# Fabric Demonstration Learning and Cross-Application Task State Status: the repository implements the governed Record/Stop/Analyze workspace, signed Task Workspace, exact/context/visual evidence classification, detailed Photoshop and Unity capture seams, consented visual fallback, capability analysis, Toolsmith/Forge Studio handoffs, and pre-live sandbox preparation. Recording continues in an explicitly degraded state when a selected evidence source is unavailable; replay remains blocked for every step that lacks exact provider-verified evidence and a governed capability binding. Installed signed adapters, trusted cross-app transports, real qualification cases, independent review, notarization, authoritative disposable-sandbox attestation, and production commissioning remain external gates. ## Scope and repository boundary This workstream owns the observation and learning side of autonomous tool use: - Live Demonstration Recorder contracts; - a universal observation/event payload; - cross-application Task Workspace projection; - semantic actions; - advisory capability-gap detection; - demonstration-to-Skill-Graph candidate derivation. It does not own capability implementation, write-capable Photoshop/Unity expansion, or capability lifecycle transitions. It owns sealed replay review plus read-only sandbox execution lanes; effectful provider execution remains in the capability factory/sandbox workstream. This split matches the repository as it exists: | Existing authority | Reused by this slice | |---|---| | `forge_events.EventStore` | signed, append-only, workspace-scoped chronology | | `physical_capability_manifest` | canonical typed Photoshop/Unity operation inventory | | `capability_matcher.match` | advisory matching against registered capabilities | | `fabric_capability_toolsmith.propose` | review-only proposal interface for a retained gap | | `skill_graph.validate` | exact DAG, runtime-binding, type, and effect validation | | `toolsmith_supervisor` | governed cross-tool execution after certification and commissioning | | `capability_builder` | governed capability lifecycle; not called by the recorder | | `physical_production_readiness` | 20-case production release gate with independent review | No existing file in the capability sandbox workstream is changed by this increment. ## Data flow ```text Photoshop/Unity provider result or typed application-adapter event -> demonstration_provider_adapter / demonstration_application_operations (registered operation + exact stable target + typed parameters + before/after state) -> fabric.universal-observation.v1 -> demonstration_event_spine: signed, idempotent observation.recorded fact -> fabric.task-workspace.v1 projection -> fabric.semantic-action.v1 (observed meaning, no coordinates) -> capability_matcher.match -> existing capability: advisory resolution -> existing Skill Graph: advisory resolution -> no match: fabric.capability-gap-observation.v1 -> existing review-only Fabric Capability Toolsmith interface authenticated desktop-observer event batch -> bounded in-memory queue (sampling never waits on persistence) -> demonstration_interactions (drop raw keys, clipboard, coordinates and screenshots) -> universal observations + semantic_action.suggested facts -> exact human confirmation -> semantic_action.recorded (still advisory and non-executable) authenticated Photoshop UXP / Unity Editor operation batch -> session-bound application adapter runtime -> registered manifest operation and required-input validation -> paired before/after universal observations -> evidence-quality classification -> exact_provider_verified: eligible for later governed replay checks -> exact_provider_observed: typed review evidence; native proof incomplete -> exact semantic suggestion (still review-only and non-executable) consented redacted ScreenCaptureKit frame + normalized pointer phase pair -> encrypted local visual-evidence vault -> review-only visual semantic suggestion -> visual_observed: human review evidence only; never replay parameters Accessibility application/focus event -> context_only semantic suggestion -> useful chronology; never proof of the edit performed inside the app finished demonstration -> bounded parallel action resolution (maximum 4 read-only workers) -> stable join in original recorded action order -> any worker failure/cancellation: no candidate or close event is written -> fabric.demonstration-session.v1 candidate -> fabric.demonstration-skill-graph-candidate.v1 -> unresolved actions: blocked_capability -> all actions resolved: skill_graph.validate receipt -> human/governed services may later register, qualify, certify, publish and commission ``` The recorder never calls an application. The server-owned observer samples its bounded macOS Accessibility view every 250 ms and immediately enqueues sanitized changes. A single ordered persistence worker writes signed Event Spine facts and provider checkpoints, so a slow checkpoint cannot hide a complete Photoshop or Unity phase from the sampler. Stop drains the queue before review. Cancel discards queued samples, rejects late dependent facts, and removes captured content from the active Task Workspace projection while retaining the minimal signed cancellation audit fact. Transient Accessibility snapshot failures are surfaced in the runtime activity log and retried without ending capture; permission loss or a bounded run of repeated failures still fails closed, discards the queue, and removes the recording overlay. `demonstration_capture` is a separate, run-gated boundary that can explicitly invoke only the production-qualified read primitives `active_document` and `get_project_info`. It retains the verified physical result before delegating the inert observation to the recorder. `tools/fabric_desktop_observer.py` is an explicitly consented macOS transport for `demonstration_interactions`. It polls only the frontmost allowlisted Photoshop, Unity, Finder, browser, or spreadsheet process and focused Accessibility element, never installs a global input event tap, and never reads `AXValue`. It uses a loopback-only control-plane client, refuses redirects, and reads authentication from an environment variable or private token file rather than argv. Raw keystrokes, clipboard contents, pointer coordinates, screenshots and provider transcripts are discarded before retention. Derived semantics are retained as suggestions and must be confirmed by an authenticated human before they become demonstration actions. Raw click replay remains forbidden; actuation continues to use deterministic registered providers only. Accessibility is deliberately not treated as an exact edit recorder. It can say that Photoshop became frontmost or that Unity focus changed, but it cannot recover a layer name, visibility value, export destination/format, serialized property value, sprite scale, or pivot. Historical recordings that retained only those focus transitions cannot be upgraded retroactively; the missing facts never entered the Event Spine. They must be deleted or kept as context and then recorded again after the application adapters below report connected. `demonstration_application_adapter_runtime` owns the prospective typed-operation lane for a single recording session. Photoshop Fabric Provider 2.4.0 emits allowlisted UXP changes for registered operations including document resize/resolution, layer selection/name/visibility/opacity/blend, layer transforms and movement, guides, and exact-path export receipts. The Unity editor package 1.2.0 emits registered component-property, GameObject-property, ScriptableObject-field, sprite-pivot, and selected TextureImporter changes. TextureImporter capture includes pixels per unit, maximum texture size, and texture type only after post-import readback matches the pending edit; unsupported fields or a mismatch become explicit capture-incomplete diagnostics. Each retained operation still needs a stable target, typed required arguments, distinct before/after state for mutations, and manifest validation. Neither adapter grants execution, approval, certification, or production authority. Native transport integrity is a separate quality gate. The repository verifies signed installed adapter-build attestations and session-bound, ordered native envelopes; Unity uses a Library-only session channel and Photoshop has a native challenge/envelope protocol. A typed operation without complete trusted build and channel proof is retained as `exact_provider_observed`, not upgraded to `exact_provider_verified`. This lets the main recording continue honestly while preventing replay. A locally installed, signed Photoshop native challenge/hybrid add-on and its trusted key binding are still required before a real Photoshop session can satisfy that proof outside the test harness. The Unity transport writes only capture control, heartbeat, and operation-envelope JSON below `/Library/Forge/FabricLearning`; it does not write `Assets/` or game content. Install `packages/unity/com.forge.fabric-toolsmith` through Unity Package Manager before recording. Load and pair `integrations/photoshop-uxp/fabric-provider` 2.4.0 through UXP Developer Tool for Photoshop. Learning Studio shows Accessibility, typed-operation, native-integrity, and visual-source health separately. A missing or disconnected source does not discard the rest of the recording: the source reports `recording_continues=true`, `capture_complete=false`, and the missed interval remains a visible recapture/capability blocker. The operator can still stop, review, and retain the honest partial recording; Fabric cannot replay the unsupported interval. The local provider adapter consumes `forge.physical-operation-result.v1` only after the physical runtime reports `verified` and binds it to the exact compiler-sealed plan. It requires a stable semantic subject for every step, removes raw provider transcripts, redacts secret-bearing fields, and preserves the Photoshop/Unity application identity. Declarative Unity property/value arguments are retained from the sealed plan. Photoshop scripts retain only compiled artifact kind, basename, and SHA; absolute paths and script bodies are discarded. It cannot contact either application. The live recorder does not accept a plan or result from the browser. `physical_operation_service` resolves the exact `operation_id` + `idempotency_key` from its durable ledger, verifies the ledger row, request digest, compiler seal, plan/result digests and goal-verification state, and returns a defensive copy. Missing, incomplete, in-flight or tampered rows produce no observation. ## Evidence quality and honest degraded recording `demonstration_evidence_quality` provides the monotonic evidence lattice used by review and replay: | Quality | What it proves | Replay status | |---|---|---| | `exact_provider_verified` | A trusted installed build and session-native channel reported a typed target, typed arguments, and required before/after/postcondition evidence. | The only evidence quality that may pass the provider-write evidence gate; capability, sandbox, consent, and lifecycle gates still apply. | | `exact_provider_observed` | A typed provider operation was observed, but installed-build or native-channel proof is incomplete. | Reviewable and retainable; replay blocked. | | `visual_observed` | Separately consented, redacted before/after visual evidence and normalized pointer phase evidence were retained. | Human review and target disambiguation only; replay blocked. | | `context_only` | Accessibility observed application/focus/control context. | Chronology only; replay blocked. | | `unobserved` | No retained evidence proves the action. | Recapture or capability/evidence work required. | Quality may be preserved or downgraded; it cannot be upgraded by a browser assertion, model inference, or human prose. `provider_write_blockers(...)