Codex
e2ecfea69b
Rust checks / check (ubuntu-latest) (push) Canceled after 0s
Rust checks / check (windows-latest) (push) Canceled after 0s
Preserve current core, source, REST, desktop, recovery, documentation and validation work, including AGENTS.md and the development summary. This is a work-in-progress checkpoint: the new compact palette has outstanding compilation errors and native acceptance; earlier passing gates retain their documented scope.
155 lines
19 KiB
Markdown
155 lines
19 KiB
Markdown
# Linux GUI runtime pilot plan — 2026-09-07
|
||
|
||
**Proposal only. No guest/package/display changes, GUI build or native input were performed for this review.** Continue the active immutable core gate first. At07:51:38UTC the host had1,239MiB available memory and13.77GiB free disk; this is not enough headroom to add a competing GUI build/session during the current lease.
|
||
|
||
## Recommended sequence and established prerequisites
|
||
|
||
Use the retained Ubuntu24.04.4 guest, a QEMU GTK framebuffer window, a minimal Xorg/Openbox session, Mesa's software Vulkan driver and a session D-Bus/GTK file-chooser portal. Root then operates the actual Linux desktop through the host QEMU window. A full Ubuntu desktop image, host X server, additional remote-control service, Windows feature change or WSL retry is unnecessary for this pilot.
|
||
|
||
The retained launcher `.local/linux-qa/launch-pilot.cjs` is the current authority, not the older `ready-command.json` (which still says two vCPUs). It uses one vCPU,2GiB, BelowNormal priority, retained `runtime/pilot.qcow2` and UEFI variables, loopback-only SSH2222/serial4444, seed18080, and the live budget file. Its `--gui` switch currently changes only the display backend while retaining `-vga none`: **that switch alone cannot display a guest framebuffer**. Read-only `qemu-system-x86_64.exe -display help` confirms GTK and SDL are compiled into this pinned QEMU11.1 distribution; corresponding DLLs are present.
|
||
|
||
The Windows Rust1.90 GNU host, Linux target std, Zig0.16 and cargo-zigbuild0.23.3 are already prepared under `.local/cross-linux-qa`. The corrected host wrapper has separately executed both a build-script EXE and proc-macro DLL; the resulting ring/thread/filesystem ELF subsequently ran successfully on Linux. This closes those prerequisites, not the actual GUI graph. [Exact probe evidence](release-linux-cross-build-probe-20260906.md).
|
||
|
||
## Display configuration after clean shutdown
|
||
|
||
Create a separate reviewed GUI launcher derived from the current live-budget launcher. Preserve its PID/resource sampling, exact disk identity and shutdown machinery. Change only the relevant QEMU arguments:
|
||
|
||
```text
|
||
-vga std
|
||
-display gtk,gl=off,zoom-to-fit=off,grab-on-hover=off,window-close=off
|
||
```
|
||
|
||
Keep USB tablet, serial and SSH unchanged. The GTK window is the intentionally visible test surface; helpers remain hidden. Use only one QEMU process for the writable overlay. Do not run qemu-img mutations, copy a live QCow2 as a backup, create an untracked fork of its backing chain, or replace its existing disk/cache. Preserve the old launcher and record the new arguments/hash. Standard VGA is a simple framebuffer; guest Vulkan runs in software, so host OpenGL/VirGL is not required. QEMU documents the independent VGA and display choices, GTK options and USB tablet behavior. [QEMU invocation](https://www.qemu.org/docs/master/system/qemu-manpage.html), [standard VGA](https://www.qemu.org/docs/master/specs/standard-vga.html).
|
||
|
||
First display-only boot: budget15minutes, preserving the3-minute shutdown reserve. Require both retained SSH host identity and a visible firmware/kernel console, and root-confirmed visible firmware/kernel framebuffer. Do not operate a terminal or console application through Computer Use; guest commands use ordinary exec/SSH tools. Actual mouse/keyboard verification follows with nonterminal desktop/app surfaces after provisioning. If the framebuffer is absent, retain QEMU/serial logs and stop; do not proceed to package provisioning. The old serial-only boot/device trouble is retained evidence, so adding the display is itself an experiment.
