feat(macos): add native ClawDnD app shell

[100yenadmin]

Summary

• Adds a native SwiftUI control center and SwiftPM package for the local ClawDnD app.
• Hosts the existing dashboard and monitor in WKWebView instead of replacing viewer state logic.
• Adds provider status and launch contracts for Claude, Codex, and OpenClaw while keeping engine/viewer state authority intact.
• Adds a local .app build/run script, Codex Run action, local signing checklist, and safer double-click launcher preflights.

Refs #82

Architecture Notes

• The native app is an orchestrator and read surface, not a second game-state writer.
• Claude launches through the existing scripts/play_party.sh path.
• Codex and OpenClaw adapters fail closed until a provider command is configured, then receive the ClawDnD provider environment contract.
• Campaign browsing reads play-state and qa/state snapshots only.

Validation

• bash -n scripts/launch_common.sh scripts/play.sh scripts/play_party.sh clawdnd-play.command script/build_and_run.sh
• python3 -m py_compile viewer/server.py
• swift build --package-path macos/ClawDnDApp
• ./script/build_and_run.sh --verify
• codesign --verify --deep --strict dist/ClawDnD.app
• plutil -lint dist/ClawDnD.app/Contents/Info.plist
• Viewer smoke: /state, /dashboard, /monitor.json against an existing QA state dir
• git diff --check

Not Run

• Live Claude narrative play session. This PR intentionally avoids spending provider budget or entering the story QA lane.

Summary by CodeRabbit

• New Features

  • Native macOS app with SwiftUI: Play dashboard, Campaigns browser, Monitor, Providers, Settings, and Logs; start/stop viewer and provider sessions, provider selection and budgeting, campaign detail/party views, status strip, and a “Copy Diagnostics” action.

• Chores

  • Added build/run and launch helper scripts with dependency checks and smarter port selection, updated .gitignore, and included a macOS release checklist.

[coderabbitai]

Warning

Review limit reached

@100yenadmin, we couldn't start this review because you've used your available PR reviews for now.

Your plan includes 5 reviews of capacity. Refill in 11 minutes and 52 seconds.

Your organization has run out of usage credits. Purchase more in the billing tab.

⌛ How to resolve this issue?

After more review capacity refills, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than trial, open-source, and free plans. In all cases, review capacity refills continuously over time.

Please see our FAQ for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 13636bb7-c877-4447-aa3d-8a0e4763b4ec

📥 Commits

Reviewing files that changed from the base of the PR and between 8134133 and 07133d8.

📒 Files selected for processing (5)

• .github/workflows/macos-swift.yml
• macos/ClawDnDApp/Sources/ClawDnDApp/Views/MonitorView.swift
• macos/ClawDnDApp/Sources/ClawDnDApp/Views/PlayView.swift
• macos/ClawDnDApp/Sources/ClawDnDApp/Views/SettingsView.swift
• macos/ClawDnDApp/Sources/ClawDnDApp/Views/WebView.swift

📝 Walkthrough

Walkthrough

A native macOS app (ClawDnDApp) is added with domain models, AppProcessService to manage viewer/provider subprocesses, provider adapters (Claude/Codex/OpenClaw), a CampaignStore for filesystem snapshots, SwiftUI views (Play, Campaigns, Monitor, Providers, Settings, Logs), port/repo/shell utilities, build/launch scripts, and a macOS CI workflow.

Changes

macOS Native App Implementation

Layer / File(s)	Summary
Data models and domain types macos/ClawDnDApp/Sources/ClawDnDApp/Models/*	Campaign, provider, endpoint, and dependency model types including computed display properties and ProviderError.
Infrastructure and utility services macos/ClawDnDApp/Sources/ClawDnDApp/Services/{RepositoryLocator,PortFinder,Shell,DependencyChecker,Diagnostics}.swift	RepositoryLocator.defaultRepoPath(), PortFinder port scanning/bind checks, Shell.which/fileExists, DependencyChecker.required/check(), Diagnostics.copy to pasteboard.
Provider adapters and registry macos/ClawDnDApp/Sources/ClawDnDApp/Services/ProviderAdapters.swift	ProviderAdapter protocol plus ClaudeProvider, CodexProvider, OpenClawProvider; ProviderRegistry map and budget/provider env helpers.
Campaign store and filesystem discovery macos/ClawDnDApp/Sources/ClawDnDApp/Services/CampaignStore.swift	CampaignStore.reload(repoPath:) enumerates play/qa runs, parses snapshot.json, resolves party/location, computes lastUpdate/isLive, and infers provider label.
Core process management and orchestration macos/ClawDnDApp/Sources/ClawDnDApp/Services/AppProcessService.swift	AppProcessService starts/stops viewer and provider sessions, selects ports, launches ManagedProcess, streams stdout/stderr to logs, updates endpoint/provider state, and exposes diagnostics.
App entry point, navigation, and status macos/ClawDnDApp/Sources/ClawDnDApp/App/ClawDnDApp.swift, macos/ClawDnDApp/Sources/ClawDnDApp/Views/RootView.swift	@main ClawDnDApp with AppDelegate activation, environment-object injection, RootView NavigationSplitView, AppStorage bindings, and StatusStrip.
Feature screens and components macos/ClawDnDApp/Sources/ClawDnDApp/Views/*	PlayView (start/stop provider/viewer), CampaignsView (list + detail + Open), MonitorView (open viewer monitor), ProvidersView (status cards + config), SettingsView (validation), LogsView (tabs + Copy Diagnostics), EmptyStateView, WebView, and supporting UI components.
Build script, launcher helpers, and integrations script/build_and_run.sh, macos/ClawDnDApp/Package.swift, scripts/launch_common.sh, scripts/play.sh, scripts/play_party.sh	Package.swift for Swift 5.9 macOS target; build_and_run.sh builds app bundle, optional codesign, modes for run/debug/logs/release-check; launch_common.sh provides clawdnd_missing_commands/clawdnd_port_available/clawdnd_choose_port; play scripts now source helpers and use port-selection logic.
Scripts, wrapper, and git config clawdnd-play.command, .gitignore, .codex/environments/environment.toml, macos/ClawDnDApp/RELEASE_CHECKLIST.md	Play wrapper now preserves exit code and optionally waits on TTY; gitignore updated for macOS build artifacts; Codex env file and macOS release checklist added.
CI workflow .github/workflows/macos-swift.yml	Adds macOS workflow that validates scripts and builds the Swift package for macos/ClawDnDApp.

Sequence Diagram(s)

sequenceDiagram
  participant User
  participant PlayView
  participant AppProcessService
  participant ProviderRegistry
  participant ManagedProcess
  PlayView->>AppProcessService: startProviderSession(kind, repoPath, world, runId, ...)
  AppProcessService->>ProviderRegistry: lookup adapter -> adapter.startSession(...)
  ProviderRegistry-->>AppProcessService: ProviderLaunchRequest(exec, args, env, wd)
  AppProcessService->>ManagedProcess: launchManagedProcess(exec, args, env, wd)
  ManagedProcess-->>AppProcessService: stream stdout/stderr -> append logs
  AppProcessService-->>PlayView: return dashboard URL
  PlayView->>WebView: load(dashboard URL)
  User->>PlayView: Click "Stop"
  PlayView->>AppProcessService: stopProvider()
  AppProcessService->>ManagedProcess: terminate() -> close()
  ManagedProcess-->>AppProcessService: termination handler records exit status

Loading

Estimated code review effort

🎯 4 (Complex) | ⏱️ ~60 minutes

Possibly related issues

• [macos][openworlds] Native app: OpenWorlds shell with Swift supervisor bridge #82 — Implements the native macOS app shell, provider adapters, process/service types, and packaging/launcher scripts; strongly related.

Possibly related PRs

• 100yenadmin/ClawDnD#83 — Appears to modify the same native macOS shell, service layer, and scripts; directly related.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 1.49% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title 'feat(macos): add native ClawDnD app shell' directly and clearly summarizes the main change: introducing a native SwiftUI macOS application. It is specific, concise, and matches the substantial additions across SwiftUI views, services, models, and build infrastructure.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

Warning

Review ran into problems

🔥 Problems

Errors were encountered while retrieving linked issues.

Errors (1)

• LINEAR integration encountered authorization issues. Please disconnect and reconnect the integration in the CodeRabbit UI.

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 15

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@macos/ClawDnDApp/Sources/ClawDnDApp/Models/CampaignSummary.swift`:
- Around line 35-39: The dayLabel computed property currently interpolates "Day
\(day), \(timeOfDay)" which leaves a trailing comma when timeOfDay is empty;
update the dayLabel logic (property name: dayLabel, symbols: day and timeOfDay)
to only include the comma and space when timeOfDay is non-empty—e.g. build the
label by conditionally appending ", \(timeOfDay)" or join non-empty
components—so outputs become "Day 3" when timeOfDay == "" and "Day 3, Morning"
otherwise.

In `@macos/ClawDnDApp/Sources/ClawDnDApp/Models/LocalEndpoint.swift`:
- Around line 10-24: LocalEndpoint currently duplicates endpoint address state
with both a stored port and a stored url causing potential divergence; pick a
single source of truth (store url only) and derive port when needed. Remove the
stored port property, keep var url: URL as the canonical address, implement a
computed port property that parses the port from url (via URLComponents or
url.port ?? default), and update dashboardURL and monitorURL to build from url
(e.g., url with path "/dashboard" and "/monitor") instead of interpolating port;
adjust any initializers/usages to construct LocalEndpoint with a URL and ensure
Equatable/Identifiable semantics remain unchanged.

