hmbown--deepseek-tui/CODEWHALE_0_8_68_TRACKER.md

CodeWhale 0.8.68 — Workflow + Stability Patch Release

Status (2026-07-12): Historical. v0.8.68 shipped on 2026-07-10; this tracker is superseded by the shipped release. Caution for readers: the Wave-7 "Multitask" rows below are marked Done but describe work that was rolled back before ship — Multitask never shipped and leftover settings normalize to Operate (crates/tui/src/tui/app.rs, mode picker). The "deferred to 0.9.0" lists remain useful as a raw next-major backlog feed; the release label itself is a maintainer decision.

What this is. Local tracker + handoff for the CodeWhale 0.8.68 release candidate. It documents what's in scope, what's deferred to 0.9.0, and the current verification state.

2026-07-07 kickoff — READ THIS FIRST. This release follows the 0.8.67 Fleet/Workflow usability pass (PR #4047). Implementation work continues on work/v0.9.0-cutover in worktree .cw-worktrees/v0867-pr4047. Issue inventory lives in milestone-audit-20260622/buckets/v0.8.68.md (30 issues in bucket).

Sub-agent sweep completed 2026-07-07. Six parallel scouts produced the release plan below. Workflow file: CodeWhale/workflows/v0868_issue_sweep.workflow.js.

2026-07-07 cutover correction — source of truth. Work for this release belongs in .cw-worktrees/v0867-pr4047 on work/v0.9.0-cutover. The durable PR base was 883f94df6; the quick-win layer that followed was briefly stranded as uncommitted working-tree changes. This tracker update travels with that quick-win layer: OpenRouter live catalog parsing, provider picker search, Status/ToolDescriptor concept-map cleanup, copy/perf fixes, foreground shell compacting, and test alignment are locally verified here. Do not mark work complete from another checkout unless the symbols and tests are verified in this worktree.

VERDICT: partial — can ship a narrow 0.8.68 patch after Wave 1–2

Wave 1 (three workflow correctness hazards) + Wave 2 (TUI P0 stability + core workflow UX) is the minimum credible release. The full 30-issue bucket is 3–4 weeks; scope must be trimmed via closes and defers.

---

SCOPE (ship in 0.8.68)

P0 bugs (must-fix before tag)

#	Title	Fix train commit
1830	Input freeze / progress loss	Commits 1 + 4 (input fairness + periodic snapshot)
1338	Enter causes GUI crash (Windows)	Commit 2 (Enter-during-busy hardening)

P1 bugs (target for release)

#	Title	Fix train commit
2317	Long reply blocks further input	Commits 1 + 5 (fairness + queue UX toasts)
1198	No response on key input (approval/git)	Commits 1 + 3 (fairness + modal submit errors)
1862	TUI read "Reading" stuck	Tool hang watchdog tuning (15min → shorter + footer clear)

Workflow correctness (release-blocking)

Hazard	Location	Fix
completion_from_manager fabricates Completed	workflow.rs:1412–1443	Fail closed after 1s poll timeout
Cancel doesn't interrupt VM	workflow.rs:380–404	Wire CancelHandle + abort run_workflow_vm
budget.spent() stub	workflow.rs:1121–1125	Delegate to manager aggregate_budget_spent

P1 features (target for release)

#	Title	Notes
4038	Workflow run view / phase progress UI	SharedWorkflowRuns exists; TUI never reads it
4011	Durable runs + journal/resume	In-memory only today; codewhale-state schema exists
4013	Verification gates	Reuse task_gate_run / Fleet verifier infra
3380	Approval modal key hints	Good-first issue — badges landed (#3799); footer contrast remains

Provider / model picker (2026-07-07)

Source: User-reported /provider and /model menu bugs (dogfood). Priority: P1 · Status: Partial (P0 done 2026-07-07) · GH: new local scope (no GH # yet). Related prior work: #3830, #3831 (0.8.67 configured-provider manager), #3083 (provider→model handoff), #3385 (live catalog — deferred).

#	Acceptance criterion	Priority	Status
1	Catalog vs picker audit — Together AI missing from /model; audit models_dev.bundled.json / bundled_catalog_offerings() vs picker sources (model_completion_names_for_provider); fix provider/model gaps	P1	Partial — bundled flash rows added; full 13-provider audit done for bundled set
2	Provider section UX — /provider lists configured providers only; press a to add/browse remaining unconfigured providers (full catalog minus configured)	P1	Done (#3830)
3	Model section UX — /model shows models from configured providers only — no more, no less	P1	Done (#3830 + lake)
4	Model search — search matches provider name OR model name (substring across both)	P1	Done (pre-existing)
5	ConfiguredProviderLake facade — single seam over catalog.rs + config auth: configured_providers, models_for_provider, all_catalog_* for expand	P0	Done — crates/tui/src/provider_lake.rs
6	Replace model_completion_names_for_provider consumers — pickers, hotbar, ModelInventory, slash completions, subagent validation	P0	Done — legacy table kept as fallback for unbundled providers
7	Model picker A toggle — ModelListView { Configured, Catalog } parity with /provider	P0	Done
8	Bundled↔picker audit — sync models_dev.bundled.json with picker rows (Together Flash drift vs hardcoded list)	P0	Done — Together/OpenRouter/Novita/SiliconFlow flash rows added (31 offerings)

