feat(desktop): consolidate consent-based runtime takeover and ownership contracts

[luvs01]

Summary

Consolidate #5459 and #5457 into one desktop ownership review. When the desktop finds an existing runtime, show the endpoint, configuration home and recorded owner before offering takeover. Approval uses the bundled CLI to stop, claim and start the runtime; declining preserves guest attachment. Unknown ownership, incompatible managing CLIs and unproven stop outcomes remain explicit failures or blocked takeover states.

• Carry all seven implementation contributions from feat(desktop): ask consent on attach and take over a foreign runtime with the bundled CLI #5459, preserve its inline consent script after the current desktop CSP/bootstrap changes, and retain contributor attribution.
• Carry docs(desktop): state runtime takeover acceptance #5457's ownership acceptance documentation and four contract tests. Clarify the existing distinction: relaunch consent reuse compares owner and installation ID, while a pending write revalidates the complete ownership subject, including consent generation.
• Integrate consent waiting with the current startup deadline. Consent, deadline and expiry publication share one lock; terminal state protection also covers delayed progress reports, so a late run cannot reopen a prompt after expiry. A reporting gate serializes state publication with event dispatch, preserving the same order on the page.

The source PRs remain open and unchanged. This proposal does not decide the separate policy questions around a stopped-but-unclaimed runtime or plain ocx start with a foreign owner. The existing retry rejection while a stalled run remains active is also unresolved; clearing the running flag alone would permit overlapping runs.

Verification

• Source heads: feat(desktop): ask consent on attach and take over a foreign runtime with the bundled CLI #5459 c0c6dd2ba4c81e4e40425020649573145e857073; docs(desktop): state runtime takeover acceptance #5457 8ed791675d6254e9eb09ca333888ab2a7bfa3dd8.
• Final integration head: 8d6b1e15d8cf9afed0d15c075810af4bb53e8275, based on dev a6b54297b03fc218105273887ce147c901848d89. All seven source carries preserve author, author date and credit. Five clean carries have equal zero-context patch IDs; two adapted carries preserve the current bootstrap and deadline integration. All 20 source file occurrences were classified; 13 implementation or test files match feat(desktop): ask consent on attach and take over a foreign runtime with the bundled CLI #5459 byte-for-byte, and docs(desktop): state runtime takeover acceptance #5457's four added contract tests are preserved.
• Earlier integrated CLI/desktop/service focused checks: 75 passed. The carried ownership contract file separately passed 13 tests. TypeScript and structure checks passed at the earlier integration head. The consent/expiry correction's surface checks passed 21 tests; these executions are separate evidence, not a final full-suite result.
• Integrated desktop contract/surface checks at e6277c19: 49 passed / 0 failed / 260 assertions across four files. The subsequent two commits contain only Rust formatting and terminal-payload indirection; TypeScript, documentation and test files are unchanged. The test wrapper installed missing dashboard dependencies into a normal directory in the isolated worktree; no shared dependency junction or live runtime was changed.
• Integrated TypeScript, structure SSOT, privacy and whitespace checks passed. Independent static review found the reported consent, terminal-publication and event-order races closed.
• Six new Rust regressions cover expiry publication, pending and answered consent, terminal prompt refusal, superseded guards, late reports and event order. Hosted validation first required one method-chain formatting correction, then flagged the 264-byte terminal payload in the expiry enum. 8d6b1e15d8 boxes that payload without changing the state machine or emitted data. The exact-head desktop shell job now passed Rust formatting, Clippy and Rust unit tests. Earlier failures are retained as such; no local Cargo execution is claimed.
• The consent page was rendered headlessly from the actual inline bootstrap page with synthetic IPC, endpoint and ownership data. This proves the displayed fixture only; actual takeover and platform WebView behavior remain unverified. Consent surface capture.
• The same hosted run subsequently ended cancelled with the remaining macOS jobs cancelled; its aggregate ci check reports failure. The completed Rust job remains a pass, but this is not a full cross-platform pass. Cancellation cause is not established by the available job records, and no automatic rerun is claimed.
• This remains draft. Full cross-platform CI, explicit security review and real desktop takeover validation are outstanding. No timeout, test skip or production budget was relaxed.

Checklist

• Scope stays focused and avoids unrelated cleanup.
• Docs or release notes were updated when needed.
• Security-sensitive changes were reviewed for secrets, auth, and unsafe defaults.

