Chat-first UI follows canonical-memory whitelist

.github/scripts/product_file_line_count_ratchet_baseline.json

@@ -16,63 +16,63 @@
     "backend/utils/sync/pipeline.py": 2296,
     "desktop/macos/Backend-Rust/src/routes/proxy.rs": 2741,
     "desktop/macos/Desktop/Sources/AuthService.swift": 3281,
-    "desktop/macos/Desktop/Sources/Chat/AgentBridge.swift": 2109,
-    "desktop/macos/Desktop/Sources/Chat/AgentRuntimeProcess.swift": 4242,
+    "desktop/macos/Desktop/Sources/Chat/AgentBridge.swift": 2089,
+    "desktop/macos/Desktop/Sources/Chat/AgentRuntimeProcess.swift": 4353,
     "desktop/macos/Desktop/Sources/CloudConnectorFormAutomation.swift": 1678,
-    "desktop/macos/Desktop/Sources/DesktopAutomationBridge.swift": 4183,
+    "desktop/macos/Desktop/Sources/DesktopAutomationBridge.swift": 4206,
     "desktop/macos/Desktop/Sources/FloatingControlBar/AgentPill.swift": 2479,
-    "desktop/macos/Desktop/Sources/FloatingControlBar/FloatingControlBarView.swift": 2808,
-    "desktop/macos/Desktop/Sources/FloatingControlBar/FloatingControlBarWindow.swift": 5006,
+    "desktop/macos/Desktop/Sources/FloatingControlBar/FloatingControlBarView.swift": 2811,
+    "desktop/macos/Desktop/Sources/FloatingControlBar/FloatingControlBarWindow.swift": 5007,
     "desktop/macos/Desktop/Sources/FloatingControlBar/PushToTalkManager.swift": 2423,
     "desktop/macos/Desktop/Sources/FloatingControlBar/RealtimeHubSession.swift": 1621,
-    "desktop/macos/Desktop/Sources/MainWindow/Components/ChatBubble.swift": 1931,
+    "desktop/macos/Desktop/Sources/MainWindow/Components/ChatBubble.swift": 2044,
     "desktop/macos/Desktop/Sources/MainWindow/Pages/AppsPage.swift": 3643,
-    "desktop/macos/Desktop/Sources/MainWindow/Pages/DashboardPage.swift": 4448,
+    "desktop/macos/Desktop/Sources/MainWindow/Pages/DashboardPage.swift": 4482,
     "desktop/macos/Desktop/Sources/MainWindow/Pages/MemoriesPage.swift": 3243,
     "desktop/macos/Desktop/Sources/MainWindow/Pages/TasksPage.swift": 5490,
     "desktop/macos/Desktop/Sources/MainWindow/SidebarView.swift": 1570,
     "desktop/macos/Desktop/Sources/MemoryExportService.swift": 1578,
     "desktop/macos/Desktop/Sources/OmiApp.swift": 1634,
-    "desktop/macos/Desktop/Sources/Onboarding/OnboardingChatView.swift": 2197,
+    "desktop/macos/Desktop/Sources/Onboarding/OnboardingChatView.swift": 2199,
     "desktop/macos/Desktop/Sources/Onboarding/OnboardingPagedIntroCoordinator.swift": 1654,
     "desktop/macos/Desktop/Sources/ProactiveAssistants/Assistants/TaskExtraction/TaskAssistant.swift": 1706,
     "desktop/macos/Desktop/Sources/ProactiveAssistants/ProactiveAssistantsPlugin.swift": 1608,
-    "desktop/macos/Desktop/Sources/Providers/ChatProvider.swift": 6215,
-    "desktop/macos/Desktop/Sources/Providers/ChatToolExecutor.swift": 2840,
+    "desktop/macos/Desktop/Sources/Providers/ChatProvider.swift": 6701,
+    "desktop/macos/Desktop/Sources/Providers/ChatToolExecutor.swift": 2865,
     "desktop/macos/Desktop/Sources/Rewind/Core/ActionItemStorage.swift": 1610,
     "desktop/macos/Desktop/Sources/Rewind/Core/RewindDatabase.swift": 3501,
     "desktop/macos/Desktop/Sources/Rewind/UI/RewindPage.swift": 1907,
-    "desktop/macos/Desktop/Sources/Stores/TasksStore.swift": 2949,
+    "desktop/macos/Desktop/Sources/Stores/TasksStore.swift": 3104,
     "desktop/macos/Desktop/Sources/VoiceTurnDomain/VoiceTurnStateMachine.swift": 2155
   },
   "raise_justifications": {
     "desktop/macos/Desktop/Sources/AuthService.swift": "Pinned swift-format normalizes line layout without changing this source's runtime behavior.",
