diff --git a/docs/current-state.md b/docs/current-state.md index 0b1882359..87627283d 100644 --- a/docs/current-state.md +++ b/docs/current-state.md @@ -5,7 +5,7 @@ Document type: current-state Owner: repository Canonical scope: state.repository Read when: determining the integrated baseline, open blockers or next repository work block -Last reviewed: 2026-08-26 +Last reviewed: 2026-08-28 This is the single operational ledger for the integrated baseline, blockers and immediate next work. Capability history belongs in [`roadmap.md`](roadmap.md); milestone detail belongs in its workstream/specification; release gates belong in [`releases/harness-0.5.md`](releases/harness-0.5.md). @@ -31,21 +31,31 @@ Q35-1 through Q35-5 are complete. Q35-6 remains active because the 0.8B/2B candi `apps/local-llm-phone-test` has connected Overview, Playground, Applications, Performance, Models, Diagnostics and Settings with real model/runtime/evaluation/observability/control-plane sources. Repository-side product-experience realignment is complete, including task-first navigation, progressive disclosure, evidence-backed Diagnostics/Performance behavior, adaptive/accessibility rules and ViewModel-owned async state/effects. -Applications control-plane implementation is complete through ACUX-80: Apps primary navigation; source-backed Application -> Assigned use case -> Preset drill-down; Suggested/Custom/default semantics; custom preset creation; revision-safe supported mutations with canonical re-read; Advanced/Technical disclosure; and medium/expanded master-detail with compact/large-font single-pane fallback. PR #449 passed Repository health, Validate and Package Android Artifacts on exact head `625747bcc6ef28a9cd0966a693550444fd4db1ed` before squash merge into `dev` as `d8caa3454c51c9c8e53ff3da95d31f7c3df6f1ed`. - -A persisted control-plane startup/upgrade regression is now active: current Binder discovery/activation can seed only an exactly empty store, so a partially populated but valid Room state may remain permanently incomplete. The bounded repair is tracked in [`workstreams/control-plane-state-reconciliation.md`](workstreams/control-plane-state-reconciliation.md). ACUX-90 is blocked until the reconciled exact-head repository candidate reaches CPREC-70. +Applications control-plane implementation is complete through ACUX-80. The subsequent control-plane persistence regression has also been repaired repository-side: CPREC-10 through CPREC-70 are integrated through PRs #455, #459, #457, #458, #460, #461 and #464. Startup now reconciles mandatory built-ins atomically before UI/Binder readers are exposed, preserves valid custom/default/disabled state, remains off the Android main thread and keeps Binder discovery/activation free of bootstrap mutation. CPREC-80/90 remain physical evidence gates; see [`workstreams/control-plane-state-reconciliation.md`](workstreams/control-plane-state-reconciliation.md). General phone work still includes process/back-stack evidence, representative TalkBack/large-font/layout/screenshots, RAM warm-idle policy/controls and signed physical-GGUF evidence. -### Shared Android runtime +### Shared Android runtime and Consumer readiness convergence SR-0 through SR-5 are integrated. SR-6 repository-side release-evidence tooling is integrated, including packaged-client, same-signer/invalid-signer and process-death/reconnect fixtures. Production/release readiness still requires representative physical SR-6 evidence. See [`shared-runtime/roadmap.md`](shared-runtime/roadmap.md) and [`shared-runtime/sr6-release-evidence.md`](shared-runtime/sr6-release-evidence.md). +The Consumer Runtime Visibility/Readiness convergence (CRV) is repository-complete through its automated candidate gate: + +- exact activated preset/execution identity and custom-preset model policy are integrated through #467/#468; +- the consumer-safe Binder readiness contract is integrated through #472 using Consumer SDK `0.1.0-alpha.6` and Binder protocol minor 4; +- activation-bound automatic runtime preparation and fail-closed no-global-fallback behavior are covered by #474; +- source-backed `IDLE / PREPARING / READY / GENERATING / FAILED` plus `LOADING / REUSING / SWITCHING` observation is wired through #475 without adding a second loader; +- Harness Applications runtime/readiness presentation is integrated through #476; +- focused runtime failure regression gaps are covered through #477; +- RedactGuard consumes the source-backed readiness lifecycle through its own integrated #100/#101 