Repository navigation
G5 Private Browser: Browser on Apple Silicon Mac #87
Description
Current goal: stable Browser on Apple Silicon Mac
Published 2.0.0 offers Browser on Apple Silicon Mac. The accepted single-window scope is recorded in the release decision. Jetson is #90; the Linux x86 source candidate is PR #349, with role evidence tracked by #293.
A fresh ordinary install opens Home → sign-in → Browser → a decoded WebRTC page. Navigate, type, scroll, click, reload and Close work. The committed profile survives reopen and an update. Runtime runs as the user; unavailable virtualization has a plain explanation.
The 0.8.0 Engine is one Linux guest recipe: Chromium, Selkies and the network wrapper run in a per-launch VM. One ARM64 image serves Mac Apple Virtualization and Jetson crosvm/KVM. Hosts without a qualified local Engine keep Browser hidden; Intel Macs stay hidden. Remote Engine delivery remains with #291. The host-native Linux Chromium/network-namespace launch path is retired; Playwright remains test-only. Linux x86 gets the same VM through #349. Runtime owns admission and lifecycle, Engine owns execution and website TLS, Exit owns approved destination streams, and Carrier carries off-device traffic.
Current scope and evidence
This issue owns the Mac signed install, launch, media/input, Close/reopen and profile-through-update journey, including the progress check carried from closed #288. The 2.0.0 publication check installed the release on Mac and excluded Home start, Browser and passkey. Run the complete journey on the selected signed Mac candidate. Reuse the accepted #131 lifecycle proof where its candidate bindings match. Reproduce #477 on the current source-Home path separately from signed release acceptance. #457 owns the visible Close/latency proof; PR #526 is a separate exact-cleanup fix. #482 owns current input ownership and lost-channel follow-up proof. Retain required human UX, media and Wallet gates.
#90 owns current Jetson state and source-Home evidence. #283 owns the cross-platform order. The earlier alpha.15 procedure below is historical test input; bind a new receipt to the selected signed candidate and current supported commands before using it.
Prepared published-release journey
Use a fresh isolated Home/data root and the stamped installer from https://elastos.elacitylabs.com/install.sh. Capture its SHA-256 and timestamp normal setup output with pipefail. On Mac, accept the run when the signed installed release records and elastos --version resolve to 0.8.0-alpha.15. Record image preparation from “Preparing Browser Engine image” through the ready configuration line, including download/verify/install progress; record total installation time separately. Start the installed binary with elastos home --browser.
The controlled fixture runs on the Engine host at localhost port 61180, which the normal Exit config already permits. Confirm the port is free.
node scripts/lib/browser-journey-fixture.mjs --port 61180Run the measured harness from the prepared candidate recorded in #217:
ELASTOS_BASE_URL="$HOME_ORIGIN" HOME_URL="$HOME_ORIGIN/home/" \
ELASTOS_BROWSER_EXECUTABLE="$VERIFIED_TEST_CHROMIUM" \
HOME_VIRTUAL_AUTH_PROFILE="$AUTH_PROFILE" \
HOME_VIRTUAL_AUTH_PRESERVE_PROFILE=1 HOME_VIRTUAL_AUTH_CLEANUP=0 \
HOME_VIRTUAL_AUTH_SYSTEM=0 HOME_VIRTUAL_AUTH_SHELL_SWITCH=0 \
HOME_VIRTUAL_AUTH_BROWSER=1 HOME_VIRTUAL_AUTH_BROWSER_EMBEDDED_UI_INPUT=1 \
HOME_VIRTUAL_AUTH_BROWSER_CONTROLLED_JOURNEY=1 \
HOME_VIRTUAL_AUTH_BROWSER_CONTROLLED_MEDIA=1 \
HOME_VIRTUAL_AUTH_BROWSER_CONTROLLED_PAGE_RELOAD=1 \
HOME_VIRTUAL_AUTH_BROWSER_REQUIRE_VM_TRANSPORT=1 \
HOME_VIRTUAL_AUTH_BROWSER_FIXTURE_ORIGIN=http://localhost:61180 \
HOME_VIRTUAL_AUTH_BROWSER_FIXTURE_ADMIN_ORIGIN="$FIXTURE_ADMIN_ORIGIN" \
HOME_VIRTUAL_AUTH_BROWSER_PROFILE_MODE="$PHASE" \
HOME_VIRTUAL_AUTH_BROWSER_PROFILE_MARKER="$MARKER" \
node scripts/home-passkey-virtual-auth-smoke.mjs >"$JOURNEY_JSON" 2>"$JOURNEY_LOG"Mac also sets HOME_VIRTUAL_AUTH_BROWSER_REQUIRE_VZ_TRANSPORT=1. Keep scrolling enabled and the profile reset disabled. Run PHASE=write, then read after the exact UI Close, then read after an actual newer published update through elastos update or System. Keep the Home principal/data, origins, marker and viewer authenticator profile throughout. browserJourneyProfilePair compares each read with the original committed write. A same-version update check leaves the update gate pending.
