[zerob13]

DeepChat's Harness, configuration and shared persistence are moving from Electron Main to one Rutis Core owner. Native windows and system capabilities stay in Main behind typed, acknowledged ports.

Current state:

• Draft targeting dev; do not merge. Published head: 356143755ac869b20ac666a775f9154dbe68f908.
• G0–G4 are complete and published. Invocation admission and lazy native Memory vector resources already use the Rust/Rutis host.
• G5 is active locally. Local head 466791536 has 42 unpublished commits, with 88 uncommitted source/doc/test/catalog files. The default local app now opens its shared profile/writer, assembles the cohesive Kernel and dispatches business routes in the actual TS Core SDK worker.
• G5 remains unpublished until complete ownership/lifecycle, Native fault, resource/responsiveness and platform/signed acceptance passes. There is no retained implementation switch or Main writer fallback.
• The implementation plan is the sole tracker; the RFC defines ownership, Rust selection and Everywhere boundaries.

Held G5 behavior, not in the published diff:

• Main no longer constructs the profile writer, data/Provider/Harness/Memory/MCP/Sync roots or business dispatcher and maintenance controller. Core keeps Session/Tape/pending-input, Scheduler claims, credentials and shared transactions with their consumers. No generic SQL or transaction-callback RPC crosses the boundary.
• Public Native routes retain Main's sender guard and fixed desktop/device/update/notification handlers. Business calls use the existing 64-entry/64-MiB queue, original caller revalidation and reserved control capacity. Activation holds that queue until business readiness is acknowledged; cold SDK calls remain denied. Widget reads use the same Core readiness.
• Main keeps a generation/revision-fenced configuration projection. Floating bounds use an exact private command. Settings-window lifecycle and system resume reach the Core startup/scheduler owners; resume does not hold the Native event lane while awaiting helper replies.
• Unsent full startup-progress snapshots and delegation projections supersede older queued versions for the same target or parent/delegation identity. Delegation revisions cannot regress. Renderer publication retains no Promise waiter per superseded update; the owner retains actual Native delivery receipts. Other events keep their deliveries. The real eight-delegation workload measured a 69-entry peak, exceeding the preparation budget of 64. Presentation now has its own 256-entry/64-MiB budget; business ingress and Native callback/control limits remain unchanged.
• Internal helpers/Browser/desktop/HTTP owner failures notify Main once through a fixed component-only capability using reserved capacity. Business calls remain fenced while shutdown controls and lifecycle exit receipts still progress. Main retires the app generation; an acknowledged normal host exit creates no false failure.
• An explicit Core shutdown fence pauses secret/security mutations and execution before Main closes windows. Final profile release still waits for accepted Native effects and physical helper/Browser/desktop retirement. Failed receipts prevent reset/restart actions. Full reset creates its filesystem-only launcher cleanup owner after Core retires.
• Production utility factories, Browser dispatch, MCP App policy/consent, remote session selection/activation, Copilot authorization, Workspace preview authorization and desktop presentation use their existing fixed Native ports. Main retains native crypto, shell, dialogs, windows, images and proxy policy.
• Core owns its SDK HTTP dispatcher and committed Native proxy snapshot, including custom-proxy credentials, bypass/direct behavior, equal-policy reuse, graceful pool replacement and terminal connection retirement. Per-destination PAC behavior is unchanged.
• Registered Exec retirement waits for actual Native helper exit and scoped recovery of that helper's registered command roots, using start-time/command-line attestation. Incomplete/corrupt recovery rejects retirement; shutdown, canceled startup and replacement await the receipt. This does not prove escaped-descendant or full process containment.
• Provider catalog requests keep distinct arguments/caller results while sharing startup progress and CPU/IO limits. Renderer catalog invalidation preserves both model selections after a model change.

BEFORE
model change -> stale catalog -> first model only

AFTER
model change -> invalidate catalog -> both models selectable

• Main's existing DialogService owns directory/file, image-save and context-menu pickers. Its bounded FIFO accepts 16 requests and opens one physical picker at a time. Stopping or parent loss denies unsent work. macOS retirement ends the active sheet and awaits the actual Native callback before destroying its parent; other platforms retire parents before awaiting completion. Pending message confirmations reject during shutdown. The unused Core dialog invocation/response capabilities are removed; shutdown confirmation remains strictly validated data. No synthetic cancellation receipt or new timeout is introduced.