slices. + +CRV-100 froze the automated physical candidate identities as Harness v31 source `a30f67b21e24adc6efea838e9a9d65cc78446f28` and RedactGuard v11 source `4679c23a9a22e5242761fe52af97f4eb7432aec7`. Both have exact-source automated package evidence. Later CI/documentation-only descendants do not replace those frozen APK source identities. CRV-110 remains the real-device same-signer + real-GGUF gate; CRV-120 cleanup follows only after that evidence passes. + ### Public Consumer API and OMBRA -CA-0 through CA-4 are integrated in `dev`; PR #104 completed the Binder v1.1 `consumer-api-v1` boundary with consumer AIDL/wire contracts, authenticated host mapping, lifecycle/generation adapters, privacy/compatibility coverage and packaged release-AAR compilation evidence. +CA-0 through CA-4 are integrated in `dev`; the published consumer boundary has continued through the current Consumer SDK line used by CRV. RedactGuard remains a pure Consumer SDK client: concrete model/config/runtime/residency ownership stays in Harness and consumer surfaces receive only safe published state. -CA-5 is active through OMBRA. Repository-side preparation includes: +CA-5 remains active through the OMBRA/RedactGuard quality and evidence program. Repository-side preparation includes: - **OMB-0** — PdfBox parser/export decision and runtime evidence through PR #106; - **OMB-1** — pure domain/application workflow through PRs #107/#108; @@ -58,7 +68,7 @@ CA-5 is active through OMBRA. Repository-side preparation includes: - **OMB-8A** — active `ombra-pii-synthetic-v2` corpus with 32 cases and at least five positive exact occurrences per supported category through PRs #223/#253; - **OMB-8B** — pre-registered support-policy v1 through PR #252, pinned to corpus v2 identity/hash and required type set with fail-closed checks. -`apps/local-llm-console` no longer owns retired model-management, observability, health, cache or raw inference surfaces. OMB-7 still depends on approved OMB-6B production identity. OMB-6B remains review-gated in PR #248; OMB-8 has corpus/policy integrated but no model/category support claim until exact reviewed Qwen3.5 artifacts pass policy. Physical two-APK/device and release evidence remain open. Canonical state: [`shared-runtime/consumer-api/roadmap.md`](shared-runtime/consumer-api/roadmap.md) and [`shared-runtime/consumer-api/pii-redactor/roadmap.md`](shared-runtime/consumer-api/pii-redactor/roadmap.md). +`apps/local-llm-console` no longer owns retired model-management, observability, health, cache or raw inference surfaces. OMB-6B remains review-gated and OMB-8 has no model/category support claim until exact reviewed Qwen3.5 artifacts pass policy. Physical two-APK/device and release evidence remain open. Canonical state: [`shared-runtime/consumer-api/roadmap.md`](shared-runtime/consumer-api/roadmap.md) and [`shared-runtime/consumer-api/pii-redactor/roadmap.md`](shared-runtime/consumer-api/pii-redactor/roadmap.md). ### Model evaluation @@ -74,33 +84,36 @@ PR #248 contains a review-gated symbol candidate, not approved production identi Corpus v2 and policy v1 are integrated and identity-bound. Before any Qwen3.5 support claim, execute each reviewed artifact/configuration, evaluate aggregate/per-type precision/recall/F1 plus structured-completion and invalid-result/finding rates, preserve exact identities and fail closed on threshold/category/identity failure. Policy v1 must not be lowered to fit observed results. -### 3. Persisted control-plane reconciliation +### 3. Physical control-plane / CRV evidence + +The persisted control-plane repair and Consumer runtime-readiness convergence are implemented and automatically validated. What remains is representative-device evidence, not repository implementation. -The current host bootstrap mutates persistent state from Binder-path discovery/activation and only seeds when the entire `HostControlPlaneState` is empty. Partial valid state can therefore survive upgrades/restarts without mandatory built-in application/use-case/preset/binding/exposure data. Repair must be atomic, conservative and idempotent; preserve unrelated/custom/disabled/default state; fail closed on conflicting built-in identity; and complete before UI or Binder observation. CPREC-10 and CPREC-20 are the first parallel implementation slices; physical Applications/HCP proof waits for CPREC-70. +A physical session must use same-signer release APKs built from the frozen Harness v31 and RedactGuard v11 source identities and a real GGUF. CRV-110 