Add code-first responses and hybrid liquid glass

.github/workflows/windows-beta.yml

@@ -214,4 +214,5 @@ jobs:
             docs/validation/milestone-7.md
             docs/validation/milestone-8.md
             docs/validation/plan-alignment.md
+            docs/validation/code-first-liquid-glass.md
           if-no-files-found: error

README.md

@@ -4,14 +4,15 @@ PresenterAI is a private, local-first Windows presentation copilot. It runs as a
 
 ## Current implementation
 
-- Frameless, always-on-top 1100px transparent overlay with CSS-rendered refractive dark glass, clipped rounded corners, one reliable content scroller, accessibility fallbacks, click-through, hide/show, tray controls, and migrated persisted bounds.
+- Frameless, always-on-top 1100px transparent overlay with Windows Acrylic where supported, a pointer-free WebGL2 liquid-material layer, fixed blue-violet neon intensity, hard-clipped rounded corners, one reliable content scroller, accessibility fallbacks, hide/show, tray controls, and migrated persisted bounds.
 - Windows capture-exclusion request through Electron `setContentProtection(true)`, with status and a visual capture-test pattern.
 - Sandboxed/context-isolated renderer and narrow, validated IPC surface.
-- OpenAI Responses API with `store:false`, structured presenter output, local rolling context, cancellation, and grounded-evidence validation. Programming creation requests can return inert, copy-only structured code cards without enabling model tools or code execution.
+- OpenAI Responses API with `store:false`, local rolling context, cancellation, and grounded-evidence validation. Code is the default answer style and uses a dedicated developer schema with named, inert, copy-only source containers; Presenter remains a one-request override using the unchanged accepted presenter schema.
 - DPAPI-backed API-key encryption through Electron `safeStorage`; the renderer never receives the stored key.
 - Local PPTX, PDF, Markdown, and text parsing with SQLite FTS5 retrieval.
 - Self-contained C#/.NET 8 WASAPI loopback helper with protocol-v2 operation IDs, bounded in-memory capture, output-device selection, 16 kHz mono PCM finalization, restricted Ctrl+Shift+Space toggle detection, health reporting, and one idle restart. Capture is system output only; PresenterAI does not request microphone audio.
 - One application-wide typed/audio operation coordinator, bounded transcription through `gpt-4o-mini-transcribe`, editable memory-only transcript review, operation-scoped cancellation, temporary-file cleanup before draft display, and a persistent conservative USD session cap (default `$0.25`).
+- Fail-closed click-through on the Copilot screen: every enable confirms that mouse input will be ignored, and `Ctrl+Shift+I` or **Tray → Show PresenterAI** restores interaction. Click-through cannot activate if its emergency shortcut is unavailable.
 
 Application-specific Chrome process-tree capture and continuous listening remain disabled until their experimental gates are validated. Capture protection is never presented as a universal guarantee.
 
@@ -53,7 +54,7 @@ Milestone 3 is accepted: the mocked safety suite and budget-bounded local live-m
 
 Milestone 4 is accepted offline: the versioned 50-case corpus reached 50/50 top-five recall, and the clean Windows CI runner built the installer and passed the packaged SQLite FTS5 probe. See [docs/validation/milestone-4.md](docs/validation/milestone-4.md) for the redacted gate record. This validation does not use OpenAI or consume API credits.
 
-Milestones 5 and 6 have completed their source/offline implementation work. The beta.2 branch passes 353/353 Vitest tests in 50 files, 33/33 .NET tests, 9/9 Playwright Electron tests, a clean high-severity dependency audit, and the accepted 50/50 M4 retrieval corpus. A strict two-cycle local WASAPI smoke produced valid 16 kHz mono captures, and the packaged FTS/helper probes passed after Windows completed its reputation scan. GitHub-hosted Windows runners expose no render endpoint, so CI runs the same published helper executable through two full protocol/finalization cycles using a dual-gated deterministic test backend and reports `wasapiCaptureValidated: false`; it never claims physical WASAPI passed. Code Integrity has also blocked unsigned local payloads (`0x800711C7`) and the local installer lifecycle timed out, so these isolated local runs do not clear the native acceptance gate. Formal M5/M6 acceptance remains blocked by the M0–M2 capture/fullscreen prerequisites and the user-assisted physical/Meet campaign.
+Milestones 5 and 6 have completed their source/offline implementation work. Their latest accepted evidence includes the .NET, Playwright, audit, packaged-helper, and accepted 50/50 M4 retrieval gates recorded in the validation documents. GitHub-hosted Windows runners expose no render endpoint, so CI runs the same published helper executable through two full protocol/finalization cycles using a dual-gated deterministic test backend and reports `wasapiCaptureValidated: false`; it never claims physical WASAPI passed. Code Integrity has also blocked unsigned local payloads (`0x800711C7`), so those isolated local failures do not clear the native acceptance gate. Formal M5/M6 acceptance remains blocked by the M0–M2 capture/fullscreen prerequisites and the user-assisted physical/Meet campaign.
 
