[lukemaj]

What: macOS Chrome login changes reach persistent desktop profiles and explicitly authorized environment browsers at c9b0ce69a2ab9da0278ec3cf1b74986c41594bff.
Why: One-time imports miss later changes, and review exposed ownership, session-removal and credential-boundary defects in the continuous path.
So what: The planner reviews this rebased head, arranges scoped direct pairings, then builds and installs it on cavallo, bestia and Rocky for live account proof.

Refs #520 (closes after live proof on bestia and Rocky)

Implements the approved #520 design and review refinements, including an argv key command for ad-hoc signed Mac builds. This approved detour supports Promachos using accounts across machines. CI on the current head is green; independent current-head review remains planner-owned.

• Desktop: Chrome-only macOS observation while Chrome runs, using the existing SQLite snapshot/decryption primitives, Cookies/WAL fingerprints and a 30-second floor. Persisted root/directory mappings preserve accounts. The renderer remains the profile-settings owner: discovery adds new profiles, preserves user labels (including Default) and keeps deletions deleted. Successful keys are cached only in memory; failures back off and retry, and command changes invalidate the cache. Keychain is used only when no command is configured.
• Delivery: One ordered, acknowledged stream per destination, reconnect generations and idempotent retries. Managed identities and removal metadata persist without values. Full partition keys survive both CDP adapters. Expiry normalization suppresses duplicate Electron notifications while forwarding Chrome changes once. Unreadable row identities protect themselves without blocking other observed removals. Vanished session cookies are removed only when the same Chrome PID/start-time identity surrounds both observations; relaunch, shutdown, unknown-process and desktop-restart cases retain them. Downstream-only identities survive.
• Server and contracts: A dedicated preview:mirror-cookies credential, live owner/parent checks and destination identity authorize writes. Renderer IPC names only an environment ID; main resolves its saved authenticated destination, owns the private grant/socket and returns the current connection state. The unused preview.enableCookieMirror RPC is removed completely. Server services apply CDP writes/deletes on existing persistent contexts and persist a profile catalog for restart while the Mac is off.
• Credential separation: Local main derives a purpose-specific HMAC credential from its private desktop secret. The renderer's bootstrap token cannot mint or rotate mirror sessions. The old separation test covered session rotation, but allowed the same public bootstrap token to mint both credentials; the extended test rejects that escalation and proves main's session remains valid. Explicitly scoped remote pairings remain authorized credentials under the existing connection model.
• Site status: DBSC supplies site identities only; binding keys and credential protobufs are never read. Observed device-bound sites and known Google credential cookies are excluded and reported individually in Settings > Integrations > Browser. Cookie batches, keys and mirror tickets stay out of renderer state, agent tools and logs.

Remote credentials do not gain mirror permission automatically. Direct pairing can carry the dedicated scope when the server issues it explicitly. T3 Connect's current environment mint uses standard scopes only; its automatic session cannot enable mirroring. This PR does not change the cloud mint protocol. For live proof, the planner must issue a direct pairing URL for each server with the standard scopes plus preview:mirror-cookies; on cavallo, paste those URLs into Settings > Connections > Add environment. A new direct pairing updates the existing environment's route/credential. The planner also sets the Bao argv in desktop-settings.json. No further mirror toggle is required.

Surface check: desktop, server, contracts and shared connection code apply. Shared web code supplies Electron's settings status. Web-only and mobile clients have no native Chrome source or desktop-main IPC, so they are not mirror sources/destinations. Providers and scheduled tasks keep using the environment browser without cookie-payload access. Map/fork ownership metadata is updated. No version bump.

Validation: 1,792 tests in 43 focused files, 10 browser tests in 2 files, all six affected-package typechecks, scoped lint on 73 TypeScript files (two existing schema-hoisting warnings), touched-file formatting (78 supported files), vp run knip:check, scripts/fork-check.sh and registry validation passed. The compiler test now compiles the component without an opt-out; the map test waits for its render callback instead of polling with a one-second deadline. ACP's exact test passes here and on main; a controlled 300 ms debounce experiment reproduces its timing failure on main, tracked separately in #536, with no ACP changes here.

The real adapter tests are opt-in and a default CI run skips them. They were run explicitly on Linux with Node 26.8.2, Electron 44.4.5 (embedded Node 24.21.0), Playwright 1.60.0 and Chromium 152.0.7977.82 against isolated synthetic profiles:

CHROMERIA_TEST_ELECTRON=/tmp/chromeria-520-electron44/electron CHROMERIA_TEST_CHROMIUM=/usr/bin/chromium node_modules/.bin/vp test run apps/desktop/src/preview/ElectronCookieMirror.integration.test.ts apps/server/src/preview/ServerCookieMirror.integration.test.ts

Result: 2 files / 2 tests PASS, including fractional expiry and exact partition-key sibling preservation. These tests also ran enabled in the 43-file suite. No install, deployment, live Keychain read or real user cookie was used.

Rebased four topic commits onto origin/main at d17be12f8a951bd4ccba1dc641065b9b4c6ca48c, preserving merge-free history. The sole conflict was scripts/fork-upstream-edits.txt; both main's entries and #520's block were retained. A final inventory correction assigns the two changed upstream bootstrap-token files to #520 and allowlists them. Pushed with an explicit lease on 6d084c1ba2ff3935fae1d67e181f0f07bbf246d9.

Upstream first: findings on #520. No continuous upstream mirror was found; #12845 changes only one-time POSIX import preflight, so no upstream commit was ported.

The planner builds these artifacts from the independently reviewed head and verifies embedded t3codeCommitHash:

Target	Exact artifact
cavallo, macOS arm64 desktop	release/Chromeria-0.1.0-arm64.zip, containing Chromeria.app
bestia, Linux x64 server	release-cli/t3-0.1.0-linux-x64.tar.gz, full runtime with client and externals
Rocky, macOS arm64 server	release-cli/t3-0.1.0-darwin-arm64.tar.gz, full runtime with client and externals

No production builds, installation, deployment, merge or live site acceptance were performed. macOS source/encryption and polling-cost proof, grok.com login, logout/relaunch and offline catch-up remain planner-owned. DBSC sites require separate sign-in. Earlier synthetic Settings screenshots remain local at /tmp/chromeria-520-settings-before.png and /tmp/chromeria-520-settings-after.png; the GitHub asset upload failed, and no PR-only images were committed. Retain this worktree for independent review.

Requirements and who asked: The user and approved #520 decisions, refined by Opus/Grok reviews and the planner's CI reports: preserve ownership, propagate live session sign-outs, prevent relaunch logouts, separate bootstrap authority and pass scoped proof.
Deleted: The dead enable RPC, renderer minting of local mirror credentials, profile-label overwrites, session-cookie blanket non-removal and a timing-dependent map observer.
Bottleneck: Prove process continuity and credential authority across Chrome, Electron and server profiles before live account use.
Checked myself: Failing-before regressions, 1,792 focused and 10 browser tests, both real adapters, six typechecks, scoped lint/format/Knip, fork ownership checks, the rebase range-diff and the pushed GitHub head.

Implemented with GPT-6.1 Sol through the Codex harness.

