Have something to say?
Фича: панель результатов агента в стиле Claude Artifacts (GitHub #271)
## Что это ## Резюме (RU) Фича: панель результатов агента в стиле Claude Artifacts (GitHub #271) *Полный перевод тела — в работе. Английский оригинал ниже.* --- # Original (EN) ### Objective Deliver the Claude Artifacts-style right-side resizable result panel for ROX.ONE conversations, with versioned artifact entities, Preview/Code modes, and sandboxed rendering. ### Source Links * GitHub issue: [https://github.com/agisota/rox.one/issues/271]() * GitHub PR: None yet * GitHub branch: Pending implementation branch * GitHub Project item: GitHub Project #9 / rox board * DeepWiki/repo context: [https://deepwiki.com/agisota/rox.one]() * Local branch / cwd: /Users/marklindgreen/Projects/rox-one-terminal-pr264-fix ### Current State GitHub #271 is open and present on GitHub Project #9 with status Todo. Linear PZD-10 is the existing synced feature for this work. Implementation is paused until this Linear-first intake is complete. ### Requirements Functional: resizable right-side panel, artifact entity with id/conversationId/type/title/content/versions, Preview and Code modes, Copy/Download/Fullscreen/Close, update current artifact instead of duplicating. Security: render HTML/interactive UI in sandbox iframe with no token/cookie/main-app access. UX: fit current ROX.ONE design and avoid layout regressions. Performance: panel should not slow chat/session startup. Compatibility: keep existing conversations and current chat flows working. ### Specification * Affected surfaces/components/modules: Electron chat workspace, conversation state/store, artifact panel UI, artifact preview renderer, artifact version controls, download/copy handlers. * Data model/API/storage changes: add artifact record shape with id, conversationId, type, title, content, versions; define migration or backward-compatible default if persisted config/session storage changes. * UI behavior and states: closed, open, resizing, Preview, Code, fullscreen, loading, empty, error, updated-version available. * Error handling: malformed artifact content renders a contained error state; sandbox load failure does not crash the main chat. * Edge cases: repeated agent edits update current artifact; large content remains scrollable; unsafe HTML cannot escape iframe. * Telemetry/logging/observability: log contained preview failures without leaking artifact content or secrets. * Backwards compatibility: exist... ## Статус Это задача из текущего backlog'а ROX.ONE (Linear). Текущий статус в Linear: `На ревью — In Review`. Метки: `Фича` / `Feature`, `Улучшение` / `Improvement`. ## 🔗 Linear - [PZD-10](https://linear.app/kuhjie/issue/PZD-10/ficha-panel-rezultatov-agenta-v-stile-claude-artifacts-github-271) — backing ticket - Parent epic: [PZD-116](https://linear.app/kuhjie/issue/PZD-116)
Документация рабочего процесса агентов V4 DeepWiki/Graphify и пакет нативных маппингов
## Что это ## Резюме (RU) Документация рабочего процесса агентов V4 DeepWiki/Graphify и пакет нативных маппингов *Полный перевод тела — в работе. Английский оригинал ниже.* --- # Original (EN) ### Objective Make the user’s v4 product/architecture plan usable by future agents by mapping it to repo-native docs, DeepWiki/Graphify evidence rules, execution goals, tickets, and worklogs. ### Source Links * GitHub issue: [https://github.com/agisota/rox.one/issues/271]() * GitHub PR: none yet * GitHub branch: `feat/rox-design-clean` * GitHub Project item: [https://github.com/users/agisota/projects/9]() (API update blocked by current PAT: `user.projectV2` not accessible) * DeepWiki/repo context: [https://deepwiki.com/agisota/rox.one]() * Local branch / cwd: `feat/rox-design-clean` / `/home/dev/craft/rox-one-terminal` * Parent Linear issue: PZD-10 * Local Graphify artifact: `/home/dev/craft/rox-one-graphify-deepwiki-2026-05-20/source/graphify-out/graph.json` ### Current State Completed in commit `15b2c85e`. Files added/updated include `AGENTS.md`, `.devin/wiki.json`, `docs/architecture/graphify-deepwiki-agent-workflow.md`, `ROX_ONE_V4_NATIVE_MAPPING.md`, `ROX_ONE_V4_AGENT_WORKFLOW.md`, `ROX_ONE_V4_EXECUTION_GOALS.md`, and tickets/worklogs T538/T539/T540. ### Requirements Docs must distinguish navigation evidence from runtime proof. DeepWiki and Graphify are orientation layers; source inspection and tests remain final proof. Instructions must cover how agents ask code questions, trace modules, debug, use Graphify UI/static artifacts, update the graph, and plan implementation. ### Specification * Add Graphify/DeepWiki workflow to AGENTS.md. * Store DeepWiki index pointer in `.devin/wiki.json`. * Provide architecture docs for native mapping, agent workflow, and execution goals. * Create tickets/worklogs so repo validation recognizes the work. * Keep Graphify as local structural evidence, not product runtime behavior. ### Acceptance Criteria * Given a future agent needs code orientation, when it reads AGENTS.md, then it finds local DeepWiki/Graphify artifacts and an evidence ladder. * Given a v4 wishlist item is broad, when mapping starts, then the agent can locate concrete modules/files and execution goals. * Given Graphify/DeepWiki disagree with source, when deciding implementation, then source/tests win. * Given do... ## Статус Это задача из текущего backlog'а ROX.ONE (Linear). Текущий статус в Linear: `На ревью — In Review`. Метки: —. ## 🔗 Linear - [PZD-14](https://linear.app/kuhjie/issue/PZD-14/dokumentaciya-rabochego-processa-agentov-v4-deepwikigraphify-i-paket) — backing ticket - Parent epic: [PZD-116](https://linear.app/kuhjie/issue/PZD-116)
Общий схема-контракт `AgentAnswerPackage` для структурированных выходных данных агентов
