mc

[deathbyknowledge]

What this PR is

This is the consolidated GSV architecture and product branch. It is intentionally much larger than a normal feature PR: it combines the managed-service work, the one-intelligence interaction model, the native host applications, protocol and media redesigns, dynamic adapters, deployment changes, and the repository-wide boundary/lint cleanup into one coherent release candidate.

The resulting system supports both:

• Standalone GSV: one user-owned installation in the user's Cloudflare account.
• Managed GSV: many installation-scoped GSVs behind a shared control plane, with platform accounts, funded inference, email, Telegram, and operator infrastructure supplied through public service contracts.

Current diff: 933 files, +197,938 / −82,854.

Product model: one intelligence, everywhere

• Introduces one canonical personal intelligence per owner, presented as Ship.
• Gives Ship one Kernel-marked personal Process while keeping its pid replaceable and its lifecycle ordinary.
• Routes private adapter messages to Ship by default.
• Separates Ship from explicit Work Sessions so opening a Process does not silently replace the user's personal intelligence elsewhere.
• Adds visible Work Session identity and reliable Back-to-Ship behavior across Web and Desktop.
• Lets Ship spawn/delegate work while remaining the user's stable point of contact.
• Routes delegated Process results back to their caller with bounded IPC, durable deadlines, cancellation, timeout handling, and late-result fencing.
• Renames the old Home conversation model to Ship and removes obsolete controller/prompt compatibility paths.

Conversations, Process activity, and explicit delivery

• Separates canonical user-visible Conversations/Messages from Process history.
• Process history remains the inspectable record of reasoning, assistant output, tool calls, tool results, retries, approvals, and run-control decisions.
• Canonical Messages survive Process replacement or deletion.
• Clients may observe raw Process activity; adapters consume committed Messages.
• Multiple clients synchronize canonical Messages without inheriting another endpoint's route behavior.
• Process results and human-facing delivery are now independent:
  • delegated IPC returns ordinary assistant output to the caller;
  • message send commits a user-visible Message without ending the run;
  • yield explicitly ends a human-facing run;
  • a final response composes as message send … && yield;
  • bare yield completes silently.
• Each send in a run receives its own durable action identity, giving multiple progress/final messages independent exactly-once delivery.
• Message attachments are consumed by the message that sends them rather than being duplicated into later output.

Installation-scoped managed runtime

• Makes immutable installationId the outer managed security and storage boundary.
• Resolves managed hostnames through the trusted installation directory before allocating Kernel state.
• Scopes Kernel, Process, Conversation, R2, ripgit, adapter accounts, inference, and background work by installation.
• Prevents public callers, adapter payloads, or arbitrary wildcard hostnames from choosing installation identity.
• Adds managed onboarding, directory lookup, installation status, restriction, recovery, and reset flows.
• A reset moves a handle to a fresh installation rather than clearing/reusing the old Kernel identity.
• Preserves the explicit singleton projection and legacy RPC arities needed for supported standalone upgrades.
• Adds lifecycle admission gates across HTTP, WebSocket, adapters, inference, Process ticks, and schedules.
• Hardens account/owner resolution and prevents cross-owner Process listing or personal-Process selection.

Process durability and execution

• Replaces PartyServer/Agents inheritance with a composed raw Durable Object runtime.
• Keeps only the scheduling, hibernating WebSocket, and MCP behavior GSV actually needs behind owned components.
• Strengthens Process cancellation, queueing, approvals, active-tool cleanup, and stale-run fencing.
• Makes killed Process pids permanently terminal across Durable Object eviction.
• Implements an atomic tombstone commit, cached kill result, stable archive snapshot, idempotent cleanup debt, and safe retry after lost responses.
• Prevents late model, media, tool, schedule, and syscall continuations from touching killed/dropped Process state.
• Preserves live state if pre-commit archive or tombstone preparation fails.
• Adds context-pressure accounting and unified provider-overflow recovery.
• Supports configurable automatic history compaction with immutable archived segments and visible summary markers.
• Bounds default file reads so a single large file cannot exhaust model context.
• Improves Process IPC, delegated schedules, worker-media return, timeout termination, and completion projection.
• Keeps new input, abort, reset, and kill available while long work is active.

