[irzhywau]

Note

This is part of a stacked PR chain — review only the commits of this checkpoint; earlier work is in the PRs below it in the stack.

Stack (top → bottom)

• feat(protected-content): runtime lifecycle — mint, buy, play, purchase closeout #36 feat/protected-content-runtime-lifecycle
• feat(protected-content): chain rights evidence and typed decisions #35 feat/protected-content-rights
• feat(protected-content): Runtime release authority and persisted state #34 feat/protected-content-runtime
• feat(protected-content): sign rights requests with Wallet #33 feat/protected-content-wallet-rights
• feat(protected-content): custody provider protocol and process #32 feat/protected-content-custody-provider
• feat(protected-content): bridge authenticated release reconstruction #31 feat/protected-content-key-reconstruction
• feat(protected-content): threshold custody envelopes and key reconstruction #30 feat/protected-content-custody
• feat(protected-content): canonical content identities, rights grants, release contracts #29 feat/protected-content-contracts
• ➡️ feat(collaboration): Profile/Chat product UI and Home window chrome #28 review/collaboration-product-integration (this PR)
• feat(collaboration): signed network protocol, Carrier transport, Profile authority #27 review/collaboration-foundation
• main

Base: review/collaboration-foundation ← Head: review/collaboration-product-integration (checkpoint 2 of 10)

Commits

• ed18b2c build(collaboration): package Profile products
• 4c02acf feat(people): add Profile contact experience
• bf7e145 feat(chat): add direct and shared conversation UI
• d436be6 feat(home): add canonical window chrome modes
• e9179a6 feat(ui): align first-party apps with Home chrome
• b3aa676 feat(home): finish shell visuals and assets
• 36890a6 fix(setup): provision explicit collaboration mode
• 0335356 fix(browser): hide Carrier endpoint identity

[irzhywau]

Three commits were added on top of 03353569 to make this checkpoint self-consistent and verifiable on its own:

• 20f6663a — cherry-pick of e891392f ("docs(collaboration): record candidate truth and acceptance"). This branch's own entropy check (rewritten in bf7e1458) asserts the AGENTS.md 0.6.0 / upstream/0.7-dev truth text, but the commit that updates AGENTS.md sat above this checkpoint in the lineage — the gate could never pass here without it.
• 70162314 — cherry-pick of c12c45f8 ("test(collaboration): add deterministic product acceptance"). Same situation for the smoke module-graph pins (home-20260725a → home-20260802a), and it also carries the justfile/CI wiring that scripts/vendor-ui-tokens.sh and this PR's own new smokes reference (just vendor-ui --check did not exist at 03353569). Extended with the same gitignored-local-docs walker exclusions applied on review/collaboration-foundation.
• e197136c — merge of the updated review/collaboration-foundation (which now carries the retirement packaging + CI fixes from checkpoint 1), so this PR's diff collapses back to its own increment. Merge chosen over rebase to keep the published history append-only; the one conflict (scripts/home-entropy-check.mjs) resolves to this branch's rewritten version.

Verified locally at the tip (this PR gets no GitHub CI since it does not target main): check-wci-alignment.sh, home/browser entropy checks, close-handshake test, vendor-ui --check, the new "product UI source proofs" (home-shell-regression-smoke, people-discovery-smoke), setup-source-home-collaboration-config-smoke.sh, cargo fmt --check, cargo clippy --workspace --all-targets with -D warnings, cargo test --workspace (1927 passed; the only 2 failures are the known macOS mDNS-environment room::direct readiness tests, green on ubuntu).

Review observations for the chain owner (no code changed for these):

1. gateway_room.rs:1240,1263 — unverified-sender attribution moved from server-side blanking to client-side filtering (filter_configured_shared_poll); the old "no device-hash name reaches the product" invariant was narrowed per the renamed presence test. Flagging for a conscious ack.
2. fix(browser): hide Carrier endpoint identity largely removes already-dead client code (the base branch's scrub_exit_authority_fields strips peer_did/tickets server-side); exit.id/grant_id still render in option text and tooltips.
3. setup-source-home.sh collaboration-config install re-reads the input file well after verifying it (verify→install TOCTOU); verifying the staged temp file instead would close it. The mode provisioning itself audits fail-closed in every branch.
4. people.js:465,546 call window.top.postMessage(…, homeParentOrigin) without the guard announceReady has — a launch without ?home_origin= throws instead of degrading.