wehub/stablyai--orca
1
0
Fork 0
Code Issues Pull Requests Actions Deployments Models Agent Notes Packages Projects Releases Wiki Activity
Files
main
stablyai--orca/config/reliability-gates.jsonc
T
wehub-resource-sync e25d789156 chore: import upstream snapshot with attribution
2026-07-13 13:05:33 +08:00

4035 lines
242 KiB
JSON
Raw Permalink Blame History

{
"schemaVersion": 1,
"updatedAt": "2026-07-12",
"policy": {
"maturityLevels": [
"experimental",
"soak",
"blocking",
"accepted-gap",
"deprecated"
],
"blockingPromotion": {
"minimumSoakRuns": 100,
"minimumSoakDays": 14,
"maximumUnexplainedFlakes": 0
}
},
"gates": [
{
"id": "editor.live-log-append-stability",
"title": "Long live session logs retain their Monaco viewport while appending",
"maturity": "experimental",
"protection": "partial",
"owner": "editor-runtime",
"layer": "renderer-electron-contract",
"surfaces": ["Agent Session History View Log", "Monaco external-content reconciliation", "renderer crash containment"],
"platforms": ["macos", "linux", "windows"],
"providers": ["local"],
"coveredPlatforms": ["macos"],
"coveredProviders": ["local"],
"coverageNotes": "Focused tests and real-Monaco 9/50 MiB benchmarks are platform-independent. Local macOS Electron evidence opens a synthetic 9 MiB transcript through Agent Session History at fixed 900x720 viewport, 13px font, 1x zoom, and the measured 2,775,880px legacy-failure geometry, then verifies three five-second-cadence watcher appends with Find open and closed. Live Windows/Linux evidence remains uncollected.",
"motivatingLinks": ["https://github.com/stablyai/orca/pull/8432"],
"invariant": "Append-only external file growth changes only Monaco's model suffix, retaining the viewport, selection, Find state, and renderer liveness above the append point; arbitrary rewrites continue to replace the model content.",
"oracle": "Focused tests assert one post-mount content owner, actual outer lifecycle remount ordering across retained path models, exact end-of-model suffix edits with one model read, no-op equality, and full replacement for non-appends. With Node forced GC, real-Monaco benchmarks alternate 30 suffix and 30 replacement samples after five warmups on fresh equivalent models at 9 and 50 MiB, forcing GC and event-loop settlement between every arm. The Electron scenario alternates an e2e-only legacy setValue red control and the fixed watcher append from restored equivalent model/geometry at the measured legacy-failure cadence, asserting that the control disrupts anchor state while the fixed path preserves visible ranges, selection, complete Find state, scroll offset, renderer survival, and forced-GC heap/native-memory budgets.",
"commands": [
"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/editor/monaco-content-sync.test.ts src/renderer/src/components/editor/MonacoEditor.content-owner.test.tsx src/renderer/src/components/editor/EditorContent.monaco-lifecycle.test.tsx",
"node --expose-gc ./node_modules/vitest/vitest.mjs bench src/renderer/src/components/editor/monaco-content-sync.bench.ts --pool=threads",
"pnpm run test:e2e -- tests/e2e/agent-session-log-tail-stability.spec.ts --workers=1"
],
"testFiles": [
"src/renderer/src/components/editor/monaco-content-sync.test.ts",
"src/renderer/src/components/editor/MonacoEditor.content-owner.test.tsx",
"src/renderer/src/components/editor/EditorContent.monaco-lifecycle.test.tsx",
"src/renderer/src/components/editor/monaco-content-sync.bench.ts",
"tests/e2e/agent-session-log-tail-stability.spec.ts"
],
"assertionRefs": [
{
"file": "src/renderer/src/components/editor/monaco-content-sync.test.ts",
"assertions": [
"append-only drift reads the current model once and inserts only at the previous model end",
"identical content emits no edit and non-append drift retains full replacement plus undo stops",
"a stale retained target model reconciles on mount without explicit undo stops while prior-path content and undo history remain isolated"
]
},
{
"file": "src/renderer/src/components/editor/MonacoEditor.content-owner.test.tsx",
"assertions": ["the Monaco wrapper receives defaultValue and no controlled value prop"]
},
{
"file": "src/renderer/src/components/editor/EditorContent.monaco-lifecycle.test.tsx",
"assertions": ["a same-pane path switch unmounts the prior outer Monaco before real mount reconciliation refreshes the stale target; the prior retained model content and undo sentinel remain untouched"]
},
{
"file": "src/renderer/src/components/editor/monaco-content-sync.bench.ts",
"assertions": ["with forced GC and deterministic settlement between every arm, fresh real-Monaco 9 MiB and 50 MiB models alternate 30 append and 30 replacement samples after five warmups; append p95 stays below 50/100ms and at least 2x faster"]
},
{
"file": "tests/e2e/agent-session-log-tail-stability.spec.ts",
"assertions": [
"production Agent Session History opens a synthetic 9 MiB View Log at the measured 2,775,880px legacy-failure geometry",
"an executable e2e-only legacy setValue control disrupts selection/Find/anchor state at each fixed-geometry five-second sample, then restores the equivalent model state before the fixed arm",
"three alternating watcher suffix appends preserve visible ranges, selection, scroll offset, Find open/query/active-match state, and exact suffix content",
"the renderer remains responsive with no render-process-gone event and forced-GC JS-heap/working-set/private-memory peak and retained budgets hold against paired legacy controls"
]
}
],
"evidenceRuns": [
{
"date": "2026-07-12",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/editor/monaco-content-sync.test.ts src/renderer/src/components/editor/MonacoEditor.content-owner.test.tsx src/renderer/src/components/editor/EditorContent.monaco-lifecycle.test.tsx",
"result": "passed",
"durationSeconds": 5,
"summary": "Focused editor ownership, edit-shape, mount reconciliation, lifecycle-key, and actual same-pane retained-model remount tests passed."
},
{
"date": "2026-07-12",
"runner": "local",
"platform": "macos",
"command": "node --expose-gc ./node_modules/vitest/vitest.mjs bench src/renderer/src/components/editor/monaco-content-sync.bench.ts --pool=threads",
"result": "passed",
"durationSeconds": 75,
"summary": "Forced-GC, settled, alternating fresh-model Monaco p95: 9 MiB append 4.02-5.51ms versus replacement 81.42-83.76ms; 50 MiB append 22.72-26.60ms versus replacement 445.11-449.21ms."
},
{
"date": "2026-07-12",
"runner": "local",
"platform": "macos",
"command": "pnpm run test:e2e -- tests/e2e/agent-session-log-tail-stability.spec.ts --workers=1",
"result": "passed",
"durationSeconds": 78,
"summary": "The production View Log journey alternated retained e2e-only legacy-red controls with fixed appends from restored equivalent state; every control detected instability while the fixed path retained viewport, selection, complete Find state, renderer liveness, and normalized forced-GC/native memory budgets."
}
],
"runtimeBudget": { "p95Seconds": 600, "scope": "local focused renderer tests plus one Electron production-journey scenario" },
"flakeHistory": { "status": "unknown", "evidence": "New deterministic gate with local macOS passes; CI soak history is not yet available." },
"redGreenEvidence": { "status": "complete", "evidence": "The retained Electron gate itself executes the former read-only wrapper setValue behavior behind MODE=e2e at fixed 900x720, 13px, 1x zoom, 2,775,880px content height, and five-second cadence. The control retains a flat incoming value like the former controlled IPC prop. Each legacy arm must disrupt selection, Find active-match state, visible range, or scroll anchor, then restore identical model length/tail/geometry and anchor state before the fixed watcher arm; every fixed arm must preserve them. Production builds never install the control. The original exact-file dev repro also recorded renderer exit code 5." },
"performanceBudget": { "required": true, "evidence": "Every update retrieves the model value once and performs at most one equality-or-prefix comparison; a matching append submits only the suffix. The registered Node command requires --expose-gc and --pool=threads so worker GC is available; alternating fresh real-Monaco arms force GC and deterministic event-loop settlement after every operation. Observed p95 ranges: 9 MiB append 4.02-5.51ms versus replacement 81.42-83.76ms; 50 MiB append 22.72-26.60ms versus replacement 445.11-449.21ms. Electron alternates each legacy replacement control and fixed watcher suffix from equivalent restored model state/geometry, samples forced-GC JS heap plus app.getAppMetrics renderer working set and OS private memory before/after/settled, asserts retained memory within max(20MiB,10%), and requires suffix peak deltas for jsHeapMb, workingSetMb, and privateMb not exceed the paired legacy controls." },
"promotionCriteria": [
"Collect stable soak history on macOS, Linux, and Windows.",
"Accumulate 100 consecutive deterministic gate passes or 14 days without unexplained flakes."
],
"knownGaps": [
"No live Windows or Linux View Log evidence yet."
],
"demotionRule": "Quarantine the Electron scenario if it flakes without a product or harness bug; demote if viewport/Find drift, renderer loss, p95 regression, or memory retention exceeds the registered budgets."
},
{
"id": "terminal-session.snapshot-freshness",
"title": "Stale liveness snapshots cannot close newer PTY bindings",
"maturity": "experimental",
"protection": "partial",
"owner": "terminal-runtime",
"layer": "renderer-unit",
"surfaces": [
"terminal lifecycle",
"dead-session reconciliation",
"tab creation"
],
"platforms": [
"macos",
"linux",
"windows"
],
"providers": [
"local",
"daemon"
],
"coveredPlatforms": [
"macos"
],
"coveredProviders": [],
"coverageNotes": "Local macOS evidence over the reconcile guards that exist on main@1282f5c2d. Broader targeted-hasPty resume paths, no-hot listing counts, and live Electron survival arrive with the pending reliability stack.",
"motivatingLinks": [
"https://github.com/stablyai/orca/issues/6773",
"https://github.com/stablyai/orca/pull/6514",
"https://github.com/stablyai/orca/pull/6796",
"https://github.com/stablyai/orca/pull/6801"
],
"invariant": "A local or daemon liveness snapshot requested before a pane binds a PTY cannot prove that newer binding dead or route it through exit teardown.",
"oracle": "The decision layer rejects reconciliation when ptyBoundAt is greater than or equal to snapshotRequestedAt, still reconciles genuinely absent older local ids, and treats rejected provider listing as unknown.",
"commands": [
"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/terminal-dead-session-reconcile.test.ts"
],
"testFiles": [
"src/renderer/src/components/terminal-pane/terminal-dead-session-reconcile.test.ts"
],
"assertionRefs": [
{
"file": "src/renderer/src/components/terminal-pane/terminal-dead-session-reconcile.test.ts",
"assertions": [
"a newborn pane bound after the snapshot was requested is not reconciled (boundAt >= requestedAt freshness guard)",
"a rejected listSessions is treated as unknown and reconciles nothing",
"remote, SSH, and mid-spawn panes are skipped by the reconcile path",
"targeted liveness probes receive the request timestamp and resolved live-session ids"
]
}
],
"evidenceRuns": [
{
"date": "2026-07-03",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/terminal-dead-session-reconcile.test.ts",
"result": "passed",
"durationSeconds": 1.5,
"summary": "1 test file(s) passed, 17 tests passed on main@1282f5c2d in a clean checkout."
}
],
"runtimeBudget": {
"p95Seconds": 10,
"scope": "local unit test"
},
"flakeHistory": {
"status": "unknown",
"evidence": "Registered after existing targeted tests were found; needs soak history before blocking promotion."
},
"redGreenEvidence": {
"status": "partial",
"evidence": "Unit tests encode the stale snapshot/newborn race and fail if the freshness guard is removed. Needs saved CI or intentional-break artifact before blocking promotion."
},
"performanceBudget": {
"required": true,
"evidence": "The gate itself is cheap. Any PR changing reconciliation loops, hidden-pane scans, or provider polling must also run a terminal throughput or event-loop-delay measurement before blocking promotion."
},
"promotionCriteria": [
"Run in soak for at least 100 consecutive passes or 14 days across required CI platforms.",
"Attach red/green evidence from the freshness guard regression.",
"Add an integration/provider-contract follow-up that proves tab survival plus input/output after stale snapshot release."
],
"knownGaps": [
"Current command asserts the pure decision and orchestration timestamp forwarding, not a full Electron tab-survival/input echo flow.",
"SSH and remote providers are intentionally unknown-liveness paths and need separate provider-contract gates."
],
"demotionRule": "Demote or quarantine if the gate flakes once without a product bug or harness bug filed to the owner."
},
{
"id": "terminal-session.kill-all-surface-cleanup",
"title": "Kill all sessions removes only the confirmed terminal surfaces and current bindings",
"maturity": "experimental",
"protection": "partial",
"owner": "terminal-runtime",
"layer": "renderer-main-contract",
"surfaces": [
"terminal lifecycle",
"terminal tab cleanup",
"PTY shutdown",
"Manage Sessions",
"Resource Manager"
],
"platforms": [
"macos",
"linux",
"windows"
],
"providers": [
"local",
"daemon",
"ssh",
"wsl",
"remote-runtime",
"mobile-relay"
],
"coveredPlatforms": [
"macos"
],
"coveredProviders": [
"local",
"daemon",
"ssh"
],
"coverageNotes": "Local macOS deterministic evidence covers the renderer snapshot/coordinator, exact local and SSH-shaped PTY request settlement, active-last and pinned terminal-tab routing, component-unmount continuation, and the existing current/legacy daemon management contract. Windows Electron process absence, live SSH/WSL behavior, and remote-runtime/mobile host completion remain explicit gaps.",
"motivatingLinks": [
"https://github.com/stablyai/orca/issues/8001"
],
"invariant": "Every terminal surface confirmed in the invoking renderer is force-closed exactly once after daemon management settles, later-created surfaces and non-terminal tabs survive, and exact shutdown requests are limited to deduplicated current non-runtime PTY bindings of the confirmed surfaces.",
"oracle": "Snapshot terminal entity IDs before the first await; mutate ownership, active selection, bindings, and tab presence while daemon management is pending; then assert only the immutable targets disappear from both terminal stores, active targets close last with valid editor/browser/deactivated post-state, every captured exact PTY promise settles before callbacks, and no provider inventory sweep or late-tab kill occurs.",
"commands": [
"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/shared/kill-all-terminal-surfaces.test.ts src/renderer/src/components/shared/useDaemonActions.test.tsx src/renderer/src/components/terminal/terminal-tab-actions-kill-all.test.ts src/main/ipc/pty-management.test.ts"
],
"testFiles": [
"src/renderer/src/components/shared/kill-all-terminal-surfaces.test.ts",
"src/renderer/src/components/shared/useDaemonActions.test.tsx",
"src/renderer/src/components/terminal/terminal-tab-actions-kill-all.test.ts",
"src/main/ipc/pty-management.test.ts"
],
"assertionRefs": [
{
"file": "src/renderer/src/components/shared/kill-all-terminal-surfaces.test.ts",
"assertions": [
"snapshot deduplicates legacy, unified-only, split, multi-worktree, and floating terminal surfaces while excluding editor tabs",
"cleanup-time moves, active-worktree switches, rebinding, missing targets, and later-created tabs preserve the confirmation boundary and active-last order",
"current exact PTY bindings are deduplicated, remote runtime IDs and stale/late bindings are excluded, and all per-PTY settlements finish before completion",
"the production dependency path calls daemon management exactly once and never invokes listSessions for a post-kill sweep",
"management rejection and per-close/provider failures do not stop remaining cleanup and produce bounded count/latency diagnostics",
"a real 100-tab Zustand fixture records 100 close attempts and exact kills, at least 100 writes, 49 event-loop yields, and no close batch over 50 ms"
]
},
{
"file": "src/renderer/src/components/shared/useDaemonActions.test.tsx",
"assertions": [
"the hook snapshots before onKillAllStart and before coordinator work",
"unmounting the invoking component does not revoke cleanup while React callbacks remain mount-gated",
"error and settled callbacks run only after coordinator settlement",
"closed terminal tabs report success instead of the no-sessions informational state when daemon management reports zero"
]
},
{
"file": "src/renderer/src/components/terminal/terminal-tab-actions-kill-all.test.ts",
"assertions": [
"force closes pinned terminals without a second confirmation",
"closing the last active terminal preserves and activates editor or browser content, otherwise deactivates without auto-spawn"
]
},
{
"file": "src/main/ipc/pty-management.test.ts",
"assertions": [
"killAll fires one shutdown for each initial daemon session and polls those initial IDs until empty",
"freshly respawned session IDs are excluded from remainingCount",
"per-session shutdown rejection does not stop the daemon batch and refused initial sessions remain reported"
]
}
],
"evidenceRuns": [
{
"date": "2026-07-09",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/shared/kill-all-terminal-surfaces.test.ts src/renderer/src/components/shared/useDaemonActions.test.tsx src/renderer/src/components/terminal/terminal-tab-actions-kill-all.test.ts src/main/ipc/pty-management.test.ts",
"result": "passed",
"durationSeconds": 1.31,
"summary": "4 test files and 27 tests passed locally, including the existing daemon handler contract and a real 100-terminal Zustand cleanup fixture."
}
],
"runtimeBudget": {
"p95Seconds": 10,
"scope": "focused renderer/main unit and performance-count tests"
},
"flakeHistory": {
"status": "unknown",
"evidence": "The focused 27-test slice passed locally once; it needs CI and soak history before promotion."
},
"redGreenEvidence": {
"status": "partial",
"evidence": "The initial 100-tab implementation exposed a 145.82 ms close batch and failed the 50 ms budget; two-close event-loop batching reduced the focused run below the budget. Saved CI artifacts and intentional-break evidence for the confirmation-boundary assertions are still needed."
},
"performanceBudget": {
"required": true,
"evidence": "The coordinator performs one existing management call, zero provider inventory sweeps, one close per present unique target, and at most one exact kill per unique current non-runtime PTY binding. A real 100-tab Zustand fixture asserts 100 close attempts, 100 exact kill calls, at least 100 store writes, 49 event-loop yields, and a maximum two-close batch at or below 50 ms."
},
"promotionCriteria": [
"Run the focused gate for at least 100 consecutive passes or 14 days across required CI platforms.",
"Attach Windows Electron evidence for both entry points, empty and established terminals, later-tab survival, xterm removal, and initial PTY absence after settlement.",
"Exercise the SSH fixture and WSL when available, or keep their live process-absence gaps explicit.",
"Propagate and align runtime-host tab-close completion before claiming verified remote-runtime shutdown."
],
"knownGaps": [
"Windows Electron screenshots and live process/xterm absence evidence were not produced by this local macOS run.",
"Live SSH and WSL process absence, Linux local/daemon behavior, and mobile/relay shutdown remain unproved.",
"Runtime-host terminal close is best-effort because closeTerminalTab still discards the existing async host result and its close-intent lifetime is shorter than the possible RPC flow.",
"Daemon adapter listing failures remain suppressed by the existing management API, so reported daemon counts are not authoritative verification of every process."
],
"demotionRule": "Keep experimental or demote to protection none if the gate flakes, permits a late-created tab or unrelated PTY to close, or exceeds the 50 ms maximum close-batch budget without a tracked product or harness bug."
},
{
"id": "terminal-session.startup-cwd-missing-dir-recovery",
"title": "Fresh local terminal creation cannot be bricked by a deleted startup cwd",
"maturity": "experimental",
"protection": "partial",
"owner": "terminal-runtime",
"layer": "shared-main-renderer-contract",
"surfaces": [
"terminal lifecycle",
"tab creation",
"PTY spawn",
"startup cwd persistence"
],
"platforms": [
"macos",
"linux",
"windows",
"mobile"
],
"providers": [
"local",
"daemon",
"ssh",
"wsl",
"remote-runtime"
],
"coveredPlatforms": [
"macos"
],
"coveredProviders": [
"local",
"ssh",
"remote-runtime"
],
"coverageNotes": "Local macOS evidence covers the shared missing-dir fallback policy, main pty:spawn recovery and metadata, no-flag and reattach strictness, renderer IPC flag routing, SSH-tagged and remote-runtime omission, and the visibility-gated terminal notice. Daemon shares the same pre-provider main cwd decision but lacks a live daemon-provider run; WSL UNC paths are exempt from the probe by design and lack a live run; Linux/Windows and mobile/API strictness are gaps.",
"motivatingLinks": [
"https://github.com/stablyai/orca/issues/7239",
"https://github.com/stablyai/orca/pull/7750",
"https://github.com/stablyai/orca/pull/7678"
],
"invariant": "A fresh local renderer terminal spawn may recover from a saved startup cwd whose directory no longer exists only by spawning at the selected workspace root and printing a generic in-terminal notice; existing directories — including ones outside the worktree (#7685) — spawn as requested, and reattach, SSH, remote-runtime, runtime/API, and mobile callers keep exact cwd semantics.",
"oracle": "The shared resolver falls back to the workspace root only when the injected existence probe reports the resolved cwd missing and the workspace root present, and never probes floating terminals or a cwd equal to the root. The renderer sends cwdFallback only for fresh local IPC spawns, main honors it only when connectionId and sessionId are absent, WSL UNC paths never engage the probe-based fallback, main returns fallback metadata only after an actual fallback, the IPC transport preserves that metadata, and the connection layer writes a generic notice that omits the missing path.",
"commands": [
"pnpm exec vitest run --config config/vitest.config.ts src/shared/terminal-startup-cwd.test.ts",
"pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/pty.test.ts",
"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/pty-transport.test.ts",
"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/pty-connection.test.ts"
],
"testFiles": [
"src/shared/terminal-startup-cwd.test.ts",
"src/main/ipc/pty.test.ts",
"src/renderer/src/components/terminal-pane/pty-transport.test.ts",
"src/renderer/src/components/terminal-pane/pty-connection.test.ts"
],
"assertionRefs": [
{
"file": "src/shared/terminal-startup-cwd.test.ts",
"assertions": [
"a missing requested cwd falls back to the workspace root and reports the missing path to the callback",
"existing cwds — nested or outside the worktree (#7685) — are never remapped",
"no fallback happens when the workspace root is missing too",
"floating terminal cwds and root-equal requests are never probed",
"non-ASCII worktree roots and folder workspace roots are recovered verbatim"
]
},
{
"file": "src/main/ipc/pty.test.ts",
"assertions": [
"local pty:spawn with cwdFallback worktree spawns at the worktree root when the saved cwd is missing and returns fallback metadata",
"a missing cwd without the flag still surfaces the provider's missing-directory error",
"an existing outside-worktree cwd spawns as requested without fallback metadata",
"session reattach spawns ignore the fallback flag and keep exact cwd semantics"
]
},
{
"file": "src/renderer/src/components/terminal-pane/pty-transport.test.ts",
"assertions": [
"IPC transport sends cwdFallback only for local fresh spawns",
"SSH-tagged and session reattach spawns omit cwdFallback",
"IPC transport returns startup cwd fallback metadata to the connection layer"
]
},
{
"file": "src/renderer/src/components/terminal-pane/pty-connection.test.ts",
"assertions": [
"fresh local IPC worktree spawns are marked with cwdFallback worktree",
"startup cwd fallback metadata prints a generic in-terminal notice",
"remote-runtime worktree spawns are not marked with cwdFallback"
]
}
],
"evidenceRuns": [
{
"date": "2026-07-08",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/shared/terminal-startup-cwd.test.ts",
"result": "passed",
"durationSeconds": 0.2,
"summary": "1 test file passed, 21 tests passed; covers the missing-dir fallback policy, #7685 outside-worktree preservation, and root-missing/floating exemptions."
},
{
"date": "2026-07-08",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/pty.test.ts",
"result": "passed",
"durationSeconds": 0.9,
"summary": "1 test file passed, 225 tests passed; covers main pty:spawn recovery, fallback metadata, and no-flag/reattach provider-error strictness."
},
{
"date": "2026-07-08",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/pty-transport.test.ts",
"result": "passed",
"durationSeconds": 0.4,
"summary": "1 test file passed, 58 tests passed; covers cwdFallback forwarding only for local fresh spawns and metadata handoff."
},
{
"date": "2026-07-08",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/pty-connection.test.ts",
"result": "passed",
"durationSeconds": 6.5,
"summary": "1 test file passed, 341 tests passed; covers local IPC marking, the generic terminal fallback notice, and remote-runtime omission."
}
],
"runtimeBudget": {
"p95Seconds": 30,
"scope": "focused unit and IPC contract tests"
},
"flakeHistory": {
"status": "unknown",
"evidence": "New experimental gate added with local deterministic evidence only; needs CI soak before promotion."
},
"redGreenEvidence": {
"status": "partial",
"evidence": "The main IPC missing-cwd tests fail with the provider's 'Working directory ... does not exist.' error when the fallback is removed and pass with it. Full live Electron reproduction from a production persisted session is not captured."
},
"performanceBudget": {
"required": true,
"evidence": "The runtime change adds at most two statSync probes on the fresh-local spawn path (the provider already stats the same paths during validation) and one bounded terminal write only when fallback actually occurs; no polling, provider listing, hidden-pane work, startup awaits, subprocesses, or render-loop work was added."
},
"promotionCriteria": [
"Attach CI evidence for all declared test files.",
"Add a live Electron regression that opens a local terminal whose persisted startupCwd was deleted and proves visible shell input/output at the workspace root.",
"Add WSL/mobile/API provider-contract coverage or explicitly narrow their risk scope."
],
"knownGaps": [
"No live Electron fixture seeds a persisted tab whose startupCwd directory was deleted.",
"Daemon coverage is via the shared pre-provider main cwd decision, not a live daemon provider spawn.",
"WSL UNC paths bypass the probe by design and have no live existence-recovery run; Linux, Windows, and mobile/API strictness are not directly exercised."
