Add neutral macOS application ownership with exact workload identity by JasonVMo · Pull Request #4492 · microsoft/fluentui-react-native

Jason Morse (JasonVMo) · 2026-11-12T03:26:53Z

Platforms Impacted

Description of changes

Part of #4446; related to #4448 and epic #4435. The rebased qualification now covers interrupted acquired-record publication, owner death, and bounded known-descendant survivors. Arbitrary descendant containment, automatic recovery and broader reliability are not claimed.

Add neutral exact macOS attach identity and opt-in supervisor-owned application launch in @fluentui-react-native/desktop-test/application-ownership. Session-owned launch remains the default; attached apps stay external. Storybook's existing lifecycle/lease relocation remains deferred until after F9.
Publish pending/acquired applications as claim resources, including exact incarnation, causal launch kind and containment. Unknown publication/cleanup remains fenced; exit notifications are advisory. Both macOS launch kinds are explicitly uncontained.
Use the driver's native OS start identity in claim schema 3 (LIFE-8); legacy/unverified claims remain unknown. claimDesktopWorkload now returns a promise and its shared Storybook caller awaits it. The desktop-test release is minor; driver/Storybook releases are patches. Preserve the stable per-user claim root across differing TMPDIRs (LIFE-9).
Harden exact-primary cleanup, direct-child versus LaunchServices causality, duplicate/foreign/stale identity handling, cross-helper exclusion, and rejected-launch settlement without adopting uncertain survivors.
Fix the CI-discovered Storybook identity-observation regression: read-only inspectApplication shares descriptor/window verification without acquiring a lease, taking the application/input locks or changing session window records. Foreign controlling services remain excluded; Windows/Win32 identity attachment is unchanged.
Fix the additional defect exposed by AX-enabled qualification: the standalone macOS helper's warmed NSWorkspace.runningApplications cache omitted newly launched apps. Descriptor discovery now enumerates current-user kernel PIDs and constructs fresh application objects, preserving uniqueness and exact identity checks. Add a failing-first warmed-discovery/duplicate-bundle native regression.

Verification

Post-fix native qualification — November 13, 2026

Qualified the unchanged published head 507effebd8568e0ede8ffe651a5cade0b1b25168 after the console was unlocked. A nonprompting signed doctor reported on-console, unlocked, and Accessibility/PostEvent/ScreenCapture preflight true without prompting. Helper artifact 1429ce4663795bad31f545086ef80bffb83e9b9533287964991c5527388b2f6c and source c17944691081d30a320cf6e4393a5bb0ce6cece8dd71295a400dbc5e6a53b3cb are unchanged. All commands ran under the shared native lock with the signed helper; no tracked file, commit or push changed.

Exact command	Result
`FURN_NATIVE_DRIVER_TEST=1 FURN_NATIVE_PHYSICAL_INPUT_TEST=1 yarn workspace @fluentui-react-native/desktop-test test --runInBand applicationOwnership.contract applicationOwnership.test ownership.test`	Passed 43: 13 real AppKit + 30 portable; failed 0, skipped 0. Includes interrupted acquired-record publication and both owner-death/survivor scenarios
Direct native retirement scenario (real `crash-owner.mjs` owner with signed AppKit fixture built by `fixtures/build.cjs`)	Passed 4 checks. The ready owner exited 1 after about 120 s. Its helper exited on EOF while the app and known descendant survived. The unchanged claim stayed fenced and replacement was refused. The orphaned AppKit app exited without an operator signal, observed 315.258 s after native start for its 300 s main-queue timer. The 300 s descendant was confirmed exited by 315.069 s

Cleanup: all 41 tracked incarnations exited. Zero owned workload processes or claims remained, and the retirement runner sent no signals. All 76 session checks stayed unlocked with permissions granted. Fabric/Paper were not rerun because their ownership and accessible lanes use ReactTestApp, not the changed fixtures. Their results remain attributed to 16558610f. Hosted CI on this head passed 19/19. The post-fix native gap is closed. The local plain aggregate's unchanged boundedCommand failure below remains disclosed and was not retried. Evidence: artifacts/desktop/f10m/postfix-native-20261112/.

