The home run-control card and the menu-bar status card render the agent
and system-proxy status rows straight from snapshot replacements, so fast
operations (e.g. proxy mode switches) flash transient states like
"applying" before settling.
Add a presentation-layer debounce shared by both surfaces:
- TransientDelayGate: per-stream gate where stable values display
immediately, transient values (starting/applying/repairing) display
after 400 ms and are dropped when superseded, and displayed transients
are held for at least 400 ms.
- StatusDisplayModel: app-level shared model deriving agent and
system-proxy payloads (row + detail + hint) from workflow snapshots
through two independent gates; domain facts keep their cadence.
- Wire the model through the composition root into RuntimeControlCard
and StatusCardView; toggles, approval actions, the difference view and
target/mode rows keep reading the raw snapshot.
Replace the custom encrypted container with AgeSwift 0.1.0 so standard
age tools can inspect sensitive configuration independently of the app.
Use independent Keychain X25519 identities for catalog.age and
proxy-listening.age. Preserve atomic commits and confirmed recovery;
reject historical NG2 formats without migration or cleanup.
Move InMemoryDiagnosticReportExporter and InMemoryConfigurationGroupFileExporter
from App/PlatformEffects to Tests/Support: both are test doubles with no
production caller, and production composition wires only the AppKit adapters.
Delete RuleRuntimeCompiler.validation, a wrapper whose only callers were two
assertion blocks in the controller deployment test; those restated
custom-to-custom shadowing and validation order-independence, both pinned by
CustomRuleValidatorTests and RuleAnalysisTests. RuleRuntimeCompiler.compile
stays and keeps its production caller.
Co-Authored-By: DeepSeek Harness <noreply@deepseek.com>
Four listening-file failure cases inject InMemoryProxyListeningStore.saveError
and assert saved == nil, which the fixture guarantees because save throws
before assigning; the only production save call is updateListening and none of
these paths reaches it. Their behavioral content is covered by sibling tests,
so keep only the three assertions that were unique there (agent intent
persistence, runtime stopped after the off cascade, no commit in flight) and
move them into those siblings.
Same pattern in testProxyExceptionsIgnoreListeningPersistenceFailure: the
path calls only the non-throwing updateProxyExceptions, so its updateError
injection is inert and the rest duplicates the sibling case. The plugin
diagnostic test fed an unproducible fixture (user-sourced facts never carry a
version, since managedInfo exists only for managed sources); assert the
reachable property, the source label in the report row. FakeSettingsSaveError
and the now-unused saveError seam go with them.
Co-Authored-By: DeepSeek Harness <noreply@deepseek.com>
The root system-proxy helper logged nothing and launchd discards its
stdout/stderr, leaving helper launches, connection refusals, GUI-side
timeouts and root-side failures invisible. Share the minimal unified-log
emission unit (SystemLog) across GUI, wrapper and helper, and add a
dedicated closed helper event enum (lifecycle minimum: listener ready,
connection accepted/rejected with peer pid, typed apply/clear results)
with ADR-0045 privacy splitting. The emission seam is injected at the
helper engine and listener for test doubles. Helper events are
Console-only: no stderr, no agent.log, no diagnostic view or report
surface (ADR-0047).
Wait for settings publications instead of a wall-clock polling budget. Separate DoH result aggregation from the real deadline check, and release gated probes after pass-through is enabled.
Separate Agent supervision from sslocal input and preserve the latest intent after deployment failure. Persist failure barriers, serialize publication and retirement, and verify reload and single-instance behavior with real processes.
Refs #83
Drop workflow port and credential prechecks that duplicated the store
gate. Credential shape is a save constraint only while LAN
authentication is enabled; terminal commands treat password() as a
usable secret without reshaping it.
CatalogEntry gains createdAt/updatedAt and the catalog document moves to
v5 (reads v1-v5, writes v5). Modification time is structure-sensitive:
editing a node's own fields bumps the node, a group's direct child set
or order changes bump the group, and a moved node keeps its timestamps.
No-op writes and unchanged subscription refreshes bump nothing; the
refresh rebuild compares per node, so surviving leaves keep theirs. All
times are passed in by callers as now: Date - one moment per logical
commit, the domain layer stays clock-free. Legacy documents load with
nil (unknown, never backfilled); duplicates and imports stamp fresh
times at the moment of the operation.
Semantics are recorded as glossary term 节点时间戳 and ADR 0031. No UI
in this change.
Qiu Yuzhou
Qiu Yuzhou