must prove Host absence/reconnect, exact assignment/preset activation, automatic cold preparation, source-backed ready/generating state, cancellation/recovery, Host restart, relevant fail-closed paths, review/export and privacy-safe evidence. CPREC-80 must additionally prove upgrade repair without uninstall/clear-data; CPREC-90/ACUX-90 may share the clean two-APK session where their independent acceptance criteria are all recorded. -### 4. Physical Android evidence +CI, packaging and emulator evidence must not be reported as this physical gate. -Hardware sessions may combine phone UX, ACUX-90, Q35-6, SR-6 and OMB-8 runs, but each exit gate stays independent. ACUX-90 specifically requires persisted default after Harness restart, real consumer discovery/activation/use of the exact app/use-case/binding/preset identity and a stale/invalid fail-closed path. ACUX-90 cannot start until the reconciled CPREC-70 candidate exists. +### 4. Other representative Android evidence -Do not claim representative-device UX, external-consumer Applications effectiveness, `MEASURED` Q35 profiles, publish-ready Binder client AAR or production-ready OMBRA/shared-host transport from CI/emulator evidence alone. +Hardware sessions may also combine phone UX, Q35-6, SR-6 and OMB-8 execution where practical, but each exit gate remains independent. Do not claim representative-device UX, `MEASURED` Q35 profiles, production-ready OMBRA/shared-host transport or physical Consumer readiness from CI/emulator evidence alone. ### 5. Follow-on validation and product hardening -Repository-side UX/UI, including Applications through ACUX-80, is complete. Remaining phone work is device/restoration evidence plus the separately scoped RAM warm-idle policy. After Q35-6, Q35-7 covers semantic/golden, context-boundary, cancellation, lifecycle, memory and thermal validation. +Repository-side UX/UI and CRV runtime visibility are complete. Remaining phone work includes device/restoration evidence plus the separately scoped RAM warm-idle policy. After Q35-6, Q35-7 covers semantic/golden, context-boundary, cancellation, lifecycle, memory and thermal validation. ## Immediate next block -1. execute CPREC-10 canonical built-in spec/reconciler and CPREC-20 Room partial-state persistence tests in parallel; -2. after the reconciliation contract settles, execute CPREC-30 startup composition cutover and CPREC-40 regression matrix in parallel, then close CPREC-50/70 exact-head integration; -3. complete OMB-6B identity review and deterministic launcher assets, and continue OMBRA corpus v2 quality execution independently where ownership does not conflict; -4. on the CPREC-70 candidate, run upgrade-repair evidence and clean two-APK HCP/ACUX evidence, then resume ACUX-90; -5. run Q35-6, SR-6 and broader phone UX evidence in parallel where hardware can be shared; -6. complete release privacy/security, packaging, versioning/signing and documentation checks on the exact build. +1. build same-signer release APKs from the frozen Harness v31 and RedactGuard v11 source revisions using their repository release helpers; +2. execute CRV-110 / RG-HCP-8 on a representative ARM64 Android device with a real GGUF, recording the exact candidate identity and privacy-safe evidence; +3. in the same hardware window where appropriate, execute CPREC-80 upgrade-repair first and then the clean CPREC-90/ACUX-90 path without collapsing their independent acceptance criteria; +4. keep OMB-6B review, OMB-8 quality execution, Q35-6, SR-6 and broader phone UX evidence parallel where their ownership does not conflict; +5. after CRV-110 passes, perform CRV-120 durable handoff/cleanup and close the temporary CRV coordinator rather than merging its stale planning branch; +6. complete release privacy/security, packaging, versioning/signing and documentation checks on the exact promoted build when a release promotion is intentionally requested. ## Source links - Capability roadmap: [`roadmap.md`](roadmap.md) - Applications UX: [`features/application-control-plane-ux.md`](features/application-control-plane-ux.md), [`workstreams/application-control-plane-ux.md`](workstreams/application-control-plane-ux.md) +- Control-plane reconciliation: [`workstreams/control-plane-state-reconciliation.md`](workstreams/control-plane-state-reconciliation.md) - Model evaluation: [`model-evaluation/README.md`](model-evaluation/README.md) - Consumer API / OMBRA: [`shared-runtime/consumer-api/roadmap.md`](shared-runtime/consumer-api/roadmap.md), [`shared-runtime/consumer-api/pii-redactor/roadmap.md`](shared-runtime/consumer-api/pii-redactor/roadmap.md) - Shared