feat: add Open Interpreter Rust TUI integration

[nikhilachale]

Code changes: +1194 -178
Tests: +1569 -4
Others: +87 -3

Current review follow-up (2026-10-15): merged current main and resolved the ACP replay, migration, and avatar conflicts. Restore now falls back to a fresh launch for missing or unusable history, accepts a torn final line and valid records above 8 MiB, and still rejects a verified foreign workspace. Open Interpreter 0.0.56 is required at runtime and pinned in AO's official install action. Codex styled observation and persisted trusted user hooks have regression coverage. The audit-only build workflow and evidence files are absent from the current PR diff; prior evidence remains available at its immutable commit. The unrelated ACP replay change is carried by main/#6617.

Local checks on this head: backend build; focused Open Interpreter, observer, CLI, and SQLite tests; 83 frontend tests; frontend typecheck. The full Windows systeminstall and session_manager suites had environment-dependent failures involving Unix commands/PATH and workspace access; all 24 current-head GitHub checks passed; renderer-smoke passed on a targeted rerun after one intermittent failure. Released-native conformance runs in Linux CI; native macOS/Windows conformance remains untested. The native Ctrl-C executing-child side effect remains a maintainer merge decision, so this PR stays draft.

Adds Open Interpreter's Rust terminal CLI as a TUI harness, with native setup/install actions, an account-aware model catalog plus custom entry, avatar, API registration, and migration 0199. The inspected contract is rust-v0.0.56 at cc054cf52fa3585a3de50e0d4e0be6f9ee6677e8; runtime help inspection rejects the older Python interpreter binary.

The initial task is passed after -- into native startup, while AO standing instructions use private SessionStart developer context. Process-local, exact-definition hook trust preserves native project/user hooks without a global trust bypass. Default native configuration, AGENTS.md, permissions, providers, and setup remain intact. --no-daemon keeps the session under AO's existing supervisor.

Native resume requires an exact provider UUID, verified native workspace identity, and valid conversation history from bounded plain or zstd rollouts; missing or unusable history falls back to a fresh launch in the AO workspace. Child hooks cannot overwrite the root ID. Continuous terminal observation now prefers the current styled viewport for surface-aware adapters, so alternate-screen idle/active states are observed correctly; submit/Stop/permission callbacks do not fabricate semantic acceptance or completion. Local credentials report configured, never authorized. Explicit custom-provider env_key configuration is observed through INTERPRETER_HOME and the daemon environment; ambiguous profiles, conflicting auth mechanisms and unsupported Bedrock overrides remain unknown. Shared preflight wiring preserves runtime environment for native profile lookup.

Validation: all 24 GitHub checks passed on 88c7431c427dda8c08802e9612042545a4febaf3: backend suites/race/lint/API and sqlc drift, frontend, CLI E2E, released native conformance, and gitleaks. VPS regressions reproduced the custom-auth and styled-observation defects before their fixes; affected package/race suites passed afterward. Independent review also caught and fixed styled Claude login-warning handling and invalid competing auth configuration. The pinned native conformance passed three consecutive VPS runs after fixing its source-proven post-render hook-input quarantine race. The original failed CI run is retained. No tests, builds, lint, typechecks or provider execution were run on the user's Mac.

Ubuntu 24.04 live validation (2026-10-10): final diagnostic attempt 5 used the existing Z.ai coding-plan credential with glm-5.3-flash and passed all 17 lifecycle gates: initial task exactly once, workspace proof, instruction consumption, AGENTS.md, second API message, active-to-idle reporting, Ctrl-C cancellation, confirmed termination, exact native-ID restore, post-restore messaging, original history/file continuity and refreshed standing instructions. Native cancellation completed in 22 ms; AO idle reconciliation took about 30 seconds, matching the unchanged observer cadence. Isolated daemon/native processes were cleaned up.

Earlier restored-input failures were sent during the native provisional “model: loading / Resuming session” screen. A source-backed runtime cue now requires the initialized model/workspace footer beside the empty composer. Controlled raw and bracketed input both worked after initialization; a separate paused-process fixture reproduced native raw-paste backlog behavior. No production timing or paste-policy workaround was added. Terminal captures bracket the final readiness boundary; there is no claim of an exact pre-send screenshot. Actual native task submission and post-restore proof mutation provide the functional continuity evidence.

