Consolidate capability qualification and camera/workbench experiments

.github/workflows/ci.yml

@@ -36,3 +36,20 @@ jobs:
           cargo test --workspace --locked
       - name: Unit and equality tests (no keys, no browser)
         run: uv run pytest -q -m "not browser"
+      - name: Camera, desk inbox and workbench conformance (synthetic inputs)
+        run: |
+          uv run ruff check ../tools/camera-capture-experiment ../tools/desk-inbox-experiment ../tools/workbench-notes ../tools/physical-workcell
+          uv run python -m unittest discover -s ../tools/camera-capture-experiment -p 'test_*.py' -v
+          uv run pytest -q ../tools/desk-inbox-experiment/test_inbox.py ../tools/workbench-notes/test_workbench.py
+      - name: Install pinned physical simulator and headless rendering libraries
+        working-directory: .
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y libegl1 libgl1-mesa-dri
+          uv venv --python 3.12 tools/physical-workcell/.venv
+          uv pip install --python tools/physical-workcell/.venv/bin/python -r tools/physical-workcell/requirements.txt
+      - name: Physical workcell conformance (simulation, no model calls)
+        working-directory: .
+        env:
+          MUJOCO_GL: egl
+        run: tools/physical-workcell/.venv/bin/python -m unittest discover -s tools/physical-workcell -p 'test_*.py' -v

README.md

@@ -17,11 +17,40 @@ The Python package is `jevdual` (in [`jevdual/`](jevdual/)); Footwork is the pro
 from a run directory under [`jevdual/results/`](jevdual/results/), and every experiment was pre-registered in
 [`jevdual/docs/experiments/`](jevdual/docs/experiments/) before it ran.
 
+For an agent integration, start with [capability installation](jevdual/docs/capability-packaging.md)
+and the [agent-host recipe](jevdual/docs/installed-agent-host.md). The wheel supplies five MCP tools
+for one scoped browser-to-TextEdit job on macOS, with durable operation results and validated completion
+reports. It needs existing Python, uv, Chrome and applicable host permissions. The current candidate
+does not discover arbitrary apps; its disposable fixture helpers derive the identifiers for that test job.
+
 Optional [browser inspection utilities](tools/browser-inspection/README.md) collect redacted,
 timestamped evidence through an existing tab/CDP adapter. They are dependency-free ESM helpers,
 separate from the Python driver and verification gates. Their contract is tested offline; live
 capture fidelity must be calibrated on the selected browser.
 
+The optional [desk paper inbox](tools/desk-inbox-experiment/README.md) connects a saved
+camera frame to local text recognition and a reviewed inbox note. Its private review keeps
+the original image and OCR text. `footwork check-artifact` checks the saved note against
+the approved source bytes without a model call; it does not judge recognition accuracy.
+
+[Project-linked workbench records](tools/workbench-notes/README.md) attach reviewed evidence
+to an explicit project, repository revision and proposed check. The optional
+[MuJoCo workcell](tools/physical-workcell/README.md) explores a body interface with
+physical-state feedback and a conditional computer work-order update. Simulation results
+remain separate from real-camera and robot qualification.
+Its [image-guided route](tools/physical-workcell/IMAGE_GUIDED.md) supplies calibrated RGB views
+to an agent, accepts frame-bound proposals and requires fresh visual placement evidence before
+the conditional local computer action.
+The [repeatable episode interface](tools/physical-workcell/EPISODES.md) binds varied cases,
+retains images when perception fails, and compares fresh-agent decisions with a deterministic
+RGB controller. [SIM3 results](jevdual/results/repeatable-work-orders-20261010/report.md)
+record all twelve attempted episodes and their limits.
+The [independent controller](tools/physical-workcell/CONTROLLER.md) owns a simulated episode
+in a separate process, with reconnectable operation status, cancellation evidence and
+conservative receipt-based restart recovery.
+[SIM4 results](jevdual/results/independent-controller-20261010/report.md) record disconnect,
+cancellation and crash trials, retained failures and the boundary of supported recovery.
+
 ## Drive it
 
 ```sh

jevdual/docs/capability-packaging.md

@@ -107,3 +107,7 @@ The summary describes the configured task's admitted operation history as of its
 The local chrome-devtools-mcp package verifier checks the artifact produced for publication rather than trusting a source file list. This builder applies that mechanism to its actual wheel; it copies no upstream source. The license metadata follows [PEP 639](https://peps.python.org/pep-0639/): `License-File: LICENSE` resolves under the wheel's `.dist-info/licenses/` directory.
