Release 0.0.21: Cowork fixes and synchronized desktop train (#30)

Fixes the complete Cowork and Files acceptance ledger, adds the desktop sidebar control and Markdown-to-DOCX export, and requires macOS, Linux, and Windows to ship one synchronized version. Windows artifacts remain intentionally unsigned under the documented accepted policy.

Author: gitcommit90

CHANGELOG.md

@@ -7,6 +7,65 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.0.21] - 2026-07-27
+
+### Fixed
+
+- Desktop release policy now fail-closes on platform parity: one version and
+  exact source commit must produce verified macOS DMG/updater, Linux host, and
+  Windows Setup/Squirrel artifacts before any tag or GitHub Release can be
+  published. Windows signature status is disclosed and unsigned output remains
+  accepted until a trusted signing identity is adopted. A missing platform
+  pauses the whole release instead of leaving users on a stale update line.
+
+- Cowork new-file prompts now start blank. Names with an explicit extension are
+  preserved, while extensionless names receive the active section's `.md`,
+  `.whiteboard.json`, `.txt`, or `.slides.json` default.
+- Presentation canvases anchor at the top of their scrollable stage, and the
+  Excalidraw hamburger menu escapes the editor's inner clip into a bounded,
+  scrollable overlay so its complete menu remains visible and interactive.
+- Cowork Code uses the normal light surface with readable dark text in light
+  mode while retaining its navy editor treatment in dark mode.
+- Offline shell fallbacks always resolve service-worker requests with a valid
+  response instead of producing a rejected FetchEvent conversion error.
+- Cowork's bare Option/Alt shortcut now carries the mic control belonging to
+  the focused Notes, Docs, or agent input and uses a capture-phase fallback
+  when the macOS desktop shell swallows the corresponding keyup.
+- Long Cowork Notes give CodeMirror a finite editor frame and scroll through
+  its actual viewport in Write mode.
+- Leaving Cowork, changing sections, or opening another file now destroys the
+  outgoing Yjs document and reloads the authoritative workspace file into a
+  fresh document. The stale browser recovery copy that could resurrect or
+  repeatedly duplicate prior text has been removed.
+- Files directory, tree, text, and content reads now paint from the host mirror
+  immediately. One explicit background refresh coalesces the expensive channel
+  computer export and repaints the current listing when it completes.
+
+### Added
+
+- Files now keeps `/workspace` and the five Cowork folders first in its visual
+  navigation rail, with all remaining root files and folders grouped under an
+  expandable **Other** disclosure without changing the underlying filesystem.
+- Selecting a Markdown file in Files exposes **Download - DOCX**, backed by an
+  authenticated, contained Office Open XML export.
+- Desktop workspace navigation can collapse to a compact channel-icon rail and
+  expand again. The profile-bound preference persists, while the existing
+  mobile drawer remains unchanged.
+
+### Tests
+
+- Browser coverage toggles both Cowork editor and agent dictation through bare
+  Option/Alt, scrolls a 120-line Note, and proves section changes, full Cowork
+  navigation, and a five-line external replacement all reopen exactly once
+  without a recovery prompt.
+- A fake Apple channel computer with an intentionally slow export proves cached
+  Files reads stay responsive, simultaneous refreshes coalesce, and guest-only
+  files appear after the background refresh.
+- Browser and server coverage verify blank Cowork naming, default and explicit
+  extensions, presentation-menu stage bounds and pointer hit-testing, light
+  Code contrast, Files grouping, real DOCX ZIP contents, and persistent
+  desktop-only sidebar collapse.
+
 ## [0.0.20] - 2026-07-27
 
 ### Added
@@ -583,7 +642,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   notarization, stapled tickets, Gatekeeper verification, persistent
   Application Support, and isolated Apple container machines.
 
-[Unreleased]: https://github.com/gitcommit90/1Helm/compare/v0.0.20...HEAD
+[Unreleased]: https://github.com/gitcommit90/1Helm/compare/v0.0.21...HEAD
+[0.0.21]: https://github.com/gitcommit90/1Helm/releases/tag/v0.0.21
 [0.0.20]: https://github.com/gitcommit90/1Helm/releases/tag/v0.0.20
 [0.0.19]: https://github.com/gitcommit90/1Helm/releases/tag/v0.0.19
 [0.0.18]: https://github.com/gitcommit90/1Helm/releases/tag/v0.0.18

README.md

@@ -126,14 +126,19 @@ update preserves it — credentials, databases, resident state, files, and
 workspaces. Profile → Check for updates asks the Mac running 1Helm—not the
 device displaying the web UI—to download and verify the signed update.
 
