fix: surface silent failures across agent, auth, and desktop

[undivisible]

What changed and why

Stops fail-open and silent-failure paths on the current (non-Tauri) desktop/backend stack so errors surface instead of looking healthy.

• Agent VM recovery — GCE/Firestore status recovery no longer discards write or network failures; failed authoritative transitions fail closed (HTTP 500) when they block state.
• Auth custom token — use_custom_token=true returns custom_token_unavailable instead of a partial token payload when minting fails/unimplemented.
• Memories — remove unused recompute_evidence placeholder (no callers).
• Electron — log corrupted Google refresh-token decrypt, non-ENOENT Rewind retention deletes, and primary-screen lookup fallbacks.
• macOS APIClient — log app setup-status check failures instead of empty catch {}.

CI no-changelog-needed / Desktop Swift changelog-bypass was split out of this PR (not included).

Product invariants affected

• INV-MEM-1

How it was verified

• cargo test --offline --bin omi-desktop-backend require_custom_token — pass
• cargo test --offline --bin omi-desktop-backend fail_closed_firestore — pass
• cargo test --offline --bin omi-desktop-backend recovered_vm_external — pass

Failure class (fixes)

Failure-Class: none

[Git-on-my-level]

Thanks for tightening these fail-open/silent-failure paths. I reviewed the diff and the direction looks good: the Rust agent VM recovery paths now log and fail closed for authoritative Firestore transitions, use_custom_token=true no longer returns a partial success when custom-token minting is unavailable, and the desktop/Electron changes surface previously swallowed errors without changing the fallback behavior.

A few maintainer notes before this should merge:

• This touches auth, agent VM state, and CI/workflow behavior, so I’m not going to formally approve it from automation; it needs human maintainer sign-off on the intended fail-closed UX and the no-changelog-needed CI bypass semantics.
• GitHub currently reports the branch as not cleanly mergeable (DIRTY), so it needs to be brought up to date with main before final review/merge.
• I could not run the Rust check locally in this sandbox because cargo is not installed here, but the PR’s GitHub checks show the Rust Backend and Desktop Swift Build & Tests jobs passing.

No blocking code issue jumped out from the patch review; after the merge conflict is resolved, I’d mainly want a maintainer to confirm the auth/agent failure behavior is the desired product behavior.

---

by AI on behalf of David — if you need David’s attention urgently, please @Git-on-my-level and escalate with need human response.

[Git-on-my-level]

Scope and behavioral-proof follow-up

The fail-closed direction is promising, but this remains a cross-cutting auth/agent-state/workflow PR. Before merge:

• split the CI-label/changelog-bypass behavior from auth and agent state changes;
• add focused behavioral coverage for failed Firestore/GCE authoritative transitions and the custom-token error contract; and
• rebase/rerun after the split.

A maintainer still needs to explicitly sign off on the intended user-facing fail-closed UX.

[undivisible]

retriggering CI

[github-actions]

Hey @undivisible 👋

Thank you so much for taking the time to contribute to Omi! We truly appreciate you putting in the effort to submit this pull request.

After careful review, we've decided not to merge this particular PR. Please don't take this personally — we genuinely try to merge as many contributions as possible, but sometimes we have to make tough calls based on:

• Project standards — Ensuring consistency across the codebase
• User needs — Making sure changes align with what our users need
• Code best practices — Maintaining code quality and maintainability
• Project direction — Keeping aligned with our product principles and locked invariants

Before your next PR, please skim:

• PRODUCT.md — product north star
• Product invariants — locked rules (shared chat, memory tiers, agent control plane, integrations, brand)

If this was declined for direction or taste, maintainers should cite an invariant ID or open a proposed one — ask if that citation is missing.

Your contribution is still valuable to us, and we'd love to see you contribute again in the future! If you'd like feedback on how to improve this PR or want to discuss alternative approaches, please don't hesitate to reach out.

Thank you for being part of the Omi community!

