feat: add private text feedback plugin

[kalvinnchau]

Scope

• Bundled feedback plugin sends bounded private kind 42000 text and optional category to the deployment operator inbox, without a channel tag or ordinary timeline/read exposure.
• Failed or unknown delivery can be explicitly discarded locally after confirmation. Discard does not undo a possibly delivered event; retry uses the original signed ID.

Evidence

• Rebased on main 6fa0e9a. At 8d1fd8c: full Vitest package suite 324 files / 3,542 tests passed with two workers; typecheck and pre-push checks passed.
• Synthetic broker/session tests exercise signed private publication, persistence, retry and local discard. Browser and native UI journeys and controlled live feedback submission at this head remain deferred. Relay acceptance does not prove operator review.

Keep draft until live validation and CI complete. No browser cases added or removed.

[wesbillman]

Carl, an automated reviewer, commenting via Wes’s GitHub account.

Changes requested. Four actionable findings are recorded inline: two P1s (no-outbox render loop and cross-deployment draft retention) and two P2s (native registration and stale Done completion).

Reviewed head c5316922cdeddc07e20e4659e477a5a3b529ca96 against target b86e8d75560277f6b61acdb8c807b17d42c88397; PR diff merge-base d6b01e6b5d159bfa16ace71978ea8230544b8dc4. Validation was static source/contract review, hosted CI inspection, and an isolated React hook-mechanism probe. No PR application code or suites were executed locally; live submission and native UI behavior remain unvalidated.

Merge criteria: fix the four inline defects with boundary/lifecycle coverage. Separately, resolve the current merge conflict and red browser journeys. Hosted run 36063108794 tested merge c57408e: JavaScript, Rust/tool integration, and browser measurements passed; two existing viewport journeys failed in both engines after bounded wheel traversal. The prepended Feedback row changes traversal geometry, but these failures do not establish product clipping or unreachable controls. Repair traversal without weakening visibility assertions and validate both affected files in Chromium/WebKit.

[wesbillman]

Carl, an automated reviewer, commenting via Wes’s GitHub account.

Source review clear; validation remains incomplete. The four findings from review5310767267 are repaired at af82c6c9949a7a9c6effc1a5b64229789312db92: stable no-outbox rendering, session-scoped drafts, native catalog registration, and stale dismissal completion. I found no additional actionable code blockers in the text-only feedback slice against base df7b7e7f45739f3e06e12d81623385701acdc51d. This is not an approval.

CI run36097958821 tested the matching integration merge. At the 05:32Z snapshot, 658 browser journeys and Rust checks passed; JavaScript was 3719/3720 with the recurring AgentModelPicker failure, and its rerun was still pending. A green required gate was not established. Changed settings/integration tests retain their previous assertions.

Remaining acceptance gaps: no feedback-dialog browser journey (including keyboard focus handoff/return), desktop UI or controlled live-relay submission; Windows validation was skipped. Source/model tests do not prove deployed private-inbox routing or operator review. Resolve the required CI gate and complete the deferred feature acceptance before claiming merge readiness. No PR code was executed during this source-only review.

[wesbillman]

Carl, an automated reviewer, commenting via Wes’s GitHub account.

Source review clear; not approval or a green merge gate. Reviewed a6027d1f7f44f1125e9cbf80e48c05b60c49755c against e44b1e44f35b881b2dcaa44147d2ab607384b058 (also the merge-base). The rebased feedback production changes preserve the previously reviewed behavior and all four repaired findings. The two subsequent commits only align three test fixtures/assertions. Independent comparison checked the actual patches and new-base interactions, not just matching diff statistics.

Integration CI run 36168395905 tests this head/base pair. At the 17:52Z snapshot, JavaScript failed 1/3937 tests; WebKit 2/2 and the required gate were still pending, and Windows was skipped. The failing PluginImport assertion expects “stays enabled,” while the component renders “stays on”; both files are byte-identical at base and head, and the direct mocked render does not use this PR’s native catalog addition. This is an inherited mismatch, not an introduced finding. The red gate still needs resolution.

Source-only review; no PR code, tests, builds or CI reruns executed. Feature-dialog browser/focus handoff, packaged-desktop behavior and controlled live private-relay delivery remain unverified; relay acceptance would not prove operator review. Screenshot/diagnostics work in #245 is excluded. No accidental screenshots/generated artifacts found in this PR’s 30-file diff.

[wesbillman]

Star Lord, automated source reviewer, commenting via Wes’s GitHub account.

No new actionable source findings in this focused follow-up. Reviewed head 57c95c34b3ffa31513a7d7347d1554fd09442d73 against base/merge-base 09086638fc1c27f7e2299f042b8eeb6b19a7fece, comparing the actual code and rebased patches with the previously reviewed a6027d1f7f44f1125e9cbf80e48c05b60c49755c. This is not a fresh exhaustive audit of the full feature or intervening main changes.

• git range-diff matches all ten previously reviewed feature commits; the only added patch updates PluginImport.test.tsx:98 to expect “stays on and may run immediately,” matching the unchanged component at PluginImport.tsx:268. Exact access-difference, visibility and no-install assertions remain intact; this is a stale-copy assertion repair, not a relaxed behavior check.
• Of the current PR’s 31 changed paths, the other 30 are byte-identical to the previous reviewed head. The stable no-outbox snapshot, session-identity draft isolation, stale-completion fence and native catalog registration repairs remain present. I also checked the new base’s mention/message changes against feedback’s raw kind-42000 outbox path: it still bypasses kind-9 mention preparation and remains excluded from ordinary local/read/live views. Screenshot/diagnostic work in #245 is outside this review.

Validation: pinned-source analysis and byte comparisons only; no dirty source inputs, and git diff --check passed. No tests, builds, app launches, live submissions or CI reruns. At the single 18:32 UTC snapshot, CI run 36173817150 was still running JavaScript, Rust/tool integration, browser measurements and all four browser shards; Semgrep, zizmor and DCO passed, Windows was skipped. No green required gate or runtime pass is established here.

The existing acceptance gaps remain: feedback-dialog browser/focus handoff, packaged-desktop behavior and controlled private-relay delivery have not been exercised in this review. Relay acceptance would not establish operator review. This COMMENT is not approval, does not dismiss prior reviews and does not declare the PR merge-ready.