-Windows 11 x64 gets a [signed Setup executable](https://1helm.com/download/windows)
+Windows 11 x64 gets a [Setup executable](https://1helm.com/download/windows)
 that provisions one private WSL 2 world per channel. Linux hosts use a verified
 installer that provisions a durable systemd service with an atomic,
 digest-verified, health-checked updater — see the
 [Linux install guide](https://1helm.com/manual/install-linux). Whichever platform,
 it works best on a dedicated machine: your crew works around the clock, and
 your everyday computer takes naps.
 
+Mac, Linux, and Windows use one synchronized desktop release version. A release
+is held in full until the DMG/updater ZIP, Linux host archive, and signed
+Windows Setup/Squirrel feed have all passed native install and update
+acceptance from the same source commit.
+
 ### Connect from iPhone, iPad, or Android
 
 The mobile apps are thin, native gateways to a 1Helm you already run. Install
@@ -268,7 +273,7 @@ and an audit trail. A prompt saying “use this service” is not a connector.
 |---|---|
 | **Apple Silicon macOS 26** | Native desktop product and real isolated Linux computer per resident (Apple `container machine`, `home-mount=none`). |
 | **Linux / CI** | Supported headless systemd host with one unprivileged LXC per resident (subordinate UID/GID mapping, exact ownership checks); CI may select an explicit test backend. |
-| **Windows 11 x64** | Native desktop product with one private WSL 2 world per resident (Windows-drive mounts and interop disabled); the signed Setup executable ships with every release. |
+| **Windows 11 x64** | Native desktop product with one private WSL 2 world per resident (Windows-drive mounts and interop disabled); the Setup executable ships with every release and its signature status is disclosed. |
 | **iPhone and iPad** | App Store gateway to an already configured HTTPS 1Helm host; sessions live in the device-only iOS Keychain. |
 | **Android 7+** | Directly distributed signed universal APK gateway; sessions are encrypted by a key held in Android Keystore. |
 
@@ -296,7 +301,7 @@ A fresh data directory opens first-run setup. The source runtime defaults to
 | `PORT` | `8123` | HTTP/WebSocket control-plane port. |
 | `CTRL_DATA_DIR` | `./data` | Databases, routing state, uploads, and narrow workspace mirrors. |
 | `HELM_CHANNEL_COMPUTER_BACKEND` | `apple` on macOS, `lxc` on Linux, `wsl` on Windows | Host isolation backend; `native` and `mock` are explicit development/test overrides. |
-| `HELM_CHANNEL_MACHINE_IMAGE` | `local/1helm-channel-machine:0.0.20` | Versioned channel-machine image contract. |
+| `HELM_CHANNEL_MACHINE_IMAGE` | `local/1helm-channel-machine:0.0.21` | Versioned channel-machine image contract. |
 
 ### Agent-first JSON CLI
 

docs/GOVERNANCE.md

@@ -57,22 +57,37 @@ contract as the slice hardens.
 8. A multi-item user request retains a numbered acceptance ledger in the pull
    request and GitHub Release. Do not collapse completed items into a generic
    summary or rely on generated commit notes as the user-facing release record.
-9. The retained Apple Silicon release host owns both artifact production and
-   public-download installed-app verification.
+9. Each supported desktop platform owns its native artifact and installed-app
+   verification lane. The retained Apple Silicon host owns macOS signing and
+   notarization; Linux owns the systemd/LXC artifact and updater acceptance;
+   Windows 11 x64 owns Squirrel and WSL acceptance. Authenticode is optional
+   until 1Helm adopts a trusted Windows signing identity; unsigned artifacts
+   must be identified honestly, but their signature status is not a release
+   blocker.
 
 ## Versioning
 
 - Semantic versioning on `package.json`.
 - **Do not** reuse a published version tag for different bits.
-- A release requires a unique version, changelog, exact tag, verified public
-  artifact, and platform-appropriate clean installation evidence.
+- A desktop release requires one unique version and exact commit, changelog,
+  complete Mac + Linux + Windows artifact matrix, and clean-install plus
+  prior-to-new update evidence on every platform. Partial platform releases
+  under the shared product version are prohibited. If one platform is blocked,
+  the entire tag/publication waits.
 - GitHub Release notes are a first-class product artifact. They must enumerate
   every user-visible fix and feature accepted for that release, using the same
   numbered ledger as the originating request when one exists. A short summary
   can introduce that ledger but cannot replace it.
 - macOS verification must use the exact publicly downloaded artifact, preserve
   Application Support, and prove signature/ticket/Gatekeeper, launch, version,
   loopback behavior, and retained state on the retained release host.
+- Linux verification must use the digest-qualified release archive and prove a
+  real systemd update, health-failure rollback, and retained `/var/lib/1helm`.
+- Windows verification must prove the Setup/Squirrel signature status, clean
+  install, old-to-new update, loopback health, WSL lifecycle, and retained
+  application data on Windows 11 x64. Do not substitute a self-signed
+  certificate or block an otherwise accepted release solely because the
+  artifacts are honestly disclosed as unsigned.
 
