@1agh/maude 0.53.1 → 0.54.0

package/apps/studio/workspace-mode.ts

@@ -1,24 +1,30 @@
 // Workspace mode + the containment invariant's first enforcement point.
 //
-// DDR-193 states the invariant:
+// DDR-193 stated the invariant, and Cloud Phase 25 A0 amended what a cell does
+// under it. The current wording (DDR-209 A′1) is:
 //
-//   > No tenant-authored TSX is ever evaluated by vendor-operated compute.
-//   > A cell runs sync + git + asset storage — nothing else. It never renders a
-//   > canvas, never builds a bundle, never executes a canvas module, never runs
-//   > a headless browser against tenant content.
+//   > No tenant-authored TSX is ever EVALUATED by vendor-operated compute.
+//   > A cell syncs, keeps git history, stores assets, and BUILDS a member's own
+//   > canvas in a bounded sandbox. The member's browser is what evaluates.
+//   > Nothing here renders, and no browser enters the image.
 //
 // and states how it is kept: "enforced, not asserted — a boot-assert in the cell
 // image plus a CI grep gate." This module is the boot-assert. The grep gate is
 // `scripts/check-containment.sh`.
 //
+// THE TEST IS EVALUATION, NOT THE SERVING OF BYTES. That distinction is the
+// whole of DDR-209 A′1, and it is load-bearing in both directions. It still
+// catches the thumbnail endpoint someone adds in 2027 (which would evaluate). It
+// stops mis-catching a static HTML harness with a strict CSP (which does not) —
+// and mis-catching it is what forced Phase 25 to hand-roll a second, poorer
+// studio rather than serve the real one.
+//
 // WHY A BOOT-ASSERT AND NOT A CODE REVIEW RULE. Every canvas is code the tenant
 // wrote. The moment vendor compute evaluates it, an anonymous signup has
 // arbitrary code execution inside our perimeter, next to other tenants' designs
 // and the control plane's credentials. A convention protects that for exactly as
 // long as everyone remembers it; a process that refuses to start does not
-// forget. The failure mode this prevents is not "someone adds a bad route on
-// purpose" — it is "someone adds a thumbnail endpoint in 2027 without knowing
-// this line exists."
+// forget.
 //
 // It fails CLOSED and LOUD: the cell refuses to boot, naming the exact surfaces
 // that broke it. A cell that will not start is a page; a cell that quietly
@@ -36,6 +42,15 @@ export function isWorkspaceMode(env: NodeJS.ProcessEnv = process.env): boolean {
  *
  * These are prefixes: `/_api/export-jobs` is caught by `/_api/export` and that
  * is intended — a variant of a forbidden surface is still forbidden.
+ *
+ * TWO KINDS OF ENTRY LIVE HERE, and both belong:
+ *
+ *   1. surfaces that EVALUATE tenant content on our compute (export, photo-edit);
+ *   2. surfaces that hold, spend or reveal a SECRET on our compute — a provider
+ *      key, the operator's GitHub token, the user's own `claude` session, the
+ *      process log. DDR-123's "claude never on our infra" is only a fact while
+ *      these are unreachable, and Cloud Phase 27 D1 is where they stop being in
+ *      the image at all. Until then, unreachable is the floor, not the ceiling.
  */
 export const FORBIDDEN_ROUTE_PREFIXES: ReadonlyArray<{ prefix: string; why: string }> =
   Object.freeze([
@@ -52,17 +67,84 @@ export const FORBIDDEN_ROUTE_PREFIXES: ReadonlyArray<{ prefix: string; why: stri
       why: 'media generation runs tenant-authored prompts against a provider key held here',
     },
     {
-      prefix: '/_canvas-shell',
-      why: 'the canvas shell is the surface that mounts and executes a canvas module',
-    },
-    {
-      prefix: '/_canvas-runtime',
-      why: 'serving the canvas runtime only makes sense if something here renders a canvas',