|
||
|
||
## Minimal guest package and session proposal
|
||
|
||
Only in a separately granted provisioning slice, record `dpkg --audit`, `df`, `free`, package versions and `apt-get -s` output first. Exact download/installed sizes are not yet measured. Candidate command (guest only):
|
||
|
||
```sh
|
||
sudo apt-get -s install --no-install-recommends \
|
||
xserver-xorg-core xserver-xorg-input-libinput xauth x11-xserver-utils \
|
||
openbox kbd dbus dbus-x11 \
|
||
libx11-6 libx11-xcb1 libxcb1 libxkbcommon0 libxkbcommon-x11-0 \
|
||
libvulkan1 mesa-vulkan-drivers vulkan-tools \
|
||
fontconfig fonts-dejavu-core fonts-noto-cjk \
|
||
xdg-desktop-portal xdg-desktop-portal-gtk
|
||
```
|
||
|
||
After reviewing that transaction, the same explicit list with `-s` removed is the proposed install. Do not install a display manager or change the default systemd target. Reserve approximately1–2GiB for this runtime experiment until apt provides real sizes; this is a planning allowance, not a measured installation footprint. Noto CJK is purposeful coverage for the existing Unicode fixtures. The locked rfd0.15.4 default is xdg-portal, not a GTK3 compile backend; GTK is needed here as the runtime portal provider. [Ubuntu portal packages](https://packages.ubuntu.com/search?keywords=xdg-desktop-portal), [Mesa packages](https://packages.ubuntu.com/search?keywords=mesa&suite=noble).
|
||
|
||
Use the task-created `arcadia` account and a fresh `/home/arcadia/qa-gui/<run>` directory. Set a fresh600-permission Xauthority cookie locally without logging it; create700-permission runtime/config/data directories. Prefer an authenticated, local-only Xorg server on an unused VT, without globally relaxing Xwrapper or running Studio as root. Proposed launch after verifying the packaged binary path and unused VT7:
|
||
|
||
```sh
|
||
sudo openvt -c 7 -s -- /usr/lib/xorg/Xorg :0 vt7 \
|
||
-nolisten tcp -auth /home/arcadia/qa-gui/RUN/Xauthority -noreset
|
||
```
|
||
|
||
`RUN` is a concrete fresh run directory chosen at execution, not a literal destination. Do not force an occupied VT. Xorg's default modesetting driver should be tested with the exposed standard-VGA/bochs device; if it fails, first inspect its log and `/dev/dri`, then assess explicit guest-only fbdev/vesa fallback packages. Do not assert driver availability from the headless baseline. [Ubuntu openvt manual](https://manpages.ubuntu.com/manpages/bionic/man1/open.1.html), [Xorg wrapper restrictions](https://manpages.ubuntu.com/manpages/noble/man1/Xorg.wrap.1.html).
|
||
|
||
Run the window manager, probes, portals and app inside **one** `dbus-run-session` as arcadia. Supply DISPLAY=:0, the cookie path, fresh XDG_RUNTIME_DIR/CONFIG_HOME/DATA_HOME, and XDG_CURRENT_DESKTOP=Openbox; unset WAYLAND_DISPLAY and WAYLAND_SOCKET. The locked winit0.30.13 then chooses the available X11 display. Under the fresh config directory, `xdg-desktop-portal/portals.conf` contains:
|
||
|
||
```ini
|
||
[preferred]
|
||
default=gtk
|
||
```
|
||
|
||
Inside that bus session, propagate DISPLAY/XAUTHORITY/XDG_CURRENT_DESKTOP/XDG_CONFIG_HOME/XDG_DATA_HOME/XDG_RUNTIME_DIR using `dbus-update-activation-environment`; start `openbox`. Verify root can open its desktop menu and manipulate a nonterminal application window. Terminal apps, including guest xterm/console applications, are not Computer Use targets. Verify an actual file chooser, not just the presence of its packages. If distro activation delegates to the existing user manager and loses the private environment, use the installed portal executables explicitly within this same private bus, after discovering their paths with `dpkg -L`. Keep logs and scoped PIDs; avoid global user-manager resets. [Portal configuration](https://flatpak.github.io/xdg-desktop-portal/docs/configuration-file.html), [activation environment](https://github.com/flatpak/xdg-desktop-portal/blob/main/doc/system-integration.rst).
