STAR IB-LINUX-X86-64-01 — Establish Linux desktop as a first-class target #137

Current execution progress — 2026-10-14 UTC

IN_PROGRESS / PARTIAL_IMPLEMENTATION. Assessment and implementation are distinct: source-grounded STAR assessment is complete; the first bounded SUN implementation wave is in progress.

Reviewable sources: isomorphisms/ib PR #148, “Establish the shared Linux browser foundation”; isomorphisms/ai-ci PR #265, “Add independent IB shared-core and Linux ABI acceptance”; isomorphisms/kitchen PR #53, “Qualify IB Linux source and native execution through Grease and Ike”; isomorphisms/flexible-pipes PR #130, “Execute and retain the IB Linux first-wave qualification”.

Exact inputs: IB 2425d21; AI-CI 4cc61d96c02ebeff408c33dc065a4a6948696967; Kitchen 1a1c31236947ed3df50e94342276d1ae1280f986; FP execution source 69a4436c5a8c5b990a662a04f7e66c2d618d2aad. Executed receipts and limitations are data-only publication, with original failures retained. Source trees were compared byte-for-byte before refs advanced.

PASS in this Linux build container: 38 independent source cases with three production mutations and recovery; 46 generated-program/FFI cases with C mutation, missing-library refusal, recovery and Unicode-path relocation; current public-vocabulary guard. Existing exact-head IB checks idric-core, scientific-media and merge-gate also completed successfully; they are not graphical desktop acceptance.

The real ib-desktop milestone, graphical session, HTTP(S), durable disk restart, deliberate renderer/worker termination and physical Android execution remain NOT_RUN. The legacy Android store still refuses ordinary tabs. Compiler/support and diagnostic Grease producer debt is open; the current build-root restriction is tracked in Idriç issue 138. Byte reproducibility is unresolved. No implementation job is closed and no merge or release is authorized.

Original assignment / historical assessment follows; its snapshot statements are not current execution status.

STAR IB-LINUX-X86-64-01 — Linux desktop architectural assessment
Inspection date: 2026-10-14 UTC / 2026-10-13 America/Detroit.
Status: source-grounded assessment and SUN issue specifications. Desktop implementation, FP dispatch and independent desktop acceptance have NOT_RUN.

Decision

Make GTK 4 the first Linux frontend qualification candidate, accessed through a narrow C boundary. Keep Idriç as the single browser semantics owner, Grease as OS orchestration, ICU as source acquisition, and Cauldron/Pensieve as retained evidence and decision owners. Make persistent navigation, worker failure recovery and parity gates prerequisites of the first integrated milestone. Full-page rendering stays optional.

Do not infer a runnable native IB application from the existing direct x86 backend: its supported scalar subset cannot implement the current browser core. The practical foundation candidate is the already maintained Idriç/Chez route, explicitly packaged with its native runtime and C boundary, subject to ICK/AI-CI build qualification. This is an explicit architecture proposal, not an accepted build or a claim of runtime-free/direct-ELF IB. No RefC/generated-C fallback is selected. If this route cannot meet build policy, SUN IB-X64-01 must produce an upstream capability blocker rather than a substituted application.

Recovery scope and evidence limits

Inspected IB main's recursive tree, 115 returned branch names, all 17 returned open pull requests, open issue inventory, the named PR changed-file sets and focused source/contract files, selected workflow jobs/logs/artifact metadata, and related repository trees/contracts. This was focused architectural recovery, not a full audit of every line on every historical branch. Unnamed experiments were inventoried rather than universally executed. No local compiler, toolkit, desktop session, physical Android device, APK or browser core was executed in this assessment.

The environment did not expose a verified FP/Cat Food/Grease/Ike/compiler entrypoint; PATH checks found none of those commands. That does not prove global absence. Authorized issue creation supplies tracking; it is not FP execution or acceptance. FP's current job-delivery contract also records no deployed ChatGPT visible-sink adapter. No fabricated FP envelope, receipt, dispatcher identity or trusted delivery PASS is used.