+      prefix: '/_api/shell-shot',
+      why: 'the shell screenshot spawns a headless browser against the studio — the same evaluation `/_api/export` is forbidden for',
     },
     {
       prefix: '/_ws/acp',
       why: 'the ACP bridge spawns the user’s own `claude` and can drive file edits (DDR-123 is desktop-only)',
     },
+    // ---- Cloud Phase 27 D1 — the secret-bearing surfaces, named at last ----
+    {
+      prefix: '/_api/acp',
+      why: 'the ACP surface drives the user’s own `claude` session; a cell must not hold one (DDR-123)',
+    },
+    {
+      prefix: '/_api/claude',
+      why: 'installing or signing in to `claude` from a cell would put a user’s subscription on our infra (DDR-123)',
+    },
+    {
+      prefix: '/_api/cloud',
+      why: 'cloud sign-in mints and stores an account session — a cell IS the cloud, it must not be a client of it',
+    },
+    {
+      prefix: '/_api/github',
+      why: 'the GitHub lane spends an operator credential; a cell asks the control plane, it never holds one (DDR-201)',
+    },
+    {
+      prefix: '/_api/hub',
+      why: 'hub linking rewrites which server owns this project — a cell must not repoint itself',
+    },
+    {
+      prefix: '/_api/debug-bundle',
+      why: 'the diagnostic bundle reads this process’s logs, where every cell secret has had a chance to appear',
+    },
+    {
+      prefix: '/_api/design',
+      why: 'design-system init shells out to the CLI on our compute against tenant-chosen input',
+    },
+  ]);
+
+/**
+ * Routes a cell MAY serve, but only while the contract that makes them safe is
+ * armed. DDR-209 A′1.
+ *
+ * These are NOT a softer forbidden list. A forbidden route is absent; a
+ * sandboxed route is PRESENT AND ATTESTED — the boot-assert refuses to start
+ * when one of them is reachable and `sandboxArmed` is false, which is a check
+ * the old list could not make because the route never existed to check.
+ *
+ * What they are, precisely:
+ *
+ *   `/_canvas-shell`    a static HTML harness with a strict CSP. The cell emits
+ *                       a string; the MEMBER'S BROWSER mounts and executes. The
+ *                       old entry's reason ("the surface that mounts and
+ *                       executes a canvas module") described the browser's job,
+ *                       not ours.
+ *   `/_canvas-runtime`  pre-built VENDOR bundles (React, motion) compiled from
+ *                       our own source at image build. Not one tenant byte, and
+ *                       serving them evaluates nothing. The old entry's reason
+ *                       ("only makes sense if something here renders") is the
+ *                       premise Phase 25 A0 replaced: it makes sense because the
+ *                       browser renders.
+ *
+ * THE CONTRACT (Cloud Phase 25 A1, unchanged and still CI-asserted): the build
+ * that turns a canvas into that module runs in its OWN process, with an EMPTY
+ * environment, an import allowlist, a wall-clock deadline and an RSS ceiling.
+ * Serving the shell without that armed would mean building tenant source in the
+ * cell's main process, next to HUB_SECRET — so the assert treats an unarmed
+ * sandbox exactly like a forbidden route.
+ */
+export const SANDBOXED_ROUTE_PREFIXES: ReadonlyArray<{ prefix: string; why: string }> =
+  Object.freeze([
+    {
+      prefix: '/_canvas-shell',
+      why: 'the canvas shell is a static harness the BROWSER evaluates — permitted only while the build sandbox is armed',
+    },
+    {
+      prefix: '/_canvas-runtime',
+      why: 'the runtime bundles are vendor code — permitted only while the build sandbox is armed',
+    },
   ]);
 
