Consolidate Workshop Intern against current backend contract

.github/workflows/desktop-conform.yml

@@ -17,10 +17,20 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@v4
+        with:
+          # The CSS debt guard compares against HEAD^. A one-commit checkout
+          # silently loses that comparison and makes existing debt look new.
+          fetch-depth: 2
 
       - name: Install ripgrep
         run: command -v rg >/dev/null || (sudo apt-get update && sudo apt-get install -y ripgrep)
 
+      - name: Verify research contract pin
+        run: python3 scripts/check-research-contract.py
+
+      - name: Verify extracted research client contracts
+        run: cargo test --locked --manifest-path crates/synth-api-client/Cargo.toml
+
       - name: Print SynthStyle CONFORM CHECK counts
         run: ./scripts/desktop.sh conform
 

apps/synth_desktop/EVAL_DRIVER.md

@@ -49,9 +49,22 @@ bearer → `401`.
 
 ## Endpoints
 
+The log-store endpoint returns `ready`, `state`, `processId`, `source`,
+`executableDigest`, and `dataRootDigest`. Readiness requires an existing supervised
+child plus a fresh local health response (at most 1.5 seconds); stale supervisor
+state alone cannot pass. Binary SHA-256 and source are captured immediately before
+spawn, not inferred from whichever binary happens to resolve at query time. The
+root digest hashes the canonical diagnostics-directory path bytes; no new paths,
+tokens, or log contents are returned. Missing capture is null and must fail closed
+in packaged acceptance. This is launch-file evidence, not OS-level executable
+attestation against hostile local file replacement. `source=bundled` requires the
+packaged app's own Resources binary and no override. It does not prove that the
+diagnostics journal has been fully indexed, nor does it run a model turn.
+
 | Method | Path | Purpose |
 | --- | --- | --- |
 | `GET` | `/health` / `/v1/health` | Liveness + protocol + instance diagnostics |
+| `GET` | `/v1/diagnostics/log-store` | Read-only supervised log-store readiness and spawn identity |
 | `POST` | `/v1/sessions` | Create Codex session (`create_session`) |
 | `POST` | `/v1/sessions/{id}/messages` | Send turn (`send_message`) |
 | `POST` | `/v1/sessions/{id}/wait_terminal` | Poll journal until terminal run event |

apps/synth_desktop/package.json

@@ -14,6 +14,7 @@
     "frontend:dev": "vite --host 127.0.0.1",
     "frontend:build": "vite build",
     "package:prepare": "../../scripts/build-computer-use-helper.sh ensure-dev && npm run frontend:build",
+    "package:stage-diagnostics": "../../scripts/diagnostics/fetch-victorialogs.sh --if-missing",
     "preview": "vite preview --host 127.0.0.1",
     "typecheck": "tsc --noEmit -p tsconfig.json",
     "lint:app-css": "node scripts/lint-app-css.mjs",

apps/synth_desktop/scripts/app-css-debt-baseline.json

@@ -1,5 +1,5 @@
 {
 	"hexColors": 647,
-	"bareFontSizes": 520,
-	"bareBorderRadii": 299
+	"bareFontSizes": 538,
+	"bareBorderRadii": 340
 }

apps/synth_desktop/src-tauri/Cargo.toml

@@ -15,6 +15,8 @@ crate-type = ["rlib"]
 tauri-build = { version = "2", features = [] }
 
 [dependencies]
+mq-core = { path = "third_party/manderqueue/crates/mq-core" }
+mq-sdk = { path = "third_party/manderqueue/crates/mq-sdk" }
 synth-api-client = { path = "../../../crates/synth-api-client" }
 anyhow = "1"
 base64 = "0.22"

apps/synth_desktop/src-tauri/src/cloud/identity.rs

@@ -58,11 +58,15 @@ impl IdentityObservation {
             bail!("unsupported cloud identity authority contract");
         }
         let origin = reqwest::Url::parse(&self.backend_origin)?;
-        if origin.scheme() != "https"
+        // A plain-http loopback origin with an explicit port is the backend's
+        // APP_ENVIRONMENT=local-only form (grant contract v2 §9); it must also
+        // equal the configured expected origin below. Everything else is https.
+        let local_slot = crate::cloud::mailbox::grant::local_loopback_origin(&self.backend_origin).is_some();
+        let https = origin.scheme() == "https" && origin.port().is_none();
+        if !(https || local_slot)
             || origin.host_str().is_none()
             || !origin.username().is_empty()
             || origin.password().is_some()
-            || origin.port().is_some()
             || origin.query().is_some()
             || origin.fragment().is_some()
             || origin.path() != "/"
@@ -139,6 +143,20 @@ mod tests {
             )
             .is_err());
     }
+    #[test]
+    fn only_the_backend_local_loopback_form_may_be_http() {
+        let mut observation = fixture();
+        let now = observation.verified_at;
+        observation.backend_origin = "http://127.0.0.1:8000".into();
+        assert!(observation.validate("http://127.0.0.1:8000", now).is_ok());
+        // It must still equal the configured origin.
+        assert!(observation.validate("http://127.0.0.1:8001", now).is_err());
+        for refused in ["http://127.0.0.1", "http://10.0.0.5:8000", "http://127.0.0.2:8000", "http://cloud.example.test", "https://cloud.example.test:8443"] {
+            observation.backend_origin = refused.into();
+            assert!(observation.validate(refused, now).is_err(), "{refused}");
+        }
+    }
+
     #[test]
     fn authority_contract_cannot_be_downgraded() {
         let mut observation = fixture();