Each run records image install time, Home Browser click → first presented frame, the separate controlled-page time, navigate/type/click/scroll, actual toolbar page Reload, controlled media, Close cleanup and profile evidence. Bind the receipt to installed Runtime/helper hashes, signed release/components and admitted image input identity. Save fixture receipts before their ten-minute expiry and capture matching human screen/UX evidence. The first-frame clock proves WebRTC presentation; human evidence confirms the visible website. Stop each owned Home, fixture and viewer after its run. All B01–B16 and physical media/manual/soak gates remain unchanged.
Exact fresh-install and update commands
Choose a stable private proof directory in BROWSER_PROOF_ROOT. Set BROWSER_WANT=0.8.0-alpha.15. Run the following in bash on the target. BROWSER_TEST_HOME stays the same through reopen and update.
set -euo pipefail
umask 077
: "${BROWSER_PROOF_ROOT:?Set a stable private proof directory}"
: "${BROWSER_WANT:?Set the exact published candidate}"
BROWSER_TEST_HOME="$BROWSER_PROOF_ROOT/fresh-home"
test ! -e "$BROWSER_TEST_HOME"
mkdir -p "$BROWSER_TEST_HOME"
curl -fsS --max-time 30 https://elastos.elacitylabs.com/release-head.json > "$BROWSER_PROOF_ROOT/release-head.json"
python3 -c 'import json,sys; assert json.load(open(sys.argv[1]))["payload"]["version"] == sys.argv[2]' "$BROWSER_PROOF_ROOT/release-head.json" "$BROWSER_WANT"
curl -fsS --max-time 30 https://elastos.elacitylabs.com/install.sh > "$BROWSER_PROOF_ROOT/install.sh"
python3 -c 'import hashlib,sys; print(hashlib.sha256(open(sys.argv[1],"rb").read()).hexdigest())' "$BROWSER_PROOF_ROOT/install.sh" > "$BROWSER_PROOF_ROOT/install.sha256"
date -u +%s > "$BROWSER_PROOF_ROOT/install-start-seconds"
env HOME="$BROWSER_TEST_HOME" XDG_DATA_HOME="$BROWSER_TEST_HOME/.local/share" XDG_CONFIG_HOME="$BROWSER_TEST_HOME/.config" \
bash "$BROWSER_PROOF_ROOT/install.sh" 2>&1 | \
python3 -u -c 'import sys,time
for line in sys.stdin: print(f"{time.time():.3f} {line.rstrip()}", flush=True)' | \
tee "$BROWSER_PROOF_ROOT/install-timed.log"
date -u +%s > "$BROWSER_PROOF_ROOT/install-end-seconds"
BROWSER_INSTALLED="$BROWSER_TEST_HOME/.local/bin/elastos"
env HOME="$BROWSER_TEST_HOME" XDG_DATA_HOME="$BROWSER_TEST_HOME/.local/share" "$BROWSER_INSTALLED" --version | tee "$BROWSER_PROOF_ROOT/installed-version.txt"
grep -F "$BROWSER_WANT" "$BROWSER_PROOF_ROOT/installed-version.txt"
env HOME="$BROWSER_TEST_HOME" XDG_DATA_HOME="$BROWSER_TEST_HOME/.local/share" "$BROWSER_INSTALLED" home --browser > "$BROWSER_PROOF_ROOT/home.log" 2>&1 &
BROWSER_HOME_LAUNCH_PID=$!
env HOME="$BROWSER_TEST_HOME" XDG_DATA_HOME="$BROWSER_TEST_HOME/.local/share" "$BROWSER_INSTALLED" home --statusRecord the normal install's elapsed time separately from the timestamped “Preparing Browser Engine image” to ready interval. Keep the signed release/components and installed file hashes with the result.
