CONTRACT: add live conversation controls with continuous chat interaction

[schlessera]

Closes #960

What changed

Chat can capture and review live voice input and play PCM replies through one queue while ordinary backend text, tool progress, question cards and permission controls remain usable. Semantic commits use the existing host turn/follow-up path. The strip separates speech connection, actual capture and interaction; Leave, hide, disconnect and stale callbacks retain review text in its original draft and stop audio safely.

Why this shape

Implements the approved #960 interaction record on the #957 contract above both adapter layers. Built-in services remain manual-send profiles; provider/device qualification is #961. Additive advertised resumable pause, start correlation and independent backend selection preserve existing final stop and dictation behavior. A minor changeset names ui-sdk, ui-server and ui-react. Includes the observed local-only gh-stack head metadata clarification required by the repo's skill-maintenance rule.

Proof

Current head 76f6b903f6185baab7e1f2677a43b32b6435bbf3 adds the reviewed source-binding correction to the unchanged UI feature. Confirmation 39036449261 is in progress. Actual checkout c34cc8e0fe623798e4e4075c73c6652bded34ecd combines main 19b43c6d7e4d8e2b44b614fd6e0d431746349f90 and that head, tree d1b8c467bda4875a1caaa3ef6fc5cb1f6ca5e263. API and fetched object agree; all ten dispatch pins match that actual merged source. Runtime, native-host, packaging and types have passed; remaining categories are pending.

• Previous confirmation 39034594574 passes thirteen product jobs but unit2 fails two private chat-dispatch binding assertions. Reviewed controller wiring and terminal-question reconciliation changed exactly two of ten pinned sources. Both named failures reproduce locally; refreshing only those reviewed pins restores all existing tests. No registry/caller closure or guard is widened.

• The new UNREVIEWED_CHAT_HANDLER_REFUSED control fails with expected false/actual true when hash enforcement is removed, then passes after byte-for-byte restoration. Focused binding/closure proof passes 45 cases/270 assertions. Incremental corrective preflight against the inspected prior head passes 950 invariant checks plus 162 affected tests. Only two metadata/test files change; UI runtime code is unchanged.

• Retained feature preflight on 3eae038d092c7ea8f498f5b02e0c164bedb385cd: 724 fast cases pass; broad feedback has 4804 pass/1 fail in 349 files. The sole missing configured-wrapper version trace is filed separately as tests: attribute missing configured-wrapper version trace in broad feedback #2341; a 35-case isolated control passes but does not explain that broader failure. No whole feature-preflight pass is claimed.

• Combined permission source 97ab5adaf5a5956179f0ba846615daa3a3be69b6 passes all 39 pinned conversation/permission cases and both actual Chrome recovery cases/16 assertions. Its parent-relative complete preflight passes 724 fast checks plus 3950 affected cases. These keep their original identities; they are not relabelled as current-head hosted proof.

• Historical complete parent-local preflight: bun run check:pr --base feat/959-gpt-live-42413928 passed: 638 tests, 3806 assertions, 33 files.

• Retained UI-only pinned offline Chromium receipt: 28 browser scenarios passed, including native AudioWorklet capture, PCM source playback/cut, hold/timeout, late epochs, terminal cards, first-session draft binding, one-activation tracker navigation, busy follow-up deduplication and interactive question submission while chat keeps streaming. Both themes at 320 × 568 and desktop check 44px targets, transcript space, overflow and contrast; screenshots reviewed.

• Capture mutation marked a ready-but-unopened mic on: the named capture assertion failed (true versus false). Epoch mutation admitted an old Send callback into a new review candidate: the named epoch assertion failed. Commit mutation auto-submitted unknown fragments: the named commit-only assertion failed (one request versus zero).

• Flush mutation omitted stopping native scheduled sources: the named cut assertion failed because future sources did not end within 500ms. Terminal mutation removed host-terminal question reconciliation: the named card assertion failed because waiting controls remained. All mutations restored; all 28 scenarios passed again.

