ops: align setup install and reconciliation gates

Author: andersalm

.github/workflows/ci.yml

@@ -25,6 +25,11 @@ jobs:
       - name: cargo fmt
         working-directory: elastos
         run: cargo fmt --all -- --check
+      - name: architecture entropy checks
+        run: |
+          bash scripts/check-wci-alignment.sh
+          node scripts/home-entropy-check.mjs
+          node scripts/browser-entropy-check.mjs
       - name: cargo clippy
         working-directory: elastos
         run: cargo clippy --workspace --all-targets -- -D warnings

justfile

@@ -46,9 +46,12 @@ lint:
 fmt:
     cd elastos && cargo fmt --all
 
-# Pre-commit gate: alignment, smoke tests, fmt/lint/test
+# Pre-commit gate: alignment, entropy, smoke tests, fmt/lint/test
 verify:
+    git diff --check
     just alignment-check
+    node scripts/home-entropy-check.mjs
+    node scripts/browser-entropy-check.mjs
     just local-carrier-setup-smoke
     ./scripts/command-smoke.sh
     just candidate-command-audit

scripts/README.md

@@ -21,6 +21,7 @@ Top-level directly-invoked entrypoints stay at the root:
 - `home-demo-local.sh` — prepare and launch the local source-based Home demo in a clean temp home
 - `publish-release.sh` — low-level release publisher
 - `setup-crosvm.sh` — install runtime VM prerequisites
+- `setup-source-home.sh` — build/provision the source-home runtime and generated helper scripts
 - `share-demo.sh` — share project docs/content
 
 If a script is something a human is expected to type from docs, it belongs here.
@@ -48,12 +49,36 @@ Proof, smoke, and audit helpers also currently live at the root. Common examples
 - `public-install-home-frontdoor-smoke.sh`
 - `protected-content-provider-contract-smoke.sh`
 - `recovery-kit-live-smoke.sh`
+- `people-conversations-local-smoke.sh`
+- `browser-vm-target-refresh.sh`
+- `linux-source-home-restart.sh`
 