Final review fix and qualification boundary — November 12, 2026

Delivery head: 507effebd8568e0ede8ffe651a5cade0b1b25168, based on main 041ac8b9894aeaa7e1aa273baa2ece4e46298b94. One Opus 5.5 review of the new qualification code found an unbounded crash-owner wait. Fix 0fb6cd47fccc4f6210797b25085e7b56aa8ca4fe bounds the ready owner's wait at 120 seconds and gives the AppKit test fixture a main-queue retirement deadline of 300 seconds; its known sleep child was already bounded at 300 seconds. Production ownership, helper protocol, exact-identity cleanup and claim settlement are unchanged. Deadlines do not settle an abandoned claim or implement automatic recovery.

Exact command	Result
`node --check packages/agentic/desktop-test/fixtures/application-ownership/crash-owner.mjs`	Passed
`yarn workspace @fluentui-react-native/desktop-test test --runInBand applicationOwnership.test ownership.test`	Passed 30; no failures/skips. The new shared-wait retirement probe failed first with ETIMEDOUT, then exited nonzero with the expected diagnostic
`yarn workspace @fluentui-react-native/desktop-driver test --runInBand`	Passed 1,237; skipped 66; native opt-in absent
`yarn workspace @fluentui-react-native/desktop-test test --runInBand`	Passed 410; skipped 14; native opt-in absent
`yarn workspace @fluentui-react-native/desktop-driver exec desktop-driver --reporter json doctor --platform macos --permissions`	Diagnostic passed without prompting; permissions granted but `screenLocked=true`
`node packages/agentic/desktop-driver/native/macos/fixtures/build.cjs artifacts/desktop/f10m/retirement-followup-20261112/fixture`	Passed signed fixture compilation and strict signature verification; not launched
`yarn clean-lage-cache && yarn lage buildci`	Failed: unchanged `boundedCommand` SIGKILL/SIGTERM assertion; no retry or environment/concurrency override
`yarn lage test-links --verbose --grouped`	Passed 90 tasks

Owning build/lint/format, root formatting/instructions, changed Markdown checks and exact-worktree cleanup passed. Post-fix native runtime qualification was initially blocked by the locked console; it is now complete (see above). The Fabric/Paper results below still qualify the pre-retirement-fix snapshot. Evidence: artifacts/desktop/f10m/retirement-followup-20261112/.

Pre-retirement-fix rebased qualification

Qualified snapshot: 16558610ff2bd14775430f86c738c12947fe81ee, rebased onto main 041ac8b9894aeaa7e1aa273baa2ece4e46298b94. Qualification-only commit d5a7530a9f2d4cb78721a36c1109b5c36fbdc5a1 adds native fixtures/tests; production ownership/helper behavior is unchanged by that follow-up. Both F6 provenance and the previous evidence ledgers are preserved. The #4492 → #4494 native stack remains #4495.

The native environment below was used only for signed/native commands, with FURN_NATIVE_PHYSICAL_INPUT_TEST=1 additionally enabled for the focused ownership contract. Portable commands and the plain aggregate had native/signing overrides and TF_BUILD absent, inherited TMPDIR, and no aggregate concurrency override. All native and aggregate work was serialized under the shared native lock.

Exact command	Result
`yarn install --immutable`	Passed; existing peer warnings
`yarn workspace @fluentui-react-native/desktop-test test --runInBand applicationOwnership.contract applicationOwnership.test ownership.test --cacheDirectory "$PWD/artifacts/desktop/f10m/rebased-qualification-20261112/jest-ownership"`	Passed 42: 13 real AppKit and 29 portable; zero failures/skips
`yarn workspace @fluentui-react-native/desktop-driver test --runInBand --cacheDirectory "$PWD/artifacts/desktop/f10m/rebased-qualification-20261112/jest-driver-native"`	Passed 1,256; failed 0; skipped 47
`yarn workspace @fluentui-react-native/desktop-test test --runInBand --cacheDirectory "$PWD/artifacts/desktop/f10m/rebased-qualification-20261112/jest-harness"`	Passed 409; failed 0; skipped 14; the 13 AppKit cases ran separately
`yarn workspace @fluentui-react-native/storybook-desktop test --runInBand --cacheDirectory "$PWD/artifacts/desktop/f10m/rebased-qualification-20261112/jest-storybook"`	Passed 392; failed 0; skipped 4
`STORYBOOK_SMOKE_STORY=components-button--default yarn storybook --reporter json smoke --macos --mode stories-and-tests --input accessible`	Passed 224; no failures/skips/unsupported/retries
`STORYBOOK_SMOKE_STORY=components-button--default yarn storybook --reporter json smoke --macos --paper --mode stories-and-tests --input accessible`	Passed 224; no failures/skips/unsupported/retries
`yarn lage test-links --verbose --grouped`	Passed 90 tasks
`yarn clean-lage-cache && yarn lage buildci`	Failed: desktop-test package dry-run exited 1; immediate identical package dry-run passed without changes
`yarn lage buildci` (two unchanged retries)	Failed: unchanged `boundedCommand` SIGKILL/SIGTERM assertion; first retry also had a private-storage timeout, which passed on final retry
`yarn workspace @fluentui-react-native/desktop-driver test --runInBand boundedCommand privateStorage`	Passed 73; skipped 10; serial diagnostic, not aggregate acceptance

