Repository navigation
Define provisional desktop theme contract and mixed package lifecycle - #2
Merged
Merged
Conversation
Lucas1479
changed the base branch from
codex/extension-protocol-review
to
main
October 12, 2026 15:50
Lucas1479
marked this pull request as ready for review
October 12, 2026 19:39
Lucas1479
added a commit
to Code-Amadeus/Amadeus
that referenced
this pull request
Oct 12, 2026
## Outcome and accepted dependencies P2 adds constrained desktop themes and one **Plugins** entry for TTS, MCP, Skill and theme lifecycle. Settings reuses that manager; Appearance selects themes. Pure frontend packages apply immediately; mixed packages use their actually loaded version until backend restart. Design #194. Final head `5de6b4e8d3ec009f2360dd199dffb8f06f563281` targets **main**, after #191 was squash-merged as `2799ba8`. Only P2's own commits were rebased, with identical file trees before/after. [Protocol #2](Code-Amadeus/Amadeus-Extensions#2) was merged using merge commit `bf1a848`, retaining pinned source `b30df73669c50d95d08fb2cd57c289ecddc959f2` in protocol main history. Host provenance now records the accepted source. The contract remains experimental. SDK source `49449a0` and wheel SHA-256 `274bd66b81932c8ea50f39f58e7bf91530a8015196acfcf9bcfd77fa2d8b8084` are unchanged. External re-review confirmed all eight earlier defects fixed; the maintainer requested the remaining documentation/guidance fixes and authorized merging this final head only after CI is green. ## Behavior and review fixes - Themes use a pinned 25-token allowlist and bounded literal syntax. Shared CSS cases and the canonical theme example are checked against Host validation. **v0 supports PNG/JPEG only**, with signature and actual native decode validation; both protocol documents now agree. - The Host proves text/status/accent/faint contrast on the actual token surfaces, preserves light/dark base identity, requires opaque surfaces and derives readable accent-button labels. Builtin gradients do not override extension surfaces. Real Chromium checks the paints/contrast and restoration of builtin decorations. - Mixed-package updates that drop/rename a selected theme retain the loaded v1 theme until restart. Additions wait for v2 admission; disable/remove closes frontend admission immediately. Startup receipts distinguish explicit rejection from missing/invalid evidence through accepted P1 behavior. - **Missing-theme guidance is actionable:** recommend restart only when a different saved revision contains that theme and the package needs restart. A theme removed by a frontend-only update, or absent after restart, instead directs the user to choose another theme in Appearance. Its saved identity and last verified base are retained. Regressions cover both sides. - Native Ctrl+Shift+F12 (Cmd on macOS) and the existing Windows wallpaper tray restore/persist classic independently of package fonts. Environment locks remain authoritative. Plugins → Voice opens navigable Settings and preserves its remembered section; IPC notifications strip raw Electron events and startup chrome uses the verified base. ## Verification - Complete Electron suite: **507 passed**; lifecycle/guidance file **62 passed**. Rebase preserved the tested code exactly; subsequent provenance changes only recorded the already-merged source. - Final clean build, real native PNG/JPEG/CSS validation (**3 check groups**) and offline startup settings (**8 checks**) passed. - Final clean-source and freshly packaged Windows applications each passed **14 real GUI checks**, including native recovery input, saved settings and complete process shutdown. Both reports identify final head `5de6b4e` with `workspace_dirty: false`. - Final extension/resource/SDK/provenance/release Python run: **75 passed, 1 skipped** (POSIX executable contract on Windows). Canonical-source comparison passed. Clean release gate: **4,024 selected, 95 excluded, zero errors/warnings**. - Final-head CI is complete: **16/16 successful checks**, including [Windows Python and source/packaged model-less smoke](https://github.com/Code-Amadeus/Amadeus/actions/runs/38299275117), [Windows Electron](https://github.com/Code-Amadeus/Amadeus/actions/runs/38299275058), Linux/macOS, installation qualification and [Source Release](https://github.com/Code-Amadeus/Amadeus/actions/runs/38299275329). Earlier successful runs are not substituted. - Protocol final-head Windows/Linux contracts and wheel comparison: **3/3 passed** in [run 38298697935](https://github.com/Code-Amadeus/Amadeus-Extensions/actions/runs/38298697935). - Earlier reviewed `d94719a` evidence remains historical: 275 scoped Python passes/4 platform or optional-runtime skips, 125 launcher passes, 8 production component journeys, and