],
"demotionRule": "Demote or quarantine if the gate flakes without a product bug, if an existing directory is ever remapped away from the requested cwd, or if a reattach/remote/API caller can engage the fallback."
},
{
"id": "agent-status.pi-hook-liveness",
"title": "Pi status hooks cannot stall a turn or complete a live runtime",
"maturity": "experimental",
"protection": "partial",
"owner": "agent-session",
"layer": "main-provider-contract",
"surfaces": [
"Pi and OMP managed extensions",
"agent status hooks",
"runtime reload and session replacement",
"loopback restart and stall recovery"
],
"platforms": [
"macos",
"linux",
"windows"
],
"providers": [
"local",
"daemon",
"ssh",
"wsl",
"remote-runtime"
],
"coveredPlatforms": [
"macos"
],
"coveredProviders": [],
"coverageNotes": "Local macOS execution of the generated Pi/OMP extension plus the shared hook normalizer. WSL fallback behavior is covered with mocked native-fetch failure and Windows curl handoff. Daemon PTYs use the same generated extension without a distinct delivery path. SSH/relay ingest uses the shared normalizer, but no live remote Pi process is exercised.",
"motivatingLinks": [
"https://github.com/stablyai/orca/issues/7791",
"https://github.com/stablyai/orca/pull/7802",
"https://github.com/stablyai/orca/pull/7838"
],
"invariant": "Orca status reporting must return synchronously from every Pi/OMP extension handler, retain at most one active request and one latest pending snapshot, and abandon stalled loopback delivery within one second. A Pi session_shutdown event cannot mark a turn done because Pi also emits it for reload, new, resume, and fork while the PTY remains alive; only agent_end proves turn completion, while real process exit is cleared by PTY teardown.",
"oracle": "Execute the generated extension with a fetch that remains pending and assert the Pi handler returns before delivery; emit three statuses during the stall and assert exactly one request is active and only the latest pending status is sent next; advance fake time by one second and assert the active signal aborts and the latest status proceeds. Through the shared normalizer, assert session_shutdown yields no status while agent_end still yields done.",
"commands": [
"pnpm exec vitest run --config config/vitest.config.ts src/main/pi/agent-status-extension-source.test.ts src/main/agent-hooks/server.test.ts --maxWorkers=1"
],
"testFiles": [
"src/main/pi/agent-status-extension-source.test.ts",
"src/main/agent-hooks/server.test.ts"
],
"assertionRefs": [
{
"file": "src/main/pi/agent-status-extension-source.test.ts",
"assertions": [
"a pending loopback fetch does not keep the Pi event handler unresolved",
"three events during a stall produce one active request and one request for only the latest pending status",
"the one-second delivery deadline aborts the active request and advances the latest pending status",
"the managed status extension does not register session_shutdown as a completion event",
"WSL native-fetch failures still hand off to a detached Windows curl process"
]
},
{
"file": "src/main/agent-hooks/server.test.ts",
"assertions": [
"session_shutdown normalizes to no status instead of done",
"agent_end remains the authoritative Pi/OMP done event"
]
}
],
"evidenceRuns": [
{
"date": "2026-07-11",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/main/pi/agent-status-extension-source.test.ts src/main/agent-hooks/server.test.ts --maxWorkers=1",
"result": "passed",
"durationSeconds": 1.3,
"summary": "2 files and 238 tests passed, including executed generated-extension liveness, latest-only queue bounds, timeout abort, WSL fallback, and Pi shutdown normalization."
}
],
"runtimeBudget": {
"p95Seconds": 10,
"scope": "generated-extension and shared-normalizer unit gate"
},
"flakeHistory": {
"status": "unknown",
"evidence": "New deterministic gate with local fake-receiver and fake-timer evidence; needs CI soak before promotion."
},
"redGreenEvidence": {
"status": "partial",
"evidence": "Before the fix, the pending-fetch handler assertion remained false and session_shutdown normalized to done (2 focused failures, 233 passes). With the fix, both pass; the bounded count and deadline assertions additionally fail if latest-only coalescing or the timeout is removed. Needs saved CI evidence before blocking promotion."
},
"performanceBudget": {
"required": true,
"evidence": "Every Pi event does O(1) work and returns without awaiting I/O. Delivery retains at most one active request plus one latest pending object, uses one unref'd timer per active request, and creates no polling, provider scans, subprocesses outside the existing WSL failure fallback, or renderer work. The deterministic burst test proves three stalled events retain two delivery slots rather than an event-count-sized queue."
},
"promotionCriteria": [
"Run in soak for at least 100 consecutive passes or 14 days across required CI platforms.",
"Attach saved red/green evidence for both the unresolved-handler and false-done regressions.",
"Add a live Pi Electron test that stalls or restarts the hook listener during a running turn and proves terminal output continues."
],
"knownGaps": [
"No live model-backed Pi turn or Electron Running-view assertion is automated; the gate executes the exact generated extension and shared normalizer below those surfaces.",
"An already-running Pi process keeps its previously loaded extension until Pi reloads or restarts.",
"During receiver unavailability, intermediate status details may be coalesced to the latest snapshot; this is intentional and bounded, but no UI test measures the temporary detail loss.",
"SSH/remote and Windows are not exercised with live providers; relay ingest shares normalization and WSL fallback has mocked contract coverage."
],
"demotionRule": "Demote or quarantine if the gate flakes without a product or harness bug, if a Pi handler can again await receiver I/O, or if coalescing allows an older status to overwrite a newer one."
},
{
"id": "agent-session.provider-ownership",
"title": "Provider sessions are resumed once per workspace ownership claim",
"maturity": "experimental",
"protection": "partial",
"owner": "agent-session",
"layer": "renderer-state",
"surfaces": [
"agent launch",
"workspace activation",
"sleep and hibernate restore",
"provider session dedupe",
"sidebar and mobile identity"
],
"platforms": [
"macos",
"linux",
"windows"
],
"providers": [
"local",
"daemon",
"ssh",
"wsl",
"remote-runtime"
],
"coveredPlatforms": [
"macos"
],
"coveredProviders": [],
"coverageNotes": "Local macOS evidence over the ownership/dedupe suite on main@1282f5c2d. Queued/pending resume-claim indexing, same-session and wrong-session hook proofs, and Electron repeat-activation coverage arrive with the pending stack (#7008).",
"motivatingLinks": [
"https://github.com/stablyai/orca/pull/6800",
"https://github.com/stablyai/orca/pull/5240",
"https://github.com/stablyai/orca/pull/6411",
"https://github.com/stablyai/orca/pull/6833"
],
"invariant": "Workspace activation, launch, restore, sleep, hibernate, dedupe, clearing, and reconnect code must not replay or resume a provider session id already owned, queued, pending, or live in that workspace.",
"oracle": "The current renderer-state slice asserts provider-session claim keys are owned by preserved active tabs, inactive split leaves, visible non-focused split groups, live records, quit records, worktree-sleep records, queued startup payloads, time-bounded resume bridge claims, and same-session live hook evidence; duplicates clear without launching a second resume command. The provider list is the risk scope, not proof that every provider has a live integration gate.",
"commands": [
"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/lib/resume-sleeping-agent-session.test.ts"
],
"testFiles": [
"src/renderer/src/lib/resume-sleeping-agent-session.test.ts"
],
"assertionRefs": [
{
"file": "src/renderer/src/lib/resume-sleeping-agent-session.test.ts",
"assertions": [
"preserved panes claim their provider session and only stale duplicates are cleared",
"one launch per provider session: skipped duplicates are cleared instead of relaunched",
"active stable-pane records owned by preserved or visible panes are not resumed again",
"hibernated stable panes with cleared live PTY bindings are skipped"
]
}
],
"evidenceRuns": [
{
"date": "2026-07-03",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/lib/resume-sleeping-agent-session.test.ts",
"result": "passed",
"durationSeconds": 1.9,
"summary": "1 test file(s) passed, 30 tests passed on main@1282f5c2d in a clean checkout."
}
],
"runtimeBudget": {
"p95Seconds": 15,
"scope": "local renderer state test"
},
"flakeHistory": {
"status": "unknown",
"evidence": "Registered after targeted tests were found; needs soak history before blocking promotion."
},
"redGreenEvidence": {
"status": "partial",
"evidence": "Tests encode provider-session dedupe and ownership claims across active/inactive/visible split records, queued pendingStartupByTabId resume payloads, time-bounded runtime automaticAgentResumeClaimsByTabId bridge claims, live same-session hook evidence, wrong-session hook rejection, and a bounded queued-claim index over many records/tabs. Needs saved red/green artifact for the class-level replay invariant."
},
"performanceBudget": {
"required": true,
"evidence": "Current state tests are cheap and assert queued pending-startup provider-session ids are indexed once per activation. PRs adding new ownership scans must show bounded work over records and no hidden-pane wake loop before blocking promotion."
},
"promotionCriteria": [
"Run in soak for at least 100 consecutive passes or 14 days across required CI platforms.",
"Add bounded-work assertions for delayed hook/status ownership scans if those paths grow.",
"Attach red/green evidence that display/replay evidence alone cannot claim ownership."
],
"knownGaps": [
"Providers listed on this gate are affected identity surfaces; the current executable command is renderer-state coverage, not live local/daemon/SSH/WSL/remote-runtime coverage.",
"Current command models live same-session and wrong-session hook evidence, but does not run the real hook timing through Electron.",
"Current command does not run a real workspace activation loop repeatedly through Electron."
],
"demotionRule": "Demote or quarantine if failures are non-actionable or if a duplicate resume escape occurs outside the modeled matrix."
},
{
"id": "terminal-geometry.visible-convergence",
"title": "Visible desktop terminals converge across xterm, fit, PTY, shell, and runtime mirror size",
"maturity": "experimental",
"protection": "partial",
"owner": "terminal-rendering",
"layer": "renderer-provider-contract",
"surfaces": [
"PTY sizing",
"split layout",
"restore",
"hidden-to-visible transitions"
],
"platforms": [
"macos",
"linux",
"windows"
],
"providers": [
"local",
"daemon",
"ssh",
"remote-runtime"
],
"coveredPlatforms": [
"macos"
],
"coveredProviders": [],
"coverageNotes": "Local macOS evidence on main@1282f5c2d, including #7192's runtime-mirror geometry authority slice. Shell-visible size, SSH/remote geometry, Windows ConPTY readback, and resume-time reassertion coverage arrive with the pending stack and #7006.",
"motivatingLinks": [
"https://github.com/stablyai/orca/pull/6644",
"https://github.com/stablyai/orca/pull/6649",
"https://github.com/stablyai/orca/pull/6725",
"https://github.com/stablyai/orca/pull/6785",
"https://github.com/stablyai/orca/pull/6853",
"https://github.com/stablyai/orca/pull/6939",
"https://github.com/stablyai/orca/pull/7192"
],
"invariant": "A visible desktop-owned terminal cannot trust 0x0, stale requested size, or renderer-only size; xterm, fit/proposed size, applied PTY size, shell-visible size, and the runtime mirror's parse dimensions must converge or enter explicit degraded state, and mirror resize reflow must stay ordered with queued output writes.",
"oracle": "The current executable slice uses deterministic frame schedulers and fake providers to force 0x0 first fit, delayed layout settle, dropped resize/readback drift, and hidden-to-visible activation, then asserts the renderer forwards a usable size, pty:getSize reports applied rather than merely requested size where available, and visibility resume reasserts real drift without hot listSessions. Shell-visible stty/echo-wrap convergence remains a live-gate follow-up.",
"commands": [
"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/pty-size-reconcile.test.ts src/renderer/src/components/terminal-pane/split-right-white-screen.test.ts src/main/ipc/pty.test.ts src/main/runtime/orca-runtime.test.ts"
],
"testFiles": [
"src/renderer/src/components/terminal-pane/pty-size-reconcile.test.ts",
"src/renderer/src/components/terminal-pane/split-right-white-screen.test.ts",
"src/main/ipc/pty.test.ts",
"src/main/runtime/orca-runtime.test.ts"
],
"assertionRefs": [
{
"file": "src/renderer/src/components/terminal-pane/pty-size-reconcile.test.ts",
"assertions": [
"hidden delayed narrow settle is forwarded instead of stopping on a fixed frame budget",
"unmeasurable frames do not count as settled",
"applied-size readback divergence is re-forwarded before handoff"
]
},
{
"file": "src/renderer/src/components/terminal-pane/split-right-white-screen.test.ts",
"assertions": [
"0x0 split-right spawn recovers when the container becomes measurable",
"visible permanently-unmeasurable 0x0 pane gets a nonzero safe fallback",
"hidden 0x0 background spawn is not forced to phantom desktop size"
]
},
{
"file": "src/main/ipc/pty.test.ts",
"assertions": [
"accepted desktop resizes fan out to the runtime after provider resize",
"rejected desktop resizes do not fan out to the runtime"
]
},
{
"file": "src/main/runtime/orca-runtime.test.ts",
"assertions": [
"the headless mirror resizes after an accepted desktop PTY resize (#7192)",
"headless mirror resizes are ordered behind queued PTY writes (#7192)"
]
}
],
"evidenceRuns": [
{
"date": "2026-07-03",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/pty-size-reconcile.test.ts src/renderer/src/components/terminal-pane/split-right-white-screen.test.ts src/main/ipc/pty.test.ts src/main/runtime/orca-runtime.test.ts",
"result": "passed",
"durationSeconds": 8.4,
"summary": "4 test file(s) passed, 777 tests passed on main@1282f5c2d in a clean checkout."
}
],
"runtimeBudget": {
"p95Seconds": 60,
"scope": "provider-contract or focused Electron test"
},
"flakeHistory": {
"status": "unknown",
"evidence": "Deterministic Vitest slices passed locally; no CI soak history yet."
},
"redGreenEvidence": {
"status": "partial",
"evidence": "#7192 proved the mirror slice red before its fix (snapshot stayed 80x24, queued write parsed at the wrong width). The renderer 0x0/settle slices do not have recorded red runs."
},
"performanceBudget": {
"required": true,
"evidence": "Must include resize/throughput budget so convergence loops do not add frame or SIGWINCH churn."
},
"promotionCriteria": [
"Build deterministic fault hooks before adding broad E2E coverage.",
"Keep stress variants non-blocking until runtime and flake history are known."
],
"knownGaps": [
"No live Electron geometry command yet beyond the local live PTY resize slice.",
"The runtime mirror geometry slice is unregistered: #7192's red tests (orca-runtime.test.ts headless-mirror resize and ordering, pty.test.ts desktop resize fan-out) exist on fresh main but not at this branch's merge-base, so they can only be registered during the rebase.",
"Does not yet prove shell-visible size, provider-applied size, and xterm size converge across SSH/remote paths.",
"Does not yet prove Windows ConPTY geometry/readback.",
"Current command uses deterministic fake providers for the main/renderer contracts, not a real remote PTY."
],
"demotionRule": "Cannot promote without deterministic oracle and runtime history."
},
{
"id": "xterm-addon.boundary-containment",
"title": "xterm addon failures stay pane-scoped and input survives",
"maturity": "experimental",
"protection": "partial",
"owner": "terminal-rendering",
"layer": "renderer-unit",
"surfaces": [
"terminal search",
"links",
"WebGL",
"decorations",
"keyboard navigation"
],
"platforms": [
"macos",
"linux",
"windows"
],
"providers": [
"local",
"daemon",
"ssh",
"remote-runtime"
],
"coveredPlatforms": [
"macos"
],
"coveredProviders": [],
"coverageNotes": "Local macOS evidence over the WebGL/link/search containment suites on main@1282f5c2d, adopting the #6949 atlas-recovery rename and #7133's reveal hardening tests. Core addon-load throw containment and live typed-input survival arrive with #7004 and a live follow-up.",
"motivatingLinks": [
"https://github.com/stablyai/orca/pull/6852",
"https://github.com/stablyai/orca/pull/6872",
"https://github.com/stablyai/orca/pull/6855"
],
"invariant": "Search, link, WebGL, decoration, input-protocol, or keyboard-navigation errors must not unmount the terminal surface, crash React/window, break focus, or stop PTY input/output.",
"oracle": "The current executable slice injects a core addon load throw and asserts pane opening continues through later addons, covers link provider throws as pane-scoped no-link results, covers search decoration positive-integer failures as false results instead of renderer crashes, and covers WebGL attach/refresh/recovery containment. Focused typed input echo after addon failure still needs a live/component follow-up.",
"commands": [
"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/lib/pane-manager/terminal-link-provider-guard.test.ts src/renderer/src/components/terminal-search-safe-find.test.ts src/renderer/src/lib/pane-manager/pane-webgl-refresh-lifecycle.test.ts src/renderer/src/components/terminal-pane/terminal-webgl-atlas-recovery.test.ts src/renderer/src/lib/pane-manager/pane-webgl-context-recovery.test.ts src/renderer/src/lib/pane-manager/pane-webgl-renderer.test.ts src/renderer/src/lib/pane-manager/pane-reveal-repaint.test.ts src/renderer/src/components/terminal-pane/terminal-visibility-resume.test.ts"
],
"testFiles": [
"src/renderer/src/lib/pane-manager/terminal-link-provider-guard.test.ts",
"src/renderer/src/components/terminal-search-safe-find.test.ts",
"src/renderer/src/lib/pane-manager/pane-webgl-refresh-lifecycle.test.ts",
"src/renderer/src/components/terminal-pane/terminal-webgl-atlas-recovery.test.ts",
"src/renderer/src/lib/pane-manager/pane-webgl-context-recovery.test.ts",
"src/renderer/src/lib/pane-manager/pane-webgl-renderer.test.ts",
"src/renderer/src/lib/pane-manager/pane-reveal-repaint.test.ts",
"src/renderer/src/components/terminal-pane/terminal-visibility-resume.test.ts"
],
"assertionRefs": [
{
"file": "src/renderer/src/lib/pane-manager/terminal-link-provider-guard.test.ts",
"assertions": [
"link-provider throws are reproduced and contained without escaping the surface"
]
},
{
"file": "src/renderer/src/components/terminal-search-safe-find.test.ts",
"assertions": [
"the xterm positive-integers decoration crash is swallowed while unrelated errors re-throw"
]
},
{
"file": "src/renderer/src/lib/pane-manager/pane-webgl-refresh-lifecycle.test.ts",
"assertions": [
"WebGL teardown/refresh lifecycle stays pane-scoped and cancels on dispose"
]
},
{
"file": "src/renderer/src/components/terminal-pane/terminal-webgl-atlas-recovery.test.ts",
"assertions": [
"risky-output atlas recovery is bounded, coalesced, and survives a throwing manager"
]
},
{
"file": "src/renderer/src/lib/pane-manager/pane-webgl-context-recovery.test.ts",
"assertions": [
"failed attach backs off and context-lost panes recover on the next rendering resume"
]
},
{
"file": "src/renderer/src/lib/pane-manager/pane-webgl-renderer.test.ts",
"assertions": [
"attach bail disposes the addon instead of orphaning it (#7133 single-addon invariant)"
]
},
{
"file": "src/renderer/src/lib/pane-manager/pane-reveal-repaint.test.ts",
"assertions": [
"reveal repaint waits for a settled frame and keeps repainting when one pane throws (#7133)"
]
},
{
"file": "src/renderer/src/components/terminal-pane/terminal-visibility-resume.test.ts",
"assertions": [
"tab reveal, heavy reveal, and window wake schedule pane-scoped repaint (#7133)"
]
}
],
"evidenceRuns": [
{
"date": "2026-07-03",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/lib/pane-manager/terminal-link-provider-guard.test.ts src/renderer/src/components/terminal-search-safe-find.test.ts src/renderer/src/lib/pane-manager/pane-webgl-refresh-lifecycle.test.ts src/renderer/src/components/terminal-pane/terminal-webgl-atlas-recovery.test.ts src/renderer/src/lib/pane-manager/pane-webgl-context-recovery.test.ts src/renderer/src/lib/pane-manager/pane-webgl-renderer.test.ts src/renderer/src/lib/pane-manager/pane-reveal-repaint.test.ts src/renderer/src/components/terminal-pane/terminal-visibility-resume.test.ts",
"result": "passed",
"durationSeconds": 0.8,
"summary": "8 test file(s) passed, 33 tests passed on main@1282f5c2d in a clean checkout."
}
],
"runtimeBudget": {
"p95Seconds": 30,
"scope": "renderer unit or component test"
},
"flakeHistory": {
"status": "unknown",
"evidence": "Focused renderer-unit containment slice passed locally on 2026-07-02; needs soak history before promotion."
},
"redGreenEvidence": {
"status": "partial",
"evidence": "#7133 proved the reveal-hardening slice against live corrupted specimens; the link/search guards reproduce their original crashes in-test. No recorded red runs for the refresh-lifecycle slice."
},
"performanceBudget": {
"required": false,
"evidence": "Required only if containment adds retry loops, polling, or renderer fallback churn."
},
"promotionCriteria": [
"Add deterministic addon throw injection.",
"Prove input/output survives after boundary failure."
],
"knownGaps": [
"Current command is renderer-unit containment, not live Electron typed input/output survival after addon failure.",
"Does not yet inject WebGL dispose/reset throws and active/hidden/resumed pane focus recovery in one component-level oracle."
],
"demotionRule": "Cannot promote while it only checks visual rendering."
},
{
"id": "terminal-scroll.intent-preservation",
"title": "Scrollbar drag intent survives tab and visibility resume",
"maturity": "experimental",
"protection": "partial",
"owner": "terminal-rendering",
"layer": "renderer-unit",
"surfaces": [
"terminal lifecycle",
"hidden-to-visible resume",
"tab switching",
"xterm scrollbar DOM",
"scrollback"
],
"platforms": [
"macos",
"linux",
"windows"
],
"providers": [
"local",
"daemon",
"ssh",
"wsl",
"remote-runtime"
],
"coveredPlatforms": [
"macos"
],
"coveredProviders": [],
"coverageNotes": "Renderer-unit coverage proves the shared xterm DOM intent path. Live Electron evidence is PR validation evidence for local macOS only until the flow has stable automation; live SSH, WSL, Linux, and Windows paths remain unproved.",
"motivatingLinks": [
"STA-1341"
],
"invariant": "A user-driven xterm scrollbar thumb or track scroll updates the live terminal scroll intent before tab, visibility, or layout resume enforces intent, so resume preserves the latest dragged viewport instead of an older pinned line.",
"oracle": "Pointerdown on .xterm-scrollbar or .xterm-slider followed by xterm viewport movement records the new pinned viewport, and enforcing current intent restores that dragged line instead of stale top intent.",
"commands": [
"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/lib/pane-manager/terminal-scroll-intent.test.ts"
],
"testFiles": [
"src/renderer/src/lib/pane-manager/terminal-scroll-intent.test.ts"
],
"assertionRefs": [
{
"file": "src/renderer/src/lib/pane-manager/terminal-scroll-intent.test.ts",
"assertions": [
"pointer-driven .xterm-scrollbar and .xterm-slider scrolls update terminal scroll intent",
"a scrollbar-dragged viewport is restored instead of stale top intent",
"terminal body pointer activity is not treated as scrollbar intent"
]
}
],
"evidenceRuns": [
{
"date": "2026-07-05",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/lib/pane-manager/terminal-scroll-intent.test.ts",
"result": "passed",
"durationSeconds": 0.3,
"summary": "1 test file(s) passed, 17 tests passed in this worktree."
}
],
"runtimeBudget": {
"p95Seconds": 10,
"scope": "focused renderer unit test"
},
"flakeHistory": {
"status": "unknown",
"evidence": "New experimental gate; needs soak history before promotion."
},
"redGreenEvidence": {
"status": "partial",
"evidence": "The new scrollbar DOM target assertions fail when only .xterm-viewport pointerdown is recognized. Needs saved CI/intentional-break artifact before blocking promotion."
},
"performanceBudget": {
"required": true,
"evidence": "Runtime fix is limited to constant-time class/closest checks on pointerdown. It must not add polling, output parsing, PTY listing, hidden-pane wakeups, resize calls, or startup awaits."
},
"promotionCriteria": [
"Collect stable CI soak history for the renderer-unit gate.",
"Add stable live Electron automation for the scrollbar drag plus tab-switch repro.",
"Attach red/green evidence for stale intent restoring the wrong viewport."
],
"knownGaps": [
"Manifest command is deterministic renderer-unit coverage, not a live Electron scrollbar drag.",
"Live daemon, SSH, WSL, remote-runtime, Linux, and Windows validation is not covered by this gate.",
"Future xterm scrollbar DOM class changes are only caught if they break the currently modeled class contract."
],
"demotionRule": "Demote or quarantine if the unit gate flakes without a product bug or harness bug filed to the owner."
},
{
"id": "startup-upgrade.persisted-session-corpus",
"title": "Current Orca preserves or recovers old production persisted sessions",
"maturity": "experimental",
"protection": "none",
"owner": "startup-persistence",
"layer": "upgrade-fixture",
"surfaces": [
"startup",
"upgrade",
"session restore",
"daemon restore"
],
"platforms": [
"macos",
"linux",
"windows"
],
"providers": [
"local",
"daemon",
"ssh",
"wsl"
],
"coveredPlatforms": [],
"coveredProviders": [],
"coverageNotes": "Registered gap only; no executable coverage is wired yet.",
"motivatingLinks": [
"https://github.com/stablyai/orca/issues/5356",
"https://github.com/stablyai/orca/pull/5234",
"https://github.com/stablyai/orca/pull/5240"
],
"invariant": "Startup and restore fixes must preserve or explicitly recover sessions from the last affected production persisted-state schema, not only from state written by current code.",
"oracle": "Boot current Orca against immutable copied user-data fixtures from affected versions and reject blank replacement panes, duplicate resume tabs, silent session loss, or works-only-after-current-write behavior.",
"commands": [],
"testFiles": [],
"assertionRefs": [],
"evidenceRuns": [],
"runtimeBudget": {
"p95Seconds": 120,
"scope": "focused Electron upgrade fixture"
},
"flakeHistory": {
"status": "not-started",
"evidence": "Fixture corpus not implemented."
