Align native qualification with the current first-run workspace

Author: Shadowfetch

README.md

@@ -214,7 +214,12 @@ assets are checksum-only and cannot be installed by this new entry point; use
 the instructions shipped with that released version for those existing assets.
 The 0.33.0 release attempt failed before signing and publication. Its tag stays
 unchanged. Version 0.33.1 was the first signed release; the public trust policy
-in `release/trust` now authorizes 0.33.0 through 2.3.3. An older independently trusted installer bundle whose policy ends at 2.3.1 will reject 2.3.3. Obtain and independently authenticate a reviewed bundle with the updated policy before installing; do not replace trust files with copies from the downloaded release.
+in this source checkout's `release/trust` authorizes 0.33.0 through the 2.4.0 candidate;
+the latest published release is still 2.3.3. The policy range does not establish
+that a candidate has been published or qualified. An older independently trusted
+installer bundle whose policy ends at 2.3.1 will reject 2.3.3. Obtain and
+independently authenticate a reviewed bundle with the updated policy before
+installing; do not replace trust files with copies from the downloaded release.
 For development, use [Build from source](#build-from-source).
 
 Obtain an independently authenticated installer bundle as described below,

docs/WINDOWS_LAPTOP_QUALIFICATION.md

@@ -1,9 +1,11 @@
 # Windows laptop qualification — October 31, 2026
 
-Current status: the **public Windows 2.3.1 installer passed** the bounded laptop
-qualification. See [the final public-installer record](#231-public-installer-qualification)
-for its exact hashes and results. Earlier sections retain the development and
-preview history, including failures.
+Latest public qualification: **Windows 2.3.3**, recorded in
+[the platform qualification report](PLATFORM_QUALIFICATION.md#233-public-release--november-2-2026).
+The **2.4.0 source candidate is awaiting installer qualification**.
+This document retains the earlier 2.3.1 qualification and development history,
+including failures. See [the 2.3.1 public-installer record](#231-public-installer-qualification)
+for that version's exact hashes and results.
 
 Test machine: Windows 11 Home x64, Ryzen 3 5300U, 32 GB RAM. Baseline:
 `9c82cae76d4c94a4416405c93f00e198080a18ac`, Windows CI preview 2.3.0.

docs/WINDOWS_PORT.md

@@ -1,13 +1,16 @@
 # Windows port
 
-Status: Windows 2.3.1 is published. The exact public installer passed installation,
+Status: Windows 2.3.3 is the latest published release. The exact public installer passed installation,
 clean-PATH startup, native editor/settings checks and a local-model coding task
 on a Windows 11 Home x64 laptop (Ryzen 3 5300U, 32 GB RAM). Gemma 4 E4B on CPU
 completed the repair, executed its tests inside AppContainer, and preserved all
 five original tests; the independent check also passed. This is one bounded
 fixture, not a broad model-reliability or Windows-hardware benchmark.
-See [the laptop qualification record](WINDOWS_LAPTOP_QUALIFICATION.md#231-public-installer-qualification)
-for exact hashes, workflow provenance, earlier failed attempts and limitations.
+See [the current platform qualification record](PLATFORM_QUALIFICATION.md#233-public-release--november-2-2026)
+for the 2.3.3 hashes and results, and [the earlier laptop qualification record](WINDOWS_LAPTOP_QUALIFICATION.md#231-public-installer-qualification)
+for the 2.3.1 history, workflow provenance, earlier failed attempts and limitations.
+The 2.4.0 workspace upgrade is a source candidate; its installer qualification is
+pending and is not covered by those older receipts.
 