runtime: [`shared-runtime/roadmap.md`](shared-runtime/roadmap.md), [`shared-runtime/sr6-release-evidence.md`](shared-runtime/sr6-release-evidence.md) diff --git a/docs/workstreams/control-plane-state-reconciliation.md b/docs/workstreams/control-plane-state-reconciliation.md index efd66d2ab..e04606158 100644 --- a/docs/workstreams/control-plane-state-reconciliation.md +++ b/docs/workstreams/control-plane-state-reconciliation.md @@ -5,102 +5,70 @@ Document type: workstream-state Owner: apps/local-llm-phone-test + models/control-plane-room-store Canonical scope: workstream.control-plane-state-reconciliation Read when: implementing or coordinating persisted Harness control-plane bootstrap, repair and upgrade safety -Last reviewed: 2026-08-26 +Last reviewed: 2026-08-28 + +Repository implementation is complete; physical evidence remains pending. Operational repository state: [`docs/current-state.md`](../current-state.md). ## Goal Make the persisted Harness control plane converge at process startup to the mandatory built-in application/use-case/preset graph before either Apps UI or Binder consumers can observe it, while preserving valid user state, remaining idempotent across restarts/upgrades and failing closed on conflicting built-in identity. -## Non-goals - -- no RedactGuard protocol/API redesign; -- no phone-global model fallback or implicit model selection/load/download/inference; -- no destructive database reset to repair partial state; -- no silent re-enable of explicitly disabled valid bindings or replacement of a valid user-selected default; -- no Room schema bump unless implementation evidence proves provenance cannot be handled safely with current identities; -- no claim that CI/emulator evidence proves upgrade or two-APK physical behavior. - ## Invariants -- `HarnessRuntimeGraph` remains the single process-scoped owner of the Room control-plane store shared by UI and service surfaces; -- Binder discovery/activation reads do not seed or repair persistent state as a side effect; -- reconciliation is atomic, deterministic and idempotent: a second pass over a reconciled state is an exact semantic no-op; -- missing mandatory built-in state may be reconstructed; incompatible built-in identity fails closed instead of being overwritten; -- unrelated applications, custom presets, valid defaults, timestamps and explicit disabled state are preserved; -- external consumers still require explicit application/use-case activation; no global selected-model fallback returns; -- prompts, generated content and private document data never enter reconciliation diagnostics/evidence. +- `HarnessRuntimeGraph` remains the single process-scoped owner of the Room control-plane store shared by UI and service surfaces. +- Binder discovery/activation reads do not seed or repair persistent state as a side effect. +- Reconciliation is atomic, deterministic and idempotent; a second pass over reconciled state is a semantic no-op. +- Missing mandatory built-in state may be reconstructed; incompatible built-in identity fails closed instead of being overwritten. +- Unrelated applications, custom presets, valid defaults, timestamps and explicit disabled state are preserved. +- External consumers require explicit application/use-case activation; there is no phone-global selected-model fallback. +- Reconciliation diagnostics/evidence never contain prompts, generated content or private document data. ## Work graph -| ID | Work | Owns/writes | Depends on | Parallel | State | -| --- | --- | --- | --- | --- | --- | -| CPREC-00 | Freeze root cause, scope, invariants and execution DAG | this workstream + state links only | — | — | DONE | -| CPREC-10 | Canonical built-in control-plane spec + pure reconciliation contract/algorithm | new app-owned built-in spec/reconciler sources + focused unit tests | CPREC-00 | CPREC-20 | READY | -| CPREC-20 | Persistence/atomicity/reopen regression harness for partial v2 state | `models/control-plane-room-store/src/androidTest/**` new/isolated tests and fixtures only | CPREC-00 | CPREC-10 | READY | -| CPREC-30 | Cut startup composition over to reconciliation and remove Binder-path seeding | `HarnessRuntimeGraph.kt`, `HarnessSharedRuntimeService.kt`, `HarnessConsumerControlPlaneHost.kt` + direct tests | CPREC-10 | CPREC-40 | BLOCKED | -| CPREC-40 | Build app-level regression matrix against the settled reconciliation contract | new/isolated phone-app test files/fixtures