Mac's local run uses HOME_ORIGIN=http://localhost:$HOME_PORT, FIXTURE_ADMIN_ORIGIN=http://localhost:61180 and HOME_VIRTUAL_AUTH_BROWSER_REQUIRE_VZ_TRANSPORT=1. Use the controlled-journey command above for PHASE=write and then read, with one marker and authenticator profile. Keep the same origins through all phases.
After OMP publishes a genuinely newer candidate, run the real update on that same target Home, then the read journey again:
env HOME="$BROWSER_TEST_HOME" XDG_DATA_HOME="$BROWSER_TEST_HOME/.local/share" "$BROWSER_INSTALLED" update 2>&1 | tee "$BROWSER_PROOF_ROOT/update.log"
env HOME="$BROWSER_TEST_HOME" XDG_DATA_HOME="$BROWSER_TEST_HOME/.local/share" "$BROWSER_INSTALLED" --version | tee "$BROWSER_PROOF_ROOT/updated-version.txt"
env HOME="$BROWSER_TEST_HOME" XDG_DATA_HOME="$BROWSER_TEST_HOME/.local/share" "$BROWSER_INSTALLED" home --browser > "$BROWSER_PROOF_ROOT/home-after-update.log" 2>&1 &
BROWSER_HOME_UPDATE_LAUNCH_PID=$!A successful same-version check leaves profile-through-update pending. Capture first failure before another run; keep any existing installed Home and other test owners outside this fixture. Stop each fixture-owned Home, viewer and server when its run ends.
Remaining for 0.8.0
Decision (11 Oct): alpha.15 ships Browser on Apple Silicon Macs only. Installed Linux runs found five Linux defects (Runtime refuses the Linux launcher's display receipt, KVM probe, guest raster size, udev rule order, crosvm filter); their fixes and Linux x86-64 are on the Browser lane's branch for the next release (feat/217-browser-amd64, passes an installed x86 journey). On Linux, alpha.15 hides Browser and removes earlier Browser host files; no sudo prompt.
Single Browser list; #90, #131, #165 and #288 link here.
- Moved to 0.8.1 with G5 Private Browser: Jetson support #90: Anders runs the Jetson one-time setup (command in Wrap third-party software as capsules served over Carrier; never download from other servers #217).
- Browser stays hidden on Intel Macs and on Linux ARM64 until G5 Private Browser: Jetson support #90 passes. Proof: https://github.com/Elacity/elastos-runtime/blob/aa3d61e4478a1a1a63dbef0dae97c23a0f9f4851/elastos/CHANGELOG.md#L31 and https://github.com/Elacity/elastos-runtime/blob/aa3d61e4478a1a1a63dbef0dae97c23a0f9f4851/components.json#L1396 (no Intel Mac image)
- Release staging: the publisher serves the image file under its CID name, and release-package.yml has repository variables BROWSER_IMAGE_PUBLISHER_DID and BROWSER_IMAGE_PUBLISHER_NODE_ID and secret BROWSER_IMAGE_CONNECT_TICKET. Proof: https://github.com/Elacity/elastos-runtime/actions/runs/38241639459 (alpha.15 package used all three and image QmPAyAFZ…Go1P; the seed publisher serves
artifacts/QmPAyAFZ85hQzocVJbzqyTcnKBWfJfNeKady3YtrJ8Go1P, 908283362 bytes, checked 13 Oct)
Existing Linux ARM64 hosts rerun the one-time host setup after updating.
Any Linux ARM64 host downloads the image, but only Jetson is tested.
The four review fixes in #307 (TURN peers, firewall rule, TCP relay off, credentials, pool) are covered only by unit tests until the fresh Mac and Jetson journeys pass.