In `@macos/ClawDnDApp/Sources/ClawDnDApp/Services/AppProcessService.swift`:
- Around line 123-125: Reset provider-related state (providerProcess,
providerLog, runningProvider) before attempting to relaunch so a failed launch
cannot leave stale values; specifically, update the block that calls
providerProcess?.terminate() and then calls launchManagedProcess(...) to also
clear runningProvider (and any other provider state) prior to the try, and apply
the same reset in the analogous block around the code referenced at the second
occurrence (the code around lines 133-135) so both failure paths cannot retain
an old runningProvider value.
- Around line 184-191: Termination handler currently closes the managed handle
and logs the exit but leaves stale process references; update the
terminationHandler closure (the Task `@MainActor` block inside
process.terminationHandler) to also clear the owned process state by setting
providerProcess/viewerProcess and runningProvider/runningViewer to nil as
appropriate based on the stream value, ensuring these mutations occur on the
MainActor after calling managed?.close() and before/after append(...) so no
stale references remain after natural or crash exits.
- Around line 205-212: The append(_ text: String, stream: LogStream, prefix:
String? = nil) method currently appends to supervisorLog and providerLog with no
bounds; introduce a hard cap (e.g. MAX_LOG_CHARS or MAX_LOG_LINES constant) and,
after building the new line, trim the target string (supervisorLog or
providerLog) to that cap by dropping the oldest characters or lines so the
newest content is preserved; update append to enforce this cap for both
.supervisor and .provider paths and ensure trimming logic keeps valid line
boundaries (and consider using a small helper trimLog(_:, toMaxChars:) to
centralize behavior).

In `@macos/ClawDnDApp/Sources/ClawDnDApp/Services/CampaignStore.swift`:
- Around line 3-24: The reload method on the `@MainActor` CampaignStore is
performing blocking disk I/O (loadCampaigns, directory walking and JSON reads)
on the main actor; change reload to perform the file system work off-main-thread
(e.g., make reload async and call loadCampaigns from a background Task or
Task.detached or DispatchQueue.global) and then marshal results back to the main
actor to update `@Published` properties (campaigns, lastError). Specifically, keep
loadCampaigns usage but call it from a background context, catch errors there,
and ensure the assignment campaigns = ... and lastError = ... happens on the
MainActor (or via await MainActor.run) so UI updates remain safe.
- Around line 21-23: The catch in CampaignStore.reload currently only sets
lastError, leaving stale campaigns visible; update the catch block in reload()
to also clear the in-memory campaign collection (e.g., set campaigns = [] or
call campaigns.removeAll()) and update any related state flags (like isLoading =
false) so the UI no longer shows stale campaign data after a failed reload;
ensure you still set lastError = error.localizedDescription.

In `@macos/ClawDnDApp/Sources/ClawDnDApp/Services/PortFinder.swift`:
- Around line 5-20: The function firstFreePort currently returns the original
start value when no free port is found, which can be occupied; change
firstFreePort(preferredPort:) to signal failure explicitly by returning an
optional Int (Int?) or throwing an error instead of returning start. Update the
implementation (references: firstFreePort, isAvailable, preferredPort, start,
nearbyEnd) so that after exhausting the nearby range and fallback range it
returns nil (or throws a descriptive PortNotFoundError) rather than returning
start, and update all callers to handle the new optional/throwing contract.

In `@macos/ClawDnDApp/Sources/ClawDnDApp/Services/ProviderAdapters.swift`:
- Around line 240-242: The adapter(for kind: ProviderKind) method currently
returns a ClaudeProvider() when adapters[kind] is missing; change this to fail
fast instead of silently falling back: lookup adapters[kind] and if missing call
fatalError (or assert) with a clear message including the missing ProviderKind
(e.g. "Unmapped ProviderKind: \(kind)"), otherwise return the found adapter;
update references to adapters and ClaudeProvider in this method only.

In `@macos/ClawDnDApp/Sources/ClawDnDApp/Services/RepositoryLocator.swift`:
- Around line 5-7: The CLAWDND_REPO_ROOT environment value is not being
expanded, so paths starting with "~" fail looksLikeRepo; in
RepositoryLocator.swift where you read
ProcessInfo.processInfo.environment["CLAWDND_REPO_ROOT"], expand the tilde
before validation (e.g. use NSString(string: env).expandingTildeInPath or
similar) and then pass the expandedPath to looksLikeRepo and return the expanded
path instead of the raw env; keep the check against looksLikeRepo and update any
returned value to the expanded form.
- Around line 19-30: The code in RepositoryLocator.swift currently falls back to
the hardcoded lexar path (variable lexar) and returns it even when
looksLikeRepo(lexar) and looksLikeRepo(cwd) are both false; remove that
machine-specific fallback by deleting the final "return lexar.path" and instead
have the function return an explicit failure (e.g., make the function return an
optional or throw an error) when neither lexar nor cwd pass looksLikeRepo;
update callers to handle the nil/throwing behavior so they stop relying on the
hardcoded lexar value (refer to the symbols lexar, cwd, looksLikeRepo and the
repository-locating function in RepositoryLocator.swift).

In `@macos/ClawDnDApp/Sources/ClawDnDApp/Views/MonitorView.swift`:
- Around line 43-55: The port fallback chain in openMonitor() is unnecessarily
complex; simplify by using the port that startViewer guarantees to set: read
processService.viewerEndpoint?.port (or parse the returned dashboard URL if you
prefer) and use that single source to build webURL, removing the fallback to
preferredPort and the URLComponents parse chain; update the openMonitor() logic
to set port = processService.viewerEndpoint!.port (or safely unwrap) and then
webURL = URL(string: "http://127.0.0.1:\(port)/monitor").

In `@macos/ClawDnDApp/Sources/ClawDnDApp/Views/PlayView.swift`:
- Around line 169-173: The newRunID() function currently allocates a new
DateFormatter on every call; replace that with a single shared DateFormatter
instance (e.g. a static property) to avoid repeated expensive
initializations—move the DateFormatter creation out of newRunID() into a static
let (configured once with dateFormat "yyyyMMdd-HHmmss" and appropriate
locale/timeZone if needed) and have newRunID() use that shared formatter to
produce the string.

In `@macos/ClawDnDApp/Sources/ClawDnDApp/Views/SettingsView.swift`:
- Around line 17-55: The form currently accepts arbitrary input for repoPath,
stateDir, preferredPort, budget, sessionBudget, maxTurns, codexProviderCommand,
openClawProviderCommand, etc., with no user feedback; add inline validation
logic in SettingsView to validate each field (e.g., use
FileManager.default.fileExists for repoPath/stateDir, ensure preferredPort and
budget/sessionBudget/maxTurns parse to Int and fall within expected ranges, and
verify command fields are non-empty or point to executables) and expose
per-field error strings (e.g., repoPathError, portError, budgetError) that are
updated in onChange handlers; show those error messages as small red Text views
under the corresponding TextField and visually indicate invalid fields (red
border/foreground or .overlay), and disable or prevent saving/applying settings
until all error strings are empty.

In `@macos/ClawDnDApp/Sources/ClawDnDApp/Views/WebView.swift`:
- Around line 15-20: The WebView lacks a WKNavigationDelegate for error
handling; create a Coordinator class that implements WKNavigationDelegate
(implement webView(_:didFailProvisionalNavigation:withError:) and
webView(_:didFail:withError:)), set view.navigationDelegate =
context.coordinator inside updateNSView(_ view: WKWebView, context: Context),
and surface any navigation errors through a callback or Binding (e.g., an
onError closure or Binding<Error?>) so the parent MonitorView/PlayView can
display diagnostic UI when loading fails.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: efe649f2-b35f-4019-9894-60cb74901c9c

📥 Commits

Reviewing files that changed from the base of the PR and between 564beae and 959d8f1.

📒 Files selected for processing (32)

• .codex/environments/environment.toml
• .gitignore
• clawdnd-play.command
• macos/ClawDnDApp/Package.swift
• macos/ClawDnDApp/RELEASE_CHECKLIST.md
• macos/ClawDnDApp/Sources/ClawDnDApp/App/ClawDnDApp.swift
• macos/ClawDnDApp/Sources/ClawDnDApp/Models/AppSection.swift
• macos/ClawDnDApp/Sources/ClawDnDApp/Models/CampaignSummary.swift
• macos/ClawDnDApp/Sources/ClawDnDApp/Models/DependencyStatus.swift
• macos/ClawDnDApp/Sources/ClawDnDApp/Models/LocalEndpoint.swift
• macos/ClawDnDApp/Sources/ClawDnDApp/Models/ProviderModels.swift
• macos/ClawDnDApp/Sources/ClawDnDApp/Services/AppProcessService.swift
• macos/ClawDnDApp/Sources/ClawDnDApp/Services/CampaignStore.swift
• macos/ClawDnDApp/Sources/ClawDnDApp/Services/DependencyChecker.swift
• macos/ClawDnDApp/Sources/ClawDnDApp/Services/Diagnostics.swift
• macos/ClawDnDApp/Sources/ClawDnDApp/Services/PortFinder.swift
• macos/ClawDnDApp/Sources/ClawDnDApp/Services/ProviderAdapters.swift
• macos/ClawDnDApp/Sources/ClawDnDApp/Services/RepositoryLocator.swift
• macos/ClawDnDApp/Sources/ClawDnDApp/Services/Shell.swift
• macos/ClawDnDApp/Sources/ClawDnDApp/Views/CampaignsView.swift
• macos/ClawDnDApp/Sources/ClawDnDApp/Views/EmptyStateView.swift
• macos/ClawDnDApp/Sources/ClawDnDApp/Views/LogsView.swift
• macos/ClawDnDApp/Sources/ClawDnDApp/Views/MonitorView.swift
• macos/ClawDnDApp/Sources/ClawDnDApp/Views/PlayView.swift
• macos/ClawDnDApp/Sources/ClawDnDApp/Views/ProvidersView.swift
• macos/ClawDnDApp/Sources/ClawDnDApp/Views/RootView.swift
• macos/ClawDnDApp/Sources/ClawDnDApp/Views/SettingsView.swift
• macos/ClawDnDApp/Sources/ClawDnDApp/Views/WebView.swift
• script/build_and_run.sh
• scripts/launch_common.sh
• scripts/play.sh
• scripts/play_party.sh

📜 Review details

🧰 Additional context used

🧬 Code graph analysis (12)

macos/ClawDnDApp/Sources/ClawDnDApp/App/ClawDnDApp.swift (1)

macos/ClawDnDApp/Sources/ClawDnDApp/Services/Diagnostics.swift (1)

