[Desolate-Jix]

Connector 0.0.8 — Runtime 0.1.11 initial-owner release fix

Continues this PR after the maintainer's initial-owner finding. Previous 0.0.5/0.0.6/0.0.7 candidates and release assets remain historical and unchanged. This revision recommends the exact connector 0.0.8 + Runtime 0.1.11 combination.

Fix and safety boundary

The real Runtime initial state is not_started / cleanup_verified=false. Earlier DELETE required verified cleanup even when the instance never attempted startup, so init/list/stop could leave its HTTP owner locked forever.

Runtime now records monotonic startup-attempt provenance at start, recovery and direct launch entrypoints, before any possible launch or reattachment. Only strict original False plus no session/process/host identity/log/lock resource yields the versioned never_started_instance proof. The shared attachment transport cannot infer it from missing files or an initial-looking phase. HTTP DELETE additionally requires host_alive=false, no pending requests and phase=not_started; normal verified-cleanup release remains unchanged. Cold cleanup_verified stays false.

Active input, unknown startup, failed startup after cleared resource fields, unverified cleanup, invalid/missing proof and in-flight requests remain blocked. Native DELETE failure preserves the original owner. Releasing an unused connection does not create/stop an execution host, submit input, replay a command, erase evidence, release the daemon's installation lease or transfer an old workflow. Proof is scoped to this instance: existing persisted/peer evidence remains unchanged and later startup still uses the original attachment/peer gates.

Models/providers, thresholds, input authorization and existing task-plan settlement checks are unchanged. The previously accepted rejected-control/observe fixes remain. Successful task-plan recover/resume_pre_dispatch settlement is still unqualified; disconnected session recovery tools remain operator-only, distinct from same-session Main review and explicit original-task continuation.

Exact delivery

• Source 323099100b04beeb6ee67a846f0e530998c19bbc, used by both new tags.
• Runtime 0.1.11: installer 4,629,504 bytes, SHA-256 1afaed72ce84f1c59965f6b915e9ffd8a32b8eaa1a6c9d6720eee8d1f71de56a; target digest 62ff1d2367914a62d2ce7f5e126e98d797ec975275f98edbba239be920461d9d.
• Connector 0.0.8: wheel 27,990 bytes, SHA-256 2f532faf152faf2e1e3ab3140e1097487689be34d638e4ee86539e06886cbcaf; source ZIP 52,657 bytes, SHA-256 b54afe548dae17c04600f48553b9e27033db4a370f6963ad2ea518b585cff3b4.
• Runtime validation · installed HTTP validation · connector author validation.
• English setup · 中文指南.

Verification actually performed

• Original production 0.1.10 reproduced both initial-state failures with real InstantSession and native ASGI transport: direct DELETE and stop-then-DELETE both returned 409. Final 215 lifecycle/security/recovery checks passed with zero skips, including the selected external Host SDK client. The 25 real-initial-state cases are included, not added as unique coverage. They cover resource traces, unknown process construction, failed start/recovery entrypoints, real pending receipts, insufficient cleanup, status exceptions, conflicting requests and failed native DELETE preserving ownership.
• 139 packaging/update/previous-settlement checks passed with zero skips. Four separate counterexample checks passed, including unknown construction followed by manually cleared resources and existing persisted/peer evidence retaining later startup gates. Groups are reported independently, without adding overlapping coverage. Initial red reproductions and repaired test-scaffolding failures are retained. A stale test importing the retired learning client was corrected to exercise the maintained passive attachment transport; learning was not restored.
• Exact native installer check-install, isolated installed entrypoints/updater status, archive/embedded manifest/all payload hashes and official check-uninstall passed: 704 payload files / 591 Python modules. In a separate temporary installed root, two raw real-TCP sessions and two external Host SDK sessions completed their original initialization/list/status/(optional stop)/DELETE and reinitialization. Host client: CPython 3.12.14, MCP 2.2.0, httpx2 2.12.0; Runtime test interpreter 3.12.10. Cold cleanup remains false; no execution host, input, model or paid API was used, and the data root was never created. The daemon lease survived DELETE and was released at final lifecycle shutdown. All 704 payload and 705 installer-owned hashes stayed equal; official uninstall and exact owned-root cleanup passed.
• The first installed harness attempt completed its two raw sessions but stopped before the SDK subprocess because of the harness's Windows audit-argument parsing TypeError. Its failure and successful cleanup were retained; only the external harness was corrected, then a new isolated root passed the complete run. This is not called an error-free first attempt or a GUI performance sample.
• Connector builds twice identically offline; source/METADATA/RECORD and the exact final 0.0.7 baseline were verified. Pinned trusted catalog 3c739e1a5c177d585db3ed63868725dae5cadc32 / Host 1840c8e4f646992ddaebea3139c8895f29743a8f static checks passed. New release assets were anonymously downloaded and size/SHA-256 checked before this PR update. Hashes identify tested bytes, not GitHub-enforced immutability; the installer is unsigned.

Compatibility and maintainer acceptance

Connector settings, permissions, HTTP contributions and minimum 0.1.6 protocol capability are unchanged. That floor is distinct from the exact recommendation and does not qualify all later patches. Runtime remains independently installed/configured/operator-started; the connector uses trusted loopback URL plus separate connection token. Provider keys remain in Runtime and external APIs may incur charges. Disabling/uninstalling the resource connector does not stop/uninstall Runtime or delete its data. Upgrade normally with confirmation and restart the daemon; running old processes do not hot-reload the fix.

This new author acceptance is installed HTTP/external-SDK lifecycle coverage, not installed Pi GUI workflow acceptance, fresh-machine dependency installation, arbitrary migration, physical power-loss, speed/token saving or general GUI accuracy. Earlier GUI/review/observe evidence retains its original versions and scope. The maintainer's remaining GUI/review/observe run and Host UI follow-ups remain theirs; author results do not replace independent acceptance.

@Lucas1479, please continue review in this PR. It adds only five 0.0.8 candidate files, preserving the fifteen historical files. No author approval facts, official catalog/packages, index, security, policy or workflow edits. review_status=not_reviewed remains. Candidate-only publication:false green CI is not store approval. Maintainers retain final acceptance, formal package/reviewer facts, non-author final-head approval, merge and separate index publication.

简体中文

按最新审核继续更新同一 PR，推荐组合改为 连接器 0.0.8／Runtime 0.1.11。旧候选与发布产物不替换。

真实冷会话的 cleanup_verified=false 继续保留。现在由生命周期生产者在所有启动／恢复／直接启动入口记录不可回退的尝试标记，只有原始严格 False 且五类执行资源均未附着，才给出单实例“从未尝试启动”证明；HTTP 同时要求未启动、宿主未运行、无待定请求。活动输入、未知或失败启动、清理未确认、缺失／无效证明及在途请求仍拒绝，原生 DELETE 失败不释放 owner。只释放未使用连接，不启动／停止宿主、不重放输入、不删证据、不释放守护进程安装租约或接管旧流程。旧记录／peer 保留，后续启动仍经过原门禁。

原 0.1.10 的两种冷会话失败已用真实 InstantSession 复现。最终 215 项生命周期检查（含 25 项真实初始状态用例）、139 项打包／更新／原结算回归及 4 项独立反例通过；最终套件未跳过，重叠组不累加。旧学习入口测试改为现维护的被动传输路径，没有恢复学习模式；原始失败与测试夹具修正保留。

确切安装包的安装／入口／更新状态／载荷／卸载检查通过。新临时安装根实跑两轮原生 TCP、两轮外部 Host SDK，均可释放并重新初始化；全程无执行宿主、输入、模型／付费 API，未创建数据根。DELETE 保留租约，最终退出释放，704 项载荷与 705 项安装器拥有文件摘要不变，官方卸载及本轮根清理通过。首次验收脚本因 Windows 审计参数解析错误在 SDK 启动前中止；错误与清理记录保留，仅修外部脚本后换新根完整通过，不冒充无错首跑或性能成绩。