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	5.0 KiB	4.9 KiB	−23 B (−0.5%)	6.8 KiB	✅
Codex	Thread snapshot wire	3.8 KiB	3.8 KiB	0 B (0.0%)	4.9 KiB	✅
Codex	Live turn WebSocket wire	1.2 KiB	1.2 KiB	−23 B (−1.9%)	2.0 KiB	✅
Codex	Live turn WebSocket decoded	20.9 KiB	20.8 KiB	−41 B (−0.2%)	29.3 KiB	✅
Codex	Live turn messages	2	1	−1 (−50.0%)	8	✅
Claude	Total thread wire	5.0 KiB	5.0 KiB	0 B (0.0%)	6.8 KiB	✅
Claude	Thread snapshot wire	3.8 KiB	3.8 KiB	0 B (0.0%)	4.9 KiB	✅
Claude	Live turn WebSocket wire	1.2 KiB	1.2 KiB	0 B (0.0%)	2.0 KiB	✅
Claude	Live turn WebSocket decoded	21.2 KiB	21.2 KiB	0 B (0.0%)	29.3 KiB	✅
Claude	Live turn messages	2	2	0 (0.0%)	8	✅

Baseline: d17be12 · PR result: c9b0ce6 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 108.5 KiB
• Claude decoded thread snapshot: 108.8 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[lukemaj]

Independent review round 1 at b91408ed: FAIL (Claude Opus 5.5 and Grok 4.7). Sent back to the builder; fixes land on this PR.

High:

• Desktop main sends Chrome cookies to any httpBaseUrl the renderer supplies (DesktopCookieMirror.ts:372-385, CookieMirrorGrant.ts:17-32); a page script could redirect cookie batches. (Grok)
• The server's desktop check trusts the client-supplied clientSurface query parameter (BrowserCookieMirror.ts:72-79, ws.ts:643, ws.ts:2967). (Grok)
• Renderer overwrites browser profiles every 5 s from a stale list, losing added and reviving deleted profiles (cookieMirrorConnection.ts:31). (Opus)

Medium:

• A failed key read is cached for the process lifetime (DesktopCookieMirror.ts:289). (Opus)
• Device-bound sites are reported only for accounts.google.com and never reach the user. (Grok)

Low: duplicate send from expiry precision, session cookies counted as removed after a Chrome relaunch, one unreadable row blocking all removals, untested SingletonLock predicate, real adapter tests skipped by default.

No defect found in managed identities, incomplete-read handling, partition keys, key command execution or value redaction.

[lukemaj]

What: All Opus and Grok review findings at b91408ed are addressed in ad8633a771bf871eb9db8da1bbf5705aeb34cbee on this PR.
Why: The reviewed implementation had competing profile writers, failed-key caching, cookie observation errors, untrusted destination/surface authority, and hidden site limitations.
So what: The planner independently reviews this head and then builds and installs it for the authorized live proof; no deployment occurred here.

Review findings and regression evidence

Finding	Change and proof
Opus 1: profile ownership	Desktop main proposes only Chrome profiles and never writes client settings. The client updater merges additions and remembers handled IDs so user additions/deletions, unrelated settings writes and restart remain intact. The regression failed on the reviewed code.
Opus 2: key recovery	Only successful keys are cached, failed reads use bounded backoff, command changes discard the key and invalidate source fingerprints, and settings reload on scans. Two focused cases prove recovery/cache reuse and command changes during success/backoff.
Opus 3: fractional expiry echo	Subtract the Chrome epoch before floating division; normalize CDP writes, reads and comparison to milliseconds. The regression failed before the fix; real Electron also round-trips a fractional microsecond expiry.
Opus 4 and SingletonLock	Vanished Chrome session cookies never produce removals. The lock-dependent deletion branch and lock predicate were deleted, so there is no mirror SingletonLock predicate left to test. The session regression failed before deletion; existing one-time-import SingletonLock tests still pass.
Opus 5: unreadable rows	Unknown exact identities protect themselves; known-absent persistent identities can still be removed. A missing ancestor column protects both ancestor siblings at that top-level site only. Regressions cover unrelated logout and sibling preservation. The unreadable-row logout regression failed before the fix.
Grok 1: renderer destination	Connect IPC accepts only an environment ID. Main resolves its own backend pool or saved catalog route/credential, checks the environment ID and authenticated permission, rejects unknown/disabled/wrong destinations, and obtains the grant itself. The attacker-URL and unknown-environment regressions both failed before the fix. Bearer, SSH and saved relay routes stay in main; relay proofs use the existing non-extractable app-window key, with main validating URL, token, signature and thumbprint. No cookie or mirror grant enters the signer/renderer.
Grok 2: credential authority	preview:mirror-cookies must be present on the authenticated credential and its live parent. Client surface/device claims grant nothing. A fabricated desktop origin on an ordinary owner credential failed the new regression before the fix. Dedicated local credentials rotate separately from renderer credentials; remote grants are explicit pairing permissions.
Grok 3: per-site status	Read only site keys from Chrome's DBSC SQLite table, never its credential protobuf/binding key. Exclude observed bound-site Chrome cookies and known Google credential cookies. Settings displays every reported site. The Settings regression fails against the previous component and passes on the new one.

No review finding is disputed. The requested SingletonLock predicate test is superseded by removal of the entire heuristic and a regression for the accepted never-remove rule.

Exact focused commands and results

CHROMERIA_TEST_ELECTRON=/tmp/chromeria-520-electron44/electron \
CHROMERIA_TEST_CHROMIUM=/usr/bin/chromium \
node_modules/.bin/vp test run \
  apps/desktop/src/preview/CookieMirror.test.ts \
  apps/desktop/src/preview/CookieMirrorMetadata.test.ts \
  apps/desktop/src/preview/CookieMirrorSocket.test.ts \
  apps/desktop/src/preview/CookieMirrorGrant.test.ts \
  apps/desktop/src/preview/ChromeCookieKey.test.ts \
  apps/desktop/src/preview/ChromeCookieSource.test.ts \
  apps/desktop/src/preview/ElectronCookieMirror.integration.test.ts \
  apps/desktop/src/preview/BrowserSession.test.ts \
  apps/desktop/src/preview/BrowserImport/BrowserImport.test.ts \
  apps/desktop/src/preview/BrowserImport/ChromiumCookies.test.ts \
  apps/desktop/src/preview/BrowserImport/ChromiumKeys.test.ts \
  apps/desktop/src/preview/BrowserImport/ChromiumKeys.module.test.ts \
  apps/desktop/src/preview/BrowserImport/CookieDatabase.test.ts \
  apps/desktop/src/preview/BrowserImport/Sources.test.ts \
  apps/desktop/src/ipc/methods/preview.test.ts \
  apps/desktop/src/settings/DesktopAppSettings.test.ts \
  apps/desktop/src/settings/DesktopClientSettings.test.ts \
  apps/desktop/src/snapShot/DesktopSnapShot.test.ts \
  apps/server/src/preview/BrowserCookieMirror.test.ts \
  apps/server/src/preview/CookieMirrorRoute.test.ts \
  apps/server/src/preview/ServerCookieMirror.integration.test.ts \
  apps/server/src/preview/ServerBrowser.test.ts \
  apps/server/src/preview/ServerBrowserContexts.test.ts \
  apps/server/src/preview/ServerBrowserStream.test.ts \
  apps/server/src/auth/RpcAuthorization.test.ts \
  apps/server/src/observability/RpcInstrumentation.test.ts \
  packages/contracts/src/browserCookieMirror.test.ts \
  packages/contracts/src/browserProfile.test.ts \
  packages/contracts/src/auth.test.ts \
  packages/shared/src/browserCookieMirror.test.ts \
  packages/client-runtime/src/rpc/session.test.ts \
  apps/web/src/hooks/useSettings.test.ts \
  apps/desktop/src/preview/CookieMirrorDestination.test.ts \
  apps/desktop/src/preview/CookieMirrorDpop.test.ts \
  apps/server/src/auth/EnvironmentAuth.test.ts \
  apps/server/src/auth/EnvironmentAuthAdmin.test.ts \
  apps/server/src/auth/PairingGrantStore.test.ts \
  apps/desktop/src/backend/DesktopLocalEnvironmentAuth.test.ts \
  packages/contracts/src/settings.test.ts