## Что это ## Резюме (RU) Общий схема-контракт `AgentAnswerPackage` для структурированных выходных данных агентов *Полный перевод тела — в работе. Английский оригинал ниже.* --- # Original (EN) ### Objective Introduce a typed shared schema for agent answers so future artifacts, notes, tasks, retrieval traces, audit metadata, and memory promotion can be handled as structured packages instead of markdown-only chat messages. ### Source Links * GitHub issue: [https://github.com/agisota/rox.one/issues/271]() * GitHub PR: none yet * GitHub branch: `feat/rox-design-clean` * GitHub Project item: [https://github.com/users/agisota/projects/9]() (API update blocked by current PAT: `user.projectV2` not accessible) * DeepWiki/repo context: [https://deepwiki.com/agisota/rox.one]() * Local branch / cwd: `feat/rox-design-clean` / `/home/dev/craft/rox-one-terminal` * Parent Linear issue: PZD-10 * Local Graphify artifact: `/home/dev/craft/rox-one-graphify-deepwiki-2026-05-20/source/graphify-out/graph.json` ### Current State Completed in commit `15b2c85e`. Added `packages/shared/src/workbench/answer-package.ts`, exported it from `packages/shared/src/workbench/index.ts`, and added `packages/shared/src/workbench/__tests__/answer-package.test.ts`. ### Requirements Schema must be strict enough for downstream runtime use but not wire into active artifact/session surfaces yet because parallel artifact-panel work owns those files. It must avoid leaking full markdown/content from summary helpers. Confidence uses repo-native 0..100 percent scale. ### Specification * Define Zod schemas/types for AgentAnswerPackage, NoteDraft, BlockDraft, TaskDraft, AgentRunDraft, RetrievalTrace, ToolUse, ContextRef, SourceRef, and related primitives. * Provide `createAgentAnswerPackage(input)` parser and `summarizeAgentAnswerPackage(package)` safe summary. * Export from shared workbench index. * Keep compatibility by adding only new shared exports; no runtime behavior change yet. ### Acceptance Criteria * Given a complete structured answer package, when parsed, then schema accepts it and preserves typed fields. * Given invalid confidence or empty promptId, when parsed, then schema rejects it. * Given caller input, when `createAgentAnswerPackage` runs, then caller input is not mutated. * Given summary generation, when called, then it returns counts/m... ## Статус Это задача из текущего backlog'а ROX.ONE (Linear). Текущий статус в Linear: `На ревью — In Review`. Метки: —. ## 🔗 Linear - [PZD-15](https://linear.app/kuhjie/issue/PZD-15/obshij-shema-kontrakt-agentanswerpackage-dlya-strukturirovannyh) — backing ticket - Parent epic: [PZD-116](https://linear.app/kuhjie/issue/PZD-116)
Открыть PR и синхронизировать метаданные GitHub issue/project для пакета docs/schema v4
## Что это ## Резюме (RU) Открыть PR и синхронизировать метаданные GitHub issue/project для пакета docs/schema v4 *Полный перевод тела — в работе. Английский оригинал ниже.* --- # Original (EN) ### Objective Turn local commit `15b2c85e` into a reviewable PR, link it to GitHub #271/PZD-10, and align GitHub Project #9 metadata once an authorized token can access ProjectV2 fields. ### Source Links * GitHub issue: [https://github.com/agisota/rox.one/issues/271]() * GitHub PR: none yet * GitHub branch: `feat/rox-design-clean` * GitHub Project item: [https://github.com/users/agisota/projects/9]() (API update blocked by current PAT: `user.projectV2` not accessible) * DeepWiki/repo context: [https://deepwiki.com/agisota/rox.one]() * Local branch / cwd: `feat/rox-design-clean` / `/home/dev/craft/rox-one-terminal` * Parent Linear issue: PZD-10 * Local Graphify artifact: `/home/dev/craft/rox-one-graphify-deepwiki-2026-05-20/source/graphify-out/graph.json` ### Current State No PR currently exists for `feat/rox-design-clean` (`gh pr list --head feat/rox-design-clean` returned `[]`). GitHub #271 is open and already has an initial Linear sync comment linking PZD-10. Current PAT can view/update issues but cannot access ProjectV2 fields (`user.projectV2` blocked). ### Requirements PR must be scoped to docs/schema/intake work, not runtime artifact wiring. GitHub issue/PR must backlink Linear children. GitHub Project fields should be aligned when API access exists. PR description should include validation and remaining Graphify/full-build gaps. ### Specification * Push branch if desired by operator. * Open PR from `feat/rox-design-clean` or split to a dedicated branch if branch contains unrelated earlier commits. * Add PR/issue backlinks to Linear child issues. * Add GitHub issue comment linking Linear child issues. * Update Project #9 fields when token has access: Status, PRIORITY, VOLUME, НАПРАВЛЕНИЕ РАБОТЫ. ### Acceptance Criteria * Given local commit exists, when PR opens, then PR links PZD-10 and relevant Linear child issues. * Given ProjectV2 token lacks access, when syncing project fields, then the blocker is recorded instead of silently ignored. * Given branch contains 7 ahead commits, when opening PR, then PR scope is reviewed for unrelated commits before merge. * Given checks run, when review starts, then validat... ## Статус Это задача из текущего backlog'а ROX.ONE (Linear). Текущий статус в Linear: `На ревью — In Review`. Метки: —. ## 🔗 Linear - [PZD-17](https://linear.app/kuhjie/issue/PZD-17/otkryt-pr-i-sinhronizirovat-metadannye-github-issueproject-dlya-paketa) — backing ticket - Parent epic: [PZD-116](https://linear.app/kuhjie/issue/PZD-116)
PR панели артефактов, синхронизация с GitHub Project и UI-подтверждение
## Что это ## Резюме (RU) PR панели артефактов, синхронизация с GitHub Project и UI-подтверждение *Полный перевод тела — в работе. Английский оригинал ниже.* --- # Original (EN) ### Objective ``` Close the remaining delivery loop for PZD-10/#271 by publishing the current branch, opening or updating the PR, aligning GitHub Project #9, and capturing UI/security proof before review. ### Source Links - GitHub issue: https://github.com/agisota/rox.one/issues/271 - GitHub PR: https://github.com/agisota/rox.one/pull/296 (draft, conflicting; traceability only) - GitHub branch: https://github.com/agisota/rox.one/tree/feat/rox-design-clean - GitHub Project item: https://github.com/users/agisota/projects/9 - DeepWiki/repo context: https://deepwiki.com/agisota/rox.one - Local branch / cwd: `feat/rox-design-clean` / `/home/dev/craft/rox-one-terminal` ### Current State No PR currently exists for `feat/rox-design-clean` according to `gh pr list --head feat/rox-design-clean`. The branch is locally ahead of origin and contains commit `805e1f6a` for #271 plus other local commits. Artifact implementation tests/build passed locally, but review evidence and GitHub Project fields are not yet updated. ### Requirements Functional: PR must describe artifact storage/RPC/UI/sandbox scope. Security: PR must call out iframe sandbox without same-origin and no token/cookie access. UX: include