feat: add Mastra Code native TUI with exact history restore

[nikhilachale]

Code changes: +1208 -11
Tests: +757 -3
Others: +245 -3

Adds the native Mastra Code TUI with additive AO instructions and exact local-history restore. Chat, reviewers, and interface handoff remain outside this integration.

Review fixes:

• Fresh restart isolates native history while preserving earlier databases and exact restore after failed launches.
• Restore retains the native model, checks locks across platforms, and refreshes private instructions after native metadata hydration.
• Dialog checks ignore transcript markers; tracked configuration is refused before writes; unsupported task prefixes have actionable errors.
• Native profile configuration determines auth status; canonical paths prevent duplicate instructions; terminated/deleted sessions release serialized-input state.

Removed the proof-build workflow, all 67 PR-only research/evidence files, and unrelated FX/OpenCode schema repairs. Main conflicts and all seven review threads are resolved.

Verification: all 24 CI checks pass at 1cb9705a990a3eb87eca2a8a20ed01241a2954b8, including full frontend tests/typechecks, Go race suites, lint, API/sqlc drift, Windows Mastra history/locks, renderer smoke, and CLI E2E across all three OSes plus Docker. Current checks. GitHub reports MERGEABLE.

Local adapter/lifecycle regressions, generated-plugin hydration, full session-manager suite, backend build/vet, macOS CLI E2E, affected storage/activity suites, product UI (160 tests), and Cloud client (29 tests) passed.

Local validation limits and retries

Full local race validation hit disk limits; pinned local lint timed out, and the long project typecheck was stopped. Those full jobs passed in CI. The initial session-manager deadline test failed under load; its full suite rerun passed.

The frontend suite passed 8,273 tests with three timing failures in unchanged tests: GlobalSettingsForm — “keeps the current language and reports a persistence failure”; board-empty-states — “respects a dismissed automatic login after the notice remounts”; IndependentSideChatDelivery — “retains the page boundary as new turns arrive (older history loaded: true)”. Rerunning all three files with one worker passed all 126 tests. An earlier native SQLite ABI mismatch was corrected by rebuilding for Node 24.

Draft: a successful current-head native lifecycle run, including the first restored continuation with changed private instructions, is still required. Historical failed native proof is not claimed as a pass.

[github-actions]

🏆 Review leaderboard

Oct 4–11, 2026 · UTC

Rank	Reviewer	PRs reviewed	Review rounds	PR comments
🥇	@illegalcall	30	51	9
🥈	@ronishrohan	17	20	11
🥉	@Prasad-D-Ware	12	27	0
4	@nikhilachale	11	24	3
5	@Vaibhaav-Tiwari	10	13	3
6	@axisrow	8	10	17
7	@mohakchakraborty2004	7	7	1
8	@Pritom14	5	5	3
9	@Rishet11	4	10	2
10	@codebanditssss	4	4	2

Ranked by distinct external PRs reviewed, then review rounds, then PR comments. Self-activity and bot activity are excluded.

Show 5 more reviewers

Rank	Reviewer	PRs reviewed	Review rounds	PR comments
11	@Annieeeee11	3	6	1
12	@harshitsinghbhandari	2	4	0
13	@neversettle17-101	2	3	0
14	@whoisasx	2	2	0
15	@AgentWrapper	1	3	0

[nikhilachale]

Actual AO Electron proof is published with immutable evidence links. UI and serving daemon are14fedd56b; pinned native mastracode0.45.0/code-sdk1.11.0, Z.ai glm-5.3-flash. Capture was inspected for secrets and the downloaded published PNG hash matches3b38aad4a58c6e4e87977c4295aa3045837147e4e347b7bca63092318357e762.

Report, lifecycle and exact cleanup receipts

Earlier failures and differing lifecycle source heads are preserved explicitly. Permission approve/reject and pending input409 protection passed; permission-cancel recovery required later Escape after native embedding initialization, so immediate dialog cancellation is not claimed. Foreground shell Escape and independent AO Kill have separate PID/kernel-start/reaping/no-late-side-effect controls. All exact owned session processes and the isolated daemon are now gone; dirty worktrees/profiles/evidence preserved. Routine tests ran only in PR CI. Draft remains until current-head CI rerun completes.