` requires exact provider-verified evidence, a verified typed target and arguments, distinct state for a mutation, and a verified provider postcondition. Visual evidence never fills those fields. The optional visual lane is separately consented after the main recording opens. The native ScreenCaptureKit helper records bounded, redacted frames plus complete pointer-down/pointer-up phases without retaining raw keyboard input, clipboard contents, passwords, or replay coordinates. Evidence is encrypted at rest in a task/session-bound local AES-GCM vault with expiry and deletion receipts. If permission, helper startup, secure-input checks, redaction, storage, or analysis fails, the lane degrades to context only and the main recording continues. Its semantic coordinator is review-only and cannot write Event Spine facts, contact a provider, or authorize replay. Finder, browser, and spreadsheet exact capture has a signed server contract and injected source seams, but no trusted native products or qualified physical manifests are shipped yet. Their missing transports report a degraded source while recording continues. See [`fabric-cross-app-native-capture.md`](fabric-cross-app-native-capture.md). ## Contracts implemented ### Universal observation `autonomy_observation.build_observation(...)` produces `fabric.universal-observation.v1`. It binds: - workspace, task, demonstration session and monotonically useful sequence identity; - application and source kind (`provider`, `accessibility`, `artifact`, `application_event`, or `operator`); - a stable semantic subject and bounded observed state; - evidence references and observation trust; - a canonical digest. Secrets are redacted. The record has `authority=observation_only`; it cannot approve or execute. Images, large application payloads and raw provider logs remain content-addressed evidence rather than being embedded in the event. ### Semantic action `autonomy_observation.build_semantic_action(...)` produces `fabric.semantic-action.v1`. It binds a verb and stable object to before/after observations, declarative arguments, effect class and the same vocabulary accepted by `capability_matcher.match`: - required effects; - input/output types; - runtimes; - permission and risk ceiling; - dry-run requirement; - intent text. Write or external actions require an observed postcondition. Raw code, scripts, shell commands, screen coordinates, authority flags and caller-asserted production readiness are forbidden. ### Demonstration session `demonstration_recorder` is a pure sealed state machine: ```text recording -> candidate \-> discarded (reserved state) ``` Every action must reference observations already recorded in the same workspace, task and session. Finishing creates only an observational candidate. It does not register or run a capability. `demonstration_event_spine` opens the task from a sealed recording session and appends already validated observations/actions as idempotent signed facts. It verifies the retained event snapshot before accepting dependent facts, binds them to the opened session, and refuses semantic actions whose referenced observations are not retained. ### Task Workspace `task_workspace.project_store(...)` verifies the authoritative Event Store and then folds its Task Workspace facts. The lower-level `project(...)` replay helper requires the corresponding `EventStore.verify(...)` receipt and rejects unattested input. The projection maintains: - authoritative goal/context references; - the latest semantic state for each application; - ordered observations and actions; - content-addressed cross-application artifact handoffs; - capability gaps and derived Skill Graph candidates. - exact human outcome-review receipts bound to closed candidates. The projection is order-tolerant and idempotent by Event Spine identity. It does not duplicate the event store or `toolsmith_supervisor` run authority. Its status is a view (`open`, `recording`, `blocked_capability`, `candidate_ready`, or `closed`), never an execution decision. The authenticated `GET /api/task-workspace?task_id=` endpoint exposes one projection within the server-selected workspace. It verifies the Event Spine before reading, binds the receipt to the exact event count and head used for projection, returns no raw cross-workspace facts, and offers no write, approval, registration, certification, or execution operation. Deleting a saved recording appends `task.workspace.recording_deleted` for the exact current session and authenticated human. It never rewrites the append-only Event Spine. The tombstone clears active review/replay material from the Task Workspace projection, hides the item from the recording library and detail route, and permits a fresh consented session to reuse the Jira key. The minimal signed deletion receipt remains as audit evidence and has no execution authority. The authenticated surface is deliberately small. Recording mutations are operator/run-gated; candidate registration is separately admin-gated: - `POST /api/demonstrations/start` opens one signed, workspace-scoped session; - `POST /api/demonstrations/capture-state` executes one explicitly requested, registered read-only Photoshop or Unity inspection, retains the exact verified result, and records an observation. It has no effectful plan steps and cannot capture OS input; - `POST /api/demonstrations/capture-source-control` runs a fixed read-only command allowlist. Git retains branch, HEAD, and bounded status entries with optional locks disabled; Perforce retains connection identity and opened-file counts/action summary without depot paths or raw output. It uses server-owned game-repository/workspace roots and cannot sync, edit, add, commit, submit, push, accept a browser-selected path, or widen execution authority; automatic Git/Perforce baselines are labeled as system readiness checks rather than demonstrated user actions. Their independent reads may overlap, but their signed observation writes share the recorder's ordered observation transaction so sequences remain unique; - `POST /api/demonstrations/cancel` closes an accidental recording with an audit-only cancellation fact and discards the attempt from the active review projection. It derives no Skill Graph candidate, detects no capability gap, and grants no authority; - `POST /api/demonstrations/stop-capture` stops the macOS observer and drains already sampled events, then appends a signed `task.workspace.capture_stopped` review boundary without deriving a candidate. The durable `capture_state=stopped` projection survives dashboard refreshes and backend restarts. The operator can then review/confirm semantics before using the same primary control to analyze the recording; - accessibility interaction persistence is batched with one signed-workspace projection per task, and repeated activation/focus hints are collapsed at the advisory suggestion layer. Slow Photoshop/Unity provider checkpoints are never run on the Accessibility sampling thread. The owned recorder queues one read-only checkpoint at each Photoshop/Unity application-phase boundary on its buffered persistence worker; deliberate verified snapshots remain available through the separate capture-state controls; - `POST /api/demonstrations/record-operation` translates one exact retained verified physical result into provider-attested observations and rejects declared artifact consumption unless it matches an exact retained handoff to that application; - `POST /api/demonstrations/record-interactions` retains one bounded desktop-observer batch as sanitized operator-attested observations and separate review-only semantic suggestions; - `POST /api/demonstrations/visual-fallback/consent`, `/start`, `/status`, `/stop`, and `/cancel` own the separately consented visual-evidence lifecycle. A visual failure never closes the main demonstration, and cancel/delete removes its task/session-bound vault material; - `POST /api/demonstrations/visual-analysis/start`, `/status`, and `/cancel` run bounded, server-owned review-only interpretation over retained redacted visual evidence. Late or cancelled advisory results cannot become actions or replay inputs; - `POST /api/demonstrations/revise-suggestion` lets an authenticated human retain a new semantic candidate with edited verb, object, effect, or intent. It preserves the source application and observation bindings, links the exact source digest as evidence, and accepts no authority fields; - `POST /api/demonstrations/confirm-suggestion` resolves only an exact retained suggestion digest and records the server-owned semantics as a confirmed advisory action; caller semantic overrides are ignored; - `POST /api/demonstrations/review-action` appends an exact human include/exclude/undo decision without deleting or mutating the confirmed action. Reloading Task Workspace restores the effective review set, and analysis accepts only the server-projected included action digests; - `POST /api/demonstrations/record-handoff` seals a content-addressed, observation-only Photoshop to Unity (or Unity to Photoshop) transfer fact without transferring or executing anything; - `POST /api/demonstrations/record-action` seals a semantic interpretation referencing retained observations; - `POST /api/demonstrations/stop` resolves independent confirmed actions with at most four bounded read-only workers and rejoins them in their original recorded order. Only after every resolution succeeds does the single parent derive and retain a review-only Skill Graph candidate plus any capability gaps and close the Task Workspace. Application control, Event Spine writes, Skill Graph construction, approvals, and publication are never fanned out; - `POST /api/demonstrations/gaps/review` explicitly hands one exact retained gap digest to the existing durable Studio `capability_acquisition` queue; - `POST /api/demonstrations/candidates/register` is a separate admin review action that resolves an exact retained, closed, `review_ready` candidate and passes only its server-retained graph to the existing Skill Graph registry; - `POST /api/demonstrations/reanalysis/qualified/start`, `/status`, and `/cancel` provide a bounded, read-only reanalysis runtime after the server resolves an explicitly selected exact qualified capability. The UI still needs an authoritative Capability Center selection/link receipt before this route can be offered automatically; - `POST /api/demonstrations/replay/sandbox-preparation/start`, `/status`, and `/cancel` resolve the closed Task Workspace server-side, bind its exact replay plan, reject protected/game-shaped targets, prepare a disposable target description, and run sealed no-write validation. A prepared projection is not a live run and cannot assert the external disposable-sandbox attestation; - `POST /api/demonstrations/outcomes/accept` is a separate admin review action that appends an identified human decision for the exact closed candidate. It cannot approve execution or set production readiness. Exact retries are idempotent. Changed session requests, subject bindings, timestamps, semantic actions or graph candidate identities fail closed. Stopping never queues capability acquisition; that requires the separate gap-review call. Candidate registration ignores caller-supplied graph data and rejects unresolved demonstrations. Registration creates only the registry's normal `candidate` lifecycle record. Certification, publication, commissioning and execution remain separate existing authorities and are all false in the registration response. ### Opt-in macOS desktop observer The Demonstrations workspace now starts the bounded observer after the disclosure dialog is accepted. While the dialog is open, polling is paused, the recorder remains idle, and the approval button stays disabled until every disclosure is checked; cancel or Escape performs no preparation or capture. The dialog is centered and a native always-on-top status window says “Fabric is capturing data” on every connected display for the duration of capture. The overlay never reads pointer coordinates to choose a display. The primary control follows `Start recording -> Stop recording -> Analyze recording`; `Cancel & discard` is a separate abandon operation. “Refresh captured steps” only reloads retained state and never captures new state. During analysis the primary control and status panel show elapsed time plus completed/total step