[lukemaj]

What: Add the approved macOS Chromeria V2 build identity beside the default Chromeria app.
Why: V2 needs its own bundle, Electron profile, protocol and T3 home while v1 keeps running.
So what: Review this identity-only PR into fork/v2; the user retains merge approval and root retains #195, landing, installation and real-data verification.

Refs #177 and the side-by-side approval in #177 (comment). This PR does not close the rollout Issue.

Change

CHROMERIA_DESKTOP_VARIANT=v2 pnpm run dist:desktop:dmg:arm64 selects one fork-owned definition in scripts/lib/chromeria-desktop-identity.ts, embedded by the desktop pack. It sets Chromeria V2, bundle md.toolbox.chromeria.v2, profile/scheme chromeria-v2, and default home ~/.t3-v2; explicit T3CODE_HOME wins. Default behavior and upstream versions stay unchanged. V2 packaging currently supports macOS only and rejects unknown variants or other platforms.

V2 sets its name and profile before Clerk, then takes the macOS profile lock; a second V2 instance stops before the bridge. It skips both legacy profile import paths and registers only its own scheme. Clerk and shared Codex handoff/return helpers use the selected scheme with their existing host/path/state checks. The branding map/allowlist owns the small upstream hooks.

--skip-build can otherwise wrap a default main.cjs in V2 packaging metadata. One pack hook writes {variant, mainSha256} after that bundle is emitted; packaging checks the requested variant and those actual bytes. No general manifest framework or dependency was added. The real pack hook remains unrun under the build hold.

Exact candidate and proof

Base: 62726b5ce141e6f4df82bbf76d731e29d172df1a (fork/v2). Head: 3535a35edc19817204329e0770feda52e02a7b23, one commit, 19 files, +898/-32; most additions are behavioral tests.

All local checks used installed Node v24.13.1, from the assigned workspace, after fresh one-minute load checks below 8. Workspace imports resolved to changed 177-delivery source, not uiv2 source. Dependency reuse was intended to be read-only, but the first test import triggered Electron 44.4.2 auto-extraction into the donor store; see the correction below.

• Focused vp test run: 26 files, 312 tests passed. New identity, shared V2 handoff/delivery and stale-bundle tests, plus affected desktop/shared/managed-Codex regressions.
• vp lint and vp fmt --check on the changed files: passed.
• tsc --noEmit in apps/desktop, packages/shared, and scripts: passed.
• bash scripts/fork-check.sh --base 12069eefd707f78eafc27812027c994eea0613cf: passed, 23 mapped features.
• git diff --check: passed.

Independent exact-head source review found no blocking actionable findings. This PR remains draft because desktop artifact proof is user-held; source review and CI do not establish built packaging/runtime or live sign-in acceptance. Desktop pack/DMG, actual bundle metadata, application behavior, external sign-in, and browser/mobile UI have not been proved by this task. Full CI passed on this exact head, without reruns; it does not prove the held macOS artifact or live sign-in. The user explicitly holds desktop builds until disk space is confirmed. No app launch, merge, application install, live database access/snapshot or main push occurred.

Dependency reuse correction

The first focused command, /tmp/177-proof/run.sh ./node_modules/.bin/vp test run apps/desktop/src/app/DesktopClerk.test.ts packages/shared/src/codexAuthHandoff.test.ts, started at 09:47:53 CEST on October 9. The real electron import resolved through the donor .pnpm link. Installed Electron 44.4.2 index.js calls install.js when path.txt is missing; it extracted node_modules/.pnpm/electron@44.4.2/node_modules/electron/dist and wrote path.txt in uiv2 at 09:47:54–09:47:55. The worker reports about 307 MB extracted, and admits its earlier unchanged-donor claim was wrong. This violated the read-only reuse constraint. Later proof used the extracted dependency; no app was launched. This thread performed no donor remediation or deletion. After explicit user authorization, root reports it removed only those donor dist and path.txt targets and verified both absent. All 13 task-owned temporary dependency directories/links in this worktree were then removed after reviewer settlement, without following their targets. The worktree remains clean at the exact head. Durable scoped evidence and incident record.