 Never hand-edit only a deployment target to fix the product. Fix in git,
 review, merge, and redeploy the exact source commit.

docs/VISION.md

@@ -79,14 +79,12 @@ verification.
 - `https://1helm.com` is the standalone product and documentation site.
 - `https://demo.1helm.com` is a separate public sandbox, not the product site
   and not a dependency of an installed workspace.
-- Apple Silicon macOS and Linux systemd are public host products with one
-  isolated Linux computer per ordinary resident.
-- The native Windows x64 + WSL implementation and real-host lifecycle are
-  accepted, but its public installer is withheld until an Authenticode signing
-  identity is available.
+- Apple Silicon macOS, Linux systemd, and native Windows x64 + WSL are the
+  synchronized public desktop-host product. Every named desktop release must
+  publish all three from one version and exact source commit.
 - 1Helm is self-hosted and open source. A hosted control plane, mobile clients,
-  blind community-skill execution, a signed public Windows installer, and a
-  native Linux desktop shell are not shipped.
+  blind community-skill execution, and a native Linux desktop shell are not
+  shipped.
 
 ## What 1Helm borrows—and what it does not
 

docs/release-checklist.md

@@ -6,7 +6,11 @@ Process: [release-lifecycle.md](./release-lifecycle.md). Policy: [GOVERNANCE.md]
 
 Docs-only governance can merge without a version bump; still update `CHANGELOG.md` Unreleased when operators should notice.
 
-**Do not say “done” for a ship until applicable checks pass.**
+**Hard gate:** every named desktop release must ship macOS, Linux, and Windows
+from the same version and exact source commit. There is no Mac-only fast path.
+Do not create the tag or GitHub Release, publish any platform, mark anything
+latest, or say “done” until all three lanes pass. If one lane is blocked, pause
+the whole release and report it.
 
 ## 1. Prepare
 
@@ -63,21 +67,51 @@ MERGED_COMMIT="$(git rev-parse origin/main)"
 VERSION="$(node -p "require('./package.json').version")"
 ```
 
-## 5. Tag (optional but preferred for named cuts)
+## 5. Build the complete desktop matrix before tagging
 
