# HOLD requirements and evidence — 0.2.0

**Local-selection update, 2026-10-19:** see [local AI selection](/reference/docs/LOCAL_AI_SELECTION.md) for implemented resource/evidence guards, exact-artifact task profiles, native results and unverified candidate/platform limits. Historical evidence below is retained.

**Free-AI update, 2026-10-17:** mobile 0.2.1 adds saved local agents, coding roles and device-aware model selection. It passed 43 mobile tests, six native groups and 92 source/build-copy checks; see [current free-AI scope](/reference/docs/FREE_AI_SCOPE.md). Desktop 0.2.0 is reused unchanged. The baseline matrix below retains its original versioned evidence; Apple native validation remains hardware-blocked.

This matrix tracks the original specification, implemented capabilities, actual verification and explicit limits. The earlier 0.1.0 reports remain historical evidence; current v2 reports are linked per row. The matrix includes optional explorations and future Network/payment operations so their absence cannot be mistaken for a working service. Those future operational rows are not claimed as current release features.

**IMPLEMENTED AND VERIFIED** means the named scope was actually exercised, not every platform/device or model. **IMPLEMENTED BUT NOT VERIFIED** means code exists but the full listed execution scope remains unobserved. **BLOCKED BY AN EXTERNAL DEPENDENCY** is reserved for unavailable hardware/toolchains, signing/account access or explicit owner approval. **NOT IMPLEMENTED** is an engineering/optional-feature gap, never disguised as a credential requirement. Counts are not a completion percentage. See [VERIFICATION.md](/reference/docs/VERIFICATION.md) for final suite totals and artifact-bound native evidence.

## Evidence and source key

All paths below are repository-relative. Table keys refer to these concrete files; “—” means no implementation.

| Key | Location / evidence |
| --- | --- |
| CORE | [packages/core/index.js](/reference/packages/core/index.js) |
| ENGINE | [packages/core/inference.js](/reference/packages/core/inference.js) |
| HW / CAT / DL | [hardware.js](/reference/packages/core/hardware.js), [catalog.js](/reference/packages/core/catalog.js), [downloads.js](/reference/packages/core/downloads.js) |
| STORE | [storage.js](/reference/packages/core/storage.js), [state-schema.js](/reference/packages/core/state-schema.js) |
| PROJECT / AGENT | [projects.js](/reference/packages/core/projects.js), [agents.js](/reference/packages/core/agents.js) |
| MAIN / PRELOAD / CTL | [main.js](/reference/apps/desktop/electron/main.js), [preload.cjs](/reference/apps/desktop/electron/preload.cjs), [controller.js](/reference/apps/desktop/electron/controller.js) |
| DUI | [apps/desktop/src/main.tsx](/reference/apps/desktop/src/main.tsx), [styles.css](/reference/apps/desktop/src/styles.css) |
| C-STORE / C-PROJECT / C-AGENT | [storage tests](/reference/tests/core/storage.test.js), [project tests](/reference/tests/core/projects.test.js), [agent tests](/reference/tests/core/agents.test.js) |
| C-DL / C-INF / C-CTL | [download tests](/reference/tests/core/downloads.test.js), [inference fixtures](/reference/tests/core/inference.test.js), [controller tests](/reference/tests/desktop/controller.test.js) |
| D-E2E | [scripts/test-desktop.mjs](/reference/scripts/test-desktop.mjs); current [desktop smoke](/reference/docs/evidence/desktop-smoke-v2.json) and delivered captures |
| REAL | [scripts/verify-inference.mjs](/reference/scripts/verify-inference.mjs); actual [inference.json](/reference/docs/evidence/inference.json) |
| INSTALLED | [scripts/test-installed-v2.mjs](/reference/scripts/test-installed-v2.mjs); final [application checks](/reference/docs/evidence/packaged-app-v2.json) and [installation/uninstall](/reference/docs/evidence/windows-installation-v2.json) |
| CATALOG-REAL | [scripts/verify-catalog-models.mjs](/reference/scripts/verify-catalog-models.mjs); [model-4b.json](/reference/docs/evidence/model-4b.json), including preserved experimental failure |
| POWER / P-TEST | [packages/power](/reference/packages/power/README.md); [17 tests](/reference/packages/power/power.test.js), [typed contract](/reference/packages/power/index.d.ts) |
| MOBILE / M-TEST | [apps/mobile](/reference/apps/mobile/App.tsx); [domain](/reference/apps/mobile/tests/domain.test.ts), [storage](/reference/apps/mobile/tests/storage.test.ts), [native lifecycle](/reference/apps/mobile/tests/native-resource.test.ts) tests |
| M-NATIVE | [mobile-native-verification.json](/reference/docs/evidence/mobile-native-verification.json); Android captures delivered with artifacts/mobile |
| SITE / W-TEST | [apps/website](/reference/apps/website/build.mjs); [website tests](/reference/apps/website/website.test.mjs), [browser verification](/reference/apps/website/VERIFICATION.md) |
| ARCH / INF / MODELS | [architecture](/reference/docs/ARCHITECTURE.md), [inference](/reference/docs/inference.md), [model matrix](/reference/docs/models.md) |
| DESIGN / RESEARCH | [design system](/reference/docs/DESIGN_SYSTEM.md), [competitive research](/reference/docs/competitive-research.md) |
| MOBILE-DOC / POWER-DOC | [mobile evidence](/reference/docs/mobile.md), [Power/Network architecture](/reference/docs/power-network.md) |

## Foundation, research, and architecture (specification §§0–4, 13, 17–19)

| Requirement | Implementation location | Status | Evidence / test coverage | Remaining blocker or limit |
| --- | --- | --- | --- | --- |
| Free local product with no wallet, API key, subscription, or cloud account | CORE, DUI | IMPLEMENTED AND VERIFIED | REAL: two local models and no-tool agent; D-E2E | Validated Windows route only. |
| Independent operation without an Elpmis service | CORE, MOBILE, SITE | IMPLEMENTED AND VERIFIED | REAL loopback-only transport; source inspection | Physical mobile offline verification remains separate. |
| Windows-first architecture with explicit platform boundaries | ARCH, INF, MOBILE-DOC | IMPLEMENTED AND VERIFIED | Architecture records and actual Windows build | Does not certify macOS/iOS. |
| Current competitor matrix: LM Mini, LM Studio, Jan, Open WebUI | RESEARCH | IMPLEMENTED AND VERIFIED | Official-source matrix with verified/conditional/unknown distinctions | No supplied LM Mini screenshots existed; no invented screenshot analysis. |
| Runtime/framework research: Ollama, llama.cpp, MLC, Google AI Edge | RESEARCH, INF, MOBILE-DOC | IMPLEMENTED AND VERIFIED | Linked primary sources and runtime decisions | Research is not integration certification. |
| Agent-system research: OpenHands, Continue, OpenCode | RESEARCH | IMPLEMENTED AND VERIFIED | Current official documentation cited | No copied proprietary implementation. |
| Design-reference research: Apple, Linear, Raycast, Claude, ChatGPT, Vercel, Cursor, Arc | RESEARCH, DESIGN | IMPLEMENTED AND VERIFIED | Source-backed notes; selected public pages visually inspected | Authenticated onboarding/motion flows were not exhaustively audited. |
| Desktop/website visual language and canonical HOLD glyph | DESIGN, DUI, SITE | IMPLEMENTED AND VERIFIED | Desktop captures, website browser review; same split glyph | Verified scope is desktop and website. |
| Canonical mobile HOLD glyph parity | apps/mobile/src/ui.tsx | IMPLEMENTED AND VERIFIED | docs/evidence/mobile-native-verification-v2.json (candidate-specific artifact hashes and native captures); docs/evidence/mobile-tests-v2.txt; actual native split-H geometry matches desktop. | Formal brand/accessibility certification not claimed. |
| Modular desktop/core/mobile/website/provider source structure | ARCH; apps/; packages/ | IMPLEMENTED AND VERIFIED | Independent core, pairing, retrieval, execution, Git, Power, desktop/mobile/site modules and tests. | Platform-specific UI and native services remain intentionally separate. |
| Reusable cross-platform component package | DESIGN; desktop/mobile/site styles and native UI | IMPLEMENTED BUT NOT VERIFIED | Shared visual guidance and canonical glyph; platform-specific components. | A literal common widget package is not required by the specification’s “where appropriate” guidance; native mobile controls are retained. |
| Original-code Apache-2.0 license and contributor/security/privacy documents | LICENSE, README.md, CONTRIBUTING.md, SECURITY.md, CODE_OF_CONDUCT.md, PRIVACY.md | IMPLEMENTED AND VERIFIED | Files present; original-code/model rights separated | Owner legal adoption/release review before publication. |
| Third-party source/license inventory | THIRD_PARTY_NOTICES.md; THIRD_PARTY_LICENSES.txt; docs/dependency-inventory.json; mobile/native inventories | IMPLEMENTED AND VERIFIED | 163 desktop production notices collected; 673 mobile/native inventory entries; pinned runtime/CUDA notices and source-to-package checks. | Inventory and actual bundled notices are verified; independent redistribution/legal adoption remains owner review. |
| Independent source build/self-hosted static website | README.md; package-lock.json; SITE | IMPLEMENTED AND VERIFIED | Desktop production build and static build pass locally | Cross-machine clean build and public hosting not verified. |
| Public source repository publication | OWNER_SETUP.md | BLOCKED BY AN EXTERNAL DEPENDENCY | Local Git repository exists; no public repository URL claimed | Owner repository authorization and explicit publication approval. |

