release(ai): gate v1.28.7 on curated local-model and runtime qualification

[qnbs]

Context

v1.28.7 is intentionally not being cut immediately after the current cloud-AI/provider convergence work.

Desktop-download volume is presently low enough that the release can wait until the most important current AI work has converged, especially the local-model surface.

This issue is the durable AI / Local-AI pre-release gate for v1.28.7.

It is a qualification/tracking authority, not a replacement implementation owner.

Implementation ownership remains in the existing issues, especially:

• ai: requalify current model catalog, defaults and end-to-end AI functionality across all providers #704 — canonical/current model authority, provider/default/catalogue reconciliation, local-model requalification and AI functional qualification;
• ai(local): harden Whisper/Kokoro model lifecycle, low-end performance, integrity & Eco-Mode #556 — Whisper/Kokoro/local-AI lifecycle, integrity, low-end performance and Eco-Mode;
• test(opt-in): qualify Settings admission, persistence and network/runtime safety for default-off features #711 — opt-in admission/persistence/network safety, especially Browser-Ollama;
• ai(lifecycle): unify Stop Generation, cancellation, supersession and duplicate-request semantics #714 — AI request lifecycle/cancellation/supersession/timeout semantics;
• pwa(ai): turn WebGPU/worker local inference into a zero-install offline AI differentiator #483 — broader PWA/browser-local AI productization, conditional release dependency only;
• perf(webgpu): reconcile enableComputeShaders with reachable production GPU paths and truthful fallback/coverage #717 — WebGPU/Compute Shader truth/performance work, conditional release dependency only.

Do not expand an implementation PR merely to close this tracker. A checkbox here is satisfied only from terminal implementation/qualification evidence.

The current #742 convergence must remain bounded to its existing OpenAI request-builder scope. This tracker does not authorize #742 scope expansion.

---

Release invariant

v1.28.7 may ship without completing every future AI roadmap item, but it must not knowingly ship:

• an uncurated local-model surface;
• an active default pointing at an unavailable/unusable model;
• a broken advertised local runtime;
• destructive persisted-model migration;
• uncontrolled local-AI cancellation/lifecycle behavior;
• corrupt/incomplete model-artifact admission;
• a privacy/local-only boundary that can silently send work to the cloud;
• a materially false local/offline capability claim.

Target sequence:

current AI convergence
        ↓
local-model/runtime curation + critical issue convergence
        ↓
AI / LOCAL-AI PRE-RELEASE GATE = PASS
        ↓
final resulting-main stabilization
        ↓
release-readiness audit
        ↓
v1.28.7 release cut / PR
        ↓
pre-tag desktop/Tauri qualification
        ↓
deliberate signed v1.28.7 tag
        ↓
artifact / updater verification

---

Gate A — canonical model authority / #704

PASS only when the current production model surface is explicit and internally consistent.

• Every production model ID that is selectable, defaulted, persisted or used as a runtime fallback has an explicit authority/classification.
• Recommended defaults are distinguished from current-supported, specialized, preview/experimental, legacy-compatible, deprecated, removed and unknown/custom persisted values.
• No known deprecated/removed/unusable model remains an accidental active default.
• Settings, runtime routing, fallbacks and provider adapters do not expose contradictory model/default truth.
• OpenAI o-series catalogue/type reachability discovered during fix(ai): adapt OpenAI reasoning parameters #742 receives an explicit durable disposition under ai: requalify current model catalog, defaults and end-to-end AI functionality across all providers #704.
• Capability admission prevents known model/provider-operation mismatches.
• Valid historical user selections are preserved where still supported.
• Unknown/custom IDs remain preservable where the configured provider/runtime legitimately supports arbitrary IDs.
• Removed/unusable persisted models have an explicit non-destructive migration/error policy.
• LOCAL / ECO / HYBRID / CLOUD routing semantics are explicit and test-backed.
• Local-only/privacy policy cannot silently escalate to cloud.

Automatic FAIL examples:

• active default references a removed/unusable model;
• runtime and UI disagree on effective model authority;
• persisted configuration is silently rewritten to an unrelated default without policy;
• known capability mismatch remains routable;
• local-only behavior can contact cloud without explicit user policy.

---

Gate B — curated local model/runtime catalogue

Every currently advertised/selectable local model/runtime must receive one explicit disposition:

ADMITTED_DEFAULT
ADMITTED_SUPPORTED
SPECIALIZED
EXPERIMENTAL_OPT_IN
LEGACY_COMPAT
UNSUPPORTED
REMOVE

WebLLM

• Every admitted model currently exists and is loadable with the supported runtime/library version.
• Model/quantization choice is explicit.
• Approximate download size and practical memory class are known.
• WebGPU/runtime requirements are truthful.
• Successful real local inference has been demonstrated.
• Cancellation/Stop has been exercised.
• WebGPU-unavailable/OOM/device-loss behavior is controlled.
• No hidden cloud fallback exists.
• A realistic lightweight local default exists if browser generative WebLLM is presented as a normal product capability.