双离线构建、最终 007 基线和固定可信预检通过；公开资产匿名下载摘要已核对。配置／权限／HTTP 贡献、最低 0.1.6 协议、操作员断线恢复、模型／阈值／输入授权不变，不承诺未来补丁通用兼容；正常确认升级后需重启守护进程。禁用／卸载扩展不停止独立 Runtime 或删除数据，密钥留在 Runtime，外部 API 可能收费。

本次只补安装态 HTTP／外部 SDK 生命周期验收，不代替维护者的 Pi GUI／审核／observe、Host 界面检查或新机器安装，也不新增迁移／断电／速度／准确率结论。SHA 标识已测字节，不代表 GitHub 强制发行不可变，安装器未签名。只新增五份 008 候选材料，保留十五份历史文件；正式收录、独立验收和非作者批准仍由维护者完成，CI 绿不代表上架。

[Lucas1479]

English

@Desolate-Jix This review covers PR head 85ace61e96685be88519cde8ae2f73e6240be33b and the 0.0.5 wheel (SHA-256 9727889c378354ee6b24648c94b2276b8ed30d986b49d1dd4b0f5c3c188774dd).

Apart from the scope question below, the other author revisions examined in this round provisionally pass; no new package-content blocker was found. The connector's pre-installation disclosure, homepage/source links, version increment, packaged and bilingual guides, troubleshooting, and minimal task instructions are in place. Downloaded bytes, source, RECORD and static admission checks passed. The real Host installer also passed 27 assertions in an isolated profile, covering the 0.0.4→0.0.5 update with configuration/secrets/Pi bindings retained, disabling, uninstalling while retaining data, reinstalling, and explicit data deletion. Confirmation and encryption callbacks were test doubles; these results do not replace real Pi/Runtime/GUI acceptance.

Before live acceptance: please clarify the two recovery tools

The recommended Runtime 0.1.8 exposes instant_recovery_preview and instant_recover_session to Pi. The former is read-only. The latter admits a new epoch after validating original resource cleanup and input settlement; it neither replays old commands nor automatically takes over the original workflow.

However, the current Skill and reference instruct the agent to retain evidence, stop, and leave recovery to the operator when the original connection is lost or ownership remains unresolved.

This does not establish a security vulnerability or a direct contradiction: a tool being available does not mean the connector supports autonomous agent use of it. We need an explicit behavior boundary so live acceptance tests the intended product behavior.

Please confirm separately:

1. May Pi independently call the read-only instant_recovery_preview, or should even the preview be left to the operator?
2. Is instant_recover_session a supported agent operation for this connector? If so, must the user explicitly authorize this particular recovery first, while all existing original-process-exit, original-evidence, same recovery request/hash, and readiness requirements still apply?
3. Does the current 0.0.5 Skill accurately express those expectations, or does it need revision?

If the existing stop-and-hand-off-to-the-operator behavior is intentional and the packaged instructions need no changes, acceptance can proceed on 0.0.5 with that boundary. There is no requirement to expose every Runtime capability through this connector. If the Skill's behavior needs changing, publish a new version, such as 0.0.6, before the relevant live acceptance on the final bytes, avoiding a complete 0.0.5 run followed by rework. An upgrade to 0.0.6 is not presumed necessary.

Two other observations do not block the current static conclusion: the packaged “store review pending” wording followed our earlier feedback, so a future version can move that changing status to the PR/Release; and Skills are agent operating instructions, so this revision should be recorded as a behavior change, rather than described broadly as documentation-only.

Please reply in this PR and keep it open. Maintainers still own independent acceptance of the unexecuted installed Pi/GUI, recovery/review-packet, real session shutdown and maintenance-admission cases. A maintenance registration not being retired immediately does not yet establish an update failure. This is an interim review and scope clarification, not final catalog approval or authorization to merge or publish. After independent acceptance, maintainers can add the formal catalog records and follow the existing publication workflow.

---

简体中文

本轮复审基于当前 PR head 85ace61e96685be88519cde8ae2f73e6240be33b 和 0.0.5 wheel（SHA-256 9727889c378354ee6b24648c94b2276b8ed30d986b49d1dd4b0f5c3c188774dd）。

除下面这一个待澄清点外，其余本轮已检查的作者返修项暂定通过，未发现新的包内阻塞。 连接器安装前披露、主页/源码链接、版本提升、包内及双语指南、排错和最小任务说明均已落实。实际下载字节/源码/RECORD 与静态准入检查通过；真实 Host 安装器在隔离 profile 中也通过了 27 项断言，覆盖 0.0.4→0.0.5 更新保留配置/密钥/Pi 绑定、停用、数据保留卸载、重装和明确删除数据。确认及加密回调是测试替身，这些结果不代替真实 Pi/Runtime/GUI 验收。

实机验收前请确认：两个恢复工具的使用范围

推荐的 Runtime 0.1.8 会向 Pi 暴露 instant_recovery_preview 和 instant_recover_session：前者只读，后者在验证原资源清理和输入结算后准入新 epoch，且不重放旧命令、不自动接管原工作流。

但当前 Skill / reference 在原连接丢失、owner 未解决时要求保留证据、停止并交给操作员恢复。

这还不能认定为安全漏洞或直接矛盾：工具具备某种能力，不代表连接器一定允许 Agent 自行使用。需要明确连接器的产品行为，以免实机验收采用不同预期。

请分别确认：

1. Pi 是否可以自行调用只读的 instant_recovery_preview，还是连预览也应交给操作员？
2. instant_recover_session 是否属于本连接器支持的 Agent 操作？如果属于，是否必须先获得用户对这次恢复的明确授权，且仍遵守工具已有的原进程退出、原证据验证、同一 recovery request/hash 和 ready 条件？
3. 当前 0.0.5 Skill 是否已准确表达上述预期，还是需要修改？

如果现有“停止并交操作员”就是预期、无需改变包内指令，可按此边界继续验收 0.0.5；不要求为了覆盖 Runtime 全部工具而增加功能。如果需要调整 Skill 行为，则应另发新版本（例如 0.0.6），再针对最终字节做相关实机验收，避免先测完 0.0.5 再重做。目前不预设必须升到 0.0.6。

另两点不阻塞当前静态结论：包内“商店审核待定”是我们此前反馈引出的表述，有下一版时可把易变审核状态移到 PR/Release；Skill 属于 Agent 操作指令，其本次变化应按行为变更记录，不能笼统归为纯文档修改。

请在本 PR 回复并保持 PR 开放。未执行的安装态 Pi/GUI、恢复/审核 packet、真实会话退出与维护准入等项目仍由维护者安排独立验收；维护登记未即时核销也尚不能推断为更新故障。本评论是阶段性复审与范围澄清，不构成最终收录批准、合并或上架授权。独立验收通过后，再由维护者补正式收录记录并按既有流程发布。

[Desolate-Jix]

@Lucas1479 Confirming the intended boundary for the exact 0.0.5 wheel reviewed at PR head 85ace61e96685be88519cde8ae2f73e6240be33b.

English

1. Read-only preview: Pi should not independently call instant_recovery_preview after a disconnect or unresolved owner conflict under the 0.0.5 connector Skill. It should retain original IDs/evidence, report the interruption and leave even this diagnostic preview to the operator.
2. Session recovery: instant_recover_session is not a supported Pi operation within this connector version. The Runtime retains it as an experimental operator-directed capability; a general GUI task does not authorize its use. Any separate operator recovery must still satisfy the tool's original-process-exit, resource/input-settlement, exact recovery request/hash and readiness gates. It does not automatically take over the old workflow or replay old commands.
3. Current Skill: the existing stop-and-hand-off-to-the-operator instructions express this intended 0.0.5 behavior. No packaged instruction or artifact change is needed for this clarification, so please continue acceptance against the existing 0.0.5 bytes; we are not requesting a 0.0.6 revision here.

