Cross-repo completion dependencies — 2026-07-15
This section augments and supersedes the generic “file a backend issue if missing” language below.
Client work may proceed against frozen schemas and local fakes after #699/#700, but #702 cannot close without compatible server implementation plus non-customer staging contract proof. #708's runtime-receipt route is existing Workbench proof infrastructure; it is not the #73 outbound relay.
No direct-IP, Tailscale, public-listener, raw connector URL/token, or browser-held relay-credential fallback is allowed.
Parent epic: #698
Depends on: #699 and #700.
Related contract issues: #655, #687, #688.
Context
The existing connector assumes local service and private-network setup in parts of the Workbench flow. A standalone customer product must work without Tailscale, inbound firewall changes, public listeners, or manual connector URLs. The Mac should establish the remote path outbound and accept commands only for the broker-selected binding.
Required change
Add an outbound authenticated WebSocket/TLS transport from Mac Access to the existing evaOS broker/ws-proxy plane. Reuse the current broker-selected binding contract. If the required server contract is missing, document the exact gap and file a linked issue in the owning backend repo rather than inventing an insecure client fallback.
Message and binding requirements
Every session/action envelope must include or cryptographically bind:
- schema version;
- customer account ID;
- Mac/device ID;
- broker grant ID;
- selected VM/runtime ID;
- session ID;
- monotonically checked sequence or nonce;
- issued-at and expiry;
- command/action type and normalized parameters;
- approval/source audit ID when required;
- correlation ID and response status.
The client must reject wrong-customer, wrong-device, wrong-grant, wrong-runtime, expired, replayed, reordered beyond the protocol window, revoked, and unknown-schema messages.
Acceptance criteria
- Mac Access reaches broker connectivity from a normal outbound HTTPS/WSS network with no Tailscale, public inbound listener, port forward, or private connector URL.
- Pairing activates exactly the broker-selected account/device/grant/runtime binding and stores only the minimum secret material in Keychain.
- Reconnect uses bounded exponential backoff with jitter, resumes only when the grant is still valid, and never replays a completed high-impact action.
- Sleep/wake, network change, captive/offline state, broker restart, app restart, and token rotation produce typed states and recover without duplicate control.
- Revocation and emergency stop close the active channel promptly and make later messages fail closed.
- Local status may expose safe scope labels and audit IDs but never raw tokens, connector URLs, private addresses, headers, or customer data.
- Transport integration tests cover selected-binding success plus wrong-scope, replay, expiry, revoke, offline, reconnect, duplicate process, and server downgrade.
- The VM agent path returns structured tool results and audit/correlation IDs through the same session; generic chat success is not proof.
- No production backend, customer VM, or broker mutation occurs without the owning issue and explicit approval.
Validation
- protocol/schema contract tests shared with the server owner;
- local fake-broker integration suite;
- ws-proxy/broker staging canary using a non-customer test binding;
- current-head GitHub CI;
- packet/log redaction review;
- negative replay and cross-customer isolation proof.
Rollback
Disable the standalone transport feature flag and revoke test grants. Workbench's existing v2.1.36 path remains unchanged until the dedicated integration issue lands.
Non-goals
- no direct VM-to-Mac IP path;
- no Tailscale enrollment automation;
- no public listener;
- no customer rollout or public release.
Cross-repo completion dependencies — 2026-07-15
This section augments and supersedes the generic “file a backend issue if missing” language below.
Client work may proceed against frozen schemas and local fakes after #699/#700, but #702 cannot close without compatible server implementation plus non-customer staging contract proof. #708's runtime-receipt route is existing Workbench proof infrastructure; it is not the #73 outbound relay.
No direct-IP, Tailscale, public-listener, raw connector URL/token, or browser-held relay-credential fallback is allowed.
Parent epic: #698
Depends on: #699 and #700.
Related contract issues: #655, #687, #688.
Context
The existing connector assumes local service and private-network setup in parts of the Workbench flow. A standalone customer product must work without Tailscale, inbound firewall changes, public listeners, or manual connector URLs. The Mac should establish the remote path outbound and accept commands only for the broker-selected binding.
Required change
Add an outbound authenticated WebSocket/TLS transport from Mac Access to the existing evaOS broker/ws-proxy plane. Reuse the current broker-selected binding contract. If the required server contract is missing, document the exact gap and file a linked issue in the owning backend repo rather than inventing an insecure client fallback.
Message and binding requirements
Every session/action envelope must include or cryptographically bind:
The client must reject wrong-customer, wrong-device, wrong-grant, wrong-runtime, expired, replayed, reordered beyond the protocol window, revoked, and unknown-schema messages.
Acceptance criteria
Validation
Rollback
Disable the standalone transport feature flag and revoke test grants. Workbench's existing v2.1.36 path remains unchanged until the dedicated integration issue lands.
Non-goals