screenshot/trace of right panel, resize, Preview/Code, fullscreen, close. Compatibility: state branch stack and conflicts. PM: link PZD-10, GitHub #271, branch, Project #9 fields. ### Specification Affected surfaces: GitHub PR, GitHub issue #271 comments, GitHub Project #9 fields, Linear PZD-10 verification evidence. Error handling: if push/PR/project API fails, record exact failed API surface without secrets. Edge cases: branch has multiple commits; PR body must separate #271 from T538/T539/T540 and earlier design/security commits. ### Acceptance Criteria - Given Linear intake is complete, When branch is pushed, Then a PR exists or an existing PR is updated. ``` * Given PR exists, When GitHub #271 is viewed, Then it links to PZD-10 and the PR. * Given Project #9 item is available, When fields are editable, Then Status/PRIORITY/VOLUME/НАПРАВЛЕНИЕ РАБОТЫ reflect #271. * Given UI smoke runs, When artifact panel opens, Then screenshots/traces prove layout and sandbox behavior. * Given a failure, When an API/check fails, Then Linear evidence records the failed surface and next rec... ## Статус Это задача из текущего backlog'а ROX.ONE (Linear). Текущий статус в Linear: `На ревью — In Review`. Метки: —. ## 🔗 Linear - [PZD-35](https://linear.app/kuhjie/issue/PZD-35/pr-paneli-artefaktov-sinhronizaciya-s-github-project-i-ui) — backing ticket - Parent epic: [PZD-116](https://linear.app/kuhjie/issue/PZD-116)
T539: полировка встроенного нативного интерфейса Rox Design
## Что это ## Резюме (RU) T539: полировка встроенного нативного интерфейса Rox Design *Полный перевод тела — в работе. Английский оригинал ниже.* --- # Original (EN) ### Objective Make the embedded Rox Design/Open Design surface feel like a native ROX.ONE screen, not a nested foreign app. This matters because the current visual state is confusing: ROX navigation, Rox Design host chrome, and Open Design internal chrome compete on the same screen. ### Source Links * GitHub issue: [https://github.com/agisota/rox.one/issues/271]() * GitHub PR: none yet * GitHub branch: codex/rox-design-native-skin-checkpoint-20260519 * GitHub Project item: [https://github.com/users/agisota/projects/9]() * DeepWiki/repo context: [https://deepwiki.com/agisota/rox.one]() * Local branch / cwd: codex/rox-design-native-skin-checkpoint-20260519 / /Users/marklindgreen/Projects/rox-one-terminal-rox-design * Parent roadmap item: PZD-10 [PZD-10](https://linear.app/id-2/issue/PZD-10/feature-claude-artifacts-style-agent-result-panel-github-271) ### Current State * Current active task: polish Rox Design native embedding after user visual feedback: "Пока что кривенько встроили". * Last completed meaningful action: current branch/worktree/diff were preserved; no reset/checkout/destructive command was run after the Linear-first directive. * Files currently touched locally: apps/electron/src/main/**tests**/rox-design-view-manager.test.ts; apps/electron/src/main/rox-design-embed-skin.ts; apps/electron/src/renderer/components/app-shell/AppShell.tsx; apps/electron/src/renderer/components/app-shell/MainContentPanel.tsx; apps/electron/src/renderer/components/app-shell/TopBar.tsx; apps/electron/src/renderer/pages/rox-design/RoxDesignPage.rtl.test.tsx; apps/electron/src/renderer/pages/rox-design/RoxDesignPage.tsx; scripts/electron-ui-smoke-packaged-mac.ts; apps/electron/src/renderer/components/app-shell/design-surface-policy.ts; apps/electron/src/renderer/components/app-shell/**tests**/design-surface-policy.test.ts; docs/tickets/T539-rox-design-native-embed-polish.md; docs/worklog/T539-rox-design-native-embed-polish.md. * Completed tests before this intake: targeted main helper test, design shell policy test, and RoxDesignPage RTL test passed in the previous implementation pass. * Observed behavior: initial packaged smoke captured blank ROX host screensho... ## Статус Это задача из текущего backlog'а ROX.ONE (Linear). Текущий статус в Linear: `В работе — In Progress`. Метки: —. ## 🔗 Linear - [PZD-39](https://linear.app/kuhjie/issue/PZD-39/t539-polirovka-vstroennogo-nativnogo-interfejsa-rox-design-t539-polish) — backing ticket - Parent epic: [PZD-116](https://linear.app/kuhjie/issue/PZD-116)
PRD совместимости UX нативного аддона ROX.ONE Open-Design
## Что это ## Резюме (RU) PRD совместимости UX нативного аддона ROX.ONE Open-Design *Полный перевод тела — в работе. Английский оригинал ниже.* --- # Original (EN) ### Objective Create an evidence-backed UI/UX compatibility PRD for making the integrated Open-Design experience feel like a native ROX.ONE add-on rather than a third-party insertion. This matters because GitHub #271 requires artifact-style UI that fits the existing ROX.ONE design system, panel model, sandbox/trust boundaries, and desktop-native behavior. ### Source Links * GitHub issue: [https://github.com/agisota/rox.one/issues/271]() * GitHub PR: none yet * GitHub branch: [https://github.com/agisota/rox-one-terminal/tree/mac/session-startup-switch-performance]() * GitHub Project item: [https://github.com/users/agisota/projects/9]() * DeepWiki/repo context: [https://deepwiki.com/agisota/rox.one]() * Local branch / cwd: mac/session-startup-switch-performance / /Users/marklindgreen/Projects/rox-one-terminal * Local repo remote observed: [https://github.com/agisota/rox-one-terminal.git]() ### Current State Current implementation work was stopped before source edits for this task. Existing worktree already had unrelated dirty state before this intake: modified .agents skills, .omc/project-memory.json, .omc/state/subagent-tracking.json, and many untracked .agents/skills entries. No reset, checkout, force-push, branch deletion, or destructive cleanup was performed. Observed app and code context: * Installed app launched from /Applications/ROX ONE.app as ROX.ONE version 1.0.0-rc.7. * Live UI screenshot captured: /Users/marklindgreen/.ai-agent-hub/evidence/playwright-smoke/rox-one-open-design-native-ux/rox-one-active-screen.png. * Current main UI has a macOS-style Electron window, compact left global navigation, nested session/status/source/skill/automation sidebar, multi-panel center workspace, ROX Experience HUD chips, bottom composer, model/backend dropdown, source selector, and task/action controls. * Inspected key files: apps/electron/src/renderer/App.tsx, apps/electron/src/renderer/components/app-shell/AppShell.tsx, apps/electron/src/renderer/components/app-shell/LeftSidebar.tsx, apps/electron/src/renderer/compo... ## Статус Это задача из текущего backlog'а ROX.ONE (Linear). Текущий статус в Linear: `В работе — In Progress`. Метки: —. ## 🔗 Linear - [PZD-64](https://linear.app/kuhjie/issue/PZD-64/prd-sovmestimosti-ux-nativnogo-addona-roxone-open-design-roxone-open) — backing ticket - Parent epic: [PZD-116](https://linear.app/kuhjie/issue/PZD-116)
A-H1 / T541: Привязать origin URL view-show Rox Design к доверенному runtime-эндпоинту