Likely files: crates/tui/src/tui/model_picker.rs, provider_picker.rs, crates/tui/src/config.rs, crates/config/src/models_dev.rs, crates/config/assets/models_dev.bundled.json, crates/config/src/catalog.rs, crates/tui/src/provider_lake.rs.

Progressive disclosure / provider lake (ethos audit) — 2026-07-07

Source: Agent d7e2f642 ethos audit. Verdict: Mostly aligned (2026-07-07 Wave 5b). Lake = provider_lake.rs + models_dev.bundled.json + configured predicate (#3830). Pickers, hotbar, ModelInventory, slash completions, and subagent hints now read the lake; legacy model_completion_names_for_provider remains fallback for providers not yet in bundled JSON. Live catalog (#3385) still unwired.

Surface	Score	Fix
Provider picker	✅ Aligned	Slim configured rows + catalog model counts via lake
Model picker	✅ Aligned	A expand + catalog lake rows
Fleet roster	⚠️ Partial	Loadout/model pins via lake
Workflow tool schema	✅ Aligned	—
Mode footer (Operate/Multitask)	✅ Aligned	—
Hotbar route slots	✅ Aligned	Lake enumeration
Operate/Multitask prompts	✅ Aligned	Conductor guidance; no catalog leak
ModelInventory / auto-router	✅ Aligned	Lake-backed inventory

P0 fixes

1. ConfiguredProviderLake facade (extend catalog.rs or thin provider_lake.rs) — configured_providers, models_for_provider from merged catalog snapshot, all_catalog_* for A expand.
2. Replace model_completion_names_for_provider consumers — pickers, hotbar, ModelInventory, slash completions, subagent validation (subagent spawn validation done 2026-07-07).
3. Model picker A toggle — ModelListView { Configured, Catalog } + footer hint (parity with provider picker).
4. Bundled↔picker audit — sync models_dev.bundled.json with picker expectations (Together Flash drift).

P1 fixes

1. Provider picker disclosure trim — Configured view: display name + auth chip; move compact_hint internals to detail panel / A catalog view only.
2. Unify bundled_offerings seeds into catalog-derived offerings (remove OFFERING_SEEDS drift).
3. Wire live cache read into lake (refresh async; stale fallback to bundled) — completes #3385 when ready.

Wave alignment: Wave 7 Operate/Multitask ✅ ethos-aligned (thin footer, no catalog leak). Waves 1–4 neutral. Wave 5b P0 done 2026-07-07 (provider_lake.rs, model/provider A toggles, bundled flash sync); P1 live-cache + OFFERING_SEEDS dedupe remain.

Subagent route validation (2026-07-07)

Source: User screenshot — sub-agent failure: Failed: [model] Model error: Model "deepseek-v4-flash" not found (provider 'Sakana AI (Fugu)' …). Priority: P0 · Status: Fixed (local, uncommitted) · Worktree: .cw-worktrees/v0867-pr4047.

Root cause: Sub-agent spawn resolved a DeepSeek-only model id (deepseek-v4-flash) against a different active provider (Sakana AI / Fugu). validate_route (#3227) existed but was #[cfg(test)]-only; inherit/faster routing and permissive requested_model_for_provider let stale operator models or fleet profile pins cross namespaces before the upstream 400.

#	Acceptance criterion	Priority	Status
1	Spawn-time model↔provider validation — ensure_subagent_model_for_provider calls production validate_route before spawn	P0	Done
2	Operator inheritance must not cross namespaces — inherit/faster/auto remap to operator catalog default when parent model is foreign	P0	Done
3	Explicit pins fail fast — fixed model / role override / spawn model= rejected locally with diagnostic naming the pair	P0	Done
4	normalize_requested_subagent_model uses lake + validate_route — not just permissive pass-through	P0	Done

Likely files: crates/tui/src/tools/subagent/mod.rs, crates/tui/src/config.rs, crates/tui/src/core/engine.rs, crates/tui/src/provider_lake.rs.

Tests added: inherit_route_remaps_stale_deepseek_model_for_sakana_provider, faster_route_remaps_stale_deepseek_model_for_sakana_provider, fixed_route_rejects_deepseek_model_for_sakana_provider, normalize_requested_subagent_model_rejects_cross_namespace_for_sakana, validate_route_rejects_mismatched_provider_model_tuple (Sakana case).

