[infamousjoeg]

Conceal supplies credentials to programs, but that alone cannot limit the service operation an agent performs. This candidate adds exact action approvals and a desktop review inbox: an operator sees the target, complete inputs, credential names, and consequence, approves the displayed digest once, and chooses when to execute. Changed requests, contracts, or schema-2 adapter plans require a new review.

The public Go adapter SDK provides versioned descriptors, input/scope schemas, explicit destinations and credential roles, deterministic preparation, structured review fields, and shared conformance tests. GitHub is the reference adapter. A second adapter lists one bounded page of S3 object names under an allowed bucket prefix in three explicit regions, using host-owned SigV4 signing after approval. Schema-1 GitHub request serialization remains compatible. A copyable starter and contribution guide show how to add another reviewed, compiled adapter.

The Tauri desktop bundles the Go engine and exposes only fixed review/approve/reject/execute commands through Rust. It includes credential-free metadata discovery, complete text-only review, expiry handling, separate execution, receipts, and isolated synthetic practice. The repository playground and task-oriented guides remain available. The candidate also includes scoped process execution, JSON secret preflight, native-store fixes, and optional Summon compatibility from the existing revision.

The approval workflow still requires a trusted operator context. There is no agent sandbox, MCP connector, runtime plugin loader, or human-presence authentication. An unrestricted same-account agent can bypass local controls. Installed adapters are trusted code. Execution consumes approval before dispatch and allows no automatic redirects or retries; uncertain remote outcomes need investigation before another proposal.

Local validation:

• Windows Go unit tests, synthetic native credential lifecycle, and lint passed; the complete Linux race suite passed.
• Adapter conformance, exact approval, credential denial/cleanup, signing, version invalidation, legacy encoding, and inbox state tests passed.
• Frontend build and five browser interaction tests passed, including stale-digest denial, plain-text rendering, expiry, keyboard, and narrow/dark layouts.
• Rust tests/clippy and Windows NSIS packaging passed. Linux Rust tests and Debian/AppImage packaging passed on WSL Ubuntu 24.04; both actual packaged WebKit apps passed isolated approval/rejection and practice checks. The actual Windows WebView2 app passed isolated review, displayed-digest approval, missing-credential denial, rejection, and practice checks through its bundled engine.
• Go vulnerability scanning and npm audit found no vulnerabilities. The Linux GLib iterator defect is fixed with the official two-line backport in a verified source copy. An optimized regression reproduces SIGSEGV on the original crate and passes on the patched crate. CI verifies every source file against the checksum-verified upstream archive, the resolved Cargo path, and the optimized regression; installers include the required license/backport notices. Cargo audit retains only the documented unmaintained build-time proc-macro-error warning; no advisory ignore list was added.
• Workflow syntax, release configuration, and local documentation links passed. Hosted verification of the final backport revision (99d73db) is running. The macOS workflow retains both app and DMG bundles so package inspection can verify the embedded engine and notices.

The workflows build native desktop installers and all seven CLI archives without publishing. Candidate packages are unsigned and macOS builds are not notarized.

Fixes #58
Fixes #59
Fixes #60