This is the connector's supported operating boundary, not a claim that the Runtime hides or disables these endpoints. Ordinary same-session Main review followed by explicit continuation of the original job remains supported; the recovery boundary above concerns lost connections or unresolved ownership.

I also accept the change-classification correction: Runtime execution code, connection keys and permission declarations are unchanged, but the revised Skill/reference are agent operating instructions and must be reviewed as a behavior-impacting instruction change, rather than broadly described as documentation-only. This corrects our earlier broad wording. In a future version, mutable store-review status can stay in PR/Release metadata.

Please keep this PR open for the remaining independent acceptance. The installer checks and green CI are not final catalog approval; installed Pi/GUI, review packets, real session shutdown and maintenance-admission coverage remain with the maintainers as described in your review.

简体中文

逐项确认当前 0.0.5 的预期：

1. 只读预览也交操作员。 断线或 owner 冲突未解决时，Pi 不自行调用 instant_recovery_preview；保留原 ID／证据，报告中断并停止。
2. 会话恢复不属于本版连接器支持的 Pi 操作。 instant_recover_session 保留为 Runtime 的实验性、操作员主导能力，普通桌面任务不构成恢复授权。另行由操作员恢复时，仍须满足原进程退出、资源／输入结算、同一 recovery request/hash 和 ready 等全部原门禁；不自动接管旧工作流，不重放旧命令。
3. 现有 Skill 已表达这个停止并交操作员的边界。 本次只是确认其预期，不改包内指令或既有产物，请继续按原 0.0.5 字节验收，无需为此发布 0.0.6。

这是连接器支持范围，不表示 Runtime 已隐藏或禁用两个接口。正常同一会话内 Main 看图审核、再明确继续原 job的能力保持支持；断线／所有权未解决后的恢复另行处理。

同时接受变更分类指正：Runtime 执行代码、连接配置键和权限声明未改，但 Skill／reference 是 Agent 操作指令，应按影响行为的指令变更审核，不能笼统归为纯文档修改；此回复更正此前过宽的表述。后续新版本可将易变商店状态留在 PR／Release。

请保持本 PR 开放，继续安排剩余独立验收。安装器检查和绿色 CI 不等于最终收录批准；安装态 Pi／GUI、审核 packet、真实退出及维护准入仍按本轮评论所列范围由维护者独立验收。

[Desolate-Jix]

Live acceptance rerun — connector 0.0.5 / Runtime 0.1.8

Result: partial; the scoped GUI and interruption checks passed, but maintenance admission failed. This is not final catalog approval. Run performed on 2026-10-26–27, Pacific/Auckland, following the author's confirmed stop-and-hand-off boundary. Neither Pi run invoked the recovery-preview or new-epoch recovery tools.

Frozen identities:

• PR head: 85ace61e96685be88519cde8ae2f73e6240be33b, unchanged on final readback.
• Public connector wheel: 24,635 bytes, SHA-256 9727889c378354ee6b24648c94b2276b8ed30d986b49d1dd4b0f5c3c188774dd; downloaded and checked for this round.
• Published Runtime 0.1.8 installer: SHA-256 03394583530aadd5b500db621bb34139d2723d6c3176850680b26f721631f93d. Fresh native --check-install under a new temporary root; all 696/696 payload files matched before and after testing. The check installation does not replace the daily installation or its OS integration.
• Host b6616a166925963ad6de4ab0a02f4eef2dccd657, native Pi 1.2.0; Host Python 3.12.14, Runtime API Python 3.12.10. Source-built shipping Electron/backend, real native ExtensionInstaller and normal Pi Work route, isolated profiles. Installer access-confirmation callbacks represented the explicitly authorized test installation; this is not a native-dialog UX test or a fresh Host installer qualification.

Scope	Observed result
Natural installed Pi/GUI task	4/4 original steps completed: Documents → Reports → Up → Receipts. The final bound frame showed the Receipts path and receipt-marker.txt; exact fixture file set and marker hashes were unchanged. Four logical actions produced seven physical click events. No TEST refusal proxy was used in this run.
Same-session image review and continuation	A natural Decision/ordinary nonpass produced a genuine pre-action packet. The original Pi fetched its bound before image, supplied its own review, then separately continued the same original run/job/candidate. One logical dispatch per business step; no replacement plan or replay to obtain a pass. This was assisted success, not an unattended-accuracy result.
Controlled cancellation	Separate explicitly labelled TEST double-refusal case: Pi cancelled the original plan at the first review wait, observed cancelled, then made one late continue request using that original wait. It was rejected with workflow_runner_wait_id_mismatch. The original job recorded a returned attempt with action_executed=false and a local invocation not_dispatched; this is no navigation input, not an assertion that no attempt record exists.
Window/host cleanup, release/reconnect	Both Pi runs closed only their own launched 7-Zip windows and reached host_alive=false, pending_ids=[], cleanup_verified=true. Each subsequent fresh client initialized, read clean status and returned its own DELETE 200. The original Pi transport's exact DELETE HTTP code was not captured and is not inferred from the new client's code.
Service unavailable, authentication and disconnected transport	Installed Runtime API harness: pre-start connection refused; seven token/Host/Origin negative cases passed. Closing a client's TCP transport did not allow another owner to take over; the retained logical owner could read status. DELETE before cleanup was refused; real child-host stop/cleanup then permitted release/reconnect. These are API-layer cases, not seven additional Pi/GUI runs.
Post-use disable/uninstall	Actual native installer persisted disable and an inactive startup projection after the natural live run, then removed the exact owned connector/package/data. Both isolated connector installations were removed. The independent Runtime installation and evidence remain. Runtime service was already stopped during the disable check.
Formal maintenance admission	FAIL. Activity correctly blocked maintenance, but after all owners stopped, official update_runtime.py --root <test-install> settle still exited 1: RuntimeTaskLedgerError / runtime_task_ledger_session_unsettled. Repeated once after the second test and final cleanup, with the same refusal. No lock/registration was deleted and no lower-level clear API was used to manufacture a pass.

The API harness completed 39/40 checks, with the post-shutdown maintenance check the sole failure. A separate read-only audit passed 51 local evidence checks for the natural navigation run; these are evidence assertions and overlap the underlying execution, so the counts must not be added as independent coverage.

Maintenance failure follow-up. The retained normal-session registration points to the completed natural task. Static comparison found that the shipped app/core/session_input_terminal.py does not handle task_plan in its input-settlement classification: start/review/continue command records reach the unsupported-kind check, and app/runtime_task_ledger.py wraps the failure as runtime_task_ledger_session_unsettled. Both installed files were byte-identical to checked source 6bd60fde83259ea0bd627873748f6a32e71342ea. See the classification and ledger wrapper. The CLI failure is directly observed; the inner classification cause is a static code/evidence diagnosis, not a captured child exception trace. Treating an input-bearing task plan as read-only would not be a valid fix; original plan/runner and input proofs need validation.

Evidence retained privately: artifact/build freeze, normal and cancellation Pi JSONL, product/tool events, bound PNGs, original command/job/plan/verification JSON, HTTP receipts, official maintenance outputs, native disable/removal receipts, independent audits, and before/after integrity manifests. Raw logs, screenshots, credentials, private profiles and personal paths are not uploaded here. The final evidence manifest hashes the retained files. All five test-owned service/backend ports were closed. The controller's Windows process termination returned exit 1 for the parent HTTP/frontend processes; this is disclosed separately from successful Runtime host cleanup and is not called a graceful daemon exit.

Retained caller limitations: natural Pi made one incorrect tool-name call before correcting it and reading the original request. The cancellation Pi attempted an unauthorized no-op shell command and an out-of-scope temporary-file read; both were denied. Neither resulted in a replay of the original plan or an extra GUI action. Work execution=succeeded / state=review_ready / completion=partial is separate from the natural Runtime plan's completed and the cancellation plan's cancelled.

