi turn or Electron Running-view assertion is automated; the gate executes the exact generated extension and shared normalizer below those surfaces.",
"An already-running Pi process keeps its previously loaded extension until Pi reloads or restarts.",
"During receiver unavailability, intermediate status details may be coalesced to the latest snapshot; this is intentional and bounded, but no UI test measures the temporary detail loss.",
"SSH/remote and Windows are not exercised with live providers; relay ingest shares normalization and WSL fallback has mocked contract coverage."
],
"demotionRule": "Demote or quarantine if the gate flakes without a product or harness bug, if a Pi handler can again await receiver I/O, or if coalescing allows an older status to overwrite a newer one."
},
{
"id": "agent-session.provider-ownership",
"title": "Provider sessions are resumed once per workspace ownership claim",
"maturity": "experimental",
"protection": "partial",
"owner": "agent-session",
"layer": "renderer-state",
"surfaces": [
"agent launch",
"workspace activation",
"sleep and hibernate restore",
"provider session dedupe",
"sidebar and mobile identity"
],
"platforms": [
"macos",
"linux",
"windows"
],
"providers": [
"local",
"daemon",
"ssh",
"wsl",
"remote-runtime"
],
"coveredPlatforms": [
"macos"
],
"coveredProviders": [],
"coverageNotes": "Local macOS evidence over the ownership/dedupe suite on main@1282f5c2d. Queued/pending resume-claim indexing, same-session and wrong-session hook proofs, and Electron repeat-activation coverage arrive with the pending stack (#7008).",
"motivatingLinks": [
"https://github.com/stablyai/orca/pull/6800",
"https://github.com/stablyai/orca/pull/5240",
"https://github.com/stablyai/orca/pull/6411",
"https://github.com/stablyai/orca/pull/6833"
],
"invariant": "Workspace activation, launch, restore, sleep, hibernate, dedupe, clearing, and reconnect code must not replay or resume a provider session id already owned, queued, pending, or live in that workspace.",
"oracle": "The current renderer-state slice asserts provider-session claim keys are owned by preserved active tabs, inactive split leaves, visible non-focused split groups, live records, quit records, worktree-sleep records, queued startup payloads, time-bounded resume bridge claims, and same-session live hook evidence; duplicates clear without launching a second resume command. The provider list is the risk scope, not proof that every provider has a live integration gate.",
"commands": [
"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/lib/resume-sleeping-agent-session.test.ts"
],
"testFiles": [
"src/renderer/src/lib/resume-sleeping-agent-session.test.ts"
],
"assertionRefs": [
{
"file": "src/renderer/src/lib/resume-sleeping-agent-session.test.ts",
"assertions": [
"preserved panes claim their provider session and only stale duplicates are cleared",
"one launch per provider session: skipped duplicates are cleared instead of relaunched",
"active stable-pane records owned by preserved or visible panes are not resumed again",
"hibernated stable panes with cleared live PTY bindings are skipped"
]
}
],
"evidenceRuns": [
{
"date": "2026-07-03",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/lib/resume-sleeping-agent-session.test.ts",
"result": "passed",
"durationSeconds": 1.9,
"summary": "1 test file(s) passed, 30 tests passed on main@1282f5c2d in a clean checkout."
}
],
"runtimeBudget": {
"p95Seconds": 15,
"scope": "local renderer state test"
},
"flakeHistory": {
"status": "unknown",
"evidence": "Registered after targeted tests were found; needs soak history before blocking promotion."
},
"redGreenEvidence": {
"status": "partial",
"evidence": "Tests encode provider-session dedupe and ownership claims across active/inactive/visible split records, queued pendingStartupByTabId resume payloads, time-bounded runtime automaticAgentResumeClaimsByTabId bridge claims, live same-session hook evidence, wrong-session hook rejection, and a bounded queued-claim index over many records/tabs. Needs saved red/green artifact for the class-level replay invariant."
},
"performanceBudget": {
"required": true,
"evidence": "Current state tests are cheap and assert queued pending-startup provider-session ids are indexed once per activation. PRs adding new ownership scans must show bounded work over records and no hidden-pane wake loop before blocking promotion."
},
"promotionCriteria": [
"Run in soak for at least 100 consecutive passes or 14 days across required CI platforms.",
"Add bounded-work assertions for delayed hook/status ownership scans if those paths grow.",
"Attach red/green evidence that display/replay evidence alone cannot claim ownership."
],
"knownGaps": [
"Providers listed on this gate are affected identity surfaces; the current executable command is renderer-state coverage, not live local/daemon/SSH/WSL/remote-runtime coverage.",
"Current command models live same-session and wrong-session hook evidence, but does not run the real hook timing through Electron.",
"Current command does not run a real workspace activation loop repeatedly through Electron."
],
"demotionRule": "Demote or quarantine if failures are non-actionable or if a duplicate resume escape occurs outside the modeled matrix."
},
{
"id": "agent-session.remote-host-authority",
"title": "Remote agent sessions have one host-authoritative PTY and durable surface lifecycle",
"maturity": "experimental",
"protection": "partial",
"owner": "agent-session",
"layer": "runtime-controller-provider-renderer-contract",
"surfaces": [
"remote agent launch and explicit resume",
"multi-client remote runtime sessions",
"paired viewer-local structured agent focus",
"headed desktop remote-server pairing",
"headless remote-server parity",
"daemon and relay reconnect",
"remote completion classification across disconnect and reconnect",
"terminal exit retirement and restart restore",
"mixed-version fallback"
],
"platforms": [
"macos",
"linux",
"windows"
],
"providers": [
"local",
"daemon",
"ssh",
"wsl",
"remote-runtime"
],
"coveredPlatforms": [
"macos"
],
"coveredProviders": [
"local",
"daemon",
"ssh",
"wsl",
"remote-runtime"
],
"coverageNotes": "Deterministic macOS tests cover controller claims, daemon and SSH/relay operation replay, mixed-version selection, runtime ownership, exact provisional handoff, durable terminal retirement, two independent viewer mirrors, guarded adoption of legacy live PTYs, and completion classification when either the outer remote transport or authoritative host/provider process inspection becomes unreachable. The adoption harness models v1.4.150 agent/setup/shell tabs, current-generation restart and reconnect, exact handle/incarnation/worktree/host checks, topology CAS, competing clients, split-pane/group restoration, WSL ownership, and SSH owner rejection. The secondary parity repro runs independent clients against one headless remote Orca runtime over encrypted pairing and a real daemon-backed PTY, with tokened fixture-process identity separated from unrelated Codex app-server startup probes. The automated primary topology runs an isolated headed macOS Orca desktop server plus a separate paired web client and proves viewer-local fresh/resume focus, exact legacy placement, writable PTYs, unrelated-terminal survival, and host/client cleanup. SSH coverage is provider/relay contract and fault-injection coverage only; it does not substitute for paired-server coverage. Live Windows, Linux, WSL, SSH, and physical paired-Linux hosts remain gaps.",
"motivatingLinks": [
"https://github.com/stablyai/orca/issues/8878",
"https://github.com/stablyai/orca/issues/9151",
"https://github.com/stablyai/orca/issues/9352",
"https://github.com/stablyai/orca/pull/9687",
"https://github.com/stablyai/orca/issues/10192",
"https://github.com/stablyai/orca/pull/10193"
],
"invariant": "For every claim-capable execution route, one provider-session identity has at most one live PTY owner and one canonical host surface across concurrent clients, retries, reconnects, and stale publications. For paired structured fresh and resume requests, the authenticated owning runtime creates in background without a renderer window; activate=true focuses the exact requested leaf only on the requesting viewer, while activate=false changes no viewer focus. A live orphan may be adopted only when the controller proves its exact handle and incarnation, its worktree and host owner match, no competing visual owner exists, and a host topology CAS wins. A viewer may classify completion only from successful host/provider inspection or explicit lifecycle evidence; transport, handle, or provider unavailability remains unknown and breaks any consecutive-idle proof. A physical exit retires that exact incarnation durably so stale client state and host restart cannot recreate it. Mixed-version routes select the unchanged legacy request before any authority side effect or execution-owner-local filesystem access.",
"oracle": "Race independent clients and repeated operation IDs, then assert one physical spawn and one canonical PTY/surface; inject exit-before-reply, provider disconnect, conflicting claim scope, old daemon/relay capabilities, reused handles, stale incarnations, owner mismatch, and topology revision conflict; assert safe adoption or explicit failure without a second spawn or wrong-process attachment. Run fresh/resume with activate true/false against an isolated headed desktop host and a separate paired client, then against isolated headless serve: assert host presentation stays background, only the requesting viewer focuses the exact leaf, inactive calls preserve client/DOM focus, a same-version publication replay cannot lose focus intent, and sibling-first split publication cannot consume exact-leaf intent. Restore legacy split panes and groups beside a newer host-owned tab, preserving exact predecessor/new/successor order, output, input, resize, titles, tab/leaf identity, active group, and multi-client convergence. For completion, drive a known running agent through outer transport loss, authoritative provider rejection, reconnect, explicit stop, real exit status, and successful hook completion; assert unavailable evidence never dispatches completion and two fresh authoritative idle samples are required after the gap. After exact exit, assert terminal and tab listings omit the surface, a stale publication cannot restore it, restart cannot resurrect it, exact tokened fixture PIDs are dead, and unrelated tabs/processes survive until scoped cleanup.",
"commands": [
"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/rpc/methods/agent-session.test.ts src/renderer/src/runtime/web-runtime-session.test.ts src/renderer/src/runtime/web-session-tabs-sync.test.ts src/renderer/src/runtime/web-session-intent-owner.test.ts src/renderer/src/runtime/remote-server-parity.test.ts",
"pnpm exec vitest run --config config/vitest.config.ts src/shared/claimed-agent-pty-owner.test.ts src/main/daemon/daemon-pty-adapter.test.ts src/main/providers/ssh-pty-provider-agent-session-create-operation.test.ts src/main/runtime/orca-runtime-agent-session-operation.test.ts src/main/runtime/remote-agent-session-host-authority.integration.test.ts src/main/runtime/orca-runtime-terminal-retirement.test.ts src/renderer/src/components/terminal-pane/remote-runtime-pty-transport.test.ts src/renderer/src/runtime/remote-runtime-session-tabs-inflight.test.ts src/renderer/src/runtime/web-runtime-session.test.ts src/renderer/src/runtime/web-session-tabs-sync.test.ts",
"pnpm exec vitest run --config config/vitest.config.ts tests/e2e/remote-terminal-tab-retirement.unit.test.ts",
"pnpm test:repro:remote-agent-session",
"pnpm run build:cli && pnpm run build:electron-vite && node config/scripts/remote-agent-session-authority-repro.mjs",
"node --check config/scripts/remote-agent-session-process-cleanup.mjs && node config/scripts/remote-agent-session-authority-repro.mjs",
"pnpm exec electron-vite build --mode e2e",
"VITE_EXPOSE_STORE=true pnpm run build:web",
"ORCA_E2E_WEB_CLIENT=1 SKIP_BUILD=1 pnpm exec playwright test tests/e2e/remote-agent-session-focus-authority.spec.ts --config tests/playwright.config.ts --project electron-headful --workers=1",
"Manual headed paired-server journey: isolated Orca desktop host + separate paired web client + real Codex process + 20-second WebSocket fault + reconnect + explicit stop",
"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/orca-runtime.test.ts src/main/runtime/terminal-orphan-owner.test.ts src/main/runtime/terminal-orphan-topology.test.ts src/renderer/src/runtime/web-session-terminal-orphan-recovery.test.ts src/renderer/src/runtime/web-session-terminal-orphan-mixed-version.test.ts src/renderer/src/runtime/web-session-tabs-sync.test.ts --maxWorkers=1",
"pnpm exec vitest run --config config/vitest.config.ts src/main/providers/pty-process-inspection.test.ts src/main/daemon/terminal-host.test.ts src/main/daemon/daemon-pty-router.test.ts src/main/daemon/degraded-daemon-pty-provider.test.ts src/relay/pty-handler.test.ts src/main/daemon/daemon-pty-adapter.test.ts src/main/runtime/orca-runtime.test.ts tests/e2e/remote-agent-completion-authority.unit.test.ts src/renderer/src/runtime/runtime-terminal-inspection.test.ts src/renderer/src/components/terminal-pane/agent-completion-coordinator.test.ts",
"pnpm exec vitest run --config config/vitest.config.ts tests/e2e/remote-agent-completion-authority.unit.test.ts src/main/providers/pty-process-inspection.test.ts src/main/daemon/terminal-host.test.ts src/main/daemon/daemon-pty-router.test.ts src/main/daemon/degraded-daemon-pty-provider.test.ts src/relay/pty-handler.test.ts src/main/daemon/daemon-pty-adapter.test.ts src/renderer/src/runtime/runtime-terminal-inspection.test.ts src/renderer/src/components/terminal-pane/agent-completion-coordinator.test.ts src/renderer/src/components/terminal-pane/pty-connection.test.ts src/renderer/src/lib/codex-session-restart.test.ts"
],
"testFiles": [
"src/main/providers/pty-process-inspection.test.ts",
"src/main/daemon/terminal-host.test.ts",
"src/main/daemon/daemon-pty-router.test.ts",
"src/main/daemon/degraded-daemon-pty-provider.test.ts",
"src/relay/pty-handler.test.ts",
"src/main/runtime/orca-runtime.test.ts",
"tests/e2e/remote-agent-completion-authority.unit.test.ts",
"src/renderer/src/runtime/runtime-terminal-inspection.test.ts",
"src/renderer/src/components/terminal-pane/agent-completion-coordinator.test.ts",
"src/renderer/src/components/terminal-pane/pty-connection.test.ts",
"src/renderer/src/lib/codex-session-restart.test.ts",
"src/shared/claimed-agent-pty-owner.test.ts",
"src/main/daemon/daemon-pty-adapter.test.ts",
"src/main/providers/ssh-pty-provider-agent-session-create-operation.test.ts",
"src/main/runtime/orca-runtime-agent-session-operation.test.ts",
"src/main/runtime/remote-agent-session-host-authority.integration.test.ts",
"src/main/runtime/rpc/methods/agent-session.test.ts",
"src/main/runtime/orca-runtime-terminal-retirement.test.ts",
"src/renderer/src/components/terminal-pane/remote-runtime-pty-transport.test.ts",
"src/renderer/src/runtime/remote-runtime-session-tabs-inflight.test.ts",
"src/renderer/src/runtime/web-runtime-session.test.ts",
"src/renderer/src/runtime/web-session-tabs-sync.test.ts",
"src/renderer/src/runtime/web-session-intent-owner.test.ts",
"src/renderer/src/runtime/remote-server-parity.test.ts",
"tests/e2e/remote-agent-session-focus-authority.spec.ts",
"config/scripts/remote-agent-session-authority-repro.mjs",
"config/scripts/remote-agent-session-process-cleanup.mjs",
"tests/e2e/remote-terminal-tab-retirement.unit.test.ts",
"src/main/runtime/orca-runtime.test.ts",
"src/main/runtime/terminal-orphan-owner.test.ts",
"src/main/runtime/terminal-orphan-topology.test.ts",
"src/renderer/src/runtime/web-session-terminal-orphan-recovery.test.ts",
"src/renderer/src/runtime/web-session-terminal-orphan-mixed-version.test.ts"
],
"assertionRefs": [
{
"file": "src/main/runtime/orca-runtime.test.ts",
"assertions": [
"completion-sensitive process inspection preserves authoritative host/provider failures"
]
},
{
"file": "src/main/providers/pty-process-inspection.test.ts",
"assertions": [
"dedicated provider inspection preserves failures and rejects missing PTYs instead of returning idle evidence"
]
},
{
"file": "src/main/daemon/daemon-pty-router.test.ts",
"assertions": [
"completion inspection rejects an unmapped session instead of borrowing the current daemon"
]
},
{
"file": "src/main/daemon/degraded-daemon-pty-provider.test.ts",
"assertions": [
"completion inspection rejects an unmapped session instead of borrowing the local fallback"
]
},
{
"file": "src/relay/pty-handler.test.ts",
"assertions": [
"strict relay inspection rejects a missing PTY"
]
},
{
"file": "tests/e2e/remote-agent-completion-authority.unit.test.ts",
"assertions": [
"transport loss remains unknown through reconnect and cannot dispatch completion",
"returned unavailability or a thrown transport failure interrupts consecutive-idle proof and requires two fresh authoritative idle samples",
"explicit stop, real exit status, and genuine successful completion remain distinct"
]
},
{
"file": "src/renderer/src/runtime/runtime-terminal-inspection.test.ts",
"assertions": [
"direct SSH terminals use strict main-process inspection rather than lax split IPC evidence"
]
},
{
"file": "src/renderer/src/components/terminal-pane/pty-connection.test.ts",
"assertions": [
"completion polling uses the atomic process-inspection boundary without regressing established lifecycle behavior"
]
},
{
"file": "src/renderer/src/lib/codex-session-restart.test.ts",
"assertions": [
"one unreachable pane cannot suppress restart notices for another authoritatively confirmed Codex pane"
]
},
{
"file": "src/shared/claimed-agent-pty-owner.test.ts",
"assertions": [
"concurrent exact claims spawn once and later callers adopt the canonical owner",
"same identity in another worktree conflicts and cannot be found as the current scope's owner",
"generation-guarded exit and authoritative reconciliation cannot retire a replacement owner"
]
},
{
"file": "src/main/runtime/orca-runtime-agent-session-operation.test.ts",
"assertions": [
"old execution owners select exact legacy fallback before trust, spawn, or ledger mutation",
"nested SSH Pi resume selects legacy before reading the remote-only transcript path locally",
"fresh operation retries replay one result and retain a fence after an ambiguous physical commit"
]
},
{
"file": "src/main/runtime/remote-agent-session-host-authority.integration.test.ts",
"assertions": [
"independent runtime clients converge on one canonical live agent-session owner",
"retries and concurrent requests cannot create a second physical PTY"
]
},
{
"file": "src/main/runtime/orca-runtime-terminal-retirement.test.ts",
"assertions": [
"an exact PTY exit retires host membership and stale topology cannot recreate the surface",
"incarnation fencing prevents an old delayed exit from retiring a replacement PTY"
]
},
{
"file": "src/renderer/src/runtime/remote-runtime-session-tabs-inflight.test.ts",
"assertions": [
"a causally post-operation inventory waits out an older request and concurrent confirmations share the fresh request"
]
},
{
"file": "src/main/runtime/rpc/methods/agent-session.test.ts",
"assertions": [
"authenticated runtime and mobile structured requests normalize focused presentation to background before reaching the owning runtime",
"trusted in-process structured callers retain focused presentation"
]
},
{
"file": "src/renderer/src/runtime/web-runtime-session.test.ts",
"assertions": [
"fresh/resume activate true/false always request background host presentation and record focus intent only for active calls",
"a publication that beats the RPC response is replayed once without broad polling"
]
},
{
"file": "src/renderer/src/runtime/web-session-tabs-sync.test.ts",
"assertions": [
"only an exact structured-create handoff retires its provisional tab",
"an absent host tab retires its exact provisional handoff only after a causally post-create snapshot while unrelated tabs remain",
"adopted split sessions focus the exact requested leaf, preserve expanded-leaf state, and retain intent when a sibling publishes first"
]
},
{
"file": "tests/e2e/remote-agent-session-focus-authority.spec.ts",
"assertions": [
"headed desktop host remains unfocused while the paired requester alone follows active fresh/resume sessions and inactive rows preserve exact client/DOM focus",
"legacy afterTabId placement is exact in authoritative, mirrored, and rendered order with a pre-existing successor",
"host PTY inventory plus writable agent/unrelated shell markers prove liveness, unrelated survival, and exact terminal/tab/PTY/process cleanup"
]
},
{
"file": "config/scripts/remote-agent-session-authority-repro.mjs",
"assertions": [
"headless focused fresh/resume requests create background host surfaces without a renderer window",
"dropped committed responses replay the same operation identity without another tokened agent spawn",
"exact terminal/tab/process identity survives retries and stale-write rejection, then retires without restart resurrection while unrelated shells survive until scoped cleanup"
]
},
{
"file": "config/scripts/remote-agent-session-process-cleanup.mjs",
"assertions": [
"isolated daemon roots and captured descendants are verified dead before profile PID records are removed"
]
},
{
"file": "tests/e2e/remote-terminal-tab-retirement.unit.test.ts",
"assertions": [
"a durable host exit removes the terminal from two independent viewer mirrors instead of publishing a handle-less phantom",
"one exact exit produces one same-epoch higher-version host publication and one durable persistence flush",
"same-epoch stale publications cannot resurrect the retired surface after reconnect"
]
},
{
"file": "src/main/runtime/orca-runtime.test.ts",
"assertions": [
"v1.4.150-shaped agent, setup, and shell PTYs adopt as one CAS transaction while stale incarnation and competing clients fail safely",
"current-generation restart and disconnect/reconnect preserve output, input, resize, title, tab, leaf, handle, and incarnation identity",
"split-pane and multi-group legacy topology merges beside a newer host-owned terminal without replacing it",
"equivalent Windows and separator-normalized persisted worktree keys canonicalize without duplicate terminal topology",
"connection mismatch, reused handles, SSH ownership mismatch, and stale topology revisions cannot claim a live PTY while WSL ownership succeeds"
]
},
{
"file": "src/renderer/src/runtime/web-session-terminal-orphan-recovery.test.ts",
"assertions": [
"absence stays pending until an exact live orphan adoption settles",
"client pane and group topology is pruned to exact orphan claims and translated to host tab identities",
"a missing split leaf remains recoverable when another leaf in the same tab is already host-owned"
]
},
{
"file": "src/renderer/src/runtime/web-session-terminal-orphan-mixed-version.test.ts",
"assertions": [
"mixed-version inventory without incarnation evidence remains visible but cannot adopt",
"a truncated legacy unfiltered inventory cannot hide a candidate whose liveness is unresolved"
]
}
],
"evidenceRuns": [
{
"date": "2026-07-23",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/rpc/methods/agent-session.test.ts src/renderer/src/runtime/web-runtime-session.test.ts src/renderer/src/runtime/web-session-tabs-sync.test.ts src/renderer/src/runtime/web-session-intent-owner.test.ts src/renderer/src/runtime/remote-server-parity.test.ts",
"result": "passed",
"durationSeconds": 2.28,
"summary": "Five focused files and 140 tests passed on the structural candidate, covering authenticated host presentation normalization, trusted local preservation, fresh/resume viewer intent, same-version response/publication replay, exact split-leaf focus, sibling-first publication, and paired-runtime parity."
},
{
"date": "2026-07-23",
"runner": "local",
"platform": "macos",
"command": "pnpm test:repro:remote-agent-session",
"result": "passed",
"durationSeconds": 53.6,
"summary": "The build-backed isolated headless serve harness passed over encrypted pairing. Tokened fresh/resume fixture processes were distinguished from unrelated Codex app-server startup probes; response-loss replay, exact spawn identity/count, writable PTYs, unrelated survival, stale rejection, exact PID death, empty restart inventory, and no session resurrection all passed."
},
{
"date": "2026-07-23",
"runner": "local",
"platform": "macos",
"command": "ORCA_E2E_WEB_CLIENT=1 SKIP_BUILD=1 pnpm exec playwright test tests/e2e/remote-agent-session-focus-authority.spec.ts --config tests/playwright.config.ts --project electron-headful --workers=1",
"result": "passed",
"durationSeconds": 5.8,
"summary": "After fresh Electron E2E and exposed-store web builds, the isolated headed desktop host plus separate paired web client passed fresh/resume activate true/false, exact non-tail legacy placement in host/mirror/DOM, host focus isolation, requester-only exact focus, writable agent and unrelated shell markers, unrelated survival, and terminal/tab/PTY/process cleanup."
},
{
"date": "2026-07-22",
"runner": "manual",
"platform": "macos",
"command": "Manual headed paired-server journey: isolated Orca desktop host + separate paired web client + real Codex process + 20-second WebSocket fault + reconnect + explicit stop",
"result": "passed",
"durationSeconds": 549,
"summary": "The primary user topology used an isolated headed Orca desktop as the owning server and a separate paired Edge client. Host inspection reported Codex alive before, during, and after a page-scoped WebSocket fault; the client showed no completion toast, reconnected to the same live Codex TUI, and explicit stop restored the shell prompt with no child process."
},
{
"date": "2026-07-23",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts tests/e2e/remote-agent-completion-authority.unit.test.ts src/main/providers/pty-process-inspection.test.ts src/main/daemon/terminal-host.test.ts src/main/daemon/daemon-pty-router.test.ts src/main/daemon/degraded-daemon-pty-provider.test.ts src/relay/pty-handler.test.ts src/main/daemon/daemon-pty-adapter.test.ts src/renderer/src/runtime/runtime-terminal-inspection.test.ts src/renderer/src/components/terminal-pane/agent-completion-coordinator.test.ts src/renderer/src/components/terminal-pane/pty-connection.test.ts src/renderer/src/lib/codex-session-restart.test.ts",
"result": "passed",
"durationSeconds": 11.96,
"summary": "Eleven focused files and 870 tests passed on the current-main candidate. The cross-boundary harness fails with the implementation reverted by dispatching process-exit from unavailable remote evidence. Direct SSH uses strict main-process inspection, daemon and relay inspection reject missing or unmapped sessions, the terminal lifecycle suite uses the atomic inspection boundary, and one stale pane cannot suppress restart notices for a separately confirmed Codex pane."
},
{
"date": "2026-07-21",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/shared/claimed-agent-pty-owner.test.ts src/main/daemon/daemon-pty-adapter.test.ts src/main/providers/ssh-pty-provider-agent-session-create-operation.test.ts src/main/runtime/orca-runtime-agent-session-operation.test.ts src/main/runtime/remote-agent-session-host-authority.integration.test.ts src/main/runtime/orca-runtime-terminal-retirement.test.ts src/renderer/src/components/terminal-pane/remote-runtime-pty-transport.test.ts src/renderer/src/runtime/remote-runtime-session-tabs-inflight.test.ts src/renderer/src/runtime/web-runtime-session.test.ts src/renderer/src/runtime/web-session-tabs-sync.test.ts",
"result": "passed",
"durationSeconds": 7.67,
"summary": "Ten focused files and 325 tests passed after the final review fixes, covering claim scope, mixed-version Pi/SSH fallback ordering, operation replay, terminal retirement, causal inventory fencing, exact concurrent handoff confirmation, daemon-generation integration, transport behavior, and remote host integration."
},
{
"date": "2026-07-22",
"runner": "local",
"platform": "macos",
"command": "pnpm test:repro:remote-agent-session",
"result": "passed",
"durationSeconds": 48.63,
"summary": "The secondary build-backed headless parity harness passed post-rebase on main@72a2d7bc7 over encrypted WebSocket pairing with independent clients, proving one spawn, retry adoption, durable exit retirement, stale-publication rejection, and no restart resurrection."
},
{
"date": "2026-07-22",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts tests/e2e/remote-terminal-tab-retirement.unit.test.ts",
"result": "failed",
"durationSeconds": 3.11,
"summary": "The exact cross-boundary oracle failed on pre-#9687 commit 2a32c5c9a because the retired publication still contained the pinned persisted terminal surface."
},
{
"date": "2026-07-22",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts tests/e2e/remote-terminal-tab-retirement.unit.test.ts",
"result": "failed",
"durationSeconds": 3.48,
"summary": "The exact strengthened oracle failed on PR #9053 head d3a1d3047 because its stale-headless pruning retained the pinned persisted terminal surface."
},
{
"date": "2026-07-22",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts tests/e2e/remote-terminal-tab-retirement.unit.test.ts",
"result": "passed",
"durationSeconds": 3.18,
"summary": "The same strengthened oracle passed on main@4fce2de49."
}
],
"runtimeBudget": {
"p95Seconds": 30,
"scope": "focused ownership, compatibility, lifecycle, and renderer handoff tests; build-backed repro tracked separately"
},
"flakeHistory": {
"status": "unknown",
"evidence": "New experimental gate with deterministic local coverage and no soak history yet."
},
"redGreenEvidence": {
"status": "partial",
"evidence": "Issue #10192 has byte-identical renderer-oracle evidence: origin/main@ee87bb38d (and earlier ef985ed80 and 94d3db4a2) fails activated fresh and resume rows by requesting focused host presentation, the PR client change passes all four rows, and disabling it turns the activated rows red again. The original PR still fails an old-client focused request against a new headless host; host-boundary normalization turns that mixed-version control green while trusted local callers remain focused. Issue #9151 has local red/green evidence for completion authority. The exact retirement oracle is red on pre-#9687 commit 2a32c5c9a and PR #9053 head d3a1d3047, and green on main@4fce2de49. Saved CI artifacts are still needed."
},
"performanceBudget": {
"required": true,
"evidence": "Agent-session reconciliation runs only at explicit claim admission, dedupes concurrent provider listing, and adds no polling or renderer output work. Viewer focus reconciliation reuses the existing one post-create list and bounded intent map; same-version replay permits one already-received snapshot, and exact-leaf matching adds one conditional scan over the bounded tab snapshot. Completion inspection reuses the coordinator's per-pane in-flight guard, global concurrency/rate queue, and existing error backoff; the strict daemon path reduces two foreground RPCs to one. Create-operation ledgers are capped globally and per client, expire after 24 hours, and reject rather than evict live replay fences. Capability caches are bounded or connection-scoped, and exact handoffs are consumed by the next authoritative snapshot."
},
"promotionCriteria": [
"Run the focused gate and remote-server repro for at least 100 consecutive passes or 14 days across required CI platforms.",
"Attach saved red/green evidence for duplicate remote resume and exit-before-snapshot retirement.",
"Run the automated headed Orca desktop-server and paired-client journey in required CI lanes; add a physical host when OS, ConPTY, update, sleep, firewall, or window lifecycle is causal.",
"Add live SSH/WSL provider evidence before claiming full provider coverage; Docker SSH proves only the SSH provider/relay path."
],
"knownGaps": [
"The primary headed macOS desktop-server journey is automated locally but not yet run in CI; Windows and Linux window, ConPTY, update, sleep/wake, and firewall behavior remain uncollected.",
"Mixed-version pairings remain conservative only when the completion-aware client and strict-inspection host changes are both present; older peers retain their legacy classification behavior.",
"The secondary headless parity harness runs on macOS with a local daemon-backed execution owner and independent short-lived encrypted RPC clients; two persistent viewer-store mirrors and reconnect ordering are joined deterministically in the cross-boundary unit test rather than mounted live.",
"SSH and relay failure ordering is deterministic provider-contract coverage, not a live SSH-host journey or paired-Orca-server proof; WSL has no provider-specific run, and Linux and Windows runs remain uncollected.",
"Fresh-launch operation replay is memory-backed and intentionally does not survive runtime restart; a durable operation journal is a documented future extension.",
"Automatic sleep checkpoints, verified nested-SSH execution namespaces, and multi-process profile coordination remain outside v1."
],
"demotionRule": "Keep experimental or demote if the focused gate flakes without a product or harness bug, if a retry can physically spawn twice, if a stale exit/publication can replace or resurrect a terminal, or if mixed-version fallback occurs after an authority side effect."
},
{
"id": "runtime-routing.active-server-preference",
"title": "Active Server changes only through its explicit Advanced control",
"maturity": "experimental",
"protection": "partial",
"owner": "runtime-routing",
"layer": "main-preload-renderer-persistence-contract",
"surfaces": [
"Advanced Active Server setting",
"saved server Connect and Disconnect",
"remote workspace navigation",
"terminal reveal and create",
"browser and mobile handoff",
"app restart"
],
"platforms": [
"macos",
"linux",
"windows",
"mobile"
],
"providers": [
"local",
"remote-runtime",
"ssh",
"wsl"
],
"coveredPlatforms": [
"macos"
],
"coveredProviders": [
"local",
"remote-runtime",
"ssh",
"wsl"
],
"coverageNotes": "Platform-neutral deterministic tests separate the durable Active Server preference from per-client connection, selected-workspace, browser-session, and execution-host routing. The composed regression models Local desktop -> connect/navigate Windows 2 -> reveal a local terminal -> restart. Multi-client browser host overrides, multi-server profile caches, generic settings IPC rejection, local and remote workspace ownership, and restart reset of transient routing are covered. Live desktop UI runs remain uncollected.",
"motivatingLinks": [
"https://github.com/stablyai/orca/pull/9687"
],
"invariant": "Only an explicit user change in Settings > Remote Orca Servers > Advanced > Active Server may mutate activeRuntimeEnvironmentId. Connecting, pairing, disconnecting, selecting or revealing a workspace or terminal, browser/mobile handoff, remote navigation, and reconnect must use transient or target-owner routing and must never rewrite the durable preference. Generic settings mutation cannot bypass the dedicated preference IPC.",
"oracle": "Start with Active Server=Local desktop, connect and navigate Windows 2, then reveal a local terminal and assert it succeeds while the persisted preference remains local before and after restart. Repeat with multiple clients and servers, browser host switches, remote-owned and local-owned workspaces, pairing/connect/disconnect, and generic settings writes. Assert only the dedicated validated preference method changes activeRuntimeEnvironmentId and stale host-operation completions cannot overwrite the newly selected transient host.",
"commands": [
"pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/settings.test.ts src/main/ipc/runtime-environments.test.ts src/renderer/src/store/slices/settings.test.ts src/renderer/src/store/slices/browser.test.ts src/renderer/src/components/settings/browser-session-host-selection.test.ts src/renderer/src/components/settings/RuntimeEnvironmentsPane.test.ts src/renderer/src/components/status-bar/SshStatusSegment.test.ts src/renderer/src/components/sidebar/use-add-repo-host-selection.test.ts src/renderer/src/hooks/useIpcEvents.test.ts src/renderer/src/web/web-preload-api.test.ts --maxWorkers=1"
],
"testFiles": [
"src/main/ipc/settings.test.ts",
"src/main/ipc/runtime-environments.test.ts",
"src/renderer/src/store/slices/settings.test.ts",
"src/renderer/src/store/slices/browser.test.ts",
"src/renderer/src/components/settings/browser-session-host-selection.test.ts",
"src/renderer/src/components/settings/RuntimeEnvironmentsPane.test.ts",
"src/renderer/src/components/status-bar/SshStatusSegment.test.ts",
"src/renderer/src/components/sidebar/use-add-repo-host-selection.test.ts",
"src/renderer/src/hooks/useIpcEvents.test.ts",
"src/renderer/src/web/web-preload-api.test.ts"
],
"assertionRefs": [
{
"file": "src/main/ipc/settings.test.ts",
"assertions": [
"generic settings IPC strips activeRuntimeEnvironmentId while the dedicated validated IPC persists it",
"invalid preference types and unknown server identities cannot mutate the durable preference"
]
},
{
"file": "src/renderer/src/hooks/useIpcEvents.test.ts",
"assertions": [
"Local desktop remains the durable default after transient Windows 2 navigation and a focused local terminal reveal succeeds",
"local and remote terminal create route by target workspace ownership instead of the durable preference"
]
},
{
"file": "src/renderer/src/store/slices/browser.test.ts",
"assertions": [
"multiple clients select different transient browser hosts without changing Active Server",
"restart clears transient browser host override while retaining the durable local preference",
"late profile and import results update only their captured host and cannot overwrite a newer selection"
]
},
{
"file": "src/renderer/src/components/settings/browser-session-host-selection.test.ts",
"assertions": [
"a removed transient server override falls back to an available host instead of leaving browser settings on an invalid option"
]
},
{
"file": "src/renderer/src/components/settings/RuntimeEnvironmentsPane.test.ts",
"assertions": [
"connection status and the Advanced default-host selection are distinct concepts"
]
},
{
"file": "src/renderer/src/web/web-preload-api.test.ts",
"assertions": [
"generic web settings writes cannot mutate Active Server",
"the dedicated web preference setter rejects unknown server identities without corrupting the saved choice"
]
}
],
"evidenceRuns": [
{
"date": "2026-07-22",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/settings.test.ts src/main/ipc/runtime-environments.test.ts src/renderer/src/store/slices/settings.test.ts src/renderer/src/store/slices/browser.test.ts src/renderer/src/components/settings/browser-session-host-selection.test.ts src/renderer/src/components/settings/RuntimeEnvironmentsPane.test.ts src/renderer/src/components/status-bar/SshStatusSegment.test.ts src/renderer/src/components/sidebar/use-add-repo-host-selection.test.ts src/renderer/src/hooks/useIpcEvents.test.ts src/renderer/src/web/web-preload-api.test.ts --maxWorkers=1",
"result": "passed",
"durationSeconds": 6.55,
"summary": "Ten files and 282 tests passed, including the composed Local -> Windows 2 navigation -> local reveal -> restart regression, dedicated-only preference persistence, removed transient-host fallback, multi-client browser routing, late host-operation suppression, and web pairing/preference separation."
}
],
"runtimeBudget": {
"p95Seconds": 20,
"scope": "focused persistence and routing contract tests"
},
"flakeHistory": {
"status": "unknown",
"evidence": "New deterministic gate with no soak history."
},
"redGreenEvidence": {
"status": "partial",
"evidence": "The user-observed local terminal reveal failure and unintended Active Server switch are encoded by deterministic routing and persistence tests; a saved intentional-break artifact is not yet attached."
},
"performanceBudget": {
"required": false,
"evidence": "Preference writes are explicit user actions; transient routing adds no polling and uses existing host/worktree indexes."
},
"promotionCriteria": [
"Run the focused gate in soak across macOS, Linux, and Windows.",
"Attach a live Windows Local -> Windows 2 -> local reveal -> restart artifact.",
"Attach saved red/green evidence for generic settings mutation and transient connection routing."
],
"knownGaps": [
"The exact journey is deterministic contract coverage, not a packaged Windows UI automation run.",
"Browser/mobile handoff is covered through transient routing state and preload contracts, not a live phone browser session."
],
"demotionRule": "Demote or block release if any non-Advanced path mutates Active Server, if local reveal depends on the durable default instead of workspace ownership, or if transient host state survives restart."
},
{
"id": "terminal-geometry.visible-convergence",
"title": "Visible desktop terminals converge across xterm, fit, PTY, shell, and runtime mirror size",
"maturity": "experimental",
"protection": "partial",
"owner": "terminal-rendering",
"layer": "renderer-provider-contract",
"surfaces": [
"PTY sizing",
"split layout",
"restore",
"hidden-to-visible transitions",
"window wake"
],
"platforms": [
"macos",
"linux",
"windows"
],
"providers": [
"local",
"daemon",
"ssh",
"remote-runtime"
],
"coveredPlatforms": [
"macos"
],
"coveredProviders": [],
"coverageNotes": "Local macOS evidence on main@1282f5c2d, including #7192's runtime-mirror geometry authority slice. Deterministic provider-contract coverage now includes settled window-wake reassertion and SSH relay applied-size readback. Live shell-visible SSH/remote geometry and Windows ConPTY readback remain non-blocking gaps.",
"motivatingLinks": [
"https://github.com/stablyai/orca/pull/6644",
"https://github.com/stablyai/orca/pull/6649",
"https://github.com/stablyai/orca/pull/6725",
"https://github.com/stablyai/orca/pull/6785",
"https://github.com/stablyai/orca/pull/6853",
"https://github.com/stablyai/orca/pull/6939",
"https://github.com/stablyai/orca/pull/7192"
],
"invariant": "A visible desktop-owned terminal cannot trust 0x0, stale requested size, or renderer-only size; xterm, fit/proposed size, applied PTY size, shell-visible size, and the runtime mirror's parse dimensions must converge or enter explicit degraded state, and mirror resize reflow must stay ordered with queued output writes.",
"oracle": "The current executable slice uses deterministic frame schedulers and fake providers to force 0x0 first fit, delayed layout settle, dropped resize/readback drift, hidden-to-visible activation, and window wake. It asserts the renderer forwards a usable size, pty:getSize reports applied rather than merely requested size where available, visibility resume reasserts real drift without hot listSessions, one settled wake produces one geometry-only readback, and SSH relay readback is authoritative with bounded fallback. Shell-visible stty/echo-wrap convergence remains a live-gate follow-up.",
"commands": [
"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/pty-size-reconcile.test.ts src/renderer/src/components/terminal-pane/pty-size-reassertion.test.ts src/renderer/src/components/terminal-pane/split-right-white-screen.test.ts src/renderer/src/components/terminal-pane/use-terminal-window-wake-recovery.test.ts src/main/ipc/pty.test.ts src/main/providers/ssh-pty-provider.test.ts src/main/runtime/orca-runtime.test.ts src/relay/pty-handler.test.ts"
],
"testFiles": [
"src/renderer/src/components/terminal-pane/pty-size-reconcile.test.ts",
"src/renderer/src/components/terminal-pane/pty-size-reassertion.test.ts",
"src/renderer/src/components/terminal-pane/split-right-white-screen.test.ts",
"src/renderer/src/components/terminal-pane/use-terminal-window-wake-recovery.test.ts",
"src/main/ipc/pty.test.ts",
"src/main/providers/ssh-pty-provider.test.ts",
"src/main/runtime/orca-runtime.test.ts",
"src/relay/pty-handler.test.ts"
],
"assertionRefs": [
{
"file": "src/renderer/src/components/terminal-pane/pty-size-reconcile.test.ts",
"assertions": [
"hidden delayed narrow settle is forwarded instead of stopping on a fixed frame budget",
"unmeasurable frames do not count as settled",
"applied-size readback divergence is re-forwarded before handoff"
]
},
{
"file": "src/renderer/src/components/terminal-pane/pty-size-reassertion.test.ts",
"assertions": [
"only one applied-size read stays in flight while the grid changes",
"stale in-flight targets never resize the PTY back to an older grid"
]
},
{
"file": "src/renderer/src/components/terminal-pane/split-right-white-screen.test.ts",
"assertions": [
"0x0 split-right spawn recovers when the container becomes measurable",
"visible permanently-unmeasurable 0x0 pane gets a nonzero safe fallback",
"hidden 0x0 background spawn is not forced to phantom desktop size"
]
},
{
"file": "src/renderer/src/components/terminal-pane/use-terminal-window-wake-recovery.test.ts",
"assertions": [
"window focus reasserts PTY size after fitting",
"the immediate and settled wake fits produce exactly one geometry-only reassertion"
]
},
{
"file": "src/main/ipc/pty.test.ts",
"assertions": [
"accepted desktop resizes fan out to the runtime after provider resize",
"rejected desktop resizes do not fan out to the runtime",
"provider-owned null remains unverified instead of falling back to requested size"
]
},
{
"file": "src/main/providers/ssh-pty-provider.test.ts",
"assertions": [
"SSH applied-size readback uses the relay with a one-second timeout",
"old-relay method-not-found is cached while transient failures remain retryable"
]
},
{
"file": "src/main/runtime/orca-runtime.test.ts",
"assertions": [
"the headless mirror resizes after an accepted desktop PTY resize (#7192)",
"headless mirror resizes are ordered behind queued PTY writes (#7192)"
]
},
{
"file": "src/relay/pty-handler.test.ts",
"assertions": [
"relay readback reports the grid actually applied by node-pty",
"missing relay PTYs return an unverified null size"
]
}
],
"evidenceRuns": [
{
"date": "2026-07-21",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/pty-size-reconcile.test.ts src/renderer/src/components/terminal-pane/pty-size-reassertion.test.ts src/renderer/src/components/terminal-pane/split-right-white-screen.test.ts src/renderer/src/components/terminal-pane/use-terminal-window-wake-recovery.test.ts src/main/ipc/pty.test.ts src/main/providers/ssh-pty-provider.test.ts src/main/runtime/orca-runtime.test.ts src/relay/pty-handler.test.ts",
"result": "passed",
"durationSeconds": 18.54,
"summary": "8 test files passed, 1,272 tests passed on the PR branch."