progress while bounded workers resolve confirmed steps. Analysis is a task-scoped background job, so reopening the workspace resumes its ephemeral progress view instead of starting a duplicate. `Cancel analysis` revokes the job's result and leaves the stopped capture available for retry; `Cancel & discard` remains the separate operation that abandons the recording. A server-owned deadline fails closed in the same retryable state. Progress is operational projection only and is not appended to the signed Event Spine. This is analysis parallelism only: Fabric still has one parent, one stable join, and no child receives write, approval, replay, or completion authority. The nearby live activity log exposes recorder drain, snapshot retries, source-control readiness, per-action resolution, cancellation, and terminal state without requiring the operator to scroll to the bottom of the page. Final Git and Perforce metadata reads overlap as a visible background phase; signed retention remains serialized, so they no longer block the browser request or race observation sequence allocation. Dynamic model subagents use the same governed pattern: an absolute deadline and cooperative cancel event revoke late advisory results. Children remain unable to write, approve, publish, control an application, or declare the parent complete. Start the signed demonstration session in the UI first. Then grant Accessibility to Terminal (or a future packaged Forge observer) in **System Settings > Privacy & Security > Accessibility** and run: ```bash FORGE_OBSERVER_TOKEN_FILE="$HOME/.config/forge/observer-token" \ venv/bin/python tools/fabric_desktop_observer.py \ --task-id GOTRPG-56903 --workspace-id default \ --base-url http://127.0.0.1:8788 --consent ``` The token file is optional when dashboard authentication is disabled; when used, it must be a private regular file (`chmod 600`). Use `--dry-run --once` to verify permission and inspect the bounded event summary without sending it. The client accepts only loopback HTTP(S), refuses HTTP redirects, and stops if the Task Workspace is not recording. `Ctrl-C` is the operator stop boundary. The observer does not open, save, export, import or otherwise modify Photoshop, Unity, Perforce or game assets. Computer control during approved sandbox replay is protected by a private operating-system file lock with a monotonic fencing generation. This makes the single-owner boundary apply across Forge backend processes on the workstation, not merely within one Python runtime. A process crash drops the OS lock automatically; preflight failure, completion, failure, stop, and emergency stop all release ownership. The lease grants no authority by itself: exact plan sealing, sandbox target, fresh human consent, and a visible control overlay remain mandatory. Vision is an optional, separately consented review source. It is not the primary recorder: screenshots remain excluded from normal Task Workspace/Event Spine observations, visual bytes stay in the encrypted local evidence vault, and semantic replay continues to require provider-verified typed targets rather than pixels or coordinates. Retained visual evidence is redacted, content-addressed, expiry-bound, and represented outside the Event Spine by non-authorizing receipts. Vision must not manufacture missing replay parameters. A visual reviewer may say that two sandbox images appear equivalent or identify a likely region for human attention, but it cannot authoritatively supply a Photoshop layer ID, filesystem destination, Unity GlobalObjectId, serialized field name, or numeric pivot. Those values must come from a registered application adapter. Vision receipts remain `review_only`, bind exact before/after artifact digests and model revision, and always carry `execution_authorized=false` and `production_ready=false`. ### Capability-gap detector `capability_gap_detector.detect(...)` consumes one sealed semantic action. It asks the existing matcher first, can inspect an explicitly supplied Skill Graph index second, and otherwise emits a stable evidence-linked gap. The gap can be adapted with `toolsmith_context(...)` to the existing `fabric_capability_toolsmith.propose` seam. Detection is deliberately read-only. It cannot write a capability candidate, bind an executor, start sandbox execution, approve promotion, or set production readiness. Because this is advisory graph construction, the matcher uses its existing `design_time_binding` mode. A production-qualified capability with unknown live connector health can be reused in a review candidate; actual execution still performs a separate readiness and authority check. This prevents a disconnected dashboard from turning an existing physical primitive into a duplicate Toolsmith implementation gap. The backend builds that advisory index only from graph versions whose existing certification, publication, and active commission still pass `skill_graph.commission_drift`. The index exposes only sealed identity and matching terms; a match blocks redundant capability acquisition but does not inline, bind, or execute the graph. The explicit gap-review route re-reads and verifies the signed Event Spine, resolves the exact gap ID and digest in the server-selected workspace, builds the existing bounded Toolsmith proposal, and queues the existing restart-safe Studio acquisition job with a stable idempotency key. The queued job and proposal both keep execution, publication and promotion authority false. Learning Studio unwraps the exact retained gap identity, renders the durable Studio job ID and status, and resumes that status after refresh. Application activation and selection hints are timeline context, not implementation gaps: they cannot be confirmed unchanged, analyzed into new gaps, or sent to Toolsmith. The reviewer may retain an immutable revision with an exact operation, stable target, replay arguments and before/after evidence, or start a corrected recording. A review-ready candidate can be added to the Forge Studio Skill Graph registry, but registration still creates only a candidate; qualification, certification, publication, commissioning and execution remain separate. ### Skill Graph integration `demonstration_skill_graph.build(...)