},
"redGreenEvidence": {
"status": "missing",
"evidence": "Needs immutable pre-fix persisted-state fixture."
},
"performanceBudget": {
"required": true,
"evidence": "Startup fixture must record startup latency and avoid adding blocking migration scans."
},
"promotionCriteria": [
"Land immutable old-version fixture with documented source version.",
"Run second restart after current code writes upgraded state.",
"Record startup timing and failure artifact."
],
"knownGaps": [
"No fixture corpus or command yet."
],
"demotionRule": "Cannot promote without old production fixture provenance."
},
{
"id": "terminal-platform.live-pty-liveness",
"title": "A real Electron local PTY accepts input, survives workspace restore, resizes, and exits cleanly",
"maturity": "experimental",
"protection": "none",
"owner": "terminal-runtime",
"layer": "electron-live-pty",
"surfaces": [
"active terminal PTY binding",
"xterm focus",
"keyboard input",
"PTY output",
"workspace hide and restore",
"resize",
"exit cleanup"
],
"platforms": [
"linux",
"macos"
],
"providers": [
"local"
],
"coveredPlatforms": [],
"coveredProviders": [],
"coverageNotes": "Registered gap on main. The live Electron Playwright slice exists only on the pending reliability stack. It registers here with its owning split PR.",
"motivatingLinks": [
"https://github.com/stablyai/orca/pull/6801",
"https://github.com/stablyai/orca/pull/6842",
"https://github.com/stablyai/orca/pull/6939",
"https://github.com/stablyai/orca/pull/6989"
],
"invariant": "An active local Electron terminal has one active PTY id listed exactly once, accepts real keyboard input through focused xterm, renders process output visibly, keeps the same live PTY across repeated workspace hide/restore cycles, applies an actual size change, and removes the old PTY from liveness state after exit.",
"oracle": "A deterministic raw-mode probe prints a ready marker, ordered key markers from real keyboard input, the active PTY id appears exactly once in pty:listSessions, remains bound to the same PTY id across two worktree switch-away/switch-back cycles, accepts more keyboard input after each restore, changes pty:getSize after viewport resize, prints the same process-visible size, and prints an exit marker; after shell exit, pty:listSessions no longer contains the old id.",
"commands": [],
"testFiles": [],
"assertionRefs": [],
"evidenceRuns": [],
"runtimeBudget": {
"p95Seconds": 75,
"scope": "focused Electron live PTY gate including e2e build/setup"
},
"flakeHistory": {
"status": "unknown",
"evidence": "Focused Playwright gate passed locally after adding two workspace hide/restore cycles, exact active-PTY listing, and actual resize convergence on 2026-07-02: 1 test passed, 8.6s test body, 58.6s full command including build/setup. Needs repeated CI/runtime history before promotion."
},
"redGreenEvidence": {
"status": "partial",
"evidence": "The gate asserts PTY binding, active PTY listed exactly once, real xterm keyboard delivery, same-PTY ownership across repeated workspace hide/restore cycles, post-restore input delivery, actual pty:getSize change, matching process-visible size, and listSessions cleanup after shell exit. Needs saved intentional-break evidence before promotion."
},
"performanceBudget": {
"required": true,
"evidence": "Must record key latencies, size snapshots, and final liveness state. The gate may use broad listing as a test oracle; product hot paths must not use broad provider listing as a synchronization primitive."
},
"promotionCriteria": [
"Implement without blind sleeps; wait only on PTY binding, probe markers, size marker, and liveness absence.",
"Run in soak on Linux before blocking; keep macOS as soak until stable.",
"Attach red/green evidence for focus, PTY write, resize, and exit cleanup failures."
],
"knownGaps": [
"No executable coverage on main yet; the slice lives on the pending fix-terminal-reliability stack.",
"Needs soak/runtime history before promotion.",
"Does not yet cover tab switch inside one worktree, scrollback after restore, or app restart persistence.",
"Does not cover Windows ConPTY, SSH, WSL, daemon, or remote-runtime providers."
],
"demotionRule": "Cannot promote without deterministic user-visible oracle, failure artifacts, and stable runtime history."
},
{
"id": "terminal-platform.windows-conpty-liveness",
"title": "Windows ConPTY terminals stay input-live, render-live, and geometry-live",
"maturity": "experimental",
"protection": "partial",
"owner": "terminal-platform",
"layer": "windows-electron-conpty",
"surfaces": [
"Windows ConPTY",
"PowerShell and cmd",
"keyboard protocol",
"CJK repaint",
"cursor and resize"
],
"platforms": [
"windows"
],
"providers": [
"local",
"daemon",
"wsl"
],
"coveredPlatforms": [
"windows"
],
"coveredProviders": [
"daemon"
],
"coverageNotes": "Issue #8048 now has deterministic wrapper and cold-restore re-anchor tests plus a Windows PR-CI harness that drives the built daemon through 25 real ConPTY workspace-close races while an unrelated witness PTY stays alive. Keyboard reset, CJK repaint, WSL, and full visible Electron coverage remain gaps.",
"motivatingLinks": [
"https://github.com/stablyai/orca/pull/6541",
"https://github.com/stablyai/orca/pull/6858",
"https://github.com/stablyai/orca/pull/6876",
"https://github.com/stablyai/orca/pull/6968",
"https://github.com/stablyai/orca/pull/6970",
"https://github.com/stablyai/orca/pull/6999",
"https://github.com/stablyai/orca/issues/8048"
],
"invariant": "Windows local and daemon terminals must spawn with the intended shell, survive overlapping graceful/forced workspace teardown without affecting unrelated PTYs, retain recovered scrollback across the fresh daemon's first checkpoint, accept normal Enter/Backspace/Arrow input after agent or TUI exit, render cursor/CJK/wide-glyph redraws without stale cells, and converge to nonzero applied size.",
"oracle": "The issue #8048 slice asserts one node-pty ConPTY close for a graceful-then-force sequence, atomically seeds recovered history before fresh shell output and re-anchoring, preserves recovery after seed failure plus adapter restart, and runs 25 built-daemon close races while checking victim session/PID reaping, a stable daemon PID, and a live witness PTY. A broader Windows live gate still needs shell input, resize, cursor, and CJK/wide-glyph pixel evidence.",
"commands": [
"pnpm vitest run src/main/daemon/pty-subprocess.test.ts src/main/daemon/daemon-pty-adapter.test.ts",
"pnpm build:electron-vite && node config/scripts/windows-daemon-workspace-close-repro.mjs",
"node config/scripts/windows-daemon-workspace-close-repro.mjs"
],
"testFiles": [
"src/main/daemon/pty-subprocess.test.ts",
"src/main/daemon/daemon-pty-adapter.test.ts",
"config/scripts/windows-daemon-workspace-close-repro.mjs"
],
"assertionRefs": [
{
"file": "src/main/daemon/pty-subprocess.test.ts",
"assertions": [
"graceful kill followed by force and dispose invokes Windows node-pty kill exactly once and never retries the dead child PID"
]
},
{
"file": "src/main/daemon/daemon-pty-adapter.test.ts",
"assertions": [
"the first checkpoint orders recovered scrollback before synchronously emitted fresh-shell startup output",
"a failed atomic history seed remains non-authoritative across adapter restart and cannot overwrite the recovery files"
]
},
{
"file": "config/scripts/windows-daemon-workspace-close-repro.mjs",
"assertions": [
"all 25 victim sessions and OS PIDs are reaped while the built daemon PID and an unrelated witness PowerShell remain alive"
]
}
],
"evidenceRuns": [
{
"date": "2026-07-10",
"runner": "local",
"platform": "windows",
"command": "node config/scripts/windows-daemon-workspace-close-repro.mjs",
"result": "passed",
"durationSeconds": 7.6,
"summary": "All 25 victim sessions and OS PIDs were reaped while the built daemon and witness PTY survived the real ConPTY workspace-close races. The double-close, history ordering, and seed-failure restart regressions produced intentional red failures before their fixes and passed afterward."
}
],
"runtimeBudget": {
"p95Seconds": 90,
"scope": "Windows focused Electron ConPTY gate"
},
"flakeHistory": {
"status": "unknown",
"evidence": "The built-daemon issue #8048 harness passed locally once and is wired into Windows PR CI; it needs repeated CI history before promotion."
},
"redGreenEvidence": {
"status": "partial",
"evidence": "The ConPTY double-close and cold-restore re-anchor assertions were each observed failing before the fix and passing afterward. Keyboard protocol, shell resolution, resize, and CJK repaint still need red/green proof."
},
"performanceBudget": {
"required": true,
"evidence": "Must include input latency and no broad session listing while typing or switching terminals."
},
"promotionCriteria": [
"Start as Windows nightly/soak because Windows Electron E2E has been flaky.",
"Use deterministic PTY markers for input/resize and reserve screenshots for repaint diagnostics.",
"Split shell parity, keyboard reset, and CJK repaint into smaller gates if a combined gate is flaky."
],
"knownGaps": [
"Real IME composition may require a separate lower-layer/native-text-forwarding gate.",
"The built-daemon harness proves process/session liveness but not renderer pixels; visible shell input, resize, cursor, and CJK repaint remain uncovered."
],
"demotionRule": "Cannot promote while Windows E2E is flaky, silently skipped, or screenshot-only."
},
{
"id": "terminal-performance.no-hot-list-sessions",
"title": "Hot terminal interactions do not call global PTY session listing",
"maturity": "experimental",
"protection": "none",
"owner": "terminal-performance",
"layer": "ipc-count-contract",
"surfaces": [
"typing",
"focus",
"tab switch",
"workspace switch",
"visibility resume",
"resize",
"render"
],
"platforms": [
"macos",
"linux",
"windows"
],
"providers": [
"local",
"daemon",
"ssh",
"wsl",
"remote-runtime"
],
"coveredPlatforms": [],
"coveredProviders": [],
"coverageNotes": "Registered gap on main. The targeted-hasPty product hardening and no-hot count assertions exist only on the pending reliability stack. It registers here with its owning split PR.",
"motivatingLinks": [
"https://github.com/stablyai/orca/pull/7002",
"https://github.com/stablyai/orca/pull/6858"
],
"invariant": "Typing, focus, terminal switch, workspace switch, visibility resume, resize, render, and per-pane liveness paths must not call global pty:listSessions; they must use targeted per-PTY APIs or cached provider-owned state.",
"oracle": "The current executable slice asserts targeted visibility/first-input liveness, resize re-assertion after visibility resume, light tab/active-state resume, SSH/remote skip behavior, and closed Resource Manager status badges avoid pty:listSessions; targeted hasPty/getSize calls are allowed for liveness/resize slices and forbidden for light tab/active-state resume. The full hot-path oracle still needs instrumentation around raw focus, split focus, workspace switch, render ticks, and high-session local/daemon/SSH fixtures.",
"commands": [],
"testFiles": [],
"assertionRefs": [],
"evidenceRuns": [],
"runtimeBudget": {
"p95Seconds": 20,
"scope": "unit or focused Electron count gate"
},
"flakeHistory": {
"status": "unknown",
"evidence": "Focused count tests now run locally; needs soak history before promotion."
},
"redGreenEvidence": {
"status": "partial",
"evidence": "Tests assert visibility resume prefers targeted hasPty over listSessions, first input after visibility resume calls targeted hasPty once, resize re-assertion after visibility resume uses getSize/resize without listSessions, light tab switches and visible active-state resume avoid listSessions/hasPty/getSize fanout while still allowing the active PTY scheduler hint, SSH/remote broad listing is skipped, Resource Manager broad session inventory polling is scoped to the open popover rather than its closed badge, and panes close only on authoritative false. Needs broader raw focus/workspace-switch/render/high-session count coverage before promotion."
},
"performanceBudget": {
"required": true,
"evidence": "This gate is the performance budget for global session listing in hot paths."
},
"promotionCriteria": [
"Add deterministic call-count instrumentation.",
"Cover typing, focus, switch, visibility resume, resize, and render separately.",
"Run with enough preserved sessions/providers to make a broad listing observable."
],
"knownGaps": [
"No executable coverage on main yet; the slice lives on the pending fix-terminal-reliability stack.",
"Current command covers targeted visibility/first-input liveness, resize re-assertion on visibility resume, light tab/active-state resume, SSH/remote skip behavior, and closed Resource Manager session-poll avoidance, but not every hot interaction listed in the invariant.",
"No Electron or IPC-level high-session counter gate yet proves raw focus, workspace switch, render, or high-session typing stay at zero global listSessions calls."
],
"demotionRule": "Cannot promote if the test allows broad listing in any hot interaction path."
},
{
"id": "terminal-observability.lifecycle-breadcrumbs",
"title": "Terminal lifecycle anomalies enter crash diagnostics as compact breadcrumbs",
"maturity": "experimental",
"protection": "none",
"owner": "terminal-runtime",
"layer": "renderer-observability",
"surfaces": [
"terminal lifecycle",
"reattach",
"restore",
"provider ownership",
"diagnostics bundle"
],
"platforms": [
"macos",
"linux",
"windows"
],
"providers": [
"local",
"daemon",
"ssh",
"wsl",
"remote-runtime"
],
"coveredPlatforms": [],
"coveredProviders": [],
"coverageNotes": "Registered gap on main. The crash-breadcrumb recording and its test exist only on the pending reliability stack. It registers here with its owning split PR.",
"motivatingLinks": [
"https://github.com/stablyai/orca/pull/6800",
"https://github.com/stablyai/orca/issues/6773"
],
"invariant": "Terminal lifecycle anomalies around reattach, restore, provider ownership, stale liveness, and fallback routing must leave compact, deduped, privacy-safe breadcrumbs in crash diagnostics so future reports can be attributed from evidence.",
"oracle": "The current executable slice calls warnTerminalLifecycleAnomaly with terminal identity, provider, PTY id, binding epoch, and reason, then asserts the existing console warning is preserved and a compact terminal_lifecycle_anomaly crash breadcrumb is recorded once per lifecycle identity. Full pane transition traces and diagnostics-bundle artifact proof remain follow-ups.",
"commands": [],
"testFiles": [],
"assertionRefs": [],
"evidenceRuns": [],
"runtimeBudget": {
"p95Seconds": 10,
"scope": "renderer observability unit test"
},
"flakeHistory": {
"status": "unknown",
"evidence": "Focused unit slice passed locally once; no CI soak history yet."
},
"redGreenEvidence": {
"status": "partial",
"evidence": "Tests would fail if lifecycle anomalies stopped recording crash breadcrumbs or stopped deduping repeated identities. Needs diagnostics-bundle artifact proof and full transition-trace evidence before promotion."
},
"performanceBudget": {
"required": true,
"evidence": "Breadcrumb recording is deduped and capped by the existing lifecycle anomaly guard; full trace buffers must include size and event-count caps before promotion."
},
"promotionCriteria": [
"Add full compact pane lifecycle trace buffer with event-count caps.",
"Prove diagnostics bundle includes recent terminal lifecycle breadcrumbs or traces.",
"Add forbidden-transition tests for stale close, unknown owner fallback, and stuck zero-size panes."
],
"knownGaps": [
"No executable coverage on main yet; the slice lives on the pending fix-terminal-reliability stack.",
"Current command records anomaly breadcrumbs only, not a full pane lifecycle state-machine trace.",
"Current command does not prove crash/diagnostics bundle export includes the breadcrumb.",
"Current command does not assert forbidden transitions across live Electron/provider flows."
],
"demotionRule": "Cannot promote if diagnostics are console-only, unbounded, or missing from support artifacts."
},
{
"id": "terminal-performance.output-backpressure-budget",
"title": "Terminal output backpressure stays bounded from daemon to renderer",
"maturity": "experimental",
"protection": "partial",
"owner": "terminal-performance",
"layer": "provider-ipc-renderer-perf",
"surfaces": [
"daemon stream",
"main PTY batching",
"runtime path provenance",
"runtime serve-sim detection",
"runtime terminal wait detection",
"renderer ACK",
"xterm scheduler",
"hidden output"
],
"platforms": [
"macos",
"linux",
"windows"
],
"providers": [
"local",
"daemon",
"ssh",
"remote-runtime"
],
"coveredPlatforms": [
"macos"
],
"coveredProviders": [],
"coverageNotes": "Local macOS evidence covers the existing main-process pending-output caps plus deterministic runtime path-provenance history reuse, idle-path serve-sim detection, and saturated-tail wait detection. Daemon stream write(false)/drain contracts, cross-session drain priority, and bounded queued tails arrive with the pending perf slice; live flood/latency artifacts remain gaps.",
"motivatingLinks": [
"https://github.com/stablyai/orca/pull/6836",
"https://github.com/stablyai/orca/pull/6858",
"https://github.com/stablyai/orca/pull/7002",
"https://github.com/stablyai/orca/pull/7054"
],
"invariant": "High-volume terminal output must stay bounded across daemon socket writes, main runtime metadata, detectors, and tail checks, main-to-renderer in-flight bytes, renderer scheduler queues, and hidden-output restore without starving focused input.",
"oracle": "The current executable slice injects daemon socket backpressure and main-process renderer backlog pressure, then asserts write(false)/drain ordering, bounded queued daemon bytes, unchanged path-provenance history reuse for pathless output, idle serve-sim detection with split-JSON continuity, ordinary terminal-wait detection without a joined-tail allocation and with full prompt-family continuity, per-PTY and total pending-output caps, preserved sequenced-tail metadata, active-pending protection ahead of background trimming, and ACK-gated in-flight bounds. The live Electron perf oracle adds hidden-output floods, renderer scheduler queue depth, dropped-output-zero normal scenarios, and active key latency budgets before promotion.",
"commands": [
"pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/pty.test.ts",
"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/orca-runtime-path-candidate-history.test.ts",
"pnpm exec vitest run --config config/vitest.config.ts src/main/emulator/serve-sim-state-watcher.test.ts",
"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/orca-runtime.test.ts src/main/runtime/orca-runtime-tail-wait-memo.test.ts"
],
"testFiles": [
"src/main/ipc/pty.test.ts",
"src/main/runtime/orca-runtime-path-candidate-history.test.ts",
"src/main/emulator/serve-sim-state-watcher.test.ts",
"src/main/runtime/orca-runtime.test.ts",
"src/main/runtime/orca-runtime-tail-wait-memo.test.ts"
],
"assertionRefs": [
{
"file": "src/main/ipc/pty.test.ts",
"assertions": [
"total renderer in-flight output is capped across many PTYs",
"active PTY pending output is prioritized during renderer backpressure",
"combined pending output exceeding the interactive size limit is batched"
]
},
{
"file": "src/main/runtime/orca-runtime-path-candidate-history.test.ts",
"assertions": [
"reuses path-candidate history across repeated pathless PTY output",
"copies history when new output adds a path candidate"
]
},
{
"file": "src/main/emulator/serve-sim-state-watcher.test.ts",
"assertions": [
"does not buffer repeated brace-free PTY output while waiting for metadata",
"detects serve-sim metadata split across PTY chunks and releases the partial object"
]
},
{
"file": "src/main/runtime/orca-runtime-tail-wait-memo.test.ts",
"assertions": [
"does not rebuild or repeatedly scan an ordinary saturated tail",
"memoized stamping matches recompute reference: blocked prompt split across chunks",
"stays equivalent across tail eviction beyond the retained cap"
]
},
{
"file": "src/main/runtime/orca-runtime.test.ts",
"assertions": [
"returns a blocked wait result for Codex update prompts",
"returns a blocked wait result for Codex workspace trust prompts",
"returns a blocked wait result for generic Codex interactive prompts",
"resolves tui-idle when a stale Codex prompt is followed by the ready header"
]
}
],
"evidenceRuns": [
{
"date": "2026-07-03",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/pty.test.ts",
"result": "passed",
"durationSeconds": 1.5,
"summary": "1 test file(s) passed, 209 tests passed on main@1282f5c2d in a clean checkout."
},
{
"date": "2026-07-10",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/orca-runtime-path-candidate-history.test.ts",
"result": "passed",
"durationSeconds": 3.49,
"summary": "1 test file passed, 2 tests passed on the exact rebased tree based on main@dc468f0ded."
},
{
"date": "2026-07-10",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/main/emulator/serve-sim-state-watcher.test.ts",
"result": "passed",
"durationSeconds": 0.37,
"summary": "1 test file passed, 6 tests passed on pushed commit f0e3a185593b."
},
{
"date": "2026-07-10",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/orca-runtime.test.ts src/main/runtime/orca-runtime-tail-wait-memo.test.ts",
"result": "passed",
"durationSeconds": 21.33,
"summary": "2 test files passed, 609 tests passed on pushed commit 4fb14eac3897."
}
],
"runtimeBudget": {
"p95Seconds": 120,
"scope": "deterministic provider/IPC contract now; terminal perf soak/report gate before promotion"
},
"flakeHistory": {
"status": "unknown",
"evidence": "Daemon stream backpressure and focused main/renderer backlog tests are deterministic unit slices. The combined perf soak still needs runtime history before promotion."
},
"redGreenEvidence": {
"status": "partial",
"evidence": "Tests assert daemon stream writes pause after socket write(false), later stream data queues behind the pressured socket, flush-immediate output from another session is prioritized ahead of unrelated queued background backlog on drain while preserving per-session order, queued lines resume on drain, global cleanup clears clients that only have backpressured writes, queued daemon stream bytes are bounded by keeping priority output and the newest tail under sustained pressure, pathless runtime output reuses unchanged path-provenance history with zero old-candidate byte scans, ordinary output leaves the niche serve-sim detector idle while split JSON still emits and releases its partial buffer, ordinary saturated terminal tails retain no rebuilt wait text or repeated phrase scans while every blocked/ready prompt family remains live, main pending renderer output is capped per PTY and in total, total-pressure trimming prefers background pending output before active pending output, trimmed pending tails preserve seq/rawLength metadata, and ACK-gated in-flight output remains bounded. Intentionally restoring the old path-history shape failed the focused scale test after 774ms and 4,096 replacements; restoring the old serve-sim buffer failed its scale test after 180ms with 4,096 buffer writes; disabling the ordinary-tail branch failed with a retained 253,999-character waitText. The fixed shapes passed their focused suites. Existing renderer tests cover replay/backlog slices. Needs broader hidden-output/input-latency perf artifacts before promotion."
},
"performanceBudget": {
"required": true,
"evidence": "Suggested ceilings: renderer in-flight <=8MB total, <=512KB per PTY plus active reserve, renderer queued chars <=2MB, dropped backlogs 0, hidden restore <=1000ms, active key median/worst <=75ms/300ms in perf scenarios. With 1,024 retained provenance candidates, 4,096 pathless chunks dropped from 78.84ms and 4,096 array replacements to 1.74ms and zero replacements. Brace-free 1 KiB output dropped from 20.32/79.12/318.23ms to 0.31/0.64/2.35ms across 4,096/16,384/65,536 chunks. Repeated ordinary 252,000-character tail checks dropped from 96.34/464.20/941.79/3,796.70ms to 3.21/15.68/31.34/129.72ms across 100/500/1,000/4,096 updates."
},
"promotionCriteria": [
"Split daemon stream backpressure into a deterministic provider/IPC contract if full E2E is flaky.",
"Record JSON artifacts with bytes, dropped counts, queue depth, timer drift, and key latency.",
"Keep stress variants non-blocking until stable runtime history exists."
],
"knownGaps": [
"Current command asserts daemon stream write(false)/drain/cleanup at the batcher contract layer and main pending renderer caps at the IPC contract layer.",
"Runtime provenance coverage is deterministic and does not include a live high-throughput provider artifact.",
"Serve-sim detector coverage is deterministic and does not include a live external simulator helper.",
"Terminal-wait scale evidence is deterministic and does not yet include a live saturated-tail event-loop artifact.",
"Current command does not prove renderer parse pressure, scheduler queue depth, event-loop delay, or active key latency.",
"Live hidden-output pressure, active input latency, and full Electron perf artifacts remain unproved."
],
"demotionRule": "Cannot promote without metric artifacts and bounded-byte assertions."
