## Summary / 摘要
- Fully revert the production behavior, contracts, documentation, and
frame-preparation changes introduced by PR #58.
- Restore the previous fully opaque flat-chroma source workflow and its
bounded transparency, edge-repair, and QA pipeline for Maker and Studio
production.
- Rewrite the existing unreleased native-Alpha-default changelog
fragment so the eventual release notes contain only the final rollback
state.
- Keep the Codex plugin and both bundled Skills monotonic at version
0.5.8; no native-Alpha-default behavior is retained by that
metadata-only bump.
## Why / 原因
The current built-in imagegen tool exposes only prompt and
reference-image selection fields, not a transparent-background control.
Direct generation can return real Alpha, but controlled reference-image
generation and editing returned opaque PNGs. Native transparency is
therefore not reliable enough to be the product default.
当前内置 imagegen 仅暴露提示词和参考图选择字段，未暴露透明背景控制。直接生图可以返回真实
Alpha，但受控参考图生图与编辑返回了不透明 PNG，因此原生透明能力尚不具备默认投产条件。
## Validation / 验证
- `./script/validate_pre_push.sh`
- `./script/changelog_fragments.py policy --base-ref
5e94852241 --release-preparation false`
- `uv run --with pillow python -m unittest discover -s
skills/agent-pet-maker/tests -p test_*.py` — 88 passed
- `cargo test -p petcore --test integration_b --locked` — 42 passed
- `DEVELOPER_DIR=/Applications/Xcode.app/Contents/Developer swift test
--package-path apps/macos --filter PortableMakerSkillManagementTests` —
5 passed
- Behavioral tree comparison matches PR #58 parent
`2844e0803734247f16d3667711479856249d13ae`; only monotonic 0.5.8
metadata, its matching Swift expectations, and the corrected retained
changelog fragment differ.
## Development claim / 开发声明
- Domain: `maker-generation`
- Claim: `maker-skills`
- Base commit: `5e9485224140e5f30ced42d598eba87b4f8b26e6`
- Release preparation: `no`
- Scope note: direct hotfix that atomically reverts the cross-contract
PR #58 delivery.
- Focused validation:
- `cargo test -p petcore --test integration_b --locked`
- `./script/validate_pet_skills.sh`
<!-- apc-engineering-coordination-v1
{"claim_overlap_rejections":3,"merge_tree_conflicts":0,"schema_version":"apc.engineering-coordination.v1","task_created_at":"2026-09-01T15:10:18Z","train_conflict_resolutions":0}
-->
Co-authored-by: gd-ops <gd-ops@xmfunny.com>
## Summary / 摘要
- Make ChatGPT/Codex built-in `imagegen` the default image path for low
and standard pet creation, requesting genuine transparent PNG source
art.
- Add version 2 `native_alpha` frame jobs that preserve authored Alpha
and visible RGBA, clear only hidden RGB under Alpha 0, keep
source-resolution masters, and perform at most one premultiplied
linear-light downscale.
- Retain version 1 readability and an explicit version 2 `chroma_key`
compatibility path for opaque-only providers; native failures never
silently fall back to chroma.
- Synchronize Studio prompts, Maker/Studio skills, V3 contracts,
architecture/public docs, plugin version 0.5.7, and the unreleased
changelog fragment.
## Validation / 验证
- `./script/validate_pre_push.sh`
- 103 Python pet-production and Skill contract tests
- 42 PetCore `integration_b` tests
- Focused PetCore external-helper prompt contract test
- 5 Portable Maker Skill Swift tests
- Plugin version and changelog policy validators
## Development claim / 开发声明
- Domain: `maker-generation`
- Claim: `maker-skills`
- Base commit: `2844e0803734247f16d3667711479856249d13ae`
- Release preparation: `no`
- Scope note: this is one atomic cross-contract delivery spanning the
Maker skills, Studio generation prompt, durable contracts, public
documentation, and their synchronized version tests.
- Focused validation:
- `cargo test -p petcore --test integration_b --locked`
- `./script/validate_pet_skills.sh`
<!-- apc-engineering-coordination-v1
{"claim_overlap_rejections":2,"merge_tree_conflicts":0,"schema_version":"apc.engineering-coordination.v1","task_created_at":"2026-09-01T02:45:18Z","train_conflict_resolutions":0}
-->
Co-authored-by: gd-ops <gd-ops@xmfunny.com>
## Summary
- DSH final `assistant/message` now projects immediately at the message
boundary instead of waiting for `turn/end`: visible `text` blocks become
bounded Agent body copy, explicit string `reasoning` blocks become
bounded thinking body copy, and a message carrying both lets the visible
text win the same-sequence selection. The edge is display-only
(`affects_activity=false`), so it never restarts a thinking animation or
pulls an in-progress tool state back to start/thinking.