Owning package build/lint/format, root formatting, changed Markdown checks and git diff --check passed; exact commands are recorded in the owning status ledgers. Fabric and Paper were separately prepared/rebuilt and each passed all nine ownership/lifecycle checks with zero cleanup failures. Each smoke excluded one physical callback before selection; that callback is not counted as passed or skipped.

New native cases retain fences after failed acquired-record publication, kill independent owners before/after acquired-record publication, verify exact surviving app/known-child identities, and perform exact operator cleanup. The known descendant survives primary-process cleanup, demonstrating uncontained, not general containment. Final cleanup proved 24 recorded incarnations exited, three ports closed, and no worktree workloads or claims remained.

Still unqualified: arbitrary descendant discovery/containment, actual forced OS PID recycling, TCC revocation/durable helper-owned grants, power-loss rename, Metro/channel survivors, automatic adoption/recovery, repeated-run reliability, and the historical LaunchServices causal-acquisition anomaly. F9 lifecycle relocation and F11 handoff remain separate. Windows/Win32 native evidence belongs to upper #4494; no Windows native run is claimed from this Mac. Apple/Office bridging checks do not apply to the standalone helper.

Local aggregate remains failed, independently of the passing focused/native/renderer checks. Hosted CI must be evaluated on the pushed head; no serial pass is substituted for that gate. Evidence: artifacts/desktop/f10m/rebased-qualification-20261112/ and packages/agentic/desktop-test/artifacts/desktop/application-ownership-kffNMN/evidence.json.

Historical pre-rebase qualification

The following retains the original results and limitations at the earlier revision; the rebased section above supersedes its publication/survivor gaps and draft recommendation.

Observed, November 12, 2026: macOS 27.2.1 arm64, signed AppKit fixture and real Agentic Components Storybook, separately on Fabric and Paper. Delivery commit: 6489386956c0485cb91b478a8f4adc4828f4178b, based on 9395737943d7e1402a40a67a41dc605ef0afb24b plus the live-discovery fix. Native/GUI/physical-input and aggregate commands ran under $HOME/Library/Caches/furn-overnight/with-native-lock.sh. The default TMPDIR was retained for this requalification.

Native environment: FURN_NATIVE_DRIVER_TEST=1, signing identity FURN Desktop Driver Development, helper cache $PWD/artifacts/desktop/f10m/helper; the ownership suite additionally uses FURN_NATIVE_PHYSICAL_INPUT_TEST=1. Helper artifact: 1429ce4663795bad31f545086ef80bffb83e9b9533287964991c5527388b2f6c; native source digest: c17944691081d30a320cf6e4393a5bb0ce6cece8dd71295a400dbc5e6a53b3cb.

