The current desktop is no longer the broken prototype shown in earlier screenshots. Source and signed-package flow suites pass across desktop, compact, light, dark, 200% zoom, 500-turn sessions, queues, recovery, attachments, session operations, Outputs, and Connect. A real Codex turn read the correct isolated project, and a real Ask-mode overwrite displayed an approval and changed the file only after Allow once.
The primary contract is still not release-clean. The shared Markdown renderer removes intraword underscores from both user and assistant messages, the official live proof times out on that corruption, drafts are global and volatile rather than session-scoped, and the current local 0.9.2 artifact is signed but rejected by Gatekeeper as unnotarized. Accessibility, visual regression, cold-user success, and external-account coverage remain proof gaps.
VANTA_DESKTOP_AUDIT_... renders as VANTADESKTOPAUDIT_.... This can corrupt file names, environment variables, IDs, hashes, and exact-output tasks.The shell restores the project, active task, session rail, provider model, runtime state, and contextual inspector state.
Primary action: Select a task or New task - opens the central work stream.
The composer exposes project, host, registered tools, MCP, memory, model, access mode, and attached-file chips.
Primary action: Send - begins a kernel-gated turn.
Partial text, tool activity, runtime state, Stop, Background, and queued turns stay visible.
Primary action: Stop, queue, or wait - controls the active run.
Ask mode shows the exact action and reason. A real overwrite was blocked until Allow once and then verified on disk.
Primary action: Allow once or Reject - resolves the pending kernel action.
The transcript, tool receipts, changed-file evidence, Outputs, and contextual inspector preserve the work.
Primary action: Open output or continue - keeps the task context.
| Screen | Purpose | Primary action | States |
|---|---|---|---|
| Work shell | Resume a project/task | Select task | loading, ready, project/provider error |
| Conversation | Understand request, progress, and result | Send/Stop | empty, streaming, approval, failed, recovered |
| Composer | Submit outcome and context | Send/Queue | idle, busy, attached files, full-access warning |
| Inspector | Review activity, files, diff, preview, receipts | Open evidence | empty, populated, narrow drawer |
| Check | Verdict | Note |
|---|---|---|
| One dominant work surface | PASS | Central transcript remains the primary surface; inspector is contextual. |
| Visible agent state and control | PASS | Streaming, tools, Stop, Queue, approvals, receipts, and recovery are visible. |
| Preserve user input and exact output | FAIL | Drafts are not per-session/persistent, and intraword underscores are removed by rendering. |
| Explain model/runtime scope | WARN | The header can show gpt-5.5 while the runtime strip says No model; the two model layers are not named. |
Work, Operate, Outputs, and Connect remain in a fixed sidebar.
Primary action: Select destination - changes the main surface without changing project context.
Pinned project tasks and searchable recent sessions are separated.
Primary action: Open task - restores messages and view position.
Rename, pin, archive with Undo, recoverable Trash, bulk selection, and Shift-range selection are implemented.
Primary action: Archive, restore, or delete - updates the session store with feedback.
| Screen | Purpose | Primary action | States |
|---|---|---|---|
| Sidebar | Project and task navigation | Open task | pinned, recent, search, bulk mode, trash |
| Operate | Standing work and runtime oversight | Inspect run | idle, active, failed |
| Outputs | Review artifacts across tasks | Open artifact/source task | empty, filtered, populated |
| Check | Verdict | Note |
|---|---|---|
| Command palette is not the only navigation | PASS | Every primary destination has a persistent visible entry. |
| Destructive actions are recoverable | PASS | Archive Undo and recoverable Trash are covered by source and packaged flows. |
| Task context is stable while switching | WARN | The global composer draft can follow the operator into another session. |
Outcome cards summarize providers, capabilities, MCP, and messaging as ready, needs setup, or unavailable.
Primary action: Choose one connection - opens only the relevant setup.
Secrets remain private; Telegram validates against the API before saving and exposes pairing versus allowlist.
Primary action: Save and test - returns a readiness result.
The project gateway can start from Connect, while status and channel verification provide redacted evidence.
Primary action: Start gateway - enables channel delivery.
| Screen | Purpose | Primary action | States |
|---|---|---|---|
| Connect overview | Select an outcome | Browse/setup | ready, needs setup, unavailable |
| Model picker | Select provider and model scope | Use model | discovered, offline catalog, discovery error |
| MCP control | Authorize and inspect servers/tools | Connect/test | ready, unhealthy, auth required |
| Messaging setup | Configure a channel | Save/test/start | not configured, ready, failed |
| Check | Verdict | Note |
|---|---|---|
| Setup is outcome-oriented | PASS | Connect avoids a single long settings maze and /setup telegram routes directly. |
| Real channel evidence | WARN | Telegram connect/poll/disconnect is live now, but no audited inbound-message to Vanta-response round trip was executed in this audit. |
| Broad connector claims | PASS | Verification reports one live channel and 21 not configured rather than calling the catalog ready. |
The shell classifies project, provider, and service setup failures instead of replacing the app with a blank page.
Primary action: Retry or configure the affected dependency - stays in place.
Failed runs retain partial output, checkpoint data, and classified failure details.
Primary action: Retry failed step or edit request - resumes from evidence.
Receipts show whether the retried action actually completed.
Primary action: Review receipt - closes the trust loop.
| Screen | Purpose | Primary action | States |
|---|---|---|---|
| Startup error | Repair project/provider/runtime | Retry/configure | project, service, provider |
| Run recovery card | Resume interrupted work | Retry/edit | partial, failed, retrying, recovered |
| Approval card | Resolve blocked consequential action | Allow/reject | pending, accepted, rejected |
| Check | Verdict | Note |
|---|---|---|
| Error names cause and action | PASS | Startup and run errors are scoped and actionable. |
| Failure preserves partial work | PASS | Recovery fixtures pass in source and packaged applications. |
| Release proof fails diagnostically | FAIL | desktop:live-turn:proof waits 150 seconds for corrupted rendered text and emits no useful failure state. |
| Offline draft recovery | FAIL | The composer draft is React state only; reload/crash loses it. |
| Check | Result | What it does not establish |
|---|---|---|
| 24 Vitest files / 64 desktop tests | PASS | Does not prove Electron, real providers, or physical assistive technology. |
desktop:renderer:typecheck | PASS | Does not prove runtime behavior. |
| Source and packaged flow suites | PASS | Most flows use deterministic local fixtures; no notarization or paid external accounts. |
| Real Codex read in isolated desktop project | PARTIAL | Provider/root/tool path works; rendered output corrupts underscores. |
| Real Ask-mode overwrite | PASS | Proves one file-edit approval, not every tool/risk class. |
| Telegram verification | PASS | Proves connect/poll/disconnect, not a full inbound/outbound conversation. |
| Current local app signature | PARTIAL | Code signature is valid; Gatekeeper rejects the local candidate as unnotarized. The published CI 0.9.2 proof is separate. |