RigelBuild · rigel-mintaka · Sep 1, 2026 · Sep 1, 2026 · Sep 1, 2026
@@ -282,10 +282,10 @@ check enforces the mechanical half. Full rationale:
 | DL-215 | Bundle binary carriage is the sidecar `bin/` layout the shell already resolves (stack sibling + `dist` beside the executable), completed by the app prepending its executable dir to the spawned `compass-stack`'s PATH so the stack's LookPath children resolve in-bundle — never Go `embed` of ELF sidecars, never Wails asset bundling | Superseded by DL-238 (Matt, 2026-08-23) | [packaging §A2](product/compass-native-packaging/design.md#a2--binary-embedding-sidecar-bin-layout--path-threading-fork-2-resolved) |
 | DL-216 | The bundle build is a moon-registered project (`compass-app-bundle`) riding affected-detection per-PR and the unconditional main/nightly full sweep — the `compass-agent-image` heavy-build precedent — with a built-in completeness sanity gate (binaries present, uniform `--version` stamp, dist present); never a per-PR unconditional build, never a ci.yml-enumerated job | Active (Matt, 2026-08-19) | [packaging §A4](product/compass-native-packaging/design.md#a4--ci-cadence-affected-gated-per-pr-unconditional-on-main--nightly-fork-3-resolved) |
 | DL-217 | Postgres tooling (`postgres`/`initdb`/`createdb`) ships in the bundle `bin/` from the devenv.lock-pinned bare `postgresql` attr, leaving rootless podman as the sole host prerequisite of the packaged embedded mode | Superseded by DL-238 (Matt, 2026-08-23) | [packaging §OQ1](product/compass-native-packaging/design.md#oq1-load-bearing-for-matt--postgres-tooling-bundled-or-host-prerequisite) |
-| DL-235 | The Compass native app is CLIENT-ONLY: `compass-app` retires embedded mode entirely (supervisor invocation, host preflight, UDS bridge target, embedded config arm) and connects exclusively over the authenticated TLS door to a headless Compass stack — normally on a dedicated KVM-capable machine, or the same box via `compass-stack up` + `https://localhost`; driven by the microVM Runner's KVM floor retiring local agent execution. Supersedes DL-106 (dual-mode charter) | Active (Matt, 2026-08-23) | [client-only §A1](product/compass-native-client-only/design.md#a1--thesis-compass-app-is-a-native-client-only-binary) |
+| DL-235 | The Compass native app is CLIENT-ONLY: `compass-app` retires embedded mode entirely (supervisor invocation, host preflight, UDS bridge target, embedded config arm) and connects exclusively over the authenticated TLS door to a headless Compass stack — normally on a dedicated KVM-capable machine, or the same box via `compass-stack up` + `https://localhost`; driven by the microVM Runner's KVM floor retiring local agent execution. Supersedes DL-106 (dual-mode charter) | Superseded by DL-319 (Matt, 2026-09-01) | [client-only §A1](product/compass-native-client-only/design.md#a1--thesis-compass-app-is-a-native-client-only-binary) |
 | DL-236 | `compass-stack` survives the app's retirement of embedded mode as the standalone headless single-user bring-up CLI (`up`/`down`/`status`, DL-183 teardown intact); the app never spawns, supervises, or tears down a stack. Refines DL-108 (which stays Active — the supervisor design lives; only the app's shell-spawn invocation retires) | Active (Matt, 2026-08-23) | [client-only §A1](product/compass-native-client-only/design.md#a1--thesis-compass-app-is-a-native-client-only-binary) |
-| DL-237 | app.toml is client-only: absent or `mode="client"` → client (`server_url` required); `mode="embedded"` is a legible retirement error, never a compatibility arm; the `--mode`/`$COMPASS_APP_MODE` override retires with the second mode. Supersedes the embedded-default mode-selection half of DL-109 (whose keychain-first bearer clause stays Active) | Active (Matt, 2026-08-23) | [client-only §A3](product/compass-native-client-only/design.md#a3--appconfig-the-clean-cut-client-is-the-only-mode) |