Exact command	Result
`yarn workspace @fluentui-react-native/desktop-driver format --check`	Passed
`yarn workspace @fluentui-react-native/desktop-driver build`	Passed
`yarn workspace @fluentui-react-native/desktop-driver lint`	Passed
`yarn workspace @fluentui-react-native/desktop-test format --check`	Passed
`yarn workspace @fluentui-react-native/desktop-test build`	Passed
`yarn workspace @fluentui-react-native/desktop-test lint`	Passed
`yarn workspace @fluentui-react-native/storybook-desktop format --check`	Passed
`yarn workspace @fluentui-react-native/storybook-desktop build`	Passed
`yarn workspace @fluentui-react-native/storybook-desktop lint`	Passed
`yarn workspace @fluentui-react-native/desktop-driver exec desktop-driver --reporter json doctor --platform macos --permissions`	Passed; Accessibility/PostEvent/ScreenCapture preflight true, unlocked/on-console, `promptRequested=false`; repeated separately for both renderers
`yarn workspace @fluentui-react-native/desktop-test test --runInBand applicationOwnership.contract applicationOwnership.test ownership.test --cacheDirectory "$PWD/artifacts/desktop/f10m/ax-qualification-20261112/jest-native-harness"`	Passed 39, failed 0, skipped 0: 10 native tests plus 29 portable regressions
`yarn workspace @fluentui-react-native/desktop-driver test --runInBand --cacheDirectory "$PWD/artifacts/desktop/f10m/ax-qualification-20261112/jest-desktop-driver-full"`	Passed 1,255, failed 0, skipped 47; native opt-in and stable signing enabled
`yarn workspace @fluentui-react-native/desktop-driver test --runInBand --cacheDirectory "$PWD/artifacts/desktop/f10m/ax-qualification-20261112/jest-desktop-driver-portable"`	Passed 1,236, failed 0, skipped 66; native/signing overrides unset
`yarn workspace @fluentui-react-native/desktop-test test --runInBand --cacheDirectory "$PWD/artifacts/desktop/f10m/ax-qualification-20261112/jest-desktop-test-portable"`	Passed 409, failed 0, skipped 11; all 10 opt-in AppKit tests separately passed in the signed selection
`yarn workspace @fluentui-react-native/storybook-desktop test --runInBand --cacheDirectory "$PWD/artifacts/desktop/f10m/ax-qualification-20261112/jest-storybook-desktop-portable"`	Passed 344, failed 0, skipped 4; native/signing overrides unset
`yarn storybook --reporter json bundle --macos`; `yarn storybook --reporter json prep --macos`; `yarn storybook --reporter json run --macos`	Passed; Fabric native build and instance-bundle launch
`yarn storybook --reporter json bundle --macos --paper`; `yarn storybook --reporter json prep --macos --paper`; `yarn storybook --reporter json run --macos --paper`	Passed; separate Paper prep, native build and instance-bundle launch
`STORYBOOK_SMOKE_STORY=components-button--default yarn storybook --reporter json smoke --macos --mode stories-and-tests --input accessible`	Passed 224, failed 0, skipped 0, unsupported 0; retries 0
`STORYBOOK_SMOKE_STORY=components-button--default yarn storybook --reporter json smoke --macos --paper --mode stories-and-tests --input accessible`	Passed 224, failed 0, skipped 0, unsupported 0; retries 0
`yarn lage test-links --verbose --grouped`	Passed 90 tasks, failed 0, skipped 0
`yarn clean-lage-cache && yarn lage buildci --concurrency 1`	Passed 178 tasks, failed 0, skipped 0, pending 0, aborted 0; serial diagnostic only, not plain aggregate acceptance; under the native lock, `TF_BUILD=1`, default TMPDIR, native/signing overrides unset
`yarn markdown-link-check -c .github/markdown-link-check-config.json packages/agentic/desktop-driver/native/macos/README.md`	Passed 12 links
`yarn markdown-link-check -c .github/markdown-link-check-config.json packages/agentic/desktop-driver/references/current-status.md`	Passed 6 links
`yarn markdown-link-check -c .github/markdown-link-check-config.json packages/agentic/desktop-test/references/current-status.md`	Passed 15 links
`yarn markdown-link-check -c .github/markdown-link-check-config.json .changeset/neutral-macos-application-ownership.md`	Passed; no links
`yarn oxfmt --check`	Passed repository-wide

Real ownership acceptance: Fabric and Paper each passed all 9 qualification checks, with 0 failed/skipped and 0 cleanup failures. The neutral supervisor-owned app survived two borrowed sessions and exited at supervisor disposal. Externally attached apps survived both external owners' cleanup. Independent native helpers refused controlling attach with application-lock-busy; the independent WebDriver service refused new-session control. Releasing the first lease permitted the second service to attach. Read-only inspection succeeded while control was held and preserved window handles. Neutral schema 3 claims verified exact OS owner/application identity and registered target/instance IDs, then released after settled cleanup.

Scope: Storybook's transitional outer CLI claim still has unregistered target/instance placeholders; its exact OS owner/run identity is verified, but this is not a completed F9 lifecycle migration. Each smoke traversed 223 catalog entries and executed the one manifest-selected Button semantics callback. One physical-pointer callback was excluded before selection, not passed or skipped. The AppKit mutex test separately passed with only bounded Shift down/up input; these smokes do not qualify pointer/capture behavior.