ONNX Runtime Web

• Every production ONNX model/artifact is identified by current source/version.
• Current runtime compatibility is verified.
• WASM/WebGPU requirements are explicit.
• Model download/cache behavior is deterministic.
• Real local execution succeeds for the task for which the model is presented.
• Failure/resource-boundary behavior is controlled.

Transformers.js

• Current model/revision identifiers are verified.
• Download and reload work.
• Offline-after-download works where claimed.
• The admitted model remains practically useful for its advertised WorldScript task.
• Historical/obsolete models are not normal recommendations.

Ollama

• Local endpoint/connection semantics are current and intentional.
• Model enumeration/selection works.
• Real local inference has been exercised.
• Local-server-unavailable behavior is actionable.
• Timeout/cancellation semantics are defined.
• Ollama failure cannot silently trigger cloud fallback under local-only policy.

LM Studio / vLLM / custom OpenAI-compatible endpoints

Where WorldScript continues to claim support:

• Endpoint normalization is correct.
• Custom model IDs are preserved where legitimate.
• Request shape is compatible with the admitted runtime contract.
• Streaming works where claimed.
• Auth/no-auth behavior is explicit.
• Timeout/cancellation behavior is defined.
• Connection testing proves meaningful usability rather than mere endpoint reachability.

Do not equate OpenAI-compatible with complete OpenAI behavioral parity automatically.

---

Gate C — #556 critical Local-AI / Voice lifecycle

The entirety of #556 is not automatically a v1.28.7 blocker. Its currently product-relevant correctness subset is.

• Current Whisper model/runtime inventory is explicit.
• Current Kokoro model/runtime inventory is explicit.
• Local model artifact sources/versions are known.
• Incomplete/corrupt downloads cannot be promoted as valid models.
• Failed initialization does not blindly destroy valid downloaded artifacts.
• Concurrent model init/download storms are prevented or bounded.
• User cancellation has deterministic semantics.
• Timeout is distinct from user cancellation.
• Resource exhaustion/backend-unavailable states are actionable.
• Offline-after-download works wherever product copy promises it.
• Eco Mode has a concrete resource/model policy rather than a cosmetic label.
• Local inference does not make editor/autosave behavior unusable.
• UI truthfully distinguishes on-device/browser-local, local-network and cloud-provider execution.

Release-blocking findings include corrupt-artifact loops, uncontrolled init/download storms, hidden cloud fallback, persistent editor/autosave starvation, destructive cache/model recovery, materially misleading local/cloud labels, or reproducible critical OOM/crash without safe recovery.

---

Gate D — #711 Browser-Ollama privacy/admission

This subset is P1 and release-blocking.

OFF-state

With enableBrowserOllama = false:

• Opening/mounting AI Settings/Ollama UI causes no automatic localhost:11434 request.
• Reloading the Settings surface causes no local-network probe.
• A saved local endpoint is not contacted merely because the UI mounted.
• OFF remains network-inert until explicit admitted user intent.

ON-state

• User explicitly enables Browser-Ollama.
• Explicit Load Models / Test Connection or equivalent action produces the expected request.
• Deterministic success produces correct UX.
• Unreachable/CORS/local-network failure produces actionable classification.
• CORS/CSP protections are not weakened to make the feature work.
• Required CI does not depend on a real Ollama daemon accidentally present on a runner.

Any unsolicited local-network request while Browser-Ollama is disabled is an automatic FAIL.

---

Gate E — #714 local-runtime lifecycle subset

For every local runtime admitted into v1.28.7:

start
→ active/streaming
→ cancel/stop/supersede
→ terminal
→ no stale resurrection

• Caller cancellation reaches the lowest practical runtime/transport boundary.
• USER_CANCELLED is not treated as ordinary provider failure.
• TIMEOUT is distinct from user cancellation.
• Cancellation stops retry/fallback escalation where policy requires.
• Stop cannot accidentally trigger a cloud fallback.
• Late stream chunks after cancel/supersession are rejected.
• Late completion cannot overwrite a newer request.
• Repeated Stop → Generate cycles remain functional.
• Request-specific listeners/readers/workers/timers are cleaned up.
• Cancellation does not unnecessarily unload/delete reusable local model state.
• OOM/device-lost/runtime-terminated states are differentiated sufficiently for safe recovery.

---

Gate F — conditional promotion from #483

#483 as a whole does not block v1.28.7.

Promote only a finding affecting an already advertised/reachable production capability, including:

• advertised offline local AI does not actually work offline;
• corrupt/incomplete artifacts can be treated as valid;
• missing WebGPU produces a crash instead of controlled fallback;
• local execution silently escalates to cloud;
• currently recommended browser-local model is no longer loadable;
• local inference materially breaks editor/autosave usability;
• product/runtime capability claims are materially false.

Long-term OPFS/model-manager/multi-tab/browser-AI productization may remain post-release unless promoted by the rules above.

---

Gate G — conditional promotion from #717

#717 as a whole does not block v1.28.7.