only; no production sources | CPREC-10 | CPREC-30 | BLOCKED | -| CPREC-50 | Prove UI gateway and Binder discovery/activation observe one reconciled canonical graph | new integration tests across Applications gateway + consumer control-plane host | CPREC-20, CPREC-30, CPREC-40 | — | BLOCKED | -| CPREC-70 | Integrate current `dev`, run cumulative exact-head repository gates and produce signed candidate | integration branch, validation/packaging metadata only | CPREC-50 | — | BLOCKED | -| CPREC-80 | Physical upgrade-repair proof without uninstall/clear-data | device evidence/runbook output only | CPREC-70 | CPREC-90 logically; serialize on one device | BLOCKED | -| CPREC-90 | Clean physical two-APK HCP/ACUX proof on the repaired candidate | device evidence/runbook output only | CPREC-70 | CPREC-80 logically; serialize on one device | BLOCKED | -| CPREC-100 | Transfer durable behavior/evidence, unblock dependent work and delete temporary workstream | durable docs/current-state + workstream cleanup | CPREC-80, CPREC-90 | — | BLOCKED | +| ID | Work | Evidence | State | +| --- | --- | --- | --- | +| CPREC-00 | Scope, invariants and execution DAG | #451 | DONE | +| CPREC-10 | Canonical built-in spec + pure reconciliation | #455 | DONE | +| CPREC-20 | Room partial-state persistence/atomicity/reopen regression | #459; #456 retained as superseded historical evidence | DONE | +| CPREC-30 | Startup composition cutover; remove Binder-path seeding | #457 | DONE | +| CPREC-40 | Upgrade/reconciliation regression matrix | #458 | DONE | +| CPREC-50 | Cross-surface Applications/Binder consistency | #460 | DONE | +| CPREC-60 | Main-thread startup regression correction | #461 | DONE | +| CPREC-70 | Integrated reconciled Harness candidate and automated gates | #464 v30; superseded for the shared physical session by CRV Harness v31 | DONE | +| CPREC-80 | Physical upgrade-repair proof without uninstall/clear-data | representative ARM64 device | READY | +| CPREC-90 | Clean physical two-APK HCP/ACUX proof | shared CRV-110 physical session where acceptance criteria overlap | READY | +| CPREC-100 | Durable handoff and temporary workstream cleanup | CPREC-80 + CPREC-90 | BLOCKED | Allowed states: `READY`, `ACTIVE`, `BLOCKED`, `DONE`. -Parallel work has explicit non-conflicting write ownership. CPREC-10 and CPREC-20 may start immediately. After CPREC-10 fixes the integration contract, CPREC-30 production composition and CPREC-40 tests may proceed in parallel. CPREC-80 and CPREC-90 are logically independent evidence gates but cannot execute simultaneously on the same physical device. - -## Current executable slices - -`CPREC-10` and `CPREC-20`. - -### CPREC-10 acceptance - -- one canonical app-owned definition supplies mandatory built-in application/use-case/preset/binding/exposure identities; -- reconciliation distinguishes missing state from incompatible built-in identity; -- missing built-ins are merged conservatively without replacing unrelated state; -- explicit disabled state and valid user-selected defaults remain unchanged; -- repeated reconciliation does not create revisions, duplicate entities or timestamp churn; -- no Room/app transport types leak into the pure reconciliation contract. - -Validation: - -- focused `:models:model-profile` and phone-app unit tests covering canonical-state invariants and reconciliation behavior. - -### CPREC-20 acceptance - -- a Room v2 database can be opened with representative partial control-plane state; -- transaction/reopen tests prove no partial write is exposed after failure and a successful reconciled state persists across close/reopen; -- the generic Room module remains free of Harness/RedactGuard built-in policy. - -Validation: +## Integrated repository behavior -- `:models:control-plane-room-store` instrumented migration/store tests on emulator/device-capable CI where available; host-side checks remain preflight only. +Repository-side reconciliation is no longer a planned repair. Current `dev` already owns the fix: -## Required regression matrix +- a canonical Harness-owned built-in graph defines mandatory application/use-case/preset/binding/exposure identities; +- startup performs conservative atomic reconciliation before UI/Binder readers are exposed; +- valid custom/default/disabled state is preserved and incompatible built-in identity fails closed; +- startup persistence work stays off the Android main thread while remaining a readiness barrier; +- Binder discovery/activation is read-only with respect to bootstrap/repair; +- Applications