The development UI has Working, Issues, My PRs, Review PRs and Messages queues. Opening an item shows its conversation; opening an item never starts an agent. Review the selected pipeline and authority before explicit Start. Pending answers belong to their owning run; uncertain delivery must not replay automatically. Settings opens separately and includes dependency and plugin administration.
These are source contracts awaiting fresh verification against the published base. Follow acceptance for the draft port's current blockers; private pilot observations do not establish acceptance for this branch.
This is a generic operator guide. Supply your own approved private pilot repository, Tailscale hostname, registered app ID and installed plugin ID; none are bundled. Read operations and acceptance first.
The service runs as the current Linux user. Verify the stable launcher and installed binary, check for unrelated live runs, and preserve authentication, user work, shared Tailscale routes and the existing login/lingering policy before changing services. Scope network changes to Code Factory paths. Never reset all Serve or Funnel configuration to repair this app.
The UI uses MCP Apps exclusively. Never embed owner credentials or add iframe
requests directly to the local daemon. Default browser control is
node scripts/browser_control.mjs; it attaches only to an owner-approved Chrome
session and may require native Allow. With separate explicit approval, a persistent
non-default pilot profile can use a loopback-only debugger and
node scripts/browser_control.mjs --pilot (port9224). The owner signs in manually;
pause inspection until confirmation and never copy authentication between profiles.
Do not expose debugging ports on LAN, Tailscale or public hosting.
The controller accepts JSON lines and prints allowed schemas. ready:true is not
browser attachment: discover current page IDs and obtain fresh element UIDs.
Do not reuse IDs across controller sessions or document reloads. Mask URL queries
and fragments before returning output, and inspect only the relevant app/dialog.
Do not dump credentials, cookies, headers, profiles, runtime.json, owner.token,
gateway-auth.json or whole subscription rows. Keep temporary snapshots private.
For a nested app iframe, use a current element UID in evaluate_script args and read its ownerDocument. For controlled React text inputs, native focus/select and ownerDocument.execCommand('insertText',false,text) may be needed; confirm the actual enabled state and resulting server/UI state. A successful tool click alone is not a passed assertion. Preserve selected plugin mentions in Work composers.
Open the installed complete plugin in a fresh Work chat and invoke open_factory without launching work. Confirm the actual iframe is Connected, displays only approved pilot data and advances sync times. Review a Plan/read-only/ask snapshot before Start. Ask a real provider to present Continue/Stop with request_user_input, answer in the widget, observe its actual response and wait for idle before sending a follow-up. Exercise reload/restart recovery and reject stale answers; resume explicitly with retained history and workspace. Cleanup must refuse dirty work.
Verify that the actual rendered UI contains the current content-addressed resource revision; refresh app tools and open a fresh view after upgrades. Local resource reads or a healthy daemon cannot prove that the host discarded cached HTML. Observe CSP enforcement directly; a development UI warning alone does not prove whether a declared policy is active. Coordinate account-wide settings and restore any temporary changes. Keep all evidence nonsecret and version-bound.
A connected soak must measure real authenticated app polling for at least one hour. Local health and fixtures do not substitute for it. Coordinate desktop logout/login with the owner because it closes desktop apps, Chrome and RDP; inspect again only after the owner confirms authentication is complete. Preserve SSH and existing service/lingering policy. A session cycle is not cold-boot proof.
The published Agents pane retains native and structured-message questions. A stopped textual ask is checked in a separate ephemeral read-only helper; the optional helper model defaults to the task model. The retained task gets at most two question-only Plan form-repair attempts, then a durable text fallback. Task mode, sandbox and publishing authority remain those of the original run.
A clock accompanies readable waiting labels; a circular arrow accompanies recovery progress. Take over stops recovery. Inspect technical transcript opens the owning agent and preserves its message draft. Automatic inputs are labelled Question recovery; actual user replies retain their role. No reply needed dismisses only a textual fallback and never answers or authorizes work.
After a successful UI answer, the owning agent opens with ✓ Answer sent for five seconds; approvals and other forms show ✓ Response sent. This confirmation is local to that run and view lifetime. Polling does not prolong it. Failed or uncertain submissions never confirm or replay; refresh failure after successful submission is separate feedback. Agent text, including UI_ANSWER_OK, stays literal transcript content. Old records without origin metadata retain native-request semantics.
The 2026-10-22 source verification in acceptance covers fixtures only. No services were restarted and no installed plugin was changed for this merge. Actual-host recovery, assistive technology, callbacks, one-hour soak and login-cycle acceptance require separate version-bound observations.