 
 The setup improvements use the structured prerequisite/error mechanism in local Cua, ambient-configuration isolation in Hermes, and exact emitted-command MCP discovery in Open Computer Use. Implementations are independent. Newer reference versions are not dependency upgrades; Footwork retains its pinned seams. The newer Cua doctor also performs legacy-file cleanup, so it is not used as a read-only verifier here.
+
+## Qualified local candidate
+
+The repaired guest permission-reset journey and one installed Claude Code task both passed with independent review. See [the guest report](../results/u3-packet-v4-permission-20261012-v3/report.md) and [the real-host report](../results/installed-agent-release-20261012-v2/report.md). The local release bundle preserves wheel9bb0440d and helper source445a348; its manifest identifies release documentation separately. It includes an [agent-host recipe](installed-agent-host.md) and exact qualification limits. Public registry publication, other hosts, pixel capture and disk persistence are separate gates.

jevdual/docs/experiments/A2-installed-agent-release.md

@@ -0,0 +1,37 @@
+# A2: installed agent host and release candidate
+
+Registered October12,2026 before installation or host execution. Developmental integration qualification; no A1, U2, U3 or heldout result is regraded.
+
+## Hypothesis and predictions
+
+One real Claude Code host can discover and use a fresh installed Footwork candidate for one owned browser-to-TextEdit task, with durable completion validated by the public adapter. If true, installed origins/private HOME, one exact append, one journal operation, accepted structured completion and automatic cleanup all pass. If false, a required gate is absent, wrong, refused or unverified; no generic success prose substitutes for it.
+
+## Design
+
+Use the immutable205577ee qualification packet and unchanged9bb0440d wheel from source445a348. Extract in a new owned output root; verify before running. Fresh empty-cache binary dependencies/private HOME on the existing host Mac and interpreter. Existing host permissions are prerequisites, not a new permission grant journey. Source harness/oracle may run outside the installed runtime; actual MCP server and detached worker must come from the installed venv, with -I and source/environment overrides excluded.
+
+One owned private Chrome fixture and exact TextEdit document; no unrelated GUI inputs. Generate the public per-job configuration and launch its actual command directly from real Claude Code, with only bind/observe/act/status/report. Use the existing isolated CLI recipe, modelclaude-opus-5-5/higheffort,1USDsoftcap and2USDschedulingreserve,180secondtimeout, no retries. Agent authentication remains opaque and unchanged; no credentials are opened/copied. Restrict MCP configuration to this job, disable builtins/hooks/slash commands/settings inheritance/session persistence. Use a fresh empty cwd inside project output. Record actual offered tools/model/version/calls and cost, exact AX oracle, read-only durable journal, runtime audits and worker absence.
+
+Host final structured_output must satisfy generated report-schema.json. After host exit, invoke the exact emitted report_adapter with those claims; retain accepted or rejected output and publish only trusted_summary. Independent root/Claude evidence review checks the final claim against its actual effect. One SIGINT closes the fixture automatically; verify exact document/browser/listener/worker absence. Preserve failed records; never repeat uncertain native input. No provider calls beyond this single host session and the authorized existing mailbox review.
+
+After passing this lane and Claude review, finalize a separate local release bundle with unchanged qualified runtime/helpers, installation and real-host guidance, MIT license, member hashes and evidence identities. Build twice and verify exact allowlisted members/digests and wheel RECORD/source equality. Keep qualification packet unchanged. No public registry upload, release/tag creation, push or merge is part of this package.
+
+## Primary metric and decision
+
+All required installation, actual host environment, exact historical effect, durable report and automatic cleanup gates must pass in one run. A missing prerequisite/host transport makes the lane unverified; a behavioral mismatch fails it. No retry changes that record. Accept only the stated host/OS/artifact scope after independent Claude review. Disk persistence, pixel routes, other agent hosts, cold OS and other machines remain unqualified. Final release bundle is a local candidate with these limits.
+
+## Evidence
+
+Private: output/installed-agent-release-20261012-v1. Sanitized: results/installed-agent-release-20261012-v1. Notebook: docs/notebook/2026-10-12-installed-agent-release.md.
+
+## Amendment · 2026-10-12 · before host execution
+
+Claude structured output may expose its schema finalizer `StructuredOutput` alongside the five MCP tools. Permit only that finalizer, which validates the requested report object and grants no resource effect. Require the exact five Footwork MCP tools, no other offered/called effect tools, and record the actual catalog. This replaces the literal five-total-tools inventory check without changing scope or completion requirements.
