From 61390b6b3b503e8c4320afe8c5fe3666af0adde9 Mon Sep 17 00:00:00 2001 From: Codev contributors Date: Fri, 9 Oct 2026 17:42:24 -0400 Subject: [PATCH] Record packaged Auto validation in V4 --- DESIGN.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/DESIGN.md b/DESIGN.md index edeb65b0..34cb64a8 100644 --- a/DESIGN.md +++ b/DESIGN.md @@ -594,7 +594,7 @@ Findings that change the backlog: - **V4b latest-head documentation and rerun (2026-10-03, `7e43d2d`).** The first current-head Windows Avalonia UI run failed `Footer_auto_default_is_visible_without_project_and_inherited_by_new_code_task_workspace` while asserting the persisted settings value: the file still held Auto after the test clicked Ask. The assertion occurs before the test creates a Code task workspace, so it did not demonstrate an inherited workspace-mode failure. The test had polled a file while the async settings write could still be in flight; a no-source rerun passed the full 35-test Windows UI suite. The current working-tree fix awaits the persistence task started by the click, then checks the live mode and saved value directly. Cross-platform CI and four-RID packaging were green at `7e43d2d`; release publishing was skipped for the PR. The current checkout still lacks the .NET 10 SDK, so local reproduction is unavailable. - **V4b persistence-test follow-up (2026-10-03, `2dfe416`).** The footer regression now asserts the live Ask mode immediately after the menu click, awaits the actual settings-persistence task, then checks the saved value before creating a workspace and checking inherited mode. Windows CI [#37147343576](https://github.com/jay23606/codev/actions/runs/37147343576) passed 936 portable tests (2 opt-in skips), all 35 Avalonia headless UI tests on Windows/Linux/macOS, the 8 Windows UI tests, and native credential-vault smoke checks. Desktop preview [#37147343579](https://github.com/jay23606/codev/actions/runs/37147343579) passed build, launch, and packaging for win-x64, linux-x64, osx-arm64, and osx-x64; the public-release job was skipped for the PR. Local execution remains unavailable because this host has only .NET SDK 9 while the projects target .NET 10. - **V4b Auto-mode disclosure review (2026-10-03, `1729220`).** Adversarial review confirmed that Auto mode also approves configured MCP tool calls, not only shell commands. The footer tooltip, command-permissions explainer, and Code task system prompt now state that MCP tools run without approval unless an exact project server/tool deny rule blocks them, and warn that they may affect external services. Regression checks cover the tooltip and prompt wording. Windows CI [#37148187560](https://github.com/jay23606/codev/actions/runs/37148187560) passed 936 portable tests (2 opt-in skips), 35 Avalonia headless UI tests on Windows/Linux/macOS, 8 Windows UI tests, and native credential-vault smoke checks. Desktop preview [#37148187564](https://github.com/jay23606/codev/actions/runs/37148187564) passed app/CLI build, launch, and packaging on all four RIDs; publishing was skipped for the PR. This review found no additional policy-routing bypass, but it does not satisfy Q3's full manual security review. -- **V4c. Real-use log (first pass, 2026-10-09).** The first Codev dogfood reports have been read and triaged in [`docs/real-use-log-release-2.md`](docs/real-use-log-release-2.md). They map to B1 (Auto prompts), B15 (local-model cold load), P2/P6 (saved hosted-key reconnect), collapsed activity/readability, sidebar ordering, and the existing Windows hidden-process follow-up. Recheck user-visible fixes against the Release 2 package; native manual items remain open. +- **V4c. Real-use log (first pass, 2026-10-09).** The first Codev dogfood reports have been read and triaged in [`docs/real-use-log-release-2.md`](docs/real-use-log-release-2.md). They map to B1 (Auto prompts), B15 (local-model cold load), P2/P6 (saved hosted-key reconnect), collapsed activity/readability, sidebar ordering, and the existing Windows hidden-process follow-up. The [PR #62 Windows package preview #37991522656](https://github.com/jay23606/codev/actions/runs/37991522656) ran the reported deletion-plus-Git-status command in Auto without a prompt, then verified an exact Deny after switching back to Auto; PR #65 records the evidence. Confirm the behavior again after the public Release 2 install; native manual items remain open. **Done when:** V4a stays green, the checklist is committed and has been run at least once, and the first real-use log has been read and its items triaged.