PASS: 39 files, 690 tests on this head. Synthetic WAL/decryption, identity/removal persistence, ordering, retries, privacy, full partition keys, auth and existing affected behavior are included. No real user cookies or Keychain reads.

cd apps/web
CHROMERIA_TEST_CHROMIUM=/usr/bin/chromium ../../node_modules/.bin/vp test run \
  src/components/settings/IntegrationsSettings.browser.test.tsx --project browser

PASS: 1 browser file, 2 tests. Uses installed Chromium with a disposable synthetic fixture. Initial attempts lacked Playwright's downloaded browser; CHROMERIA_TEST_CHROMIUM now selects the existing executable without installation. Before/after images are /tmp/chromeria-520-settings-before.png and /tmp/chromeria-520-settings-after.png. A token-authenticated attempt to GitHub's image upload endpoint failed with invalid character '<' looking for beginning of value; images remain local and were not committed. Browser-session cookies were not accessed.

CHROMERIA_TEST_ELECTRON=/tmp/chromeria-520-electron44/electron \
CHROMERIA_TEST_CHROMIUM=/usr/bin/chromium node_modules/.bin/vp test run \
  apps/desktop/src/preview/ElectronCookieMirror.integration.test.ts \
  apps/server/src/preview/ServerCookieMirror.integration.test.ts

PASS: 2 files, 2 real adapter tests, also included in the 690-test final run. Runtime versions: Electron 44.4.5; Playwright 1.60.0; Chromium 152.0.7977.82. Both run isolated persistent profiles, preserving attributes, full partition keys and exact sibling removal. Electron also proves millisecond expiry normalization.

Additional focused commands used during repair, all included in the final run:

• vp test run apps/web/src/hooks/useSettings.test.ts apps/desktop/src/preview/CookieMirror.test.ts: before-fix 4 failed / 33 passed for Opus 1/3/4/5; final cases pass.
• vp test run apps/desktop/src/preview/CookieMirrorGrant.test.ts apps/server/src/preview/BrowserCookieMirror.test.ts: before-fix 3 failed / 7 passed for both Grok high-severity findings; final cases pass.
• vp test run apps/desktop/src/preview/ChromeCookieKey.test.ts apps/desktop/src/preview/ChromeCookieSource.test.ts packages/shared/src/browserCookieMirror.test.ts apps/desktop/src/preview/CookieMirrorSocket.test.ts apps/web/src/hooks/useSettings.test.ts apps/desktop/src/preview/CookieMirror.test.ts: 54 passed at that intermediate revision.
• vp test run apps/server/src/auth/EnvironmentAuth.test.ts apps/server/src/auth/EnvironmentAuthAdmin.test.ts apps/server/src/auth/PairingGrantStore.test.ts apps/desktop/src/backend/DesktopLocalEnvironmentAuth.test.ts: initially caught a session-rotation regression (1 failed / 39 passed); it was fixed and the final run passes, including a new separation case.
• vp test run apps/server/src/auth/EnvironmentAuth.test.ts apps/server/src/auth/PairingGrantStore.test.ts apps/server/src/preview/BrowserCookieMirror.test.ts apps/desktop/src/preview/CookieMirrorDestination.test.ts: 43 passed.
• vp test run apps/desktop/src/preview/CookieMirrorDpop.test.ts apps/desktop/src/preview/CookieMirrorDestination.test.ts apps/server/src/auth/EnvironmentAuth.test.ts: 27 passed; the signing script uses real WebCrypto with synthetic IndexedDB.
• vp test run apps/desktop/src/preview/CookieMirrorDpop.test.ts apps/desktop/src/preview/ChromeCookieSource.test.ts apps/desktop/src/preview/CookieMirror.test.ts: 21 passed.
• vp test run apps/desktop/src/preview/CookieMirrorDpop.test.ts: 1 passed after making the test clock deterministic; it is also in the final 690-test run.

vp was invoked through this worktree's existing node_modules/.bin/vp. No packages or browsers were installed. Scoped lint on the 73 TypeScript files in the PR diff passed, with six pre-existing warnings; the final changed signing test also passed scoped lint. Each command below passed:

node_modules/.bin/tsc-rs --noEmit -p apps/desktop/tsconfig.json
node_modules/.bin/tsc-rs --noEmit -p apps/server/tsconfig.json
node_modules/.bin/tsc-rs --noEmit -p apps/web/tsconfig.json
node_modules/.bin/tsc-rs --noEmit -p packages/contracts/tsconfig.json
node_modules/.bin/tsc-rs --noEmit -p packages/shared/tsconfig.json
node_modules/.bin/tsc-rs --noEmit -p packages/client-runtime/tsconfig.json
scripts/fork-check.sh
node scripts/fork-features.mjs check
git diff --check

No repo-wide checks. No version bump. The restored DesktopClientSettings and SnapShot test files remove the obsolete main-process settings writer from the overall PR. The fork registry/allowlist and user guidance reflect the final behavior.

Planner handoff

Existing remote connections need pairing credentials with Mirror desktop browser logins (preview:mirror-cookies); standard credentials and standard cloud-connect sessions do not implicitly gain cookie-write authority. The setting is available in Connections' pairing permissions. The trusted local desktop bootstrap can mint a separate main-only credential; renderer defaults remain standard scopes. Configure the Bao argv in desktop-settings.json; command changes and repaired reads now recover without restarting the app.

Build all artifacts from the independently reviewed head and verify embedded t3codeCommitHash:

• cavallo desktop: release/Chromeria-0.1.0-arm64.zip, containing Chromeria.app.
• bestia server: release-cli/t3-0.1.0-linux-x64.tar.gz, entire extracted runtime including client and externals.
• Rocky server: release-cli/t3-0.1.0-darwin-arm64.tar.gz, entire extracted runtime including client and externals.

No production artifacts were built, installed or deployed. Independent exact-head review, macOS source/version/encryption and cost proof, live site acceptance, logout/restart/offline checks remain with the planner. Google/other DBSC sites require independent sign-in; no DBSC workaround exists here. Retain the worktree and branch for that review; the planner retires them at merge.

