buzz/beehive/UX_NAVIGATION_CHECKPOINT.md

Host-local enrollment and Move — local functional candidate

Delegation 25a9e2b7, based on f59436c1aa6020e84f75853e54e59102103c9814. This replaces the earlier incomplete navigation checkpoints. Their exact text and historical evidence remain available in Git and the referenced artifact directories. No push, export, installation, relay change or native rebuild was performed. Installed 176497874 stays intact.

Corrected owner scope

Logan's correction 260a376e895ff7b1cce2fb8dcae800a4ad0661c8fcd30be0e7fc696e12905485 and steering 5679e6d7d7b51a2b07103fa6cfd2182ab567269d5216dcce7b45799b61839de1 supersede the earlier shared-first-enrollment investigation. There is no shared claim, global singleton or relay-rollout gate. Registration and explicit Start are host-local; Move transfers between selected hosts. Local duplicate prevention, authenticated owner intent, retained identity/assignment history, credential custody and truthful transfer outcomes remain required. Initial local enrollment does not assert absence on independently configured hosts.

Implemented flow and code map

• Four sections remain Host / Agents / Harnesses / Providers. Directory selection drives agent details. Start / Stop / Restart / Move and saved runtime harness/provider/model/effort/environment remain available. Later selected-next changes do not re-register identity or mutate active snapshots.
• manager-controller.ts captures an exact local host enrollment target for an owned directory agent lacking a local slot, even when another host reports that identity. manager-view.ts passes this target for explicit Start, not the other report's target. Matching hidden nsec and configured runtime registration still use read-back custody and settings revision fences.
• After verified registration, the controller submits a durable authenticated enroll intent. host-transport.ts admits it only from the configured owner. The host's bounded serialized enrollment queue runs under its existing host.lock; shutdown aborts/drains it before slot teardown.
• local-enrollment.ts retains an inert public agents/<agent>/enrollment.json before the ordinary journal and v3 manifest. Exact retained attempts recover journal/manifest prefixes; retained journals are never reset. Existing custody is read, not recreated. Enrollment hydrates through the extracted ordinary slot constructor. New and existing slot inventories are checked against the actual wire budget before manifest activation. Slot capacity stays 32.
• Enrollment is stopped placement, not Start. The continuation requires the enrollment receipt and fresh exact inventory, then the existing Save receipt, then submits ordinary revision-fenced Start. Cancellation may retain credentials or stopped enrollment, but cannot launch on a late receipt. Retry is explicit.
• Independent local roots now compose with Move. For such a destination, authorize-move is an authenticated owner command pinning the exact source operation/assignment, destination assignment and next revision. Only after its receipt does the controller submit the source Move. Destination preparation verifies this authorized prefix; the unseen successor still requires its exact source/relay signature. Without destination authorization, cross-root Move fails before source Stop. The previous same-root Move path is preserved.
• Destination adoption retains its prior assignment in assignmentHistory and preserves identity, configurations and run history. Authorizations/history are bounded. Selected-source owned Stop, preparation lifetime/CAS, source-consumed outbox, actual destination launch checks, retained receipts and failed/unknown outcome reporting remain governing. No credentials/workspace/session transfer.