real installer/store/SDK Runner lifecycle. The installer driver supplies confirmation decisions (`nativeDialogs: false`); it is not a new manual native-dialog or natural-voice test. Commands: `npm test --prefix electron`; `node --experimental-strip-types --test electron/tests/extensions.test.mjs`; clean `npm run build --prefix electron`; actual Electron running `electron/tests/extensionThemeNative.smoke.mjs` and `electron/scripts/smoke-startup-settings.cjs`; `python -X utf8 tools/smoke_electron_model_less.py`; `npx electron-builder --win --x64 --dir --publish never`, then that smoke with `--packaged-executable electron/build/win-unpacked/amadeus-desktop.exe`; `python -X utf8 tools/check_extension_protocol.py --source <protocol-checkout>`; `python -X utf8 tools/build_source_release.py`. Focused final Python selection: `python -X utf8 -m pytest -q -rs tests/test_extensions.py tests/test_extension_resources.py tests/test_extension_sdk_build.py tests/test_extension_protocol_provenance.py tests/test_release_tooling.py`. ## Corrected GUI evidence and limits The old pre-repair **14/14 claim is withdrawn as recovery evidence**. It ignored a failed settings-save reply and used Playwright's asynchronous `wait_for_function` predicate as proof, which returned on Promise truthiness even when resolved false. A clean old-head reproduction and independent Chromium probe confirmed the cause; see existing [Playwright #29132](microsoft/playwright#29132). The repaired smoke checks save replies, explicitly awaits and compares persisted values, and asserts DOM transitions under the shipping CSP. Missing/wrong/never-returning values fail regressions. Reports bind source identity and build digest. Native recovery testing uses an explicitly authorized temporary loopback main inspector only for the isolated, secret-free test profile. It verifies the owned process/window and uses Electron `sendInputEvent` to reach the real input hook, disconnecting immediately and exiting the owned process. It does not invoke recovery directly and is not a claim of manual/physical keyboard input or a production debugging feature. Preparation failures preserve the previous installation. **After old references are released, a mixed update may collect v1 before v2 starts; there is no automatic startup rollback.** No new paid-service voice or cross-platform GUI qualification is claimed. MiMo Japanese remains unsupported; existing DSH stdout and Windows ACL limitations stay observable and fail closed. Developer mode, logs, registry, ASR, installed AUIP, character features and memory are outside this batch. Repository protection is unchanged; the maintainer explicitly permitted administrator merge for this PR after all final-head CI checks pass. Final local GUI build identities (report filename/content digest, not installer signature): - Source dist: `aba8baa5c0c5e6e1955768202b578113bc24352dc639f91464839a0eb411dfeb`, UTC `2026-10-12T19:42:31.898582+00:00`. - Packaged ASAR: `4c81de1f5c49d287025582119a26b82096f873fd91a110157d189036a3c1a553`, UTC `2026-10-12T19:45:05.101227+00:00`.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Outcome and dependency
Provisional
amadeus.ui.theme/v0defines builtin base identity, declarative tokens and bounded image resources. Pure frontend packages apply immediately; mixed packages use their actually loaded version until backend restart. Disabling/removing closes frontend admission without claiming process exit. Design: Code-Amadeus/Amadeus#194. Consumer: Host #192, on support profile #191. External re-review completed; maintainer requested a merge commit after final checks.Head
b30df73669c50d95d08fb2cd57c289ecddc959f2includes accepted protocol mainc770dfe. Protocol/SDK licensing remains Apache-2.0; authored templates/examples remain MIT-0. SDK source, builder and locked dependencies are unchanged from accepted49449a0.Validator and example alignment
schemas/theme-tokens.v0.json. Host generates allowed names from its pinned copy; internal CSS additions grant no package authority.Validation
274bd66b81932c8ea50f39f58e7bf91530a8015196acfcf9bcfd77fa2d8b8084. No SDK publication/rebuild requirement is introduced.Review and merge gate
Use Create a merge commit, preserving the exact pinned source in main. Host can then retain its pin and change provenance from provisional to accepted before the consumer merges. Developer mode, logs, new contribution kinds and memory remain outside this batch. The maintainer requested this merge after Host #191; no later phase is included.
Final follow-up: the main specification P4 now also says PNG/JPEG, and the theme contract background paragraph is repaired. This last commit changes only those two documentation files; validator, example and SDK bytes are unchanged.