This is diagnostic lifecycle coverage, not a full strict audit PASS. AO auth remains configured-only; the original audit observed an empty AO model catalog; native model discovery was added afterward, but that strict audit gate and exact catalog comparison have not been rerun. Evidence: harness-20261010/reports/open-interpreter-diagnostic-attempt5/report.json, the preserved prior attempts and control reports in the VPS audit archive. Real terminal text was captured; Electron UI and native non-Linux harness coverage are not claimed. The PR remains draft.

Intentional limits: TUI only; no Chat, reviewer, interface handoff, provider usage accounting, or semantic prompt acknowledgement. Native macOS/Windows execution is not covered by the release conformance job. Customized terminal footers beyond inspected chrome remain unknown. Histories exceeding the documented validation bounds are refused. Shared transcript readers receive plain JSONL only; compressed history remains eligible for verified native restore.

Native provider limitation: Open Interpreter's Chat Completions compatibility converts all native developer messages to wire user roles. AO hook context remains a tagged developer record in native history and is not appended to the visible task, but these providers do not receive developer-role precedence for it. A model can echo consumed context in tool output; the VPS audit observed an audit-only marker echo, so instruction consumption is not a secrecy guarantee. The conformance test explicitly checks both native metadata and the source-defined wire mapping.

Ctrl-C cancels the native turn without guaranteeing immediate provider connection teardown: the native detached Chat Completions stream reader can remain open until another chunk or timeout. Conformance checks the exact durable aborted turn, current-screen idle, late-output exclusion, and completion of a subsequent turn.

Pinned source details and lifecycle rationale: docs/harnesses/open-interpreter.md.

Follow-up at 330590df92575a958dc7a507d16654079b17b4fa: prevents native hook preview from dropping standing instructions in the middle of AO context. Only AO SessionStart sets additionalContextLimit=0, included in its exact trust hash; other hooks retain defaults. Official Rust0.0.56 middle-canary regression fails before fix and passes after. Fresh provider audit/capture and broader validation are underway; original failures are preserved.

Fresh follow-up: corrected restore and actual AO Electron evidence. Prior failures and historical limitations retained; strict authentication/model gaps remain explicit. Evidence-only commit, 2 PNG assets (binary files carry zero line counts).

Current focused prompt audit: ordinary-task fresh and after-Kill NEW-token consumption passed on runtime7130668 with actual AO Electron evidence. Native Ctrl+C executing-child cleanup FAILED with a late side effect; independent AO Kill/reaping/no-late/control usability passed. Actual authenticated wire role NOT_CAPTURED; native Chat Completions source maps developer hook context to user. Draft retained. Harness-owned report. Later evidence-head CI is pending; old checks are not current-head results.

[github-actions]

🏆 Review leaderboard

Oct 3–10, 2026 · UTC

Rank	Reviewer	PRs reviewed	Review rounds	PR comments
🥇	@illegalcall	27	45	10
🥈	@ronishrohan	19	22	16
🥉	@Vaibhaav-Tiwari	16	20	11
4	@Prasad-D-Ware	10	27	1
5	@axisrow	8	10	54
6	@Rishet11	7	17	2
7	@mohakchakraborty2004	7	7	1
8	@nikhilachale	6	15	3
9	@Pritom14	5	5	4
10	@codebanditssss	4	4	2

Ranked by distinct external PRs reviewed, then review rounds, then PR comments. Self-activity and bot activity are excluded.

Show 5 more reviewers

Rank	Reviewer	PRs reviewed	Review rounds	PR comments
11	@neversettle17-101	3	4	0
12	@harshitsinghbhandari	2	4	0
13	@whoisasx	2	2	0
14	@AgentWrapper	1	3	0
15	@ApexYash11	1	2	0

[nikhilachale]

Evidence correction from the skill packaging review: the historical system_prompt_restore token was included in the initial standing instructions before the first turn. Its later appearance proves that token remained available after restore; it does not prove fresh instruction delivery or reinjection. The original 17/17 lifecycle result is a recorded runner result, not verified evidence for all 17 intended behaviors. Refreshed instructions remain unproven for this historical run. The reusable runner is being corrected to introduce a fresh token only after confirmed kill and before restore; fixture validation of that change is separate from real-provider validation, which has not been rerun. Original counts and artifacts below are retained for traceability.

---

Open Interpreter Rust 0.0.56 — VPS audit report, 2026-10-10

Functional lifecycle: 17/17 PASS. CI on the audited commit: 24/24 PASS. Overall audit: FAIL. This is diagnostic lifecycle coverage; a full strict audit PASS is not claimed.