 /**
@@ -78,9 +160,18 @@ export const FORBIDDEN_MODULES: ReadonlyArray<string> = Object.freeze([
   'puppeteer-core',
 ]);
 
+function matches(route: string, prefix: string): boolean {
+  return route === prefix || route.startsWith(prefix);
+}
+
 /** True when `route` is (or starts with) a forbidden prefix. */
 export function isForbiddenRoute(route: string): boolean {
-  return FORBIDDEN_ROUTE_PREFIXES.some((f) => route === f.prefix || route.startsWith(f.prefix));
+  return FORBIDDEN_ROUTE_PREFIXES.some((f) => matches(route, f.prefix));
+}
+
+/** True when `route` is one a cell may serve only while the sandbox is armed. */
+export function isSandboxedRoute(route: string): boolean {
+  return SANDBOXED_ROUTE_PREFIXES.some((f) => matches(route, f.prefix));
 }
 
 /**
@@ -115,25 +206,38 @@ export interface ContainmentReport {
   routes: Array<{ route: string; prefix: string; why: string }>;
   /** Forbidden modules that resolve in this process. */
   modules: string[];
+  /** Sandboxed routes that are reachable while the sandbox is NOT armed. */
+  unattested: Array<{ route: string; prefix: string; why: string }>;
 }
 
 /**
  * Check a route table against the invariant. Pure — takes the route names so it
  * can be unit-tested without booting a server, and so the caller decides what
  * "reachable" means for its own dispatch shape.
+ *
+ * `sandboxArmed` is the A′1 contract, passed in rather than detected here: this
+ * module has no business importing the build host, and the caller is the only
+ * one who knows whether it wired it. Default `false` is deliberate — an unstated
+ * contract is an unmet one.
  */
 export function checkContainment(
   routeNames: Iterable<string>,
-  { resolveModule }: { resolveModule?: (specifier: string) => boolean } = {}
+  {
+    resolveModule,
+    sandboxArmed = false,
+  }: { resolveModule?: (specifier: string) => boolean; sandboxArmed?: boolean } = {}
 ): ContainmentReport {
   const routes: ContainmentReport['routes'] = [];
+  const unattested: ContainmentReport['unattested'] = [];
   for (const route of routeNames) {
-    for (const { prefix, why } of FORBIDDEN_ROUTE_PREFIXES) {
-      if (route === prefix || route.startsWith(prefix)) {
-        routes.push({ route, prefix, why });
-        break;
-      }
+    const forbidden = FORBIDDEN_ROUTE_PREFIXES.find((f) => matches(route, f.prefix));
+    if (forbidden) {
+      routes.push({ route, prefix: forbidden.prefix, why: forbidden.why });
+      continue;
     }
+    if (sandboxArmed) continue;
+    const sandboxed = SANDBOXED_ROUTE_PREFIXES.find((f) => matches(route, f.prefix));
+    if (sandboxed) unattested.push({ route, prefix: sandboxed.prefix, why: sandboxed.why });
   }
 
   const modules: string[] = [];
@@ -143,7 +247,12 @@ export function checkContainment(
     }
   }
 
-  return { ok: routes.length === 0 && modules.length === 0, routes, modules };
+  return {
+    ok: routes.length === 0 && modules.length === 0 && unattested.length === 0,
+    routes,
+    modules,
+    unattested,
+  };
 }
 