This run does not qualify current-agent mode, typing/save/compression tasks, physical reboot/power loss, arbitrary migrations, unexpected Pi-process loss during an in-flight input, or every incompatible Runtime version. The documented four navigation steps were exercised in a task-owned launched window, rather than an operator-prepared window. No production code or catalog record was changed. Please retain the completed checks and address the maintenance blocker before final approval/admission; catalog/packages records, merge and index publication remain separate work.

---

简体中文结论：本轮已实际重跑，但整体验收仍为 partial。 固定了 #11 的 0.0.5 发布 wheel、全新安装的 Runtime 0.1.8、Host b6616a1 和 Pi 1.2.0。四步导航全部完成，包含一次自然触发、由原 Pi 看绑定图后分别审核及继续原任务；独立受控取消用例也确认取消到终态、未执行导航输入、迟到继续被拒。窗口／宿主清理、释放重连及真实运行后的连接器停用／卸载通过。

未通过项是正式维护准入： 原任务和清理均结束后，官方 settle 仍以 runtime_task_ledger_session_unsettled 拒绝。静态核对定位到输入结算尚未支持 task_plan 的原命令记录；没有删除登记、锁或绕过门禁。原始数据和失败登记保留，696 个 Runtime 载荷文件前后摘要全同。以上通过结果可以保留，但不能写成最终收录批准；本轮未合并、未填写批准记录、未发布索引。

Private retained evidence manifest SHA-256: 20ba6e0e6a1d25123ec76e11fb9c3aeb7fed8a22943c6c48b774e8b448461084. This identifier commits to the retained evidence inventory; it is not a public raw-log attachment.

[Lucas1479]

English

@Desolate-Jix I reviewed the latest installed acceptance record. Please keep #11 open: the Runtime maintenance-admission failure blocks final approval. The connector's previously passed static and isolated-installer checks remain valid, and the confirmed operator-only recovery boundary is settled.

The record reports meaningful progress: natural four-step navigation, genuine same-session pre-action image review/continuation, controlled cancellation with a rejected late continue, cleanup/reconnect, and post-use connector disable/removal. Neither Pi run used the experimental recovery tools. These are author-reported live results. We independently checked the public identities/source and the shipped source archive, but have not inspected the private raw evidence or rerun these live tasks ourselves. A private evidence-inventory hash does not replace independent acceptance.

Runtime author: fix settlement and qualify the repair

The observed failure is the official update_runtime.py settle returning runtime_task_ledger_session_unsettled after the normal task and cleanup have finished. Public source supports the reported diagnosis: the classifier does not handle task_plan, while the ledger wraps the resulting failure as unsettled. The reported CLI refusal is observed evidence; its precise internal cause remains the source/evidence diagnosis, not a captured inner traceback.

This fix belongs in agent-gui-runtime, not an Amadeus workaround. Please validate the original task-plan/runner and input-settlement proofs. Do not classify input-bearing plans as read-only, swallow failures, or delete registrations to make maintenance pass.

Please provide an immutable repaired Runtime with focused positive/negative coverage: a completed plan and a proven cancelled plan can settle; active/unknown input and missing or altered evidence still reject. Then exercise a normal Work → stop/release → official settle successfully, preserving the original failure.

Also verify the upgrade route for users already affected on 0.1.8. Because the old updater applies the old admission gate, it may be unable to install its own fix; this has not been tested and is not a claim that manual reinstallation is necessarily required. Document a verified recovery/migration route without bypassing cleanup or input proofs.

Connector author: align the recommended Runtime

0.0.5's manifest, README and Skill explicitly recommend 0.1.8. Once the repaired Runtime is released, the store should guide new users to that qualified version. Since catalog display comes from the wheel manifest, updating those packaged recommendations requires a new connector version, likely 0.0.6; do not replace 0.0.5 bytes. The recovery policy itself need not change. If a new version is needed, mutable store-review status can also move out of the package into PR/Release metadata.

Reuse valid unchanged evidence. A new wheel still needs byte/static/diff checks, and the final connector/Runtime combination needs the natural task and maintenance regression; this does not call for restarting every earlier test.

Maintainers: independent acceptance and publication

We own the Host-side work: independently check unavailable service/wrong-token behavior through Amadeus's connection-test UI and Pi Work, then run the final natural task and official settlement path. Host UI/state defects are ours to investigate. Your API-layer negative checks are useful evidence but do not establish Host-visible behavior; the earlier 27 isolated installer assertions can be retained for their stated scope.

Keep the remaining scope precise, without treating every limitation as a new author blocker:

• Task-owned windows were tested; preservation of an operator-prepared window was not.
• Runtime was already stopped during disable testing, so this does not directly observe disabling while the external service remains running.
• The cancelled Pi run's shell/file attempts were denied; they are not executed operations or evidence of a package permission bypass.
• The recorded Work completion=partial needs Host-side interpretation against the same natural run and timestamp. A completed Runtime plan and a Work awaiting review may represent different layers; this is not yet a confirmed Host defect.

After the blocker and necessary independent acceptance are closed, maintainers add the real catalog/packages/ facts in this PR, let admission inspect the actual wheel, obtain non-author approval on the final head, and merge. Index publication follows in a separate PR. Required review rules and reviewer arrangements are also maintainer responsibilities; a green candidate-only publication:false check is not approval.

---

简体中文

已复核最新安装态验收记录。请保持 #11 开放：Runtime 的维护准入失败是最终批准的阻塞项。 连接器此前通过的静态与隔离安装器结果继续保留，两个恢复工具交操作员的边界也已确认。

记录报告了实质进展：自然四步导航、真实同会话输入前看图审核及继续、受控取消和迟到继续拒绝、清理重连、使用后的停用卸载。两次 Pi 均未调用实验性恢复工具。这些是作者报告的实机结果；我们独立核对了公开身份、源码和发行源码载荷，尚未查看私有原始证据或自行重跑这轮实机。私有证据清单哈希不能替代独立验收。

Runtime 作者负责：修复结算并验证修复

实测失败是正常任务和清理结束后，官方 update_runtime.py settle 仍报 runtime_task_ledger_session_unsettled。公开源码支持报告中的诊断：输入结算分类未处理 task_plan，ledger 再把异常包装为 unsettled。CLI 拒绝是已报告的实测；具体内部原因仍是源码/证据诊断，不冒称捕获了内部异常栈。

这个问题由 agent-gui-runtime 作者修，Amadeus 不应添加绕过补丁。 应核验原 task-plan/runner 和输入结算证明，不能把有输入的计划视为只读、吞异常或删除登记来制造通过。

请发布不可变的修复 Runtime，并补定点正反检查：已完成、已证明取消的计划能结算；活动/未知输入、缺失或篡改证据仍拒绝。再跑正常 Work → 停止/释放 → 官方 settle 成功，保留原失败记录。

还请验证已经受影响的 0.1.8 用户如何升级。旧更新器仍使用旧准入逻辑，可能无法安装自身修复，但目前未测试，不能直接断言只能手动重装。需要给出经过验证、不绕过清理与输入证明的恢复/迁移路径。

连接器作者负责：更新推荐 Runtime

0.0.5 的 manifest、README 和 Skill 都明确推荐 0.1.8。修复 Runtime 发布后，商店应引导新用户使用经过验收的修复版本。展示来自 wheel manifest，因此更新这些包内推荐需要新连接器版本，预计为 0.0.6，不能覆盖 0.0.5。恢复行为策略本身无需改变；若发新版，可顺手将易变审核状态移至 PR/Release。