TCC responsibility: both renderer runs observed the same stable signer/designated requirement with effective Accessibility/PostEvent permissions under the Rex Server.app responsible process tree. No TCC/privacy settings were changed. This does not establish a first-run/durable helper-owned grant, another process tree, clean-machine/PPPC behavior or permission revocation.

Failing-first evidence: the initial AppKit run passed 8 and failed 1; the added warmed-discovery regression failed before the fix (1 failed, 9 skipped). The final focused run passed 39/39. Exploratory Fabric toolchain/qualifier failures and their exact cleanup are retained separately, not counted as passes. CocoaPods prep selected the already-installed JSON 2.18.0 through a project-local Ruby preload because Ruby 4.0.6 selected incompatible JSON 3.1.0; no package installation, Podfile/generated-source patch or global Ruby change was made.

Scope correction: a broad native-enabled harness attempt recorded 416 passed, 3 failed, 1 skipped. Two portable fixtures replaced HOME while inheriting the signing override, hiding that keychain. One LaunchServices acquisition could not prove its causal incarnation and correctly preserved an unknown process; its precise cause is unestablished. Exact operator cleanup verified its native identity, run-specific executable and launch interval, then proved exit. The discovery-only regression now uses externally started, native-identified children instead of unrelated LaunchServices setup; no causal guard was relaxed. The signed selection and portable full suites subsequently passed in separate environments. This does not resolve causal-acquisition reliability.

Evidence: both owning references/current-status.md ledgers contain exact commands, counts, identities, cleanup and remaining gates. Raw evidence: artifacts/desktop/f10m/ax-qualification-20261112/. Final AppKit: packages/agentic/desktop-test/artifacts/desktop/application-ownership-1V0SrR/evidence.json. Fabric smoke: apps/storybook/artifacts/desktop/616bf2e8-a675-408f-bd56-2e09982ea969/run.json. Paper smoke: apps/storybook/artifacts/desktop/19358539-eed2-49e9-9c9a-79b5e7db4e9f/run.json.

Observed final cleanup: after the aggregate, all 31 recorded exact process incarnations were exited, all three reported ports refused connections, and scoped command-line/working-directory inspection found zero worktree workload processes. The shared workload claim and all interactive.lock files in eight native/renderer/failed-attempt artifact roots were absent. The locked verifier exited 0; a following locked true reacquired and released the native lock. cleanup-final.json/.log record the checks. No helper, fixture, app, driver service or Metro from this worktree remains; experimental scratch sources were removed while retaining their evidence.

Not run/unqualified: causal-acquisition reliability after the observed unverifiable LaunchServices snapshot; arbitrary surviving descendants, interrupted native publication, supervisor-death survivors, live failed-cleanup/restart fault injection, native Windows/Win32 packaged-survivor journaling/recovery and repeated-run reliability. Ordinary hosted Windows driver-native/smoke CI does not exercise that harness survivor gate. Windows CI sufficient: no; keep draft. Apple/Office module and bridging-header checks are inapplicable to this standalone helper. New-head CI monitoring belongs to the coordinator.

Before	After
Generic attach depended on Storybook identity; launched apps ended with sessions; claims estimated owner start time and omitted application resources. Warmed helper discovery missed new apps.	Neutral exact macOS ownership, opt-in supervisor lifetime, OS-verified claims and live discovery. Signed AppKit and separate Fabric/Paper lifecycle/inspection/exclusion passed, including bounded publication/owner-death/known-descendant cases; arbitrary containment and automatic recovery are not claimed.

Pull request checklist

This PR has considered (when applicable):

github-actions · 2026-11-12T03:29:31Z

Bundle size report

Tree-shaken, minified production esbuild bundles with React and React Native runtimes externalized.