Promote only confirmed production-impacting findings such as:

• production GPU path returns materially incorrect results versus its reference path;
• WebGPU failure crashes functionality instead of safely falling back;
• device/buffer/resource leak has realistic user impact;
• GPU capability detection causes an unusable local-AI default;
• default-on Compute Shader policy causes incorrect product behavior;
• privacy/routing truth depends on an incorrect GPU/runtime decision.

Pure experimental WGSL expansion, benchmark refinement or roadmap cleanup remains post-release unless promoted by current production evidence.

---

Gate H — real local-runtime qualification

Mocks alone are insufficient for final release qualification.

For every runtime actually admitted into the release, exercise real supported environments where applicable, including the currently admitted subset of:

• WebLLM/browser-local generative model;
• ONNX Runtime Web task(s);
• Transformers.js task(s);
• Ollama;
• LM Studio / vLLM if retained as explicitly supported presets;
• Whisper;
• Kokoro.

Minimum real qualification contract:

• initialization/download succeeds;
• inference succeeds;
• result is structurally/usefully valid;
• cancellation succeeds, or runtime limitations are explicitly documented with safe late-result rejection;
• a second inference after cancellation still works;
• offline operation works where promised;
• unsupported hardware/runtime fails safely;
• no unexpected cloud request occurs.

Do not assert exact creative prose. Assert stable properties such as successful admission, non-empty/valid result, expected schema/task result, correct execution backend and privacy-boundary preservation.

Paid/live cloud-provider qualification that requires purchasing or supplying provider credentials remains deferred unless separately authorized. Mandatory CI must remain secret-free and deterministic.

---

Gate I — hardware/resource qualification

A full benchmark laboratory is not required.

For recommended local models/runtimes, capture enough evidence to avoid obviously unsuitable defaults:

• approximate download size;
• practical memory class;
• execution backend;
• cold/warm initialization class;
• representative responsiveness;
• known unsupported environment/fallback.

Where practical, distinguish at least:

• lower-end/integrated hardware;
• ordinary current laptop/desktop;
• WebGPU unavailable/disabled;
• bounded memory-pressure/OOM failure behavior.

---

Gate J — unconditional privacy/data-integrity invariants

• Local-only means no cloud-provider contact.
• No qualification path puts real API keys into repository or logs.
• Model-download requests contain no manuscript/prompt data.
• Local diagnostics do not expose manuscript/prompt/result contents by default.
• Persisted-model migration is preserve-first.
• Unknown/custom configuration is not destructively normalized without an explicit compatibility rule.
• Local artifact cleanup cannot delete unrelated project/user data.
• Failure recovery cannot weaken encryption/storage/privacy authority.

Any confirmed violation is an automatic release FAIL.

---

Finding promotion rule

Must be fixed before v1.28.7:

• every P0/P1 finding;
• any P2 affecting data integrity, privacy/local-only guarantees, security, production crash, advertised core AI functionality, active-default usability, destructive persisted-config migration, severe resource exhaustion, hidden network/cloud fallback, or a materially false release/product claim.

May remain post-release with a durable owner:

• future model additions;
• optional extra runtimes;
• benchmark refinement;
• experimental GPU expansion;
• architecture cleanup without current correctness impact;
• long-term PWA model-manager expansion;
• non-critical UX polish.

Do not create scope cascade merely to make this tracker numerically complete.

---

Per-PR terminality

A contributing implementation slice counts as complete only when normal repository governance is satisfied:

• source correctness established;
• focused tests green;
• pnpm run pr:budget -- --base <ref> within governance;
• pnpm run ci:prepush green before push;
• all current review channels inspected;
• every actionable finding fixed, disproved or durably deferred to an explicit owner;
• no unresolved actionable current-head thread remains;
• exact-head CI/CD terminal green;
• exact-head CodeQL terminal green;
• required external quality gates terminal or explicitly classified as non-authoritative/transient;
• PR merged without bypass;
• resulting-main CI/CD terminal green;
• resulting-main CodeQL terminal green;
• durable owning issue updated with resulting-main evidence.

---

Final release decision

PASS

Only when all hard gates above are satisfied and no unresolved release-blocking AI/local-AI finding remains.

FAIL

If any hard gate remains incomplete or a known P0/P1/release-critical P2 remains unresolved.

CONDITIONAL PASS is not sufficient for the release cut.

Non-release-critical work may be deferred only with explicit scope, owner, reason and post-release disposition.