+
+A preparation CLI typo passed --root to a verifier requiring --packet-root, and the shell continued into dependency installation. No fixture or agent started. Retain v1 with this operator error; v2 first passes pristine14member verification, then performs its own fresh installation. Neither preparation contains a measured native/model task. The single paid/live attempt will be in v2.
+
+## Result
+
+October12,2026: the v2 fresh installation and one real Claude Code task passed every selected gate. Actual modelclaude-opus-5-5/CLI2.1.296 used the generated installed MCP command with five public tools plus StructuredOutput, one append and one durable final/applied/sent operation. The emitted readonly adapter accepted finalclaims afterhostexit; a missing-operation claim was rejected. ExactAXoracle, installedserver/worker/privateHOME provenance andautomaticcleanup/independentabsence pass. Cost0.0990072USD. Claude independently approved this single clean task; no real-host restart/uncertainty scenarios are claimed here.
+
+Final local release source d931559 packages the unchanged qualified9bb0440d wheel and445a348 helpers. Two builds match8dc81c72,30members342599bytes; manifest/RECORD/source/extractedverifier/18links pass. Independent review of v1 found identifyingpaths in legacyevidence; IA3preregistered derived sanitization, preserved originals and produced v2 with zero identifyinghomepaths and original/derived hashes. Claude1791837075792802000 approves exactv2 andclosesN1. See results/installed-agent-release-20261012-v2 and results/release-candidate-20261012. Registry publication, tags, push/merge, otherhosts/pixels/persistence remain outside this package. Original failures and all prior versions remainpreserved.

jevdual/docs/experiments/A3-readme-only-codex-adoption.md

@@ -0,0 +1,33 @@
+# A3: README-only Codex adoption on the existing Mac
+
+## Hypothesis
+
+A fresh Codex host given the exact macOS candidate and its README can install it, prepare an owned fixture and complete its bounded browser-to-TextEdit job without author-supplied process IDs, window IDs, URL or document path.
+
+If true, the published helpers and linked instructions suffice to derive job scope and use the registered public tools. If false, the retained attempt identifies missing installation or host-registration instructions, target discovery friction, unavailable host permissions, or an execution/report/cleanup defect.
+
+## Frozen inputs and prerequisites
+
+Use only candidate ZIP `8dc81c724bf617a9f3aa4833f250d5124b9e8c5e9a1c504c67d634080f44fd1f`, wheel `9bb0440d7bd981df7dc70bbd22f97861a7ed32a88bf6de7a18c2f46982fef3a7`, and its extracted README and linked consumer files. Installation uses existing compatible Python, uv and Chrome and fetches declared binary dependencies. Host authentication remains opaque and unchanged. Score provenance by the exact release ZIP and wheel digests. A helper receipt's `source_commit` from this bundle means the manifest/release commit `d931559`, while its qualified product source remains `445a348`; these are distinct identities and must not be compared as interchangeable commits.
+
+The user substituted this existing Mac for another Mac and requires at least 8 GiB available memory with other project actors idle. Measure resources before model or fixture execution; if the gate fails, retain a blocked preparation record and do not claim an adoption attempt. Keep the macOS VM stopped. Stop only independently attested, owned idle Footwork actors; unrelated apps and other agents require direct authorization. The separate user response about which apps may be quit remains pending.
+
+## Design
+
+After PR3 lands, use a fresh empty directory under ignored project output. Disable inherited project instructions, memory, skills, hooks and MCP configuration through supported local Codex flags. Never expose repository source or previous transcripts to the adoption host. Retain actual command, CLI version, offered tools, calls, errors and final output.
+
+A fresh installer context receives the package README and the ordinary task: install the candidate and prepare its disposable qualification job to read the invoice total and append exactly that value while preserving existing document characters. It may read linked consumer instructions and native CLI help. It must derive all target identifiers through the bundled helpers. It may write only within the owned trial directory and may not change global settings, copy credentials, use personal browser profiles or operate unrelated documents.
+
+Host registration is fixed at Codex startup. If a second context is needed, the author transfers only the installer-generated MCP registration into a fresh execution context by mechanical JSON-to-TOML adaptation. Preserve the exact command, arguments and environment; add no target identifiers, source knowledge or task coaching. Record both contexts separately. The executor uses the five actual registered Footwork tools and the generated report schema. Model choice remains the host default. Bound installer and executor time; retain failed or unavailable sessions without retrying uncertain native input.