Symptom link: screenshot error pairs deepseek-v4-flash with Sakana AI (Fugu) — exactly the #3227 route-isolation contamination class; fix prevents spawn instead of upstream model-not-found.

UI/UX copy slop audit (2026-07-07)

Source: Agent 9a53917c copy-slop audit (worktree v0867-pr4047). Verdict: 18 findings — 7 P1 (same-screen status/mode repetition + foreground shell wait verbosity), 11 P2 (toast vs chip, approval/setup boilerplate). Ethos: Disclose once, not thrice — each fact at one highest-signal layer; drop redundant chrome over rephrasing. Wave: 5c (TUI copy dedupe) — Done 2026-07-07 (original P1 #1–#6 + P2 #7/#8/#9/#10/#12; #17/#18 tracked separately).

#	Location	What repeats	Sev	Suggested fix (dedupe one layer)	Status
1	header.rs:534 + footer.rs:307-314	Mode in header left (Plan/Act/…) and footer left (plan/act/…) simultaneously	P1	Keep mode in one chrome row only (header or footer); footer keeps model/cost/status	Done — footer blanks mode_label
2	header.rs:377-393 + footer_ui.rs:67-97,1127-1146	Header ● Live while footer shows busy / animated working... / tool detail during same turn	P1	Header owns live pulse; footer shows action detail only (tool name, stall reason) — drop coarse busy/working when header streams	Done — header_owns_live_pulse, action-only footer
3	history.rs:808-868	Explore card: header state done/running + summary {N} done, {M} running + per-entry KV prefix done/live	P1	Header = aggregate glyph only; either counts line or per-entry prefixes, not both	Done — multi-entry: glyph header + dot counts, label-only rows
4	agent_card.rs:318-356	Fanout card: header [done]/[running] + dot grid + FanoutCounts ({done} done · {running} running · …)	P1	Drop FanoutCounts when header+grid present; or header shows role/title only, counts line owns status words	Done — counts line removed
5	sidebar.rs:2770-2810 + footer_ui.rs:474-504	Agents panel: N running / M or N done header + rows … is working/… is done while footer may show agents N/M running · …	P1	Footer or sidebar owns fanout summary; rows show name + objective, not status verb	Done — sidebar rows name—objective; footer suppresses when agents panel visible
6	app.rs:3043 + header/footer mode chips	Switched to ACT mode toast while mode already visible in header+footer	P1	Suppress mode-switch toast when mode chips visible; toast only on picker /mode or first session	Done — no status_message on Tab cycle; /mode command message retained
7	history.rs:1525-1539	Workflow run card (Wave 3): header tool_status_label (done/running) + body KV status: <same>	P2	Header owns lifecycle; body shows goal/children/progress only	Done
8	footer_ui.rs:566-578 + tool cards in history.rs	Footer read foo · 2 active · 1 done while transcript cards already show per-tool done/running	P2	Footer = primary running action + elapsed; drop active/done counts	Done — include_counts=false when header streams
9	app.rs:3183-3187 + footer.rs:326-337	Shift+Tab toast Permissions: Ask + footer perm Ask chip	P2	Chip is canonical; drop permission toast (or toast on lock-denial only)	Done
10	app.rs:3157-3165 + header.rs:314-338	Ctrl+T toast Thinking: high + header effort chip ◆ high	P2	Header chip only; toast on first post-migration session only	Done
11	header.rs:396-407 + footer_ui.rs:857-871 + sidebar.rs:3175-3203	Context % in header, optional footer active ctx N%, sidebar context: X/Y tokens … N%	P2	Disclose once: header default; hide sidebar bar when header shows %; footer chip off by default	Open
12	widgets/mod.rs:1595-1617 + en.json:520-522	Approval: per-row [1 / y] + Choose: Enter selected option, or press y/a/d directly + v: full params · Esc: abort	P2	Rows keep key badges; collapse footer to v pager + Esc only	Done
13	mode_picker.rs:102-130 + en.json:484	Modal title Mode + prompt Choose how CodeWhale should operate:	P2	Title carries intent; drop ModePickerPrompt body line	Open
14	en.json:147,151,245,262	Fleet status phrasing repeated: /fleet status, Fleet worker status, Fetching Fleet worker status...	P2	One canonical phrase in slash help; home/quick lines reference command name only	Open
15	en.json:389-422 (setup hints)	Six near-identical Enter records… hints differing only by step noun	P2	Single shared hint template + step-specific one-word action (P/M/R)	Open
16	en.json:494 + app.rs:3102-3106	YOLO deprecation in picker hint and one-shot compat toast	P2	Picker hint for discoverability; suppress repeat toast after first sighting per install	Open
17	history.rs:659-770 (ExecCell::render)	Foreground shell wait: main transcript shows header + command: + live output/artifact paths + separate Ctrl+B line (4+ lines)	P1	Live foreground wait = one header line (▶ run running (Ns) · Ctrl+B → /jobs); command/output/artifacts in Tasks sidebar + /jobs only; Transcript mode keeps full body
18	footer_ui.rs:600-601,831-870 + history.rs compact wait	Footer shell fg: <cmd> + Ctrl+B /jobs duplicates transcript/sidebar shell detail	P2	Footer keeps primary action chip; drop redundant counts (see #8)