Once this tracker reaches PASS:

AI / LOCAL-AI PRE-RELEASE GATE = PASS
        ↓
final resulting-main stabilization
        ↓
release-readiness audit
        ↓
version synchronization
        ↓
CHANGELOG [Unreleased] → [1.28.7]
        ↓
fresh empty [Unreleased]
        ↓
v1.28.7 release PR convergence
        ↓
resulting-main qualification
        ↓
pre-tag desktop/Tauri qualification
        ↓
deliberate signed v1.28.7 tag
        ↓
tag-triggered desktop builds
        ↓
artifact / signature / updater-metadata verification
        ↓
RELEASE TERMINAL

[qnbs]

Initialization checkpoint — 2026-09-14

The release-gate authority is now established and cross-linked into the implementation owners:

• ai: requalify current model catalog, defaults and end-to-end AI functionality across all providers #704 — model/provider authority + local-model requalification;
• ai(local): harden Whisper/Kokoro model lifecycle, low-end performance, integrity & Eco-Mode #556 — release-critical Local-AI/Voice lifecycle subset;
• test(opt-in): qualify Settings admission, persistence and network/runtime safety for default-off features #711 — Browser-Ollama privacy/network admission subset;
• ai(lifecycle): unify Stop Generation, cancellation, supersession and duplicate-request semantics #714 — currently admitted local-runtime lifecycle subset;
• pwa(ai): turn WebGPU/worker local inference into a zero-install offline AI differentiator #483 — conditional promotion only, not a wholesale release blocker;
• perf(webgpu): reconcile enableComputeShaders with reachable production GPU paths and truthful fallback/coverage #717 — conditional promotion only, not a wholesale release blocker.

Current disposition: GATE OPEN / NOT YET PASS. This is a tracking state, not evidence of a new defect.

PR #742 remains intentionally unchanged in scope. Finish its existing exact-head convergence and resulting-main verification first; do not pull local-model work into #742 merely because this tracker now exists.

After #742 is terminal, re-fetch live main and the issue graph before selecting the next causal AI slice. Subsequent work should close #743 requirements through their owning issues/PRs rather than implementing directly against this tracker.

No v1.28.7 release cut or public release tag should begin until this gate has an explicit evidence-backed PASS.

[qnbs]

Terminal checkpoint — #742 / resulting main — 2026-09-14

• PR fix(ai): adapt OpenAI reasoning parameters #742 exact head: 4678a9fb18b43f614ff2e1a442a730d4ac2c0398; final review wave was quiescent with 19/19 GraphQL review threads resolved and no new actionable current-head finding.
• Exact-head CI/CD run 34788653907: success, including Node 22/24 quality gates, Build, ordinary Playwright E2E, Deep E2E, Storybook and Browser Quality.
• Exact-head CodeQL: success.
• PR fix(ai): adapt OpenAI reasoning parameters #742 merged normally at 2026-09-13T23:32:41Z.
• Resulting main: dd5f76b10b31991acef96d417a8bd77643a5d44d.
• Resulting-main CI/CD run 34790006373: success.
• Resulting-main CodeQL SAST run 34790006430: success.

The OpenAI o-series catalogue/type reachability residual remains an explicit #704 follow-up. The v1.28.7 AI/Local-AI gate remains OPEN / NOT YET PASS; no release cut or tag is authorized until the release-critical local-runtime evidence is complete.

[qnbs]

Gate checkpoint: PR #744 / #711

PR #744 is terminal and merged. This closes the deterministic Browser-Ollama admission/privacy implementation slice only.

• PR final head: b4feb84668ee9e361ece20e8d0a2b28b7e82bcc8
• exact-head CI/CD 34795386263: PASS
• exact-head CodeQL 34795386190: PASS
• resulting-main SHA: e41b74b4bc72d50384d50cc0b414a5beddbcd721
• resulting-main CI/CD 34797067732: PASS
• resulting-main CodeQL 34797067760: PASS

#743 remains OPEN / NOT YET PASS. The merged E2E uses a deterministic Ollama route stub and therefore does not claim real local-runtime qualification. The release gate still requires current admitted local model/runtime evidence and the release-critical subsets of #704, #556, #711, and #714. #483/#717 remain conditional owners only. No v1.28.7 release cut or tag is authorized by this checkpoint; paid/live cloud-provider qualification remains deferred.

[qnbs]

AI / Local-AI release-gate housekeeping checkpoint — #745/#746 terminal, #747 split — 2026-09-14

Current disposition remains: GATE OPEN / NOT YET PASS.

No v1.28.7 release cut or public tag is authorized by this checkpoint.

Newly terminal since the last #743 checkpoint

#745 — duplicate-cancellation propagation / #714 lifecycle slice

• final exact head: 796f5f8c0dff85e8649526b807963e98e3f2a8f3
• exact-head CI/CD #3146: PASS
• exact-head CodeQL #2994: PASS
• merge/resulting main: 505574dc97e411530c61dfc1f444bc87ec113752

#745 materially advances Gate E/#714: cancellation is propagated through the affected provider/downstream request paths, late publication is fenced, and cancellation is not intended to become ordinary failure/fallback. It does not by itself complete the full local-runtime lifecycle gate.

Post-#745 security blocker / #746

The first #745 resulting-main CI run found an unrelated newly-known OSV advisory rather than a #745 source regression:

• RUSTSEC-2026-0285
• rustls 0.23.40
• fixed upstream in 0.23.45

PR #746 was the bounded lockfile/security remediation. It was squash-merged and produced current main:

3e94cfb2a23fef6e19b8afe1a26d9742f9c6286e

Resulting-main qualification:

• CI/CD #3150: PASS
• CodeQL SAST #2998: PASS
• Security/OSV gate no longer blocks on RUSTSEC-2026-0285

The transient security blocker is therefore closed and the post-#745 main line is verified green.

