Desktop Material — Feature and Acceptance Plan

The build plan, August 2 2026

Eighteen roadmap items, mirrored one-to-one into issues #118-#135. Two rules set by the project owner govern every one of them:

1. Every screenshotted feature MUST be added. Not should - must. If it does not exist, it is built from scratch, a web server included, and a way is found. "We don't have that", "that needs a service we don't run" and "that is not possible here" are answers to nothing. Nothing on the list is cut for being hard.
2. Anything server-shaped is hosted in Docker, by the user. No vendor backend anywhere. Installation is a fully automated, wizard-guided flow inside the app.

Order of work, and why

Phase 1 - the server, because almost everything else needs it. R1 (self-hosted Docker server + wizard) then R2 (OAuth server: SSO, multi-domain SSO, SAML). R13 collaboration, R18 patches, R6 conflict detection and R11's team view all sit on top of these, so anything built before them either has to be rebuilt or ships single-player only. R1 is the critical path in the literal sense: it is the longest chain, and it starts at zero.

Phase 2 - the gate, before anything sends code anywhere. R14 (admin and AI security controls). Every AI feature - R7 merge resolution, R9 compose commits, R10 summarize changes, R12 review suggestions - has to ask it what may leave the machine. Building those first means retrofitting a gate onto four features instead of building four features against a gate.

Phase 3 - the two already in flight. R3 (history graph view) and R4 (Agents panel). Neither needs the server. R3 also turns out to be a prerequisite for two later items: R8 hangs its context menu off the graph, and R15's live-synchronized terminal needs that graph to refresh from an external mutation rather than only from the app's own.

Phase 4 - the palette, which is cheap and large. R5. The audit is done: 108 concrete additions across both halves. 55 need only a palette:* case calling one dispatcher method or one showPopup. The rest need a teleport anchor first, and 16 of those collapse into a single initialTool prop on the Repository Tools hub. Two shipped rows are also wrong and should be fixed in the same pass - palette:tag-lifecycle lands on Status summary rather than Tag lifecycle, and three signing rows teleport to an anchor no element renders.

Phase 5 - the rest, in rough value order. R7, R9, R10 (the AI trio), R8 (graph context menu), R11 (Launchpad), R12 (PR review), R6 (conflict detection), R18 (patches), R13 (collaboration), R15 (terminal), R16 (issue trackers), R17 (parity gaps).

What "done" means for an issue

An issue closes when the feature genuinely works and has been verified - not when the code compiles and not when a test passes in isolation. For R1 that means a wizard run on a clean machine with no Docker, producing a reachable server a second machine can join. For anything with a visible surface it means a screenshot of that surface, from a real build, posted on the issue.

Two honesty rules carried forward

• The parity table in ROADMAP.md is a grep-level answer, not a parity claim. It must not be quoted as evidence that something works.
• The coding agent picker ships Codex CLI and OpenCode only, because those are the two with real runners. Claude Code, Gemini CLI and Copilot CLI were dropped rather than shown as entries that do nothing.

Current status

July 21 reviewed pull preview

Ordinary toolbar and menu pulls use a prepared-review workflow: fetch the exact configured upstream, capture refs/OIDs and Git strategy inputs, show bounded incoming commits and paths, and require explicit confirmation. Execution checks the same identity, strategy snapshot, and clean worktree immediately before running git pull . <reviewed-oid> with the frozen integration flags. The dialog is globally modal and cannot be dismissed during fetch or integration; the direct noninteractive automation path remains available. English, playful Hong Kong-style Cantonese, and compact bilingual copy share the same safety contract. Detailed verification and capture receipts are in HANDOFF.md and .codex/run-manifests/2026-07-21-preview-pulls-publish.md.

Milestones M0 through M21 are shipped on main. M22 owner-scoped management remains in its separately tracked visual-publication acceptance, while the M23 Ollama model manager is complete, published, and remotely verified. M24's guided sparse-checkout implementation and local acceptance are complete. The concise public status and current maintenance gates live in ROADMAP.md; this document keeps the detailed implementation ledger, architecture contracts, and historical acceptance evidence. Build, screenshot, CI, Pages, wiki, privacy, and cleanup receipts remain in HANDOFF.md and the publish-mode run manifests.