|
||
|
||
Discover the actual Lavapipe ICD path with `dpkg -L mesa-vulkan-drivers`; set `VK_DRIVER_FILES` to that path. Mesa documents `lvp_icd.x86_64.json` as the usual64-bit name. Run `vulkaninfo --summary` and then a bounded visible `vkcube` on DISPLAY=:0; require a software adapter and visible presentation, not just Vulkan enumeration. [Mesa driver selection](https://docs.mesa3d.org/install.html). For Studio set `WGPU_BACKEND=vulkan`; this exact setting is read by locked iced_wgpu0.14/wgpu-types27 source. Limit software-rendering worker count with `LP_NUM_THREADS=1` if supported by the installed Mesa; measure actual threads and responsiveness. Do not treat standard VGA as a hardware GPU or software-rendering latency as accelerated-host performance.
|
||
|
||
## Exact locked GUI build proposal
|
||
|
||
After the current Linux lease ends, prefer the host-native cross-build to avoid TCG compilation cost. Freeze a new complete source snapshot including `build/` and Cargo.lock; no mid-build edits. Keep the established separate target/cache and one-job environment:
|
||
|
||
```powershell
|
||
. .local/cross-linux-qa/env.ps1
|
||
cargo +1.90.0-x86_64-pc-windows-gnu zigbuild `
|
||
--manifest-path <FROZEN-SNAPSHOT>/Cargo.toml `
|
||
-p oa-desktop --bin arcadia-studio `
|
||
--target x86_64-unknown-linux-gnu.2.28 --offline --locked
|
||
```
|
||
|
||
`<FROZEN-SNAPSHOT>` must be replaced with its reviewed path. A missing offline dependency is a fetch prerequisite, not permission to change the lock. Inspect any failure before adding a sysroot or system packages. The inspected graph has dynamically loaded X11/XKB/Wayland/Vulkan; wayland-sys0.31.11 skips pkg-config under DLOPEN. rfd's default avoids GTK compile libraries. This suggests low sysroot burden, but full feature unification/linkage remains unproven. The project Windows manifest build script returns early for the Linux target. The host wrapper's response-file-only DLL detection remains a documented untested corner.
|
||
|
||
Give the first actual locked GUI compile its own bounded45minute lease with a20minute progress review; preserve cache on timeout. Allow several GiB target growth, retain the5GiB disk floor, and do not overlap the2GiB guest with heavy host compilation when RAM is tight. Exact GUI duration/size are unmeasured. On success inspect ELF interpreter/DT_NEEDED/GLIBC requirements, hash the binary and copy the complete teaching/evidence folder beside the packaged executable. Native guest `ldd` and loader logs resolve final runtime dependencies. Cross-built integration tests containing Windows CARGO_MANIFEST_DIR paths are not substitutes for native Linux test gates.
|
||
|
||
## Acceptance and budget
|
||
|
||
Root alone controls the QEMU GUI through Computer Use; scripts may provision/inspect but may not substitute automated clicks for the native task evidence. Record guest pixel size with xrandr, host-window scaling and supported app content dimensions. Start with the visible firmware framebuffer, then Openbox desktop input and a software Vulkan cube; then Home, offline guide, real portal Open/Save/Cancel, a complete source/model edit/Save/Undo/Redo/reopen oracle, qualified-link routing and exact operation/Reply identity. Save screenshots through the established native tool and retain stderr, adapter, process, binary and source hashes. An Xvfb image, process uptime or ELF header alone cannot close these workflows. X11/software Vulkan acceptance does not establish Wayland or hardware-GPU acceptance.
|
||
|
||
Recommended next experiment is the15minute display-only boot after current clean shutdown, followed by a separately budgeted45minute package/X11/portal/Vulkan pilot if display/input works. Keep the live deadline,20-second host sampling,512MiB available-memory/5GiB free-disk thresholds and3-minute shutdown reserve. Do not begin apt when less than15minutes remain; reserve time to finish its transaction and never intentionally terminate dpkg midway. Cleanly stop the task session and guest, preserving the existing disk and compile cache. Full Studio acceptance follows only after both the runtime pilot and the exact GUI build succeed.