有效的未变化证据可以沿用。新 wheel 仍需字节、静态及差异检查，最终组合重跑自然任务和维护回归即可按影响范围继续验收，不要求全部从头再测。

维护者负责：独立验收与发布

Host 侧由我们处理：在 Amadeus 连接测试界面和 Pi Work 中独立核对服务不可达/错误 token 的表现，再用最终组合完成自然任务与官方结算路径。Host 界面或状态缺陷由我们查。API 负例是有效证据，但不等于 Host 用户可见体验已经通过；此前 27 项隔离安装器断言保留其原有范围。

其余限制准确记录，不全部变成新的作者阻塞：

• 测过任务自己启动的窗口，未直接测试保留操作员预先打开的窗口。
• 停用时 Runtime 已停止，未直接观察外部服务仍运行时的停用效果。
• 取消 Pi 的 shell/文件尝试被拒，不能算成实际执行或包绕过权限。
• Work 的 completion=partial 由我们对照同一自然运行及时间点核对；Runtime plan 完成与 Work 待审可能属于不同层次，目前不能认定 Host 缺陷。

阻塞修复且必要独立验收完成后，由维护者在本 PR 补正式 catalog/packages/ 记录，让 admission 真正检查 wheel，取得最终 head 的非作者批准后合并，随后另开索引发布 PR。强制审核规则及评审人安排也是维护者责任；候选材料的绿色 publication:false 检查不等于批准。

[Lucas1479]

English

@Desolate-Jix Combined review of PR head dd267cbf5ffcb1fa9900c5fa9d2320e446f2d7d2, connector 0.0.6 and Runtime 0.1.9 (source b0ddd8096bacd0d8710cc60736bce5b861032156):

The examined connector content and author revisions provisionally pass; please proceed to independent maintainer acceptance on this combination. Keep #11 open until that acceptance, formal catalog records and non-author approval are complete. We will track the two remaining Runtime settlement cases below as follow-up defects, rather than require a 0.0.7 connector release solely for them. This is an interim review, not final catalog approval.

The 25,761-byte wheel (e55b88de422d2a8bfcb0edd39331a4980d5753c25a2ec084b7b2abac2ee8c586), RECORD, inventory/source comparison and Host static checks passed. Configuration, permissions and contributions are unchanged. The recommended version, operator-only recovery wording and removal of mutable review-status text address the previous package feedback. Our independent offline checks passed 49 new task-plan settlement tests and 28 existing settlement tests against the shipped payload; all 700 original payload files remained unchanged. These counts are separate from your reported suites.

The source supports the normal-path repair without bypassing the maintenance gate. Your reported retained-session migration and new four-step installed Pi task followed by official settle success are valuable author evidence. We have not independently rerun that migration/live task or inspected the private raw sessions.

Runtime follow-ups

1. Rejected control requests can prevent later settlement — source-reviewed; these rejection cases were not independently executed in this review. The classifier includes all recorded task-plan controls. A rejected sole start can encounter runner_missing; a rejected additional start can encounter start_binding; a retained failed stale review can encounter response_binding. The special case for a rejected late continue does not cover those shapes. Please investigate a shared proof of rejection before dispatch and add representative positive/negative regressions. Before using absence from admission/control records as proof of no input, establish the durable record-before-dispatch invariant across every relevant path, including interrupted/partial writes. Absence alone is not sufficient. Preserve refusal for genuinely unknown input; avoid a growing whitelist of error strings.

2. Successful observe still prevents settlement — independently reproduced offline. With unmodified 0.1.9 production code and upstream synthetic fixtures, a one-step v2 plan → bound review → explicit continuation finishes and settles. Adding one successful read-only observe, then reviewing the revised packet and continuing, also finishes with one original dispatch and unchanged evidence, but returns session_input_task_plan_control_unsupported. Settlement rejects this control, while MCP instructions expose it. recover and resume_pre_dispatch are also declared unqualified; we have not independently exercised those two complete paths. This is distinct from the two operator-only session-recovery tools. The Skill's stop/report rule and missing ready-made recovery recipes reduce exposure in some pre-dispatch waits, but do not disable these controls or prove their settlement. Please track their supported scope and evidence validation explicitly in Runtime, and align the Skill/reference when next revised.

The demonstrated impact is maintenance/update refusal; these findings do not demonstrate unauthorized input or lost evidence. Retaining evidence makes a future verified repair possible, but is not a guarantee that every affected session will be recoverable. Do not delete registrations/evidence or bypass checks. Maintainers should record these limitations in the final acceptance decision.

Before merge — maintainer responsibilities

• Independently test the exact final combination on current Host main: unavailable service/wrong token through the connection-test UI and Pi Work, a natural task followed by cleanup/release and official settle, preservation of an operator-prepared window, and disabling the connector while the separate Runtime remains running.
• Keep evidence scopes explicit: this 0.1.9 live run did not naturally trigger Main review; earlier review/continue evidence retains its original scope. Original Pi DELETE status was not captured, and HTTP/Electron parent exit 1 was disclosed separately from verified child cleanup. Author reports and previous isolated installer tests do not replace the remaining independent checks.
• Add real catalog/packages/ records in this PR, run admission against the actual wheel, obtain non-author approval on the final head, then merge. Publish the index in a separate PR. CLEAN/MERGEABLE and candidate-only publication:false do not satisfy these steps.

Non-blocking documentation/distribution improvements: provide a reproducible manifest-verification command; both release API responses currently report immutable:false, so distinguish digest pinning from GitHub-enforced release immutability (replacement/deletion can still affect availability); separate the exact tested/recommended baseline from the minimum protocol contract without promising compatibility with every future 0.1.x patch. Keep 0.0.5 candidate files clearly historical and admit only the selected final version.

There is no requirement to create 0.0.7 before starting the above acceptance. If a repaired Runtime such as 0.1.10 is released and selected as the new recommendation, update the packaged recommendations in a new connector version and validate the final combination, reusing unaffected evidence.

---

简体中文

综合复审当前 head dd267cbf5ffcb1fa9900c5fa9d2320e446f2d7d2，对象为连接器 0.0.6＋Runtime 0.1.9，Runtime 源提交为 b0ddd8096bacd0d8710cc60736bce5b861032156。

本轮已检查的连接器内容和作者返修项暂定通过，可以直接进入这个组合的维护者独立验收。请保持 #11 开放，完成验收、正式收录记录和非作者批准后再合并。 下面两项按 Runtime 后续缺陷跟进，不单独要求为此重发 0.0.7。本评论不是最终收录批准。

实际 wheel 为 25,761 字节，摘要 e55b88de…，RECORD、清单、源码对照和 Host 静态检查通过；配置、权限及贡献点不变。推荐版本、两个恢复工具仅限操作员、删除包内易变审核状态等上一轮反馈已落实。我们独立运行了 49 项新任务计划结算测试＋28 项已有结算测试，全部通过；发行载荷原有 700 个文件未改变，不与作者报告的测试分组累加。

源码支持正常路径的结算修复，没有绕过维护门禁。作者报告的旧会话迁移及新版四步 Pi 实机任务后官方 settle 成功，是有价值的作者证据；我们尚未独立重跑这两条实机路径，也未查看私有原始会话。

Runtime 后续问题

1. 被拒绝的控制请求可能阻止后续结算：本项已核对源码，未独立运行这些拒绝用例。 分类器遍历全部 task-plan 请求；唯一 start 被拒可能遇到 runner_missing，额外 start 被拒可能遇到 start_binding，保留的过期 review 失败响应可能遇到 response_binding。现有迟到 continue 豁免未覆盖这些形态。建议建立统一的“输入派发前已拒绝”证明并补正反回归；采用“没有准入记录，所以没有输入”之前，必须先证明所有相关路径都满足先持久化记录、再派发输入，包括中断和部分写入。记录缺失本身不充分，不应逐个增加错误字符串豁免；真实未知输入仍要拒绝。
2. 成功 observe 后仍不能结算：已独立离线复现。 原版 0.1.9 上，一步 v2 计划→审核→明确继续能完成并结算；中间加入一次成功只读 observe，再绑定新 packet 审核、继续，计划同样完成且只有一个原派发命令，证据未改变，但结算报 session_input_task_plan_control_unsupported。工具说明仍提供这个操作。recover、resume_pre_dispatch 也被作者明确列为未覆盖，本轮未独立完整执行这两个分支。这与之前两个 operator-only 会话恢复工具不同。Skill 的停报规则及部分输入前等待没有现成恢复模板，能降低误用机会，但不代表这些操作被禁用或已具备结算能力；请在 Runtime 跟进，并在后续修改 Skill/reference 时同步支持边界。