}
],
"runtimeBudget": {
"p95Seconds": 60,
"scope": "provider-contract or focused Electron test"
},
"flakeHistory": {
"status": "unknown",
"evidence": "Deterministic Vitest slices passed locally; no CI soak history yet."
},
"redGreenEvidence": {
"status": "partial",
"evidence": "#7192 proved the mirror slice red before its fix (snapshot stayed 80x24, queued write parsed at the wrong width). The renderer 0x0/settle slices do not have recorded red runs."
},
"performanceBudget": {
"required": true,
"evidence": "The wake hook count test permits two visual fits but exactly one applied-size read per visible pane and no broad visibility/agent lifecycle call. SSH readback has a one-second timeout, caches stable method-not-found, and retries only transient failures. No polling, listSessions scan, subprocess, or unbounded retry was added."
},
"promotionCriteria": [
"Build deterministic fault hooks before adding broad E2E coverage.",
"Keep stress variants non-blocking until runtime and flake history are known."
],
"knownGaps": [
"Local and Docker-backed SSH Electron wake specs exist but remain manual/non-blocking pending runtime and flake history.",
"The deterministic gate proves the SSH provider/relay readback contract, not live shell-visible convergence across every remote path.",
"Does not yet prove Windows ConPTY geometry/readback.",
"Current command uses deterministic fake providers for the main/renderer contracts, not a real remote PTY."
],
"demotionRule": "Cannot promote without deterministic oracle and runtime history."
},
{
"id": "xterm-addon.boundary-containment",
"title": "xterm addon failures stay pane-scoped and input survives",
"maturity": "experimental",
"protection": "partial",
"owner": "terminal-rendering",
"layer": "renderer-unit",
"surfaces": [
"terminal search",
"links",
"WebGL",
"decorations",
"keyboard navigation"
],
"platforms": [
"macos",
"linux",
"windows"
],
"providers": [
"local",
"daemon",
"ssh",
"remote-runtime"
],
"coveredPlatforms": [
"macos"
],
"coveredProviders": [],
"coverageNotes": "Local macOS evidence over the WebGL/link/search containment suites on main@1282f5c2d, adopting the #6949 atlas-recovery rename and #7133's reveal hardening tests. Core addon-load throw containment and live typed-input survival arrive with #7004 and a live follow-up.",
"motivatingLinks": [
"https://github.com/stablyai/orca/pull/6852",
"https://github.com/stablyai/orca/pull/6872",
"https://github.com/stablyai/orca/pull/6855"
],
"invariant": "Search, link, WebGL, decoration, input-protocol, or keyboard-navigation errors must not unmount the terminal surface, crash React/window, break focus, or stop PTY input/output.",
"oracle": "The current executable slice injects a core addon load throw and asserts pane opening continues through later addons, covers link provider throws as pane-scoped no-link results, covers search decoration positive-integer failures as false results instead of renderer crashes, and covers WebGL attach/refresh/recovery containment. Focused typed input echo after addon failure still needs a live/component follow-up.",
"commands": [
"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/lib/pane-manager/terminal-link-provider-guard.test.ts src/renderer/src/components/terminal-search-safe-find.test.ts src/renderer/src/lib/pane-manager/pane-webgl-refresh-lifecycle.test.ts src/renderer/src/components/terminal-pane/terminal-webgl-atlas-recovery.test.ts src/renderer/src/lib/pane-manager/pane-webgl-context-recovery.test.ts src/renderer/src/lib/pane-manager/pane-webgl-renderer.test.ts src/renderer/src/lib/pane-manager/pane-reveal-repaint.test.ts src/renderer/src/components/terminal-pane/terminal-visibility-resume.test.ts"
],
"testFiles": [
"src/renderer/src/lib/pane-manager/terminal-link-provider-guard.test.ts",
"src/renderer/src/components/terminal-search-safe-find.test.ts",
"src/renderer/src/lib/pane-manager/pane-webgl-refresh-lifecycle.test.ts",
"src/renderer/src/components/terminal-pane/terminal-webgl-atlas-recovery.test.ts",
"src/renderer/src/lib/pane-manager/pane-webgl-context-recovery.test.ts",
"src/renderer/src/lib/pane-manager/pane-webgl-renderer.test.ts",
"src/renderer/src/lib/pane-manager/pane-reveal-repaint.test.ts",
"src/renderer/src/components/terminal-pane/terminal-visibility-resume.test.ts"
],
"assertionRefs": [
{
"file": "src/renderer/src/lib/pane-manager/terminal-link-provider-guard.test.ts",
"assertions": [
"link-provider throws are reproduced and contained without escaping the surface"
]
},
{
"file": "src/renderer/src/components/terminal-search-safe-find.test.ts",
"assertions": [
"the xterm positive-integers decoration crash is swallowed while unrelated errors re-throw"
]
},
{
"file": "src/renderer/src/lib/pane-manager/pane-webgl-refresh-lifecycle.test.ts",
"assertions": [
"WebGL teardown/refresh lifecycle stays pane-scoped and cancels on dispose"
]
},
{
"file": "src/renderer/src/components/terminal-pane/terminal-webgl-atlas-recovery.test.ts",
"assertions": [
"risky-output atlas recovery is bounded, coalesced, and survives a throwing manager"
]
},
{
"file": "src/renderer/src/lib/pane-manager/pane-webgl-context-recovery.test.ts",
"assertions": [
"failed attach backs off and context-lost panes recover on the next rendering resume"
]
},
{
"file": "src/renderer/src/lib/pane-manager/pane-webgl-renderer.test.ts",
"assertions": [
"attach bail disposes the addon instead of orphaning it (#7133 single-addon invariant)"
]
},
{
"file": "src/renderer/src/lib/pane-manager/pane-reveal-repaint.test.ts",
"assertions": [
"reveal repaint waits for a settled frame and keeps repainting when one pane throws (#7133)"
]
},
{
"file": "src/renderer/src/components/terminal-pane/terminal-visibility-resume.test.ts",
"assertions": [
"tab reveal, heavy reveal, and window wake schedule pane-scoped repaint (#7133)"
]
}
],
"evidenceRuns": [
{
"date": "2026-07-03",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/lib/pane-manager/terminal-link-provider-guard.test.ts src/renderer/src/components/terminal-search-safe-find.test.ts src/renderer/src/lib/pane-manager/pane-webgl-refresh-lifecycle.test.ts src/renderer/src/components/terminal-pane/terminal-webgl-atlas-recovery.test.ts src/renderer/src/lib/pane-manager/pane-webgl-context-recovery.test.ts src/renderer/src/lib/pane-manager/pane-webgl-renderer.test.ts src/renderer/src/lib/pane-manager/pane-reveal-repaint.test.ts src/renderer/src/components/terminal-pane/terminal-visibility-resume.test.ts",
"result": "passed",
"durationSeconds": 0.8,
"summary": "8 test file(s) passed, 33 tests passed on main@1282f5c2d in a clean checkout."
}
],
"runtimeBudget": {
"p95Seconds": 30,
"scope": "renderer unit or component test"
},
"flakeHistory": {
"status": "unknown",
"evidence": "Focused renderer-unit containment slice passed locally on 2026-07-02; needs soak history before promotion."
},
"redGreenEvidence": {
"status": "partial",
"evidence": "#7133 proved the reveal-hardening slice against live corrupted specimens; the link/search guards reproduce their original crashes in-test. No recorded red runs for the refresh-lifecycle slice."
},
"performanceBudget": {
"required": false,
"evidence": "Required only if containment adds retry loops, polling, or renderer fallback churn."
},
"promotionCriteria": [
"Add deterministic addon throw injection.",
"Prove input/output survives after boundary failure."
],
"knownGaps": [
"Current command is renderer-unit containment, not live Electron typed input/output survival after addon failure.",
"Does not yet inject WebGL dispose/reset throws and active/hidden/resumed pane focus recovery in one component-level oracle."
],
"demotionRule": "Cannot promote while it only checks visual rendering."
},
{
"id": "terminal-scroll.intent-preservation",
"title": "Scrollbar drag intent survives tab and visibility resume",
"maturity": "experimental",
"protection": "partial",
"owner": "terminal-rendering",
"layer": "renderer-unit",
"surfaces": [
"terminal lifecycle",
"hidden-to-visible resume",
"tab switching",
"xterm scrollbar DOM",
"scrollback"
],
"platforms": [
"macos",
"linux",
"windows"
],
"providers": [
"local",
"daemon",
"ssh",
"wsl",
"remote-runtime"
],
"coveredPlatforms": [
"macos"
],
"coveredProviders": [],
"coverageNotes": "Renderer-unit coverage proves the shared xterm DOM intent path. Live Electron evidence is PR validation evidence for local macOS only until the flow has stable automation; live SSH, WSL, Linux, and Windows paths remain unproved.",
"motivatingLinks": [
"STA-1341"
],
"invariant": "A user-driven xterm scrollbar thumb or track scroll updates the live terminal scroll intent before tab, visibility, or layout resume enforces intent, so resume preserves the latest dragged viewport instead of an older pinned line.",
"oracle": "Pointerdown on .xterm-scrollbar or .xterm-slider followed by xterm viewport movement records the new pinned viewport, and enforcing current intent restores that dragged line instead of stale top intent.",
"commands": [
"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/lib/pane-manager/terminal-scroll-intent.test.ts"
],
"testFiles": [
"src/renderer/src/lib/pane-manager/terminal-scroll-intent.test.ts"
],
"assertionRefs": [
{
"file": "src/renderer/src/lib/pane-manager/terminal-scroll-intent.test.ts",
"assertions": [
"pointer-driven .xterm-scrollbar and .xterm-slider scrolls update terminal scroll intent",
"a scrollbar-dragged viewport is restored instead of stale top intent",
"terminal body pointer activity is not treated as scrollbar intent"
]
}
],
"evidenceRuns": [
{
"date": "2026-07-05",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/lib/pane-manager/terminal-scroll-intent.test.ts",
"result": "passed",
"durationSeconds": 0.3,
"summary": "1 test file(s) passed, 17 tests passed in this worktree."
}
],
"runtimeBudget": {
"p95Seconds": 10,
"scope": "focused renderer unit test"
},
"flakeHistory": {
"status": "unknown",
"evidence": "New experimental gate; needs soak history before promotion."
},
"redGreenEvidence": {
"status": "partial",
"evidence": "The new scrollbar DOM target assertions fail when only .xterm-viewport pointerdown is recognized. Needs saved CI/intentional-break artifact before blocking promotion."
},
"performanceBudget": {
"required": true,
"evidence": "Runtime fix is limited to constant-time class/closest checks on pointerdown. It must not add polling, output parsing, PTY listing, hidden-pane wakeups, resize calls, or startup awaits."
},
"promotionCriteria": [
"Collect stable CI soak history for the renderer-unit gate.",
"Add stable live Electron automation for the scrollbar drag plus tab-switch repro.",
"Attach red/green evidence for stale intent restoring the wrong viewport."
],
"knownGaps": [
"Manifest command is deterministic renderer-unit coverage, not a live Electron scrollbar drag.",
"Live daemon, SSH, WSL, remote-runtime, Linux, and Windows validation is not covered by this gate.",
"Future xterm scrollbar DOM class changes are only caught if they break the currently modeled class contract."
],
"demotionRule": "Demote or quarantine if the unit gate flakes without a product bug or harness bug filed to the owner."
},
{
"id": "startup-upgrade.persisted-session-corpus",
"title": "Current Orca preserves or recovers old production persisted sessions",
"maturity": "experimental",
"protection": "none",
"owner": "startup-persistence",
"layer": "upgrade-fixture",
"surfaces": [
"startup",
"upgrade",
"session restore",
"daemon restore"
],
"platforms": [
"macos",
"linux",
"windows"
],
"providers": [
"local",
"daemon",
"ssh",
"wsl"
],
"coveredPlatforms": [],
"coveredProviders": [],
"coverageNotes": "Registered gap only; no executable coverage is wired yet.",
"motivatingLinks": [
"https://github.com/stablyai/orca/issues/5356",
"https://github.com/stablyai/orca/pull/5234",
"https://github.com/stablyai/orca/pull/5240"
],
"invariant": "Startup and restore fixes must preserve or explicitly recover sessions from the last affected production persisted-state schema, not only from state written by current code.",
"oracle": "Boot current Orca against immutable copied user-data fixtures from affected versions and reject blank replacement panes, duplicate resume tabs, silent session loss, or works-only-after-current-write behavior.",
"commands": [],
"testFiles": [],
"assertionRefs": [],
"evidenceRuns": [],
"runtimeBudget": {
"p95Seconds": 120,
"scope": "focused Electron upgrade fixture"
},
"flakeHistory": {
"status": "not-started",
"evidence": "Fixture corpus not implemented."
},
"redGreenEvidence": {
"status": "missing",
"evidence": "Needs immutable pre-fix persisted-state fixture."
},
"performanceBudget": {
"required": true,
"evidence": "Startup fixture must record startup latency and avoid adding blocking migration scans."
},
"promotionCriteria": [
"Land immutable old-version fixture with documented source version.",
"Run second restart after current code writes upgraded state.",
"Record startup timing and failure artifact."
],
"knownGaps": [
"No fixture corpus or command yet."
],
"demotionRule": "Cannot promote without old production fixture provenance."
},
{
"id": "terminal-platform.live-pty-liveness",
"title": "A real Electron local PTY accepts input, survives workspace restore, resizes, and exits cleanly",
"maturity": "experimental",
"protection": "none",
"owner": "terminal-runtime",
"layer": "electron-live-pty",
"surfaces": [
"active terminal PTY binding",
"xterm focus",
"keyboard input",
"PTY output",
"workspace hide and restore",
"resize",
"exit cleanup"
],
"platforms": [
"linux",
"macos"
],
"providers": [
"local"
],
"coveredPlatforms": [],
"coveredProviders": [],
"coverageNotes": "Registered gap on main. The live Electron Playwright slice exists only on the pending reliability stack. It registers here with its owning split PR.",
"motivatingLinks": [
"https://github.com/stablyai/orca/pull/6801",
"https://github.com/stablyai/orca/pull/6842",
"https://github.com/stablyai/orca/pull/6939",
"https://github.com/stablyai/orca/pull/6989"
],
"invariant": "An active local Electron terminal has one active PTY id listed exactly once, accepts real keyboard input through focused xterm, renders process output visibly, keeps the same live PTY across repeated workspace hide/restore cycles, applies an actual size change, and removes the old PTY from liveness state after exit.",
"oracle": "A deterministic raw-mode probe prints a ready marker, ordered key markers from real keyboard input, the active PTY id appears exactly once in pty:listSessions, remains bound to the same PTY id across two worktree switch-away/switch-back cycles, accepts more keyboard input after each restore, changes pty:getSize after viewport resize, prints the same process-visible size, and prints an exit marker; after shell exit, pty:listSessions no longer contains the old id.",
"commands": [],
"testFiles": [],
"assertionRefs": [],
"evidenceRuns": [],
"runtimeBudget": {
"p95Seconds": 75,
"scope": "focused Electron live PTY gate including e2e build/setup"
},
"flakeHistory": {
"status": "unknown",
"evidence": "Focused Playwright gate passed locally after adding two workspace hide/restore cycles, exact active-PTY listing, and actual resize convergence on 2026-07-02: 1 test passed, 8.6s test body, 58.6s full command including build/setup. Needs repeated CI/runtime history before promotion."
},
"redGreenEvidence": {
"status": "partial",
"evidence": "The gate asserts PTY binding, active PTY listed exactly once, real xterm keyboard delivery, same-PTY ownership across repeated workspace hide/restore cycles, post-restore input delivery, actual pty:getSize change, matching process-visible size, and listSessions cleanup after shell exit. Needs saved intentional-break evidence before promotion."
},
"performanceBudget": {
"required": true,
"evidence": "Must record key latencies, size snapshots, and final liveness state. The gate may use broad listing as a test oracle; product hot paths must not use broad provider listing as a synchronization primitive."
},
"promotionCriteria": [
"Implement without blind sleeps; wait only on PTY binding, probe markers, size marker, and liveness absence.",
"Run in soak on Linux before blocking; keep macOS as soak until stable.",
"Attach red/green evidence for focus, PTY write, resize, and exit cleanup failures."
],
"knownGaps": [
"No executable coverage on main yet; the slice lives on the pending fix-terminal-reliability stack.",
"Needs soak/runtime history before promotion.",
"Does not yet cover tab switch inside one worktree, scrollback after restore, or app restart persistence.",
"Does not cover Windows ConPTY, SSH, WSL, daemon, or remote-runtime providers."
],
"demotionRule": "Cannot promote without deterministic user-visible oracle, failure artifacts, and stable runtime history."
},
{
"id": "terminal-session.windows-main-crash-survival",
"title": "A Windows main-process crash preserves and reattaches daemon terminals",
"maturity": "experimental",
"protection": "partial",
"owner": "terminal-platform",
"layer": "windows-packaged-electron-daemon",
"surfaces": [
"Electron main-process crash",
"detached terminal daemon",
"ConPTY shell survival",
"packaged relaunch reattach"
],
"platforms": ["windows"],
"providers": ["daemon"],
"coveredPlatforms": ["windows"],
"coveredProviders": ["daemon"],
"coverageNotes": "A packaged Windows CI run force-kills the launched instance's real Electron main without tree-killing, then proves the same scoped daemon and interactive PowerShell survive, no FailFast event is observed, and relaunch input reaches the same shell. Focused cross-platform unit tests fail closed on unavailable event-log or PID-liveness evidence, stale or ambiguous daemon identity, and incomplete reattach assertions.",
"motivatingLinks": [
"https://github.com/stablyai/orca/issues/7742",
"https://github.com/stablyai/orca/pull/9311"
],
"invariant": "On packaged Windows, abrupt death of Orca's Electron main process must not terminate or replace the userData-scoped terminal daemon or its live ConPTY shell, and a relaunch must adopt that exact daemon and route terminal input to that exact surviving shell without a PowerShell 0xE9 FailFast.",
"oracle": "Resolve the launched instance's real main PID from inside Electron, force-kill only that PID, require it to die, require one command-line-scoped daemon PID and the stamped interactive shell PID to remain live, relaunch with persisted state, require the daemon PID to remain identical, read the exact shell PID and a per-shell environment sentinel back through the exact restored tab, then require a successful Windows Application event-log query with zero matching pwsh FailFast events across the full crash-to-input window.",
"commands": [
"pnpm exec vitest run --config config/vitest.config.ts config/scripts/win-crash-survival-e2e.test.mjs",
"node tools/win-crash-survival-e2e/run.mjs --expect survival --exe-path \"$env:ORCA_EXE\" --soak-seconds 8"
],
"testFiles": [
"config/scripts/win-crash-survival-e2e.test.mjs",
"tools/win-crash-survival-e2e/run.mjs"
],
"assertionRefs": [
{
"file": "config/scripts/win-crash-survival-e2e.test.mjs",
"assertions": [
"survival requires the crash antecedent, daemon and shell liveness, unchanged daemon identity, zero FailFast events, and same-shell reattach",
"event-log query failure cannot be converted into zero FailFast events",
"malformed event-log and PID-liveness evidence fails closed",
"stale, missing, or ambiguous userData-scoped daemon identity fails closed",
"the packaged survival proof remains wired to targeted pull requests without a duplicate branch-push run"
]
},
{
"file": "tools/win-crash-survival-e2e/run.mjs",
"assertions": [
"force-killing only the real Electron main leaves the exact scoped daemon and stamped interactive shell alive",
"packaged relaunch adopts the unchanged daemon and reads the survivor shell's environment sentinel through the restored terminal"
]
}
],
"evidenceRuns": [
{
"date": "2026-07-18",
"runner": "ci",
"platform": "windows",
"command": "node tools/win-crash-survival-e2e/run.mjs --expect survival --exe-path \"$env:ORCA_EXE\" --soak-seconds 8",
"result": "passed",
"durationSeconds": 61,
"summary": "The packaged branch build's real main died; the same daemon and shell PIDs survived; the event-log scan found zero FailFast events; relaunch adopted the unchanged daemon; and terminal input read the survivor shell sentinel back."
}
],
"runtimeBudget": {
"p95Seconds": 120,
"scope": "installed-app crash/relaunch harness, excluding installer build and dependency setup"
},
"flakeHistory": {
"status": "unknown",
"evidence": "One green packaged Windows CI run is recorded; the durable pull-request trigger must accumulate repeated history before promotion."
},
"redGreenEvidence": {
"status": "partial",
"evidence": "The inverse orphaned profile failed against the fixed packaged build because the daemon stayed live and no FailFast occurred. A genuinely pre-relocation packaged build has not yet been retained as a CI red fixture."
},
"performanceBudget": {
"required": true,
"evidence": "Production code is unchanged. The harness has bounded 500ms liveness polls, one 8-second crash soak, two scoped daemon identity scans plus teardown rediscovery, a 60-second cap on every synchronous PowerShell probe, a 5-second cap on Electron main-PID resolution, cleared and unreferenced close deadlines, a 50-minute job timeout, concurrency cancellation, and targeted production-path filtering that excludes source tests and benchmarks. The installer cache is keyed by every production build input; the job also restores the pnpm store and restores Electron/NSIS downloads only when an installer rebuild is required. The measured packaged harness completed in 61 seconds."
},
"promotionCriteria": [
"Collect at least 100 consecutive targeted Windows PR or soak passes over 14 days with zero unexplained flakes.",
"Retain a pre-relocation packaged red fixture or equivalent fault injection that makes the survival profile fail for daemon death and shell loss.",
"Keep the live oracle fail-closed for crash delivery, event-log access, daemon identity, and same-shell reattach."
],
"knownGaps": [
"The packaged journey proves one terminal end to end; concurrent restoration across the user's multi-terminal, multi-worktree layout is not exercised live.",
"The gate covers a Windows local daemon-backed PowerShell terminal; WSL-backed shells are not exercised.",
"SSH, remote-runtime, relay, mobile, macOS, and Linux paths are unaffected by the Windows relocated ConPTY host contract and are not exercised here.",
"The Application event-log query is machine-wide, so an unrelated PowerShell crash on a non-isolated runner can false-fail the gate.",
"Standalone daemon self-crash and renderer-only crash containment remain separate invariants."
],
"demotionRule": "Keep experimental or quarantine with a linked harness defect if the Windows job flakes; never weaken the crash, identity, event-log, or same-shell reattach oracle to obtain a pass."
},
{
"id": "terminal-platform.windows-conpty-liveness",
"title": "Windows ConPTY terminals stay input-live, render-live, and geometry-live",
"maturity": "experimental",
"protection": "partial",
"owner": "terminal-platform",
"layer": "windows-electron-conpty",
"surfaces": [
"Windows ConPTY",
"PowerShell and cmd",
"keyboard protocol",
"CJK repaint",
"cursor and resize"
],
"platforms": [
"windows"
],
"providers": [
"local",
"daemon",
"wsl"
],
"coveredPlatforms": [
"windows"
],
"coveredProviders": [
"daemon"
],
"coverageNotes": "Issue #8048 now has deterministic wrapper and cold-restore re-anchor tests plus a Windows PR-CI harness that drives the built daemon through 25 real ConPTY workspace-close races while an unrelated witness PTY stays alive. Keyboard reset, CJK repaint, WSL, and full visible Electron coverage remain gaps.",
"motivatingLinks": [
"https://github.com/stablyai/orca/pull/6541",
"https://github.com/stablyai/orca/pull/6858",
"https://github.com/stablyai/orca/pull/6876",
"https://github.com/stablyai/orca/pull/6968",
"https://github.com/stablyai/orca/pull/6970",
"https://github.com/stablyai/orca/pull/6999",
"https://github.com/stablyai/orca/issues/8048"
],
"invariant": "Windows local and daemon terminals must spawn with the intended shell, survive overlapping graceful/forced workspace teardown without affecting unrelated PTYs, retain recovered scrollback across the fresh daemon's first checkpoint, accept normal Enter/Backspace/Arrow input after agent or TUI exit, render cursor/CJK/wide-glyph redraws without stale cells, and converge to nonzero applied size.",
"oracle": "The issue #8048 slice asserts one node-pty ConPTY close for a graceful-then-force sequence, atomically seeds recovered history before fresh shell output and re-anchoring, preserves recovery after seed failure plus adapter restart, and runs 25 built-daemon close races while checking victim session/PID reaping, a stable daemon PID, and a live witness PTY. A broader Windows live gate still needs shell input, resize, cursor, and CJK/wide-glyph pixel evidence.",
"commands": [
"pnpm vitest run src/main/daemon/pty-subprocess.test.ts src/main/daemon/daemon-pty-adapter.test.ts",
"pnpm build:electron-vite && node config/scripts/windows-daemon-workspace-close-repro.mjs",
"node config/scripts/windows-daemon-workspace-close-repro.mjs"
],
"testFiles": [
"src/main/daemon/pty-subprocess.test.ts",
"src/main/daemon/daemon-pty-adapter.test.ts",
"config/scripts/windows-daemon-workspace-close-repro.mjs"
],
"assertionRefs": [
{
"file": "src/main/daemon/pty-subprocess.test.ts",
"assertions": [
"graceful kill followed by force and dispose invokes Windows node-pty kill exactly once and never retries the dead child PID"
]
},
{
"file": "src/main/daemon/daemon-pty-adapter.test.ts",
"assertions": [
"the first checkpoint orders recovered scrollback before synchronously emitted fresh-shell startup output",
"a failed atomic history seed remains non-authoritative across adapter restart and cannot overwrite the recovery files"
]
},
{
"file": "config/scripts/windows-daemon-workspace-close-repro.mjs",
"assertions": [
"all 25 victim sessions and OS PIDs are reaped while the built daemon PID and an unrelated witness PowerShell remain alive"
]
}
],
"evidenceRuns": [
{
"date": "2026-07-10",
"runner": "local",
"platform": "windows",
"command": "node config/scripts/windows-daemon-workspace-close-repro.mjs",
"result": "passed",
"durationSeconds": 7.6,
"summary": "All 25 victim sessions and OS PIDs were reaped while the built daemon and witness PTY survived the real ConPTY workspace-close races. The double-close, history ordering, and seed-failure restart regressions produced intentional red failures before their fixes and passed afterward."
}
],
"runtimeBudget": {
"p95Seconds": 90,
"scope": "Windows focused Electron ConPTY gate"
},
"flakeHistory": {
"status": "unknown",
"evidence": "The built-daemon issue #8048 harness passed locally once and is wired into Windows PR CI; it needs repeated CI history before promotion."
},
"redGreenEvidence": {
"status": "partial",
"evidence": "The ConPTY double-close and cold-restore re-anchor assertions were each observed failing before the fix and passing afterward. Keyboard protocol, shell resolution, resize, and CJK repaint still need red/green proof."
},
"performanceBudget": {
"required": true,
"evidence": "Must include input latency and no broad session listing while typing or switching terminals."
},
"promotionCriteria": [
"Start as Windows nightly/soak because Windows Electron E2E has been flaky.",
"Use deterministic PTY markers for input/resize and reserve screenshots for repaint diagnostics.",
"Split shell parity, keyboard reset, and CJK repaint into smaller gates if a combined gate is flaky."
],
"knownGaps": [
"Real IME composition may require a separate lower-layer/native-text-forwarding gate.",
"The built-daemon harness proves process/session liveness but not renderer pixels; visible shell input, resize, cursor, and CJK repaint remain uncovered."
],
"demotionRule": "Cannot promote while Windows E2E is flaky, silently skipped, or screenshot-only."
},
{
"id": "terminal-performance.cold-restore-replay-budget",
"title": "Daemon cold restore keeps replay work and retained payloads bounded",
"maturity": "experimental",
"protection": "partial",
"owner": "terminal-runtime",
"layer": "main-daemon-unit",
"surfaces": [
"startup restore",
"daemon history replay",
"sleep and hibernation restore",
"main-process memory"
],
"platforms": ["macos", "linux", "windows"],
"providers": ["daemon", "wsl"],
"coveredPlatforms": ["macos"],
"coveredProviders": ["daemon"],
"coverageNotes": "Deterministic main-process tests cover byte-bounded cache eviction and ACK release, one-at-a-time replay admission, a fixed per-turn replay budget within one large output record, UTF-16 boundary preservation, and checkpoint-only restore bypass while another replay is paused. The same HistoryReader path carries WSL context, but live WSL and cross-platform startup-scale runs remain gaps.",
"motivatingLinks": [
"https://github.com/stablyai/orca/issues/9971",
"https://github.com/stablyai/orca/pull/9990",
"https://github.com/stablyai/orca/issues/9441"
],
"invariant": "Cold restore must reproduce persisted terminal output while admitting at most one scratch-emulator replay, yielding after at most 64 Ki UTF-16 code units or 1,024 replay operations, keeping sticky restore payloads within 16 MiB, and allowing header-only checkpoint restores to bypass the replay queue.",
"oracle": "Pause setImmediate during two single-batch restores larger than one replay slice and require exactly one admitted yield at a time, preserved text across a surrogate-pair slice boundary, and a concurrent header-only checkpoint restore to finish without consuming a replay slot. Cache tests require least-recently-used eviction, rejection of one oversized payload, and zero retained cache bytes after renderer ACK.",
"commands": [
"pnpm exec vitest run --config config/vitest.config.ts src/main/daemon/cold-restore-payload-cache.test.ts src/main/daemon/history-reader.test.ts src/main/daemon/terminal-history-incremental-restore.test.ts src/main/daemon/hibernation-cold-restore-repro.test.ts src/main/daemon/daemon-pty-adapter.test.ts"
],
"testFiles": [
"src/main/daemon/cold-restore-payload-cache.test.ts",
"src/main/daemon/history-reader.test.ts",
"src/main/daemon/terminal-history-incremental-restore.test.ts",
"src/main/daemon/hibernation-cold-restore-repro.test.ts",
"src/main/daemon/daemon-pty-adapter.test.ts"
],
"assertionRefs": [
{
"file": "src/main/daemon/terminal-history-incremental-restore.test.ts",
"assertions": [
"large single-batch replays yield within the record, preserve a surrogate pair at the slice boundary, and admit only one scratch replay at a time",
"a header-only checkpoint restore completes while an unrelated incremental replay is paused"
]
},
{
"file": "src/main/daemon/cold-restore-payload-cache.test.ts",
"assertions": [
"least-recently-used payloads are evicted to the aggregate byte budget",
"one payload larger than the entire budget is not retained"
]
},
{
"file": "src/main/daemon/daemon-pty-adapter.test.ts",
"assertions": [
"StrictMode remount receives sticky cold-restore data until renderer ACK clears its retained bytes"
]
}
],
"evidenceRuns": [
{
"date": "2026-07-22",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/main/daemon/cold-restore-payload-cache.test.ts src/main/daemon/history-reader.test.ts src/main/daemon/terminal-history-incremental-restore.test.ts src/main/daemon/hibernation-cold-restore-repro.test.ts src/main/daemon/daemon-pty-adapter.test.ts",
"result": "passed",
"durationSeconds": 5.68,
"summary": "Five focused files passed 150 tests, including deterministic single-record replay slicing, one-at-a-time admission, UTF-16 boundary preservation, header-only queue bypass, byte-bounded LRU eviction, and ACK cleanup."
}
],
"runtimeBudget": {
"p95Seconds": 15,
"scope": "focused main-process cold-restore unit contract"
},
"flakeHistory": {
"status": "unknown",
"evidence": "The focused deterministic slice is new and has no CI or soak history yet."
},
"redGreenEvidence": {
"status": "partial",
"evidence": "The prior implementation had no yield inside one large batch and queued header-only restores behind the shared semaphore by inspection; an intentional pre-fix test run was not recorded."
},
"performanceBudget": {
"required": true,
"evidence": "Production admits one emulator replay globally, yields after a deterministic 64 Ki character or 1,024-operation budget even within one record, bypasses the semaphore for the common header-only final-checkpoint path, and caps sticky payloads at 16 MiB. No polling, subprocess, session inventory, or renderer wake loop is added."
},
"promotionCriteria": [
"Record an intentional-break red run for both the within-record yield and header-only bypass assertions.",
"Collect startup event-loop-delay evidence with dozens of near-cap histories on representative macOS, Windows, and Linux hardware.",
"Add live WSL restore evidence before claiming WSL coverage."
],
"knownGaps": [
"The log decoder and final headless snapshot serialization remain synchronous inside the one-at-a-time replay slot; the gate bounds replay writes, not every CPU phase.",
"No live Electron startup-scale run currently proves first-pane paint order or end-to-end restore latency with dozens of histories.",
"SSH, remote-runtime, relay, and mobile do not use this local daemon history reader and are unaffected."
],
"demotionRule": "Keep experimental or demote to protection none if output differs across replay slices, header-only restores consume a replay slot, retained payload bytes exceed the cap, or the focused gate flakes."
},
{
"id": "terminal-performance.no-hot-list-sessions",
"title": "Hot terminal interactions do not call global PTY session listing",
"maturity": "experimental",
"protection": "partial",
"owner": "terminal-performance",
"layer": "ipc-count-contract",
"surfaces": [
"typing",
"focus",
"tab switch",
"workspace switch",
"visibility resume",
"resize",
"render"
],
"platforms": [
"macos",
"linux",
"windows"
],
"providers": [
"local",
"daemon",
"ssh",
"wsl",
"remote-runtime"
],
"coveredPlatforms": [
"macos"
],
"coveredProviders": [],
"coverageNotes": "Platform-neutral unit coverage proves the Resource Manager closed badge performs one readiness seed, coalesces unknown spawn signals, skips known-session reattach signals, and installs no interval. Broader terminal interaction coverage remains on the pending reliability stack.",
"motivatingLinks": [
"https://github.com/stablyai/orca/pull/7002",
"https://github.com/stablyai/orca/pull/6858",
"https://github.com/stablyai/orca/issues/9386",
"https://github.com/stablyai/orca/pull/9387"
],
"invariant": "Typing, focus, terminal switch, workspace switch, visibility resume, resize, render, and per-pane liveness paths must not call global pty:listSessions; they must use targeted per-PTY APIs or cached provider-owned state.",
"oracle": "The current executable slice asserts targeted visibility/first-input liveness, resize re-assertion after visibility resume, light tab/active-state resume, SSH/remote skip behavior, and a closed Resource Manager budget of one readiness seed plus one coalesced inventory read only for unknown spawn IDs; known-session reattach signals and steady closed time perform zero reads. Targeted hasPty/getSize calls are allowed for liveness/resize slices and forbidden for light tab/active-state resume. The full hot-path oracle still needs instrumentation around raw focus, split focus, workspace switch, render ticks, and high-session local/daemon/SSH fixtures.",
"commands": [
"pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/pty.test.ts src/renderer/src/components/status-bar/use-resource-session-inventory.test.tsx src/renderer/src/components/status-bar/resource-session-inventory.test.ts src/renderer/src/components/status-bar/ResourceUsageStatusSegment.session-polling.test.ts"
],
"testFiles": [
"src/main/ipc/pty.test.ts",
"src/renderer/src/components/status-bar/use-resource-session-inventory.test.tsx",
"src/renderer/src/components/status-bar/resource-session-inventory.test.ts",
"src/renderer/src/components/status-bar/ResourceUsageStatusSegment.session-polling.test.ts"
],
"assertionRefs": [
{
"file": "src/renderer/src/components/status-bar/use-resource-session-inventory.test.tsx",
"assertions": [
"the false-to-true workspace readiness transition performs one daemon inventory seed",
"a failed readiness seed surfaces an error and a later inventory refresh recovers",
"known-session reattach signals perform zero additional inventory reads",
"multiple unknown background spawn signals coalesce to one inventory read",
"spawn signals during a slow inventory read never overlap provider-wide scans and cause at most one required follow-up",
"unknown sessions that exit before reconciliation cancel their queued inventory read",
"unmount during a slow inventory read cannot schedule follow-up work",
"exit and out-of-order refresh races cannot resurrect stale sessions"
]
},
{
"file": "src/main/ipc/pty.test.ts",
"assertions": [
"global inventory starts local and SSH provider listings concurrently"
]
},
{
"file": "src/renderer/src/components/status-bar/resource-session-inventory.test.ts",
"assertions": [
"daemon inventory construction copies its source and preserves count parity",
"single and batch removals preserve unrelated sessions and no-op references"
]
},
{
"file": "src/renderer/src/components/status-bar/ResourceUsageStatusSegment.session-polling.test.ts",
"assertions": [
"the closed inventory hook installs no interval",
"the badge count comes from cached daemon inventory rather than wake-hint bindings"
]
}
],
"evidenceRuns": [
{
"date": "2026-07-22",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/pty.test.ts src/renderer/src/components/status-bar/use-resource-session-inventory.test.tsx src/renderer/src/components/status-bar/resource-session-inventory.test.ts src/renderer/src/components/status-bar/ResourceUsageStatusSegment.session-polling.test.ts",
"result": "passed",
"durationSeconds": 4.3,
"summary": "4 files and 358 tests passed, covering readiness seed/recovery, zero interval polling, bounded unknown-spawn reconciliation, concurrent provider starts, exit fencing, cleanup, and out-of-order refresh fencing."
}
],
"runtimeBudget": {
"p95Seconds": 20,
"scope": "unit or focused Electron count gate"
},
"flakeHistory": {
"status": "unknown",
"evidence": "Focused count tests now run locally; needs soak history before promotion."
},
"redGreenEvidence": {
"status": "partial",
"evidence": "Tests assert visibility resume prefers targeted hasPty over listSessions, first input after visibility resume calls targeted hasPty once, resize re-assertion after visibility resume uses getSize/resize without listSessions, light tab switches and visible active-state resume avoid listSessions/hasPty/getSize fanout while still allowing the active PTY scheduler hint, SSH/remote broad listing is skipped, and the closed Resource Manager performs one readiness seed while known reattach signals and steady time perform no additional reads. Needs broader raw focus/workspace-switch/render/high-session count coverage before promotion."
},
"performanceBudget": {
"required": true,
"evidence": "This gate is the performance budget for global session listing in hot paths."
},
"promotionCriteria": [
"Add deterministic call-count instrumentation.",
"Cover typing, focus, switch, visibility resume, resize, and render separately.",
"Run with enough preserved sessions/providers to make a broad listing observable."
],
"knownGaps": [
"Current commands cover Resource Manager readiness/lifecycle inventory counts; the broader targeted-liveness slice still lives on the pending fix-terminal-reliability stack.",
"Current coverage includes the closed Resource Manager's no-interval and known-reattach budgets, but not every hot interaction listed in the invariant.",
"No Electron or IPC-level high-session counter gate yet proves raw focus, workspace switch, render, or high-session typing stay at zero global listSessions calls."
],
"demotionRule": "Cannot promote if the test allows broad listing in any hot interaction path."