• Real host bridge: 47 tests / 166 assertions passed, including pending asynchronous work, retained resumable identity, explicit independent profile routing, opening correlation and ordinary card responses. The pause and profile regressions each failed first on the old behavior, then passed with their fixes. A refused-send browser regression failed first by losing the original candidate, then passed with once-only restoration.

• Full build and strict types passed before the final documentation-only integration. Current-parent API reports, citations, lint and other contribution guards passed in preflight. Selected hosted proof remains pending; no earlier run is represented as this combined tree's hosted proof.

Checklist

• Complete selected hosted proof passed on this candidate.
• Acceptance scenarios and all five named mutation guards have local runtime receipts.
• Release milestones read back before merge.
• A named minor changeset is included.
• Leakage and contribution guards passed.
• The normative wire contract is updated in the behavior commit.
• Relevant docs and moved citations are updated.

Anything left open

Hosted candidate proof and dependency integration remain before merge. No further rebase or long rerun is planned solely for unrelated main advancement. Exact permission announcements/refusal are #114; live recognition, echo, latency and reserved device measurements are #961. These capability limits remain visible and are not claimed as qualified.

[schlessera]

Current draft PR #2142 head 2ded64053f2ba6d952567d5defde82cf5b9886ff targets live GPT-Live parent da85ded4c25367a086fbee50e12ad99b5bc95249 in native stack #2135. Gemini #2063 has landed; all six GPT commits were rebased unchanged by GitHub. The UI layer was rebased onto that parent, preserving the main branch's reading-column markup and accounting documentation and repairing conflicting source citations. Range-diff shows no additional UI feature change.

Current focused checks pass: 699 tests / 4,420 assertions across 34 files, plus all initial lint/environment/changeset gates. The complete check:pr command is not claimed green: its subsequent import-graph feedback entered the existing browser-runtime build hook, hit the 180 s setup deadline, and the remainder was deliberately stopped. The earlier full hosted pass 38902984565 retains its original head/base/tree, rather than being relabeled as this rebased candidate.

The rebased permission layer's pinned browser run also exercises all 28 UI scenarios alongside 11 permission scenarios; all 39 pass with rebuilt SDK/client browser inputs. These cover real capture, output flushing, stale scope guards, continuing progress, interactive cards, draft ownership and both phone/desktop themes.

Delivery remains in dependency order. GPT's current-head confirmation 38933150766 is pending with its first job waiting for a hosted runner; native upper aggregate support is still tracked in #2141. Keep this PR draft until its lower layer can land and its resulting current candidate can be confirmed. Milestone remains 0.44.0. No live provider/device qualification is claimed.

[schlessera]

Current voice-stack delivery recheck, 2026-10-17: the frozen heads are GPT #2070 1a6cb2cefa0326f4e65421898e94fc3c4eb02122, UI #2142 7b87dff3113ae807b5a36f169d1aab2e2c784147, permission #2145 4c2dca7e4b79023fb236d3a94b75aa825e15f671 in native stack #2135. Gemini #2063 is already merged.

The current actual native merge chain again uses synthetic predecessors:

• GPT checkout e3da8cef9ce9a4f4cbdd713bbd85aceadee792fa: parents fixed trunk 8c4d191e761bec31f3267d3b612a77712692f54a / frozen GPT head, tree 0c5ecb958f1a4f0a9c0352fe70208d581ca9bcb4.
• UI checkout b10efee5ba865e89cbd6cce2759c1deaf5bb3450: parents GPT synthetic checkout / frozen UI head, tree f408f9e06ebbf0048b3ae2baae6ed95ce9a7aea9. Its declared live parent is the GPT branch head, not that synthetic commit.
• Permission checkout c7dac5c8e0dc7bfa832ff6abe57f1032204cd22c: parents UI synthetic checkout / frozen permission head, tree 8d13f1dca53d69003ce776a6b7f34d672995a9be. Its declared live parent is the UI branch head.