Scenario	Modules-Mac (Δ)	Modules-Win (Δ)	Size-Mac (Δ)	Size-Win (Δ)
components-button	79 (+1)	80 (+1)	72.92k (-702b)	72.85k (-702b)
components-catalog	228 (+1)	229 (+1)	229.66k (+349b)	229.59k (+349b)
design-themed-root	55 (+4)	56 (+4)	56.26k (+998b)	56.18k (+998b)
design-color-lib	6 (+0)	6 (+0)	6.27k (+0b)	6.27k (+0b)
design-theme-state-legacy-source	49 (+1)	50 (+1)	52.96k (-841b)	52.89k (-841b)
design-legacy-theme	42 (+0)	42 (+0)	39.11k (+0b)	42.91k (+0b)
design-legacy-theme-from-flex	58 (+4)	58 (+4)	60.70k (+824b)	64.51k (+822b)
design-fluent-light-theme	7 (+0)	7 (+0)	18.74k (+0b)	22.59k (+0b)
design-fluent-theme	35 (+0)	35 (+0)	27.46k (+4b)	31.25k (-1b)
design-fluent-hc-theme	32 (+0)	32 (+0)	27.34k (+0b)	31.13k (+0b)
design-flex-theme	29 (-4)	29 (-4)	14.30k (-9.07k)	14.29k (-9.07k)
design-flex-cool-theme	26 (New)	26 (New)	12.51k (New)	12.50k (New)
design-flex-warm-theme	26 (-7)	26 (-7)	12.28k (-11.15k)	12.27k (-11.15k)

The job is advisory: size changes are reported but do not fail the pull request. Bundle or analysis errors still fail.

View bundle-size workflow run

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

…tity Record pending and acquired application claim resources, retain opt-in supervisor launches across sessions, and fail closed on ambiguous ownership. Preserve exact kernel incarnations through launch, attach, cancellation and cleanup, and exclude other helpers for the same application. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Keep exact process capture bound to the causal child or LaunchServices application, retain bounded native error metadata, and cover Windows/Win32 application-survivor claims. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

LaunchServices rejected the inherited macOS 28.0 minimum on this macOS 27.2.1 machine. Align the fixture compiler/bundle minimum with the helper, import the new public neutral entry in its consumer fixture, and account for bounded diagnostic truncation markers in the protocol schema. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

…g gates Record frozen-source native identity, rejected direct-child and LaunchServices cleanup, and portable claim/survivor regressions. Preserve separate Accessibility-blocked positive lifecycle, Fabric/Paper, descendant, physical mutex and Windows native survivor gates. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Use explicit code paths for cross-package evidence and provider references, as required by check-agent-instructions. Native qualification remains tied to its recorded frozen source. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

The corrected clean-cache buildci run passed 176 tasks with two cache skips and no failures. Record its exact source, environment and the prior owned guidance-link correction without promoting blocked native gates to passes. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Distinguish not-started acquisitions from uncertain dispatch, preserve launched applications only on actual lock contention, and version the async claim API as a minor release. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Observe the authenticated Storybook bridge incarnation through the session helper without taking another controlling lease or disturbing its window records. Preserve foreign-service exclusion and the existing Windows identity attachment path. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Trace both Storybook CI failures to competing identity attachment, record the default-TMPDIR focused regressions and full package checks, and preserve the positive native qualification gates. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Preserve the unexplained first aggregate failure, the unchanged isolated Storybook pass, and the successful serialized clean-cache aggregate without treating portable results as positive native qualification. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Enumerate current-user PIDs for warmed descriptor discovery and refuse unavailable enumeration. Cover newly launched and duplicate bundle identities with a native regression. Record signed AppKit ownership/input and separate Fabric/Paper smoke evidence without closing the remaining causal-acquisition and survivor gates. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Exercise real AppKit acquisition publication failure and abrupt exact-owner death before and after acquired-record publication. Preserve fenced claims while native apps and known uncontained descendants survive, then verify exact operator cleanup. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Preserve the independent F6 provenance evidence and record signed AppKit interrupted-publication and survivor results, exact cleanup, full package checks, and remaining qualification limits. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Jason Morse (JasonVMo) · 2026-11-12T22:55:16Z

Windows coordinator note, for coordination only; no push to this branch.

This branch is now dirty against main after #4490 merged (041ac8b98). The only conflict is the end-of-file append in packages/agentic/desktop-test/references/current-status.md: #4490 appended "## F6 generated manifest provenance — 2026-11-12" at the same place.

Effect on the stack: #4494 (Windows F10-W, head da89fe9bc) still shows mergeable_state: unknown. Its refs/pull/4494/merge is stale at the previous head, and no PR Actions run has started for da89fe9bc. #4494 itself merges cleanly into this branch (git merge-tree exit 0).

The Windows branches #4491 and #4498 are moving their self-contained Windows sections to separate mid-file anchors, with no merge or rebase, so they no longer collide with end-of-file appends.