Requirements and who asked: The user and approved #520 decisions, refined by Opus/Grok reviews: preserve client ownership and source identities, recover keys, prevent cookie echo, authenticate destinations/credentials, and show per-site limitations.
Deleted: Main's competing profile writer, process-lifetime failure caching, lock-dependent session deletion, snapshot-wide removal blocking, renderer-selected destinations, and client-surface authority.
Bottleneck: Prove order, identity and credential authority across SQLite, Electron, and environment contexts before live account use.
Checked myself: Before-fix failures, final focused outputs, both real adapters, actual signing/verification, per-site Settings behavior, six package typechecks, scoped lint, fork ownership checks, and the final diff.

Implemented with GPT-6.1 Sol through the Codex harness.

[lukemaj]

Independent review round 2 at ad8633a7: FAIL (Claude Opus 5.5 and Grok 4.7). Both confirm every round-1 finding fixed. Sent back to the builder:

• Medium (both): CookieMirror.ts:298-306 removes only persistent cookies, so signing out of a session-cookie login in a running Chrome never reaches downstream; CookieMirror.test.ts:137-145 asserts that behavior.
• Low (Opus): the renderer can still request preview:mirror-cookies with the desktop bootstrap token (window.ts:135-139, EnvironmentAuth.ts:1005, :1030); Grok cites an existing separation test, to be reconciled.
• Low (Opus): user renames of Chrome-mapped profiles are overwritten (useSettings.ts:288); dead preview.enableCookieMirror wiring; docs/map.md lacks PR #530; connect reports the old socket (DesktopCookieMirror.ts:384).
• Low (Grok): the Electron adapter test skips unless CHROMERIA_TEST_ELECTRON is set.
• CI on ad8633a/6d084c1: knip unused export, React Compiler bail-out in ChromeCookieMirrorStatus.tsx, feature-map test, formatting in docs/fork-features.md, one possibly pre-existing AcpRegistrySearchStep browser test; the branch now conflicts with main.

[lukemaj]

What: Round-2 findings and the reported CI defects are fixed at c9b0ce69a2ab9da0278ec3cf1b74986c41594bff.
Why: Live session removals, public bootstrap authority, profile labels and the new compiler path needed stronger boundaries and proof.
So what: The planner independently reviews this rebased head and owns installation and live site proof; scoped direct pairings are required for remote mirroring.

Final base: d17be12f8a951bd4ccba1dc641065b9b4c6ca48c (origin/main at rebase and push). Final head: c9b0ce69a2ab9da0278ec3cf1b74986c41594bff. Four commits, no merge commit. Explicit force-push lease: 6d084c1ba2ff3935fae1d67e181f0f07bbf246d9. GitHub reports this head and MERGEABLE; local/remote divergence is 0/0 and the worktree is clean.

The Knip-only delta was first pushed separately as 6d084c1ba2ff3935fae1d67e181f0f07bbf246d9 (now replayed as c83579bfe1). Its entire diff was:

-export const cookieMirrorUrl = (cookie: CookieMirrorKey, secure: boolean) => {
+const cookieMirrorUrl = (cookie: CookieMirrorKey, secure: boolean) => {

node_modules/.bin/vp run knip:check: PASS. The first local attempt reported relay dependencies because that worktree had no infra/relay/node_modules; restoring ignored links from an existing dependency cache made the complete command pass. No dependency or manifest was installed/changed for that setup.

Review responses:

1. Session-cookie sign-out: source observations now carry an in-memory Chrome PID/start-time identity. Main probes before and after the database snapshot; the core removes vanished session cookies only across the same known process identity. Relaunch (including PID reuse with a new start time), unknown/dead/foreign locks and desktop restart preserve them. A synthetic SingletonLock/process-probe test covers local/foreign/malformed/stale cases. The service test proves session removal reaches both environments; the companion test preserves relaunch/unknown/restart cases. The live-session regression failed before the fix.
2. Bootstrap authority: fixed with a distinct HMAC purpose derived from main's existing private desktop secret. Renderer bootstrap grants have standard scopes only, and cannot obtain preview:mirror-cookies or rotate main's session. The existing separation test tested rotation of separately named sessions but still used the same bootstrap token for both, so it did not cover Opus's escalation. It now uses distinct derived tokens and proves the renderer's mirror request fails without invalidating main. A legacy-token escalation regression also failed before the fix; legacy token-only backends fail closed for mirroring. This was a small change to the existing derivation, not a new credential service.
3. Profile labels: discovery initializes names for new profiles; existing client labels, including Default, win. The mapping service also retains the selected client's label. The renamed-profile regression failed before the fix.
4. Dead API: removed preview.enableCookieMirror, its RPC schema/group entry, permission mapping, instrumentation and service method. The private authenticated grant route remains the service entry. No occurrence remains in source.
5. Map and compiler: %% BLM: #520 PR #530 is present. The component's try/finally was rewritten without a compiler opt-out. The compiler regression was reproduced before fixing it. CI's map failure was at the helper's one-second vi.waitFor deadline on a fixed diagram that does not read docs/map.md, not a missing BLM node. The observer now awaits its actual render callback; all real-map and fixed-diagram assertions remain and pass.
6. Connect status: returns the current map entry after replacement rather than the captured old connection. A service test covers first connection, replacement, stale-generation disconnect and current disconnect; it failed against the pre-fix implementation.
7. Real adapters: default CI skips the opt-in adapter tests. They were explicitly enabled on this head and passed, as detailed below. No CI gate is claimed for the skipped default path.
8. ACP timing failure: unchanged by this PR. Exact file: 8 PASS on the PR and 8 PASS on isolated origin/main at d17be12f8a951bd4ccba1dc641065b9b4c6ca48c. Advancing the existing debounce by 300 ms before Enter with virtual timers on main reproduces the same unexpected-refresh assertion. This demonstrates a pre-existing timing-sensitive assertion; tracked separately in #536. The disposable baseline edits were restored.

No review finding remains disputed. The BLM attribution is the only corrected hypothesis: the failing fixed-diagram test never reads the map file.

Proof, 2026-10-19 (Europe/Warsaw), on the rebased candidate:

• Focused suite: 43 files / 1,792 tests PASS, including 1,090 compiler-coverage cases, 3 map cases and enabled real adapters. The same suite passed before the rebase. The final amendment changed only fork inventory/allowlist metadata, with no tested TypeScript changes; fresh format and fork checks passed on the final head.
• Browser: 2 files / 10 tests PASS (2 Settings status tests and 8 ACP tests).
• Real adapters, standalone: 2 files / 2 tests PASS.
• Typecheck: desktop, server, web, contracts, shared, client-runtime: all PASS.
• Scoped lint: 73 TypeScript files PASS, two existing inline-schema compilation warnings in browserProfile.test.ts.
• Format check: 78 supported touched files PASS (79 PR paths supplied; the allowlist is plain text).
• Knip: both stages PASS. Fork stack and feature registry: PASS, 53 features. git diff --check: PASS.
• No repo-wide test/typecheck/lint run. The repo-wide Knip command was explicitly requested. No package/browser install, production write, live Keychain access or real user cookie was used.