## Что это ## Резюме (RU) A-H1 / T541: Привязать origin URL view-show Rox Design к доверенному runtime-эндпоинту *Полный перевод тела — в работе. Английский оригинал ниже.* --- # Original (EN) ## Objective Close the security gap audited as **A-H1** in the PR #268 release-readiness audit: the `rox-design:view-show` IPC handler accepted a renderer-supplied URL and validated only its `http(s):` scheme before `webContents.loadURL`. The resulting `WebContentsView` inherits the privileged `rox-design-bridge:*` IPC surface (`openExternal`, `pickFolder`, `pickAndImport`, `openPath`, `printPdf`). A compromised main renderer (XSS in any allowed origin, supply-chain script injection) could redirect that view to an attacker host and pivot through those handlers — a classic confused-deputy pattern. ## Source Links * GitHub repo: [https://github.com/agisota/rox.one]() * GitHub PR (parent, merged): [https://github.com/agisota/rox.one/pull/268]() * GitHub branch: `feat/rox-design-clean` * GitHub Project item: [https://github.com/users/agisota/projects/9]() * DeepWiki: [https://deepwiki.com/agisota/rox.one]() * Local branch / cwd: `/home/dev/craft/rox-one-terminal` on `feat/rox-design-clean` * Commit (already landed): `0d8bf3d2` — `fix(design): pin view-show URL origin to trusted runtime endpoint (T541)` * Audit doc: `docs/audits/2026-05-20-pr268-release-readiness-audit.md` (finding A-H1, committed `12a1093f`) * Audit memory: `project_pr268_audit_outcome.md` ## Current State Implementation already landed on `feat/rox-design-clean` as commit `0d8bf3d2`: * Added `isRoxDesignUrlOriginAuthorized(expectedWebUrl, candidateUrl)` helper in `apps/electron/src/main/rox-design-view-policy.ts`. Returns false unless the candidate is `http(s):` and origin-matches the expected URL. * `RoxDesignViewManager.show()` extended to accept `expectedWebUrl?: string | null`; throws on origin mismatch. * The IPC handler in `apps/electron/src/main/index.ts:627-639` resolves `expectedWebUrl` from `runtimeManager.getStatus().webUrl`, but only when `status === 'running'`. A non-running runtime resolves to `null`, which fails the check intentionally — refusing to load any URL until the runtime has come up is safer than fallback validation against an unknown origin. * Test added at `apps/electron/src/main/__tests__/rox-desi... ## Статус Это задача из текущего backlog'а ROX.ONE (Linear). Текущий статус в Linear: `На ревью — In Review`. Метки: —. ## 🔗 Linear - [PZD-65](https://linear.app/kuhjie/issue/PZD-65/a-h1-t541-privyazat-origin-url-view-show-rox-design-k-doverennomu) — backing ticket - Parent epic: [PZD-120](https://linear.app/kuhjie/issue/PZD-120)
A-M1+A-M2: Запретить переопределение runtime Rox Design через env-переменные в упакован...
## Что это ## Резюме (RU) A-M1+A-M2: Запретить переопределение runtime Rox Design через env-переменные в упакованных сборках *Полный перевод тела — в работе. Английский оригинал ниже.* --- # Original (EN) ## Objective Close two trust-boundary findings from the PR #268 release-readiness audit: * **A-M1**: `ROX_DESIGN_WEB_URL` env var is loaded verbatim with no scheme/host allowlist. A poisoned shell profile or launcher injection could silently redirect the embedded WebContentsView to an attacker host that inherits the `rox-design-bridge:*` IPC surface. * **A-M2**: `ROX_DESIGN_RUNTIME_ROOT` env var points the runtime manager at an arbitrary directory containing `open-design-config.json`. The manager then `spawn`s the binary at that bundle's `nodeCommandRelative` — **arbitrary-code execution in main-process context**. These overrides remain useful during dev/debug but cross a trust boundary the user does not see in a packaged build. Gate both behind `!app.isPackaged`; log a warn-level message when the env attempt is detected in production builds. ## Source Links * GitHub repo: [https://github.com/agisota/rox.one]() * GitHub PR (parent, merged): [https://github.com/agisota/rox.one/pull/268]() * GitHub branch: `feat/rox-design-clean` * GitHub Project item: [https://github.com/users/agisota/projects/9]() * DeepWiki: [https://deepwiki.com/agisota/rox.one]() * Local branch / cwd: `/home/dev/craft/rox-one-terminal` on `feat/rox-design-clean` * Commit (already landed): `a8f90784` — `fix(design): refuse env-var runtime overrides in packaged builds (A-M1, A-M2)` * Audit doc: `docs/audits/2026-05-20-pr268-release-readiness-audit.md` (findings A-M1, A-M2) * Audit memory: `project_pr268_audit_outcome.md` * Related: [PZD-65](https://linear.app/id-2/issue/PZD-65) (T541 URL origin pin — compounds with this fix) ## Current State Implementation landed on `feat/rox-design-clean` as commit `a8f90784`: * Import `app` from `electron` in `apps/electron/src/main/rox-design-runtime-manager.ts`. * In `_doStart()`: compute `allowEnvOverrides = !app.isPackaged`. If `ROX_DESIGN_WEB_URL` is set in a packaged build, log warn and ignore. * In `findBundledRuntimeLayout()`: same gate for `ROX_DESIGN_RUNTIME_ROOT`. Attacker-supplied root is removed from candidates list with a warn log. * Test mock updated to e... ## Статус Это задача из текущего backlog'а ROX.ONE (Linear). Текущий статус в Linear: `На ревью — In Review`. Метки: —. ## 🔗 Linear - [PZD-66](https://linear.app/kuhjie/issue/PZD-66/a-m1a-m2-zapretit-pereopredelenie-runtime-rox-design-cherez-env) — backing ticket - Parent epic: [PZD-120](https://linear.app/kuhjie/issue/PZD-120)
Intake текущей сессии: чекпоинт трассируемости Linear-first