#747 architecture/decomposition disposition

PR #747 (refactor(ai): decompose ai provider service) reached exact head:

0e511aa1543baf6c0fa83b483747ebdea10f6015

with:

• CI/CD #3151: PASS
• CodeQL #2999: PASS
• Codecov patch: PASS, ~81.49% diff coverage against ~75.84% target
• 16 changed files / ~2,998 meaningful lines / 1 commit

The architecture direction is retained, but the PR is now intentionally Draft and frozen as a reference, because it operated only ~2 meaningful lines below the absolute PR ceiling and accumulated a large cross-provider review surface. It is superseded as a merge unit by a sequential dependency-correct bounded decomposition series, each child based on the latest verified green main.

This is governance/risk reduction, not rollback of the architecture. #747 review findings are being classified against its base to distinguish decomposition-introduced regressions from pre-existing defects. Release-critical pre-existing findings remain durably owned by #704/#714/#743 or their specific implementation owner rather than being lost during the split.

Gate status after these merges

Gate	Current disposition
A — canonical model/provider authority / #704	PARTIAL / OPEN — prior cloud/provider slices landed; full current catalogue/default/persisted compatibility and remaining residuals are not terminal
B — curated local model/runtime catalogue	OPEN
C — #556 critical Local-AI/Voice subset	OPEN
D — #711 Browser-Ollama admission/privacy	DETERMINISTIC SUB-SLICE PASS via #744; real local-runtime qualification still required elsewhere in this tracker
E — #714 local-runtime lifecycle	PARTIAL / OPEN — #745 advances cancellation propagation; full admitted-runtime lifecycle evidence remains
F — #483 conditional	CONDITIONAL ONLY; no wholesale promotion
G — #717 conditional	CONDITIONAL ONLY; no wholesale promotion
H — real local-runtime qualification	OPEN / release-critical
I — hardware/resource qualification	OPEN
J — privacy/data-integrity invariants	must remain continuously satisfied; final gate not yet PASS

Next release-gate discipline

Continue closing requirements through bounded owner PRs. The #747 split must not become a reason to defer any confirmed P0/P1 or release-critical P2 involving privacy/local-only boundaries, request integrity, cancellation, wrong-server routing, credential exposure, production crash/resource exhaustion, destructive configuration behavior, hidden cloud fallback, or materially false local/offline claims.

Paid/credentialed cloud-provider qualification remains deferred unless separately authorized. Mandatory CI remains deterministic and secret-free.

No v1.28.7 release work begins until #743 receives an explicit evidence-backed PASS.

[qnbs]

Canonical current-owner / release-gate checkpoint — 2026-09-16

The body and earlier initialization comments still name #704 as an active implementation owner. That is now historical. #704 is terminal/closed and must not be reopened merely to carry residual work. Its completed cloud-model/provider work remains evidence/provenance; the current executable responsibilities now live in dedicated owners.

Current implementation/evidence owner map

#709 = exhaustive feature/test coverage authority
#710 = deterministic AI product E2E
#711 = default-off Settings/admission/network-safety contracts
#713 = deferred/apply-later project-incarnation authority
#714 = Stop/cancellation/supersession/request lifecycle
#729 = Claude structured-output runtime implementation
#731 = Claude budgets/timeouts + genuine end-to-end streaming
#732 = provider usage/token accounting
#556 = Local-AI/Voice lifecycle, integrity, resource/low-end qualification
#602 = remaining reset/remanence residuals where promoted by release risk
#483 = conditional browser/PWA local-AI productization
#717 = conditional WebGPU/Compute Shader production-truth work

#607 remains an open P3 Codecov Bundle-Analysis observability integration issue and is not a release blocker absent materially different evidence.

Terminal/reconciled evidence since the earlier gate comments

• fix(ai): project-qualify image storage and use the real delete API #719: terminal project-qualified image/storage foundation.
• fix(project): fence async image authority by incarnation #734: terminal direct Character/World/Scene image + Character Interview project-incarnation authority.
• test(ai): qualify Browser-Ollama admission boundary #744: terminal deterministic Browser-Ollama Settings admission/privacy E2E. This satisfies the mocked OFF/ON admission evidence slice only; it is not real Ollama inference qualification.
• fix(ai): propagate duplicate cancellation signals #745: terminal duplicate-request cancellation propagation slice under ai(lifecycle): unify Stop Generation, cancellation, supersession and duplicate-request semantics #714; ai(lifecycle): unify Stop Generation, cancellation, supersession and duplicate-request semantics #714 as a whole remains open.
• refactor(ai): extract provider request lifecycle #748: terminal request-contract/lifecycle extraction foundation.
• refactor(ai): extract provider adapters #759: terminal cloud/local provider-adapter extraction.
• ci(tooling): admit local security/quality toolchain + QNBS-v3 checker #760: terminal QNBS-v3/toolchain-governance slice.
• fix(ai): reject stale AI image writes and project-qualify image storage #718: responsibility-first reconciled and closed as superseded; never merge/replay it.
• docs(proforge): plan real token accounting for the Claude path #727/docs(proforge): plan Claude max_tokens/timeout right-sizing #728/feat(proforge): plan Claude structured-outputs wiring #730: terminal planning/evidence PRs for ai(proforge): replace character-count token metrics with provider usage telemetry #732/ai(claude): right-size ProForge response budgets and implement real end-to-end streaming #731/ai(proforge): use native Claude structured outputs for schema-bound pipeline stages #729. They do not satisfy the corresponding runtime gates.
• refactor(ai): extract connection-diagnostics and local-model-discovery #761: merged behavior-preserving connection-diagnostics/local-model-discovery extraction from current main. At the time of this checkpoint, resulting-main CI for 4137286887275ca03aa5b75906e6b529c68c786c is still running, so this comment does not claim terminal resulting-main evidence yet. The slice is architectural support, not a release(ai): gate v1.28.7 on curated local-model and runtime qualification #743 gate PASS by itself.
• refactor(ai): decompose ai provider service #747 remains a frozen XXL draft/reference only; residual orchestration work must be selectively reconciled into bounded current-main slices if it is still justified.