Exact focused command:

CHROMERIA_TEST_ELECTRON=/tmp/chromeria-520-electron44/electron CHROMERIA_TEST_CHROMIUM=/usr/bin/chromium node_modules/.bin/vp test run apps/desktop/src/backend/DesktopLocalEnvironmentAuth.test.ts \
  apps/desktop/src/ipc/methods/preview.test.ts \
  apps/desktop/src/preview/BrowserImport/BrowserImport.test.ts \
  apps/desktop/src/preview/BrowserImport/ChromiumCookies.test.ts \
  apps/desktop/src/preview/BrowserImport/ChromiumKeys.module.test.ts \
  apps/desktop/src/preview/BrowserImport/ChromiumKeys.test.ts \
  apps/desktop/src/preview/BrowserImport/CookieDatabase.test.ts \
  apps/desktop/src/preview/BrowserImport/Sources.test.ts \
  apps/desktop/src/preview/BrowserSession.test.ts \
  apps/desktop/src/preview/ChromeCookieKey.test.ts \
  apps/desktop/src/preview/ChromeCookieSource.test.ts \
  apps/desktop/src/preview/CookieMirror.test.ts \
  apps/desktop/src/preview/CookieMirrorDestination.test.ts \
  apps/desktop/src/preview/CookieMirrorDpop.test.ts \
  apps/desktop/src/preview/CookieMirrorGrant.test.ts \
  apps/desktop/src/preview/CookieMirrorMetadata.test.ts \
  apps/desktop/src/preview/CookieMirrorSocket.test.ts \
  apps/desktop/src/preview/DesktopCookieMirror.test.ts \
  apps/desktop/src/preview/ElectronCookieMirror.integration.test.ts \
  apps/desktop/src/settings/DesktopAppSettings.test.ts \
  apps/desktop/src/settings/DesktopClientSettings.test.ts \
  apps/desktop/src/snapShot/DesktopSnapShot.test.ts \
  apps/server/src/auth/EnvironmentAuth.test.ts \
  apps/server/src/auth/EnvironmentAuthAdmin.test.ts \
  apps/server/src/auth/PairingGrantStore.test.ts \
  apps/server/src/auth/RpcAuthorization.test.ts \
  apps/server/src/observability/RpcInstrumentation.test.ts \
  apps/server/src/preview/BrowserCookieMirror.test.ts \
  apps/server/src/preview/CookieMirrorRoute.test.ts \
  apps/server/src/preview/ServerBrowser.test.ts \
  apps/server/src/preview/ServerBrowserContexts.test.ts \
  apps/server/src/preview/ServerBrowserStream.test.ts \
  apps/server/src/preview/ServerCookieMirror.integration.test.ts \
  apps/web/src/components/featureMap/featureMap.mermaid.test.tsx \
  apps/web/src/hooks/useSettings.test.ts \
  apps/web/src/reactCompilerCoverage.test.ts \
  packages/client-runtime/src/rpc/session.test.ts \
  packages/contracts/src/auth.test.ts \
  packages/contracts/src/browserCookieMirror.test.ts \
  packages/contracts/src/browserProfile.test.ts \
  packages/contracts/src/settings.test.ts \
  packages/shared/src/browserCookieMirror.test.ts \
  packages/shared/src/desktopBootstrapToken.test.ts

Exact browser command, from apps/web:

CHROMERIA_TEST_CHROMIUM=/usr/bin/chromium ../../node_modules/.bin/vp test run src/components/settings/IntegrationsSettings.browser.test.tsx src/components/settings/AcpRegistrySearchStep.browser.test.tsx --project browser

Real adapter command, from the repository root:

CHROMERIA_TEST_ELECTRON=/tmp/chromeria-520-electron44/electron CHROMERIA_TEST_CHROMIUM=/usr/bin/chromium node_modules/.bin/vp test run apps/desktop/src/preview/ElectronCookieMirror.integration.test.ts apps/server/src/preview/ServerCookieMirror.integration.test.ts

Environment: Linux, runner Node 26.8.2, existing Electron 44.4.5 (embedded Node 24.21.0), Playwright 1.60.0, installed Chromium 152.0.7977.82. Tests use isolated synthetic profiles and verify fractional expiry plus full-partition-key removal/sibling preservation.

Other exact commands:

node_modules/.bin/tsc-rs --noEmit -p apps/desktop/tsconfig.json
node_modules/.bin/tsc-rs --noEmit -p apps/server/tsconfig.json
node_modules/.bin/tsc-rs --noEmit -p apps/web/tsconfig.json
node_modules/.bin/tsc-rs --noEmit -p packages/contracts/tsconfig.json
node_modules/.bin/tsc-rs --noEmit -p packages/shared/tsconfig.json
node_modules/.bin/tsc-rs --noEmit -p packages/client-runtime/tsconfig.json
node_modules/.bin/vp run knip:check
scripts/fork-check.sh
node scripts/fork-features.mjs check
git diff --check