已确认影响是维护/更新受阻，没有由这些发现证明越权输入或证据丢失。保留证据给未来核验修复留下可能，不能保证所有受影响会话以后都能恢复。不删除登记或证据、不绕过检查；维护者最终验收应明确记录这些限制。

合并前由维护者完成

• 在当前 Host main 上独立测试最终组合：连接测试界面及 Pi Work 的服务不可用/错误 token 体验；自然任务、清理释放、官方 settle；保留操作员预先打开的窗口；Runtime 仍运行时禁用连接器。
• 准确保留证据范围：本次 0.1.9 实机未自然触发 Main 审核，旧审核/继续结果仍属旧范围；原 Pi DELETE 状态未捕获，HTTP/Electron 父进程退出码 1 与已验证子进程清理分别记录。作者报告和此前隔离安装器结果不能代替尚缺的独立检查。
• 在同一 PR 添加真实 catalog/packages/ 记录，让 admission 检查实际 wheel，取得最终 head 的非作者批准，再合并；另开索引发布 PR。CLEAN/MERGEABLE 和候选材料的 publication:false 不代表这些步骤完成。

低优先级改进：给出逐文件清单核验命令；两个 Release API 当前均为 immutable:false，应区分摘要锁定与 GitHub 强制不可变，资产替换/删除仍可能影响可用性；版本说明区分“实际验收的推荐版本”和“最低协议能力”，不直接承诺未来所有 0.1.x 补丁兼容。0.0.5 候选资料可清楚标为历史，仅正式收录最终选定版本。

当前不要求先出 0.0.7 才开始验收。若作者发布并选用新的修复 Runtime（例如 0.1.10），再通过新连接器版本同步包内推荐，验收最终组合，并沿用未受影响的已有证据。

[Lucas1479]

English

@Desolate-Jix Independent maintainer live acceptance: partial; keep this PR open.

Reviewed current PR head 3fb33fb46609f9097bd53e66812e9a449d778775, connector 0.0.7 and Runtime 0.1.10. The connector/static checks and 146 independent offline tests passed; the control/observe settlement fixes remain accepted within that scope. This new Runtime lifecycle finding and the remaining live acceptance prevent final approval.

Problem

A fresh Runtime 0.1.10 HTTP session that only initializes and lists tools cannot release its owner. Its normal DELETE returns 409 runtime_cleanup_required; following that error's instruction to call instant_stop does not help. A second client is then rejected with 409 owner_already_initialized, even though no execution host was ever started and no input could have been dispatched. This also affects connection-only probes before a Pi Work.

Upstream check

Checked Desolate-Jix/agent-gui-runtime at db9dc10dacf3534949cd59e3e83804232fb227dd (instant-v0.1.10 and current main on 2026-10-27). Production files were unmodified. The real InstantSession reports not_started / cleanup_verified=false, while the HTTP DELETE gate requires cleanup_verified=true. See the DELETE gate and real initial status. The existing HTTP fixture begins with cleanup_verified=true and therefore does not cover this production initial state. Searches for the error code and initial phase found no matching issue.

Environment and evidence (sanitized)

Windows x64, Runtime Python 3.11.16; Host 47954d8b, Python 3.12.10, Pi 1.2.0 with subscription-backed Luna. Runtime was the existing source deployment updated in place to the exact tag, not a fresh official-installer test. The independent live connection probe exposed the failure; a separate minimal reproduction used the actual InstantSession and native ASGI transport with synthetic authentication and no model calls or desktop execution:

initialize                         -> 200
notifications/initialized          -> 202
tools/list                         -> 200, 9 tools
status                             -> not_started, host_alive=false,
                                      pending_ids=[], cleanup_verified=false
DELETE                             -> 409 runtime_cleanup_required
instant_stop                       -> 200, same not_started state
DELETE                             -> 409 runtime_cleanup_required
second initialize                  -> 409 owner_already_initialized
execution host / model / input     -> never started / never called / none

Please handle release of a provably never-started owner at the Runtime lifecycle boundary, while retaining rejection for active input, unknown startup and unverified cleanup. Add coverage using the real initial-session state and retain the existing negative lifecycle tests. Host should not start an execution host merely to make a connection probe releasable.

Separately, our real Pi/Luna run reached readiness and selected the operator-preopened 7-Zip window, but stopped at capture_window_occluded; no task plan or navigation was submitted. Original host cleanup, preserving that window, disabling/uninstalling without stopping the external daemon, and official settle of that no-navigation session succeeded within those scopes. Disabling was exercised through the real UI and backend restart; uninstall used the production native ExtensionInstaller API after Host exit, with data retention. The settle result verified/cleared 1 registration and left all 16 original session files unchanged; because that session contained no task plan, it does not qualify task-plan/observe settlement in live use. Full GUI/review/observe acceptance remains pending. The missing extension connection-test UI and inconsistent Host lifecycle warnings belong to our Host follow-up, not an additional connector-author checklist.

简体中文

上一轮控制/observe 结算修复在原审核范围内仍认可，但维护者实机尚未完成，PR 请继续保持开启。新增问题在 Runtime：新 HTTP 会话仅初始化、列出工具，没有启动执行宿主，也没有任何输入，DELETE 就会被 runtime_cleanup_required 拒绝；按提示调用 instant_stop 后仍然无法释放，下一客户端被 owner_already_initialized 拒绝。

连接器 0.0.7 的静态检查和 146 项独立离线测试通过。本次复用现有 Runtime 源码部署并更新到固定 tag，没有重跑官方安装器。在未修改的 0.1.10/当前 main db9dc10d 上，已用真实 InstantSession 和原生 ASGI transport 独立复现上面的请求序列，全程没有模型调用、执行宿主或桌面输入。真实初始状态是 cleanup_verified=false，而现有 HTTP 测试 fixture 初始就设为 true，漏掉了这个生命周期分支。

请在 Runtime 处理有充分证明“从未启动且无待定输入”的 owner 释放；活动输入、启动结果未知、清理未证实仍须拒绝。请覆盖真实初始状态，不要让 Host 为测试连接而启动执行宿主。我们的 Pi/Luna 实机已到 ready 并选择预先打开的 7-Zip，但取图因遮挡停止，未提交导航计划。宿主清理、保留窗口、禁用/卸载不停止独立服务，以及这次无导航会话的官方 settle 已在各自范围内通过。停用走真实 UI 与后端重启，卸载走 Host 退出后的生产安装器 API 并保留数据。官方 settle 验证清除 1 条登记，16 项原会话文件未变；由于未提交 task_plan，不能代替完整任务/observe 的实机结算。完整 GUI/审核/observe 仍待完成；Host 的连接测试入口和状态警告由维护者跟进，不转派给连接器作者。

[Lucas1479]

Independent 0.0.8 review record

Performed 2026-10-29, published 2026-11-05 (Pacific/Auckland). This publishes the previously local, sanitized maintainer-side review so the eventual catalog record has a durable evidence link. It is not a new test run or a GitHub approval.