Audited commit: 88c7431c427dda8c08802e9612042545a4febaf3. Environment: Ubuntu 24.04 x86_64, the released native CLI, an isolated AO daemon/workspace/profile, and real Z.ai coding-plan calls using glm-5.3-flash. No tests, builds, lint, typechecks or provider execution ran on the user's Mac.

Gate totals: 24 PASS, 2 NOT_RUN, 1 BLOCKED, 1 FAIL. These are gate counts, separate from the 24 CI checks.

Local CLI

Gate	Result	Reason
local_binary	PASS	local executable resolved
local_version	PASS	local version command succeeded
local_integration	PASS	local integration probe succeeded
local_session_spawn	PASS	direct local CLI session produced the requested proof
local_models_list	NOT_RUN	local model-list command is not defined

AO / AOS11

Gate	Result	Reason
registered	PASS	agent is registered
installed	PASS	AO resolved the installed executable
fresh_probe	PASS	installation and authentication observations are fresh
authentication	BLOCKED	Open Interpreter has credentials configured, but AO could not verify them.
ao_models_api	FAIL	HTTP 200 returned an empty catalog; this integration accepts a free-form model
tui_spawn	PASS	AO created the requested TUI session
proof_file_creation	PASS	AO_AUDIT_PROOF.json contains valid JSON
correct_working_directory	PASS	provider reported AO's session workspace
initial_prompt_exactly_once	PASS	unique initial token was handled once
hidden_ao_instructions	PASS	provider consumed hidden AO standing instructions
project_agents_md	PASS	provider consumed project AGENTS.md
activity_status	PASS	AO exposed ready status and an active→idle transition
second_message	PASS	second API message produced the requested provider-authored mutation
native_session_id	PASS	AO persisted a provider-native session identity
cancellation	PASS	AO terminal mux sent configured input to the observed active session and the same terminal settled
termination	PASS	kill was acknowledged and termination was confirmed
native_restore	PASS	AO restored in native mode with the exact provider-native ID
same_ao_session_workspace	PASS	restore retained the AO session ID and workspace
post_restore_terminal_ready	PASS	the restored native terminal displayed the configured ready cue on the same terminal generation
post_restore_message	PASS	post-restore message produced a provider-authored mutation
history_file_continuity	PASS	native history recall and original proof-file continuity were both observed
system_prompt_restore	PASS	restore-only hidden standing instruction was observed after restore

Cross-check

Gate	Result	Reason
model_catalog_consistency	NOT_RUN	both local and AO model catalogs are required for comparison

AO reports credentials as configured, not provider-verified, despite successful real Z.ai calls. The AO model endpoint returned HTTP 200 with an empty catalog for this free-form model integration, so ao_models_api remains FAIL. Native model listing/exact catalog comparison remain NOT_RUN.

The audit fixed custom-provider credential observation and activity detection from the current styled viewport. Independent review also fixed styled Claude login-warning handling and rejection of conflicting native auth settings. The pinned native conformance test now respects native post-render hook-input quarantine; three consecutive VPS conformance runs passed.

Earlier continuation was sent into the provisional “model: loading / Resuming session” screen. Final attempt 5 required the initialized model/workspace footer beside the empty composer; the normal API message then executed and proved history/file/instruction continuity. No production sleep or paste-policy workaround was added.

Native cancellation took 22 ms; AO confirmed idle after 29.928 s, matching its unchanged observation cadence. The restored native task started 14 ms after the API response. Captures bracket the readiness boundary but do not independently show an exact pre-send initialized-empty frame. Actual native submission and proof mutation establish functional continuity. The model also echoed an audit-only instruction marker in tool output: instruction consumption does not guarantee secrecy.

The original strict skill remains unchanged. The separate diagnostic runner continues lifecycle testing only after successful direct native proof and AO installation/freshness checks; it retains the original non-passing auth/model gates. Its final revision passed 91/91 fixture tests.

Audited-head backend/aggregate CI · Pinned released-native conformance

Cleanup confirmed: the created session was terminated and the isolated daemon/native PTY processes stopped. A final audit-wide process scan found no remaining owned test processes. Credentials and raw native IDs are omitted here. Previous failed attempts and controlled comparisons remain preserved in the audit bundle. Real terminal text was captured; screenshots, Electron UI and native non-Linux harness coverage are not claimed.