Canonical resources, media, and streaming

• Introduces immutable resource references as the common file/media identity.
• Stores content once and passes references through Process history and canonical Messages.
• Resolves and hydrates bytes lazily only when model context or an explicit read needs them.
• Retains exact source revisions so two reads of a changing file can refer to different immutable states.
• Externalizes tool-result images instead of embedding large base64 payloads in structured frames.
• Replaces Process-specific media attachment duplication with resource references.
• Streams binary frame bodies across Durable Object and Worker service RPC boundaries using forwardable ReadableStream bodies.
• Gives every body one explicit owner and terminal outcome: consumed, forwarded, or cancelled.
• Cleans up bodies on malformed frames, authorization failures, timeouts, disconnects, and caller cancellation.
• Fixes the service-binding stream recursion that previously surfaced as “Subrequest depth limit exceeded.”

Unified protocol peers and routing

• Models browsers, native clients, machines, and adapters as protocol peers rather than unrelated special cases.
• Separates peer axes:
  • authenticated principal;
  • callable syscalls;
  • receivable signals;
  • implemented/targetable syscalls;
  • transport;
  • provenance and interaction context.
• Authority comes from authenticated identity and attenuated grants, never from transport type or a claimed peer id.
• Allows linked adapter actors to call ordinary syscalls through a Kernel-derived, interaction-scoped human grant.
• Allows clients to implement endpoint behavior while retaining ordinary client observation/control capabilities.
• Adds generated validation for the WebSocket wire protocol and validates hostile input at external RPC/webhook boundaries.
• Preserves typed internal values after those boundaries instead of repeatedly re-validating them.
• Adds exact run-route and destination authorization, late-delivery fencing, private-DM fallback, and explicit Work routing.
• Makes adapter entrypoints and Gateway bindings data driven instead of hardcoding Telegram/WhatsApp/Discord as a closed set.

Adapters

• Defines one public AdapterService contract and a data-driven adapter catalog.
• Generates deployment bindings, manifests, release archives, and runtime lookup from adapter descriptors.
• Makes adding an adapter primarily an implementation + descriptor operation rather than editing Gateway switch statements.
• Keeps platform-specific identity, webhook, delivery, formatting, and media behavior inside each adapter.
• Preserves standalone adapter compatibility while supporting installation-scoped managed deployments.
• Adds strict arity/identity validation and binary-body cleanup for adapter RPC compatibility paths.
• Improves reply authorization so delayed output cannot cross a relink or installation boundary.

Managed Telegram

• Adds a platform-owned shared Telegram bot and peer-scoped routing.
• Implements signed, one-time, human-confirmed pairing into a selected installation.
• Intercepts pairing commands before normal message ingress.
• Adds route-generation fencing, actor ownership, replay handling, disconnect/recovery, and installation lifecycle checks.
• Validates the webhook secret before bounded body parsing.
• Supports inbound and outbound text, images, files, audio, and voice.
• Keeps standalone Telegram as a separate supported deployment mode.
• Adds deployment/webhook reconciliation and live health checks.

Email

• Adds managed inbound and outbound email workers, queues, dead-letter handling, mailbox state, and installation isolation.
• Uses replay-safe summarization and stable message identities.
• Routes inbound mail notification to Ship rather than a separate user-facing Inbox intelligence.
• Sends only a bounded, untrusted summary into a notify-only Process run.
• Prevents forged/unoffered tools from executing during notify-only mail runs.
• Supports outbound mail authorization, sender/destination restrictions, budgets, retries, and delivery status.
• Keeps standalone deployments free of required email resources; managed mail fails closed when unavailable.

Managed services and public contracts

• Defines public Worker RPC contracts under packages/gsv/src/services/ for:
  • installation directory;
  • onboarding;
  • entitlements;
  • funded inference;
  • mail;
  • adapter services.
• Separates deployment-operator implementations from the open GSV runtime.
• Keeps local managed development composable by pointing the public repository at implementations supplied by the infrastructure checkout.
• Avoids making the open runtime brittle: standalone uses local implementations/defaults, while managed operators can implement the stable contracts independently.