 External programs that open the Windows null device themselves can fail in
 AppContainer; external Git commands demonstrated this in the 2.3.0 public-installer

scripts/fixtures/native-onboarding-smoke.mjs

@@ -0,0 +1,74 @@
+// Shared by the real native desktop/endurance and opt-in download flows.
+// Keep DOM checks callable through WebDriver's execute(script, args).
+import assert from "node:assert/strict";
+
+export async function assertFolderOnboarding(execute) {
+  const dialog = await execute(`
+    const d = document.querySelector('.wizard[role="dialog"]');
+    return d && {
+      text: d.innerText,
+      fields: [...d.querySelectorAll('input, select, textarea')].map(e => e.type || e.tagName),
+      open: [...d.querySelectorAll('button')].some(b => b.textContent.trim() === 'Open project'),
+      folder: !!d.querySelector('#onboarding-folder'),
+    };
+  `);
+  assert.ok(dialog, "Accessible first-run dialog");
+  assert.match(dialog.text, /Welcome to ShadowCode/);
+  assert.match(dialog.text, /Ask-first approvals are\s+on/);
+  assert.match(dialog.text, /Opening trusts this folder: the agent may read it/);
+  assert.match(dialog.text, /File edits and\s+commands still wait for your approval until you change that/);
+  assert.doesNotMatch(dialog.text, /\b(Provider|provider|Endpoint|endpoint|API key|Choose a model|Next)\b/, "Folder onboarding has no model step");
+  assert.deepEqual(dialog.fields, ["text"], "Only a project folder is requested; permissions default to ask-first");
+  assert.ok(dialog.folder && dialog.open, "Project folder and explicit Open project action");
+}
+
+export async function assertWorkspacePermissions(api, project) {
+  const status = await api("GET", "/api/workspace/status");
+  assert.equal(status.workspace, project);
+  assert.equal(status.trusted, true, "Opening explicitly trusts the chosen workspace");
+  assert.equal(status.onboarding?.completed, true, "Onboarding completion persisted");
+  assert.equal(status.onboarding?.workspace, project, "Onboarding records the chosen folder");
+  assert.equal(status.permissions?.mode, "ask", "Live workspace still requires approvals");
+  assert.equal(status.permissions?.level, "workspace", "Opening does not grant elevated access");
+  const config = await api("GET", "/api/config");
+  const values = config.values || config.config || config;
+  assert.equal(values.permissions?.mode, "ask", "Ask-first mode saved in configuration");
+  assert.equal(values.permissions?.level, "workspace", "Workspace permission level saved");
+}
+
+export async function assertWelcomeControls(execute) {
+  // The inline API-key provider is a legitimate select, not a model picker.
+  const unexpected = await execute(`return [...document.querySelectorAll('select')]
+    .filter(s => !s.closest('.worktree-base') && !s.matches('.welcome-model-setup .api-key-quick select[aria-label="API key provider"]'))
+    .map(s => s.outerHTML)`);
+  assert.deepEqual(unexpected, [], "No select-based model controls in the workspace");
+}
+
+export async function assertWelcomeModelSetup(execute) {
+  const setup = await execute(`
+    const s = document.querySelector('.welcome-model-setup .model-setup');
+    if (!s) return null;
+    const key = s.querySelector('input[aria-label="OpenRouter API key"]');
+    return {
+      radios: [...s.querySelectorAll('.mode-options input[type=radio]')].map(r => r.closest('label').innerText),
+      providers: [...s.querySelectorAll('.provider-tile button[aria-label]')].map(b => b.getAttribute('aria-label')),
+      keyType: key?.type,
+      keyProviders: [...s.querySelectorAll('.api-key-quick select option')].map(o => o.value),
+      saveDisabled: s.querySelector('.api-key-quick button[type=submit]')?.disabled,
+    };
+  `);
+  assert.ok(setup, "Model setup is in the empty conversation after onboarding");
+  assert.equal(setup.radios.length, 1, "Local download is the single model-setup radio");
+  assert.match(setup.radios[0], /Download a free model to run on this computer/);
+  // A real CI host may lack vendor CLIs: honest 'not installed' controls are
+  // valid, as are Connect and Connected. Never start a vendor login here.
+  for (const provider of ["Codex", "Claude Code", "Cursor", "Grok"]) {
+    assert.ok(setup.providers.some(label => [
+      `Connect ${provider}`, `Connected ${provider}`, `${provider} is not installed`,
+    ].includes(label)), `${provider} connection or availability control`);
+  }
+  assert.ok(setup.providers.some(label => /Antigravity/.test(label)), "Antigravity connection or install status");
+  assert.equal(setup.keyType, "password", "OpenRouter key entry is masked");
+  assert.deepEqual(setup.keyProviders, ["openrouter", "grok", "openai"], "Inline key provider choices");
+  assert.equal(setup.saveDisabled, true, "An empty API key cannot be saved");
+}