Done means
- Fresh ordinary installation supplies the admitted image, matching helpers, dependencies and Runtime configuration. Test (Apple Silicon Mac only in 0.8.0; Linux x86 is Browser on Linux x86: restore the qualified VM Engine with private boot input and expiring TURN credentials (#217) #349, Jetson G5 Private Browser: Jetson support #90): fresh install with the commands in this issue, then the measured harness with PHASE=write, Close, then PHASE=read. Re-check on the candidate (see 0.8.0: Release 0.8.0 #93). Earlier proof (alpha.19 fresh install, Browser opens first try): G5 Private Browser: Browser on Apple Silicon Mac #87 (comment)
- Home sign-in → Browser → decoded page → navigate/type/scroll/click/reload → Close/reopen passes on the exact release candidate. Test (Apple Silicon Mac only in 0.8.0; Linux x86 is Browser on Linux x86: restore the qualified VM Engine with private boot input and expiring TURN credentials (#217) #349, Jetson G5 Private Browser: Jetson support #90): fresh install with the commands in this issue, then the measured harness with PHASE=write, Close, then PHASE=read.
- Committed profile state survives a normal release update and reopen. Test (Mac): update the same Home to the next release, then run PHASE=read.
- Runtime and launched helpers operate as the user; unavailable virtualization gives a plain explanation. Test (Mac): Runtime and its VZ helpers run as the user, and still work with sudo removed from PATH.
- Setup or first launch reports streamed progress; 30 s without data is a recoverable error. Test (Mac): watch the fresh-install output (from Browser: prepare the selected local Engine during normal installation and repair #288).
- Required independent and human review and OMP integration/publication are complete.
Owner: @andersalm. Wallet and broader daily media/reconnect/human qualification moved to #283/#293. Fractional wheel, clipboard, CDP-ACK, IME and guest behavior changes stay with #283. The shared ARM64 image delivery is the present #217 release gate. Prior complete record.
One lead (Codex) and at most one read-only reviewer. Fast local checks per change, one CI run per coherent batch, failed-job reruns only. OMP integrates the reviewed branch, performs cross-family review and publishes the release. Runtime owns signed artifact admission, configuration and lifecycle; Engine owns website execution and rendering; Exit owns authorized website networking; Carrier carries delivery below Runtime authority.
Activity
andersalm commentedon Sep 29, 2026
Retained Browser regression input from the earlier reviews:
Test incomplete installation, sustained horizontal and vertical scrolling, text composition, temporary connection loss, background/sleep recovery and profile separation. Each Home owns its Browser controls and profile. Where recovery is supported, it returns to the same page. Restart cleanup must settle the exact retained session through the product path and prove its resources are gone.
Record cold and warm startup, first usable frame, input delay, media continuity and retained resources against the current Browser objective and human checks. Older proposed timing targets and failed probes are historical, not current acceptance results.
andersalm commentedon Sep 29, 2026
QA tip retest on
feat/0.7.1-models@b1a22a6e(2026-09-29) — still broken; filed under Browser Done means (child processes / capsule):browser-vm-control-service(Notion QA-48)Evidence:
/workspace/elastos-qa/github-reset-20260929/retest-models/RETEST.mdandersalm commentedon Sep 30, 2026
The operator-selected saved fix
17204951is next: Services explains the owner's Share and Inbox approval steps for a private Browser Engine request.Use approved base/target
feat/0.7.1-models@ea670e27; bring in code and tests only, leaving the embeddedTASKS.mdandstate.mdnotes on the historical branch.This is request-flow preparation. Installed Browser media, Wallet, cleanup and human acceptance remain open under this issue's Done means.
Next: apply the small pick, test signed private-engine request handling, and review the approval boundary.
andersalm commentedon Sep 30, 2026
The saved private Browser Engine request fix applied as a five-file code/test concern on
ea670e27.The embedded historical
TASKS.mdandstate.mdchanges were removed before commit; the base notes remain intact.Next: focused signed-request/approval tests, Services UI smoke gates, and independent approval-boundary review.
Installed Browser/Wallet acceptance remains open.
andersalm commentedon Sep 30, 2026
Candidate
33977482passes the four basic gates, Browser entropy, and Services JavaScript syntax checks.The five-file pick keeps sharing and Inbox approval as the Engine activation gates; the private request remains visible with a recovery instruction.