## Что это ## Резюме (RU) Intake текущей сессии: чекпоинт трассируемости Linear-first *Полный перевод тела — в работе. Английский оригинал ниже.* --- # Original (EN) ### Objective Preserve and track the current agent/session state under the Linear-first protocol before any further ROX.ONE implementation. This issue is the PM trace for the intake/checkpoint itself, not the feature implementation. ### Source Links * GitHub issue: [https://github.com/agisota/rox.one/issues/271]() * GitHub PR: [https://github.com/agisota/rox.one/pull/301]() and [https://github.com/agisota/rox.one/pull/272]() * GitHub branch: `feat/artifact-panel-271-clean` for PR #301; local candidate branch `mac/session-startup-switch-performance` observed in `/Users/marklindgreen/Projects/rox-one-terminal` * GitHub Project item: [https://github.com/users/agisota/projects/9]() * DeepWiki/repo context: [https://deepwiki.com/agisota/rox.one]() * Local branch / cwd: `/Users/marklindgreen`; no exact local checkout at `/Users/marklindgreen/Projects/rox.one` found during intake ### Current State * Implementation was paused for Linear intake. * GitHub #271 is open. * PR #301 exists for the focused artifact-panel slice and is open / non-draft / mergeable at verification time. * PR #272 is merged and was moved to Done in Linear/GitHub Project tracking. * Local worktree snapshots were recorded; no destructive git commands were run. * PZD-10 and PZD-35 were moved to In Review based on PR #301 state. * A stale-reference correction was posted to PZD-13 because that identifier currently belongs to the release-feed task, not this intake. ### Requirements * Do not lose current branch, worktree, diff, or state. * Do not run `git reset`, `git checkout --`, force-push, or branch deletion. * Keep Linear as PM/roadmap/backlog/traceability layer and GitHub as engineering source of truth. * Do not print or persist secrets. * Record verification evidence before resuming implementation. ### Specification * Affected surfaces: Linear PZD project, GitHub issue #271, PR #301, PR #272, GitHub Project #9, local worktree status. * Data/API changes: none in code; only Linear/GitHub metadata updates. * UI behavior: not applicable. * Error handling: stale Linear identifiers must be correc... ## Статус Это задача из текущего backlog'а ROX.ONE (Linear). Текущий статус в Linear: `В работе — In Progress`. Метки: —. ## 🔗 Linear - [PZD-71](https://linear.app/kuhjie/issue/PZD-71/intake-tekushej-sessii-chekpoint-trassiruemosti-linear-first-current) — backing ticket - Parent epic: [PZD-116](https://linear.app/kuhjie/issue/PZD-116)
Goal 1
## Что это ## Резюме (RU) Goal 1 — Indistinguishability: нативный Rox Design + интеграции *Полный перевод тела — в работе. Английский оригинал ниже.* --- # Original (EN) ## Objective **Goal 1 — Indistinguishability**: Rox Design (and every future integration) feels like a native ROX.ONE surface. 6 dimensions × 4 sub-objectives = 24 sub-objectives / 72-84 tasks / \~10-13 dev-weeks. > Vision: "I never notice when I cross between ROX.ONE and Rox Design — clicking, navigating, theming, scrolling, error-recovery, screen-reader experience — it all feels like one product designed by one team." ## Source Links * Design doc: `docs/superpowers/specs/2026-05-20-rox-integration-vision-design.md` (committed 2026-05-20) * Audit context: `docs/audits/2026-05-20-pr268-release-readiness-audit.md` * Memory: `project_pr268_audit_outcome.md`, `project_pr268_linear_intake_complete.md` * GitHub Project: [https://github.com/users/agisota/projects/9]() ## Requirements (summary) 6 dimensions: Visual continuity, Interaction parity, Navigation as one app, Error/failure UX, A11y floor (≥95% axe), Performance floor (cold ≤1500ms P95, warm ≤300ms P95, INP <200ms, bundle delta ≤30KB gzip). Full breakdown in design doc Section 2. ## Acceptance Criteria (vision-level) 1. Maintainer + design-lead walkthrough confirms "feels native". 2. axe-core ≥95% on design panel snapshot. 3. INP <200ms inside panel; cold-start ≤1500ms P95 verified per platform. 4. Keyboard-only flow recording without mode switch. 5. SR landmarks correctly narrated in VoiceOver/NVDA/Narrator. ## Implementation Plan Decomposed in design doc Section 2 + Section 4 (sequencing). Week 0 foundation + Week 1-2 quick wins are first sub-issues. ## Status / Priority / Estimate Status: **In Progress** (decomposition complete; Week 1-2 sub-issues created concurrent) Priority: **High** Estimate: **XL** (10-13 dev-weeks total; tracked as parent of multiple sub-issues) Workstream: КОД (with Design + QA part-time) ## Update Log * **2026-05-20** Parent issue created during integration-vision brainstorm. Spec committed as `4d223078`. ## Статус Это задача из текущего backlog'а ROX.ONE (Linear). Текущий статус в Linear: `К работе — Todo`. Метки: —. ## 🔗 Linear - [PZD-76](https://linear.app/kuhjie/issue/PZD-76/goal-1-indistinguishability-nativnyj-rox-design-integracii-goal-1) — backing ticket - Parent epic: [PZD-116](https://linear.app/kuhjie/issue/PZD-116)
Goal 2
## Что это ## Резюме (RU) Goal 2 — Integration Constellation: фреймворк + 2 новые интеграции *Полный перевод тела — в работе. Английский оригинал ниже.* --- # Original (EN) ## Objective **Goal 2 — Integration Constellation**: every integration is a native sense organ of ROX.ONE; we land 2 more integrations this quarter (T271 artifacts + Browser-as-tool) on a shared framework; Rox Design refactors onto same framework. 6 areas × \~4-8 sub-objectives = 26 sub-objectives / 74-94 tasks / \~11-15 dev-weeks. > Vision: "ROX.ONE evolves from a chat-app-with-one-design-tool into a workbench where multiple integrations each feel native, compound via agent workflows, and obey the same trust/UX/observability contract." ## Source Links * Design doc: `docs/superpowers/specs/2026-05-20-rox-integration-vision-design.md` * Audit context: `docs/audits/2026-05-20-pr268-release-readiness-audit.md` * T271 active work: [PZD-10](https://linear.app/id-2/issue/PZD-10), [PZD-35](https://linear.app/id-2/issue/PZD-35) ## Requirements (summary) 6 areas: framework primitives (manifest/lifecycle/sandbox/skin/navigation/telemetry/capability/budget), test infrastructure, T271-as-first-consumer, Browser-as-tool-as-second, Rox Design refactor, playbook+docs. Full breakdown in design doc Section 3. ## Acceptance Criteria (vision-level) 1. T271 ships on framework (or absorbs into framework ≤1 dev-day post-landing). 2. Browser-as-tool ships as new integration (≤200 LoC manifest + custom code, smell-check). 3. Rox Design refactor: zero functional regression + ≥40% bespoke LoC reduction. 4. Playbook published; new integration can be stood up in ≤1 day using docs. 5. Framework test infrastructure exists (closes Lane C \~0% coverage gap). ## Implementation Plan Sections 3 + 4 of design doc. Foundation (Week 0) starts now: manifest schema + sandbox baseline + mock test infra. ## Status / Priority / Estimate Status: **In Progress** Priority: **High** Estimate: **XL** (11-15 dev-weeks) Workstream: КОД (with PM coordination for T271 sequencing) ## Update Log * **2026-05-20** Parent issue created; Week 0 sub-issues created concurrent. ## Статус Это задача из текущего backlog'а ROX.ONE (Linear). Текущий статус в Linear: `К работе — Todo`. Метки: —. ## 🔗 Linear - [PZD-77](https://linear.app/kuhjie/issue/PZD-77/goal-2-integration-constellation-frejmvork-2-novye-integracii-goal-2) — backing ticket - Parent epic: [PZD-120](https://linear.app/kuhjie/issue/PZD-120)
G2.2.1.A