scripts/test-native-desktop.mjs

@@ -29,6 +29,7 @@
 //   SHADOW_EXPECT_VENDORS   e.g. "codex=Ready,claude=Sign in": exact picker
 //                           availability expected for vendors on this machine
 import assert from "node:assert/strict";
+import { assertFolderOnboarding, assertWorkspacePermissions, assertWelcomeModelSetup, assertWelcomeControls } from "./fixtures/native-onboarding-smoke.mjs";
 import { capturePrivateSession, writePrivateSessionReport } from "./native-test-session.mjs";
 import { EDITOR_FILE, OTHER_FILE, seedNativeEditorFixtures, nativeEditorBeforeReload, nativeEditorAfterReload } from "./fixtures/native-editor-smoke.mjs";
 import { nativeRunCheck } from "./fixtures/native-run-check-smoke.mjs";
@@ -489,34 +490,15 @@ try {
   }
   const expectedScript = (await readFile(path.join(root, "ui/dist/index.html"), "utf8")).match(/src="([^"]+\.js)"/)[1];
   assert.equal(await execute("return new URL(document.querySelector('script[type=module]').src).pathname"), expectedScript, "The binary embeds the current ui/dist build");
-  const onboarding = await text();
-  assert.match(onboarding, /Welcome to ShadowCode/);
-  assert.match(onboarding, /Ask before actions/); assert.match(onboarding, /Allow project edits/);
-  assert.doesNotMatch(onboarding, /\b(Provider|provider|Endpoint|endpoint|API key|Choose a model|Next)\b/, "Onboarding has no model step");
-  assert.deepEqual(await execute("return [...document.querySelectorAll('.wizard input, .wizard select, .wizard textarea')].map(e=>e.type||e.tagName)"), ["text", "radio", "radio"], "Onboarding asks only for the folder and the permission mode");
-  assert.equal(await execute("return document.querySelector('input[name=onboarding-mode]:checked').closest('label').textContent.includes('Ask before actions')"), true, "Ask before actions is the default");
+  await assertFolderOnboarding(execute);
   await fill("#onboarding-folder", project);
   await setTheme("light");
   await screenshot("onboarding");
   await accessibility("onboarding");
-  await clickButton("Trust and open");
-  // Without any ready model (no signed-in subscription on this machine), the
-  // first run asks how to get one; this run skips it (test-native-first-run.mjs
-  // covers that step).
-  const modelStep = await until("Onboarding closes or asks for a model", () => execute("if(!document.querySelector('.wizard'))return 'closed';return /Choose how ShadowCode thinks/.test(document.body.innerText)?'model':false"), 20000);
-  if (modelStep === "model") {
-    const choices = await text();
-    for (const choice of [/Download a free model to run on this computer/, /Use an OpenRouter key/, /Sign in to a subscription/]) assert.match(choices, choice);
-    await clickButton("Skip for now");
-    note("first run without a ready model offers download, OpenRouter and subscription; skipped here");
-  }
+  await clickButton("Open project");
   await until("Workspace ready", () => execute("const t=document.querySelector(arguments[0]);return !!t && !t.disabled && !document.querySelector('.wizard')", [composer]), 20000);
-  const status = await api("GET", "/api/workspace/status");
-  assert.equal(status.workspace, project);
-  const config = await api("GET", "/api/config");
-  const cfgValues = config.values || config.config || config;
-  assert.equal(cfgValues.permissions?.mode, "ask", "Onboarding saved Ask before actions");
-  note("first run: folder, trust and permission mode (Ask before actions), no model step");
+  await assertWorkspacePermissions(api, project);
+  note("first run: Open project trusts the folder, saves ask-first workspace permissions and opens the composer directly");
   // Onboarding saves "system"; the screenshots below choose explicitly.
   await setTheme("light");
 