 /** Render a report as the message the operator sees when a cell refuses to boot. */
@@ -163,17 +272,36 @@ export function formatContainmentFailure(report: ContainmentReport): string {
     }
     lines.push('');
   }
+  if (report.unattested.length > 0) {
+    lines.push(
+      'Canvas surfaces are reachable but the BUILD SANDBOX is not armed:',
+      ...report.unattested.flatMap(({ route, prefix, why }) => [
+        `  ${route}`,
+        `      matches ${prefix} — ${why}`,
+      ]),
+      '',
+      'These routes are permitted in a cell (DDR-209 A′1) — but only together',
+      'with the Phase 25 A1 contract: the canvas build runs in its OWN process,',
+      'with an EMPTY environment, an import allowlist and wall-clock + RSS',
+      'ceilings. Serving the shell without it means parsing tenant source in the',
+      'process that holds HUB_SECRET. Pass sandboxArmed once that host is wired.',
+      ''
+    );
+  }
   if (report.modules.length > 0) {
     lines.push('Modules that resolve in this process and must not:');
     for (const m of report.modules) lines.push(`  ${m}`);
     lines.push('');
   }
   lines.push(
-    'A cell runs sync + git + asset storage. Rendering happens on a member’s own',
-    'machine, in Maude Desktop, where DDR-063/DDR-054 already contain it.',
+    'A cell syncs, keeps history, stores assets and BUILDS a member’s own canvas',
+    'in a bounded sandbox. Evaluation happens in the member’s own browser, in a',
+    'segregated origin, where DDR-063/DDR-054 already contain it. Nothing here',
+    'renders, and no browser enters the image.',
     '',
-    'If a feature genuinely needs one of these, Direction B (a structured,',
-    'non-executable synced unit) is its HARD PREREQUISITE — not a flag to add here.'
+    'If a feature genuinely needs one of the FORBIDDEN surfaces, Direction B (a',
+    'structured, non-executable synced unit) is its HARD PREREQUISITE — not a',
+    'flag to add here.'
   );
   if (report.modules.length > 0) {
     lines.push(
@@ -201,10 +329,15 @@ export function assertContainment(
   {
     env = process.env,
     resolveModule,
-  }: { env?: NodeJS.ProcessEnv; resolveModule?: (specifier: string) => boolean } = {}
+    sandboxArmed = false,
+  }: {
+    env?: NodeJS.ProcessEnv;
+    resolveModule?: (specifier: string) => boolean;
+    sandboxArmed?: boolean;
+  } = {}
 ): void {
   if (!isWorkspaceMode(env)) return;
-  const report = checkContainment(routeNames, { resolveModule });
+  const report = checkContainment(routeNames, { resolveModule, sandboxArmed });
   if (report.ok) return;
   throw new Error(formatContainmentFailure(report));
 }

package/apps/studio/ws.ts

@@ -9,7 +9,7 @@ import type { Api } from './api.ts';
 import type { Collab, RoomConn } from './collab/index.ts';
 import type { Context } from './context.ts';
 import { createHmrBroadcaster } from './hmr-broadcast.ts';
-import type { Inspect } from './inspect.ts';
+import type { InspectRegistry } from './inspect.ts';
 
 /**
  * Per-connection state. `kind` discriminates between the legacy JSON
@@ -21,6 +21,19 @@ export type WsData =
       id: string;
       remote: string;
       kind: 'inspector';
+      /** Cloud Phase 27 — the role this socket was opened under, stamped at
+       *  upgrade time from the proxy's injected header. `true` outside a cell
+       *  only when the linked hub vouched `viewer`.
+       *
+       *  It has to live on the SOCKET, not be re-read per message: a role is
+       *  per session, and a handshake is the one moment the session is
+       *  unambiguous. */
+      readOnly: boolean;
+      /** WHOSE socket this is — Cloud Phase 27 D3. Same reasoning as `readOnly`
+       *  one line up, for the other thing a cell has more than one of. `''` on
+       *  a desktop, which is what makes every broadcast below reach everybody
+       *  exactly as it always did. */
+      session: string;
     }
   | {
       id: string;
@@ -31,6 +44,14 @@ export type WsData =
        *  canvas iframe origin, whose sync frames go through the DDR-122
        *  origin gate in collab/room.ts. Set at upgrade time in server.ts. */
       realm: 'main' | 'canvas';
+      /** Cloud collab lane (RCA issue-cloud-live-collaboration-dead) — the
+       *  role this socket was opened under, stamped at upgrade time from the
+       *  proxy's injected header (fail-closed in a cell, always false on a
+       *  loopback desktop). A read-only collab socket receives everything and
+       *  publishes awareness (presence is the point), but its sync writes are
+       *  gated to the comment lane in collab/room.ts — the WS mirror of the
+       *  role matrix's `viewer.comment === true`. */
+      readOnly?: boolean;
     }
   | {
       // T2 (9.1-A) — HMR-only socket for the segregated canvas origin. Receives
@@ -131,7 +152,10 @@ export interface Ws {
 export function createWs(
   ctx: Context,
   api: Api,
-  inspect: Inspect,
+  /** Cloud Phase 27 D3 — one inspector per member, not one per process. Every
+   *  read/write below resolves through the socket's own session key, so a
+   *  desktop (key `''`) keeps hitting the single instance it always had. */
+  inspects: InspectRegistry,
   collab: Collab,
   activity: Activity,
   acp: Acp
@@ -148,10 +172,16 @@ export function createWs(
 
