aiturk-hermes-ide/apps/desktop/assets/codex-bridge/NATIVE-WATCH-LAUNCHER.md

Native watch launcher — reviewable Windows candidate

This is an owned startup hook for the original Codex engine, not another model engine. Do not activate it until root has built a new packaged release and reviewed the evidence. No environment variable is set by build/provision tools.

Build and provision

Normal Windows beforePack invokes scripts/build-native-watch-launcher.mjs. The resulting native-watch.exe is included in the existing codex-bridge extraResources directory along with Python modules. Windows hosts use the .NET Framework C# compiler. The existing Linux/Wine Windows-package job installs mono-mcs and libmono-system-web-extensions4.0-cil 6.8.0.105+dfsg-3.2 from its Ubuntu 22.04 apt repository and compiles with mcs. Both hosts rebuild the same C# source; missing compilers or invalid source fail packaging and remove stale output. The generated EXE is ignored by git. This is a Windows artifact cross-build, not a Linux runtime launcher. The executable is a managed console bootstrap; use an absolute managed python.exe, not pythonw.exe. It checks pinned hashes of original binary, interpreter and launcher script. Original is checked again in Python immediately before use. Parent directory ACLs and the selected official binary hash are provisioning authority; this does not claim Authenticode trust.

After installing the new package, root provisions an owner-local candidate:

py -3 prepare_native_watch.py --source <packaged-codex-bridge> --destination <owned-candidate-directory> --original <official-absolute-codex.exe> --expected-sha256 <independently-verified-official-sha256> --python <managed-python.exe> --bridge-home <bridge-data-directory> --hermes-home <existing-agent-home>

prepare_native_watch.py copies only the relevant resources and writes the adjacent native-watch.json (paths/hashes only, no keys). It never reads CODEX_CLI_PATH to locate the original and rejects its own executable as original. Root alone may later point Desktop's CODEX_CLI_PATH at this EXE. No Python argv are placed inside CODEX_CLI_PATH. No installed app.asar/binary modification. Rollback is root removing its override to restore original app startup.

Installed app read-only inspection (OpenAI.Codex_26.1007.2314.0): .vite/build/application-network-startup-CfAQmSYg.js tc()/Ks() constructs -c pairs before/after app-server, --analytics-default-enabled. Recognizer accepts that grammar plus explicit stdio forms, rejects daemon/websocket/unknown commands and passes those unchanged to the original. Approvals flow untouched. One original engine only; no extra version process at startup. Original cwd and args preserved except one per-child -c openai_base_url selecting the in-process bridge's ephemeral loopback /backend-api/codex. Normal original models and public member catalog reuse kopru.H. Native environment is restored after bridge import. Bridge logging uses stderr so stdout remains native JSONL only.

Receipt, delivery and lifecycle

Before routing/rewrite, all three actual request values must agree: session-id, thread-id and prompt_cache_key. The active mux connection ID and realtime generation are captured then. Neither current tab nor notice data can create that mapping. thread/unsubscribe, realtime stop/start/closed/error and EOF invalidate an epoch. UI-only switches not observable in native protocol cannot be detected here; root must verify Desktop emits stop/unsubscribe for its switch. Concurrent active native threads have independent request mappings.

SSE event: bekci.watch and nonstream _bekci_watch are removed before native model text, history observers, response rewriting and response preview logging. Only /v1/bekci/events and the fixed https://ai.turkservis.online origin are accepted. The same primary route public member key authenticates POST; redirects are not followed. No backend keys, raw server tenant/session/history identifiers, or reconstructed history exist in this client.

Only authenticated SSE ready binds the receipt. Binding's legacy tenant_id, bekci_session_id, history_revision fields contain local opaque scopes, not literal server claims: member-key fingerprint, key+public-subscription digest, public-receipt revision digest. Server remains authoritative for hidden history. TLS plus same-key proxy ready is the receipt validity attestation. SQLite also locks receipt scope to its original connection/thread/generation across restarts.