Native picker ownership:

BEFORE  [App window]  [OS picker(s)]
AFTER   [App window -> OS picker] <- queued requests

Current local validation:

• 25 targeted checks across five Main/SDK files pass, including the actual standalone Core worker, Native FIFO/capacity, shutdown fences, writer exclusion and physical retirement. 79 catalog checks across four files pass for the normal build's retained Provider refresh. The unchanged Rust host retains its six passing checks, fmt and locked Clippy evidence.
• Retained default-Core acceptance passes 14 application scenarios across five files: configuration reads; all three Provider model/credential/save-error flows; encryption/rekey/reopen; five maintenance/drain cases; and four Exec completion/shutdown/canceled-start/helper-loss cases.
• Immutable f511c078b passes 13 of the same 14 cases. Its helper-loss case leaves the owned command running. The current app passes that case and all 13 shared cases. Both artifact trees are restored and hash-verified.
• Application acceptance also covers generation failure/profile reopen, editable streaming, first-message Workspace/Browser, eight-delegation queue/cancel/release and Memory lazy allocation/model changes/native-worker loss. The frozen baseline retains its known owner-failure and first-message model-picker gaps.
• A separate application launch/exit scenario passes. A temporary OS-handle probe confirms one SDK worker beneath the Rust host holds the profile lock with a PID different from Electron Main. Temporary probes are removed.
• Node/web and affected-test types, normal build with subsequent current harness/app rebuilds, format/check, lint and i18n pass. The existing Remote unsafe-finally warning remains. CLI launcher warnings also occur on the immutable baseline.
• Durable coverage protects latest startup/delegation projections, separate identities, stale revisions, independent business events and the 256-entry boundary. A real SDK failure case holds physical Native closure, verifies notification and continued shutdown control, and proves writer exclusion until retirement. One app lifecycle case refuses a real Native renderer registration and verifies generation exit/profile reopen without replay. Memory process checks track all existing SDK workers plus exactly one new Memory worker. The obsolete controller Native route-map injection option is removed. Three assertions tied to removed Main source order are deleted.
• Evidence and source/artifact hashes are under .deepchat/rutis-g5-kernel-assembly-acceptance/. Ended media and probes are removed; the sole needed baseline and compact evidence occupy about 300 MiB. No dependency, public debug API, functional deadline increase or Main fallback is introduced.

Remaining G5:

• Complete default streaming/delegation/interaction, Memory ingestion, Browser/Native/helper fault and recovery acceptance.
• Prove failed command registration, exec identity transitions, escaped descendants, process-group/fd/environment authority and production proxy behavior.
• Verify sustained input-to-paint responsiveness and settled idle behavior beyond the short representative delegation pair; no speed or aggregate-memory gain is established.
• Finish foreground browser-focus acceptance on an unlocked Mac and supported native/signed packages. The locked-session focus scenario is retained and is not counted as passed.
• Finish old-path review and whole-goal acceptance, then commit/push G5 once to this PR. G6 has not started.

Current Native/interaction acceptance:

• The current app passes four matching cases across Project and file/image flows: real macOS picker retirement, Project persistence, native image/file actions and held image downloads. The unchanged CLI approval/failure-reopen case also passes on this same app artifact.
• The existing Main image service owns one shutdown signal. Main stops reads before awaiting Native settings writes, freeing all three ordinary Core slots when image downloads are held. Real HTTP headers/body and cache reads abort; post-await checks deny late picker/clipboard/new file writes. A target write already started completes before its existing Native receipt retires. No process, request map, RPC or serialized AbortSignal is added.
• The held-download case fills all three ordinary slots on quit, verifies actual TCP closure, and repeats with Core-owner failure during two downloads. Each mode reopens the same profile with a fresh usable image owner.
• The same frozen baseline passes 2/4: ordinary Project and image/file actions. Picker and held-download quit require forced exit under the existing ten-second deadline. The baseline download case fails on quit before reaching its later Core-failure subcase. Both output trees are restored and hash-verified.
• The baseline CLI failure is retained from the identical test source and identical frozen artifact: unanswered approval plus refused Native registration leaves the app alive. No unchanged baseline retry is selected.
• 25 Main/SDK checks across five files and all 46 Project checks pass. A small image regression case covers download cancellation and late data from a Native stub that ignores abort. Existing byte-preservation coverage holds an accepted target write through shutdown. The Project E2E checks prepared path/version/persistence, with lazy getter behavior retained in its unit suite; live bootstrap may prepare the directory before the explicit request.
• One fixed-device delegation resource pair retains seven process-tree samples per build. Current/baseline footprint medians are 1108.1/993.4 MiB, peaks 1146.5/1038.8 MiB, and Main's last footprint 138.5/330.2 MiB. Final process counts are 9/8, with the additional Core SDK worker.
• Observed CPU is 6.42/5.86 seconds, readiness 1933/2049 ms, and Main loop p95/p99 12.8/23.1 vs 33.8/57.4 ms. This short pair establishes neither variance nor sustained responsiveness, settled idle memory or a performance gain. Native image lifetime does not change that delegation process layout/workload; no unchanged resource matrix, timing-gate change or confirmation batch is selected.
• Full remaining Native/concurrent interaction and containment/fault coverage, unlocked foreground focus and supported native/signed platform behavior remain required. G5 stays active and unpublished; G6 has not started.

