Add the built-in Computer workload plugin

[kachofugetsu09]

Outcome

Akashic now ships Computer as a built-in ordinary plugin. Enabling its exact plugin generation starts one persistent Linux desktop with Chromium and OpenCLI; disabling or uninstalling that generation stops the workload and removes its Tool, Skill, and Chat UI while keeping plugin data and login state.

The Chat surface is no longer a screenshot viewer. Its upper-right tool entry opens a generic, resizable, multi-tab right pane backed by a real noVNC client, so a person can use the same Computer that the Agent is operating.

Architecture

• add the generic v3 WORKLOADS composition service and WorkloadPort endpoint binding
• keep Docker access in a separate non-root Workload Controller over an authenticated Unix socket; Core never receives docker.sock
• bind workload start, health, endpoints, leases, stop receipts, adopt, rollback, and cleanup to the exact plugin generation
• package one Xvnc desktop, Chromium profile, OpenCLI daemon, structured Browser gateway, visual Computer input, and RFB bridge in the built-in Computer image
• keep OpenCLI as a dynamically loaded Skill used through the ordinary shell; it is not a Browser tool
• add conversation.tools.v1 as the generic Chat list slot; Computer owns only its tab content, while conversation-ui owns open/close, active tab, width, notice handling, keyboard behavior, and narrow-screen layout
• pin the final Computer image by digest: sha256:6fd3c605380a3daef5ddebb34f2905ee992d2b4e1490fbfb78dcce9f06a3dadb

Product acceptance

• real noVNC input passed: pointer move, left/double/right/middle click, drag, wheel, Enter, continuous typing, two-way clipboard, and in-window navigation
• Agent structured Browser, Agent visual input, and human noVNC input changed the same Chromium/display/profile; a handoff ended with the exact DOM value Agent started here | Human took over
• Browser snapshot refs survive separate MCP adapter processes while remaining document-bound; fill now replaces selected text instead of appending
• the live pane updates after every Agent action, auto-opens for a new activity notice, respects a user close until another new request, and reconnects after immediate or 31.5-second close/reopen cycles
• fullscreen occupied 1920×1080; keyboard resizing, pointer dragging, stored width, focus/close behavior, and a 900px full-width narrow layout without horizontal overflow passed
• OpenCLI GitHub auth reported logged_in=true; real refresh, workload replacement, and restart retained the session; the daemon remained loopback-only on 127.0.0.1:19825
• a real model turn dynamically loaded browser_action and browser_observe, navigated to Example Domain, read its title, and returned 标题是 Example Domain。; the Computer pane opened from the live tool activity

Security and lifecycle

• the Computer runs as 1000:1000, with cap-drop=ALL, NoNewPrivs=1, CapEff=0, seccomp filtering, a 2 GiB memory limit, and 512 PID limit
• Chromium does not use --no-sandbox; its renderer runs in a user namespace different from container PID 1
• candidate/formal data, ports, identity, and publication remain separate; Docker-normalized mounts are checked before adopt
• lost responses, cancellation, controller restart, Core restart, stop receipts, strong remove proof, and built-in generation recovery remain explicit and retryable
• real disable/uninstall/re-enable and Core restart/adopt tests stopped and restored capabilities without changing the Computer data checksum

Verification

• targeted final suite: 209 passed
• Computer Web module tests: 3 passed
• desktop navigation tests: 46 passed
• TypeScript typecheck and production build: passed
• exact-HEAD full Change Gate: 27/27 public scenarios passed, zero residual containers/networks/volumes; report 20260831-153346-db2c5299
• full repository CI on the preceding code-identical runtime commit: 3392 passed, 6 skipped; exact final HEAD CI is linked in this PR
• Computer image workflow: run 33365143243
• final architecture/product review: PASS; P0/P1/P2 = 0
• final entropy review: PASS; no P0/P1 simplification preserves the same lifecycle, sandbox, VNC, and generation contracts

Cross-repository handoff

Merge this PR first, then merge akashic-plugins/huayue-skills#6. That PR removes the previous OpenCLI Skill owner. The isolated final deployment already projected workspace/skills/opencli from the built-in Computer plugin, with no duplicate owner.

Recovery points

Implementation stayed in an isolated worktree. Named backup branches were created before each persistent repair and before final contract evidence. The complete CloakBrowser profile recovery point remains /home/huashen/.backups/cloakbrowser-pre-computer-e2e-20260831-0336-full; no formal workspace or production service was changed.