Focused approval tests and the existing Services UI smoke are running; the smoke reuses the installed Playwright/Brave tools.
Next: inspect the UI results and resolve any independent approval-boundary findings before draft publication.
andersalm commentedon Sep 30, 2026
At
33977482, private-engine request recovery, Inbox copy, scoped signed Engine grant tests and the Services UI smoke pass; desktop/narrow captures were inspected.Authority review found the older empty-mailbox assertion in this branch. The already-reviewed #145 correction is now cherry-picked as separate commit
fad9a21e.PR #146 / #145 is an integration dependency; the request-flow candidate retains its signature/contact/revocation checks.
Next: verify the mailbox test and basic gates at
fad9a21e, then publish a draft. Installed Browser media/Wallet/human acceptance stays open.andersalm commentedon Sep 30, 2026
Candidate
fad9a21efcd0769ff1954638146f84879dd77391now passes the combined mailbox authority test and all four basic gates.The three Engine request/copy/scoped-grant tests and Services desktop/narrow UI smoke passed before the test-only correction; the UI/product files are unchanged.
Independent approval-boundary review passes the complete diff, SHA-256
3ad18e7293d6ed753772789c91254e4bda7dd6b2bc8209ca8e607f8c2957f565.Against
origin/feat/0.7.1-models@ea670e27, this is 0 behind / 2 ahead; five code/test files change (219 added, 25 removed lines), with historical notes unchanged.Next: publish
fix/0.7.1-private-engine-requesttooriginas a draft PR. #145 / PR #146 integration, installed acceptance and human review remain open.andersalm commentedon Sep 30, 2026
Published
fad9a21etoorigin/fix/0.7.1-private-engine-request; draft PR #147 targetsfeat/0.7.1-models.The worktree is clean and matches its remote (0 behind / 0 ahead); source/UI checks and independent security review pass.
#145 integration, installed acceptance, candidate CI and required human reviews remain open. Review requests wait until the PR is ready.
Next: continue the LA-03 bounded socket diagnosis, then the saved hosted End/send fix under #85.
andersalm commentedon Sep 30, 2026
PR #147 at fad9a21: CI run 36759295343 failed in the unchanged prepare-release-platform-test.py cleanup, with Directory not empty: objects; later jobs were skipped.
Source authority/UI checks and security review remain passing. The test passed on the other three saved-fix candidates, but this CI result is failed.
Next: rerun the failed CI attempt once without changing source; continue #85 while CI runs. Installed acceptance and dependency PR #146 remain open.
andersalm commentedon Sep 30, 2026
PR #147 at fad9a21 now has all eight required CI checks passing after run 36759295343 attempt 2; the earlier cleanup error remains a failed first attempt.
Source authority/UI checks and independent security review are accepted. The draft remains open for installed request/Browser/Wallet journeys and human acceptance.
Integration still depends on PR #146; source and task remote remain unchanged at 0/0.
[-]0.7.1: Browser and Wallet on Mac[/-][+]0.8.0: Browser and Wallet on Mac[/+]andersalm commentedon Sep 30, 2026
Published normal
develop@938a5926merge26a891c7cc1f0fa9e8b2453e395621ef16e2bb16, tree8930d3437a6dd323679c797dda5bb0f16981c635, toorigin/fix/0.7.1-private-engine-requestfor PR #147.The task diff is byte-identical to the accepted independent security review, SHA-256
3ad18e7293d6ed753772789c91254e4bda7dd6b2bc8209ca8e607f8c2957f565. The focused authority/UI proof and inspected desktop/narrow captures remain evidence for unchanged source.All four basic gates and Browser entropy pass; the checkout is clean and remote divergence is 0/0.
Anders explicitly approved integration of #147 into
developon passing current checks plus one independent agent review. That direction governs this PR; its dependency #146 integrates first.Current-candidate CI and #146 integration remain open. Full installed Browser/Wallet and human product acceptance stay with #87, which remains open after this task PR. Next: complete #146's integration gate.
andersalm commentedon Sep 30, 2026
PR #147 is now ready at
26a891c7cc1f0fa9e8b2453e395621ef16e2bb16for the integration path Anders explicitly approved: passing current checks, one qualified independent review and dependency #146 integrated first.The accepted task-diff review remains exact; current CI is pending. Product journey and screen acceptance remain in this open issue.