## Hardware diagnostics and model selection (§4)

| Requirement | Implementation location | Status | Evidence / test coverage | Remaining blocker or limit |
| --- | --- | --- | --- | --- |
| OS and architecture detection | HW | IMPLEMENTED AND VERIFIED | D-E2E recorded Windows x64 | Other OS behavior unverified. |
| CPU model/logical cores and runtime capability boundary | HW | IMPLEMENTED AND VERIFIED | D-E2E hardware record; CPU runtime loads | No separate benchmark-derived CPU instruction suitability score. |
| Total and currently available RAM | HW | IMPLEMENTED AND VERIFIED | Measured Windows values; C-INF recommendation test | Available RAM can change after recommendation. |
| GPU model detection | HW | IMPLEMENTED AND VERIFIED | Windows CIM and nvidia-smi evidence | Other vendor/platform paths unverified. |
| Reliable NVIDIA GPU memory detection | HW | IMPLEMENTED AND VERIFIED | RTX 4080 VRAM recorded via nvidia-smi | Non-NVIDIA VRAM intentionally unknown. |
| Available storage detection | HW | IMPLEMENTED AND VERIFIED | statfs evidence in D-E2E | Storage shortage UX not physically exercised. |
| Supported acceleration shown separately from active acceleration | HW, DUI | IMPLEMENTED AND VERIFIED | Final installed UI CPU/Vulkan/CUDA tests and repeated backend cycles; native positive GPU layer offload. | RTX 4080 on the recorded Windows host; other GPU vendors and platforms remain unverified. |
| Automatic memory/disk-aware recommendations | CAT, HW | IMPLEMENTED AND VERIFIED | C-INF high/low resource fixture; D-E2E catalog | Memory budgets are estimates, not certification. |
| Model catalog with pinned versions, exact bytes, hashes and separate licenses | packages/core/catalog.js; packages/core/catalog-extended.js; docs/models.md | IMPLEMENTED AND VERIFIED | docs/evidence/model-provenance-v2.json; docs/evidence/model-evaluation-v2.json; docs/evidence/model-4b.json | Selected immutable artifacts are audited separately; hashes do not establish quality or native parser safety. |
| Lightweight and balanced model choices | packages/core/catalog.js; packages/core/catalog-extended.js; docs/models.md | IMPLEMENTED AND VERIFIED | docs/evidence/inference-v2.json; docs/evidence/model-4b.json; tests/core/inference.test.js | Existing small/balanced recommendations remain unchanged; estimates are not minimum-hardware certification. |
| Recommended balanced Qwen 3 4B actual text inference | ENGINE, CAT; CATALOG-REAL | IMPLEMENTED AND VERIFIED | 37 Vulkan layers; 4/4 hash/load/arithmetic/coding checks | Windows RTX 4080 only; no sustained performance claim. |
| Experimental Qwen 3.5 0.8B runtime compatibility | ENGINE, CAT; CATALOG-REAL | IMPLEMENTED AND VERIFIED | Complete hash, actual text stream and 25 Vulkan layers | Text-only; no vision projector/input. |
| Experimental Qwen 3.5 0.8B response reliability | CAT; CATALOG-REAL | IMPLEMENTED BUT NOT VERIFIED | Arithmetic failed; coding explanation inaccurate; raw responses preserved | Known functional failure; remains experimental and excluded from recommendations. |
| Advanced model category | packages/core/catalog.js; packages/core/catalog-extended.js; docs/models.md | IMPLEMENTED AND VERIFIED | docs/evidence/model-provenance-v2.json; docs/evidence/model-evaluation-v2.json; docs/evidence/model-4b.json | Optional Qwen 3 8B Q4_K_M; 8/10 ordinary cases and 2/2 bounded thinking cases. No broad ranking or default recommendation change. |
| Dedicated coding model category | packages/core/catalog.js; packages/core/catalog-extended.js; docs/models.md | IMPLEMENTED AND VERIFIED | docs/evidence/model-provenance-v2.json; docs/evidence/model-evaluation-v2.json; docs/evidence/model-4b.json | Official Qwen 2.5 Coder 7B Q4_K_M; 7/10 exact-output cases. Known logic/SQL failures preserved; generated code was not executed in this suite. |
| Dedicated reasoning model category | packages/core/catalog.js; packages/core/catalog-extended.js; docs/models.md | IMPLEMENTED AND VERIFIED | docs/evidence/model-provenance-v2.json; docs/evidence/model-evaluation-v2.json; docs/evidence/model-4b.json | Qwen 3 1.7B Q8_0 and 8B thinking controls tested; compact 1.7B passed 3/10 ordinary and 2/2 thinking checks. Category is not a correctness guarantee. |
| Vision model execution | packages/core/media.js; packages/core/model-bundles.js; packages/core/inference.js; docs/vision.md | IMPLEMENTED AND VERIFIED | docs/evidence/vision-real-v2.json; docs/evidence/desktop-photo-v2.json | Actual SmolVLM 256M Q8 plus verified projector on Windows CPU; bounded JPEG input and actual image-aware token measurement. Small-model recognition quality is not general vision certification. |
| Experimental model labeling | packages/core/catalog.js; packages/core/catalog-extended.js; docs/models.md | IMPLEMENTED AND VERIFIED | docs/evidence/model-4b.json; tests/core/catalog-evaluation.test.js | Experimental Qwen 3.5 0.8B arithmetic/explanation failures remain recorded and excluded from recommendations. |
| Model-family research: Qwen, Gemma, gpt-oss, Granite, DeepSeek | docs/models.md; docs/evidence/model-provenance-v2.json | IMPLEMENTED AND VERIFIED | Primary publisher/model-card/license references retained in docs/models.md and model-provenance-v2.json. | Licenses apply to the exact inspected release; researched families are not all integrated or runtime-certified. |
| General reasoning, coding, instruction following and tool-quality evaluation | packages/core/catalog.js; packages/core/catalog-extended.js; docs/models.md; scripts/verify-model-evaluation.mjs; scripts/verify-paired-tasks.mjs | IMPLEMENTED AND VERIFIED | docs/evidence/model-provenance-v2.json; docs/evidence/model-evaluation-v2.json; docs/evidence/model-4b.json; docs/evidence/paired-tasks-real-v2.json; docs/evidence/paired-tasks-small-model-failure-v2.json | 34 bounded actual local evaluation runs plus real agent read/cancellation tests. Exact wrong answers and small-model tool-path failures retained. This is not a comprehensive benchmark or reliability certification. |
| Quantization and context behavior assessment | packages/core/context.js; packages/core/inference.js; docs/models.md | IMPLEMENTED BUT NOT VERIFIED | docs/evidence/model-evaluation-v2.json; docs/evidence/conversations-native-v2.json; docs/evidence/vision-real-v2.json | Selected Q4/Q8 models and 4096-token context exercised; exhaustive quantization/long-context quality and memory matrix not performed. |
| Verified download sizes and understandable suitability explanations | packages/core/catalog.js; packages/core/catalog-extended.js; docs/models.md; apps/desktop/src/main.tsx | IMPLEMENTED AND VERIFIED | docs/evidence/model-provenance-v2.json; docs/evidence/model-evaluation-v2.json; docs/evidence/model-4b.json; docs/evidence/desktop-model-import-v2.json | Exact lengths and full hashes verified; suitability estimates remain hardware-dependent and no broad novice usability study is claimed. |
| User-selected arbitrary GGUF import | packages/core/local-models.js; apps/desktop/electron/controller.js | IMPLEMENTED AND VERIFIED | docs/evidence/desktop-model-import-v2.json; docs/evidence/conversations-native-v2.json; tests/core/local-models.test.js | Native selection, bounded managed copy, GGUF header, full hash, separate library identity, actual CPU response and encrypted restart. Unknown architectures/provenance may fail; no arbitrary-model parser sandbox. |
| User-custom model catalog entries | packages/core/local-models.js; packages/core/state-schema.js; apps/desktop/src/main.tsx | IMPLEMENTED AND VERIFIED | docs/evidence/desktop-model-import-v2.json; tests/core/local-models.test.js | User-owned imported local files become separate persistent library entries. Arbitrary publisher URLs or an unrestricted metadata editor are not exposed. |
| Automatic model update discovery | packages/core/model-updates.js; apps/desktop/src/ModelUpdates.tsx; docs/model-updates.md | IMPLEMENTED AND VERIFIED | docs/evidence/desktop-model-import-v2.json; tests/core/model-updates.test.js | Discovery/comparison is automatic only after explicit native-approved metadata check. No startup/periodic network poll or silent replacement; opaque expiring candidates need separate installation approval. |
| Model deletion and resource release | packages/core/index.js; packages/core/model-bundles.js; packages/core/local-models.js | IMPLEMENTED AND VERIFIED | docs/evidence/conversations-native-v2.json; tests/core/vision.test.js; tests/core/local-models.test.js | Actual imported-model deletion tested; model/projector operations serialize. Every model/backend delete-and-redownload permutation is not UI-tested. |
| Download progress and cancellation | DL, CTL, DUI | IMPLEMENTED AND VERIFIED | C-DL abort/resume; actual download evidence | Slow-network UI stress run pending. |
| Resumable downloads and ignored-range recovery | DL | IMPLEMENTED AND VERIFIED | C-DL valid/invalid ranges, ignored range, interrupted download | Publisher/network conditions vary. |
| Integrity and GGUF-header checks before install and load | packages/core/downloads.js; packages/core/model-bundles.js; packages/core/local-models.js | IMPLEMENTED AND VERIFIED | docs/evidence/model-provenance-v2.json; docs/evidence/model-evaluation-v2.json; docs/evidence/model-4b.json; docs/evidence/vision-real-v2.json; tests/core/downloads.test.js | Complete size/SHA and GGUF checks cover both model/projector; integrity is not native parser isolation. |
| Model download failure recovery | packages/core/downloads.js; packages/core/model-bundles.js | IMPLEMENTED AND VERIFIED | tests/core/downloads.test.js; tests/core/vision.test.js; docs/evidence/inference.json | Range/resume/abort/ignored-range/corruption defenses; physical full-disk and all publisher outage conditions not certified. |
| Windows CPU local inference | packages/core/inference.js; packages/core/index.js | IMPLEMENTED AND VERIFIED | docs/evidence/inference-v2.json; docs/evidence/conversations-native-v2.json; docs/evidence/vision-real-v2.json | Actual b11429 on Windows x64, real text/vision and cancellation. No hardware-universal timing claim. |
| Windows Vulkan runtime/core acceleration and CPU comparison | packages/core/inference.js; scripts/setup-vulkan.mjs; scripts/verify-vulkan.mjs | IMPLEMENTED AND VERIFIED | docs/evidence/vulkan.json; tests/core/acceleration.test.js | Positive RTX 4080 layer offload verified; shared-machine timings and diagnostic/prompt-cache effects are not a controlled benchmark. |
| Desktop/packaged Vulkan mode selection | packages/core/index.js; apps/desktop/electron/controller.js; apps/desktop/src/main.tsx | IMPLEMENTED AND VERIFIED | docs/evidence/installed-app.json; tests/core/acceleration.test.js | Actual installed CPU-to-Vulkan reply with offload. Other GPU vendors/platforms remain unverified. |
| Windows CUDA backend | runtime-assets.mjs; runtime-bundle.mjs; core/acceleration.js | IMPLEMENTED AND VERIFIED | [10 CUDA checks](/reference/docs/evidence/cuda-v2.json); [packaged CPU/Vulkan/CUDA acceptance](/reference/docs/evidence/packaged-app-v2.json). | Actual RTX4080 Windowsx64; no universal NVIDIA device claim. |
| macOS runtime acquisition and bundle integration | runtime-assets.mjs; runtime-install.mjs; runtime-bundle.mjs | IMPLEMENTED AND VERIFIED | [Pinned archive validation](/reference/docs/evidence/runtime-archives-v2.json); target/hash/tamper bundle tests. | macOS x64/arm64 official bundles acquired/verified on Windows; native launch/signing needs Mac. |
| macOS Metal inference execution verification | ENGINE; runtime-assets.mjs | BLOCKED BY AN EXTERNAL DEPENDENCY | Pinned Metal archives verified; native execution not run. | Compatible Mac required; archive integrity does not establish Metal execution. |
| Linux runtime acquisition and bundle integration | runtime-assets.mjs; runtime-install.mjs; runtime-bundle.mjs | IMPLEMENTED AND VERIFIED | [Archive verification](/reference/docs/evidence/runtime-archives-v2.json); [actual Linux CPU execution](/reference/docs/evidence/linux-runtime-v2.json). | Container x64 CPU scope; physical desktop/GPU validation separate. |
| Linux inference/package validation | packages/core/inference.js; scripts/verify-linux-runtime.mjs; scripts/verify-linux-desktop.mjs; docs/linux-validation.md | IMPLEMENTED BUT NOT VERIFIED | docs/evidence/linux-runtime-v2.json; docs/evidence/linux-desktop-v2.json; docs/evidence/linux-artifact-v2.json | Actual Linux x64 CPU core passed 8 groups in network-disabled Debian12 container: model/runtime hashes, stream, HTTP401, encrypted restart with test codec, context reload, cancellation and stop. Final AppImage extracts and its runtime matches, but production Electron sandbox launch refuses the restricted extracted-container helper. Physical Linux desktop/keyring/FUSE/GPU/ARM64 remain unverified; earlier implicit-unsandboxed harness results are explicitly nonacceptance. |

## Desktop shell and basic chat (§5)

| Requirement | Implementation location | Status | Evidence / test coverage | Remaining blocker or limit |
| --- | --- | --- | --- | --- |
| Sandboxed desktop window and trusted narrow IPC | MAIN, PRELOAD, CTL | IMPLEMENTED AND VERIFIED | D-E2E no Node globals/unknown IPC rejection | Independent penetration review pending. |
| Chat, Projects and Agents navigation | DUI | IMPLEMENTED AND VERIFIED | D-E2E native navigation | No full accessibility certification. |
| Power and Network hidden from primary onboarding with truthful availability | DUI | IMPLEMENTED AND VERIFIED | Settings entry points and explicit unavailable copy inspected | No live service. |
| Model manager, settings, memory, privacy and hardware pages | DUI | IMPLEMENTED AND VERIFIED | D-E2E settings/memory/catalog; actual diagnostics | Every control not yet UI automated. |
| Downloads management inside model rows | DUI; CTL; core/downloads.js | IMPLEMENTED AND VERIFIED | Actual native desktop model download/hash and Android resume/delete/re-download acceptance. | Progress/cancel/resume are in each model row; no separate global queue page. |
| In-app Help/documentation entry point | DUI; HelpCenter.tsx; main.tsx | IMPLEMENTED AND VERIFIED | [workspace native acceptance](/reference/docs/evidence/desktop-workspace-v2.json) | Actual 1,000-message fixture, bounded rendering, code/table/clipboard/search and keyboard Help tests; not complete screen-reader certification. |
| Streaming responses | ENGINE, CTL, DUI | IMPLEMENTED AND VERIFIED | REAL streaming; C-INF SSE boundaries; INSTALLED actual UI response | Broader rich-content/long-response UI coverage remains. |
| Markdown rendering | DUI; HelpCenter.tsx; main.tsx | IMPLEMENTED AND VERIFIED | [workspace native acceptance](/reference/docs/evidence/desktop-workspace-v2.json) | Actual 1,000-message fixture, bounded rendering, code/table/clipboard/search and keyboard Help tests; not complete screen-reader certification. |
| Code blocks and syntax highlighting | DUI; HelpCenter.tsx; main.tsx | IMPLEMENTED AND VERIFIED | [workspace native acceptance](/reference/docs/evidence/desktop-workspace-v2.json) | Actual 1,000-message fixture, bounded rendering, code/table/clipboard/search and keyboard Help tests; not complete screen-reader certification. |
| Copy message/code controls | DUI; HelpCenter.tsx; main.tsx | IMPLEMENTED AND VERIFIED | [workspace native acceptance](/reference/docs/evidence/desktop-workspace-v2.json) | Actual 1,000-message fixture, bounded rendering, code/table/clipboard/search and keyboard Help tests; not complete screen-reader certification. |
| Conversation renaming | DUI, CTL, STORE | IMPLEMENTED AND VERIFIED | D-E2E rename and restart | —. |
| Conversation content/name search | DUI; HelpCenter.tsx; main.tsx | IMPLEMENTED AND VERIFIED | [workspace native acceptance](/reference/docs/evidence/desktop-workspace-v2.json) | Actual 1,000-message fixture, bounded rendering, code/table/clipboard/search and keyboard Help tests; not complete screen-reader certification. |
| Persistent local history | DUI; HelpCenter.tsx; main.tsx | IMPLEMENTED AND VERIFIED | [workspace native acceptance](/reference/docs/evidence/desktop-workspace-v2.json) | Actual 1,000-message fixture, bounded rendering, code/table/clipboard/search and keyboard Help tests; not complete screen-reader certification. |
| Conversation deletion | STORE, CTL, DUI | IMPLEMENTED AND VERIFIED | C-STORE deletion clears backup; validated schema | Native confirmation flow not separately automated. |
| Chat folders and moving conversations | DUI, CTL, STORE | IMPLEMENTED AND VERIFIED | D-E2E create/move/restart | —. |
| Regenerate response | apps/desktop/electron/controller.js; packages/core/context.js; apps/desktop/src/ConversationPreferences.tsx; apps/desktop/src/ModelComparison.tsx | IMPLEMENTED AND VERIFIED | docs/evidence/desktop-chat-v2.json; docs/evidence/conversations-native-v2.json; docs/evidence/desktop-photo-v2.json | Actual native workflow and persisted state tested. One local runtime slot; comparisons run sequentially and model instruction compliance is not guaranteed. |
| Stop generation | ENGINE, CTL, DUI | IMPLEMENTED AND VERIFIED | REAL actual cancellation | Visual cancellation latency benchmarking pending. |
| Edit prior user messages | apps/desktop/electron/controller.js; packages/core/context.js; apps/desktop/src/ConversationPreferences.tsx; apps/desktop/src/ModelComparison.tsx | IMPLEMENTED AND VERIFIED | docs/evidence/desktop-chat-v2.json; docs/evidence/conversations-native-v2.json; docs/evidence/desktop-photo-v2.json | Actual native workflow and persisted state tested. One local runtime slot; comparisons run sequentially and model instruction compliance is not guaranteed. |
| Local model selection and switching | apps/desktop/electron/controller.js; packages/core/context.js; apps/desktop/src/ConversationPreferences.tsx; apps/desktop/src/ModelComparison.tsx | IMPLEMENTED AND VERIFIED | docs/evidence/desktop-chat-v2.json; docs/evidence/conversations-native-v2.json; docs/evidence/desktop-photo-v2.json | Actual native workflow and persisted state tested. One local runtime slot; comparisons run sequentially and model instruction compliance is not guaranteed. |
| Context usage visibility | ENGINE, CTL, DUI | IMPLEMENTED AND VERIFIED | [conversation native acceptance](/reference/docs/evidence/desktop-chat-v2.json); native tokenizer/photo usage evidence | Composer estimate is labeled; response details record actual tokenizer/input/output usage. |
| Context setting reload behavior | CORE, CTL; conversation-context.js | IMPLEMENTED AND VERIFIED | Core tests plus native conversation/context/photo acceptance | Bounded trimming preserves system/recent context; quality at every context length is not certified. |
| Text file attachments through explicit native picker | CTL; bounded-file.js | IMPLEMENTED AND VERIFIED | Attachment bounds/batch/epoch regressions; actual dropped-text response in [conversation native acceptance](/reference/docs/evidence/desktop-chat-v2.json) | Text/code only; 256 KiB per file, at most four per selection. |
| Image attachments for compatible models | apps/desktop/electron/image-input.js; packages/core/media.js; packages/core/inference.js | IMPLEMENTED AND VERIFIED | docs/evidence/desktop-photo-v2.json; docs/evidence/vision-real-v2.json | One native-decoded/reencoded JPEG per user turn, <=1536px and <=3MiB prepared image, compatible verified model/projector; text-only models reject photos before history mutation. |
| Drag-and-drop attachments | CTL, DUI | IMPLEMENTED AND VERIFIED | [conversation native acceptance](/reference/docs/evidence/desktop-chat-v2.json); [photo native acceptance](/reference/docs/evidence/desktop-photo-v2.json) | Bounded text and compatible photos; arbitrary filesystem paths cannot be injected by renderer data. |
| Keyboard shortcuts | DUI; HelpCenter.tsx; main.tsx | IMPLEMENTED AND VERIFIED | [workspace native acceptance](/reference/docs/evidence/desktop-workspace-v2.json) | Actual 1,000-message fixture, bounded rendering, code/table/clipboard/search and keyboard Help tests; not complete screen-reader certification. |
| Chat error recovery and concurrent-send safety | CTL, DUI | IMPLEMENTED AND VERIFIED | C-CTL overlap, failed persistence and invalid edits | Network/native crash fault injection remains limited. |
| Conversation Markdown and complete JSON export | packages/core/storage.js; packages/core/state-schema.js; apps/desktop/electron/controller.js | IMPLEMENTED AND VERIFIED | docs/evidence/desktop-photo-v2.json; tests/core/storage.test.js | Portable exports are plaintext; strict imports retain supported content/images while removing filesystem/tool grants. No claim of compatibility with arbitrary third-party exports. |
| Local-versus-remote status | DUI; PowerConnections.tsx; Devices.tsx | IMPLEMENTED AND VERIFIED | [conversation native acceptance](/reference/docs/evidence/desktop-chat-v2.json); [Power UI](/reference/docs/evidence/desktop-power-v2.json) | Remote requests are explicit and show recipient/payload; no silent cloud fallback. |
| Conversation branches | apps/desktop/electron/controller.js; packages/core/context.js; apps/desktop/src/ConversationPreferences.tsx; apps/desktop/src/ModelComparison.tsx | IMPLEMENTED AND VERIFIED | docs/evidence/desktop-chat-v2.json; docs/evidence/conversations-native-v2.json; docs/evidence/desktop-photo-v2.json | Actual native workflow and persisted state tested. One local runtime slot; comparisons run sequentially and model instruction compliance is not guaranteed. |
| Side-by-side model response comparison | apps/desktop/electron/controller.js; packages/core/context.js; apps/desktop/src/ConversationPreferences.tsx; apps/desktop/src/ModelComparison.tsx | IMPLEMENTED AND VERIFIED | docs/evidence/desktop-chat-v2.json; docs/evidence/conversations-native-v2.json; docs/evidence/desktop-photo-v2.json | Actual native workflow and persisted state tested. One local runtime slot; comparisons run sequentially and model instruction compliance is not guaranteed. |
| Custom chat instructions | apps/desktop/electron/controller.js; packages/core/context.js; apps/desktop/src/ConversationPreferences.tsx; apps/desktop/src/ModelComparison.tsx | IMPLEMENTED AND VERIFIED | docs/evidence/desktop-chat-v2.json; docs/evidence/conversations-native-v2.json; docs/evidence/desktop-photo-v2.json | Actual native workflow and persisted state tested. One local runtime slot; comparisons run sequentially and model instruction compliance is not guaranteed. |
| Dedicated chat personas | apps/desktop/electron/controller.js; packages/core/context.js; apps/desktop/src/ConversationPreferences.tsx; apps/desktop/src/ModelComparison.tsx | IMPLEMENTED AND VERIFIED | docs/evidence/desktop-chat-v2.json; docs/evidence/conversations-native-v2.json; docs/evidence/desktop-photo-v2.json | Actual native workflow and persisted state tested. One local runtime slot; comparisons run sequentially and model instruction compliance is not guaranteed. |
| Desktop voice input | speech-service.js; windows-speech.ps1; VoiceInput.tsx | IMPLEMENTED AND VERIFIED | [speech](/reference/docs/evidence/desktop-speech-v2.json), [dictation](/reference/docs/evidence/desktop-dictation-v2.json) | Installed local Windows recognizer; real WAV and controlled capture fixture, not physical microphone certification. |
| Desktop spoken responses | speech-service.js; SpeechControls.tsx | IMPLEMENTED AND VERIFIED | [speech](/reference/docs/evidence/desktop-speech-v2.json), [dictation](/reference/docs/evidence/desktop-dictation-v2.json) | Installed local Windows voices; bounded text/audio, playback controls and cancellation. |
| Optional explicit personal notes | CTL, DUI, STORE | IMPLEMENTED AND VERIFIED | D-E2E create, opt-in and persistence | No automatic extraction. |
| Semantic memory and semantic conversation search | packages/retrieval/conversations.js; apps/desktop/electron/conversation-search-service.js; apps/desktop/src/ConversationSearch.tsx; docs/saved-search.md | IMPLEMENTED AND VERIFIED | docs/evidence/conversation-search-real-v2.json; docs/evidence/desktop-saved-search-v2.json; tests/desktop/conversation-search.test.js | Explicit indexing; shared 146MB Nomic model, encrypted cache, source-hash validation, open current source. Up to 200 documents/2MiB/500 chunks; notes require global opt-in; no automatic extraction or prompt injection. |
| Sequential model switching within one conversation | apps/desktop/electron/controller.js; packages/core/context.js; apps/desktop/src/ConversationPreferences.tsx; apps/desktop/src/ModelComparison.tsx | IMPLEMENTED AND VERIFIED | docs/evidence/desktop-chat-v2.json; docs/evidence/conversations-native-v2.json; docs/evidence/desktop-photo-v2.json | Actual native workflow and persisted state tested. One local runtime slot; comparisons run sequentially and model instruction compliance is not guaranteed. |
| Concurrent/per-message routed multiple-model conversations | apps/desktop/electron/controller.js; packages/core/context.js; apps/desktop/src/ConversationPreferences.tsx; apps/desktop/src/ModelComparison.tsx | NOT IMPLEMENTED | docs/evidence/desktop-chat-v2.json; docs/evidence/conversations-native-v2.json | Simultaneous/per-message routing is not implemented; sequential switching and independent comparison branches are implemented. |
| Image generation | — | NOT IMPLEMENTED | No image-generation runtime advertised. | Optional exploration, not a required text/vision deliverable; not implemented. |
| Custom hosted/API endpoints | packages/power/hosted.js; electron/power-service.js; PowerConnections.tsx | IMPLEMENTED AND VERIFIED | [Actual-model loopback endpoint](/reference/docs/evidence/hosted-model-v2.json); [native Power UI](/reference/docs/evidence/desktop-power-v2.json). | Explicit separate request workflow; provider retention/cost controls are disclosed. No silent chat upload or paid rental. |
| Core sampling parameter API | ENGINE | IMPLEMENTED AND VERIFIED | REAL/CATALOG-REAL actual calls set temperature, maxTokens and thinking | These calls do not verify every parameter boundary or provide consumer controls. |
| User-adjustable advanced sampling controls | apps/desktop/electron/controller.js; packages/core/context.js; apps/desktop/src/ConversationPreferences.tsx; apps/desktop/src/ModelComparison.tsx | IMPLEMENTED AND VERIFIED | docs/evidence/desktop-chat-v2.json; docs/evidence/conversations-native-v2.json; docs/evidence/desktop-photo-v2.json | Actual native workflow and persisted state tested. One local runtime slot; comparisons run sequentially and model instruction compliance is not guaranteed. |