` accepts only a sealed advisory resolution bound to the exact semantic-action ID and digest, maps resolved actions to ordered capability nodes, and passes the draft through `skill_graph.validate`. Missing or tampered action resolution remains explicit in `unresolved_gaps`; it is never hidden behind a generic control. Even a fully valid graph remains a `learning_candidate` with registration, certification, publication and commissioning all false. ## Certification boundary A successful sandbox smoke proves only that one candidate can execute in one throwaway context. It may support candidate certification or a bounded pilot, but it is not production evidence. The existing production authority is already stronger: 1. capability contract validation and exact executor binding; 2. no-write qualification; 3. live sandbox smoke with postconditions; 4. independently approved pilot activation; 5. `physical_production_readiness` over at least 20 unique attributable cases, including provider execution, zero unauthorized writes, honest completion, recovery/stop behavior, acceptance and independent review; 6. separately fenced production approval; 7. production transition through `capability_builder`/`physical_toolsmith`. The observation model should supply the attributable case/evidence references for steps 3–5. It must not weaken or replace those gates. `demonstration_readiness.build_case(...)` now supplies that narrow bridge. It derives provider contact, mechanical success and postcondition evidence from one verified Task Workspace, requires the signed human-acceptance fact, and defaults non-derivable safety claims to failing values. Its single-case evaluator necessarily remains non-production-ready because it has neither the 20-case corpus nor independent review. ## Progress tracker Current release-gate progress: **0 of 20 distinct accepted production cases**. The live read-only provider probes validate connectivity but do not count as production cases because they had no approved writable ticket scope, artifact handoff outcome, or independent human acceptance. ### Read-only operator audit The repository can prepare and inspect evidence without manufacturing it or granting authority: ```bash venv/bin/python tools/fabric_qualification_batches.py \ --output /tmp/fabric-autonomy-qualification-batches.json venv/bin/python tools/audit_macos_release.py \ --archive /absolute/path/to/Forge-macOS.zip \ --receipt /absolute/path/to/notarization-receipt.json \ --app /absolute/path/to/Forge.app ``` The qualification packet is disabled and review-only. The macOS command verifies already-created artifacts and returns a blocked result until archive binding, Developer ID signature, accepted notarization, stapling, Gatekeeper assessment, and package identity all pass. Neither command contacts an application provider, enables live control, changes capability maturity, commissions an agent, or authorizes distribution. The full gate/evidence split is recorded in [`fabric-autonomy-external-gates.md`](fabric-autonomy-external-gates.md). ### Platform implementation - [x] Reconcile ownership with the capability factory/sandbox workstream and preserve its changes. - [x] Implement the sealed Live Demonstration Recorder state machine. - [x] Implement the universal Photoshop/Unity observation and Semantic Action contracts. - [x] Persist observations, actions, gaps, candidates, handoffs, closure, and acceptance decisions on the signed Event Spine. - [x] Expose a verified, read-only cross-application Task Workspace projection. - [x] Resolve exact retained physical-operation results instead of accepting browser claims. - [x] Add a run-gated, read-only live-state capture boundary for Photoshop and Unity. - [x] Add explicit Git and Perforce demonstration scopes with signed metadata-only snapshots; keep source-control commands read-only and retain no Perforce depot paths from unbound opened files. - [x] Add an accessible operator Record/Stop workspace with ticket/goal/application scope, retained event timeline, semantic confirmation, and review-only stop result. - [x] Add sanitized application-interaction ingestion with replay-safe observations and retained semantic suggestions; never store raw keys, clipboard data, coordinates, screenshots or authority. - [x] Add session-bound exact Photoshop UXP and Unity Editor operation adapters that retain only registered typed operations with stable targets and before/after state; keep Unity transport under `Library/` and never write game assets during capture. - [x] Add an immutable evidence-quality lattice (`exact_provider_verified`, `exact_provider_observed`, `visual_observed`, `context_only`, `unobserved`) and require the first quality plus typed target/arguments/postcondition before a provider write can be replay-ready. - [x] Add installed-build attestation and native session-envelope verification, anti-replay, ordering, revocation, and explicit degradation. A missing proof keeps recording open but cannot upgrade evidence or authorize replay. - [x] Capture detailed supported Photoshop layer/transform/guide/export operations and Unity component/GameObject/ScriptableObject/sprite/TextureImporter operations prospectively, with postcondition/readback checks and explicit unsupported/mismatch diagnostics. - [x] Add separately consented visual fallback with bounded native ScreenCaptureKit evidence, normalized pointer phases, redaction, encrypted local retention, review-only semantics, cancellation/deadlines, and deletion receipts. Visual evidence never supplies replay parameters. - [x] Add signed Finder/browser/spreadsheet operation-envelope contracts and injected source seams that report degraded status without stopping the recording. They intentionally remain observation-only until trusted native transports and qualified physical manifests exist. - [x] Show Accessibility and exact-operation adapter readiness separately so