Post-M19 appearance customization, adaptive app-bar overflow, Material entry surfaces, tab management, Actions cancellation, reviewed rebase, repository account propagation, OAuth scope alignment, and compact-surface corrections are shipped and retain their historical build, headless, main, CI, Pages, wiki, and cleanup receipts below and in HANDOFF.md.

The current appearance architecture supersedes the original aggregate design. Every customizable owner is edited from an anchored right-click surface and has its own versioned setting, local Git repository, and history manager. General Appearance now contains ordinary preferences; Repository Settings has no Appearance tab. The toolbar owner additionally provides localized text color and complete bounded font controls. Repository typography is a partial layer over its profile, and the adaptive toolbar remeasures whenever that layer changes.

The July 18–19 maintenance target also implements temporary navigation from an initialized submodule back to its persisted root repository, exact persisted English/Hong Kong Cantonese/bilingual language modes, and per-profile Back control styling. CI updater tests now choose a per-job loopback port, and release publication is gated on successful CI for the exact eligible main SHA. The exact production build and ten-pass headless local acceptance are complete; the post-build child/read-only/Back regression and owned headless-resource cleanup are also complete. Initial remote CI exposed a macOS arm64 symlink/junction error-ordering issue, correctly withholding a release; the focused 98d93ccc correction passed remote CI and CodeQL and published v3.6.3-beta3-b0000000165. Exact Pages, wiki, asset, and cleanup receipts are recorded in HANDOFF.md and the canonical wiki.

M21 closes the 30 demand-backed workflow gaps in the July 19 research brief. The canonical item-by-item map is docs/features/github-desktop-demand-backlog.md; its category documents define configuration, failure recovery, security bounds, and focused verification. The implementation extends existing account, repository, Git, provider, store/dispatcher, and Material UI contracts rather than introducing a new application HTTP endpoint, so no new Postman collection is applicable.

M23 adds a purpose-built local Ollama lifecycle workspace to Copilot provider preferences. It separates health/version, installed inventory, running state, and selected-model details; supports search/filter, streamed pull with cancellation, copy and guarded rename, load/unload, and confirmed delete; and synchronizes the authoritative installed inventory back to the provider's selectable Copilot model list. Endpoint validation requires one terminal /v1, permits only an exact loopback base, and derives fixed native /api/* routes from that origin while rejecting remote hosts, arbitrary prefixes, credential-bearing URLs, queries, and fragments.

All visible and accessible strings follow English, playful Hong Kong Cantonese, or bilingual mode. The complete workflow, failure, privacy, and API contracts are in docs/features/integrations/ollama-model-manager.md.

Local acceptance built exact source 27ffc1af7dd1223809c69ea0f72ddab369869f31 through the required low-level MCP production path in 213.16 seconds. The deterministic fixture verified the full health, inventory, search, running-state, pull/cancel/rollback, pull, copy, rename, load, unload, confirmed-delete, and provider-synchronization lifecycle. The accepted privacy-safe capture is 1452×1001 and 128,903 bytes with SHA-256 f1735c664248cd1b10a64e672dbbab24c95dabab99a62deeaf93557145a36509; its geometry receipt reports zero overlaps and no horizontal overflow. Owned runtime resources were cleaned. Final exact-main Windows CI, Pages, and wiki publication checks passed; exact receipts are recorded in HANDOFF.md and the M23 publish-mode run manifest.

M24 turns the existing bounded cone-mode sparse-checkout operation into a persistent Choose/Adjust/Restore → Review selection → Apply and refresh workflow. The guide remains in a fixed region above the scrolling editor/review body, stacks at compact widths, and distinguishes empty, invalid, ready, locked-review, running, and settled-result states. Review freezes the editor, lists the complete bounded normalized selection, and reports either selected roots or added/removed/unchanged roots. The Apply/result phase persists through success, cancellation, or failure until an edit or manual refresh starts a new pass.

Exact application source 255ad0c2283dd3a86328808a373a5438526bdaec passed 23 focused parser, Git-safety, guided-behavior, and layout checks, TypeScript, targeted ESLint/Prettier, the 41-test gallery-driver contract, and the required low-level-MCP production build in 254.90 seconds. The accepted Choose and Review captures are 1452×1001, 112,506 and 125,413 bytes, with SHA-256 values 8ee7149da7eb045bcda347067dcf2d88c32a626829402c97a52df2d60b2a3576 and d536c936e1888c5ea7712bb746ec6eac302ae204edd170ab55379455aeda6a5d. Both passed original-resolution privacy/layout review and byte-for-byte promotion; the app, hidden desktop, provider, credentials, ports, and owned Temp root were removed.