## Projects and coding workspace (§5)

| Requirement | Implementation location | Status | Evidence / test coverage | Remaining blocker or limit |
| --- | --- | --- | --- | --- |
| Register an explicitly selected existing local project folder | PROJECT, CORE, CTL | IMPLEMENTED AND VERIFIED | [project search and memory](/reference/docs/evidence/desktop-context-v2.json) | Native picker-controlled root; explicit reauthorization required after portable import. |
| Create a new project directory from inside HOLD | project-directory.js; ProjectWorkspace.tsx | IMPLEMENTED AND VERIFIED | [workspace native acceptance](/reference/docs/evidence/desktop-workspace-v2.json); path/nonoverwrite tests | Exact native parent/name review; cannot silently reuse or overwrite an existing directory. |
| Project-specific instructions | ProjectWorkspace.tsx; CTL; STORE | IMPLEMENTED AND VERIFIED | [workspace native acceptance](/reference/docs/evidence/desktop-workspace-v2.json) | Verified native create/preview/filter/instruction roundtrip and project-chat restart. |
| Organize project conversations | ProjectWorkspace.tsx; CTL; STORE | IMPLEMENTED AND VERIFIED | [workspace native acceptance](/reference/docs/evidence/desktop-workspace-v2.json) | Verified native create/preview/filter/instruction roundtrip and project-chat restart. |
| Bounded local text-file indexing | packages/core/projects.js; packages/retrieval/index.js; apps/desktop/electron/retrieval-service.js | IMPLEMENTED AND VERIFIED | docs/evidence/retrieval-real-v2.json; docs/evidence/desktop-context-v2.json; tests/core/projects.test.js | Approved bounded text/code only. Lexical scan 500 files/2000 entries; semantic index 200 documents/2MiB/500 chunks. Skipped coverage is reported. |
| Document retrieval from approved text files | packages/retrieval; apps/desktop/electron/retrieval-service.js; apps/desktop/src/ProjectSearch.tsx | IMPLEMENTED AND VERIFIED | docs/evidence/retrieval-real-v2.json; docs/evidence/desktop-context-v2.json; packages/retrieval/tests | Actual pinned Nomic embeddings, local citations, current content hashes and grant checks. PDF/DOCX extraction is not implemented. |
| Project memory distinct from global notes | memory.js; MemorySettings.tsx; CTL | IMPLEMENTED AND VERIFIED | [project search and memory](/reference/docs/evidence/desktop-context-v2.json) | Explicit notes scoped to personal or one project; agent permission and global opt-in enforced. |
| File previews | ProjectWorkspace.tsx; CTL; STORE | IMPLEMENTED AND VERIFIED | [workspace native acceptance](/reference/docs/evidence/desktop-workspace-v2.json) | Verified native create/preview/filter/instruction roundtrip and project-chat restart. |
| Project filename filtering | ProjectWorkspace.tsx; CTL; STORE | IMPLEMENTED AND VERIFIED | [workspace native acceptance](/reference/docs/evidence/desktop-workspace-v2.json) | Verified native create/preview/filter/instruction roundtrip and project-chat restart. |
| Core project content-search API | packages/core/projects.js; packages/retrieval | IMPLEMENTED AND VERIFIED | tests/core/projects.test.js; docs/evidence/retrieval-real-v2.json; docs/evidence/desktop-context-v2.json | Lexical and explicit semantic retrieval are bounded; returned excerpts remain untrusted and cannot grant tools. |
| Filesystem least privilege and unrelated-file rejection | packages/core/projects.js; packages/core/checkpoints.js | IMPLEMENTED AND VERIFIED | tests/core/projects.test.js; tests/core/checkpoints.test.js | Native approved roots, traversal/UNC/ADS/junction/hardlink checks and content CAS. Not a hostile same-user racing-process OS sandbox. |
| Read repository structure | PROJECT, AGENT | IMPLEMENTED AND VERIFIED | Bounded file listing and read tests | No semantic repository graph. |
| Propose new code files | PROJECT, AGENT | IMPLEMENTED AND VERIFIED | C-PROJECT create/revert; approval checkpoint | Model quality limited by selected model. |
| Propose edits to existing files | PROJECT, AGENT | IMPLEMENTED AND VERIFIED | REAL model-proposed edit; stale-content checks | Full-file replacement, not a structured patch language. |
| Show diffs before file writes | packages/core/projects.js; packages/core/checkpoints.js; apps/desktop/src/ProjectChanges.tsx | IMPLEMENTED AND VERIFIED | docs/evidence/desktop-checkpoints-v2.json; tests/core/checkpoints.test.js; tests/core/agent-core-integration.test.js | Up to eight reviewed files and 1MiB batch content. Encrypted journal/before-images, restart recovery and compare-and-swap checks; later edits cause explicit conflict, never blind overwrite. Recovery never writes automatically at startup. |
| Apply exact approved change | packages/core/projects.js; packages/core/checkpoints.js; apps/desktop/src/ProjectChanges.tsx | IMPLEMENTED AND VERIFIED | docs/evidence/desktop-checkpoints-v2.json; tests/core/checkpoints.test.js; tests/core/agent-core-integration.test.js | Up to eight reviewed files and 1MiB batch content. Encrypted journal/before-images, restart recovery and compare-and-swap checks; later edits cause explicit conflict, never blind overwrite. Recovery never writes automatically at startup. |
| Revert an approved change in same session | packages/core/projects.js; packages/core/checkpoints.js; apps/desktop/src/ProjectChanges.tsx | IMPLEMENTED AND VERIFIED | docs/evidence/desktop-checkpoints-v2.json; tests/core/checkpoints.test.js; tests/core/agent-core-integration.test.js | Up to eight reviewed files and 1MiB batch content. Encrypted journal/before-images, restart recovery and compare-and-swap checks; later edits cause explicit conflict, never blind overwrite. Recovery never writes automatically at startup. |
| Durable checkpoints and multi-file rollback | packages/core/projects.js; packages/core/checkpoints.js; apps/desktop/src/ProjectChanges.tsx | IMPLEMENTED AND VERIFIED | docs/evidence/desktop-checkpoints-v2.json; tests/core/checkpoints.test.js; tests/core/agent-core-integration.test.js | Up to eight reviewed files and 1MiB batch content. Encrypted journal/before-images, restart recovery and compare-and-swap checks; later edits cause explicit conflict, never blind overwrite. Recovery never writes automatically at startup. |
| Run project tests from agent/workspace | packages/execution; apps/desktop/electron/execution-service.js; ProjectExecution.tsx; core/agent-execution.js | IMPLEMENTED AND VERIFIED | [34 regressions](/reference/docs/evidence/isolated-execution-v2.json); [10 actual container groups](/reference/docs/evidence/isolated-execution-real-v2.json); [4 native UI groups](/reference/docs/evidence/desktop-execution-v2.json); [6 real agent groups](/reference/docs/evidence/agent-isolated-real-v2.json) | Fixed Node test/script profiles on a working local Docker Linux engine. Only selected copied sources; no host shell, package install, Python or native build commands. |
| View terminal output | packages/execution; apps/desktop/electron/execution-service.js; ProjectExecution.tsx; core/agent-execution.js | IMPLEMENTED AND VERIFIED | [34 regressions](/reference/docs/evidence/isolated-execution-v2.json); [10 actual container groups](/reference/docs/evidence/isolated-execution-real-v2.json); [4 native UI groups](/reference/docs/evidence/desktop-execution-v2.json); [6 real agent groups](/reference/docs/evidence/agent-isolated-real-v2.json) | Bounded plain output from isolated jobs, genuine exit codes and native copy. This is not an interactive host terminal. |
| Diagnose errors from executed tests | core/agent-execution.js; execution-service.js | IMPLEMENTED AND VERIFIED | [Actual Qwen agent test diagnosis](/reference/docs/evidence/agent-isolated-real-v2.json) | Verified one real failing arithmetic test: actual 2 versus expected 6. General diagnosis quality depends on model and task; no guaranteed correction. |
| Review agent actions and approvals | AGENT, CTL, DUI | IMPLEMENTED AND VERIFIED | C-AGENT logs/approval; REAL audit trail | Large-task audit UI testing pending. |
| Git status, commits, branches and repository operations | packages/git; electron/git-service.js; ProjectGit.tsx | IMPLEMENTED AND VERIFIED | [12 actual Git regressions](/reference/docs/evidence/project-git-v2.json); [native Git UI](/reference/docs/evidence/desktop-git-v2.json) | Ordinary SHA-1 repositories only. Exact reviewed staging, selected-file commit and branch creation. No checkout, push, pull, arbitrary Git commands or reflog writing. |
| Isolated arbitrary-code execution environment | packages/execution; apps/desktop/electron/execution-service.js; ProjectExecution.tsx; core/agent-execution.js | IMPLEMENTED AND VERIFIED | [34 regressions](/reference/docs/evidence/isolated-execution-v2.json); [10 actual container groups](/reference/docs/evidence/isolated-execution-real-v2.json); [4 native UI groups](/reference/docs/evidence/desktop-execution-v2.json); [6 real agent groups](/reference/docs/evidence/agent-isolated-real-v2.json) | Actual Node code runs inside a constrained Docker Linux container. Fixed profiles only; not an independent escape audit, universal language environment or host sandbox. |
| Sensitive writes require human confirmation | PROJECT, CTL | IMPLEMENTED AND VERIFIED | Exact one-use proposal, native confirmation and tests | Desktop native confirmation flow inspected; no universal OS isolation claim. |
| Arbitrary commands, network and destructive tools default denied | agent-policy.js; agent-execution.js; packages/execution | IMPLEMENTED AND VERIFIED | [34 regressions](/reference/docs/evidence/isolated-execution-v2.json); [10 actual container groups](/reference/docs/evidence/isolated-execution-real-v2.json); [4 native UI groups](/reference/docs/evidence/desktop-execution-v2.json); [6 real agent groups](/reference/docs/evidence/agent-isolated-real-v2.json) | Explicit isolated-test permission enables only fixed Node tests under native review; arbitrary command fields and host execution remain rejected. |