## Что это ## Резюме (RU) G2.2.1.A — Схема IntegrationManifest + валидатор (Week 0 foundation) *Полный перевод тела — в работе. Английский оригинал ниже.* --- # Original (EN) ## Objective Define TypeScript interface + Zod schema for the framework's IntegrationManifest. Registry keyed by [manifest.id](). Startup validation; fail fast on schema mismatch. This is THE foundation primitive — blocks every other framework consumer. ## Source Links * Design doc section: `docs/superpowers/specs/2026-05-20-rox-integration-vision-design.md` § 3 (Section 3 → 2.1.A) * Parent: PZD-77 * Audit context: `docs/audits/2026-05-20-pr268-release-readiness-audit.md` ## Tasks (a) Create `packages/shared/src/integrations/manifest.ts` with `IntegrationManifest` interface + Zod schema (b) Create `packages/shared/src/integrations/registry.ts` with `IntegrationRegistry` class (c) Validation runs at app startup; fail-fast logs which integration's manifest is invalid + why (d) Unit tests: happy-path manifest, missing required fields, invalid types, security-baseline cannot be weakened (sandbox:false rejected) (e) Documentation comment block at the top of manifest.ts explaining the security contract ## Acceptance Criteria Implementation passes typecheck + lint + targeted unit tests + relevant audit gates. PR backlinks to this Linear issue. ## Implementation Plan 1. Read design doc section 3 (Section 3 → 2.1.A) for full context. 2. Implement tasks above on a feature branch off current main + my 3 PR #268 audit commits (`0d8bf3d2`, `a8f90784`, `4d223078`) or current main if those land first. 3. Atomic commits per task; PR when complete. 4. Update this issue with verification evidence. ## Status / Priority / Estimate Status: **Todo** (Week 0) Priority: **High** Estimate: **S** (\~1-3 dev-days) Workstream: КОД ## Update Log * **2026-05-20** Sub-issue created during integration-vision brainstorm. Dispatched to autonomous agent. ## Статус Это задача из текущего backlog'а ROX.ONE (Linear). Текущий статус в Linear: `В работе — In Progress`. Метки: —. ## 🔗 Linear - [PZD-78](https://linear.app/kuhjie/issue/PZD-78/g221a-shema-integrationmanifest-validator-week-0-foundation-g221a) — backing ticket - Parent epic: [PZD-120](https://linear.app/kuhjie/issue/PZD-120)
G2.2.1.C
## Что это ## Резюме (RU) G2.2.1.C — Базовые sandbox-хелперы + примитивы границы доверия (Week 0 foundation) *Полный перевод тела — в работе. Английский оригинал ниже.* --- # Original (EN) ## Objective Provide WebContentsView spawning helper that enforces security baseline by default. Generalize the trust-boundary helpers from PZD-65 (URL origin pinning) and PZD-66 (env-var hardening) so future integrations inherit them automatically. ## Source Links * Design doc section: `docs/superpowers/specs/2026-05-20-rox-integration-vision-design.md` § 3 (Section 3 → 2.1.C) * Parent: PZD-77 * Audit context: `docs/audits/2026-05-20-pr268-release-readiness-audit.md` ## Tasks (a) Create `apps/electron/src/main/integrations/sandbox-baseline.ts` exporting `createSecureWebContentsView(manifest)` (b) Helper enforces: sandbox:true, contextIsolation:true, nodeIntegration:false, webviewTag:false, no devtools in production (c) Manifest validator rejects any attempt to weaken these (compile-time + runtime) (d) Generalize `isRoxDesignUrlOriginAuthorized` → `isUrlOriginAuthorized(allowlist, candidate)` taking explicit allowlist (e) Generalize env-var hardening pattern → `isEnvOverrideAllowed(): boolean` based on `app.isPackaged` (f) Unit tests for all helpers; integration test that the security baseline is non-bypassable (g) Doc block explaining why each restriction exists, referencing CLAUDE.md security rules ## Acceptance Criteria Implementation passes typecheck + lint + targeted unit tests + relevant audit gates. PR backlinks to this Linear issue. ## Implementation Plan 1. Read design doc section 3 (Section 3 → 2.1.C) for full context. 2. Implement tasks above on a feature branch off current main + my 3 PR #268 audit commits (`0d8bf3d2`, `a8f90784`, `4d223078`) or current main if those land first. 3. Atomic commits per task; PR when complete. 4. Update this issue with verification evidence. ## Status / Priority / Estimate Status: **Todo** (Week 0) Priority: **High** Estimate: **S** (\~1-3 dev-days) Workstream: КОД ## Update Log * **2026-05-20** Sub-issue created during integration-vision brainstorm. Dispatched to autonomous agent. ## Статус Это задача из текущего backlog'а ROX.ONE (Linear). Текущий статус в Linear: `К работе — Todo`. Метки: —. ## 🔗 Linear - [PZD-79](https://linear.app/kuhjie/issue/PZD-79/g221c-bazovye-sandbox-helpery-primitivy-granicy-doveriya-week-0) — backing ticket - Parent epic: [PZD-120](https://linear.app/kuhjie/issue/PZD-120)
G2.2.2.A