     "desktop/macos/Desktop/Sources/Chat/AgentBridge.swift": "Strict concurrency annotations (Ticket 14) add Sendable conformances and isolation qualifiers without changing runtime behavior.",
-    "desktop/macos/Desktop/Sources/Chat/AgentRuntimeProcess.swift": "Strict concurrency annotations (Ticket 14) add Sendable conformances and isolation qualifiers without changing runtime behavior.",
-    "desktop/macos/Desktop/Sources/DesktopAutomationBridge.swift": "Strict concurrency annotations (Ticket 14) add Sendable conformances and isolation qualifiers without changing runtime behavior.",
+    "desktop/macos/Desktop/Sources/Chat/AgentRuntimeProcess.swift": "Chat-first capability projection and journal integration keep the enrolled-user shell synchronized with the agent runtime.",
+    "desktop/macos/Desktop/Sources/DesktopAutomationBridge.swift": "Automation bridge actions expose the Chat-first shell controls needed for deterministic desktop flow coverage.",
     "desktop/macos/Desktop/Sources/FloatingControlBar/AgentPill.swift": "Agent completion presentation now follows the canonical terminal lifecycle used by PTT and chat.",
-    "desktop/macos/Desktop/Sources/FloatingControlBar/FloatingControlBarView.swift": "Strict concurrency annotations (Ticket 14) add Sendable conformances and isolation qualifiers without changing runtime behavior.",
-    "desktop/macos/Desktop/Sources/FloatingControlBar/FloatingControlBarWindow.swift": "Strict concurrency annotations (Ticket 14) add Sendable conformances and isolation qualifiers without changing runtime behavior.",
+    "desktop/macos/Desktop/Sources/FloatingControlBar/FloatingControlBarView.swift": "The compact control bar forwards selected Chat-first interaction state without creating a second chat surface.",
+    "desktop/macos/Desktop/Sources/FloatingControlBar/FloatingControlBarWindow.swift": "Window routing preserves the main Chat-first surface while the compact control bar remains push-to-talk only.",
     "desktop/macos/Desktop/Sources/FloatingControlBar/PushToTalkManager.swift": "Strict concurrency annotations (Ticket 14) add Sendable conformances and isolation qualifiers without changing runtime behavior.",
     "desktop/macos/Desktop/Sources/FloatingControlBar/RealtimeHubSession.swift": "Strict concurrency annotations (Ticket 14) add Sendable conformances and isolation qualifiers without changing runtime behavior.",
-    "desktop/macos/Desktop/Sources/MainWindow/Components/ChatBubble.swift": "Strict concurrency annotations (Ticket 14) add Sendable conformances and isolation qualifiers without changing runtime behavior.",
+    "desktop/macos/Desktop/Sources/MainWindow/Components/ChatBubble.swift": "Chat bubbles render validated rich task, goal, and question blocks for enrolled canonical-memory users.",
     "desktop/macos/Desktop/Sources/MainWindow/Pages/AppsPage.swift": "Rebase reconciliation applies the pinned swift-format to the main-branch app-detail safety fixes; runtime behavior is unchanged.",
-    "desktop/macos/Desktop/Sources/MainWindow/Pages/DashboardPage.swift": "Pinned swift-format normalizes line layout without changing this source's runtime behavior.",
+    "desktop/macos/Desktop/Sources/MainWindow/Pages/DashboardPage.swift": "The dashboard selects the Chat-first shell only from the canonical-memory cohort capability projection.",
     "desktop/macos/Desktop/Sources/MainWindow/Pages/MemoriesPage.swift": "Pinned swift-format normalizes line layout without changing this source's runtime behavior.",