• Responsible catalog maintainer: @Lucas1479, with Codex-assisted independent inspection and execution; artifact author/publisher: Desolate-Jix.
• Review policy: curated-v1, catalog baseline 3c739e1a5c177d585db3ed63868725dae5cadc32.
• Submission head: 8705a3f04e602d145d74782c310f6866cbc20f24.
• Reviewed package: io.github.desolate-jix.gui-runtime 0.0.8, wheel amadeus_agent_gui_runtime-0.0.8-py3-none-any.whl, 27,990 bytes, SHA-256 2f532faf152faf2e1e3ab3140e1097487689be34d638e4ee86539e06886cbcaf.
• Connector source ZIP: 52,657 bytes, SHA-256 b54afe548dae17c04600f48553b9e27033db4a370f6963ad2ea518b585cff3b4.
• Source revision for connector and Runtime: 323099100b04beeb6ee67a846f0e530998c19bbc; recommended external Runtime 0.1.11.

Bytes, source and package policy

The retained receipts record 17 downloaded public artifacts matching release sizes and SHA-256 values; all 15 downloaded files covered by SHA256SUMS also matched. The wheel has 10 files and nine hashed RECORD entries. The four package files match the source ZIP, and the README matches METADATA. Seven relevant source/build/documentation files match the fixed source revision with the explicitly recorded CRLF/LF and trailing-whitespace normalization. The Runtime archive's 704 payload hashes also matched its update manifest.

The actual Host check_wheel and catalog policy inspection passed on Windows, CPython 3.12.10, Host 47954d8b5b40bcaa4aeb465aa9bb5cde0a8e3bc2 (0.17.1a0). Effective dependencies are empty. The wheel is pure py3-none-any; it supplies declarations, Skill/reference text and a version/manifest marker, with no native binaries or startup hooks. Compared with final 0.0.7, only manifest version, description and homepage changed; configuration, permissions, runtime kind and contributions did not. English/Chinese descriptions are 488/238 characters.

Reviewed wheel inventory

amadeus_agent_gui/__init__.py
amadeus_agent_gui/amadeus-extension.json
amadeus_agent_gui/skills/gui-execution/SKILL.md
amadeus_agent_gui/skills/gui-execution/references/runtime.md
amadeus_agent_gui_runtime-0.0.8.dist-info/licenses/LICENSE
amadeus_agent_gui_runtime-0.0.8.dist-info/METADATA
amadeus_agent_gui_runtime-0.0.8.dist-info/WHEEL
amadeus_agent_gui_runtime-0.0.8.dist-info/entry_points.txt
amadeus_agent_gui_runtime-0.0.8.dist-info/top_level.txt
amadeus_agent_gui_runtime-0.0.8.dist-info/RECORD

Source/publishing control was additionally rechecked when publishing this record: the source repository is owned by Desolate-Jix; the versioned release and wheel uploader are also Desolate-Jix. The retained wheel digest still matches the release metadata. The wheel contains the ISC license with the publisher's 2026 copyright notice, consistent with the source repository declaration. No separately licensed artwork, audio or font assets are bundled in this inventory.

Installation disclosure identifies a connector: the user separately deploys, configures and stops Runtime; the connection requires trusted URL/token configuration and Pi binding. Disabling/removing this connector does not stop or uninstall Runtime. The protocol minimum is not a promise of arbitrary patch compatibility. Disconnected recovery tools remain operator-only, distinct from original-session image review and explicit continuation. Releases report immutable=false; recorded hashes identify tested bytes rather than GitHub-enforced release immutability. The external installer is unsigned.

Independent Runtime repair checks

The initial-owner release repair preserves the cold state not_started / cleanup_verified=false. A monotonic startup-attempt marker and absence of execution resources are required for the new never-started proof. HTTP DELETE additionally checks phase, host liveness and pending requests; active/unknown/failed startup and unverified cleanup remain blocked. No evidence deletion, input replay or recovery-authority transfer is introduced.

Nine bounded upstream lifecycle/recovery/settlement modules passed independently: 272 passed, zero failed, zero skipped. This count includes the external Host SDK cases; subcases are not added again. The reused Runtime environment used Python 3.11.16; all 1,372 tracked Runtime files remained byte-identical. These tests did not run a desktop execution host, model or installer.

A separate real-loopback TCP reproduction used actual InstantSession and the current Host MCP SDK. Both direct release and stop-then-release listed nine tools, retained cold cleanup_verified=false, returned native DELETE 200, and allowed a second initialization. The original 409 finding is therefore independently resolved. The daemon's installation lease remained held until normal service shutdown. No execution session/data root or model input was created by this test.

One test-fixture limitation is retained: seven synthetic epoch-test registrations were left beside the reused installation. Only the independently verified test-owned entries were backed up and removed under the maintenance lock. This was fixture cleanup, not product settlement evidence, and is excluded from the pass claim. Real user registrations were not removed.

The author's separate installer/HTTP reports remain author evidence with their own environment and overlapping counts; they are not added to the independent 272. The installer was not executed in the October 29 maintainer review. Author raw logs were not publicly downloadable merely because their hashes appeared in the report.

Subsequent GUI evidence and remaining gates

The later 0.0.8 + 0.1.11 live results stay in the Host repository; do not duplicate them into Extensions. See the fixed Host-side live record, carried by Host #291. Raw live evidence has now been preserved and individually hash-verified in a private archive outside the disposable worktree.

The live Host ran on ffb1037b plus then-uncommitted diagnostic changes, subsequently committed as 8a09ae30; no contemporaneous diff digest was recorded. Captured wording matches the committed changes, and final cd4ab09c CI covers the committed implementation. The newer Pi settings-direction wording was observed live for the missing-service case; the final wrong-token wording has regression-test coverage. The real plugin test button covered both cases.

No new connector version is requested. Remaining maintainer work is the Host's protected non-author approval/merge, final catalog/packages/ review facts for this exact 0.0.8 artifact, eligible non-author approval on the final submission head, and a separate index-publication PR with delivery verification. Candidate-only publication:false is not package admission or approval.

Thank you, @Desolate-Jix, for the revisions, explicit boundaries and retained failure evidence, and thanks to the external reviewer for identifying the missing public record and evidence-retention gap.

简体中文

这条评论公开此前仅在本地的 2026-10-29 独立审查脱敏记录，发布日期为 2026-11-05。负责维护者为 @Lucas1479，由 Codex 辅助独立检查和执行；规则为 curated-v1。精确版本、摘要、Host/Runtime 环境和完整 wheel 清单见上文，不冒充本次重新测试或 GitHub 正式批准。

0.0.8 的字节、RECORD、源码对应关系、Host checker 和目录政策检查通过；0.1.11 的冷 owner 释放修复由独立 272 项回归及两轮真实 TCP/Host SDK 验证。七条合成测试登记残留的清理单独保留，不计作 Runtime 成功结算。没有把作者安装器报告计为维护者安装验收。公开时再次核对了来源、Release/资产上传者、wheel 摘要和 ISC 许可证。

11 月 5 日实机结果继续引用 Host 库的固定文档，不在 Extensions 重抄。原始材料已归档到 worktree 之外并逐文件验证。实机基线应表述为 ffb1037b 加未提交改动，随后提交为 8a09ae30；缺服务时的新 Pi 提示有实机覆盖，错误 token 的最终文案为回归覆盖。

不要求作者再发版本。后续由维护者完成 Host 的正式批准/合并、同一投稿 PR 的 0.0.8 收录事实、最终 head 的非作者批准及独立索引发布。感谢作者持续返修与如实保留限制，也感谢外审指出公开证据与归档缺口。

[Lucas1479]

Maintainer catalog input added

The exact 0.0.8 review record is now in catalog/packages/io.github.desolate-jix.gui-runtime/0.0.8.json, commit d5d728abdc6375ec75e08f87317ddfa7943a78d5, on this same PR branch. The wheel remains SHA-256 2f532faf152faf2e1e3ab3140e1097487689be34d638e4ee86539e06886cbcaf; no package bytes or historical candidates were replaced.