• copy (5-10)

macos/ClawDnDApp/Sources/ClawDnDApp/Services/DependencyChecker.swift (1)

macos/ClawDnDApp/Sources/ClawDnDApp/Services/Shell.swift (1)

• which (4-22)

macos/ClawDnDApp/Sources/ClawDnDApp/Views/ProvidersView.swift (1)

macos/ClawDnDApp/Sources/ClawDnDApp/Services/AppProcessService.swift (1)

• providerStatuses (41-43)

macos/ClawDnDApp/Sources/ClawDnDApp/Views/MonitorView.swift (2)

macos/ClawDnDApp/Sources/ClawDnDApp/Services/AppProcessService.swift (1)

• startViewer (45-87)

macos/ClawDnDApp/Sources/ClawDnDApp/Views/PlayView.swift (1)

• startViewer (122-132)

macos/ClawDnDApp/Sources/ClawDnDApp/Views/LogsView.swift (1)

macos/ClawDnDApp/Sources/ClawDnDApp/Services/Diagnostics.swift (1)

• copy (5-10)

scripts/play.sh (1)

scripts/launch_common.sh (2)

• clawdnd_missing_commands (7-19)
• clawdnd_choose_port (46-78)

scripts/play_party.sh (1)

scripts/launch_common.sh (2)

• clawdnd_missing_commands (7-19)
• clawdnd_choose_port (46-78)

macos/ClawDnDApp/Sources/ClawDnDApp/Services/AppProcessService.swift (6)

macos/ClawDnDApp/Sources/ClawDnDApp/Services/ProviderAdapters.swift (3)

• detectAll (244-246)
• adapter (240-242)
• startSession (48-73)

macos/ClawDnDApp/Sources/ClawDnDApp/Views/PlayView.swift (1)

• startViewer (122-132)

macos/ClawDnDApp/Sources/ClawDnDApp/Services/Shell.swift (1)

• which (4-22)

macos/ClawDnDApp/Sources/ClawDnDApp/Services/RepositoryLocator.swift (1)

• looksLikeRepo (32-37)

macos/ClawDnDApp/Sources/ClawDnDApp/Services/PortFinder.swift (1)

• firstFreePort (5-20)

macos/ClawDnDApp/Sources/ClawDnDApp/Services/DependencyChecker.swift (1)

• check (12-16)

macos/ClawDnDApp/Sources/ClawDnDApp/Views/RootView.swift (3)

macos/ClawDnDApp/Sources/ClawDnDApp/Services/AppProcessService.swift (1)

• refreshDependencies (37-39)

macos/ClawDnDApp/Sources/ClawDnDApp/Services/RepositoryLocator.swift (1)

• defaultRepoPath (4-30)

macos/ClawDnDApp/Sources/ClawDnDApp/Services/CampaignStore.swift (1)

• reload (8-24)

macos/ClawDnDApp/Sources/ClawDnDApp/Views/CampaignsView.swift (2)

macos/ClawDnDApp/Sources/ClawDnDApp/Services/AppProcessService.swift (1)

• startViewer (45-87)

macos/ClawDnDApp/Sources/ClawDnDApp/Services/CampaignStore.swift (1)

• reload (8-24)

macos/ClawDnDApp/Sources/ClawDnDApp/Services/ProviderAdapters.swift (2)

macos/ClawDnDApp/Sources/ClawDnDApp/Services/AppProcessService.swift (1)

• append (205-213)

macos/ClawDnDApp/Sources/ClawDnDApp/Services/Shell.swift (2)

• fileExists (24-26)
• which (4-22)

macos/ClawDnDApp/Sources/ClawDnDApp/Views/PlayView.swift (1)

macos/ClawDnDApp/Sources/ClawDnDApp/Services/AppProcessService.swift (4)

• startViewer (45-87)
• stopProvider (147-151)
• stopViewer (89-96)
• startProviderSession (98-145)

🪛 SwiftLint (0.63.2)

macos/ClawDnDApp/Sources/ClawDnDApp/App/ClawDnDApp.swift

[Warning] 29-29: Classes should have an explicit deinit method

(required_deinit)

macos/ClawDnDApp/Sources/ClawDnDApp/Services/AppProcessService.swift

[Warning] 178-178: Prefer failable String(bytes:encoding:) initializer when converting Data to String

(optional_data_string_conversion)

---

[Warning] 4-4: Classes should have an explicit deinit method

(required_deinit)

---

[Warning] 227-227: Classes should have an explicit deinit method

(required_deinit)

macos/ClawDnDApp/Sources/ClawDnDApp/Services/CampaignStore.swift

[Warning] 4-4: Classes should have an explicit deinit method

(required_deinit)

🔍 Remote MCP

It appears the repository is private and I cannot access it via the DeepWiki tools. Let me provide a comprehensive summary based on the detailed PR context you've provided:

PR Review Summary: Native macOS App Shell for ClawDnD

Based on the comprehensive pull request changes provided, here are the key architectural and technical findings relevant to your review:

Architectural Overview

The PR introduces a non-authoritative orchestrator pattern: the native macOS app acts as a UI control surface and read-only monitor without modifying game state. This is explicitly stated in the PR objectives—"the native app acts as an orchestrator and read surface (not a second game-state writer)." The Python viewer (viewer/server.py) retains authority over all game state, while the Swift app:

• Launches and monitors external processes (viewer + providers)
• Browses campaigns from filesystem snapshots
• Provides UI for configuration and status monitoring

Key Service Components & Responsibilities

AppProcessService (@MainActor): Central orchestrator managing:

• Viewer lifecycle: validates repo path, checks python3 availability, selects free port, launches python3 viewer/server.py with optional state directory injection
• Provider session management: validates config, builds launch parameters via adapters, manages process I/O streaming with real-time log capture
• Error tracking and diagnostic log aggregation (with a diagnostics property exposed for pasteboard copying)

CampaignStore: Read-only campaign discovery and aggregation:

• Loads from two roots (play-state and qa/state)
• Parses snapshot.json files (extracting id, title, world_id, day, time_of_day, location, party)
• Infers provider type based on file presence (e.g., companion_0.mcp.json → "Claude party", dm.mcp.json → "Claude", otherwise "Local")
• Computes campaign recency by comparing snapshot modification date to latest sessions/*.jsonl timestamp
• Considers campaigns "live" if snapshot is < 120 seconds old

Provider Adapters Pattern: Three adapter implementations for Claude, Codex, and OpenClaw:

• detect(): checks for CLI tools, config files, or user-configured launch commands
• startSession(): builds launch requests with provider-specific environment variables and validates required configuration
• Returns structured ProviderStatus (availability states: installed, configured, missing, error)

Helper Services:

• DependencyChecker: static list of required commands → runs /usr/bin/which for each
• PortFinder: clamps preferred port to 1–65535, tests availability via socket bind on 127.0.0.1, falls back to scanning nearby/default ranges
• RepositoryLocator: checks CLAWDND_REPO_ROOT env var, walks up from app bundle directory, falls back to hardcoded path; validates via presence of viewer/server.py and .claude-plugin/plugin.json
• Shell: wraps /usr/bin/which and FileManager.fileExists with tilde expansion

Campaign Browsing & State Authority

Campaign data is read-only from filesystem:

• Two isolated state roots (play-state/ for production runs, qa/state/ for QA)
• Discovery walks run directories → per-campaign directories → snapshot.json per campaign
• Party/provider inference happens locally; no API calls to game state
• Last update computed from filesystem timestamps, not from viewer endpoints

Process Management & I/O

ManagedProcess wrapper (used by AppProcessService):

• Pipes stdout/stderr to a shared pipe with readability handler
• Streams log output to background queue, dispatches log appends back to @MainActor
• Installs termination handler that closes file descriptors, records exit status, clears provider state
• Provides terminate() and close() helpers for cleanup

Build & Launch Infrastructure

build_and_run.sh script:

• Derives project paths relative to its location
• Compiles via swift build, copies binary into .app bundle structure
• Writes Info.plist via heredoc
• Attempts codesign when available
• Supports modes: run, --verify, --debug, --logs, --telemetry, --release-check

launch_common.sh (new bash helpers):

• clawdnd_missing_commands: validates required tools (python3, claude, uv, jq, curl)
• clawdnd_port_available: checks TCP port bindability via Python socket probe
• clawdnd_choose_port: validates/selects available port or errors on explicit request

Script modifications (play.sh, play_party.sh):

• Now optionally source launch_common.sh for dependency/port validation
• Preserve user-supplied vs. defaulted port arguments so play.sh can fall back appropriately
• Track PORT_EXPLICIT flag to distinguish user intent from internal defaults

Configuration & UI Design

RootView architecture:

• NavigationSplitView with sidebar + tabbed detail area
• SidebarView lists AppSection cases (play, campaigns, monitor, providers, settings, logs)
• StatusStrip shows compact status: viewer endpoint/port, state directory, active campaign, running provider, last error (if any)
• AppStorage bindings persist: repo path, provider/world/config commands, budget controls, voice backend

SettingsView: Grouped form with editable fields for workspace (repo path, state dir, port), defaults (world, provider, voice backend), budgets, and provider commands.