## Agent builder, runtime and orchestration (§6)

| Requirement | Implementation location | Status | Evidence / test coverage | Remaining blocker or limit |
| --- | --- | --- | --- | --- |
| Create multiple persisted named agents | AGENT, CTL, DUI, STORE | IMPLEMENTED AND VERIFIED | D-E2E saves agent/restarts; C-STORE schema | Multi-agent scheduling separate. |
| Role/personality/instructions editor | AgentEditor.tsx; AgentTasks.tsx; agent-execution.js; agent-services.js | IMPLEMENTED AND VERIFIED | [agent native acceptance](/reference/docs/evidence/desktop-agents-v2.json); [actual delegated tasks](/reference/docs/evidence/agent-execution-v2.json); [web](/reference/docs/evidence/agent-web-v2.json) | One inference slot; exact native review for external calls; bounded task/depth/tool/token budgets and no automatic restart replay. |
| Per-agent selected local model | AgentEditor.tsx; AgentTasks.tsx; agent-execution.js; agent-services.js | IMPLEMENTED AND VERIFIED | [agent native acceptance](/reference/docs/evidence/desktop-agents-v2.json); [actual delegated tasks](/reference/docs/evidence/agent-execution-v2.json); [web](/reference/docs/evidence/agent-web-v2.json) | One inference slot; exact native review for external calls; bounded task/depth/tool/token budgets and no automatic restart replay. |
| Allowed tools selected by user | CTL; agent-policy.js; AgentEditor.tsx | IMPLEMENTED AND VERIFIED | [agent native acceptance](/reference/docs/evidence/desktop-agents-v2.json); agent authorization regressions | Project reads/proposals, selected MCP tools, exact website hosts, memory and isolated tests require their own grants. |
| Approved project directories | CTL, PROJECT, AGENT | IMPLEMENTED AND VERIFIED | Native project grants; C-CTL invented grants rejected | No arbitrary per-agent raw-directory input. |
| Per-agent memory permissions | AgentEditor.tsx; AgentTasks.tsx; agent-execution.js; agent-services.js | IMPLEMENTED AND VERIFIED | [agent native acceptance](/reference/docs/evidence/desktop-agents-v2.json); [actual delegated tasks](/reference/docs/evidence/agent-execution-v2.json); [web](/reference/docs/evidence/agent-web-v2.json) | One inference slot; exact native review for external calls; bounded task/depth/tool/token budgets and no automatic restart replay. |
| Internet permission setting with working approved internet tools | AgentEditor.tsx; AgentTasks.tsx; agent-execution.js; agent-services.js | IMPLEMENTED AND VERIFIED | [agent native acceptance](/reference/docs/evidence/desktop-agents-v2.json); [actual delegated tasks](/reference/docs/evidence/agent-execution-v2.json); [web](/reference/docs/evidence/agent-web-v2.json) | One inference slot; exact native review for external calls; bounded task/depth/tool/token budgets and no automatic restart replay. |
| Terminal permission setting with working isolated commands | AgentEditor.tsx; agent-policy.js; execution-service.js | IMPLEMENTED AND VERIFIED | [34 regressions](/reference/docs/evidence/isolated-execution-v2.json); [10 actual container groups](/reference/docs/evidence/isolated-execution-real-v2.json); [4 native UI groups](/reference/docs/evidence/desktop-execution-v2.json); [6 real agent groups](/reference/docs/evidence/agent-isolated-real-v2.json) | Legacy terminal field now means only project-scoped fixed run_tests; current ancestor permissions are rechecked after review. No general terminal. |
| Spending permission setting with integrated paid work | AgentEditor.tsx; CTL; packages/power | BLOCKED BY AN EXTERNAL DEPENDENCY | Local agent spending remains zero; provider caps enforced at integration boundary. | Paid agent work is deliberately disabled until a provider-enforced hard cap and separately approved account/budget are available. |
| Maximum steps and timeouts | AGENT, CTL | IMPLEMENTED AND VERIFIED | C-AGENT hard budget, loop, cancellation tests | No per-agent CPU/memory quota enforcement. |
| Human file approval requirements | AGENT; PROJECT; CTL | IMPLEMENTED AND VERIFIED | [checkpoint acceptance](/reference/docs/evidence/desktop-checkpoints-v2.json); [agent native acceptance](/reference/docs/evidence/desktop-agents-v2.json) | Approval resolves only the exact proposal; interrupted work requires an explicit new task. |
| Developer template | AGENT; DUI; AgentEditor.tsx | IMPLEMENTED AND VERIFIED | Four visible beginner templates and permissioned builder; [agent native acceptance](/reference/docs/evidence/desktop-agents-v2.json) | Template is a starting configuration, not a guarantee of model quality. |
| Researcher template | AGENT; DUI; AgentEditor.tsx | IMPLEMENTED AND VERIFIED | Four visible beginner templates and permissioned builder; [agent native acceptance](/reference/docs/evidence/desktop-agents-v2.json) | Template is a starting configuration, not a guarantee of model quality. |
| Writer template | AGENT; DUI; AgentEditor.tsx | IMPLEMENTED AND VERIFIED | Four visible beginner templates and permissioned builder; [agent native acceptance](/reference/docs/evidence/desktop-agents-v2.json) | Template is a starting configuration, not a guarantee of model quality. |
| Organizer template | AGENT; DUI; AgentEditor.tsx | IMPLEMENTED AND VERIFIED | Four visible beginner templates and permissioned builder; [agent native acceptance](/reference/docs/evidence/desktop-agents-v2.json) | Template is a starting configuration, not a guarantee of model quality. |
| Custom agent builder without JSON authoring | AgentEditor.tsx; AgentTasks.tsx; agent-execution.js; agent-services.js | IMPLEMENTED AND VERIFIED | [agent native acceptance](/reference/docs/evidence/desktop-agents-v2.json); [actual delegated tasks](/reference/docs/evidence/agent-execution-v2.json); [web](/reference/docs/evidence/agent-web-v2.json) | One inference slot; exact native review for external calls; bounded task/depth/tool/token budgets and no automatic restart replay. |
| Tool calling through constrained local action protocol | AGENT | IMPLEMENTED AND VERIFIED | C-AGENT and REAL tool task | JSON-over-chat protocol; not all models reliably plan tools. |
| Multi-step bounded tasks | AGENT | IMPLEMENTED AND VERIFIED | C-AGENT read then finish; REAL model edit task | Small-model reliability remains limited. |
| Task status, persisted logs and progress events | core/agent-execution.js; AgentTasks.tsx; AgentResourceMonitor.tsx | IMPLEMENTED AND VERIFIED | [Agent queue regressions](/reference/docs/evidence/agent-checks-v2.json); [native agents](/reference/docs/evidence/desktop-agents-v2.json); [live resource UI](/reference/docs/evidence/desktop-agent-resources-v2.json) | Durable terminal events and root-budget snapshots update the UI. Shared inference is serial; interrupted work is never replayed automatically. |
| Cancellation | AGENT, CORE, CTL | IMPLEMENTED AND VERIFIED | C-AGENT cancel/loop; runtime cancellation REAL | All late-cancel race variations not independently audited. |
| Error handling and interrupted-task state | agent-execution.js; execution-store.js | IMPLEMENTED AND VERIFIED | Durable queue tests and native restart evidence | Interrupted tasks are visible and never automatically replay external actions. |
| Agent resource monitoring | electron/agent-resource-service.js; windows-process-resources.ps1; AgentResourceMonitor.tsx | IMPLEMENTED AND VERIFIED | [8 actual sampler checks](/reference/docs/evidence/agent-resources-v2.json); [4 native UI groups](/reference/docs/evidence/desktop-agent-resources-v2.json); tests/desktop/agent-resources.test.js | Owned shared model-process RSS/CPU, elapsed time and live root token budget. No GPU-memory value or per-agent model RAM quota; Mac/Linux parsing only fixture-tested. |
| MCP integration layer | AgentEditor.tsx; AgentTasks.tsx; agent-execution.js; agent-services.js | IMPLEMENTED AND VERIFIED | [agent native acceptance](/reference/docs/evidence/desktop-agents-v2.json); [actual delegated tasks](/reference/docs/evidence/agent-execution-v2.json); [web](/reference/docs/evidence/agent-web-v2.json) | One inference slot; exact native review for external calls; bounded task/depth/tool/token budgets and no automatic restart replay. |
| Untrusted tool-output policy | AGENT, PROJECT | IMPLEMENTED AND VERIFIED | Fixed permission broker; C-AGENT injection denial | Cannot guarantee a model ignores malicious content; permissions remain enforced. |
| Model cannot expand tool permissions or spending | AGENT, CTL, POWER | IMPLEMENTED AND VERIFIED | C-AGENT/C-CTL denials; P-TEST max budget | Power is not connected to agent tools. |
| Delegation from one agent to another | AgentEditor.tsx; AgentTasks.tsx; agent-execution.js; agent-services.js | IMPLEMENTED AND VERIFIED | [agent native acceptance](/reference/docs/evidence/desktop-agents-v2.json); [actual delegated tasks](/reference/docs/evidence/agent-execution-v2.json); [web](/reference/docs/evidence/agent-web-v2.json) | One inference slot; exact native review for external calls; bounded task/depth/tool/token budgets and no automatic restart replay. |
| Bounded multi-agent orchestration | AgentEditor.tsx; AgentTasks.tsx; agent-execution.js; agent-services.js | IMPLEMENTED AND VERIFIED | [agent native acceptance](/reference/docs/evidence/desktop-agents-v2.json); [actual delegated tasks](/reference/docs/evidence/agent-execution-v2.json); [web](/reference/docs/evidence/agent-web-v2.json) | One inference slot; exact native review for external calls; bounded task/depth/tool/token budgets and no automatic restart replay. |
| Task queues | AgentEditor.tsx; AgentTasks.tsx; agent-execution.js; agent-services.js | IMPLEMENTED AND VERIFIED | [agent native acceptance](/reference/docs/evidence/desktop-agents-v2.json); [actual delegated tasks](/reference/docs/evidence/agent-execution-v2.json); [web](/reference/docs/evidence/agent-web-v2.json) | One inference slot; exact native review for external calls; bounded task/depth/tool/token budgets and no automatic restart replay. |
| Maximum iterations and repeated-action loop detection | AGENT | IMPLEMENTED AND VERIFIED | C-AGENT repeated actions and budget | Not a guarantee against every semantically equivalent loop. |
| Explicit execution budgets for CPU/memory/tokens | packages/execution/index.js; core/agent-budget.js; core/agent-execution.js | IMPLEMENTED AND VERIFIED | [34 regressions](/reference/docs/evidence/isolated-execution-v2.json); [10 actual container groups](/reference/docs/evidence/isolated-execution-real-v2.json); [4 native UI groups](/reference/docs/evidence/desktop-execution-v2.json); [6 real agent groups](/reference/docs/evidence/agent-isolated-real-v2.json); [live resource budget](/reference/docs/evidence/desktop-agent-resources-v2.json) | Isolated tests enforce 1 CPU/512MiB/no extra swap/64 PIDs and time/output caps. Agent inference enforces shared token/step/tool/time budgets; local model sidecar CPU/RAM allocation quotas remain unimplemented. |

