Cowork: second landing (inert; nothing creatable or runnable)

.github/workflows/ci.yml

@@ -398,6 +398,16 @@ jobs:
       - name: verify:runtime-state
         run: bun run verify:runtime-state
 
+      # N2 S7B: the Cowork native pair's packaging gate. Builds the real launcher (swift build, scratch path), embeds it with a stand-in worker into a
+      # scratch bundle (ad hoc), accepts it and proves seven refusals. Never runs either binary, never signs with a real identity.
+      - name: verify:cowork-native
+        run: bun run verify:cowork-native
+
+      # N2 S7B: the Cowork channel's receiver thread must start in the COMPILED daemon (a third compile:core entrypoint). Compiles winter-core and runs a temp copy's
+      # probe on a socketpair; touches no home, Keychain, daemon or launcher.
+      - name: verify:fd-receiver
+        run: bun run verify:fd-receiver
+
       # WS-23 (fix round 1, minor 6): the vendored ant, pinned and checksum-verified by fetch-ant
       # itself, so verify:runtimes exercises ant's bundle rung and its record's SHA against the pin
       # rather than skipping them.
@@ -457,7 +467,7 @@ jobs:
           python3 -I -B -c "
           import json
           d = json.load(open('$RUNNER_TEMP/prepare.json'))
-          assert d['fullSourceDiffSha256'] == '3826aa68ee08b23ed046f8ec5a8df7f6271969747364dd63b0bd12f27013ec01', d
+          assert d['fullSourceDiffSha256'] == '7ec7dd847bc09373d02ffe23894ca9f6ddebf2c992f8dbd2f251127823be5f24', d
           print('composed hash ok', d['fullSourceDiffSha256'])"
 
       - name: Guard tests (including the composition test)

.github/workflows/cowork-guest-boot.yml

@@ -1,7 +1,8 @@
 name: Cowork guest boot (N2 S5, unprivileged)
 # Source-only checks of the guest's PID 1, relay and bootstrap helper, and of the artifact scripts and kernel pins.
-# No root, no mount, no loop device, no container, no VM, no package installation, no network. The ext4 tools used are the
-# ones already on the runner, against regular files in a temporary directory.
+# No container, no VM, no package installation, no network. The ext4 tools used are the ones already on the runner, against regular
+# files in a temporary directory. Two steps run as root: the plan view's identity test (it needs to become a tool uid), and SH6's real mounts,
+# each test in a private mount namespace below a temporary directory; this runner has no virtio-fs device, so the live virtio-fs mount is gate G7's.
 on:
   workflow_dispatch:
   pull_request:
@@ -28,6 +29,17 @@ jobs:
         run: python3 -I -S -B -m unittest discover -s apple/Cowork/WinterCoworkGuest/bootstrap -p 'test_*.py' -v
       - name: "Native C modules, relay process, state machine and source hygiene (sanitizers)"
         run: python3 -I -S -B -m unittest discover -s apple/Cowork/WinterCoworkGuest/tests -p 'test_*.py' -v
+      - name: "Plan view identities, as root (a sibling conversation's tool uid is refused for real)"
+        # The one test that changes identity: it makes the plan directories for tool uids 41001 and 41002 and then lists, reads, writes and creates as each of them.
+        # sudo is already on the runner (nothing is installed); the test is marked skipped, not passed, when it is not root.
+        env:
+          WG_REQUIRE_ROOT: "1"
+        run: sudo -E env "PATH=$PATH" python3 -I -S -B -m unittest discover -s apple/Cowork/WinterCoworkGuest/tests -p 'test_filechannel.py' -k sibling -v
+      - name: "Real mounts as root, each in a private mount namespace (SH6: the whole share step on tmpfs, ext4 with dax=never, the refused virtio-fs mount)"
+        # WG_REQUIRE_REALMOUNT=1: a realmount test that cannot run here fails instead of skipping
+        run: |
+          sudo -E env "PATH=$PATH" WG_REQUIRE_REALMOUNT=1 python3 -I -S -B -m unittest discover -s apple/Cowork/WinterCoworkGuest/tests -p 'test_pid1_linux.py' -k realmount -v
+          sudo -E env "PATH=$PATH" WG_REQUIRE_REALMOUNT=1 python3 -I -S -B -m unittest discover -s apple/Cowork/WinterCoworkGuest/tests -p 'test_mutants.py' -k realmount -v
       - name: "Artifact scripts and kernel pins"
         run: |
           python3 -I -S -B -m unittest discover -s scripts/cowork-guest-artifact -p 'test_*.py' -v