Code Organization & Reusability

• Model types are value semantics (structs) with computed properties for derived labels (e.g., CampaignSummary.sourceLabel, dayLabel, partyLabel)
• Views are compositional (EmptyStateView, ProviderCard, CampaignRow, CampaignDetail, LogText)
• Environment injection: AppProcessService wired as @EnvironmentObject; child views receive via @EnvironmentObject or @Binding

🔇 Additional comments (40)

macos/ClawDnDApp/Sources/ClawDnDApp/Models/AppSection.swift (1)

3-34: LGTM!

macos/ClawDnDApp/Sources/ClawDnDApp/Models/CampaignSummary.swift (1)

3-33: LGTM!

macos/ClawDnDApp/Sources/ClawDnDApp/Models/DependencyStatus.swift (1)

3-10: LGTM!

macos/ClawDnDApp/Sources/ClawDnDApp/Models/LocalEndpoint.swift (1)

3-8: LGTM!

macos/ClawDnDApp/Sources/ClawDnDApp/Models/ProviderModels.swift (1)

3-81: LGTM!

macos/ClawDnDApp/Sources/ClawDnDApp/Services/PortFinder.swift (1)

22-40: LGTM!

macos/ClawDnDApp/Sources/ClawDnDApp/Services/Shell.swift (1)

3-27: LGTM!

macos/ClawDnDApp/Sources/ClawDnDApp/Services/RepositoryLocator.swift (1)

32-37: LGTM!

macos/ClawDnDApp/Sources/ClawDnDApp/Services/DependencyChecker.swift (1)

3-17: LGTM!

macos/ClawDnDApp/Sources/ClawDnDApp/Services/Diagnostics.swift (1)

4-10: LGTM!

macos/ClawDnDApp/Package.swift (1)

1-16: LGTM!

script/build_and_run.sh (1)

1-123: LGTM!

scripts/launch_common.sh (1)

1-78: LGTM!

scripts/play.sh (1)

27-34: LGTM!

Also applies to: 42-46

scripts/play_party.sh (1)

49-56: LGTM!

Also applies to: 60-61, 74-82, 93-95

.codex/environments/environment.toml (1)

1-11: LGTM!

.gitignore (1)

38-42: LGTM!

clawdnd-play.command (1)

28-40: LGTM!

macos/ClawDnDApp/RELEASE_CHECKLIST.md (1)

1-32: LGTM!

macos/ClawDnDApp/Sources/ClawDnDApp/App/ClawDnDApp.swift (2)

29-34: SwiftLint false positive: deinit not required.

The static analysis warning about missing deinit can be ignored. NSApplicationDelegate instances managed by SwiftUI don't require explicit deinitialization unless they hold unmanaged resources or observers.

---

4-27: LGTM!

macos/ClawDnDApp/Sources/ClawDnDApp/Views/RootView.swift (3)

3-100: LGTM!

---

102-118: LGTM!

---

120-153: LGTM!

macos/ClawDnDApp/Sources/ClawDnDApp/Views/CampaignsView.swift (3)

3-85: LGTM!

---

87-116: LGTM!

---

118-177: LGTM!

macos/ClawDnDApp/Sources/ClawDnDApp/Views/EmptyStateView.swift (1)

3-18: LGTM!

macos/ClawDnDApp/Sources/ClawDnDApp/Views/LogsView.swift (2)

3-35: LGTM!

---

37-51: LGTM!

macos/ClawDnDApp/Sources/ClawDnDApp/Views/MonitorView.swift (1)

57-59: LGTM!

macos/ClawDnDApp/Sources/ClawDnDApp/Views/PlayView.swift (4)

3-120: LGTM!

---

122-132: LGTM!

---

134-150: LGTM!

---

152-167: LGTM!

macos/ClawDnDApp/Sources/ClawDnDApp/Views/ProvidersView.swift (2)

3-81: LGTM!

---

83-124: LGTM!

macos/ClawDnDApp/Sources/ClawDnDApp/Views/SettingsView.swift (2)

3-14: LGTM!

---

42-46: ⚡ Quick win

Validate numeric budget inputs instead of keeping them as free-form Strings

In macos/ClawDnDApp/Sources/ClawDnDApp/Views/SettingsView.swift (“Caps”, lines 42-46), budget, sessionBudget, and maxTurns are edited as String. Add explicit numeric parsing/validation right before these values are used (e.g., constructing provider args/env or invoking scripts), or switch the bindings to numeric types and use TextField(value:format:).

Example parsing guard:

let trimmed = input.trimmingCharacters(in: .whitespacesAndNewlines)
guard let v = Int(trimmed), v >= 0 else { return nil } // handle invalid input explicitly

macos/ClawDnDApp/Sources/ClawDnDApp/Views/WebView.swift (1)

4-13: LGTM!

[coderabbitai]

Actionable comments posted: 4

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

macos/ClawDnDApp/Sources/ClawDnDApp/Views/MonitorView.swift (1)

45-50: ⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Do not fall back to the dashboard URL in the Monitor tab.

If viewerEndpoint is unavailable, Line 50 opens /dashboard, so this screen can render the wrong surface after a successful viewer start. Derive /monitor from the returned URL instead of reusing the dashboard URL.

Proposed fix

             let dashboard = try processService.startViewer(
                 repoPath: repoPath,
                 preferredPort: preferredPort,
                 stateDir: stateDir
             )
-            webURL = processService.viewerEndpoint?.monitorURL ?? dashboard
+            webURL = processService.viewerEndpoint?.monitorURL
+                ?? dashboard.deletingLastPathComponent().appendingPathComponent("monitor")

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@macos/ClawDnDApp/Sources/ClawDnDApp/Views/MonitorView.swift` around lines 45
- 50, The Monitor tab currently falls back to the dashboard URL when
processService.viewerEndpoint is nil, causing the Monitor view to render the
wrong surface; update the assignment after calling processService.startViewer to
derive a /monitor URL from the returned dashboard URL when viewerEndpoint or
viewerEndpoint.monitorURL is unavailable: call processService.startViewer(...)
as before, then if processService.viewerEndpoint?.monitorURL exists use it,
otherwise parse the returned dashboard string (variable dashboard) and replace
or append its path with "/monitor" to compute webURL (referencing startViewer,
dashboard, viewerEndpoint, monitorURL, and webURL).

♻️ Duplicate comments (1)

macos/ClawDnDApp/Sources/ClawDnDApp/Services/RepositoryLocator.swift (1)

4-32: ⚠️ Potential issue | 🟠 Major | 🏗️ Heavy lift

Return an explicit failure instead of "".

Line 32 still encodes repo-discovery failure in-band. That leaves every caller responsible for remembering a special case, instead of forcing launch/browse flows to stop when no valid repo was found. Make defaultRepoPath() return String? or throw, and handle that failure explicitly at the call sites.

Suggested direction

-enum RepositoryLocator {
-    static func defaultRepoPath() -> String {
+enum RepositoryLocator {
+    static func defaultRepoPath() -> String? {
@@
-                return expanded
+                return expanded
             }
         }
@@
-            return homeRepo.path
+            return homeRepo.path
         }
@@
-            return cwd.path
+            return cwd.path
         }
 
-        return ""
+        return nil
     }
 }

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@macos/ClawDnDApp/Sources/ClawDnDApp/Services/RepositoryLocator.swift` around
lines 4 - 32, The function defaultRepoPath() currently returns an empty string
on failure; change its signature to return an optional String? (or alternately
make it throwing) so failure is explicit, update its implementation to return
nil (or throw a descriptive error) instead of "" when no repo is found, and
update all callers (places that call RepositoryLocator.defaultRepoPath()) to
handle the nil/throwing case explicitly (e.g., show an error, abort launch, or
present a repo-browse UI) rather than checking for "" — keep the repo detection
logic (looksLikeRepo, bundleURL/cursor loop, homeRepo, cwd) unchanged except for
the new return values and ensure unit/usage sites compile and handle the new
failure path.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@macos/ClawDnDApp/Sources/ClawDnDApp/Services/AppProcessService.swift`:
- Around line 144-149: The provider-owned viewerEndpoint set in
startProviderSession must be cleared/marked stopped when the provider stops or
crashes; update stopProvider() and the provider termination handler to reset
viewerEndpoint (the LocalEndpoint instance used for "Provider viewer") by
setting its status to .stopped and clearing or resetting any provider-specific
URL/healthPath so the UI no longer targets a dead localhost URL; ensure the same
reset is applied in all termination paths that currently mirror
startProviderSession changes.
- Around line 233-238: The trimLogIfNeeded implementation can drop the entire
retained buffer when the suffix contains a single oversized line because it
always removes up to the first newline even if none exists; update
trimLogIfNeeded to first truncate to maxLogCharacters, then only remove the
leading partial line if there is a newline in the retained suffix (i.e. check
for log.firstIndex(of: "\n") and remove through that newline only when it
exists), otherwise keep the truncated partial line so the newest output is
preserved.

In `@macos/ClawDnDApp/Sources/ClawDnDApp/Services/CampaignStore.swift`:
- Around line 8-31: Concurrent detached Tasks started by reload(repoPath:) can
finish out of order and overwrite state; change reload(repoPath:) to track the
active reload (e.g., an instance property like currentReloadTask: Task<Void,
Never>? or a reloadToken/Int) and on each call cancel the previous Task or
increment the token before starting a new Task, then ensure the Task checks for
cancellation (Task.isCancelled) or verifies the token before calling
finishReload(campaigns:lastError:); this guarantees older scans are ignored and
only the latest reload updates campaigns/lastError.

In `@macos/ClawDnDApp/Sources/ClawDnDApp/Views/PlayView.swift`:
- Around line 169-176: The runIDFormatter DateFormatter can produce different
results under user locales/calendars; update the static runIDFormatter
initializer (used by newRunID) to set formatter.locale = Locale(identifier:
"en_US_POSIX") and formatter.calendar = Calendar(identifier: .gregorian) (and
optionally formatter.timeZone = TimeZone(secondsFromGMT: 0)) so the fixed-format
run IDs are stable across user settings.

---

Outside diff comments:
In `@macos/ClawDnDApp/Sources/ClawDnDApp/Views/MonitorView.swift`:
- Around line 45-50: The Monitor tab currently falls back to the dashboard URL
when processService.viewerEndpoint is nil, causing the Monitor view to render
the wrong surface; update the assignment after calling
processService.startViewer to derive a /monitor URL from the returned dashboard
URL when viewerEndpoint or viewerEndpoint.monitorURL is unavailable: call
processService.startViewer(...) as before, then if
processService.viewerEndpoint?.monitorURL exists use it, otherwise parse the
returned dashboard string (variable dashboard) and replace or append its path
with "/monitor" to compute webURL (referencing startViewer, dashboard,
viewerEndpoint, monitorURL, and webURL).