Product milestone ledger

M19 guided parity implementation ledger

Current customization and adaptive-surface ledger

July 18 submodule navigation and delivery-hardening ledger

July 18–19 local acceptance receipts

The exact low-level MCP server ran from checkout 8d6940be6a5f6e7c37de3f73acd2259fa7651efe at http://127.0.0.1:8765/mcp. One off-screen desktop, DesktopMaterialDebug10-20260718-232824, carried the full run. The synthetic provider used PID 12096 and loopback port 50158; app-native CDP used 62241. The earlier accepted exact production build returned zero in 215.38 seconds (217 seconds wall time). After the later stale-parent correction, the same MCP command rebuilt the renderer, but its client stream detached before returning a receipt; the fresh bundle passed the final off-screen duplicate Open/Back race regression recorded in .codex/run-manifests/2026-07-19-final-exact-race-regression.md.

The debug loop and final safety audit corrected both product and verification defects: continuous repository-database persistence checks; robust toolbar/rail selectors and async waits; capture-only tooltip cleanup; Windows directory fsync; profile-lock recovery when one process ID owns a different renderer lifetime; localized stale-workspace recovery; notification-panel timing and close behavior; and the recursive log-history profile Git-bookkeeping loop. Localization now uses separate resources and semantic localized spans. Comprehensive temporary-child mutation, cache, listener, abort, and asynchronous generation guards reject unsafe operations while preserving read-only Repository Tools.

The final stable focused set passed 237/237; the lifecycle and localization sets passed 66/66 and 32/32, respectively. The supervised full unit command passed all 562 test files in three batches: 3,986 tests passed and one was skipped; the final batch passed 537/537. Script tests passed 16/16. TypeScript, full lint, actionlint, and git diff --check also passed.

The inspected supplementary frames were the 1443×993 stale bilingual recovery state (pass-09-stale-error.png, 163,335 bytes, 33a595e1faf1b7ade1b523c254ef826c0a9e5239c84a184a84e7cfe6f6b50a6b), Actions pagination (1440×960, 109,546 bytes, bd682b6f465012f0737fd6e47eb054bdb58333c13d2eaaffdf092523b0529325), and Releases (1440×960, 146,415 bytes, 8dea0b61a0da101c730cb93e3534b5281d9aa3392c75acef8a1944cc36fbc1fb). The provider sweep also accepted the effective-branch-rules frame. After the final build, a separate 1440×960 child/read-only capture was accepted at 134,223 bytes (53bae0c04eccedbafa4dbb749151b00df4d95fadce701758259ffd049fdc89ad), then Back restored the root in a clean 159,924-byte frame (e11956f58a18216bd90b65276890f86579e0bdd1b559268a139861fe2f94dcf0). Both were inspected at original pixels.

The log-history repository remained at af8c8e91c8d99f0bf99f05dd46c7903d2ef9baf1, count 22682, and clean status across an eight-second idle check. Before disposal, the fixture root was at 5f4cc173 with only the expected submodule-pointer modification, while the child was clean at de377c26. The owned app/provider processes, ports 62241 and 50158, credential entry, headless desktop, and run root were then removed and independently confirmed absent.

A final privacy review rejected the first two Repository Tools promotions because their explanatory copy exposed the verifier account's Temp path. They were recaptured from the same production bundle with the synthetic C:\DesktopMaterialEvidence-20260719\fixture checkout. The replacement regular and real-scrolled frames were inspected at original pixels, promoted with the hashes below, and the exact recapture app, port 62243, hidden desktop, and neutral evidence root were then removed and confirmed absent.

Remote implementation receipts are complete: initial implementation 751c9aef reached Pages and CodeQL but failed macOS arm64 error-ordering tests and produced no release; correction 98d93ccc passed CI 29696805239, CodeQL 29696805243, and Build Installers 29697597981, which published v3.6.3-beta3-b0000000165. The corresponding Pages, wiki, asset, and cleanup details are recorded in HANDOFF.md.