.github/workflows/cowork-guest-image-build.yml

@@ -8,12 +8,12 @@ name: cowork-guest-image-build
 # The first steps refuse unless REVIEWED_HEAD is an ancestor of the pushed commit and the whole diff is that one line.
 on:
   push:
-    branches: [cowork/guest-image-build]
+    branches: [cowork/guest-image-build-6]
 permissions:
   contents: read
 env:
   REVIEWED_HEAD: '0000000000000000000000000000000000000000'
-  AGENT_SDK_HEAD: '7e71929d0231be2d77645bfa47ee2b550f3add22'
+  AGENT_SDK_HEAD: 'ec91fe06719d76e99bcdbdae8a6daaf690dfeb50'
   BUILDER_HEAD: '180d3effd7ddbb9406aeea0912f76c78ef20cf75'
   BUN_ARCHIVE_URL: 'https://github.com/oven-sh/bun/releases/download/bun-v1.3.14/bun-linux-aarch64.zip'
   BUN_ARCHIVE_SHA256: 'a27ffb63a8310375836e0d6f668ae17fa8d8d18b88c37c821c65331973a19a3b'
@@ -35,7 +35,7 @@ env:
   LLVM_KEY_SHA256: 'dc0ffd470f01a27a19fad7a243cf85cf79f063d60b3a4c75090b24d9bdc6e2c8'
 jobs:
   build:
-    if: github.repository == 'yanlingLabs/winter' && github.event_name == 'push' && github.ref == 'refs/heads/cowork/guest-image-build' && github.event.created == true && github.run_attempt == '1'
+    if: github.repository == 'yanlingLabs/winter' && github.event_name == 'push' && github.ref == 'refs/heads/cowork/guest-image-build-6' && github.event.created == true && github.run_attempt == '1'
     runs-on: ubuntu-24.04-arm
     timeout-minutes: 210
     steps:
@@ -117,15 +117,17 @@ jobs:
         run: |
           set -euo pipefail
           pnpm install --frozen-lockfile --ignore-scripts
-      - name: Build the pinned kernel twice at the same paths
+      - name: Build the pinned kernel twice, under two different work paths that must give identical bytes
         shell: bash
         run: |
           set -euo pipefail
-          kernel_work="$IMAGE_WORK/kernel-work"
+          kernel_work="$RUNNER_TEMP/winter-kernel-work"
+          kernel_work_b="$RUNNER_TEMP/winter-kernel-work-b"
+          test "$kernel_work" != "$kernel_work_b"
           python3 -I -S -B scripts/cowork-guest-artifact/kernel/native_build.py --downloads "$IMAGE_WORK/kernel-downloads" --work "$kernel_work" --out "$IMAGE_WORK/kernel-1"
           rm -rf "$kernel_work"
-          python3 -I -S -B scripts/cowork-guest-artifact/kernel/native_build.py --downloads "$IMAGE_WORK/kernel-downloads" --work "$kernel_work" --out "$IMAGE_WORK/kernel-2"
-          rm -rf "$kernel_work"
+          python3 -I -S -B scripts/cowork-guest-artifact/kernel/native_build.py --downloads "$IMAGE_WORK/kernel-downloads" --work "$kernel_work_b" --out "$IMAGE_WORK/kernel-2"
+          rm -rf "$kernel_work_b"
       - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
         with:
           name: guest-kernel-${{ github.run_id }}

CLAUDE.md

@@ -6,7 +6,7 @@ Guidance for Claude Code (claude.ai/code) when working in this repository. This
 
 Winter is a macOS-native AI assistant: a TypeScript/Bun daemon (`winter-core`) plus a native Swift menu-bar app. They speak JSON-RPC 2.0 over NDJSON on a Unix socket (`<WINTER_HOME>/run/core.sock`; default home `~/.winter`). The daemon is the single source of truth; every client — CLI, Mac app, phone — is a view over its event stream.
 
-**The daemon runs no agent loop of its own.** Every session is a runtime child driven through the router (`@yanlinglabs/winter-runtime-sdk`) on the Winter agent runtime — the only leg; every model runs on it, Claude included. Code sessions spawn the `winter` binary; chat and dispatch run it EMBEDDED in `winter-core`, one Bun Worker per session. Session modes are `code`, `dispatch`, `chat`. **Cowork is not an implemented session mode** — the protocol names it (`SESSION_MODES`) but `session.create` refuses it for every role (`unsupported_topology`) and no runtime-facing type can hold it; see [docs/cowork-status.md](docs/cowork-status.md). The daemon owns everything around the child: IPC, event-sourced session storage, settings, approvals, the capability tools it hands the child over MCP, the hooks, and the SDK-message→`SessionEvent` projector.
+**The daemon runs no agent loop of its own.** Every session is a runtime child driven through the router (`@yanlinglabs/winter-runtime-sdk`) on the Winter agent runtime — the only leg; every model runs on it, Claude included. Code sessions spawn the `winter` binary; chat and dispatch run it EMBEDDED in `winter-core`, one Bun Worker per session. Session modes are `code`, `dispatch`, `chat`. **Cowork is not an implemented session mode** — the protocol names it (`SESSION_MODES`) but `session.create` refuses it for every role (`unsupported_topology`) and no runtime-facing type can hold it; its native VM/guest source is inert and has never booted; see [docs/cowork-status.md](docs/cowork-status.md). The daemon owns everything around the child: IPC, event-sourced session storage, settings, approvals, the capability tools it hands the child over MCP, the hooks, and the SDK-message→`SessionEvent` projector.
 