@@ -528,8 +510,7 @@ try {
   });
   assert.ok(suggestions.length <= 3, `At most three suggestions (${suggestions})`);
   assert.equal(await execute("return document.querySelectorAll('.unified-picker-trigger').length"), 1, "Exactly one model picker");
-  // More's "New worktree starts from" branch list is the one select allowed.
-  assert.equal(await execute("return [...document.querySelectorAll('select')].filter(s=>!s.closest('.worktree-base')).length"), 0, "No select-based model controls in the workspace");
+  await assertWelcomeControls(execute);
   assert.ok(await visible('button[aria-label^="Attach"]'), "Attachment button");
   await screenshot("welcome-light");
   await accessibility("welcome-light");
@@ -555,19 +536,16 @@ try {
   await until("Welcome model action", () => visible(".welcome-model-setup button"));
   await screenshot("welcome-model-ready");
   // With a ready model (a signed-in vendor CLI on this machine) the welcome
-  // offers "Choose a model"; with none (a clean CI host) it offers a free
-  // download, an OpenRouter key or a subscription instead.
+  // offers "Choose a model"; with none (a clean CI host) the conversation
+  // offers vendor connection controls, an API key form and a free download.
   const canChoose = await execute("return [...document.querySelectorAll('.welcome-model-setup button')].some(b => b.textContent.trim() === 'Choose a model' && b.getClientRects().length > 0)");
   if (canChoose) {
     await clickButton("Choose a model", "//div[contains(@class,'welcome-model-setup')]");
     await until("Welcome action opens picker", () => visible(".unified-picker-menu"));
     note("first-run Choose a model opens the unified picker after model discovery");
   } else {
-    const setup = await execute("return document.querySelector('.welcome-model-setup').innerText");
-    assert.match(setup, /free model|Download/i, "No-model welcome offers a free model");
-    assert.match(setup, /OpenRouter/i, "No-model welcome offers an OpenRouter key");
-    assert.match(setup, /subscription/i, "No-model welcome offers a subscription");
-    note("no model ready: the welcome offers a free model, an OpenRouter key or a subscription");
+    await assertWelcomeModelSetup(execute);
+    note("no model ready: inline vendor connection/status controls, API key form and local download");
   }
   await until("Vendor rows probed", async () => {
     const data = await api("GET", "/api/picker");

scripts/test-native-first-run.mjs

@@ -2,8 +2,8 @@
 // no vendor CLI on PATH, an empty HOME, no API keys, no local model. The real
 // llama.cpp runtime (the managed install) detects this computer's hardware.
 //
-// The run: onboarding → the model step (three choices; the recommendation
-// comes from this computer) → "See other free models" → download one model
+// The run: folder onboarding → the empty conversation (provider connections,
+// API key form and hardware-based local recommendation) → "See other free models" → download one model
 // for real from Hugging Face with Pause and Resume → it is selected in the
 // composer → one short read-only task on it → Delete → quit. Nothing is
 // downloaded before the click. The profile (and the ~2 GB download) lives in
@@ -19,6 +19,7 @@
 //   SHADOW_FIRST_RUN_MODEL  catalog id to download (default granite-4.2-3b, the smallest)
 //   SHADOW_KEEP_SCRATCH=1   keep the scratch profile
 import assert from "node:assert/strict";
+import { assertFolderOnboarding, assertWorkspacePermissions, assertWelcomeModelSetup, assertWelcomeControls } from "./fixtures/native-onboarding-smoke.mjs";
 import { capturePrivateSession, writePrivateSessionReport } from "./native-test-session.mjs";
 import { createServer } from "node:http";
 import { spawn, execFile } from "node:child_process";
@@ -221,28 +222,34 @@ try {
   assert.ok(target, `${modelId} is in the download list`);
   const recommended = catalog.models.find((m) => m.id === catalog.recommended);
   note(`hardware: ${catalog.hardware.gpu || "no GPU"} (${Math.round((catalog.hardware.vram_bytes || 0) / 2 ** 30)} GB) · ${Math.round(catalog.hardware.ram_bytes / 2 ** 30)} GB RAM → recommended ${recommended?.name || "none"} (${catalog.recommended_fit || "-"})`);
+  await assertFolderOnboarding(execute);
   await fill("#onboarding-folder", project);
-  await clickButton("Trust and open");
+  await clickButton("Open project");
+  await until("Workspace ready", () => execute("const t=document.querySelector('textarea[aria-label=\"Message ShadowCode\"]');return !!t && !t.disabled && !document.querySelector('.wizard')"), 30000);
+  await assertWorkspacePermissions(api, project);
 