     "desktop/macos/Desktop/Sources/MainWindow/Pages/TasksPage.swift": "Strict concurrency annotations (Ticket 14) add Sendable conformances and isolation qualifiers without changing runtime behavior.",
     "desktop/macos/Desktop/Sources/MainWindow/SidebarView.swift": "Strict concurrency imports annotate legacy AppKit image usage without changing runtime behavior.",
     "desktop/macos/Desktop/Sources/MemoryExportService.swift": "Pinned swift-format normalizes line layout without changing this source's runtime behavior.",
     "desktop/macos/Desktop/Sources/OmiApp.swift": "Strict concurrency annotations (Ticket 14) add Sendable conformances and isolation qualifiers without changing runtime behavior.",
-    "desktop/macos/Desktop/Sources/Onboarding/OnboardingChatView.swift": "Pinned swift-format normalizes line layout without changing this source's runtime behavior.",
+    "desktop/macos/Desktop/Sources/Onboarding/OnboardingChatView.swift": "Onboarding maintains the same capability-safe chat presentation as the enrolled-user main window.",
     "desktop/macos/Desktop/Sources/Onboarding/OnboardingPagedIntroCoordinator.swift": "Pinned swift-format normalizes line layout without changing this source's runtime behavior.",
     "desktop/macos/Desktop/Sources/ProactiveAssistants/Assistants/TaskExtraction/TaskAssistant.swift": "Strict concurrency annotations (Ticket 14) add Sendable conformances and isolation qualifiers without changing runtime behavior.",
     "desktop/macos/Desktop/Sources/ProactiveAssistants/ProactiveAssistantsPlugin.swift": "Strict concurrency annotations (Ticket 14) add Sendable conformances and isolation qualifiers without changing runtime behavior.",
-    "desktop/macos/Desktop/Sources/Providers/ChatProvider.swift": "Adds carryingLocalOnlyFields projection guard so journal replay preserves local-only row state (metadata/rating/notificationScreenshot); INV-CHAT-1 write-path fix.",
-    "desktop/macos/Desktop/Sources/Providers/ChatToolExecutor.swift": "Strict concurrency cleanup keeps non-Sendable JSON payloads behind checked boundaries without changing runtime behavior.",
+    "desktop/macos/Desktop/Sources/Providers/ChatProvider.swift": "Chat-first rich-block handling, answer submission, and task completion use the server capability projection and canonical task APIs.",
+    "desktop/macos/Desktop/Sources/Providers/ChatToolExecutor.swift": "Tool execution adds validated canonical task and goal interactions for rendered Chat-first blocks.",
     "desktop/macos/Desktop/Sources/Rewind/Core/ActionItemStorage.swift": "Strict concurrency annotations (Ticket 14) add Sendable conformances and isolation qualifiers without changing runtime behavior.",
     "desktop/macos/Desktop/Sources/Rewind/Core/RewindDatabase.swift": "Pinned swift-format normalizes line layout without changing this source's runtime behavior.",
     "desktop/macos/Desktop/Sources/Rewind/UI/RewindPage.swift": "Strict concurrency cleanup unwraps actor-safe screenshot image boxes at UI boundary without changing rendering behavior.",
-    "desktop/macos/Desktop/Sources/Stores/TasksStore.swift": "Strict concurrency annotations (Ticket 14) add Sendable conformances and isolation qualifiers without changing runtime behavior.",
+    "desktop/macos/Desktop/Sources/Stores/TasksStore.swift": "The task store carries canonical goal badges, completion state, and navigation for the enrolled-user Chat-first pages.",
     "desktop/macos/Desktop/Sources/VoiceTurnDomain/VoiceTurnStateMachine.swift": "The strict VoiceTurnDomain target centralizes reducer ownership and moves the lifecycle state machine intact."
   },
   "threshold": 1500