---

Duplicate comments:
In `@macos/ClawDnDApp/Sources/ClawDnDApp/Services/RepositoryLocator.swift`:
- Around line 4-32: The function defaultRepoPath() currently returns an empty
string on failure; change its signature to return an optional String? (or
alternately make it throwing) so failure is explicit, update its implementation
to return nil (or throw a descriptive error) instead of "" when no repo is
found, and update all callers (places that call
RepositoryLocator.defaultRepoPath()) to handle the nil/throwing case explicitly
(e.g., show an error, abort launch, or present a repo-browse UI) rather than
checking for "" — keep the repo detection logic (looksLikeRepo, bundleURL/cursor
loop, homeRepo, cwd) unchanged except for the new return values and ensure
unit/usage sites compile and handle the new failure path.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: fccd817e-1a69-4157-b262-8f2207130dc4

📥 Commits

Reviewing files that changed from the base of the PR and between 959d8f1 and 057e7fa.

📒 Files selected for processing (9)

• macos/ClawDnDApp/Sources/ClawDnDApp/Models/CampaignSummary.swift
• macos/ClawDnDApp/Sources/ClawDnDApp/Models/LocalEndpoint.swift
• macos/ClawDnDApp/Sources/ClawDnDApp/Services/AppProcessService.swift
• macos/ClawDnDApp/Sources/ClawDnDApp/Services/CampaignStore.swift
• macos/ClawDnDApp/Sources/ClawDnDApp/Services/PortFinder.swift
• macos/ClawDnDApp/Sources/ClawDnDApp/Services/ProviderAdapters.swift
• macos/ClawDnDApp/Sources/ClawDnDApp/Services/RepositoryLocator.swift
• macos/ClawDnDApp/Sources/ClawDnDApp/Views/MonitorView.swift
• macos/ClawDnDApp/Sources/ClawDnDApp/Views/PlayView.swift

📜 Review details

🧰 Additional context used

🧬 Code graph analysis (1)

macos/ClawDnDApp/Sources/ClawDnDApp/Services/AppProcessService.swift (1)

macos/ClawDnDApp/Sources/ClawDnDApp/Services/PortFinder.swift (1)

• firstFreePort (5-20)

[coderabbitai]

♻️ Duplicate comments (1)

macos/ClawDnDApp/Sources/ClawDnDApp/Services/AppProcessService.swift (1)

128-132: ⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Clear provider viewer endpoint before relaunch attempt.

If startProviderSession terminates an old provider and the new launch fails, viewerEndpoint can remain as stale "Provider viewer" because ownership is nulled before the old termination handler can apply cleanup.

Proposed fix

         providerProcess?.terminate()
         providerProcess = nil
         runningProvider = nil
+        stopProviderViewerEndpointIfNeeded()
         providerLog = ""
         let managed = try launchManagedProcess(

Also applies to: 154-159

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@macos/ClawDnDApp/Sources/ClawDnDApp/Services/AppProcessService.swift` around
lines 128 - 132, When stopping an existing provider in startProviderSession,
clear the stale viewerEndpoint immediately (set viewerEndpoint = nil or empty
string) before nulling providerProcess/runningProvider and before attempting the
new launch so a failed relaunch cannot leave the old "Provider viewer" value;
apply the same fix to the other shutdown block (the code around the second
provider termination at lines 154-159) so both termination paths explicitly
clear viewerEndpoint prior to restart/cleanup. Ensure you update references to
viewerEndpoint in AppProcessService (the startProviderSession termination logic
and the second termination block) rather than relying on the old termination
handler to do it.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Duplicate comments:
In `@macos/ClawDnDApp/Sources/ClawDnDApp/Services/AppProcessService.swift`:
- Around line 128-132: When stopping an existing provider in
startProviderSession, clear the stale viewerEndpoint immediately (set
viewerEndpoint = nil or empty string) before nulling
providerProcess/runningProvider and before attempting the new launch so a failed
relaunch cannot leave the old "Provider viewer" value; apply the same fix to the
other shutdown block (the code around the second provider termination at lines
154-159) so both termination paths explicitly clear viewerEndpoint prior to
restart/cleanup. Ensure you update references to viewerEndpoint in
AppProcessService (the startProviderSession termination logic and the second
termination block) rather than relying on the old termination handler to do it.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: cf9bddbf-b056-4d72-9443-78f373437832

📥 Commits

Reviewing files that changed from the base of the PR and between 057e7fa and 8134133.

📒 Files selected for processing (6)

• macos/ClawDnDApp/Sources/ClawDnDApp/Services/AppProcessService.swift
• macos/ClawDnDApp/Sources/ClawDnDApp/Services/CampaignStore.swift
• macos/ClawDnDApp/Sources/ClawDnDApp/Services/RepositoryLocator.swift
• macos/ClawDnDApp/Sources/ClawDnDApp/Views/MonitorView.swift
• macos/ClawDnDApp/Sources/ClawDnDApp/Views/PlayView.swift
• macos/ClawDnDApp/Sources/ClawDnDApp/Views/RootView.swift

📜 Review details

🧰 Additional context used

🧬 Code graph analysis (1)

macos/ClawDnDApp/Sources/ClawDnDApp/Views/RootView.swift (1)

macos/ClawDnDApp/Sources/ClawDnDApp/Services/RepositoryLocator.swift (1)

• defaultRepoPath (4-33)

🔍 Remote MCP

The DeepWiki tools require authentication for this repository. However, based on the comprehensive AI summary provided in the context, I have sufficient information to provide a focused review summary. Let me synthesize the key architectural findings from the PR changes:

Additional Context Summary for PR Review

Based on analysis of the pulled code changes, here are the key architectural and implementation details relevant for effective review:

Core Architecture Pattern

The PR establishes a clear separation of concerns: the native macOS app acts as an orchestrator and read-only UI surface rather than a second writer to game state. This is critical because:

• AppProcessService manages subprocess lifecycles for the viewer (Python-based dashboard server) and providers (external processes)
• CampaignStore reads campaign snapshots from filesystem (play-state/ and qa/state/) without writing state
• The app delegates all game logic to the existing ClawDnD engine via the viewer and provider processes

Subprocess Management Implementation

AppProcessService implements a unified subprocess handling pattern via:

• launchManagedProcess() centralizes all process lifecycle: environment merging, stdout/stderr piping, asynchronous readability handlers, and termination cleanup
• Logs are trimmed to a maxLogCharacters limit and appended per-stream (supervisor vs provider logs)
• Termination handlers distinguish between viewer/provider processes and clean up corresponding state
• Port discovery via PortFinder validates port availability through TCP socket binding on 127.0.0.1

Provider Adapter Layer

Three provider implementations share a common contract:

• ClaudeProvider: Validates Claude CLI presence via Shell.which(), sources environment from budgetEnvironment helper
• CodexProvider & OpenClawProvider: Check user-configured command presence first, throw ProviderError.missingDependency or ProviderError.configuration as appropriate
• All adapters construct ProviderLaunchRequest with provider-specific environment variables (budget, world, run ID, companions, port) via providerEnvironment helper
• ProviderRegistry provides a factory interface mapping ProviderKind to adapters and detectAll() for status refresh

Campaign Discovery and Metadata Extraction

CampaignStore.loadSnapshot() implements careful metadata extraction:

• Requires campaign id field; derives runID from parent directory
• Computes lastUpdate as maximum of snapshot modification time and any sessions/*.jsonl timestamps
• Sets isLive flag based on snapshot age (< 120 seconds)
• Derives location and party by traversing nested JSON structures in snapshot
• Provider inference (inferProvider()) probes for companion/DM MCP config files to distinguish Claude party vs Claude vs Local

UI State Management

The root view architecture uses:

• @AppStorage for persistent settings (repo path, provider commands, budgets, voice backend)
• @EnvironmentObject to inject AppProcessService into the view hierarchy
• Tab/view switching drives different use-cases: Play (provider + viewer), Campaigns (read-only), Monitor (dashboard), Providers (status/config), Settings, Logs

Build and Signing

• script/build_and_run.sh automates app bundle creation, codesign verification, and release verification steps
• .codex/environments/environment.toml defines a Codex action to run the build script
• RELEASE_CHECKLIST.md documents Developer ID signing, hardened runtime, notarization, and Gatekeeper requirements

Process Validation and Error Handling

• Repository location validation requires both viewer/server.py and .claude-plugin/plugin.json to exist
• Dependency checking validates presence of external commands (python3, claude, uv, jq, curl) with human-readable labels
• Startup errors are caught and surfaced via alert dialogs with localized descriptions

🔇 Additional comments (6)

macos/ClawDnDApp/Sources/ClawDnDApp/Views/MonitorView.swift (1)

50-51: LGTM!

macos/ClawDnDApp/Sources/ClawDnDApp/Services/RepositoryLocator.swift (1)

4-9: LGTM!

Also applies to: 32-32

macos/ClawDnDApp/Sources/ClawDnDApp/Views/RootView.swift (1)

7-7: LGTM!

macos/ClawDnDApp/Sources/ClawDnDApp/Views/PlayView.swift (1)

171-172: LGTM!

macos/ClawDnDApp/Sources/ClawDnDApp/Services/CampaignStore.swift (1)

8-13: LGTM!

Also applies to: 24-28

macos/ClawDnDApp/Sources/ClawDnDApp/Services/AppProcessService.swift (1)

192-208: LGTM!

Also applies to: 235-250

[100yenadmin]

OWNER STEER (2026-07-22 ~21:30) — this spike is now THE demo blocker, elevated above all render/paint work. Verbatim intent: the character can still walk through tables/walls and hits invisible objects in EVERY room; ~98% of painted area disagrees with collision boundaries; the constant silhouette firing on invisible proxies is the same registration error made visible. Paint-first rooms that fail navigation-truth are to be THROWN AWAY, not patched, unless greyboxes can be reverse-engineered from the paint to ≥99% agreement. Owner authorizes: workflows/ultracode, buying tools, using the owned Unity software stack — whatever it takes. REFRAME: the walk gates verify GRID-truth (clicks resolve, engine blocks cells); the unsolved problem is FELT-truth (grid ↔ painting registration per object). §9 G4 is gated on THIS, not on render polish. Execution starts now: (1) 3D-first crypt scene on the box (collision by construction) + painterly post, panel vs the 8.3 plate control, walk+cert green by construction; (2) a REGISTRATION instrument scoring every existing room's paint↔proxy disagreement so '98%' becomes a measured number and the ship/kill call per room is instrumented; (3) hybrid path per the premise study (3D structure + paint demoted to non-collidable dressing) as hypothesis D, pure 3D-painterly as fallback C.

