137 lines
8.8 KiB
Markdown
137 lines
8.8 KiB
Markdown
# Native watch launcher — reviewable Windows candidate
|
|
|
|
This is an owned startup hook for the original Codex engine, not another model
|
|
engine. Do not activate it until root has built a new packaged release and
|
|
reviewed the evidence. No environment variable is set by build/provision tools.
|
|
|
|
## Build and provision
|
|
|
|
Normal Windows `beforePack` invokes `scripts/build-native-watch-launcher.mjs`.
|
|
The resulting `native-watch.exe` is included in the existing codex-bridge
|
|
extraResources directory along with Python modules. Windows hosts use the .NET Framework C# compiler. The existing Linux/Wine
|
|
Windows-package job installs mono-mcs and libmono-system-web-extensions4.0-cil
|
|
6.8.0.105+dfsg-3.2 from its Ubuntu 22.04 apt repository and compiles with mcs.
|
|
Both hosts rebuild the same C# source; missing compilers or invalid source fail
|
|
packaging and remove stale output. The generated EXE is ignored by git.
|
|
This is a Windows artifact cross-build, not a Linux runtime launcher. The executable is a managed console bootstrap; use
|
|
an absolute managed **python.exe**, not pythonw.exe. It checks pinned hashes of
|
|
original binary, interpreter and launcher script. Original is checked again in
|
|
Python immediately before use. Parent directory ACLs and the selected official
|
|
binary hash are provisioning authority; this does not claim Authenticode trust.
|
|
|
|
After installing the new package, root provisions an owner-local candidate:
|
|
|
|
```powershell
|
|
py -3 prepare_native_watch.py --source <packaged-codex-bridge> --destination <owned-candidate-directory> --original <official-absolute-codex.exe> --expected-sha256 <independently-verified-official-sha256> --python <managed-python.exe> --bridge-home <bridge-data-directory> --hermes-home <existing-agent-home>
|
|
```
|
|
|
|
`prepare_native_watch.py` copies only the relevant resources and writes the
|
|
adjacent native-watch.json (paths/hashes only, no keys). It never reads
|
|
CODEX_CLI_PATH to locate the original and rejects its own executable as original.
|
|
Root alone may later point Desktop's CODEX_CLI_PATH at this EXE. No Python argv
|
|
are placed inside CODEX_CLI_PATH. No installed app.asar/binary modification.
|
|
Rollback is root removing its override to restore original app startup.
|
|
|
|
Installed app read-only inspection (OpenAI.Codex_26.1007.2314.0):
|
|
`.vite/build/application-network-startup-CfAQmSYg.js` tc()/Ks() constructs
|
|
`-c` pairs before/after `app-server`, `--analytics-default-enabled`. Recognizer
|
|
accepts that grammar plus explicit stdio forms, rejects daemon/websocket/unknown
|
|
commands and passes those unchanged to the original. Approvals flow untouched.
|
|
One original engine only; no extra version process at startup. Original cwd and
|
|
args preserved except one per-child `-c openai_base_url` selecting the in-process
|
|
bridge's ephemeral loopback `/backend-api/codex`. Normal original models and
|
|
public member catalog reuse kopru.H. Native environment is restored after bridge
|
|
import. Bridge logging uses stderr so stdout remains native JSONL only.
|
|
|
|
## Receipt, delivery and lifecycle
|
|
|
|
Before routing/rewrite, all three actual request values must agree:
|
|
session-id, thread-id and prompt_cache_key. The active mux connection ID and
|
|
realtime generation are captured then. Neither current tab nor notice data can
|
|
create that mapping. thread/unsubscribe, realtime stop/start/closed/error and EOF
|
|
invalidate an epoch. UI-only switches not observable in native protocol cannot
|
|
be detected here; root must verify Desktop emits stop/unsubscribe for its switch.
|
|
Concurrent active native threads have independent request mappings.
|
|
|
|
SSE `event: bekci.watch` and nonstream `_bekci_watch` are removed before native
|
|
model text, history observers, response rewriting and response preview logging.
|
|
Only `/v1/bekci/events` and the fixed `https://ai.turkservis.online` origin are
|
|
accepted. The same primary route public member key authenticates POST; redirects
|
|
are not followed. No backend keys, raw server tenant/session/history identifiers,
|
|
or reconstructed history exist in this client.
|
|
|
|
Only authenticated SSE `ready` binds the receipt. Binding's legacy tenant_id,
|
|
bekci_session_id, history_revision fields contain **local opaque scopes**, not
|
|
literal server claims: member-key fingerprint, key+public-subscription digest,
|
|
public-receipt revision digest. Server remains authoritative for hidden history.
|
|
TLS plus same-key proxy ready is the receipt validity attestation. SQLite also
|
|
locks receipt scope to its original connection/thread/generation across restarts.