},
{
"id": "terminal-observability.lifecycle-breadcrumbs",
"title": "Terminal lifecycle anomalies enter crash diagnostics as compact breadcrumbs",
"maturity": "experimental",
"protection": "none",
"owner": "terminal-runtime",
"layer": "renderer-observability",
"surfaces": [
"terminal lifecycle",
"reattach",
"restore",
"provider ownership",
"diagnostics bundle"
],
"platforms": [
"macos",
"linux",
"windows"
],
"providers": [
"local",
"daemon",
"ssh",
"wsl",
"remote-runtime"
],
"coveredPlatforms": [],
"coveredProviders": [],
"coverageNotes": "Registered gap on main. The crash-breadcrumb recording and its test exist only on the pending reliability stack. It registers here with its owning split PR.",
"motivatingLinks": [
"https://github.com/stablyai/orca/pull/6800",
"https://github.com/stablyai/orca/issues/6773"
],
"invariant": "Terminal lifecycle anomalies around reattach, restore, provider ownership, stale liveness, and fallback routing must leave compact, deduped, privacy-safe breadcrumbs in crash diagnostics so future reports can be attributed from evidence.",
"oracle": "The current executable slice calls warnTerminalLifecycleAnomaly with terminal identity, provider, PTY id, binding epoch, and reason, then asserts the existing console warning is preserved and a compact terminal_lifecycle_anomaly crash breadcrumb is recorded once per lifecycle identity. Full pane transition traces and diagnostics-bundle artifact proof remain follow-ups.",
"commands": [],
"testFiles": [],
"assertionRefs": [],
"evidenceRuns": [],
"runtimeBudget": {
"p95Seconds": 10,
"scope": "renderer observability unit test"
},
"flakeHistory": {
"status": "unknown",
"evidence": "Focused unit slice passed locally once; no CI soak history yet."
},
"redGreenEvidence": {
"status": "partial",
"evidence": "Tests would fail if lifecycle anomalies stopped recording crash breadcrumbs or stopped deduping repeated identities. Needs diagnostics-bundle artifact proof and full transition-trace evidence before promotion."
},
"performanceBudget": {
"required": true,
"evidence": "Breadcrumb recording is deduped and capped by the existing lifecycle anomaly guard; full trace buffers must include size and event-count caps before promotion."
},
"promotionCriteria": [
"Add full compact pane lifecycle trace buffer with event-count caps.",
"Prove diagnostics bundle includes recent terminal lifecycle breadcrumbs or traces.",
"Add forbidden-transition tests for stale close, unknown owner fallback, and stuck zero-size panes."
],
"knownGaps": [
"No executable coverage on main yet; the slice lives on the pending fix-terminal-reliability stack.",
"Current command records anomaly breadcrumbs only, not a full pane lifecycle state-machine trace.",
"Current command does not prove crash/diagnostics bundle export includes the breadcrumb.",
"Current command does not assert forbidden transitions across live Electron/provider flows."
],
"demotionRule": "Cannot promote if diagnostics are console-only, unbounded, or missing from support artifacts."
},
{
"id": "terminal-performance.output-backpressure-budget",
"title": "Terminal output backpressure stays bounded from daemon to renderer",
"maturity": "experimental",
"protection": "partial",
"owner": "terminal-performance",
"layer": "provider-ipc-renderer-perf",
"surfaces": [
"daemon stream",
"main PTY batching",
"runtime path provenance",
"runtime terminal wait detection",
"renderer ACK",
"xterm scheduler",
"hidden output"
],
"platforms": [
"macos",
"linux",
"windows"
],
"providers": [
"local",
"daemon",
"ssh",
"remote-runtime"
],
"coveredPlatforms": [
"macos"
],
"coveredProviders": [],
"coverageNotes": "Local macOS evidence covers the existing main-process pending-output caps plus deterministic runtime path-provenance history reuse and saturated-tail wait detection. Daemon stream write(false)/drain contracts, cross-session drain priority, and bounded queued tails arrive with the pending perf slice; live flood/latency artifacts remain gaps.",
"motivatingLinks": [
"https://github.com/stablyai/orca/pull/6836",
"https://github.com/stablyai/orca/pull/6858",
"https://github.com/stablyai/orca/pull/7002",
"https://github.com/stablyai/orca/pull/7054"
],
"invariant": "High-volume terminal output must stay bounded across daemon socket writes, main runtime metadata, detectors, and tail checks, main-to-renderer in-flight bytes, renderer scheduler queues, and hidden-output restore without starving focused input.",
"oracle": "The current executable slice injects main-process renderer backlog pressure, then asserts unchanged path-provenance history reuse for pathless output, ordinary terminal-wait detection without a joined-tail allocation and with full prompt-family continuity, per-PTY and total pending-output caps, preserved sequenced-tail metadata, active-pending protection ahead of background trimming, and ACK-gated in-flight bounds. The live Electron perf oracle adds hidden-output floods, renderer scheduler queue depth, dropped-output-zero normal scenarios, and active key latency budgets before promotion.",
"commands": [
"pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/pty.test.ts",
"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/orca-runtime-path-candidate-history.test.ts",
"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/orca-runtime.test.ts src/main/runtime/orca-runtime-tail-wait-memo.test.ts"
],
"testFiles": [
"src/main/ipc/pty.test.ts",
"src/main/runtime/orca-runtime-path-candidate-history.test.ts",
"src/main/runtime/orca-runtime.test.ts",
"src/main/runtime/orca-runtime-tail-wait-memo.test.ts"
],
"assertionRefs": [
{
"file": "src/main/ipc/pty.test.ts",
"assertions": [
"total renderer in-flight output is capped across many PTYs",
"active PTY pending output is prioritized during renderer backpressure",
"combined pending output exceeding the interactive size limit is batched"
]
},
{
"file": "src/main/runtime/orca-runtime-path-candidate-history.test.ts",
"assertions": [
"reuses path-candidate history across repeated pathless PTY output",
"copies history when new output adds a path candidate"
]
},
{
"file": "src/main/runtime/orca-runtime-tail-wait-memo.test.ts",
"assertions": [
"does not rebuild or repeatedly scan an ordinary saturated tail",
"memoized stamping matches recompute reference: blocked prompt split across chunks",
"stays equivalent across tail eviction beyond the retained cap"
]
},
{
"file": "src/main/runtime/orca-runtime.test.ts",
"assertions": [
"returns a blocked wait result for Codex update prompts",
"returns a blocked wait result for Codex workspace trust prompts",
"returns a blocked wait result for generic Codex interactive prompts",
"resolves tui-idle when a stale Codex prompt is followed by the ready header"
]
}
],
"evidenceRuns": [
{
"date": "2026-07-03",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/pty.test.ts",
"result": "passed",
"durationSeconds": 1.5,
"summary": "1 test file(s) passed, 209 tests passed on main@1282f5c2d in a clean checkout."
},
{
"date": "2026-07-10",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/orca-runtime-path-candidate-history.test.ts",
"result": "passed",
"durationSeconds": 3.49,
"summary": "1 test file passed, 2 tests passed on the exact rebased tree based on main@dc468f0ded."
},
{
"date": "2026-07-10",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/orca-runtime.test.ts src/main/runtime/orca-runtime-tail-wait-memo.test.ts",
"result": "passed",
"durationSeconds": 21.33,
"summary": "2 test files passed, 609 tests passed on pushed commit 4fb14eac3897."
}
],
"runtimeBudget": {
"p95Seconds": 120,
"scope": "deterministic provider/IPC contract now; terminal perf soak/report gate before promotion"
},
"flakeHistory": {
"status": "unknown",
"evidence": "Focused main-process backlog tests are deterministic unit slices. The combined perf soak still needs runtime history before promotion."
},
"redGreenEvidence": {
"status": "partial",
"evidence": "Tests assert pathless runtime output reuses unchanged path-provenance history with zero old-candidate byte scans, ordinary saturated terminal tails retain no rebuilt wait text or repeated phrase scans while every blocked/ready prompt family remains live, main pending renderer output is capped per PTY and in total, total-pressure trimming prefers background pending output before active pending output, trimmed pending tails preserve seq/rawLength metadata, and ACK-gated in-flight output remains bounded. Intentionally restoring the old path-history shape failed the focused scale test after 774ms and 4,096 replacements; disabling the ordinary-tail branch failed with a retained 253,999-character waitText. The fixed shapes passed their focused suites. Existing renderer tests cover replay/backlog slices. Needs daemon-stream contract coverage and broader hidden-output/input-latency perf artifacts before promotion."
},
"performanceBudget": {
"required": true,
"evidence": "Suggested ceilings: renderer in-flight <=8MB total, <=512KB per PTY plus active reserve, renderer queued chars <=2MB, dropped backlogs 0, hidden restore <=1000ms, active key median/worst <=75ms/300ms in perf scenarios. With 1,024 retained provenance candidates, 4,096 pathless chunks dropped from 78.84ms and 4,096 array replacements to 1.74ms and zero replacements. Brace-free 1 KiB output dropped from 20.32/79.12/318.23ms to 0.31/0.64/2.35ms across 4,096/16,384/65,536 chunks. Repeated ordinary 252,000-character tail checks dropped from 96.34/464.20/941.79/3,796.70ms to 3.21/15.68/31.34/129.72ms across 100/500/1,000/4,096 updates."
},
"promotionCriteria": [
"Split daemon stream backpressure into a deterministic provider/IPC contract if full E2E is flaky.",
"Record JSON artifacts with bytes, dropped counts, queue depth, timer drift, and key latency.",
"Keep stress variants non-blocking until stable runtime history exists."
],
"knownGaps": [
"Daemon stream write(false)/drain/cleanup and bounded queued-tail contracts are not registered in the current command.",
"Runtime provenance coverage is deterministic and does not include a live high-throughput provider artifact.",
"Terminal-wait scale evidence is deterministic and does not yet include a live saturated-tail event-loop artifact.",
"Current command does not prove renderer parse pressure, scheduler queue depth, event-loop delay, or active key latency.",
"Live hidden-output pressure, active input latency, and full Electron perf artifacts remain unproved."
],
"demotionRule": "Cannot promote without metric artifacts and bounded-byte assertions."
},
{
"id": "terminal-provider.daemon-startup-degraded-contract",
"title": "Daemon startup reconcile and degraded fallback preserve provider identity",
"maturity": "experimental",
"protection": "none",
"owner": "terminal-provider",
"layer": "provider-contract",
"surfaces": [
"daemon startup",
"degraded daemon",
"fallback PTY",
"provider ownership",
"startup restore"
],
"platforms": [
"macos",
"linux",
"windows"
],
"providers": [
"daemon",
"local"
],
"coveredPlatforms": [],
"coveredProviders": [],
"coverageNotes": "Registered gap on main. The fail-closed degraded-daemon hardening and its contracts exist only on the pending reliability stack. It registers here with its owning split PR.",
"motivatingLinks": [
"https://github.com/stablyai/orca/pull/6830",
"https://github.com/stablyai/orca/pull/6866",
"https://github.com/stablyai/orca/pull/7002"
],
"invariant": "Daemon startup reconciliation must preserve valid live daemon sessions, reap only true orphans, and degraded mode must not route an existing-looking daemon session through local fallback unless the caller explicitly marks a fresh degraded-mode spawn.",
"oracle": "The current provider-contract corpus covers valid current-worktree ids, folder/floating workspace ids, invalid removed-worktree ids, mixed live/orphan dry-run reconciliation, hyphenated worktree ids, malformed ids, daemon sessions discovered after restart, router discovery before existing-session spawn, router fail-closed behavior when legacy ownership cannot be listed or a known session has exited, degraded daemon fallback for fresh sessions, fail-closed behavior for unknown restored ids, benign inspection defaults for unknown ownership, and synthetic exits on daemon restart. Prior-worktree aliases and renamed-worktree startup wiring are promotion gaps, not current proof.",
"commands": [],
"testFiles": [],
"assertionRefs": [],
"evidenceRuns": [],
"runtimeBudget": {
"p95Seconds": 20,
"scope": "provider contract unit/integration test"
},
"flakeHistory": {
"status": "unknown",
"evidence": "Focused provider contract tests now run locally; needs soak history before promotion."
},
"redGreenEvidence": {
"status": "partial",
"evidence": "Tests assert discovered daemon sessions route to the daemon, fresh degraded-mode PTYs route to fallback only when marked new, router spawn discovers uncached existing sessions before choosing an adapter, router spawn fails closed instead of falling through to current when legacy listing fails or a known session has exited, targeted hasPty discovery caches legacy ownership before later write/resize-style operations, real daemon adapter listProcesses discovery seeds targeted hasPty liveness, folder and floating terminal workspace ids survive startup reconcile when valid, restored worktree-scoped and legacy/non-scoped ids do not fall back through spawn after ownership is lost or unknown, operations on unknown or exited existing ids fail closed, startup reconcile can dry-run orphan detection without killing live sessions, and process inspection returns benign defaults for unknown ownership. Production startup reconcile wiring remains unproven."
},
"performanceBudget": {
"required": true,
"evidence": "Reconcile must not add startup-blocking scans beyond the explicit daemon session inventory and must not leak global listing into hot paths."
},
"promotionCriteria": [
"Wire reconcileOnStartup or mark the production wiring gap explicitly.",
"Cover priorWorktreeIds so renamed worktrees are not falsely reaped."
],
"knownGaps": [
"No executable coverage on main yet; the slice lives on the pending fix-terminal-reliability stack.",
"Production startup reconcile wiring remains unproven.",
"Prior-worktree aliases and renamed-worktree startup reconcile are not covered by the current executable corpus.",
"Real daemon restart behavior is still covered only by lower-level synthetic exit and provider-contract tests."
],
"demotionRule": "Cannot promote while restored daemon ids or routing operations can silently route to local fallback."
},
{
"id": "terminal-provider.startup-shutdown-authority",
"title": "Cold-start terminal shutdown targets the installed daemon provider",
"maturity": "experimental",
"protection": "partial",
"owner": "terminal-provider",
"layer": "main-provider-contract",
"surfaces": [
"daemon startup",
"renderer terminal close",
"runtime terminal stop",
"restored terminal teardown"
],
"platforms": [
"macos",
"linux",
"windows"
],
"providers": [
"local",
"daemon",
"ssh"
],
"coveredPlatforms": [
"macos"
],
"coveredProviders": [
"local",
"daemon",
"ssh"
],
"coverageNotes": "A real daemon server over a local socket proves a fresh adapter can kill a live session before any prior client operation. Main-process tests prove renderer IPC, runtime kill, and runtime exact-stop wait for the provider swap and issue zero shutdowns to the fallback provider, while SSH spawn and kill bypass the local barrier. The same shared logic runs on Linux and Windows; live platform runs remain gaps.",
"motivatingLinks": [
"https://github.com/stablyai/orca/issues/7742",
"https://github.com/stablyai/orca/pull/7836"
],
"invariant": "A local PTY shutdown requested during desktop cold start must resolve its provider only after daemon startup settles, and a fresh daemon adapter must connect before issuing the destructive request; a fallback provider must never falsely acknowledge shutdown while the restored daemon session remains live, and SSH shutdown must not wait on local startup.",
"oracle": "Hold the desktop provider-startup promise unresolved, request shutdown through renderer IPC and both runtime-controller entry points, install the daemon provider, and assert the fallback receives zero shutdowns while the daemon receives exactly the requested kill; prove the provider gate opens as soon as daemon authority settles even while optional hook startup remains unresolved, and prove an SSH spawn and kill complete without touching either local barrier. Separately, spawn a session through one adapter, kill it through a fresh unconnected adapter, and assert the daemon no longer lists it.",
"commands": [
"pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/pty.test.ts src/main/daemon/daemon-pty-adapter.test.ts src/main/startup/first-window-startup-services.test.ts"
],
"testFiles": [
"src/main/ipc/pty.test.ts",
"src/main/daemon/daemon-pty-adapter.test.ts",
"src/main/startup/first-window-startup-services.test.ts"
],
"assertionRefs": [
{
"file": "src/main/ipc/pty.test.ts",
"assertions": [
"renderer local kills issue zero fallback shutdowns before startup and target the installed daemon afterward",
"runtime fire-and-forget local kills issue zero fallback shutdowns before startup and target the installed daemon afterward",
"runtime exact local stops issue zero fallback shutdowns before startup and verify the installed daemon target stopped",
"SSH spawns and kills bypass the unresolved local startup barrier and target the SSH provider"
]
},
{
"file": "src/main/daemon/daemon-pty-adapter.test.ts",
"assertions": [
"a fresh unconnected adapter kills a session hosted by the live daemon and the session disappears from daemon inventory",
"concurrent shutdowns through a fresh adapter perform exactly one control-plus-stream handshake and remove both daemon sessions"
]
},
{
"file": "src/main/startup/first-window-startup-services.test.ts",
"assertions": [
"daemon provider authority opens before an unresolved optional hook startup while the broader local spawn gate remains closed",
"the provider authority gate shares the bounded 60-second fail-open when daemon startup hangs"
]
}
],
"evidenceRuns": [
{
"date": "2026-07-17",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/pty.test.ts src/main/daemon/daemon-pty-adapter.test.ts src/main/startup/first-window-startup-services.test.ts",
"result": "passed",
"durationSeconds": 3.27,
"summary": "3 files and 406 tests passed, including single and concurrent real-socket fresh-adapter shutdown, one control-plus-stream handshake for burst shutdown, three deferred local provider-selection teardown paths, hook-independent provider authority, and SSH barrier bypass."
}
],
"runtimeBudget": {
"p95Seconds": 10,
"scope": "focused main-process provider and IPC contract tests"
},
"flakeHistory": {
"status": "unknown",
"evidence": "The focused deterministic gate passed locally once and needs CI soak history."
},
"redGreenEvidence": {
"status": "partial",
"evidence": "Removing the adapter connection reproduces DaemonProtocolError: Not connected, and removing the renderer startup barrier routes shutdown to the fallback. The new runtime-controller barrier assertions also fail against the prior provider-before-startup shape; saved CI red artifacts remain uncollected."
},
"performanceBudget": {
"required": true,
"evidence": "The provider-authority barrier and connection guard add no polling, timers, subprocesses, session inventories, or provider fanout; runtime exact-stop's existing post-stop verification inventory is unchanged. Shutdown does not wait for optional hook startup once daemon authority settles. Each path awaits one bounded provider promise; DaemonClient.ensureConnected is an O(1) no-op when connected and deduplicates concurrent connection attempts when disconnected. Tests deterministically count zero fallback shutdowns, exactly one target shutdown per entry point, and exactly one control-plus-stream handshake for concurrent fresh-adapter shutdowns."
},
"promotionCriteria": [
"Run the focused gate for at least 100 consecutive passes or 14 days across required CI platforms.",
"Collect a Windows cold-start close or exact-stop run against a preserved daemon PTY.",
"Attach saved red/green artifacts for all three provider-selection entry points."
],
"knownGaps": [
"No live Electron restart-to-close journey is included; provider and IPC contracts cover the race deterministically.",
"The bounded daemon-startup fail-open to LocalPtyProvider remains an accepted boot-over-persistence tradeoff tracked by issue #5232.",
"Daemon process death and the resulting Windows ConPTY PowerShell FailFast are separate from provider-selection shutdown authority."
],
"demotionRule": "Keep experimental or demote if the gate flakes without a product or harness bug, if any local shutdown reaches fallback before startup settles, or if shutdown adds inventory scans or retry loops."
},
{
"id": "terminal-provider.ssh-remote-reattach-contract",
"title": "SSH restore and remote-runtime recovery preserve live terminal ownership",
"maturity": "experimental",
"protection": "partial",
"owner": "terminal-provider",
"layer": "provider-contract",
"surfaces": [
"SSH deferred restore",
"direct SSH reconnect finalization",
"direct SSH folder workspace reattach",
"direct SSH split-pane retry ownership",
"same-authority terminal correction",
"remote-runtime mirror polling",
"remote-runtime network recovery",
"terminal create idempotency",
"provider listing",
"reattach",
"unknown liveness"
],
"platforms": [
"macos",
"linux",
"windows"
],
"providers": [
"ssh",
"remote-runtime",
"wsl"
],
"coveredPlatforms": [
"macos"
],
"coveredProviders": [
"ssh",
"remote-runtime"
],
"coverageNotes": "Deterministic renderer coverage proves startup publishes the state returned by ssh.connect, retained native and runtime SSH payloads are admitted through production routes only with valid complete authority, stale cleanup cannot unregister a replacement runtime terminal, direct SSH Git and folder panes clear and retry by exact authority, one authority chain stops after two automatic attempts even when each timeout exceeds the rolling window, rejected acknowledgements mutate no store maps, and one shared exact attempt admits every concurrent split-pane spawn and reattach while preserving the first PTY as the tab fallback. A later sibling failure rotates the tab once, stale callbacks from the prior attempt mutate no state, split remount activity suppression is counted per leaf, primary PTY exit promotes a bound survivor or preserves an empty continuation gap for a late sibling, and primary, non-primary, or null-PTY detach preserves exact authority on both resulting tabs. Intentional pane disposal cancels its settlement timer without breaking StrictMode remount timeout ownership. Target snapshot hydration/reconnect preserves sibling SSH/local/WSL/runtime state, and a mounted remote-runtime terminal survives repeated transport partitions without changing PTY identity. Direct SSH coordinator tests cover immediate terminal finalization, hydration correction, damping, bounded retry, and telemetry non-interference. Client/server heartbeat tests cover timer suspension, socket generations fence stale callbacks, cold restored-terminal attachment retries, cached pixels remain unhealthy until authoritative replay, automatic retries stop after one minute, manual reconnect preserves the PTY, and pane closure releases recovery UI state. Current macOS Electron journeys against an ephemeral Linux Docker SSH target cover exact-authority repo/worktree hydration, live terminal recovery after disconnect/reconnect, and eager six-terminal remount after renderer reload. A Windows remote-runtime smoke covers reachability and PTY round-trip. Multi-target live fanout, paired-close, WSL, and patched live partition journeys remain gaps.",
"motivatingLinks": [
"https://github.com/stablyai/orca/pull/6951",
"https://github.com/stablyai/orca/pull/6955",
"https://github.com/stablyai/orca/pull/6979",
"https://github.com/stablyai/orca/pull/7009",
"https://github.com/stablyai/orca/pull/8597"
],
"invariant": "SSH, WSL, and remote-runtime restore paths must treat provider listing failures and unknown liveness as unknown, not dead, while still avoiding duplicate spawn and clearing expired relay leases exactly once. Direct SSH reconnect must atomically clear only exact-target live PTY bindings, preserve relay identity, retry Git and folder panes without paired close or provider shutdown, and allow at most two automatic attempts in one authority chain even when each settlement exceeds the rolling window. A rejected acknowledgement mutates no store map. A successful exact split-pane spawn or reattach must retain that attempt as shared live authority until sibling leaves settle; the first success cannot consume sibling authority, a sibling failure can start at most one second tab-wide attempt, and prior-attempt callbacks become inert after rotation. Once the retry budget is exhausted, a failure cannot start attempt three or revoke attempt-two authority from siblings that may still settle. Primary PTY exit must promote a bound survivor or preserve exact authority through an empty activation gap, and split detach must project that authority to both resulting tabs. Hydrated PTY hints cannot supersede a current exact-attempt owner, and target snapshot hydration/reconnect cannot reset sibling SSH, local, WSL, or runtime-owned state. Every restored remote terminal must preserve its provider PTY identity. After a recoverable partition the same authenticated runtime must reattach the same PTY, reject detached input, apply the latest viewport, and report healthy only after authoritative replay. Automatic PTY recovery stops after one bounded minute without a fatal terminal error; a manual reconnect starts a newly fenced epoch against the same PTY, and closed panes retain no recovery UI state. One capability-gated terminal-create mutation must produce at most one host PTY across an unknown response outcome, remain manually retryable after cutoff, and never let a stale completion replace a newer pane lifecycle.",
"oracle": "Deterministic tests cover bounded stale-handle replacement, suspended heartbeat clocks, cold and established subscription failure, ten partition/recovery cycles, automatic-recovery cutoff, manual reconnect, and exact direct SSH binding recovery. They assert one atomic store publication clears only exact-target PTY indexes, null-PTY activation remains unchanged, relay identity survives, Git and folder panes retry symmetrically, another target/local/WSL/runtime panes remain byte-identical through target snapshot hydration and reconnect, only an accepted exact failure or timeout starts the second attempt, two 31-second timeouts cannot start a third settlement-triggered attempt, rejected stale/mismatched acknowledgements preserve every store map, and concurrent split-pane spawn and reattach callbacks both commit under the same attempt ID after the first success replaces pending state with live shared authority. A sibling failure revokes that shared authority and starts exactly one second attempt; duplicate failures and late first-attempt PTY callbacks preserve the second attempt and every state map. Attempt-two failure retains continuation authority for later siblings, primary exit promotes a bound survivor or preserves the lease until a late sibling binds, and primary plus non-primary detach retain exact authority and history on both resulting tabs. Both remount callbacks consume split-count activity suppression, intentional dispose emits no failure/timeout, and a same-attempt StrictMode remount still owns one timeout. Hydration clears an untrusted PTY hint without clearing its current pending owner, healthy current-authority bindings suppress correction, hydration finalizes once, and reconnect emits no paired close lifecycle. Tests also assert one unsubscribe per remote-runtime epoch, observable recovery phases, stable PTY identity, resumed snapshot/output/input, no healthy state before replay, no retry or input after cutoff, a new manual epoch against the same PTY, quiet recovery UI with an explicit Reconnect action, pane-close state cleanup, one stable create mutation id, old-runtime no-retry behavior, cross-process PTY adoption, and bounded in-flight coordination.",
"commands": [
"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/startup/ssh-startup-reconnect.test.ts src/renderer/src/lib/resolved-worktree-execution-host.test.ts src/renderer/src/components/terminal/background-terminal-worktree-mount.test.ts src/renderer/src/runtime/sync-runtime-graph-scheduling.test.ts src/renderer/src/components/terminal-pane/use-terminal-pane-lifecycle.test.ts src/renderer/src/components/terminal-pane/pty-connection.test.ts src/renderer/src/components/terminal-pane/remote-runtime-pty-transport.test.ts src/renderer/src/runtime/remote-runtime-session-tabs-inflight.test.ts src/renderer/src/runtime/web-session-terminal-handle-events.test.ts src/renderer/src/store/slices/terminal-pty-identity-replacement.test.ts",
"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/pty-transport.test.ts",
"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/remote-runtime-pty-transport.test.ts src/renderer/src/components/terminal-pane/remote-runtime-pty-recovery-state.test.ts src/renderer/src/components/terminal-pane/TerminalRemoteRuntimeReconnectBanner.test.tsx src/renderer/src/components/terminal-pane/terminal-remote-runtime-recovery-ui-state.test.ts src/shared/remote-runtime-socket-liveness.test.ts src/shared/remote-runtime-shared-control-connection.test.ts src/shared/remote-runtime-shared-control-socket-generation.test.ts src/shared/remote-runtime-client-error-classification.test.ts src/main/runtime/rpc/remote-runtime-server-heartbeat.test.ts src/main/runtime/rpc/methods/terminal-create-idempotency.test.ts src/main/runtime/orca-runtime-terminal-create-idempotency.test.ts",
"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/store/slices/direct-ssh-terminal-retry.test.ts src/renderer/src/store/slices/direct-ssh-pane-detach-ledger.test.ts src/renderer/src/store/slices/direct-ssh-terminal-recovery.test.ts src/renderer/src/store/slices/direct-ssh-terminal-workspace-scope.test.ts src/renderer/src/store/slices/terminals-hydration.test.ts src/renderer/src/store/slices/repos-ssh-host-reconciliation.test.ts src/renderer/src/hooks/direct-ssh-reconnect-coordinator.test.ts src/renderer/src/hooks/direct-ssh-host-hydration.test.ts src/renderer/src/hooks/direct-ssh-state-routing.test.ts src/renderer/src/hooks/remote-workspace-target-sync.test.ts src/renderer/src/components/terminal-pane/pty-connection.test.ts src/renderer/src/components/terminal-pane/terminal-pane-tab-detach.test.ts --reporter=dot",
"pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/repos-remote.test.ts src/main/ipc/ssh.test.ts src/main/ipc/worktrees.test.ts src/main/runtime/public-ssh-state.test.ts src/main/ssh/ssh-connection-manager.test.ts src/main/ssh/ssh-connection.test.ts src/main/ssh/ssh-provider-authority.test.ts src/preload/ssh-authority-forwarding.test.ts src/renderer/src/runtime/runtime-client-events.test.ts src/renderer/src/runtime/runtime-environment-ssh-state.test.ts src/shared/ssh-retained-payload-admission.test.ts src/shared/ssh-types.test.ts --reporter=dot",
"pnpm exec electron-vite build --mode e2e",
"SKIP_BUILD=1 pnpm exec playwright test tests/e2e/terminal-cold-activation-deferral.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
"ORCA_E2E_SSH_DOCKER=1 SKIP_BUILD=1 pnpm exec playwright test tests/e2e/ssh-cold-activation-restore.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
"ORCA_E2E_SSH_DOCKER=1 SKIP_BUILD=1 pnpm exec playwright test tests/e2e/ssh-docker-relay-perf.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1"
],
"testFiles": [
"src/renderer/src/startup/ssh-startup-reconnect.test.ts",
"src/renderer/src/lib/resolved-worktree-execution-host.test.ts",
"src/renderer/src/components/terminal/background-terminal-worktree-mount.test.ts",
"src/renderer/src/runtime/sync-runtime-graph-scheduling.test.ts",
"src/renderer/src/components/terminal-pane/use-terminal-pane-lifecycle.test.ts",
"src/renderer/src/components/terminal-pane/pty-connection.test.ts",
"src/renderer/src/components/terminal-pane/pty-transport.test.ts",
"src/renderer/src/components/terminal-pane/remote-runtime-pty-transport.test.ts",
"src/renderer/src/components/terminal-pane/remote-runtime-pty-recovery-state.test.ts",
"src/renderer/src/components/terminal-pane/TerminalRemoteRuntimeReconnectBanner.test.tsx",
"src/renderer/src/components/terminal-pane/terminal-remote-runtime-recovery-ui-state.test.ts",
"src/renderer/src/runtime/remote-runtime-session-tabs-inflight.test.ts",
"src/renderer/src/runtime/web-session-terminal-handle-events.test.ts",
"src/renderer/src/store/slices/terminal-pty-identity-replacement.test.ts",
"src/shared/remote-runtime-socket-liveness.test.ts",
"src/shared/remote-runtime-shared-control-connection.test.ts",
"src/shared/remote-runtime-shared-control-socket-generation.test.ts",
"src/shared/remote-runtime-client-error-classification.test.ts",
"src/main/runtime/rpc/remote-runtime-server-heartbeat.test.ts",
"src/main/runtime/rpc/methods/terminal-create-idempotency.test.ts",
"src/main/runtime/orca-runtime-terminal-create-idempotency.test.ts",
"src/renderer/src/store/slices/direct-ssh-terminal-retry.test.ts",
"src/renderer/src/store/slices/direct-ssh-pane-detach-ledger.test.ts",
"src/renderer/src/store/slices/direct-ssh-terminal-recovery.test.ts",
"src/renderer/src/store/slices/direct-ssh-terminal-workspace-scope.test.ts",
"src/renderer/src/store/slices/terminals-hydration.test.ts",
"src/renderer/src/store/slices/repos-ssh-host-reconciliation.test.ts",
"src/renderer/src/hooks/direct-ssh-reconnect-coordinator.test.ts",
"src/renderer/src/hooks/direct-ssh-host-hydration.test.ts",
"src/renderer/src/hooks/direct-ssh-state-routing.test.ts",
"src/renderer/src/hooks/remote-workspace-target-sync.test.ts",
"src/renderer/src/components/terminal-pane/terminal-pane-tab-detach.test.ts",
"src/main/ipc/repos-remote.test.ts",
"src/main/ipc/ssh.test.ts",
"src/main/ipc/worktrees.test.ts",
"src/main/runtime/public-ssh-state.test.ts",
"src/main/ssh/ssh-connection-manager.test.ts",
"src/main/ssh/ssh-connection.test.ts",
"src/main/ssh/ssh-provider-authority.test.ts",
"src/preload/ssh-authority-forwarding.test.ts",
"src/renderer/src/runtime/runtime-client-events.test.ts",
"src/renderer/src/runtime/runtime-environment-ssh-state.test.ts",
"src/shared/ssh-retained-payload-admission.test.ts",
"src/shared/ssh-types.test.ts",
"tests/e2e/terminal-cold-activation-deferral.spec.ts",
"tests/e2e/ssh-cold-activation-restore.spec.ts",
"tests/e2e/ssh-docker-relay-perf.spec.ts"
],
"assertionRefs": [
{
"file": "src/renderer/src/startup/ssh-startup-reconnect.test.ts",
"assertions": [
"the state returned by ssh.connect is published before persisted terminals reconnect"
]
},
{
"file": "src/renderer/src/components/terminal/background-terminal-worktree-mount.test.ts",
"assertions": [
"only an explicit local execution host can defer cold activation",
"SSH, remote-runtime, and unresolved owners remain eager"
]
},
{
"file": "src/renderer/src/components/terminal-pane/remote-runtime-pty-transport.test.ts",
"assertions": [
"a stale web-mirror handle polls until a different ready handle is published without resubscribing the stale handle",
"replacement does not emit pane exit or disconnect callbacks and explicit terminal exit still retires the mirror",
"replacement polling and each in-flight request share a 15-second deadline, then accepted snapshots own recovery without input re-arming polling",
"cold restored-terminal subscription failure retries and resumes snapshot, output, and input without a fatal error",
"a canonical close before subscription readiness opens exactly one replacement stream without surfacing a fatal error",
"recovery exposes connecting, recovering, backoff, connected, and fatal-offline phases with fenced epochs",
"ten partition cycles retain one PTY identity, reject detached input, and unsubscribe each epoch exactly once",
"cached terminal pixels remain disconnected until authoritative replay completes",
"automatic retries stop after one minute with no fatal error, no further requests, and no stale input",
"manual reconnect starts a new epoch, resubscribes the same PTY exactly once, and becomes healthy only after its snapshot",
"unknown terminal-create recovery stops all request activity after one minute without a fatal error, clips post-probe RPC timeouts to the remaining budget, then manual retry re-probes capability and reconciles the same mutation",
"a stale create completion cannot replace or close a newer attachment, including when two runtimes use the same raw handle",
"an authoritative capability-probe failure replaces the stale connectivity error"
]
},
{
"file": "src/renderer/src/components/terminal-pane/remote-runtime-pty-recovery-state.test.ts",
"assertions": [
"a healthy replacement invalidates the prior recovery epoch so a slower failure cannot re-arm retry",
"the automatic-recovery deadline cancels pending backoff and a manual retry owns a new epoch",
"a caller-owned recovery cutoff cancels scheduled work and remains disconnected"
]
},
{
"file": "src/renderer/src/components/terminal-pane/TerminalRemoteRuntimeReconnectBanner.test.tsx",
"assertions": [
"automatic recovery renders as a quiet bounded status without a button",
"the disconnected state exposes one explicit Reconnect action"
]
},
{
"file": "src/renderer/src/components/terminal-pane/terminal-remote-runtime-recovery-ui-state.test.ts",
"assertions": [
"only actionable recovery phases retain UI state and pane closure removes disconnected state"
]
},
{
"file": "src/shared/remote-runtime-socket-liveness.test.ts",
"assertions": [
"a suspended client receives a fresh probe deadline after resume and post-resume activity clears it"
]
},
{
"file": "src/main/runtime/orca-runtime-terminal-create-idempotency.test.ts",
"assertions": [
"one authenticated client/worktree mutation derives a stable server-owned terminal handle",
"an unknown-outcome retry adopts the same provider PTY after runtime-process restart without rerunning startup",
"retry inventory failure, missing same-worktree identity metadata, or ownership mismatch fails closed without spawning",
"in-flight mutation coordination is bounded and releases capacity after settlement"
]
},
{
"file": "src/renderer/src/runtime/remote-runtime-session-tabs-inflight.test.ts",
"assertions": [
"concurrent panes share one in-flight inventory request within a runtime/worktree and do not share across ownership boundaries"
]
},
{
"file": "src/renderer/src/runtime/web-session-terminal-handle-events.test.ts",
"assertions": [
"accepted host snapshot listeners are scoped by runtime, worktree, and pane and distinguish pending handles from removed surfaces",
"listeners are released after the waiting transport settles"
]
},
{
"file": "src/renderer/src/store/slices/terminal-pty-identity-replacement.test.ts",
"assertions": [
"repeated handle rotations retain exactly one live PTY identity and update the tab fallback atomically",
"snapshot-first replacement still migrates stale PTY-indexed state"
]
},
{
"file": "src/renderer/src/store/slices/direct-ssh-terminal-recovery.test.ts",
"assertions": [
"one atomic patch clears exact-target live PTY indexes while preserving relay identity and null-PTY activation",
"another SSH target, local, WSL, floating, and runtime-owned terminal state remains unchanged"
]
},
{
"file": "src/renderer/src/store/slices/direct-ssh-terminal-workspace-scope.test.ts",
"assertions": [
"Git and folder workspaces resolve only from consistent exact-target provenance",
"ambiguous, contradictory, mixed, and runtime-owned folders fail closed"
]
},
{
"file": "src/renderer/src/store/slices/direct-ssh-terminal-retry.test.ts",
"assertions": [
"one authority chain permits at most two automatic attempts even when both timeouts exceed the rolling thirty-second window",
"rejected stale-authority, stale-attempt, or pre-commit success acknowledgements mutate none of the tab, PTY-index, pending, history, or live-binding maps",
"both split-pane siblings bind under one exact attempt while the first PTY remains the tab fallback",
"a sibling failure starts one second tab-wide attempt and stale first-attempt callbacks preserve it",
"an exhausted attempt retains sibling continuation authority and promotes a surviving primary PTY without attempt three",
"primary exit before sibling commit preserves the exact continuation lease and accepts the late sibling"
]
},
{
"file": "src/renderer/src/store/slices/direct-ssh-pane-detach-ledger.test.ts",
"assertions": [
"primary and non-primary split detach preserve exact live authority and retry history on both resulting tabs",
"detaching the only bound split while its sibling is still spawning preserves the source continuation lease until that sibling binds",
"detaching during a null-PTY continuation gap projects the exact lease to both pending tabs",
"a pending-only all-null detach preserves the exact lease on both tabs before either leaf binds",
"same-authority invalidation and correction leave both detached live PTYs unchanged"
]
},
{
"file": "src/renderer/src/components/terminal-pane/terminal-pane-tab-detach.test.ts",
"assertions": [
"a detached null-PTY leaf remains marked for pending activation before ownership transfer"
]
},
{
"file": "src/main/ipc/repos-remote.test.ts",
"assertions": [
"host-qualified repo catalogs require one consistent execution host and complete current SSH authority",
"contradictory, partial, mismatched, stale, and runtime-owned catalog requests fail closed"
]
},
{
"file": "src/main/ipc/ssh.test.ts",
"assertions": [
"concurrent same-authority connects share one provider attempt",
"authority rotation starts stale transport cancellation before teardown, concurrent fresh callers share one replacement, and stale completion cannot clobber the fresh session",
"same-turn disconnect and forward-teardown failures across removal, reset, and terminate keep replacement connects and metadata mutation behind complete target cleanup"
]
},
{
"file": "src/main/ssh/ssh-connection-manager.test.ts",
"assertions": [
"disconnect invalidates a pending transport attempt immediately so late rejection or resolution cannot remove the replacement"
]
},
{
"file": "src/main/ssh/ssh-connection.test.ts",
"assertions": [
"late ssh2 ready and startup error events after disconnect cannot resurrect or overwrite disconnected state"
]
},
{
"file": "src/main/ipc/worktrees.test.ts",
"assertions": [
"host-qualified worktree reads reject malformed or contradictory repo executionHostId/connectionId provenance before provider access and after provider awaits without durable mutations",
"host-qualified lineage excludes other SSH and runtime owners and rejects ambiguous or contradictory provenance",
"one lineage request snapshots repo, folder, and group catalogs once and memoizes repeated owner resolution"
]
},
{
"file": "src/main/runtime/public-ssh-state.test.ts",
"assertions": [
"public SSH state preserves the complete provider epoch and connection generation pair"
]
},
{
"file": "src/main/ssh/ssh-provider-authority.test.ts",
"assertions": [
"provider epoch and connection generation rotate as one exact authority pair",
"provider resolution rejects stale or incomplete authority",
"unknown-target currency probes reject without allocating provider authority state"
]
},
{
"file": "src/preload/ssh-authority-forwarding.test.ts",
"assertions": [
"full authority crosses Electron IPC without loss",
"partial authority becomes unknown for bounded reconciliation and malformed full authority is dropped",
"variable-form host-qualified worktree requests retain fail-closed outcomes in their return type"
]
},
{
"file": "src/shared/ssh-retained-payload-admission.test.ts",
"assertions": [
"retained connection states reject partial or malformed authority",
"only partial compatibility authority can normalize to unknown for bounded direct-SSH reconciliation",
"shared direct SSH authority admission requires bounded identifiers and a non-negative safe generation"
]
},
{
"file": "src/renderer/src/runtime/runtime-client-events.test.ts",
"assertions": [
"retained runtime snapshots and live events preserve the full pair",
"partial runtime authority is rejected before it reaches environment state"
]
},
{
"file": "src/renderer/src/runtime/runtime-environment-ssh-state.test.ts",
"assertions": [
"runtime-owned SSH state remains isolated by environment and rejects partial retained authority",
"in-flight hydration cannot resurrect disconnected or removed runtime environments"
]
},
{
"file": "src/shared/ssh-types.test.ts",
"assertions": [
"SSH connection state carries the provider epoch and connection generation authority pair"
]
},
{
"file": "src/renderer/src/store/slices/terminals-hydration.test.ts",
"assertions": [
"target-scoped hydration and reconnect preserve sibling SSH and runtime tabs, PTY indexes, runtime ownership, and active selection",
"authoritative target-tab deletion prunes only that tab's retry, live-binding, and retry-history ledgers",
"a snapshot PTY from another SSH host is rejected from the target scope"
]
},
{
"file": "src/renderer/src/store/slices/repos-ssh-host-reconciliation.test.ts",
"assertions": [
"a provider result becomes stale when same-ID repo ownership turns malformed or contradictory during the await"
]
},
{
"file": "src/renderer/src/hooks/direct-ssh-reconnect-coordinator.test.ts",
"assertions": [
"terminal invalidation and retry run synchronously before provider preparation",
"hydrated terminal finalization and same-authority correction are current-authority fenced",
"rapid authority rotation keeps immediate terminal checks while damping full preparation"
]
},
{
"file": "src/renderer/src/hooks/direct-ssh-host-hydration.test.ts",
"assertions": [
"exact-host catalog and lineage hydration preserves sibling SSH, local, runtime, ambiguous, and contradictory rows"
]
},
{
"file": "src/renderer/src/hooks/remote-workspace-target-sync.test.ts",
"assertions": [
"snapshot hydration preserves newer local recovery and keeps imported PTY ids retryable until exact-attempt transport acknowledgement",
"stale operation tokens cannot apply an older snapshot over current authority",
"target snapshot projection and persisted-terminal reconnect are host-qualified and preserve sibling SSH, local, WSL, and runtime state"
]
},
{
"file": "src/renderer/src/components/terminal-pane/pty-connection.test.ts",
"assertions": [
"StrictMode remounts join only the same direct SSH retry attempt",
"authority rotation starts a new spawn and rejects then retires a late obsolete-authority fresh PTY",
"late stale rebind and reattach completions, including lease replacement during asynchronous SSH preparation, callback errors, rejected promises, session-expired, empty, and launch-metadata outcomes, cannot clear current state, start replacement recovery, publish errors, or publish metadata",
"both concurrent split-pane spawns commit through the same exact retry attempt",
"both concurrent split-pane reattaches commit through the same exact retry attempt",
"a sibling mounted after first success captures the retained live lease",
"authority rotation rejects and retires a delayed sibling spawned from a retained live lease",
"intentional pane disposal cancels retry settlement while a same-attempt StrictMode remount retains one timeout"
]
},
{
"file": "src/renderer/src/components/terminal-pane/pty-transport.test.ts",
"assertions": [
"admission rejection precedes buffered final-frame and exit publication",
"abandoning an obsolete reattach drops its data, replay, write-unavailable, and exit handlers without killing the durable PTY",
"a rejected or destroyed fresh session fallback settles retirement before it can publish handlers, shutdown refusal is reported as unknown, and reattach remains non-destructive"
]
},
{
"file": "tests/e2e/ssh-cold-activation-restore.spec.ts",
"assertions": [
"six relay-backed tabs retain the same six PTY ids across renderer reload",
"all six SSH managers mount eagerly and none is parked",
"restored terminal input reaches a proof file on the Linux SSH host"
]
},
{
"file": "tests/e2e/ssh-docker-relay-perf.spec.ts",
"assertions": [
"repo and worktree setup fails closed unless the exact direct SSH host and complete authority are returned",
"a reconnected terminal accepts input and writes a proof file visible inside the Linux SSH target"
]
}
],
"evidenceRuns": [
{
"date": "2026-07-14",
"runner": "local",
"platform": "macos",
"command": "ORCA_E2E_SSH_DOCKER=1 SKIP_BUILD=1 pnpm exec playwright test tests/e2e/ssh-cold-activation-restore.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
"result": "passed",
"durationSeconds": 128,
"summary": "Six focused files and 475 tests passed; the local cold-activation journey passed; the Docker/Linux SSH journey restored six of six original relay PTYs, mounted six of six managers without parking, and executed remote input through the restored terminal."