Managed inference

• Adds installation-scoped platform-funded inference with reservation, settlement, usage accounting, and budget enforcement.
• Supports OpenRouter/provider routing and streamed generation through Worker bindings.
• Adds operator controls for the enabled model/provider configuration.
• Propagates cancellation and stream ownership correctly across Gateway → inference Worker → provider.
• Keeps provider credentials and platform policy in the managed service rather than in tenant Kernel state.

Web application

• Reworks the chat shell around Ship, Work Sessions, canonical Messages, and raw Process activity.
• Separates canonical conversation synchronization from Process observation.
• Protects the personal Process from Work reset/kill actions and excludes it from Work counts.
• Adds explicit Work banners and Back-to-Ship behavior.
• Prevents admin/root sessions from manufacturing a fake personal intelligence or starting unauthorized work.
• Scopes Process selection, pending work, QueryClient caches, and mounted query observers to the authenticated session/owner.
• Fixes lock/login races and stale cross-user cache publication.
• Adds context-pressure display, history segments, compaction controls, message attachments, media rendering, and streamed Markdown.
• Keeps process reasoning/tool activity inspectable while showing committed Messages as the user conversation.
• Preserves task/settings compatibility routes.

Rust host applications

Reorganizes Rust under one host/ workspace:

• host/apps/desktop — GPUI Desktop application;
• host/apps/cli — the gsv CLI;
• host/apps/machine — the gsvd machine runtime;
• host/helpers/transcriber and host/helpers/gestures;
• shared transport, configuration, Desktop IPC, and gesture contracts under host/crates.

Desktop and machine ownership

• Desktop performs first-run machine naming/enrollment and derives a stable machine id from the chosen name.
• Desktop owns starting, stopping, inspecting, and reconnecting gsvd through cross-platform local IPC.
• Stores host configuration in the shared host config rather than making platform keychains the architecture.
• Adds tray/status controls for Gateway, machine connectivity, voice, and gestures.
• Adds system status, notification/sound behavior, streamed Process activity, canonical Messages, media, HIL, and Process controls.
• Adds macOS development app packaging, bundled helper executables/models, permissions, icon resources, and normal Quit behavior.
• Keeps Linux and Windows as first-class architectural targets.

Native gestures and voice

• Replaces the Java/MediaPipe build/runtime with a native Rust hand-tracking pipeline using tract and pinned TFLite palm/landmark models.
• Embeds the model weights into distributable artifacts.
• Implements resize/normalization, palm anchor decoding, NMS, oriented ROI crop, landmark projection, tracking, two-hand discovery, and ROI updates.
• Adds gesture arming, voice control, dictation correction, held scrolling, fist drag, and a simplified gesture grammar.
• Adds deterministic benchmarks and operator profiling for the native inference path.
• Parallelizes palm/landmark work, reuses stable detections, gates discovery on motion, and vectorizes depthwise inference.
• Fixes macOS camera access/format negotiation and Linux V4L2 capture, JPEG fallback, color-camera selection, IR-camera avoidance, and camera diagnostics.
• Removes the experimental Android/Wear runtime from the final tree.

Deployment and releases

• Adds reusable Alchemy deployment constructs to the public repository.
• Makes standalone deployment available through Alchemy without requiring the private managed infrastructure.
• Removes the old gsv deploy and gsv infra * CLI deployment paths.
• Builds self-describing release manifests with checksums and dynamic adapter artifacts.
• Lets deployment consumers resolve adapter manifests rather than depending on a fixed adapter list.
• Keeps managed infrastructure and service credentials in the operator-owned infrastructure repository.
• Adds managed local composition scripts and resolves service/build paths cleanly.
• Preserves production/staging separation for accounts, storage, inference, email, Telegram, routes, Access, and secrets.

