Run and verify the harness

Fresh homes use HTTPS and restricted account bootstrap. Use the maintained public-backend and browser scripts below. Never assume HTTP/auth-off startup on a real home or use a key as a login substitute.

From the repository root, with the pinned toolchain and an isolated home:

cargo build --release --locked
python3 scripts/test-desktop-backend.py
node scripts/chat-browser-acceptance.mjs

The Python suite uses disposable homes, a real built backend, HTTPS/account login and a mock local model. CGAH_TEST_BINARY selects another binary. The browser suite uses installed Chrome and a Node runtime with WebSocket; it serves mock APIs and checks the real console/CSP. CHROME_BIN selects Chrome. Neither suite establishes actual-model or native WebKit acceptance.

For a real disposable Chrome/model coding workflow, follow docs/CODING_PIPELINE.md and scripts/browser-fixture.py. That fixture explicitly opts into HTTP, retains account login, uses a local bare remote and mocks GitHub publication. No actual GitHub write is part of acceptance.

For ordinary operation:

./target/release/cgagentharness serve

Use an unused port and one server per home. A fresh installation signs in as admin with the one-time code in <home>/setup-code and requires password replacement. Native app trust and external browser trust differ; follow docs/SECURE_RESEARCH.md rather than bypassing certificate checks. Use its authenticated account and web CLI examples for terminal operations. Preserve existing home/config/model state and never set a global Git identity for disposable tests.

Run full repository checks per AGENTS.md. Actual native desktop verification is macOS-specific and recorded in PR bodies; Linux builds do not establish equivalent sandbox or WebKit behavior.