Exact scoped lint and touched-file format commands

node_modules/.bin/vp lint apps/desktop/src/backend/DesktopLocalEnvironmentAuth.ts apps/desktop/src/ipc/DesktopIpcHandlers.ts apps/desktop/src/ipc/channels.ts apps/desktop/src/ipc/methods/cookieMirror.ts apps/desktop/src/ipc/methods/preview.test.ts apps/desktop/src/ipc/methods/preview.ts apps/desktop/src/main.ts apps/desktop/src/preload.ts apps/desktop/src/preview/BrowserImport/BrowserImport.ts apps/desktop/src/preview/BrowserImport/ChromiumKeys.ts apps/desktop/src/preview/ChromeCookieKey.test.ts apps/desktop/src/preview/ChromeCookieKey.ts apps/desktop/src/preview/ChromeCookieSource.test.ts apps/desktop/src/preview/ChromeCookieSource.ts apps/desktop/src/preview/CookieMirror.test.ts apps/desktop/src/preview/CookieMirror.ts apps/desktop/src/preview/CookieMirrorDestination.test.ts apps/desktop/src/preview/CookieMirrorDestination.ts apps/desktop/src/preview/CookieMirrorDpop.test.ts apps/desktop/src/preview/CookieMirrorDpop.ts apps/desktop/src/preview/CookieMirrorGrant.test.ts apps/desktop/src/preview/CookieMirrorGrant.ts apps/desktop/src/preview/CookieMirrorMetadata.test.ts apps/desktop/src/preview/CookieMirrorMetadata.ts apps/desktop/src/preview/CookieMirrorSocket.test.ts apps/desktop/src/preview/CookieMirrorSocket.ts apps/desktop/src/preview/DesktopCookieMirror.test.ts apps/desktop/src/preview/DesktopCookieMirror.ts apps/desktop/src/preview/ElectronCookieMirror.integration.test.ts apps/desktop/src/preview/ElectronCookieMirror.ts apps/desktop/src/preview/PartitionScope.ts apps/desktop/src/settings/DesktopAppSettings.test.ts apps/desktop/src/settings/DesktopAppSettings.ts apps/server/src/auth/EnvironmentAuth.test.ts apps/server/src/auth/EnvironmentAuth.ts apps/server/src/auth/PairingGrantStore.test.ts apps/server/src/auth/PairingGrantStore.ts apps/server/src/preview/BrowserCookieMirror.test.ts apps/server/src/preview/BrowserCookieMirror.ts apps/server/src/preview/CookieMirrorRoute.test.ts apps/server/src/preview/CookieMirrorRoute.ts apps/server/src/preview/ServerBrowser.test.ts apps/server/src/preview/ServerBrowser.ts apps/server/src/preview/ServerBrowserStream.test.ts apps/server/src/preview/ServerCookieMirror.integration.test.ts apps/server/src/preview/ServerCookieMirror.ts apps/server/src/preview/ServerCookieMirrorProfiles.ts apps/server/src/server.ts apps/web/src/components/featureMap/featureMap.mermaid.test.tsx apps/web/src/components/settings/ChromeCookieMirrorStatus.tsx apps/web/src/components/settings/IntegrationsSettings.browser.test.tsx apps/web/src/components/settings/IntegrationsSettings.tsx apps/web/src/connection/runtime.ts apps/web/src/hooks/useSettings.test.ts apps/web/src/hooks/useSettings.ts apps/web/src/rpc/cookieMirrorConnection.ts apps/web/src/rpc/cookieMirrorStatus.ts apps/web/vite.config.ts packages/client-runtime/src/rpc/session.test.ts packages/client-runtime/src/rpc/session.ts packages/contracts/src/auth.ts packages/contracts/src/browserCookieMirror.test.ts packages/contracts/src/browserCookieMirror.ts packages/contracts/src/browserProfile.test.ts packages/contracts/src/browserProfile.ts packages/contracts/src/index.ts packages/contracts/src/ipc.ts packages/contracts/src/settings.ts packages/shared/src/authScopeOptions.ts packages/shared/src/browserCookieMirror.test.ts packages/shared/src/browserCookieMirror.ts packages/shared/src/desktopBootstrapToken.test.ts packages/shared/src/desktopBootstrapToken.ts
node_modules/.bin/vp fmt --check apps/desktop/src/backend/DesktopLocalEnvironmentAuth.ts apps/desktop/src/ipc/DesktopIpcHandlers.ts apps/desktop/src/ipc/channels.ts apps/desktop/src/ipc/methods/cookieMirror.ts apps/desktop/src/ipc/methods/preview.test.ts apps/desktop/src/ipc/methods/preview.ts apps/desktop/src/main.ts apps/desktop/src/preload.ts apps/desktop/src/preview/BrowserImport/BrowserImport.ts apps/desktop/src/preview/BrowserImport/ChromiumKeys.ts apps/desktop/src/preview/ChromeCookieKey.test.ts apps/desktop/src/preview/ChromeCookieKey.ts apps/desktop/src/preview/ChromeCookieSource.test.ts apps/desktop/src/preview/ChromeCookieSource.ts apps/desktop/src/preview/CookieMirror.test.ts apps/desktop/src/preview/CookieMirror.ts apps/desktop/src/preview/CookieMirrorDestination.test.ts apps/desktop/src/preview/CookieMirrorDestination.ts apps/desktop/src/preview/CookieMirrorDpop.test.ts apps/desktop/src/preview/CookieMirrorDpop.ts apps/desktop/src/preview/CookieMirrorGrant.test.ts apps/desktop/src/preview/CookieMirrorGrant.ts apps/desktop/src/preview/CookieMirrorMetadata.test.ts apps/desktop/src/preview/CookieMirrorMetadata.ts apps/desktop/src/preview/CookieMirrorSocket.test.ts apps/desktop/src/preview/CookieMirrorSocket.ts apps/desktop/src/preview/DesktopCookieMirror.test.ts apps/desktop/src/preview/DesktopCookieMirror.ts apps/desktop/src/preview/ElectronCookieMirror.integration.test.ts apps/desktop/src/preview/ElectronCookieMirror.ts apps/desktop/src/preview/PartitionScope.ts apps/desktop/src/settings/DesktopAppSettings.test.ts apps/desktop/src/settings/DesktopAppSettings.ts apps/server/src/auth/EnvironmentAuth.test.ts apps/server/src/auth/EnvironmentAuth.ts apps/server/src/auth/PairingGrantStore.test.ts apps/server/src/auth/PairingGrantStore.ts apps/server/src/preview/BrowserCookieMirror.test.ts apps/server/src/preview/BrowserCookieMirror.ts apps/server/src/preview/CookieMirrorRoute.test.ts apps/server/src/preview/CookieMirrorRoute.ts apps/server/src/preview/ServerBrowser.test.ts apps/server/src/preview/ServerBrowser.ts apps/server/src/preview/ServerBrowserStream.test.ts apps/server/src/preview/ServerCookieMirror.integration.test.ts apps/server/src/preview/ServerCookieMirror.ts apps/server/src/preview/ServerCookieMirrorProfiles.ts apps/server/src/server.ts apps/web/src/components/featureMap/featureMap.mermaid.test.tsx apps/web/src/components/settings/ChromeCookieMirrorStatus.tsx apps/web/src/components/settings/IntegrationsSettings.browser.test.tsx apps/web/src/components/settings/IntegrationsSettings.tsx apps/web/src/connection/runtime.ts apps/web/src/hooks/useSettings.test.ts apps/web/src/hooks/useSettings.ts apps/web/src/rpc/cookieMirrorConnection.ts apps/web/src/rpc/cookieMirrorStatus.ts apps/web/vite.config.ts docs/fork-features.md docs/fork.md docs/map.md docs/user/browser-import.md packages/client-runtime/src/rpc/session.test.ts packages/client-runtime/src/rpc/session.ts packages/contracts/src/auth.ts packages/contracts/src/browserCookieMirror.test.ts packages/contracts/src/browserCookieMirror.ts packages/contracts/src/browserProfile.test.ts packages/contracts/src/browserProfile.ts packages/contracts/src/index.ts packages/contracts/src/ipc.ts packages/contracts/src/settings.ts packages/shared/package.json packages/shared/src/authScopeOptions.ts packages/shared/src/browserCookieMirror.test.ts packages/shared/src/browserCookieMirror.ts packages/shared/src/desktopBootstrapToken.test.ts packages/shared/src/desktopBootstrapToken.ts scripts/fork-upstream-edits.txt

Before-fix command results:

• node_modules/.bin/vp test run apps/desktop/src/preview/CookieMirror.test.ts apps/web/src/hooks/useSettings.test.ts apps/server/src/auth/EnvironmentAuth.test.ts: 3 intended regression failures / 61 PASS (live session removal, user labels, renderer minting).
• node_modules/.bin/vp test run apps/desktop/src/preview/DesktopCookieMirror.test.ts against the saved pre-fix main implementation: FAIL, first connect returned false instead of the new connection's true state; passed after restoration of the fix.
• node_modules/.bin/vp test run apps/web/src/reactCompilerCoverage.test.ts apps/web/src/components/featureMap/featureMap.mermaid.test.tsx: before compiler fix, 1 FAIL / 1,092 PASS; after the fix, 1,093 PASS. They also pass in the final 43-file suite.
• Main ACP experiment and exact baseline command/results are recorded in test(web): ACP submit assertion races the search debounce #536. The baseline config only selects the installed Chromium executable; no source change was retained.

Rebase conflict: only scripts/fork-upstream-edits.txt. The conflict was concurrent additions at EOF. Preserved main's apps/mobile/src/lib/threadActivity.ts and apps/web/src/session-logic.ts, followed by the complete #520 block. No feature code conflict required a design choice. The two newly modified upstream bootstrap-token files were then added to the allowlist and assigned to #520 in docs/fork-features.md; the checker caught and verified that correction. Also formatted only the requested registry path and other touched paths, and removed two stale PR-only screenshot paths from that registry.

