Status#
Effective on merge for Task 6.3. Native desktop admission remains blocked.
Decision#
Production computer-use code must fail closed when its native capability is absent. An action may report success only after its OS primitive resolves. A screenshot may be returned only when its encoded bytes are non-substitute capture output and its dimensions describe those bytes. Unsupported input, window, cursor, clipboard, capture, or transform semantics reject rather than silently degrading to a different operation.
Test doubles are dependencies, not automatic runtime modes. The production roots
of the four packages with test facilities export no mock or controller-injection
symbol. Tests import their explicit /testing subpaths. Production sources may
not import any /testing subpath.
The in-process @iris/desktop-automation window/menu/dialog/application model
is not a native backend. It is private, explicitly test-only, forbidden to
production imports, and has 0 production consumers. Eve's native owner remains
@psyche/computer-use-core under ADR-0077.
Two-pass result#
Pass one censused 82 production source files across 5 scoped packages. It found 0 test-double exports in production roots, 0 production testing-subpath imports, and 0 prohibited fabrication signals after remediation.
Pass two pins 12 controlled assertions covering native action, capture, clipboard, exact screenshot forwarding, capture-error propagation, deterministic comparison, and encoded-image metadata validation. These assertions run in display-free fixtures and therefore do not substitute for Task 6.4's real OS fixture.
Consequences#
- Native-unavailable action paths now return typed failure and never update cursor state before the OS primitive resolves.
- Native-unavailable capture paths now reject and never synthesize empty, gradient, one-pixel, or declared-only screenshots.
- Clipboard access no longer falls back to process-local memory.
- Unsupported buttons, independent key down/up, cursor queries, window capture, and modifier-held drag reject instead of degrading semantics.
- Iris element detection requires a real screenshot only when an enabled pixel consumer is actually bound.
- ScreenAnalyzer delegates capture bytes unchanged and propagates capture errors.
- ChangeDetector decodes pixels deterministically, validates image metadata, and contains no random comparison outcomes.
- Psyche screenshot resize/crop reports decoded output dimensions and surfaces transform failures.
- Mock screenshot, action, browser-network, OCR, and element providers are isolated behind explicit package testing subpaths.
- The simulated Iris desktop prototype is private, marked test-only, and guarded against production imports.
- Iris Vitest roots now discover the intended suites, including spec files.
Phase 6 remains open. G6, G10, and G14 remain open. Task 6.4 must prove real OS-level behavior and permissions before any native admission claim.
Evidence#
- Machine record:
docs/audits/eve-sota-computer-use-fabrication/2026-09-08.json - Schema:
docs/audits/eve-sota-computer-use-fabrication.schema.json - Record digest:
9dbc1609bbf69bc9dc60ee45bf69b2ef7aadfcf4c9afbedc4430cbe636dd4a21