   // Privileged inspector feed — comments, selection, ai-activity, git-lifecycle,
   // sync:status, fs:*. ONLY the same-origin inspector clients (the shell) get it.
-  function broadcast(payload: unknown) {
+  function broadcast(payload: unknown, session?: string) {
     const msg = typeof payload === 'string' ? payload : JSON.stringify(payload);
     for (const ws of clients) {
       if (ws.data.kind !== 'inspector') continue;
+      // D3 — an event ABOUT one member goes only to that member. `session` is
+      // set by the emitter (inspect.ts stamps its own key); everything else —
+      // fs changes, comments, git lifecycle, sync status — is about the
+      // PROJECT and reaches everyone, which is why the audience is opt-in
+      // rather than the default.
+      if (session && ws.data.session !== session) continue;
       send(ws, msg);
     }
   }
@@ -169,8 +199,10 @@ export function createWs(
 
   // Wire bus -> WS broadcasts. inspect.ts emits 'selected' / 'active' after every
   // state write; fs-watch.ts emits 'fs:*' on every save.
-  ctx.bus.on('selected', (sel) => broadcast({ type: 'selected', selected: sel }));
-  ctx.bus.on('active', (file) => broadcast({ type: 'active', file }));
+  ctx.bus.on('selected', (sel, meta) =>
+    broadcast({ type: 'selected', selected: sel }, meta?.session)
+  );
+  ctx.bus.on('active', (file, meta) => broadcast({ type: 'active', file }, meta?.session));
   ctx.bus.on('fs:html', (file) => broadcast({ type: 'fs:html', file }));
   ctx.bus.on('fs:css', (file) => broadcast({ type: 'fs:css', file }));
   ctx.bus.on('fs:json', (file) => broadcast({ type: 'fs:json', file }));
@@ -251,11 +283,13 @@ export function createWs(
   function bindCollab(
     ws: ServerWebSocket<WsData>,
     slug: string,
-    realm: 'main' | 'canvas'
+    realm: 'main' | 'canvas',
+    readOnly: boolean
   ): RoomConn {
     const conn: RoomConn = {
       id: ws.data.id,
       realm,
+      readOnly,
       send(payload: Uint8Array) {
         try {
           // Bun's ws.send accepts Uint8Array directly as binary.
@@ -273,7 +307,12 @@ export function createWs(
     async open(ws) {
       if (ws.data.kind === 'collab') {
         const room = collab.registry.get(ws.data.slug);
-        const conn = bindCollab(ws, ws.data.slug, ws.data.realm ?? 'main');
+        const conn = bindCollab(
+          ws,
+          ws.data.slug,
+          ws.data.realm ?? 'main',
+          ws.data.readOnly === true
+        );
         await room.connect(conn);
         return;
       }
@@ -291,7 +330,11 @@ export function createWs(
       // opening mid-edit seeds its overlay state (Phase 13). Inspector-origin
       // sockets only — `canvas-hmr` sockets get no snapshot by design and rely
       // on live `activity` broadcasts.
-      send(ws, { type: 'snapshot', state: inspect.state, activity: activity.state });
+      send(ws, {
+        type: 'snapshot',
+        state: inspects.for(ws.data.kind === 'inspector' ? ws.data.session : '').state,
+        activity: activity.state,
+      });
     },
     async close(ws) {
       if (ws.data.kind === 'acp') {
@@ -347,6 +390,29 @@ export function createWs(
       }
       if (!msg || typeof msg !== 'object') return;
       try {
+        // Cloud Phase 27 — THE ROLE REACHES THE SOCKET TOO.
+        //
+        // The HTTP gate (http.ts `readOnlyRefusal`) does not see WebSocket
+        // frames, and comment creation is WS-driven — so without this a
+        // read-only session reached `comments-delete` and `comments-patch` over
+        // a socket while every equivalent HTTP write was refused. Found by
+        // reading what this channel actually accepts, after a live cell showed
+        // the HTTP `/_comments` route is GET-only.
+        //
+        // `comments-add` is deliberately NOT here: comment is the one write a
+        // viewer holds (role matrix, `viewer.comment === true`). Patch and
+        // delete are not — they change or remove somebody else's note.
+        const readOnlySocket = ws.data.kind === 'inspector' && ws.data.readOnly === true;
+        const MUTATES_OTHERS = new Set(['comments-patch', 'comments-delete']);
+        if (readOnlySocket && MUTATES_OTHERS.has(msg.type)) {
+          send(ws, {
+            type: 'refused',
+            reason: 'read-only',
+            message: 'Your role in this project is viewer — that change was not applied.',
+          });
+          return;
+        }
+        const inspect = inspects.for(ws.data.kind === 'inspector' ? ws.data.session : '');
         if (msg.type === 'active' && typeof msg.file === 'string') inspect.setActive(msg.file);
         else if (msg.type === 'tabs' && Array.isArray(msg.tabs)) inspect.setOpenTabs(msg.tabs);
         else if (msg.type === 'select' && msg.selection) inspect.setSelected(msg.selection);

