P0 PROGRAM: reliable Effect Native Desktop/mobile coding and fleet software

July 13, 2026 · View on GitHub

Owner direction

Desktop and mobile are the active product clients. OpenAgents web remains a supported public/API/operations surface, but web expansion does not preempt the reliability program. The Sarah product surface is removed. Any future assistant must consume the same typed actions without becoming a new authority or front door.

Both clients use one Effect Native application/component/intent grammar and one Khala Sync identity/state/outcome reality:

OpenAgents mobile <---- Khala Sync ----> OpenAgents Desktop
remote coding + fleet                    full workbench + fleet

Program tracks and bounded work

  • #8574 — Desktop D0–D6 implementation is represented by closed CUT-01 through CUT-26; #8707 remains the exact ordinary local-coding acceptance and reconciliation gate.
  • #8597 — mobile's bounded local-cutover rung also remains gated by #8707. Its literal remote-workroom, host-movement, any-host control, voice, signed dogfood, and legacy-retirement exit remains owned by PORT-03 through PORT-08.
  • closed #8547/#8636 — accepted managed Agent Computer execution and the bounded concurrent owner-local/managed-cloud hybrid-routing proof. They do not prove portable host movement or provider breadth.
  • closed #8638 — existing Fleet substrate consumed by the clients; it is not another epic.
  • closed #8640 — bounded accepted simultaneous Codex+Claude runtime substrate proof only; it does not replace CUT-27 client acceptance.
  • closed #8675 — real-Electron acceptance of the landed loss-accounted Codex trace workspace and its UX promise.
  • closed #8676 — one real streamed Desktop conversation immediately continued on mobile through the same confirmed refs and request processor.
  • closed #8677 — the bounded command/event fault-convergence matrix for that seam.
  • closed #8678 — #8683/#8684 complete its source-coupled Effect topology, ambient-authority denial, replaceability, lifecycle, correlation, and full-host residual.
  • closed #8681–#8706 plus open #8707 — the ordered CUT-01–CUT-27 installed Codex/Claude cutover graph. #8707 alone owns the remaining named-Claude, per-counted-task cross-device, consolidated-evidence, and default-surface declaration gates.
  • closed #8733 and #8734–#8740 plus open #8741 — the separately tracked P1-parallel persistent Desktop audio MVP. AUDIO-8 remains an independent owner-microphone/evidence gate; voice/A/V/presentation is not a #8574 or #8566 exit criterion and does not block CUT-27 or program closure.
  • closed PORT-00 through PORT-02 #8745–#8747 plus open PORT-03 through PORT-08 #8748–#8753 — the ordered portable-session, broker, real-move, owner-managed/managed-provider, mobile any-host, session-neutral voice, and signed R7 dogfood packet. Keep these residuals explicit; no local CUT, #8547/#8636, or AUDIO receipt manufactures them.

The retired web/presentation/privacy-backlog records #8595, #8610, #8634, #8635, #8642, #8643, #8646, and #8650 are closed wontfix / not-planned. Production defects and real privacy requests get a new bounded incident or task; these backlog tombstones are not dormant epics.

Shared implementation laws

  • Effect Native owns typed components, state, intents, and command IDs; Electron/React Native/DOM/native/canvas are hosts or renderers.
  • Khala Sync owns canonical cross-device projections and durable mutation outcomes. Device-local state is cache/offline queue, never a second authority.
  • Pylon/Worker/Cloud/data/payment services retain their own typed authority.
  • Desktop and mobile may expose different capabilities but share identifiers, versions, outcome grammar, privacy classes, and receipt refs.
  • Every mutation carries owner scope, target ref, idempotency, version/ commutative semantics, and durable accepted/rejected/failed/unknown outcome.
  • Existing auth, promise, receipt, payment, release, and security contracts stay green through migration.
  • Deprecated mobile and Electrobun clients are extraction sources, not conversion targets or parallel shipping products.
  • New shared component/host demand goes upstream; app-local state/UI architectures do not regrow.
  • Process, WorkContext, conversation/run, request/command, and foreign-host/ view scopes are explicit. Wider scopes never capture narrower authority; ambient cwd, AsyncLocalStorage, renderer paths, and module singletons do not select runtime authority.
  • Embedded, local, remote, mobile, and test adapters enter one canonical request processor. ManagedRuntime, Promise, Electron, provider, and native callback bridges remain named perimeter modules.
  • Cancellation remains Effect interruption with owned finalization. A broad error adapter never converts interruption or a defect into ordinary tool success/failure.
  • Every human-visible P0 milestone has a checked UX/behavior contract plus the real host/device smoke appropriate to its proof rung. Fixture green is not owner-visible acceptance.
  • Pointer, tap, palette, menu, and conflict-safe hotkeys dispatch the same typed supervision intent. Public-safe acceptance evidence reuses the existing QA receipt machinery rather than creating a second broad QA program.
  • Agent topology is durable session state: children stay attached to the root, open independent transcripts, repair the derived current projection from the authoritative durable log, and move under graph-wide attachment fencing.

R0–R7 exit

  1. Desktop and mobile are truthfully green from clean state.
  2. Both use one authenticated owner/org/device/session contract.
  3. Loss-accounted local Codex history remains predictable under its executable UX promise, without becoming Sync authority or exposing raw local data.
  4. Conversation/project/agent-graph/Fleet/work/attempt/approval/command/outcome/ receipt state converges through Khala Sync across restart, handoff, and graph-wide host movement without an orphaned source child.
  5. One real Codex+Claude FleetRun completes through named isolated accounts; its later client observation/control remains owned by the client tracks.
  6. Offline, lost-ack, out-of-order, stale generation, refetch, restart, migration, and rollback behavior fails closed and converges.
  7. Desktop completes D0–D6 practical OpenCode parity; mobile completes R6 compact remote coding plus fleet control through typed workroom capabilities without unsafe local filesystem/process/credential authority.
  8. Signed/installable iOS, Android, and Desktop releases survive sustained owner dogfood with exact receipts.
  9. Legacy product/install/release/update paths are deleted or unable to ship only after successor and migration proof.

#8566 closes last, after child issues, R7, issue/docs reconciliation, and legacy retirement agree. Sarah/persona/A/V/presentation work is not an exit criterion.