Likely files: crates/tui/src/tui/widgets/header.rs, footer.rs, footer_ui.rs, history.rs, agent_card.rs, sidebar.rs, widgets/mod.rs, views/mode_picker.rs, app.rs, crates/tui/locales/en.json.

Acceptance (finding #17 — foreground shell wait): While a foreground exec_shell blocks the turn, the main transcript shows only spinner + running (+ elapsed badge) + Ctrl+B → /jobs. Command line, live stdout, spillover/artifact paths (call_*.txt), and call IDs appear in the Tasks/jobs sidebar scroll and /jobs show detail — not in the live transcript card.

Modes & permissions (Multitask) — Wave 7

Source: Multitask mode design (agent 776bb3c0, 2026-07-07). Priority: P1 · Status: Done (2026-07-07) · Depends on: Wave 3 workflow UX (done), authority baseline (#3386 shipped in 0.8.67).

2026-07-07 correction: Operate AppMode = Fleet operator posture — session /model route is the operator slot (pinned first row in /fleet roster); operator decomposes into workflow/Fleet, workers execute, operator monitors. Multitask = lighter delegation; Operate = full conductor. See prompts/modes/operate.md.

Epic	ID	Acceptance criteria	Status
Tab 4-mode cycle	M1	Tab cycles Plan → Act → Multitask → Operate → Plan; YOLO removed from cycle; /mode + hotbar accept new modes; footer shows Act label for Agent	Done — app.rs CYCLE/CHOICES, footer, hotbar, KEYBINDINGS.md
Permission on Shift+Tab	M2	Shift+Tab cycles Suggest → Auto → Bypass (Ask / Auto-Review / Full Access) with trust/sandbox projection; footer permission chip separate from mode chip; locked while turn running (#2982)	Done — cycle_approval_posture, footer_permission_chip
Thinking on Ctrl+T	M3	Ctrl+T cycles reasoning effort (moved from Shift+Tab); live-transcript overlay relocated (e.g. Ctrl+Shift+T or Alt+T); KEYBINDINGS.md + in-app migration toast	Done (verified 2026-07-07) — ui.rs Ctrl+T/Ctrl+Shift+T, KEYBINDINGS.md; review pass added the missing one-shot Shift+Tab rebinding toast (notify_keybinding_migration_once + test) and fixed stale Ctrl+T doc comments in live_transcript.rs
Multitask mode behavior	M4	multitask.md prompt delta; higher default subagent fan-out; Agents sidebar auto-focus; non-blocking workflow start; operator-vs-worker spawn contract	Done — multitask.md, apply_session_spawn_policy (Multitask→Faster default), mode_delegation_launch_floor, Multitask→Agents sidebar
Operate mode (thin)	M5	Operate AppMode = Fleet operator: session model route, operate.md conductor prompt, workflow run cards, operate_ready hints; full Operation value-stream → 0.9.0	Done — operate.md, SubAgentRuntime.parent_mode, Operate spawn_policy metadata on agent start; full value-stream → 0.9.0
YOLO → permissions migration	M6	--yolo / default_mode=yolo / hotbar mode.yolo map to Agent + ApprovalMode::Bypass via shim; deprecation notice in MODES.md; AppMode::Yolo kept for parse/back-compat only	Done — set_mode shim + one-shot toast

Linked GH:

Issue	Action
#3386	Close — mode/permission untangle shipped 0.8.67 (authority.rs, base_policy_for_mode)
#3387	Close — prompt-as-mode-switch fixed 0.8.67 (#3491)
#3211	Defer full permission profiles + /permissions UX to 0.9.0; M2 ships Shift+Tab chord slice only

Likely files: crates/tui/src/tui/app.rs (AppMode, CYCLE), ui.rs (Tab/Shift+Tab/Ctrl+T), core/authority.rs, prompts/modes/{multitask,operate}.md, widgets/footer.rs, hotbar/actions.rs, tools/subagent/mod.rs, tools/workflow.rs, docs/KEYBINDINGS.md, docs/MODES.md.