Evidence identity

• Final attempt: open-interpreter-diagnostic-attempt5
• Source report: open-interpreter-diagnostic-attempt5/report.json
• Original JSON report SHA-256: 32acbfde9baf2655d2b1f62dce080ed918f3a0f622bc0ae268418cdf2fc3bbad
• Audited AO binary SHA-256: 7cc271c14bd98521a1f3d04bd09ec044ba8f46e94cdabf2d1882e7c82cf3c51a
• Diagnostic runner SHA-256: 37e6d6f8901ba080ec1a41cc36d6a253a56abad8003f753a4357fedc7f0170d7
• The retained export includes sanitized report copies, prior attempts, fixture logs, review findings and exact-head CI evidence; export copies hash native/opaque identities and retain original-file hashes.

[nikhilachale]

Evidence correction from the skill packaging review: the historical system_prompt_restore token was included in the initial standing instructions before the first turn. Its later appearance proves that token remained available after restore; it does not prove fresh instruction delivery or reinjection. The original 17/17 lifecycle result is a recorded runner result, not verified evidence for all 17 intended behaviors. Refreshed instructions remain unproven for this historical run. The reusable runner is being corrected to introduce a fresh token only after confirmed kill and before restore; fixture validation of that change is separate from real-provider validation, which has not been rerun. Original counts and artifacts below are retained for traceability.

---

Open Interpreter Rust 0.0.56 — failed-attempt report, 2026-10-10

The original failures remain preserved even though the final diagnostic run passed all 17 lifecycle gates. The overall audit remains FAIL: AO's model endpoint returned an empty catalog; authentication is BLOCKED; native model discovery/comparison are NOT_RUN. See the final gate-by-gate report.

All attempt times below are UTC on 2026-10-10. Testing ran on the Ubuntu VPS, with real Z.ai calls; no local Mac checks were run.

Attempt / start	Observed failure	Cause and resolution	Preserved evidence
Initial direct workspace-writing probe	RTM_NEWADDR: Operation not permitted from bwrap networking.	VPS sandbox compatibility limitation: the disposable audit used an explicit native sandbox bypass. Native sandbox enforcement is therefore not validated by the successful audit.	Original direct-probe evidence; AUTH-AND-TEST-SCOPE.txt
Strict 1 / 05:52:10; strict 2 / 06:05:18	Authentication remained non-passing; dependent lifecycle gates did not run.	Custom-provider credentials initially observed as unknown. Production observation now recognizes an unambiguous selected env_key as configured/fresh and rejects conflicting auth settings. Configured still does not equal provider-verified.	open-interpreter-strict-attempt{1,2}/report.json; review-findings.json
Diagnostic 1 / 06:16:38	Startup-hook, proof, native identity and later restore gates failed or remained unproven.	Fixture blockers: renamed AO executable omitted canonical ao from native PATH; scratch-folder trust was not configured. These caused downstream failures. Corrected the launch fixture and scoped trust to generated scratch workspaces.	open-interpreter-diagnostic-attempt1/report.json
Diagnostic 2 / 06:26:07	Partial run; no complete result claimed.	Symlink alias still resolved to renamed executable. Owned runner was deliberately stopped after API kill and process cleanup. Canonical executable/hardlink corrected the setup.	open-interpreter-diagnostic-attempt2/report.json
Diagnostic 3 / 06:28:25	Native UI was idle while AO remained active; second-message settled/cancellation checks failed. Restored request stayed draft.	Integration observer bug: plain terminal output could not identify the current styled idle composer. Observer now prefers styled output for surface-aware adapters, retaining fallback/error semantics. The original runner's active→active activity PASS was invalid and is explicitly overridden by supplemental findings.	open-interpreter-diagnostic-attempt3/report.json, supplemental-observations.json; terminal-capture/g01-0863-styled.ansi
Diagnostic 3 privacy observation	The model echoed an audit-only standing-instruction marker into tool output.	Instruction consumption was proven; nondisclosure was not. This was an audit marker, not a provider credential. No secrecy claim is made.	Attempt 3 supplemental-observations.json, historical matching terminal frames
Diagnostic 4 / 06:56:26	Activity/cancellation now passed, but post-restore execution, history and refreshed instructions failed to be proven.	Runner readiness defect: continuation reached the provisional model: loading / Resuming session… screen and remained draft. A visible placeholder alone was insufficient.	open-interpreter-diagnostic-attempt4/report.json, supplemental-observations.json
Bracketed control / 07:06:59; raw API control / 07:08:37	Both continuations succeeded after initialization.	Both controls included 1500 ms stabilization, so they do not prove bracketed paste alone fixed readiness. Separate fake-provider SIGSTOP/SIGCONT control showed raw paste backlog can swallow Enter; that control is not real-provider evidence. No production paste workaround was added.	open-interpreter-control-bracketed/report.json; open-interpreter-control-raw-settled/report.json; open-interpreter-paste-backlog-control.log
Diagnostic 5 / 07:16:28–07:20:32	No functional lifecycle failures; strict auth/catalog gaps persist.	Required initialized model/workspace footer plus the empty composer. The normal API message executed and proved history/file/refreshed instructions. All 17 lifecycle gates passed; total 24 PASS, 1 FAIL, 1 BLOCKED, 2 NOT_RUN.	open-interpreter-diagnostic-attempt5/report.json, supplemental-observations.json; open-interpreter-ready-candidate-validation.json