Callback audit and limitations

Path	Verified source/tests or remaining limit
Clerk desktop SDK	Installed @clerk/electron 0.0.44 derives its callback and protocol registration from the selected renderer scheme. V2 passes only chromeria-v2; pre-ready name/profile/lock order is tested. External Clerk tenant acceptance of that URI is unknown, not a proven service failure.
Direct managed ChatGPT/Codex desktop sign-in	OAuth redirect is http://127.0.0.1:<port>/auth/callback; desktop IPC returns the code without navigation. No custom OAuth scheme registration is required by this path.
Explicit V2 desktop helper	Real loopback-listener test receives chromeria-v2://auth/codex, refuses v1/dev receivers, and returns the delivery. Shared helpers round-trip V2 path-form return URLs, sanitize parameters and reject malicious hosts/paths.
Managed server and primary-environment handoff	CodexAuthCallbackPage and CodexChatGptAuth use the corrected shared return validator. Relay transports authenticated environment calls, with no separate hardcoded Codex scheme.
Existing Electron hash-route return	Actual <scheme>://app/#/... return URLs remain rejected by the existing path-only sanitizer for every desktop scheme. The primary-environment handoff has no browser return link for this form. Path-form tests do not prove hash navigation; direct desktop IPC still works.
Hosted upstream app.t3.codes helper	It emits fixed t3code://auth/codex; V2 cannot receive it. The existing manual redirect-paste path remains. V2 never registers t3code or t3code-dev to work around this.

The existing explicit Install/Remove t3 command action controls the shared CLI link, even when both apps exist; the V2 launcher itself lives under its own T3 home. This behavior is documented and unchanged.

Artifact identity for later authorized build

Expected default-version outputs: release/Chromeria-V2-0.0.45-arm64.dmg and release/Chromeria-V2-0.0.45-arm64.zip, containing Chromeria V2.app. Pattern: Chromeria-V2-${version}-${arch}.${ext}. DMG volume: Chromeria V2 <version> Installer.

Staged package.json has chromeriaDesktopVariant: "v2" and the first 12 characters of t3codeCommitHash; it has no top-level productName field. build.productName is Chromeria V2. Info.plist must have bundle md.toolbox.chromeria.v2 and exactly chromeria-v2 under CFBundleURLTypes. The bundle marker is apps/desktop/dist-electron/chromeria-desktop-identity.json, with variant: "v2" and SHA-256 of sibling main.cjs. These are expected identities, not observations of a built app.

Website impact: none; this changes local desktop packaging/runtime, not a published website. Agent Observer cost publication was attempted with publish --task toolboxmd/chromeria#177 --repo toolboxmd/chromeria --pr 196 against its read-only cached ledger: exit 2, nothing to publish: no sessions in scope. No cost total is claimed. Ledger sync was not run because it reads live T3 state, which this task prohibits.

Elon record

Requirements and who asked: User approved one build-time side-by-side identity and every sign-in callback path checked, as one PR into fork/v2 for #177.
Deleted: Scheme takeover, v1 imports/lock changes, version bump, extra dependency tree/worktree, generic manifest framework, builds/install/real-data work from this scope.
Bottleneck: Build and live-sign-in proof are held by disk/authority limits; focused source proof and exact-head independent review are available now.
Checked myself: Full Issue decisions, upstream identity/protocol searches, clean exclusive base/head, complete diff, installed Clerk SDK, shared/server/relay callback paths and actual focused proof output.

Implementation: Claude Opus 5.5 through Claude Code, routed by Prism. Integration: GPT-6.1-Sol through Codex in T3 Code. Independent review: GPT-6-Luna through Codex, routed by Prism.