Risks:

1. Muscle memory: Shift+Tab (thinking → permission) and Ctrl+T (overlay → thinking) churn — ship one-release migration toast + KEYBINDINGS.md banner.
2. Back-compat: default_mode = "yolo", hotbar mode.yolo, --yolo CLI must keep working via shim through 0.8.68.
3. Operate vs cutover tension: 0.9.0 cutover doc treats Operate as orchestration structure, not AppMode; 0.8.68 Operate is a thin AppMode — document scope boundary.
4. Ctrl+T conflict: live-transcript overlay already binds Ctrl+T — relocation required before thinking migration.

Hotbar (partial — close what's done)

#	Title	Status
2067	Slash commands source	Done — close
2068	MCP tools source	Done 2026-07-07 — McpToolHotbarActionSource, prefill-only dispatch (never executes; agent approval flow untouched); lists enabled-server tools from discovery snapshot
2069	Skills source	Done 2026-07-07 — SkillHotbarActionSource from startup skill cache; dispatch via existing $skill alias
2070	Plugins source	Audited 2026-07-07 → close — no TUI-side plugin registry/snapshot exists; a source would need side-effectful disk scans + config reloads; descriptor stays Deferred with tests enforcing it

---

DEFER (explicitly out of 0.8.68)

Issues	Reason
1890–1897	Refactor epics (workbench, truth surface, slash suite) — 0.9.0+
1754	Shell-aware AI commands — L-sized, cross-cutting
1708	tui_help tool — net-new surface
1682	Output/thinking preview redesign — open-ended UX epic
2342	File click preview — needs product design
4039	Background task phase ledger UI — UX polish
4010, #4012, #4014–#4016	Conductor, topology, lag, context budget, worktree pool — 0.9.0 architecture

---

CLOSE

#	Title	Reason
3324	mosaic-compress promo	Third-party recommendation, no codebase tie-in
1607	More currency units	CNY already implemented (cost_currency = "cny")
1678	Version check + GitHub link	Already exists (UpdateConfig, /links)
1853	Terminal copy line breaks	Documented behavior; /copy + mouse_capture handle it
2067	Hotbar slash source	Implemented in v0867-pr4047

---

WAVES (execution order)

Wave	Theme	Issues / hazards	Owner lane
1	Workflow correctness	H1 completion_from_manager, H2 cancel→VM, H3 budget.spent()	.cw-worktrees/v0867-pr4047/crates/tui/src/tools/workflow.rs
2a	TUI input fairness	#1830, #2317, #1198 foundation	crates/tui/src/tui/ui.rs event loop
2b	TUI P0 hardening	#1338 Windows Enter, #1830 persistence	ui.rs, app.rs
3	Workflow UX	#4038 run view, #4011 journal, #4013 gates	history.rs, workflow.rs, verifier.rs — Done (minimal slices)
4a	Deep-dive security & infra	DD #1, #2, #4, #5, #14, #15, #19–#21, #34, #36–#37, #39–#40, #42	app-server/, execpolicy/, config/, secrets/, cli/, hooks/
4b	Deep-dive core/runtime	DD #10–#13, #16–#18, #23, #25, #33, #50	core/, state/, mcp/, workflow-js/
5	Hotbar + polish	#3380 approval UX, #2068/#2069 adapters	approval.rs, hotbar/actions.rs
5b	Provider/model picker UX + provider lake	Local #1–#8: P0 ConfiguredProviderLake facade, replace model_completion_names_for_provider consumers, model picker A toggle, bundled↔picker audit; P1 configured-only lists, search, disclosure trim	model_picker.rs, provider_picker.rs, config.rs, catalog.rs, provider_lake.rs (new)
5c	TUI copy dedupe	Header/footer mode dup, done×3 on explore/fanout cards, toast vs chip, workflow status KV, approval footer trim (18 findings: P1 #1–#6 done, P2 #7/#8/#9/#10/#12 done)	header.rs, footer.rs, footer_ui.rs, history.rs, agent_card.rs, sidebar.rs, widgets/mod.rs, app.rs — Done 2026-07-07
6	Platform investigate	#1327 FreeBSD, #1675 CJK, #1854 Windows .bat	Platform-specific
7	Modes & permissions (Multitask)	M1–M6 (Tab cycle, Shift+Tab permission, Ctrl+T thinking, Multitask MVP, Operate thin, YOLO shim)	app.rs, ui.rs, authority.rs, prompts/modes/, footer.rs

TUI fix train detail (Wave 2)

1. Commit 1 — Event-loop input fairness (ui.rs — break engine drain every 8–16 events)
2. Commit 2 — #1338 Windows Enter-during-busy hardening
3. Commit 3 — #1198 modal submit error handling (stop swallowing submit_user_input errors)
4. Commit 4 — #1830 periodic recovery snapshot (30–60s while loading)
5. Commit 5 — #2317 queue UX toasts during streaming