Current-state inventory

Exact source anchors

• IB ownership, implementation boundary, storage model.
• History, Information extractor, LongViewTask, PaintBudget.
• Renderer contract, display interchange, resource-constrained acquisition.
• Canonical Strand, fragment acceptance, reader receipt.
• Longview diagnosis, worker lifecycle, ordinary object store.
• Retained intake, decision core, home projection.
• Idriç FFI, x86 supported surface, ICK targets.
• ICU captured response, ICU provider.
• FP stage contract, FP delivery, Kitchen IB baseline, Cat Food IB help.
• AI-CI build contract, AI-CI instructions.

Hosted execution and artifact evidence

IB's foundation workflow selects Idriç 7050c116326c9c8e8d0a56c2db7baf2119cbae19 and Chez; bin/ci_browser_foundation.grease bootstraps C support using make and invokes a stock cc for an independent verifier. Despite its extension, the file has a /bin/sh shebang and POSIX implementation. This is inherited build/orchestration debt, not a qualified new Grease/ICK pipeline.

The same script pipes compiler and runtime producers through tee. Checking output lines or executable existence does not exclude a producer printing expected output and then failing. The exact-text-specific repair cannot be treated as a blanket foundation repair.

The API associated foundation run 37319157443 with main's source SHA. Its observed idric-core job failed opening tests/test_android_shizuku_host.grease after checking out that SHA; this extra step is absent from the pinned main workflow file. Record the workflow/source pairing failure rather than claiming the core itself failed compilation. The scientific-media job passed. A universal gate success and old exact-text success do not override this narrower failure or the producer-status hole.

Longview run 38272204879 reported successful exact-source DEX generation and ART test steps. Artifact 11758200178 is present, unexpired, 910233 bytes, API digest sha256:2f539122dd7a4c8f60d8d24fe09d359f18bfbd18486ffeb1c6e92c549b683025. This assessment verified metadata and job steps; it did not download/reexecute that artifact. The compiler-cache restore passed and compiler-bootstrap steps skipped, so this run cannot establish a fresh-host bootstrap. The PR's 37 host and nine ART assertions are recorded evidence scoped to that diagnostic.

The native reader branch's browser-foundation run 38504708562 was in progress during initial inspection. No finished desktop, graphical, ARM32 or ARM64 result is inferred. Other successful foundation checks on Pensieve/lifecycle heads exercise the workflow's declared old smoke paths; they are not proof that every new module was included.

Shared architecture

One Idriç core process owns mutations. A replaceable GTK presentation process consumes bounded source-backed revisions and emits commands bearing the current object/revision/generation identity. Grease supervises acquisition/rendering workers; it does not interpret browser policy. Ordinary native socketpairs avoid importing Android's cross-UID provider design. The native supervisor reports observed identities; Idriç applies existing attempt/replay policy. A reconnecting local endpoint, if needed, lives in an ownership-checked private runtime directory and authenticates peers; same-UID permissions alone are not a sandbox against a malicious same-user process.

Publish bytes and journal records only after validation and admission. The Linux adapter supplies descriptor-relative no-follow opens and explicit file/directory sync outcomes. A GTK widget, IPC row, content hash, engine URL, PID or window handle never replaces a browser identity. UI callbacks cannot perform blocking network acquisition or full journal fsync on the presentation thread.

Keep immutable source bytes, decoded representation, extraction/selection, prepaint revision and glyph layout distinct. Resize changes layout. It does not reacquire a URL, reparse rendered text or create a visit. Selection anchors bind source revision plus a stated coordinate unit; exact-copy operations consult the checked source mapping. GTK character offsets, UTF-8 byte indexes, visual grapheme clusters and Android UTF-16 positions need explicit conversions.

The current semantic contradictions require reconciliation before broad propagation: HistoryEntry ordering is not stable durable event identity; ordinary tabs currently select renderer_lifetime_only; NeutralAddress rejects query/fragment but is not itself the Android origin-only sanitizer; the information extractor collapses whitespace; the source-backed canonical strand remains unmerged and separate from that extractor. Do not fix origin-only loss by blindly storing secret-bearing URLs.