|
||
|
||
## Prepared display launcher (not executed)
|
||
|
||
`.local/linux-qa/launch-display-pilot.cjs` is a new derivative of the unchanged current launcher. Only its explanatory comment, window name, VGA type and GTK display argument differ. Disk/UEFI/cache identity, one vCPU/2GiB, BelowNormal priority, loopback bindings, seed lifecycle, hidden helper processes, PID recording, live resource/deadline checks and SSH shutdown/forced-stop fallback are byte-identical. There is intentionally no QEMU monitor or terminal-input test added.
|
||
|
||
Node syntax checking and `--describe` are read-only verification; neither launches the VM. After root reviews this diff, the current VM is cleanly stopped, its logs/PIDs are preserved, and a fresh15minute `resume-budget.json` is installed, the proposed PowerShell launch from the repository root is:
|
||
|
||
```powershell
|
||
$qaDisplayNode = 'C:\Users\User\.cache\codex-runtimes\codex-primary-runtime\dependencies\node\bin\node.exe'
|
||
$qaDisplayScript = Join-Path $PWD '.local/linux-qa/launch-display-pilot.cjs'
|
||
Start-Process -FilePath $qaDisplayNode -ArgumentList ('"' + $qaDisplayScript + '"') `
|
||
-WorkingDirectory $PWD -WindowStyle Hidden -PassThru
|
||
```
|
||
|
||
The Node console is hidden; QEMU's GTK graphics window is the intentionally visible test surface. This launcher still depends on root's existing single-VM lease and fresh live budget: do not launch it beside the active core VM or against an expired budget. For inspection only, use `node --check .local/linux-qa/launch-display-pilot.cjs` and `node .local/linux-qa/launch-display-pilot.cjs --describe`.
|
||
|
||
|
||
## Prepared provisioning helpers and monotonic lease (not executed)
|
||
|
||
Subsequent root evidence showed VMware Tools changing wall time by +1,958,781ms and +796,378ms. An absolute-UTC watchdog consequently ended a cross-build experiment early without a compiler error. For the next display pilot, **use the new `.local/linux-qa/launch-display-monotonic.cjs`, not either earlier launcher**. Both predecessors remain unchanged. The new launcher accepts exactly15(default) or45minutes through `ARCADIA_GUI_BUDGET_MINUTES`, measures elapsed duration with Node `performance.now()` from QEMU spawn, and initiates shutdown with3minutes remaining. Wall-clock timestamps are provenance only and may jump. It intentionally does not read or extend the old live UTC deadline file. Resource floors,20-second sampling, seed/PID identity and the bounded SSH/forced-stop lifecycle are retained. Root must review this changed clock policy before boot.
|
||
|
||
Three new task-local Bash helpers are prepared:
|
||
|
||
| Helper | Exact scope and guard |
|
||
|---|---|
|
||
| `gui-packages.sh measure DIR` | Fresh private evidence directory; existing dpkg audit, package inventory/policy and `apt-get -s`; no apt update, fetch or installation. Prints the proposed plan hash. Includes Xorg/Openbox, XKB/Vulkan, GTK portal and CJK fonts; no terminal GUI/display manager. |
|
||
| `gui-packages.sh install DIR SHA256` | Requires the explicitly reviewed plan hash and an identical fresh simulation; refuses removals, dirty dpkg state, guest RAM below512MiB, guest disk below5GiB, or less than20minutes until the supplied monotonic guest deadline. No package-operation timeout that deliberately interrupts dpkg. |
|
||
| `gui-session.sh start RUN [ELF]` | Fresh700-permission runtime/config/data and600-permission cookie, authenticated Xorg on unused VT7, private session D-Bus, unprivileged Openbox/software Vulkan, explicit same-bus GTK portal providers. Starts either nonterminal vkcube or the reviewed ELF. No autologin/default-target/Xwrapper changes. Captures Xorg/portal/adapter/app logs. |
|
||
| `gui-open-app.sh RUN ELF` | Joins only the running task's private session using its600-permission environment file, checks display and prints the exact binary hash, then execs Studio as arcadia. No scripted GUI input. |
|
||
|
||
Syntax checks (`bash -n` on all three Bash files and `node --check` on the monotonic launcher) pass; `--describe` confirms the display arguments and fixed15minute default. **No helper has run against Linux.** Runtime package locations, VT/device/session behavior and the complete app remain unverified. `gui-session.sh` deliberately fails if the actual installed ICD/provider path inventory is ambiguous, rather than guessing. Files contain no existing credentials; the display cookie is generated only when an authorized session starts and is never printed.