---

Control board

Lane	Status	Constraint
Core workflow (#4038, #4011, #4013)	Done — Wave 3	Transcript run cards + .codewhale/workflow-runs.jsonl journal + optional verify completion gates
Workflow hazards (H1–H3)	Verified 2026-07-07 — Wave 1	workflow.rs + vm.rs; cargo test … --locked workflow 20/20, codewhale-workflow 73/73, codewhale-workflow-js pass; regression tests completion_from_manager_fails_closed_when_status_stays_running, workflow_cancel_interrupts_vm_and_blocks_further_spawns, workflow_budget_spent_delegates_to_manager_scope; uncommitted in worktree
TUI stability (#1830, #1338, #1198, #2317)	Done — Wave 2	Input fairness + steer hardening + modal submit + snapshots + queue toasts; verified 2026-07-07 — cargo check -p codewhale-tui --bin codewhale-tui clean; Wave 2 targeted tests 4/4 pass after Wave 7 AppMode::Multitask/Operate match exhaustiveness (status.rs, core.rs, config_ui.rs, header.rs, authority.rs, engine.rs, footer.rs, widgets/mod.rs)
Deep-dive security/infra (DD #1–#5, app-server)	Done — Wave 4A	#1 auth proxy, #2 HTTP status, #4 execpolicy layer, #5 atomic save, #14–#15, #20–#21
Deep-dive core/runtime (DD #10–#18, MCP)	In motion — Wave 4b	Paused jobs, checkpoints, tool timeout
Hotbar adapters (#2068–2070, #3380)	Done 2026-07-07 — Wave 5	#2067 done (close); #2068/#2069 implemented (prefill/skill-alias dispatch); #3380 footer contrast TEXT_MUTED + regression test; #2070 audited → close; cargo test … -- hotbar approval 258/258
Provider/model picker + lake (local #1–#8)	Partial — Wave 5b P0 done	Lake facade + picker wiring + bundled flash sync; P1 live cache + OFFERING_SEEDS dedupe remain — see ethos audit
TUI copy dedupe (copy slop audit)	Done — Wave 5c	P1 #1–#6 + P2 #7/#8/#9/#10/#12 shipped in v0867-pr4047; open P2: context % (#11), mode picker (#13), fleet phrasing (#14), setup hints (#15), YOLO repeat toast (#16), shell footer dup (#18) — see copy slop audit
Platform (#1327, #1675, #1854)	Investigated 2026-07-07 — Wave 6	#1327: already fixed by #2468, reporter-confirmed — close, no action. #1675: no code bug found (stream pipeline is grapheme/width-safe end-to-end); needs live CJK repro — defer 0.9.0. #1854: fix = wt.exe-preferring .bat launcher in release packaging; needs Hunter approval; not a 0.8.68 blocker
Modes & permissions (Multitask, M1–M6)	Done — Wave 7	M1–M6 shipped; Operate = Fleet operator (operate.md + spawn policy); all AppMode match arms exhaustive; close #3386/#3387
Defer/close (#3324, #1890-series)	Done — 15 issues trimmed	Scope reduction

---

Issue inventory (v0.8.68-tagged)

#	Title	Type	Priority	Status
3380	Approval modal key hints more prominent	UX	P2	Done (Wave 5) — footer hints TEXT_HINT→TEXT_MUTED
3324	mosaic-compress library recommendation	Community	—	Close
2342	File preview on click	Enhancement	P3	Defer
2317	Long reply blocks further input	Bug	P1	Wave 2
2070	Hotbar: plugins source (exploratory)	Enhancement	P3	Audit → close
2069	Hotbar: skills source	Enhancement	P2	Done (Wave 5) — SkillHotbarActionSource via $skill alias
2068	Hotbar: MCP tools source	Enhancement	P2	Done (Wave 5) — prefill-only MCP source
2067	Hotbar: slash commands source	Enhancement	P2	Close (done)
2061	Hotbar umbrella	Epic	—	Update checklist
1862	TUI read stuck	Bug	P1	Wave 2
1830	Input freeze / progress loss	Bug	P0	Wave 2
1338	Enter causes GUI crash (Windows)	Bug	P0	Wave 2
1327	FreeBSD dispatch timeout	Bug	P2	Wave 6 investigate
1198	No response on key input	Bug	P1	Wave 2
1165	Settings border rendering (Windows)	Bug	P2	P2 cosmetic — defer if time

---

Deep-dive additions (2026-07-07)

Full report: CODEWHALE_0_8_68_DEEP_DIVE.md

Parallel scouts across all 17 crates + web frontend found 64 numbered items (~75 raw bugs) independent of the 30-issue milestone bucket. Deduped against Waves 1–3:

Wave overlap	Deep-dive #	Tracker link
Wave 1 (workflow correctness)	#3, #8, #9	H1–H3 hazards
Wave 2 (TUI stability)	#6, #7, #45	#1830, #1338, #2317
Wave 3 (workflow UX)	#4038, #4011, #4013	Done — transcript cards, JSONL journal, completion gates