},
{
"id": "terminal-provider.daemon-startup-degraded-contract",
"title": "Daemon startup reconcile and degraded fallback preserve provider identity",
"maturity": "experimental",
"protection": "none",
"owner": "terminal-provider",
"layer": "provider-contract",
"surfaces": [
"daemon startup",
"degraded daemon",
"fallback PTY",
"provider ownership",
"startup restore"
],
"platforms": [
"macos",
"linux",
"windows"
],
"providers": [
"daemon",
"local"
],
"coveredPlatforms": [],
"coveredProviders": [],
"coverageNotes": "Registered gap on main. The fail-closed degraded-daemon hardening and its contracts exist only on the pending reliability stack. It registers here with its owning split PR.",
"motivatingLinks": [
"https://github.com/stablyai/orca/pull/6830",
"https://github.com/stablyai/orca/pull/6866",
"https://github.com/stablyai/orca/pull/7002"
],
"invariant": "Daemon startup reconciliation must preserve valid live daemon sessions, reap only true orphans, and degraded mode must not route an existing-looking daemon session through local fallback unless the caller explicitly marks a fresh degraded-mode spawn.",
"oracle": "The current provider-contract corpus covers valid current-worktree ids, folder/floating workspace ids, invalid removed-worktree ids, mixed live/orphan dry-run reconciliation, hyphenated worktree ids, malformed ids, daemon sessions discovered after restart, router discovery before existing-session spawn, router fail-closed behavior when legacy ownership cannot be listed or a known session has exited, degraded daemon fallback for fresh sessions, fail-closed behavior for unknown restored ids, benign inspection defaults for unknown ownership, and synthetic exits on daemon restart. Prior-worktree aliases and renamed-worktree startup wiring are promotion gaps, not current proof.",
"commands": [],
"testFiles": [],
"assertionRefs": [],
"evidenceRuns": [],
"runtimeBudget": {
"p95Seconds": 20,
"scope": "provider contract unit/integration test"
},
"flakeHistory": {
"status": "unknown",
"evidence": "Focused provider contract tests now run locally; needs soak history before promotion."
},
"redGreenEvidence": {
"status": "partial",
"evidence": "Tests assert discovered daemon sessions route to the daemon, fresh degraded-mode PTYs route to fallback only when marked new, router spawn discovers uncached existing sessions before choosing an adapter, router spawn fails closed instead of falling through to current when legacy listing fails or a known session has exited, targeted hasPty discovery caches legacy ownership before later write/resize-style operations, real daemon adapter listProcesses discovery seeds targeted hasPty liveness, folder and floating terminal workspace ids survive startup reconcile when valid, restored worktree-scoped and legacy/non-scoped ids do not fall back through spawn after ownership is lost or unknown, operations on unknown or exited existing ids fail closed, startup reconcile can dry-run orphan detection without killing live sessions, and process inspection returns benign defaults for unknown ownership. Production startup reconcile wiring remains unproven."
},
"performanceBudget": {
"required": true,
"evidence": "Reconcile must not add startup-blocking scans beyond the explicit daemon session inventory and must not leak global listing into hot paths."
},
"promotionCriteria": [
"Wire reconcileOnStartup or mark the production wiring gap explicitly.",
"Cover priorWorktreeIds so renamed worktrees are not falsely reaped."
],
"knownGaps": [
"No executable coverage on main yet; the slice lives on the pending fix-terminal-reliability stack.",
"Production startup reconcile wiring remains unproven.",
"Prior-worktree aliases and renamed-worktree startup reconcile are not covered by the current executable corpus.",
"Real daemon restart behavior is still covered only by lower-level synthetic exit and provider-contract tests."
],
"demotionRule": "Cannot promote while restored daemon ids or routing operations can silently route to local fallback."
},
{
"id": "terminal-provider.ssh-remote-reattach-contract",
"title": "SSH and remote terminal restore never turn unknown liveness into destructive cleanup",
"maturity": "experimental",
"protection": "none",
"owner": "terminal-provider",
"layer": "provider-contract",
"surfaces": [
"SSH deferred restore",
"remote-runtime mirror polling",
"provider listing",
"reattach",
"unknown liveness"
],
"platforms": [
"macos",
"linux",
"windows"
],
"providers": [
"ssh",
"remote-runtime",
"wsl"
],
"coveredPlatforms": [],
"coveredProviders": [],
"coverageNotes": "Registered gap on main. The SSH unknown-liveness hardening and deferred-reattach contracts exist only on the pending reliability stack. It registers here with its owning split PR.",
"motivatingLinks": [
"https://github.com/stablyai/orca/pull/6951",
"https://github.com/stablyai/orca/pull/6955",
"https://github.com/stablyai/orca/pull/6979",
"https://github.com/stablyai/orca/pull/7009"
],
"invariant": "SSH, WSL, and remote-runtime restore paths must treat provider listing failures and unknown liveness as unknown, not dead, while still avoiding duplicate spawn and clearing expired relay leases exactly once.",
"oracle": "The current executable slice asserts saved SSH sessions use relay attach, expired relay attach does not silently fresh-spawn inside the provider, provider listing and targeted-liveness failures are unknown rather than dead, deferred passphrase cancellation does not auto-reconnect, deferred SSH attach uses saved leaf/tab session ids once connected, transient deferred reattach failure preserves the saved restore id without fresh-spawning, deferred SSH no-result cleanup clears the pending serializer without consuming the saved restore id, disconnected SSH relay ids are retained as deferred reconnect metadata and sidebar wake hints rather than attached PTY proof, and expired deferred relay state clears stale pane/tab bindings before one fresh replacement spawn. WSL and remote-runtime mirror polling require separate follow-up contracts.",
"commands": [],
"testFiles": [],
"assertionRefs": [],
"evidenceRuns": [],
"runtimeBudget": {
"p95Seconds": 45,
"scope": "provider contract plus optional SSH soak"
},
"flakeHistory": {
"status": "unknown",
"evidence": "Focused provider/main/renderer SSH contract tests now run locally; needs soak history before promotion."
},
"redGreenEvidence": {
"status": "partial",
"evidence": "Tests assert SSH attach uses relay pty.attach for saved sessions, expired relay attach does not fresh-spawn in the provider, a failed SSH listProcesses observation does not clear previously learned ownership, a rejected SSH hasPty probe resolves as unknown liveness, deferred SSH passphrase cancellation does not auto-reconnect, deferred attach uses saved leaf/tab session ids once connected, transient deferred reattach failure preserves the saved session id without clearing pane/tab bindings or fresh-spawning, deferred SSH no-result cleanup clears the pending serializer without clearing pane/tab bindings or consuming the saved restore id, disconnected SSH relay ids are retained as deferred reconnect metadata and sidebar wake hints rather than attached PTY proof, and expired deferred relay state clears stale pane/tab bindings before one fresh replacement spawn. Needs WSL, remote-runtime mirror polling, live SSH, and saved intentional-break artifacts before promotion."
},
"performanceBudget": {
"required": true,
"evidence": "Provider listing and polling must be bounded, targeted where possible, and absent from typing/focus hot paths."
},
"promotionCriteria": [
"Use deterministic fake providers for failure and unknown-liveness cases.",
"Keep environment-dependent live SSH tests as soak until stable.",
"Include reconnect/polling artifacts that identify provider, connection id, and lease state."
],
"knownGaps": [
"No executable coverage on main yet; the slice lives on the pending fix-terminal-reliability stack.",
"Current command covers store wake-hint metadata, main-process SSH provider failure semantics, provider attach/expired-attach behavior, and renderer deferred SSH reconnect/transient-failure/expired-relay fallback with mocked transports.",
"The store coverage asserts recoverability metadata, not a live attached PTY or user-visible connected state.",
"Live SSH/remote coverage remains environment-dependent.",
"WSL and remote-runtime mirror polling contracts are not wired yet.",
"The deferred SSH coverage does not boot Electron against a real SSH relay or exercise real network reconnect timing."
],
"demotionRule": "Cannot promote if provider failure can close panes or if the oracle is screenshot-only."
},
{
"id": "terminal-provider.wsl-restore-contract",
"title": "WSL terminals preserve launch identity, liveness, and restore boundaries",
"maturity": "experimental",
"protection": "none",
"owner": "terminal-provider",
"layer": "windows-provider-contract",
"surfaces": [
"WSL",
"Windows host boundary",
"cwd identity",
"startup command",
"provider liveness",
"restore"
],
"platforms": [
"windows"
],
"providers": [
"wsl"
],
"coveredPlatforms": [],
"coveredProviders": [],
"coverageNotes": "Registered gap only; no executable coverage is wired yet.",
"motivatingLinks": [
"https://github.com/stablyai/orca/pull/6801",
"https://github.com/stablyai/orca/pull/6830",
"https://github.com/stablyai/orca/pull/6866",
"https://github.com/stablyai/orca/pull/6951"
],
"invariant": "WSL terminal restore must preserve Windows-host and Linux-guest path/cwd identity, shell launch args, startup command delivery, provider liveness semantics, and saved session ownership without being treated as ordinary local Windows ConPTY or generic SSH.",
"oracle": "No executable slice yet. Promotion needs a Windows provider contract plus one focused live WSL smoke proving cwd/path mapping, shell echo, startup command delivery, targeted liveness unknown handling, and restore without duplicate panes or destructive false-dead cleanup.",
"commands": [],
"testFiles": [],
"assertionRefs": [],
"evidenceRuns": [],
"runtimeBudget": {
"p95Seconds": 90,
"scope": "Windows WSL provider contract plus focused live smoke"
},
"flakeHistory": {
"status": "not-started",
"evidence": "WSL is split out from SSH/remote planning so it cannot be mistaken for covered provider behavior."
},
"redGreenEvidence": {
"status": "missing",
"evidence": "Needs intentional-break evidence for path/cwd mapping, startup command delivery, liveness unknown handling, and restore ownership."
},
"performanceBudget": {
"required": true,
"evidence": "WSL restore and liveness checks must avoid broad provider scans on typing, focus, switch, render, or resize hot paths."
},
"promotionCriteria": [
"Start with deterministic provider contracts for path/cwd mapping and launch args.",
"Add one focused Windows live WSL smoke after provider contracts are stable.",
"Keep WSL separate from SSH and local ConPTY evidence in PR descriptions."
],
"knownGaps": [
"No manifest command yet.",
"No live Windows WSL CI evidence.",
"No provider contract yet separates Windows host paths from Linux guest cwd identity."
],
"demotionRule": "Cannot promote while WSL restore is inferred from SSH, local ConPTY, or remote-runtime gates."
},
{
"id": "terminal-output.scrollback-replay-fifo",
"title": "Replay, scrollback, and hidden-output restore preserve ordering and clear semantics",
"maturity": "experimental",
"protection": "none",
"owner": "terminal-rendering",
"layer": "renderer-unit-provider-contract",
"surfaces": [
"snapshot replay",
"scrollback restore",
"hidden output",
"metadata-only replay",
"WebGL recovery"
],
"platforms": [
"macos",
"linux",
"windows"
],
"providers": [
"local",
"daemon",
"ssh",
"remote-runtime"
],
"coveredPlatforms": [],
"coveredProviders": [],
"coverageNotes": "Registered gap on main. The replay FIFO/burst coalescing product change and its tests exist only on the pending reliability stack; main still uses a single pendingReplayData slot. It registers here with its owning split PR.",
"motivatingLinks": [
"https://github.com/stablyai/orca/pull/7012",
"https://github.com/stablyai/orca/pull/7054",
"https://github.com/stablyai/orca/pull/6949"
],
"invariant": "Multiple replay notifications, metadata-only eager replays, hidden-output restores, and WebGL recovery must preserve FIFO ordering, apply clear-before-replay only when intended, and never overlay stale bytes on newer terminal output.",
"oracle": "The current executable slice injects overlapping replay notifications while async replay drains and asserts pre-parse coalescing, in-flight replay preservation, FIFO draining after xterm parsing starts, and bounded burst-tail coalescing. Metadata-only replay, hidden output chunks, live output interleaving, clear semantics, and stale-overlap checks remain promotion-scope gaps.",
"commands": [],
"testFiles": [],
"assertionRefs": [],
"evidenceRuns": [],
"runtimeBudget": {
"p95Seconds": 20,
"scope": "renderer unit or provider-contract test"
},
"flakeHistory": {
"status": "unknown",
"evidence": "Focused remote replay tests now run locally; needs soak history before promotion."
},
"redGreenEvidence": {
"status": "partial",
"evidence": "Focused tests assert pre-parse replay coalescing, in-flight replay preservation, FIFO draining for multiple replay notifications accepted after xterm parsing starts, and bounded burst-tail coalescing that keeps the newest snapshot. Needs saved red/green evidence and broader clear/metadata/hidden-output cases before promotion."
},
"performanceBudget": {
"required": true,
"evidence": "Replay fixes must not add unbounded renderer parsing, hidden-pane wakeups, or retry loops."
},
"promotionCriteria": [
"Extend deterministic multi-replay coverage before changing replay code.",
"Prove metadata-only replay does not clear restored scrollback.",
"Keep long-table/golden visual tests as supporting evidence, not the primary oracle."
],
"knownGaps": [
"No executable coverage on main yet; the slice lives on the pending fix-terminal-reliability stack.",
"Current command covers remote replay overlap, in-flight preservation, FIFO ordering for multiple in-progress replay notifications, and bounded burst-tail coalescing only.",
"Does not yet cover clearBeforeReplay metadata on the fresh main implementation.",
"Does not yet cover hidden-output restore plus live-output interleaving."
],
"demotionRule": "Cannot promote without ordered replay and clear-semantics assertions."
},
{
"id": "terminal-input.ime-and-synthetic-forwarding",
"title": "IME, native text, and synthetic input commit exactly once and do not leak preedit bytes",
"maturity": "experimental",
"protection": "partial",
"owner": "terminal-input",
"layer": "renderer-unit-platform-soak",
"surfaces": [
"IME",
"native text forwarding",
"synthetic input",
"paste",
"keyboard bypass",
"JIS yen"
],
"platforms": [
"macos",
"linux",
"windows"
],
"providers": [
"local",
"daemon",
"ssh",
"remote-runtime"
],
"coveredPlatforms": [
"macos",
"linux"
],
"coveredProviders": [],
"coverageNotes": "Local macOS and containerized Linux evidence, deterministic renderer-unit coverage for the Linux/Sogou candidate-key policy including the legacy orphaned-keyup fallback, and Electron/CDP live-PTY Sogou-style repros. Real Linux/Sogou OS IME automation, Windows ConPTY post-agent reset, and the CJK/Vietnamese/Arabic matrix remain registered gaps.",
"motivatingLinks": [
"https://github.com/stablyai/orca/pull/6699",
"https://github.com/stablyai/orca/pull/6682",
"https://github.com/stablyai/orca/pull/6513",
"https://github.com/stablyai/orca/pull/6999"
],
"invariant": "Composition, native text forwarding, synthetic input, paste, and platform keyboard bypass paths must not send preedit/control bytes before commit and must commit text exactly once to the intended PTY.",
"oracle": "The current renderer-unit slice asserts native text commits route to the intended PTY once, composition/preedit bookkeeping does not leak premature text, input-source classification handles synthetic/native paths, paste/runtime forwarding avoids duplicate terminal payloads for covered fixtures, and Linux/Sogou candidate Space/digit selectors do not leak keydown/keypress/keyup while ordinary and long-held letter-to-digit typing remains available. The Electron/CDP live-PTY repro verifies Sogou-style Space and digit selectors submit only the committed Chinese text, while the legacy orphaned-letter-keyup sequence sends no selector byte to the PTY. Real legacy IME commit preservation and the full CJK/Vietnamese/Arabic/JIS-yen matrix run in follow-up platform soak where automation is possible.",
"commands": [
"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/terminal-ime-native-text-forwarder.test.ts src/renderer/src/components/terminal-pane/terminal-ime-input-source.test.ts src/renderer/src/components/terminal-pane/terminal-paste-runtime.test.ts src/renderer/src/components/terminal-pane/terminal-ime-composition-tracker.test.ts src/renderer/src/components/terminal-pane/terminal-ime-candidate-key-release-guard.test.ts src/renderer/src/components/terminal-pane/xterm-bypass-policy-non-mac.test.ts src/renderer/src/components/terminal-pane/xterm-bypass-policy.test.ts",
"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/terminal-ime-linux-candidate-state.test.ts",
"pnpm run test:e2e -- tests/e2e/chinese-ime-chat-input-repro.spec.ts"
],
"testFiles": [
"src/renderer/src/components/terminal-pane/terminal-ime-native-text-forwarder.test.ts",
"src/renderer/src/components/terminal-pane/terminal-ime-input-source.test.ts",
"src/renderer/src/components/terminal-pane/terminal-paste-runtime.test.ts",
"src/renderer/src/components/terminal-pane/terminal-ime-composition-tracker.test.ts",
"src/renderer/src/components/terminal-pane/terminal-ime-candidate-key-release-guard.test.ts",
"src/renderer/src/components/terminal-pane/terminal-ime-linux-candidate-state.test.ts",
"src/renderer/src/components/terminal-pane/xterm-bypass-policy-non-mac.test.ts",
"src/renderer/src/components/terminal-pane/xterm-bypass-policy.test.ts",
"tests/e2e/chinese-ime-chat-input-repro.spec.ts"
],
"assertionRefs": [
{
"file": "src/renderer/src/components/terminal-pane/terminal-ime-native-text-forwarder.test.ts",
"assertions": [
"native text commits route once to the intended PTY",
"composition/preedit bookkeeping does not leak premature text"
]
},
{
"file": "src/renderer/src/components/terminal-pane/terminal-ime-input-source.test.ts",
"assertions": [
"synthetic and native input-source paths are classified for covered fixtures"
]
},
{
"file": "src/renderer/src/components/terminal-pane/terminal-paste-runtime.test.ts",
"assertions": [
"paste/runtime forwarding avoids duplicate terminal payloads"
]
},
{
"file": "src/renderer/src/components/terminal-pane/terminal-ime-composition-tracker.test.ts",
"assertions": [
"empty Sogou-style compositionupdate keeps composition active",
"stale composition state expires so editing keys cannot stay suppressed indefinitely",
"post-composition candidate guard is armed only by Sogou-style empty updates and clears after real typing"
]
},
{
"file": "src/renderer/src/components/terminal-pane/terminal-ime-candidate-key-release-guard.test.ts",
"assertions": [
"suppressed candidate keydown arms only the matching keypress/keyup release guard",
"held-key repeat keydowns stay guarded until their keyup, even past expiry",
"fresh keydowns, other keys, modified keys, and expired keypresses are not guarded, and a fresh press drops a stale pending release"
]
},
{
"file": "src/renderer/src/components/terminal-pane/terminal-ime-linux-candidate-state.test.ts",
"assertions": [
"an orphaned plain-letter keyup arms exactly the next bare digit guard",
"ordinary, overlapping, shifted, and long-held letter keydowns keep following digits available",
"physical letter tracking survives cross-pane focus handoff and clears on renderer-window blur"
]
},
{
"file": "src/renderer/src/components/terminal-pane/xterm-bypass-policy-non-mac.test.ts",
"assertions": [
"standalone Linux 229 keydowns reach xterm while Windows 229 keydowns stay suppressed",
"candidate Space/digit selectors are suppressed only while candidate guards are active"
]
},
{
"file": "src/renderer/src/components/terminal-pane/xterm-bypass-policy.test.ts",
"assertions": [
"macOS standalone Process key behavior and composition-owned key suppression stay intact"
]
},
{
"file": "tests/e2e/chinese-ime-chat-input-repro.spec.ts",
"assertions": [
"Sogou-style Space candidate selection submits only the committed Chinese character",
"Sogou-style digit candidate selection submits only the committed Chinese phrase",
"Post-composition Sogou-style digit selection stays out of the PTY after compositionend",
"Legacy orphaned-letter-keyup digit selection submits no selector byte to the PTY; real legacy candidate commit preservation remains a platform gap"
]
}
],
"evidenceRuns": [
{
"date": "2026-07-11",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/terminal-ime-linux-candidate-state.test.ts",
"result": "passed",
"durationSeconds": 0.619,
"summary": "1 state test file and 10 tests passed on macOS, including orphan-keyup, shifted/modifier-changed releases, intervening-key cancellation, cross-pane focus handoff, window/terminal blur cleanup, and long-held-letter coverage; the complete 8-file slice also passed 158 tests."
},
{
"date": "2026-07-11",
"runner": "local",
"platform": "linux",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/terminal-ime-linux-candidate-state.test.ts",
"result": "passed",
"durationSeconds": 0.747,
"summary": "1 state test file and 10 tests passed in Debian 12 arm64 Docker under Node 24, including orphan-keyup, shifted/modifier-changed releases, intervening-key cancellation, cross-pane focus handoff, window/terminal blur cleanup, and long-held-letter coverage; the complete 8-file slice also passed 158 tests."
},
{
"date": "2026-07-11",
"runner": "local",
"platform": "linux",
"command": "pnpm run test:e2e -- tests/e2e/chinese-ime-chat-input-repro.spec.ts",
"result": "passed",
"durationSeconds": 30.3,
"summary": "Debian 12 arm64 Docker with Node 24 and Xvfb passed both live Electron/PTY IME scenarios; the orphaned-letter-keyup candidate digit submitted no selector byte, and the real-Codex opt-in scenario was skipped."
},
{
"date": "2026-07-07",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/terminal-ime-native-text-forwarder.test.ts src/renderer/src/components/terminal-pane/terminal-ime-input-source.test.ts src/renderer/src/components/terminal-pane/terminal-paste-runtime.test.ts src/renderer/src/components/terminal-pane/terminal-ime-composition-tracker.test.ts src/renderer/src/components/terminal-pane/terminal-ime-candidate-key-release-guard.test.ts src/renderer/src/components/terminal-pane/xterm-bypass-policy-non-mac.test.ts src/renderer/src/components/terminal-pane/xterm-bypass-policy.test.ts",
"result": "passed",
"durationSeconds": 0.7,
"summary": "7 test file(s) passed, 144 tests passed on the Linux/Sogou candidate-key branch (includes held-key repeat guard coverage)."
},
{
"date": "2026-07-07",
"runner": "local",
"platform": "macos",
"command": "pnpm run test:e2e -- tests/e2e/chinese-ime-chat-input-repro.spec.ts",
"result": "passed",
"durationSeconds": 72.0,
"summary": "Electron/CDP IME repro passed: Sogou candidate selection, post-composition candidate selection, and existing Chinese IME harness passed; real Codex IME test was skipped behind ORCA_E2E_REAL_CODEX_IME."
}
],
"runtimeBudget": {
"p95Seconds": 90,
"scope": "renderer unit plus focused Electron/CDP IME repro"
},
"flakeHistory": {
"status": "unknown",
"evidence": "Focused renderer input tests and the Electron/CDP Sogou-style repro are now registered; needs soak history and true platform IME evidence before promotion."
},
"redGreenEvidence": {
"status": "partial",
"evidence": "Focused tests cover existing native-text, input-source, paste/runtime forwarding, Linux/Sogou candidate selector, post-composition guard contracts, and live-PTY Sogou-style candidate commits. Needs intentional-break proof for duplicate native text forwarding and composition preedit leakage, plus the broader language/platform matrix."
},
"performanceBudget": {
"required": true,
"evidence": "Terminal IME hot-path audit clean on 2026-07-11: candidate guards add O(1) boolean checks plus bounded per-pane Space/digit state and one renderer-scoped currently pressed physical-letter set; ref-counted renderer and pane blur listeners are disposed with pane lifecycle; no per-pane keyboard-event fan-out, polling, IPC, subprocess work, or SSH/remote transport cost added."
},
"promotionCriteria": [
"Cover deterministic byte/cell oracles first.",
"Mark true OS IME automation gaps explicitly by platform.",
"Pair with Windows ConPTY keyboard reset for Windows standard-key behavior."
],
"knownGaps": [
"Current commands include renderer-unit coverage and a CDP-driven Electron repro; real OS IME automation may need manual or soak evidence.",
"Backspace/Enter during composition, JIS yen, Arabic/RTL, paste edge cases, and Windows ConPTY post-agent key reset still need representative gate coverage."
],
"demotionRule": "Cannot promote if success is based only on DOM text without PTY byte/cell evidence."
},
{
"id": "terminal-input.windows-conpty-keyboard-reset",
"title": "Windows ConPTY resets keyboard protocol state after agents and TUIs exit",
"maturity": "experimental",
"protection": "none",
"owner": "terminal-platform",
"layer": "windows-electron-conpty",
"surfaces": [
"Windows ConPTY",
"keyboard protocol",
"agent exit",
"TUI exit",
"standard key input"
],
"platforms": [
"windows"
],
"providers": [
"local",
"daemon",
"wsl"
],
"coveredPlatforms": [],
"coveredProviders": [],
"coverageNotes": "Registered gap only; no executable coverage is wired yet.",
"motivatingLinks": [
"https://github.com/stablyai/orca/pull/6999",
"https://github.com/stablyai/orca/pull/6858"
],
"invariant": "After an agent or TUI exits on Windows ConPTY, ordinary Enter, Backspace, Arrow, paste, and printable keys must be delivered as standard shell input, not stale Kitty/CSI-u or application-mode bytes.",
"oracle": "A Windows gate records PTY input bytes before and after agent/TUI exit, submits real shell commands, and proves standard keys work without protocol leakage.",
"commands": [],
"testFiles": [],
"assertionRefs": [],
"evidenceRuns": [],
"runtimeBudget": {
"p95Seconds": 60,
"scope": "Windows provider-contract or focused Electron gate"
},
"flakeHistory": {
"status": "not-started",
"evidence": "Gate is registered as a known Windows ConPTY gap; no command is wired."
},
"redGreenEvidence": {
"status": "missing",
"evidence": "Needs intentional-break proof for stale keyboard-protocol mode after agent/TUI exit."
},
"performanceBudget": {
"required": true,
"evidence": "Must not add per-key global session listing or repeated protocol reset work on the typing hot path."
},
"promotionCriteria": [
"Use byte-level PTY input evidence, not only screenshots.",
"Start as Windows soak until skip and flake behavior is known.",
"Fail promotion on silent Windows environment skips."
],
"knownGaps": [
"No manifest command yet.",
"Real Windows ConPTY execution is not covered by macOS/Linux CI."
],
"demotionRule": "Cannot promote if standard-key behavior is inferred without PTY byte evidence."