|
||
|
||
After root confirms the old QEMU/launcher/seed processes are absent, preserve current top-level runtime evidence into a fresh directory. Example PowerShell preparation, not executed:
|
||
|
||
```powershell
|
||
$qaRuntime = Join-Path $PWD '.local/linux-qa/runtime'
|
||
$qaArchive = Join-Path $PWD ('.local/linux-qa/runtime-archive-' + [guid]::NewGuid())
|
||
New-Item -ItemType Directory -Path $qaArchive -ErrorAction Stop
|
||
Get-ChildItem -LiteralPath $qaRuntime -File |
|
||
Where-Object { $_.Extension -in '.log', '.json', '.jsonl' } |
|
||
Copy-Item -Destination $qaArchive -ErrorAction Stop
|
||
Get-ChildItem -LiteralPath $qaArchive -File | Get-FileHash -Algorithm SHA256 |
|
||
ConvertTo-Json | Set-Content -LiteralPath (Join-Path $qaArchive 'copied-hashes.json')
|
||
```
|
||
|
||
This copies logs/metadata only; it does not copy/move/delete the QCow2, UEFI variables, guest target cache or nested prior gate archives. The archive GUID remains unique even if wall time changes. The reviewed launch command becomes:
|
||
|
||
```powershell
|
||
$env:ARCADIA_GUI_BUDGET_MINUTES = '15'
|
||
$qaDisplayNode = 'C:\Users\User\.cache\codex-runtimes\codex-primary-runtime\dependencies\node\bin\node.exe'
|
||
$qaDisplayScript = Join-Path $PWD '.local/linux-qa/launch-display-monotonic.cjs'
|
||
Start-Process -FilePath $qaDisplayNode -ArgumentList ('"' + $qaDisplayScript + '"') `
|
||
-WorkingDirectory $PWD -WindowStyle Hidden -PassThru
|
||
```
|
||
|
||
Use45 only for a separately reviewed provisioning lease; never change Windows/global environment or quietly extend a running fixed lease. Root remains responsible for the single-VM/CPU lease. After the visible framebuffer/retained SSH gate succeeds, transfer the hash-checked scripts to a fresh guest helper directory via existing authenticated SCP. Proposed SSH-executed commands (replace RUN/PACKAGES/ELF with concrete reviewed paths):
|
||
|
||
```sh
|
||
bash /home/arcadia/qa-gui-helpers/gui-packages.sh measure /home/arcadia/qa-gui-packages/PACKAGES
|
||
# Review plan.txt, its SHA256, actual download/disk sizes, host resource samples,
|
||
# and remaining monotonic host lease BEFORE the separate installation action.
|
||
GUI_DEADLINE_UPTIME_SECONDS=REVIEWED_GUEST_UPTIME_DEADLINE \
|
||
bash /home/arcadia/qa-gui-helpers/gui-packages.sh install \
|
||
/home/arcadia/qa-gui-packages/PACKAGES REVIEWED_PLAN_SHA256
|
||
bash /home/arcadia/qa-gui-helpers/gui-session.sh start /home/arcadia/qa-gui/RUN
|
||
# Later, join that private bus/display without opening a terminal GUI:
|
||
bash /home/arcadia/qa-gui-helpers/gui-open-app.sh /home/arcadia/qa-gui/RUN /home/arcadia/qa-app/ELF
|
||
```
|
||
|
||
Set `GUI_DEADLINE_UPTIME_SECONDS` from current guest `/proc/uptime` plus the host launcher's **monotonically measured** remaining time before shutdown reserve; never derive it from UTC. It is an admission bound, not a new watchdog and not a reason to kill apt midway. Start installation early in a45minute lease and monitor progress; defer the action if transaction size/time does not fit. Keep the session command on a managed SSH job; no Computer Use terminal is opened. Root observes firmware, then Openbox/vkcube/file chooser/Studio surfaces. Session exit scopes cleanup to its own processes and verifies Xorg's exact run-specific cookie path before signalling it.
|
||
|
||
The current458-file corrected-routing/private-server source snapshot and any later UI-layout delta require their own exact artifact hashes; neither is silently substituted into the older frozen455-file Linux gate. Preserve binary/example pairing and root's source oracle at launch. A successful package install or cube remains prerequisite evidence only.
|