Evidence

/Users/loganj/.buzz/artifacts/beehive-ux-25a9e2b7/

• focused-candidate.log: 61 passed / 0 failed, including initial unassigned registration → real private owner/host enrollment → actual owned process; cancellation before registration and after persisted enrollment; retry of before-journal, before-manifest and after-manifest failure prefixes; retained root/identity and host reopen; a running sibling unchanged; duplicate enrollment; independent-destination registration → actual Start → Stop → Move composition; cross-root Move without destination authorization refuses before source Stop; existing private/legacy/named Move, cancellation, signature, key-loss, Stop-failure, lost-grant and immutable selected-next tests.
• typecheck-candidate.log: Node 24.15.0 strict TypeScript passed.
• renderer.log: Bun 1.4.2 renderer 4/4; four-way keyboard/pointer navigation, narrow layout, selected details, hidden input and cancellation ownership.
• full-candidate.log: one default-concurrent whole-package run, 239 passed / 1 failed / 19 skipped, 259 tests, natural 34.360 seconds. Not green. broker.test.ts failed its unchanged ok conversation-response timeout. Cause is not established; no deadline/assertion relaxation, serial mask or retry-to-green. Installed opt-in cases remain skipped. The earlier f594 Move suite evidence (233/1/19) and its qualification remain historical, not overwritten.
• pty-first.log, walkthrough.json, 01-host through 11-destination-stopped .ansi/.txt: actual isolated 100×30 Node/Bun PTY. Source starts without a slot/genesis; registration cancellation preserves settings; matching hidden nsec/runtime leads to actual gpt-5; Move reaches an independently enrolled destination and visibly reports Move · Completed; destination history is retained; awaited Stop and exit 0; nsec absent from output. Frames reconstruct real PTY bytes, not screenshots. Stop-barrier instrumentation is in tests; the PTY observes resulting states.
• Failed development evidence retained: composition-first.log exposed optional empty-chain normalization in the owner-authorized prefix; composition-second.log verifies its correction. focused-final.log and typecheck-final.log retain a duplicate local test variable introduced while adding reopen coverage; corrected candidate logs above supersede them. registration-first.log, recovery-first.log and focused-first.log preserve intermediate successful scope checks.
• Unchanged native historical 700-test evidence is reused, not rerun. No repository-wide CI, live provider/relay/admission/OS-store proof is claimed.

Runnable reviewer UX

sh beehive/tools/ux-walkthrough.sh --help
sh beehive/tools/ux-walkthrough.sh

Every invocation creates a fresh beehive-pairing-cli-ux- HOME and explicit BEEHIVE_TEST_CREDENTIAL_FILE plus NODE_OPTIONS --import installed-loader isolation. It uses a real synthetic private relay, host owners and owned processes; installed service, external provider, browser, harness and credential operations remain fenced. Use only the printed synthetic nsec. The fixture pre-seeds the configured runtime, not source placement. Destination setup uses ordinary local registration and signed enrollment/Start/Stop, not a common pre-provisioned root.

Agents → Sign in → Start → yes → Review runtime → synthetic nsec → confirm. Wait for running. Move → Destination host → confirm → wait for Move Completed. Stop → confirm → wait for stopped. Ctrl-Q exits. Host/Agents/Harnesses/Providers navigation and provider/runtime configuration remain as before.

Reproduce focused validation from package CWD:

NODE=/Users/loganj/Library/Caches/hermit/pkg/node-24.15.0/bin/node
"$NODE" node_modules/typescript/bin/tsc --noEmit
"$NODE" --test test/local-enrollment.test.ts test/registration-start.test.ts \
  test/private-move.test.ts test/move.test.ts test/named-move.test.ts \
  test/binding-recovery.test.ts test/manager-controller.test.ts test/intents.test.ts \
  test/profiles.test.ts test/host-settings.test.ts test/manager-navigation.test.ts \
  test/relay-directory.test.ts
"$NODE" --test test/*.test.ts

Independent UX acceptance is arranged by Larry after this functional handback. Current-Desktop provider/harness parity is a separately supplied bounded read-only delta, not a parity claim by this implementation. No packaged harness-contract pin, Pi/Codex policy, Desktop/native source or installed artifact changed here.

Current Desktop parity continuation — b5cd2aa0

Local source continuation of 86921025, compared with Desktop 6d1f488d2273dd314184fc2ec805f8982327dc51 at refs/parity/a8c4d530-main. The parity paragraph above is historical; this bounded delta is now implemented. The enrollment/Move evidence above remains reusable and unchanged in its original artifact directory. Installed 176497874 exports, native code, relay protocols, harness discovery tiers and Databricks v2 auth are unchanged.