Deep-dive disposition (all 64 items)

#	Sev	Crate	Disposition
1	C	app-server	Done (Wave 4A)
2	C	app-server	Done (Wave 4A)
3	C	tui/workflow	Done (Wave 1, verified 2026-07-07) — fail-closed + regression test
4	C	execpolicy	Done (Wave 4A)
5	C	config	Done (Wave 4A)
6	C	tui	Done (Wave 2 gap-fill 2026-07-07) — restart_detached() un-gated from Windows; Unix stall recovery now restarts pump (ui.rs) + tests
7	C	tui	Done (Wave 2 gap-fill 2026-07-07) — raw-mode probe handshake disables raw mode on abandoned startup probe (ui.rs) + tests
8	H	tui/workflow	Done (Wave 1, verified 2026-07-07) — WorkflowRunController cancels VM + aborts run handle
9	H	tui/workflow	Done (Wave 1, verified 2026-07-07) — budget.spent() wired to manager scope
10	H	core	Done (Wave 4b, verified 2026-07-07) — JobStateStatus::Paused variant + mapping; test paused_job_persists_as_paused_not_running
11	H	core	Done (Wave 4b, verified 2026-07-07) — unarchive refreshes running_threads cache; test unarchive_thread_updates_running_threads_cache
12	H	core	Done (Wave 4b, verified 2026-07-07) — tool_dispatch_timeout() wrapper (300s prod) + timeout error frame; test invoke_tool_returns_timeout_status_for_slow_tools
13	H	mcp	Done (Wave 4b, verified 2026-07-07) — notifications (id-less) get no JSON-RPC response; test jsonrpc_notifications_do_not_require_responses
14	H	execpolicy	Done (Wave 4A)
15	H	secrets	Done (Wave 4A)
16	H	state	Done (Wave 4b, verified 2026-07-07) — checkpoint parse errors propagate; test load_checkpoint_propagates_invalid_state_json
17	H	state/config	Done (Wave 4b, verified 2026-07-07) — ProviderChain::current() no longer indexes empty list; test current_on_empty_chain_returns_default_provider
18	H	state	Done (Wave 4b, verified 2026-07-07) — session index compacts at threshold; test session_index_compacts_after_threshold
19	H	app-server	Done (Wave 4a gap-fill 2026-07-07) — with_graceful_shutdown (ctrl_c + SIGTERM)
20	H	app-server	Done (Wave 4A)
21	H	app-server	Done (Wave 4A)
22	H	tui	Deferred 0.9.0 (2026-07-07) — Wave 2 landed; OSC 52 off main loop is polish
23	H	tui/workflow	Done (Wave 1/4b) — interrupt load Relaxed→Acquire, cancel store SeqCst (vm.rs)
24	H	protocol	Deferred 0.9.0
25	H	app-server	Done (Wave 4b gap-fill 2026-07-07) — child reaped on detached thread; Drop no longer blocks runtime
26	M	core	Deferred 0.9.0
27	M	core	Deferred 0.9.0
28	M	core	Deferred 0.9.0
29	M	execpolicy	Deferred 0.9.0
30	M	mcp	Deferred 0.9.0
31	M	state	Deferred 0.9.0
32	M	state	Deferred 0.9.0
33	M	secrets	Done (Wave 4b gap-fill 2026-07-07) — sync_all before tempfile persist
34	M	app-server	Done (Wave 4a gap-fill 2026-07-07) — constant-time bearer token compare
35	M	app-server	Deferred 0.9.0
36	M	app-server	Done (Wave 4a gap-fill 2026-07-07) — 16 MiB SSE frame bound in stream_turn_events
37	M	app-server	Done (Wave 4a gap-fill 2026-07-07) — stdio shutdown kills runtime child via shutdown_child()
38	M	app-server	Deferred 0.9.0
39	M	cli	Deferred 0.9.0 (2026-07-07) — login provider-switch is a product-behavior decision, not a patch fix
40	M	cli	Deferred 0.9.0 (2026-07-07) — flag validation needs scoping; no crash/security impact
41	M	cli	Deferred 0.9.0 (known plaintext storage)
42	M	hooks	Done (Wave 4a gap-fill 2026-07-07) — 10s reqwest timeout on WebhookHookSink client
43	M	workflow	Deferred 0.9.0
44	M	workflow	Deferred 0.9.0
45	M	tui	Deferred 0.9.0 (2026-07-07) — paste-burst infra untouched by Wave 2; no regression, tuning only
46	M	tui	Deferred 0.9.0
47	M	tui	Deferred 0.9.0
48	M	tui	Deferred 0.9.0
49	M	tui	Already tracked (#1678)
50	M	config	Done (Wave 4b, verified 2026-07-07) — ConfigStore::save uses atomic_write + one-time backup on all platforms
51	M	tools	Deferred 0.9.0
52	L	workflow	Deferred 0.9.0
53	L	workflow	Deferred 0.9.0
54	L	workflow	Deferred 0.9.0
55	L	tui	Already tracked (#1165)
56	L	tui	Already tracked (#1338)
57	L	tui	Already tracked (#1338)
58	L	tui	Deferred 0.9.0
59	L	core	Deferred 0.9.0
60	L	core	Deferred 0.9.0
61	L	web	Deferred 0.9.0
62	L	web	Deferred 0.9.0
63	L	web	Deferred 0.9.0
64	L	web	Deferred 0.9.0