Current gate interpretation

#743 = OPEN / NOT PASS remains the only valid release disposition.

Useful partial progress must not be inflated into release completion:

• Gate A / canonical cloud-model authority: substantially advanced/terminal through the completed ai: requalify current model catalog, defaults and end-to-end AI functionality across all providers #704 lineage, but current runtime/product truth still has dedicated open owners and local-runtime release gates. Do not use ai: requalify current model catalog, defaults and end-to-end AI functionality across all providers #704 closure as an overall AI gate PASS.
• Gate D / Browser-Ollama admission: deterministic Settings/network-inertness evidence exists via test(ai): qualify Browser-Ollama admission boundary #744; real runtime/model inference remains Gate H plus ai(local): harden Whisper/Kokoro model lifecycle, low-end performance, integrity & Eco-Mode #556/ai(lifecycle): unify Stop Generation, cancellation, supersession and duplicate-request semantics #714/current runtime owners.
• Gate E / lifecycle: incomplete while ai(lifecycle): unify Stop Generation, cancellation, supersession and duplicate-request semantics #714 remains open; fix(ai): propagate duplicate cancellation signals #745 is only a bounded subset.
• Gate C / Local-AI & Voice: incomplete while the release-critical ai(local): harden Whisper/Kokoro model lifecycle, low-end performance, integrity & Eco-Mode #556 subset is not terminally qualified.
• Gate H / real local runtimes: still requires real admitted-runtime evidence; mocks are not sufficient.
• Gate I / hardware/resource qualification: still incomplete for release-admitted local models/runtimes.
• Gate J / privacy/data-integrity: remains unconditional; any promoted violation blocks release regardless of tracker percentage.

Release invariant remains unchanged

No v1.28.7 release cut, version-finalization PR, or public signed tag is authorized until this issue receives an explicit evidence-backed PASS after all release-critical current owners have terminal evidence.

This tracker remains qualification/coordination authority only. Do not implement broad code directly “for #743”; execute through the owning issues above and feed terminal evidence back here.

[qnbs]

Resulting-main CI for 4137286887275ca03aa5b75906e6b529c68c786c (#761 merge) is now fully terminal and green (CodeQL, Security Audit, Verified Signatures, Workflow Policy Gate, Quality Gate Node 22/24, Build, Storybook, Browser Quality/Lighthouse, E2E Tests, E2E Deep Coverage all success; Rust/Tauri/PR-Size gates skipped as expected on this TS-only commit). Confirming the architectural-support evidence only — this does not change #743's OPEN/NOT PASS disposition.

[qnbs]

Current gate checkpoint — through #761 / current main — 2026-09-16

Current live main after PR #761:

main = 4137286887275ca03aa5b75906e6b529c68c786c
CI/CD = 35029296359 — SUCCESS
CodeQL SAST = 35029296306 — SUCCESS

This is the current green stabilization baseline for the AI/Local-AI release program.

Terminal work since the earlier #744 checkpoint

• refactor(ai): extract provider adapters #759 merged the provider-adapter extraction (c75e4dc74da8b43070c95e08315e686edaef6558 → resulting main f774732686f6feef51ad48de15c8790f7852c36d). It is a behavior-preserving architecture slice; it does not by itself satisfy model/runtime/lifecycle qualification gates.
• ci(tooling): admit local security/quality toolchain + QNBS-v3 checker #760 merged the local security/quality-tool admission + mechanical QNBS-v3 comment checker (4385bff149bccbe65ce6c1448c891ef7f3da8f0c → resulting main a65ed798555e972ce2ef398c7bb8a36c206db4e0). This strengthens repository governance but is not an AI-runtime PASS criterion by itself.
• refactor(ai): extract connection-diagnostics and local-model-discovery #761 merged connection-diagnostics/local-model-discovery extraction (d22ad5f07534d51c44f25d2efb74ef90927b115e → current main above). It preserves behavior and public compatibility; it does not claim new local-runtime qualification.
• ai: requalify current model catalog, defaults and end-to-end AI functionality across all providers #704 is terminal/closed as the historical umbrella. Do not treat its broad unchecked body as the current executable owner map.