All five saved task checkouts are clean and even with their remotes; their existing private lifecycle ledgers now bind the published candidates. The lane started no heavy Mac build and keeps the 10% disk reserve.
26 remaining items
andersalm commentedon Oct 16, 2026
Remaining for 0.8.0 (15 Oct 22:45 COT; final candidate alpha.21 = alpha.20 + automatic Community recovery; plan #93 6207232773): on installed alpha.21 Mac: the Browser profile is kept after the System update. Owner: the Done means still name Jetson, which moved to 0.8.1 (#90, #349); please reword those boxes to Mac only so they can be ticked honestly.
changelog: 0.8.0 notes match what a new user gets: phone layout reach…
andersalm commentedon Oct 16, 2026
Done means reworded to Apple Silicon Mac only: Browser ships on Apple Silicon Macs only in 0.8.0 (decision 12 Oct in this issue). Linux x86 is #349 and Jetson #90, both After 0.8.0. No boxes ticked.
[-]G5 Private Browser: Browser on Mac and Jetson[/-][+]G5 Private Browser: Browser on Apple Silicon Mac[/+]andersalm commentedon Oct 19, 2026
Retitled from "Browser on Mac and Jetson" and marked the Jetson checkpoint outdated, per the 12 Oct decision (#87 (comment)). Jetson stays in #90 (After 0.8.0). Browser close time is now #457.
andersalm commentedon Oct 22, 2026
Text selection in the Browser (finding, 22 Oct). Anders reports that he cannot select and copy text in Browser. OMP's source investigation uses the train head
26f7c7589; which Home served his session is still open.Cause, from a source reading (nothing was run): the Browser window sends a mouse press and release to the page as one click and never as a held-button move (
capsules/browser/browser/browser-input-surface.jslines 236-254 at26f7c7589), and the Runtime click route always sends a click count of 1 (scripts/browser-selkies-control-service.mjslines 5470 and 5480). The window sends no Cmd, Ctrl or Alt shortcut other than C and V to the page (lines 364-366), so Cmd+A does not reach it, and it does not send Shift, so Shift+Arrow cannot select either. Copy works when the page has a selection: Cmd+C copies in the page, and Home asks before it writes the Mac clipboard. The three input files (browser-input-surface.js,browser-input.js,browser-clipboard.js) are identical in alpha.24 (3beb81643) and26f7c7589(git diffis empty), so the gap exists since at least alpha.24. The copy test uses a fake page clipboard, and no test makes a selection.Disposition for 0.8.0 (OMP decision, 22 Oct): the Browser window sends a mouse drag to the page as held-button moves over the data channel, and sends Cmd/Ctrl+A as select-all. The change is in the Browser window code only, and the Browser image stays the same. The change went through three local commits on
fix/080-browser-text-select(base26f7c7589):8c0cdbf23adds the drag and select-all;6efbae970andf72ec5d1emake input that goes through the Runtime route, such as typed text, wait until earlier data-channel input has drained, and make the window send the button release whenever a drag ends. Codex review failed on8c0cdbf23and6efbae970and passed onf72ec5d1e. The three commits are on the local release trainrelease/train-0.8.0-rc10as35b4833bb,65d9899f7and460b1888d, with the same patches. Unit tests cover the input order and the release, and a smoke runs the window code in real Chromium with a stand-in data channel. The final-head checks and Anders's check on the test Home rebuilt from the integrated train head remain: drag over text and Cmd+A select it; in a text field, a word selected by drag is replaced by the text typed right after; and Cmd+C with the Home approval puts the text on the Mac clipboard. The smoke does not reach the page inside the VM or the Mac clipboard, so that check is the proof for this journey. The release-candidate check for the second Done means box in this issue adds the same step.After 0.8.0, in #283, which already holds the clipboard and guest input work: double-click to select a word, right-click Copy, and Shift+Arrow selection. A click count for double-click on the Runtime click route changes guest and Runtime code; a data-channel route for it is not checked yet.