},
{
"id": "terminal-input.windows-modified-enter-routing",
"title": "Windows modified Enter routes agent-compatible bytes to the active pane",
"maturity": "experimental",
"protection": "partial",
"owner": "terminal-input",
"layer": "main-provider-renderer-unit-and-windows-electron",
"surfaces": [
"terminal input",
"Windows modified Enter",
"agent identity",
"split panes",
"SSH",
"WSL",
"remote runtime"
],
"platforms": [
"macos",
"linux",
"windows"
],
"providers": [
"local",
"daemon",
"ssh",
"wsl",
"remote-runtime"
],
"coveredPlatforms": [
"macos"
],
"coveredProviders": [],
"coverageNotes": "Deterministic main/renderer tests run on macOS and exercise simulated Windows plus POSIX/Linux process-confirmation behavior. They cover exact local-ConPTY membership, detached-child rejection, SSH and paired-runtime host-platform routing including legacy runtime PTY IDs, active-PTY ownership after worktree host changes, Windows-to-WSL routing, unknown-metadata fallback, production handler composition, KKP authorization on every host, process-confirmed Droid routing and launch-triggered confirmation, typed-alias and forged-OSC isolation, shells without OSC 133, split/detach ownership with preserved shell classification, stale PTY exit/rebind rejection, command-generation revocation, daemon v21 warm-reattach identity, unavailable inspection, and lazy subprocess/RPC callback counts. A live linux-arm64 Docker target additionally proved real relay deployment, SSH PTY host detection, and exact inactive/active KKP bytes. The Electron byte test runs only on Windows; live Windows evidence remains uncollected. Test failures report exact expected bytes; no product telemetry or raw terminal logging is added.",
"motivatingLinks": [
"https://github.com/stablyai/orca/issues/7620",
"https://github.com/stablyai/orca/pull/7668"
],
"invariant": "Shift+Enter key recognition follows the client OS, while emitted bytes follow the active application and PTY host: active Kitty keyboard protocol authorizes CSI-u on every host; otherwise Windows hosts use Esc+CR except when allowlisted Droid ownership or fresh routing-trusted Droid process evidence authorizes CSI-u, and non-Windows hosts use Esc+CR. The active SSH connection, remote-runtime PTY owner, or live local session outranks later worktree ownership changes, and missing host-platform metadata falls back to the client. Every new command and PTY replacement revokes stale agent routing until current evidence settles; split or reused panes cannot inherit sibling or prior-PTY authority; unrelated keys perform no host, agent, protocol, or ConPTY lookup.",
"oracle": "Renderer tests assert exact bytes across client/PTY-host combinations, including Kitty keyboard protocol active and inactive on Windows and non-Windows hosts, and prove SSH identity, the environment encoded in an active remote-runtime PTY id, and live local-session identity outrank current worktree ownership, while unavailable platform metadata falls back to the client. A live linux-arm64 SSH PTY independently captured Esc+CR with KKP inactive and CSI-u with KKP active. Fresh Windows process evidence authorizes Droid bytes only after a recognized global candidate is intersected with the exact ConPTY console process list; detached descendants, helper failure/timeout/root-only fallback, stale PTY exit/rebind results, typed text, and hook/OSC output fail closed. A new OSC 133;C immediately publishes a routing-neutral generation, including during D-to-C races. In cmd.exe/Git Bash/custom shells without OSC 133, accepted inferred commands start the same fresh generation; accepted submit/interrupt, title exit, focus, and visibility revoke trusted Droid bytes while one bounded confirmation runs. Detach preserves the live PTY's source shell override so WSL/native classification cannot change with the current default. Ordinary fast shell commands use cached/no-scan paths; routing-relevant confirmation bypasses cached process snapshots and keeps the bounded three-read ladder. Daemon protocol v21 persists only an allowlisted launchAgent; warm reattach uses it as a display/confirmation hint and restores routing only after current process proof. The Windows Electron test focuses the real xterm textarea and records exact renderer-to-main PTY writes.",
"commands": [
"pnpm exec vitest run --config config/vitest.config.ts src/main/daemon/daemon-foreground-confirmation-protocol.test.ts src/main/daemon/daemon-pty-adapter.test.ts src/main/daemon/daemon-pty-router.test.ts src/main/daemon/daemon-server.test.ts src/main/daemon/degraded-daemon-pty-provider.test.ts src/main/daemon/pty-subprocess-foreground-scan-cadence.test.ts src/main/daemon/pty-subprocess.test.ts src/main/ipc/pty.test.ts src/main/providers/agent-foreground-process.test.ts src/main/providers/local-pty-provider.test.ts src/main/providers/windows-conpty-process-membership.test.ts src/renderer/src/components/terminal-pane/pane-foreground-agent-tracker.test.ts src/renderer/src/components/terminal-pane/pty-connection.test.ts src/renderer/src/components/terminal-pane/pty-transport.test.ts src/renderer/src/components/terminal-pane/terminal-pane-tab-detach.test.ts src/renderer/src/components/terminal-pane/terminal-shortcut-policy.test.ts src/renderer/src/components/terminal-pane/terminal-windows-shift-enter.test.ts src/renderer/src/store/slices/store-cascades.test.ts src/renderer/src/store/slices/terminal-pane-detach-agent-identity.test.ts src/shared/agent-process-recognition.test.ts src/shared/process-table-snapshot.test.ts tests/e2e/terminal-foreground-confirmation.unit.test.ts",
"pnpm run test:e2e -- tests/e2e/terminal-shortcuts.spec.ts",
"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/keyboard-handlers.test.ts src/renderer/src/components/terminal-pane/remote-runtime-pty-transport.test.ts src/renderer/src/components/terminal-pane/terminal-input-host-platform.test.ts"
],
"testFiles": [
"src/main/daemon/daemon-foreground-confirmation-protocol.test.ts",
"src/main/daemon/daemon-pty-adapter.test.ts",
"src/main/daemon/daemon-pty-router.test.ts",
"src/main/daemon/daemon-server.test.ts",
"src/main/daemon/degraded-daemon-pty-provider.test.ts",
"src/main/daemon/pty-subprocess-foreground-scan-cadence.test.ts",
"src/main/daemon/pty-subprocess.test.ts",
"src/main/ipc/pty.test.ts",
"src/main/providers/agent-foreground-process.test.ts",
"src/main/providers/local-pty-provider.test.ts",
"src/main/providers/windows-conpty-process-membership.test.ts",
"src/renderer/src/components/terminal-pane/pane-foreground-agent-tracker.test.ts",
"src/renderer/src/components/terminal-pane/keyboard-handlers.test.ts",
"src/renderer/src/components/terminal-pane/pty-connection.test.ts",
"src/renderer/src/components/terminal-pane/pty-transport.test.ts",
"src/renderer/src/components/terminal-pane/remote-runtime-pty-transport.test.ts",
"src/renderer/src/components/terminal-pane/terminal-pane-tab-detach.test.ts",
"src/renderer/src/components/terminal-pane/terminal-input-host-platform.test.ts",
"src/renderer/src/components/terminal-pane/terminal-shortcut-policy.test.ts",
"src/renderer/src/components/terminal-pane/terminal-windows-shift-enter.test.ts",
"src/renderer/src/store/slices/store-cascades.test.ts",
"src/renderer/src/store/slices/terminal-pane-detach-agent-identity.test.ts",
"src/shared/agent-process-recognition.test.ts",
"src/shared/process-table-snapshot.test.ts",
"tests/e2e/terminal-foreground-confirmation.unit.test.ts",
"tests/e2e/terminal-shortcuts.spec.ts"
],
"assertionRefs": [
{
"file": "src/shared/process-table-snapshot.test.ts",
"assertions": [
"a fresh request bypasses a same-tick TTL cache and any scan already in flight before the request",
"same-turn fresh requests and ordinary cache misses share one later scan while requests arriving after it starts queue behind it"
]
},
{
"file": "src/main/providers/agent-foreground-process.test.ts",
"assertions": [
"successful root-present Windows enumeration and failed, blank, malformed, or root-missing enumeration remain distinct evidence states",
"an observed shell root with no children is authoritative while a snapshot omitting that root is unavailable",
"an attached Droid candidate is authorized only when exact ConPTY membership contains it, while a detached Start-Process descendant is rejected",
"a Windows process-table scan with no recognized agent performs zero ConPTY membership helper forks",
"fresh POSIX scan failure or a snapshot missing the PTY root is unavailable rather than shell proof",
"the compatibility process-name API still preserves its existing fallback contract for other consumers"
]
},
{
"file": "src/main/providers/windows-conpty-process-membership.test.ts",
"assertions": [
"the fixed node-pty helper returns validated integer console membership containing the PTY root",
"root-only fallback, malformed/missing-root messages, spawn errors, and a silent helper timeout all fail closed",
"the bounded timeout kills the child helper exactly once"
]
},
{
"file": "src/main/providers/local-pty-provider.test.ts",
"assertions": [
"a delayed foreground confirmation is discarded after the owning PTY exits"
]
},
{
"file": "src/main/daemon/daemon-pty-adapter.test.ts",
"assertions": [
"new daemon sessions and warm reattach results carry the same minimal allowlisted launchAgent"
]
},
{
"file": "src/main/daemon/daemon-server.test.ts",
"assertions": [
"daemon protocol v21 persists allowlisted launchAgent across reattach and drops unknown identity strings"
]
},
{
"file": "src/main/daemon/pty-subprocess.test.ts",
"assertions": [
"Windows daemon foreground lookup can return PowerShell synchronously before async process-tree enrichment resolves the agent",
"the enriched agent result is served by a later foreground read",
"fresh confirmation awaits a post-request scan instead of serving cached PowerShell and returns null when inspection is unavailable"
]
},
{
"file": "tests/e2e/terminal-foreground-confirmation.unit.test.ts",
"assertions": [
"the real daemon handle and pane tracker keep restored Droid identity when confirmation resolves after the old cache window",
"one fresh command-finish scan confirms real shell exit, while unavailable inspection performs exactly three bounded reads and never claims shell"
]
},
{
"file": "src/renderer/src/components/terminal-pane/keyboard-handlers.test.ts",
"assertions": [
"the production keyboard-policy boundary requires active-host routing and composes macOS Shift+Enter with Windows PTY bytes"
]
},
{
"file": "src/renderer/src/components/terminal-pane/remote-runtime-pty-transport.test.ts",
"assertions": [
"a legacy remote PTY id retains the transport's captured runtime environment identity"
]
},
{
"file": "src/renderer/src/components/terminal-pane/terminal-input-host-platform.test.ts",
"assertions": [
"SSH terminals use remote-platform metadata and execution-host identity when the active transport has not captured a connection id",
"encoded and legacy active remote-runtime PTY identities plus a live local PTY session outrank later worktree host changes",
"a live WSL session normalizes to a Linux terminal host",
"missing SSH/runtime platform metadata and local terminals fall back to the client platform"
]
},
{
"file": "src/renderer/src/components/terminal-pane/terminal-shortcut-policy.test.ts",
"assertions": [
"Windows defaults and non-Droid agents preserve Esc+CR while explicit Droid capability selects CSI-u",
"Windows and non-Windows PTYs reached cross-OS use CSI-u only with active Kitty keyboard protocol unless trusted Windows Droid evidence independently authorizes it",
"unrelated keys invoke neither host, agent, nor protocol callbacks"
]
},
{
"file": "src/renderer/src/components/terminal-pane/terminal-windows-shift-enter.test.ts",
"assertions": [
"only routing-trusted current process identity overrides launch evidence and confirmed shell foreground clears stale identity",
"a newer untrusted or neutral command generation blocks stale launch ownership until confirmation",
"only allowlisted fresh process or pane-scoped launch ownership selects Droid's CSI-u capability",
"forged hook or OSC-derived Droid status cannot change the Windows byte encoding",
"after split and original-pane close, a sole surviving sibling cannot inherit the original pane's Droid launch identity"
]
},
{
"file": "src/renderer/src/components/terminal-pane/pane-foreground-agent-tracker.test.ts",
"assertions": [
"manual and restored local agent identity is published from bounded foreground-process reads",
"a delayed read cannot publish after the pane rebinds to a replacement PTY id",
"every new command publishes a routing-neutral generation before confirmation",
"typed agent text only widens the confirmation window and never becomes published or routable identity",
"unavailable typed-command confirmation stays on legacy routing through the three-read ladder and then fails closed",
"ordinary fast OSC 133;C-to-D command pairs publish shell without a fresh confirmation scan",
"command-start and visible launch recovery use at most three reads across the bounded 350 ms, 1.2 s, and 6 s ladder",
"null and rejected reads participate in the same bounded known-identity ladder",
"command-finished accepts one fresh recognized shell scan when agent evidence exists, while unavailable final evidence retires routing without claiming shell"
]
},
{
"file": "src/renderer/src/components/terminal-pane/pty-connection.test.ts",
"assertions": [
"after detach remount, pane-key launch/process identity forces a leaked nested OSC 133;D through foreground confirmation",
"a still-running Droid process republishes Droid instead of being overwritten with shell-foreground evidence",
"typing droid does not route CSI-u until fresh process evidence confirms Droid",
"null and rejected command-start reads never promote typed Droid text to process evidence",
"typed Droid input cannot replace live Antigravity process or pane-scoped launch identity inside another TUI",
"typed Droid input on SSH or remote-runtime panes never writes local process evidence",
"Droid routing survives a fresh command-finish scan that still sees Droid and retires after one fresh shell result",
"a D-to-C transition immediately routes legacy bytes while the new command generation is pending",
"an identityless visible-read versus OSC 133;D race cancels stale sampling and fails closed to shell",
"a manually typed Droid in a shell without OSC 133 gains routing only after accepted-input fresh confirmation",
"accepted no-OSC exit or interrupt input immediately revokes trusted Droid bytes and confirms the returned shell",
"unavailable command-finish evidence resolves deferred cleanup, returns legacy routing, and does not assert shell foreground",
"daemon-returned allowlisted launchAgent requests warm-reattach confirmation without restoring stale byte authority or the original args/env payload, while missing identity fails closed",
"an unknown persisted wrapper cannot spoof launch identity and confirmed shell state prevents repeat focus scans"
]
},
{
"file": "src/renderer/src/components/terminal-pane/pty-transport.test.ts",
"assertions": [
"allowlisted daemon launchAgent reaches PtyConnectResult on reattach",
"unknown launch identity is dropped at the renderer transport boundary"
]
},
{
"file": "src/renderer/src/store/slices/terminal-pane-detach-agent-identity.test.ts",
"assertions": [
"pane-to-tab detach moves only the detached leaf's launch and process identity to its new pane key",
"pane-to-tab detach preserves the source PTY shell override across native PowerShell and WSL classifications",
"the source hook snapshot is retired rather than copied to a key the running PTY cannot emit",
"the detached Droid keeps CSI-u while the source sibling keeps its own legacy encoding"
]
},
{
"file": "src/shared/agent-process-recognition.test.ts",
"assertions": [
"Droid's process name resolves to the allowlisted Droid agent identity without substring matching"
]
},
{
"file": "tests/e2e/terminal-shortcuts.spec.ts",
"assertions": [
"on Windows the focused terminal sends CSI-u bytes for a Droid pane and Esc+CR bytes after switching that same pane to Antigravity identity",
"the byte oracle observes the real renderer-to-main PTY write path rather than terminal DOM state"
]
}
],
"evidenceRuns": [
{
"date": "2026-07-10",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/main/daemon/daemon-foreground-confirmation-protocol.test.ts src/main/daemon/daemon-pty-adapter.test.ts src/main/daemon/daemon-pty-router.test.ts src/main/daemon/daemon-server.test.ts src/main/daemon/degraded-daemon-pty-provider.test.ts src/main/daemon/pty-subprocess-foreground-scan-cadence.test.ts src/main/daemon/pty-subprocess.test.ts src/main/ipc/pty.test.ts src/main/providers/agent-foreground-process.test.ts src/main/providers/local-pty-provider.test.ts src/main/providers/windows-conpty-process-membership.test.ts src/renderer/src/components/terminal-pane/pane-foreground-agent-tracker.test.ts src/renderer/src/components/terminal-pane/pty-connection.test.ts src/renderer/src/components/terminal-pane/pty-transport.test.ts src/renderer/src/components/terminal-pane/terminal-pane-tab-detach.test.ts src/renderer/src/components/terminal-pane/terminal-shortcut-policy.test.ts src/renderer/src/components/terminal-pane/terminal-windows-shift-enter.test.ts src/renderer/src/store/slices/store-cascades.test.ts src/renderer/src/store/slices/terminal-pane-detach-agent-identity.test.ts src/shared/agent-process-recognition.test.ts src/shared/process-table-snapshot.test.ts tests/e2e/terminal-foreground-confirmation.unit.test.ts",
"result": "passed",
"durationSeconds": 8.71,
"summary": "Twenty-two focused test files passed (1206 tests) on current main, covering fresh-scan ordering/deduplication, exact ConPTY membership and detached-child rejection, stale PTY guards, daemon v21 launch ownership with current-process confirmation, no-OSC command/exit recovery, preserved detach shell classification, unavailable evidence, routing-neutral command generations, exact shortcut bytes, and the composed daemon-plus-tracker contract; the Windows Electron byte test remains platform-gated and is not counted as local macOS evidence."
}
],
"runtimeBudget": {
"p95Seconds": 90,
"scope": "focused renderer units plus the Windows Electron terminal-shortcut spec"
},
"flakeHistory": {
"status": "unknown",
"evidence": "The deterministic units are stable locally; the Windows-only Electron byte path needs CI or nightly soak history before promotion."
},
"redGreenEvidence": {
"status": "partial",
"evidence": "Reverting to the previous unconditional Windows Esc+CR branch fails the Droid byte assertion, while resolving launch metadata from any key other than the active pane fails the split-survivor isolation assertion. Saved intentional-break artifacts and live Windows history are still missing."
},
"performanceBudget": {
"required": true,
"evidence": "Callback-count tests prove unrelated ordinary keys invoke neither host, agent, nor Kitty-protocol resolution. Host and agent callbacks are created once per keyboard effect, so printable input adds no per-key allocations or store reads. Shift+Enter performs bounded synchronous active-transport and indexed store lookups, plus at most one pane-keyed protocol-mode lookup when trusted Windows Droid evidence does not already authorize CSI-u, with no IPC, RPC, subprocess, polling, listener, or timer. Typed text performs no routing write. Ordinary fast OSC 133;C-to-D shell commands perform no fresh confirmation RPC or process scan. An accepted submit/interrupt while trusted Droid is current, a typed allowlisted agent command, title exit, focus, visibility transition, or an idle burst after trusted Droid Shift+Enter can schedule the bounded confirmation ladder; each event cancels/deduplicates prior work and no timer recurs after settling. Windows confirmation performs one fresh process-table scan and forks exact ConPTY membership only after a recognized agent candidate appears; no recognized candidate makes zero helper calls. Same-turn fresh requests share one scan and later arrivals queue at most one successor. Recovery remains three bounded one-shot reads (350 ms, 1.2 s, 6 s). No polling loop, provider fanout, persistent listener, hidden-pane wake loop, or per-printable-key work is added."
},
"promotionCriteria": [
"Run the exact PTY-byte Electron oracle on Windows without silent platform skips.",
"Collect stable runtime and flake history for local and daemon Windows ConPTY while retaining deterministic host-routing assertions for SSH, WSL, and remote runtime.",
"Attach saved intentional-break evidence for Droid capability removal and split-sibling identity leakage."
],
"knownGaps": [
"No Windows runner or live Windows PTY evidence is attached; the Electron byte test skips on macOS and Linux, while a live Linux SSH PTY covers only the remote Linux host path.",
"Droid agent-specific CSI-u authorization is available only from trusted pane evidence; without it, Windows and non-Windows PTY hosts depend on the application's Kitty keyboard protocol state.",
"The Electron test injects allowlisted pane identity rather than launching the real Droid and Antigravity binaries.",
"If both Windows process-enumeration backends remain unavailable through the bounded ladder, routing fails closed to the legacy Esc+CR path; no live Droid artifact covers that degraded host configuration.",
"Protocol v21 restarts older daemons because the minimal persisted launchAgent is a new contract; sessions preserved by pre-v21 daemons cannot supply warm-reattach launch ownership and fail closed until current process confirmation or restart.",
"No live daemon, WSL, remote-runtime, paired-web, or restore/replay byte artifact has been collected; SSH is covered only by a macOS-client-to-Linux-host relay run.",
"A running PTY keeps its spawn-time ORCA_PANE_KEY after pane-to-tab detach. This change transfers launch/process routing evidence and retires the stale hook snapshot, but does not redesign future hook reattribution across tab IDs."
],
"demotionRule": "Keep non-blocking or demote to protection none if the Windows byte test silently skips, flakes without an actionable artifact, routes bytes using tab/title/terminal-output heuristics, or adds any ordinary-key lookup, IPC, polling, scan, or lifecycle leak."
},
{
"id": "terminal-input.guarded-agent-send-authorization",
"title": "Guarded agent sends authorize only the confirmed exact PTY",
"maturity": "experimental",
"protection": "partial",
"owner": "terminal-input",
"layer": "runtime-provider-contract",
"surfaces": [
"terminal input",
"guarded note sends",
"agent status",
"PTY identity",
"foreground process confirmation"
],
"platforms": [
"macos",
"linux",
"windows"
],
"providers": [
"local",
"daemon",
"ssh",
"wsl",
"remote-runtime"
],
"coveredPlatforms": [
"macos"
],
"coveredProviders": [
"local",
"daemon"
],
"coverageNotes": "Runtime and provider-contract tests on macOS cover exact-PTY authorization, local/daemon fresh confirmation, exact ConPTY membership, and unsupported-provider fail-closed behavior. Physical Windows, live Linux, SSH, WSL, and remote-runtime validation remain explicit gaps; providers without confirmation preserve conservative refusal on a shell conflict.",
"motivatingLinks": [
"https://github.com/stablyai/orca/issues/8303"
],
"invariant": "A guarded note send writes only to the exact PTY binding checked by the guard and only while permission/wait evidence allows input; fresh hook state conflicting with an ordinary shell foreground requires fresh provider confirmation of a recognized agent in that PTY.",
"oracle": "Fresh explicit state plus ordinary PowerShell plus confirmed recognized agent is sendable on the same PTY. Confirmed shell/non-agent, unavailable confirmation, PTY exit, handle rebind, or a callback PTY mismatch returns a refusal or not-writable result and writes zero bytes.",
"commands": [
"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/orca-runtime.test.ts src/main/runtime/rpc/terminal-send.test.ts src/main/ipc/pty.test.ts src/main/providers/agent-foreground-process.test.ts src/main/providers/local-pty-provider.test.ts src/main/providers/windows-conpty-process-membership.test.ts src/main/daemon/daemon-foreground-confirmation-protocol.test.ts src/main/daemon/pty-subprocess.test.ts src/renderer/src/lib/active-agent-note-send.test.ts src/renderer/src/components/browser-pane/BrowserAnnotationSendMenuContent.test.tsx"
],
"testFiles": [
"src/main/runtime/orca-runtime.test.ts",
"src/main/runtime/rpc/terminal-send.test.ts",
"src/main/ipc/pty.test.ts",
"src/main/providers/agent-foreground-process.test.ts",
"src/main/providers/local-pty-provider.test.ts",
"src/main/providers/windows-conpty-process-membership.test.ts",
"src/main/daemon/daemon-foreground-confirmation-protocol.test.ts",
"src/main/daemon/pty-subprocess.test.ts",
"src/renderer/src/lib/active-agent-note-send.test.ts",
"src/renderer/src/components/browser-pane/BrowserAnnotationSendMenuContent.test.tsx"
],
"assertionRefs": [
{
"file": "src/main/runtime/orca-runtime.test.ts",
"assertions": [
"a recognized fresh provider confirmation authorizes explicit hook state over an ordinary shell result",
"shell, non-agent, null, thrown, and missing confirmation remain fail-closed",
"title blockers and ordinary recognized agent evidence add no confirmation call",
"PTY exit or handle rebind during either foreground read rejects evidence bound to the original PTY",
"controller-less yields preserve stale-handle errors and confirmation methods retain their controller receiver"
]
},
{
"file": "src/main/runtime/rpc/terminal-send.test.ts",
"assertions": [
"a handle rebind during guarded status evaluation returns not writable and writes zero bytes",
"the callback's actual PTY must equal the handle binding before status can authorize a write"
]
},
{
"file": "src/main/ipc/pty.test.ts",
"assertions": [
"runtime confirmation reaches the provider owning the captured PTY",
"unsupported or missing providers return unavailable confirmation"
]
},
{
"file": "src/main/providers/agent-foreground-process.test.ts",
"assertions": [
"recognized Windows candidates require exact ConPTY membership and detached descendants are rejected",
"unavailable process inspection is distinct from authoritative shell evidence"
]
},
{
"file": "src/main/providers/local-pty-provider.test.ts",
"assertions": [
"fresh confirmation is discarded when its owning local PTY exits"
]
},
{
"file": "src/main/providers/windows-conpty-process-membership.test.ts",
"assertions": [
"exact ConPTY console membership comes from the fixed node-pty helper",
"malformed, incomplete, timed-out, and spawn-error membership reads fail closed"
]
},
{
"file": "src/main/daemon/daemon-foreground-confirmation-protocol.test.ts",
"assertions": [
"daemons from before the fresh-confirmation RPC are rejected by protocol version"
]
},
{
"file": "src/main/daemon/pty-subprocess.test.ts",
"assertions": [
"fresh confirmation bypasses cached PowerShell and waits for a post-request process scan"
]
},
{
"file": "src/renderer/src/lib/active-agent-note-send.test.ts",
"assertions": [
"selected active-agent note sends retain guarded paste and submit routing"
]
},
{
"file": "src/renderer/src/components/browser-pane/BrowserAnnotationSendMenuContent.test.tsx",
"assertions": [
"browser annotation send content routes through review-notes send so existing agent sessions remain selectable",
"both browser annotation send surfaces wire the shared menu content"
]
}
],
"evidenceRuns": [
{
"date": "2026-07-11",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/orca-runtime.test.ts src/main/runtime/rpc/terminal-send.test.ts src/main/ipc/pty.test.ts src/main/providers/agent-foreground-process.test.ts src/main/providers/local-pty-provider.test.ts src/main/providers/windows-conpty-process-membership.test.ts src/main/daemon/daemon-foreground-confirmation-protocol.test.ts src/main/daemon/pty-subprocess.test.ts src/renderer/src/lib/active-agent-note-send.test.ts src/renderer/src/components/browser-pane/BrowserAnnotationSendMenuContent.test.tsx",
"result": "passed",
"durationSeconds": 9.58,
"summary": "Ten focused test files passed (1183 tests), covering runtime confirmation and PTY revalidation, guarded RPC zero-write behavior, PTY controller routing, local/daemon fresh scans, exact ConPTY membership, and unchanged renderer note routing."
