test(qa): add credential-free native VNC runtime matrix by oxfern · Pull Request #1 · oxfern/coven-cave

oxfern · 2026-07-17T00:53:49Z

Summary

Adds an opt-in Linux native QA harness under qa/native-vnc/ with thin Bun entrypoints and separate core, desktop, runtimes, scenarios, and tests layers.
Runs the real Tauri shell in an isolated 1440x900 Openbox desktop, centers Cave at 1180x760, and exposes the same session through loopback-only VNC and noVNC.
Keeps Cave, Next, the Coven daemon, persistence, APIs, SSE parsing, routing, and the native window real. Only credential-bearing vendor process boundaries are deterministic doubles.
Preserves the product's runtime boundaries: Codex, Claude Code, Copilot, and Hermes are summonable; OpenCode is registry-trusted for chat; OpenClaw uses its local agent bridge; external manifests remain visible but untrusted.
Leaves existing CI untouched. The proposed workflow is inert under qa/native-vnc/workflow-template/ and also has a job-level if: false guard for owner review.
Documents architecture, adding test cases, evidence handling, CI enablement, and a concrete hardening roadmap in qa/.

All command orchestration uses Bun Shell. Bun.spawn is limited to supervised long-lived services that need PIDs, logs, signals, and shutdown deadlines.

Verification

bun test qa/native-vnc/tests — 7/7 passed.
bun run typecheck — passed.
Bun bundled all six harness entrypoints successfully.
Inactive workflow YAML parse and git diff --check origin/main...HEAD — passed.
Live Linux native smoke — real window ready, VNC input passed, noVNC and WebSocket-to-RFB passed, daemon health passed, 97,373-byte screenshot with 7,189 colors.
Credential-free runtime matrix — 11/11 passed against the real app and daemon.
Scope audit — every changed file is under qa/; no .sh, WebM, MP4, MOV, or GIF is tracked.