an operator cannot mistake focus context for layer/property/export/pivot evidence. - [x] Add authenticated, exact-session recording deletion as an append-only tombstone; hide deleted attempts from list/detail views while preserving the audit chain and allowing a clean re-record. - [x] Require exact human confirmation of a retained suggestion before it participates in analysis. - [x] Add durable include/exclude/restore decisions for confirmed semantic steps, keep the original signed evidence immutable, and bind analysis to the exact effective review projection. - [x] Add immutable human suggestion revisions: the source candidate remains retained, the revision links its exact digest, and only the new candidate's exact digest can be confirmed. - [x] Add an opt-in macOS desktop-observer CLI with explicit `--consent`, fail-closed Accessibility preflight, Photoshop/Unity allowlisting, loopback-only authenticated batching, and no global input event tap or `AXValue` reads. - [x] Enforce content-addressed artifact handoffs before declared downstream consumption. - [x] Route unsupported actions to the existing review-only Toolsmith acquisition seam. - [x] Reuse production-qualified capabilities for advisory candidates when only live connector health is unknown; retain execution/readiness gates and prevent duplicate Toolsmith gaps. - [x] Reuse eligible retained Skill Graphs only when certification, publication, and active commissioning still pass drift checks. - [x] Register only exact retained `review_ready` candidates through the existing admin authority. - [x] Expose unresolved capability gaps and review-ready candidate registration directly in Learning Studio as governed handoffs to Toolsmith and Forge Studio. - [x] Observe sealed sandbox smoke results without granting promotion or production readiness. - [x] Record an identified human outcome decision without granting execution or lifecycle authority. - [x] Convert one exact accepted Task Workspace outcome into one conservative readiness case. - [x] Verify read-only live provider contact with Photoshop 27.8.0 and Unity 2022.3.62f2. - [x] Complete an isolated UI smoke demonstration end-to-end (`UI-SMOKE-20260808`) with one Photoshop `active_document` observation, one confirmed advisory Semantic Action, and a retained capability-gap candidate; no application writes or lifecycle promotion occurred. - [x] Add replay, duplicate, order, drift, authority, handoff, and 20-case bypass regressions. - [x] Commit and push the implementation to `main` without changing certified agents. - [x] Require an explicit pre-record disclosure and identified human consent before opening a demonstration session. Retain the bounded-observation, sensitive-data, separate-live-approval, and emergency-stop acknowledgements as a signed Task Workspace fact. - [x] Extend bounded desktop observation and semantic review to Finder, allowlisted browsers, and spreadsheet applications while continuing to discard values, raw keys, clipboard data, screenshots, and pointer coordinates. - [x] Build an exact, content-addressed replay plan from the closed retained candidate, show its observations, arguments, provider binding, missing inputs, and blockers, then issue a no-write validation receipt without contacting application providers. The UI calls this a sandbox readiness check, focuses an actionable summary after the check, and separates blockers for no-write validation from blockers for later live control. - [x] Require an identified human to review every exact validated replay step in order. One sandbox validation and one review do not certify or promote a capability. - [x] Show a clearly labeled secondary Fabric pointer only when a planned macOS Accessibility step has a stable selector (or is an application activation), including click feedback and reduced-motion support. Generic semantic or provider steps are shown as procedure cards, not as simulated pointer replay. Preview positions remain illustrative and raw pointer coordinates stay excluded from retention. - [x] Show a small, non-interactive native macOS overlay while approved live sandbox control is active. It identifies Fabric control, includes a secondary pointer/status pulse, respects Reduce Motion, disappears on completion/failure/emergency stop, and fails closed if it cannot appear. - [x] Add an ephemeral, emergency-stoppable macOS Accessibility test lane for reviewed Finder, browser, and spreadsheet read/navigation actions. It uses application/control selectors only, never coordinates or raw keyboard replay, and requires a separate one-run live-control consent. - [x] Add a live read-only Photoshop/Unity provider lane that revalidates the exact production manifest binding and provider readiness immediately before execution. It cannot execute writes, use coordinates, or widen the reviewed plan. - [x] Add server-owned sandbox preparation routes and UI sequencing for exact plan binding, protected-target rejection, disposable target description, bounded cancellation/deadlines, and sealed no-write validation before a replay plan is retained. - [x] Add bounded qualified-selection reanalysis services that accept only a server-resolved exact qualified capability identity and retain no execution authority. - [ ] Install and trust a signed Photoshop native challenge/hybrid add-on; bind its exact build key and verify it in real Photoshop sessions. Repository protocol tests are not installation proof. - [ ] Build, sign, install, and qualify trusted Finder, browser, spreadsheet, and Numbers transports; provision their keys and add reviewed physical manifests/handlers before any replay use. - [ ] Package/notarize the desktop observer as part of the Forge macOS distribution and add signed lifecycle/status reporting. The repo CLI is functional, but it is not installed as a background service and no global OS listener is enabled. - [ ] Link Capability Center's authoritative exact qualified-capability selection receipt to the reanalysis UI. Never infer the selection from a completed Toolsmith job or matching prose. - [ ] Supply