Orbit v1.1.0: reliability, permissions, local voice, and Codex runtime

[4xiomdev]

Summary

Orbit v1.1.0 is a coordinated reliability, permissions, Codex, exact local voice, UI, privacy, and release-tooling update.

• Selects the exact Siri Natural Nora / Shortcuts Voice 4 identifier, com.apple.siri.natural.Nora, rather than the unrelated public Norwegian Nora voice.
• Runs Apple's private local TextToSpeech interface in a separately signed, disposable helper with selector validation, timeouts, interruption, and crash containment; public AVFoundation remains the named fallback.
• Keeps one authenticated Codex thread warm while model, effort, and service-tier turn overrides change.
• Treats account-scoped model/list as authoritative and preserves future model, effort, tier, and upgrade metadata.
• Requires one fresh current-screen capture per request, blocks on capture failure, and owns private temporary files through every terminal state and startup recovery.
• Preserves unrestricted automation: danger-full-access, approval_policy = "never", and automatic app-server approvals.
• Pins Codex CLI 0.144.0 and chrome-devtools-mcp 1.5.0, generates protocol/runtime metadata, and keeps publishing fail-closed.

Product contracts

• No persistent screen-share indicator or per-action approval switch.
• Capture failure never silently submits a request without visual context.
• Capture files use an Orbit-owned private directory, mode 0600, terminal cleanup, and owned-only startup recovery.
• Exact Voice 4 playback stays local and streams directly; Orbit creates no narration file.
• Local speech is the default; Cloud Voice remains explicit and Keychain-backed.
• Team-up remains explicit or instruction-triggered.
• Agent Folder starts fresh context without restricting filesystem access.

Validation

• Full Swift 6 test suite passed.
• Opt-in live test resolved and audibly played the exact installed Shortcuts Voice 4 through the isolated helper.
• Static analyzer, swift-format, and Objective-C formatting passed.
• Helper and app nested signatures validate; a private-runtime helper failure cannot crash Orbit.
• Release-manifest Python tests and diff validation passed.
• Bundled Codex 0.144.0 and Node started successfully.
• chrome-devtools-mcp 1.5.0 browser discovery and read-only list_pages smoke test passed.

Coordinated release

Companion website PR: https://github.com/4xiomdev/orbit-web/pull/9

Cloudflare preview: https://codex-orbit-v1-1-0.orbitcodex-web.pages.dev

The desktop manifest marks v1.1.0 unpublished and contains no fabricated artifact URL or checksum. The website continues serving stable 1.0.7 until a signed, notarized, stapled v1.1.0 artifact supplies the final URL and checksum. Apple notarization remains blocked by the account agreement 403; the release script fails closed.

[4xiomdev]

Final reliability pass pushed in 31f2a5f.

• Rebuilt permission onboarding around typed states, injectable drivers/clock/window locator, serialized System Settings handoff, draggable Orbit pill, safe relaunch, and multi-display clamping.
• Added request-owned Codex steering/cancellation recovery and a typed conversation reducer that preserves one warm thread.
• Added protected first-line narration scheduling with 700 ms stabilization, final-only fallback, prefix removal, and completion queuing that cannot cut off Nora.
• Replaced the legacy 1,935-line panel with the 344-point task-first drill-down UI, localization catalog, accessibility identifiers, and deterministic visual fixtures.
• Added race, narration, permission, capture, geometry, and fixture tests.

Latest local gates: full Swift tests, analyzer, swift-format lint, ShellCheck, release-manifest validation, nested code-sign verification, exact Voice 4 probe, and live Nora playback all passed.