Makefile

@@ -3,8 +3,11 @@ HOOKS_DIR := $(shell git rev-parse --git-path hooks)
 PYTHON ?= $(shell if [ -x backend/venv/bin/python ]; then printf backend/venv/bin/python; else printf python3; fi)
 DESKTOP_USER ?= alice
 DESKTOP_APP_NAME ?=
+CHAT_FIRST_E2E_ACTION ?= prepare
+CHAT_FIRST_E2E_CASE ?= enabled
+CHAT_FIRST_E2E_SECONDS ?= 86400
 
-.PHONY: setup setup-main setup-hooks preflight runtime-image-source-closure runtime-image-smoke dev-check dev-up dev-status dev-summary dev-reset dev-down dev-logs dev dev-desktop dev-init dev-verify list-memory-scenarios seed-memory-scenario reset-memory-scenario desktop-run-local run-canonical-promotion
+.PHONY: setup setup-main setup-hooks preflight runtime-image-source-closure runtime-image-smoke dev-check dev-up dev-status dev-summary dev-reset dev-down dev-logs dev dev-desktop dev-init dev-verify list-memory-scenarios seed-memory-scenario reset-memory-scenario desktop-run-local chat-first-e2e-fixture run-canonical-promotion
 
 setup: setup-main setup-hooks
 	@echo "Worktree setup complete."
@@ -75,5 +78,8 @@ desktop-run-local:
 		PYTHON="$(PYTHON)" bash scripts/dev-harness/desktop-run-local.sh "$(DESKTOP_USER)"; \
 	fi
 
+chat-first-e2e-fixture:
+	PYTHON="$(PYTHON)" bash scripts/dev-harness/chat-first-e2e-fixture.sh "$(CHAT_FIRST_E2E_ACTION)" "$(CHAT_FIRST_E2E_CASE)" "$(CHAT_FIRST_E2E_SECONDS)"
+
 run-canonical-promotion:
 	PYTHON="$(PYTHON)" PYTHONPATH="scripts/dev-harness:backend$(if $(PYTHONPATH),:$(PYTHONPATH),)" $(PYTHON) scripts/dev-harness/run-canonical-promotion.py "$(PROMOTION_USER)"

backend/.env.template

@@ -1,10 +1,12 @@
 # Stage templates (local harness / cloud dev): see backend/.env.{local-dev,offline,dev,prod}.template
 # Copy one to backend/.env.<stage>, symlink backend/.env, set OMI_ENV_STAGE. See .envrc.example.
 
-# Memory rollout (canonical MEMORY_* env)
+# Canonical-memory maintenance controls. They never select a user, task
+# system, or Chat-first shell: those are selected only by the code-owned
+# CANONICAL_MEMORY_USERS whitelist in config/canonical_memory_cohort.py.
+# Keep these values aligned with maintenance-job readiness requirements.
 MEMORY_MODE=off
 MEMORY_ENABLED_USERS=
-# Canonical cohort: edit CANONICAL_MEMORY_USERS in utils/memory/memory_system.py (not env).
 MEMORY_CANONICAL_PROMOTION_CRON_ENABLED=false
 MEMORY_CANONICAL_PROMOTION_CRON_INTERVAL_HOURS=1
 MEMORY_V3_GET_ENABLED=false