## Mobile application and native capabilities (§7)

| Requirement | Implementation location | Status | Evidence / test coverage | Remaining blocker or limit |
| --- | --- | --- | --- | --- |
| Native React Native consumer chat interface | apps/mobile/App.tsx; src/ui.tsx | IMPLEMENTED AND VERIFIED | docs/evidence/mobile-native-verification-v2.json (candidate-specific artifact hashes and native captures); docs/evidence/mobile-tests-v2.txt; Actual installed text/photo chat, contextual actions, model onboarding and 200% Settings-return layout. | Android 16/API 36 x86_64 emulator only; physical phones and iOS remain unverified. |
| Android native installable build | apps/mobile/android; scripts/build-android.ps1 | IMPLEMENTED AND VERIFIED | docs/evidence/mobile-native-verification-v2.json (candidate-specific artifact hashes and native captures); docs/evidence/mobile-tests-v2.txt; Actual 0.2.0/versionCode2 release APK, debuggable=false, installed; scanner graph/DEX/manifest exclusion. | Development signing certificate; not owner-signed or store-published. |
| iOS native project generation/build | MOBILE/app.json; MOBILE/modules/hold-device/ios; MOBILE/ci/native-builds.yml | BLOCKED BY AN EXTERNAL DEPENDENCY | Swift module and macOS build configuration prepared | Windows cannot generate/build iOS; compatible Mac/Xcode required. |
| Genuine on-device llama.rn inference | apps/mobile/src/inference.ts | IMPLEMENTED AND VERIFIED | docs/evidence/mobile-native-verification-v2.json (candidate-specific artifact hashes and native captures); docs/evidence/mobile-tests-v2.txt; Actual Qwen2.5, Qwen3 and SmolVLM native CPU responses; Qwen and vision offline runs. | Android 16/API 36 x86_64 emulator only; physical phones and iOS remain unverified. |
| Downloadable compatible pinned models | apps/mobile/src/catalog.ts; src/models.ts | IMPLEMENTED AND VERIFIED | docs/evidence/mobile-native-verification-v2.json (candidate-specific artifact hashes and native captures); docs/evidence/mobile-tests-v2.txt; All three catalog model families downloaded; SmolVLM projector paired; native size/SHA checks. | Android 16/API 36 x86_64 emulator only; physical phones and iOS remain unverified. |
| Device-specific memory-aware recommendations | apps/mobile/src/domain.ts; modules/hold-device | IMPLEMENTED AND VERIFIED | docs/evidence/mobile-native-verification-v2.json (candidate-specific artifact hashes and native captures); docs/evidence/mobile-tests-v2.txt; Actual memory/storage diagnostics and guards; conservative model recommendations. | Emulator readings and policy tests; sustained physical pressure/thermal behavior unverified. |
| Streaming replies | apps/mobile/src/inference.ts; App.tsx | IMPLEMENTED AND VERIFIED | docs/evidence/mobile-native-verification-v2.json (candidate-specific artifact hashes and native captures); docs/evidence/mobile-tests-v2.txt; Actual changing native response captures and partial output. | Android 16/API 36 x86_64 emulator only; physical phones and iOS remain unverified. |
| Stop mobile generation | apps/mobile/src/inference.ts; App.tsx | IMPLEMENTED AND VERIFIED | docs/evidence/mobile-native-verification-v2.json (candidate-specific artifact hashes and native captures); docs/evidence/mobile-tests-v2.txt; Actual Stop and app-background interruption retain partial output. | Android 16/API 36 x86_64 emulator only; physical phones and iOS remain unverified. |
| Retry reply | apps/mobile/App.tsx | IMPLEMENTED AND VERIFIED | docs/evidence/mobile-native-verification-v2.json (candidate-specific artifact hashes and native captures); docs/evidence/mobile-tests-v2.txt; Actual local Qwen3 retry and encrypted desktop retry. | Android 16/API 36 x86_64 emulator only; physical phones and iOS remain unverified. |
| Local model switching | apps/mobile/src/inference.ts; App.tsx | IMPLEMENTED AND VERIFIED | docs/evidence/mobile-native-verification-v2.json (candidate-specific artifact hashes and native captures); docs/evidence/mobile-tests-v2.txt; Switched between SmolVLM, Qwen3 and Qwen2.5; offline responses; context reload. | Android 16/API 36 x86_64 emulator only; physical phones and iOS remain unverified. |
| Local conversation history | apps/mobile/src/storage.ts | IMPLEMENTED AND VERIFIED | docs/evidence/mobile-native-verification-v2.json (candidate-specific artifact hashes and native captures); docs/evidence/mobile-tests-v2.txt; Native SQLite history after force-stop/relaunch; invalid stored row preserved for recovery export. | Android 16/API 36 x86_64 emulator only; physical phones and iOS remain unverified. |
| Search conversations | apps/mobile/App.tsx; src/domain.ts | IMPLEMENTED AND VERIFIED | docs/evidence/mobile-native-verification-v2.json (candidate-specific artifact hashes and native captures); docs/evidence/mobile-tests-v2.txt; Actual message-content search and resulting conversation selection. | Long-history performance remains unbenchmarked. |
| Rename conversations | apps/mobile/App.tsx | IMPLEMENTED AND VERIFIED | docs/evidence/mobile-native-verification-v2.json (candidate-specific artifact hashes and native captures); docs/evidence/mobile-tests-v2.txt; Actual renamed history persists after force-stop/restart. | Android 16/API 36 x86_64 emulator only; physical phones and iOS remain unverified. |
| Delete conversations | apps/mobile/App.tsx | IMPLEMENTED AND VERIFIED | docs/evidence/mobile-native-verification-v2.json (candidate-specific artifact hashes and native captures); docs/evidence/mobile-tests-v2.txt; Native confirmation deletes the matching searched conversation. | Android 16/API 36 x86_64 emulator only; physical phones and iOS remain unverified. |
| Voice input with on-device-only requirement | apps/mobile/App.tsx; src/audio.ts | IMPLEMENTED AND VERIFIED | docs/evidence/mobile-native-verification-v2.json (candidate-specific artifact hashes and native captures); docs/evidence/mobile-tests-v2.txt; On-device recognizer opened offline; explicit local WAV became an editable transcript with no active network. | Real-speaker microphone accuracy and physical-device recognizer availability remain unverified; no cloud fallback. |
| Spoken responses using offline voices | apps/mobile/modules/hold-device; App.tsx | IMPLEMENTED AND VERIFIED | docs/evidence/mobile-native-verification-v2.json (candidate-specific artifact hashes and native captures); docs/evidence/mobile-tests-v2.txt; Explicit Listen chooses an offline-marked Android voice and native completion clears playback state in airplane mode. | Headless emulator API/lifecycle evidence only; audible quality and vendor system-service behavior not certified. |
| Image attachments | apps/mobile/src/photos.ts; src/inference.ts | IMPLEMENTED AND VERIFIED | docs/evidence/mobile-native-verification-v2.json (candidate-specific artifact hashes and native captures); docs/evidence/mobile-tests-v2.txt; Actual camera JPEG enters SmolVLM native multimodal completion; image persists in history. | Small model hallucinated details; functional pipeline is not a visual-quality benchmark. |
| Camera integration | apps/mobile/src/photos.ts; src/pairing-ui.tsx | IMPLEMENTED AND VERIFIED | docs/evidence/mobile-native-verification-v2.json (candidate-specific artifact hashes and native captures); docs/evidence/mobile-tests-v2.txt; Native camera permission deny/allow, synthetic emulator photo capture, local decoder no-QR rejection. | Physical camera QR acquisition remains unverified. |
| Photo-library picker | apps/mobile/src/photos.ts; src/pairing-ui.tsx | IMPLEMENTED AND VERIFIED | docs/evidence/mobile-native-verification-v2.json (candidate-specific artifact hashes and native captures); docs/evidence/mobile-tests-v2.txt; Actual native library selection for vision and fresh QR photo decode; font-change picker regression tested. | Android 16/API 36 x86_64 emulator only; physical phones and iOS remain unverified. |
| Incoming OS share-sheet extension | apps/mobile/modules/hold-device; plugins/withIncomingShare.cjs; App.tsx | IMPLEMENTED AND VERIFIED | docs/evidence/mobile-native-verification-v2.json (candidate-specific artifact hashes and native captures); docs/evidence/mobile-tests-v2.txt; Actual Android text/content-URI image share, review and unsent local draft; network URI rejected. | Android target implemented and tested. iOS incoming share extension is not implemented. |
| Copy response | apps/mobile/App.tsx | IMPLEMENTED AND VERIFIED | docs/evidence/mobile-native-verification-v2.json (candidate-specific artifact hashes and native captures); docs/evidence/mobile-tests-v2.txt; Actual clipboard copy and paste into composer matches FINALOFFLINE. | Android 16/API 36 x86_64 emulator only; physical phones and iOS remain unverified. |
| Share response/export using OS sheet | apps/mobile/App.tsx | IMPLEMENTED AND VERIFIED | docs/evidence/mobile-native-verification-v2.json (candidate-specific artifact hashes and native captures); docs/evidence/mobile-tests-v2.txt; Actual OS share/recovery sheet and Save to Files export; versioned native import with photo decode. | No external recipient selected or message sent; receiving-app behavior outside tested file save remains separate. |
| Custom instructions | apps/mobile/src/domain.ts; src/conversation-settings.tsx | IMPLEMENTED AND VERIFIED | docs/evidence/mobile-native-verification-v2.json (candidate-specific artifact hashes and native captures); docs/evidence/mobile-tests-v2.txt; Saved per-chat instructions while keyboard open; next local response PINE. | Android 16/API 36 x86_64 emulator only; physical phones and iOS remain unverified. |
| Optional explicit personal memory notes | apps/mobile/src/domain.ts; App.tsx | IMPLEMENTED AND VERIFIED | docs/evidence/mobile-native-verification-v2.json (candidate-specific artifact hashes and native captures); docs/evidence/mobile-tests-v2.txt; Global opt-in note produced Cedar; explicit erase removed notes; per-chat scope unit tests. | Android 16/API 36 x86_64 emulator only; physical phones and iOS remain unverified. |
| Automatic/semantic mobile memory | — | NOT IMPLEMENTED | No embeddings or automatic ingestion | Engineering. |
| Light and dark themes | apps/mobile/App.tsx | IMPLEMENTED AND VERIFIED | docs/evidence/mobile-native-verification-v2.json (candidate-specific artifact hashes and native captures); docs/evidence/mobile-tests-v2.txt; Actual dark/light captures; saved preference and live system-follow transitions. | Android 16/API 36 x86_64 emulator only; physical phones and iOS remain unverified. |
| Follow operating-system theme | apps/mobile/App.tsx | IMPLEMENTED AND VERIFIED | docs/evidence/mobile-native-verification-v2.json (candidate-specific artifact hashes and native captures); docs/evidence/mobile-tests-v2.txt; Native Android uiMode no/yes switches installed interface while preference is system. | Android 16/API 36 x86_64 emulator only; physical phones and iOS remain unverified. |
| Model download progress and pause/resume | apps/mobile/src/download-engine.ts; src/models.ts | IMPLEMENTED AND VERIFIED | docs/evidence/mobile-native-verification-v2.json (candidate-specific artifact hashes and native captures); docs/evidence/mobile-tests-v2.txt; Actual pause/resume/re-download and final integrity promotion; concurrency/range regressions. | Android 16/API 36 x86_64 emulator only; physical phones and iOS remain unverified. |
| Downloaded model storage deletion | apps/mobile/src/models.ts; App.tsx | IMPLEMENTED AND VERIFIED | docs/evidence/mobile-native-verification-v2.json (candidate-specific artifact hashes and native captures); docs/evidence/mobile-tests-v2.txt; Actual Qwen2.5 removal, Download state, re-download, pause/resume and verified installed state. | Android 16/API 36 x86_64 emulator only; physical phones and iOS remain unverified. |
| Battery/low-power awareness | apps/mobile/modules/hold-device; src/domain.ts | IMPLEMENTED BUT NOT VERIFIED | Native device API and policy tests; emulator diagnostics. | Physical low-power behavior and drain measurement remain unverified. |
| Thermal and available-memory safety stops | apps/mobile/modules/hold-device; src/inference.ts | IMPLEMENTED BUT NOT VERIFIED | Native callbacks/guards and serialized-release regressions. | Actual physical heat/low-memory stress/throttling not exercised. |
| Background lifecycle cancels inference and microphone | apps/mobile/App.tsx; src/inference.ts | IMPLEMENTED AND VERIFIED | docs/evidence/mobile-native-verification-v2.json (candidate-specific artifact hashes and native captures); docs/evidence/mobile-tests-v2.txt; Actual background event interrupted active native reply and persisted partial text; microphone abort handler inspected. | Actual microphone background transition not separately exercised; inference path verified on emulator. |
| Local privacy/export/delete controls | apps/mobile/App.tsx; src/storage.ts | IMPLEMENTED AND VERIFIED | docs/evidence/mobile-native-verification-v2.json (candidate-specific artifact hashes and native captures); docs/evidence/mobile-tests-v2.txt; Native conversation/model/notes deletion, export/import/recovery controls; denied camera/microphone; SecureStore lifecycle regression. | Complete OS security and iOS backup protection require device-specific validation. |
| Airplane-mode chat after setup | apps/mobile/App.tsx; src/inference.ts | IMPLEMENTED AND VERIFIED | docs/evidence/mobile-native-verification-v2.json (candidate-specific artifact hashes and native captures); docs/evidence/mobile-tests-v2.txt; No active default network/IP route; fresh native replies and force-stop/relaunch persistence. | Android 16/API 36 x86_64 emulator only; physical phones and iOS remain unverified. |
| Native microphone permission denied/granted flow | apps/mobile/App.tsx | IMPLEMENTED AND VERIFIED | docs/evidence/mobile-native-verification-v2.json (candidate-specific artifact hashes and native captures); docs/evidence/mobile-tests-v2.txt; Actual permission denial leaves typing available; later on-device recognizer session starts and no-speech error is explicit. | No physical microphone accuracy test. |
| Apple Metal with CPU fallback | MOBILE/src/inference.ts | IMPLEMENTED BUT NOT VERIFIED | iOS gpu-layer attempt/fallback code | Mac/iPhone runtime test. |
| Apple Neural Engine/Core ML integration | — | NOT IMPLEMENTED | llama.rn Metal/CPU selected | Engineering; research does not implement these backends. |
| Android GPU/NNAPI/LiteRT/Hexagon acceleration | — | NOT IMPLEMENTED | Android CPU selected | Engineering and target-hardware validation. |
| Platform-protected app storage and backup controls | apps/mobile/app.json; src/storage.ts; src/pairing.ts | IMPLEMENTED BUT NOT VERIFIED | Final Android manifest disables backups/cleartext/debugging; private SQLite/files; SecureStore credentials excluded from export. | iOS protection source exists but unbuilt; OS/device security is not independently certified. |
| Multiple screen sizes, large text and screen readers | apps/mobile/App.tsx; src/ui.tsx | IMPLEMENTED AND VERIFIED | docs/evidence/mobile-accessibility-v2.json; exact509bfe57 APK:1080x2340/440dpi and720x1600/360dpi(320dp),200%text. Fixed keyboard covering Send. Actual bound TalkBack, visible focus, Tab/Enter conversation actions, microphone refusal/dismissal, keyboard draft and pointer-send local reply. | Scoped emulator acceptance; small scrollable transcript at200%. Full screen-reader certification, human-audible TalkBack, VoiceOver and physical phones remain unverified. |
| Mobile startup, latency, throughput and battery benchmarks | apps/mobile/src/inference.ts; src/metrics.ts; scripts/verify-emulator-performance.mjs | IMPLEMENTED BUT NOT VERIFIED | docs/evidence/mobile-performance-v2.json; exact509bfe57 APK:3 process-cold loads+3 reused-context replies, real native timing/token rates,3 Android activity startup observations,26 memory samples. Median native8.04tokens/s; model-load1.22s. | Repeated emulator performance verified under disclosed concurrent host builds; physical-device sustained thermal/battery and iOS benchmarks remain unverified. Callback first-token time is not screen paint. |
| Mobile agents and desktop-task delegation | apps/mobile/src/desktop-tasks.tsx; src/pairing.ts | IMPLEMENTED AND VERIFIED | docs/evidence/mobile-native-verification-v2.json (candidate-specific artifact hashes and native captures); docs/evidence/mobile-tests-v2.txt; Final APK: real approved read_file task returned SILVER PINE; operator desktop rejection, pending/running cancellation, phone/host restart and restored result without rerun. | Android emulator + real Qwen3 4B CPU production queue. Isolated task fixture uses explicit operator consent, not the production OS dialog; separate desktop evidence covers that dialog. No arbitrary on-phone code execution, agent configuration or change approval. |