Immutable GitHub commit responses confirm all three identities. UI metadata job 117369693498 in draft run 39023456026 actually checks out the UI synthetic commit and records that tree/parent pair. This is metadata evidence, not full qualification. The unchanged exact-own-parent validator on the product branches cannot admit the two upper shapes.

Queued upper confirmation runs 39023921626 and 39023923038 were deliberately cancelled before selected expensive jobs, and both upper PRs returned to draft. These are not passing receipts. The valid bottom-layer request 39023395726 remains active for ordinary dependency-order delivery. No #2141 implementation, native-policy waiver, guard weakening or duplicate fix is introduced here.

Both upper layers pass 723 focused checks; the combined current source passes strict types, 39 pinned conversation browser scenarios and both native approval recovery cases (full package build in setup, 172.87 seconds total). Their supplemental import-graph runs encountered the existing 180-second build-hook timeout and were stopped after retaining the failed receipts; entire preflights are not claimed green. Keep complete hosted qualification as the remaining delivery bar.

[schlessera]

The current prepared stack is pushed; this layer remains draft, milestone 0.44.0. All feature commits compare unchanged by range-diff. Full source identities, historical CI and current blockers are recorded in the latest #2070 handoff.

Current top head cb250a48417c776b2679cf04156d6dd5917e956a passes a separate full build and all 39 pinned Chromium conversation/permission cases (29.54 seconds). Both async adapters pass 42 loopback cases at the matching current GPT layer. The current recovery setup separately fails its unchanged 180-second package-build hook; phase evidence is on #1600. Its earlier two passing recovery cases are historical, not a current-head result. No assertion, timeout or offline guard changed.

Delivery awaits the focused diagram source-binding repair #2322 / #2314, whose required preflight is blocked by #2153, then current selected hosted proof and dependency-order native merges. The latest draft gates pass but do not substitute for full product qualification. #114 retains its reserved human verification and stays open under Refs.

[schlessera]

Delivery resumed after #2326 landed the diagram binding repair. Current pushed heads: #2070 3dc08df98e155d08b9feda38ceb05ce68e82415f, #2142 3eae038d092c7ea8f498f5b02e0c164bedb385cd, #2145 97ab5adaf5a5956179f0ba846615daa3a3be69b6, base 7cc86931e763f0eca636b89abd78b3b5371ec027. GPT and permission feature commits compare unchanged; the UI range-diff differs only in an upstream backend citation offset, verified against the source.

Current focused adapters/binding proof passes 52 cases / 172 assertions; the named restart case also passes. GPT complete local preflight passes 542 invariant tests plus 25 affected feedback tests. Top-layer actual Chrome recovery passes both cases / 16 assertions (163.71 seconds), and all 39 pinned Chromium conversation cases pass (28.93 seconds). Delivered forward-closure builds complete under the unchanged setup budget; no guard or timeout change is included here. Upper-layer local preflights remain in progress, with UI fast invariants already passing 724 cases.

GPT is ready and confirmation 39032664018 is running all fourteen selected product categories. Contract and metadata pass. Actual checkout f9889eb78e00c38f1f94b2013242176d079adb72 has parents recorded base/current GPT head, tree 040dcebe25ead4aecb7cc22f32a99e3119185e7a; immutable API and fetched Git object agree. This identifies its candidate, not a completed whole-run result. Upper layers remain draft for dependency-order delivery. The obsolete #2314 blocker has been removed from #959.

[schlessera]

Corrective head 76f6b903f6185baab7e1f2677a43b32b6435bbf3 fixes the two source-binding omissions exposed by unit2 in confirmation39034594574. The controller/helper import and terminal-question handler changes were reviewed against their previously trusted bytes. Auditing all ten declarations finds exactly those two mismatches; only those two pins change. The registry shape, private copy, caller constraints and hash guard remain unchanged. Permission-layer code changes neither pinned source and will inherit the correction.

