Origin flip: framed app + connections bridge + vendored pin move to the service origin and stock v1.18.29 (#823)

[aarontrowbridge]

Implements #823 — the M3 cutover the #822 app-shelf service was built for.

In this commit (slice 1 of the branch):

• Bootstrap seam — the service parses the engine's ?auth_token= carrier (GET-only, query-preferred, both mints — engine-middleware parity) and ports the fork's public-UI exemptions (GET /assets/*, manifest, /amicode/widget-frame), so a real browser iframe can bootstrap + load the framed app from the shelf.
• Consumer flip — frameOriginUrl (service origin wins; engine origin the honest degraded fallback) drives every chat-panel / deck-pane call site; the connections bridge follows the framed origin (routes native on the service); the cloud-key fallback submit targets the service.
• Vendored pin flip — opencode.lock.json → stock canonical anomalyco/opencode v1.18.29, sha256s recorded from the real release assets (sizes match the release), ref = the tag's upstream commit.
• Parity-fixture self-tracking flips to the frozen fork record — stock serves no /amicode/* (M0 gate (a)), so parity re-recording from the new pin is structurally impossible; the goldens stay pinned at the last fork pin (v1.18.10-amicode.21) as the service's regression record.
• Parallel-run language retired — the service is the framed origin now, not a second harness.

Gate evidence so far: workspace typecheck clean; extension suite 2494 passed / 0 failed (vitest), amico-run 1441 passed / 0 failed. Two environmental exclusions, both verified pre-existing by unsetting the leaked host env (OPENCODE_DB / OPENCODE_CONFIG_CONTENT — this dev shell runs inside Amicode's own host env) and one fresh-worktree artifact fixed by pnpm -r build (the gitignored staged CLI gh shim).

Still landing on this branch: the boot-proof extension (document GET via ?auth_token=, anonymous assets, framed SSE) + the live end-to-end proof against the stock v1.18.29 binary, the assert_ui_gate check against the stock binary, and the fixture/recorder header notes.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[aarontrowbridge]

Slice 2 landed (6e64e65d) — the end-to-end proof against stock.

LIVE boot proof (the app-shelf-boot-proof lane's script, run for real): real service (esbuild-bundled from this branch) + real stock v1.18.29 vendored engine (.source: release anomalyco/opencode@v1.18.29, sha-verified) + real built app dist (build:app: materialize → bun install → vite build, 18 entries staged) — all six surfaces PASS:

[boot-probe] ✓ app document from the service origin (4327 bytes, not the placeholder)
[boot-probe] ✓ iframe bootstrap: document GET via ?auth_token= (no header) — the framed carriage
[boot-probe] ✓ anonymous asset fetch (GET /assets/LROKH5N7-B9MVhZqS.js) — the browser sub-resource constraint
[boot-probe] ✓ engine API call through the proxy (GET /session)
[boot-probe] ✓ SSE connect through the proxy (GET /event, first chunk delivered)
[boot-probe] ✓ /amicode/* route with the engine credential (GET /amicode/profile)

assert_ui_gate re-based for the cutover (a pin-dependent re-record the flip demanded): the framed app comes from the shelf now, so the engine's embedded UI showing amicode surfaces is no longer an invariant — and stock v1.18.29's minified newLayoutDesigns (a multi-branch upgrade-eligibility memo) matches none of the fork-era patterns. The gate now asserts what the ENGINE must guarantee: --version equals the lock's pin, and the auth_token carrier machinery (the bootstrap seam's engine side) is present. Unit tests re-recorded to the new contract.

Boot-smoke PASS against the stock vendored binary — the CI boot-smoke lane vendors stock after the flip and must stay green; verified locally.

Final gate evidence: workspace typecheck clean; schema 241, amico-run 1441, extension 2497 passed / 0 failed (vitest, stock binary vendored). Environmental exclusions documented with verification: host OPENCODE_DB/OPENCODE_CONFIG_CONTENT leak (this dev shell runs inside Amicode's own host env — both files pass with the vars unset), and the fresh-worktree gitignored CLI gh shim (fixed by pnpm -r build). One landmine flagged for the director: overlay_sync.test.ts runs overlay-sync.mjs --apply against the local fork checkout's CURRENT branch, mutating the committed overlay on dev machines (CI skips — no fork clone); restored before each commit, nothing of it rides this PR.

[aarontrowbridge]

Slice 3 (d86975f7) — the vsix-gate fix — landed, and ALL 9 CI CHECKS GREEN on this branch now:

app-bundle-gate        pass
app-shelf-boot-proof   pass   (CI self-skips per #825 — the LIVE run is the local evidence above)
boot-smoke (macos-14 / ubuntu-24.04-arm / ubuntu-latest)  pass  ← vendoring STOCK v1.18.29 through the flipped lock
bundle-build-gate      pass
fast                   pass
schema-roundtrip       pass
vsix-gate              pass   ← the re-based gate across ALL THREE platform binaries

The vsix-gate red was mine and is fixed in-slice: the re-based assert_ui_gate executed --version, and the vsix-gate loops every platform's binary on one machine (foreign-arch exec → 126). Now: same-arch binaries get the runtime version re-assertion; foreign-arch ones skip it honestly (the sha256 download gate IS the cross-platform pin verification) while the arch-independent auth_token carrier grep applies to every binary. Local suite after the fix: 2498 passed / 0 failed.

Branch complete — ready for director gate + human merge. The fork-retirement blocker #2 is discharged pending this merge: the vendored pin is stock v1.18.29, every UI consumer frames the service origin, and the framed path is proven live against stock.