},
{
"date": "2026-07-17",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/startup/ssh-startup-reconnect.test.ts src/renderer/src/lib/resolved-worktree-execution-host.test.ts src/renderer/src/components/terminal/background-terminal-worktree-mount.test.ts src/renderer/src/runtime/sync-runtime-graph-scheduling.test.ts src/renderer/src/components/terminal-pane/use-terminal-pane-lifecycle.test.ts src/renderer/src/components/terminal-pane/pty-connection.test.ts src/renderer/src/components/terminal-pane/remote-runtime-pty-transport.test.ts src/renderer/src/runtime/remote-runtime-session-tabs-inflight.test.ts src/renderer/src/runtime/web-session-terminal-handle-events.test.ts src/renderer/src/store/slices/terminal-pty-identity-replacement.test.ts",
"result": "passed",
"durationSeconds": 15,
"summary": "Ten provider-contract files and 566 tests passed, including a shared 15-second polling/RPC deadline, no input-triggered re-polling after the bound, post-timeout snapshot recovery, listener cleanup, in-flight inventory deduplication, and replacement-state migration."
},
{
"date": "2026-07-21",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/remote-runtime-pty-transport.test.ts src/renderer/src/components/terminal-pane/remote-runtime-pty-recovery-state.test.ts src/renderer/src/components/terminal-pane/TerminalRemoteRuntimeReconnectBanner.test.tsx src/renderer/src/components/terminal-pane/terminal-remote-runtime-recovery-ui-state.test.ts src/shared/remote-runtime-socket-liveness.test.ts src/shared/remote-runtime-shared-control-connection.test.ts src/shared/remote-runtime-shared-control-socket-generation.test.ts src/shared/remote-runtime-client-error-classification.test.ts src/main/runtime/rpc/remote-runtime-server-heartbeat.test.ts src/main/runtime/rpc/methods/terminal-create-idempotency.test.ts src/main/runtime/orca-runtime-terminal-create-idempotency.test.ts",
"result": "passed",
"durationSeconds": 5,
"summary": "Eleven fault-injection and recovery-UI files and 127 tests passed, covering suspended heartbeat clocks, stale socket, PTY, and create generations, canonical pre-ready close recovery with one replacement subscription, cold and repeated PTY reattachment, authoritative health, bounded PTY and terminal-create recovery, post-probe timeout clipping, manually retryable create cutoff, accurate capability-probe failures, same-PTY manual reconnect, pane-state cleanup, fatal error deduplication, stable create identity, cross-process PTY adoption, and fail-closed legacy inventory."
},
{
"date": "2026-07-28",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/store/slices/direct-ssh-terminal-retry.test.ts src/renderer/src/store/slices/direct-ssh-pane-detach-ledger.test.ts src/renderer/src/store/slices/direct-ssh-terminal-recovery.test.ts src/renderer/src/store/slices/direct-ssh-terminal-workspace-scope.test.ts src/renderer/src/store/slices/terminals-hydration.test.ts src/renderer/src/store/slices/repos-ssh-host-reconciliation.test.ts src/renderer/src/hooks/direct-ssh-reconnect-coordinator.test.ts src/renderer/src/hooks/direct-ssh-host-hydration.test.ts src/renderer/src/hooks/direct-ssh-state-routing.test.ts src/renderer/src/hooks/remote-workspace-target-sync.test.ts src/renderer/src/components/terminal-pane/pty-connection.test.ts src/renderer/src/components/terminal-pane/terminal-pane-tab-detach.test.ts --reporter=dot",
"result": "passed",
"durationSeconds": 15.8,
"summary": "Twelve direct SSH files and 647 tests passed, including exact lease revalidation after asynchronous SSH preparation, primary-exit continuation gaps, pending-only and live null-PTY two-sided split-detach authority, delayed post-success sibling admission, stale-authority provider retirement, late ownership-provenance rejection, and deleted-tab ledger pruning."
},
{
"date": "2026-07-28",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/pty-transport.test.ts",
"result": "passed",
"durationSeconds": 1.48,
"summary": "All 90 transport tests passed, including pre-publication admission rejection, handler-complete non-destructive detach for obsolete SSH reattach transports, settled retirement of rejected or destroyed fresh fallbacks, and reported shutdown refusal."
},
{
"date": "2026-07-28",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/repos-remote.test.ts src/main/ipc/ssh.test.ts src/main/ipc/worktrees.test.ts src/main/runtime/public-ssh-state.test.ts src/main/ssh/ssh-connection-manager.test.ts src/main/ssh/ssh-connection.test.ts src/main/ssh/ssh-provider-authority.test.ts src/preload/ssh-authority-forwarding.test.ts src/renderer/src/runtime/runtime-client-events.test.ts src/renderer/src/runtime/runtime-environment-ssh-state.test.ts src/shared/ssh-retained-payload-admission.test.ts src/shared/ssh-types.test.ts --reporter=dot",
"result": "passed",
"durationSeconds": 2.55,
"summary": "Twelve main, preload, runtime, and shared authority files and 513 tests passed, including fail-closed pre/post-await repo ownership provenance, production retained-payload admission, fenced stale-transport replacement, failure-safe target lifecycle barriers, and real ssh2 late-ready/error rejection."
},
{
"date": "2026-07-28",
"runner": "local",
"platform": "macos",
"command": "ORCA_E2E_SSH_DOCKER=1 SKIP_BUILD=1 pnpm exec playwright test tests/e2e/ssh-docker-relay-perf.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
"result": "passed",
"durationSeconds": 51.4,
"summary": "Four Electron Docker SSH tests passed on the final implementation, including exact-authority repo/worktree hydration, two concurrent immutable file streams under Git churn, live terminal input before and after disconnect/reconnect, and an independent container-visible remote proof file."
},
{
"date": "2026-07-28",
"runner": "local",
"platform": "macos",
"command": "ORCA_E2E_SSH_DOCKER=1 SKIP_BUILD=1 pnpm exec playwright test tests/e2e/ssh-cold-activation-restore.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
"result": "passed",
"durationSeconds": 12.5,
"summary": "One Electron journey passed on the final implementation after exact-authority hydration; six restored SSH terminal managers remounted after renderer reload and remote input reached the Linux target."
}
],
"runtimeBudget": {
"p95Seconds": 150,
"scope": "all configured provider-contract, build, Electron, Docker SSH reconnect, and six-terminal cold-restore commands"
},
"flakeHistory": {
"status": "unknown",
"evidence": "Focused renderer contracts, one current 627-test direct SSH run, and current Docker/Linux reconnect and six-terminal cold-restore journeys pass locally. One pressure run entered reconnect while waiting for its seventh marker; later runs delivered all markers but exposed an independent disappearing-second-file fixture race. The corrected two-reader single-file load passed the complete 4/4 suite while retaining concurrent stream pressure. Live multi-target fanout still needs CI soak history before promotion."
},
"redGreenEvidence": {
"status": "partial",
"evidence": "The remote-runtime fault tests failed before the recovery changes by leaving a cold restored subscription detached, reporting connected before authoritative replay, delivering a fatal setup error twice, and allowing an unknown create outcome to spawn again after process-local state was lost. On exact pre-fix HEAD 939719443, the split-pane store, fresh-spawn, and reattach oracles failed because the first success removed pending authority and the sibling could not bind; the same three oracles pass after live bindings retain the exact attempt ID. On exact committed HEAD d501f2e96, primary-exit-before-sibling and primary/non-primary split-detach oracles failed because live authority was deleted during the empty gap or transferred to only one resulting tab; all three pass after continuation-gap preservation and two-sided detach projection. On exact committed HEAD d44ea382b with test-only oracles, a pending-only all-null detach deleted the attempt ledger, a sibling mounted after first success committed without its lease, and that sibling could bind after authority rotation; all three pass after pending-only projection and retained-live-lease capture with provider retirement. On exact committed HEAD 9fa84dacf, the production-manager in-progress oracle rejected the fresh authority and the forward-removal barrier delayed stale transport cancellation; both pass after replacement starts cancellation immediately, shares concurrent fresh callers, and waits for teardown before connecting. On exact committed HEAD e5ba9a9e5, overlapping disconnect allowed a replacement connect before forward teardown completed and delayed transport cancellation behind that barrier; disconnect, removal, and terminate now share a target lifecycle barrier, start transport cancellation immediately, retain captured-session identity, and admit the replacement only after cleanup. On exact committed HEAD 9a29e7a81, a rejected forward teardown short-circuited the lifecycle while transport disconnect was pending, removal left its captured relay session alive, same-turn connect escaped admission, and reset remained outside the target barrier; the exact failure oracles pass after both cleanup branches settle, captured sessions always retire, admission is authority-fenced, and reset shares the barrier. On exact committed HEAD 47c7198f2, reset's remaining bespoke forward teardown could still reject after authority rotation but before captured-session retirement; reset now uses the same hardened session teardown and a failed reset remains cleanly retryable. Other direct SSH tests encode red conditions for non-atomic binding clear, cross-target retry, folder omission, duplicate same-authority attempts, hydration overwrite, terminal finalization delayed behind provider work, obsolete-authority pending-spawn adoption, Git lineage namespace mismatch, and snapshot PTY hint promotion without exact-attempt acknowledgement. Existing SSH and stale-handle reattach coverage remains green. Needs WSL, paired-close, and a patched live remote-runtime partition journey before promotion."
},
"performanceBudget": {
"required": true,
"evidence": "Direct SSH terminal invalidation and retry each use one exact-target store publication and execute before provider discovery; another target's five occupied provider slots cannot delay terminal finalization. Each split-pane completion or delayed mount adds constant-time pending/live lease lookups and no provider listing, polling, subprocess, cross-tab scan, or new fanout; two mounted leaves still perform exactly their two existing provider operations. The scheduler caps locally unsettled detected-worktree work at five with a two-call late-work allowance. Remote-runtime recovery allocates at most one backoff timer and one one-minute deadline per detached pane, then stops all PTY retry work until explicit user action. Timers, accepted-snapshot listeners, stale streams, and pane UI entries are released on health, cutoff, rebind, removal, detach, or destroy; ten-cycle tests prove one unsubscribe per epoch. Common terminal input/output paths add only constant-time state checks. No live large-terminal-map direct SSH timing is claimed."
},
"promotionCriteria": [
"Use deterministic fake providers for failure and unknown-liveness cases.",
"Keep environment-dependent live SSH tests as soak until stable.",
"Include reconnect/polling artifacts that identify provider, connection id, and lease state."
],
"knownGaps": [
"Current command covers store wake-hint metadata, main-process SSH provider failure semantics, provider attach/expired-attach behavior, and renderer deferred SSH reconnect/transient-failure/expired-relay fallback with mocked transports.",
"The live SSH journey is environment-dependent and currently runs from a macOS Electron client against a Linux Docker host.",
"Current Docker/Linux journeys prove one target's reconnect and cold-restore paths; live multi-target fanout, folder-workspace reconnect, and large-terminal-map timing remain untested.",
"No paired-client close/non-interference journey was run for direct SSH reconnect; paired web clients intentionally remain outside coordinator ownership.",
"WSL restore and direct SSH/WSL isolation remain inferred rather than directly covered.",
"Linux and Windows desktop-client partition journeys using patched builds are not yet collected; the Windows smoke proves current reachability and PTY round-trip only.",
"Terminal-create recovery depends on providers authoritatively listing live terminal handles and worktree ownership; older runtimes do not advertise the capability and are never retried after an unknown outcome."
],
"demotionRule": "Cannot promote if provider failure can close panes or if the oracle is screenshot-only."
},
{
"id": "terminal-provider.wsl-restore-contract",
"title": "WSL terminals preserve launch identity, liveness, and restore boundaries",
"maturity": "experimental",
"protection": "none",
"owner": "terminal-provider",
"layer": "windows-provider-contract",
"surfaces": [
"WSL",
"Windows host boundary",
"cwd identity",
"startup command",
"provider liveness",
"restore"
],
"platforms": [
"windows"
],
"providers": [
"wsl"
],
"coveredPlatforms": [],
"coveredProviders": [],
"coverageNotes": "Registered gap only; no executable coverage is wired yet.",
"motivatingLinks": [
"https://github.com/stablyai/orca/pull/6801",
"https://github.com/stablyai/orca/pull/6830",
"https://github.com/stablyai/orca/pull/6866",
"https://github.com/stablyai/orca/pull/6951"
],
"invariant": "WSL terminal restore must preserve Windows-host and Linux-guest path/cwd identity, shell launch args, startup command delivery, provider liveness semantics, and saved session ownership without being treated as ordinary local Windows ConPTY or generic SSH.",
"oracle": "No executable slice yet. Promotion needs a Windows provider contract plus one focused live WSL smoke proving cwd/path mapping, shell echo, startup command delivery, targeted liveness unknown handling, and restore without duplicate panes or destructive false-dead cleanup.",
"commands": [],
"testFiles": [],
"assertionRefs": [],
"evidenceRuns": [],
"runtimeBudget": {
"p95Seconds": 90,
"scope": "Windows WSL provider contract plus focused live smoke"
},
"flakeHistory": {
"status": "not-started",
"evidence": "WSL is split out from SSH/remote planning so it cannot be mistaken for covered provider behavior."
},
"redGreenEvidence": {
"status": "missing",
"evidence": "Needs intentional-break evidence for path/cwd mapping, startup command delivery, liveness unknown handling, and restore ownership."
},
"performanceBudget": {
"required": true,
"evidence": "WSL restore and liveness checks must avoid broad provider scans on typing, focus, switch, render, or resize hot paths."
},
"promotionCriteria": [
"Start with deterministic provider contracts for path/cwd mapping and launch args.",
"Add one focused Windows live WSL smoke after provider contracts are stable.",
"Keep WSL separate from SSH and local ConPTY evidence in PR descriptions."
],
"knownGaps": [
"No manifest command yet.",
"No live Windows WSL CI evidence.",
"No provider contract yet separates Windows host paths from Linux guest cwd identity."
],
"demotionRule": "Cannot promote while WSL restore is inferred from SSH, local ConPTY, or remote-runtime gates."
},
{
"id": "terminal-output.scrollback-replay-fifo",
"title": "Replay, scrollback, and hidden-output restore preserve ordering and clear semantics",
"maturity": "experimental",
"protection": "none",
"owner": "terminal-rendering",
"layer": "renderer-unit-provider-contract",
"surfaces": [
"snapshot replay",
"scrollback restore",
"hidden output",
"metadata-only replay",
"WebGL recovery"
],
"platforms": [
"macos",
"linux",
"windows"
],
"providers": [
"local",
"daemon",
"ssh",
"remote-runtime"
],
"coveredPlatforms": [],
"coveredProviders": [],
"coverageNotes": "Registered gap on main. The replay FIFO/burst coalescing product change and its tests exist only on the pending reliability stack; main still uses a single pendingReplayData slot. It registers here with its owning split PR.",
"motivatingLinks": [
"https://github.com/stablyai/orca/pull/7012",
"https://github.com/stablyai/orca/pull/7054",
"https://github.com/stablyai/orca/pull/6949"
],
"invariant": "Multiple replay notifications, metadata-only eager replays, hidden-output restores, and WebGL recovery must preserve FIFO ordering, apply clear-before-replay only when intended, and never overlay stale bytes on newer terminal output.",
"oracle": "The current executable slice injects overlapping replay notifications while async replay drains and asserts pre-parse coalescing, in-flight replay preservation, FIFO draining after xterm parsing starts, and bounded burst-tail coalescing. Metadata-only replay, hidden output chunks, live output interleaving, clear semantics, and stale-overlap checks remain promotion-scope gaps.",
"commands": [],
"testFiles": [],
"assertionRefs": [],
"evidenceRuns": [],
"runtimeBudget": {
"p95Seconds": 20,
"scope": "renderer unit or provider-contract test"
},
"flakeHistory": {
"status": "unknown",
"evidence": "Focused remote replay tests now run locally; needs soak history before promotion."
},
"redGreenEvidence": {
"status": "partial",
"evidence": "Focused tests assert pre-parse replay coalescing, in-flight replay preservation, FIFO draining for multiple replay notifications accepted after xterm parsing starts, and bounded burst-tail coalescing that keeps the newest snapshot. Needs saved red/green evidence and broader clear/metadata/hidden-output cases before promotion."
},
"performanceBudget": {
"required": true,
"evidence": "Replay fixes must not add unbounded renderer parsing, hidden-pane wakeups, or retry loops."
},
"promotionCriteria": [
"Extend deterministic multi-replay coverage before changing replay code.",
"Prove metadata-only replay does not clear restored scrollback.",
"Keep long-table/golden visual tests as supporting evidence, not the primary oracle."
],
"knownGaps": [
"No executable coverage on main yet; the slice lives on the pending fix-terminal-reliability stack.",
"Current command covers remote replay overlap, in-flight preservation, FIFO ordering for multiple in-progress replay notifications, and bounded burst-tail coalescing only.",
"Does not yet cover clearBeforeReplay metadata on the fresh main implementation.",
"Does not yet cover hidden-output restore plus live-output interleaving."
],
"demotionRule": "Cannot promote without ordered replay and clear-semantics assertions."
},
{
"id": "terminal-input.ime-and-synthetic-forwarding",
"title": "IME, native text, and synthetic input commit exactly once and do not leak preedit bytes",
"maturity": "experimental",
"protection": "partial",
"owner": "terminal-input",
"layer": "renderer-unit-platform-soak",
"surfaces": [
"IME",
"native text forwarding",
"synthetic input",
"paste",
"keyboard bypass",
"JIS yen"
],
"platforms": [
"macos",
"linux",
"windows"
],
"providers": [
"local",
"daemon",
"ssh",
"remote-runtime"
],
"coveredPlatforms": [
"macos",
"linux"
],
"coveredProviders": [],
"coverageNotes": "Local macOS and containerized Linux evidence, deterministic renderer-unit coverage for the Linux/Sogou candidate-key policy including the legacy orphaned-keyup fallback, and Electron/CDP live-PTY Sogou-style repros. Real Linux/Sogou OS IME automation, Windows ConPTY post-agent reset, and the CJK/Vietnamese/Arabic matrix remain registered gaps.",
"motivatingLinks": [
"https://github.com/stablyai/orca/pull/6699",
"https://github.com/stablyai/orca/pull/6682",
"https://github.com/stablyai/orca/pull/6513",
"https://github.com/stablyai/orca/pull/6999"
],
"invariant": "Composition, native text forwarding, synthetic input, paste, and platform keyboard bypass paths must not send preedit/control bytes before commit and must commit text exactly once to the intended PTY.",
"oracle": "The current renderer-unit slice asserts native text commits route to the intended PTY once, composition/preedit bookkeeping does not leak premature text, input-source classification handles synthetic/native paths, paste/runtime forwarding avoids duplicate terminal payloads for covered fixtures, and Linux/Sogou candidate Space/digit selectors do not leak keydown/keypress/keyup while ordinary and long-held letter-to-digit typing remains available. The Electron/CDP live-PTY repro verifies Sogou-style Space and digit selectors submit only the committed Chinese text, while the legacy orphaned-letter-keyup sequence sends no selector byte to the PTY. Real legacy IME commit preservation and the full CJK/Vietnamese/Arabic/JIS-yen matrix run in follow-up platform soak where automation is possible.",
"commands": [
"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/terminal-ime-native-text-forwarder.test.ts src/renderer/src/components/terminal-pane/terminal-ime-input-source.test.ts src/renderer/src/components/terminal-pane/terminal-paste-runtime.test.ts src/renderer/src/components/terminal-pane/terminal-ime-composition-tracker.test.ts src/renderer/src/components/terminal-pane/terminal-ime-candidate-key-release-guard.test.ts src/renderer/src/components/terminal-pane/xterm-bypass-policy-non-mac.test.ts src/renderer/src/components/terminal-pane/xterm-bypass-policy.test.ts",
"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/terminal-ime-linux-candidate-state.test.ts",
"pnpm run test:e2e -- tests/e2e/chinese-ime-chat-input-repro.spec.ts"
],
"testFiles": [
"src/renderer/src/components/terminal-pane/terminal-ime-native-text-forwarder.test.ts",
"src/renderer/src/components/terminal-pane/terminal-ime-input-source.test.ts",
"src/renderer/src/components/terminal-pane/terminal-paste-runtime.test.ts",
"src/renderer/src/components/terminal-pane/terminal-ime-composition-tracker.test.ts",
"src/renderer/src/components/terminal-pane/terminal-ime-candidate-key-release-guard.test.ts",
"src/renderer/src/components/terminal-pane/terminal-ime-linux-candidate-state.test.ts",
"src/renderer/src/components/terminal-pane/xterm-bypass-policy-non-mac.test.ts",
"src/renderer/src/components/terminal-pane/xterm-bypass-policy.test.ts",
"tests/e2e/chinese-ime-chat-input-repro.spec.ts"
],
"assertionRefs": [
{
"file": "src/renderer/src/components/terminal-pane/terminal-ime-native-text-forwarder.test.ts",
"assertions": [
"native text commits route once to the intended PTY",
"composition/preedit bookkeeping does not leak premature text"
]
},
{
"file": "src/renderer/src/components/terminal-pane/terminal-ime-input-source.test.ts",
"assertions": [
"synthetic and native input-source paths are classified for covered fixtures"
]
},
{
"file": "src/renderer/src/components/terminal-pane/terminal-paste-runtime.test.ts",
"assertions": [
"paste/runtime forwarding avoids duplicate terminal payloads"
]
},
{
"file": "src/renderer/src/components/terminal-pane/terminal-ime-composition-tracker.test.ts",
"assertions": [
"empty Sogou-style compositionupdate keeps composition active",
"stale composition state expires so editing keys cannot stay suppressed indefinitely",
"post-composition candidate guard is armed only by Sogou-style empty updates and clears after real typing"
]
},
{
"file": "src/renderer/src/components/terminal-pane/terminal-ime-candidate-key-release-guard.test.ts",
"assertions": [
"suppressed candidate keydown arms only the matching keypress/keyup release guard",
"held-key repeat keydowns stay guarded until their keyup, even past expiry",
"fresh keydowns, other keys, modified keys, and expired keypresses are not guarded, and a fresh press drops a stale pending release"
]
},
{
"file": "src/renderer/src/components/terminal-pane/terminal-ime-linux-candidate-state.test.ts",
"assertions": [
"an orphaned plain-letter keyup arms exactly the next bare digit guard",
"ordinary, overlapping, shifted, and long-held letter keydowns keep following digits available",
"physical letter tracking survives cross-pane focus handoff and clears on renderer-window blur"
]
},
{
"file": "src/renderer/src/components/terminal-pane/xterm-bypass-policy-non-mac.test.ts",
"assertions": [
"standalone Linux 229 keydowns reach xterm while Windows 229 keydowns stay suppressed",
"candidate Space/digit selectors are suppressed only while candidate guards are active"
]
},
{
"file": "src/renderer/src/components/terminal-pane/xterm-bypass-policy.test.ts",
"assertions": [
"macOS standalone Process key behavior and composition-owned key suppression stay intact"
]
},
{
"file": "tests/e2e/chinese-ime-chat-input-repro.spec.ts",
"assertions": [
"Sogou-style Space candidate selection submits only the committed Chinese character",
"Sogou-style digit candidate selection submits only the committed Chinese phrase",
"Post-composition Sogou-style digit selection stays out of the PTY after compositionend",
"Legacy orphaned-letter-keyup digit selection submits no selector byte to the PTY; real legacy candidate commit preservation remains a platform gap"
]
}
],
"evidenceRuns": [
{
"date": "2026-07-11",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/terminal-ime-linux-candidate-state.test.ts",
"result": "passed",
"durationSeconds": 0.619,
"summary": "1 state test file and 10 tests passed on macOS, including orphan-keyup, shifted/modifier-changed releases, intervening-key cancellation, cross-pane focus handoff, window/terminal blur cleanup, and long-held-letter coverage; the complete 8-file slice also passed 158 tests."
},
{
"date": "2026-07-11",
"runner": "local",
"platform": "linux",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/terminal-ime-linux-candidate-state.test.ts",
"result": "passed",
"durationSeconds": 0.747,
"summary": "1 state test file and 10 tests passed in Debian 12 arm64 Docker under Node 24, including orphan-keyup, shifted/modifier-changed releases, intervening-key cancellation, cross-pane focus handoff, window/terminal blur cleanup, and long-held-letter coverage; the complete 8-file slice also passed 158 tests."
},
{
"date": "2026-07-11",
"runner": "local",
"platform": "linux",
"command": "pnpm run test:e2e -- tests/e2e/chinese-ime-chat-input-repro.spec.ts",
"result": "passed",
"durationSeconds": 30.3,
"summary": "Debian 12 arm64 Docker with Node 24 and Xvfb passed both live Electron/PTY IME scenarios; the orphaned-letter-keyup candidate digit submitted no selector byte, and the real-Codex opt-in scenario was skipped."
},
{
"date": "2026-07-07",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/terminal-ime-native-text-forwarder.test.ts src/renderer/src/components/terminal-pane/terminal-ime-input-source.test.ts src/renderer/src/components/terminal-pane/terminal-paste-runtime.test.ts src/renderer/src/components/terminal-pane/terminal-ime-composition-tracker.test.ts src/renderer/src/components/terminal-pane/terminal-ime-candidate-key-release-guard.test.ts src/renderer/src/components/terminal-pane/xterm-bypass-policy-non-mac.test.ts src/renderer/src/components/terminal-pane/xterm-bypass-policy.test.ts",
"result": "passed",
"durationSeconds": 0.7,
"summary": "7 test file(s) passed, 144 tests passed on the Linux/Sogou candidate-key branch (includes held-key repeat guard coverage)."
},
{
"date": "2026-07-07",
"runner": "local",
"platform": "macos",
"command": "pnpm run test:e2e -- tests/e2e/chinese-ime-chat-input-repro.spec.ts",
"result": "passed",
"durationSeconds": 72.0,
"summary": "Electron/CDP IME repro passed: Sogou candidate selection, post-composition candidate selection, and existing Chinese IME harness passed; real Codex IME test was skipped behind ORCA_E2E_REAL_CODEX_IME."
}
],
"runtimeBudget": {
"p95Seconds": 90,
"scope": "renderer unit plus focused Electron/CDP IME repro"
},
"flakeHistory": {
"status": "unknown",
"evidence": "Focused renderer input tests and the Electron/CDP Sogou-style repro are now registered; needs soak history and true platform IME evidence before promotion."
},
"redGreenEvidence": {
"status": "partial",
"evidence": "Focused tests cover existing native-text, input-source, paste/runtime forwarding, Linux/Sogou candidate selector, post-composition guard contracts, and live-PTY Sogou-style candidate commits. Needs intentional-break proof for duplicate native text forwarding and composition preedit leakage, plus the broader language/platform matrix."
},
"performanceBudget": {
"required": true,
"evidence": "Terminal IME hot-path audit clean on 2026-07-11: candidate guards add O(1) boolean checks plus bounded per-pane Space/digit state and one renderer-scoped currently pressed physical-letter set; ref-counted renderer and pane blur listeners are disposed with pane lifecycle; no per-pane keyboard-event fan-out, polling, IPC, subprocess work, or SSH/remote transport cost added."
},
"promotionCriteria": [
"Cover deterministic byte/cell oracles first.",
"Mark true OS IME automation gaps explicitly by platform.",
"Pair with Windows ConPTY keyboard reset for Windows standard-key behavior."
],
"knownGaps": [
"Current commands include renderer-unit coverage and a CDP-driven Electron repro; real OS IME automation may need manual or soak evidence.",
"Backspace/Enter during composition, JIS yen, Arabic/RTL, paste edge cases, and Windows ConPTY post-agent key reset still need representative gate coverage."
],
"demotionRule": "Cannot promote if success is based only on DOM text without PTY byte/cell evidence."
},
{
"id": "terminal-input.windows-conpty-keyboard-reset",
"title": "Windows ConPTY resets keyboard protocol state after agents and TUIs exit",
"maturity": "experimental",
"protection": "none",
"owner": "terminal-platform",
"layer": "windows-electron-conpty",
"surfaces": [
"Windows ConPTY",
"keyboard protocol",
"agent exit",
"TUI exit",
"standard key input"
],
"platforms": [
"windows"
],
"providers": [
"local",
"daemon",
"wsl"
],
"coveredPlatforms": [],
"coveredProviders": [],
"coverageNotes": "Registered gap only; no executable coverage is wired yet.",
"motivatingLinks": [
"https://github.com/stablyai/orca/pull/6999",
"https://github.com/stablyai/orca/pull/6858"
],
"invariant": "After an agent or TUI exits on Windows ConPTY, ordinary Enter, Backspace, Arrow, paste, and printable keys must be delivered as standard shell input, not stale Kitty/CSI-u or application-mode bytes.",
"oracle": "A Windows gate records PTY input bytes before and after agent/TUI exit, submits real shell commands, and proves standard keys work without protocol leakage.",
"commands": [],
"testFiles": [],
"assertionRefs": [],
"evidenceRuns": [],
"runtimeBudget": {
"p95Seconds": 60,
"scope": "Windows provider-contract or focused Electron gate"
},
"flakeHistory": {
"status": "not-started",
"evidence": "Gate is registered as a known Windows ConPTY gap; no command is wired."
},
"redGreenEvidence": {
"status": "missing",
"evidence": "Needs intentional-break proof for stale keyboard-protocol mode after agent/TUI exit."
},
"performanceBudget": {
"required": true,
"evidence": "Must not add per-key global session listing or repeated protocol reset work on the typing hot path."
},
"promotionCriteria": [
"Use byte-level PTY input evidence, not only screenshots.",
"Start as Windows soak until skip and flake behavior is known.",
"Fail promotion on silent Windows environment skips."
],
"knownGaps": [
"No manifest command yet.",
"Real Windows ConPTY execution is not covered by macOS/Linux CI."
],
"demotionRule": "Cannot promote if standard-key behavior is inferred without PTY byte evidence."