Co-authored-by: jun bitkyc08@gmail.com
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Co-authored-by: sanggyulee andy53295774@gmail.com

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

✅ Deterministic PR hygiene checks passed.

[lidge-jun]

리뷰 · 우선순위 58 / 80

이 PR은 데스크톱이 이미 떠 있는 런타임을 만났을 때, 그냥 손님으로 붙을지 주인으로 가져갈지 사용자에게 묻고, 가져가기로 하면 번들 CLI로 멈추고·소유를 적고·다시 시작하는 흐름을 한곳에 모은 작업이다. 원래 열려 있던 #5459(실제 가져가기·동의 UI·클레임)와 #5457(소유 수락 규칙·계약 테스트)을 dev 위로 한데 합쳤고, 동의 대기와 시작 마감·만료 실패·늦은 진행 보고가 서로 끼어들어 화면이 다시 열리거나 실패가 덮이지 않도록 잠금/보고 게이트도 고쳤다. 거절하면 손님으로 붙고, 소유를 못 읽거나 관리 CLI가 맞지 않으면 가져가기를 막는다. 초안(draft)이며 작성자도 정책·실기기 검증이 아직이라고 적어 두었다.

라인 - desktop/src-tauri/src/startup.rs take_over: 정지는 됐는데 service claim이 실패하면 런타임은 꺼진 채 소유 기록이 없는 상태로 끝난다. 코드/문서상 “다음 실행이 부재로 시작”을 허용하지만, 다른 설치·CLI가 그 공백을 어떻게 봐야 하는지는 아직 정책으로 닫히지 않았다.
라인 - desktop/ui/index.html 동의 안내: 가져가기 후에도 터미널의 평문 ocx start는 아직 막지 않는다고 화면에 적어 두었다. 동의로 주인이 바뀌었다고 사용자가 믿기 쉬운데, 실제 차단 범위는 ocx service start 쪽에 가깝다.
라인 - Startup.running / 재시도: PR 본문이 말하듯, 멈춘 채 running만 남은 실행이 있을 때 Retry만으로 겹쳐 돌 수 있는 문제는 이 PR에서 풀지 않았다. 동의·만료 레이스는 줄였지만 재시도 겹침은 남는다.
라인 - 검증 구멍: 작성 머신에 Cargo가 없어 로컬 Rust 실행이 없고, 보안 체크리스트도 미체크·draft다. TS/표면 테스트와 Rust 회귀 추가는 있으나, 실기기 가져가기·호스트 Rust/Clippy 통과를 머지 전 증거로 못 본다.
라인 - 원본 PR: #5459, #5457이 여전히 OPEN이다. 이 PR이 둘을 통합·대체하는 제안이면 무효/중복으로 닫을지 정리해야 한다.

메인테이너의 판단이 필요한 지점

정지 후 클레임 실패를 “허용된 부재”로 둘지, 아니면 복구·재시도·명시적 handback이 필요한 실패로 올릴지. 평문 ocx start를 언제 ownership-aware로 막을지(이 PR 범위 밖인지). draft를 ready로 올리기 전에 필수인 증거 목록(호스트 Rust 테스트, 실기기 takeover, 보안 리뷰)을 어디까지로 할지. #5459/#5457을 이 PR에 흡수해 닫을지.

너의 추천

방향(동의→정지 증명→클레임→시작, unknown/비호환은 손님·차단, 동의·마감 원자성)은 dev에 올릴 만한 한 줄기다. 다만 draft인 채 머지하지 말고, 호스트 Rust/포맷/Clippy와 실제 데스크톱 가져가기를 통과시킨 뒤 ready로 올린다. 정지·미클레임과 평문 ocx start는 머지 차단 이슈가 아니면 follow-up 이슈로 번호를 박고, #5459·#5457은 이 PR이 대체한다면 닫는 쪽이 맞다. 보안·소유권 경계라 체크리스트와 별도 보안 리뷰는 비워 두지 말 것.

이 댓글은 grok-bot이 작성했습니다

[lidge-jun]

Carried into #5619 at 8d6b1e1 with your authorship and the co-author trailers kept. The review screenshot stays in the #5619 description instead of the tree. Follow-ups revalidate ownership right before the stop and bind it to the approved runtime through an opt-in guarded stop. Unresolved or unreadable outcomes now fail closed before any claim. Closing in favor of #5619. Thank you!