Android-only facilities: Binder, Shizuku/rish authority, ContentProvider/PFD across Android UIDs, Activity/ART/DEX, APK signing/update identity and Android storage grants. Linux adapters expose equivalent semantic operations when possible, not fake Binder availability. Wayland/X11 and XDG paths are Linux-specific mechanisms. Shared semantics must be checked on Linux and both maintained Android ABI targets; physical MIRO A1/C67 outcomes remain separately identified.

Desktop platform comparison

GTK qualification must include Wayland and X11 independently, with OS/compositor/toolkit/font/renderer versions, 1×/2× and fractional scale, resize and mixed-script selection. A qualified nested/native software display can prove exercised graphics/input behavior; Xvfb alone proves only its X11 lane. Software rendering cannot establish physical GPU performance or real touchpad feel. Do not promise every distribution/driver configuration from one run.

Primary platform references:

• GTK TextView, GTK text/coordinate model.
• GDK clipboard, GTK Wayland, GDK X11, GTK runtime renderer controls.
• Pango, EFL source and dependency notes, EFL Wayland, SDL 3.
• Qt introduction.

Optional WebKitGTK

The GTK 4 API is webkitgtk-6.0 (API name, not a product version). Its official migration document describes mandatory web-process sandboxing, process swaps across security origins, and NetworkSession-owned persistent/ephemeral profiles. The C adapter must translate those events to IB's renderer contract; engine back/forward state is not the canonical navigation journal. An engine session may cache recoverable state, but cache loss must leave IB tasks, events and retained sources usable.

ICU owns source acquisition; WebKit's internal resource network is a separate renderer mechanism. Do not pretend replacing a top-level download intercepts all JavaScript requests or shares credentials automatically. Cookies, credentials and engine profiles need a protected service policy. Authentication continuity, ordinary URL reconstruction, DOM state, form state and heap continuity are separate outcomes.

WebKitGTK includes a C++ engine. A C-facing API does not erase that dependency. Evaluation is complete at the architectural level; actual introduction remains conditional on satisfying the user's no-C++ boundary. Likewise a GTK C API does not certify that every transitive system library is implemented in C. SUN jobs must inventory that closure rather than claim a C++-free system. No C++ first-party IB implementation is proposed.

WebKit's GTK 4 migration guide is the primary inspected API source. Some stable reference URLs could not be retrieved; implementation must pin a concrete supported package/API and inspect its installed headers. No package version or full-page renderer has been qualified here.

Android/Linux parity matrix

All Linux desktop rows below are outstanding product evidence. “Shared source” does not mean a deployed shared executable.

Dependency graph and milestones

00 shared contract and 01 executable qualification can start independently; 08's gate/receipt design starts alongside both. Only each job's stated boundary may pass before its prerequisites.

00 + 01 → 02 window and 05 storage/supervision.
02 + 00 → 03 prepaint.
05 + 00 + 01 → 04 acquisition/navigation (ICU metadata work may begin independently).
03 + 04 + 05 → first integrated desktop milestone, accepted by 08.
That milestone → 07 durable Pensieve/workbench.
That milestone → conditional 06 full-page renderer.
07 + existing portable-evidence work → selected-source continuity qualification, before any general synchronization claim.

The first milestone includes persistence and deliberate worker/presentation termination, because the user's eight-step acceptance requires both. Deferring all of 05 until after a pretty reader window would fail that acceptance boundary. Full-page rendering is not on the first milestone's critical path.

Continuing parity gate

Start the gate before frontend development. Use a required, broadly triggered check for changes to shared source, platform interfaces, fixtures, recipes, pins and acceptance code. A dependency pin update must execute consuming tests; no stale prerequisite receipt may carry over as PASS. Record the checkout SHA, workflow source SHA and synthetic integration SHA separately.