package/cli/commands/kg.mjs

@@ -18,7 +18,7 @@ import { basename, join, resolve } from 'node:path';
 import { parseArgs } from '../lib/argv.mjs';
 
 const CONFIG_PATH = '.ai/workflows.config.json';
-const DEFAULT_ENGINE_VERSION = 'v0.1.9';
+const DEFAULT_ENGINE_VERSION = 'v1.0.0';
 const KGAI_REPO = 'kgaidev/kgai';
 
 const VERBS = new Set([
@@ -195,21 +195,32 @@ function verbDoctor(state) {
 async function verbCheckUpstream(state) {
   const pinned = state.engineVersion;
   process.stdout.write(`maude kg check-upstream\n\n  pinned (engineVersion): ${pinned}\n`);
-  let latest = null;
-  let assets = [];
-  try {
-    const res = await fetch(`https://api.github.com/repos/${KGAI_REPO}/releases/latest`, {
-      headers: { 'user-agent': 'maude-kg', accept: 'application/vnd.github+json' },
-      signal: AbortSignal.timeout(15000),
-    });
-    if (res.ok) {
+  const ghHeaders = { 'user-agent': 'maude-kg', accept: 'application/vnd.github+json' };
+  /** Asset names for one release ref, or null when the fetch itself failed. */
+  const assetsFor = async (path) => {
+    try {
+      const res = await fetch(`https://api.github.com/repos/${KGAI_REPO}/releases/${path}`, {
+        headers: ghHeaders,
+        signal: AbortSignal.timeout(15000),
+      });
+      if (!res.ok) return { ok: false, tag: null, assets: [] };
       const rel = await res.json();
-      latest = rel.tag_name;
-      assets = (rel.assets ?? []).map((a) => a.name);
+      return { ok: true, tag: rel.tag_name, assets: (rel.assets ?? []).map((a) => a.name) };
+    } catch {
+      return null; // offline — best-effort
     }
-  } catch {
-    /* offline — best-effort */
-  }
+  };
+
+  const latestRel = await assetsFor('latest');
+  const latest = latestRel?.tag ?? null;
+  // The PINNED release is the one that matters: sync-kg.mjs downloads the
+  // desktop sidecars from `releases/download/<pinned>`. Reporting `latest`'s
+  // assets here said "✓" while the pinned release had been stripped of every
+  // asset upstream, so this check stayed green through a desktop build that was
+  // failing on exactly what it claims to verify (v0.53.2, kgai v0.1.9). A tag is
+  // a name, not a content hash — upstream can rewrite what it points at.
+  const pinnedRel = await assetsFor(`tags/${encodeURIComponent(pinned)}`);
+  const assets = pinnedRel?.assets ?? [];
   if (!latest) {
     process.stdout.write('  latest: unknown (offline) — using pinned.\n');
