docs(desktop-client): revise spec v2 with triple-review fixes
Address 6 Critical + 10 Warning findings from Claude + Codex + Gemini
cross-review:
- C1 Replace Network.responseReceivedExtraInfo path with EventSource /
Fetch.takeResponseBodyAsStream routing per transport type; add
Electron-Chromium CDP compatibility matrix commitment.
- C2 Default patch channel to pure-data DSL (no JS exec); executable
fallback gated on utilityProcess + isolated-vm sandbox with frozen
globals. Full TUF-style signing chain (patch_seq, hash, expires_at,
key_id rotation, revokes, runtime hash re-verify).
- C3 Add RabbitMQ task_available fanout + Redis presence registry;
SSE only pushes signals, task ownership decided atomically by
lease endpoint.
- C4 platform_accounts gains platform_uid + account_fingerprint +
UNIQUE(platform, platform_uid) enforcing workspace-exclusive
binding in DB, not by client discipline.
- C5 Task protocol adds attempt_id + lease_token with
extend/pause/resume/cancel endpoints; manual mode enters
waiting_user status with extended lease; 409 on stale lease_token.
- C6 Rewrite scope estimate with 7 detect-only publish adapters and
DeepSeek monitor placeholder called out explicitly; reshape as
9-bucket 22-26 week effort; introduce Plan A/B/C split.
Warnings addressed: BrowserView->WebContentsView everywhere;
allowDowngrade spelling fix; client_token decoupled from
client_version with rotate/revoke APIs; safeStorage Linux
basic_text guard + separate vault-export for machine migration;
keep-alive token bucket + 429 backoff + resume warm-up;
packages/ui-shared carve-out (no admin-web cloning); state machine
gets failed/aborted/unknown terminal states; sqlc regeneration
footprint made explicit; crash recovery split by task.kind;
autoUpdater unit tests + pre-release smoke; trace phased
(Alpha=logs+shots, Phase 2=Playwright-compat export).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
root
2e1a5900ea