CI failures are also retained:

Failed revision	Failure	Resolution
b34c3413c2fd75099d98a4e40781f8340a2c9115, job 114147744725	errcheck required handling the config reader's Close result.	Fixed in ca612f7c4ca8f06e327dc6cf11c74fde2664724a.
0eceedc6a203680fff41389091881988b383dae4	Native hook-review menu rendered before its input quarantine expired; the immediate 3 shortcut was discarded.	Conformance fixture respects native quarantine, rechecks the menu, then sends a single checked 3; trust assertions retained. Fixed in 88c7431c427dda8c08802e9612042545a4febaf3; three consecutive VPS conformance runs and all 24 final-head CI checks passed.

Still failing: GET /api/v1/agents/open-interpreter/models returned HTTP 200 with selectionMode: "text", models: [], allowCustom: true. Free-form model support works, but that does not satisfy the skill's nonempty-catalog gate. Authentication remains BLOCKED because AO only observes configured credentials despite successful real provider calls. This is not an expired-login finding. Native model listing/comparison remain NOT_RUN.

Timing limits: final native cancellation took 22 ms while AO's idle confirmation took 29.928 s at its existing observation cadence. The final restored native task started 14 ms after the send API response. Captures bracket that boundary; no exact pre-send initialized-empty frame is available for the original run.

Fresh screenshot follow-up — failure reproduced on the current commit: at 09:01:23.924 UTC the original weak placeholder cue appeared; the normal API send began at 09:01:23.936 and returned HTTP 200 at 09:01:24.256. The request remained unsubmitted in the composer, with zero new native tasks during the 60-second observation. This deliberately exercises early input; it does not replace the successful initialized-ready diagnostic run or establish that early input is safe.

New live capture	UTC capture start	What it shows	PNG SHA-256
01-provisional-live.png	09:01:23.945	model: loading, Resuming session, and the premature placeholder.	73b4cd76e5a042858d16f8c1a74839c6e10bbd0c7c64cc688aad285d24df1d87
02-persistent-draft-live.png	09:01:26.679	Initialized model/workspace footer; newest request still in the composer.	43d8e07cbf82714e840ea986dc5e6cd23a82c1abe8045edf02421ae6348d28f2
04-final-live-state.png	09:02:24.934	Same unsubmitted draft at the end of the observation.	43d8e07cbf82714e840ea986dc5e6cd23a82c1abe8045edf02421ae6348d28f2

Capture method: actual scrot PNGs of an xterm window under Xvfb, displaying a read-only live mirror of AO PTY styled output. This is not a direct-attached native PTY screenshot. Source frames were 4.6–25.1 ms old at capture start; the first capture straddled a frame change. Later PNGs are byte-identical, consistent with the persistent draft. The screen includes restored historical transcript above the newest draft; that older transcript is not new execution evidence. Credential/source-frame scans passed; all owned session, daemon, PTY and GUI processes exited.

Files and sanitized-report.json are retained under screenshots-followup/ on the VPS and in the local export. PNGs have been delivered as local files; they are not uploaded GitHub attachments. Historical attempts still have ANSI/text captures only. These PNGs document a new reproduction, not the original earlier failures.

Evidence paths above are relative to the preserved VPS report directory /home/azureuser/.ao/audits/harness-20261010/reports/. A sanitized report export is retained locally under ao-agent-harness/reports/vps-2026-10-10/, including attempt-history.json, ci-preserved-failures.json and review-findings.json; raw terminal captures remain on the VPS. These paths are provenance references, not public downloadable GitHub attachments. Original failed/partial artifacts were not replaced by final passing results.

[nikhilachale]

The reusable integration/testing skill and consolidated session report are now in #6509.

• Complete report: all 52 intake decisions, the three integration PRs, attempts, failures, controls, CI and limits
• Skill usage and integration/audit references
• Curated evidence, exact revisions, CI links and image provenance

The report includes two redacted, actual screenshots from the new Open Interpreter early-send reproduction; they are published repository evidence, not historical screenshots of Tau or Neovate. Original captures remain unchanged.