},
{
"id": "terminal-input.windows-modified-enter-routing",
"title": "Windows modified Enter routes agent-compatible bytes to the active pane",
"maturity": "experimental",
"protection": "partial",
"owner": "terminal-input",
"layer": "main-provider-renderer-unit-and-windows-electron",
"surfaces": [
"terminal input",
"Windows modified Enter",
"agent identity",
"split panes",
"SSH",
"WSL",
"remote runtime"
],
"platforms": [
"macos",
"linux",
"windows"
],
"providers": [
"local",
"daemon",
"ssh",
"wsl",
"remote-runtime"
],
"coveredPlatforms": [
"macos"
],
"coveredProviders": [],
"coverageNotes": "Deterministic main/renderer tests run on macOS and exercise simulated Windows plus POSIX/Linux process-confirmation behavior. They cover exact local-ConPTY membership, detached-child rejection, SSH and paired-runtime host-platform routing including legacy runtime PTY IDs, active-PTY ownership after worktree host changes, Windows-to-WSL routing, unknown-metadata fallback, production handler composition, KKP authorization on every host, process-confirmed Droid routing and launch-triggered confirmation, typed-alias and forged-OSC isolation, shells without OSC 133, split/detach ownership with preserved shell classification, stale PTY exit/rebind rejection, command-generation revocation, daemon v21 warm-reattach identity, unavailable inspection, and lazy subprocess/RPC callback counts. A live linux-arm64 Docker target additionally proved real relay deployment, SSH PTY host detection, and exact inactive/active KKP bytes. The Electron byte test runs only on Windows; live Windows evidence remains uncollected. Test failures report exact expected bytes; no product telemetry or raw terminal logging is added.",
"motivatingLinks": [
"https://github.com/stablyai/orca/issues/7620",
"https://github.com/stablyai/orca/pull/7668"
],
"invariant": "Shift+Enter key recognition follows the client OS, while emitted bytes follow the active application and PTY host: active Kitty keyboard protocol authorizes CSI-u on every host; otherwise Windows hosts use Esc+CR except when allowlisted Droid ownership or fresh routing-trusted Droid process evidence authorizes CSI-u, and non-Windows hosts use Esc+CR. The active SSH connection, remote-runtime PTY owner, or live local session outranks later worktree ownership changes, and missing host-platform metadata falls back to the client. Every new command and PTY replacement revokes stale agent routing until current evidence settles; split or reused panes cannot inherit sibling or prior-PTY authority; unrelated keys perform no host, agent, protocol, or ConPTY lookup.",
"oracle": "Renderer tests assert exact bytes across client/PTY-host combinations, including Kitty keyboard protocol active and inactive on Windows and non-Windows hosts, and prove SSH identity, the environment encoded in an active remote-runtime PTY id, and live local-session identity outrank current worktree ownership, while unavailable platform metadata falls back to the client. A live linux-arm64 SSH PTY independently captured Esc+CR with KKP inactive and CSI-u with KKP active. Fresh Windows process evidence authorizes Droid bytes only after a recognized global candidate is intersected with the exact ConPTY console process list; detached descendants, helper failure/timeout/root-only fallback, stale PTY exit/rebind results, typed text, and hook/OSC output fail closed. A new OSC 133;C immediately publishes a routing-neutral generation, including during D-to-C races. In cmd.exe/Git Bash/custom shells without OSC 133, accepted inferred commands start the same fresh generation; accepted submit/interrupt, title exit, focus, and visibility revoke trusted Droid bytes while one bounded confirmation runs. Detach preserves the live PTY's source shell override so WSL/native classification cannot change with the current default. Ordinary fast shell commands use cached/no-scan paths; routing-relevant confirmation bypasses cached process snapshots and keeps the bounded three-read ladder. Daemon protocol v21 persists only an allowlisted launchAgent; warm reattach uses it as a display/confirmation hint and restores routing only after current process proof. The Windows Electron test focuses the real xterm textarea and records exact renderer-to-main PTY writes.",
"commands": [
"pnpm exec vitest run --config config/vitest.config.ts src/main/daemon/daemon-foreground-confirmation-protocol.test.ts src/main/daemon/daemon-pty-adapter.test.ts src/main/daemon/daemon-pty-router.test.ts src/main/daemon/daemon-server.test.ts src/main/daemon/degraded-daemon-pty-provider.test.ts src/main/daemon/pty-subprocess-foreground-scan-cadence.test.ts src/main/daemon/pty-subprocess.test.ts src/main/ipc/pty.test.ts src/main/providers/agent-foreground-process.test.ts src/main/providers/local-pty-provider.test.ts src/main/providers/windows-conpty-process-membership.test.ts src/renderer/src/components/terminal-pane/pane-foreground-agent-tracker.test.ts src/renderer/src/components/terminal-pane/pty-connection.test.ts src/renderer/src/components/terminal-pane/pty-transport.test.ts src/renderer/src/components/terminal-pane/terminal-pane-tab-detach.test.ts src/renderer/src/components/terminal-pane/terminal-shortcut-policy.test.ts src/renderer/src/components/terminal-pane/terminal-windows-shift-enter.test.ts src/renderer/src/store/slices/store-cascades.test.ts src/renderer/src/store/slices/terminal-pane-detach-agent-identity.test.ts src/shared/agent-process-recognition.test.ts src/shared/process-table-snapshot.test.ts tests/e2e/terminal-foreground-confirmation.unit.test.ts",
"pnpm run test:e2e -- tests/e2e/terminal-shortcuts.spec.ts",
"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/keyboard-handlers.test.ts src/renderer/src/components/terminal-pane/remote-runtime-pty-transport.test.ts src/renderer/src/components/terminal-pane/terminal-input-host-platform.test.ts"
],
"testFiles": [
"src/main/daemon/daemon-foreground-confirmation-protocol.test.ts",
"src/main/daemon/daemon-pty-adapter.test.ts",
"src/main/daemon/daemon-pty-router.test.ts",
"src/main/daemon/daemon-server.test.ts",
"src/main/daemon/degraded-daemon-pty-provider.test.ts",
"src/main/daemon/pty-subprocess-foreground-scan-cadence.test.ts",
"src/main/daemon/pty-subprocess.test.ts",
"src/main/ipc/pty.test.ts",
"src/main/providers/agent-foreground-process.test.ts",
"src/main/providers/local-pty-provider.test.ts",
"src/main/providers/windows-conpty-process-membership.test.ts",
"src/renderer/src/components/terminal-pane/pane-foreground-agent-tracker.test.ts",
"src/renderer/src/components/terminal-pane/keyboard-handlers.test.ts",
"src/renderer/src/components/terminal-pane/pty-connection.test.ts",
"src/renderer/src/components/terminal-pane/pty-transport.test.ts",
"src/renderer/src/components/terminal-pane/remote-runtime-pty-transport.test.ts",
"src/renderer/src/components/terminal-pane/terminal-pane-tab-detach.test.ts",
"src/renderer/src/components/terminal-pane/terminal-input-host-platform.test.ts",
"src/renderer/src/components/terminal-pane/terminal-shortcut-policy.test.ts",
"src/renderer/src/components/terminal-pane/terminal-windows-shift-enter.test.ts",
"src/renderer/src/store/slices/store-cascades.test.ts",
"src/renderer/src/store/slices/terminal-pane-detach-agent-identity.test.ts",
"src/shared/agent-process-recognition.test.ts",
"src/shared/process-table-snapshot.test.ts",
"tests/e2e/terminal-foreground-confirmation.unit.test.ts",
"tests/e2e/terminal-shortcuts.spec.ts"
],
"assertionRefs": [
{
"file": "src/shared/process-table-snapshot.test.ts",
"assertions": [
"a fresh request bypasses a same-tick TTL cache and any scan already in flight before the request",
"same-turn fresh requests and ordinary cache misses share one later scan while requests arriving after it starts queue behind it"
]
},
{
"file": "src/main/providers/agent-foreground-process.test.ts",
"assertions": [
"successful root-present Windows enumeration and failed, blank, malformed, or root-missing enumeration remain distinct evidence states",
"an observed shell root with no children is authoritative while a snapshot omitting that root is unavailable",
"an attached Droid candidate is authorized only when exact ConPTY membership contains it, while a detached Start-Process descendant is rejected",
"a Windows process-table scan with no recognized agent performs zero ConPTY membership helper forks",
"fresh POSIX scan failure or a snapshot missing the PTY root is unavailable rather than shell proof",
"the compatibility process-name API still preserves its existing fallback contract for other consumers"
]
},
{
"file": "src/main/providers/windows-conpty-process-membership.test.ts",
"assertions": [
"the fixed node-pty helper returns validated integer console membership containing the PTY root",
"root-only fallback, malformed/missing-root messages, spawn errors, and a silent helper timeout all fail closed",
"the bounded timeout kills the child helper exactly once"
]
},
{
"file": "src/main/providers/local-pty-provider.test.ts",
"assertions": [
"a delayed foreground confirmation is discarded after the owning PTY exits"
]
},
{
"file": "src/main/daemon/daemon-pty-adapter.test.ts",
"assertions": [
"new daemon sessions and warm reattach results carry the same minimal allowlisted launchAgent"
]
},
{
"file": "src/main/daemon/daemon-server.test.ts",
"assertions": [
"daemon protocol v21 persists allowlisted launchAgent across reattach and drops unknown identity strings"
]
},
{
"file": "src/main/daemon/pty-subprocess.test.ts",
"assertions": [
"Windows daemon foreground lookup can return PowerShell synchronously before async process-tree enrichment resolves the agent",
"the enriched agent result is served by a later foreground read",
"fresh confirmation awaits a post-request scan instead of serving cached PowerShell and returns null when inspection is unavailable"
]
},
{
"file": "tests/e2e/terminal-foreground-confirmation.unit.test.ts",
"assertions": [
"the real daemon handle and pane tracker keep restored Droid identity when confirmation resolves after the old cache window",
"one fresh command-finish scan confirms real shell exit, while unavailable inspection performs exactly three bounded reads and never claims shell"
]
},
{
"file": "src/renderer/src/components/terminal-pane/keyboard-handlers.test.ts",
"assertions": [
"the production keyboard-policy boundary requires active-host routing and composes macOS Shift+Enter with Windows PTY bytes"
]
},
{
"file": "src/renderer/src/components/terminal-pane/remote-runtime-pty-transport.test.ts",
"assertions": [
"a legacy remote PTY id retains the transport's captured runtime environment identity"
]
},
{
"file": "src/renderer/src/components/terminal-pane/terminal-input-host-platform.test.ts",
"assertions": [
"SSH terminals use remote-platform metadata and execution-host identity when the active transport has not captured a connection id",
"encoded and legacy active remote-runtime PTY identities plus a live local PTY session outrank later worktree host changes",
"a live WSL session normalizes to a Linux terminal host",
"missing SSH/runtime platform metadata and local terminals fall back to the client platform"
]
},
{
"file": "src/renderer/src/components/terminal-pane/terminal-shortcut-policy.test.ts",
"assertions": [
"Windows defaults and non-Droid agents preserve Esc+CR while explicit Droid capability selects CSI-u",
"Windows and non-Windows PTYs reached cross-OS use CSI-u only with active Kitty keyboard protocol unless trusted Windows Droid evidence independently authorizes it",
"unrelated keys invoke neither host, agent, nor protocol callbacks"
]
},
{
"file": "src/renderer/src/components/terminal-pane/terminal-windows-shift-enter.test.ts",
"assertions": [
"only routing-trusted current process identity overrides launch evidence and confirmed shell foreground clears stale identity",
"a newer untrusted or neutral command generation blocks stale launch ownership until confirmation",
"only allowlisted fresh process or pane-scoped launch ownership selects Droid's CSI-u capability",
"forged hook or OSC-derived Droid status cannot change the Windows byte encoding",
"after split and original-pane close, a sole surviving sibling cannot inherit the original pane's Droid launch identity"
]
},
{
"file": "src/renderer/src/components/terminal-pane/pane-foreground-agent-tracker.test.ts",
"assertions": [
"manual and restored local agent identity is published from bounded foreground-process reads",
"a delayed read cannot publish after the pane rebinds to a replacement PTY id",
"every new command publishes a routing-neutral generation before confirmation",
"typed agent text only widens the confirmation window and never becomes published or routable identity",
"unavailable typed-command confirmation stays on legacy routing through the three-read ladder and then fails closed",
"ordinary fast OSC 133;C-to-D command pairs publish shell without a fresh confirmation scan",
"command-start and visible launch recovery use at most three reads across the bounded 350 ms, 1.2 s, and 6 s ladder",
"null and rejected reads participate in the same bounded known-identity ladder",
"command-finished accepts one fresh recognized shell scan when agent evidence exists, while unavailable final evidence retires routing without claiming shell"
]
},
{
"file": "src/renderer/src/components/terminal-pane/pty-connection.test.ts",
"assertions": [
"after detach remount, pane-key launch/process identity forces a leaked nested OSC 133;D through foreground confirmation",
"a still-running Droid process republishes Droid instead of being overwritten with shell-foreground evidence",
"typing droid does not route CSI-u until fresh process evidence confirms Droid",
"null and rejected command-start reads never promote typed Droid text to process evidence",
"typed Droid input cannot replace live Antigravity process or pane-scoped launch identity inside another TUI",
"typed Droid input on SSH or remote-runtime panes never writes local process evidence",
"Droid routing survives a fresh command-finish scan that still sees Droid and retires after one fresh shell result",
"a D-to-C transition immediately routes legacy bytes while the new command generation is pending",
"an identityless visible-read versus OSC 133;D race cancels stale sampling and fails closed to shell",
"a manually typed Droid in a shell without OSC 133 gains routing only after accepted-input fresh confirmation",
"accepted no-OSC exit or interrupt input immediately revokes trusted Droid bytes and confirms the returned shell",
"unavailable command-finish evidence resolves deferred cleanup, returns legacy routing, and does not assert shell foreground",
"daemon-returned allowlisted launchAgent requests warm-reattach confirmation without restoring stale byte authority or the original args/env payload, while missing identity fails closed",
"an unknown persisted wrapper cannot spoof launch identity and confirmed shell state prevents repeat focus scans"
]
},
{
"file": "src/renderer/src/components/terminal-pane/pty-transport.test.ts",
"assertions": [
"allowlisted daemon launchAgent reaches PtyConnectResult on reattach",
"unknown launch identity is dropped at the renderer transport boundary"
]
},
{
"file": "src/renderer/src/store/slices/terminal-pane-detach-agent-identity.test.ts",
"assertions": [
"pane-to-tab detach moves only the detached leaf's launch and process identity to its new pane key",
"pane-to-tab detach preserves the source PTY shell override across native PowerShell and WSL classifications",
"the source hook snapshot is retired rather than copied to a key the running PTY cannot emit",
"the detached Droid keeps CSI-u while the source sibling keeps its own legacy encoding"
]
},
{
"file": "src/shared/agent-process-recognition.test.ts",
"assertions": [
"Droid's process name resolves to the allowlisted Droid agent identity without substring matching"
]
},
{
"file": "tests/e2e/terminal-shortcuts.spec.ts",
"assertions": [
"on Windows the focused terminal sends CSI-u bytes for a Droid pane and Esc+CR bytes after switching that same pane to Antigravity identity",
"the byte oracle observes the real renderer-to-main PTY write path rather than terminal DOM state"
]
}
],
"evidenceRuns": [
{
"date": "2026-07-10",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/main/daemon/daemon-foreground-confirmation-protocol.test.ts src/main/daemon/daemon-pty-adapter.test.ts src/main/daemon/daemon-pty-router.test.ts src/main/daemon/daemon-server.test.ts src/main/daemon/degraded-daemon-pty-provider.test.ts src/main/daemon/pty-subprocess-foreground-scan-cadence.test.ts src/main/daemon/pty-subprocess.test.ts src/main/ipc/pty.test.ts src/main/providers/agent-foreground-process.test.ts src/main/providers/local-pty-provider.test.ts src/main/providers/windows-conpty-process-membership.test.ts src/renderer/src/components/terminal-pane/pane-foreground-agent-tracker.test.ts src/renderer/src/components/terminal-pane/pty-connection.test.ts src/renderer/src/components/terminal-pane/pty-transport.test.ts src/renderer/src/components/terminal-pane/terminal-pane-tab-detach.test.ts src/renderer/src/components/terminal-pane/terminal-shortcut-policy.test.ts src/renderer/src/components/terminal-pane/terminal-windows-shift-enter.test.ts src/renderer/src/store/slices/store-cascades.test.ts src/renderer/src/store/slices/terminal-pane-detach-agent-identity.test.ts src/shared/agent-process-recognition.test.ts src/shared/process-table-snapshot.test.ts tests/e2e/terminal-foreground-confirmation.unit.test.ts",
"result": "passed",
"durationSeconds": 8.71,
"summary": "Twenty-two focused test files passed (1206 tests) on current main, covering fresh-scan ordering/deduplication, exact ConPTY membership and detached-child rejection, stale PTY guards, daemon v21 launch ownership with current-process confirmation, no-OSC command/exit recovery, preserved detach shell classification, unavailable evidence, routing-neutral command generations, exact shortcut bytes, and the composed daemon-plus-tracker contract; the Windows Electron byte test remains platform-gated and is not counted as local macOS evidence."
}
],
"runtimeBudget": {
"p95Seconds": 90,
"scope": "focused renderer units plus the Windows Electron terminal-shortcut spec"
},
"flakeHistory": {
"status": "unknown",
"evidence": "The deterministic units are stable locally; the Windows-only Electron byte path needs CI or nightly soak history before promotion."
},
"redGreenEvidence": {
"status": "partial",
"evidence": "Reverting to the previous unconditional Windows Esc+CR branch fails the Droid byte assertion, while resolving launch metadata from any key other than the active pane fails the split-survivor isolation assertion. Saved intentional-break artifacts and live Windows history are still missing."
},
"performanceBudget": {
"required": true,
"evidence": "Callback-count tests prove unrelated ordinary keys invoke neither host, agent, nor Kitty-protocol resolution. Host and agent callbacks are created once per keyboard effect, so printable input adds no per-key allocations or store reads. Shift+Enter performs bounded synchronous active-transport and indexed store lookups, plus at most one pane-keyed protocol-mode lookup when trusted Windows Droid evidence does not already authorize CSI-u, with no IPC, RPC, subprocess, polling, listener, or timer. Typed text performs no routing write. Ordinary fast OSC 133;C-to-D shell commands perform no fresh confirmation RPC or process scan. An accepted submit/interrupt while trusted Droid is current, a typed allowlisted agent command, title exit, focus, visibility transition, or an idle burst after trusted Droid Shift+Enter can schedule the bounded confirmation ladder; each event cancels/deduplicates prior work and no timer recurs after settling. Windows confirmation performs one fresh process-table scan and forks exact ConPTY membership only after a recognized agent candidate appears; no recognized candidate makes zero helper calls. Same-turn fresh requests share one scan and later arrivals queue at most one successor. Recovery remains three bounded one-shot reads (350 ms, 1.2 s, 6 s). No polling loop, provider fanout, persistent listener, hidden-pane wake loop, or per-printable-key work is added."
},
"promotionCriteria": [
"Run the exact PTY-byte Electron oracle on Windows without silent platform skips.",
"Collect stable runtime and flake history for local and daemon Windows ConPTY while retaining deterministic host-routing assertions for SSH, WSL, and remote runtime.",
"Attach saved intentional-break evidence for Droid capability removal and split-sibling identity leakage."
],
"knownGaps": [
"No Windows runner or live Windows PTY evidence is attached; the Electron byte test skips on macOS and Linux, while a live Linux SSH PTY covers only the remote Linux host path.",
"Droid agent-specific CSI-u authorization is available only from trusted pane evidence; without it, Windows and non-Windows PTY hosts depend on the application's Kitty keyboard protocol state.",
"The Electron test injects allowlisted pane identity rather than launching the real Droid and Antigravity binaries.",
"If both Windows process-enumeration backends remain unavailable through the bounded ladder, routing fails closed to the legacy Esc+CR path; no live Droid artifact covers that degraded host configuration.",
"Protocol v21 restarts older daemons because the minimal persisted launchAgent is a new contract; sessions preserved by pre-v21 daemons cannot supply warm-reattach launch ownership and fail closed until current process confirmation or restart.",
"No live daemon, WSL, remote-runtime, paired-web, or restore/replay byte artifact has been collected; SSH is covered only by a macOS-client-to-Linux-host relay run.",
"A running PTY keeps its spawn-time ORCA_PANE_KEY after pane-to-tab detach. This change transfers launch/process routing evidence and retires the stale hook snapshot, but does not redesign future hook reattribution across tab IDs."
],
"demotionRule": "Keep non-blocking or demote to protection none if the Windows byte test silently skips, flakes without an actionable artifact, routes bytes using tab/title/terminal-output heuristics, or adds any ordinary-key lookup, IPC, polling, scan, or lifecycle leak."
},
{
"id": "terminal-input.guarded-agent-send-authorization",
"title": "Guarded agent sends authorize only the confirmed exact PTY",
"maturity": "experimental",
"protection": "partial",
"owner": "terminal-input",
"layer": "runtime-provider-contract",
"surfaces": [
"terminal input",
"guarded note sends",
"agent status",
"PTY identity",
"foreground process confirmation"
],
"platforms": [
"macos",
"linux",
"windows"
],
"providers": [
"local",
"daemon",
"ssh",
"wsl",
"remote-runtime"
],
"coveredPlatforms": [
"macos"
],
"coveredProviders": [
"local",
"daemon"
],
"coverageNotes": "Runtime and provider-contract tests on macOS cover exact-PTY authorization, local/daemon fresh confirmation, exact ConPTY membership, and unsupported-provider fail-closed behavior. Physical Windows, live Linux, SSH, WSL, and remote-runtime validation remain explicit gaps; providers without confirmation preserve conservative refusal on a shell conflict.",
"motivatingLinks": [
"https://github.com/stablyai/orca/issues/8303"
],
"invariant": "A guarded note send writes only to the exact PTY binding checked by the guard and only while permission/wait evidence allows input; fresh hook state conflicting with an ordinary shell foreground requires fresh provider confirmation of a recognized agent in that PTY.",
"oracle": "Fresh explicit state plus ordinary PowerShell plus confirmed recognized agent is sendable on the same PTY. Confirmed shell/non-agent, unavailable confirmation, PTY exit, handle rebind, or a callback PTY mismatch returns a refusal or not-writable result and writes zero bytes.",
"commands": [
"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/orca-runtime.test.ts src/main/runtime/rpc/terminal-send.test.ts src/main/ipc/pty.test.ts src/main/providers/agent-foreground-process.test.ts src/main/providers/local-pty-provider.test.ts src/main/providers/windows-conpty-process-membership.test.ts src/main/daemon/daemon-foreground-confirmation-protocol.test.ts src/main/daemon/pty-subprocess.test.ts src/renderer/src/lib/active-agent-note-send.test.ts src/renderer/src/components/browser-pane/BrowserAnnotationSendMenuContent.test.tsx"
],
"testFiles": [
"src/main/runtime/orca-runtime.test.ts",
"src/main/runtime/rpc/terminal-send.test.ts",
"src/main/ipc/pty.test.ts",
"src/main/providers/agent-foreground-process.test.ts",
"src/main/providers/local-pty-provider.test.ts",
"src/main/providers/windows-conpty-process-membership.test.ts",
"src/main/daemon/daemon-foreground-confirmation-protocol.test.ts",
"src/main/daemon/pty-subprocess.test.ts",
"src/renderer/src/lib/active-agent-note-send.test.ts",
"src/renderer/src/components/browser-pane/BrowserAnnotationSendMenuContent.test.tsx"
],
"assertionRefs": [
{
"file": "src/main/runtime/orca-runtime.test.ts",
"assertions": [
"a recognized fresh provider confirmation authorizes explicit hook state over an ordinary shell result",
"shell, non-agent, null, thrown, and missing confirmation remain fail-closed",
"title blockers and ordinary recognized agent evidence add no confirmation call",
"PTY exit or handle rebind during either foreground read rejects evidence bound to the original PTY",
"controller-less yields preserve stale-handle errors and confirmation methods retain their controller receiver"
]
},
{
"file": "src/main/runtime/rpc/terminal-send.test.ts",
"assertions": [
"a handle rebind during guarded status evaluation returns not writable and writes zero bytes",
"the callback's actual PTY must equal the handle binding before status can authorize a write"
]
},
{
"file": "src/main/ipc/pty.test.ts",
"assertions": [
"runtime confirmation reaches the provider owning the captured PTY",
"unsupported or missing providers return unavailable confirmation"
]
},
{
"file": "src/main/providers/agent-foreground-process.test.ts",
"assertions": [
"recognized Windows candidates require exact ConPTY membership and detached descendants are rejected",
"unavailable process inspection is distinct from authoritative shell evidence"
]
},
{
"file": "src/main/providers/local-pty-provider.test.ts",
"assertions": [
"fresh confirmation is discarded when its owning local PTY exits"
]
},
{
"file": "src/main/providers/windows-conpty-process-membership.test.ts",
"assertions": [
"exact ConPTY console membership comes from the fixed node-pty helper",
"malformed, incomplete, timed-out, and spawn-error membership reads fail closed"
]
},
{
"file": "src/main/daemon/daemon-foreground-confirmation-protocol.test.ts",
"assertions": [
"daemons from before the fresh-confirmation RPC are rejected by protocol version"
]
},
{
"file": "src/main/daemon/pty-subprocess.test.ts",
"assertions": [
"fresh confirmation bypasses cached PowerShell and waits for a post-request process scan"
]
},
{
"file": "src/renderer/src/lib/active-agent-note-send.test.ts",
"assertions": [
"selected active-agent note sends retain guarded paste and submit routing"
]
},
{
"file": "src/renderer/src/components/browser-pane/BrowserAnnotationSendMenuContent.test.tsx",
"assertions": [
"browser annotation send content routes through review-notes send so existing agent sessions remain selectable",
"both browser annotation send surfaces wire the shared menu content"
]
}
],
"evidenceRuns": [
{
"date": "2026-07-11",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/orca-runtime.test.ts src/main/runtime/rpc/terminal-send.test.ts src/main/ipc/pty.test.ts src/main/providers/agent-foreground-process.test.ts src/main/providers/local-pty-provider.test.ts src/main/providers/windows-conpty-process-membership.test.ts src/main/daemon/daemon-foreground-confirmation-protocol.test.ts src/main/daemon/pty-subprocess.test.ts src/renderer/src/lib/active-agent-note-send.test.ts src/renderer/src/components/browser-pane/BrowserAnnotationSendMenuContent.test.tsx",
"result": "passed",
"durationSeconds": 9.58,
"summary": "Ten focused test files passed (1183 tests), covering runtime confirmation and PTY revalidation, guarded RPC zero-write behavior, PTY controller routing, local/daemon fresh scans, exact ConPTY membership, and unchanged renderer note routing."
}
],
"runtimeBudget": {
"p95Seconds": 45,
"scope": "focused runtime, RPC, PTY provider, and renderer routing units"
},
"flakeHistory": {
"status": "unknown",
"evidence": "Deterministic units have local coverage only; promotion requires repeated CI and platform history."
},
"redGreenEvidence": {
"status": "partial",
"evidence": "Removing strong confirmation fails the shell-conflict success oracle, while removing either exact-binding comparison fails zero-write rebind coverage; saved intentional-break and physical Windows evidence remain missing."
},
"performanceBudget": {
"required": true,
"evidence": "Confirmation is invoked at most once per status evaluation and only for fresh explicit hook state whose ordinary foreground result is a shell. Count tests prove permission/title blockers and ordinary recognized-agent evidence add zero confirmations; no polling, retry, session listing, provider fanout, or runtime-global cache is added, and existing provider snapshot dedup remains authoritative."
},
"promotionCriteria": [
"Run the browser annotation existing-agent and repeat-send path in Electron on Windows ConPTY without a recognition refusal.",
"Collect stable CI and flake history across local and daemon providers on Windows plus representative macOS/Linux coverage.",
"Attach saved intentional-break evidence for confirmation removal and exact-PTY revalidation removal."
],
"knownGaps": [
"Physical Windows validation is unavailable on the current macOS host; exact ConPTY membership is covered deterministically.",
"Electron annotation golden-path, repeat-send, adjacent-menu evidence, and screenshots are left to coordinator validation.",
"SSH, WSL, legacy daemon, and remote-runtime providers without confirmation remain intentionally fail-closed on an ordinary-shell conflict; no live artifacts cover those degraded paths.",
"No live Linux PTY, paired-web, mobile/relay, restore/replay, or multi-window artifact is attached; those surfaces receive no renderer, persistence, or protocol change."
],
"demotionRule": "Keep non-blocking or demote to protection none if provider confirmation becomes unconditional, exact-PTY mismatch can write bytes, unsupported providers fail open, or the focused gate flakes without an actionable product or harness defect."
},
{
"id": "terminal-input.agent-prompt-injection",
"title": "Orchestration agent prompts arrive as bracketed paste before submit",
"maturity": "experimental",
"protection": "partial",
"owner": "terminal-input",
"layer": "runtime-contract-and-cli-repro",
"surfaces": [
"terminal input",
"agent prompt injection",
"orchestration dispatch",
"PTY writes",
"bracketed paste"
],
"platforms": [
"macos",
"linux",
"windows"
],
"providers": [
"local",
"daemon",
"ssh",
"remote-runtime"
],
"coveredPlatforms": [
"macos"
],
"coveredProviders": [
"local"
],
"coverageNotes": "Local macOS evidence covers the runtime PTY write contract and a live dev-runtime CLI repro. SSH, daemon, remote-runtime, Linux, and Windows remain provider/platform gaps; the product path stays provider-owned and does not add local filesystem or process assumptions.",
"motivatingLinks": [
"https://github.com/stablyai/orca/issues/7226"
],
"invariant": "Injected orchestration task prompts for recognized agent CLIs must send the prompt body inside one bracketed-paste frame, sanitize embedded ESC bytes, preserve chunk boundaries without losing the frame, and send Enter only after the paste frame completes.",
"oracle": "Runtime tests assert the exact PTY write sequence and failure cleanup; orchestration tests assert dispatch/coordinator use the agent prompt path; the live CLI harness dispatches a 32KB task to a fake Codex-like TUI and requires marker present, bracketed paste present, zero unframed line breaks, and submit observed.",
"commands": [
"pnpm exec vitest run --config config/vitest.config.ts src/shared/agent-prompt-injection.test.ts src/main/runtime/orca-runtime.test.ts src/main/runtime/rpc/methods/orchestration.test.ts src/main/runtime/orchestration/coordinator.test.ts",
"node tools/repro-orchestration-long-prompt.mjs --cli out/bin/orca-dev --mode codex-like --size-kb 32 --timeout-ms 20000"
],
"testFiles": [
"src/shared/agent-prompt-injection.test.ts",
"src/main/runtime/orca-runtime.test.ts",
"src/main/runtime/rpc/methods/orchestration.test.ts",
"src/main/runtime/orchestration/coordinator.test.ts",
"tools/repro-orchestration-long-prompt.mjs"
],
"assertionRefs": [
{
"file": "src/shared/agent-prompt-injection.test.ts",
"assertions": [
"agent prompts are always framed as bracketed paste",
"submit stays separate from the paste frame",
"embedded ESC bytes are made inert before framing",
"chunk reconstruction preserves the paste frame"
]
},
{
"file": "src/main/runtime/orca-runtime.test.ts",
"assertions": [
"runtime writes bracketed paste before a delayed submit",
"large prompt frames are chunked and reconstructed before submit",
"partial prompt write failure closes the paste frame and does not submit"
]
},
{
"file": "src/main/runtime/rpc/methods/orchestration.test.ts",
"assertions": [
"orchestration.dispatch uses the agent prompt path for injected preambles",
"raw terminal.send is not called for injected task prompts",
"failed prompt injection rolls back the active dispatch"
]
},
{
"file": "src/main/runtime/orchestration/coordinator.test.ts",
"assertions": [
"coordinator dispatch failures from prompt injection circuit-break through the DB",
"silent-skip paths do not attempt prompt injection"
]
},
{
"file": "tools/repro-orchestration-long-prompt.mjs",
"assertions": [
"fake Codex-like worker observes submit after long orchestration dispatch",
"32KB task marker survives before submit",
"prompt bytes include a bracketed-paste frame with zero unframed line breaks"
]
}
],
"evidenceRuns": [
{
"date": "2026-07-07",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/shared/agent-prompt-injection.test.ts src/main/runtime/orca-runtime.test.ts src/main/runtime/rpc/methods/orchestration.test.ts src/main/runtime/orchestration/coordinator.test.ts",
"result": "passed",
"durationSeconds": 7.4,
"summary": "4 test files passed, 697 tests passed; covers framing, runtime PTY writes, orchestration RPC dispatch, and coordinator dispatch behavior."
},
{
"date": "2026-07-07",
"runner": "local",
"platform": "macos",
"command": "node tools/repro-orchestration-long-prompt.mjs --cli out/bin/orca-dev --mode codex-like --size-kb 32 --timeout-ms 20000",
"result": "passed",
"durationSeconds": 2.2,
"summary": "Live dev-runtime repro passed: expectedSpecBytes=32830, hasSubmit=true, rawContainsMarker=true, hasBracketedPasteFrame=true, unframedLineBreaks=0, contractOk=true."
}
],
"runtimeBudget": {
"p95Seconds": 30,
"scope": "runtime contract tests plus optional local dev-runtime CLI repro"
},
"flakeHistory": {
"status": "unknown",
"evidence": "First local macOS evidence only; needs repeated dev-runtime harness runs and provider matrix evidence before promotion."
},
"redGreenEvidence": {
"status": "partial",
"evidence": "The live harness reproduced the unsafe raw multiline contract before the fix and passes after the fix; intentional-break evidence is local only and not yet in CI."
},
"performanceBudget": {
"required": true,
"evidence": "Agent prompt dispatch remains O(prompt bytes), uses the existing 16KB terminal input chunking and one existing 500ms submit delay, and adds no polling, provider listing, subprocess churn, hidden-pane wakeups, or renderer work."
},
"promotionCriteria": [
"Run the live harness in soak with a self-starting dev runtime or provider-contract fixture.",
"Add daemon, SSH, remote-runtime, Linux, and Windows evidence or mark narrower provider scope.",
"Capture stable red/green intentional-break evidence in CI before blocking promotion."
],
"knownGaps": [
"Live harness command currently expects an already-running dev runtime and generated out/bin/orca-dev wrapper.",
"No Windows ConPTY, Linux PTY, SSH, daemon, or remote-runtime live evidence yet.",
"Push-on-idle orchestration message banners remain outside this dispatch-prompt gate."
],
"demotionRule": "Demote or quarantine if the live harness flakes without a product bug or harness bug filed to the terminal-input owner."
},
{
"id": "orchestration.worker-terminal-delivery",
"title": "Started workers are visible without stealing focus and retain mailbox identity",
"maturity": "experimental",
"protection": "partial",
"owner": "orchestration",
"layer": "cli-runtime-renderer-contract",
"surfaces": [
"Run and Dispatch mailboxes",
"worker-start",
"terminal creation",
"terminal tab materialization",
"workspace re-entry"
],
"platforms": [
"macos",
"linux",
"windows"
],
"providers": [
"local",
"daemon",
"ssh",
"wsl",
"remote-runtime"
],
"coveredPlatforms": [
"macos"
],
"coveredProviders": [
"local",
"daemon",
"ssh"
],
"coverageNotes": "Deterministic units cover local worker presentation, reveal-failure warnings, stable-pane Run/Dispatch routing, and the SSH in-process CLI fallback. An isolated macOS Electron journey launches a fake Codex worker through the real RPC path, tolerates spawn-time handle reminting, asserts the inactive tab in the DOM before navigation, checks Run delivery by pane identity, and proves workspace re-entry keeps one worker tab by both original tab ID and visible title. SSH, WSL, remote-runtime, Linux, and Windows remain live-test gaps; federated workers retain explicit background presentation.",
"motivatingLinks": [
"https://github.com/stablyai/orca/pull/11107#discussion_r3663321387"
],
"invariant": "Starting a worker in the coordinator's current workspace must materialize one inactive terminal tab before worker-start returns, preserve coordinator focus, and remain exactly once after workspace re-entry. An exact existing target workspace must receive a discoverable tab without stealing coordinator focus; if renderer reveal fails, worker-start must expose that the live worker remains background-only. Run and Dispatch checks must resolve through the caller's stable pane identity when a terminal handle is reminted, while a live handle outranks mismatched pane metadata, explicit legacy terminal inspection remains handle-scoped, and remote or headless worker presentation remains background-only.",
"oracle": "Drive Run create, Task create, and worker-start through a production Electron runtime with a deterministic Codex fixture. Require the worker tab to be visible in the DOM with data-active=false while the coordinator tab stays active, send ACK to the Run, read it with a deliberately stale coordinator handle plus its stable pane key, switch workspaces away and back, and require exactly one worker tab by original ID and visible title. Unit tests separately assert local worker-start omits background presentation, reveal failures return an actionable warning without discarding the worker, reminted coordinators and workers retain mailbox routing, live handles outrank mismatched pane metadata, and explicit legacy terminal checks do not inherit the caller pane key locally or through the SSH fallback.",
"commands": [
"pnpm exec vitest run --config config/vitest.config.ts src/cli/handlers/orchestration.test.ts src/cli/handlers/orchestration-check-identity.test.ts src/cli/handlers/orchestration-worker-cli.test.ts src/main/runtime/rpc/methods/orchestration.test.ts src/main/ssh/ssh-remote-orca-cli.test.ts",
"pnpm run test:e2e -- tests/e2e/orchestration-worker-terminal-visibility.spec.ts --workers=1"
],
"testFiles": [
"src/cli/handlers/orchestration.test.ts",
"src/cli/handlers/orchestration-check-identity.test.ts",
"src/cli/handlers/orchestration-worker-cli.test.ts",
"src/main/runtime/rpc/methods/orchestration.test.ts",
"src/main/ssh/ssh-remote-orca-cli.test.ts",
"tests/e2e/orchestration-worker-terminal-visibility.spec.ts"
],
"assertionRefs": [
{
"file": "src/cli/handlers/orchestration-check-identity.test.ts",
"assertions": [
"implicit check carries the caller pane key with a potentially stale environment handle",
"explicit legacy terminal inspection does not inherit the caller pane key"
]
},
{
"file": "src/cli/handlers/orchestration-worker-cli.test.ts",
"assertions": [
"worker-start prints an explicit warning when its live worker remains background-only"
]
},
{
"file": "src/main/runtime/rpc/methods/orchestration.test.ts",
"assertions": [
"same-workspace worker creation uses visible inactive presentation",
"worker-start preserves and reports renderer reveal failures",
"Run delivery resolves through a stable coordinator pane after handle remint",
"Dispatch delivery resolves through a stable worker pane after handle remint",
"a live handle cannot be retargeted by mismatched pane metadata"
]
},
{
"file": "src/main/ssh/ssh-remote-orca-cli.test.ts",
"assertions": [
"implicit SSH fallback checks retain stable pane identity",
"explicit legacy SSH inspection does not inherit the caller pane key"
]
},
{
"file": "tests/e2e/orchestration-worker-terminal-visibility.spec.ts",
"assertions": [
"worker-start exposes one inactive worker tab before workspace navigation",
"the coordinator tab remains active",
"ACK delivery reaches a stable coordinator pane through a stale handle",
"workspace re-entry does not duplicate the worker tab under the same or a new tab ID"
]
}
],
"evidenceRuns": [
{
"date": "2026-07-28",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/cli/handlers/orchestration.test.ts src/cli/handlers/orchestration-check-identity.test.ts src/cli/handlers/orchestration-worker-cli.test.ts src/main/runtime/rpc/methods/orchestration.test.ts src/main/ssh/ssh-remote-orca-cli.test.ts",
"result": "passed",
"durationSeconds": 5.27,
"summary": "Five focused files passed with 216 tests, covering visible inactive local worker creation, reveal-failure warnings, stable-pane mailbox routing, live-handle precedence, and SSH fallback parity."
},
{
"date": "2026-07-28",
"runner": "local",
"platform": "macos",
"command": "pnpm run test:e2e -- tests/e2e/orchestration-worker-terminal-visibility.spec.ts --workers=1",
"result": "passed",
"durationSeconds": 11.5,
"summary": "The isolated Electron journey passed with a real Run and Task, deterministic Codex PTY, immediate inactive DOM tab, ACK delivery through a stale coordinator handle, and exactly one worker tab by original ID and management title after workspace re-entry."
}
],
"runtimeBudget": {
"p95Seconds": 45,
"scope": "focused CLI/runtime units plus one isolated Electron worker-start journey"
},
"flakeHistory": {
"status": "unknown",
"evidence": "The deterministic units and isolated Electron journey pass locally; CI and soak history are not yet available."
},
"redGreenEvidence": {
"status": "partial",
"evidence": "The focused presentation and stale-handle tests failed against the pre-fix implementation, and the live incident plus Electron topology showed the worker PTY existed without an immediate tab. Saved intentional-break and CI artifacts are still needed."
},
"performanceBudget": {
"required": true,
"evidence": "Worker-start reuses the existing one-shot renderer reveal and adds no polling, provider listing, or output work. Check adds one optional pane-key field and reuses the existing Run scan or bounded active-Dispatch lookup; it adds no extra RPC, subprocess, timer, or renderer update. Federated and explicitly background terminals are unchanged."
},
"promotionCriteria": [
"Collect 100 consecutive passes or 14 days of stable CI history on macOS, Linux, and Windows.",
"Add live SSH and WSL exact-workspace worker-start evidence and a paired remote-runtime control.",
"Attach saved intentional-break artifacts for hidden local presentation and dropped stable-pane delivery."
],
"knownGaps": [
"No live Linux, Windows, SSH, WSL, or paired remote-runtime run is attached.",
"The Electron journey uses a deterministic fake Codex CLI rather than a real account.",
"The gate does not cover terminal output recovery after app restart; it covers identity, discoverability, focus, and mailbox routing."
],
"demotionRule": "Keep experimental or demote if the Electron journey flakes without a product or harness defect, if local worker-start can return before tab materialization without an explicit reveal warning, if focus moves to the worker, if workspace re-entry duplicates the tab, or if pane-stable delivery reads the wrong mailbox."
},
{
"id": "terminal-render.windows-cjk-repaint",
"title": "Windows ConPTY wide glyphs and cursor rewrites repaint without stale cells",
"maturity": "experimental",
"protection": "none",
"owner": "terminal-rendering",
"layer": "windows-electron-conpty",
"surfaces": [
"Windows ConPTY",
"CJK",
"emoji",
"wide glyphs",
"cursor repaint",
"rewrite output"
],
"platforms": [
"windows"
],
"providers": [
"local",
"daemon",
"wsl"
],
"coveredPlatforms": [],
"coveredProviders": [],
"coverageNotes": "Registered gap only; no executable coverage is wired yet.",
"motivatingLinks": [
"https://github.com/stablyai/orca/pull/6876",
"https://github.com/stablyai/orca/pull/6968",
"https://github.com/stablyai/orca/pull/6970"
],
"invariant": "Windows terminal repaint must not leave stale cells, clipped wide glyphs, or hidden cursor state after CJK, emoji, or cursor-rewrite output.",
"oracle": "A Windows gate combines xterm buffer assertions with bounded screenshot/canvas evidence for representative CJK, emoji, and rewrite sequences.",
"commands": [],
"testFiles": [],
"assertionRefs": [],
"evidenceRuns": [],
"runtimeBudget": {
"p95Seconds": 90,
"scope": "Windows focused Electron render gate"
},
"flakeHistory": {
"status": "not-started",
"evidence": "Gate is registered as a known Windows rendering gap; no command is wired."
},
"redGreenEvidence": {
"status": "missing",
"evidence": "Needs intentional-break proof for stale wide-glyph repaint or cursor restore."
},
"performanceBudget": {
"required": true,
"evidence": "Must record refresh count or frame budget so repaint fixes do not mask excessive redraw churn."
},
"promotionCriteria": [
"Use buffer/cell evidence as the primary oracle and screenshots as diagnostics.",
"Keep stress cases non-blocking until Windows runtime history is stable.",
"Fail promotion on silent Windows environment skips."
],
"knownGaps": [
"No manifest command yet.",
"No Windows CJK/emoji repaint command is wired."
],
"demotionRule": "Cannot promote if the oracle is screenshot-only or environment-skipped."
},
{
"id": "terminal-shell.windows-resolution-parity",
"title": "Windows local and daemon providers resolve shells and startup commands consistently",
"maturity": "experimental",
"protection": "none",
"owner": "terminal-platform",
"layer": "provider-contract-windows",
"surfaces": [
"shell resolution",
"startup command",
"cwd",
"environment",
"local provider",
"daemon provider"
],
"platforms": [
"windows"
],
"providers": [
"local",
"daemon",
"wsl"
],
"coveredPlatforms": [],
"coveredProviders": [],
"coverageNotes": "Registered gap only; no executable coverage is wired yet.",
"motivatingLinks": [
"https://github.com/stablyai/orca/pull/6541",
"https://github.com/stablyai/orca/pull/6858"
],
"invariant": "Windows local and daemon terminals must resolve equivalent shell paths, args, cwd, env, startup command delivery, and fallback behavior for PowerShell 5/7, cmd, Git Bash, WSL, and missing pwsh.",
"oracle": "Provider-contract fixtures compare resolved command descriptors and live shell markers for supported Windows shells across local and daemon providers.",
"commands": [],
"testFiles": [],
"assertionRefs": [],
"evidenceRuns": [],
"runtimeBudget": {
"p95Seconds": 60,
"scope": "Windows provider-contract gate"
},
"flakeHistory": {
"status": "not-started",
"evidence": "Gate is registered as a known Windows shell parity gap; no command is wired."
},
"redGreenEvidence": {
"status": "missing",
"evidence": "Needs intentional-break proof for mismatched daemon/local shell resolution or lost startup command."
},
"performanceBudget": {
"required": false,
"evidence": "Required if resolution adds probing or PATH scans on hot startup paths."
},
"promotionCriteria": [
"Start with provider-contract fixtures before live Electron coverage.",
"Cover missing-shell fallback explicitly.",
"Fail promotion on silent Windows environment skips."
],
"knownGaps": [
"No manifest command yet.",
"No local-vs-daemon Windows shell parity command is wired."
],
"demotionRule": "Cannot promote if local and daemon provider behavior are tested separately without parity assertions."
},
{
"id": "terminal-performance.input-throughput",
"title": "Terminal input latency and throughput stay inside explicit budgets",
"maturity": "experimental",
"protection": "none",
"owner": "terminal-performance",
"layer": "electron-perf",
"surfaces": [
"typing latency",
"output throughput",
"hidden output",
"renderer CPU",
"resize churn"
],
"platforms": [
"macos",
"linux",
"windows"
],
"providers": [
"local",
"daemon",
"ssh",
"remote-runtime"
],
"coveredPlatforms": [],
"coveredProviders": [],
"coverageNotes": "Registered gap only; no executable coverage is wired yet.",
"motivatingLinks": [
"https://github.com/stablyai/orca/pull/7002",
"https://github.com/stablyai/orca/pull/6858"
],
"invariant": "Terminal typing, paste, resize, and output rendering must stay within latency and throughput budgets under realistic active and hidden-output load.",
"oracle": "Perf artifacts record median/p95/max key latency, event-loop delay, renderer CPU, output bytes/sec, resize count, hidden restore latency, queue depth, and dropped-output counts.",
"commands": [],
"testFiles": [],
"assertionRefs": [],
"evidenceRuns": [],
"runtimeBudget": {
"p95Seconds": 120,
"scope": "focused terminal perf report gate"
},
"flakeHistory": {
"status": "not-started",
"evidence": "Existing terminal perf scripts exist, but this gate is not wired with budgets or artifacts."
},
"redGreenEvidence": {
"status": "missing",
"evidence": "Needs intentional-break proof for hot-path listing, unbounded scheduler work, and input starvation."
},
"performanceBudget": {
"required": true,
"evidence": "Suggested initial budgets: active key median <=75ms, worst <=300ms in perf scenarios, dropped output 0, and bounded queue depths recorded per run."
},
"promotionCriteria": [
"Wire existing perf scripts to emit machine-readable artifacts.",
"Make budgets platform-aware before blocking.",
"Do not promote stress variants until runtime history is stable."