Additional completed product work

• The per-repository .gitignore manager, template catalogue, suggestions, and reversible marker-section merge live in app/src/lib/gitignore/ and app/src/ui/repository-settings/.
• Build & Run auto-detects bounded nested projects across Node/npm/yarn/pnpm/bun, Deno, Rust, Go, .NET, Python, Java/Kotlin, PHP, Ruby, Swift, Dart/Flutter, Elixir, Scala, Haskell, Zig, Make, and CMake, with project folders shown in every profile label projects; handles multiple .NET projects; can install missing toolchains; streams logs; minimizes; and stores per-repository settings under app/src/lib/build-run/, app/src/main-process/, and app/src/ui/build-run/.
• Fork update checks and release feeds point to the Desktop Material repository, not the upstream GitHub Desktop updater.
• The design/ prototype sources are published as a sanitized five-file set; sample identities and private-looking endpoints were replaced, while raster files with identifiers baked into pixels or metadata were intentionally excluded.
• GitHub Actions job logs use Electron-managed redirects so Chromium receives the signed-host body without an opaque status-0 response. The installed request filter strips authentication, authorization, and cookie headers on cross-origin hops; safe errors omit signed URLs, and late failures cannot overwrite a newer or closed job viewer.
• Pull All first attempts the repository's normal credential resolution. Only an HTTPS authentication failure or HTTPS not-found ambiguity can retry the remaining token-bearing signed-in accounts for that exact HTML origin. A repository-bound account is preferred, then the stable account order is retained; SSH and non-authentication failures are never retried.
• Clone preserves a valid hosted-account selection for the first attempt. For a generic URL it chooses the API-matched token-bearing account, or the first eligible exact-origin account when lookup is inconclusive, so Git does not open a manual credentials prompt. The attempt remains unforced only when no eligible identity exists. An HTTPS authentication/not-found ambiguity is bound to the rejecting origin; only remaining token-bearing accounts for that exact scheme, host, and port are eligible. The successful account key is persisted before initial repository matching and retained by single, batch, missing-repository, and retry-clone paths.
• The agent and Remote site expose saved-host SSH cloning only through list-ssh-hosts and clone-to-ssh. The list returns display-safe metadata from validated saved definitions; cloning accepts a credential-free URL, a validated absolute or home-relative POSIX path, and an optional branch. Connection secrets stay in the operating-system credential flow and credential-shaped errors are redacted.
• Account selection, profile mutation serialization, export rendering, provider routing, submodule display, repository tooltips, and other integration regressions found during the merge waves were fixed before the final build.