Wave 4 uncovered count: 27 (4 Critical + 15 High + 8 Medium; excludes Wave 1–3 in-motion items and deferred/tracked overlap).

---

OPEN RISKS

1. Full bucket overload: 30 issues is 3–4 weeks; Wave 1–3 is the realistic ship set.
2. Windows conhost cluster: #1338, #1165, #1830 share legacy conhost paths — WT launcher (#1854) mitigates but doesn't fix.
3. Workflow integration test flake: completion_from_manager race likely root cause (H1 fix should deflake).
4. Dogfood gap: v0867-main-dogfood has transcript workflow card polish not in v0867-pr4047 — port before #4038.
5. Deep-dive surface area: 64 new items expand scope beyond the 30-issue bucket; Wave 4 (security + core) is required for a credible ship alongside Waves 1–2.

---

Implementation lane

• Worktree: /Users/hunter/Desktop/Harnesses/CW/.cw-worktrees/v0867-pr4047
• Branch: work/v0.9.0-cutover
• Base version: 0.8.67 (from PR #4047)
• Target version: 0.8.68

Verification gate

cargo fmt --all --check
cargo clippy --workspace --all-features --locked -D warnings
cargo test -p codewhale-tui --bin codewhale-tui --locked
cargo test -p codewhale-workflow --locked javascript
./scripts/release/check-versions.sh

Manual: Win11 Enter-during-busy (#1338), 15+ min turn follow-up (#2317), approval Enter (#1198), /workflow cancel mid-run.

---

Quick-win cutover verification (2026-07-07)

Verified in .cw-worktrees/v0867-pr4047 on work/v0.9.0-cutover. Topology before the quick-win commit: origin/main...HEAD = 0 behind / 9 ahead with origin/main at cdb52ee48 and branch head 883f94df6.

Verified complete in this layer

• S1.1 OpenRouter live parser: parse_openrouter_models_response maps limits, pricing, reasoning support, and modalities into CatalogOffering.
• Provider lake live bridge: refresh_catalog_cache now publishes fresh cache snapshots into provider_lake; the remaining #3385 work is scheduling or invoking refresh from UI/runtime surfaces.
• S3 picker search: provider picker search matches provider name and model ids across configured/catalog views.
• S4 concept-map cleanup: ThreadStatus dedupe, ToolDescriptor rename, Status trait, and MODEL_ALIAS_PRECEDENCE.md are present.
• S5 copy cleanup: verified items 5.1-5.6 plus compact foreground shell wait and stale test copy updates are in this layer; remaining copy items stay open in the audit table.
• S6 perf quick wins: the verified subset is present; do not mark the full perf list complete until the remaining unchecked S6 items are implemented.
• Wave 2 wait-state behavior: streaming Enter queues follow-up; model waiting Enter steers immediately; double-tap still steers while streaming.

Local verification

• cargo fmt --all --check — pass
• cargo clippy --workspace --all-features --locked -- -D warnings ... — pass
• cargo test -p codewhale-tools --locked — pass, 18 tests
• cargo test -p codewhale-tui --bin codewhale-tui --locked --quiet — pass, 5976 passed / 0 failed / 2 ignored
• cargo test -p codewhale-workflow --locked javascript --quiet — pass, 6 tests
• ./scripts/release/check-versions.sh — pass, workspace/npm/lockfile in sync

Still open before merge to main

• Push the quick-win commit to origin/work/v0.9.0-cutover so PR #4099 runs CI on this exact state.
• Check PR #4099 macOS CI after push; the earlier red macOS job ran against the old committed head and is not evidence for or against this quick-win layer.
• Fleet/AgentProfile cutover remains open: Fleet should keep execution durability (manager.rs, ledger.rs, executor.rs, task_spec.rs) while consuming canonical AgentProfiles instead of maintaining a separate loadout/model-class profile system.
• Catalog consumer migration beyond S1.1/S3, Section 2 workflow UI/launch, and unchecked copy/perf items remain open unless separately verified in code.

Last updated: 2026-07-07 after quick-win layer verification and tracker correction.