- A text-less final step clears the cached assistant text so a terminal
edge cannot resurrect stale body copy over newer thinking.
- `user/message` now reads the real rc.7 direct payload shape
(`event.data` is the `UserMessage`); a bounded historical nested `{
message }` fallback is retained, and only `source.kind === 'user'`
counts as user context.
- `todo/write` projects exactly one closed, bounded plan line (first
`in_progress`, else first `pending`, else last `completed`); the whole
list is never serialized.
- Streaming deltas remain dropped locally; tool args/results, usage,
credentials, and full host objects never cross the contract.
- DSH connector contract bumped to `dsh-v0.1.0-rc.7-events-v3` across
plugin template, Rust constant, fixtures, and validations (host version
is diagnostic context only, not a compat gate).
- Current-state `docs/integrations/agent-connectors.md` updated;
changelog fragment added under `changes/unreleased/`.
## Verification
- `node --test plugins/connector-privacy.test.mjs` — real-shape rc.7
fixtures, immediate assistant/message delivery, reasoning/text
precedence, stale-cache clearing, todo selection, non-user source
suppression: pass
- `cargo test -p petcore --lib dsh_adapter_tests` — 5 pass
- `cargo test -p petcore --test integration_d --locked` — 164 pass,
including the new real-chain regression
`dsh_real_chain_keeps_latest_agent_and_thinking_body_across_tool_activity`
(raw envelopes through `parse_dsh` → `agent.ingest` → bubble projection)
- `./script/validate_connectors_runtime.sh`,
`./script/validate_security_boundaries.sh` — pass
- `./script/validate_pre_push.sh` — pass; `cargo clippy` clean
- UI acceptance not claimed: no live macOS bubble observation was made
in this task; structural/automated proof only.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
## Development claim / 开发声明
- Domain: `agent-connections`
- Claim: `dsh-connector`
- Base commit: `836419bb616e7ad03b8545e005274683d8785335`
- Release preparation: `no`
- Focused validation:
- `cargo test -p petcore --test integration_d --locked`
- `./script/validate_connectors_runtime.sh`
<!-- apc-engineering-coordination-v1
{"claim_overlap_rejections":1,"merge_tree_conflicts":0,"schema_version":"apc.engineering-coordination.v1","task_created_at":"2026-08-19T05:53:48Z","train_conflict_resolutions":0}
-->
Co-authored-by: gd-ops <gd-ops@xmfunny.com>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
## Summary
- wait for GitHub's authoritative pull-request response to expose the
newly merged identity after a successful squash
- keep the existing exact base/head/SHA fail-closed checks after a
bounded retry window
- add a workflow contract regression that requires merge observation to
happen after the merge command
## Incident evidence
- protected merge run `32168497595` successfully merged PR #44, then
failed in `Squash or recover only the PR proven by the completed CI run`
- the same failure shape occurred after PR #43
- because merges performed with the workflow token do not trigger a
fresh workflow automatically, the failure skipped exact-SHA main CI
dispatch and source-branch cleanup
## Validation
- `python3 script/tests/test_validation_tooling.py` (58 passed)
- `python3 script/tests/test_release_distribution_contracts.py` (44
passed)
- `./script/validate_build_scripts_safety.sh --static-only`
- `./script/validate_source_syntax.sh`
- `./script/validate_pre_push.sh`
This PR changes the protected delivery control plane and therefore
requires a trusted manual squash merge after CI.
## Development claim / 开发声明
- Domain: `release-control-plane`
- Claim: `control-plane`
- Base commit: `964f69f128cd0a41305afe5fd734880dabb47552`
- Release preparation: `no`
- Focused validation:
- `python3 script/tests/test_validation_tooling.py`
- `./script/validate_build_scripts_safety.sh --static-only`
<!-- apc-engineering-coordination-v1
{"claim_overlap_rejections":0,"merge_tree_conflicts":0,"schema_version":"apc.engineering-coordination.v1","task_created_at":"2026-08-18T18:05:06Z","train_conflict_resolutions":0}
-->
Co-authored-by: gd-ops <gd-ops@xmfunny.com>
## Summary
- render each GitHub Release body from the exact version section in
`CHANGELOG.md`
- place categorized bilingual version changes before a concise bilingual
installation and first-open note
- remove internal changelog fragment markers from public notes and
verify the published body exactly matches the generated file
- update release contracts, validation ownership, documentation, and
regression tests
## Root cause
The Release workflow assembled one fixed three-step installation
template and never consumed the version-specific changelog section, so
every Release body omitted its actual changes.