Architecture contracts that remain authoritative

1. Account identity is getAccountKey(account) = endpoint#id; provider ports do not fall back to login-only identity.
2. Shared profile settings, structural tab state, flushes, and multi-window mutations use the serialized profile queue. Appearance mutations serialize inside the exact owner's dedicated store, so one owner's history action cannot rewrite another owner.
3. VersionedStoreHistory remains the shared history engine, including the independently bound history in each anchored appearance editor.
4. Batch clone consumes sanitized URL-only items; exports never contain tokens.
5. Filter modes and regex parsing use the shared bounded search infrastructure.
6. Automation posts results to the notification centre and never lets a background failure block the foreground UI.
7. Agent access stays localhost-only, opt-in, token-gated, origin-checked, size-bounded, and redacted.
8. Desktop Plus behavior is adapted under its MIT license, but visuals continue to use Desktop Material's --md-sys-* token system.
9. No token may be written to a profile repository, appearance-element repository, notification repository, export file, screenshot, log, or agent response.
10. Pull All account fallback remains HTTPS-only and exact-origin. Its forced account selector is internal to the trampoline, is never placed in a Git child environment, and is removed after the operation. Missing same-origin credentials fail closed; cross-origin submodules use normal credential resolution.
11. Clone account fallback remains HTTPS-auth/not-found-only and is scoped to the origin that rejected the credential, including any non-default port. A generic URL selects the API-matched token-bearing identity or the first eligible exact-origin identity and remains unforced only when none exists. Account selectors stay internal to the trampoline; the successful stable account key is persisted for later repository matching and retries without exposing a token, login, selector, or credentials dialog.
12. Each customizable visual owner has one strict versioned setting.json, one dedicated local Git repository, and one history source. Editors open beside the actual right-clicked owner; general Appearance contains ordinary preferences rather than a monolithic visual editor.
13. Repository workspace, toolbar, tab-strip, list-name, and logo owners are keyed by a stable local appearance UUID. Nullable fields inherit their profile owner. Legacy aggregate profile values and desktop-material.appearance are migration/compatibility inputs only, and Repository Settings has no Appearance tab.
14. Responsive app-bar layout is measurement-driven. Core repository, worktree, branch, and sync controls remain pinned; Build & Run moves to More before Commit & Push, and every resize recomputes restoration from the full ordered descriptor set without remounting live controls.
15. Tab foreground and background colors remain bounded by the shared color validator. Each tab title style persists in its own dedicated Git repository and has independent inspect/undo/redo/restore history; structural tab state remains in the serialized profile store.
16. Bulk tab close treats pinned tabs as protected. The inverse literal query cannot degrade into close-all, and tab arrangement never crosses a pin-group boundary unless the user explicitly changes pin state.
17. Tab sorts are one-shot stable mutations. Status changes do not continuously reorder the strip, and persisted openedAt/order data remains migration-safe and isolated by account/window scope.
18. Actions cancellation is exact repository/account/run-bound, revalidates status before POST, sends no force-cancel from the primary action, and deduplicates an in-flight request before polling the terminal state.
19. Rebase revalidates the current and base refs immediately before mutation, refuses dirty/conflicted/ongoing-operation state, and never performs an automatic force push.
20. A valid explicit repository-account binding is authoritative. Provider views may auto-bind only an unassigned repository with one usable exact endpoint match; every save/load remains repository/account-generation-safe.
21. GitHub OAuth scopes remain a reviewed feature allowlist. Adding an app feature does not implicitly authorize destructive or unrelated administrative scope families.
22. Task surfaces use vertical scrolling and responsive stacking before text or controls collapse. Page-level horizontal scrolling is not a fallback for Repository Tools, Remote Manager, Regex Builder, or confirmation dialogs.
23. A temporary submodule repository is derived only from a freshly validated, initialized child worktree contained by the selected root repository. It never enters repository persistence, Recent, or last-selection state, and Back always targets the persisted root rather than another temporary child.
24. Language mode is an ordinary explicit profile preference under language-mode-v1, separate from custom element appearance, with exactly English, playful Hong Kong Cantonese, and bilingual choices. English is the fallback; the host locale does not silently replace a saved selection.
25. Packaged updater E2E builds and their mock server consume the same validated loopback /update URL selected for that job; no shared fixed port is part of the CI contract.
26. Release publication follows successful CI for the exact eligible main SHA. Failed CI publishes nothing; immutable tags are not reused; required installable assets must exist and be non-empty; one eligible run has one release publication action.
27. list-ssh-hosts exposes only bounded display metadata from validated saved SSH definitions. clone-to-ssh accepts only a returned unambiguous host ID, credential-free Git URL, validated POSIX destination, and optional branch; it never accepts or returns an SSH secret and redacts credential-shaped failures.

M19 accepted app-source evidence

Exact application source 5e80e678d062b65a82c0991b352e5a861c7469e5 was built through the required low-level MCP HTTP client with npx --no-install cross-env RELEASE_CHANNEL=development DESKTOP_SKIP_PACKAGE=1 yarn build:prod. The client reported client_ok: true, return code 0, and no timeout after the production bundles, native dependencies, bundled Git, Sass validation, license generation, and unpackaged out tree completed.

One uniquely named hidden Win32 desktop then exercised that exact bundle with an isolated user-data directory and an owned %TEMP% root. The fixture used only proof-a, proof-b, neutral repository labels, loopback HTTPS, and random synthetic credentials that never entered a command line, child environment, error, screenshot, or retained ledger. Its redacted cross-account evidence was:

• clone: proof-a returned the private-repository-style not-found response; proof-b served the smart-Git advertisement and pack; the clean cloned repository opened on main, and its persisted affinity named only the synthetic proof-b account key. Tokenless candidates and stale tokenless repository bindings were excluded;
• Pull All: exact built source 5e80e678… retried four fixture repositories; the app reported 4 pulled, 0 skipped, 0 failed, and every row used the neutral result Pull completed using another signed-in account. without revealing which synthetic identity succeeded;
• history deepening: a shallow fetch recovered through the Desktop credential trampoline and another exact-origin account, and the app reported Fetch completed using another signed-in account.; and
• provider UI: native pull-request creation, Actions log/artifact transfer, Releases, Issues, and provider triage mutated only the in-memory loopback fixture. No public provider object was changed.