The historical instruction-refresh correction remains explicit: the old system_prompt_restore token was available before the first turn, so the recorded 17/17 result does not prove reinjected/refreshed instructions. The packaged runner now creates and installs a fresh token only after confirmed kill. Its exact commit passed 98/98 fixture tests on the Ubuntu VPS; the strengthened instruction gate has not been rerun against real providers. Auth/model gaps and the observed early-send failure remain unresolved in the historical integration results.

[nikhilachale]

Fresh restore-only instructions and actual AO Electron evidence

This follows up the historical native audit and early-send failure. Official Rust Open Interpreter0.0.56, not Python, pinned release archive SHA-256 9e859353d6e2af28381489570d3ecf02060f7c73df5a652f3ca60c196835ccac; existing authorized Z.ai glm-5.3-flash profile, explicit native bypass only in isolated audit. All execution occurred on the VPS, sequentially under the compute lock. Current runner SHA-256 8887aa2e7101b9e6d3950bfca08ffddf2e1e6c1c3f1d030c8dec2676443aecea.

Fresh attempt	Functional source	PASS	FAIL	BLOCKED	NOT_RUN
001, preserved failure	88c7431c427dda8c08802e9612042545a4febaf3	19	2	2	5
002, corrected	330590df92575a958dc7a507d16654079b17b4fa	24	1	1	2

All functional lifecycle gates pass in002. Strict verdict remains FAIL / diagnostic-only: empty HTTP200 AO model catalog is FAIL, configured-but-unverified authentication is BLOCKED, native model listing and local/AO model comparison are NOT_RUN. No fabricated catalog, credential-presence PASS, login, draft clearing, or historical relabeling.

Actual defect and evidence-derived fix

001 consumed the project AGENTS token instead of the hidden standing-instruction token. The AO callback emitted valid15KiB context containing the required assignment, but native developer history held a truncated preview with a spill-file footer and omitted the token. Pinned native hooks default to a 2,500-token preview retaining both ends; the AO rule was in the omitted middle. See primary native source.

Fix 330590df92575a958dc7a507d16654079b17b4fa sets documented additionalContextLimit=0 only for AO's SessionStart and includes it in the canonical exact-definition trust hash. Other hook defaults and provider defaults are preserved. The five-second callback timeout is a time bound, not a byte/token cap.

Released-native regression now puts its canary in the middle of19KiB: before fix FAIL (model request missing AO_PRIVATE_CONTEXT), after fix the complete Open Interpreter adapter suite including released TUI conformance PASS. A tail-only control was weak and passed because preview preserves the ends; retained honestly. One green invocation failed in the launcher because of wrong cwd, also preserved before the corrected invocation.

001 also blocked on restored terminal readiness because the rendered-screen pattern did not match raw cursor redraw/border characters. No continuation was sent; three downstream gates stayed NOT_RUN. The corrected contract was derived from genuine raw frames and requires an end-anchored initialized empty composer, exact model and full audit workspace. It rejects loading, foreign drafts and stale empty frames followed by a current draft. No native draft cleanup was performed. This verifies the readiness-aware path; the historical HTTP200-during-initialization/unsubmitted-draft bug is not declared fixed.

Fresh post-kill proof

002 introduced the restore-only rule after confirmed kill, wrote/read back project config, restored the same nativeID/workspace, confirmed an initialized EMPTY composer, then verified post-restore mutation, history continuity and consumption of the new rule. Independent native history shows complete initial and later restored developer rows, with the fresh token absent initially and present only after kill/restore; neither row has a spill footer. Tokens prove consumption, not secrecy or instruction-role precedence.

Cancellation proves configured native cancel input interrupted the observed active turn and AO later settled. It does not establish termination of an already-running subprocess or immediate provider socket closure.

Real AO screenshots — original failure and corrected restore

These are actual AO Electron/scrot/Xvfb captures, visually inspected for secrets and relevance. window.ao bridge, exact selected target session, source/binary/model, native digest and restored terminal generation were checked. After the finalized runner stopped, the GUI supervisor reopened identical isolated data with the identical binary. These later retained-session captures are not original gate-time screenshots. The native Rust UI retains upstream “Ask Codex” wording; binary/session provenance identifies Open Interpreter. Historical terminal mirrors remain mirrors.