[nikhilachale]

Mastra stage complete. Integration head14fedd56b6904974a325d09ac3ac8c1c73cb2313 has23/23 successful GitHub checks; evidence head92c6b0e49be75d650248e7218b7af376d65676ef has5/5, including current-head fixtures. PR6541 is ready for review. The initial autoreview timeout and evidence frontend late jsdom row.animate error are preserved separately; their failed jobs passed on remote rerun. No routine local suites ran.

Immutable AO screenshot, provenance, lifecycle controls, limitations and cleanup report. Published screenshot download hash verified. Three owned sessions and isolated daemon were shut down with process identity/readback controls; dirty worktrees/profiles and prior evidence remain preserved. Scope remains TUI-only; no Chat/handoff/background ownership claim or immediate permission-dialog-cancel claim.

This stage changed no runner source. Installed runner remains8887aa2e7101b9e6d3950bfca08ffddf2e1e6c1c3f1d030c8dec2676443aecea; evidence checkout's earlier runner revisions hash23dc1a2f39bd6c88fd95b47d041040a039d16c52ab71996a278f49e68f8bdcc5 is covered by the new fixture check. Native instruction/restore/permission lessons were synced to installed skill documentation.

[nikhilachale]

Harness-specific reports, JSON receipts, screenshots and provenance now live on this integration PR branch, rather than the skill PR #6509.

Evidence index with embedded screenshots and JSON links.

Historical successes, failures and scope limitations remain as recorded. Moving these files does not rerun native/AO testing or upgrade any verdict.

This is evidence relocation only. Existing tested source/native hashes and failures are preserved; the documentation commit is not a fresh runtime pass. Applicable checks run in PR CI.

[nikhilachale]

Canonical main conflicts reconciled at eb73fd14e7f0, preserving previous source/evidence ancestry and every existing harness report/screenshot byte. Reconciliation receipt.

Validation is PR CI only; current-head checks are pending until GitHub reports them. This merge does not constitute a new native/AO run or promote historical fresh/restore/provider-role proof. Harness evidence stays on this integration PR; PR6509 remains reusable guidance and linked summaries.

[nikhilachale]

Canonical main conflicts reconciled at 6db4eca087ec, preserving previous source/evidence ancestry and every existing harness report/screenshot byte. Reconciliation receipt.

Validation is PR CI only; current-head checks are pending until GitHub reports them. This merge does not constitute a new native/AO run or promote historical fresh/restore/provider-role proof. Harness evidence stays on this integration PR; PR6509 remains reusable guidance and linked summaries.

[nikhilachale]

Canonical main conflicts reconciled at ec7669914826, preserving previous source/evidence ancestry and every existing harness report/screenshot byte. Reconciliation receipt.

Validation is PR CI only; current-head checks are pending until GitHub reports them. This merge does not constitute a new native/AO run or promote historical fresh/restore/provider-role proof. Harness evidence stays on this integration PR; PR6509 remains reusable guidance and linked summaries.

[nikhilachale]

Canonical main and the green shared ACP replay CI budget reconciled at 988c6618d807, preserving previous source/evidence ancestry and every existing harness report/screenshot byte. Reconciliation receipt.

The shared test-only fix PR6617 had21 green applicable checks; this integration head still needs its own exact-head CI. The full20543-frame replay burst and exact-once assertions remain unchanged. No routine local suites ran. This merge does not constitute a new native/AO run or promote historical fresh/restore/provider-role proof. Harness evidence stays on this integration PR; PR6509 remains reusable guidance and linked summaries.

[nikhilachale]

Published, incomplete qualification — AO UI evidence BLOCKED; not merge-ready.