],
"knownGaps": [
"No manifest command yet.",
"Existing perf scripts are not registered with explicit budgets or flake history."
],
"demotionRule": "Cannot promote without metric artifacts and stable p95 runtime history."
},
{
"id": "terminal-performance.daemon-stream-backpressure",
"title": "Daemon terminal streams respect socket backpressure under output floods",
"maturity": "experimental",
"protection": "none",
"owner": "terminal-performance",
"layer": "daemon-provider-contract",
"surfaces": [
"daemon stream",
"socket write",
"drain",
"hidden output",
"input starvation"
],
"platforms": [
"macos",
"linux",
"windows"
],
"providers": [
"daemon"
],
"coveredPlatforms": [],
"coveredProviders": [],
"coverageNotes": "Registered gap on main. The daemon batcher write(false)/drain contracts exist only on the pending reliability stack. It registers here with its owning split PR.",
"motivatingLinks": [
"https://github.com/stablyai/orca/pull/6836",
"https://github.com/stablyai/orca/pull/6858"
],
"invariant": "Daemon terminal output floods must pause when socket writes return false, resume on drain, keep buffered bytes bounded, and not starve focused input.",
"oracle": "The current executable slice injects a slow socket and asserts write(false)/drain ordering, bounded queued daemon stream bytes, close/error listener cleanup, newest-tail preservation under sustained pressure, and flush-immediate cross-session priority ahead of unrelated background backlog on drain. Active input latency remains part of the broader perf gate.",
"commands": [],
"testFiles": [],
"assertionRefs": [],
"evidenceRuns": [],
"runtimeBudget": {
"p95Seconds": 60,
"scope": "daemon provider-contract gate"
},
"flakeHistory": {
"status": "unknown",
"evidence": "Focused daemon stream backpressure contract runs locally; needs soak history before promotion."
},
"redGreenEvidence": {
"status": "partial",
"evidence": "Tests assert daemon stream writes pause after socket write(false), later stream data queues behind the pressured socket, flush-immediate output from another session is prioritized ahead of unrelated queued background backlog on drain while preserving per-session order, queued lines resume on drain, global cleanup and close/error clear pending drain listeners, and queued bytes are bounded by preserving priority output plus the newest tail. Needs intentional-break artifact plus active-input latency proof before promotion."
},
"performanceBudget": {
"required": true,
"evidence": "Must record queued bytes, drain count, write(false) count, dropped output, and active input latency."
},
"promotionCriteria": [
"Keep deterministic socket mocks as the blocking candidate only after soak.",
"Record byte and drain artifacts on failure.",
"Pair with the broader output-backpressure budget before blocking."
],
"knownGaps": [
"No executable coverage on main yet; the slice lives on the pending fix-terminal-reliability stack.",
"Current command is daemon batcher contract coverage, not live daemon/Electron perf.",
"Active input latency is not proven in live daemon/Electron perf."
],
"demotionRule": "Cannot promote if backpressure is inferred only from renderer output success."
},
{
"id": "terminal-performance.store-and-git-hot-paths",
"title": "Terminal-adjacent store and git polling work stays off hot interaction paths",
"maturity": "experimental",
"protection": "none",
"owner": "terminal-performance",
"layer": "renderer-main-perf-contract",
"surfaces": [
"store selectors",
"git polling",
"startup hydration",
"terminal focus",
"tab switch",
"workspace switch",
"agent status"
],
"platforms": [
"macos",
"linux",
"windows"
],
"providers": [
"local",
"daemon",
"ssh",
"remote-runtime"
],
"coveredPlatforms": [],
"coveredProviders": [],
"coverageNotes": "Registered gap on main. The boot-hydration counters and their tests exist only on the pending reliability stack. It registers here with its owning split PR.",
"motivatingLinks": [
"https://github.com/stablyai/orca/pull/7002"
],
"invariant": "Terminal typing, focus, resize, tab/workspace switch, and agent/session restore must not trigger unbounded store projection, git status, provider listing, or per-pane polling work.",
"oracle": "The current executable slice instruments boot-time local PTY registry hydration with repo counts, local-vs-remote repo skips, worktree enumeration counts, adapter/session listing counts, registration/skipped-session counts, duration, and failure phase. The broader oracle still needs instrumentation that counts store selector recomputes, git status requests, provider listings, and session scans during scripted hot interactions with many worktrees and terminal panes.",
"commands": [],
"testFiles": [],
"assertionRefs": [],
"evidenceRuns": [],
"runtimeBudget": {
"p95Seconds": 60,
"scope": "renderer-main perf/count gate"
},
"flakeHistory": {
"status": "unknown",
"evidence": "Focused boot-hydration counter slice passed locally once; needs CI/runtime history before promotion."
},
"redGreenEvidence": {
"status": "partial",
"evidence": "Tests would fail if boot hydration enumerated SSH worktrees, stopped recording provider-unavailable retry state, lost the startup counter surface, stopped recording fatal hydration failures, or missed router adapter fanout/list-failure counters. Needs intentional-break proof for git/status polling or store scans triggered by terminal hot paths."
},
"performanceBudget": {
"required": true,
"evidence": "Current slice records boot-hydration repo, worktree, adapter, session, skip, register, and duration counters. Promotion still requires count budgets for listSessions, git status, provider scans, store recomputes, and elapsed hot-interaction time."
},
"promotionCriteria": [
"Use deterministic counters before broad perf scenarios.",
"Cover high-session and high-worktree fixtures.",
"Keep stress variants non-blocking until stable."
],
"knownGaps": [
"No executable coverage on main yet; the slice lives on the pending fix-terminal-reliability stack.",
"Current command covers boot hydration counters only, not interactive terminal hot paths.",
"No Electron count gate yet proves focus, typing, tab switch, workspace switch, render, or high-session provider fanout avoids broad store/git/provider scans."
],
"demotionRule": "Cannot promote without count budgets and actionable artifacts."
},
{
"id": "terminal-output.scrollback-restore",
"title": "Scrollback restore, hidden output, and replay clear semantics do not overlap stale bytes",
"maturity": "experimental",
"protection": "partial",
"owner": "terminal-rendering",
"layer": "renderer-provider-contract",
"surfaces": [
"scrollback",
"hidden output",
"snapshot replay",
"metadata-only replay",
"clear semantics"
],
"platforms": [
"macos",
"linux",
"windows"
],
"providers": [
"local",
"daemon",
"ssh",
"remote-runtime"
],
"coveredPlatforms": [
"macos"
],
"coveredProviders": [],
"coverageNotes": "Local macOS evidence over the merged #7133/#7173 restore and hidden-output ordering tests on main@1282f5c2d. The dirty-state exactness contract, normal-buffer clear semantics, and metadata-only replay remain pending-stack work.",
"motivatingLinks": [
"https://github.com/stablyai/orca/pull/7173",
"https://github.com/stablyai/orca/pull/7133",
"https://github.com/stablyai/orca/pull/7012",
"https://github.com/stablyai/orca/pull/7054",
"https://github.com/stablyai/orca/pull/6949"
],
"invariant": "Hidden-output restore, snapshot replay, metadata-only replay, and clear-before-replay must preserve order and never overlay stale bytes on newer live terminal output; restoring a snapshot onto an already-dirty pane must yield a buffer exactly equal to the snapshot frame.",
"oracle": "Apply snapshots onto adversarially dirty pane states (already on the alternate screen, stale content occupying cells the new frame leaves blank, scrollback present, wide glyphs, revived sessions with restarted PTY seq counters) and assert exact buffer equality with the snapshot frame; fault injection interleaves hidden chunks, live output, metadata-only replay, and clear-before-replay, then asserts ordered terminal buffer content, clear decisions, and replay diagnostics. Marker-presence checks are not acceptable evidence on restore paths.",
"commands": [
"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/pty-connection.test.ts"
],
"testFiles": [
"src/renderer/src/components/terminal-pane/pty-connection.test.ts"
],
"assertionRefs": [
{
"file": "src/renderer/src/components/terminal-pane/pty-connection.test.ts",
"assertions": [
"restoring an alternate-screen snapshot clears only the alternate screen (#7133)",
"hidden Codex output is restored when the pty seq counter restarts, with or without an observed exit (#7173)",
"pending hidden restore chunks are not replayed after a terminal clear",
"a scrolled-up viewport is preserved after hidden-backlog snapshot replay"
]
}
],
"evidenceRuns": [
{
"date": "2026-07-03",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/pty-connection.test.ts",
"result": "passed",
"durationSeconds": 8.4,
"summary": "1 test file(s) passed, 311 tests passed on main@1282f5c2d in a clean checkout."
}
],
"runtimeBudget": {
"p95Seconds": 45,
"scope": "renderer provider-contract gate"
},
"flakeHistory": {
"status": "not-started",
"evidence": "Remote replay FIFO has a focused slice, but the broader scrollback restore gate is not wired."
},
"redGreenEvidence": {
"status": "partial",
"evidence": "#7133 and #7173 each proved their slices red before fix (stale alt-screen bleed-through; stale background chunk written after restore; frozen revived seq counters). The broader dirty-state exactness contract has no red runs yet."
},
"performanceBudget": {
"required": true,
"evidence": "Must keep hidden restore bounded and avoid unbounded renderer parsing or wake loops."
},
"promotionCriteria": [
"Start every restore case from adversarially dirty pane state, never only fresh terminals.",
"Assert frame exactness or stale-content absence, never marker presence.",
"Build deterministic lower-layer clear and interleaving tests before broad golden E2E.",
"Use long-table/golden visual tests only as supporting evidence.",
"Record ordered buffer diagnostics on failure."
],
"knownGaps": [
"No manifest command yet.",
"The existing replay FIFO command is narrower than this broader scrollback restore invariant.",
"#7133's merged alt-only-clear restore tests exist on main but are not yet registered as this gate's command.",
"#7173's ordered-seq interleaving and session-revival tests in pty-connection.test.ts on main are the seed for the hidden/live interleaving slice and are unregistered until the rebase."
],
"demotionRule": "Cannot promote without clear-semantics and hidden/live interleaving assertions."
},
{
"id": "terminal-capability.startup-color-query",
"title": "Startup color capability queries do not leak into shell or terminal streams",
"maturity": "experimental",
"protection": "none",
"owner": "terminal-rendering",
"layer": "renderer-provider-contract",
"surfaces": [
"OSC 10/11",
"startup capability query",
"shell stream",
"renderer stream",
"terminal colors"
],
"platforms": [
"macos",
"linux",
"windows"
],
"providers": [
"local",
"daemon",
"ssh",
"remote-runtime"
],
"coveredPlatforms": [],
"coveredProviders": [],
"coverageNotes": "Registered gap only; no executable coverage is wired yet.",
"motivatingLinks": [
"https://github.com/stablyai/orca/pull/6949"
],
"invariant": "Startup OSC 10/11 color queries are answered out of band at startup only, never leak into shell/provider output streams, and ordinary runtime OSC color queries remain renderer-handled.",
"oracle": "A provider-contract fixture records startup query replies, shell-visible bytes, renderer-visible bytes, and later runtime OSC behavior to prove no query leakage or color deadlock.",
"commands": [],
"testFiles": [],
"assertionRefs": [],
"evidenceRuns": [],
"runtimeBudget": {
"p95Seconds": 30,
"scope": "renderer provider-contract gate"
},
"flakeHistory": {
"status": "not-started",
"evidence": "Gate is registered as a capability/startup gap; no command is wired."
},
"redGreenEvidence": {
"status": "missing",
"evidence": "Needs intentional-break proof for leaked startup OSC replies or disabled runtime OSC handling."
},
"performanceBudget": {
"required": false,
"evidence": "Required if capability probing adds retry loops or startup polling."
},
"promotionCriteria": [
"Assert shell/provider byte streams directly.",
"Cover startup-only and runtime OSC paths separately.",
"Keep screenshot evidence diagnostic only."
],
"knownGaps": [
"No manifest command yet.",
"No startup color-query contract is wired."
],
"demotionRule": "Cannot promote if success is based only on absence of visible artifacts."
},
{
"id": "terminal-query.mobile-view-authority",
"title": "Mobile xterm answers live terminal queries exactly once without replay or floor side effects",
"maturity": "experimental",
"protection": "partial",
"owner": "terminal-runtime",
"layer": "mobile-runtime-rpc-contract",
"surfaces": [
"mobile terminal WebView",
"terminal query authority",
"runtime RPC",
"mobile subscription replay",
"multi-mobile input floor"
],
"platforms": [
"macos",
"linux",
"windows",
"mobile"
],
"providers": [
"local",
"daemon",
"ssh",
"remote-runtime"
],
"coveredPlatforms": [
"macos"
],
"coveredProviders": [],
"coverageNotes": "Deterministic local tests execute the exact injected mobile replay/generation gate, the React Native query classifier, stale-subscription sender, server-side single-responder election, query-reply RPC semantics, and live-output capture during async mobile fit. The provider write path is shared, but no live iOS/Android, SSH, WSL, or multi-device run is registered yet.",
"motivatingLinks": [
"https://github.com/stablyai/orca/issues/8128",
"https://github.com/stablyai/orca/pull/8206"
],
"invariant": "Snapshot and replacement-terminal replay answer no terminal queries; every live query delivered to subscribed mobile views has at most one current responder; a live query queued behind replay is answered after the replay boundary; terminal-generated replies never transfer the user-input floor.",
"oracle": "The injected gate emits zero replies during replay, exactly one after its live boundary, and ignores a superseded generation; native routing rejects ordinary input; the sender rejects disconnected or unsubscribed handles; runtime election accepts only the earliest active mobile subscriber and promotes its survivor; terminal.send writes only validated query grammar without mobileTookFloor; legacy binary subscribe captures a query while phone-fit is still pending and emits it after the snapshot.",
"commands": [
"pnpm --dir mobile exec vitest run --root .. mobile/src/terminal/terminal-webview-query-reply.test.ts mobile/src/terminal/terminal-webview-query-reply-routing.test.ts mobile/src/terminal/mobile-terminal-query-reply.test.ts",
"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/rpc/terminal-send.test.ts src/main/runtime/rpc/terminal-subscribe-buffer.test.ts src/main/runtime/mobile-presence-lock.test.ts src/shared/terminal-query-reply.test.ts src/shared/terminal-reply-query-scan.test.ts",
"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/pty-connection.test.ts"
],
"testFiles": [
"mobile/src/terminal/terminal-webview-query-reply.test.ts",
"mobile/src/terminal/terminal-webview-query-reply-routing.test.ts",
"mobile/src/terminal/mobile-terminal-query-reply.test.ts",
"src/main/runtime/rpc/terminal-send.test.ts",
"src/main/runtime/rpc/terminal-subscribe-buffer.test.ts",
"src/main/runtime/mobile-presence-lock.test.ts",
"src/shared/terminal-query-reply.test.ts",
"src/shared/terminal-reply-query-scan.test.ts",
"src/renderer/src/components/terminal-pane/pty-connection.test.ts"
],
"assertionRefs": [
{
"file": "mobile/src/terminal/terminal-webview-query-reply.test.ts",
"assertions": [
"snapshot replay emits no terminal-data message before the replay boundary",
"a live query after the boundary emits exactly one terminal-data message",
"a superseded terminal generation cannot regain reply authority",
"xterm parser replies remain enabled while its DOM textarea and hardware-key path stay inert"
]
},
{
"file": "src/main/runtime/rpc/terminal-send.test.ts",
"assertions": [
"only the elected mobile subscriber can write a claimed query reply",
"valid replies skip mobileTookFloor",
"ordinary bytes and reply payloads combined with enter, interrupt, or guarded-send semantics are rejected"
]
},
{
"file": "src/main/runtime/rpc/terminal-subscribe-buffer.test.ts",
"assertions": [
"live terminal data and view authority register before asynchronous mobile fit",
"a query received during that await is retained and emitted after the snapshot"
]
},
{
"file": "src/renderer/src/components/terminal-pane/pty-connection.test.ts",
"assertions": [
"desktop xterm onData replies are dropped while mobile owns the terminal driver",
"desktop capability-handler replies outside onData honor the same mobile authority lock"
]
}
],
"evidenceRuns": [
{
"date": "2026-07-10",
"runner": "local",
"platform": "macos",
"command": "pnpm --dir mobile exec vitest run --root .. mobile/src/terminal/terminal-webview-query-reply.test.ts mobile/src/terminal/terminal-webview-query-reply-routing.test.ts mobile/src/terminal/mobile-terminal-query-reply.test.ts",
"result": "passed",
"durationSeconds": 1,
"summary": "10 mobile bridge, routing, replay/generation, and stale-subscription tests passed. Before implementation, the WebView listener, native route, and sender tests failed."
},
{
"date": "2026-07-10",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/rpc/terminal-send.test.ts src/main/runtime/rpc/terminal-subscribe-buffer.test.ts src/main/runtime/mobile-presence-lock.test.ts src/shared/terminal-query-reply.test.ts src/shared/terminal-reply-query-scan.test.ts",
"result": "passed",
"durationSeconds": 4,
"summary": "69 shared/runtime tests passed. Before implementation, terminal.send took the floor for claimed replies and accepted ordinary claimed bytes."
},
{
"date": "2026-07-10",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/pty-connection.test.ts",
"result": "passed",
"durationSeconds": 11,
"summary": "421 renderer terminal connection tests passed, including desktop onData and capability-handler suppression while mobile owns query authority."
}
],
"runtimeBudget": {
"p95Seconds": 20,
"scope": "mobile and runtime deterministic unit gate"
},
"flakeHistory": {
"status": "unknown",
"evidence": "New deterministic gate; no soak history yet. Tests use no timing sleeps or external services."
},
"redGreenEvidence": {
"status": "partial",
"evidence": "Observed red before implementation for the missing WebView listener/native route/sender and for RPC floor-taking plus unvalidated claims; all are green after the fix. The later multi-mobile and pre-fit race assertions have green deterministic coverage but no saved intentional-break artifact yet."
},
"performanceBudget": {
"required": true,
"evidence": "No polling, scans, timers, or output fanout were added. The WebView adds one disposable onData listener; native/RPC work occurs only for xterm data and is grammar-filtered; responder election is O(1) from Map insertion order; pre-fit output uses the existing capped pending-output queue."
},
"promotionCriteria": [
"Attach an intentional-break artifact for the pre-fit capture and multi-mobile election assertions.",
"Run live iOS and Android WebViews against a real querying TUI and verify no software-keyboard regression.",
"Exercise two physical/virtual mobile clients on one PTY and observe one reply per query.",
"Accumulate the normal soak window with zero unexplained flakes."
],
"knownGaps": [
"No live iOS or Android WebView run is registered.",
"No real SSH, WSL, daemon, or two-device provider-contract run is registered.",
"Mixed-version pairing is gated by the terminal.query-reply-input.v1 capability (mobile drops replies unless the host advertises it), but no live old-binary pairing run is registered.",
"A desktop-to-mobile driver handoff has a bounded double-reply window: the server elects the mobile responder synchronously while the desktop renderer's cached driver map updates via an async event, so an in-flight query can be answered by both until the driver-change event lands."
],
"demotionRule": "Keep experimental or disable mobile forwarding if the gate flakes without a product bug, live WebView input isolation regresses, or duplicate replies appear under multi-mobile use."
},
{
"id": "terminal-runtime.mobile-stream-budget",
"title": "Runtime and mobile terminal streams keep snapshot and live-output bytes bounded",
"maturity": "experimental",
"protection": "partial",
"owner": "terminal-runtime",
"layer": "runtime-rpc-contract",
"surfaces": [
"mobile terminal",
"native-chat terminal overlay",
"runtime RPC",
"binary multiplex",
"JSON subscribe fallback",
"snapshot buffering"
],
"platforms": [
"macos",
"linux",
"windows",
"mobile"
],
"providers": [
"remote-runtime",
"ssh",
"local",
"daemon"
],
"coveredPlatforms": [
"macos"
],
"coveredProviders": [],
"coverageNotes": "Local macOS evidence covers runtime-RPC stream budgets plus paired-renderer parse/discard credit. Deferred credit is shared by local and remote transports, batches ACKs at 192 KiB or 4 ms, grows per-stream windows from 512 KiB to 2 MiB and aggregate windows from 2 MiB to 8 MiB, bounds queued output to 256 KiB per stream, and caps each multiplex connection at 32 active or pending streams for an 8 MiB aggregate pending-output ceiling. Deterministic tests cover replay ordering, stale generations, malformed frames, hidden panes, queue eviction, disposal, send/recovery failure, repeated pending-slot replacement, reconnect, and round-robin fairness. The opt-in benchmark covers 1/20/100 ms RTT and 1/4/8 viewers, exact protocol-frame allocations, scheduler CPU, and measured @xterm/headless parser CPU/retained heap. Live Android restore evidence, browser/WebGL parser measurements, and legacy JSON subscribe parity remain required.",
"motivatingLinks": [
"https://github.com/stablyai/orca/pull/6951",
"https://github.com/stablyai/orca/pull/6955",
"https://github.com/stablyai/orca/pull/7009"
],
"invariant": "Runtime and mobile terminal subscriptions must cap initial snapshots, live output buffered while snapshots load, chunk sizes, batches, and aggregate in-flight credit. ACK means the renderer parsed the bytes or intentionally discarded them; receipt-time ACK is forbidden. Every replay, stale-generation, malformed-frame, hidden-pane, eviction, disposal, error, and reconnect path must settle credit exactly once so streams neither leak memory nor stall. A terminal covered by native chat must restore from fresh scrollback when revealed, while preserving output order, input locks, resize/driver events, fairness, and fallback parity or explicit fallback deprecation.",
"oracle": "Assert mobile initial snapshots downgrade until they fit <=512KB, requested binary snapshots downgrade until they fit <=2MB, live output queued while snapshots load stays <=256KB per stream, large output splits into <=48KB frames, and output bursts coalesce. Feed paired output through the xterm parse callback and prove ACK is deferred until parse or intentional discard, then inject stale generation, malformed/transformed frames, replay failure, queue eviction, hidden panes, pane disposal, ACK send failure, recovery serialization failure, and reconnect races; assert ordered replay and exactly-once credit settlement. Fill the aggregate window across bulk and interactive streams, ACK once, and prove round-robin progress. Run the opt-in 64 MiB/viewer RTT matrix and enforce bounded 8 MiB aggregate in-flight memory, >7 MiB/s/viewer at 100 ms RTT, and <200 ms completion spread. JSON fallback parity and live Android scrollback restoration remain explicit gaps.",
"commands": [
"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/rpc/terminal-subscribe-buffer.test.ts src/main/runtime/rpc/terminal-output-batching.test.ts src/main/runtime/rpc/terminal-multiplex.test.ts",
"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/rpc/terminal-subscribe-buffer.test.ts src/main/runtime/rpc/terminal-output-batching.test.ts src/main/runtime/rpc/terminal-multiplex.test.ts src/renderer/src/components/terminal-pane/pty-connection.test.ts src/renderer/src/components/terminal-pane/terminal-pty-ack-gate.test.ts src/renderer/src/lib/pane-manager/terminal-delivery-credit.test.ts src/renderer/src/runtime/remote-runtime-terminal-parse-backpressure.test.ts src/renderer/src/runtime/runtime-terminal-stream.test.ts --maxWorkers=1",
"ORCA_TERMINAL_PERF_BENCH=1 pnpm exec vitest run --config config/vitest.config.ts --disableConsoleIntercept src/main/runtime/rpc/terminal-multiplex-flow-control.bench.test.ts",
"pnpm --dir mobile exec vitest run --root .. mobile/src/session/mobile-native-chat-terminal-stream.test.ts",
"pnpm --dir mobile exec vitest run --root .. mobile/src/session/use-mobile-native-chat-terminal-stream.test.ts"
],
"testFiles": [
"src/main/runtime/rpc/terminal-subscribe-buffer.test.ts",
"src/main/runtime/rpc/terminal-output-batching.test.ts",
"src/main/runtime/rpc/terminal-multiplex.test.ts",
"src/main/runtime/rpc/terminal-multiplex-flow-control.bench.test.ts",
"src/renderer/src/components/terminal-pane/pty-connection.test.ts",
"src/renderer/src/components/terminal-pane/terminal-pty-ack-gate.test.ts",
"src/renderer/src/lib/pane-manager/terminal-delivery-credit.test.ts",
"src/renderer/src/runtime/remote-runtime-terminal-parse-backpressure.test.ts",
"src/renderer/src/runtime/runtime-terminal-stream.test.ts",
"mobile/src/session/mobile-native-chat-terminal-stream.test.ts",
"mobile/src/session/use-mobile-native-chat-terminal-stream.test.ts"
],
"assertionRefs": [
{
"file": "src/main/runtime/rpc/terminal-subscribe-buffer.test.ts",
"assertions": [
"legacy binary output queued during initial snapshot serialization stays bounded",
"stale mobile resize re-stream completions are dropped for legacy binary streams",
"aborted stream signals do not register stale listeners"
]
},
{
"file": "src/main/runtime/rpc/terminal-output-batching.test.ts",
"assertions": [
"desktop output bursts coalesce before stream emission",
"large binary output is encoded lazily before the first output frame"
]
},
{
"file": "src/main/runtime/rpc/terminal-multiplex.test.ts",
"assertions": [
"requested snapshots fall back smaller when serialized data exceeds the send budget",
"oversized live output frames are bounded for subscribed binary streams",
"multibyte live output flushes when encoded bytes reach the batch budget",
"adaptive credit grows only after ACK, stays globally bounded, and drains pending streams round-robin",
"send and recovery serialization failures detach once instead of leaking credit or retrying forever",
"32 active or pending slots cap aggregate queued output and repeated pending-slot subscribe cancels its older waiter"
]
},
{
"file": "src/renderer/src/lib/pane-manager/terminal-delivery-credit.test.ts",
"assertions": [
"nested synchronous deliveries restore the outer credit owner",
"unclaimed intentional discards settle automatically while every claimed scheduler child must settle before the parent credits"
]
},
{
"file": "src/renderer/src/runtime/remote-runtime-terminal-parse-backpressure.test.ts",
"assertions": [
"paired renderer ACK waits for xterm parse completion or explicit discard",
"192 KiB parsed output batches into one ACK while the 4 ms timer releases interactive output",
"malformed frames, malformed transformed output, disposal, late parse, renderer delivery failure, and ACK transport failure release credit or close the owning stream without reordering output"
]
},
{
"file": "src/main/runtime/rpc/terminal-multiplex-flow-control.bench.test.ts",
"assertions": [
"one through eight viewers stay within the 8 MiB aggregate adaptive window",
"the 100 ms RTT model sustains more than 7 MiB/s per viewer with less than 200 ms fairness spread",
"the opt-in benchmark reports RTT throughput, scheduler CPU time, exact protocol frame allocations, completion spread, and measured @xterm/headless parser CPU and retained heap"
]
},
{
"file": "mobile/src/session/mobile-native-chat-terminal-stream.test.ts",
"assertions": [
"an active terminal stream pauses while native chat covers its WebView",
"the stream resumes only for the ready active terminal after chat closes",
"non-terminal and already-settled stream states perform no lifecycle work"
]
},
{
"file": "mobile/src/session/use-mobile-native-chat-terminal-stream.test.ts",
"assertions": [
"a late WebView-ready transition converts a cold-start lease-only stream back to output",
"ordinary WebView readiness does not rerender the mobile session route"
]
}
],
"evidenceRuns": [
{
"date": "2026-07-03",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/rpc/terminal-subscribe-buffer.test.ts src/main/runtime/rpc/terminal-output-batching.test.ts src/main/runtime/rpc/terminal-multiplex.test.ts",
"result": "passed",
"durationSeconds": 3.8,
"summary": "3 test file(s) passed, 28 tests passed on main@1282f5c2d in a clean checkout."
},
{
"date": "2026-07-12",
"runner": "local",
"platform": "macos",
"command": "pnpm --dir mobile exec vitest run --root .. mobile/src/session/mobile-native-chat-terminal-stream.test.ts",
"result": "passed",
"durationSeconds": 0.2,
"summary": "The focused mobile native-chat suite passed with 3 terminal-stream lifecycle assertions in the staged PR #5824 worktree."
},
{
"date": "2026-07-22",
"runner": "local",
"platform": "macos",
"command": "ORCA_TERMINAL_PERF_BENCH=1 pnpm exec vitest run --config config/vitest.config.ts --disableConsoleIntercept src/main/runtime/rpc/terminal-multiplex-flow-control.bench.test.ts",
"result": "passed",
"durationSeconds": 0.91,
"summary": "The 1/20/100 ms RTT x 1/4/8 viewer matrix stayed at or below 8 MiB in flight with zero completion spread. At 100 ms it modeled 18.8 MiB/s per viewer for 1-4 viewers and 9.7 MiB/s for 8 viewers. Measured @xterm/headless parsing was 26.7/63.6/95.3 aggregate MiB/s for 1/4/8 viewers, with 84.4/236.5/336.0 ms CPU and 2893/13409/28991 KiB retained heap for 4 MiB per viewer."
}
],
"runtimeBudget": {
"p95Seconds": 20,
"scope": "runtime RPC contract test"
},
"flakeHistory": {
"status": "unknown",
"evidence": "Focused runtime RPC contract tests passed locally on 2026-07-02; needs soak history before promotion."
},
"redGreenEvidence": {
"status": "partial",
"evidence": "Tests cover mobile initial snapshot byte downgrade, requested binary snapshot byte downgrade, pending live-output cap while snapshot loads, output chunk size, output coalescing, abort cleanup, and stale resize re-stream suppression. Needs intentional-break proof plus JSON fallback coverage before promotion."
},
"performanceBudget": {
"required": true,
"evidence": "Parsed/discarded credit uses 192 KiB/4 ms ACK batching, 512 KiB-to-2 MiB adaptive per-stream windows, a 2 MiB-to-8 MiB aggregate window, <=48 KiB output frames, <=256 KiB queued output per stream, and <=32 streams per connection (8 MiB aggregate pending output). The 64 MiB/viewer model gate requires >7 MiB/s/viewer at 100 ms RTT, <200 ms completion spread, and aggregate in-flight bytes <=8 MiB. The 2026-07-22 run modeled 9.7 MiB/s/viewer at 100 ms with eight viewers and measured @xterm/headless at 95.3 aggregate MiB/s, 336.0 ms parser CPU, and 28991 KiB retained heap for eight 4 MiB viewers."
},
"promotionCriteria": [
"Gate binary multiplex first.",
"Decide whether JSON fallback is supported, gated, or deprecated.",
"Record byte counts and order/cursor artifacts on failure."
],
"knownGaps": [
"The pure mobile decision gate does not yet prove live Android WebView scrollback restore after a chat toggle.",
"Legacy JSON subscribe parity is undecided.",
"The parser measurement uses @xterm/headless; browser renderer/WebGL CPU, GPU, and allocation behavior still need packaged-app performance evidence."
],
"demotionRule": "Cannot promote while a supported stream path has uncapped snapshot or live-output buffering."
},
{
"id": "terminal-mirror.parser-parity",
"title": "Renderer xterm and main headless mirror parse identical bytes into identical cells",
"maturity": "experimental",
"protection": "partial",
"owner": "terminal-rendering",
"layer": "renderer-main-parity-contract",
"surfaces": [
"main mirror buffer",
"snapshot restore",
"terminal reads",
"mobile streams",
"unicode width",
"parser configuration"
],
"platforms": [
"macos",
"linux",
"windows"
],
"providers": [
"local",
"daemon",
"ssh",
"remote-runtime"
],
"coveredPlatforms": [
"macos"
],
"coveredProviders": [],
"coverageNotes": "Local macOS evidence over #7148's width-parity oracle on main@1282f5c2d. A broader byte corpus, a shared parser-construction assertion over terminal-unicode-provider.ts/pane-terminal-options.ts, and recorded agent-session corpora remain gaps.",
"motivatingLinks": [
"https://github.com/stablyai/orca/pull/7148",
"https://github.com/stablyai/orca/pull/7133"
],
"invariant": "The main-process headless terminal mirror and the renderer xterm must parse identical byte streams into cell-identical buffers (unicode width tables, joining behavior, modes, and addon-visible semantics), so snapshots, restores, reads, and mobile streams never encode a frame the renderer would not have produced.",
"oracle": "Feed identical byte corpora (emoji/ZWJ/wide glyphs, positioned overwrites after wide characters, alternate-screen transitions, wrapped lines) to both parser configurations and assert cell-identical visible buffers; both parsers must be constructed from one shared configuration module so one-sided drift fails the gate.",
"commands": [
"pnpm exec vitest run --config config/vitest.config.ts src/main/daemon/headless-emulator-unicode-width.test.ts"
],
"testFiles": [
"src/main/daemon/headless-emulator-unicode-width.test.ts"
],
"assertionRefs": [
{
"file": "src/main/daemon/headless-emulator-unicode-width.test.ts",
"assertions": [
"emoji advance two cells in the headless mirror so positioned writes land like the renderer (#7148)",
"ZWJ emoji join into one wide pair like the renderer provider (#7148)"
]
}
],
"evidenceRuns": [
{
"date": "2026-07-03",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/main/daemon/headless-emulator-unicode-width.test.ts",
"result": "passed",
"durationSeconds": 0.7,
"summary": "1 test file(s) passed, 2 tests passed on main@1282f5c2d in a clean checkout."
}
],
"runtimeBudget": {
"p95Seconds": 30,
"scope": "shared parser-parity unit gate"
},
"flakeHistory": {
"status": "not-started",
"evidence": "Deterministic unit-layer corpus; no timing dependence expected."
},
"redGreenEvidence": {
"status": "partial",
"evidence": "#7148 proved this red before its fix (positioned overwrite after emoji landed shifted in the mirror). Intentional-drift proof for the shared provider is still missing."
},
"performanceBudget": {
"required": true,
"evidence": "Shared parser construction must not add renderer or emulator startup cost; the corpus stays a bounded unit fixture."
},
"promotionCriteria": [
"Register #7148's merged width test (src/main/daemon/headless-emulator-unicode-width.test.ts) plus a shared-construction assertion over src/shared/terminal-unicode-provider.ts and pane-terminal-options.ts as the first command during the stack rebase.",
"Extend the corpus with recorded real agent-session byte streams.",
"Promote only on aggregated reliability-gates CI history."
],
"knownGaps": [
"No manifest command yet; the seed test exists on fresh main but not at this branch's merge-base.",
"Width parity is protected only by #7148's single test; no broader corpus or shared-construction assertion covers the other parser-config axes.",
"Corpus does not yet include recorded live agent sessions.",
"Parity at identical configuration cannot catch state-synchronization divergence such as #7192's stale-width mirror; geometry fan-out and reflow ordering are owned by terminal-geometry.visible-convergence."
],
"demotionRule": "Cannot promote without cell-exact parity assertions over a wide-glyph corpus and shared-construction proof."
},
{
"id": "terminal-observability.restore-convergence-selfcheck",
"title": "Post-restore convergence self-check flags renderer/mirror divergence as an anomaly",
"maturity": "experimental",
"protection": "none",
"owner": "terminal-rendering",
"layer": "renderer-observability",
"surfaces": [
"hidden-output restore",
"snapshot replay",
"anomaly breadcrumbs",
"telemetry"
],
"platforms": [
"macos",
"linux",
"windows"
],
"providers": [
"local",
"daemon",
"ssh",
"remote-runtime"
],
"coveredPlatforms": [],
"coveredProviders": [],
"coverageNotes": "Registered gap only; the anomaly-breadcrumb machinery exists in this branch but no convergence probe is implemented.",
"motivatingLinks": [
"https://github.com/stablyai/orca/pull/7133",
"https://github.com/stablyai/orca/pull/7054"
],
"invariant": "After every hidden-to-visible reveal settles — whether or not a restore was triggered — the renderer buffer must converge with the current main-mirror state; divergence is recorded as a compact, content-free terminal_lifecycle_anomaly breadcrumb and counted in telemetry instead of failing silently. Restore-scoped checking is insufficient: #7173's frozen-output variant restores faithfully and then silently drops later hidden output, so it never triggers another restore.",
"oracle": "Deterministic tests inject forced divergence in both shapes — stale bytes written after a faithful restore, and a frozen pane whose reveal triggers no restore — and assert exactly one deduped breadcrumb with row-hash evidence and no terminal content; the production probe is a bounded row-hash sample comparison against current mirror rows that runs once per reveal with no polling and a strict time budget.",
"commands": [],
"testFiles": [],
"assertionRefs": [],
"evidenceRuns": [],
"runtimeBudget": {
"p95Seconds": 30,
"scope": "renderer observability unit gate"
},
"flakeHistory": {
"status": "not-started",
"evidence": "Probe and tests not yet implemented."
},
"redGreenEvidence": {
"status": "missing",
"evidence": "Needs an intentionally divergent restore fixture proving the probe fires, dedupes, and stays silent on faithful restores."
},
"performanceBudget": {
"required": true,
"evidence": "One bounded comparison per reveal; no polling, no hot-path work, no content serialization beyond hashed row samples."
},
"promotionCriteria": [
"Prove the probe is content-free and privacy-safe (hashes and indices only).",
"Prove zero false positives across the existing restore test corpus before enabling telemetry counting.",
"Watch anomaly telemetry after each terminal release as the in-production regression signal."
],
"knownGaps": [
"No manifest command yet.",
"Probe not implemented; #7133-class and #7173-class corruption is currently silent in production.",
"Pixel-level divergence is out of scope for this probe (see terminal-render.pixel-refresh-repair).",
"Renderer-vs-mirror comparison cannot see corruption upstream of the mirror itself (#7192's stale-width mirror); mirror-vs-PTY truth is owned by terminal-geometry.visible-convergence."
],
"demotionRule": "Disable the probe if it exceeds its per-reveal budget or produces false-positive anomaly noise."
},
{
"id": "terminal-render.atlas-identity-invalidation",
"title": "A WebGL atlas identity change rebuilds cached glyph vertices",
"maturity": "experimental",
"protection": "partial",
"owner": "terminal-rendering",
"layer": "electron-visual-golden",
"surfaces": ["WebGL rendering", "shared glyph atlas", "render model"],
"platforms": ["macos", "linux", "windows"],
"providers": ["local", "daemon", "ssh", "remote-runtime"],
"coveredPlatforms": ["macos"],
"coveredProviders": [],
"coverageNotes": "A deterministic macOS Electron test uses two real WebGL terminals with distinct atlas populations, attaches one renderer to the other's atlas, and compares its pixels before and after rendering. Provider paths are unaffected because atlas ownership is renderer-local; Linux and Windows GPU evidence remains pending.",
"motivatingLinks": ["https://github.com/stablyai/orca/pull/8899"],
"invariant": "Whenever GlyphRenderer attaches a different shared atlas, every cached glyph vertex is rebuilt before the next draw even if the old and new atlases have the same clear-model generation.",
"oracle": "Render terminal A and capture its non-empty canvas, populate terminal B with a distinct atlas, attach A's glyph renderer to B's atlas without changing A's buffer, render A again, and require byte-equivalent visible pixels. Also require the atlas identities to differ so the test cannot pass without exercising the transition.",
"commands": [
"pnpm run ensure:electron-runtime && pnpm exec playwright test tests/e2e/terminal-webgl-atlas-budget.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1"
],
"testFiles": ["tests/e2e/terminal-webgl-atlas-budget.spec.ts"],
"assertionRefs": [
{
"file": "tests/e2e/terminal-webgl-atlas-budget.spec.ts",
"assertions": [
"the replacement scenario uses distinct atlas identities and renders a non-empty baseline",
"attaching the replacement atlas leaves zero pixels different from the same terminal buffer's baseline"
]
}
],
"evidenceRuns": [
{
"date": "2026-07-17",
"runner": "local",
"platform": "macos",
"command": "pnpm run ensure:electron-runtime && pnpm exec playwright test tests/e2e/terminal-webgl-atlas-budget.spec.ts --config tests/playwright.config.ts --project electron-headless --workers=1",
"result": "passed",
"durationSeconds": 44,
"summary": "Both real-WebGL scenarios passed. The atlas-replacement case changed 327,165 pixels with the old generation adoption and zero pixels after identity invalidation."
}
],
"runtimeBudget": {
"p95Seconds": 180,
"scope": "fresh E2E build plus two real-WebGL atlas tests"
},
"flakeHistory": {
"status": "unknown",
"evidence": "The focused local macOS run and the PR's macOS golden experiment job passed. The Linux golden job skipped both WebGL atlas tests because WebGL was unavailable; soak history is not yet available."
},
"redGreenEvidence": {
"status": "complete",
"evidence": "The old setAtlas behavior deterministically changed 327,165 pixels after replacement; setting the last-seen generation to an invalid value on identity change produced zero changed pixels."
},
"performanceBudget": {
"required": true,
"evidence": "The added work is one existing full-model rebuild only when atlas object identity changes; ordinary frames and repeated setAtlas calls with the same object take the existing path. The field sentinel remains off by default, samples only a modifier-clicked pane in a bounded ten-second burst, reuses and releases one readback canvas, and caps renderer and disk evidence."
},
"promotionCriteria": [
"Accumulate stable macOS and Linux GPU runs across the release golden suite.",
"Add Windows GPU evidence or retain the platform gap explicitly.",
"Remove the flag-gated field sentinel after the confirmation window while keeping this pixel regression."