• Providers independently adds OpenAI, Anthropic, OpenAI-compatible and OpenRouter, alongside existing Databricks v2. Compatible endpoints require HTTPS without URL credentials/query/fragment and select auto/chat/responses. Anthropic and OpenRouter use their canonical endpoints and key contracts. Each API-key save validates the entire candidate before retaining an exact recovery reference, writes/read-backs the OS entry, then commits public settings by CAS. Secrets stay in hidden input/private helper IPC/closed runtime environment, not argv or public settings. No plaintext fallback. Failed persistence retains references.
• Buzz Agent accepts all five providers. Pi remains OpenAI/Databricks v2 only; Codex remains OpenAI only with its own CLI/effort restrictions. Catalog validation repeats these restrictions, independent of picker filtering. The stale Pi diagnostic row now uses buzz-pi-acp and salman1993/buzz-pi-acp#86b201e.
• OpenAI models use Desktop text prefixes/exclusions, creation-descending ordering, ID tie-break, dated alias suppression and display names. Compatible lists are unfiltered. Anthropic uses x-api-key/anthropic-version, display_name and after_id; OpenRouter selects tools-capable entries. Fetches forbid redirects, bound each response to 1 MiB, total rows to 10,000, returned rows to 1,000 and pagination to 20 pages with repeated/missing-cursor refusal. UI labels never replace exact IDs. Custom model entry remains available after listing failure.
• Unknown/custom models and UC FQNs retain authored provider fallback efforts. Known model constraints and Anthropic omit-fields remain; Pi projects only its supported effort vocabulary. Save and actual launch both validate. Saving a runtime/selected-next still does not alter an active run.

New evidence

/Users/loganj/.buzz/artifacts/beehive-parity-b5cd2aa0/

• DESKTOP_PARITY_DELTA.md: durable reconciliation of public source report 62399bb5…89a24, with canonical consumer pointers and resolved scope.
• focused-candidate.log: 63 passed / 0 failed. Provider-specific model APIs, bounded pagination, labels, compatibility and effort validation; actual host Save preserves the prior run, then Stop/Start produces real owned synthetic requests for Anthropic/compatible/OpenRouter. Unknown compatible/router models deliver high effort; Anthropic preserves omitted effort. Existing Pi/Codex, registration-first continuation, controller and discovery checks remain green. These external wrappers assert the production provider environment then call a loopback fixture; they are not actual vendor adapters or live API attestations.
• typecheck-final.log: strict Node 24.15.0 TypeScript passed.
• renderer-candidate.log: Bun 1.4.2 renderer 4/4.
• full-candidate.log: one final default-concurrent package run, 244 passed / 2 failed / 19 skipped, 265 tests, natural 45.719s. Not green. Broker ok conversation timeout recurred. Admission wrong-authority timing was 3210ms > 2500ms; retained records show wrong-authority rejection plus accepted Start and subsequent authorized Stop, with storage-phase and receive-order trace. Those records establish a timing assertion failure, not a wrong-authority execution failure; underlying latency cause is not established. No timeout/assertion relaxation, serial masking or retry-to-green. Native 700-test history reused.
• pty-candidate.log, walkthrough.json, numbered .ansi and .txt: actual isolated 100×30 PTY adds all three providers with hidden synthetic keys, opens selected-provider Models, saves OpenRouter/custom/high/environment runtime, registers the initially unassigned agent with that runtime, observes actual unknown-custom-model running, awaits Stop and exits 0. Synthetic API key absent from terminal bytes. Frames reconstruct PTY output; not screenshots.
• Development failures retained: first provider fixture incorrectly assigned high effort to an Anthropic omit-fields model and reused OpenAI-only ACP validation; corrected fixture now omits effort and checks the generic saved-provider seam. First unit constraint assumed gpt-4.1 lacked fallback high (manifest says otherwise); replaced with explicit known gpt-5 xhigh rejection. provider-first.log and anthropic-first.log reached outer execution timeouts after failures; they are not successful runs. First typechecks retain headers-union and duplicate-test- ternary diagnostics. renderer.log is an invocation/filter error, superseded by the explicit-path renderer run. First PTY retained a noncanonical /tmp executable alias; production correctly refused Start. Loader now resolves the synthetic executable canonically. pty-failed/ retains those frames; no production path check was weakened.

Reviewer delta

sh beehive/tools/ux-walkthrough.sh --help documents the new provider/runtime steps. Run without arguments for a fresh explicit installed-loader and synthetic-credential HOME. Use only synthetic-provider-key and the printed synthetic nsec. Host service buttons remain fenced. Provider API tests exercise bounded fetches separately; the PTY uses synthetic model responses. pty-walkthrough.py in the new artifact folder reproduces the final provider/custom-runtime Start/Stop delta. Prior independent- root Move PTY is reused, not relabeled as a new provider Move test.

No production OS-store/provider/browser/relay/harness/service operations, native rebuild, repository-wide CI, push, export or install were performed. Independent UX review remains Larry's acceptance step.