Repository navigation
desktop acceptance: native render observation, artifact identity in receipts, and a tool-usage oracle #239
Description
Splits out from #232, whose guidance half shipped in 0.2.37 (native desktop acceptance and macOS approval references, plus the desktop goalplan surface).
Three parts of #232's request need code or schema changes that 0.2.37 deliberately did not make:
- Native render observation.
render-observations.tsrecognizes web file types only and records that an observation tool ran, not which app, artifact or scenario was observed. Adding.swift/.rsby extension would demand screenshots for non-UI Swift model code, which dev: native desktop acceptance is not represented in routing or evidence gates (Tauri macOS case study) #232 rules out. A useful version needs to know which changes touch a presented native surface. - Artifact identity inside receipts. The source-bound receipt binds command, source tree, session and cycle, not target architecture, SDK/toolchain, bundle digest, signing mode or the acceptance row covered. 0.2.37 asks agents to put an
artifact-identity.jsonin QAartifactRefs; nothing validates it. - A tool-usage oracle. dev: native desktop acceptance is not represented in routing or evidence gates (Tauri macOS case study) #232 asks that a fixture with the historical wrong
lipousage be rejected by an independent behavioral oracle. 0.2.37 only states the rule. Executed on Command Line Tools 27.0, several architectures passed to one-verify_archfail in either argument order, while Xcode 26.6 rejected only the file-last form, so a string-level check cannot be the oracle either.
Also still open from the 0.2.37 work: --surface is still parsed and ignored on steer, add-work-phase, add-task and meet-criterion, and misspelled flags are skipped silently by the goalplan CLI parser.
Record: devlog/_plan/260923_native_desktop_acceptance/ (000 issue mapping, 001 research, 010 bypass record).
Activity
Issue sweep: PDF export completion, paged report QA, desktop evidence…
lidge-jun commentedon Sep 24, 2026
Fixed in v0.2.38 (#242).
cxc loopandcxc goalplanvalidate flags per verb.--surfaceoutsideadd-criterion, misspelled flags, stray positionals, missing values and repeated singleton flags now fail before anything is written. Every value flag also accepts--flag=value.artifact-identity.jsonfor desktop artifact verdicts. That covers the bundle tree digest (viavalidate-evidence.mjs --bundle-digest), executable, archive, signing, toolchain and a binding to goalplancriterionIds. It hashes those files into a typedartifactManifestin the QA receipt, which is rechecked on every read. A schemaVersion 2+ final gate requires an identity entry for each non-native desktop criterion; v1 plans rely on ingress validation.add-criterion --surface desktop --presented nativemarks criteria that need a native surface inspected. At Check they get a soft, fail-open advisory that clears only on an explicit native app observation or a viewed, declared screenshot. File extensions never trigger it.skills/dev-devops/scripts/verify-lipo-command.mjsruns a candidate command against the artifact and a verified thin negative control, with no shell. With Xcode lipo on/bin/ls, the historicallipo <file> -verify_arch x86_64 arm64ewas rejected ("requires exactly one input file"), while the per-architecture form passed.Residuals: one native observation clears the advisory for every native criterion (soft tier). The validator does not read
Info.plistor unpack the archive. The oracle is proven with real lipo only on macOS; Linux and Windows run it against a fake.