 ```bash
-git tag -a "v${VERSION}" "$MERGED_COMMIT" -m "1Helm ${VERSION}"
-git push origin "refs/tags/v${VERSION}"
 HEADLESS="dist/1Helm-${VERSION}-linux-node.tgz"
 DMG="dist/1Helm-${VERSION}-arm64.dmg"
 UPDATE_ZIP="dist/1Helm-${VERSION}-mac-arm64.zip"
+WINDOWS_SETUP="dist/1Helm-${VERSION}-windows-x64-setup.exe"
+WINDOWS_NUPKG="dist/1Helm-${VERSION}-full.nupkg"
+WINDOWS_RELEASES="dist/RELEASES"
 ANDROID_APK="dist/1Helm-${VERSION}-universal.apk"
 RELEASE_NOTES="dist/1Helm-${VERSION}-release-notes.md"
+
+# Build from clean snapshots of the same MERGED_COMMIT on the platform owners:
+# macOS arm64: npm ci && npm run typecheck && npm run build && npm test && npm run package:dmg:release
+# Linux:       npm ci && npm run typecheck && npm run build && npm test && npm run package:linux
+# Windows x64: npm ci && npm run typecheck && npm run build && npm test && npm run package:windows
+
+for artifact in "$DMG" "$UPDATE_ZIP" "$HEADLESS" "$WINDOWS_SETUP" "$WINDOWS_NUPKG" "$WINDOWS_RELEASES"; do
+  test -s "$artifact"
+done
 # Author RELEASE_NOTES from docs/release-notes-template.md. It must contain the
-# complete numbered acceptance ledger, artifact digests, and verification.
+# complete numbered acceptance ledger, every desktop artifact digest, and all
+# three platform verification records.
 test -s "$RELEASE_NOTES"
 rg -q '^1\. ' "$RELEASE_NOTES" # multi-item ships must retain a numbered ledger
-gh release create "v${VERSION}" "$DMG" "$UPDATE_ZIP" "$HEADLESS" "$ANDROID_APK" --title "1Helm ${VERSION}" --notes-file "$RELEASE_NOTES" --draft
+```
+
+The Windows `.nupkg` basename must exactly match the entry inside `RELEASES`.
+Record Authenticode status for Windows executable code and Setup. Trusted
+signing is optional until 1Helm adopts a Windows signing identity: an honestly
+disclosed `NotSigned` result is accepted and must not block the release. Never
+substitute a self-signed identity. When a trusted identity is configured, use
+the fail-closed `package:windows:release` command.
+
+Only after Sections 6–8 pass for all three desktop platforms:
+
+```bash
+git tag -a "v${VERSION}" "$MERGED_COMMIT" -m "1Helm ${VERSION}"
+git push origin "refs/tags/v${VERSION}"
+gh release create "v${VERSION}" \
+  "$DMG" "$UPDATE_ZIP" "$HEADLESS" \
+  "$WINDOWS_SETUP" "$WINDOWS_NUPKG" "$WINDOWS_RELEASES" \
+  --title "1Helm ${VERSION}" --notes-file "$RELEASE_NOTES" --draft
+# Upload mobile artifacts through their applicable distribution lane; their
+# timing never permits a partial desktop release.
 # review notes, then:
 gh release edit "v${VERSION}" --draft=false
 ```
@@ -117,16 +151,31 @@ curl -fsS "http://127.0.0.1:18123/api/setup/status"
 
 Expect first-run / needs_setup on empty data dir.
 
-## 7. Host updater acceptance
+## 7. Host updater acceptance — all three lanes are required
 
-- Verify the native ZIP was created only after the app was notarized and stapled; extract it and repeat strict signature, ticket, and Gatekeeper checks.
-- Confirm the public Electron feed selects that ZIP for the prior Mac version and returns no update for the new version.
+- **macOS:** verify the native ZIP was created only after the app was notarized
+  and stapled; extract it and repeat strict signature, ticket, and Gatekeeper
+  checks. Confirm the staged/public Electron feed selects that ZIP for the
+  prior Mac version and no update for the new version.
 - On the same retained Apple Silicon release host used for the clean build,
   install the **publicly downloaded** DMG/update with preserved Application
   Support, then verify the new version, loopback health, resident state, and
   data-directory identity.
-- Upload the exact `npm run package:linux` artifact and require GitHub's recorded `sha256:` digest before publication.
-- In a disposable systemd host running the prior release, invoke the same Captain host-update action, observe checking/downloading/installing/restarting, verify the new version and `/var/lib/1helm` identity, and exercise rollback with an intentionally unhealthy disposable fixture.
+- **Linux:** verify the exact `npm run package:linux` archive, its source commit
+  and SHA-256, then stage equivalent release metadata. In a disposable systemd
+  host running the prior release, invoke the Captain host-update action,
+  observe checking/downloading/installing/restarting, verify the new version
+  and `/var/lib/1helm` identity, and exercise health-failure rollback.
+- **Windows:** on Windows 11 x64, record Authenticode status for Setup, the
+  packaged app, and its executable code; confirm `.nupkg` and `RELEASES`
+  consistency; clean install Setup; exercise the real WSL 2 channel lifecycle;
+  then expose staged
+  Squirrel metadata to the prior public version and prove download,
+  verification, restart installation, new version, loopback health, WSL state,
+  and app-data preservation.
+- Before publication, compare each uploaded GitHub asset digest with the local
+  verified digest and assert the release contains the complete six-file
+  desktop matrix. A missing asset is a release blocker, not “not applicable.”
 
 ## 8. Clean deployment verify (when shipping install path)
 
@@ -147,6 +196,8 @@ Local setup:    needs_setup verified on clean CTRL_DATA_DIR
 Clean deploy:   <pass / skipped + reason>
 Mac host update:<public artifact installed on release host + state preserved>
 Linux update:  <old → new, digest + health + state preserved>
+Windows update:<old → new, disclosed signature status + Squirrel feed + WSL/app state preserved>
+Desktop matrix:<DMG + Mac ZIP + Linux TGZ + Windows Setup + nupkg + RELEASES, all same version/commit>
 Android:      <public APK digest, certificate fingerprint, install/update smoke>
 iOS:          <App Store build number + validation/upload result>
 CI:             Actions green on main