+
+After executor exit, the author checks the exact destination accessibility value independently, inspects the durable journal read-only, and invokes the generated report adapter with only the host's structured claims. Publish only its trusted summary. Verify complete admitted-operation coverage, one applied/sent append and exact expected text. Signal the owned fixture once and check its cleanup receipt, exact document window, owned browser/listener and detached worker absence. Saved-file persistence remains `not_checked`.
+
+## Primary metric and decision
+
+Accept only if installation, self-derived scope, actual registered MCP execution, independent exact-text oracle, durable report validation and automatic cleanup all pass for the frozen artifact. Mechanical startup transfer is disclosed as two contexts rather than claimed as a single uninterrupted session. A prerequisite failure is unverified; a behavioral mismatch fails the attempt. Preserve every record. Fix only demonstrated friction in a new artifact after review and new qualification; keep the original candidate immutable.
+
+This measures README-only adoption on an already provisioned Mac. It does not establish another machine, a never-granted OS, arbitrary app discovery, pixel capture, physical devices or disk persistence.
+
+## Evidence
+
+Private output: `output/readme-codex-adoption-20261014-v1`. Notebook: `docs/notebook/2026-10-14-consolidation-adoption.md`. Results will be appended after the attempt; a pending resource gate is not a passed test.

jevdual/docs/experiments/DI1-desk-paper-inbox.md

@@ -0,0 +1,32 @@
+# DI1: Camera paper note to a Footwork-checked desk inbox
+
+Mode: bounded engineering/workflow feasibility. Not a model qualification or product-demand test.
+
+## Hypothesis
+
+An existing native-camera frame can supply a small paper note to local Apple Vision text recognition; an explicit review bound to the candidate digest can save exactly that text into a private inbox and Footwork can independently verify the saved bytes.
+
+## Predictions
+
+A known synthetic printed note yields expected text through the real Vision helper. A live paper note, when presented clearly and reviewed, can yield a saved note matching approved text. No text, altered candidates/source images, mismatched approval digests or invalid saved bytes cannot become verified notes. Repeating an accepted operation does not create duplicate notes.
+
+Against: a verified result without exact matching saved bytes, fabricated browser/native carries, unreviewed capture triggering an action, or a repeat creating another note.
+
+## Design
+
+Keep camera acquisition in the existing tools/camera-capture-experiment package and desk workflow in tools/desk-inbox-experiment. Use one native frame per deliberate operation; microphone disabled. Use installed Swift/Vision for local English OCR, with no cloud provider. Preserve OCR lines/confidence as fallible evidence, never execution authority. Explicit review approves a text digest; corrections are retained separately from original recognition. Keep images, recognized/private text, review pages, notes and per-operation receipts in ignored private output.
+
+Introduce a narrow provider-free read-only footwork check-artifact command and library boundary. It checks a digest-bound reviewed source and exact destination bytes. It supplies current artifact equality, not OCR correctness, native UI completion, authorization authentication or an exactly-once physical effect. Do not synthesize Footwork session carries or change native recovery/guard interfaces.
+
+Primary metric: one accepted note exists exactly once and matches its independently approved source bytes (binary feasibility), with source/candidate provenance retained.
+
+Checks: real Vision on a known generated printed note; public CLI whole workflow; repeat across processes; missing text; changed source/candidate; changed approval digest; missing/tampered destination; concurrency and interrupted write/receipt handling as appropriate. A human live note is a separate validation requiring positioning and review; if unavailable, report that gap explicitly.
+
+Decision rule: qualify only demonstrated source/OCR/file behavior. Advance toward a daily desk inbox only after one real note is reviewed and saved. Keep synthetic proof separate from live paper utility and semantic correctness. No model calls, UI automation, external task creation, publication or robot movement.
+
+## Result
+
+Reviewed live note handoff verified on frozen source 6e93c35: user-confirmed corrected text saved once and independently matched by Footwork; original frame/raw OCR retained. All 31 focused tests and Ruff pass. Known printed/normal/mirrored OCR matches expected text; blank and adversarial cases remain explicit. Raw live handwriting OCR required correction, so autonomous transcription and daily utility are unqualified. See results/desk-inbox-20261010/report.md and verification.json.
+
+## Amendment · 2026-10-10 14:54
+The user asks whether the camera mirrors. Preparation will expose an explicit --mirror-input option for OCR orientation and review display, bind it in request provenance, and retain original capture bytes. Mirroring is chosen from readable calibration text, not inferred from faces or OCR confidence. Normal/mirrored synthetic fixtures and the live LEFT 123 RIGHT line will assess orientation.