 ## Commands
 
@@ -57,7 +57,7 @@ Plain links, not `@` imports — read the file whose area you are about to touch
 | [providers-and-credentials.md](docs/claude/providers-and-credentials.md) | Before touching a Keychain slot, `credential.*`/`provider.*` doors, the host-credential broker, the boot Keychain passes or Anthropic/Console sign-in. |
 | [internal-jobs.md](docs/claude/internal-jobs.md) | Before touching titles, the bash safety reviewer, the dreamer or the session cleaner — model/effort/credential resolution and the role problems. |
 | [protocol-and-remote.md](docs/claude/protocol-and-remote.md) | Before changing a `SessionEvent` variant or field (the 7-step checklist), adding an RPC method, or touching what a remote/phone client sees (allowlists, history, transients, thinking pill, phone mirror). |
-| [settings-and-migrations.md](docs/claude/settings-and-migrations.md) | Before adding a setting (live reload, the one-reader rule) or touching the legacy `~/.norma` home or project migration. |
+| [settings-and-migrations.md](docs/claude/settings-and-migrations.md) | Before adding a setting (live reload, the one-reader rule), touching the legacy `~/.norma` home or project migration, or bumping the runtime-state schema (currently v21). |
 | [runtime-home.md](docs/claude/runtime-home.md) | Before touching `<home>/sdk`, run folders, MCP/settings scopes and trust, Migration C, saved answers or the plugin format. |
 | [tool-surface.md](docs/claude/tool-surface.md) | Before changing what a model can call: capability servers and plain names, deferral, chat/dispatch allowed lists, web tools, hooks, read/write fences, sandbox escapes, saved allow rules, skills. |
 | [dispatch-and-messaging.md](docs/claude/dispatch-and-messaging.md) | Before touching mid-turn pushes (the fold), turn pairing, `SpawnSession`/children, `SendMessage`/`ListAgents`/`TaskStop`, `ListSessions`, or the Dispatch pill's command mode and terminal. |
@@ -69,8 +69,8 @@ Plain links, not `@` imports — read the file whose area you are about to touch
 | [headless.md](docs/claude/headless.md) | Before touching the `headless` backend, the Winter Headless helper, its local-network rules or the Chromium embed layout. |
 | [usage.md](docs/claude/usage.md) | Before touching usage and cost tracking: `packages/core/src/usage/`, the projector's `onTurnUsage`, `usage.*`, `settings.usage`, reading the user's Codex/Claude Code/Antigravity/OpenCode usage or plans, `apple/Winter/Sources/Usage/`. |
 | [testing.md](docs/claude/testing.md) | Before running or writing tests, a verify gate, the live computer-use suite, or anything reading daemon logs/temp dirs. |
-| [release.md](docs/claude/release.md) | Before bumping a version, writing release notes or cutting a release. |
-| [cowork.md](docs/claude/cowork.md) | Before touching `packages/core/src/cowork/**`, `packages/protocol/src/cowork.ts`, `apple/Cowork/**`, host-storage-fence or home-fence cowork roots, `refreshForStorage`, or the `workspace.*` / `project.*` methods and events. |
+| [release.md](docs/claude/release.md) | Before bumping a version, writing release notes or cutting a release — including the Cowork native-pair choice (`COWORK_NATIVE=omit` or both libkrun inputs) and a schema bump's rollback line. |
+| [cowork.md](docs/claude/cowork.md) | Before touching `packages/core/src/cowork/**`, `packages/protocol/src/cowork.ts`, `apple/Cowork/**`, `scripts/cowork-guest-artifact/**`, host-storage-fence or home-fence cowork roots, `refreshForStorage`, or the `workspace.*` / `project.*` methods and events. |
 
 Other references: `winter-vs-cc-tools.md` (repo root, the live tool comparison with Claude Code), `apple/ComputerUse/PROTOCOL.md` (the helper's wire contract), `apple/ComputerUse/WinterBrowserHost/PROTOCOL.md` (Winter for Chrome's).