Each receipt identifies: job/FP attempt; source and dependency revisions; executable and package SHA-256; OS/release/kernel/CPU ABI/libc; toolkit/display/backend/font identity; inputs/source digests; test ID; actual output, exit and typed result; failure injection; observer identity; timestamps; and links to sanitized logs/screenshots. Store original source/private URLs/credentials only within their authorized boundary, never public receipts.

Separate required categories: semantic, compiler/build, Linux native runtime, native graphical integration, real network, durable reopen/fault behavior, Android ARM32/ARM64 runtime, and named physical-device acceptance. Platform-specific exceptions require a reviewed reason and scope; unsupported/NOT_RUN is not PASS. A change adding shared semantics is not cross-platform accepted until both target families execute the relevant assertions. Preserve physical MIRO A1 and C67 receipts independently and use runtime-only delivery with stable Android update identities.

AI-CI must reject at least: wrong source/tool/artifact; stale prerequisite; expected output plus failed producer; synthetic merge mislabeled as head; Android x86 evidence labeled Linux; screenshot-only acceptance; fixture HTTP labeled public network; clipboard echo without independent read; renderer-owned duplicate history; lost ordinary path; origin-only false restoration; wrong Unicode unit; stale navigation/worker completion; accepted torn publication; “saved” after failed journal write; and platform-exception abuse. These are proposed gate requirements, not tests run in this assessment.

First integrated desktop scenario: launch real ib-desktop; open an actual public HTTP(S) URL and retain response evidence; show extracted native content; resize twice with unchanged source/parse counts; select/copy Unicode into an independent application; activate a link and verify destination bytes/content; exit/relaunch and verify canonical navigation/history; kill a worker or presentation process and reopen without durable corruption. Deterministic local network fixtures and native display lanes remain separate from public-network evidence.

Measure cold/warm start, first useful paint, input/reflow p50/p95, steady/peak RSS/PSS where supported, worker/renderer counts, and CPU/GPU paint observations. The current PaintBudget takes supplied estimates; it does not measure GPU time or establish a scheduler. Pre-register thresholds from a measured baseline and target budget; do not invent performance acceptance from a smoke test. Use 10,000 known resources with a bounded resident set to test scaling independently.

Effort and job state

Estimates below are focused engineering hours, not wall-clock promises or model-allocation units. Their range excludes an unbounded compiler extension or an unavailable physical test channel. Unknown compiler closure is the largest schedule risk. All SUN jobs are CREATED/NOT_EXECUTED when issued; no implementation, dispatch, merge or deployment is claimed.

Trackable SUN queue

flowchart TD
  S["00 Shared contract"] --> W["02 Window"]
  F["01 Executable"] --> W
  S --> L["05 Persistence"]
  F --> L
  W --> P["03 Prepaint"]
  L --> N["04 Navigation"]
  P --> M["First integrated desktop"]
  N --> M
  L --> M
  G["08 Parity and packaging"] -.-> M
  M --> H["07 Workbench"]
  M --> R["06 Optional renderer"]

Common SUN execution contract

Model: SUN — extra-high reasoning.
Repository: isomorphisms/ib. Parent assessment: #137
Execution: Flexible Pipes → Kitchen / Ike; dependencies through Cat Food and Grease; independent acceptance: isomorphisms/ai-ci.
Recheck live source and existing work before edits. Use one Idriç core, narrow C adapters and no Java/Python/C++ application implementation, Electron or duplicate browser state. New shared semantics require Linux and Android ARM32/ARM64 evidence. Follow current build policy; no undeclared fallback.
Receipts: source/dependency revisions, executable hashes, OS/ABI, actual outputs/exits, targeted failures and recovery, with semantic/native/graphical/network/physical results separated. Missing evidence is NOT_RUN. No merge or release authority.

Every child issue contains its full assignment, prerequisites, failure cases and estimate. The complete assignment text is also delivered in the accompanying response. Tracked issues are not FP dispatches or executed implementation. The continuing parity gate above is specified but not yet installed.