## Personal device pairing and remote access (§7)

| Requirement | Implementation location | Status | Evidence / test coverage | Remaining blocker or limit |
| --- | --- | --- | --- | --- |
| Pairing UI and one-time identity challenge | packages/pairing; apps/mobile/src/pairing-ui.tsx | IMPLEMENTED AND VERIFIED | packages/pairing/PROTOCOL.md; artifacts/verification-v2/pairing-real.json; packages/pairing/tests; docs/evidence/mobile-native-verification-v2.json (candidate-specific artifact hashes and native captures); docs/evidence/mobile-tests-v2.txt; Actual manual invitation, local QR photo decode and pairing. | Actual Android native pinned transport + local desktop fixture; iOS source uncompiled. |
| Mutual authentication and encrypted transport | packages/pairing; apps/mobile/modules/hold-pairing | IMPLEMENTED AND VERIFIED | packages/pairing/PROTOCOL.md; artifacts/verification-v2/pairing-real.json; packages/pairing/tests; docs/evidence/mobile-native-verification-v2.json (candidate-specific artifact hashes and native captures); docs/evidence/mobile-tests-v2.txt; TLS1.3 certificate pin before secrets, native HMAC/session/nonce; actual encrypted Qwen response and wrong-pin refusal. | Actual Android native pinned transport + local desktop fixture; iOS source uncompiled. |
| OS-protected pairing key storage | apps/mobile/src/pairing.ts | IMPLEMENTED AND VERIFIED | packages/pairing/PROTOCOL.md; artifacts/verification-v2/pairing-real.json; packages/pairing/tests; docs/evidence/mobile-native-verification-v2.json (candidate-specific artifact hashes and native captures); docs/evidence/mobile-tests-v2.txt; Android SecureStore; actual connection persists after restart; export excludes secret; stale refresh cannot restore forgotten key regression. | Android app-private encrypted storage path exercised; iOS Keychain source only; device compromise outside scope. |
| Named device and scoped permission approval | packages/pairing; apps/desktop/electron/controller.js | IMPLEMENTED AND VERIFIED | packages/pairing/PROTOCOL.md; artifacts/verification-v2/pairing-real.json; packages/pairing/tests; docs/evidence/mobile-native-verification-v2.json (candidate-specific artifact hashes and native captures); docs/evidence/mobile-tests-v2.txt; Native desktop approval exercised by desktop owner; phone consent opens separate desktop conversation. | Emulator harness auto-approval is explicitly test-only; production approval evidence is separate. |
| Replay/expiry protection | packages/pairing; apps/mobile/src/pairing-format.ts | IMPLEMENTED AND VERIFIED | packages/pairing/PROTOCOL.md; artifacts/verification-v2/pairing-real.json; packages/pairing/tests; docs/evidence/mobile-native-verification-v2.json (candidate-specific artifact hashes and native captures); docs/evidence/mobile-tests-v2.txt; Host nonce/timestamp/session protection and expired-code tests; actual server-session restart recovered. | Actual Android native pinned transport + local desktop fixture; iOS source uncompiled. |
| Revocation from either device | packages/pairing; apps/mobile/src/pairing.ts | IMPLEMENTED AND VERIFIED | packages/pairing/PROTOCOL.md; artifacts/verification-v2/pairing-real.json; packages/pairing/tests; docs/evidence/mobile-native-verification-v2.json (candidate-specific artifact hashes and native captures); docs/evidence/mobile-tests-v2.txt; Actual host revocation refused subsequent mobile request. Final APK phone self-disconnect returned to fresh pairing; host recorded revokedAt and zero active requests. | Offline local removal deletes the key but cannot confirm revocation of an unreachable host record; UI warns. iOS uncompiled. |
| Reconnect and unreachable-desktop handling | apps/mobile/src/pairing.ts | IMPLEMENTED AND VERIFIED | packages/pairing/PROTOCOL.md; artifacts/verification-v2/pairing-real.json; packages/pairing/tests; docs/evidence/mobile-native-verification-v2.json (candidate-specific artifact hashes and native captures); docs/evidence/mobile-tests-v2.txt; Actual host restart refreshes session and fresh RECONNECTED response; explicit revocation/unreachable errors. | Actual Android native pinned transport + local desktop fixture; iOS source uncompiled. |
| Phone use of desktop models | apps/mobile/src/pairing.ts; packages/pairing | IMPLEMENTED AND VERIFIED | packages/pairing/PROTOCOL.md; artifacts/verification-v2/pairing-real.json; packages/pairing/tests; docs/evidence/mobile-native-verification-v2.json (candidate-specific artifact hashes and native captures); docs/evidence/mobile-tests-v2.txt; Real local Qwen output through Android TLS/HMAC native transport; retry/edit and partial stream cancellation. | Text-only mobile pairing. Slow-stream fixture delayed real generated chunks; not engine throughput benchmark. |
| Approved desktop-task control from phone | packages/pairing; apps/mobile/src/desktop-tasks.tsx | IMPLEMENTED AND VERIFIED | packages/pairing/PROTOCOL.md; artifacts/verification-v2/pairing-real.json; packages/pairing/tests; docs/evidence/mobile-native-verification-v2.json (candidate-specific artifact hashes and native captures); docs/evidence/mobile-tests-v2.txt; Final installed APK: explicit phone consent, desktop approval/rejection, real file-backed result, pending/running cancellation, foreground bounded polling, recent tasks restored after phone and host-session restart. | Phone cannot configure agents, broaden paths/tools/budgets, approve proposed changes or automatically rerun. Qwen3 0.6B failed the file task; separate real 4B success is preserved. Emulator harness uses operator-controlled consent. |
| Pairing adversarial tests | packages/pairing; apps/mobile/tests | IMPLEMENTED AND VERIFIED | packages/pairing/PROTOCOL.md; artifacts/verification-v2/pairing-real.json; packages/pairing/tests; docs/evidence/mobile-native-verification-v2.json (candidate-specific artifact hashes and native captures); docs/evidence/mobile-tests-v2.txt; Wrong certificate, replay/session/expiry/revocation and native Java transport tests; parser and credential-lifecycle regressions. | Independent penetration review and physical-network/device coverage remain. |
| No unauthenticated public inference exposure | packages/pairing; apps/desktop/electron/main.js | IMPLEMENTED AND VERIFIED | packages/pairing/PROTOCOL.md; artifacts/verification-v2/pairing-real.json; packages/pairing/tests; docs/evidence/mobile-native-verification-v2.json (candidate-specific artifact hashes and native captures); docs/evidence/mobile-tests-v2.txt; Private-LAN TLS listener, explicit host enablement, pin + device HMAC before inference; unauthenticated requests denied. | No public tunneling/hosted service; authentication is not blanket security certification. |

## Power local contract and future external services (§8)

| Requirement | Implementation location | Status | Evidence / test coverage | Remaining blocker or limit |
| --- | --- | --- | --- | --- |
| Local / My Computer / Remote Model / Rent GPU explained distinctly | PowerConnections.tsx; website Power; docs/power-connections-v2.md | IMPLEMENTED AND VERIFIED | [33 Power tests](/reference/docs/evidence/power-connections-v2.json); [native Power UI](/reference/docs/evidence/desktop-power-v2.json) | Local inference, paired owned computer, existing owner-hosted endpoint and unavailable paid rentals have distinct boundaries. |
| Typed modular provider contract | packages/power/index.js; index.d.ts; hosted.d.ts | IMPLEMENTED AND VERIFIED | [33 Power tests](/reference/docs/evidence/power-connections-v2.json) | Capability results distinguish fixture, owner-hosted and unsupported paid rental paths. |
| Provider capability/configuration discovery | packages/power/index.js; hosted.js; runpod.js | IMPLEMENTED AND VERIFIED | [33 Power tests](/reference/docs/evidence/power-connections-v2.json); [real compatible endpoint](/reference/docs/evidence/hosted-model-v2.json) | Existing endpoint model discovery works; no live marketplace discovery or provider hardware validation. |
| Cost estimation and expiring quote in synthetic provider | packages/power/index.js; hosted.js; runpod.js | IMPLEMENTED AND VERIFIED | [33 Power tests](/reference/docs/evidence/power-connections-v2.json) | Synthetic quote arithmetic only; no verified live provider price guarantee. |
| Workload mode/target matching and bounded inputs | packages/power/index.js; hosted.js; runpod.js | IMPLEMENTED AND VERIFIED | [33 Power tests](/reference/docs/evidence/power-connections-v2.json) | Contract validation and test provider only; remote code deployment is not enabled. |
| Provision/execute/observe/cancel/release synthetic lifecycle | packages/power/index.js; hosted.js; runpod.js | IMPLEMENTED AND VERIFIED | [33 Power tests](/reference/docs/evidence/power-connections-v2.json) | Explicitly marked mock fixtures; not a live rental or provider sandbox. |
| Usage reporting and durable lifetime budget ledger | packages/power/index.js; hosted.js; runpod.js | IMPLEMENTED AND VERIFIED | [33 Power tests](/reference/docs/evidence/power-connections-v2.json) | Local commitments and supplied receipts are enforced; provider billing truth is not established. |
| Idempotent submission and no duplicate spend reservation | packages/power/index.js; hosted.js; runpod.js | IMPLEMENTED AND VERIFIED | [33 Power tests](/reference/docs/evidence/power-connections-v2.json) | Local durable request identity and hosted duplicate-request prevention; no claim of remote exactly-once billing. |
| Separate human approval capability | packages/power/index.js; hosted.js; runpod.js | IMPLEMENTED AND VERIFIED | [33 Power tests](/reference/docs/evidence/power-connections-v2.json) | Backend checks and native exact transfer approval callback verified; no manual dialog claim in automated evidence. |
| Exact provider/workload/model/price/cap/data/privacy disclosure object | packages/power/index.js; hosted.js; runpod.js | IMPLEMENTED AND VERIFIED | [33 Power tests](/reference/docs/evidence/power-connections-v2.json) | Exact selected payload, destination and explicit retention/cost limits. Provider assertions are not independently verified. |
| Backend maximum spending enforcement | packages/power/index.js; hosted.js; runpod.js | IMPLEMENTED AND VERIFIED | [33 Power tests](/reference/docs/evidence/power-connections-v2.json) | Local synthetic ledger cap is tested. No supported verified provider-enforced paid total cap; paid creates fail closed. |
| Cancellation preserves consumed usage | packages/power/index.js; hosted.js; runpod.js | IMPLEMENTED AND VERIFIED | [33 Power tests](/reference/docs/evidence/power-connections-v2.json) | Local ledger preserves committed usage. Closing remote HTTP cannot guarantee termination, refund or final remote charges. |
| Unknown cleanup holds entire reservation | packages/power/index.js; hosted.js; runpod.js | IMPLEMENTED AND VERIFIED | [33 Power tests](/reference/docs/evidence/power-connections-v2.json) | Unknown synthetic/rental fixture outcomes retain commitment and forbid duplicate automatic provisioning. |
| Crash-persistent commitments and recovery lock | packages/power/index.js; hosted.js; runpod.js | IMPLEMENTED AND VERIFIED | [33 Power tests](/reference/docs/evidence/power-connections-v2.json) | Encrypted local durable accounting; no live-provider crash/reconciliation acceptance. |
| Runpod configured-disabled adapter | packages/power/index.js; runpod.js | IMPLEMENTED AND VERIFIED | [33 Power tests](/reference/docs/evidence/power-connections-v2.json) | Credentials do not enable live provisioning: missing verified per-job monetary hard cap fails before network or secret lookup. |
| Runpod live/serverless API integration | packages/power/runpod.js | NOT IMPLEMENTED | [33 Power tests](/reference/docs/evidence/power-connections-v2.json); [implemented protocol scope](/reference/docs/power-connections-v2.md) | Pod create/list/get/stop/delete and uncertain-create recovery exist behind mock/protocol gates. Live execution, serverless worker deployment and final billing reconciliation are not complete. |
| Nosana configured-disabled adapter | packages/power/index.js | IMPLEMENTED AND VERIFIED | [33 Power tests](/reference/docs/evidence/power-connections-v2.json) | Capabilities remain explicitly unsupported even with configuration. |
| Nosana live deployment/settlement integration | Not implemented | NOT IMPLEMENTED | [Provider research and gaps](/reference/docs/power-connections-v2.md) | Engineering: live deployment, identity, cancellation, reconciliation and settlement; not merely missing credentials. |
| Other GPU marketplace adapters | Not implemented | NOT IMPLEMENTED | [Provider research and gaps](/reference/docs/power-connections-v2.md) | Engineering: adapters, provider-enforced caps, workload deployment and complete lifecycle verification. |
| Hosted model API execution | packages/power/hosted.js; transport.js; connection-store.js | IMPLEMENTED AND VERIFIED | [Real streamed Qwen endpoint](/reference/docs/evidence/hosted-model-v2.json); [33 Power tests](/reference/docs/evidence/power-connections-v2.json) | Genuine compatible endpoint inference verified over loopback in trusted test mode. Production public HTTPS DNS/TLS protections are implemented; external endpoint acceptance remains unverified. No automatic chat-history transfer. |
| Real provider sandbox tests | Protocol fixtures only | NOT IMPLEMENTED | [33 Power tests](/reference/docs/evidence/power-connections-v2.json) | Recorded/protocol fixtures are not a provider-operated sandbox. A complete supported provider path and provider test environment remain necessary. |
| Paid end-to-end acceptance tests | Not run | NOT IMPLEMENTED | [Explicit paid limitations](/reference/docs/power-connections-v2.md) | Engineering and verified provider total-spend guarantees remain prerequisites; owner credentials and explicit spending authorization would then be required. No money spent. |
| Desktop Power review/execute/monitor UI | PowerConnections.tsx; electron/power-service.js | IMPLEMENTED AND VERIFIED | [Native Power UI](/reference/docs/evidence/desktop-power-v2.json); [33 Power tests](/reference/docs/evidence/power-connections-v2.json) | Existing owner-hosted connection configuration, exact review, stream, cancel, copy, history, removal and protected credentials. Paid rent-GPU flow is unavailable. |
| Automatic orphan-resource recovery/reconciliation | Runpod protocol recovery foundation | NOT IMPLEMENTED | [33 Power tests](/reference/docs/evidence/power-connections-v2.json) | Uncertain identities retain full reservation and can be explicitly reconciled in fixtures. Automatic live resource/billing reconciliation is not implemented. |
| Traditional payment provider implementation | Not implemented | NOT IMPLEMENTED | [Power limits](/reference/docs/power-connections-v2.md) | Engineering: payment flow, refunds, settlement and accounting. No payment credentials, charges or payment processor setup performed. |
| Optional USDC/Solana settlement implementation | — | NOT IMPLEMENTED | Architectural boundary only | Engineering; no token/wallet requirement. |

## Network marketplace and settlement (§§9, 18)

The specification explicitly defines this as a future extension. The implemented deliverable is the transparent roadmap and modular contract; operational service rows below remain honestly unimplemented, not current product claims.

