P0: own the Workbench Mac bridge in evaOS-GUI and block legacy app focus

[100yenadmin]

Problem

The v2.1.36 release candidate still clones the deprecated, archived electricsheephq/evaos-desktop-bridge repository during packaging. Its pinned payload hard-codes /Applications/evaOS.app and process EvaDesktop, so audited Workbench focus can open a coinstalled legacy 0.6.27 app instead of /Applications/evaOS Workbench.app.

Required release fix

• Make evaOS-GUI own the bundled bridge source used by Workbench; release builds must not clone or require the archived repository.
• Set canonical focus to /Applications/evaOS Workbench.app, process evaOS Workbench, and current bundle alias com.evaos.workbench.
• Keep legacy names only as compatibility inputs that resolve to the current exact path; never use app-name lookup or the legacy path.
• Fail closed if the vendored payload identity drifts.
• Bind the packaged bridge manifest to the exact evaOS-GUI release head and prove direct Mac control from the signed/notarized installed app.

Release gate

Blocks public evaOS Workbench v2.1.36 publication. The previous draft/tag remain unpublished and publication variables remain false.

[coderabbitai]

🔗 Related PRs

#269 - chore: register beta RC release workflows [closed]
#271 - fix: distribute beta RC through GitHub Releases [closed]
#449 - Fix legacy app stale owner proof path [merged]
#636 - fix(evaos): enforce no-ACP release packaging [merged]
#675 - P0: bundle self-contained Mac connector runtime [merged]

---

📝 Issue Planner

_{Check the box below or use the @coderabbitai plan command to generate an implementation plan and prompts that you can use with your favorite coding assistant.}

• Create Plan

---

🧪 Issue enrichment is currently in open beta.

You can configure auto-planning by selecting labels in the issue_enrichment configuration.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord!

[evaos-code-review-bot]

evaOS issue enrichment

Issue: #696 - P0: own the Workbench Mac bridge in evaOS-GUI and block legacy app focus
State: open

Related issues/PRs: none detected from issue metadata.
Existing labels: bug, evaos, public-beta, area:native-companion, area:release, kind:integration, blocked, release-train:runtime-reliability, priority:P0.
Suggested labels: none.
Suggested owners: none.

Related context

• No same-repo issue/PR references detected in issue metadata.

Agent-start packet

Problem shape: P0: own the Workbench Mac bridge in evaOS-GUI and block legacy app focus - ## Problem The v2.1.36 release candidate still clones the deprecated, archived electricsheephq/evaos-desktop-bridge repository during packaging. Its pinned payload hard-codes /Applications/evaOS.app and process
Product fit: Implementation issue; keep product fit lightweight unless VISION.md/repo policy raises a constraint.
Implementation wedge: Start with a focused fixture or dry-run path that proves the issue shape before widening behavior.

Build / borrow / buy scan:

• Build: identify the smallest implementation wedge that proves the issue without broad rollout.
• Borrow: inspect same-repo prior art, repo memory, GitNexus context, and allowlisted cross-repo examples first.
• Buy/use: deferred; no product, architecture, UX, library-choice, integration, roadmap, or market-positioning trigger detected.

Candidate sources:

• VISION.md / repo policy / repo-memory.md / GitNexus packet.
• Same-repo issues and PRs referenced by issue metadata.

Acceptance criteria:

• Add explicit acceptance criteria before implementation is considered done.
• Include source citations for any external OSS/library/current-market claims.
• Keep issue-enrichment comments sticky and idempotent.
• Keep labels, owners, reviewers, and roadmap fields suggestion-only.

Proof plan:

• Focused unit/fixture test for the changed planner behavior.
• Dry-run issue-enrichment evidence packet before live comment posting.
• Redaction check for issue body, citations, and generated markdown.

Known traps:

• Do not treat related links as proof by themselves; each source needs a reason why it matters.
• Do not scan old issue backlogs or exceed repo-level enrichment throttles.

Non-goals:

• Do not auto-apply labels, owners, reviewers, roadmap fields, or milestones.
• Do not bulk-enrich old backlog issues from this planner output.
• Do not claim external market or OSS research was performed unless cited sources are present.

Context-source taxonomy:

• [enabled] vision_repo_policy_memory_gitnexus: Use repo vision, policy, memory, and GitNexus first before external research.
• [enabled] same_repo_issues_prs: No explicit same-repo references detected; still safe as bounded local context.
• [deferred] allowlisted_cross_repo_github: Deferred until product, UX, market-positioning, or library-choice signal appears.
• [deferred] external_oss_examples: Deferred for low-research-value issue class.
• [deferred] library_api_docs: Deferred unless a library/API decision is present.
• [deferred] current_market_examples: Deferred for implementation-only issues.
• [enabled] internal_mcp_docs: Use internal docs/MCP context when available; missing context is degraded, not blocking.

Validation suggestions

• Confirm owner, acceptance criteria, and validation evidence before implementation.

Triage gaps

• Acceptance criteria or validation evidence not detected in issue body.
• Owner or reviewer signal not detected in issue body.

No labels, owners, reviewers, or roadmap fields were changed by this bot.