## Что это ## Резюме (RU) G2.2.2.A — Мок WebContentsView для юнит-тестов (Week 0 foundation) *Полный перевод тела — в работе. Английский оригинал ниже.* --- # Original (EN) ## Objective Provide a reusable test-double for WebContentsView so every integration can unit-test without spawning Electron. Currently `RoxDesignViewManager` has \~0% coverage (Lane C audit) because there's no mock. This closes that gap framework-wide. ## Source Links * Design doc section: `docs/superpowers/specs/2026-05-20-rox-integration-vision-design.md` § 3 (Section 3 → 2.2.A) * Parent: PZD-77 * Audit context: `docs/audits/2026-05-20-pr268-release-readiness-audit.md` ## Tasks (a) Create `apps/electron/src/main/integrations/__testing__/mock-web-contents-view.ts` exposing minimal stub: loadURL, setBounds, isDestroyed, on/off, removeAllListeners, executeJavaScript, insertCSS, removeInsertedCSS, send (b) Stub emits configurable events: did-finish-load, dom-ready, did-start-navigation, will-navigate, render-process-gone (c) Test helper `mockWebContentsViewFor(manifest)` constructs a fully-stubbed view ready for use in any integration's unit tests (d) Mock surface mirrors real WebContentsView API closely enough that integration tests using the real one would be straightforward to write later (e) Demonstrate by writing 3 example tests in `apps/electron/src/main/integrations/__testing__/mock.test.ts` (f) README in `__testing__/` explaining usage ## Acceptance Criteria Implementation passes typecheck + lint + targeted unit tests + relevant audit gates. PR backlinks to this Linear issue. ## Implementation Plan 1. Read design doc section 3 (Section 3 → 2.2.A) for full context. 2. Implement tasks above on a feature branch off current main + my 3 PR #268 audit commits (`0d8bf3d2`, `a8f90784`, `4d223078`) or current main if those land first. 3. Atomic commits per task; PR when complete. 4. Update this issue with verification evidence. ## Status / Priority / Estimate Status: **Todo** (Week 0) Priority: **High** Estimate: **S** (\~1-3 dev-days) Workstream: КОД ## Update Log * **2026-05-20** Sub-issue created during integration-vision brainstorm. Dispatched to autonomous agent. ## Статус Это задача из текущего backlog'а ROX.ONE (Linear). Текущий статус в Linear: `К работе — Todo`. Метки: —. ## 🔗 Linear - [PZD-80](https://linear.app/kuhjie/issue/PZD-80/g222a-mok-webcontentsview-dlya-yunit-testov-week-0-foundation-g222a) — backing ticket - Parent epic: [PZD-120](https://linear.app/kuhjie/issue/PZD-120)
G1.1.4.A
## Что это ## Резюме (RU) G1.1.4.A — Sidecar-crash → баннер ROX.ONE с восстановлением в 1 клик (Week 1-2 quick win) *Полный перевод тела — в работе. Английский оригинал ниже.* --- # Original (EN) ## Objective When the Rox Design sidecar crashes mid-session, the user sees a ROX.ONE-styled banner with a retry action. This is the highest-trust-payoff item for Goal 1 — small surface, immediately visible. ## Source Links * Design doc section: `docs/superpowers/specs/2026-05-20-rox-integration-vision-design.md` § 2 (Section 2 → 1.4.A) * Parent: PZD-76 * Audit context: `docs/audits/2026-05-20-pr268-release-readiness-audit.md` ## Tasks (a) Hook into existing IPC event `rox-design:sidecar-exited` (already emitted per upstream commit d1ea1854) (b) Render a banner component matching existing ROX.ONE error banner patterns (search codebase for similar) (c) Banner shows: 'Rox Design отключился неожиданно. Перезапустить?' (RU) / 'Rox Design disconnected unexpectedly. Reconnect?' (EN); use existing translation infrastructure (d) 'Retry' button calls `roxDesign.start()` and dismisses banner on success (e) Telemetry span: `rox-design.crash-recovery.{attempt,success,failure}` with reason tag (f) Playwright test: simulate sidecar exit (mock IPC event) → banner appears → click retry → banner dismisses (g) Manual smoke: kill node sidecar process via Activity Monitor / Task Manager → verify banner shows within 800ms ## Acceptance Criteria Implementation passes typecheck + lint + targeted unit tests + relevant audit gates. PR backlinks to this Linear issue. ## Implementation Plan 1. Read design doc section 2 (Section 2 → 1.4.A) for full context. 2. Implement tasks above on a feature branch off current main + my 3 PR #268 audit commits (`0d8bf3d2`, `a8f90784`, `4d223078`) or current main if those land first. 3. Atomic commits per task; PR when complete. 4. Update this issue with verification evidence. ## Status / Priority / Estimate Status: **Todo** (Week 1-2) Priority: **High** Estimate: **S** (\~1-3 dev-days) Workstream: КОД ## Update Log * **2026-05-20** Sub-issue created during integration-vision brainstorm. Dispatched to autonomous agent. ## Статус Это задача из текущего backlog'а ROX.ONE (Linear). Текущий статус в Linear: `К работе — Todo`. Метки: —. ## 🔗 Linear - [PZD-81](https://linear.app/kuhjie/issue/PZD-81/g114a-sidecar-crash-banner-roxone-s-vosstanovleniem-v-1-klik-week-1-2) — backing ticket - Parent epic: [PZD-116](https://linear.app/kuhjie/issue/PZD-116)
G1.1.4.D
## Что это ## Резюме (RU) G1.1.4.D — Структурированные error-спаны в lifecycle Rox Design (Week 1-2 quick win) *Полный перевод тела — в работе. Английский оригинал ниже.* --- # Original (EN) ## Objective Replace silent `.catch(() => {})` swallowing identified in Lane C audit with structured logging + Sentry breadcrumbs tagged by integration. Cross-cuts with Goal 2 telemetry contract — start here as the proof-of-concept. ## Source Links * Design doc section: `docs/superpowers/specs/2026-05-20-rox-integration-vision-design.md` § 2 (Section 2 → 1.4.D) * Parent: PZD-76 * Audit context: `docs/audits/2026-05-20-pr268-release-readiness-audit.md` ## Tasks (a) Audit Rox Design code for silent error paths: grep for `\.catch\(\(\) =>\)` and `.catch(error =>` in rox-design files (b) Replace each with: `mainLog.error('[rox-design.{phase}]', { error, ...context })` + Sentry.addBreadcrumb({ category: 'rox-design', level: 'error', message, data }) (c) Cover phases: start, navigate, IPC-handler, view-attach, view-show, view-hide, destroy, before-quit cleanup (d) Tag every span with the integration id (`rox-design`) so future integrations follow the same pattern (e) Unit tests: simulate failures at each phase, assert breadcrumb is added with correct tags (f) Verify Sentry receives correctly-tagged events in a dev synthetic-error test ## Acceptance Criteria Implementation passes typecheck + lint + targeted unit tests + relevant audit gates. PR backlinks to this Linear issue. ## Implementation Plan 1. Read design doc section 2 (Section 2 → 1.4.D) for full context. 2. Implement tasks above on a feature branch off current main + my 3 PR #268 audit commits (`0d8bf3d2`, `a8f90784`, `4d223078`) or current main if those land first. 3. Atomic commits per task; PR when complete. 4. Update this issue with verification evidence. ## Status / Priority / Estimate Status: **Todo** (Week 1-2) Priority: **High** Estimate: **S** (\~1-3 dev-days) Workstream: КОД ## Update Log * **2026-05-20** Sub-issue created during integration-vision brainstorm. Dispatched to autonomous agent. ## Статус Это задача из текущего backlog'а ROX.ONE (Linear). Текущий статус в Linear: `К работе — Todo`. Метки: —. ## 🔗 Linear - [PZD-82](https://linear.app/kuhjie/issue/PZD-82/g114d-strukturirovannye-error-spany-v-lifecycle-rox-design-week-1-2) — backing ticket - Parent epic: [PZD-116](https://linear.app/kuhjie/issue/PZD-116)
G1.1.6.A