[100yenadmin]

DECISION (orchestrator, 2026-07-22 ~22:00, trade-study-informed): PRIMARY = 3D-FIRST (A), with the HYBRID dressing variant (D) measured in the same box session. FALLBACK = C-lite (coherence-derived per-cell walkmask as a safety gate on legacy rooms). B (per-object re-registration) REJECTED for scale — no reliable per-object correspondence on painterly art (braziers are the only findable beacons; the dwing 126px local non-affine case is its native failure mode); its refutation experiment runs only if A/D fails beauty.

Why: agreement is only GUARANTEED by construction; the owner declared agreement the sole blocker and authorized discarding beauty-first rooms; the diffusion style pass injects per-object local drift no whole-plate solve can fix; every AAA isometric precedent renders 3D then paints.

The deciding session (one box session, A+D together): (1) re-author the crypt as a Synty PolygonDungeonMap/DunGen kit scene via a COMMITTED build script (CANONICAL discipline); (2) Beautify 3 + WOSRelight painterly post (+ optional LOW-strength img2img over the 3D capture); (3) capture through the contract camera → #1680 registration score (expect ~100% by construction) + blind panel vs the crypt 8.3 plate control, judged by WITHIN-PANEL DELTA (the control re-scores ~6.7-7 under the current ruler — absolute 8.3 would false-fail); (4) D variant: composite a NON-COLLIDABLE diffusion dressing layer over the 3D capture → re-score + re-panel + assert no dressing object over open floor; (5) walk gates + player_cert green by construction. Known first hazard: Synty wiring-debt (pink-material risk in the box RP) — material sanity capture is step 0. Panel ≥ control-delta ⇒ A ships standalone; D adds beauty without seam cost ⇒ hybrid; both fail beauty ⇒ B/C refutation experiments before any retreat.

[100yenadmin]

r4 probe data (for the r5 script fix): Synty pillar prefab natural bounds = (0.43, 3.02, 0.43) single renderer. The r3 script instantiates pillars at localScale (4.20, 1.66, 4.20) → world (1.80, 5.00, 0.90) — wide thin SLABS, not columns (x/z inflated asymmetrically; z squashed). Correct treatment: scale so world ≈ (1.2, 4.0, 1.2) — measured-multiplier method proven live (factor = target/measured per axis on the instance's renderer bounds). Walls at 1.5× script height read RIGHT (r4b frame: kit_crypt_r4b.png — brick, tall, capped). r4b pillars still read squat as plain grey boxes → r5 must ALSO assign the stone/brick material to pillars (they are staying default grey) + verify the 4u height actually applies (set, then re-measure, assert ±10%). Frames: kit_crypt_r4.png (overshoot cubes — blind multipliers rejected), kit_crypt_r4b.png (measured set).

[100yenadmin]

Kit rounds r5-r6 + FIRST registration score on a kit-built room (2026-07-22 ~22:45)

r5 (PR #1684, merged): measured-multiplier pillar scaling landed — in-engine assert logs show all 4 pillars achieve world (1.20, 4.00, 1.20) exactly on target; pillar force-material live (material_fixes 3→7); walls at 5.4u.

r6 (PR #1685, auto-merging): r5 eyeball caught pillars rendering as SHORT STUBS despite on-target size → box probe: every pillar at pos.y=-1.98, bounds -1.99..+2.01 — half the column underground. Root cause: PlacePillar's seating formula pivotOffset.y - b1.min.y double-counts the bounds centre for base-pivot meshes (Synty pillar pivot = base). Fixed to ground on min.y alone; post-fix probe minY=0.00/maxY=4.00 ×4; frame shows four full-height brick columns. Also: CaptureRoom now emits the 1344x768 CONTRACT frame alongside the review render (registration_score refuses other sizes).

First registration score of the kit crypt (the spike's core question):

crypt kit r6: agreement 58.85% (bar 99%) — 60 invisible-wall / 19 walk-through / 192 cells
   (paint baseline for comparison: 48.4%)

NOT the ~100%-by-construction I predicted — and the per-cell decomposition says exactly why (this is the instrument doing its job):

1. The builder renders a SUBSET of collision truth. The geometry's impassable list carries cells that exist in no props wall_run — interior buttress cells (2,1),(3,1),(9,1),(11,1),(12,1) are engine-blocked, visually EMPTY. By-construction registration requires building from impassable, not props.
2. Wall bases don't cover their cells — thin skins at the outer edge leave the wall cell's floor quad exposed (whole perimeter reads open) + the camera-side run is fully cut away (needs a low parapet, PoE2-style).
3. Pillar masses vs footprints: fixed 1.2u columns cover ~36% of their authored 1x2-cell footprints → 6 footprint cells read open. Sizing must be footprint-driven.
4. Door leaf at (15,5) renders closed → painted-blocked but walkable.
5. All 19 walk-throughs are brazier light pools — luminance fooling the coverage scorer, not placement. Fix = flat-light scoring capture (score object placement under flat ambient; beauty renders separately).

r7 lane dispatched (packet: LEXAR session-notes 2026-07-22/g4-build/dispatch/kit-room-r7-spec.md): impassable-set coverage rule (buttress/plinth for uncovered cells), wall base thickness ≥1.4u, camera-side parapet 0.55u, footprint-driven pillars, open doorways, flat-light _score.png capture. Expect the flat-light re-score to isolate true placement residuals; then iterate the residual list to ≥99%.

Frames: kit_crypt_r5/r6(.png), heatmap + registration JSON at LEXAR session-notes 2026-07-22/g4-build/artifacts/.

[100yenadmin]

r7 verdict (2026-07-22 ~23:15) — masses landed, the residual is ALBEDO, and the certification design fell out of it

r7 (PR #1686, auto-merging) box cycle: +5 buttresses at exactly the predicted uncovered impassable cells, walls 25→50 (≥1.4u bases re-centered + 0.55u camera-side parapets), pillars footprint-driven (1.70×4.00×3.40 filling their 1×2 footprints, in-engine assert), doorways verified bare, and CaptureRoom now emits a flat-light _score.png.

Scores: flat 67.19% (walk-through 19→2 — light pools eliminated) · lit 72.40% (invisible-wall 60→35). Cross-referencing flat∩lit isolates the entire residual to ONE class: dark mass on similar-toned floor — every one of the 35 shared cells is a placed, visible mass scoring 0.33–1.73 against BLOCK_T 1.85. Light pools score 3.3–5.6 (they can never be tuned under threshold in a fire-lit room).

Certification design this forces (recorded as the spike's ship-gate story):

1. Flat-light _score.png = the placement gate — albedo-separated materials, no lights: measures pure paint↔collision placement. This must hit 99%.
2. The lit render = the beauty artifact. It cannot drift from collision — it IS the same scene through the same contract camera (provenance replaces image forensics). Chiaroscuro pools stay.
3. Only img2img-dressed variants (the D arm) reintroduce drift risk → only those need the forensic err_cells/registration machinery on the final image.

r8 lane dispatched (packet: LEXAR g4-build/dispatch/kit-room-r8-spec.md): pale stone floor vs dark masonry masses (shared runtime materials), stone plinths under braziers, taller/darker rubble, dark fallback boxes. Expect flat ≥95% next cycle; iterate the residual list to 99.

[100yenadmin]

★ 2026-07-23 ~00:30 — REGISTRATION GATE HIT 100.00% (bar 99) — the construction process is proven

crypt kit r8d: agreement 100.00% (PASS @ bar 99%) — 0 invisible-wall, 0 walk-through / 192 cells

The arc from tonight's baseline: paint-first crypt 48.4% → kit r6 58.85% → r7 masses 67-72% → r8d 100.00%.

The two instrument rounds that closed it (both measured, both inline on PR #1687):

• r8c segmentation frame: albedo tinting could not separate floor from mass through the kit textures (flat score DROPPED 67→60 in r8 — everything converges to warm brown; the scorer is self-calibrating so monochrome plates compress). The gate question is "which floor quads are covered by mass through the contract camera" — so the score frame now renders it literally: floor flat white, mass flat black, unlit. Result: invisible-wall 75→0.
• r8d footprint flattening: tall seg-black masses screen-occlude walkable cells BEHIND them (50 false walk-throughs). The gate is a footprint question — masses flatten to floor slabs for the seg render; door frames hidden so lintels don't drop onto open door cells. Result: walk-through 50→0.

Verified by eyeball (pixels-in-chat rule): the seg frame is a genuine footprint mask — door gaps open, all 5 buttresses + 4 piers + tomb + braziers + rubble at their authored cells. Not a degenerate pass: the same instrument scored 59.90 on this exact scene one capture-design earlier.

The certified chain for 3D-first rooms: geometry JSON → kit assembly (impassable-set coverage rule) → footprint seg gate (must be ≥99, crypt = 100.00) → the lit contract capture IS the plate (provenance: same scene, same camera — no drift possible) → painterly post tunes beauty freely without touching the gate.

Remaining for #83 exit: painterly post (Beautify Builtin + WOSRelight) on the lit capture → blind panel within-delta vs the crypt 8.3 control → adopt as the crypt plate → box player build → sandbox walk gate → owner. Evidence: kit_crypt_r8d_score.png + registration JSON at LEXAR g4-build/artifacts/.