and verify an authoritative disposable-sandbox attestation before live application contact; repository target preparation cannot attest an external sandbox. - [ ] Add governed write execution of a confirmed Skill Graph through registered providers. Do not replay raw mouse/keyboard coordinates or bypass normal approval/readiness checks. Photoshop/Unity writes remain blocked until the exact Skill Graph has a commissioned provider binding and a positively identified disposable application sandbox. ### Production evidence campaign - [ ] Select the first approved Jira ticket and a bounded disposable/approved Photoshop and Unity resource scope. - [ ] Confirm the ticket's acceptance criteria, source-preservation requirements, allowed writes, rollback, application versions, worker identity, and named human reviewer. - [ ] Capture the Photoshop before-state through a provider-attested observation. - [ ] Execute only the ticket-approved Photoshop operation through the governed physical runtime. - [ ] Verify the Photoshop postcondition and seal the exported artifact digest. - [ ] Append the exact Photoshop-to-Unity handoff before Unity declares artifact consumption. - [ ] Execute only the ticket-approved Unity import/application operation. - [ ] Verify Unity postconditions, source preservation, authorization, and recovery/stop evidence. - [ ] Obtain and retain the identified human review decision for the exact closed candidate. - [ ] Add the accepted result as one unique `physical_production_readiness` case. - [ ] Repeat with distinct tickets, evidence references, and resource scopes until **20/20** cases are retained; do not duplicate or synthesize cases. - [ ] Obtain independent review of the sealed 20-case corpus. - [ ] Run `physical_production_readiness.evaluate` and require every dimension to pass. - [ ] Request the separately governed production transition through `capability_builder` only after the full benchmark and approval gates pass. ### Coordination - [x] Claude's sandbox/factory implementation is already integrated; no general Claude follow-up is required. - [ ] Ask Claude or Toolsmith for a concrete capability implementation only if a retained demonstration produces an unresolved capability gap. - [ ] The operator/product owner must supply or approve each real Jira ticket, writable scope, and reviewer; Codex can then execute and retain the governed evidence flow. ## Incremental integration sequence 1. Land these pure contracts and tests independently of the capability sandbox branch. **Done.** 2. Add provider-side adapters that translate existing Photoshop/Unity typed responses into `fabric.universal-observation.v1`; do not add coordinate actuation. **The verified physical-result adapter and exact retained-result resolver are done.** 3. Append the observation/action payloads as signed Event Spine facts and expose the Task Workspace projection through a read-only backend endpoint. **The signed append service and verified read endpoint are done.** 4. Route retained gaps to the existing Studio capability-acquisition review flow. The acquisition service, not the detector, owns candidate persistence. **Done through an explicit, idempotent retained-gap review action.** 5. Accept sandbox smoke evidence from the capability workstream as one observation class. Keep the result at candidate/pilot maturity until the existing production benchmark passes. **Done through an internal-only adapter that accepts both verified and honest failed/skipped sealed receipts while preserving `lifecycle_effect=none`, `promotion_eligible=false`, and `production_ready=false`.** 6. Add an explicit review action that converts a fully resolved demonstration candidate into a normal `skill_graph.register` request. Preserve the existing separate qualification, certification, publication and commissioning actions. **Done through an exact retained candidate digest and the existing admin-gated registry authority.** 7. Run representative Photoshop-to-Unity demonstrations and feed their distinct accepted outcomes into `physical_production_readiness`; do not infer production readiness from recorder confidence. **The live read-only provider boundary was verified on 2026-08-08 against Photoshop 27.8.0 and Unity 2022.3.62f2. Writable cross-application production cases remain intentionally pending distinct approved tickets, bounded resource scopes, human acceptance, and independent review.** ## Regression coverage - provider-event replay produces byte-identical observation and action digests; - dropped/duplicated/out-of-order events converge in Task Workspace; - declared Unity consumption rejects a missing or changed Photoshop handoff digest; - Git capture disables optional locks and records only branch/HEAD/bounded status metadata; - Perforce capture records connection/opened summaries but never syncs or retains unbound depot paths; - application focus changes do not change stable semantic object identity; - unsupported observed actions generate one idempotent gap and no candidate write; - raw keyboard, clipboard, pointer-coordinate and screenshot fields never enter retained interaction observations, and unsupported key-capture event kinds fail closed; - replaying an exact observer batch converges on one observation and one suggestion; - caller-supplied confirmation fields cannot replace the exact retained suggestion semantics; - semantic review cannot mutate its source suggestion, replace application/observation bindings, submit authority fields, or bypass exact-digest confirmation of the retained revision; - the desktop observer refuses non-loopback control planes, redirects, absent consent, missing Accessibility permission, non-Photoshop/Unity processes, and non-private token files; - a changed capability or graph digest invalidates the derived candidate; - sandbox success and a single accepted live case cannot bypass the 20-case release gate; - observations, handoffs, matches, registrations and acceptances cannot authorize execution, approval, certification, commissioning, publication, or production readiness.