## Что это ## Резюме (RU) G1.1.6.A — Телеметрия производительности: измерение first-click → visible (Week 1-2 quick win) *Полный перевод тела — в работе. Английский оригинал ниже.* --- # Original (EN) ## Objective Measure cold-start, warm-open, and INP for Rox Design. Without telemetry we can't claim ≤1500ms P95 cold-start or ≤300ms warm-open. Measure first, optimize next quarter. ## Source Links * Design doc section: `docs/superpowers/specs/2026-05-20-rox-integration-vision-design.md` § 2 (Section 2 → 1.6.A) * Parent: PZD-76 * Audit context: `docs/audits/2026-05-20-pr268-release-readiness-audit.md` ## Tasks (a) Add timing span `rox-design:first-show:duration` from TopBar click → `did-finish-load` event (b) Distinguish phases: spawn-sidecar, attach-view, load-url, first-paint, first-interactive (c) Per-platform breakdown (mac arm64 / linux / win) (d) web-vitals INP tracker inside the design panel (via injected bootstrap script) (e) Send metrics to existing ROX.ONE telemetry pipeline (or stub if not wired) (f) Ops dashboard panel showing P50/P95/P99 cold-start and warm-open (g) Unit tests for the timing instrumentation (mock timers) ## Acceptance Criteria Implementation passes typecheck + lint + targeted unit tests + relevant audit gates. PR backlinks to this Linear issue. ## Implementation Plan 1. Read design doc section 2 (Section 2 → 1.6.A) for full context. 2. Implement tasks above on a feature branch off current main + my 3 PR #268 audit commits (`0d8bf3d2`, `a8f90784`, `4d223078`) or current main if those land first. 3. Atomic commits per task; PR when complete. 4. Update this issue with verification evidence. ## Status / Priority / Estimate Status: **Todo** (Week 1-2) Priority: **High** Estimate: **S** (\~1-3 dev-days) Workstream: КОД ## Update Log * **2026-05-20** Sub-issue created during integration-vision brainstorm. Dispatched to autonomous agent. ## Статус Это задача из текущего backlog'а ROX.ONE (Linear). Текущий статус в Linear: `В работе — In Progress`. Метки: —. ## 🔗 Linear - [PZD-83](https://linear.app/kuhjie/issue/PZD-83/g116a-telemetriya-proizvoditelnosti-izmerenie-first-click-visible-week) — backing ticket - Parent epic: [PZD-116](https://linear.app/kuhjie/issue/PZD-116)
RC8 cut: тег v1.0.0-rc.8
## Что это ## Резюме (RU) RC8 cut: тег v1.0.0-rc.8 — описание + 11 gates верификации (PR #294) *Полный перевод тела — в работе. Английский оригинал ниже.* --- # Original (EN) ## Objective Tag `v1.0.0-rc.8` from `origin/main` at HEAD, cut window 2026-05-21. Capture the full RC8 narrative, verification gates, and P0 blockers for the eighth release candidate in the 1.0.0 sequence. ## Source Links * **PR #294**: [https://github.com/agisota/rox.one/pull/294]() (`chore/rc8-narrative-2026-05-20`) * **Source plan**: `docs/release/rc8-cut-plan-2026-05-20.md` on `chore/rc8-narrative-2026-05-20` * **Supersedes**: PZD-54 (overwritten by parallel agent on 2026-05-20) ## Current State RC7 tagged at `3dcdf109` on 2026-05-17. Seven PRs merged to main since RC7. Three P0 blockers (B-CI-1, B-REPRO-2, B-SIGN-3) identified by 2026-05-20 PR #268 audit. RC8 cut window: 2026-05-21. ## Requirements * Close P0 blockers B-CI-1, B-REPRO-2 (optional/defer), B-SIGN-3 before tagging * All 11 verification gates must pass * PR #272 (CVE-2026-45736 ws security fix) recommended for inclusion * macOS Ventura officially dropped (Sonoma 14+ floor, PR #274) ## Specification ### What's in RC8 (since RC7 `3dcdf109`) | \# | PR | Title | Impact | | -- | -- | -- | -- | | 1 | #265 | feat(linux): DEB + RPM packages alongside AppImage | new artifacts | | 2 | #267 | feat(nixos): flake with FHS wrapper for AppImage | new platform | | 3 | #268 | feat(design): integrate ROX Design (embed) + 7 follow-up fixes | new feature | | 4 | #274 | chore(mac): drop Ventura support, Sonoma 14+ floor | **breaking** | | 5 | #276 | feat(win): self-signed codesign generator + install instructions | new tooling | | 6 | #277 | chore(ci): add cache@v4 to release/build workflows | CI hygiene | | 7 | #279 | feat(ci): multi-platform on-merge pipeline + R2 mirror + nightly cleanup | release infra | ### P0 Blockers **B-CI-1** — signed-release workflows bypass `rox-design:payload:verify` gate. Fix: hoist verify into `apps/electron/scripts/beforeBuild.cjs` + prepend explicit step in 5 workflow files. **B-REPRO-2** — non-reproducible payload preparation (host-local `/Applications/Open Design.app/`, no SHA-256 pinning). Fix: `--from-archive` mode with pinned tarball. Recommended: defer to RC9. **B-SIGN-3** — nested Mach-O `node` binary lacks `mac.binaries`/`signIgnore`; notarization will reject. Fix: add to `electron-builder.yml` `mac.binaries`. ## Acceptance C... ## Статус Это задача из текущего backlog'а ROX.ONE (Linear). Текущий статус в Linear: `На ревью — In Review`. Метки: `Улучшение` / `Improvement`, `Фича` / `Feature`. ## 🔗 Linear - [PZD-86](https://linear.app/kuhjie/issue/PZD-86/rc8-cut-teg-v100-rc8-opisanie-11-gates-verifikacii-pr-294-rc8-cut-tag) — backing ticket - Parent epic: [PZD-119](https://linear.app/kuhjie/issue/PZD-119)
chore(ci): разблокировать валидацию PR с текущими CI-контрактами (mac-diag-validator-path)
## Что это ## Резюме (RU) chore(ci): разблокировать валидацию PR с текущими CI-контрактами (mac-diag-validator-path) *Полный перевод тела — в работе. Английский оригинал ниже.* --- # Original (EN) PR #330 — fix/mac-diag-validator-path Unblocks current PR validation for #299 and other active branches by fixing main CI blockers (mac diag stale launch path). Related: #299, #271, #304. GH PR: [https://github.com/agisota/rox.one/pull/330]() ## Статус Это задача из текущего backlog'а ROX.ONE (Linear). Текущий статус в Linear: `Бэклог — Backlog`. Метки: —. ## 🔗 Linear - [PZD-102](https://linear.app/kuhjie/issue/PZD-102/choreci-razblokirovat-validaciyu-pr-s-tekushimi-ci-kontraktami-mac) — backing ticket - Parent epic: [PZD-119](https://linear.app/kuhjie/issue/PZD-119)