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

ℹ️ No successful main baseline artifact is available yet. This run establishes the initial measurement.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	—	5.0 KiB	—	6.8 KiB	✅
Codex	Thread snapshot wire	—	3.8 KiB	—	4.9 KiB	✅
Codex	Live turn WebSocket wire	—	1.2 KiB	—	2.0 KiB	✅
Codex	Live turn WebSocket decoded	—	20.9 KiB	—	29.3 KiB	✅
Codex	Live turn messages	—	2	—	8	✅
Claude	Total thread wire	—	5.0 KiB	—	6.8 KiB	✅
Claude	Thread snapshot wire	—	3.8 KiB	—	4.9 KiB	✅
Claude	Live turn WebSocket wire	—	1.2 KiB	—	2.0 KiB	✅
Claude	Live turn WebSocket decoded	—	21.2 KiB	—	29.3 KiB	✅
Claude	Live turn messages	—	1	—	8	✅

Baseline: unavailable · PR result: 3535a35 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 108.5 KiB
• Claude decoded thread snapshot: 108.8 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[lukemaj]

What Exact-head source review of toolboxmd/chromeria#196 found no blocking actionable findings at 3535a35edc19817204329e0770feda52e02a7b23.
Why The full diff keeps V2 identity coherent across build, startup profile/name/scheme, Clerk callback setup, and the digest-bound package marker; reviewed callback paths match their consumers.
So what review/independent passes this SHA; desktop packaging and live Clerk sign-in remain unverified and user-held.

Reviewed base 62726b5ce141e6f4df82bbf76d731e29d172df1a to exact head above, all 19 changed files, docs/fork.md, the root glossary and full direction triad, #177 comments, and #166's decision table. I traced build selection and package marker enforcement; profile and app-name setup before Clerk; protocol and callback allowlists; direct desktop IPC, managed primary-environment handoff, and hosted web callers.

The installed @clerk/electron 0.0.44 source skips its own single-instance lock on Darwin. V2 takes the native lock after setting its name and user-data path and before creating the Clerk bridge. The bridge receives the selected scheme. Direct desktop Codex sign-in returns through receiveProviderAuthCallback; primary-environment handoff transfers the profile through the subscribed handoff stream.

Two bounded limitations are not blockers for the approved scope: hosted app.t3.codes still emits the fixed t3code:// helper URL, which V2 intentionally does not register; and the pathname-only return validator rejects Electron's hash-form route, so there is no automatic browser return link. The hosted limitation is documented, while the actual direct desktop and primary-stream paths above do not rely on that browser return. Acceptance of chromeria-v2 by the external Clerk tenant remains unknown because no live sign-in was performed.

Proof qualification: The PR body records that the first scoped test import started at 09:47:53 CEST and auto-extracted about 307 MB of Electron 44.4.2 into the shared uiv2 donor by 09:47:55; the later 312-test proof used that extracted dependency. The local outputs therefore do not establish an unchanged donor or a pristine read-only test environment. No app was launched and no donor cleanup was performed. I did not rerun checks. This does not change the exact-head source verdict or the user/root-verified CI success.

Proof inspected: parent-provided focused outputs report 26 files / 312 tests, changed lint/format, desktop/shared/scripts typechecks, and fork-check passing. The user and root verified CI run 37902966336 succeeded on this exact SHA with no reruns; I did not rerun it. No desktop build/package or live sign-in was attempted, so this review makes no artifact or tenant-acceptance claim.

Requirements and who asked: User-approved build-time CHROMERIA_DESKTOP_VARIANT=v2 identity, side-by-side with Chromeria, per #177/#166.
Deleted: V1 scheme takeover, V1 profile import, version bump, and generalized manifest machinery.
Bottleneck: User-held desktop artifact build and live Clerk sign-in; source review and exact-head CI evidence were available.
Checked myself: Exact diff and callback consumers, startup/profile ordering, installed Clerk 0.0.44 lock behavior, build marker path, and parent-provided proof outputs.

Reviewer: GPT-6-Luna (gpt-6-luna, max effort) via Codex in T3 Code.

[lukemaj]

What: Closing as superseded; the side-by-side Chromeria V2 identity is no longer wanted.
Why: The user chose a full cutover instead of running V2 beside v1 (#177, 2026-10-09), and #177 was closed on 2026-10-17 as superseded by #166/PR #291 and #370/PR #371. Its base fork/v2 is retired history.
So what: Nothing to do. The branch chore/177-v2-delivery is kept, so the identity code can be revived if a side-by-side build is ever needed again.

🤖 Generated with Claude Code