| Requirement | Implementation location | Status | Evidence / test coverage | Remaining blocker or limit |
| --- | --- | --- | --- | --- |
| Transparent Network roadmap/extension page | DUI, SITE, POWER-DOC | IMPLEMENTED AND VERIFIED | Unavailable copy, no fabricated earnings | No operational marketplace. |
| Voluntary resource-sharing opt-in | — | NOT IMPLEMENTED | No hardware sharing occurs | Engineering: consent records and worker controls. |
| Provider onboarding | — | NOT IMPLEMENTED | Architecture requirement only | Engineering. |
| Hardware verification and supported-device eligibility | — | NOT IMPLEMENTED | Local diagnostics are not marketplace verification | Engineering. |
| Capacity listings | — | NOT IMPLEMENTED | No listings database or API | Engineering. |
| Availability/heartbeat service | — | NOT IMPLEMENTED | No network worker | Engineering. |
| Provider pricing and matching | — | NOT IMPLEMENTED | No marketplace prices | Engineering. |
| Workload isolation for hostile customer code | — | NOT IMPLEMENTED | Firecracker/NVIDIA research only | Engineering: separate worker VM/GPU boundaries and adversarial tests. |
| Job assignment/scheduling | — | NOT IMPLEMENTED | No scheduler | Engineering. |
| Provider resource monitoring and quotas | — | NOT IMPLEMENTED | No worker resource service | Engineering. |
| Payment accounting for real marketplace jobs | — | NOT IMPLEMENTED | Synthetic local ledger is not settlement | Engineering. |
| Reliability scores | — | NOT IMPLEMENTED | No verified job history | Engineering; no fake metrics. |
| Provider withdrawals/payouts | — | NOT IMPLEMENTED | No payout flow | Engineering and later authorized payment integration. |
| Dispute handling | — | NOT IMPLEMENTED | No dispute case/receipt service | Engineering. |
| Abuse prevention and workload validation | — | NOT IMPLEMENTED | No marketplace workload runner | Engineering: signed policies, quotas, screening and response. |
| Remote attestation validation | — | NOT IMPLEMENTED | Documented hardware-specific research | Engineering: nonce/chain/revocation/measurement verifier and hardware. |
| Wallet authentication | — | NOT IMPLEMENTED | No wallet integration | Engineering only if later useful; never local prerequisite. |
| Optional blockchain accounting records | — | NOT IMPLEMENTED | No chain transactions | Engineering and later owner-authorized test environment. |
| No token issuance or simulated earnings advertised as real | DUI, SITE, POWER | IMPLEMENTED AND VERIFIED | Copy/source review and simulation markers | Preserve through future integration. |

## Privacy, security and data ownership (§10)

| Requirement | Implementation location | Status | Evidence / test coverage | Remaining blocker or limit |
| --- | --- | --- | --- | --- |
| Desktop local models, conversations, projects, agents and settings | CORE, STORE | IMPLEMENTED AND VERIFIED | Windows REAL/D-E2E/C-STORE | Android emulator history is separately verified above; iOS/physical phones remain unverified. |
| Desktop OS-backed encrypted state and backup | MAIN; STORE; encrypted service stores | IMPLEMENTED AND VERIFIED | [workspace native acceptance](/reference/docs/evidence/desktop-workspace-v2.json); [project search and memory](/reference/docs/evidence/desktop-context-v2.json); [checkpoint acceptance](/reference/docs/evidence/desktop-checkpoints-v2.json) | OS-account protection only; models and original project files remain outside HOLD encryption. |
| Portable documented JSON export/import | STORE; CTL; PRIVACY.md | IMPLEMENTED AND VERIFIED | [photo native acceptance](/reference/docs/evidence/desktop-photo-v2.json); bounded import and permission-revocation regressions | 128 MiB input cap; exports are plaintext and imported grants require fresh authorization. |
| Deletion removes saved record and prior backup | STORE | IMPLEMENTED AND VERIFIED | C-STORE backup deletion regression | No secure SSD erasure claim. |
| No mandatory telemetry or chat analytics upload | CORE, MOBILE, SITE | IMPLEMENTED AND VERIFIED | Source/network boundary inspection; site tests | Not an independent packet-capture audit of every native dependency. |
| Remote data/retention disclosed before approval | PowerConnections.tsx; electron/power-service.js; packages/power | IMPLEMENTED AND VERIFIED | Actual native approve/deny review and owned endpoint execution. | Provider disclosure is not independent verification of its retention promises. |
| Path traversal/Windows path quirks defenses | PROJECT | IMPLEMENTED AND VERIFIED | C-PROJECT matrix, junction and hardlink tests | Same-user malicious racing process outside guarantee. |
| Command injection/unsafe shell default denial | AGENT, ENGINE, CTL | IMPLEMENTED AND VERIFIED | Fixed exec arguments; C-AGENT/C-CTL tool denials | No authorized arbitrary shell feature. |
| Prompt injection cannot grant new tools | AGENT, CTL | IMPLEMENTED AND VERIFIED | Adversarial tool/config tests | Model answer correctness cannot be guaranteed. |
| Credential file exclusion and secret handling | PROJECT; ENGINE; agent-services.js; Power; pairing | IMPLEMENTED AND VERIFIED | Adversarial grant/credential tests; [source secret scan](/reference/docs/evidence/source-secret-scan-v2.json). | Pattern scan and OS-protected stores are scoped checks, not proof of absence of every possible secret. |
| Authenticated loopback inference | ENGINE | IMPLEMENTED AND VERIFIED | REAL unauthorized request HTTP 401 | No public listener or unauthenticated remote access. |
| Malicious/tampered model download defense | packages/core/downloads.js; packages/core/model-bundles.js; packages/core/local-models.js; packages/core/model-updates.js | IMPLEMENTED AND VERIFIED | tests/core/downloads.test.js; tests/core/model-updates.test.js; docs/evidence/model-provenance-v2.json; docs/evidence/model-evaluation-v2.json; docs/evidence/model-4b.json | Pins, complete hashes, exact lengths, approved origins and GGUF validation reject tampering; no claim native model parsing is sandboxed. |
| Strict imported-data schema/migration validation | packages/core/state-schema.js; packages/core/storage.js; apps/mobile/src/portable.ts | IMPLEMENTED AND VERIFIED | tests/core/storage.test.js; apps/mobile/tests/portable.test.ts; docs/evidence/desktop-photo-v2.json | Strict bounded records/IDs/roles/images/options, old-version migration and grant stripping. Long-lived cross-version corpus and all third-party formats are not certified. |
| Default-deny tool authorization | AGENT; PROJECT; CTL; agent-policy.js | IMPLEMENTED AND VERIFIED | [agent native acceptance](/reference/docs/evidence/desktop-agents-v2.json); permission/delegation/MCP/web/execution regressions | The model cannot expand saved grants; every external call and test run keeps native approval. |
| Unsafe plugin execution protection | agent-services.js; core/mcp-client.js | IMPLEMENTED AND VERIFIED | MCP host/tool/credential/race regressions and exact native call approval. | No arbitrary stdio plugin loader or unrestricted local process execution. |
| Cross-device pairing security audit | packages/pairing; docs/pairing.md | NOT IMPLEMENTED | docs/evidence/pairing-real-v2.json; packages/pairing/tests/pairing.test.js; tests/desktop/pairing-integration.test.js; packages/pairing/tests/tasks.test.js | Engineering reviews and adversarial tests exist, but an independent protocol/penetration audit has not been performed. |
| Desktop dependency vulnerability audit | package-lock.json; docs/evidence/root-audit-*-v2.json | IMPLEMENTED AND VERIFIED | Fresh user-approved registry audits: production 0; full graph 8 moderate development-tool findings. | sprintf-js has no patched advisory version; no forced older builder downgrade applied. |
| Mobile dependency vulnerability audit and unresolved findings | MOBILE/package-lock.json; docs/evidence/mobile-audit-*-v2.json | IMPLEMENTED AND VERIFIED | Fresh user-approved registry audits: 15 high propagated entries; APK runtime-scope analysis retained. | node-forge/braces upstream roots; native APK source-map exposure is separate from build dependency risk. |
| Independent penetration/supply-chain security review | — | NOT IMPLEMENTED | Focused automated regressions are not penetration testing | Engineering/review work. |
| Native model parser sandbox beyond authenticated sidecar | ENGINE; local-models.js | NOT IMPLEMENTED | Authenticated owned sidecar; curated hashes and explicit unreviewed-import labels. | A stronger OS sandbox for arbitrary model parsers is not implemented; do not load untrusted models. |

## Official website (§11)

| Requirement | Implementation location | Status | Evidence / test coverage | Remaining blocker or limit |
| --- | --- | --- | --- | --- |
| Home page and required positioning/CTAs | apps/website/build.mjs; content-v2.mjs; public; release-status.json | IMPLEMENTED AND VERIFIED | [Current website checks](/reference/docs/evidence/website-v2.json); apps/website/website.test.mjs | Source preview with honest availability; local publication only. |
| Download page with accurate platform state | apps/website/build.mjs; content-v2.mjs; public; release-status.json | IMPLEMENTED AND VERIFIED | [Current website checks](/reference/docs/evidence/website-v2.json); apps/website/website.test.mjs | Final 0.2.0 Windows install/app/uninstall and native Android emulator results are scoped separately from unsigned trust and physical-device limits. Public download URLs await owner publication approval. |
| Features page | apps/website/build.mjs; content-v2.mjs; public; release-status.json | IMPLEMENTED AND VERIFIED | [Current website checks](/reference/docs/evidence/website-v2.json); apps/website/website.test.mjs | Verified source workflows include reviewed Git, bounded agents, observed resources and actual Windows Docker tests. Broad platform/security review remains separate. |
| Models page and memory guidance | apps/website/build.mjs; content-v2.mjs; public; release-status.json | IMPLEMENTED AND VERIFIED | [Current website checks](/reference/docs/evidence/website-v2.json); apps/website/website.test.mjs | Guidance is approximate; verified model/device evidence is separate and no universal compatibility promise is made. |
| Power page | apps/website/build.mjs; content-v2.mjs; public; release-status.json | IMPLEMENTED AND VERIFIED | [Current website checks](/reference/docs/evidence/website-v2.json); apps/website/website.test.mjs | Owner-hosted connection evidence distinguished from unverified external HTTPS and unavailable paid rentals. |
| Network page | apps/website/build.mjs; content-v2.mjs; public; release-status.json | IMPLEMENTED AND VERIFIED | [Current website checks](/reference/docs/evidence/website-v2.json); apps/website/website.test.mjs | Future marketplace explicitly unavailable; no earnings, paid jobs or tokens offered. |
| Open Source page/license/contributing links | apps/website/build.mjs; content-v2.mjs; public; release-status.json | IMPLEMENTED AND VERIFIED | [Current website checks](/reference/docs/evidence/website-v2.json); apps/website/website.test.mjs | Local source delivery and license references available. Public repository remains owner-gated. |
| Privacy page | apps/website/build.mjs; content-v2.mjs; public; release-status.json | IMPLEMENTED AND VERIFIED | [Current website checks](/reference/docs/evidence/website-v2.json); apps/website/website.test.mjs | Local storage, downloads and optional reviewed external transfer described; no invented confidential-compute guarantees. |
| Documentation with install/model/agents/troubleshooting/developer navigation | apps/website/build.mjs; content-v2.mjs; public; release-status.json | IMPLEMENTED AND VERIFIED | [Current website checks](/reference/docs/evidence/website-v2.json); apps/website/website.test.mjs | Local public reference documents; final release/package instructions remain owner-controlled. |
| Actual product screenshot | apps/website/build.mjs; content-v2.mjs; public; release-status.json | IMPLEMENTED AND VERIFIED | [Current website checks](/reference/docs/evidence/website-v2.json); apps/website/website.test.mjs | Authentic preserved 0.1.0 installed screenshot, explicitly captioned as older alpha; no fabricated current screenshot. |
| Visitor OS detection plus manual selection | apps/website/build.mjs; content-v2.mjs; public; release-status.json | IMPLEMENTED AND VERIFIED | [Current website checks](/reference/docs/evidence/website-v2.json); apps/website/website.test.mjs | Actual browser checks include manual Linux selection and prior Windows detection. iPhone/Android physical browser detection not tested. |
| Responsive layout and mobile navigation | apps/website/build.mjs; content-v2.mjs; public; release-status.json | IMPLEMENTED AND VERIFIED | [Current website checks](/reference/docs/evidence/website-v2.json); apps/website/website.test.mjs | Desktop, 390px and 320px Chrome review; no horizontal overflow. Physical browsers unverified. |
| Light/dark theme and persistence | apps/website/build.mjs; content-v2.mjs; public; release-status.json | IMPLEMENTED AND VERIFIED | [Current website checks](/reference/docs/evidence/website-v2.json); apps/website/website.test.mjs | Theme switch and persistence across navigation verified in Chrome. |
| Accessible landmarks, focus states and reduced motion | apps/website/build.mjs; content-v2.mjs; public; release-status.json | IMPLEMENTED AND VERIFIED | [Current website checks](/reference/docs/evidence/website-v2.json); apps/website/website.test.mjs | Source/route assertions and visible keyboard/focus conventions; not a complete WCAG or screen-reader audit. |
| SEO metadata and local social preview | apps/website/build.mjs; content-v2.mjs; public; release-status.json | IMPLEMENTED AND VERIFIED | [Current website checks](/reference/docs/evidence/website-v2.json); apps/website/website.test.mjs | Static metadata and local preview exist; no live canonical host, crawler or social-platform acceptance. |
| No third-party scripts, fonts, analytics or false forms | apps/website/build.mjs; content-v2.mjs; public; release-status.json | IMPLEMENTED AND VERIFIED | [Current website checks](/reference/docs/evidence/website-v2.json); apps/website/website.test.mjs | Static source assertions; no analytics network or hosted production monitoring configured. |
| Custom 404 and local server error behavior | apps/website/build.mjs; content-v2.mjs; public; release-status.json | IMPLEMENTED AND VERIFIED | [Current website checks](/reference/docs/evidence/website-v2.json); apps/website/website.test.mjs | Local server and generated 404 verified; eventual host routing/headers require deployment acceptance. |
| Buildable deployable static output | apps/website/build.mjs; content-v2.mjs; public; release-status.json | IMPLEMENTED AND VERIFIED | [Current website checks](/reference/docs/evidence/website-v2.json); apps/website/website.test.mjs | Nine pages and custom 404 generated; final ZIP is a separate root packaging step. |
| Real public binary download URLs | Deliberately absent | BLOCKED BY AN EXTERNAL DEPENDENCY | [Current website checks](/reference/docs/evidence/website-v2.json); apps/website/website.test.mjs | Owner publication approval and real signed/verified publicly hosted artifacts are required. No placeholder download links. |
| Canonical domain, DNS and public website deployment | Local build only | BLOCKED BY AN EXTERNAL DEPENDENCY | [Current website checks](/reference/docs/evidence/website-v2.json); apps/website/website.test.mjs | Owner-controlled domain/hosting/publication approval are required; no publication performed. |