Record both 224-case consumer smokes and exact cleanup, while retaining the failed plain aggregate evidence and known boundedCommand startup assertion. No concurrency/environment workaround or unrelated fix was used. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Retire the interrupted-publication owner nonzero after two minutes and request AppKit fixture shutdown after five minutes. Exercise the same wait in the existing portable ownership suite without acquiring native resources; preserve exact-identity cleanup and durable workload fences. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Retain portable red/green, signed compile, locked-console native limitation, single plain aggregate failure, and exact-worktree cleanup evidence without carrying pre-fix runtime results forward. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Implement F10-W on the neutral application-resource contracts from #4492, pinned at 6489386. Preserve exact identity, per-incarnation exclusion, and bounded survivor reconciliation. Packaged activation remains explicitly uncontained; unknown or unleased work stays fenced. Part of #4447. Part of #4435. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 3be5f341-831b-40d4-9582-337c8ea65709

…onvmo/desktop-macos-app-ownership # Conflicts: # packages/agentic/desktop-driver/references/current-status.md # packages/agentic/desktop-test/README.md # packages/agentic/desktop-test/references/current-status.md Co-authored-by: JasonVMo <35609178+JasonVMo@users.noreply.github.com>

…onvmo/desktop-macos-app-ownership # Conflicts: # packages/agentic/desktop-driver/references/current-status.md # packages/agentic/desktop-test/references/current-status.md Co-authored-by: JasonVMo <35609178+JasonVMo@users.noreply.github.com>

This was referenced Nov 12, 2026

Record permission-enabled macOS evidence and qualification gaps #4493

Merged

feat(desktop-test): qualify Windows application ownership and containment #4494

Open

Jason Morse (JasonVMo) added this pull request to stack #4495 November 12, 2026 18:41

Vladimir Morozov (vmoroz) approved these changes Nov 12, 2026

View reviewed changes

Jason Morse (JasonVMo) and others added 17 commits November 12, 2026 22:21

Add neutral host preparation seam to desktop service startup

19bc0cd

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Add isolated AppKit fixture for native application ownership contracts

50c1f86

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Record launch settlement review qualification

12ec40a

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Record final clean-cache ownership review validation

9113909

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Jason Morse (JasonVMo) and others added 3 commits November 12, 2026 23:08

Jason Morse (JasonVMo) force-pushed the user/jasonvmo/desktop-macos-app-ownership branch from 6489386 to 507effe Compare November 12, 2026 23:31

Jason Morse (JasonVMo) marked this pull request as ready for review November 13, 2026 00:15

Jason Morse (JasonVMo) assigned Copilot Nov 13, 2026

Copilot started work to resolve merge conflicts on behalf of Jason Morse (JasonVMo) November 13, 2026 06:56

View session

Copilot finished work on behalf of Jason Morse (JasonVMo) November 13, 2026 07:14

Copilot started work to resolve merge conflicts on behalf of Jason Morse (JasonVMo) November 13, 2026 08:02

View session

Copilot finished work on behalf of Jason Morse (JasonVMo) November 13, 2026 08:16

Copilot started work to fix failing Actions workflows on behalf of Jason Morse (JasonVMo) November 13, 2026 10:55

View session

Copilot finished work on behalf of Jason Morse (JasonVMo) November 13, 2026 10:58

Jason Morse (JasonVMo) merged commit c57dcd8 into main Nov 13, 2026
35 of 36 checks passed

Jason Morse (JasonVMo) deleted the user/jasonvmo/desktop-macos-app-ownership branch November 13, 2026 12:52

Navigation Menu

Repository navigation

Add neutral macOS application ownership with exact workload identity - #4492

Add neutral macOS application ownership with exact workload identity#4492
Jason Morse (JasonVMo) merged 22 commits into
mainfrom
user/jasonvmo/desktop-macos-app-ownership

Jason Morse (JasonVMo) commented Nov 12, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Nov 12, 2026 •

edited

Loading

Uh oh!

Jason Morse (JasonVMo) commented Nov 12, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

Jason Morse (JasonVMo) commented Nov 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Platforms Impacted

Description of changes

Verification

Post-fix native qualification — November 13, 2026

Final review fix and qualification boundary — November 12, 2026

Pre-retirement-fix rebased qualification

Historical pre-rebase qualification

Pull request checklist

Uh oh!

github-actions Bot commented Nov 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Bundle size report

Uh oh!

Jason Morse (JasonVMo) commented Nov 12, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Jason Morse (JasonVMo) commented Nov 12, 2026 •

edited

Loading

github-actions Bot commented Nov 12, 2026 •

edited

Loading