 The M6 live campaign is additionally safety-blocked before any network request. The current repair-branch preflight estimates **$0.148247**, but its documented model limits produce a **$0.644547** worst-case bound, which cannot satisfy the immutable **$0.15** cap. The preflight therefore reports `strictCampaignFeasible=false` and `billableExecutionEnabled=false`; M6 has spent **$0**. A separate user decision must revise the case count or cap before paid validation can run. See [docs/validation/milestone-5.md](docs/validation/milestone-5.md) and [docs/validation/milestone-6.md](docs/validation/milestone-6.md).
 
@@ -63,7 +64,7 @@ PR [#3](https://github.com/KanuTomer/Presentation-Helper/pull/3) merged the M7/M
 
 Repair PR [#4](https://github.com/KanuTomer/Presentation-Helper/pull/4) initializes the legacy build through observable local state and retains strict result-file hooks for current builds. Its first Windows run exposed and led to a fix for a Delete All maintenance self-lock. Its second run exposed a harness race while NSIS was concurrently removing the installation tree. The final repair tolerates only a disappearing-path `ENOENT`, continues polling real residual files to the deadline, and keeps complete payload removal strict. [Repair run 29642064032](https://github.com/KanuTomer/Presentation-Helper/actions/runs/29642064032) and [post-merge main run 29642541009](https://github.com/KanuTomer/Presentation-Helper/actions/runs/29642541009) both passed the complete lifecycle; the main run uploaded the installer, checksum manifest, M7/M8 records, and redacted lifecycle diagnostics.
 
-The unsigned per-user NSIS installer is written to `release/`. Uninstalling it does not remove PresenterAI documents or settings. Windows Smart App Control or enterprise Code Integrity may refuse to launch a newly rebuilt unsigned executable; code signing remains outside this milestone and security controls must not be disabled. The beta.2 installer is not eligible for preview until its branch and post-merge `build-and-package` workflows are green. The artifact from green `main` run 29642541009 remains the latest eligible closed manual-mode technical preview in the meantime. No public release is created.
+The unsigned per-user NSIS installer is written to `release/`. Uninstalling it does not remove PresenterAI documents or settings. Windows Smart App Control or enterprise Code Integrity may refuse to launch a newly rebuilt unsigned executable; code signing remains outside this milestone and security controls must not be disabled. Beta.3 is not eligible for preview until its pull-request and post-merge `build-and-package` workflows are green. Until then, the artifact from green `main` run 29642541009 remains the latest eligible closed manual-mode technical preview. No public release is created.
 
 ## Privacy model
 

docs/manual/manual-mode-technical-preview.md

@@ -9,11 +9,11 @@ The preview covers typed questions, local document ingestion and retrieval, grou
 1. Open the repository's **Actions** page and select the newest successful Windows Beta run whose branch is `main`.
 2. Confirm the workflow commit is the current remote `main` commit and that the complete installer lifecycle step passed.
 3. Download and extract the `PresenterAI-Windows-beta` artifact. Do not use artifacts from PR #3 or either failed `986469b` workflow.
-4. Confirm the artifact contains the unsigned `PresenterAI-0.2.0-beta.1-setup.exe`, `SHA256SUMS.txt`, and redacted validation/lifecycle reports.
+4. Confirm the artifact contains the unsigned `PresenterAI-0.2.0-beta.3-setup.exe`, `SHA256SUMS.txt`, and redacted validation/lifecycle reports.
 5. In PowerShell, calculate the installer hash:
 