Original failure, UTC 2026-10-10T18:48:33.530050Z, source/UI 88c7431c427dda8c08802e9612042545a4febaf3, PNG SHA-256 0f720af3fb8835e7abdd48c2a35ae215b9a500686a6c329959a94ae3d22cb669:

Corrected restore, UTC 2026-10-10T19:04:31.649461Z, source/UI 330590df92575a958dc7a507d16654079b17b4fa, AO binary SHA-256 8d84f311dac085d2b1d9df1c07019b54e6f5d21816b19e4467d3a2ebc4617c42, nativeID digest 0bd058dae3bfcc86e66555bd2aeb6f10594e019e682d7b343680344da5696756, PNG SHA-256 1df692b9cfdd088808dac4d7ddc5ecd021830ee48e5206085176f83ef9a50d61:

Detailed report, all28 gate results, before/after witnesses and complete capture provenance. Published PNG bytes verified against local SHA-256 before this comment was posted.

Validation and cleanup

Original source and corrected functional source each have 24/24 exact-head GitHub checks SUCCESS. Local released-native adapter suite and focused adapter/CLI race suite PASS. Full local go test ./... was supervisor-interrupted after roughly eight minutes following independent green-CI verification: INCOMPLETE with observed failures in five packages,94 failed test names recorded. No local full-suite pass or baseline diagnosis. Failed packages: fake-agent adapter, OpenCode V2 adapter, HTTP controllers, integration, agent service. Exact commands/environment, names and preserved log hash are in backend-validation.json. Local full vet/lint/race were NOT_RUN; CI-only. Frontend typecheck was not repeated after the earlier VPS OOM; native macOS/Windows/container execution is CI-only. Final evidence head 74d89ab52a951f69538742fd34bf8c947df0f841 now has 24/24 exact-head GitHub checks SUCCESS, verified 2026-10-10T19:30:19.548316+00:00. Evidence-only commit; corrected source already separately had24/24 SUCCESS.

Both audited sessions API-killed/termination confirmed; exact main Electron/current run-file daemon executable verified before TERM, processes gone. Shared Git store, profiles, original failures, runtime archive, native/AO binaries and source retained. Audit-only state; no regular user AO data touched. No merge/release/new PR.

[nikhilachale]

Harness-specific reports, JSON receipts, screenshots and provenance now live on this integration PR branch, rather than the skill PR #6509.

Evidence index with embedded screenshots and JSON links.

The two historical October10 PNGs are live terminal mirrors reproducing an early-send failure, NOT actual AO Electron proof. Separate existing follow-up screenshots carry their own actual-AO provenance.

This is evidence relocation only. Existing tested source/native hashes and failures are preserved; the documentation commit is not a fresh runtime pass. Applicable checks run in PR CI.

[nikhilachale]

Canonical main conflicts reconciled at 5a1bfb6ebc17, preserving previous source/evidence ancestry and every existing harness report/screenshot byte. Reconciliation receipt.

Validation is PR CI only; current-head checks are pending until GitHub reports them. This merge does not constitute a new native/AO run or promote historical fresh/restore/provider-role proof. Harness evidence stays on this integration PR; PR6509 remains reusable guidance and linked summaries.

[nikhilachale]

Canonical main conflicts reconciled at 71306680a659, preserving previous source/evidence ancestry and every existing harness report/screenshot byte. Reconciliation receipt.

Validation is PR CI only; current-head checks are pending until GitHub reports them. This merge does not constitute a new native/AO run or promote historical fresh/restore/provider-role proof. Harness evidence stays on this integration PR; PR6509 remains reusable guidance and linked summaries.

[nikhilachale]

Canonical main conflicts reconciled at e4fb1af7762f, preserving previous source/evidence ancestry and every existing harness report/screenshot byte. Reconciliation receipt.

Validation is PR CI only; current-head checks are pending until GitHub reports them. This merge does not constitute a new native/AO run or promote historical fresh/restore/provider-role proof. Harness evidence stays on this integration PR; PR6509 remains reusable guidance and linked summaries.

[nikhilachale]

Focused ordinary-task instruction audit on source-pinned daemon 7130668: fresh private/project actions PASS; exact native restore with NEW hidden input PASS; missing history rejection PASS. Ordinary tasks did not name private/project tokens or their action paths, and did not ask the model to read instructions. Native default prompt and user/project configuration remain scoped as recorded.

Native Ctrl+C executing-child cancellation FAIL, including its late side effect. A separate AO Kill executing-child/reaping/no-late/unrelated-control test PASS does not erase that failure. The unrelated control completed its message; its short active transition was not observed by the30-second observer.

Actual authenticated wire role: NOT_CAPTURED. Source conformance maps native developer hook context to user Chat Completions role; receipt is not proof of a system-role payload. The integration remains draft. New evidence-head checks are pending.