## Validation
- `./script/validate_pre_push.sh`
- `./script/validate_build_scripts_safety.sh --static-only`
- `python3 script/tests/test_validation_tooling.py` (58 passed)
- `python3 script/tests/test_release_distribution_contracts.py` (44
passed)
- generated and inspected the complete `0.4.5` preview
This PR changes the Release control plane and therefore requires a
trusted manual squash merge after CI.
## Development claim / 开发声明
- Domain: `release-control-plane`
- Claim: `control-plane`
- Base commit: `80f7912026e531c22a50de82036705e19b03669a`
- Release preparation: `no`
- Focused validation:
- `python3 script/tests/test_validation_tooling.py`
- `./script/validate_build_scripts_safety.sh --static-only`
<!-- apc-engineering-coordination-v1
{"claim_overlap_rejections":2,"merge_tree_conflicts":0,"schema_version":"apc.engineering-coordination.v1","task_created_at":"2026-08-17T07:11:03Z","train_conflict_resolutions":0}
-->
Co-authored-by: gd-ops <gd-ops@xmfunny.com>
## Summary / 摘要
- Make one coordinator the sole owner of Control Center presentation,
activation, exact-window registration, and key-window state across cold
launch, reopen, menu, overlay, and update paths.
- Remove the startup alpha/input gate; appearance hydration now applies
only `NSAppearance` while the window stays visible and interactive.
- Keep overlay panels passive by default and grant the session bubble
keyboard focus only through an explicit, revocable lease.
- Add bounded lifecycle diagnostics and a fail-closed cold-launch
release gate that rebuilds the exact worktree App and proves singleton
identity, layer, alpha, nonblank pixels, overlay ordering, and retained
focus.
- Replace every retention-sensitive fixed Rust event timestamp with one
current UTC fixture base plus relative offsets; the audit removed 25
calendar-dependent timestamps, including the failing 2026-07-17 cases,
imminent 2026-07-20 cases, and 2099 escape fixtures.
- Add a CI-enforced Rust source validator that follows same-file fixture
helpers, rejects fixed RFC 3339 timestamps crossing real event-retention
APIs, and permits isolated deterministic schema/serialization/migration
samples.
## Validation / 验证
- `cargo test --workspace --locked` — complete Rust workspace passed
(petcore unit 279; integration A/B/C/D 96/40/66/160; CLI and type suites
passed).
- `cargo clippy -p petcore --all-targets --locked -- -D warnings`
passed.
- `python3 script/validate_time_independent_tests.py --root .` passed;
running the same validator against the unfixed main tree reports all 25
risky timestamps.
- `python3 script/tests/test_validation_tooling.py` — 56 tests passed.
- `./script/validate_swift_tests.sh --scope all` — 749 tests passed.
- `./script/validate_app_lifecycle_contract.sh` — 16/16 passed.
- `APC_VALIDATE_HOST_UI=1 APC_MAIN_UI_COLD_LAUNCH_ITERATIONS=20
./script/validate_main_window_ui.sh` — 20/20 cold launches passed.
- Computer Use acceptance — five destinations, three bundled pets,
action preview, pet hide/show, Control Center close/reopen, and two
consecutive quit/relaunch cycles passed.
- `./script/validate_pre_push.sh` passed after the Rust and source-gate
update.
- `./script/validate_test_isolation.sh` and
`./script/validate_build_scripts_safety.sh --static-only` passed.
This PR updates the release-control-plane inventory, so it must complete
PR CI and then receive a trusted manual squash merge.
## Development claim / 开发声明
- Domain: `release-control-plane`
- Claim: `control-plane`
- Base commit: `e216a4fd13af88902cf2bd77d23939fe606c9383`
- Release preparation: `no`
- Focused validation:
- `python3 script/tests/test_validation_tooling.py`
- `./script/validate_build_scripts_safety.sh --static-only`
<!-- apc-engineering-coordination-v1
{"claim_overlap_rejections":1,"merge_tree_conflicts":0,"schema_version":"apc.engineering-coordination.v1","task_created_at":"2026-08-16T12:09:52Z","train_conflict_resolutions":0}
-->
---------
Co-authored-by: gd-ops <gd-ops@xmfunny.com>
Land the B0/M0-M5/E0-E4/P0-P3 engineering-speedup control plane, including exact Swift caching, measured engineering metrics, canonical Rust identity validation, deterministic test isolation, proof fallback/promotion, and supporting architecture splits.\n\nRelease validation and dispatch are intentionally deferred to the next release.