 These are review and release helpers, not automatically part of the stable
 end-user command contract. The `public-install-*.sh` helpers can target a
-published candidate gateway by setting `ELASTOS_PUBLISHER_GATEWAY=<url>`.
+published candidate gateway by setting `ELASTOS_PUBLISHER_GATEWAY=<url>`. They
+use the stamped trusted-source transports by default. During 0.5.0 candidate
+review, `ELASTOS_BIN_OVERRIDE=<path-to-branch-elastos>` swaps in the current
+branch binary only when the selected gateway serves a 0.5.0-compatible manifest
+with the current `home` setup profile and checksummed artifacts. The helpers pin
+the installer-selected components manifest so source checkout metadata cannot
+leak into the installed-path smoke. Use `scripts/local-carrier-setup-smoke.sh`
+for source/local Carrier setup proof before a candidate gateway exists. Set
+`ELASTOS_PUBLIC_INSTALL_FORCE_RELAY_ONLY=1` when you intentionally want to
+turn the public install proof into a stricter publisher relay-health check.
 `recovery-kit-live-smoke.sh` requires `ELASTOS_HOME_TOKEN` from a signed
 browser session and is non-mutating unless create/import flags are set.
+`people-conversations-local-smoke.sh` is a local review wrapper for the People
+and Chat conversation slice. It composes the Home entropy guard with the narrow
+Rust/WASM tests for join-object creation, launch-query preservation, profile
+cards, People contact projection, and Chat invite-query decoding.
+`browser-vm-target-refresh.sh` is the renewable drift-repair path for
+already-provisioned Browser VM targets. It refreshes installed helper scripts
+and guest script artifacts from the reviewed source checkout without pretending
+those helpers are standalone `components.json` release components.
+`linux-source-home-restart.sh` is the Linux source-home gateway restart/proof
+path for targets such as Jetson. Run it after full source-home setup replaces
+the gateway binary so the live front door comes back with a hash-bound Home and
+Services receipt.
 `auth-wallet-focus-smoke.sh` runs the current passkey, Recovery Kit,
 capsule-bridge principal storage, principal-launch, System managed-wallet route,
 wallet approval, managed-wallet, BTC, typed chain proof/prepare/broadcast,
@@ -72,6 +97,7 @@ include:
 - `browser-glide-wallet-smoke.sh`
 - `browser-per-launch-selkies-supervisor-smoke.sh`
 - `browser-session-capacity-smoke.sh`
+- `browser-vm-engine-supervisor-autostart-smoke.sh`
 - `browser-home-session-smoke.sh`
 - `browser-ela-city-protected-content-open-smoke.sh`
 - `HOME_URL=http://localhost:8090/apps/home/ HOME_VIRTUAL_AUTH_BROWSER=1 HOME_VIRTUAL_AUTH_BROWSER_OPEN=1 node scripts/home-passkey-virtual-auth-smoke.mjs`
@@ -100,9 +126,17 @@ Use `HOME_VIRTUAL_AUTH_BROWSER_OPEN_CONCURRENT=2` and
 `HOME_VIRTUAL_AUTH_BROWSER_OPEN_HOLD_MS=30000` with the same smoke to prove
 multiple Runtime Browser pages can stay alive, receive heartbeats, appear in
 the Browser session-capacity receipt, and close without leaving capacity behind.
-Use `scripts/browser-session-capacity-smoke.sh` first when you only need to
-verify that a running gateway exposes `elastos.browser.session-capacity/v1`
-without opening a heavyweight Browser engine session.
+Use `HOME_VIRTUAL_AUTH_BROWSER_OPEN=0 HOME_VIRTUAL_AUTH_BROWSER_SUMMARY=1` on
+`home-passkey-virtual-auth-smoke.mjs` when you only need to verify that a
+running gateway exposes `elastos.browser.session-capacity/v1` without opening a
+heavyweight Browser engine session.
+Use `scripts/browser-session-capacity-smoke.sh` to prove the active Browser
+capacity path. By default it opens one Browser page, holds heartbeats for
+30 seconds, verifies an additional open fails closed with structured
+`browser_capacity_unavailable`, then closes the page and checks the Browser
+session-capacity receipt returns to baseline. Override
+`HOME_VIRTUAL_AUTH_BROWSER_OPEN_CONCURRENT` only for a provider that truthfully
+supports more active pages than the current Mac VM single-page substrate.
 `scripts/browser-home-session-smoke.sh` is the named release gate wrapper for
 that proof. Override `HOME_URL`, `HOME_VIRTUAL_AUTH_BROWSER_OPEN_CONCURRENT`,
 and `HOME_VIRTUAL_AUTH_BROWSER_OPEN_HOLD_MS` when testing another runtime.
@@ -115,6 +149,11 @@ through a disposable Home passkey and close the page cleanly. This is a Browser
 reachability and session-cleanup proof only; it does not prove purchase,
 license, key release, or dDRM playback success.
 
+Internal target-maintenance wrappers that depend on private SSH aliases,
+reverse tunnels, local usernames, or host-specific data roots should not live in
+the public repo. Keep those commands in local operator notes and leave reusable
+repo scripts parameterized through explicit environment variables or CLI flags.
+
 ## Support Subdirectories
 
 - `build/` — lower-level build helpers

scripts/browser-entropy-check.mjs

@@ -993,6 +993,8 @@ assert(
 
 assert(
   browserVmRemoteVzLauncher.includes("ELASTOS_BROWSER_REMOTE_VZ_SSH") &&
+    browserVmRemoteVzLauncher.includes("ELASTOS_BROWSER_REMOTE_VZ_SSH must name") &&
+    !browserVmRemoteVzLauncher.includes(["elastos", "mac", "staging"].join("-")) &&
     browserVmRemoteVzLauncher.includes("-R") &&
     !browserVmRemoteVzLauncher.includes("control-forward") &&
     !browserVmRemoteVzLauncher.includes("waitForLocalTcpPort") &&

scripts/browser-mac-vm-acceptance-audit-smoke.sh

@@ -363,7 +363,7 @@ write_machine_proof "$tmp_dir/mac-generic-profile.json" "Log In Profile director
   const proof = JSON.parse(fs.readFileSync(process.argv[1], "utf8"));
   proof.profile_reset.receipt.profile.profile_key = "profile-secret";
   proof.profile_reset.receipt.profile.principal_id = "person:local:secret";
-  proof.profile_reset.receipt.profile.disk_path = "/Users/anders/elastos/Users/0123456789ab/BrowserProfiles/default/profile.ext4";
+  proof.profile_reset.receipt.profile.disk_path = "/Users/operator/elastos/Users/0123456789ab/BrowserProfiles/default/profile.ext4";
   fs.writeFileSync(process.argv[2], `${JSON.stringify(proof, null, 2)}\n`);
 ' "$tmp_dir/mac-authenticated.json" "$tmp_dir/mac-leaky-profile-reset.json"
 