],
"knownGaps": [
"The historical field capture predates renderer-internal atlas identity diagnostics, so it cannot prove this exact transition retrospectively.",
"The deterministic test drives the renderer transition directly rather than reproducing the original Cmd/Ctrl-click lifecycle trigger.",
"Windows GPU evidence is not yet recorded."
],
"demotionRule": "Keep experimental or demote to protection none if GPU skips hide the transition, the pixel oracle flakes across stable runners, or the test no longer fails with generation adoption restored."
},
{
"id": "terminal-render.pixel-refresh-repair",
"title": "Forced repaint does not change revealed pane pixels",
"maturity": "experimental",
"protection": "none",
"owner": "terminal-rendering",
"layer": "electron-visual-golden",
"surfaces": [
"WebGL rendering",
"tab reveal",
"worktree resume",
"window wake",
"render model"
],
"platforms": [
"macos",
"linux",
"windows"
],
"providers": [
"local",
"daemon"
],
"coveredPlatforms": [],
"coveredProviders": [],
"coverageNotes": "Registered gap only; the live repro harness with a refresh-repair oracle exists but is not productized into the release-blocking terminal-rendering-golden suite.",
"motivatingLinks": [
"https://github.com/stablyai/orca/pull/7133",
"https://github.com/stablyai/orca/pull/7054"
],
"invariant": "After any reveal, restore, or wake, the pixels a pane displays must equal what a forced full model-invalidating repaint would draw from the buffer; a material refresh-repair diff means stale rendering escaped, whatever the mechanism.",
"oracle": "Screenshot the revealed pane, force a model-invalidating full repaint, screenshot again, and assert the bounded pixel diff is immaterial; pair with a JS-level render-model-vs-buffer comparison. Compositor screenshots only, because WebGL canvas readback is blank with preserveDrawingBuffer disabled.",
"commands": [],
"testFiles": [],
"assertionRefs": [],
"evidenceRuns": [],
"runtimeBudget": {
"p95Seconds": 300,
"scope": "release-blocking golden Electron visual test"
},
"flakeHistory": {
"status": "not-started",
"evidence": "Runs nightly only while the per-platform diff threshold stabilizes; the destination is the release-blocking terminal-rendering-golden suite in release-cut.yml."
},
"redGreenEvidence": {
"status": "missing",
"evidence": "Needs an intentionally fossilized render model (skip the model invalidation on reveal) proving the refresh-repair diff fires."
},
"performanceBudget": {
"required": true,
"evidence": "Soak-only; must not add product-path repaints beyond the existing reveal hardening."
},
"promotionCriteria": [
"Productize the existing stale-render repro harness with the refresh-repair oracle and failure artifacts.",
"Establish a stable material-diff threshold across platforms via nightly runs.",
"Promotion means membership in the release-blocking terminal-rendering-golden suite that release-cut.yml runs against every release tag; never PR-blocking.",
"Register the gate command as a direct spec-file invocation; the checker rejects --grep tag selectors, so do not reuse the existing --grep-based golden script as the command."
],
"knownGaps": [
"No manifest command yet.",
"Buffer-clean, pixels-stale variants are otherwise invisible to every buffer oracle in the manifest."
],
"demotionRule": "Drop from the golden suite back to nightly diagnostic if diff thresholds cannot be kept stable across CI runners."
},
{
"id": "pty-delivery.renderer-lifecycle-accounting-reset",
"title": "Renderer lifecycle reset clears leaked PTY delivery accounting so surviving PTYs cannot freeze",
"maturity": "experimental",
"protection": "partial",
"owner": "terminal-runtime",
"layer": "main-unit",
"surfaces": [
"terminal output delivery",
"renderer reload / crash recovery",
"surviving daemon and local PTYs"
],
"platforms": [
"macos",
"linux",
"windows"
],
"providers": [
"local",
"daemon"
],
"coveredPlatforms": [
"macos"
],
"coveredProviders": [],
"coverageNotes": "Local macOS unit evidence over the shared main-process delivery pipeline in registerPtyHandlers. The oracle drives a local mock PTY, but the in-flight/pending accounting is provider-agnostic and daemon PTYs ride the identical pipeline (the manual dev repro that proved the freeze was daemon-backed). SSH is a separate relay/credit path and never enters these counters; mobile/relay ride unaffected paths; WSL terminals ride this same local/daemon pipeline and are covered by the same accounting (no dedicated provider-contract test yet). Motivated by a production incident on v1.4.131 (three frozen/broken terminal panes in one desktop session) diagnosed to leaked in-flight/pending accounting across a renderer reload (rendererGraphEpoch 3). Live validation of the fix on a rebuilt dev instance surfaced a second leak mode (the boot window): after the reset ran, main resumed flushing a flooding PTY into the still-booting page before its pty:data listener re-registered, so those sends were dropped yet counted and re-pinned rendererInFlightChars at 524288. The gate now also covers holding sends until the renderer's pty:rendererDispatcherReady handshake. A watchdog self-heals a lost handshake: on each reset a one-shot ~10s timer arms and, if the handshake never arrives, force-opens the gate (rendererDispatcherReadyForcedCount increments) so a dropped handshake degrades to pre-handshake behavior instead of a permanent hold; the real handshake or a re-registration cancels it. Two new diagnostics — rendererPtyDispatcherReady and rendererDispatcherReadyForcedCount — expose the otherwise-invisible boot-window hold, which early-returns before ackGatedFlushSkipCount increments.",
"motivatingLinks": [
// #5787 introduced the renderer-reload delivery-accounting path this gate hardens;
// kept for lineage, not the primary motivation. THIS fix is motivated by the
// v1.4.131 three-frozen-panes incident (see coverageNotes).
"https://github.com/stablyai/orca/pull/5787",
"https://github.com/stablyai/orca/pull/8034"
],
"invariant": "After a renderer lifecycle reset (did-start-loading / render-process-gone / destroyed), no surviving PTY remains delivery-gated by pre-reset unacked bytes: main's in-flight counters and pending backlog equal the true state of the new page (zero in-flight, zero pending). Delivery then resumes only once the reloaded page's pty:data dispatcher re-registers and signals pty:rendererDispatcherReady; during the boot window before that handshake main holds all sends (data accrues losslessly in the capped pending backlog) so bytes cannot be dropped into a listener-less page and re-pin the gate. The hold itself cannot become a permanent freeze: a one-shot ~10s watchdog armed on each reset force-opens the gate (incrementing rendererDispatcherReadyForcedCount) if the handshake is lost, and the real handshake or a re-registration cancels it. The reset fires only for a main-frame load: did-start-loading also fires for in-page subframe loads (sandboxed srcDoc iframes in notebook HTML output), which are filtered out via isLoadingMainFrame() so a subframe load never clears accounting or holds the gate on the still-alive page. If a lifecycle-reset edge is missed entirely — a main-frame reload overlapped by an in-page subframe load emits no did-start-loading at all — a backstop still recovers: because the handshake is one-shot per page load, receiving pty:rendererDispatcherReady while the gate is already open proves a reset was missed (or the watchdog force-opened the gate), so the handler reconciles by clearing the stale accounting before re-opening. The renderer sends that handshake exactly once per page load, after its pty:data listener registers.",
"oracle": "Ingest more than 512 KB of PTY output with no renderer ACKs and assert the per-PTY gate closes (sends stop at the 512 KB high-water, remainder accrues as pending). Fire the registered did-start-loading listener and assert rendererInFlightChars and pendingChars are zero and the new diagnostics record the reset (rendererLifecycleResetCount 1, lastLifecycleResetClearedChars 512 KB). Then, before any dispatcher-ready handshake, ingest another chunk and assert it is NOT sent and NOT counted in-flight (held for the boot window, accruing in pending). Finally fire the pty:rendererDispatcherReady handshake and assert the held chunk is delivered to the renderer. Counters-zero without proving both the boot-window hold and that delivery resumes is insufficient. Additional cases prove the boot-window hold also covers the interactive direct-send fast path (input-primed keystroke echo is held, not sent, until the handshake) and that the self-heal watchdog force-opens the gate (rendererDispatcherReadyForcedCount 1) when no handshake arrives, while a timely handshake cancels the watchdog and leaves no orphaned timer. A further case fires did-start-loading with isLoadingMainFrame() false (a subframe/iframe load) and asserts accounting is untouched (rendererLifecycleResetCount stays 0, pending preserved, ready stays true) and delivery still drains on ACK — proving an in-page iframe load cannot trigger a spurious freeze. A backstop case saturates the gate, then fires pty:rendererDispatcherReady while the gate is still open (ready true) with no preceding reset — modeling a missed lifecycle edge — and asserts the handler reconciles: in-flight and pending clear, rendererLifecycleResetCount increments, and fresh output flows immediately (a straggler ACK is clamped and cannot underflow). A renderer-side case (pty-dispatcher-pi-routing.test.ts) asserts ensurePtyDispatcher() sends pty:rendererDispatcherReady exactly once across two attach calls — proving the send fires (it is optional-chained) and the one-shot guard holds.",
"commands": [
"pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/pty.test.ts src/renderer/src/components/terminal-pane/pty-dispatcher-pi-routing.test.ts"
],
"testFiles": [
"src/main/ipc/pty.test.ts",
"src/renderer/src/components/terminal-pane/pty-dispatcher-pi-routing.test.ts"
],
"assertionRefs": [
{
"file": "src/main/ipc/pty.test.ts",
"assertions": [
"a PTY saturated past the 512 KB per-PTY high-water with no ACKs stops sending and accrues pending output (gate closed)",
"firing the registered did-start-loading listener zeroes rendererInFlightChars and pendingData and records rendererLifecycleResetCount and lastLifecycleResetClearedChars",
"after the reset, output ingested during the boot window is NOT sent and NOT counted in-flight until the pty:rendererDispatcherReady handshake fires (held in pending)",
"firing the pty:rendererDispatcherReady handshake releases the held backlog and delivery resumes (delivery gated on the handshake, not just counters cleared)",
"interactive input-primed keystroke echo is also held during the boot window (interactive fast path gated on the handshake) and delivered once it fires",
"when no handshake arrives, the ~10s watchdog force-opens the gate (rendererDispatcherReadyForcedCount 1) and the held backlog drains; a timely handshake cancels the watchdog and leaves no orphaned timer",
"a did-start-loading with isLoadingMainFrame() false (in-page subframe/iframe load) does NOT reset accounting (rendererLifecycleResetCount stays 0, pending and in-flight preserved, rendererPtyDispatcherReady stays true) and delivery still drains on ACK",
"a pty:rendererDispatcherReady handshake arriving while the gate is still open (ready true, no preceding reset — a missed lifecycle edge) reconciles the stale accounting: in-flight and pending clear, rendererLifecycleResetCount increments, fresh output flows, and a straggler ACK is clamped",
"re-registering handlers (macOS re-activate / new window) cancels the prior registration's armed dispatcher-ready watchdog via the cross-registration bridge, leaving no orphaned ~10s timer to force-open a dead window's gate"
]
},
{
"file": "src/renderer/src/components/terminal-pane/pty-dispatcher-pi-routing.test.ts",
"assertions": [
"ensurePtyDispatcher() sends pty:rendererDispatcherReady exactly once across two attach calls (the optional-chained send fires, and the ptyDispatcherAttached one-shot guard prevents a re-signal)"
]
}
],
"evidenceRuns": [
{
"date": "2026-07-09",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/pty.test.ts src/renderer/src/components/terminal-pane/pty-dispatcher-pi-routing.test.ts",
"result": "passed",
"durationSeconds": 1,
"summary": "243 tests passed (232 main-process + 11 renderer dispatcher) including the lifecycle-reset, boot-window (dispatcher-ready handshake), interactive-gate hold, watchdog self-heal, main-frame-filter (subframe did-start-loading is ignored), missed-reset reconcile backstop (handshake-while-open), cross-registration watchdog-cancel, and renderer-side one-shot handshake-send regressions. Removing the reset call reproduces the reload freeze (rendererInFlightChars stays 524288); removing the send-hold reproduces the boot-window leak; removing the interactive-path flag check sends keystroke echo into the not-yet-ready page; removing the watchdog arm leaves the gate held forever; removing the watchdog cancel leaves an orphaned timer after the handshake; removing the isLoadingMainFrame filter lets a subframe iframe load run a spurious reset; removing the handshake-while-open reconcile leaves the survivors pinned at 524288 after a missed lifecycle edge."
}
],
"runtimeBudget": {
"p95Seconds": 10,
"scope": "local main-process unit test"
},
"flakeHistory": {
"status": "unknown",
"evidence": "Newly registered with this fix; needs soak history before any promotion. The oracle is deterministic (fake timers, mock webContents)."
},
"redGreenEvidence": {
"status": "partial",
"evidence": "Locally verified red/green on every load-bearing branch: (1) reset call removed -> rendererInFlightChars stays 524288 after did-start-loading; (2) boot-window send-hold removed -> post-reload output is sent into the not-yet-ready page ('NOT sent until handshake' fails); (3) interactive-path flag check removed -> input-primed keystroke echo is sent during the hold; (4) watchdog arm removed -> the gate is never force-opened and the held backlog never drains; (5) watchdog cancel removed -> an orphaned ~10s timer survives the handshake (getTimerCount 1); (6) isLoadingMainFrame filter removed -> a subframe did-start-loading runs a spurious reset (rendererLifecycleResetCount 1, pending cleared, ready dropped) — locally verified red; (7) handshake-while-open reconcile removed -> a pty:rendererDispatcherReady arriving after a missed lifecycle edge leaves the gate pinned (rendererInFlightChars stays 524288, pending 90112, rendererLifecycleResetCount 0) — locally verified red; (8) cross-registration bridge cancel removed (top-of-registerPtyHandlers clearRendererDispatcherReadyWatchdog) -> a prior registration's armed watchdog survives re-registration as an orphaned timer (getTimerCount 1 instead of 0) — locally verified red. With the full fix all eight are green. The performance budget below still holds: the watchdog is a single unref'd one-shot per reset, not per-chunk. Needs a saved CI or intentional-break artifact before blocking promotion."
},
"performanceBudget": {
"required": true,
"evidence": "The reset is an O(#ptys) map clear on rare lifecycle events (reload/crash) plus one unref'd one-shot ~10s watchdog timer per reset (cancelled by the handshake or a re-registration); no polling and no per-chunk work. Any PR changing the delivery gate, in-flight accounting, or flush loop must re-measure terminal throughput before promotion."
},
"promotionCriteria": [
"Run in soak for at least 100 consecutive passes or 14 days across required CI platforms.",
"Attach saved red/green evidence from removing the lifecycle-reset accounting clear.",
"Add an Electron-level reload survival test that proves a saturated pane resumes rendering and input after Cmd+R / crash recovery."
],
"knownGaps": [
"The unit oracle drives a local mock PTY; daemon and WSL coverage rides the same pipeline but has no dedicated provider-contract test yet.",
"The dev repro covers the output-delivery freeze only; the arrow-key input symptom and mouse-mode flood observed in the same incident are out of scope and need their own repros.",
"No live Electron reload-survival assertion yet — the gate proves the main-side accounting reset, not the full renderer reattach paint."
],
"demotionRule": "Demote or quarantine if the gate flakes once without a product bug or harness bug filed to the owner."
},
{
"id": "runtime-files.watcher-process-isolation",
"title": "Runtime and SSH relay watcher faults stay process-isolated without disrupting host services",
"maturity": "experimental",
"protection": "partial",
"owner": "runtime-platform",
"layer": "process-rpc-contract",
"surfaces": [
"headless orca serve",
"paired file explorer",
"runtime editor external-change detection",
"desktop filesystem watcher",
"SSH relay filesystem watcher and live PTYs"
],
"platforms": [
"macos",
"linux",
"windows"
],
"providers": [
"local",
"remote-runtime",
"ssh"
],
"coveredPlatforms": [
"macos"
],
"coveredProviders": [
"local",
"remote-runtime",
"ssh"
],
"coverageNotes": "Deterministic tests cover one shared healthy child per runtime process plus at most four bounded fault-quarantine children, native desktop, paired-runtime, and WSL snapshot processes sharing the same eight-physical-child reservation with typed serialized event-driven capacity recovery, including recursive re-wait when crash recovery reclaims an announced slot, one quarantine attempt per watch lifetime, generation-scoped cancellation, bounded termination with removable deadline waiters, replacement-crawl errors that cannot be blessed by a late readiness ack, pre-ready paired-web cancellation registered before an unbounded capacity wait, already-resolved and late physical-exit retry of a rejected paired-web teardown, physical desktop-install and local/SSH PTY teardown, stale-generation rejection, per-child stat bounds, final-overflow RPC delivery, and renderer eviction before terminal callbacks can retry. Destructive local and SSH removal fences both ID-derived and resolved-cwd terminal roots, including sibling-root/cwd combinations with reverse admission rollback, closes descendant relay watches before parent deletion, enumerates authoritative provider/cwd ownership, falls back to daemon spawn cwd before OSC 7, and keeps daemon/relay immediate shutdown pending until native exit or a bounded fail-closed error; a dead relay PID discovered during attach also settles concurrent shutdown before its stale entry is reaped, while Windows runtime watcher deadlines retain one removable physical-close waiter, treat Node's error-close path as positive physical-exit proof, and clear root ownership on late close. The relay policy test maps a standard repository's base, Git common directory, and worktree roots to one healthy supervisor, then proves a shared-child failure recovers those roots in separate quarantine supervisors with overflow and resumed events. Abortable capacity, quarantine, runtime-root, relay, SSH, and relay pre-install setup waits attach one reaction to each shared promise and explicitly remove 10,000 cancelled caller closures while one anchor remains. Built-entry macOS harnesses kill the desktop/runtime and SSH relay watcher children, then require automatic resubscription and later events while the host process and relay PTY survive. SSH bundles the child boundary beside relay.js, requires both artifacts for install completeness, and preserves registration-owned same-root cancellation.",
"motivatingLinks": [
"https://github.com/stablyai/orca/issues/5308",
"https://github.com/stablyai/orca/issues/7547",
"https://github.com/stablyai/orca/issues/8212"
],
"invariant": "Local runtime and SSH relay roots share one watcher child per host process while healthy and use at most four quarantine children after shard failure; native desktop, paired-runtime, and direct WSL snapshot children consume the same process-wide eight-child reservation and retry transient exhaustion without permanently disabling a root. Cancellation remains owned by its child generation and settles only after acknowledgement or bounded physical exit; paired-web retains cleanup ownership and can cancel before readiness even while capacity is exhausted, retries a failed unwatch after already-resolved or late physical exit without duplicating stream termination, replacements never overlap a still-retiring generation, and aborted or timed-out callers detach immediately even while queued behind same-root relay teardown. Destructive local and SSH cleanup holds one containment-aware watcher/terminal removal fence through descendant watcher and PTY physical exit plus parent Git/filesystem deletion; daemon and relay kill requests retain ownership until the actual subprocess exit callback or an equivalent positive dead-PID proof and propagate rejected signals or a bounded failure otherwise. A crash-fused shared shard moves affected roots into the bounded quarantine pool, a second fused quarantine ends those watch lifetimes, interrupted setup emits overflow after recovery, metadata work stays bounded, and the SSH relay, PTYs, Git, and other filesystem operations never load the watcher native addon or share its fault boundary.",
"oracle": "Fill the global watcher-child reservation, require native desktop, paired-runtime, and WSL setup to retain typed transient capacity and retry after one serialized release, then cancel pending desktop and paired-client watches and require no retry. Hold one live anchor while aborting 10,000 callers at the capacity, quarantine-assignment, runtime-root, relay-setup, and SSH-registration layers; require exactly one explicit waiter and one base-promise reaction to remain, then zero after settlement. Hold an old relay unsubscribe, queue one same-root setup leader and one anchor, then abort 10,000 joiners; require every cancellation to settle before teardown releases, exactly one anchor waiter, and only one later physical install. Advance the former paired-web callback deadline while capacity remains full, require cancellation ownership to stay live, publish the server token before ready, and require files.unwatch to abort setup before a later slot release can install a native root. Reject the first ready-watch unwatch with a physical-exit promise, resolve that exit later, and require a fresh physical unwatch attempt, registry release, and exactly one stream end. Fill one healthy shared child with multiple roots, map a standard SSH repository's base, Git common directory, and worktree roots to one relay supervisor, then inject IPC disconnect-before-exit, queued and active cancellation, operations during termination, kill-without-exit, repeated unkillable generations, initial and recovery timeouts, and shard failure. During local and SSH deletion, attempt a late terminal spawn whose worktree identity and cwd name different roots, enumerate a non-prefix remote PTY by authoritative worktree ownership, withhold daemon/relay exit callbacks, make attach positively prove a concurrent-shutdown PID dead, and make the provider unavailable; require every acquired admission to roll back on rejection, dead-PID proof to settle physical exit before reaping, timeout to retain ownership, and Git/filesystem deletion never to start. Require bounded watcher process count, physical-exit settlement, healthy-root recovery, stale-generation rejection, overflow plus later events, and fail-closed destructive cleanup. Verify relay build hashes and remote install probes require both relay.js and relay-watcher.js. Launch the built relay with a real PTY and Parcel watch, kill only the watcher child, and require the same relay PID and PTY to answer before a replacement child delivers overflow and a post-crash event.",
"commands": [
"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/rpc/methods/files-watch-cleanup.test.ts --reporter=dot",
"pnpm exec vitest run --config config/vitest.config.ts src/relay/relay-watcher-pending-setup-waiters.test.ts --reporter=dot",
"pnpm exec vitest run --config config/vitest.config.ts src/relay/relay-watcher-parent-removal.test.ts --reporter=dot",
"pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/parcel-watcher-unsubscribe-timeout.test.ts --reporter=dot",
"pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/filesystem-watcher.test.ts src/main/ipc/filesystem-watcher-native-capacity.test.ts src/main/ipc/parcel-watcher-child-registry.test.ts src/main/ipc/parcel-watcher-child-launch.test.ts src/main/ipc/parcel-watcher-process.test.ts src/main/ipc/parcel-watcher-supervisor-capacity-wait.test.ts src/main/ipc/parcel-watcher-supervisor-capacity.test.ts src/main/ipc/parcel-watcher-disconnect-termination.test.ts src/main/ipc/runtime-watcher-pending-assignment.test.ts src/main/ipc/runtime-watcher-process-pool.test.ts src/main/ipc/parcel-watcher-process-entry.test.ts src/main/ipc/parcel-watcher-event-delivery.test.ts src/main/ipc/filesystem-watcher-local-unsubscribe.test.ts src/main/ipc/filesystem-watcher-wsl.test.ts src/main/ipc/worktrees.test.ts src/main/ipc/watcher-removal-gate.test.ts src/main/runtime/file-watcher-host.test.ts src/main/runtime/orca-runtime-files-watch.test.ts src/main/runtime/worktree-teardown.test.ts src/main/runtime/orca-runtime.test.ts src/main/runtime/rpc/methods/files.test.ts src/main/runtime/rpc/methods/files-watch-cancellation.test.ts src/main/providers/ssh-filesystem-provider-watch-waiters.test.ts src/main/providers/ssh-filesystem-provider.test.ts src/renderer/src/runtime/runtime-file-client.test.ts src/renderer/src/web/web-runtime-client.test.ts src/shared/cross-platform-path.test.ts src/shared/physical-exit-tracker.test.ts src/shared/promise-settlement-waiters.test.ts src/main/ipc/pty.test.ts src/main/providers/local-pty-provider.test.ts src/main/daemon/daemon-pty-adapter.test.ts src/main/daemon/pty-subprocess.test.ts src/main/daemon/session.test.ts src/main/daemon/terminal-host.test.ts src/main/daemon/terminal-host-session-reaping-leak.test.ts src/main/providers/ssh-pty-provider.test.ts src/relay/relay-watcher-setup-wait.test.ts src/relay/pty-handler.test.ts --reporter=dot",
"pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/filesystem-watcher.test.ts src/main/ipc/filesystem-watcher-native-capacity.test.ts src/main/ipc/parcel-watcher-child-registry.test.ts src/main/ipc/parcel-watcher-child-launch.test.ts src/main/ipc/parcel-watcher-process.test.ts src/main/ipc/parcel-watcher-supervisor-capacity.test.ts src/main/ipc/parcel-watcher-disconnect-termination.test.ts src/main/ipc/runtime-watcher-process-pool.test.ts src/main/ipc/parcel-watcher-process-entry.test.ts src/main/ipc/parcel-watcher-event-delivery.test.ts src/main/ipc/filesystem-watcher-local-unsubscribe.test.ts src/main/ipc/filesystem-watcher-wsl.test.ts src/main/ipc/worktrees.test.ts src/main/ipc/watcher-removal-gate.test.ts src/main/runtime/file-watcher-host.test.ts src/main/runtime/orca-runtime-files-watch.test.ts src/main/runtime/worktree-teardown.test.ts src/main/runtime/orca-runtime.test.ts src/main/runtime/rpc/methods/files.test.ts src/main/runtime/rpc/methods/files-watch-cancellation.test.ts src/main/providers/ssh-filesystem-provider.test.ts src/renderer/src/runtime/runtime-file-client.test.ts src/renderer/src/web/web-runtime-client.test.ts src/shared/cross-platform-path.test.ts src/shared/physical-exit-tracker.test.ts src/main/ipc/pty.test.ts src/main/providers/local-pty-provider.test.ts src/main/daemon/daemon-pty-adapter.test.ts src/main/daemon/pty-subprocess.test.ts src/main/daemon/session.test.ts src/main/daemon/terminal-host.test.ts src/main/daemon/terminal-host-session-reaping-leak.test.ts src/main/providers/ssh-pty-provider.test.ts src/relay/pty-handler.test.ts --reporter=dot",
"pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/filesystem-watcher.test.ts src/main/ipc/parcel-watcher-process.test.ts src/main/ipc/parcel-watcher-disconnect-termination.test.ts src/main/ipc/runtime-watcher-process-pool.test.ts src/main/ipc/parcel-watcher-process-entry.test.ts src/main/ipc/parcel-watcher-event-delivery.test.ts src/main/ipc/filesystem-watcher-local-unsubscribe.test.ts src/main/ipc/filesystem-watcher-wsl.test.ts src/main/ipc/worktrees.test.ts src/main/ipc/watcher-removal-gate.test.ts src/main/runtime/file-watcher-host.test.ts src/main/runtime/orca-runtime-files-watch.test.ts src/main/runtime/worktree-teardown.test.ts src/main/runtime/orca-runtime.test.ts src/main/runtime/rpc/methods/files.test.ts src/main/providers/ssh-filesystem-provider.test.ts src/renderer/src/runtime/runtime-file-client.test.ts src/renderer/src/web/web-runtime-client.test.ts src/shared/cross-platform-path.test.ts src/main/ipc/pty.test.ts src/main/providers/local-pty-provider.test.ts src/main/daemon/pty-subprocess.test.ts src/main/daemon/session.test.ts src/main/daemon/terminal-host.test.ts src/main/daemon/terminal-host-session-reaping-leak.test.ts src/main/providers/ssh-pty-provider.test.ts src/relay/pty-handler.test.ts --reporter=dot",
"pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/parcel-watcher-process.test.ts src/main/ipc/parcel-watcher-disconnect-termination.test.ts src/main/ipc/runtime-watcher-process-pool.test.ts src/main/ipc/parcel-watcher-process-entry.test.ts src/main/ipc/parcel-watcher-event-delivery.test.ts src/main/ipc/filesystem-watcher-local-unsubscribe.test.ts src/main/ipc/filesystem-watcher-wsl.test.ts src/main/ipc/worktrees.test.ts src/main/ipc/watcher-removal-gate.test.ts src/main/runtime/file-watcher-host.test.ts src/main/runtime/orca-runtime-files-watch.test.ts src/main/runtime/worktree-teardown.test.ts src/main/runtime/orca-runtime.test.ts src/main/runtime/rpc/methods/files.test.ts src/main/providers/ssh-filesystem-provider.test.ts src/renderer/src/runtime/runtime-file-client.test.ts src/renderer/src/web/web-runtime-client.test.ts src/shared/cross-platform-path.test.ts src/main/ipc/pty.test.ts src/main/providers/local-pty-provider.test.ts src/main/daemon/pty-subprocess.test.ts src/main/daemon/session.test.ts src/main/daemon/terminal-host.test.ts src/main/daemon/terminal-host-session-reaping-leak.test.ts src/main/providers/ssh-pty-provider.test.ts src/relay/pty-handler.test.ts",
"pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/parcel-watcher-process.test.ts src/main/ipc/parcel-watcher-disconnect-termination.test.ts src/main/ipc/runtime-watcher-process-pool.test.ts src/main/ipc/parcel-watcher-process-entry.test.ts src/main/ipc/parcel-watcher-event-delivery.test.ts src/main/ipc/filesystem-watcher-local-unsubscribe.test.ts src/main/ipc/filesystem-watcher-wsl.test.ts src/main/ipc/worktrees.test.ts src/main/ipc/watcher-removal-gate.test.ts src/main/runtime/file-watcher-host.test.ts src/main/runtime/orca-runtime-files-watch.test.ts src/main/runtime/worktree-teardown.test.ts src/main/runtime/orca-runtime.test.ts src/main/runtime/rpc/methods/files.test.ts src/main/providers/ssh-filesystem-provider.test.ts src/renderer/src/runtime/runtime-file-client.test.ts src/renderer/src/web/web-runtime-client.test.ts src/shared/cross-platform-path.test.ts src/main/ipc/pty.test.ts src/main/providers/local-pty-provider.test.ts src/main/daemon/session.test.ts src/main/daemon/terminal-host.test.ts src/main/daemon/terminal-host-session-reaping-leak.test.ts src/main/providers/ssh-pty-provider.test.ts src/relay/pty-handler.test.ts",
"pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/parcel-watcher-process.test.ts src/main/ipc/parcel-watcher-disconnect-termination.test.ts src/main/ipc/runtime-watcher-process-pool.test.ts src/main/ipc/parcel-watcher-process-entry.test.ts src/main/ipc/parcel-watcher-event-delivery.test.ts src/main/ipc/filesystem-watcher-local-unsubscribe.test.ts src/main/ipc/filesystem-watcher-wsl.test.ts src/main/ipc/worktrees.test.ts src/main/ipc/watcher-removal-gate.test.ts src/main/runtime/file-watcher-host.test.ts src/main/runtime/orca-runtime-files-watch.test.ts src/main/runtime/worktree-teardown.test.ts src/main/runtime/orca-runtime.test.ts src/main/runtime/rpc/methods/files.test.ts src/main/providers/ssh-filesystem-provider.test.ts src/renderer/src/runtime/runtime-file-client.test.ts src/renderer/src/web/web-runtime-client.test.ts src/shared/cross-platform-path.test.ts src/main/ipc/pty.test.ts src/main/daemon/terminal-host.test.ts src/main/daemon/terminal-host-session-reaping-leak.test.ts src/main/providers/ssh-pty-provider.test.ts src/relay/pty-handler.test.ts",
"pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/parcel-watcher-process.test.ts src/main/ipc/parcel-watcher-disconnect-termination.test.ts src/main/ipc/runtime-watcher-process-pool.test.ts src/main/ipc/parcel-watcher-process-entry.test.ts src/main/ipc/parcel-watcher-event-delivery.test.ts src/main/ipc/filesystem-watcher-local-unsubscribe.test.ts src/main/ipc/filesystem-watcher-wsl.test.ts src/main/ipc/worktrees.test.ts src/main/ipc/watcher-removal-gate.test.ts src/main/runtime/file-watcher-host.test.ts src/main/runtime/orca-runtime-files-watch.test.ts src/main/runtime/worktree-teardown.test.ts src/main/runtime/orca-runtime.test.ts src/main/runtime/rpc/methods/files.test.ts src/main/providers/ssh-filesystem-provider.test.ts src/renderer/src/runtime/runtime-file-client.test.ts src/renderer/src/web/web-runtime-client.test.ts src/shared/cross-platform-path.test.ts",
"pnpm run build:electron-vite",
"node config/scripts/runtime-file-watcher-resource-probe.mjs",
"node config/scripts/runtime-file-watcher-fault-harness.mjs",
"ELECTRON_RUN_AS_NODE=1 pnpm exec electron config/scripts/runtime-file-watcher-fault-harness.mjs",
"pnpm exec vitest run --config config/vitest.config.ts src/relay/relay-watcher-setup-wait.test.ts src/relay/relay-filesystem-watch-registry.test.ts src/relay/fs-handler.test.ts src/relay/git-handler.test.ts src/relay/subprocess.test.ts src/main/ssh/ssh-relay-versioned-install.test.ts config/scripts/package-electron-runtime-contract.test.mjs",
"pnpm exec vitest run --config config/vitest.config.ts src/relay/relay-filesystem-watch-registry.test.ts src/relay/fs-handler.test.ts src/relay/git-handler.test.ts src/relay/subprocess.test.ts src/main/ssh/ssh-relay-versioned-install.test.ts config/scripts/package-electron-runtime-contract.test.mjs",
"pnpm run build:relay",
"node config/scripts/relay-watcher-fault-harness.mjs"
],
"testFiles": [
"src/main/daemon/daemon-pty-adapter.test.ts",
"src/main/ipc/filesystem-watcher.test.ts",
"src/main/ipc/filesystem-watcher-native-capacity.test.ts",
"src/main/ipc/parcel-watcher-child-registry.test.ts",
"src/main/ipc/parcel-watcher-child-launch.test.ts",
"src/main/ipc/parcel-watcher-process.test.ts",
"src/main/ipc/parcel-watcher-unsubscribe-timeout.test.ts",
"src/main/ipc/parcel-watcher-supervisor-capacity-wait.test.ts",
"src/main/ipc/parcel-watcher-supervisor-capacity.test.ts",
"src/main/ipc/parcel-watcher-disconnect-termination.test.ts",
"src/main/ipc/runtime-watcher-pending-assignment.test.ts",
"src/main/ipc/runtime-watcher-process-pool.test.ts",
"src/main/ipc/parcel-watcher-process-entry.test.ts",
"src/main/ipc/parcel-watcher-event-delivery.test.ts",
"src/main/ipc/filesystem-watcher-local-unsubscribe.test.ts",
"src/main/ipc/filesystem-watcher-wsl.test.ts",
"src/main/ipc/worktrees.test.ts",
"src/main/ipc/watcher-removal-gate.test.ts",
"src/main/ipc/pty.test.ts",
"src/main/providers/local-pty-provider.test.ts",
"src/main/daemon/pty-subprocess.test.ts",
"src/main/daemon/session.test.ts",
"src/main/daemon/terminal-host.test.ts",
"src/main/daemon/terminal-host-session-reaping-leak.test.ts",
"src/main/runtime/file-watcher-host.test.ts",
"src/main/runtime/orca-runtime-files-watch.test.ts",
"src/main/runtime/worktree-teardown.test.ts",
"src/main/runtime/orca-runtime.test.ts",
"src/main/runtime/rpc/methods/files.test.ts",
"src/main/runtime/rpc/methods/files-watch-cancellation.test.ts",
"src/main/runtime/rpc/methods/files-watch-cleanup.test.ts",
"src/main/providers/ssh-filesystem-provider.test.ts",
"src/main/providers/ssh-filesystem-provider-watch-waiters.test.ts",
"src/main/providers/ssh-pty-provider.test.ts",
"src/renderer/src/runtime/runtime-file-client.test.ts",
"src/renderer/src/web/web-runtime-client.test.ts",
"src/shared/cross-platform-path.test.ts",
"src/shared/physical-exit-tracker.test.ts",
"src/shared/promise-settlement-waiters.test.ts",
"config/scripts/runtime-file-watcher-fault-harness.mjs",
"config/scripts/runtime-file-watcher-resource-probe.mjs",
"src/relay/relay-filesystem-watch-registry.test.ts",
"src/relay/relay-watcher-pending-setup-waiters.test.ts",
"src/relay/relay-watcher-parent-removal.test.ts",
"src/relay/relay-watcher-setup-wait.test.ts",
"src/relay/fs-handler.test.ts",
"src/relay/pty-handler.test.ts",
"src/relay/git-handler.test.ts",
"src/relay/subprocess.test.ts",
"src/main/ssh/ssh-relay-versioned-install.test.ts",
"config/scripts/package-electron-runtime-contract.test.mjs",
"config/scripts/relay-watcher-fault-harness.mjs"
],
"assertionRefs": [
{
"file": "src/main/ipc/filesystem-watcher.test.ts",
"assertions": [
"a transient WSL child-capacity rejection automatically retries on release and renderer unwatch cancels the wait",
"failed SSH worktree removal restores every live renderer listener, emits overflow, and resumes precise events"
]
},
{
"file": "src/main/ipc/filesystem-watcher-native-capacity.test.ts",
"assertions": [
"typed native child-capacity exhaustion automatically retries after a serialized slot release",
"renderer unwatch cancels a pending native capacity retry before subscription restarts"
]
},
{
"file": "src/main/ipc/parcel-watcher-child-registry.test.ts",
"assertions": [
"capacity notification closes the release-before-listen race, supports cancellation, fires at most once, and serializes reserving waiters per released slot"
]
},
{
"file": "src/main/ipc/parcel-watcher-child-launch.test.ts",
"assertions": [
"native launcher reports typed transient capacity exhaustion without forking another child"
]
},
{
"file": "src/shared/physical-exit-tracker.test.ts",
"assertions": [
"timed-out physical-exit waiters detach while active and later retries still settle on exact exit"
]
},
{
"file": "src/shared/promise-settlement-waiters.test.ts",
"assertions": [
"one shared-promise reaction serves an anchor plus 10,000 abortable callers, and all cancelled closures detach immediately",
"timeout and already-aborted paths remove timers, listeners, and ownership while preserving the active anchor"
]
},
{
"file": "src/main/daemon/daemon-pty-adapter.test.ts",
"assertions": [
"daemon process enumeration falls back to spawn cwd before OSC 7 reports a live cwd",
"force-killed keep-history sleep remains cold-restorable across repeated wake cycles after physical exit"
]
},
{
"file": "src/main/ipc/parcel-watcher-process.test.ts",
"assertions": [
"initial-subscribe crashes complete with an interruption refresh",
"watch errors before readiness reject setup and physically cancel the native crawl",
"watch errors during replacement crawl terminate recovery and a late readiness ack cannot revive the failed root",
"IPC disconnect recovery restores every existing root before accepting new setup",
"queued abort removes one request without restarting healthy roots, while active abort or crawl-scoped timeout restores the shard",
"a crash-resubscribe crawl deadline and concurrent unsubscribe settle only after physical shard exit, or report physical-exit failure at the termination deadline",
"a close-only asynchronous spawn failure settles physical termination without waiting for the exit deadline",
"production runtime-pool disposal rejects later subscriptions without forking an overlapping child",
"Vitest cleanup resets rather than re-disposes the reusable runtime pool",
"native child launch preserves typed transient capacity exhaustion instead of reporting permanent process unavailability",
"missing built entries fail closed and unavailable canary storage remains optional",
"fault-harness PID reporting cannot clobber an existing filesystem path"
]
},
{
"file": "src/main/ipc/parcel-watcher-unsubscribe-timeout.test.ts",
"assertions": [
"a canary-independent native-unsubscribe deadline restarts the shard and restores healthy siblings after physical child exit",
"an unkillable child rejects the native unsubscribe with its retained physical-exit promise only at the bounded exit deadline"
]
},
{
"file": "src/main/ipc/parcel-watcher-supervisor-capacity-wait.test.ts",
"assertions": [
"10,000 cancelled capacity callers leave exactly one live anchor and zero waiters after the released slot settles"
]
},
{
"file": "src/main/ipc/parcel-watcher-supervisor-capacity.test.ts",
"assertions": [
"one released physical slot launches one shared supervisor child for every waiting root, while partial/all cancellation and disposal remove the shared capacity barrier",
"a waiter recursively re-enters the event-driven barrier when crash recovery reclaims its announced slot"
]
},
{
"file": "src/main/ipc/parcel-watcher-disconnect-termination.test.ts",
"assertions": [
"pending-crawl cancellation after disconnect remains pending until the exact child exits",
"ready and pending-crawl cancellation force disconnected-child exit even while a healthy sibling root remains",
"a cancellation deadline joins active disconnect termination without duplicate sibling resubscription",
"an exit-deadline failure replaces the early cancellation and remains visible to synchronous unsubscribe until physical exit"
]
},
{
"file": "src/main/ipc/runtime-watcher-pending-assignment.test.ts",
"assertions": [
"10,000 cancelled quarantine-assignment callers leave exactly one live anchor and zero waiters after grant",
"an already-aborted first caller synchronously releases pending assignment ownership"
]
},
{
"file": "src/main/ipc/runtime-watcher-process-pool.test.ts",
"assertions": [
"healthy roots share one supervisor until a fault requires quarantine",
"a supervisor-scoped failure spreads affected roots across at most four quarantine supervisors",
"a second fused quarantine creates no further replacement for that watch lifetime",
"a root-specific failure preserves healthy shard assignments",
"a live root whose crash-resubscribe times out moves to quarantine",
"an older same-root teardown cannot erase a newer watch lease's assignment",
"test reset explicitly reopens the production-disposed pool",
"a zero-waiter aborted assignment cannot poison a same-turn replacement subscribe"
]
},
{
"file": "src/main/ipc/parcel-watcher-process-entry.test.ts",
"assertions": [
"queued cancellation removes the request before Parcel starts its crawl",