}
],
"runtimeBudget": {
"p95Seconds": 45,
"scope": "focused runtime, RPC, PTY provider, and renderer routing units"
},
"flakeHistory": {
"status": "unknown",
"evidence": "Deterministic units have local coverage only; promotion requires repeated CI and platform history."
},
"redGreenEvidence": {
"status": "partial",
"evidence": "Removing strong confirmation fails the shell-conflict success oracle, while removing either exact-binding comparison fails zero-write rebind coverage; saved intentional-break and physical Windows evidence remain missing."
},
"performanceBudget": {
"required": true,
"evidence": "Confirmation is invoked at most once per status evaluation and only for fresh explicit hook state whose ordinary foreground result is a shell. Count tests prove permission/title blockers and ordinary recognized-agent evidence add zero confirmations; no polling, retry, session listing, provider fanout, or runtime-global cache is added, and existing provider snapshot dedup remains authoritative."
},
"promotionCriteria": [
"Run the browser annotation existing-agent and repeat-send path in Electron on Windows ConPTY without a recognition refusal.",
"Collect stable CI and flake history across local and daemon providers on Windows plus representative macOS/Linux coverage.",
"Attach saved intentional-break evidence for confirmation removal and exact-PTY revalidation removal."
],
"knownGaps": [
"Physical Windows validation is unavailable on the current macOS host; exact ConPTY membership is covered deterministically.",
"Electron annotation golden-path, repeat-send, adjacent-menu evidence, and screenshots are left to coordinator validation.",
"SSH, WSL, legacy daemon, and remote-runtime providers without confirmation remain intentionally fail-closed on an ordinary-shell conflict; no live artifacts cover those degraded paths.",
"No live Linux PTY, paired-web, mobile/relay, restore/replay, or multi-window artifact is attached; those surfaces receive no renderer, persistence, or protocol change."
],
"demotionRule": "Keep non-blocking or demote to protection none if provider confirmation becomes unconditional, exact-PTY mismatch can write bytes, unsupported providers fail open, or the focused gate flakes without an actionable product or harness defect."
},
{
"id": "terminal-input.agent-prompt-injection",
"title": "Orchestration agent prompts arrive as bracketed paste before submit",
"maturity": "experimental",
"protection": "partial",
"owner": "terminal-input",
"layer": "runtime-contract-and-cli-repro",
"surfaces": [
"terminal input",
"agent prompt injection",
"orchestration dispatch",
"PTY writes",
"bracketed paste"
],
"platforms": [
"macos",
"linux",
"windows"
],
"providers": [
"local",
"daemon",
"ssh",
"remote-runtime"
],
"coveredPlatforms": [
"macos"
],
"coveredProviders": [
"local"
],
"coverageNotes": "Local macOS evidence covers the runtime PTY write contract and a live dev-runtime CLI repro. SSH, daemon, remote-runtime, Linux, and Windows remain provider/platform gaps; the product path stays provider-owned and does not add local filesystem or process assumptions.",
"motivatingLinks": [
"https://github.com/stablyai/orca/issues/7226"
],
"invariant": "Injected orchestration task prompts for recognized agent CLIs must send the prompt body inside one bracketed-paste frame, sanitize embedded ESC bytes, preserve chunk boundaries without losing the frame, and send Enter only after the paste frame completes.",
"oracle": "Runtime tests assert the exact PTY write sequence and failure cleanup; orchestration tests assert dispatch/coordinator use the agent prompt path; the live CLI harness dispatches a 32KB task to a fake Codex-like TUI and requires marker present, bracketed paste present, zero unframed line breaks, and submit observed.",
"commands": [
"pnpm exec vitest run --config config/vitest.config.ts src/shared/agent-prompt-injection.test.ts src/main/runtime/orca-runtime.test.ts src/main/runtime/rpc/methods/orchestration.test.ts src/main/runtime/orchestration/coordinator.test.ts",
"node tools/repro-orchestration-long-prompt.mjs --cli out/bin/orca-dev --mode codex-like --size-kb 32 --timeout-ms 20000"
],
"testFiles": [
"src/shared/agent-prompt-injection.test.ts",
"src/main/runtime/orca-runtime.test.ts",
"src/main/runtime/rpc/methods/orchestration.test.ts",
"src/main/runtime/orchestration/coordinator.test.ts",
"tools/repro-orchestration-long-prompt.mjs"
],
"assertionRefs": [
{
"file": "src/shared/agent-prompt-injection.test.ts",
"assertions": [
"agent prompts are always framed as bracketed paste",
"submit stays separate from the paste frame",
"embedded ESC bytes are made inert before framing",
"chunk reconstruction preserves the paste frame"
]
},
{
"file": "src/main/runtime/orca-runtime.test.ts",
"assertions": [
"runtime writes bracketed paste before a delayed submit",
"large prompt frames are chunked and reconstructed before submit",
"partial prompt write failure closes the paste frame and does not submit"
]
},
{
"file": "src/main/runtime/rpc/methods/orchestration.test.ts",
"assertions": [
"orchestration.dispatch uses the agent prompt path for injected preambles",
"raw terminal.send is not called for injected task prompts",
"failed prompt injection rolls back the active dispatch"
]
},
{
"file": "src/main/runtime/orchestration/coordinator.test.ts",
"assertions": [
"coordinator dispatch failures from prompt injection circuit-break through the DB",
"silent-skip paths do not attempt prompt injection"
]
},
{
"file": "tools/repro-orchestration-long-prompt.mjs",
"assertions": [
"fake Codex-like worker observes submit after long orchestration dispatch",
"32KB task marker survives before submit",
"prompt bytes include a bracketed-paste frame with zero unframed line breaks"
]
}
],
"evidenceRuns": [
{
"date": "2026-07-07",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/shared/agent-prompt-injection.test.ts src/main/runtime/orca-runtime.test.ts src/main/runtime/rpc/methods/orchestration.test.ts src/main/runtime/orchestration/coordinator.test.ts",
"result": "passed",
"durationSeconds": 7.4,
"summary": "4 test files passed, 697 tests passed; covers framing, runtime PTY writes, orchestration RPC dispatch, and coordinator dispatch behavior."
},
{
"date": "2026-07-07",
"runner": "local",
"platform": "macos",
"command": "node tools/repro-orchestration-long-prompt.mjs --cli out/bin/orca-dev --mode codex-like --size-kb 32 --timeout-ms 20000",
"result": "passed",
"durationSeconds": 2.2,
"summary": "Live dev-runtime repro passed: expectedSpecBytes=32830, hasSubmit=true, rawContainsMarker=true, hasBracketedPasteFrame=true, unframedLineBreaks=0, contractOk=true."
}
],
"runtimeBudget": {
"p95Seconds": 30,
"scope": "runtime contract tests plus optional local dev-runtime CLI repro"
},
"flakeHistory": {
"status": "unknown",
"evidence": "First local macOS evidence only; needs repeated dev-runtime harness runs and provider matrix evidence before promotion."
},
"redGreenEvidence": {
"status": "partial",
"evidence": "The live harness reproduced the unsafe raw multiline contract before the fix and passes after the fix; intentional-break evidence is local only and not yet in CI."
},
"performanceBudget": {
"required": true,
"evidence": "Agent prompt dispatch remains O(prompt bytes), uses the existing 16KB terminal input chunking and one existing 500ms submit delay, and adds no polling, provider listing, subprocess churn, hidden-pane wakeups, or renderer work."
},
"promotionCriteria": [
"Run the live harness in soak with a self-starting dev runtime or provider-contract fixture.",
"Add daemon, SSH, remote-runtime, Linux, and Windows evidence or mark narrower provider scope.",
"Capture stable red/green intentional-break evidence in CI before blocking promotion."
],
"knownGaps": [
"Live harness command currently expects an already-running dev runtime and generated out/bin/orca-dev wrapper.",
"No Windows ConPTY, Linux PTY, SSH, daemon, or remote-runtime live evidence yet.",
"Push-on-idle orchestration message banners remain outside this dispatch-prompt gate."
],
"demotionRule": "Demote or quarantine if the live harness flakes without a product bug or harness bug filed to the terminal-input owner."
},
{
"id": "terminal-render.windows-cjk-repaint",
"title": "Windows ConPTY wide glyphs and cursor rewrites repaint without stale cells",
"maturity": "experimental",
"protection": "none",
"owner": "terminal-rendering",
"layer": "windows-electron-conpty",
"surfaces": [
"Windows ConPTY",
"CJK",
"emoji",
"wide glyphs",
"cursor repaint",
"rewrite output"
],
"platforms": [
"windows"
],
"providers": [
"local",
"daemon",
"wsl"
],
"coveredPlatforms": [],
"coveredProviders": [],
"coverageNotes": "Registered gap only; no executable coverage is wired yet.",
"motivatingLinks": [
"https://github.com/stablyai/orca/pull/6876",
"https://github.com/stablyai/orca/pull/6968",
"https://github.com/stablyai/orca/pull/6970"
],
"invariant": "Windows terminal repaint must not leave stale cells, clipped wide glyphs, or hidden cursor state after CJK, emoji, or cursor-rewrite output.",
"oracle": "A Windows gate combines xterm buffer assertions with bounded screenshot/canvas evidence for representative CJK, emoji, and rewrite sequences.",
"commands": [],
"testFiles": [],
"assertionRefs": [],
"evidenceRuns": [],
"runtimeBudget": {
"p95Seconds": 90,
"scope": "Windows focused Electron render gate"
},
"flakeHistory": {
"status": "not-started",
"evidence": "Gate is registered as a known Windows rendering gap; no command is wired."
},
"redGreenEvidence": {
"status": "missing",
"evidence": "Needs intentional-break proof for stale wide-glyph repaint or cursor restore."
},
"performanceBudget": {
"required": true,
"evidence": "Must record refresh count or frame budget so repaint fixes do not mask excessive redraw churn."
},
"promotionCriteria": [
"Use buffer/cell evidence as the primary oracle and screenshots as diagnostics.",
"Keep stress cases non-blocking until Windows runtime history is stable.",
"Fail promotion on silent Windows environment skips."
],
"knownGaps": [
"No manifest command yet.",
"No Windows CJK/emoji repaint command is wired."
],
"demotionRule": "Cannot promote if the oracle is screenshot-only or environment-skipped."
},
{
"id": "terminal-shell.windows-resolution-parity",
"title": "Windows local and daemon providers resolve shells and startup commands consistently",
"maturity": "experimental",
"protection": "none",
"owner": "terminal-platform",
"layer": "provider-contract-windows",
"surfaces": [
"shell resolution",
"startup command",
"cwd",
"environment",
"local provider",
"daemon provider"
],
"platforms": [
"windows"
],
"providers": [
"local",
"daemon",
"wsl"
],
"coveredPlatforms": [],
"coveredProviders": [],
"coverageNotes": "Registered gap only; no executable coverage is wired yet.",
"motivatingLinks": [
"https://github.com/stablyai/orca/pull/6541",
"https://github.com/stablyai/orca/pull/6858"
],
"invariant": "Windows local and daemon terminals must resolve equivalent shell paths, args, cwd, env, startup command delivery, and fallback behavior for PowerShell 5/7, cmd, Git Bash, WSL, and missing pwsh.",
"oracle": "Provider-contract fixtures compare resolved command descriptors and live shell markers for supported Windows shells across local and daemon providers.",
"commands": [],
"testFiles": [],
"assertionRefs": [],
"evidenceRuns": [],
"runtimeBudget": {
"p95Seconds": 60,
"scope": "Windows provider-contract gate"
},
"flakeHistory": {
"status": "not-started",
"evidence": "Gate is registered as a known Windows shell parity gap; no command is wired."
},
"redGreenEvidence": {
"status": "missing",
"evidence": "Needs intentional-break proof for mismatched daemon/local shell resolution or lost startup command."
},
"performanceBudget": {
"required": false,
"evidence": "Required if resolution adds probing or PATH scans on hot startup paths."
},
"promotionCriteria": [
"Start with provider-contract fixtures before live Electron coverage.",
"Cover missing-shell fallback explicitly.",
"Fail promotion on silent Windows environment skips."
],
"knownGaps": [
"No manifest command yet.",
"No local-vs-daemon Windows shell parity command is wired."
],
"demotionRule": "Cannot promote if local and daemon provider behavior are tested separately without parity assertions."
},
{
"id": "terminal-performance.input-throughput",
"title": "Terminal input latency and throughput stay inside explicit budgets",
"maturity": "experimental",
"protection": "none",
"owner": "terminal-performance",
"layer": "electron-perf",
"surfaces": [
"typing latency",
"output throughput",
"hidden output",
"renderer CPU",
"resize churn"
],
"platforms": [
"macos",
"linux",
"windows"
],
"providers": [
"local",
"daemon",
"ssh",
"remote-runtime"
],
"coveredPlatforms": [],
"coveredProviders": [],
"coverageNotes": "Registered gap only; no executable coverage is wired yet.",
"motivatingLinks": [
"https://github.com/stablyai/orca/pull/7002",
"https://github.com/stablyai/orca/pull/6858"
],
"invariant": "Terminal typing, paste, resize, and output rendering must stay within latency and throughput budgets under realistic active and hidden-output load.",
"oracle": "Perf artifacts record median/p95/max key latency, event-loop delay, renderer CPU, output bytes/sec, resize count, hidden restore latency, queue depth, and dropped-output counts.",
"commands": [],
"testFiles": [],
"assertionRefs": [],
"evidenceRuns": [],
"runtimeBudget": {
"p95Seconds": 120,
"scope": "focused terminal perf report gate"
},
"flakeHistory": {
"status": "not-started",
"evidence": "Existing terminal perf scripts exist, but this gate is not wired with budgets or artifacts."
},
"redGreenEvidence": {
"status": "missing",
"evidence": "Needs intentional-break proof for hot-path listing, unbounded scheduler work, and input starvation."
},
"performanceBudget": {
"required": true,
"evidence": "Suggested initial budgets: active key median <=75ms, worst <=300ms in perf scenarios, dropped output 0, and bounded queue depths recorded per run."
},
"promotionCriteria": [
"Wire existing perf scripts to emit machine-readable artifacts.",
"Make budgets platform-aware before blocking.",
"Do not promote stress variants until runtime history is stable."
],
"knownGaps": [
"No manifest command yet.",
"Existing perf scripts are not registered with explicit budgets or flake history."
],
"demotionRule": "Cannot promote without metric artifacts and stable p95 runtime history."
},
{
"id": "terminal-performance.daemon-stream-backpressure",
"title": "Daemon terminal streams respect socket backpressure under output floods",
"maturity": "experimental",
"protection": "none",
"owner": "terminal-performance",
"layer": "daemon-provider-contract",
"surfaces": [
"daemon stream",
"socket write",
"drain",
"hidden output",
"input starvation"
],
"platforms": [
"macos",
"linux",
"windows"
],
"providers": [
"daemon"
],
"coveredPlatforms": [],
"coveredProviders": [],
"coverageNotes": "Registered gap on main. The daemon batcher write(false)/drain contracts exist only on the pending reliability stack. It registers here with its owning split PR.",
"motivatingLinks": [
"https://github.com/stablyai/orca/pull/6836",
"https://github.com/stablyai/orca/pull/6858"
],
"invariant": "Daemon terminal output floods must pause when socket writes return false, resume on drain, keep buffered bytes bounded, and not starve focused input.",
"oracle": "The current executable slice injects a slow socket and asserts write(false)/drain ordering, bounded queued daemon stream bytes, close/error listener cleanup, newest-tail preservation under sustained pressure, and flush-immediate cross-session priority ahead of unrelated background backlog on drain. Active input latency remains part of the broader perf gate.",
"commands": [],
"testFiles": [],
"assertionRefs": [],
"evidenceRuns": [],
"runtimeBudget": {
"p95Seconds": 60,
"scope": "daemon provider-contract gate"
},
"flakeHistory": {
"status": "unknown",
"evidence": "Focused daemon stream backpressure contract runs locally; needs soak history before promotion."
},
"redGreenEvidence": {
"status": "partial",
"evidence": "Tests assert daemon stream writes pause after socket write(false), later stream data queues behind the pressured socket, flush-immediate output from another session is prioritized ahead of unrelated queued background backlog on drain while preserving per-session order, queued lines resume on drain, global cleanup and close/error clear pending drain listeners, and queued bytes are bounded by preserving priority output plus the newest tail. Needs intentional-break artifact plus active-input latency proof before promotion."
},
"performanceBudget": {
"required": true,
"evidence": "Must record queued bytes, drain count, write(false) count, dropped output, and active input latency."
},
"promotionCriteria": [
"Keep deterministic socket mocks as the blocking candidate only after soak.",
"Record byte and drain artifacts on failure.",
"Pair with the broader output-backpressure budget before blocking."
],
"knownGaps": [
"No executable coverage on main yet; the slice lives on the pending fix-terminal-reliability stack.",
"Current command is daemon batcher contract coverage, not live daemon/Electron perf.",
"Active input latency is not proven in live daemon/Electron perf."
],
"demotionRule": "Cannot promote if backpressure is inferred only from renderer output success."
},
{
"id": "terminal-performance.store-and-git-hot-paths",
"title": "Terminal-adjacent store and git polling work stays off hot interaction paths",
"maturity": "experimental",
"protection": "none",
"owner": "terminal-performance",
"layer": "renderer-main-perf-contract",
"surfaces": [
"store selectors",
"git polling",
"startup hydration",
"terminal focus",
"tab switch",
"workspace switch",
"agent status"
],
"platforms": [
"macos",
"linux",
"windows"
],
"providers": [
"local",
"daemon",
"ssh",
"remote-runtime"
],
"coveredPlatforms": [],
"coveredProviders": [],
"coverageNotes": "Registered gap on main. The boot-hydration counters and their tests exist only on the pending reliability stack. It registers here with its owning split PR.",
"motivatingLinks": [
"https://github.com/stablyai/orca/pull/7002"
],
"invariant": "Terminal typing, focus, resize, tab/workspace switch, and agent/session restore must not trigger unbounded store projection, git status, provider listing, or per-pane polling work.",
"oracle": "The current executable slice instruments boot-time local PTY registry hydration with repo counts, local-vs-remote repo skips, worktree enumeration counts, adapter/session listing counts, registration/skipped-session counts, duration, and failure phase. The broader oracle still needs instrumentation that counts store selector recomputes, git status requests, provider listings, and session scans during scripted hot interactions with many worktrees and terminal panes.",
"commands": [],
"testFiles": [],
"assertionRefs": [],
"evidenceRuns": [],
"runtimeBudget": {
"p95Seconds": 60,
"scope": "renderer-main perf/count gate"
},
"flakeHistory": {
"status": "unknown",
"evidence": "Focused boot-hydration counter slice passed locally once; needs CI/runtime history before promotion."
},
"redGreenEvidence": {
"status": "partial",
"evidence": "Tests would fail if boot hydration enumerated SSH worktrees, stopped recording provider-unavailable retry state, lost the startup counter surface, stopped recording fatal hydration failures, or missed router adapter fanout/list-failure counters. Needs intentional-break proof for git/status polling or store scans triggered by terminal hot paths."
},
"performanceBudget": {
"required": true,
"evidence": "Current slice records boot-hydration repo, worktree, adapter, session, skip, register, and duration counters. Promotion still requires count budgets for listSessions, git status, provider scans, store recomputes, and elapsed hot-interaction time."
},
"promotionCriteria": [
"Use deterministic counters before broad perf scenarios.",
"Cover high-session and high-worktree fixtures.",
"Keep stress variants non-blocking until stable."
],
"knownGaps": [
"No executable coverage on main yet; the slice lives on the pending fix-terminal-reliability stack.",
"Current command covers boot hydration counters only, not interactive terminal hot paths.",
"No Electron count gate yet proves focus, typing, tab switch, workspace switch, render, or high-session provider fanout avoids broad store/git/provider scans."
],
"demotionRule": "Cannot promote without count budgets and actionable artifacts."
},
{
"id": "terminal-output.scrollback-restore",
"title": "Scrollback restore, hidden output, and replay clear semantics do not overlap stale bytes",
"maturity": "experimental",
"protection": "partial",
"owner": "terminal-rendering",
"layer": "renderer-provider-contract",
"surfaces": [
"scrollback",
"hidden output",
"snapshot replay",
"metadata-only replay",
"clear semantics"
],
"platforms": [
"macos",
"linux",
"windows"
],
"providers": [
"local",
"daemon",
"ssh",
"remote-runtime"
],
"coveredPlatforms": [
"macos"
],
"coveredProviders": [],
"coverageNotes": "Local macOS evidence over the merged #7133/#7173 restore and hidden-output ordering tests on main@1282f5c2d. The dirty-state exactness contract, normal-buffer clear semantics, and metadata-only replay remain pending-stack work.",
"motivatingLinks": [
"https://github.com/stablyai/orca/pull/7173",
"https://github.com/stablyai/orca/pull/7133",
"https://github.com/stablyai/orca/pull/7012",
"https://github.com/stablyai/orca/pull/7054",
"https://github.com/stablyai/orca/pull/6949"
],
"invariant": "Hidden-output restore, snapshot replay, metadata-only replay, and clear-before-replay must preserve order and never overlay stale bytes on newer live terminal output; restoring a snapshot onto an already-dirty pane must yield a buffer exactly equal to the snapshot frame.",
"oracle": "Apply snapshots onto adversarially dirty pane states (already on the alternate screen, stale content occupying cells the new frame leaves blank, scrollback present, wide glyphs, revived sessions with restarted PTY seq counters) and assert exact buffer equality with the snapshot frame; fault injection interleaves hidden chunks, live output, metadata-only replay, and clear-before-replay, then asserts ordered terminal buffer content, clear decisions, and replay diagnostics. Marker-presence checks are not acceptable evidence on restore paths.",
"commands": [
"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/pty-connection.test.ts"
],
"testFiles": [
"src/renderer/src/components/terminal-pane/pty-connection.test.ts"
],
"assertionRefs": [
{
"file": "src/renderer/src/components/terminal-pane/pty-connection.test.ts",
"assertions": [
"restoring an alternate-screen snapshot clears only the alternate screen (#7133)",
"hidden Codex output is restored when the pty seq counter restarts, with or without an observed exit (#7173)",
"pending hidden restore chunks are not replayed after a terminal clear",
"a scrolled-up viewport is preserved after hidden-backlog snapshot replay"
]
}
],
"evidenceRuns": [
{
"date": "2026-07-03",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/pty-connection.test.ts",
"result": "passed",
"durationSeconds": 8.4,
"summary": "1 test file(s) passed, 311 tests passed on main@1282f5c2d in a clean checkout."
}
],
"runtimeBudget": {
"p95Seconds": 45,
"scope": "renderer provider-contract gate"
},
"flakeHistory": {
"status": "not-started",
"evidence": "Remote replay FIFO has a focused slice, but the broader scrollback restore gate is not wired."
},
"redGreenEvidence": {
"status": "partial",
"evidence": "#7133 and #7173 each proved their slices red before fix (stale alt-screen bleed-through; stale background chunk written after restore; frozen revived seq counters). The broader dirty-state exactness contract has no red runs yet."
},
"performanceBudget": {
"required": true,
"evidence": "Must keep hidden restore bounded and avoid unbounded renderer parsing or wake loops."
},
"promotionCriteria": [
"Start every restore case from adversarially dirty pane state, never only fresh terminals.",
"Assert frame exactness or stale-content absence, never marker presence.",
"Build deterministic lower-layer clear and interleaving tests before broad golden E2E.",
"Use long-table/golden visual tests only as supporting evidence.",
"Record ordered buffer diagnostics on failure."
],
"knownGaps": [
"No manifest command yet.",
"The existing replay FIFO command is narrower than this broader scrollback restore invariant.",
"#7133's merged alt-only-clear restore tests exist on main but are not yet registered as this gate's command.",
"#7173's ordered-seq interleaving and session-revival tests in pty-connection.test.ts on main are the seed for the hidden/live interleaving slice and are unregistered until the rebase."
],
"demotionRule": "Cannot promote without clear-semantics and hidden/live interleaving assertions."