@@ -411,13 +411,13 @@ const sourceHomeRestart = {
   ok: true,
   dry_run: false,
   generated_at: "2026-06-19T00:00:00.000Z",
-  repo: "/Users/anders/Code/elastos-runtime",
-  test_home: "/Users/anders/elastos-mac-test-home",
-  data_dir: "/Users/anders/elastos-mac-test-home/Library/Application Support/elastos",
+  repo: "/Users/operator/Code/elastos-runtime",
+  test_home: "/Users/operator/elastos-mac-test-home",
+  data_dir: "/Users/operator/elastos-mac-test-home/Library/Application Support/elastos",
   addr: "localhost:61180",
   home_url: "http://localhost:61180/apps/home/",
-  gateway_bin: "/Users/anders/Code/elastos-runtime/elastos/target/release/elastos",
-  gateway_log: "/Users/anders/elastos-mac-test-home/logs/gateway-smoke.log",
+  gateway_bin: "/Users/operator/Code/elastos-runtime/elastos/target/release/elastos",
+  gateway_log: "/Users/operator/elastos-mac-test-home/logs/gateway-smoke.log",
   http_code: 200,
   served_index_sha256: proof.home.installed_index_sha256,
   installed_index_sha256: proof.home.installed_index_sha256,

scripts/browser-mac-vm-acceptance-handoff-smoke.sh

@@ -186,13 +186,13 @@ const receipt = {
   ok: true,
   dry_run: false,
   generated_at: "2026-06-19T00:00:00.000Z",
-  repo: "/Users/anders/Code/elastos-runtime",
-  test_home: "/Users/anders/elastos-mac-test-home",
-  data_dir: "/Users/anders/elastos-mac-test-home/Library/Application Support/elastos",
+  repo: "/Users/operator/Code/elastos-runtime",
+  test_home: "/Users/operator/elastos-mac-test-home",
+  data_dir: "/Users/operator/elastos-mac-test-home/Library/Application Support/elastos",
   addr: "localhost:61180",
   home_url: "http://localhost:61180/apps/home/",
-  gateway_bin: "/Users/anders/Code/elastos-runtime/elastos/target/release/elastos",
-  gateway_log: "/Users/anders/elastos-mac-test-home/logs/gateway-smoke.log",
+  gateway_bin: "/Users/operator/Code/elastos-runtime/elastos/target/release/elastos",
+  gateway_log: "/Users/operator/elastos-mac-test-home/logs/gateway-smoke.log",
   http_code: 200,
   served_index_sha256: proof.home.installed_index_sha256,
   installed_index_sha256: proof.home.installed_index_sha256,

scripts/browser-mac-vm-manual-ux-smoke.sh

@@ -294,7 +294,7 @@ missing_profile_reset_sha="$("$node_bin" -e 'const fs = require("node:fs"); cons
   const proof = JSON.parse(fs.readFileSync(process.argv[1], "utf8"));
   proof.profile_reset.receipt.profile.profile_key = "profile-secret";
   proof.profile_reset.receipt.profile.principal_id = "person:local:secret";
-  proof.profile_reset.receipt.profile.disk_path = "/Users/anders/elastos/Users/0123456789ab/BrowserProfiles/default/profile.ext4";
+  proof.profile_reset.receipt.profile.disk_path = "/Users/operator/elastos/Users/0123456789ab/BrowserProfiles/default/profile.ext4";
   fs.writeFileSync(process.argv[2], `${JSON.stringify(proof, null, 2)}\n`);
 ' "$tmp_dir/mac-valid.json" "$tmp_dir/mac-leaky-profile-reset.json"
 leaky_profile_reset_sha="$("$node_bin" -e 'const fs = require("node:fs"); const crypto = require("node:crypto"); process.stdout.write(crypto.createHash("sha256").update(fs.readFileSync(process.argv[1])).digest("hex"));' "$tmp_dir/mac-leaky-profile-reset.json")"

scripts/browser-per-launch-selkies-supervisor-smoke.sh

@@ -20,12 +20,9 @@ trap cleanup EXIT
 
 cd "$repo_root"
 