[100yenadmin]

Beauty stage opened (2026-07-23 ~00:00) — Beautify live on the box; verdict: shader post alone won't reach the bar; D-variant next

Box ops battle log (runbook-worthy): the Beautify import chain wedged the editor bridge for ~25 min — THREE stacked blockers, all diagnosed by screenshot: (1) Unity's Script Updating Consent dialog (API updater for Beautify's VRCheck.cs) silently blocks ALL script compilation → the MCP WebSocket client never re-arms after the import's domain reload — clicked '[Yes, just for these files]' via xdotool (⚠ the box root screenshot is 3840x2160 — a wrong scale factor sent my first click into the scene view); (2) the RPG-anim-pack SetupInputLayers.cs nag modal re-spawns every reload; (3) deleting that nag script OUTSIDE Unity desynced the compile graph (CS2001 'source file could not be found' → Assembly-CSharp-Editor fails → every execute_code snippet dies with success:false/null) — recovered by git-restoring the file + focus/Ctrl+R refresh. Bridge now healthy; box autosaved (9484e5924).

Beauty pass 1 (kit_crypt_beauty1.png): BeautifyEffect.Beautify on the contract camera — bloom 1.25/0.62, contrast 1.08, sharpen 2.0, saturate +0.3, vignette. Fire glow + mood real, BUT (a) the r8 dark-masonry brazier plinths bloom into NEON-RED slabs, (b) the flat-brown material monotony is untouched — honest read ~5 vs the 8.3 control. Conclusion: the A-arm (pure 3D + shader post) won't hit the beauty bar alone; the D-arm (Gemini structure-locked painterly restyle over the 3D lit base) is the path — exactly the hybrid the trade-study predicted. Registration stays certified by the seg gate + provenance; the D output gets the forensic err_cells check on top.

Next: feed the lit kit base through the Gemini restyle (paint_room's styled pass with the crypt recipe + structure locks) → within-panel delta vs the 8.3 control (two-anchor rule) → if in-band, adopt as the crypt plate + wire the seg gate into the room pipeline. PR #1687 (r8+r8b/c/d incl. the seg gate) auto-merge armed, CI cycling.

[100yenadmin]

D-arm round 1 (2026-07-23 ~00:20): direct Gemini restyle of the 3D render = HONEST NEGATIVE (total recompose); depth-anchored D2 launched

D1 (kit_crypt_beauty2_contract → _gemini_pass with the crypt recipe verbatim): output is genuinely PoE2-painterly (carved knotwork pillars, effigy tomb, stone slabs) and structurally worthless as a plate — ~8 pillars painted vs 4 authored, 5 invented wall arches vs 2 doors, braziers relocated to flank the (re-centered, stepped) tomb, recomposed framing, wrong aspect (2816x1536). The image-slot conditioning on the Gemini model has no structure strength — the measured dwing-falsification class, reproduced on a 3D base. err_cells would refuse instantly. Evidence: g4-build/artifacts/d1/kit_crypt_d1.png (+ submitted body beside it).

The fix is the pipeline we already trust: the kit scene now emits its own DEPTH map through the contract camera (LinDepthRemap replacement-shader pass, box-side; kit_crypt_depth.png — real 3D profiles for every pier/buttress/brazier/tomb, far richer than greybox depth). D2 = the FULL proven chain on that depth — 3 flux depth-CN draws → edge-recall selection → Gemini structure-lock → the solve-based err_cells hard gate (--boxes armed) — i.e. the exact recipe that made the 8.3 control, conditioned by the 3D scene instead of a greybox. Running now (~47 CU).

If D2 lands in-band on the two-anchor panel AND passes err_cells, the full story closes: geometry → kit scene (seg gate 100%) → 3D depth → proven paint chain (err_cells) → plate whose collision agreement is certified at both ends.

[100yenadmin]

Two-anchor panel on the gate-compatible candidates (2026-07-23 ~01:00) — both OUT of band; the decision matrix is now fully measured

Blind 5-scorer control-anchored panels (versioned ruler, A/B alternated; control = shipped crypt plate, reproduced at 8):

• D2 flux base (recall 0.9752, gate-compatible): 3 vs 8, Δ −5 — 'flat, muddy, blockout-like, no chiaroscuro' (unanimous)
• Beautify'd kit render (registration 100% by construction): 2 vs 8, Δ −6 — 'placeholder layout pass, not concept art'

The spike's trade, in numbers:

arm	structure	beauty	verdict
A: 3D + shader post	100.00% seg	Δ −6	beauty FAIL
D-gemini: repaint	err_cells 1.39 (recompose ×2 today)	~8-class	structure FAIL
D2 flux base	recall 0.9752	Δ −5	beauty FAIL
D-MAI: edit pass	0.9999 recall, 0 invented (#1556)	7.0 = Δ −1.0 IN BAND (#1556)	the only candidate passing BOTH

MAI 2.5 Edit is currently infra-down on Scenario (two jobs stuck warming-up 15-20 min; third attempt polling with a 1200s window). If it lands and reproduces its bake-off behavior on the kit-depth flux base: seg gate 100% + structure-held style pass + in-band panel = the full 3D-first chain closes end-to-end. If it stays down: the beauty half parks pending the retry — the certification machinery (impassable-coverage builder + seg gate + 3D-depth conditioning, PRs #1682-#1687) is the durable yield either way. Panel evidence: workflow wf_72a16275 notes on this thread's artifacts dir.

[100yenadmin]

Night close (2026-07-23 ~02:15) — beauty half PARKED on a probe-verified provider outage; registration half SHIPPED

MAI 2.5 Edit is down on Scenario: 3 jobs (job_kZJ…/job_7xq…/job_YsV…) across ~45 min all died stuck at warming-up (300s/900s/1200s windows) while flux + Gemini jobs on the same account completed normally tonight. The one styler that passes both structure (0.9999 recall, 0 inventions) and beauty (7.0 in-band) in the #1556 bake-off cannot be exercised until the provider recovers. Morning opener: re-run the MAI pass over the D2 flux base (asset_qM9R3tuRH4sceUrVjCoLdPRk) → recall_vs_base + err_cells + two-anchor panel → in-band ⇒ adopt as the crypt plate (manifest swap PR + model-registry allowlist proposal — OWNER GATE — + room_pipeline seg-gate wiring + box player build + sandbox walk gate).

What shipped tonight (all merged to main, #1682→#1687): the kit-room construction pipeline + the registration certification chain — crypt registration 48.4% → 100.00% (0/192 disagreements), with the full per-round evidence and honest negatives (Gemini recompose ×2, panel Δ−5/−6 on the raw renders) on this thread. The remaining rooms can be kit-rebuilt to 100% registration through the same chain as soon as the styler question resolves — or with interim flux-base plates if beauty must wait.

Owner's framing answered where it stands: building a navigable room at a fundamental level is now a measured, repeatable, gated process. Making it beautiful without breaking it is one working edit-model away, with in-scene material dressing as the fallback.

[100yenadmin]

★★ OWNER-STEERED BAKE-OFF ROUND 2 (2026-07-23 ~02:45) — the models were never broken; MY payloads were. Two finalists IN BAND.

Owner's diagnosis confirmed: MAI never had an outage — my freehand call carried numSamples + resolution, both INVALID for that model (its schema takes only referenceImages/prompt/aspectRatio/numOutputs). Scenario queued the malformed jobs and the worker hung at warm-up, three times. Schema-first calls fixed everything: all four owner-ranked models ran successfully on the first conformant attempt over the kit-depth flux base (asset_qM9R3tuRH4sceUrVjCoLdPRk).

model	CU	eyeball structure	panel (blind, ctrl same run)
Gemini 3.0 Pro (model_google-gemini-pro-image-editing, 2K out)	25	held cell-for-cell (effigy in place, 4 piers at quadrants, buttresses, parapets, both doors; recall 0.886 = best)	6.5 vs 7.5, Δ −1.0 IN BAND
GPT Image 2 (exact 1344×768, quality=high)	45	held (round columns at pier cells, all masses placed)	7 vs 8, Δ −1.0 IN BAND
Flux 2 Max (match_input)	24	mostly held; hallucinated tomb→fire-pit + exterior ground	not panelled
Seedream 5.0 Pro	9	full recompose (rebuilt cutaway walls, dais, niches) — #1556 class	not panelled

Compare last night's Δ −5/−6 for everything gate-compatible. The chain now closes end-to-end for the first time: geometry → kit scene (seg gate 100.00%) → 3D depth → flux base (0.9752) → schema-correct structure-holding edit → panel IN BAND.

Honest open gate: the forensic registration instrument reads the styled finalists at 45/39% — but it reads ALL painterly images this way (documented light-pool + dark-mass classes; it scored the shipped plate 48.4% and even the raw kit render 58-72%). It cannot certify painterly layers; that's what the seg gate + provenance are for. The styled layer's formal per-object verification is the ONE remaining check: next round re-runs the winner with all four braziers lit so the 4-point beacon err_cells solve is valid (last night's solves were fitting on 2 fires = meaningless).

Also corrected for the record: MAI's corrected-payload job is still processing (d4) — its result completes the ranking. Evidence: d5/ artifacts + submitted bodies + heatmaps at LEXAR g4-build/artifacts/d5/. ~103 CU this round.

[100yenadmin]

d6 fire round (2026-07-23 ~03:00): GPT Image 2 fire plate = the run's strongest candidate; beacon instrument declared unfit for painterly plates

With the all-four-braziers-lit clause, GPT Image 2 produced fires at exactly the authored beacon cells with structure held (eyeball) — raw err_cells 0.79 → warp 0.41, BUT the solve's internals are invalid on this class: n_blobs=27 (painterly glow highlights everywhere), fitted_ortho 20.8 vs stamped 11.8 = the correspondence is garbage, so neither 0.79 nor 0.41 is meaningful. Gemini-3-Pro-fire read 2.88 for the same reason. Verdict recorded: the beacon blob-solve joins the coverage stat as unfit for rich painterly plates. The styled-layer formal gate must be a PER-OBJECT VQA check (candidate vs base object positions — the adjudicated-VQA machinery from the coherence instruments): tomorrow's build, charter noted here.