Complete rebase range-diff

1:  b91408ed5d ! 1:  58c2d38c9b feat(desktop): mirror Chrome logins to connected environments
    @@ docs/fork.md: with its existing Electron `chromeria` profile. Development keeps
     
      ## docs/map.md ##
     @@ docs/map.md: flowchart TD
    -     %% PBI: #460 PR #470
    +     %% PBI: #460 PR #470 PR #527
          T3C --> PBI
      
     +    BLM["Chrome login mirror"]
    @@ packages/shared/src/browserCookieMirror.ts (new)
     +}
     
      ## scripts/fork-upstream-edits.txt ##
    -@@ scripts/fork-upstream-edits.txt: packages/provider-core/src/server/ProviderContinuationRequests.ts
    - packages/provider-muse/src/server/adapter.ts
    - packages/provider-pi/src/server/adapter.ts
    +@@ scripts/fork-upstream-edits.txt: packages/provider-pi/src/server/adapter.ts
      apps/server/src/mcp/toolkits/pullRequests/handlers.test.ts
    + apps/mobile/src/lib/threadActivity.ts
    + apps/web/src/session-logic.ts
     +
     +# Chrome login mirror (#520)
     +apps/desktop/src/ipc/methods/preview.test.ts
2:  ad8633a771 = 2:  0199098523 fix(preview): resolve cookie mirror review findings
3:  6d084c1ba2 = 3:  c83579bfe1 fix(shared): keep cookie mirror URL helper private
4:  382a5803d3 ! 4:  c9b0ce69a2 fix(preview): preserve session logouts and desktop authority
    @@ docs/fork-features.md: sources and reasons.
          "apps/web/src/components/settings/ChromeCookieMirrorStatus.tsx",
          "apps/web/src/rpc/cookieMirrorConnection.ts",
          "apps/web/src/rpc/cookieMirrorStatus.ts",
    +@@ docs/fork-features.md: sources and reasons.
    +     "packages/client-runtime/src/rpc/session.ts",
    +     "packages/contracts/src/browserProfile.test.ts",
    +     "packages/contracts/src/browserProfile.ts",
    +-    "packages/shared/src/authScopeOptions.ts"
    ++    "packages/shared/src/authScopeOptions.ts",
    ++    "packages/shared/src/desktopBootstrapToken.test.ts",
    ++    "packages/shared/src/desktopBootstrapToken.ts"
    +   ],
    +   "sharedFiles": [
    +     "apps/desktop/src/ipc/DesktopIpcHandlers.ts",
     @@ docs/fork-features.md: sources and reasons.
          "apps/server/src/server.ts",
          "apps/server/src/ws.ts",
    @@ docs/fork-features.md: sources and reasons.
          "docs/map.md",
          "packages/contracts/src/auth.ts",
     @@ docs/fork-features.md: sources and reasons.
    -     "packages/contracts/src/ipc.ts",
    -     "packages/contracts/src/rpc.ts",
          "packages/contracts/src/settings.ts",
    --    "packages/shared/package.json"
    -+    "packages/shared/package.json",
    -+    "packages/shared/src/desktopBootstrapToken.test.ts",
    -+    "packages/shared/src/desktopBootstrapToken.ts"
    +     "packages/shared/package.json"
        ],
     -  "keywords": [
     -    "cookie mirror",
    @@ packages/shared/src/desktopBootstrapToken.ts: function windowIndex(nowMs: number
          return expected.length === presented.length && NodeCrypto.timingSafeEqual(expected, presented);
        });
      }
    +
    + ## scripts/fork-upstream-edits.txt ##
    +@@ scripts/fork-upstream-edits.txt: apps/mobile/src/lib/threadActivity.ts
    + apps/web/src/session-logic.ts
    + 
    + # Chrome login mirror (#520)
    ++packages/shared/src/desktopBootstrapToken.test.ts
    ++packages/shared/src/desktopBootstrapToken.ts
    + apps/desktop/src/ipc/methods/preview.test.ts
    + apps/desktop/src/ipc/methods/preview.ts
    + apps/desktop/src/preview/BrowserImport/BrowserImport.ts

Pairing answer and one-time cavallo setup:

• A direct pairing can carry preview:mirror-cookies, only when issued explicitly. The CLI's repeated --scope flags replace its defaults, so include all standard scopes too. A default direct pairing lacks the new scope.
• T3 Connect's current CloudLink.ts environment mint explicitly grants AuthStandardClientScopes; its automatic environment credential therefore cannot carry mirror authority in this build. Changing the cloud mint protocol is not included. The safe supported setup is an explicit direct pairing for the same environment, which updates its saved route/credential.
• After deploying this head, the planner sets Bao argv on cavallo and creates a new scoped direct URL for each server using that server's installed CLI/configured home and reachable base URL. No token is published in this record. Example template:

t3 auth pairing create --home-dir <server-home> --base-url <reachable-server-origin> --label cavallo --scope orchestration:read --scope orchestration:operate --scope settings:write --scope providers:manage --scope environment:maintain --scope preview:operate --scope diagnostics:read --scope terminal:read --scope terminal:operate --scope source-control:write --scope filesystem:read --scope filesystem:write --scope relay:read --scope access:read --scope access:write --scope relay:write --scope preview:mirror-cookies

• Once on cavallo, use Settings > Connections > Add environment to paste the fresh bestia URL and Rocky URL. Keep those environments enabled and Chrome/Chromeria running. No further mirror switch is needed. Allow roughly a minute for Chrome flush plus observation. Existing standard pairing/T3 Connect sessions do not silently gain this permission.

Surfaces: desktop, server, contracts and shared authenticated-connection code apply; Electron Settings uses shared web code. Web-only/mobile have no Chrome source or desktop-main IPC, so source/destination mirroring does not apply there. Providers and agents consume the server browser without receiving cookie batches. No version bump.

Delivery: code, commits, lease push and PR update complete; independent current-head review, production builds/installation, merge and live proof remain planner-owned. T3 Connect-only mirroring is not delivered because its mint grants no dedicated authority; use scoped direct pairing for live proof. DBSC sign-ins remain per environment. Mac process/source behavior, scan cost, live grok.com login, logout/relaunch and offline catch-up are not claimed proved by Linux synthetic tests.

Artifacts for the planner to build/install from the independently reviewed head:

• cavallo: release/Chromeria-0.1.0-arm64.zip containing Chromeria.app.
• bestia: release-cli/t3-0.1.0-linux-x64.tar.gz, full runtime with client and externals.
• Rocky: release-cli/t3-0.1.0-darwin-arm64.tar.gz, full runtime with client and externals.
  Verify embedded t3codeCommitHash. No builds or installation were performed here. Earlier synthetic Settings images remain local; their GitHub upload failure is recorded in the PR body, and no PR-only image is committed.