andersalm commentedon Oct 22, 2026
The 22 October audit reproduced two input lifecycle gaps in the latest local candidate
460b1888d: an active drag can cross page ownership, and channel disconnect can satisfy the input drain barrier. #482 holds the source fixture results and acceptance; two reviewers repeated them. Coordinate with #421/#439 without counting their earlier tests as coverage for these new transitions. The full behaviour suite passed 1,819 tests; installed Browser media and input acceptance remains separate.andersalm commentedon Oct 22, 2026
Source test Home check (22 Oct, Anders, Mac): on a source Home built from the 0.8.0 train at
05da461c2(Chromium 155 image):This is not an installed release; the installed check on the signed candidate stays open.
andersalm commentedon Oct 22, 2026
SHR-041 disposition for alpha.25 acceptance (#194 comment 6348034894). Until the Browser proof producer and the acceptance validators use the same media contract, those validators are not used as acceptance evidence for #87.
andersalm commentedon Oct 31, 2026
Browser continuity has a passing diagnostic trial and bounded human observations. Main owns VZ implementation and integrated qualification; Root owns independent review.
Root read Anders's originating reports on 1 November: Browser stayed open, and a Documents link opened in the ElastOS Browser. The owner identifies those observations with earlier mixed staging, so current-package hash parity and full journey acceptance remain open. Chat testing in that exchange was outside Community in the isolated fixture. The reported startup improvement remains an author measurement with its own evidence limits.
Latest completed trials: the instrumented lazy-relay variant passed its 660.5-second workload and normal Close. A separate clean, media-only candidate then passed a 660.2-second workload, exited 0 at 664.8 seconds after Close returned 200 and hid the window, and recorded 11/11 navigation checks, 11/11 trusted-click checks, resize and 19,119 decoded frames. Independent raw review confirms that bounded result. The tested d1b commit and 638 have the same source tree; their cumulative input also contains the parent FFI close-after-dup change. Independent source review found no implementation blocker in the media wait, EOF/error, shutdown or descriptor ownership paths. Root has now checked local integration snapshot
28069cc32: it contains both parent changes, and all 64 tracked native-input objects match 638. The source-combination constraint is resolved in that local snapshot. Compiler settings, built/installed hashes and journeys on the integrated Runtime still need their own evidence. Source comments about descriptor exhaustion retain an inference limit. Saved FD values remain row counts; the named full-dump path was unavailable. The resource receipts also omitted their recorded 6 GiB peak from the entry sum, although observed floor and reserves stayed intact. Main has these exact-input and resource findings. Final integrated checks, longer continuity and the accepted Browser journeys remain open.Retained failed candidate: Main's explicit-close candidate still failed both Mac sessions. The completed result records Virtualization failures at 485.031 and 489.134seconds of the reported XPC generations, despite 9/9 navigation checks, 8/8 trusted-click checks and resize in each session. Close returned 200 and hid the first window; the second Close had no HTTP reply and the window stayed visible. Root read the completed result through independent raw review. Independent raw review matched both IPS responsible PIDs and process births to the tested native generations. Both native paths matched the sealed candidate hash at binding; the compilation link remains saved author evidence. The broader live responsibility rule has a narrower ownership scope than these post-run IPS matches. This result rules out shipping this candidate as the demonstrated crash repair. Open-file row growth remains an observation; numeric descriptors and the cause need separate evidence. Main retains VZ ownership for the next diagnostic.
Native comparison. Root provided the reviewed close-after-dup candidate and the source-bound original supervisor. The original locked release build passed in 2m13s, with exact 64inputs and all owned children reaped. Its raw SHA-256 is
ffd3751ab184c5e224213cac0926c9da6b753f601e68c296cbd571ba5d19ddc2. Three POSIX descriptor cases passed; The later Mac trials show that duplicate I/O works after the Apple close, while the crash remains. The earlier trace failed 485.495seconds after launcher start. Accepted-session ordinals near 1,024, shared web/media labels and unseen pending Apple calls support hypotheses, rather than a proven cause.Inputs and method. Main completed read-only image qualification: all 4,414,914,012bytes across rootfs, initrd and kernel matched their expected hashes and current eight-field identities. Root read the receipt and checked those identities again. This proves image inputs. Its serialized before/after VM and open-file observations are separate from the continuous guard required during a guest run. The first three admission failures remain retained: the initial reason was hidden, the second exposed a signed-UID parser error, and the third stopped after a concurrent observer exceeded its deadline. Zero complete parts were admitted by those attempts.