Both positive assertions fail first locally, matching CI. A new unreviewed-terminal-handler fixture stays refused; removing hash enforcement fails its explicit oracle (expected false, actual true), and the guard is restored byte-for-byte. Focused binding/closure checks pass45 cases/270 assertions. Incremental corrective preflight against prior native head d66418d passes950 fast checks plus162 affected tests. The correction changes only scripts/source-browser-dispatch.ts and its test.

Fresh confirmation39036449261 is running on actual merged checkout c34cc8e0fe623798e4e4075c73c6652bded34ecd, parents main 19b43c6d7e4d8e2b44b614fd6e0d431746349f90 / corrected head, tree d1b8c467bda4875a1caaa3ef6fc5cb1f6ca5e263. All ten pins independently match that actual checkout; metadata, both runtime categories, types and packaging pass. Remaining jobs are not yet green.

The separate old feature-feedback result is4804 pass/1 fail, with the configured-wrapper version-trace finding filed as #2341. Its35-case isolated control passes without explaining that broader failure. The permission layer's complete local preflight passes724 fast plus3950 feedback cases. Historical failures and all receipts retain their sources; no unchanged failing run was retried as a repair.

[schlessera]

Corrected UI head: 76f6b903f6185baab7e1f2677a43b32b6435bbf3.

Confirmation run 39036449261 completed all 14 selected product jobs successfully, plus metadata and the separate contract workflow. The four unit shards report 3,651 + 3,587 + 3,525 + 3,712 = 14,475 passing tests, zero failures/todos. The 28 unit skips are 24 opt-in paid image cases and four inactive sqlite-unavailable placeholder tests; the corresponding actual sqlite tests executed. All 28 conversation browser cases executed successfully in layout shard 1.

Actual product checkout: c34cc8e0fe623798e4e4075c73c6652bded34ecd, tree d1b8c467bda4875a1caaa3ef6fc5cb1f6ca5e263, parents 19b43c6d7e4d8e2b44b614fd6e0d431746349f90 and the inspected head. Product logs and all four unit checkout/resource/summary artifacts agree; all eight private worker checkouts agree, with distinct dependency inodes within each pair.

The overall workflow is failed, not green: aggregate validation reports Candidate checkout does not match the requested head/base merge identity. PR metadata still records base 18a65206d4ed5f6fc4790728293ac2ce72858026; the actual tested checkout incorporates the newer 19b43c6d7e4d8e2b44b614fd6e0d431746349f90 base. No product assertion failed. This identity failure is recorded separately from product execution, consistent with the maintainer instruction to continue without repeated full refreshes.

Live main advanced once more to bfaf3be35408e7983f6b525430118fa867c19d6a through #2316. Reviewed its entire three-file delta: only the answer-delivery browser test and a tested fixture clock helper change; no product code, proof gates or conversation implementation change. Retain the original proof identities rather than claim it tested this newer combination. Predicted normal merge tree on this main: 040abc02cd78bd0f2f1a463bda12ca3cccab913a.

PR and delivered issue #960 both retain milestone 0.44.0. No review/protection bypass requested; use the normal native stack merge. Live provider/device qualification remains reserved for #961.

[schlessera]

Post-merge automatic run 39037986346 finished with 13 successful product jobs and a failed unit shard 2 / aggregate. Actual squash checkout/tree/parent match the delivered receipt. Unit worker 2 reports zero failed assertions and one unhandled window is not defined React scheduler error between tests, matching the existing #2146 teardown/global-removal failure class. Added the exact hosted observation there; the preceding worker-host-notice group passed, and callback ownership remains unproven. This main run is failed, not green. The recorded pre-merge proof and merged tree identities remain unchanged; no merged branch was pushed or failing run retried.