## Summary
- move initial appearance reveal ownership from transient SwiftUI hosts
to one NSWindow coordinator
- fail open when the final gate host disappears and keep the desktop pet
visible during appearance hydration
- add host-replacement regressions, on-screen window validation, and
bump App/PetCore to 0.4.2
## Root cause
The 0.4.1 deferred reveal callback was owned by a short-lived
representable host. SwiftUI could replace or dismantle that host before
the next main-queue turn, leaving the actual control-center NSWindow at
alpha 0 and non-interactive. A duplicate host could also record that
concealed state as its restoration baseline.
## Validation
- ./script/validate_swift_tests.sh --scope all: 738 tests passed
- ./script/validate_pre_push.sh: passed
- APC_VALIDATE_HOST_UI=1 ./script/validate_main_window_ui.sh: passed
- Computer Use: all five destinations, three bundled pets/action
preview, pet hide/show, close/reopen passed
- Computer Use: two consecutive full quit/relaunch cold starts produced
new App processes and a visible usable control center each time
Co-authored-by: gd-ops <gd-ops@xmfunny.com>
## Summary
- defer the initial Control Center reveal until SwiftUI finishes the
current render pass
- avoid synchronous AppKit layout/display calls from updateNSView
- add a regression test and bilingual changelog entry
- require exact-commit local Computer Use acceptance before every GitHub
Release
- block tag creation and archive builds when live UI acceptance failed,
is missing, or targets another commit
## Root cause
The initial appearance gate called layoutSubtreeIfNeeded() and
displayIfNeeded() while SwiftUI was rendering its NSHostingView. macOS
reported a reentrant layout fault and skipped the content render,
leaving the installed 0.4.0 Control Center visually blank even though
its accessibility tree was present.
The previous Release path could miss this because packaged UI validation
deliberately ran without a real main window and live Computer Use
verification was optional.
## Impact
The installed macOS App now presents onboarding or Control Center
content normally on launch while still suppressing the pre-theme
title-bar flash.
Release publication is now explicit-dispatch only. Before dispatch, the
exact clean main commit must pass the documented local Computer Use
checklist: visible nonblank launch, all five destinations, bundled pets
and preview, desktop-pet hide/show, window reopen, and quit/relaunch.
The workflow requires the same full commit in host_ui_tested_commit and
host_ui_result=passed before it can create a tag or build archives.
Failed or unobservable checks stop publication and leave the next action
to the user.
## Validation
- ./script/validate_swift_tests.sh --scope all — 735 tests passed
- ./script/build_and_run.sh --run — bundle built, signed, launched, and
synchronized with PetCore; 124 overlay/interaction checks passed
- Computer Use visual verification — first-run onboarding and all three
bundled pet cards rendered correctly
- unified log verification — the fixed build no longer emitted the
NSHostingView reentrant-layout fault
- python3 -m unittest script.tests.test_release_distribution_contracts —
44 tests passed
- ./script/validate_build_scripts_safety.sh — passed
- actionlint .github/workflows/release.yml — passed
---------
Co-authored-by: gd-ops <gd-ops@xmfunny.com>
## Summary
- Treat the Pulls list response as closed-PR discovery only.
- Resolve merged state, exact base/head identity, and merge commit from
the authoritative single-PR API before replay.
- Document the recovery trust boundary and include it in the 0.4.0
changelog.
## Root cause
PR #12 merged successfully, but GitHub temporarily returned
merge_commit_sha as null in the Pulls list response while the single-PR
endpoint already returned the correct merge identity. The replay filter
therefore could not locate the merged PR to recover exact-main dispatch.
## Validation
- Red/green closed replay regression test
- 53 Release and CI proof tests
- actionlint .github/workflows/auto-merge.yml
- static build and Release safety contracts
- ./script/validate_pre_push.sh
Co-authored-by: gd-ops <gd-ops@xmfunny.com>
## What changed
- add App and PetCore portable Agent Pet Maker skill management, with
fd-relative ownership and race-safe install/uninstall
- improve Pi no-model failure projection, session bubble message
selection, child-session filtering, onboarding rendering, and related
App behavior
- delete verified PR source branches with exact leases after merge while
dispatching exact-main CI first
- document direct/train multi-agent delivery, explicit
add/commit/clean/push checks, post-merge worktree audits, and exact-SHA
release proof
## Validation
- full `cargo test -p petcore`
- Swift package suite: 734 tests
- Pi connector privacy tests
- promotion/release Python tests and actionlint
- `./script/validate_pre_push.sh`
- independent specification and safety reviews: no remaining blockers
This PR changes the protected CI control plane, so it is intended for
full CI followed by trusted exact-head squash merge.