-| DL-238 | The app bundle is the THIN CLIENT: `compass-app` + `dist` + `.desktop` + LICENSE, no sidecar binaries, no postgres tooling; headless-stack distribution (`compass-stack`+`compass-postgres` onto the dedicated machine) is a releases-lane follow-up, and RIG-2477 re-scopes to client-app release artifacts with macOS as the first new target. Supersedes DL-215 (sidecar `bin/` + PATH threading) and DL-217 (bundled postgres tooling) | Active (Matt, 2026-08-23) | [client-only §A4](product/compass-native-client-only/design.md#a4--cutover-plan-sequenced-clean-no-shims) |
+| DL-237 | app.toml is client-only: absent or `mode="client"` → client (`server_url` required); `mode="embedded"` is a legible retirement error, never a compatibility arm; the `--mode`/`$COMPASS_APP_MODE` override retires with the second mode. Supersedes the embedded-default mode-selection half of DL-109 (whose keychain-first bearer clause stays Active) | Superseded by DL-320 (Matt, 2026-09-01) | [client-only §A3](product/compass-native-client-only/design.md#a3--appconfig-the-clean-cut-client-is-the-only-mode) |
+| DL-238 | The app bundle is the THIN CLIENT: `compass-app` + `dist` + `.desktop` + LICENSE, no sidecar binaries, no postgres tooling; headless-stack distribution (`compass-stack`+`compass-postgres` onto the dedicated machine) is a releases-lane follow-up, and RIG-2477 re-scopes to client-app release artifacts with macOS as the first new target. Supersedes DL-215 (sidecar `bin/` + PATH threading) and DL-217 (bundled postgres tooling) | Superseded by DL-321 (Matt, 2026-09-01) | [client-only §A4](product/compass-native-client-only/design.md#a4--cutover-plan-sequenced-clean-no-shims) |
 | DL-257 | The client app ships a full per-OS matrix from day one — Linux x86_64 (thin-client tarball, DL-238 content) AND macOS arm64 (signed+notarized `.app` in a dmg, built on a macOS runner, never cross-compiled) — attached to the RIG-1746 release lanes, extending the release-bundling record's Fork 2(i) asset boundary and resolving its OQ-1 deferral (RIG-2477) | Active (Matt, 2026-08-24) | [distribution §S1](infra/release/compass-distribution/design.md#s1--client-app-per-os-matrix) |
 | DL-258 | Client install channels are homebrew (RigelBuild/homebrew-tap: cask for the macOS app + a cross-OS CLI formula, semver-bumped by the release workflow) and a repo `flake.nix` (client + stack packages pinned to the devenv.lock nixpkgs), over the raw release assets; distro-native packages (deb/rpm/AUR) deferred | Active (Matt, 2026-08-24) | [distribution §S2](infra/release/compass-distribution/design.md#s2--client-app-install-channels) |
 | DL-259 | The self-host stack stays a host-level bring-up on a KVM-capable Linux machine (`compass-stack up`; microVM D3 hard-fail consumed, no compose/Swarm packaging); `compass-stack` joins the release binary matrix, and the flake + preflight + self-host doc are its install surface — resolving the client-only record's OQ-3 (RIG-2608) | Active (Matt, 2026-08-24) | [distribution §S3](infra/release/compass-distribution/design.md#s3--self-host-stack-host-level-kvm-bring-up) |
@@ -294,6 +294,9 @@ check enforces the mechanical half. Full rationale:
 | DL-262 | Containerized-postgres teardown extends the DL-183 pgid record to format v2: `pgidFileVersion` `"1"`→`"2"`, entries become a kind-tagged discriminated union (`proc <component> <pgid> <starttime>` torn down by group signal as today; `ctr <component> <name>` torn down by `podman stop`/`rm -f`), `readPgidFile` dispatches on the tag and a shipped v1 binary hard-errors on a v2 entry line by the entry-grammar (not a header check) under the unchanged signal-off-a-half-understood-record discipline. The per-agent microVMs are the runner's sandbox one layer below the stack and are untouched (the stack tears the runner down by pgid as a plain host process); what forces v2 is postgres containerizing, not microVMs. Extends DL-183 (which stays Active); resolves distribution OQ-7 | Active (Matt, 2026-08-25) | [distribution §S4](infra/release/compass-distribution/design.md#s4--postgres-as-container-the-dl-217-supersession) |