SQLite WAL/FULL ledger commits uncertain before enqueue. Replays or a crash between commit and append are suppressed, including possible lost delivery. Cursor is persisted after durable admission/disposition; it is a local replay ack, not a server consumption API or exactly-once guarantee. Native RPC acceptance does not prove audio output. Replay IDs never cause automatic uncertain resend. Keepalives, bounded reconnect attempts, receipt expiry, lifecycle abort and simultaneous threads are handled. Receipt expiry invalidates its local binding. No raw notice text or credentials are persisted in the ledger.

Evidence and exact remaining operations

• .claude/sesli-client-all-tests.log: 20 files, 203 passed, 0 failed.
• .claude/sesli-client-tests-red.log: compiled Windows bootstrap lost stdout/ stderr before fix; interactive flush subsequently exposed by real native probe and covered by test_executable_flushes_interactive_stdin_before_eof.
• .claude/native-launcher-proof.json: compiled candidate, pinned official native initialize accepted, stdout JSON, EOF exit 0. No native voice call performed.
• .claude/native-launcher-candidate/native-watch.exe: concrete provisioned candidate under worktree, not activated or installed.

Source now stamps desktop beta.30 and bridge 10. Root still must run normal full package CI/build/signing policy, inspect packaged resources, provision the new packaged candidate with trusted official SHA/managed runtime, activate only authorized Desktop startup, verify thread-switch notifications and exercise a real Sesli-Hizli-Zeki call through deployed server to audible appendSpeech. The bootstrap assigns itself to a non-inheritable KILL_ON_JOB_CLOSE Windows Job Object before Python starts. Its descendants inherit membership; abrupt bootstrap termination closes the handle and kills only that owned tree. Owned fake and pinned original initialize/kill tests passed for both Windows-built and Linux-built EXEs running on Windows. Actual Desktop UI termination remains a manual acceptance step. Atomic generation enforcement inside native appendSpeech is still unavailable (the native RPC has no expected-generation field). No commit, push, deployment, installed runtime change or AITURK delegation.

2026-10-12 source verification update

• .claude/native-watch-linux-build.log: exact CI image digest sha256:b226b27b1a7e95ad25eb3d6414ea90c56c04eb6d8329967f4d721dce50b989ff, real apt dependencies, two compiler regressions passed, Windows PE produced.
• .claude/native-watch-windows-build.log: same two tests passed with Framework csc.
• .claude/native-watch-linux-artifact-windows-tests.log: 25 tests passed with the cross-built artifact, including pinned original initialize and abrupt kill.
• .claude/sesli-client-release-all-tests.log: 220 passed, 21 files, zero failures.
• .claude/electron-beta30-tests.log: 47 passed including Python/Electron version alignment.

Receipt validation accepts up to 24 hours plus 60 seconds clock skew. Actual expiry remains authoritative; expired, boolean, nonnumeric, NaN, infinite and over-bound receipts are rejected. Long research has no local 15-minute limit.

Provision the exact rebuilt candidate with the explicit original SHA-256 d13914ced6c7af174d8d638db938284231227312104b06a25e9608c632a7daec only when that is the selected independently verified official original. SHA-1 is not the executable integrity pin; a Git source identity and an executable SHA-256 have different roles. Fixed-origin TLS plus the same public member key and authenticated ready event attest the receipt; none claims Authenticode. No full installer build, signing, activation, or audible acceptance is claimed.

CI verify explicitly runs test_bekci_watch.py and test_native_speech_mux.py using ci-venv pytest in addition to the unchanged unittest suite. Both focused files pass on Linux without skips. Tests that execute native-watch.exe reside in the explicitly Windows-only test_native_watch_cleanup.py; their owned-process proof is Windows evidence, not Linux CI runtime coverage.

Sideband JSON extraction and SSE filtering apply only to the resolved exact Sesli-Hizli-Zeki target, including when no watch owner is active. Other models retain their original Jev/response pipeline without the sideband frame buffer. After the final scope correction, rebuild/provision from final source; the older local candidate hash proof does not include this last kopru.py change.