---------
Co-authored-by: gd-ops <gd-ops@xmfunny.com>
## Summary
- emit one run/attempt-scoped completion artifact per Rust test shard
- require the exact five-shard marker set before candidate proof, main
source proof, or Required CI can succeed
- document full-workflow rerun recovery and cover missing, extra, and
malformed marker cases
## Evidence
- real run 31501024780 completed successfully while the Jobs API
retained integration-a as queued
- 85 Python workflow/tooling tests
- build/release static safety suites (31 + 8 + 4)
- actionlint for CI, auto-merge, and Release workflows
- Release shell contracts and git diff check
This changes the CI control plane, so the trusted merger must
intentionally refuse privileged auto-merge; merge only through the
documented trusted manual squash path after Required CI succeeds.
Co-authored-by: gd-ops <gd-ops@xmfunny.com>
## Summary
- emit a bounded candidate proof after complete direct or final train PR
CI
- promote that proof to an identical squash-merged `main` tree and issue
a main-bound Release source proof without repeating Rust, Swift,
integration, stress, overlay, or App assembly jobs
- fail closed to complete main CI for missing/ambiguous evidence,
changed parents or tree, expired artifacts, API inconsistency, or
CI/Release proof-control changes
- keep task → train PRs path-scoped with no post-merge train CI or
Release candidate
This rollout changes the proof control plane, so its first merge
intentionally takes the complete main-CI fallback. Later ordinary
direct/train merges can use the fast promotion path.
## Validation
- `actionlint .github/workflows/ci.yml .github/workflows/release.yml
.github/workflows/auto-merge.yml`
- 75 focused Python and Release contract tests
- `script/tests/test_release_shell_contracts.sh`
- `./script/validate_source_syntax.sh`
- `./script/validate_build_scripts_safety.sh --skip-source-syntax
--static-only`
- live read-only selector check against Actions run `31490206146`,
including its empty `pull_requests` API payload
Co-authored-by: gd-ops <gd-ops@xmfunny.com>
## Development lane / 开发通道
- Lane: `direct-to-main` bootstrap
- Base branch: `main`
- Active train: `n/a`
- Owning Agent/session: workflow coordinator
## Change / 改动
- Split authoritative CI into parallel static, contract, Rust lint/test
shards, Swift interaction, stress, overlay, bundle, and stable `Required
CI` jobs.
- Make every ready PR to `main` a complete gate while keeping task PRs
to `gd-ops/train/*` path-scoped.
- Add direct/train worktree coordination, bounded changelog fragments,
protected main/train ruleset automation, and safe same-repository squash
auto-merge.
- Let GitHub Release promote an exact successful main commit, reuse its
source proof, and create a missing release tag only after proof
validation.
- Keep local pre-push validation bounded to basic syntax, formatting,
contracts, and compilation; complete duplicate proof stays in GitHub CI.
This is the one bootstrap PR: the auto-merge workflow and required rules
do not exist on the base branch yet. After this PR passes and is merged
once, the exact `main` push must pass `Required CI`; then the
fail-closed applicator can activate both rulesets and all later ready
`gd-ops/*` PRs follow the automated path.
## Validation / 验证
- `actionlint .github/workflows/ci.yml .github/workflows/release.yml
.github/workflows/auto-merge.yml`
- `./script/validate_source_syntax.sh`
- `./script/validate_build_scripts_safety.sh --skip-source-syntax`
- Exact staged diff was reapplied to a clean detached worktree before
the final validation run.
- 28 validation-tooling tests, 40 release-distribution tests, macOS
build-contract tests, Release shell contracts, and test-isolation
validation passed.
## Risk / 风险
- No product runtime or credential access is added.
- `pull_request_target` never checks out or executes PR code and only
enables auto-merge after API verification of active PR and `Required CI`
rules.
- Full ruleset activation fails closed until the exact remote main
commit has a trusted successful GitHub Actions push run.
- Reversible repository settings are already enabled: auto-merge,
squash-only, update branch, and delete merged branches.
---------
Co-authored-by: gd-ops <gd-ops@xmfunny.com>