"active cancellation requests one host restart and emits no stale subscribed acknowledgement",
"runtime batches receive directory metadata before child IPC",
"an FSEvents dropped-events error is reported as recoverable and later events continue",
"batches above the configured event limit become one overflow before stat or IPC fanout",
"while process.send is backpressured, later bursts retain at most one bounded pending batch and collapse excess paths to overflow",
"unsubscribe discards pending delivery before it can perform stale stat work"
]
},
{
"file": "src/main/ipc/parcel-watcher-event-delivery.test.ts",
"assertions": [
"eight concurrent root batches never exceed eight active directory metadata stats within one child"
]
},
{
"file": "src/main/ipc/filesystem-watcher-local-unsubscribe.test.ts",
"assertions": [
"worktree deletion physically aborts pending native setup and settles before its crawl resolves",
"app shutdown physically aborts pending native setup and releases a late native handle",
"a cancelled pending install retains physical-exit failure across an immediate second destructive close",
"desktop terminal failure remains root-owned even when the cleared subscription later unsubscribes cleanly",
"Windows drive and UNC watcher ownership is found across path casing and separator variants",
"Windows event payloads retain the physical root spelling instead of the comparison key",
"failed local worktree removal restores every live renderer listener and emits overflow"
]
},
{
"file": "src/main/ipc/filesystem-watcher-wsl.test.ts",
"assertions": [
"unsubscribe and startup abort remain pending until the WSL watcher process physically closes",
"a termination timeout or rejected kill retains the WSL watcher owner for later physical-exit proof",
"WSL watcher processes consume the shared eight-child reservation until physical close, including synchronous startup-write cleanup"
]
},
{
"file": "src/main/ipc/worktrees.test.ts",
"assertions": [
"desktop IPC deletion never starts Git removal when physical PTY teardown cannot be proven",
"normal and orphan/leftover deletion paths perform strict PTY teardown before local or SSH Git/filesystem removal",
"SSH deletion fails closed before Git when the remote PTY provider is unavailable",
"failed IPC deletion finishes the watcher fence as aborted so logical subscriptions can recover"
]
},
{
"file": "src/main/ipc/watcher-removal-gate.test.ts",
"assertions": [
"Windows-equivalent spellings share one removal fence while distinct POSIX backslash roots do not",
"desktop and runtime removal entry points cannot own overlapping destructive roots concurrently",
"parent removal waits descendant terminal spawns and rejects later descendant installs"
]
},
{
"file": "src/main/ipc/pty.test.ts",
"assertions": [
"renderer PTY spawn is rejected before provider creation while destructive worktree removal holds the shared terminal gate",
"renderer and runtime spawns fence both the worktree-ID root and resolved cwd, including cross-worktree cwd ownership with rollback",
"manual and runtime-controller local PTY shutdown retain listener and provider ownership until physical exit",
"did-finish-load orphan cleanup disposes data delivery but retains the onExit listener and tracker through physical exit",
"a failed local PTY kill retains retryable provider ownership until a later physical exit"
]
},
{
"file": "src/main/providers/local-pty-provider.test.ts",
"assertions": [
"local shutdown remains pending and owned until node-pty reports physical exit",
"local process enumeration retains the spawn cwd for destructive ownership fallback",
"destructive cleanup escalates an existing graceful shutdown without losing its shared exit proof",
"POSIX graceful shutdown escalates to one bounded SIGKILL when the child ignores SIGTERM",
"Windows graceful-to-destructive cleanup treats the first ConPTY kill as final and never double-closes the handle",
"orphan cleanup racing immediate shutdown shares one kill and remains owned until the queued physical exit",
"timeout and kill failure preserve ownership for a later successful retry"
]
},
{
"file": "src/main/daemon/pty-subprocess.test.ts",
"assertions": [
"rejected graceful and force kills propagate without marking the wrapper dead so retries can signal the same child"
]
},
{
"file": "src/main/daemon/session.test.ts",
"assertions": [
"graceful daemon termination force-kills after its deadline but retains session ownership and late output until physical exit",
"rejected graceful and force kills reopen termination state for a later retry"
]
},
{
"file": "src/main/daemon/terminal-host.test.ts",
"assertions": [
"immediate daemon kill remains pending and listed until the subprocess exit callback",
"an unconfirmed immediate kill rejects at the bounded deadline, retains ownership, and blocks same-id replacement"
]
},
{
"file": "src/main/daemon/terminal-host-session-reaping-leak.test.ts",
"assertions": [
"immediate daemon kill reaps the emulator and session only after physical exit"
]
},
{
"file": "src/main/runtime/file-watcher-host.test.ts",
"assertions": [
"same-root clients share one physical watch and one client abort cannot cancel another owner's setup",
"concurrent pre-ready cancellations join one native root release before an immediate replacement subscribes",
"10,000 cancelled runtime-root callers detach while one setup anchor remains",
"root-scoped destructive cleanup joins an in-progress subscriber teardown",
"shard failure preserves existing subscribers through isolated recovery and rejects stale-generation events",
"only failed isolated recovery ends subscribers, after a conservative overflow",
"initial setup failure remains discoverable by root-scoped destructive cleanup until physical exit"
]
},
{
"file": "src/main/runtime/orca-runtime-files-watch.test.ts",
"assertions": [
"Windows runtime cleanup waits for the native close event, fails closed at a bounded deadline, and clears retained ownership on late close without retry listeners",
"a Windows watcher error before cleanup uses Node's proven native error-close as physical-exit proof, emits final overflow and terminal error, and releases deletion ownership",
"pre-publication local runtime setup failure remains owned through destructive cleanup",
"failed deletion re-arms runtime watches immediately after ordinary teardown or after delayed physical exit, without reviving a logically stopped watch"
]
},
{
"file": "src/main/runtime/worktree-teardown.test.ts",
"assertions": [
"overlapping runtime, provider, and registry sweeps stay behind one physical PTY-stop promise",
"destructive teardown rejects instead of releasing deletion when physical stop misses its deadline",
"cwd-owned and floating PTYs are swept while legacy rows without cwd retain prefix ownership",
"remote provider enumeration matches authoritative worktree ownership without touching the local-only registry"
]
},
{
"file": "src/main/runtime/orca-runtime.test.ts",
"assertions": [
"destructive worktree teardown awaits controller stopAndWait instead of treating fire-and-forget kill as physical exit",
"runtime worktree deletion never starts Git removal when a known PTY cannot be physically stopped",
"SSH runtime deletion shuts down an authoritatively owned remote PTY before remote Git removal",
"a delayed physical-exit retry remains scoped to its registered cleanup owner and cannot tear down a same-id replacement",
"failed CLI worktree deletion restores watcher ownership after releasing the install fence",
"cross-layer teardown failure joins every bounded watcher close before restoration begins"
]
},
{
"file": "src/main/runtime/rpc/methods/files.test.ts",
"assertions": [
"pre-ready transport abort reaches RuntimeFileCommands as the owning AbortSignal",
"terminal watcher loss flushes a final overflow change before error/end and unregisters cleanup"
]
},
{
"file": "src/main/runtime/rpc/methods/files-watch-cancellation.test.ts",
"assertions": [
"the server publishes a cleanup token before ready and files.unwatch aborts pending setup without delivering queued crawl events"
]
},
{
"file": "src/main/runtime/rpc/methods/files-watch-cleanup.test.ts",
"assertions": [
"a failed paired-web unwatch retries after already-resolved or late physical exit and emits stream end exactly once"
]
},
{
"file": "src/main/providers/ssh-filesystem-provider-watch-waiters.test.ts",
"assertions": [
"10,000 cancelled SSH callers detach while one registration-owned setup anchor remains"
]
},
{
"file": "src/main/providers/ssh-filesystem-provider.test.ts",
"assertions": [
"an SSH caller abort rejects promptly without cancelling another same-root subscriber's shared setup",
"the physical relay request is cancelled when the last pending subscriber leaves",
"provider disposal cancels pending setup and sends one remote unwatch",
"equivalent Windows spellings share one provider generation and terminal failure reaches the surviving owner"
]
},
{
"file": "src/main/providers/ssh-pty-provider.test.ts",
"assertions": [
"remote process enumeration preserves authoritative worktree ownership while scoping relay PTY ids to the SSH connection"
]
},
{
"file": "src/shared/cross-platform-path.test.ts",
"assertions": [
"comparison keys preserve literal POSIX backslashes while folding Windows drive and UNC spellings"
]
},
{
"file": "src/renderer/src/runtime/runtime-file-client.test.ts",
"assertions": [
"terminal error evicts the shared renderer watch before an error callback can synchronously retry",
"the old stream's later end cannot evict or orphan the replacement stream",
"the end response releases retained preload and main-process subscription bookkeeping",
"a later same-root listener opens a fresh server subscription instead of reusing a dead stream"
]
},
{
"file": "src/relay/relay-watcher-parent-removal.test.ts",
"assertions": [
"POSIX and Windows parent deletion closes and terminally notifies descendant watches before removal while preserving path siblings",
"parent deletion waits for descendant setup publication and already-retiring descendant teardown before removal"
]
},
{
"file": "src/relay/relay-watcher-pending-setup-waiters.test.ts",
"assertions": [
"10,000 aborted relay setup callers detach while one same-root teardown anchor remains and only one replacement installs"
]
},
{
"file": "src/relay/relay-watcher-setup-wait.test.ts",
"assertions": [
"10,000 cancelled relay setup callers leave exactly one explicit anchor and one base-promise reaction"
]
},
{
"file": "src/relay/relay-filesystem-watch-registry.test.ts",
"assertions": [
"each SSH host keeps its own healthy watcher supervisor while a standard repository's three distinct roots share that one child",
"shared-child failure moves those roots into separate quarantine supervisors with overflow and resumed events",
"replacement emits overflow before later ordered events",
"terminal shard failure preserves same-root clients through recovery",
"pending setup aborts only after the last same-root client leaves",
"relay-side removal sends every client a terminal failure, closes every watch, and fences new same-root watcher or PTY setup even when deletion fails",
"a missing child fails closed even if the relay inherits a VITEST environment"
]
},
{
"file": "src/relay/fs-handler.test.ts",
"assertions": [
"shared watches retain the twenty-root budget and release after every client leaves",
"recursive relay deletion closes and terminally notifies same-root watches before removing the directory"
]
},
{
"file": "src/relay/pty-handler.test.ts",
"assertions": [
"immediate relay shutdown stays pending with the PTY map entry retained until onExit",
"a missing exit rejects at the bounded deadline, preserves the physical owner, and a retry joins without duplicate SIGKILL",
"Windows relay graceful, fallback, immediate, stale-spawn, exit-dispose, and handler-dispose paths issue at most one ConPTY kill",
"relay PTY admission succeeds when post-Node-18 array copy methods are unavailable",
"attach dead-PID proof settles a concurrent immediate shutdown before the stale PTY entry is reaped",
"concurrent spawn and revive admission is atomic, capped at fifty physical PTYs, and same-id revive is deduplicated",
"worktree removal waits explicit and default-cwd PTY creation, rejects later creation, and physically stops only authoritative matching PTYs before deletion",
"relay spawn and revive fence distinct worktree-ID and cwd roots, rolling back earlier admissions in reverse when either root is removing"
]
},
{
"file": "src/renderer/src/web/web-runtime-client.test.ts",
"assertions": [
"a stopped pre-ready paired-web watch retains its callback beyond the former deadline and uses the early server token to unwatch",
"transient shared-socket loss replays an active file watch under a new transport id while preserving its logical handle and never revives a stopped watch"
]
},
{
"file": "src/relay/git-handler.test.ts",
"assertions": [
"remote Git worktree removal executes inside the relay filesystem watcher fence"
]
},
{
"file": "src/relay/subprocess.test.ts",
"assertions": [
"the real relay bundle serves PTY, filesystem, and Git requests with its adjacent watcher child",
"the Node-18-targeted relay bundle contains no unsupported array copy methods"
]
},
{
"file": "src/main/ssh/ssh-relay-versioned-install.test.ts",
"assertions": [
"remote completeness requires relay.js, relay-watcher.js, and the install sentinel"
]
},
{
"file": "config/scripts/package-electron-runtime-contract.test.mjs",
"assertions": [
"every release platform packages and gates the hashed watcher child"
]
},
{
"file": "config/scripts/runtime-file-watcher-resource-probe.mjs",
"assertions": [
"five healthy roots share one exact watcher PID within the per-child RSS budget",
"four quarantine roots use exactly four child PIDs and remain within the global eight-child reservation cap",
"CPU and RSS are sampled for every exact child PID and every PID exits during cleanup",
"per-child and aggregate RSS and sampled CPU ceilings fail the probe before the physical child cap can hide excess resource use"
]
},
{
"file": "config/scripts/runtime-file-watcher-fault-harness.mjs",
"assertions": [
"the built watcher entry delivers an event before fault injection",
"the harness parent survives watcher-child SIGSEGV",
"the real supervisor automatically replaces the child, resubscribes, and delivers a post-crash event"
]
},
{
"file": "config/scripts/relay-watcher-fault-harness.mjs",
"assertions": [
"the built relay and existing PTY survive watcher-child fault injection",
"replacement emits overflow and a precise post-crash event"
]
}
],
"evidenceRuns": [
{
"date": "2026-07-13",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/filesystem-watcher.test.ts src/main/ipc/filesystem-watcher-native-capacity.test.ts src/main/ipc/parcel-watcher-child-registry.test.ts src/main/ipc/parcel-watcher-child-launch.test.ts src/main/ipc/parcel-watcher-process.test.ts src/main/ipc/parcel-watcher-supervisor-capacity-wait.test.ts src/main/ipc/parcel-watcher-supervisor-capacity.test.ts src/main/ipc/parcel-watcher-disconnect-termination.test.ts src/main/ipc/runtime-watcher-pending-assignment.test.ts src/main/ipc/runtime-watcher-process-pool.test.ts src/main/ipc/parcel-watcher-process-entry.test.ts src/main/ipc/parcel-watcher-event-delivery.test.ts src/main/ipc/filesystem-watcher-local-unsubscribe.test.ts src/main/ipc/filesystem-watcher-wsl.test.ts src/main/ipc/worktrees.test.ts src/main/ipc/watcher-removal-gate.test.ts src/main/runtime/file-watcher-host.test.ts src/main/runtime/orca-runtime-files-watch.test.ts src/main/runtime/worktree-teardown.test.ts src/main/runtime/orca-runtime.test.ts src/main/runtime/rpc/methods/files.test.ts src/main/runtime/rpc/methods/files-watch-cancellation.test.ts src/main/providers/ssh-filesystem-provider-watch-waiters.test.ts src/main/providers/ssh-filesystem-provider.test.ts src/renderer/src/runtime/runtime-file-client.test.ts src/renderer/src/web/web-runtime-client.test.ts src/shared/cross-platform-path.test.ts src/shared/physical-exit-tracker.test.ts src/shared/promise-settlement-waiters.test.ts src/main/ipc/pty.test.ts src/main/providers/local-pty-provider.test.ts src/main/daemon/daemon-pty-adapter.test.ts src/main/daemon/pty-subprocess.test.ts src/main/daemon/session.test.ts src/main/daemon/terminal-host.test.ts src/main/daemon/terminal-host-session-reaping-leak.test.ts src/main/providers/ssh-pty-provider.test.ts src/relay/relay-watcher-setup-wait.test.ts src/relay/pty-handler.test.ts --reporter=dot",
"result": "passed",
"durationSeconds": 11.98,
"summary": "Thirty-nine watcher, cancellation, desktop/serve, paired-web, WSL, SSH/relay, removal, and PTY physical-exit files passed with 2,008 tests. Capacity, quarantine, runtime-root, relay, and SSH setup layers each prove that 10,000 aborted callers detach while one anchor remains and zero waiters remain after settlement."
},
{
"date": "2026-07-13",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/filesystem-watcher.test.ts src/main/ipc/filesystem-watcher-native-capacity.test.ts src/main/ipc/parcel-watcher-child-registry.test.ts src/main/ipc/parcel-watcher-child-launch.test.ts src/main/ipc/parcel-watcher-process.test.ts src/main/ipc/parcel-watcher-supervisor-capacity.test.ts src/main/ipc/parcel-watcher-disconnect-termination.test.ts src/main/ipc/runtime-watcher-process-pool.test.ts src/main/ipc/parcel-watcher-process-entry.test.ts src/main/ipc/parcel-watcher-event-delivery.test.ts src/main/ipc/filesystem-watcher-local-unsubscribe.test.ts src/main/ipc/filesystem-watcher-wsl.test.ts src/main/ipc/worktrees.test.ts src/main/ipc/watcher-removal-gate.test.ts src/main/runtime/file-watcher-host.test.ts src/main/runtime/orca-runtime-files-watch.test.ts src/main/runtime/worktree-teardown.test.ts src/main/runtime/orca-runtime.test.ts src/main/runtime/rpc/methods/files.test.ts src/main/runtime/rpc/methods/files-watch-cancellation.test.ts src/main/providers/ssh-filesystem-provider.test.ts src/renderer/src/runtime/runtime-file-client.test.ts src/renderer/src/web/web-runtime-client.test.ts src/shared/cross-platform-path.test.ts src/shared/physical-exit-tracker.test.ts src/main/ipc/pty.test.ts src/main/providers/local-pty-provider.test.ts src/main/daemon/daemon-pty-adapter.test.ts src/main/daemon/pty-subprocess.test.ts src/main/daemon/session.test.ts src/main/daemon/terminal-host.test.ts src/main/daemon/terminal-host-session-reaping-leak.test.ts src/main/providers/ssh-pty-provider.test.ts src/relay/pty-handler.test.ts --reporter=dot",
"result": "passed",
"durationSeconds": 11.59,
"summary": "Thirty-four watcher, cancellation, desktop/serve, paired-web, WSL, removal, PTY physical-exit, provider, renderer, and path files passed with 1,999 tests; paired-web cancellation now owns a server token before ready and aborts pending setup without a late native install."
},
{
"date": "2026-07-13",
"runner": "local",
"platform": "macos",
"command": "node config/scripts/runtime-file-watcher-resource-probe.mjs",
"result": "passed",
"durationSeconds": 0.58,
"summary": "Five healthy roots shared one child at 50,688 KiB RSS and 4.9% sampled CPU; four quarantine children totaled 202,368 KiB RSS and 29.5% sampled CPU, all budgets and the eight-child cap passed, and exact-PID cleanup was true."
},
{
"date": "2026-07-13",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/filesystem-watcher.test.ts src/main/ipc/parcel-watcher-process.test.ts src/main/ipc/parcel-watcher-disconnect-termination.test.ts src/main/ipc/runtime-watcher-process-pool.test.ts src/main/ipc/parcel-watcher-process-entry.test.ts src/main/ipc/parcel-watcher-event-delivery.test.ts src/main/ipc/filesystem-watcher-local-unsubscribe.test.ts src/main/ipc/filesystem-watcher-wsl.test.ts src/main/ipc/worktrees.test.ts src/main/ipc/watcher-removal-gate.test.ts src/main/runtime/file-watcher-host.test.ts src/main/runtime/orca-runtime-files-watch.test.ts src/main/runtime/worktree-teardown.test.ts src/main/runtime/orca-runtime.test.ts src/main/runtime/rpc/methods/files.test.ts src/main/providers/ssh-filesystem-provider.test.ts src/renderer/src/runtime/runtime-file-client.test.ts src/renderer/src/web/web-runtime-client.test.ts src/shared/cross-platform-path.test.ts src/main/ipc/pty.test.ts src/main/providers/local-pty-provider.test.ts src/main/daemon/pty-subprocess.test.ts src/main/daemon/session.test.ts src/main/daemon/terminal-host.test.ts src/main/daemon/terminal-host-session-reaping-leak.test.ts src/main/providers/ssh-pty-provider.test.ts src/relay/pty-handler.test.ts --reporter=dot",
"result": "passed",
"durationSeconds": 10.01,
"summary": "Twenty-seven watcher, WSL, desktop/serve removal, local/daemon/SSH PTY physical-exit, provider ownership, RPC, renderer, relay PTY admission, and cross-platform path files passed with 1,886 tests. The suite includes nested removal fencing, renderer/runtime cwd-only admission, legacy provider rows, rejected kill retries, transient WSL capacity, and synchronous-startup reservation cleanup."
},
{
"date": "2026-07-13",
"runner": "local",
"platform": "macos",
"command": "node config/scripts/runtime-file-watcher-resource-probe.mjs",
"result": "passed",
"durationSeconds": 0.56,
"summary": "Five healthy roots shared one child at 50,176 KiB RSS and 6.0% sampled CPU; four quarantine children totaled 200,112 KiB RSS and 18.0% sampled CPU. The global eight-child cap and all per-child/aggregate budgets passed, and exact-PID cleanup was true."
},
{
"date": "2026-07-13",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/relay/relay-filesystem-watch-registry.test.ts src/relay/fs-handler.test.ts src/relay/git-handler.test.ts src/relay/subprocess.test.ts src/main/ssh/ssh-relay-versioned-install.test.ts config/scripts/package-electron-runtime-contract.test.mjs",
"result": "passed",
"durationSeconds": 10.01,
"summary": "Six relay registry, filesystem/Git handler, bundled subprocess, install, and package contract files passed with 226 tests."
},
{
"date": "2026-07-13",
"runner": "local",
"platform": "macos",
"command": "pnpm run build:electron-vite",
"result": "passed",
"durationSeconds": 24.41,
"summary": "The production Electron main, preload, renderer, daemon, and watcher child entries built successfully."
},
{
"date": "2026-07-13",
"runner": "local",
"platform": "macos",
"command": "node config/scripts/runtime-file-watcher-fault-harness.mjs",
"result": "passed",
"durationSeconds": 0.1,
"summary": "The Node host survived watcher-child SIGSEGV, replaced and resubscribed the child, and delivered a post-crash event."
},
{
"date": "2026-07-13",
"runner": "local",
"platform": "macos",
"command": "ELECTRON_RUN_AS_NODE=1 pnpm exec electron config/scripts/runtime-file-watcher-fault-harness.mjs",
"result": "passed",
"durationSeconds": 0.46,
"summary": "The Electron-as-Node host survived watcher-child SIGSEGV, replaced and resubscribed the child, and delivered a post-crash event."
},
{
"date": "2026-07-13",
"runner": "local",
"platform": "macos",
"command": "pnpm run build:relay",
"result": "passed",
"durationSeconds": 0.38,
"summary": "Relay and adjacent watcher artifacts built for Linux, macOS, and Windows on x64 and arm64, plus the WSL hook relay."
},
{
"date": "2026-07-13",
"runner": "local",
"platform": "macos",
"command": "node config/scripts/relay-watcher-fault-harness.mjs",
"result": "passed",
"durationSeconds": 0.12,
"summary": "The relay and existing PTY survived watcher-child SIGSEGV; replacement delivered overflow and a precise post-crash event."
},
{
"date": "2026-07-13",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/parcel-watcher-process.test.ts src/main/ipc/parcel-watcher-disconnect-termination.test.ts src/main/ipc/runtime-watcher-process-pool.test.ts src/main/ipc/parcel-watcher-process-entry.test.ts src/main/ipc/parcel-watcher-event-delivery.test.ts src/main/ipc/filesystem-watcher-local-unsubscribe.test.ts src/main/ipc/filesystem-watcher-wsl.test.ts src/main/ipc/worktrees.test.ts src/main/ipc/watcher-removal-gate.test.ts src/main/runtime/file-watcher-host.test.ts src/main/runtime/orca-runtime-files-watch.test.ts src/main/runtime/worktree-teardown.test.ts src/main/runtime/orca-runtime.test.ts src/main/runtime/rpc/methods/files.test.ts src/main/providers/ssh-filesystem-provider.test.ts src/renderer/src/runtime/runtime-file-client.test.ts src/renderer/src/web/web-runtime-client.test.ts src/shared/cross-platform-path.test.ts src/main/ipc/pty.test.ts src/main/providers/local-pty-provider.test.ts src/main/daemon/session.test.ts src/main/daemon/terminal-host.test.ts src/main/daemon/terminal-host-session-reaping-leak.test.ts src/main/providers/ssh-pty-provider.test.ts src/relay/pty-handler.test.ts",
"result": "passed",
"durationSeconds": 9.12,
"summary": "Twenty-five watcher, WSL, desktop/serve removal, local/daemon/SSH PTY physical-exit, provider ownership, RPC, renderer, relay PTY admission, and cross-platform path files passed with 1,762 tests. The suite covers operations joining in-flight termination, kill failures retaining ownership, bounded timeouts, atomic relay spawn/revive caps, and PTY-removal admission."
},
{
"date": "2026-07-13",
"runner": "local",
"platform": "macos",
"command": "node config/scripts/runtime-file-watcher-resource-probe.mjs",
"result": "passed",
"durationSeconds": 0.56,
"summary": "Five healthy roots shared one child at 50,096 KiB RSS and 3.4% sampled CPU; four quarantine children totaled 200,576 KiB RSS and 25.0% sampled CPU. The eight-child physical cap and every per-child/aggregate CPU and RSS budget passed, and exact-PID cleanup was true."
},
{
"date": "2026-07-13",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/relay/relay-filesystem-watch-registry.test.ts src/relay/fs-handler.test.ts src/relay/git-handler.test.ts src/relay/subprocess.test.ts src/main/ssh/ssh-relay-versioned-install.test.ts config/scripts/package-electron-runtime-contract.test.mjs",
"result": "passed",
"durationSeconds": 10.69,
"summary": "Six relay registry, filesystem/Git handler, bundled subprocess, install, and package contract files passed with 226 tests, including watcher/PTY removal fencing and recursive deletion failure behavior."
},
{
"date": "2026-07-13",
"runner": "local",
"platform": "macos",
"command": "pnpm run build:electron-vite",
"result": "passed",
"durationSeconds": 24,
"summary": "The production Electron main, preload, renderer, daemon, and watcher child entries built successfully."
},
{
"date": "2026-07-13",
"runner": "local",
"platform": "macos",
"command": "node config/scripts/runtime-file-watcher-fault-harness.mjs",
"result": "passed",
"durationSeconds": 0.01,
"summary": "The Node host survived watcher-child SIGSEGV, replaced and resubscribed the child, and delivered a post-crash event."
},
{
"date": "2026-07-13",
"runner": "local",
"platform": "macos",
"command": "ELECTRON_RUN_AS_NODE=1 pnpm exec electron config/scripts/runtime-file-watcher-fault-harness.mjs",
"result": "passed",
"durationSeconds": 0.46,
"summary": "The Electron-as-Node host survived watcher-child SIGSEGV, replaced and resubscribed the child, and delivered a post-crash event."
},
{
"date": "2026-07-13",
"runner": "local",
"platform": "macos",
"command": "pnpm run build:relay",
"result": "passed",
"durationSeconds": 0.39,
"summary": "Relay and adjacent watcher artifacts built for Linux, macOS, and Windows on x64 and arm64, plus the WSL hook relay."
},
{
"date": "2026-07-13",
"runner": "local",
"platform": "macos",
"command": "node config/scripts/relay-watcher-fault-harness.mjs",
"result": "passed",
"durationSeconds": 0.12,
"summary": "The relay and existing PTY survived watcher-child SIGSEGV; replacement delivered overflow and a precise post-crash event."
},
{
"date": "2026-07-13",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/parcel-watcher-process.test.ts src/main/ipc/parcel-watcher-disconnect-termination.test.ts src/main/ipc/runtime-watcher-process-pool.test.ts src/main/ipc/parcel-watcher-process-entry.test.ts src/main/ipc/parcel-watcher-event-delivery.test.ts src/main/ipc/filesystem-watcher-local-unsubscribe.test.ts src/main/ipc/filesystem-watcher-wsl.test.ts src/main/ipc/worktrees.test.ts src/main/ipc/watcher-removal-gate.test.ts src/main/runtime/file-watcher-host.test.ts src/main/runtime/orca-runtime-files-watch.test.ts src/main/runtime/worktree-teardown.test.ts src/main/runtime/orca-runtime.test.ts src/main/runtime/rpc/methods/files.test.ts src/main/providers/ssh-filesystem-provider.test.ts src/renderer/src/runtime/runtime-file-client.test.ts src/renderer/src/web/web-runtime-client.test.ts src/shared/cross-platform-path.test.ts src/main/ipc/pty.test.ts src/main/daemon/terminal-host.test.ts src/main/daemon/terminal-host-session-reaping-leak.test.ts src/main/providers/ssh-pty-provider.test.ts src/relay/pty-handler.test.ts",
"result": "passed",
"durationSeconds": 9.03,
"summary": "Twenty-three watcher, desktop/serve removal, terminal-spawn gate, daemon/SSH physical PTY exit, provider ownership, RPC, renderer, and cross-platform path files passed with 1,630 tests. The suite includes same-turn watcher replacement, authoritative SSH teardown before Git, bounded kill-without-exit failures that retain ownership, and local/SSH deletion fail-closed behavior."
},
{
"date": "2026-07-13",
"runner": "local",
"platform": "macos",
"command": "node config/scripts/runtime-file-watcher-resource-probe.mjs",
"result": "passed",
"durationSeconds": 0.55,
"summary": "Five healthy roots shared one child at 50,160 KiB RSS and 5.6% sampled CPU; four quarantine children totaled 199,968 KiB RSS and 16.7% sampled CPU, hard per-child and aggregate RSS/CPU budgets passed, the eight-child reservation cap rejected the next launch, and every exact PID exited during cleanup."
},
{
"date": "2026-07-13",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/relay/relay-filesystem-watch-registry.test.ts src/relay/fs-handler.test.ts src/relay/git-handler.test.ts src/relay/subprocess.test.ts src/main/ssh/ssh-relay-versioned-install.test.ts config/scripts/package-electron-runtime-contract.test.mjs",
"result": "passed",
"durationSeconds": 9.79,
"summary": "Six relay registry, filesystem/Git handler, bundled subprocess, install, and package contract files passed with 225 tests, including terminal removal notification and recursive deletion fencing."
},
{
"date": "2026-07-12",
"runner": "local",
"platform": "macos",
"command": "node config/scripts/relay-watcher-fault-harness.mjs",
"result": "passed",
"durationSeconds": 0.61,
"summary": "The relay PID and existing PTY survived watcher-child SIGSEGV; overflow and precise events resumed from a replacement child."
},
{
"date": "2026-07-13",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/parcel-watcher-process.test.ts src/main/ipc/parcel-watcher-disconnect-termination.test.ts src/main/ipc/runtime-watcher-process-pool.test.ts src/main/ipc/parcel-watcher-process-entry.test.ts src/main/ipc/parcel-watcher-event-delivery.test.ts src/main/ipc/filesystem-watcher-local-unsubscribe.test.ts src/main/ipc/filesystem-watcher-wsl.test.ts src/main/ipc/worktrees.test.ts src/main/ipc/watcher-removal-gate.test.ts src/main/runtime/file-watcher-host.test.ts src/main/runtime/orca-runtime-files-watch.test.ts src/main/runtime/worktree-teardown.test.ts src/main/runtime/orca-runtime.test.ts src/main/runtime/rpc/methods/files.test.ts src/main/providers/ssh-filesystem-provider.test.ts src/renderer/src/runtime/runtime-file-client.test.ts src/renderer/src/web/web-runtime-client.test.ts src/shared/cross-platform-path.test.ts",
"result": "passed",
"durationSeconds": 8.85,
"summary": "18 focused supervisor, disconnect termination, pool, child-entry, delivery, desktop/WSL cleanup and IPC removal, removal-gate, runtime-host/commands and physical PTY teardown, RPC, SSH ownership, renderer/paired-web clients, and cross-platform path files passed with 1,193 tests."
},
{
"date": "2026-07-12",
"runner": "local",
"platform": "macos",
"command": "node config/scripts/runtime-file-watcher-fault-harness.mjs",
"result": "passed",
"durationSeconds": 5,
"summary": "All 26 built-entry SIGSEGV injections preserved the parent, replaced and resubscribed the child, and delivered a post-crash event; watcher-canary temp-directory count remained 6 before and after the final five-run leak check."
},
{
"date": "2026-07-11",
"runner": "local",
"platform": "macos",
"command": "node config/scripts/runtime-file-watcher-fault-harness.mjs",
"result": "passed",
"durationSeconds": 0.3,
"summary": "The source-bundled real supervisor delivered through the built child before and after SIGSEGV; the parent survived and automatic resubscription used a replacement PID."
},
{
"date": "2026-07-11",
"runner": "local",
"platform": "macos",
"command": "node config/scripts/runtime-file-watcher-fault-harness.mjs",
"result": "passed",
"durationSeconds": 2.2,
"summary": "Ten consecutive invocations survived, automatically replaced and resubscribed the child, and delivered a post-crash event. The watcher-canary temp-directory count remained 8 before and after the loop."
}
],
"runtimeBudget": {
"p95Seconds": 60,
"scope": "focused process/RPC contract tests plus built child fault harness"
},
"flakeHistory": {
"status": "unknown",
"evidence": "New deterministic unit coverage and ten consecutive local built-entry harness passes; still below the CI and soak history required for promotion."
},
"redGreenEvidence": {
"status": "partial",
"evidence": "Red tests reproduced the reviewed failures: IPC disconnect-before-exit orphaned existing roots, queue-admission deadlines cascaded shard replacement, a fused shard created one child per root, a standard SSH repository created three healthy watcher supervisors, destructive desktop cleanup waited indefinitely for native setup, and synchronous renderer retry joined a terminal stream. Earlier red coverage also reproduced missing-entry fail-open, terminal recovery loss, stale same-root lease deletion, and unbounded per-child stat lanes. The bounded quarantine and cancellation rewrite passes those contracts, the relay-specific healthy width test reduces the three-root case to one supervisor, and the real-supervisor built-entry harness survives SIGSEGV with automatic replacement. CI/soak history is still absent."
},
"performanceBudget": {
"required": true,
"evidence": "The committed resource probe reproducibly measures five healthy roots sharing one child (50,160 KiB RSS, 5.6% sampled CPU) and four quarantine children (199,968 KiB total RSS, 16.7% sampled CPU), enforces 128 MiB/50% per-child and 512 MiB/100% quarantine aggregate budgets, derives a 1 GiB/400% ceiling across the global eight-physical-child cap, and waits for every exact PID during cleanup. A relay policy test separately proves a standard SSH repository's three roots share one healthy child. Shared pending setup attaches one base-promise reaction per generation; quantitative owner tests abort 10,000 callers at each affected layer and require exactly one anchor, then zero explicit waiters after settlement. The shared supervisor capacity barrier is event-driven, one-shot, abortable, and serialized per released physical slot, waking every same-child desktop, paired-runtime, or SSH relay root without consuming crash-recovery attempts; direct WSL capacity retains the same event-driven desktop retry. Relay PTY admission adds at most two deduplicated path checks per spawn/revive and releases both without polling or retained listeners, while dead-PID reaping settles an existing tracker without allocating another timer. Fault quarantine distributes affected roots by least load, disposes empty slots, and permits no replacement after a quarantine shard itself fuses. Each child caps directory stats at eight across its assigned roots (at most eight healthy or 32 quarantined operations), each subscription retains at most one active plus one bounded pending batch, and no additional polling or serve-process stat fanout is added."
},
"promotionCriteria": [
"Run the built-entry SIGSEGV harness in soak for at least 100 consecutive passes or 14 days on macOS.",
"Add an eight-root/six-writer event-loop-delay soak artifact with an explicit latency budget.",
"Add a packaged orca serve pairing scenario that proves a connected client refreshes after child replacement."
],
"knownGaps": [
"The fault harness bundles the real source supervisor and drives the built child, but it does not launch a packaged orca serve pairing session or exercise app.asar path resolution.",
"The committed resource probe covers the one-child healthy pool, four-child fault-quarantine ceiling, RSS/CPU sampling, global physical-child cap, and exact-PID cleanup, but sustained six-writer event-loop-delay and CPU soak evidence is still absent.",
"Linux native watcher fault containment is source-equivalent but not live fault-injected in this evidence run.",
"Windows native runtime watches bypass this child path; WSL reservation/release is deterministic-contract tested but not live fault-injected, and SSH registration ownership is not live-relay fault-injected."
],
"demotionRule": "Demote or quarantine if the fault harness flakes without a product or harness bug, if healthy operation exceeds one runtime watcher child, if total physical operation exceeds eight children including retiring generations, if quarantine children outlive their roots or repeat after fusing, if event delivery becomes unbounded, or if metadata/stat work returns to the serve process."
},
{
"id": "terminal-input.plugin-explicit-worktree-routing",
"title": "Plugin terminal input stays inside the freshly resolved worktree",
"maturity": "experimental",
"protection": "partial",
"owner": "plugin-platform",
"layer": "main-relay-contract",
"surfaces": [
"plugin host API terminal input",
"active worktree resolution",
"provider terminal inventory",
"relay capability enforcement"
],
"platforms": [
"macos",
"linux",
"windows"
],
"providers": [
"local",
"daemon",
"ssh",
"wsl",
"remote-runtime",
"mobile-relay"
],
"coveredPlatforms": [
"macos"
],
"coveredProviders": [
"local",
"ssh"
],
"coverageNotes": "Deterministic macOS contract evidence covers opaque local- and SSH-shaped terminal ids, one bounded worktree listing, mismatch rejection, and the main/relay host-call adapter matrix. It does not launch a live PTY or provision a relay-hosted plugin.",
"motivatingLinks": [
"https://github.com/stablyai/orca/pull/8549"
],
"invariant": "terminal.sendText accepts only an explicit provider-owned terminal id present in one bounded inventory of the worktree resolved immediately before the send; an absent id causes zero send calls, and relay callers cannot supply their own capability grants or transport classification.",
"oracle": "Resolve the active worktree once, list that worktree with the v0 terminal cap once, and assert zero sendTerminal calls for a mismatched opaque id versus exactly one send for matching local- and SSH-shaped ids; then run the same permission and schema cases through desktop-main and registered relay panel/worker adapters and compare error codes.",
"commands": [
"pnpm exec vitest run --config config/vitest.config.ts src/main/plugins/plugin-host-methods.test.ts src/main/plugins/plugin-host-conformance.test.ts"
],
"testFiles": [
"src/main/plugins/plugin-host-methods.test.ts",
"src/main/plugins/plugin-host-conformance.test.ts"
],
"assertionRefs": [
{
"file": "src/main/plugins/plugin-host-methods.test.ts",
"assertions": [
"a terminal outside the freshly resolved worktree performs one capped list and zero sends",
"matching local- and SSH-shaped opaque ids each perform one capped list and one exact send",
"workspace.readContext drops provider paths, path-bearing internal worktree ids, and terminal titles while capping its terminal projection"
]
},
{
"file": "src/main/plugins/plugin-host-conformance.test.ts",
"assertions": [
"all 13 v0 methods succeed with the required consented capability through desktop-main and relay adapters",
"missing consent, missing capability, unknown method, malformed params, panel-forbidden access, malformed results, and mutation-audit failure return identical codes",
"malformed qualified keys, client-supplied grants, and client-supplied transport flags are rejected before host policy resolution"
]
}
],
"evidenceRuns": [
{
"date": "2026-07-10",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/main/plugins/plugin-host-methods.test.ts src/main/plugins/plugin-host-conformance.test.ts",
"result": "passed",
"durationSeconds": 0.18,
"summary": "2 files and 17 tests passed, covering the 13-method main/relay conformance matrix and exact terminal routing call counts."
}
],
"runtimeBudget": {
"p95Seconds": 10,
"scope": "plugin host main/relay contract tests"
},
"flakeHistory": {
"status": "unknown",
"evidence": "The deterministic focused suite passed locally once and needs CI and soak history before promotion."
},
"redGreenEvidence": {
"status": "partial",
"evidence": "Exact mismatch/send counts and adapter error parity are asserted; intentional-break and saved CI evidence are still missing."
},
"performanceBudget": {
"required": true,
"evidence": "Each plugin send resolves once, performs exactly one list capped at 50 terminals, and performs at most one send. The path adds no polling, subprocesses, provider fanout, renderer work, or startup await."
},
"promotionCriteria": [
"Run for at least 100 consecutive passes or 14 days across required CI platforms.",
"Attach intentional-break evidence for the worktree membership check and relay transport binding.",
"Exercise live local and SSH provider terminals, including mismatch rejection and successful input echo.",
"Keep relay-hosted plugin provisioning behind a separate reviewed policy before replacing the fail-closed registration."
],
"knownGaps": [
"Linux and Windows execution evidence is not recorded.",
"Daemon, WSL, remote-runtime, and mobile-relay providers have no live input evidence.",
"Local and SSH coverage is contract-level over opaque ids, not a live PTY input/echo run.",
"The bounded 50-terminal inventory intentionally rejects a target not present in the capped result; scale behavior above that cap needs a targeted membership API before expansion.",
"Relay-hosted plugin provisioning, consent persistence, workers, and audit services remain out of scope and the relay registration therefore denies every provisioned identity by default."
],
"demotionRule": "Keep experimental or demote to protection none if the suite flakes, permits a mismatched terminal send, performs more than one inventory list per call, accepts client-supplied grants, or relay and desktop error codes diverge."
}
]
}
Reference in New Issue View Git Blame Copy Permalink