The record names the verified publisher and independent catalog reviewer and links this review PR as its evidence entry point (the current catalog URL validator does not allow fragments). The detailed sources are the public October 29 static/byte review and the merged Host live-verification record. Host #291 is merged; its explicitly authorized administrator exception is separately recorded there.

All five checks on the new input head succeeded. The protected-base admission run checked out d5d728a, fetched/inspected the actual wheel with the fixed Host checker, and uploaded 2f532faf152faf2e1e3ab3140e1097487689be34d638e4ee86539e06886cbcaf.json. Its ten inventory hashes match the retained reviewed wheel.

The final log still correctly says {"ok": true, "publication": false} because this is an input PR with an unchanged index. It is no longer an empty package scan. The machine evidence deliberately says requires_human_review; CI does not create human approval.

Next maintainer steps: eligible non-author approval on this final PR head, merge the reviewed input, then a separate index-publication PR and official delivery verification. The store index has not been published by this update. Thank you again, @Desolate-Jix, for the contribution and revisions.

简体中文

已在同一个 PR 分支提交 d5d728a，只增加精确 0.0.8 的正式收录事实。发布者、独立审核者、规则、日期、摘要和证据入口均已填写；旧候选和包字节保留。当前 v1 URL 校验不允许 fragment，因此 review.evidence 指向本 PR，具体静态审查评论和已合入 Host 的实机 permalink 在上文列明。

5 项 CI 全部成功。保护基线的 admission 实际检出了新 head、检查了 wheel，并上传该 wheel 摘要命名的证据文件；10 个包内文件摘要逐项与已审字节一致。日志中的 publication:false 现在只是“输入 PR 尚未发布索引”，不是此前的空包扫描；自动证据仍明确要求人工审核。

后续仍需最终 head 的非作者批准、合并输入和独立索引发布/分发校验。此更新没有上架索引。感谢作者的贡献与持续返修。

[Lucas1479]

Approved for catalog input admission at d5d728a.

This approval covers only io.github.desolate-jix.gui-runtime 0.0.8, wheel SHA-256 2f532faf152faf2e1e3ab3140e1097487689be34d638e4ee86539e06886cbcaf (27,990 bytes), under curated-v1, with the qualified external Runtime 0.1.11 combination. The earlier candidate directories remain historical evidence; they are not approved catalog entries.

The independent artifact/ownership/license review, merged Host live acceptance and its explicit limits, and final input/admission receipt establish the reviewed scope. All five checks pass on this exact head; actual wheel inspection produced ten inventory hashes matching the retained reviewed artifact. No package bytes, URL/control or qualification changed after these checks.

Reviewer @Lucas1479 is distinct from package author/publisher maintainer @Desolate-Jix. The maintainer-added JSON records the completed review; it does not change the package. The remaining TLS diagnostic follow-up is tracked in Host #292 and does not affect this loopback-HTTP connector's qualification. No new connector version is requested.

Merge this reviewed input, then publish a separate generated-index PR and verify its candidate and official delivery endpoints. This approval does not claim that the store is already live. Thank you for the contribution and the successive fixes.

简体中文

正式批准精确 head d5d728a 的目录输入，仅覆盖 0.0.8、上列固定 wheel 摘要及已验收的 Runtime 0.1.11 组合。旧版本候选只保留为历史证据，不批准收录。独立字节、权属、ISC 许可审查和 Host 实机记录均已公开；最终 5 项 CI 通过，真实 wheel 的 10 个文件摘要与已审产物一致。

审核账号 @Lucas1479 不是包作者或发布者维护者；维护者补入的 JSON 只记录已完成的审核事实。Host TLS 诊断后续项不影响该本地 HTTP 连接器，不要求作者再发版本。后续合并输入、另开索引发布 PR，再验证候选与官方分发端点。此批准本身不代表已经上架。感谢作者贡献与持续返修。

[Lucas1479]

The exact 0.0.8 input has now received formal non-author approval and was merged normally as 0afb576b2366a455be64e53322abf26259edfede, without an administrator bypass.

Separate publication draft #12 is prepared for sequence 1. All five checks passed, including actual protected-base reconstruction with publication:true; fresh-cache candidate delivery also verified the exact index and newly downloaded wheel. Only 0.0.8 is included; no additional author revision is requested.

The maintainer has asked to keep publication on hold while the existing first-release controls are completed. The official main index is still sequence 0; #11 is approved and merged, awaiting publication, not yet published. After #12 is merged and the official endpoint passes its own fresh verification, the final delivery receipt will be linked here. Thank you again for the contribution and fixes.

简体中文

精确 0.0.8 输入已获正式非作者批准，并正常合并为 0afb576，未使用 bypass。独立发布草稿 #12 已准备完整：5 项 CI 全通过，保护基线实际重建返回 publication:true；空缓存候选索引与 wheel 下载校验均通过，只发布 0.0.8，不要求作者继续返修。

按维护者最新要求，首发控制完成前暂缓发布；官方索引仍为 sequence 0。当前状态是“已批准、已合并、待发布”，尚未上架。发布 PR 合并并通过官方地址校验后，会在这里补最终回执。感谢贡献与持续返修。

[Lucas1479]

Published and official delivery verified

Windows GUI Runtime Connector 0.0.8 is now published in the official catalog at sequence 1. Publication #12 merged as 3435a98081b329992c6ecbfe5f56f699c5450658 on 2026-11-05 (Pacific/Auckland). This closes the publication handoff for the reviewed input #11; earlier candidate versions are not listed.

After merge, the maintained verify_publication.py fetched the client's exact official index URL, compared its actual bytes with the expected generated index, and freshly downloaded the newly distributed wheel using its empty artifact cache.

Verified fact	Result
Index sequence	1
Index SHA-256	3fd41db8e4ed6a8cc84559807934ffb2b701409e7922ea2571b1dc71f3fc28b2
Package	io.github.desolate-jix.gui-runtime / 0.0.8
Wheel size	27,990 bytes
Wheel SHA-256	2f532faf152faf2e1e3ab3140e1097487689be34d638e4ee86539e06886cbcaf
Fresh artifact downloads checked / skipped	1 / 0
Verification	ok: true

All final-head checks passed, including the additional ready-for-review admission run, which returned publication:true. The first merge attempt was blocked while that new required check was still running; it was merged only after the check passed. The final verification is a point-in-time official delivery check, not a new GUI run or an uptime guarantee.

The genuine non-author artifact approval remains on #11. The maintainer-authored publication used the explicitly authorized, named PR-review exception documented in the merge decision. Main review/force-push/deletion protections are configured, and the strict GitHub Actions admission ruleset remains unchanged with no bypass actors. No synthetic APPROVED event was created. Maintainer 2FA is advisory under the requested policy update; the matching Host #293 is merged.

The listing continues to identify a connector requiring the independently installed/configured Runtime 0.1.11 and Pi binding. Installing the connector does not install or start Runtime. Thank you, @Desolate-Jix, for the contribution and successive fixes, and thanks to the external reviewer for the review and evidence corrections.

简体中文

0.0.8 已正式上架，官方索引 sequence 为 1。 发布 PR #12 已合并为 3435a98；合并后再次从客户端的官方地址下载索引，并用空缓存重新下载唯一 wheel，实际字节、摘要和 27,990 字节大小全部匹配，检查 1 项、跳过 0 项。上表列出完整摘要，旧候选版本未上架。

最终所有检查通过，转正式审阅后新增的 admission 也明确返回 publication:true。该检查尚在运行时 GitHub 阻止过合并，待其通过才完成合并，没有绕过 CI。#11 的真实非作者产物批准保留；本次维护者自建发布 PR 使用明确授权并已留档的具名审核例外，不伪造 APPROVED。

2FA 已按维护者要求改为建议，Host #293 也已合并；主线审核和禁止强推／删除已配置。条目继续披露连接器的独立 Runtime 0.1.11 配置与运行责任。感谢作者的贡献和多轮返修，也感谢外审补充证据与纠正记录。