Head 24dc3ce57c8d53f63279b68ede76284ccab79487; main 54b28374912cb2771f17b8cc32a9482e6d607bce reconciled without force-push. Published 16 visually reviewed actual Electron screenshots with27 checkpoint rows. Real initial private/project effects, follow-up, witnessed Escape cancellation/no-late effect, idle Archive, same-native-ID/history restore and Kanban return were observed at787eaa74. The first ordinary restored continuation failed its fresh private-instruction effect. Manual onboarding/model UI and original per-image after-probe provenance remain incomplete; later diagnostics do not replace that failure.

Publication report · Full ordered report/checkpoint table

Images below are actual original captures from runtime/UI787eaa74, not the newer merged head. Sidecars, hashes, native digest, generations, functional receipts and original provenance limitations are linked in the full report.

Harness: installed/configured

Missing binary: manual install offer; no install progress

Installed unconfigured: setup guide return

New Task harness selection

Model menu loading frame; no manual entry proof

Project-configured model before submit

Original unsupported Auto failure

Separate bypass attempt: initial output/instruction effects

Actual native UI follow-up/result

Witnessed executing command before Escape

Empty composer after cancel; command box lags

Idle Archive confirmation

Exact terminated entry

Same native history: initialized restored composer

History continuation; fresh private witness FAIL

Same card back in Kanban

Exact publication-head CI is being checked separately below; old green heads do not qualify edited/merged source. No routine VPS tests, lint, typecheck, gofmt or CI emulator ran. Linux/provider evidence does not establish other OS/provider coverage. Original failures/profiles/logs remain intact privately. No skill6509 writes, production changes, merge, release or deployment.

Exact-head CI (2026-10-15T07:12:27.707215+00:00): complete at 24dc3ce57c8d53f63279b68ede76284ccab79487 — 25 SUCCESS (25 reported; 25 expected including the merged Go aggregate gate). Current checks. Mergeability MERGEABLE, merge state BLOCKED; draft handoff. CI does not qualify missing native/UI/provider/OS gates. Canonical main subsequently advanced to48c4ef5e with only two non-overlapping preview-process files; GitHub reports this head mergeable. These completed checks belong to the stated publication head, not a newly rebuilt merge with that later base.

[Prasad-D-Ware]

Requesting changes. I reviewed the diff at 24dc3ce5 without building or running it.

The design holds up well: it refuses to resume unless the history is provably this session's, and it checks the restored session's identity before the new terminal goes live. Below are the blockers and should-fix items; the inline comments have the details.

Blocking

1. Your own evidence shows restore failing. The PR body says "AO UI evidence BLOCKED; not merge-ready", and your run showed the first normal message after a restore without AO's instructions. Restoring with fresh instructions is the headline feature, so this needs a fix and a passing run before merge. Until then, please mark the PR as a draft.
2. Fresh restart always fails once a session has any history. See history.go:33.
3. On Windows, the lock check always errors. See history.go:87.
4. Evidence files and the proof CI workflow shouldn't merge. That's docs/research/** (68 files, 19 PNGs, including about 73 /home/azureuser paths) and .github/workflows/harness-proof-build.yml. docs/harnesses/mastra-code.md is fine to keep.

Should fix: model-mismatch restore lockout (history.go:123), decision markers matched in the transcript (activity.go:46), tracked .mastracode config edits (hooks.go:196), and the rejection of tasks that start with / or ! (mastracode.go:99).

Nits

• hooks.go:284: matching context.cwd against cfg.WorkspacePath can miss on macOS (/var vs /private/var), which would add another copy of the instructions on each restore.
• hooks.go:262: the comment says "without modifying native state", but the code calls session.state.set.
• AuthStatus reports configured whenever OPENAI_API_KEY or ANTHROPIC_API_KEY is set, which is common because other tools use them.
• serializedInput never drops entries for deleted sessions.
• The fx/opencode-v2 additions to reconcileHarnessConstraint are unrelated; please move them to their own PR.
• The PR description is hard to follow. Please cut it down to the current state, verification, and known gaps.