},
{
"id": "terminal-capability.startup-color-query",
"title": "Startup color capability queries do not leak into shell or terminal streams",
"maturity": "experimental",
"protection": "none",
"owner": "terminal-rendering",
"layer": "renderer-provider-contract",
"surfaces": [
"OSC 10/11",
"startup capability query",
"shell stream",
"renderer stream",
"terminal colors"
],
"platforms": [
"macos",
"linux",
"windows"
],
"providers": [
"local",
"daemon",
"ssh",
"remote-runtime"
],
"coveredPlatforms": [],
"coveredProviders": [],
"coverageNotes": "Registered gap only; no executable coverage is wired yet.",
"motivatingLinks": [
"https://github.com/stablyai/orca/pull/6949"
],
"invariant": "Startup OSC 10/11 color queries are answered out of band at startup only, never leak into shell/provider output streams, and ordinary runtime OSC color queries remain renderer-handled.",
"oracle": "A provider-contract fixture records startup query replies, shell-visible bytes, renderer-visible bytes, and later runtime OSC behavior to prove no query leakage or color deadlock.",
"commands": [],
"testFiles": [],
"assertionRefs": [],
"evidenceRuns": [],
"runtimeBudget": {
"p95Seconds": 30,
"scope": "renderer provider-contract gate"
},
"flakeHistory": {
"status": "not-started",
"evidence": "Gate is registered as a capability/startup gap; no command is wired."
},
"redGreenEvidence": {
"status": "missing",
"evidence": "Needs intentional-break proof for leaked startup OSC replies or disabled runtime OSC handling."
},
"performanceBudget": {
"required": false,
"evidence": "Required if capability probing adds retry loops or startup polling."
},
"promotionCriteria": [
"Assert shell/provider byte streams directly.",
"Cover startup-only and runtime OSC paths separately.",
"Keep screenshot evidence diagnostic only."
],
"knownGaps": [
"No manifest command yet.",
"No startup color-query contract is wired."
],
"demotionRule": "Cannot promote if success is based only on absence of visible artifacts."
},
{
"id": "terminal-query.mobile-view-authority",
"title": "Mobile xterm answers live terminal queries exactly once without replay or floor side effects",
"maturity": "experimental",
"protection": "partial",
"owner": "terminal-runtime",
"layer": "mobile-runtime-rpc-contract",
"surfaces": [
"mobile terminal WebView",
"terminal query authority",
"runtime RPC",
"mobile subscription replay",
"multi-mobile input floor"
],
"platforms": [
"macos",
"linux",
"windows",
"mobile"
],
"providers": [
"local",
"daemon",
"ssh",
"remote-runtime"
],
"coveredPlatforms": [
"macos"
],
"coveredProviders": [],
"coverageNotes": "Deterministic local tests execute the exact injected mobile replay/generation gate, the React Native query classifier, stale-subscription sender, server-side single-responder election, query-reply RPC semantics, and live-output capture during async mobile fit. The provider write path is shared, but no live iOS/Android, SSH, WSL, or multi-device run is registered yet.",
"motivatingLinks": [
"https://github.com/stablyai/orca/issues/8128",
"https://github.com/stablyai/orca/pull/8206"
],
"invariant": "Snapshot and replacement-terminal replay answer no terminal queries; every live query delivered to subscribed mobile views has at most one current responder; a live query queued behind replay is answered after the replay boundary; terminal-generated replies never transfer the user-input floor.",
"oracle": "The injected gate emits zero replies during replay, exactly one after its live boundary, and ignores a superseded generation; native routing rejects ordinary input; the sender rejects disconnected or unsubscribed handles; runtime election accepts only the earliest active mobile subscriber and promotes its survivor; terminal.send writes only validated query grammar without mobileTookFloor; legacy binary subscribe captures a query while phone-fit is still pending and emits it after the snapshot.",
"commands": [
"pnpm --dir mobile exec vitest run --root .. mobile/src/terminal/terminal-webview-query-reply.test.ts mobile/src/terminal/terminal-webview-query-reply-routing.test.ts mobile/src/terminal/mobile-terminal-query-reply.test.ts",
"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/rpc/terminal-send.test.ts src/main/runtime/rpc/terminal-subscribe-buffer.test.ts src/main/runtime/mobile-presence-lock.test.ts src/shared/terminal-query-reply.test.ts src/shared/terminal-reply-query-scan.test.ts",
"pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/pty-connection.test.ts"
],
"testFiles": [
"mobile/src/terminal/terminal-webview-query-reply.test.ts",
"mobile/src/terminal/terminal-webview-query-reply-routing.test.ts",
"mobile/src/terminal/mobile-terminal-query-reply.test.ts",
"src/main/runtime/rpc/terminal-send.test.ts",
"src/main/runtime/rpc/terminal-subscribe-buffer.test.ts",
"src/main/runtime/mobile-presence-lock.test.ts",
"src/shared/terminal-query-reply.test.ts",
"src/shared/terminal-reply-query-scan.test.ts",
"src/renderer/src/components/terminal-pane/pty-connection.test.ts"
],
"assertionRefs": [
{
"file": "mobile/src/terminal/terminal-webview-query-reply.test.ts",
"assertions": [
"snapshot replay emits no terminal-data message before the replay boundary",
"a live query after the boundary emits exactly one terminal-data message",
"a superseded terminal generation cannot regain reply authority",
"xterm parser replies remain enabled while its DOM textarea and hardware-key path stay inert"
]
},
{
"file": "src/main/runtime/rpc/terminal-send.test.ts",
"assertions": [
"only the elected mobile subscriber can write a claimed query reply",
"valid replies skip mobileTookFloor",
"ordinary bytes and reply payloads combined with enter, interrupt, or guarded-send semantics are rejected"
]
},
{
"file": "src/main/runtime/rpc/terminal-subscribe-buffer.test.ts",
"assertions": [
"live terminal data and view authority register before asynchronous mobile fit",
"a query received during that await is retained and emitted after the snapshot"
]
},
{
"file": "src/renderer/src/components/terminal-pane/pty-connection.test.ts",
"assertions": [
"desktop xterm onData replies are dropped while mobile owns the terminal driver",
"desktop capability-handler replies outside onData honor the same mobile authority lock"
]
}
],
"evidenceRuns": [
{
"date": "2026-07-10",
"runner": "local",
"platform": "macos",
"command": "pnpm --dir mobile exec vitest run --root .. mobile/src/terminal/terminal-webview-query-reply.test.ts mobile/src/terminal/terminal-webview-query-reply-routing.test.ts mobile/src/terminal/mobile-terminal-query-reply.test.ts",
"result": "passed",
"durationSeconds": 1,
"summary": "10 mobile bridge, routing, replay/generation, and stale-subscription tests passed. Before implementation, the WebView listener, native route, and sender tests failed."
},
{
"date": "2026-07-10",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/rpc/terminal-send.test.ts src/main/runtime/rpc/terminal-subscribe-buffer.test.ts src/main/runtime/mobile-presence-lock.test.ts src/shared/terminal-query-reply.test.ts src/shared/terminal-reply-query-scan.test.ts",
"result": "passed",
"durationSeconds": 4,
"summary": "69 shared/runtime tests passed. Before implementation, terminal.send took the floor for claimed replies and accepted ordinary claimed bytes."
},
{
"date": "2026-07-10",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/pty-connection.test.ts",
"result": "passed",
"durationSeconds": 11,
"summary": "421 renderer terminal connection tests passed, including desktop onData and capability-handler suppression while mobile owns query authority."
}
],
"runtimeBudget": {
"p95Seconds": 20,
"scope": "mobile and runtime deterministic unit gate"
},
"flakeHistory": {
"status": "unknown",
"evidence": "New deterministic gate; no soak history yet. Tests use no timing sleeps or external services."
},
"redGreenEvidence": {
"status": "partial",
"evidence": "Observed red before implementation for the missing WebView listener/native route/sender and for RPC floor-taking plus unvalidated claims; all are green after the fix. The later multi-mobile and pre-fit race assertions have green deterministic coverage but no saved intentional-break artifact yet."
},
"performanceBudget": {
"required": true,
"evidence": "No polling, scans, timers, or output fanout were added. The WebView adds one disposable onData listener; native/RPC work occurs only for xterm data and is grammar-filtered; responder election is O(1) from Map insertion order; pre-fit output uses the existing capped pending-output queue."
},
"promotionCriteria": [
"Attach an intentional-break artifact for the pre-fit capture and multi-mobile election assertions.",
"Run live iOS and Android WebViews against a real querying TUI and verify no software-keyboard regression.",
"Exercise two physical/virtual mobile clients on one PTY and observe one reply per query.",
"Accumulate the normal soak window with zero unexplained flakes."
],
"knownGaps": [
"No live iOS or Android WebView run is registered.",
"No real SSH, WSL, daemon, or two-device provider-contract run is registered.",
"Mixed-version pairing is gated by the terminal.query-reply-input.v1 capability (mobile drops replies unless the host advertises it), but no live old-binary pairing run is registered.",
"A desktop-to-mobile driver handoff has a bounded double-reply window: the server elects the mobile responder synchronously while the desktop renderer's cached driver map updates via an async event, so an in-flight query can be answered by both until the driver-change event lands."
],
"demotionRule": "Keep experimental or disable mobile forwarding if the gate flakes without a product bug, live WebView input isolation regresses, or duplicate replies appear under multi-mobile use."
},
{
"id": "terminal-runtime.mobile-stream-budget",
"title": "Runtime and mobile terminal streams keep snapshot and live-output bytes bounded",
"maturity": "experimental",
"protection": "partial",
"owner": "terminal-runtime",
"layer": "runtime-rpc-contract",
"surfaces": [
"mobile terminal",
"runtime RPC",
"binary multiplex",
"JSON subscribe fallback",
"snapshot buffering"
],
"platforms": [
"macos",
"linux",
"windows",
"mobile"
],
"providers": [
"remote-runtime",
"ssh",
"local",
"daemon"
],
"coveredPlatforms": [
"macos"
],
"coveredProviders": [],
"coverageNotes": "Local macOS evidence over the runtime-RPC stream budgets on main@1282f5c2d. The pending stack adds byte-exact 512KB/2MB/256KB/48KB budget assertions; legacy JSON subscribe parity remains undecided.",
"motivatingLinks": [
"https://github.com/stablyai/orca/pull/6951",
"https://github.com/stablyai/orca/pull/6955",
"https://github.com/stablyai/orca/pull/7009"
],
"invariant": "Runtime and mobile terminal subscriptions must cap initial snapshots, live output buffered while snapshots load, chunk sizes, and batch sizes, while preserving output order, input locks, resize/driver events, and fallback parity or explicit fallback deprecation.",
"oracle": "The current executable slice asserts mobile initial snapshots downgrade until they fit <=512KB, requested binary snapshots downgrade until they fit <=2MB, binary live output queued while the initial snapshot loads stays <=256KB while preserving the newest tail, large binary output is split into <=48KB frames, output bursts are coalesced before emit, aborts do not register stale listeners, and stale mobile resize re-stream completions are dropped. JSON fallback parity/deprecation remains an explicit gap.",
"commands": [
"pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/rpc/terminal-subscribe-buffer.test.ts src/main/runtime/rpc/terminal-output-batching.test.ts src/main/runtime/rpc/terminal-multiplex.test.ts"
],
"testFiles": [
"src/main/runtime/rpc/terminal-subscribe-buffer.test.ts",
"src/main/runtime/rpc/terminal-output-batching.test.ts",
"src/main/runtime/rpc/terminal-multiplex.test.ts"
],
"assertionRefs": [
{
"file": "src/main/runtime/rpc/terminal-subscribe-buffer.test.ts",
"assertions": [
"legacy binary output queued during initial snapshot serialization stays bounded",
"stale mobile resize re-stream completions are dropped for legacy binary streams",
"aborted stream signals do not register stale listeners"
]
},
{
"file": "src/main/runtime/rpc/terminal-output-batching.test.ts",
"assertions": [
"desktop output bursts coalesce before stream emission",
"large binary output is encoded lazily before the first output frame"
]
},
{
"file": "src/main/runtime/rpc/terminal-multiplex.test.ts",
"assertions": [
"requested snapshots fall back smaller when serialized data exceeds the send budget",
"oversized live output frames are bounded for subscribed binary streams",
"multibyte live output flushes when encoded bytes reach the batch budget"
]
}
],
"evidenceRuns": [
{
"date": "2026-07-03",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/rpc/terminal-subscribe-buffer.test.ts src/main/runtime/rpc/terminal-output-batching.test.ts src/main/runtime/rpc/terminal-multiplex.test.ts",
"result": "passed",
"durationSeconds": 3.8,
"summary": "3 test file(s) passed, 28 tests passed on main@1282f5c2d in a clean checkout."
}
],
"runtimeBudget": {
"p95Seconds": 20,
"scope": "runtime RPC contract test"
},
"flakeHistory": {
"status": "unknown",
"evidence": "Focused runtime RPC contract tests passed locally on 2026-07-02; needs soak history before promotion."
},
"redGreenEvidence": {
"status": "partial",
"evidence": "Tests cover mobile initial snapshot byte downgrade, requested binary snapshot byte downgrade, pending live-output cap while snapshot loads, output chunk size, output coalescing, abort cleanup, and stale resize re-stream suppression. Needs intentional-break proof plus JSON fallback coverage before promotion."
},
"performanceBudget": {
"required": true,
"evidence": "This gate is the byte and batching budget for runtime/mobile terminal streaming."
},
"promotionCriteria": [
"Gate binary multiplex first.",
"Decide whether JSON fallback is supported, gated, or deprecated.",
"Record byte counts and order/cursor artifacts on failure."
],
"knownGaps": [
"Current command covers binary runtime/mobile stream contracts only.",
"Legacy JSON subscribe parity is undecided."
],
"demotionRule": "Cannot promote while a supported stream path has uncapped snapshot or live-output buffering."
},
{
"id": "terminal-mirror.parser-parity",
"title": "Renderer xterm and main headless mirror parse identical bytes into identical cells",
"maturity": "experimental",
"protection": "partial",
"owner": "terminal-rendering",
"layer": "renderer-main-parity-contract",
"surfaces": [
"main mirror buffer",
"snapshot restore",
"terminal reads",
"mobile streams",
"unicode width",
"parser configuration"
],
"platforms": [
"macos",
"linux",
"windows"
],
"providers": [
"local",
"daemon",
"ssh",
"remote-runtime"
],
"coveredPlatforms": [
"macos"
],
"coveredProviders": [],
"coverageNotes": "Local macOS evidence over #7148's width-parity oracle on main@1282f5c2d. A broader byte corpus, a shared parser-construction assertion over terminal-unicode-provider.ts/pane-terminal-options.ts, and recorded agent-session corpora remain gaps.",
"motivatingLinks": [
"https://github.com/stablyai/orca/pull/7148",
"https://github.com/stablyai/orca/pull/7133"
],
"invariant": "The main-process headless terminal mirror and the renderer xterm must parse identical byte streams into cell-identical buffers (unicode width tables, joining behavior, modes, and addon-visible semantics), so snapshots, restores, reads, and mobile streams never encode a frame the renderer would not have produced.",
"oracle": "Feed identical byte corpora (emoji/ZWJ/wide glyphs, positioned overwrites after wide characters, alternate-screen transitions, wrapped lines) to both parser configurations and assert cell-identical visible buffers; both parsers must be constructed from one shared configuration module so one-sided drift fails the gate.",
"commands": [
"pnpm exec vitest run --config config/vitest.config.ts src/main/daemon/headless-emulator-unicode-width.test.ts"
],
"testFiles": [
"src/main/daemon/headless-emulator-unicode-width.test.ts"
],
"assertionRefs": [
{
"file": "src/main/daemon/headless-emulator-unicode-width.test.ts",
"assertions": [
"emoji advance two cells in the headless mirror so positioned writes land like the renderer (#7148)",
"ZWJ emoji join into one wide pair like the renderer provider (#7148)"
]
}
],
"evidenceRuns": [
{
"date": "2026-07-03",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/main/daemon/headless-emulator-unicode-width.test.ts",
"result": "passed",
"durationSeconds": 0.7,
"summary": "1 test file(s) passed, 2 tests passed on main@1282f5c2d in a clean checkout."
}
],
"runtimeBudget": {
"p95Seconds": 30,
"scope": "shared parser-parity unit gate"
},
"flakeHistory": {
"status": "not-started",
"evidence": "Deterministic unit-layer corpus; no timing dependence expected."
},
"redGreenEvidence": {
"status": "partial",
"evidence": "#7148 proved this red before its fix (positioned overwrite after emoji landed shifted in the mirror). Intentional-drift proof for the shared provider is still missing."
},
"performanceBudget": {
"required": true,
"evidence": "Shared parser construction must not add renderer or emulator startup cost; the corpus stays a bounded unit fixture."
},
"promotionCriteria": [
"Register #7148's merged width test (src/main/daemon/headless-emulator-unicode-width.test.ts) plus a shared-construction assertion over src/shared/terminal-unicode-provider.ts and pane-terminal-options.ts as the first command during the stack rebase.",
"Extend the corpus with recorded real agent-session byte streams.",
"Promote only on aggregated reliability-gates CI history."
],
"knownGaps": [
"No manifest command yet; the seed test exists on fresh main but not at this branch's merge-base.",
"Width parity is protected only by #7148's single test; no broader corpus or shared-construction assertion covers the other parser-config axes.",
"Corpus does not yet include recorded live agent sessions.",
"Parity at identical configuration cannot catch state-synchronization divergence such as #7192's stale-width mirror; geometry fan-out and reflow ordering are owned by terminal-geometry.visible-convergence."
],
"demotionRule": "Cannot promote without cell-exact parity assertions over a wide-glyph corpus and shared-construction proof."
},
{
"id": "terminal-observability.restore-convergence-selfcheck",
"title": "Post-restore convergence self-check flags renderer/mirror divergence as an anomaly",
"maturity": "experimental",
"protection": "none",
"owner": "terminal-rendering",
"layer": "renderer-observability",
"surfaces": [
"hidden-output restore",
"snapshot replay",
"anomaly breadcrumbs",
"telemetry"
],
"platforms": [
"macos",
"linux",
"windows"
],
"providers": [
"local",
"daemon",
"ssh",
"remote-runtime"
],
"coveredPlatforms": [],
"coveredProviders": [],
"coverageNotes": "Registered gap only; the anomaly-breadcrumb machinery exists in this branch but no convergence probe is implemented.",
"motivatingLinks": [
"https://github.com/stablyai/orca/pull/7133",
"https://github.com/stablyai/orca/pull/7054"
],
"invariant": "After every hidden-to-visible reveal settles — whether or not a restore was triggered — the renderer buffer must converge with the current main-mirror state; divergence is recorded as a compact, content-free terminal_lifecycle_anomaly breadcrumb and counted in telemetry instead of failing silently. Restore-scoped checking is insufficient: #7173's frozen-output variant restores faithfully and then silently drops later hidden output, so it never triggers another restore.",
"oracle": "Deterministic tests inject forced divergence in both shapes — stale bytes written after a faithful restore, and a frozen pane whose reveal triggers no restore — and assert exactly one deduped breadcrumb with row-hash evidence and no terminal content; the production probe is a bounded row-hash sample comparison against current mirror rows that runs once per reveal with no polling and a strict time budget.",
"commands": [],
"testFiles": [],
"assertionRefs": [],
"evidenceRuns": [],
"runtimeBudget": {
"p95Seconds": 30,
"scope": "renderer observability unit gate"
},
"flakeHistory": {
"status": "not-started",
"evidence": "Probe and tests not yet implemented."
},
"redGreenEvidence": {
"status": "missing",
"evidence": "Needs an intentionally divergent restore fixture proving the probe fires, dedupes, and stays silent on faithful restores."
},
"performanceBudget": {
"required": true,
"evidence": "One bounded comparison per reveal; no polling, no hot-path work, no content serialization beyond hashed row samples."
},
"promotionCriteria": [
"Prove the probe is content-free and privacy-safe (hashes and indices only).",
"Prove zero false positives across the existing restore test corpus before enabling telemetry counting.",
"Watch anomaly telemetry after each terminal release as the in-production regression signal."
],
"knownGaps": [
"No manifest command yet.",
"Probe not implemented; #7133-class and #7173-class corruption is currently silent in production.",
"Pixel-level divergence is out of scope for this probe (see terminal-render.pixel-refresh-repair).",
"Renderer-vs-mirror comparison cannot see corruption upstream of the mirror itself (#7192's stale-width mirror); mirror-vs-PTY truth is owned by terminal-geometry.visible-convergence."
],
"demotionRule": "Disable the probe if it exceeds its per-reveal budget or produces false-positive anomaly noise."
},
{
"id": "terminal-render.pixel-refresh-repair",
"title": "Forced repaint does not change revealed pane pixels",
"maturity": "experimental",
"protection": "none",
"owner": "terminal-rendering",
"layer": "electron-visual-golden",
"surfaces": [
"WebGL rendering",
"tab reveal",
"worktree resume",
"window wake",
"render model"
],
"platforms": [
"macos",
"linux",
"windows"
],
"providers": [
"local",
"daemon"
],
"coveredPlatforms": [],
"coveredProviders": [],
"coverageNotes": "Registered gap only; the live repro harness with a refresh-repair oracle exists but is not productized into the release-blocking terminal-rendering-golden suite.",
"motivatingLinks": [
"https://github.com/stablyai/orca/pull/7133",
"https://github.com/stablyai/orca/pull/7054"
],
"invariant": "After any reveal, restore, or wake, the pixels a pane displays must equal what a forced full model-invalidating repaint would draw from the buffer; a material refresh-repair diff means stale rendering escaped, whatever the mechanism.",
"oracle": "Screenshot the revealed pane, force a model-invalidating full repaint, screenshot again, and assert the bounded pixel diff is immaterial; pair with a JS-level render-model-vs-buffer comparison. Compositor screenshots only, because WebGL canvas readback is blank with preserveDrawingBuffer disabled.",
"commands": [],
"testFiles": [],
"assertionRefs": [],
"evidenceRuns": [],
"runtimeBudget": {
"p95Seconds": 300,
"scope": "release-blocking golden Electron visual test"
},
"flakeHistory": {
"status": "not-started",
"evidence": "Runs nightly only while the per-platform diff threshold stabilizes; the destination is the release-blocking terminal-rendering-golden suite in release-cut.yml."
},
"redGreenEvidence": {
"status": "missing",
"evidence": "Needs an intentionally fossilized render model (skip the model invalidation on reveal) proving the refresh-repair diff fires."
},
"performanceBudget": {
"required": true,
"evidence": "Soak-only; must not add product-path repaints beyond the existing reveal hardening."
},
"promotionCriteria": [
"Productize the existing stale-render repro harness with the refresh-repair oracle and failure artifacts.",
"Establish a stable material-diff threshold across platforms via nightly runs.",
"Promotion means membership in the release-blocking terminal-rendering-golden suite that release-cut.yml runs against every release tag; never PR-blocking.",
"Register the gate command as a direct spec-file invocation; the checker rejects --grep tag selectors, so do not reuse the existing --grep-based golden script as the command."
],
"knownGaps": [
"No manifest command yet.",
"Buffer-clean, pixels-stale variants are otherwise invisible to every buffer oracle in the manifest."
],
"demotionRule": "Drop from the golden suite back to nightly diagnostic if diff thresholds cannot be kept stable across CI runners."
},
{
"id": "pty-delivery.renderer-lifecycle-accounting-reset",
"title": "Renderer lifecycle reset clears leaked PTY delivery accounting so surviving PTYs cannot freeze",
"maturity": "experimental",
"protection": "partial",
"owner": "terminal-runtime",
"layer": "main-unit",
"surfaces": [
"terminal output delivery",
"renderer reload / crash recovery",
"surviving daemon and local PTYs"
],
"platforms": [
"macos",
"linux",
"windows"
],
"providers": [
"local",
"daemon"
],
"coveredPlatforms": [
"macos"
],
"coveredProviders": [],
"coverageNotes": "Local macOS unit evidence over the shared main-process delivery pipeline in registerPtyHandlers. The oracle drives a local mock PTY, but the in-flight/pending accounting is provider-agnostic and daemon PTYs ride the identical pipeline (the manual dev repro that proved the freeze was daemon-backed). SSH is a separate relay/credit path and never enters these counters; mobile/relay ride unaffected paths; WSL terminals ride this same local/daemon pipeline and are covered by the same accounting (no dedicated provider-contract test yet). Motivated by a production incident on v1.4.131 (three frozen/broken terminal panes in one desktop session) diagnosed to leaked in-flight/pending accounting across a renderer reload (rendererGraphEpoch 3). Live validation of the fix on a rebuilt dev instance surfaced a second leak mode (the boot window): after the reset ran, main resumed flushing a flooding PTY into the still-booting page before its pty:data listener re-registered, so those sends were dropped yet counted and re-pinned rendererInFlightChars at 524288. The gate now also covers holding sends until the renderer's pty:rendererDispatcherReady handshake. A watchdog self-heals a lost handshake: on each reset a one-shot ~10s timer arms and, if the handshake never arrives, force-opens the gate (rendererDispatcherReadyForcedCount increments) so a dropped handshake degrades to pre-handshake behavior instead of a permanent hold; the real handshake or a re-registration cancels it. Two new diagnostics — rendererPtyDispatcherReady and rendererDispatcherReadyForcedCount — expose the otherwise-invisible boot-window hold, which early-returns before ackGatedFlushSkipCount increments.",
"motivatingLinks": [
// #5787 introduced the renderer-reload delivery-accounting path this gate hardens;
// kept for lineage, not the primary motivation. THIS fix is motivated by the
// v1.4.131 three-frozen-panes incident (see coverageNotes).
