feat(roomie): add durable workspace and shared Codex/Claude runs - #962

Roomie runs Codex and Claude through the same durable command and run contract, without requiring a browser to stay open. Browsers use the existing analytics surfaces and save drafts through authenticated, revision-checked commands. SQLite COMMIT remains the durability boundary.

This PR stays draft, stacked on #960 (experiment/quack-node-wasm-v2), which depends on #959. The base is unchanged; do not merge. M1–M3 are complete. M4 has both live adapters, Linux Bubblewrap isolation, locked analytical configuration, local distribution, private gateway sign-in and Sprite lifecycle integration. Aggregate hosted memory/CPU-rate/PID quotas and the approximately two-hour unattended soak remain outstanding.

Changes

• Native DuckDB 2.0 and SQLite WAL/FULL metadata, serialized Loro commits, explicit targets/revisions, idempotent receipts and crash recovery.
• Shared Codex/Claude supervision, durable conversation/event/approval replay, explicit decisions, cancellation, deadlines and command drain. Browser absence never grants permission. Native continuation and approval recovery are not advertised.
• Existing browser chat, tables and charts; SQL/Arrow types, uploads, connection-local Mosaic caches, cancellation and external Quack refresh. SQL extensions preserve source/function validation.
• Command-backed editing with local drafts, explicit conflicts, uncertain-save retry and monotonic snapshots. Raw Loro writes and snapshot seeding remain disabled.
• Legacy migration and consistent versioned bundles spanning both databases, optional history, stable artifact/block/result IDs and provenance.
• Foreground launcher and private installable tarball containing the existing built UI/native host. Node 24.9–24.x is required; the Python launcher is preserved. No registry publication or bundled Node runtime.
• Linux Sprite service with kernel ownership, private IPC admission, renewable Tasks, fixed execution deadlines and a watchdog outside the host event loop. Active work and cleanup hold leases until drained; idle subscriptions alone do not. Managed mode keeps Quack disabled.
• Explicit trusted-private-gateway browser sign-in: a separate ingress exchanges Sprite-authenticated browser access for the existing scoped page session. Exact-origin/Host, JSON POST and fetch metadata checks remain enforced. Forwarded headers never grant authority. Local launch tickets and agent MCP tokens remain intact.

One isolation backend

Docker support is removed to reduce provisioning, cleanup/recovery, packaging and CI complexity. Enforced isolation is Linux/Sprite-only through Bubblewrap. macOS uses no harness or explicit trusted-local execution. Old image CLI/API/service settings and the live driver's retired environment variable fail closed before workspace mutation or recovery. Older Docker deployments must drain their owned containers with the old version before upgrading; this release does not manage Docker processes.

Bubblewrap supplies private user/mount/PID/network/IPC/UTS namespaces, zero capabilities, no-new-privileges, read-only runtime/input and bounded supplied tmpfs. A scoped broker exposes shared MCP and selected model authorities. A trusted external runner enforces deadlines and host liveness; boot/PID-namespace/start/UID/nonce-scoped records support safe recovery. Sprite bootstrap uses privilege only for mount/procfs setup before dropping all capabilities.

This profile has no aggregate memory, CPU-rate or PID quota. Per-process limits and supplied tmpfs bounds are not aggregate budgets. Resource starvation can affect the host/watchdog. The analytical instance remains locked before exposure, with external access and automatic extension installation/loading disabled.

Private gateway mode trusts Sprite's auth: sprite / private_access: admins boundary. All authorized admins act as one Roomie owner. Host processes outside the harness are trusted; runtime does not detect an administrator later making the gateway public. Custom Bubblewrap model origins are refused in this mode. HTTPS CONNECT restricts destination authority, not encrypted headers.

Verification

Docker-retirement slice: 97 native tests pass locally, with 12 explicitly skipped Linux-only cases. All 15 selected Linux acceptance/rejection cases pass on the real Sprite with zero skips/failures. Useful former Docker assertions now run on Bubblewrap: host environment exclusion, delegated-key allowlist/redaction, read-only root/input, work tmpfs ENOSPC, no writes into host input, database/WAL/bundle/credential/other-workspace canaries, shell/proc/network denial, scoped commands, approvals, cancellation and disposable Codex login. Both actual CLIs run through shared commands using credential-free model fixtures. Deadline, orphan/watchdog and gateway bypass tests remain intact.

Five installed-package tests and all 65 Node/Python conformance tests pass, along with affected build/typecheck, lint, Knip, circular and formatting checks. Independent review approved after preventing stale development settings from downgrading isolation and preserving the useful boundary assertions. All final-head checks pass on 0a0a5eea7e089ba5a5428c1715a44829f4020a47: JavaScript, Python/conformance, documentation, formatting, and PR title. Actual Linux logs confirm 62/62 test tasks, 98 native passes, and all 12 dedicated Bubblewrap cases with zero skips, plus installed-package and deterministic behavioral checks.

The same private Sprite runs the Docker-free package with its existing protected model-key wrapper. A new real external-model Codex turn succeeded and rendered in the browser. The old smoke driver expected document revision 2 and failed because the user had already committed revision 3; comparison with the stopped backup taken immediately before upgrading proves content and receipts are unchanged. Lifecycle rows remain January 300 / February 450. No user content or drafts were reverted.

Earlier acceptance covers real Codex/Claude document authoring, approvals/denial/cancellation, reconnect/restart, cold/wake, lease renewal/release and SIGSTOP watchdog recovery. The separate ambiguous-revenue fixture remains January 300.00 / February 450.00, at order grain with whole-order refund exclusion. M3 verifies both bundle history policies and stable IDs; its 1,000,000-row benchmark measured loaded p95 filtering 30.71 ms, command commits 7.88 ms and event writes 0.270 ms locally.

Evidence: Docker retirement, Bubblewrap, gateway authentication, Sprite service, launcher, M3, and current host README. Older Docker reports are historical evidence, not current support.

Limits

The watchdog runs in the same Sprite, not off-VM. Releasing a Task permits idle shutdown, not immediate sleep or zero billing. Host generation limits do not replace platform restart policy. Personal harness login files are never copied.

Raw INTERVAL output requires a VARCHAR cast with Arrow JS 17. Unknown migrations and unsupported source rewrites fail closed. View state and unsent drafts stay local. The unrelated full-workspace MapLibre type mismatch at packages/deck/src/protomapsStyles.ts:36 is unchanged; affected checks passed and commit/push hooks were disabled. Six concurrent ai-core edits are excluded from this slice.