-  // ------------------------------------------------------------ step 2
-  await until("Model step", async () => /Choose how ShadowCode thinks/.test(await text()), 30000);
-  const step = await text();
-  for (const choice of [/Download a free model to run on this computer/, /Use an OpenRouter key/, /Sign in to a subscription/]) assert.match(step, choice);
+  // ------------------------------------------------------------ empty conversation
+  await until("Inline model setup", () => visible(".welcome-model-setup .model-setup"), 30000);
+  await assertWelcomeModelSetup(execute);
+  await assertWelcomeControls(execute);
+  // Catalog rendering is asynchronous even when the API above has returned.
+  await until("Local recommendation settled", () => execute("const e=document.querySelector('.welcome-model-setup .model-setup-detail');return !!e && !/Checking what this computer can run/.test(e.innerText)"), 30000);
+  const step = await execute("return document.querySelector('.welcome-model-setup').innerText");
   if (recommended) {
     assert.match(step, new RegExp(`${recommended.name} by ${recommended.publisher}: [\\d.]+ GB, about`), "Recommended model with size and time");
     assert.match(step, /Picked for this computer: /);
-    assert.equal(await execute("const r=document.querySelector('.wizard input[type=radio]:checked');return r?r.closest('label').innerText:''").then((t) => /Download a free model/.test(t)), true, "Download is preselected");
+    assert.equal(await execute("const r=document.querySelector('.welcome-model-setup .mode-options input[type=radio]:checked');return r?r.closest('label').innerText:''").then((t) => /Download a free model/.test(t)), true, "Download is preselected");
   }
   const picker = await api("GET", "/api/picker?cached=1");
   assert.ok(!picker.targets.some((t) => t.availability === "ready"), "No model is ready on a first run without accounts");
   assert.equal(existsSync(downloads) ? (await readdir(downloads)).length : 0, 0, "Nothing is downloaded before a click");
   await screenshot("first-run-model-step");
   await accessibility("first-run-model-step");
-  note(`first run without accounts: model step with three choices${recommended ? `, ${recommended.name} preselected` : ""}; nothing downloaded`);
+  note(`first run without accounts: inline provider connections, API key form and local download${recommended ? `, ${recommended.name} preselected` : ""}; nothing downloaded`);
 
   // ------------------------------------------------------------ download
   await clickButton("See other free models");
-  await until("Settings › Local models", async () => /Download a free model/.test(await text()), 20000);
+  await until("Settings › Local models", () => execute("const s=document.querySelector('.settings-body');return !!s?.querySelector('#local-gguf') && /Download a free model/i.test(s.innerText)"), 20000);
   const sizeLabel = await until(`${target.name} offers Download`, async () => (await rowText(target.name)).match(/Download \(([^)]+)\)/)?.[1], 20000);
   await screenshot("local-models-before");
   await accessibility("local-models");