and the consumer control-plane host read the same reconciled persisted graph; +- Room close/reopen, rollback, idempotence and cross-surface consistency are covered by deterministic repository tests. -Repository tests must cover at least: empty state; application present but PII graph absent; use case present but binding absent; binding present but exposure absent; unrelated app/custom preset preservation; valid custom/default preservation; explicit disabled-state preservation; exact second-pass no-op; conflicting built-in identity fail-closed; Room close/reopen persistence; Apps gateway and Binder discovery seeing the same app/use-case/binding/preset identity. +The original CPREC v30 candidate established post-reconciliation lineage. CRV subsequently produced Harness v31 at source `a30f67b21e24adc6efea838e9a9d65cc78446f28`, which includes the integrated CPREC behavior plus the converged runtime-readiness work and is the current frozen Harness source for the shared physical two-APK session. -## Integration points +## Remaining physical evidence -- `HarnessBuiltInControlPlaneSpec` (name may vary) is app-owned policy; the generic Room store persists state but does not know built-in semantics. -- `HarnessControlPlaneReconciler` (name may vary) operates on neutral `HostControlPlaneState`/`HostControlPlaneStore` contracts and returns a bounded success/no-op/conflict outcome. -- `HarnessRuntimeGraph.from(...)` completes reconciliation before exposing the process-scoped graph; service/UI do not open a parallel database owner. -- `HarnessConsumerControlPlaneHost` becomes discovery/activation only; no `ensureSeeded()` or equivalent persistent mutation remains in read paths. -- If CPREC-10 proves current identities cannot safely distinguish preserve-vs-conflict semantics, stop and explicitly re-plan a schema/provenance slice plus migration tests instead of adding an opportunistic Room v3 migration. +### CPREC-80 — upgrade repair -## Physical evidence gates +Install the signed Harness candidate over representative pre-reconciliation persisted state **without uninstall or clear-data**. Prove that mandatory built-ins are repaired while already-installed GGUF, unrelated/custom state, valid defaults and explicit disabled state remain intact. A conflict must fail closed rather than reset or overwrite state. -CPREC-80 must install the new signed Harness candidate over the existing application without uninstall or clear-data, then prove Apps/RedactGuard assignment recovery while already-installed GGUF and valid persisted configuration remain intact. +### CPREC-90 — clean two-APK path -CPREC-90 then runs the clean same-signer two-APK path and proves persisted default after Harness restart, real consumer discover/activate/infer with exact application/use-case/binding/preset identity, and stale/invalid fail-closed behavior. Existing ACUX-90/HCP evidence may be satisfied only by exact candidate evidence that meets their independent criteria. +On a clean target, prove persisted default after Harness restart plus real RedactGuard discovery, activation and inference against the exact application/use-case/binding/preset identity, including a stale/invalid fail-closed path. -## Durable documentation destinations +CPREC-90 may share one physical session with CRV-110 / RG-HCP-8 / ACUX-90 where the exact candidate and scenario satisfy each gate independently. Shared execution does not collapse their acceptance criteria. -- `docs/architecture.md`: startup/control-plane ownership only if the durable lifecycle description changes materially; -- `docs/features/application-control-plane-ux.md`: durable user-visible/effective behavior if Apps semantics change; -- `docs/current-state.md`: blocker/next-action status and final evidence result, not implementation diary; -- tests/contracts: executable truth for idempotence, preservation, conflict and cross-surface consistency. +CI, emulator and package evidence do not satisfy CPREC-80/90. ## Completion -The workstream is complete only when repository behavior, persistence/restart behavior, exact-head validation, upgrade-repair physical evidence, clean two-APK evidence and durable documentation agree. Then update dependent ACUX/HCP state, remove the temporary current-state link and delete this file by default. +After CPREC-80 and CPREC-90 pass on one recorded exact identity set, transfer the evidence to durable current-state/feature owners, reconcile dependent ACUX/HCP state, and remove this temporary workstream by default.