     return 0;
@@ -218,12 +229,31 @@ async function verbCheckUpstream(state) {
   process.stdout.write(
     `  status:                 ${latest === pinned ? '✓ up to date' : `⚠ upstream moved ${pinned} → ${latest}`}\n`
   );
-  // Capability diff — flags/commands the plan's assumptions hinge on.
+  // Prebuilt assets ON THE PIN — what the desktop build actually downloads.
   const hasDarwin = assets.some((a) => /kg-darwin/.test(a));
   const hasKuzu = assets.some((a) => /libkuzu/.test(a));
-  process.stdout.write('\n  prebuilt assets:\n');
-  process.stdout.write(`    macOS kg binary:      ${hasDarwin ? '✓' : '✗'}\n`);
-  process.stdout.write(`    libkuzu dylib/so:     ${hasKuzu ? '✓' : '✗'}\n`);
+  const hasLinux = assets.some((a) => /kg-linux/.test(a));
+  process.stdout.write(`\n  prebuilt assets on the PIN (${pinned}):\n`);
+  if (pinnedRel === null) {
+    process.stdout.write('    (offline — not checked)\n');
+  } else if (!pinnedRel.ok) {
+    process.stdout.write(`    ✗ release ${pinned} not found upstream\n`);
+  } else {
+    process.stdout.write(`    macOS kg binary:      ${hasDarwin ? '✓' : '✗'}\n`);
+    process.stdout.write(`    linux kg binary:      ${hasLinux ? '✓' : '✗'}\n`);
+    process.stdout.write(`    libkuzu dylib/so:     ${hasKuzu ? '✓' : '✗'}\n`);
+  }
+  // A pin whose assets are gone breaks `sync-kg.mjs`, which fails the desktop
+  // build for macOS and Linux. Exit non-zero so this can gate a release.
+  const pinBroken = pinnedRel !== null && (!pinnedRel.ok || !hasDarwin || !hasKuzu || !hasLinux);
+  if (pinBroken) {
+    process.stdout.write(
+      `\n  ✗ the pinned release cannot build the desktop app — sync-kg.mjs downloads from\n` +
+        `    releases/download/${pinned}, and those assets are missing. Upstream deleted or\n` +
+        `    rewrote the release. Bump the pin to one that still carries them (verify\n` +
+        `    compatibility first: CLI surface diff + a canonical-export comparison).\n`
+    );
+  }
   if (latest !== pinned) {
     process.stdout.write(
       '\n  → Re-scan the capability surface (native --scope filter? kg import? Stop-hook/guessActor changes?),\n' +
@@ -231,7 +261,7 @@ async function verbCheckUpstream(state) {
         '    config.knowledgeGraph.engineVersion deliberately (never float — supply-chain surface, DDR-054/056).\n'
     );
   }
-  return 0;
+  return pinBroken ? 1 : 0;
 }
 