-service_home="${ELASTOS_BROWSER_SERVICE_HOME:-/home/wau/.local/share/elastos-public-gateway-live}"
+service_home="${ELASTOS_BROWSER_SERVICE_HOME:-$tmp_dir/service-home}"
 service_xdg_data_home="${ELASTOS_BROWSER_SERVICE_XDG_DATA_HOME:-$service_home/xdg-data}"
 browser_program="${ELASTOS_BROWSER_SELKIES_BROWSER_PROGRAM:-}"
-if [[ -z "$browser_program" && -x /home/wau/.cache/ms-playwright/chromium-1217/chrome-linux64/chrome ]]; then
-  browser_program="/home/wau/.cache/ms-playwright/chromium-1217/chrome-linux64/chrome"
-fi
 if [[ -z "$browser_program" || ! -x "$browser_program" ]]; then
   echo "ELASTOS_BROWSER_SELKIES_BROWSER_PROGRAM must point at an executable Chromium binary" >&2
   exit 2

scripts/browser-provider-decision-report.mjs

@@ -6,18 +6,14 @@ import { spawnSync } from "node:child_process";
 import process from "node:process";
 
 const selkiesBaselineConfig = "/tmp/elastos-browser-selkies-live/browser-engine-adapter.json";
-const gatewayLiveConfig = "/home/wau/.local/share/elastos-public-gateway-live/xdg-data/elastos/config/browser-engine-adapter.json";
 const userDataHomeConfig = path.join(os.homedir(), "Library/Application Support/elastos/config/browser-engine-adapter.json");
-const macStagingConfig = path.join(os.homedir(), "elastos-mac-test-home/Library/Application Support/elastos/config/browser-engine-adapter.json");
 const nodeBinary = process.execPath;
 
 function defaultLiveConfig() {
   if (process.env.ELASTOS_BROWSER_ENGINE_ADAPTER_CONFIG) {
     return process.env.ELASTOS_BROWSER_ENGINE_ADAPTER_CONFIG;
   }
   for (const candidate of [
-    gatewayLiveConfig,
-    macStagingConfig,
     userDataHomeConfig,
     selkiesBaselineConfig,
   ]) {
@@ -137,13 +133,6 @@ function discoverNativeBrowserProgram(explicitProgram) {
     const found = commandPath(command);
     if (found) return found;
   }
-  for (const candidate of [
-    "/home/wau/.cache/ms-playwright/chromium-1217/chrome-linux64/chrome",
-    "/home/wau/.cache/ms-playwright/chromium-1208/chrome-linux64/chrome",
-    "/home/wau/.cache/ms-playwright/chromium-1181/chrome-linux/chrome",
-  ]) {
-    if (fs.existsSync(candidate)) return candidate;
-  }
   return "";
 }
 

scripts/browser-provider-runbook.mjs

@@ -340,7 +340,7 @@ ${shellBlock([
   "node scripts/browser-hosted-product-operator-config.mjs \\",
   "  --candidate kasm-workspaces \\",
   "  --out-dir /opt/elastos/kasm-workspaces \\",
-  "  --supervisor-program /home/wau/elastos-runtime/scripts/browser-hosted-product-supervisor.mjs \\",
+  "  --supervisor-program \"$PWD/scripts/browser-hosted-product-supervisor.mjs\" \\",
   "  --control-socket \"$KASM_CONTROL_SOCKET\"",
   "",
   "node scripts/browser-hosted-provider-preflight.mjs \\",
@@ -382,7 +382,7 @@ ${shellBlock([
   "node scripts/browser-hosted-product-operator-config.mjs \\",
   "  --candidate browserbox \\",
   "  --out-dir /opt/elastos/browserbox \\",
-  "  --supervisor-program /home/wau/elastos-runtime/scripts/browser-hosted-product-supervisor.mjs \\",
+  "  --supervisor-program \"$PWD/scripts/browser-hosted-product-supervisor.mjs\" \\",
   "  --control-socket \"$BROWSERBOX_CONTROL_SOCKET\"",
   "",
   "node scripts/browser-hosted-provider-preflight.mjs \\",