The following 14 synthetic-only PNGs were reopened at original resolution and accepted as nonblank, unclipped, and identity-safe. Every canonical candidate was captured from exact built app source 5e80e678…; compositor-banded earlier attempts were rejected rather than promoted. The exact files were promoted unchanged in final documentation/image union a890ab579c….

The table preserves the historical M19 receipt. M24 later replaced the tracked material-sparse-checkout-safe.png with the 125,413-byte guided Review capture from 255ad0c228, SHA-256 d536c936e1888c5ea7712bb746ec6eac302ae204edd170ab55379455aeda6a5d.

This app-source proof is intentionally distinct from the later publication identities. The application, loopback listener, synthetic credential entries, hidden desktop, owned temporary roots, and completed worktrees were subsequently removed and verified absent as part of the final cleanup gate.

Prior M0–M18 integrated validation evidence

The exhaustive historical run on the same application/test tree shipped by b2699faccb07728fe9aa2838aa13355d71e172b0 recorded:

• unit suite: 1,880 tests — 1,879 passed, 0 failed, 1 intentional skip;
• repository-wide yarn lint:src: passed;
• repository-wide Prettier validation: passed;
• yarn tsc --noEmit --skipLibCheck: passed;
• production unpackaged build: passed for the identical application source, using npx --no-install cross-env RELEASE_CHANNEL=development DESKTOP_SKIP_PACKAGE=1 yarn build:prod;
• the build and GUI verification path used the exact low-level MCP checkout at SHA beed66ca6ed2503e6170ee1e1158247f1c2f0140;
• an isolated HTTPS fixture proved a clean Pull All advance from proof A dd0bbb04b04da50d42fa55245bc89a1426f01488 to proof B 1d58935cf4ef9645f08e2fb3aa68e364ab382676: the redacted sequence was primary account rejected, fallback account accepted, and the renderer displayed exactly Pull completed using another signed-in account.;
• all promoted final milestone captures were inspected at original resolution, were nonblank, and contained no private data. The standard ledger is 1443×992; the final responsive proof is the user's exact 1450×997 client size.

Secure clone account fallback validation

The later clone hardening tree at implementation commit 0b4f25cc8e91eb62634e70f90e24f1a44d00dc9d, first reviewed on main at 3dc1ecc4d8daff6150980e47a13db4f3a61ec37a, recorded:

• 627 suites and 1,906 tests: 1,905 passed, 0 failed, 1 intentional skip;
• full yarn lint:src, repository-wide Prettier, and yarn tsc --noEmit --skipLibCheck: passed;
• the exact MCP-driven unpackaged production build: passed;
• a synthetic HTTPS smart-Git proof in which account A was rejected and account B was accepted silently, producing a clean clone on main at c9eee876c4451d380f8cc7628b5971f624f9395f;
• custom-port exact-origin matching remained intact and no credentials dialog appeared; and
• every owned proof process, listener, Temp path, and synthetic credential entry was removed after the accepted capture.

Those three same-name rows are commit-pinned historical values; the M19 documentation/image union replaced their current tracked files with the accepted M19 PNGs and hashes recorded above.