 // ── verb: session-sync (SessionStart hook — non-blocking pull) ──────────────

package/cli/lib/gitignore-block.mjs

@@ -34,6 +34,9 @@ export function buildBlock(designRel = '.design', { s3Assets = false } = {}) {
     `${root}/_server.log`,
     `${root}/_server.lock`,
     `${root}/_active.json`,
+    // Per-member siblings in a cloud cell (Phase 27 D3) — same runtime state,
+    // one file per person, and no more committable than the singleton.
+    `${root}/_active.*.json`,
     `${root}/_sync.json`, // linked-mode offline/sync status (Task 8)
     `${root}/_preflight.json`,
     `${root}/_locator.json`, // regenerable slug→path index

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@1agh/maude",
-  "version": "0.53.1",
+  "version": "0.54.0",
   "description": "Marketplace of Claude Code plugins by Michal Dovrtěl: `design` (canvas-first design iteration) + `flow` (generic agentic workflow loop with .ai second brain). Ships the `maude` CLI (with `mdcc` legacy alias) to scaffold workspace, run the design dev server, and manage configs.",
   "type": "module",
   "engines": {
@@ -49,16 +49,18 @@
     "test:e2e:desktop:lifecycle": "pnpm --filter @maude/desktop-e2e e2e:lifecycle",
     "test:e2e:desktop:switchrepos": "pnpm --filter @maude/desktop-e2e e2e:switchrepos",
     "test:e2e:desktop:onboarding": "pnpm --filter @maude/desktop-e2e e2e:onboarding",
-    "test:e2e:desktop:acp-cold-start": "pnpm --filter @maude/desktop-e2e e2e:acp-cold-start"
+    "test:e2e:desktop:acp-cold-start": "pnpm --filter @maude/desktop-e2e e2e:acp-cold-start",
+    "test:e2e:desktop:parity": "pnpm --filter @maude/desktop-e2e e2e:parity",
+    "test:e2e:desktop:parity:cloud": "pnpm --filter @maude/desktop-e2e e2e:parity:cloud"
   },
   "optionalDependencies": {
-    "@1agh/maude-darwin-arm64": "0.53.1",
-    "@1agh/maude-darwin-x64": "0.53.1",
-    "@1agh/maude-linux-arm64": "0.53.1",
-    "@1agh/maude-linux-arm64-musl": "0.53.1",
-    "@1agh/maude-linux-x64": "0.53.1",
-    "@1agh/maude-linux-x64-musl": "0.53.1",
-    "@1agh/maude-win32-x64": "0.53.1"
+    "@1agh/maude-darwin-arm64": "0.54.0",
+    "@1agh/maude-darwin-x64": "0.54.0",
+    "@1agh/maude-linux-arm64": "0.54.0",
+    "@1agh/maude-linux-arm64-musl": "0.54.0",
+    "@1agh/maude-linux-x64": "0.54.0",
+    "@1agh/maude-linux-x64-musl": "0.54.0",
+    "@1agh/maude-win32-x64": "0.54.0"
   },
   "files": [
     "cli",

package/plugins/design/dependencies.json

@@ -156,7 +156,7 @@
       },
       "install": {
         "preferred": "See docs/kgai-onboarding.md — download the pinned kgai release binary (kgai is capability-gated + opt-out; nothing to install to use classic .ai/ mode)",
-        "darwin": "curl -fsSL https://github.com/kgaidev/kgai/releases/download/v0.1.9/kg-darwin-arm64 -o /usr/local/bin/kg && chmod +x /usr/local/bin/kg"
+        "darwin": "curl -fsSL https://github.com/kgaidev/kgai/releases/download/v1.0.0/kg-darwin-arm64 -o /usr/local/bin/kg && chmod +x /usr/local/bin/kg"
       },
       "autoInstall": false,
       "fallbackBehavior": "Design DS/canvas/brand decisions are not recorded to the kgai graph; the classic .ai/ path (via /flow:record-ddr) and on-disk sidecars are unchanged.",