Code quality and documentation

• Adds Oxlint plus the anti-slop rules and establishes a zero-warning/error ratchet.
• Moves validation to hostile wire/service/webhook boundaries and simplifies internal behavioral code around trusted types.
• Adds generated protocol validators and a check that fails when generated wire validation is stale.
• Removes thousands of redundant speculative type checks, compatibility branches, and duplicated adapter/client paths.
• Updates the engineering contract, architecture docs, syscall reference, routing docs, deployment docs, man pages, built-in skills, and protected runtime context for the implemented behavior.
• Adds local source-review tools for assembled prompts and GSV Manual content without shipping those tools as product UI.
• Removes obsolete prompt-profile, legacy context reconciliation, product review-tool, and fixed-deployment paths.

Security and data invariants

• Kernel remains the authorization boundary.
• Installation identity is derived from trusted routing, never user input.
• Managed physical addresses include installation scope.
• Standalone singleton compatibility remains explicit.
• Canonical Messages are independent of Process lifetime.
• Killed pids cannot be resurrected.
• Late/cancelled work cannot mutate a successor run.
• Adapter output is re-authorized immediately before delivery.
• Binary bodies are cancelled whenever ownership cannot be transferred.
• Mail summaries and external content remain untrusted.
• Notify-only runs cannot execute fabricated tool calls.
• Session-owned caches and Process selection fail closed across user changes.

Schema and compatibility notes

• Adds versioned Kernel, Process, Conversation, managed mail, adapter, and service schema changes.
• Preserves shipped migration identities; new migrations are appended rather than rewritten.
• Supports fresh standalone and managed installations.
• Preserves existing standalone Process and adapter Durable Object addressing through the explicit singleton projection.
• Keeps old/new standalone adapter RPC deployment orders compatible during upgrade.
• The branch has been deployed to a reset staging installation and exercised through Web, Desktop, Telegram, email, inference, and machine flows.

Validation performed

Latest release-candidate checks include:

• root Oxlint/anti-slop: zero warnings and errors;
• generated wire-protocol consistency check;
• Gateway TypeScript check;
• Gateway unit suite: 98 files / 1,540 tests passed;
• affected runtime integration suite: 3 files / 22 tests passed;
• Web typecheck, full unit suite, and production build;
• public SDK build/typecheck/tests;
• Rust workspace formatting, tests, clippy, macOS bundle build, and Linux/macOS dogfood;
• Telegram, WhatsApp, Discord, test-adapter, email, Accounts, and Inference checks;
• standalone Wrangler dry-run without managed-only bindings;
• Alchemy staging plan with no create/replace/delete;
• live staging deployment of Gateway, Inference, and Email;
• hank.staging.gsv.space HTTP smoke check;
• managed Telegram webhook reconciliation and health check.

Expected non-failing diagnostics remain limited to dependency sourcemap notices, the Vite large-chunk advisory, and existing ripgit compiler warnings.

Suggested review order

1. AGENTS.md and docs/architecture/ for the target model.
2. packages/gsv/src/services/ and protocol maps for public boundaries.
3. installation routing, lifecycle, and authorization under gateway/src/kernel/.
4. Process lifecycle, history, resources, compaction, delivery, and raw DO composition under gateway/src/process/.
5. Conversation storage and canonical Message projection.
6. adapter service contract, catalog, and managed Telegram/email boundaries.
7. Web Ship/Work/Process activity model.
8. host/ workspace, Desktop↔machine IPC, packaging, gestures, and voice.
9. deployment/release scripts and standalone/managed composition.

Deliberately deferred

These are tracked separately rather than hidden inside this PR:

• Ship stewardship through typed system events, cleanup-debt awareness, exact commitment deadlines, and 50%/80% context-pressure self-management: HAM-675.
• Autonomous retry/reconciliation for remaining terminal cleanup debt: HAM-645.
• Conversation retention/archive policy for unbounded long-term growth: HAM-644.
• Final GSV Manual review/publication: HAM-634.
• Production entitlements/rates, complete user-facing installation deletion, broader user administration/recovery, and signed public Desktop distribution.
• Any Cap'n Proto/CapnWeb wire migration; the current typed protocol and forwardable binary streams remain the shipping boundary.

[deathbyknowledge]

@codex review

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 65a9be4674

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".