M19 final publication evidence

1. Final documentation/image union a890ab579c63651e5089ee433b259f0fc9198fbf reached main. Its Pages run 29272714314 and deployment 5428939908 succeeded. All 40 tracked PNGs match their Git blobs on raw main and live Pages: 80/80 byte-and-SHA comparisons, 0 failures, 4,272,687 bytes per surface.
2. Final code/release baseline a0c2f19433631d577979c8c8a88a5151f5ab0656 passed all seven jobs in CI 29274841990. Windows x64 ran 365 unit-test files in two batches: 2,533 tests, 2,532 passed, 1 intentional skip, 0 failed/cancelled. macOS arm64 ran 2,531 tests, 2,530 passed, 1 intentional skip, 0 failed/cancelled. Script tests passed 15/15 on both full-unit lanes; both packaged E2E jobs passed.
3. Build Installers 29274842059 published public, non-draft, non-prerelease release v3.6.3-beta3-b0000000083. Its lightweight tag points directly to a0c2f194…; all five public assets are non-empty, and independently streamed byte counts and SHA-256 values match GitHub's metadata exactly.
4. Canonical wiki commit 9f9c8010c8fcf275e39ae3e805856728ac6a23f8 matches all seven docs/wiki Markdown blobs from a890ab579c… exactly. Home, User Guide, Developer Guide, and Feature Gallery return HTTP 200.
5. The 3,011-file tracked privacy scan found zero current-user paths, names, emails, provider-token signatures, private keys, or personal files. All proof-owned resources and completed agent worktrees are absent; local main equals origin/main; Actions is enabled; active workers and retained Actions artifacts both report zero at the administrative closure check.

Historical root-finalized publication evidence

The M0–M18 publication gate was closed with this evidence:

1. Final implementation baseline b2699faccb07728fe9aa2838aa13355d71e172b0 passed all seven jobs in CI 29225926836.
2. Build Installers 29225926808 succeeded for that exact commit and published public, non-draft, non-prerelease release v3.6.3-beta3-b0000000076. Its lightweight tag resolves exactly to the build SHA; all five uploaded assets are non-empty, and the workflow retained zero artifacts. Both full NUPKG aliases are 307,547,223 bytes with SHA-256 3a4b0bd30668b2480f9820dab62ca7cfa13f2b58e976ce7454c024942029f365.
3. Pull All proof baseline 3acb0ba0dc69af6f2cfdd5e2967593158eac448d passed Pages run 29227302226. Its Pages and raw-main image URLs both return the tracked 114,222 bytes with SHA-256 80674cf75511c1238bcf527e6e678ffd3d46e4cc36ee2455ebd4b8cecf1c0991.
4. The canonical six-file docs/wiki/ mirror is published at wiki commit 2d169244373f27a6b08f6c9594ec433ff561880b; the live Home and User Guide return HTTP 200, and the published User Guide embeds the Pull All proof through its raw-main URL.
5. The final headless audit verified the exact 1450×997 review size, the supported minimum behavior, and requested 200% scaling auto-fit. Toolbar, Changes search/filter/composer controls, rows, actions, and the page shell no longer clip or produce horizontal overflow. Existing accessibility tests cover names, roles, focus, keyboard paths, and 50–200% zoom bounds; recorded light/dark contrast pairs meet WCAG AA for normal text.
6. The published design set and the tracked repository pass targeted personal identifier and common-secret scans. Account-specific Windows paths use %USERPROFILE% in public documentation.

The secure clone implementation commit 0b4f25cc8e91eb62634e70f90e24f1a44d00dc9d is present in first reviewed main baseline 3dc1ecc4d8daff6150980e47a13db4f3a61ec37a.

The later guided-function integration intentionally excludes privacy-tainted feature ancestry. Its named P0/P1/P2/Later corrections and focused regressions are present at the M19 checkpoints recorded above. The fresh M19 evidence is kept separate from the historical M0–M18 evidence that follows.

M19 closing evidence checklist

• Record exact accepted app source 5e80e678d062b65a82c0991b352e5a861c7469e5 and its successful exact MCP production build. Exhaustive gates must be repeated after the final documentation/image union and recorded separately.
• Record the deterministic synthetic cross-account clone/Pull All/deepen ledger and exact off-screen interaction matrix for representative Foundation/P0/P1/Later surfaces.
• Record all 14 inspected, identity-safe capture candidates with dimensions, byte counts, SHA-256 digests, and exact 5e80e678… source/build provenance.
• Promote those exact 14 files unchanged and verify their tracked hashes in the final documentation/image union.
• Record the merge to main, exact-SHA CI, Pages, canonical wiki, installer/release, release-asset/digest, and public live-URL evidence.
• Record cleanup of every proof-owned process, hidden desktop, credential, fixture, alias, and temporary root.
• Remove every completed agent worktree and finish with clean local main equal to origin/main, Actions enabled, zero active workers, and zero retained Actions artifacts.