Current executable owner map

Use the dedicated owners now:

#556  = Local-AI / Whisper / Kokoro lifecycle, integrity and resource qualification
#711  = default-off Settings admission/network safety; #744 satisfies its bounded deterministic Browser-Ollama subset
#713  = deferred/apply-later AI project-incarnation authority
#714  = cancellation / timeout / supersession / request lifecycle
#729  = ProForge Claude native structured outputs
#731  = Claude output budgets / timeout / genuine SSE streaming
#732  = provider usage / token accounting
#602  = residual Local-First reset/remanence follow-ups (now P2 after #602-A landed)
#483  = conditional browser-local/PWA promotion only
#717  = conditional WebGPU/Compute Shader promotion only
THIS ISSUE = release qualification / PASS-FAIL authority

#729/#731/#732 remain important AI correctness/runtime owners, but they are not automatically wholesale v1.28.7 blockers merely because they remain open. Apply this issue's promotion rule: they block the release only where a remaining finding meets the defined P0/P1 or release-critical P2 criteria / materially breaks an advertised release capability.

Gate D — Browser-Ollama deterministic admission evidence

#744 provides valid evidence that the disabled Browser-Ollama path is network-inert and explicit user intent gates the deterministic local-endpoint request. That bounded part of Gate D should no longer be treated as unimplemented.

It does not replace Gate H: real Ollama/local-runtime initialization, model discovery/inference, cancellation/recovery/offline/privacy behavior still require real supported-environment qualification where that runtime remains admitted for v1.28.7.

Remaining hard release work

The gate remains primarily blocked on evidence, not the recent refactors:

1. curated current local model/runtime catalogue and admitted/default dispositions;
2. real supported-environment qualification for each local runtime retained in the release;
3. release-critical ai(local): harden Whisper/Kokoro model lifecycle, low-end performance, integrity & Eco-Mode #556 lifecycle/artifact/resource subset;
4. ai(lifecycle): unify Stop Generation, cancellation, supersession and duplicate-request semantics #714 cancellation/timeout/supersession semantics for admitted local runtimes;
5. any Reset-gate follow-ups from #596: local-first Safari fallback, encryption-remanence clearData() propagation, IdbConnectionManager test-closer leak #602/pwa(ai): turn WebGPU/worker local inference into a zero-install offline AI differentiator #483/perf(webgpu): reconcile enableComputeShaders with reachable production GPU paths and truthful fallback/coverage #717 finding promoted by the release-critical rule;
6. preserve-first persisted-model/config migration and unconditional local-only/no-cloud/privacy invariants;
7. final current-main stabilization after the above and an explicit evidence-backed gate decision.

Current verdict

AI / LOCAL-AI PRE-RELEASE GATE = OPEN / NOT PASS.

No v1.28.7 release cut or public tag is authorized by #759/#760/#761 or by deterministic mocked runtime evidence alone. Keep implementation in bounded owning PRs; update this tracker only from terminal evidence rather than expanding work directly against the tracker.

[qnbs]

Release-gate promotion — partial-stream fallback concatenation — 2026-09-16

Current-main audit at 4137286887275ca03aa5b75906e6b529c68c786c identified and empirically reproduced a release-critical #714 defect: after a streaming provider has already emitted partial user-visible text, a later failure can still fall through to another provider and append a second full answer to the same logical stream.

Reproduced example:

OpenRouter emits PARTIAL-
→ throws
→ Gemini fallback runs
→ callbacks receive ["PARTIAL-", "FALLBACK-FULL-ANSWER"]
→ no onError; request reports success

The current partial-output fence is Grok-specific rather than attempt-generic. The same orchestration contract must cover normal provider-chain fallback, heuristic fallback and OpenRouter transient promotion.

Gate disposition: promoted under #743's finding-promotion rule as a P1 correctness / core-AI output-integrity blocker. v1.28.7 must not reach PASS while this current-main behavior remains admitted.

Owner: #714. Fix/test before or at the first correctness step of the remaining orchestration decomposition; do not perform a purely behavior-preserving extraction that carries this defect forward.

The associated current Grok regression is also structurally weak: its configured Gemini fallback is not proven reachable under the current fallback-chain rules, so the test can pass without exercising the guard. #714 now carries the required non-vacuous regression contract.

[qnbs]

Current-audit gate reconciliation — 2026-09-16

Fresh current-main audit evidence at exact SHA 4137286887275ca03aa5b75906e6b529c68c786c has now been reconciled into durable owners. Apply this checkpoint together with the existing gate body/promotion rule.

Newly confirmed/promoted before v1.28.7 PASS

#714 — P1 core-AI output/lifecycle correctness

• empirically reproduced partial-stream fallback concatenation: OpenRouter can emit partial text, fail, then Gemini fallback appends a second full answer and the logical request reports success;
• existing Grok regression is structurally vacuous unless it proves a fallback is actually reachable;
• correctness fix/test must precede or be the first correctness step of any remaining orchestration extraction.