backend/AGENTS.md

@@ -156,7 +156,7 @@ Helm charts: `backend/charts/{agent-proxy,agent-vm-reaper,backend-listen,backend
 - **nllb-translation** (`nllb_translation/`) — GPU translation service. Called by backend when `HOSTED_TRANSLATION_API_URL` is set and NLLB is selected.
 - **backend-sync** (`main.py`, same image as backend) — Cloud Run admission service for `/v2/sync-local-files`. The server classifies whole batches: recordings no more than six hours old enter `sync-jobs` (fresh), while older or untrusted batches enter `sync-backfill` and the scale-to-zero **backend-sync-backfill** worker. Fresh keeps its bounded inline fallback; backfill never falls into fresh/inline capacity. Backfill defaults to one in-flight job per UID, four processed speech hours per UID/day, 555 processed speech hours globally/day, a 30-day lookback, and four queue workers. Live fair-use reads only `realtime + sync_fresh`; `sync_backfill` is separately metered. A 45-day Firestore content ledger protects transcription and usage side effects across job expiry and re-upload. Audio playback merges (`/v1/sync/audio/*`) follow the same pattern via queue `audio-merge` building 30-day MP3 artifacts under `playback/` (`AUDIO_MERGE_DISPATCH_MODE`) — per-part files plus one dense per-conversation `conversation.mp3` whose spans manifest + audio_files fingerprint are stamped on the conversation doc (`conversation_audio`); a fingerprint mismatch after late chunks re-enqueues the build. In production, account deletion requires `ACCOUNT_DELETION_DISPATCH_MODE=cloud_tasks` and complete Cloud Tasks bindings to enqueue opaque job IDs to queue `account-deletion`, which posts `/v1/users/account-deletion-wipes/run`; startup rejects inline or incomplete configuration, reconciliation only re-dispatches tasks so the OIDC handler is the sole wipe executor, and the post-deploy queue-drain window accepts the former sync OIDC audience only for legacy UID payloads. API success is returned only after the deletion marker is persisted and the wipe task is durably enqueued.
 - **notifications-job** (`modal/job.py`) — Cron job, reads Firestore/Redis, sends push notifications and runs X connector sync. It has no canonical maintenance flags or Typesense secrets; its deploy workflow removes only those retired bindings and preserves unrelated notification/X-sync env.
-- **memory-maintenance-job** (`modal/memory_maintenance_job.py`) — Cloud Run Job and sole host for canonical ST→LT maintenance (TTL → consolidation → promotion). Manual deploy via `.github/workflows/gcp_memory_maintenance_job.yml`; auto-dev on push to `main` via `gcp_memory_maintenance_job_auto_dev.yml`. Enablement is a multi-var contract (`MEMORY_MODE`, `MEMORY_ENABLED_USERS`, cron/fast-track/consolidation flags) enforced by `backend/scripts/validate-backend-runtime-env.py`; prod stays `MEMORY_MODE=off` until Gate 3.
+- **memory-maintenance-job** (`modal/memory_maintenance_job.py`) — Cloud Run Job and sole host for canonical ST→LT maintenance (TTL → consolidation → promotion). Manual deploy via `.github/workflows/gcp_memory_maintenance_job.yml`; auto-dev on push to `main` via `gcp_memory_maintenance_job_auto_dev.yml`. Its multi-var runtime contract (`MEMORY_MODE`, `MEMORY_ENABLED_USERS`, cron/fast-track/consolidation flags) controls maintenance readiness only; user selection for canonical memory, tasks, and Chat-first is exclusively `CANONICAL_MEMORY_USERS` in `config/canonical_memory_cohort.py`.
 - **monitoring** (`backend/charts/monitoring/`) — Prometheus, Grafana, Loki, Alloy, alerts, and HPA metric adapters for backend services.
 - **agent-vm-reaper** (`backend/charts/agent-vm-reaper/`) — CronJob that deletes stale `omi-agent-*` GCE VMs left by desktop agent sandboxes.
 - **backend-secrets** (`backend/charts/backend-secrets/`) — ExternalSecret and SecretStore resources that sync backend runtime secrets into GKE namespaces.

backend/config/canonical_memory_cohort.py

@@ -0,0 +1,33 @@
+"""Code-owned canonical-memory entitlement selector.
+
+This deliberately dependency-free module is importable from database, utility,
+and router layers. It is the one source of truth for canonical memory, task
+intelligence, and Chat-first cohort membership.
+"""
+
+# This fixed Auth-emulator UID is a local-only E2E account. Its presence here
+# deliberately makes the harness use the same membership predicate as every
+# real account; the paired disabled fixture UID is intentionally absent.
+LOCAL_CHAT_FIRST_E2E_ENABLED_UID = 'omi-local-emulator-chat-first-enabled-v1'
+
+CANONICAL_MEMORY_USERS: frozenset[str] = frozenset(
+    {
+        "vi7SA9ckQCe4ccobWNxlbdcNdC23",  # david.d.zhang@gmail.com (prod Firebase: based-hardware)
+        LOCAL_CHAT_FIRST_E2E_ENABLED_UID,
+        # Next dogfood (re-enable soon):
+        # "viUv7GtdoHXbK1UBCDlPuTDuPgJ2",  # kodjima33@gmail.com (prod Firebase: based-hardware)
+    }
+)
+
+
+def is_canonical_memory_user(uid: str) -> bool:
+    """Return whether ``uid`` belongs to the sole canonical entitlement cohort."""
+
+    return bool(uid) and uid in CANONICAL_MEMORY_USERS
+
+
+__all__ = [
+    'CANONICAL_MEMORY_USERS',
+    'LOCAL_CHAT_FIRST_E2E_ENABLED_UID',
+    'is_canonical_memory_user',
+]