"https://github.com/stablyai/orca/pull/5787",
"https://github.com/stablyai/orca/pull/8034"
],
"invariant": "After a renderer lifecycle reset (did-start-loading / render-process-gone / destroyed), no surviving PTY remains delivery-gated by pre-reset unacked bytes: main's in-flight counters and pending backlog equal the true state of the new page (zero in-flight, zero pending). Delivery then resumes only once the reloaded page's pty:data dispatcher re-registers and signals pty:rendererDispatcherReady; during the boot window before that handshake main holds all sends (data accrues losslessly in the capped pending backlog) so bytes cannot be dropped into a listener-less page and re-pin the gate. The hold itself cannot become a permanent freeze: a one-shot ~10s watchdog armed on each reset force-opens the gate (incrementing rendererDispatcherReadyForcedCount) if the handshake is lost, and the real handshake or a re-registration cancels it. The reset fires only for a main-frame load: did-start-loading also fires for in-page subframe loads (sandboxed srcDoc iframes in notebook HTML output), which are filtered out via isLoadingMainFrame() so a subframe load never clears accounting or holds the gate on the still-alive page. If a lifecycle-reset edge is missed entirely — a main-frame reload overlapped by an in-page subframe load emits no did-start-loading at all — a backstop still recovers: because the handshake is one-shot per page load, receiving pty:rendererDispatcherReady while the gate is already open proves a reset was missed (or the watchdog force-opened the gate), so the handler reconciles by clearing the stale accounting before re-opening. The renderer sends that handshake exactly once per page load, after its pty:data listener registers.",
"oracle": "Ingest more than 512 KB of PTY output with no renderer ACKs and assert the per-PTY gate closes (sends stop at the 512 KB high-water, remainder accrues as pending). Fire the registered did-start-loading listener and assert rendererInFlightChars and pendingChars are zero and the new diagnostics record the reset (rendererLifecycleResetCount 1, lastLifecycleResetClearedChars 512 KB). Then, before any dispatcher-ready handshake, ingest another chunk and assert it is NOT sent and NOT counted in-flight (held for the boot window, accruing in pending). Finally fire the pty:rendererDispatcherReady handshake and assert the held chunk is delivered to the renderer. Counters-zero without proving both the boot-window hold and that delivery resumes is insufficient. Additional cases prove the boot-window hold also covers the interactive direct-send fast path (input-primed keystroke echo is held, not sent, until the handshake) and that the self-heal watchdog force-opens the gate (rendererDispatcherReadyForcedCount 1) when no handshake arrives, while a timely handshake cancels the watchdog and leaves no orphaned timer. A further case fires did-start-loading with isLoadingMainFrame() false (a subframe/iframe load) and asserts accounting is untouched (rendererLifecycleResetCount stays 0, pending preserved, ready stays true) and delivery still drains on ACK — proving an in-page iframe load cannot trigger a spurious freeze. A backstop case saturates the gate, then fires pty:rendererDispatcherReady while the gate is still open (ready true) with no preceding reset — modeling a missed lifecycle edge — and asserts the handler reconciles: in-flight and pending clear, rendererLifecycleResetCount increments, and fresh output flows immediately (a straggler ACK is clamped and cannot underflow). A renderer-side case (pty-dispatcher-pi-routing.test.ts) asserts ensurePtyDispatcher() sends pty:rendererDispatcherReady exactly once across two attach calls — proving the send fires (it is optional-chained) and the one-shot guard holds.",
"commands": [
"pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/pty.test.ts src/renderer/src/components/terminal-pane/pty-dispatcher-pi-routing.test.ts"
],
"testFiles": [
"src/main/ipc/pty.test.ts",
"src/renderer/src/components/terminal-pane/pty-dispatcher-pi-routing.test.ts"
],
"assertionRefs": [
{
"file": "src/main/ipc/pty.test.ts",
"assertions": [
"a PTY saturated past the 512 KB per-PTY high-water with no ACKs stops sending and accrues pending output (gate closed)",
"firing the registered did-start-loading listener zeroes rendererInFlightChars and pendingData and records rendererLifecycleResetCount and lastLifecycleResetClearedChars",
"after the reset, output ingested during the boot window is NOT sent and NOT counted in-flight until the pty:rendererDispatcherReady handshake fires (held in pending)",
"firing the pty:rendererDispatcherReady handshake releases the held backlog and delivery resumes (delivery gated on the handshake, not just counters cleared)",
"interactive input-primed keystroke echo is also held during the boot window (interactive fast path gated on the handshake) and delivered once it fires",
"when no handshake arrives, the ~10s watchdog force-opens the gate (rendererDispatcherReadyForcedCount 1) and the held backlog drains; a timely handshake cancels the watchdog and leaves no orphaned timer",
"a did-start-loading with isLoadingMainFrame() false (in-page subframe/iframe load) does NOT reset accounting (rendererLifecycleResetCount stays 0, pending and in-flight preserved, rendererPtyDispatcherReady stays true) and delivery still drains on ACK",
"a pty:rendererDispatcherReady handshake arriving while the gate is still open (ready true, no preceding reset — a missed lifecycle edge) reconciles the stale accounting: in-flight and pending clear, rendererLifecycleResetCount increments, fresh output flows, and a straggler ACK is clamped",
"re-registering handlers (macOS re-activate / new window) cancels the prior registration's armed dispatcher-ready watchdog via the cross-registration bridge, leaving no orphaned ~10s timer to force-open a dead window's gate"
]
},
{
"file": "src/renderer/src/components/terminal-pane/pty-dispatcher-pi-routing.test.ts",
"assertions": [
"ensurePtyDispatcher() sends pty:rendererDispatcherReady exactly once across two attach calls (the optional-chained send fires, and the ptyDispatcherAttached one-shot guard prevents a re-signal)"
]
}
],
"evidenceRuns": [
{
"date": "2026-07-09",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/pty.test.ts src/renderer/src/components/terminal-pane/pty-dispatcher-pi-routing.test.ts",
"result": "passed",
"durationSeconds": 1,
"summary": "243 tests passed (232 main-process + 11 renderer dispatcher) including the lifecycle-reset, boot-window (dispatcher-ready handshake), interactive-gate hold, watchdog self-heal, main-frame-filter (subframe did-start-loading is ignored), missed-reset reconcile backstop (handshake-while-open), cross-registration watchdog-cancel, and renderer-side one-shot handshake-send regressions. Removing the reset call reproduces the reload freeze (rendererInFlightChars stays 524288); removing the send-hold reproduces the boot-window leak; removing the interactive-path flag check sends keystroke echo into the not-yet-ready page; removing the watchdog arm leaves the gate held forever; removing the watchdog cancel leaves an orphaned timer after the handshake; removing the isLoadingMainFrame filter lets a subframe iframe load run a spurious reset; removing the handshake-while-open reconcile leaves the survivors pinned at 524288 after a missed lifecycle edge."
}
],
"runtimeBudget": {
"p95Seconds": 10,
"scope": "local main-process unit test"
},
"flakeHistory": {
"status": "unknown",
"evidence": "Newly registered with this fix; needs soak history before any promotion. The oracle is deterministic (fake timers, mock webContents)."
},
"redGreenEvidence": {
"status": "partial",
"evidence": "Locally verified red/green on every load-bearing branch: (1) reset call removed -> rendererInFlightChars stays 524288 after did-start-loading; (2) boot-window send-hold removed -> post-reload output is sent into the not-yet-ready page ('NOT sent until handshake' fails); (3) interactive-path flag check removed -> input-primed keystroke echo is sent during the hold; (4) watchdog arm removed -> the gate is never force-opened and the held backlog never drains; (5) watchdog cancel removed -> an orphaned ~10s timer survives the handshake (getTimerCount 1); (6) isLoadingMainFrame filter removed -> a subframe did-start-loading runs a spurious reset (rendererLifecycleResetCount 1, pending cleared, ready dropped) — locally verified red; (7) handshake-while-open reconcile removed -> a pty:rendererDispatcherReady arriving after a missed lifecycle edge leaves the gate pinned (rendererInFlightChars stays 524288, pending 90112, rendererLifecycleResetCount 0) — locally verified red; (8) cross-registration bridge cancel removed (top-of-registerPtyHandlers clearRendererDispatcherReadyWatchdog) -> a prior registration's armed watchdog survives re-registration as an orphaned timer (getTimerCount 1 instead of 0) — locally verified red. With the full fix all eight are green. The performance budget below still holds: the watchdog is a single unref'd one-shot per reset, not per-chunk. Needs a saved CI or intentional-break artifact before blocking promotion."
},
"performanceBudget": {
"required": true,
"evidence": "The reset is an O(#ptys) map clear on rare lifecycle events (reload/crash) plus one unref'd one-shot ~10s watchdog timer per reset (cancelled by the handshake or a re-registration); no polling and no per-chunk work. Any PR changing the delivery gate, in-flight accounting, or flush loop must re-measure terminal throughput before promotion."
},
"promotionCriteria": [
"Run in soak for at least 100 consecutive passes or 14 days across required CI platforms.",
"Attach saved red/green evidence from removing the lifecycle-reset accounting clear.",
"Add an Electron-level reload survival test that proves a saturated pane resumes rendering and input after Cmd+R / crash recovery."
],
"knownGaps": [
"The unit oracle drives a local mock PTY; daemon and WSL coverage rides the same pipeline but has no dedicated provider-contract test yet.",
"The dev repro covers the output-delivery freeze only; the arrow-key input symptom and mouse-mode flood observed in the same incident are out of scope and need their own repros.",
"No live Electron reload-survival assertion yet — the gate proves the main-side accounting reset, not the full renderer reattach paint."
],
"demotionRule": "Demote or quarantine if the gate flakes once without a product bug or harness bug filed to the owner."
},
{
"id": "runtime-files.watcher-process-isolation",
"title": "Runtime and SSH relay watcher faults stay process-isolated without disrupting host services",
"maturity": "experimental",
"protection": "partial",
"owner": "runtime-platform",
"layer": "process-rpc-contract",
"surfaces": [
"headless orca serve",
"paired file explorer",
"runtime editor external-change detection",
"desktop filesystem watcher",
"SSH relay filesystem watcher and live PTYs"
],
"platforms": [
"macos",
"linux",
"windows"
],
"providers": [
"local",
"remote-runtime",
"ssh"
],
"coveredPlatforms": [
"macos"
],
"coveredProviders": [
"local",
"remote-runtime",
"ssh"
],
"coverageNotes": "Deterministic tests cover a four-child healthy runtime pool plus at most four bounded quarantine children, one quarantine attempt per watch lifetime, queue-aware cancellation, bounded initial and crash-resubscribe crawls, physical desktop-install abort, stale-generation rejection, per-child stat bounds, final-overflow RPC delivery, and renderer eviction before terminal callbacks can retry. A built-entry macOS harness drives the real supervisor, kills its child with SIGSEGV, then requires automatic resubscription and a later event. SSH now bundles the same child boundary beside relay.js, requires both artifacts for install completeness, and preserves registration-owned same-root cancellation. A built-relay harness kills that child and requires the original relay PID and existing PTY to survive before overflow and precise events resume.",
"motivatingLinks": [
"https://github.com/stablyai/orca/issues/5308",
"https://github.com/stablyai/orca/issues/7547",
"https://github.com/stablyai/orca/issues/8212"
],
"invariant": "Local runtime and SSH relay roots use at most four shared watcher children while healthy and at most four additional quarantine children after shard failure. Cancelling queued setup removes only that request; cancelling an active crawl restarts one shard and restores its healthy records. Setup deadlines start only when the child owns the crawl; the runtime RPC transport owns the normal 15-second initial budget, while a 60-second recovery deadline quarantines a root that would otherwise pin its shard. A crash-fused shared shard moves affected roots into the bounded quarantine pool, and a second fused quarantine ends those watch lifetimes instead of spawning replacements indefinitely. Every interrupted setup emits overflow after recovery, event delivery stays bounded, and the SSH relay, PTYs, Git, and other filesystem operations never load the watcher native addon or share its fault boundary.",
"oracle": "Fill the four-child healthy pool with multiple roots, inject IPC disconnect-before-exit, queued and active setup cancellation, initial and crash-resubscribe timeouts, and shard-level terminal failure, then assert healthy roots are restored, affected roots spread across no more than four quarantine supervisors, a second quarantine fuse creates no replacement, stale generations stop delivering, and existing same-root clients receive overflow plus later events without error/end. Abort a pending desktop install and require worktree close and app shutdown to settle before the native crawl resolves. Verify relay build hashes and remote install probes require both relay.js and relay-watcher.js. Launch the built relay with a real PTY and Parcel watch, kill only the watcher child, and require the same relay PID and PTY to answer before a replacement child delivers overflow and a post-crash event.",
"commands": [
"pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/parcel-watcher-process.test.ts src/main/ipc/runtime-watcher-process-pool.test.ts src/main/ipc/parcel-watcher-process-entry.test.ts src/main/ipc/parcel-watcher-event-delivery.test.ts src/main/ipc/filesystem-watcher-local-unsubscribe.test.ts src/main/ipc/filesystem-watcher-wsl.test.ts src/main/runtime/file-watcher-host.test.ts src/main/runtime/rpc/methods/files.test.ts src/main/providers/ssh-filesystem-provider.test.ts src/renderer/src/runtime/runtime-file-client.test.ts",
"pnpm run build:electron-vite",
"node config/scripts/runtime-file-watcher-fault-harness.mjs",
"ELECTRON_RUN_AS_NODE=1 pnpm exec electron config/scripts/runtime-file-watcher-fault-harness.mjs",
"pnpm exec vitest run --config config/vitest.config.ts src/relay/relay-filesystem-watch-registry.test.ts src/relay/fs-handler.test.ts src/relay/subprocess.test.ts src/main/ssh/ssh-relay-versioned-install.test.ts config/scripts/package-electron-runtime-contract.test.mjs",
"pnpm run build:relay",
"node config/scripts/relay-watcher-fault-harness.mjs"
],
"testFiles": [
"src/main/ipc/parcel-watcher-process.test.ts",
"src/main/ipc/runtime-watcher-process-pool.test.ts",
"src/main/ipc/parcel-watcher-process-entry.test.ts",
"src/main/ipc/parcel-watcher-event-delivery.test.ts",
"src/main/ipc/filesystem-watcher-local-unsubscribe.test.ts",
"src/main/ipc/filesystem-watcher-wsl.test.ts",
"src/main/runtime/file-watcher-host.test.ts",
"src/main/runtime/rpc/methods/files.test.ts",
"src/main/providers/ssh-filesystem-provider.test.ts",
"src/renderer/src/runtime/runtime-file-client.test.ts",
"config/scripts/runtime-file-watcher-fault-harness.mjs",
"src/relay/relay-filesystem-watch-registry.test.ts",
"src/relay/fs-handler.test.ts",
"src/relay/subprocess.test.ts",
"src/main/ssh/ssh-relay-versioned-install.test.ts",
"config/scripts/package-electron-runtime-contract.test.mjs",
"config/scripts/relay-watcher-fault-harness.mjs"
],
"assertionRefs": [
{
"file": "src/main/ipc/parcel-watcher-process.test.ts",
"assertions": [
"initial-subscribe crashes complete with an interruption refresh",
"IPC disconnect recovery restores every existing root before accepting new setup",
"queued abort removes one request without restarting healthy roots, while active abort or crawl-scoped timeout restores the shard",
"a crash-resubscribe crawl deadline ends only the stuck root and tears down its shard process",
"missing built entries fail closed and unavailable canary storage remains optional",
"fault-harness PID reporting cannot clobber an existing filesystem path"
]
},
{
"file": "src/main/ipc/runtime-watcher-process-pool.test.ts",
"assertions": [
"healthy roots spread across at most four shared supervisors before sharing",
"a supervisor-scoped failure spreads affected roots across at most four quarantine supervisors",
"a second fused quarantine creates no further replacement for that watch lifetime",
"a root-specific failure preserves healthy shard assignments",
"a live root whose crash-resubscribe times out moves to quarantine",
"an older same-root teardown cannot erase a newer watch lease's assignment"
]
},
{
"file": "src/main/ipc/parcel-watcher-process-entry.test.ts",
"assertions": [
"queued cancellation removes the request before Parcel starts its crawl",
"active cancellation requests one host restart and emits no stale subscribed acknowledgement",
"runtime batches receive directory metadata before child IPC",
"an FSEvents dropped-events error is reported as recoverable and later events continue",
"batches above the configured event limit become one overflow before stat or IPC fanout",
"while process.send is backpressured, later bursts retain at most one bounded pending batch and collapse excess paths to overflow",
"unsubscribe discards pending delivery before it can perform stale stat work"
]
},
{
"file": "src/main/ipc/parcel-watcher-event-delivery.test.ts",
"assertions": [
"eight concurrent root batches never exceed eight active directory metadata stats within one child"
]
},
{
"file": "src/main/ipc/filesystem-watcher-local-unsubscribe.test.ts",
"assertions": [
"worktree deletion physically aborts pending native setup and settles before its crawl resolves",
"app shutdown physically aborts pending native setup and releases a late native handle"
]
},
{
"file": "src/main/runtime/file-watcher-host.test.ts",
"assertions": [
"same-root clients share one physical watch and one client abort cannot cancel another owner's setup",
"shard failure preserves existing subscribers through isolated recovery and rejects stale-generation events",
"only failed isolated recovery ends subscribers, after a conservative overflow"
]
},
{
"file": "src/main/runtime/rpc/methods/files.test.ts",
"assertions": [
"pre-ready transport abort reaches RuntimeFileCommands as the owning AbortSignal",
"terminal watcher loss flushes a final overflow change before error/end and unregisters cleanup"
]
},
{
"file": "src/main/providers/ssh-filesystem-provider.test.ts",
"assertions": [
"an SSH caller abort rejects promptly without cancelling another same-root subscriber's shared setup",
"the physical relay request is cancelled when the last pending subscriber leaves",
"provider disposal cancels pending setup and sends one remote unwatch"
]
},
{
"file": "src/renderer/src/runtime/runtime-file-client.test.ts",
"assertions": [
"terminal error evicts the shared renderer watch before an error callback can synchronously retry",
"the old stream's later end cannot evict or orphan the replacement stream",
"the end response releases retained preload and main-process subscription bookkeeping",
"a later same-root listener opens a fresh server subscription instead of reusing a dead stream"
]
},
{
"file": "src/relay/relay-filesystem-watch-registry.test.ts",
"assertions": [
"replacement emits overflow before later ordered events",
"terminal shard failure preserves same-root clients through recovery",
"pending setup aborts only after the last same-root client leaves",
"a missing child fails closed even if the relay inherits a VITEST environment"
]
},
{
"file": "src/relay/fs-handler.test.ts",
"assertions": [
"shared watches retain the twenty-root budget and release after every client leaves"
]
},
{
"file": "src/relay/subprocess.test.ts",
"assertions": [
"the real relay bundle serves PTY, filesystem, and Git requests with its adjacent watcher child"
]
},
{
"file": "src/main/ssh/ssh-relay-versioned-install.test.ts",
"assertions": [
"remote completeness requires relay.js, relay-watcher.js, and the install sentinel"
]
},
{
"file": "config/scripts/package-electron-runtime-contract.test.mjs",
"assertions": [
"every release platform packages and gates the hashed watcher child"
]
},
{
"file": "config/scripts/runtime-file-watcher-fault-harness.mjs",
"assertions": [
"the built watcher entry delivers an event before fault injection",
"the harness parent survives watcher-child SIGSEGV",
"the real supervisor automatically replaces the child, resubscribes, and delivers a post-crash event"
]
},
{
"file": "config/scripts/relay-watcher-fault-harness.mjs",
"assertions": [
"the built relay and existing PTY survive watcher-child fault injection",
"replacement emits overflow and a precise post-crash event"
]
}
],
"evidenceRuns": [
{
"date": "2026-07-12",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/relay/relay-filesystem-watch-registry.test.ts src/relay/fs-handler.test.ts src/relay/subprocess.test.ts src/main/ssh/ssh-relay-versioned-install.test.ts config/scripts/package-electron-runtime-contract.test.mjs",
"result": "passed",
"durationSeconds": 4.5,
"summary": "Five relay registry, handler, bundled subprocess, install, and package contract files passed with 114 tests."
},
{
"date": "2026-07-12",
"runner": "local",
"platform": "macos",
"command": "node config/scripts/relay-watcher-fault-harness.mjs",
"result": "passed",
"durationSeconds": 0.61,
"summary": "The relay PID and existing PTY survived watcher-child SIGSEGV; overflow and precise events resumed from a replacement child."
},
{
"date": "2026-07-12",
"runner": "local",
"platform": "macos",
"command": "pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/parcel-watcher-process.test.ts src/main/ipc/runtime-watcher-process-pool.test.ts src/main/ipc/parcel-watcher-process-entry.test.ts src/main/ipc/parcel-watcher-event-delivery.test.ts src/main/ipc/filesystem-watcher-local-unsubscribe.test.ts src/main/ipc/filesystem-watcher-wsl.test.ts src/main/runtime/file-watcher-host.test.ts src/main/runtime/rpc/methods/files.test.ts src/main/providers/ssh-filesystem-provider.test.ts src/renderer/src/runtime/runtime-file-client.test.ts",
"result": "passed",
"durationSeconds": 1.7,
"summary": "10 focused supervisor, pool, child-entry, delivery, desktop/WSL cleanup, runtime-host, RPC, SSH ownership, and renderer-client test files passed with 223 tests."
},
{
"date": "2026-07-12",
"runner": "local",
"platform": "macos",
"command": "node config/scripts/runtime-file-watcher-fault-harness.mjs",
"result": "passed",
"durationSeconds": 5,
"summary": "All 26 built-entry SIGSEGV injections preserved the parent, replaced and resubscribed the child, and delivered a post-crash event; watcher-canary temp-directory count remained 6 before and after the final five-run leak check."
},
{
"date": "2026-07-11",
"runner": "local",
"platform": "macos",
"command": "node config/scripts/runtime-file-watcher-fault-harness.mjs",
"result": "passed",
"durationSeconds": 0.3,
"summary": "The source-bundled real supervisor delivered through the built child before and after SIGSEGV; the parent survived and automatic resubscription used a replacement PID."
},
{
"date": "2026-07-11",
"runner": "local",
"platform": "macos",
"command": "node config/scripts/runtime-file-watcher-fault-harness.mjs",
"result": "passed",
"durationSeconds": 2.2,
"summary": "Ten consecutive invocations survived, automatically replaced and resubscribed the child, and delivered a post-crash event. The watcher-canary temp-directory count remained 8 before and after the loop."
}
],
"runtimeBudget": {
"p95Seconds": 60,
"scope": "focused process/RPC contract tests plus built child fault harness"
},
"flakeHistory": {
"status": "unknown",
"evidence": "New deterministic unit coverage and ten consecutive local built-entry harness passes; still below the CI and soak history required for promotion."
},
"redGreenEvidence": {
"status": "partial",
"evidence": "Red tests reproduced the reviewed failures: IPC disconnect-before-exit orphaned existing roots, queue-admission deadlines cascaded shard replacement, a fused shard created one child per root, destructive desktop cleanup waited indefinitely for native setup, and synchronous renderer retry joined a terminal stream. Earlier red coverage also reproduced missing-entry fail-open, terminal recovery loss, stale same-root lease deletion, and unbounded per-child stat lanes. The bounded quarantine and cancellation rewrite passes those contracts, and the real-supervisor built-entry harness survives SIGSEGV with automatic replacement. CI/soak history is still absent."
},
"performanceBudget": {
"required": true,
"evidence": "Healthy operation is capped at four shared child processes instead of one child per root; based on the prior 51.9 MiB one-child measurement this bounds the unremeasured eight-root healthy ceiling near 207.6 MiB rather than the rejected 388.7 MiB per-root design. Degraded operation adds at most four quarantine children, distributes affected roots by least load, disposes empty slots, and permits no replacement after a quarantine shard itself fuses. Each child caps directory stats at eight across its assigned roots (at most 32 healthy or 64 total logical stat operations), each subscription retains at most one active plus one bounded pending batch, and no polling or serve-process stat fanout is added."
},
"promotionCriteria": [
"Run the built-entry SIGSEGV harness in soak for at least 100 consecutive passes or 14 days on macOS.",
"Add an eight-root/six-writer event-loop-delay soak artifact with an explicit latency budget.",
"Add a packaged orca serve pairing scenario that proves a connected client refreshes after child replacement."
],
"knownGaps": [
"The fault harness bundles the real source supervisor and drives the built child, but it does not launch a packaged orca serve pairing session or exercise app.asar path resolution.",
"The four-child healthy and four-child quarantine memory ceilings are inferred from the earlier one-child measurement; direct degraded-state RSS plus sustained six-writer event-loop-delay and CPU soak evidence is still absent.",
"Linux native watcher fault containment is source-equivalent but not live fault-injected in this evidence run.",
"Windows runtime watches bypass this path; SSH registration ownership is deterministic-contract tested but not live-relay fault-injected."
],
"demotionRule": "Demote or quarantine if the fault harness flakes without a product or harness bug, if healthy operation exceeds four runtime watcher children, if total healthy plus quarantine operation exceeds eight, if quarantine children outlive their roots or repeat after fusing, if event delivery becomes unbounded, or if metadata/stat work returns to the serve process."
}
]
}
Reference in New Issue View Git Blame Copy Permalink