|
|
|
|
SQLite WAL/FULL ledger commits `uncertain` before enqueue. Replays or a crash
|
|
between commit and append are suppressed, including possible lost delivery.
|
|
Cursor is persisted after durable admission/disposition; it is a local replay
|
|
ack, not a server consumption API or exactly-once guarantee. Native RPC acceptance
|
|
does not prove audio output. Replay IDs never cause automatic uncertain resend.
|
|
Keepalives, bounded reconnect attempts, receipt expiry, lifecycle abort and
|
|
simultaneous threads are handled. Receipt expiry invalidates its local binding.
|
|
No raw notice text or credentials are persisted in the ledger.
|
|
|
|
## Evidence and exact remaining operations
|
|
|
|
- `.claude/sesli-client-all-tests.log`: 20 files, 203 passed, 0 failed.
|
|
- `.claude/sesli-client-tests-red.log`: compiled Windows bootstrap lost stdout/
|
|
stderr before fix; interactive flush subsequently exposed by real native probe
|
|
and covered by `test_executable_flushes_interactive_stdin_before_eof`.
|
|
- `.claude/native-launcher-proof.json`: compiled candidate, pinned official native
|
|
initialize accepted, stdout JSON, EOF exit 0. No native voice call performed.
|
|
- `.claude/native-launcher-candidate/native-watch.exe`: concrete provisioned
|
|
candidate under worktree, not activated or installed.
|
|
|
|
Source now stamps desktop beta.30 and bridge 10. Root still must run
|
|
normal full package CI/build/signing policy, inspect packaged resources, provision the
|
|
new packaged candidate with trusted official SHA/managed runtime, activate only
|
|
authorized Desktop startup, verify thread-switch notifications and exercise a
|
|
real Sesli-Hizli-Zeki call through deployed server to audible appendSpeech. The bootstrap assigns itself to a non-inheritable KILL_ON_JOB_CLOSE Windows
|
|
Job Object before Python starts. Its descendants inherit membership; abrupt
|
|
bootstrap termination closes the handle and kills only that owned tree. Owned
|
|
fake and pinned original initialize/kill tests passed for both Windows-built and
|
|
Linux-built EXEs running on Windows. Actual Desktop UI termination remains a
|
|
manual acceptance step. Atomic generation enforcement inside native appendSpeech
|
|
is still unavailable (the native RPC has no expected-generation field).
|
|
No commit, push, deployment, installed runtime change or AITURK delegation.
|
|
|
|
## 2026-10-12 source verification update
|
|
|
|
- `.claude/native-watch-linux-build.log`: exact CI image digest
|
|
`sha256:b226b27b1a7e95ad25eb3d6414ea90c56c04eb6d8329967f4d721dce50b989ff`,
|
|
real apt dependencies, two compiler regressions passed, Windows PE produced.
|
|
- `.claude/native-watch-windows-build.log`: same two tests passed with Framework csc.
|
|
- `.claude/native-watch-linux-artifact-windows-tests.log`: 25 tests passed with
|
|
the cross-built artifact, including pinned original initialize and abrupt kill.
|
|
- `.claude/sesli-client-release-all-tests.log`: 220 passed, 21 files, zero failures.
|
|
- `.claude/electron-beta30-tests.log`: 47 passed including Python/Electron version alignment.
|
|
|
|
Receipt validation accepts up to 24 hours plus 60 seconds clock skew. Actual
|
|
expiry remains authoritative; expired, boolean, nonnumeric, NaN, infinite and
|
|
over-bound receipts are rejected. Long research has no local 15-minute limit.
|
|
|
|
Provision the exact rebuilt candidate with the explicit original SHA-256
|
|
`d13914ced6c7af174d8d638db938284231227312104b06a25e9608c632a7daec` only
|
|
when that is the selected independently verified official original. SHA-1 is
|
|
not the executable integrity pin; a Git source identity and an executable
|
|
SHA-256 have different roles. Fixed-origin TLS plus the same public member key
|
|
and authenticated ready event attest the receipt; none claims Authenticode.
|
|
No full installer build, signing, activation, or audible acceptance is claimed.
|
|
|
|
CI verify explicitly runs test_bekci_watch.py and test_native_speech_mux.py using
|
|
ci-venv pytest in addition to the unchanged unittest suite. Both focused files
|
|
pass on Linux without skips. Tests that execute native-watch.exe reside in the
|
|
explicitly Windows-only test_native_watch_cleanup.py; their owned-process proof
|
|
is Windows evidence, not Linux CI runtime coverage.
|
|
|
|
Sideband JSON extraction and SSE filtering apply only to the resolved exact
|
|
Sesli-Hizli-Zeki target, including when no watch owner is active. Other models
|
|
retain their original Jev/response pipeline without the sideband frame buffer.
|
|
After the final scope correction, rebuild/provision from final source; the older
|
|
local candidate hash proof does not include this last kopru.py change.
|