Candidate plate of record: d6/gpt_image_2_fire.png (panel-in-band family Δ−1.0, fires at beacons, structure eyeball-held over the provenance-perfect base). Runner-up: d5 Gemini 3 Pro (best recall 0.886, 2K native).

Also for the record per the owner's steer: Scenario on-platform workflows are API-accessible (workflow_create/run via MCP) and the account currently has ZERO defined — candidate: codify base→edit→verify as an on-platform workflow. Flux 2 family confirmed present (Max/Pro/Flex/Dev + klein LoRA-trainable bases; flux.2-dev-lora model type exists) — our painterly LoRAs are all Flux-1-era; retraining on Flux 2 is a real lever (training spend = owner gate). ~198 CU total tonight.

[100yenadmin]

MAI correction (2026-07-23 ~03:15): the corrected schema-conformant job (job_7YUbMkC6d3Z6K2xbYnnHM9iw — verified clean payload, prompt 2500/4096) ALSO hung at warming-up 15+ min with no error field, statusHistory stuck at queued. So the honest two-cause verdict: (1) my three earlier payloads WERE malformed (invalid numSamples/resolution — owner's diagnosis correct, schema-first rule now standing), AND (2) MAI's Scenario worker pool is genuinely not picking up jobs right now — every other model completed in <3 min tonight. MAI stays parked for a later retry; GPT Image 2 + Gemini 3 Pro carry the styled-plate lane (both in-band, both structure-holding). Note: the stuck jobs show billing.cuCost 12 each — verify whether warming-up-timeouts actually charge (≤48 CU exposure if so).

[100yenadmin]

d7 round (2026-07-23 ~03:45) — style-mix + tamed Seedream + Flux2-LoRA probe, panelled

Owner-suggested experiments, all run inline schema-first:

candidate	structure (eyeball)	panel	verdict
gemini_pro_mix (base=layout + owner's 10/10 Seedream as STYLE ref)	held; all 4 fires at authored cells; buttresses restyled stone→crates (footprint intact)	6 vs 8, Δ−2.0	band edge — my eyeball read it higher; the blind ruler flagged 'blank gravestones, flat crate row'
seedream_locked (edit-framed lock + cutaway callout)	HELD — Seedream tamed for the first time (no recompose)	6 vs 8, Δ−2.0	band edge; style reads 3D-render not painterly
flux2_v2lora (Flux2-dev + owner's v2 PoE2 LoRA via referenceImages)	held; 1 stray extra fire; grey backdrop	(panelled low)	the Flux2+LoRA edit path WORKS mechanically — a fresh Flux2 train is the quality lever
(d6 champion) gpt_image_2_fire	held; 4 fires at beacons	7 vs 8, Δ−1.0	PLATE OF RECORD stands

Notes for the record: MAI normal (model_microsoft-mai-image-2-5) is txt2img-only — cannot edit; the edit variant stays parked on its worker-pool issue. Two memories written from the owner's feedback: schema-first model calls + check-it-yourself-first (diagnosis and creative iteration are Fable-inline).

Queue: (1) per-object VQA gate for the styled layer → formally certify the d6 champion; (2) adoption chain (manifest swap + registry allowlist proposal OWNER GATE + box build + sandbox walk gate + owner install); (3) fresh Flux 2 LoRA train (klein/dev base, curated PoE2 set) as the beauty-ceiling lever; (4) remaining 6 rooms through geometry→kit→depth→edit. ~270 CU total tonight.

[100yenadmin]

★★★★ ADOPTION EXECUTED (2026-07-23 ~04:45) — KIT-CRYPT v1 is the first fully-certified 3D-first plate; PR #1688 armed; box build running

Winner: Gemini 3.0 Pro, critique-targeted round (d8_gemini_a) — blind panel 7 vs control 8 (Δ−1.0, in-band), phase-correlation ALIGNED dx=0,dy=0 against the depth-proven base, knight effigy + carved knotwork + all four fires at authored brazier cells. Runner-up standings: d6 GPT-2 champion warped-to-aligned 6.5 (Δ−1.5); three others Δ−2.

The styled-layer gate that closed the last link (built tonight, numpy-only): qa/styled_align_check.py — FFT phase correlation at multi-scale between styled plate and flux base. Control experiment proved the OLD forensic instruments (coverage NCC, beacon solve) mis-read even the depth-proven base — the kit pipeline's registration certification is: seg gate 100% (scene↔walkmask) + depth-locked base (0.9752) + styled ALIGNED (≤1px) = registered by construction, measured at every link. GPT-2's uniform 26px drift (caught by the aligner, invisible to eyeball) validated the gate red-first.

Shipped in PR #1688: the plate (geometric void composite via the seg-frame mask), manifest swap (ortho pin preserved, boxes unchanged, +4 runtime fire effects at brazier cells), the alignment gate, seg evidence. ⚠ Owner gate flagged: model_google-gemini-pro-image-editing → registry allowlist.

In flight: box player build (kit scene root removed + scene saved first — the QA construction must not ship embedded). On build: sandbox walk gate → frames → owner install. ~410 CU tonight.

[100yenadmin]

★★★★★ SHIPPED TO THE OWNER (2026-07-23 ~05:40) — the certified kit-crypt is LIVE on the owner's machine

Owner frame verified (their world: To Tavern/To Throne Hall labels, Aldric, no monsters — the QA-rig frame was caught and discarded by the serving-identity check first): the painterly certified plate renders in their installed player, with the walk-behind silhouette composing correctly against it. Install: backup at ~/worldos-session-notes/kitcrypt-2026-07-23/backup-preinstall-20260722T193315Z, xattr+codesign, double-kickstart. No reseed needed — the plate adopts by location id over the UNCHANGED walkslice grid.

Two more real defects were caught and fixed by pixels-before-credit during the ship chain:

1. The built scene still carried the kit 3D construction (first clean ran against a different open scene — fixed by opening the canonical scene explicitly; grep-verified on disk).
2. The PaintedBackdrop billboard renderer was saved DISABLED into the scene — legacy of the Beautify-import domain reload killing a capture mid-isolation (the finally never ran), then kit builds saving that state. Every plate rendered black until re-enabled. 35 renderers restored, logged. ⚠ Runbook lesson: after any editor crash/reload during capture work, audit disabled renderers before building.

Sandbox verification on the shipped binary: walk gate — 36/36 open cells, 26/26 impassable rejections, 2/2 doors, 36/36 paths (the only 2 'fails' = goblin-occupied cells where the engine correctly refuses to stack). Fire effects spawn at all 4 authored brazier cells (Hovl legacy-shader warning noted — flames render dim; polish item).

The owner's 6-week problem, closed end-to-end in one night: geometry → kit 3D scene (seg gate 100.00%) → 3D depth → flux base (0.9752) → Gemini 3 Pro edit (panel 7 vs 8, in-band) → phase-corr aligned → adopted → box build → walk green → installed. NEXT: replicate the chain on the remaining rooms starting with the tavern — the 'stone cold every time' proof. PR #1688 auto-merging.

[100yenadmin]

★★ TAVERN REPLICATED (2026-07-23 ~07:00) — second room through the certified chain in ~80 minutes, PR #1689 armed

link	crypt (first, 8 builder rounds)	tavern (replication)
seg gate	100.00% after r1→r8d	100.00% FIRST TRY (0/154, zero iteration)
flux base recall	0.9752	0.983 / 0.976 / 0.974
edit alignment	dx=0	dx=0 both outputs
panel	7 vs 8, Δ−1.0	7 vs 8, Δ−1.0 (c1 without furniture grounding: 6/Δ−2.0)

New load-bearing recipe clause discovered: FURNITURE-IDENTITY grounding — naming what each kit mass IS ('the long counter-shaped mass is the BAR — worn oak, brass rail; the square boxes are round oak TABLES…') moved the panel a full point in one cycle while alignment stayed dx=0. Recorded in the manifest provenance; belongs in the recipe schema next.

The winner: timber-frame + stone walls, roaring hearth, iron-hooped barrel stacks, carved bar with brass rail, tables with mugs — every mass on its authored footprint. Box build packaging BOTH kit plates running → tavern walk gate → owner install #2. The chain is now demonstrably a PROCESS, not an artifact: crypt ~8 hours including all instrument-building; tavern ~80 minutes using it.

[100yenadmin]

Tavern ship-gate: WITHHELD on an honest eyeball catch (2026-07-23 ~07:45) — grey occluder tops over the new plate's furniture

Tavern walk gate on the new build: FULL GREEN — 30/30 reachable, 21/21 impassable, 2/2 doors, 30/30 paths, zero fails. Plate renders beautifully live. BUT the eyeball caught grey proxy slabs standing above the painted tables/bar/candelabra bases: the tavern_v2 boxes sidecar's occlusion volumes (built chunky for the OLD plate's depth cues) are TALLER than the new painting's furniture, and their exposed tops render visible. Ruled out: truth overlay (sandbox doesn't set it), stale saved objects (37 purged, rebuilt, still present — so runtime-built).

Owner install of the tavern build WITHHELD (pixels-before-credit). The owner's current install is unaffected — its old tavern plate matches the old proxy heights; their crypt remains the certified kit plate.

Diagnosis queue (next session, fresh eyes): (1) why are the proxies VISIBLE at all — expected ColorMask-0/renderer-off; check the occluder material path in CombatSurfaceClient for a stripped-shader fallback (the #1674 class — the always-included list carries only OccluderDepth+ActorSilhouette); (2) if visibility is by-design-when-material-fails, the fix is baking the occluder shader into EnsureAlwaysIncludedShaders; (3) independently, regenerate the tavern sidecar volumes from the KIT scene's real mass heights (the kit knows every mass's true height — the sidecar should inherit it). Scene hygiene fix that DID land: 37 stale saved runtime objects (Occluder_/Actor_/HP_*) purged from the canonical scene + the PaintedBackdrop-disabled trap documented.

Night ledger: crypt SHIPPED to owner (certified end-to-end) · tavern adopted on main (PR #1689) + walk-green + one named visual defect blocking install · process replication proven (100.00% seg first-try, ~80 min/room) · ~520 CU.