[Desolate-Jix]

Catalog submission: Windows GUI Runtime 0.0.4

• Versioned wheel URL and attached preflight.json: 0.0.4 wheel, SHA-256 9acc7f5d1d667d1d44e3750cdf0f351abefeb5e5136b7fad91d50d77a6d29b31 (13,822 bytes). attached preflight.json (release copy) is unchanged: fixed Windows/Python 3.12.10/Host 1840c8e format, Host and curated-policy checks passed; review_status=not_reviewed and human/runtime review pending.
• Source/build and usage/test evidence: Exact source ZIP (SHA-256 4b6ef25b280cdfd4b8e3567ef8321e9a9137019cfd9738add3453dfb2c9ddd8d, 16,069 bytes), usage, inventory and bounded installed acceptance. Runtime 0.1.6 is installed separately. Bare MCP five-step and native installed Pi four-step read-only workflows completed after one explicit TEST double refusal, actual original Main before-frame review and separate same-job continuation. Retained failures, Pi full-frame resizing, cleanup and evidence limits are recorded; this is not an autonomous accuracy/speed benchmark.
• First submission: ownership and code/asset rights links: Proposed namespace io.github.desolate-jix.gui-runtime; source repository, release history, extension ISC license. These are control/rights evidence for independent verification, not author-issued approval. No Runtime binary, artwork, model weights or credentials are bundled in the wheel; external Runtime/dependency licenses are separate.
• Update: changes and any access/configuration/data migration: First catalog submission. Compared with the earlier 0.0.2 launcher, 0.0.4 contains only native HTTP MCP plus Skill resources, with no external executable selector or dependencies. Configure a trusted loopback runtime_url and secret connection_token; provider keys/profiles/input authorization stay in Runtime. Bind MCP and Skill to Pi, enable, restart backend and open a new Work. Pre-action review uses the bound before frame, field review uses after; exact review and separate continue recipes retain the original job and hard gates. Extension removal does not stop Runtime.

Independent catalog review/approval and maintainer publication remain outstanding. This PR supplies evidence only; it does not add catalog entries or an invented reviewer. Please revise this same submission PR.

CI follow-up (2026-10-23)

The two offline-contracts jobs (Windows/Linux), catalog-contracts and compare-wheels passed. These are repository CI checks, not independent catalog approval.

Catalog admission job failed before proposal/package inspection, during the proposal checkout: actions/checkout@v7 refuses fork PR code in a pull_request_target workflow with allow-unsafe-pr-checkout: false. No author package check ran in that job. The fixed local author preflight and its actual artifact hashes remain attached.

This requires a maintainer-side decision on safe fork-data intake in the trusted workflow. This submission does not change the workflow or opt out of that protection. Independent review and catalog publication remain pending.

[Lucas1479]

Approved for merging the four candidate-evidence files in this PR. No blocking issue was found within that scope. The materials explicitly retain not_reviewed catalog status; this review does not create a reviewed catalog package record or authorize publication.

Independent checks performed on 2026-10-23:

• Downloaded the actual 0.0.4 wheel and exact source ZIP. SHA-256 values match the submission (9acc7f5d1d667d1d44e3750cdf0f351abefeb5e5136b7fad91d50d77a6d29b31 and 4b6ef25b280cdfd4b8e3567ef8321e9a9137019cfd9738add3453dfb2c9ddd8d). All ten wheel inventory entries match; all four package files match the source archive. Reviewed the complete packaged manifest, Skill, reference, metadata and license. No bundled executable launcher, native binary, startup hook, credentials or effective dependency was found.
• Reproduced static Host/resource and curated-policy acceptance using exported unmodified Host 1840c8e4f646992ddaebea3139c8895f29743a8f checker files, Windows CPython 3.12.10 and matching authoring dependency versions. This was an exported-checker test, not verify_host on a complete clean checkout.
• Exercised the actual wheel through the Host installer/settings/helper in a disposable profile: disabled installation; required Agent binding and connection secret; Pi enable/configuration; public secret redaction; disable; removal retaining data; disabled reinstall; explicit data deletion. Native confirmation and encryption callbacks were synthetic; no production profile or external Runtime was used. Native MCP projection preserves the Pi binding, namespaced bearer secret and main_chat_access=false.
• Verified instant-v0.1.6 resolves to Runtime source d49e946ba00fac474996b9edc0d4805b64b60fa3. Inspected the HTTP authorization/ownership/cleanup boundary and ran 26 selected upstream ASGI tests with harmless sessions, synthetic tokens, cleared credential environment and the Runtime's hash-pinned HTTP dependencies: 26 passed. These cover bad/missing/duplicate authentication, Host/Origin and peer restrictions, negotiation/ownership, failed initialize, verified DELETE and shutdown ordering. They do not execute desktop input or model calls.
• Checked source/release ownership and ISC license evidence, and the separate candidate05/final-installer identities. The release packaging report explicitly maps those identities; it does not claim a fresh desktop/model run on the final installer.

Remaining qualification is accurately disclosed: the supplied live GUI results are author evidence with controlled refusals and limited workflows. I did not independently replay real desktop/model tasks or qualify native install dialogs, OS installation or general typing/saving reliability. Those limits remain relevant to later package approval/publication, and are not represented as completed by merging this evidence-only PR.