#764 — P1 mutation-test evidence quality

• last four Stryker workflow runs chore(deps): bump pnpm/action-setup from 5.0.0 to 6.0.8 #52–chore(deps): bump log from 0.4.29 to 0.4.30 in /src-tauri #55 are verified failures;
• chore(deps): bump log from 0.4.29 to 0.4.30 in /src-tauri #55 proves the workflow can instrument/run mutants, but several scopes fall below the configured break: 75 threshold (e.g. Copilot 34.65%);
• no current post-refactor(ai): extract provider adapters #759/refactor(ai): extract connection-diagnostics and local-model-discovery #761 main mutation baseline exists;
• this matters directly to ai(lifecycle): unify Stop Generation, cancellation, supersession and duplicate-request semantics #714 because the fresh audit identified a green-but-vacuous regression oracle of exactly the class mutation testing is intended to expose.

Before release PASS, #764 does not require mutation-score perfection or promotion into required PR CI. It requires an evidence-backed current-main re-baseline and an admitted non-regressing mutation policy so the lane is not permanently red/uninterpretable.

#763 — P2 security dependency remediation/verification

• current security docs/config still say the adm-zip GHSA has no patched release;
• adm-zip 0.6.1 now exists, but the GitHub advisory metadata remains stale/unreviewed;
• security(deps): requalify adm-zip 0.6.1 and retire GHSA-vwc7-r8mq-g2x9 accepted-risk exception #763 therefore source/repro-qualifies 0.6.1 before removing the accepted-risk exception and respects the repository release-age policy.

Because #743 already promotes security-affecting P2 findings, this must receive a terminal disposition before release PASS: either verified upgrade/removal of the ignore, or evidence that 0.6.1 does not actually fix the advisory plus a current safe owner/mitigation. Stale “no release exists” wording is not sufficient.

Current findings that are NOT automatic #743 blockers

• build(toolchain): reconcile Node engine floor with jsdom 30 requirements #762 Node/jsdom/undici support-contract drift — P2 developer/toolchain correctness. Must be corrected for truthful contributor/build support, but promote into this gate only if requalification shows the release/build runtime itself is unsupported or broken.
• deps(governance): keep breaking majors out of grouped dev-tooling Dependabot PRs #765 Dependabot group policy / Vitest-major mixing — P2 merge-safety governance; not itself product release correctness.
• chore(quality): tighten token-audit baseline and make the ratchet mechanically monotonic #766 token-audit baseline headroom — P3 ratchet hygiene.
• chore(quality): reduce suppression debt and preserve ratchet headroom #447 suppression baseline headroom — P3 ratchet hygiene.

This distinction is deliberate: do not let the audit create release scope cascade merely because several useful P2/P3 hygiene items were found.

Gate remains OPEN / NOT PASS.

[qnbs]

Current-main gate checkpoint — #768/#769 — 2026-09-16

Live main has advanced from the prior audit anchor 4137286887275ca03aa5b75906e6b529c68c786c to:

06fa5d64cccdc451849646d40234f79fb13fbbcd

through two bounded #713 implementation slices:

• fix(project): reject stale deferred AI results in outline/logline/proofread/synopsis #768 (9df193393d880111c5a8b278a31b880b69c8d167) — outline regeneration, Manuscript logline, proofread, synopsis/export deferred-result authority;
• fix(project): reject stale AI generations in Writer, Global Copilot, and Dashboard after a project switch #769 (06fa5d64cccdc451849646d40234f79fb13fbbcd) — Writer, Global Copilot and Dashboard-logline project-incarnation authority, including mid-stream/project-switch/request-supersession races.

Resulting-main CI/CD run 35077859667 is terminal SUCCESS for 06fa5d64...; CodeQL for the same resulting-main head is also green.

Disposition:

• ai(project): bind Writer, Copilot and deferred AI results to originating project incarnation #713 is now in terminal reconciliation: the concrete named surfaces are materially covered by fix(project): reject stale deferred AI results in outline/logline/proofread/synopsis #768/fix(project): reject stale AI generations in Writer, Global Copilot, and Dashboard after a project switch #769, but its repository-wide deferred-result classification sweep must be explicitly dispositioned before closing the owner.
• This does not change the already-promoted ai(lifecycle): unify Stop Generation, cancellation, supersession and duplicate-request semantics #714 blocker. The reproduced partial-stream fallback-concatenation defect and the vacuous fallback regression remain P1/pre-PASS work and should be the next bounded core-AI correctness slice once ai(project): bind Writer, Copilot and deferred AI results to originating project incarnation #713's no-residual/terminal disposition is recorded.
• test(mutation): restore a green current-main Stryker evidence lane and actionable survivor signal #764 remains a separate P1 evidence-quality owner.

AI / LOCAL-AI PRE-RELEASE GATE remains OPEN / NOT PASS. No v1.28.7 release cut or public tag is authorized by the #768/#769 convergence alone.