    ```powershell
-   Get-FileHash ".\PresenterAI-0.2.0-beta.1-setup.exe" -Algorithm SHA256
+   Get-FileHash ".\PresenterAI-0.2.0-beta.3-setup.exe" -Algorithm SHA256
    ```
 
 6. Compare the complete hexadecimal value with the matching entry in `SHA256SUMS.txt`. Stop if the filename or hash differs.
@@ -27,7 +27,7 @@ Use a disposable Windows account or VM where practical. The installer is unsigne
 3. Confirm the tray menu can show the overlay and quit the application completely.
 4. Test the fixed `Ctrl+Shift+I` recovery shortcut before enabling click-through.
 5. Verify Ask and Hide/Show shortcuts while another application has focus.
-6. Restart PresenterAI and confirm bounds, opacity, and non-audio preferences are restored.
+6. Restart PresenterAI and confirm bounds, neon intensity, and non-audio preferences are restored.
 7. Treat capture status only as requested, Electron-reported, or manually recorded. Do not infer that the overlay is absent from any recording or sharing path.
 
 Do not enable listening, accept listening consent, or run a Meet/OBS/capture-protection experiment in this preview. System loopback can include every sound on the selected output endpoint, and its physical/live gate is still incomplete.
@@ -67,7 +67,7 @@ For an independent upgrade check:
 
 1. Verify and install the previous successful `main` installer in the same controlled account.
 2. Add disposable settings and fixture documents, then quit from the tray.
-3. Install the verified `0.2.0-beta.1` artifact over it.
+3. Install the verified `0.2.0-beta.3` artifact over it.
 4. Confirm settings and indexed catalog remain usable, the helper health is reported, and source files are unchanged.
 5. Perform Delete All and final uninstall as described above.
 

docs/validation/code-first-liquid-glass.md

@@ -0,0 +1,46 @@
+# Code-first, safe click-through, and hybrid liquid-glass validation
+
+Delivery target: `0.2.0-beta.3`.
+
+This change is a UX and presentation-layer hardening release. It does not accept any outstanding M0–M2 or M5–M8 manual gate, spend API credits, enable screen capture, or claim universal capture exclusion.
+
+## Implemented invariants
+
+- Code is the renderer, preload, and typed-controller default. Presenter is an explicit one-submission override and returns to Code immediately when submitted.
+- Legacy IPC value `auto` remains accepted only as a temporary compatibility input and maps to Presenter.
+- Developer responses use a distinct strict provider schema and local `responseStyle: "developer"` discriminator. The accepted presenter provider instructions and JSON schema are unchanged.
+- Developer output is inert and copy-only: no HTML injection, execution, Run button, tool use, or code retention in conversation summaries.
+- Click-through can be enabled only while the fixed `Ctrl+Shift+I` recovery shortcut is registered. Every enable requires an in-app confirmation that also identifies `Tray → Show PresenterAI`.
+- Shortcut and tray recovery publish the resulting state to the renderer. An active high-contrast banner remains visible while mouse input is ignored.
+- Settings schema v5 migrates v2–v4 data to `neonIntensity: 0.65` while preserving bounds, documents, consent, usage, session budget state, audio preferences, shortcuts, and project context.
+- Neon intensity changes only the fixed blue-violet material emission. Text, code, cards, and control opacity remain independently readable.
+- Supported Windows 11 builds request native Acrylic. A pointer-free, DPR-capped WebGL2 layer adds caustics and specular movement; unsupported WebGL or Windows versions use CSS/shader fallbacks.
+- The renderer, native window region, and Acrylic surface use the same rounded boundary. Automated capture checks require transparent corner pixels.
+
+## Non-billable evidence
+
+| Gate | Result |
+|---|---|
+| TypeScript and production build | Passed |
+| Vitest | 378/378 across 54 files |
+| .NET helper | 33/33 |
+| Playwright Electron | 10/10 |
+| M4 retrieval | 50/50 top-five recall |
+| M6 preflight | Passed with `networkRequests: 0`; paid campaign remains blocked |
+| M7 offline | 50/50 |
+| Dependency audit | 0 vulnerabilities |
+| Packaging and packaged FTS | Passed; Electron 43.1.0, SQLite 3.53.1 with FTS5 |
+| Helper smoke | Passed two real WASAPI loopback cycles at 16 kHz mono; packaged protocol-v2 helper located |
+| Installer smoke | Passed clean install, launch, data preservation, and complete uninstall |
+| Code Integrity diagnostic | Smart App Control `enforced`; helper `NotSigned`; controlled spawn returned protocol-v2 `ready` in this run |
+| GitHub `build-and-package` | Required before merge |
+
+Visual inspection was performed at the 1100×720 default and 680×420 minimum layout. The quick controls reflow at the minimum size, the single content viewport remains scrollable, native-capture corner alpha is zero at all four corners, and the shader remains behind readable local surfaces.
+
+On 2026-07-23, the app was also launched four times with Windows/Electron device scale factors of 100%, 125%, 150%, and 200%. Each run reported the matching `devicePixelRatio` and display scale factor. With capture protection disabled only for this controlled visual check, full desktop-composited captures showed the requested Acrylic passthrough, readable blue-violet material, responsive controls, and a rounded outer edge without a rectangular backdrop or corner bleed at all four scales. The captures contained the tester's desktop and were reviewed transiently rather than committed or uploaded.
+
+These local smoke results do not replace the original Meet, physical-device, fullscreen, or capture-protection matrices and do not formally accept M0–M2 or M5–M8.
+
+## Remaining acceptance boundary
+
+The formal milestone table in `plan-alignment.md` is unchanged. A green beta.3 workflow makes this build eligible for the same narrow closed manual-mode technical preview as earlier green builds; it does not validate Meet audio, physical devices, fullscreen behavior, or capture-protection compatibility.