G5 execution ownership (locally validated, unpublished):

• New macOS commands enter the existing Rust artifact's gate before Tokio/Rutis startup. The owned helper persists native identity before sending one bounded environment grant over the fourth descriptor. Request overrides are withheld from the gate; stdin and output remain independent. EOF or invalid grants run no user command. Control closes before same-PID exec, without a resident supervisor.
• Native identity is bound to the actual live child and revalidated after asynchronous inspection. Boot UUID and the full process unique ID survive exec. PID-only callers, legacy records and other platforms retain conservative attestation; argv changes alone never clear uncertain ownership.
• Default native-record recovery now delegates to the same Rust artifact. A bounded group snapshot revalidates the root and binds each member's group to its birth identity. TERM and force use the system audit-token interface's kernel PID/version validation, with no numeric-PID/group signal fallback. Retirement waits for every captured birth and group to disappear. Unsupported APIs, uncertain observations, concurrent exec and new/surviving members retain failed evidence.
• Explicit utility-owned POSIX stop still retains its acquired group after root close and joins one physical group/stdio receipt before registry or Skill-package cleanup. Startup failure compensates through that receipt. Natural root loss before admission, escaped descendants and this explicit signaling path remain separate G5 work.
• 334 execution/registry, MCP, ACP, Sync, Skill, shell and plugin checks across sixteen files, eight Rust checks, 88 catalog checks across five files and ten actual Exec/MCP scenarios pass. Real Rust coverage refuses another birth without killing it, then forces an owned TERM-resistant root/child group. The new public Agent case loses the helper while its child ignores TERM, observes both gone and reopens the profile. The frozen baseline fails with its root still alive, before later child/reopen assertions; that failure is not attributed solely to the audit-token interface. The final-source selected case also passes after adding its non-macOS guard, with the macOS workload and application artifacts unchanged.
• The gate's real EOF/oversize/environment/stdin/PID coverage and the held-initial-observer helper-loss/reopen acceptance remain. Normal full build, final Rust/Core rebuild, Node/web source types, scoped process/registry/E2E types, format/docs, lint, i18n and locked Rust Clippy/fmt pass. The manager fixture retains its 22 existing unrelated type diagnostics. The normal generated Provider refresh is kept and checked.
• The declared completion/reopen resource receipt has initial current/baseline last total footprints 1150.2/1038.7 MiB, Main 129.7/306.6 MiB, processes 10/9, observed sampled CPU 6.627/5.748 s, readiness 1952/2026 ms, Main loop p95/p99 12.45/30.98 vs 27.80/112.72 ms. All six initial samples and five/four reopen samples are retained. Aggregate last/peak memory is higher. The receipt binds its own artifact snapshot, includes Core migration, may miss short-lived peaks and does not establish current recovery-path performance or a gain. No new measurements or confirmation batch are selected.
• XNU native/API availability still requires supported signed-platform acceptance. Unobserved pre-registration gate retirement, natural root loss, escaped descendants, explicit-path atomic signaling, complete fd/environment/proxy authority, foreground focus and platform behavior remain required. G5 remains active and unpublished; G6-G12 have not started.

Publication and remaining goal scope:

• Published-head PR Check and Package Check pass all 14 checks and six platform packages. These cover published 356143755, not held G5 work. No new code or CI run is published here.
• Correctness, persistence, security, ownership, bounded resources and lifecycle block progress. Shared-CI wall-clock performance is report-only; do not repeat unchanged benchmark matrices or retry CI for a green timing sample.
• Each complete validated goal is committed/pushed to this Draft, then must pass exact-head required CI before the next goal. Never merge.
• G6 completes Memory orchestration/ingestion/recall/quality/maintenance. G7 establishes coherent Rust run/control ownership. G8 selects measured Rust batches or records no-go; G9 selects useful independent peripherals; G10 remains conditional on encrypted Store compatibility/migration/recovery.
• G11 requires actual headless CLI Session Host execution without Electron installation/runtime or a connected desktop. G12 adds reconnect-safe clients and separately authorized, revocable device operations. Data sync pairing grants no execution authority.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}