The private native method now has bounded source review. Held staging and current canonical receipts, child ownership, durable passkey state, Open admission, foreground Gateway startup and owned listeners have corrected source paths. Isolated source-method and synthetic cases passed. Main received the code and owns adoption, exact installed/executed hashes, retained fixture state, the lease and one-VM execution. The planned original-first comparison was superseded by Main's separate candidate trials; the failed result stands on those actual inputs. Intended comparison inputs remain Runtime 530, host/UI 71e, image 689, 128 web/16 media and the existing measurement identity. Main must record the inputs it actually runs.
Retained product limits. Earlier bounded resize and Close evidence belongs to its recorded628/92d/image 689 inputs. Current broad train changes need their own qualification. Three Close status 500 responses remain unexplained; batch-three input failures, batch-four aborts/timeouts and auth partials stay retained. Strict portrait outerWidth 500 still failed. Complete resize/decode/four-corner behavior, media and input, continuity/reconnect, Close/reopen and orphan cleanup, AI/Wallet flows, objective media, matching manual UX and stable human acceptance remain open. These records establish neither comparative speed-up nor 8MP/negotiated-codec support.
Window scope. Anders accepted one Browser window at a time; several windows or tabs move later. Sequential navigation, Close/reopen, media, continuity and recovery retain their accepted checks.
Root's separate Home CLI slice has native and installed Mac fixture proof in#368. Its own authentication attempts remain failed overall despite fresh authentication 200 responses and durable returned state; they launched zero guests. Namespace access is restored. Root supplied a separate exact-e417 installer port. Two private remote attempts produced no usable functional verdict and are now frozen; Main owns qualification of the integrated candidate through existing checks and device fixtures. The 38-input Home CLI producer keeps its own evidence and scope. The complete release acceptance remains open, including required human review and signing by Anders.
andersalm commentedon Oct 31, 2026
Free resize test Home for Anders, 31 October (Main OMP; Codex Root granted the Browser window).
andersalm commentedon Oct 31, 2026
Anders's feedback on the free resize test Home (31 October, 17:08 UTC): resizing works well; he asked how close Browser is on the Jetson and how to cut the roughly 30 s open time on his Mac.
andersalm commentedon Nov 1, 2026
Browser free resize and open time for rc.2, 1 November (Main OMP). Integration branch integ/2.0-rc2 at 628d84a (local, not pushed) with a new Browser image built from 84680c4 on a local Linux VM: archive sha256 6894608add893a9b5791da9cd141ab9ce756f3d6d16e710c114373384e4bcb66, 910,822,094 bytes, CID Qmcqwe2TfBPCsjNaFfQbh8njPNgea2bDKa5NsU1S7TdX7n; admission checks pass for linux-arm64 and darwin-arm64; the guest control module equals the source. Not published yet.
andersalm commentedon Nov 1, 2026
Scope decision for 2.0.0 (Anders, 2026-11-01T07:44:15.931Z): one Browser window at a time is accepted for 2.0.0; several windows or tabs move to a later release. Mac Browser allows one live page per user (one profile disk, one VM; ELASTOS_BROWSER_VM_CONTROL_MAX_ACTIVE_PAGES 1). The rc.2 candidate (integ 71e237f, reviewed) makes a second open bring the existing Browser window to the front and open the requested link there, shows Show/Open Browser instead of New Window, and replaces the vague refusal with "Only one Browser window can be open at a time. Close the other one first." Separate stable blocker, existing in rc.1: Apple's Virtualization process crashes about 485 s after a Browser VM starts (8 crash reports since 29 October), so a Browser left open goes blank after about 8 minutes; owner Codex Root (elastos-vz supervisor), cause not yet proven.
andersalm commentedon Nov 1, 2026
Mac Browser closing after about 8 minutes: cause found and fixed on a candidate branch (1 November, Main OMP).