## Design system, testing and performance (§§12, 14, 20–24)

| Requirement | Implementation location | Status | Evidence / test coverage | Remaining blocker or limit |
| --- | --- | --- | --- | --- |
| Color/typography/spacing/radius/icon/elevation/motion tokens | DESIGN; apps/desktop/src/styles.css; SITE/public/assets/site.css | IMPLEMENTED AND VERIFIED | Source design system and visual review | Cross-platform parity/mobile visual verification incomplete. |
| Forms, navigation, notifications and dialogs | DUI; SITE; MOBILE/App.tsx | IMPLEMENTED AND VERIFIED | [7 desktop keyboard/accessibility groups,18 screens](/reference/docs/evidence/desktop-accessibility-source-v2.json); native mobile accessibility evidence. | Named native/emulator scope; full accessibility certification and physical-device screen-reader testing remain outside these checks. |
| First-time Windows installation acceptance | scripts/verify-windows-install-v2.ps1; test-installed-v2.mjs | IMPLEMENTED AND VERIFIED | Final 0.2.0 NSIS exit 0; fresh profile, real-model app checks, uninstall exit 0, profile preserved. | Unsigned development-host result; clean-machine and upgrade validation remain. |
| First model download/load and first real conversation | DL, CORE; REAL; INSTALLED | IMPLEMENTED AND VERIFIED | Actual installed UI pinned download, CPU load and streamed response | Windows host only; download timing depends on network. |
| Model switching and application/core restart | CORE; D-E2E; REAL | IMPLEMENTED AND VERIFIED | Two real models; saved state reopened | Broader device/OS coverage pending. |
| Offline desktop operation | CORE; REAL | IMPLEMENTED AND VERIFIED | Application transport restricted to loopback after setup | No physical network adapter/airplane-mode test performed. |
| Weak hardware rejection | HW; MOBILE/src/domain.ts | IMPLEMENTED AND VERIFIED | C-INF low-resource and M-TEST memory guards | Physical low-end device usability unverified. |
| Slow response UX, sustained load and long histories | DUI; main.tsx | IMPLEMENTED BUT NOT VERIFIED | [workspace native acceptance](/reference/docs/evidence/desktop-workspace-v2.json); cancellation/streaming native tests | 1,000-message UI paging verified; extended multi-hour soak and cross-device performance are not certified. |
| Download interruption/failure/tamper recovery | DL; C-DL; MOBILE-DOC | IMPLEMENTED AND VERIFIED | Abort/range/corrupt/redirect regressions; native Android pause/resume and full integrity check | Physical storage-exhaustion and broader network/device coverage remain. |
| Storage-shortage handling UI | DL; CTL; MOBILE/src/models.ts | IMPLEMENTED AND VERIFIED | [7 controlled native recovery groups](/reference/docs/evidence/desktop-storage-shortage-v2.json); disk/quota rollback regression. | No real disk filling; exact draft/attachment/history retained, retry and encrypted restart exercised. |
| Agent permission denial and exact approval | PROJECT; AGENT; CTL | IMPLEMENTED AND VERIFIED | [agent native acceptance](/reference/docs/evidence/desktop-agents-v2.json); [checkpoint acceptance](/reference/docs/evidence/desktop-checkpoints-v2.json); actual isolated execution evidence | Permission denial and approved bounded tests do not authorize unrestricted host code. |
| Desktop light/dark/compact layouts | DUI | IMPLEMENTED AND VERIFIED | D-E2E screenshots, 800x700 overflow check | Formal accessibility audit pending. |
| Desktop startup timing | scripts/test-desktop.mjs; test-installed-v2.mjs | IMPLEMENTED AND VERIFIED | Source desktop smoke and final installed startup recorded in current reports. | Single-machine observations, not cold-launch distribution. |
| Time to first token, tokens/sec, model load and native memory | REAL; CATALOG-REAL | IMPLEMENTED AND VERIFIED | Actual small/balanced/experimental short responses with raw usage | Not sustained-throughput benchmark or cross-model quality comparison. |
| CPU time and GPU utilization snapshots | REAL; CATALOG-REAL | IMPLEMENTED AND VERIFIED | Native cumulative CPU time, working/private memory and nvidia-smi snapshots | Whole GPU may be shared; no utilization time-series or per-model allocation. |
| Mobile battery drain, startup and thermal throttling benchmarks | MOBILE; native device policy; final emulator observations | IMPLEMENTED BUT NOT VERIFIED | [Final native report](/reference/docs/evidence/mobile-native-verification-v2.json); measured startup/memory and lifecycle checks. | Physical battery/heat/throttling and repeated sustained throughput require target phones; not inferred from emulator. |
| Installed artifact storage footprint | docs/evidence/artifact-footprint-v2.json | IMPLEMENTED AND VERIFIED | Windows installed 1769775480 bytes; unpacked 1769608284; installer 592597766; APK 177020791. | Models/user data excluded; Android physical package allocation unverified. |
| Unit/integration tests | tests/core; tests/desktop; tests/review; packages/* tests; MOBILE/tests; SITE | IMPLEMENTED AND VERIFIED | [304/304 desktop/core](/reference/docs/evidence/unit-tests-v2.json); 38/38 mobile; 6/6 website. | Counts are separate suites; focused subsets overlap and are not summed as user journeys. |
| Actual inference tests | scripts/verify-inference.mjs; verify-cuda.mjs; verify-vision.mjs; Linux runtime check | IMPLEMENTED AND VERIFIED | Actual CPU/Vulkan/CUDA, native vision, Android local inference and Linux CPU evidence. | Only named hardware/model scope; known model-quality failures retained. |
| Desktop UI end-to-end tests | scripts/test-*-v2.mjs | IMPLEMENTED AND VERIFIED | Native chat/device12, workspace5, agents6, contexts6, checkpoints4, search5, photos5, voice8, Git4, Power4, execution4 and resource4 groups. | Separate deterministic native dialogs/controlled media fixtures; no physical microphone or universal accessibility certification. |
| Installed Windows real-model UI acceptance | scripts/verify-windows-install-v2.ps1; test-installed-v2.mjs | IMPLEMENTED AND VERIFIED | [Final install/uninstall](/reference/docs/evidence/windows-installation-v2.json); [10 installed application groups](/reference/docs/evidence/packaged-app-v2.json). | Exact executable/app.asar hashes recorded; unsigned development host, not a clean VM. |
| Migration/storage/security regression tests | C-STORE; C-PROJECT; C-AGENT; C-CTL | IMPLEMENTED AND VERIFIED | Explicit negative/boundary tests | No guarantee against every threat. |
| Device pairing test suite | packages/pairing/tests; tests/desktop/pairing-integration.test.js | IMPLEMENTED AND VERIFIED | docs/evidence/pairing-real-v2.json; packages/pairing/tests/pairing.test.js; tests/desktop/pairing-integration.test.js; packages/pairing/tests/tasks.test.js | Actual local TLS regressions include spoofed/replayed/expired/altered/revoked requests, cross-device ownership, late approval, stop/preflight, budget and reset/regrant races. Not independent penetration testing. |
| Native Android emulator UI/offline acceptance | MOBILE; docs/mobile.md | IMPLEMENTED AND VERIFIED | [Final APK and historical candidate-scoped checks](/reference/docs/evidence/mobile-native-verification-v2.json);38 tests. | Actual API36 x64 emulator; physical Android/iOS and battery/thermal certification remain. |
| CI workflow configuration | .github/workflows; MOBILE/ci/native-builds.yml | IMPLEMENTED BUT NOT VERIFIED | Source configuration exists | No hosted CI execution evidence. |
| Clean-room reproducible builds on another machine | .github/workflows; lockfiles; runtime manifests | BLOCKED BY AN EXTERNAL DEPENDENCY | Pinned local builds and source-to-artifact verification prepared. | A separate clean machine/CI environment and native platform toolchains are needed for independent build verification. |
| Requirements completeness matrix | docs/REQUIREMENTS.md | IMPLEMENTED AND VERIFIED | Mapped original specification and inspected source/evidence | Must update when new tests/artifacts land. |
| Production readiness of complete requested product | docs/VERIFICATION.md; OWNER_SETUP.md | BLOCKED BY AN EXTERNAL DEPENDENCY | Implemented local capabilities have scoped tests; public trust/platform gates are explicit. | Owner signing/publication, physical devices, Mac/iOS native validation, and independent release certification remain. This is not a universal production certification. |

## Packaging, owner setup and release deliverables (§§15–18, 21–22)

| Requirement | Implementation location | Status | Evidence / test coverage | Remaining blocker or limit |
| --- | --- | --- | --- | --- |
| Complete local source repository | hold/; README.md | IMPLEMENTED AND VERIFIED | Local build/testable project | No published remote. |
| Desktop packaged files and Android build-source consistency | scripts/verify-artifact-sources-v2.mjs | IMPLEMENTED AND VERIFIED | [Current consistency report](/reference/docs/evidence/artifact-source-consistency-v2.json):79 desktop files,89 Android inputs and final APK hash match. | Source consistency is distinct from independent reproducibility and publisher signing. |
| Windows installer generation | package.json; scripts/runtime-bundle.mjs | IMPLEMENTED AND VERIFIED | Final NSIS includes CPU/Vulkan/CUDA runtimes; 592597766 bytes; install/app/uninstall passed. | Unsigned; recorded development host only. |
| Windows installer signing | OWNER_SETUP.md | BLOCKED BY AN EXTERNAL DEPENDENCY | Unsigned configuration disclosed | Owner signing identity/certificate; signing does not block local unsigned build. |
| Windows installed launch/uninstall verification | scripts/verify-windows-install-v2.ps1 | IMPLEMENTED AND VERIFIED | [Final installer and exact hash](/reference/docs/evidence/windows-installation-v2.json): installation/native tests/uninstall exit 0; profile retained. | No security-policy changes. Clean-machine/upgrade and owner signing remain. |
| macOS application/DMG packaging configuration | package.json; runtime-assets.mjs; runtime-bundle.mjs | IMPLEMENTED BUT NOT VERIFIED | Pinned archive acquisition and target-specific bundle validation tests | Native DMG build/signing/run requires a Mac. |
| macOS application/DMG native execution verification | — | BLOCKED BY AN EXTERNAL DEPENDENCY | No actual Mac build/run claimed | Compatible Mac/toolchain required; configuration alone does not establish a release. |
| Linux AppImage | package.json; scripts/build-linux-validation.mjs; scripts/verify-linux-artifact.mjs; artifacts/desktop/HOLD-0.2.0-linux-x86_64.AppImage | IMPLEMENTED AND VERIFIED | docs/evidence/linux-artifact-v2.json; docs/evidence/linux-desktop-v2.json | Verified native Linux build/extraction only: CPU bundle, 149187437 bytes, SHA256 874f900dccd32bcc0317683f411cdce6df5a6fda3e4cc99549ec85c73fa04a0d; 77 checked packaged workspace files including retrieval Markdown, 31 current renderer source inputs and 61 runtime files. Production desktop launch/keyring needs a compatible Linux environment. Source binding is not independent reproducible-build certification. |
| Android installable APK | MOBILE/android; scripts/build-android.ps1 | IMPLEMENTED AND VERIFIED | Final 0.2.0 APK177,020,791 bytes; installed base.apk independently matches; [native report](/reference/docs/evidence/mobile-native-verification-v2.json). | Development certificate; physical phones and owner store signing not verified. |
| Android owner upload signing | MOBILE/plugins/withReleaseSigning.cjs; .env.example | BLOCKED BY AN EXTERNAL DEPENDENCY | Release signing configuration point exists | Owner upload key and secrets for release; development builds do not need these. |
| Google Play publication | OWNER_SETUP.md | BLOCKED BY AN EXTERNAL DEPENDENCY | Local app/project exists | Owner Play account, policy review, signed artifact and explicit submission approval. |
| iOS simulator/native build verification | MOBILE/app.json; MOBILE/ci/native-builds.yml | BLOCKED BY AN EXTERNAL DEPENDENCY | Mac generation/build instructions prepared | Mac/Xcode/CocoaPods required; no iOS build claim. |
| iOS distribution signing and App Store submission | OWNER_SETUP.md; MOBILE/eas.json | BLOCKED BY AN EXTERNAL DEPENDENCY | Configuration/instructions prepared | Owner Apple team/provisioning and explicit submission approval after native tests. |
| Deployable website artifact | apps/website/build.mjs; content-v2.mjs; public; release-status.json | IMPLEMENTED AND VERIFIED | Website ZIP contains deployable static output and source; extracted archive rebuilds and passes six link/structure checks. | No public deployment or fake public download links. |
| Versioned desktop/mobile release manifest | scripts/package-release-v2.mjs; scripts/verify-release-v2.ps1 | IMPLEMENTED AND VERIFIED | Version-specific manifest, committed-source archive and seven artifact hashes checked by scripts/verify-release-v2.ps1. | Local delivery; publication remains owner-controlled. |
| Windows installer checksum bound to installation evidence | docs/evidence/windows-installation-v2.json | IMPLEMENTED AND VERIFIED | Final successful installer SHA256 13140a813144e4633c6fb6716d29987a981d279871260744776739bd9702d20f. | Direct ZIP execution was refused by this host policy; use the verified installer. |
| Android APK final checksum | docs/evidence/mobile-native-verification-v2.json | IMPLEMENTED AND VERIFIED | SHA256509bfe572c83f75f78965b06a574a253555bf0ec29d937f97a74f2efe47cac63; source and installedAPK matching. | Hash binds tested bytes, not owner publisher trust. |
| Release notes | RELEASE_NOTES.md | IMPLEMENTED AND VERIFIED | Version 0.2.0 features, artifact trust, platform and dependency limits. | Nothing published; earlier versioned baseline artifacts preserved. |
| OWNER_SETUP.md with explicit remaining owner actions | OWNER_SETUP.md; .env.example | IMPLEMENTED AND VERIFIED | Documentation audited against build/signing source; Android instructions corrected to actual environment variables | Owner-operated account, signing and publication steps have not been executed; no unverified cost estimates. |
| Model compatibility/licensing matrix | MODELS | IMPLEMENTED AND VERIFIED | Exact artifact licenses/pins and tested-model status | New models need separate validation. |
| Automated test evidence and actual results | tests/; docs/evidence; SITE/VERIFICATION.md; MOBILE-DOC | IMPLEMENTED AND VERIFIED | Recorded suites, actual Windows inference/UI, Android native/offline acceptance | Scope-specific evidence; no physical phone/Apple certification inferred. |
| Security findings and resolutions | docs/security.md; docs/power-self-review.md; MOBILE-DOC | IMPLEMENTED AND VERIFIED | Boundary regressions, receipt fix and unresolved dependency findings | Independent security review not complete. |
| Honest release-readiness assessment | docs/REQUIREMENTS.md; docs/VERIFICATION.md; OWNER_SETUP.md | IMPLEMENTED AND VERIFIED | Current feature evidence and remaining platform/owner gates separated from future marketplace scope. | Passing scoped tests is not broad model-quality, security or platform certification. |

# Local media integration and in-chat model choice — 2026-10-19

- Desktop downloaded-model choice: IMPLEMENTED; actual native Qwen2.5 0.5B and SmolVLM switches preserve conversation and unsent draft. [Evidence](/reference/docs/evidence/generation-ui-2026-10-19.json).
- Mobile downloaded-model choice and capability names: IMPLEMENTED IN SOURCE; TypeScript/50 unit checks pass. Native build and physical-device validation remain UNVERIFIED for this change.
- Windows local image/video runtime, pinned multi-component downloads, creation views, cancellation, saving and resource admission: IMPLEMENTED EXPERIMENTALLY. CLI/device enumeration and application admission checks pass; generation control flow is unit tested with mock processes. These are not native image/video output tests.
- Image/video quality, responsiveness, peak memory and exact artifact execution: UNVERIFIED. Large transfers were truncated and no complete generation bundle was verified; the laptop's available RAM also failed admission. No automatic recommendation or universal winner was introduced. [Native admission](/reference/docs/evidence/generation-native-2026-10-19.json), [download failures](/reference/docs/evidence/generation-downloads-2026-10-19.json).
- Phone/Mac/Linux generation, photo editing, video input/understanding, audio generation, thermals and battery behavior: NOT IMPLEMENTED/UNVERIFIED by this change. [Scope and reproduction](/reference/docs/LOCAL_MEDIA_GENERATION.md).