 | DL-263 | darwin CI cadence mirrors the shipped affected-on-PR + full-sweep-on-main + nightly shape (`ci.yml:25-36`): a `macos-14` compile+bundle sweep runs on every push to main AND nightly ALWAYS (the backstop), plus an affected-on-PR leg gated by a small ubuntu pre-job asking moon which projects the PR affects (moon's own affected-detection — the signal `moon ci` uses — never a GitHub `paths:` filter, so moon stays the single source of affected-truth per the ci.yml header's rejection of a YAML project list), so a scarce mac runner spins up on a PR only when a darwin-relevant project is affected. Resolves distribution OQ-8 | Active (Matt, 2026-08-25) | [distribution §T3](infra/release/compass-distribution/design.md#t3--macos-app-bundle--ci-lane-unsigned) |
 | DL-282 | The Compass Linux shell builds Wails' default GTK4 + webkitgtk-6.0 stack (repo tag `gtk4`; closure `gtk4`/`webkitgtk_6_0` in gtk-closure.nix), retiring the legacy `gtk3` + webkit2gtk-4.1 variant ahead of its Wails v3.1 removal; the closure edit is in place (one definition, all consumers). DL-110 (Wails v3) stays Active unchanged, and DL-214/DL-216 (packaging) stay Active — the bundle shape is unchanged, only its closure contents move | Active (Matt, 2026-08-28) | [gtk4 migration §Ledger delta](product/compass-gtk4-migration/design.md#ledger-delta-for-the-coordinator-to-encode-at-freeze--not-edited-here) |
+| DL-319 | The Compass native app is DUAL-MODE again: `mode="embedded"` returns as the low-friction onboarding / local-dev front door — the app spawns/supervises a LOCAL stack via rootless podman on the user's own machine (macOS via podman machine, Linux native; Windows/WSL deferred) — ADDED ALONGSIDE the fully-surviving client mode, which stays first-class and is the RECOMMENDED steady-state for real self-host (always-on VPS/EC2 running `compass-stack up`, reached over TLS). Rationale is the trust model (DL-318): single-tenant operator-own-code needs no KVM isolation; podman is a permanent supported tier. Supersedes DL-235 (the "client is the ONLY mode" thesis — the exclusivity dies, the client surface survives whole) and the app-never-spawns half of DL-236 (whose standalone-`compass-stack`-CLI half stays load-bearing as client mode's target); partially supersedes DL-259 by citation (split, the DL-236 pattern): DL-259's "KVM-capable Linux machine" floor clause is superseded — the podman tier needs no KVM, including a KVM-absent VPS — while its host-level-bring-up/no-compose/install-surface clause stays Active and load-bearing; restores DL-106's dual-mode SHAPE under this new rationale (the old KVM-era premise is not restored) | Active (Matt, 2026-09-01) | [embedded-revival §Topology](product/compass-native-embedded-revival/design.md#topology--three-funnel-entries-consumed-from-compass-obs-pr-804) |
+| DL-320 | app.toml is dual-mode: absent → embedded (the zero-config onboarding default returns); `mode="embedded"` accepts no server_url/ca_cert; `mode="client"` keeps the built contract (https-only server_url required, optional ca_cert, keychain-first bearer per DL-109); the `--mode`/`$COMPASS_APP_MODE` override returns (flag > env > file > default). Graduation embedded→client is a config edit documented in the self-host doc, not an in-app flow. Supersedes DL-237 | Active (Matt, 2026-09-01) | [embedded-revival §A1](product/compass-native-embedded-revival/design.md#a1--mode-selection-contract-dual-mode-returns-embedded-is-the-onboarding-default) |
+| DL-321 | The app bundle carries embedded's sidecars again — `bin/{compass-app,compass-stack,compass-server,compass-runner}` + dist, PATH-threaded (DL-215's mechanism restored by citation) — but NO postgres tooling and no `compass-postgres` sidecar: the embedded stack's postgres is the DL-260 stock `postgres:18` container via rootless podman (the CLI's own default), leaving rootless podman (plus podman machine on macOS) as the packaged embedded mode's sole container prerequisite. DL-217 STAYS superseded. macOS stages the same four binaries in `Contents/MacOS/`. Supersedes DL-238 | Active (Matt, 2026-09-01) | [embedded-revival §A4](product/compass-native-embedded-revival/design.md#a4--bundle-re-scope-sidecars-return-postgres-stays-a-container) |
 
 ## Agent batteries