docs/validation/milestone-8.md

@@ -75,7 +75,7 @@ Milestone 8 depends on Milestones 2–7 in the original plan. The capture-protec
 - M4/M6/M7: 50/50 retrieval; zero-dispatch budget preflight; 50/50 grounding.
 - Packaged runtime: Electron 43.1.0, SQLite 3.53.1 with FTS5, helper protocol v2 with nine required features.
 - PR #3 merged as `986469b`; its PR workflow and post-merge `main` workflow failed at the legacy-baseline launch step before upgrade assertions.
-- Delivery target: `PresenterAI-0.2.0-beta.2`, upgrading from the `0.2.0-beta.1` baseline with strict current-build hooks, redacted lifecycle and Code Integrity diagnostics, and a SHA-256 manifest.
-- Current offline/source gate: audit, 353/353 Vitest, 33/33 .NET tests in the latest isolated run, M4 50/50, M7 50/50, M6 zero-network preflight, two-cycle helper smoke, 9/9 Playwright, production build, NSIS packaging, and packaged FTS/helper probes completed on 2026-07-22. Enterprise Code Integrity has blocked unsigned local payloads, and the local clean-install lifecycle timed out; both remain fail-closed without disabling or bypassing Windows security. Clean Windows CI is authoritative for beta.2 delivery.
+- Current delivery target: `PresenterAI-0.2.0-beta.3`. Installer lifecycle validation retains the strict current-build hooks, redacted lifecycle and Code Integrity diagnostics, and a SHA-256 manifest.
+- Current beta.3 local source gate: audit with 0 vulnerabilities, 378/378 Vitest, 33/33 .NET tests, 10/10 Playwright, M4 50/50, M7 50/50, M6 zero-network preflight, production build, NSIS packaging, packaged FTS/helper probes, two real WASAPI smoke cycles, and clean installer smoke completed on 2026-07-23. Smart App Control reported `enforced` and the helper remained unsigned, but the controlled helper spawn returned protocol-v2 `ready` in this run. These smoke results do not replace the outstanding physical/Meet/manual gates. Beta.3 delivery still requires green pull-request and post-merge Windows CI.
 - Repair PR Windows workflow: **Passed** in [run 29642064032](https://github.com/KanuTomer/Presentation-Helper/actions/runs/29642064032). Lifecycle report `ok=true`; clean and upgraded uninstalls each reached zero payload. The installer SHA-256 is `3995A2DE9AD478A1C3EEE7CC62B82AACE27B75E4AC9F5FA5ACE5BC879A9D24E6`, matching the uploaded manifest.
 - Post-merge `main` workflow and artifacts: **Passed** in [run 29642541009](https://github.com/KanuTomer/Presentation-Helper/actions/runs/29642541009) for `dc1b609`. That baseline is eligible for the closed manual-mode technical preview; later source changes require a new green workflow.