Requirements and who asked: The #520 planner's Opus/Grok round-2 findings, CI failures and merge-free rebase request, preserving the approved cookie-mirror design.
Deleted: Dead enable RPC, shared bootstrap minting authority, rename overwrites, blanket session non-removal and a polling-based test observer; no ACP implementation change.
Bottleneck: Establish process continuity and scoped credential authority, then pass the requested exact scoped proof before live account use.
Checked myself: Red/green regressions, both origin/main ACP experiments, all commands/results above, real adapter versions, range-diff, live remote head and mergeability.

[lukemaj]

What: The requested map comparison passes on both the pushed #530 head and current origin/main; CI on the PR head is green.
Why: The map fixture exercises a fixed graph independently of docs/map.md, and its previous observer had a one-second polling deadline around lazy Mermaid rendering.
So what: The planner can review c9b0ce6 using the complete proof below; no additional implementation or deployment was performed.

Verified on 2026-10-19, Europe/Warsaw. Branch and remote are both c9b0ce69a2ab9da0278ec3cf1b74986c41594bff; current main is d17be12f8a951bd4ccba1dc641065b9b4c6ca48c, already included by the merge-free rebase. The PR is mergeable and the task worktree is clean. All prior regression, typecheck, Knip, formatting, real-adapter and rebase proof remains bound to this same candidate in the complete command record.

Fresh comparison command in each checkout:

node_modules/.bin/vp test run apps/web/src/components/featureMap/featureMap.mermaid.test.tsx

• PR head, implementation worktree: 1 file / 3 tests PASS, 16:33:03 Warsaw, 3.49 seconds.
• Unmodified origin/main d17be12 in /tmp/chromeria-520-main-map-proof: 1 file / 3 tests PASS, 16:33:35 Warsaw, 5.93 seconds. Used only ignored links to existing dependency caches, with no install or tracked edits.
• Assertions are unchanged. This PR replaces only the observer's timed vi.waitFor with the actual onRendered callback Promise. The fixture does not load docs/map.md. The separate BLM map reference is fixed to #520 PR #530.

The ACP test and component have no diff against main. The exact file passed 8/8 on both branches; a controlled 300 ms debounce experiment reproduced the reported assertion on main. Evidence and the separate pre-existing issue are in #536. No ACP source or test change was included in #530.

Current-head CI: Lint, Build and Typecheck, Test Web, package tests, all eight Server test shards and the final Check are SUCCESS. The Fork Stack Model also passed. Optional EAS/web preview/native static analysis jobs were skipped as configured. The real Electron/Playwright adapter proof remains the explicit opt-in 2 files / 2 tests PASS command and environment documented in the PR body and full proof record.

Credential setup is unchanged: the local renderer bootstrap cannot mint mirror authority. Default direct and automatic T3 Connect pairings lack preview:mirror-cookies. The planner must issue direct pairing URLs with all standard scopes plus that dedicated scope; once on cavallo, paste the bestia and Rocky URLs into Settings > Connections > Add environment, keeping both enabled. Registration updates the existing environment's route/credential. No mirror toggle is required. Automatic T3 Connect-only minting remains outside this build and is explicitly recorded as not delivered. No credential was created or read by this worker.

Requirements and who asked: The planner requested an explicit origin/main map comparison, complete round-2 status, exact proof, a merge-free rebase and scope setup instructions.
Deleted: No additional feature code; no ACP workaround or assertion weakening.
Bottleneck: Independent exact-head review and planner-owned scoped pairing and live Mac proof.
Checked myself: Both map commands, unmodified baseline status, source assertions and registration path, live remote refs, mergeability and current-head CI conclusions.

[lukemaj]

Independent review round 3 at c9b0ce69a2: PASS (Claude Opus 5.5). All round-2 findings verified fixed: 85/85 targeted tests pass, and restoring the pre-fix CookieMirror.ts, PairingGrantStore.ts, useSettings.ts and DesktopCookieMirror.ts fails 6 of them. Electron adapter tests 2/2 with CHROMERIA_TEST_ELECTRON set (skipped by default in CI). Rebase resolution of scripts/fork-upstream-edits.txt checked. CI: 26/26 checks green.

Grok 4.7 round 3 did not run: 402 Payment Required: Grok Build usage balance exhausted.

Remaining Low, not blocking: a Chrome quit and relaunch within one poll interval can propagate Chrome's startup removal of last session's session cookies (CookieMirror.ts:309-312, DesktopCookieMirror.ts:297-322); downstream then matches Chrome. Suggested fix: remove a session cookie only if it was created after the current Chrome process started. Optional: persist the Chrome process identity so session sign-outs made while the desktop app was closed catch up.

Not yet proven: live install and the grok.com acceptance on bestia and Rocky.

[lukemaj]

Agent work on this PR

Estimated cost unknown · 3 responses · 10 sessions · 3.5 h wall time

Model	Responses	Tokens	Estimated cost
grok-4.7 (grok, high)	3	8,251,831	unknown

Flags: 2 human corrections · 2 large tool outputs · 7 repeated commands · 3 repeated failures · 8 repeated reads · 11 repeated skill loads · 1 test edited after a failure · 3 unpriced responses

Details: snapshot, prices, coverage, counters

• Task toolboxmd/chromeria#520: outcome unknown (recorded acceptance only; a finished process never implies it).
• Proof: spec: mirror Mac browser logins into Chromeria and out to bestia and Rocky #520
• Snapshot 71791d5948d972412ef12fa826e99eb89da4f9ea9d99f9252c050f8eb7f0e09c, records up to 2026-10-19 14:34 UTC.
• 10 sessions on claude, codex, grok; AgentsMD unknown.
• The total includes work shared with 2 other tasks, counted whole in each, so sums across PRs overlap.
• Not counted: 507 responses ($29.19) in sessions shared with other PRs that worked in no single PR's checkout.
• 219 responses in these sessions worked on other PRs and are counted there.
• Totals reconcile with the measured sessions: yes. Evidence complete: yes.
• Prices: list-price estimate from T3 local rate table (path withheld) as of 2026-10-18, schedule 414551dda4c47258113dcfa46a5dfa5aa512406e3dfcadcca3381421595c5588. Unknown prices stay unknown, never zero.
  • T3 LiteLLM rate table when present; bundled schedule covers the rest.
  • Model price sources: T3 local rate table (path withheld).
  • Unpriced: unknown model (3).
• Harness-reported cost: none reported.
• Usage totals are not billing. Subscription spending is separate and is never posted as spend.
• Crashed runs are counted separately: 0.

Token counters by model (native counter semantics; never added across semantics):

• grok-4.7 (grok, high), grok counters: input includes cached, output includes reasoning: input 8,114,887; cache-read 7,636,096; cache-write 0; output 136,944; reasoning 120,740; harness total 8,251,831.

Generated tokens (reasoning and other output are disjoint; other output includes code, tool calls and replies):

Model	Reasoning	Other output	Reasoning share	Split known for
grok-4.7 (grok, high)	unknown	unknown	unknown	0 of 3

Selected rates (USD per million tokens). These rates value the report at the selected schedule date; they do not establish historical prices or subscription spending.

Model	Input tier	Input	Cache read	Cache write	Other output	Reasoning
grok-4.7	all	unknown	unknown	unknown	unknown	unknown

Other output and reasoning are priced without double counting inclusive native output. Missing rates remain unknown.

_{Local measurement from native records; usage totals are not billing. Updated in place by agent-observer publish.}