[elemdos]

Frozen candidate and resulting behavior

Consolidates the complete existing founding-builder draft tree onto current main in one CMS review target. Final source: af0f4aa73cb55e3565b53792bab91916d99a41b5, CMS v3.3.2-rc.8. Unchanged exact package inputs: CLI #67, 0.3.0-rc.2 at d851dd980ad43ce3c44e5f03bf68048cd443f3bc; MCP #30, 0.1.11-rc.2 at 8c96de27908373983bfff831ee99e4231e0873c8.

The initial consolidated tree was verified identical to the full prior draft input. All 27 historical PR heads remain unchanged/open/draft; do not merge overlapping candidate chains in sequence. release/rc8/INPUTS.json and SCOPE.md record the frozen scope.

New runtime changes are limited to the accepted frame-ancestors 'self' policy (retaining static-preview script blocking/cache behavior) and lazy compiler-worker startup. Previously authentication/dashboard redirects started idle compiler workers; now workers start independently on actual compilation and retain reuse/caches and error handling. This addresses the reproduced Firefox navigation integration failure while preserving editor compilation.

Existing synchronization/nested data/identity safety, content-only source permissions/repeater ordering, compiler/hydration/cache, dependency security, production validation, type/Svelte-warning and browser/draft fixes are retained. References: #1239, #1241, #1259, #1235, #1309, #705, #804, #1314. Original #1235/#705 fixture uncertainty remains; no issue is closed. Trusted editor compiled-output publication remains; an untrusted-code sandbox is not claimed.

Final validation

• Source browsers: 44/44 each in Chromium, Firefox and WebKit.
• Exact native/package qualification: all five native targets 28/28 with production validation and actual installed-CLI publication; the same frozen Linux executable passes 44/44 and the full packaged agent/client handoff in all three engines. Exact source/hash/every-shipped-file checks pass before and after. Isolated framing 2/2 and production copied recovery pass.
• E2E/Go/compiler: zero errors/warnings, 57 integration tests, 15 compiler/browser cases, full Go suite and complete Chromium workflow pass. Staging tools: 29/29 on both Node minima.
• Local final CI-built macOS artifact: production CLI contracts, full packaged handoff, byte/provenance verification on Node 22.13.0 and 24.0.0; production copied recovery passes. Unchanged CLI/MCP packages pass 187 CLI + six compiler cases on each minimum with zero skips. All twelve local artifacts, every shipped file and embedded clean VCS identity verify; wrong-source/corrupted-copy guards reject.
• Portable kit consumption also passes from a fresh disposable directory/home: fresh locked product/tooling installs, complete packaged handoff and before/after every-file checks.
• Zero npm findings in CMS full and shipping CLI/MCP trees; reachable Go vulnerability scan passes. Product Go builds use 1.26.9. Qualified Node lines: 22.x >=22.13.0 and 24.x; compatible glibc required on Linux.
• Before/after framing and three worker-lifecycle regressions fail before/pass after; real-browser lifecycle regression fails on the old executable and passes after with actual editor rendering. Normal trace capture, all assertions and timeout/retry policy remain. Failed Firefox attempts, the insufficient trace-only workaround, hydration transport-adapter collision and standalone kit binary/path selection failures are retained as superseded evidence; final complete qualification was rerun after correction.

Recovery compares ten collections, all record identities/values, nested data, image bytes, active publication and client authentication/source denial. It upgrades one copy, restores a different pristine-backup copy using matching RC.7 bytes, verifies the backup unchanged and preserves newer candidate writes separately. No old executable opens upgraded data.

Review, rollout and remaining gates

release/rc8/REVIEW.md records agent integration review. Maintainer approval remains outstanding; draft-skipped automated review is not approval. The local RC.8 kit report/manifest/checksums retain final source-bound evidence outside the source commit so recording results cannot replace the tested binary identity.

See release/rc8/ROLLOUT.md and RECOVERY.md. Later authorized order: approved MCP first, refresh references/locks and requalify any changed bytes, compatible CMS before public CLI, CLI last with a fresh registry handoff. Main/tag/release automation can publish containers/change consumers, including prereleases; control those paths before later authorization.

Pilot accounts/sites/client assignments are operator-provisioned. Real SMTP invitation/setup/reset delivery, selected pilot host/support ownership and explicit release/deployment/invitation authorization gate activation. Physical phones, applicable real domain/TLS/CDN and operational backup/support gate first-client launch. Representative legacy fixtures gate actual migrations. General cross-origin embeds/marketplace previews need a separately approved/tested exception before upgrading a host that relies on them. RC.7 hosted/Safari/soak evidence remains historical; RC.8 was not deployed and physical devices/real mail are not claimed.

Keep this and every historical PR draft. No merge, tag/release, registry/container/site publication, deployment, live-mail configuration or outbound invitation was performed. Local/CI tests use generated data and loopback publication only. Recommendation: GO for maintainer review; NO-GO for activation until the stated gates and separate authorization.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}