Report and qualified failure history · Functional receipt · Screenshot/source/native provenance

All assets are harness-owned on6496. PR6509 was not modified.

[nikhilachale]

Canonical main conflicts reconciled at 3d997079087e, preserving previous source/evidence ancestry and every existing harness report/screenshot byte. Reconciliation receipt.

Validation is PR CI only; current-head checks are pending until GitHub reports them. This merge does not constitute a new native/AO run or promote historical fresh/restore/provider-role proof. Harness evidence stays on this integration PR; PR6509 remains reusable guidance and linked summaries.

[nikhilachale]

Canonical main and the green shared ACP replay CI budget reconciled at d1952fff3524, preserving previous source/evidence ancestry and every existing harness report/screenshot byte. Reconciliation receipt.

The shared test-only fix PR6617 had21 green applicable checks; this integration head still needs its own exact-head CI. The full20543-frame replay burst and exact-once assertions remain unchanged. No routine local suites ran. This merge does not constitute a new native/AO run or promote historical fresh/restore/provider-role proof. Harness evidence stays on this integration PR; PR6509 remains reusable guidance and linked summaries.

[Prasad-D-Ware]

Read through the code diff (not the evidence files in detail). The adapter itself is careful: task after --, TOML escaping, no global hook-trust bypass, exact-UUID restore with a same-directory workspace check, bounded zstd reads, child hooks can't overwrite the root id, and a checksum-pinned real-binary conformance job. A few things I'd want addressed before this leaves draft — details inline.

Should fix

1. Restore errors instead of falling back to a fresh launch (openinterpreter.go).
2. -c hooks.state={...} may replace, not merge, the user's persisted hook trust — untested (hooks.go).
3. The styled-screen observer change applies to Codex and Claude Code too, not just Open Interpreter (observer.go).

Shouldn't ship in this PR
4. ~4.1k lines of audit JSON + 13 PNGs under docs/research/assets/ — please keep these in PR comments/artifacts rather than the repo.
5. harness-proof-build.yml builds and uploads an ao binary on every backend PR for VPS proofs — that's audit infra, not product CI.
6. The ACP replay timeout bump is unrelated, duplicates #6617, and is one of the two current merge conflicts.

Product decision
7. Per your 2026-10-12 audit, native Ctrl-C leaves an executing tool child running and its side effect still lands. If AO's cancel path ends up sending Ctrl-C, users will believe a tool was stopped when it wasn't. Worth an explicit maintainer call on whether that blocks merge.

Minor

• Migration is 0199 while main is at 0197 — fine if 0198 is reserved by another open PR, just flagging. migrate_burned_versions_test.go also conflicts.
• Windows hook command (& '...') and macOS/Windows execution aren't covered by the conformance job.

[Prasad-D-Ware]

Re-checked at d1952fff3. That's the same head as my earlier review, so nothing has changed since then. The findings from that review all still apply: restore errors instead of falling back, hooks.state replace vs merge, the observer change reaching Codex/Claude, the evidence assets, harness-proof-build.yml, the ACP replay bump, and the Ctrl-C decision. The re-read nit, migration 0199 (main is still at 0197) and the Windows/macOS coverage note also still apply. The PR still has the same two conflicts: controller_acp_replay_test.go and migrate_burned_versions_test.go. All 24 checks are green on this head.

I ran these focused tests locally on this head and they all passed: openinterpreter, registry, activitydispatch, claudecode, observe/activity, systeminstall, agentauth, storage/sqlite, cli (hooks/doctor/spawn), and the session_manager restore tests.

Two new items are inline. One is another way restore gets stuck, separate from the missing-history case I raised before. The other is about version drift.

[nikhilachale]

Reviewed head 12670453c58449238a66cdccddff6de691325f16. I found no new actionable defects in this static review.

The earlier restore fallback, torn-final-record/large-record handling, and version-drift findings are addressed in the current code. Persisted user-hook trust and Codex styled-screen observation now have regression coverage. I also compared hook execution, profile resolution, and model discovery with the pinned upstream Rust source.

The documented Ctrl-C executing-child limitation still needs the maintainer decision already requested in the earlier review: cancelling a native turn can leave a tool child running and allow a later side effect. This review does not resolve that outstanding concern or recommend lifting the draft on that basis.

All 24 current-head GitHub checks report success. GitHub currently reports merge conflicts. No project programs, tests, builds, or installers were executed for this review; the native conformance coverage remains Linux-only.