[Git-on-my-level]

Thanks for the follow-up on this head. The fail-closed/silent-failure direction still looks worthwhile, but I’m going to keep this in changes-requested state before merge.

Blocking items that still apply on f0955b8:

• The Desktop Swift CI no-changelog-needed / --skip-changelog behavior is still bundled with the auth and agent-state runtime hardening. That workflow policy change is independently reviewable/rollbackable, so please split it from the auth/agent/desktop failure-surfacing changes.
• I still don’t see focused behavioral coverage for the Rust auth custom-token error contract (use_custom_token=true should hard-error rather than return a partial payload) or for failed Firestore/GCE authoritative agent-VM transitions. The existing CI is helpful, but these are security/user-state-sensitive behavior changes and need direct regression coverage.
• A human maintainer still needs to sign off on the intended fail-closed UX for the auth and agent-state paths before merge.

No security attack concern from my review; this is normal heightened review because the PR touches auth, agent VM state, and workflow/changelog enforcement.

---

by AI on behalf of David — if you need David’s attention urgently, please @Git-on-my-level and escalate with need human response.

[skanderkaroui]

Solid reliability fix that surfaces errors instead of hiding them, without breaking any working path or the changelog automation. Safe to merge.

[skanderkaroui]

@undivisible this looks good to merge on review but has merge conflicts with main — could you rebase/resolve the conflicts and merge? Thanks!

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[undivisible]

Addressed CHANGES_REQUESTED on 3748b45a26 (rebased onto main):

1. Split — removed Desktop Swift CI no-changelog-needed / --skip-changelog workflow changes from this PR (auth/agent/desktop failure-surfacing only).
2. Behavioral tests — extracted require_custom_token (fails closed with custom_token_unavailable) and fail_closed_firestore_transition / recovered_vm_external_ip; unit tests cover mint failure, successful mint, write→500 mapping, and empty/missing NAT IP rejection.
3. Dropped unrelated CI harness commits that had ridden along earlier.

Human maintainer sign-off on fail-closed UX still needed per prior review.

[undivisible]

Review blocker follow-up (8a15569024)

Addressed the remaining automated CHANGES_REQUESTED items on top of 40b211f520:

1. Desktop Swift CI / changelog policy split

Already scoped out of this PR — git diff origin/main...HEAD touches zero .github/** files. No no-changelog-needed / --skip-changelog workflow work rides on this branch.

2. Behavioral fail-closed coverage (Rust)

Added route-level regression tests in 8a15569024:

Contract	Test
use_custom_token=true hard-errors instead of partial payload	auth_token_with_custom_token_fails_closed_when_mint_unavailable (POST /v1/auth/token → 400 custom_token_unavailable, no id_token)
Mint skipped when custom token not requested	auth_token_without_custom_token_returns_id_token_without_mint
Authoritative Firestore agent-VM transition fails closed	authoritative_agent_vm_transition_fails_closed_in_async_handler (+ existing fail_closed_firestore_transition_* helper tests)
Custom-token helper	existing require_custom_token_* unit tests

Local verification: cargo test auth_token_ fail_closed authoritative_agent in desktop/macos/Backend-Rust.

3. Backend unit suite failure

Root cause: the earlier backend/database/memories.py deletion forced the full backend unit suite (backend/database/** → full run). That suite was failing in parallel CI due to unrelated langchain_core stub pollution in other test files — not caused by the auth/agent/desktop runtime changes.

Fix: restored memories.py on this branch so backend unit selection is now “no backend files changed” and the suite should skip for this PR.

---

Ready for human maintainer sign-off (cannot be automated)

Please confirm the intended fail-closed UX for:

1. Auth token exchange — desktop clients sending use_custom_token=true now receive 400 { error: "custom_token_unavailable" } when minting is unavailable, instead of a partial token payload. Clients must surface/handle that hard error.
2. Agent VM status recovery — when an authoritative Firestore write during stopped/missing-VM recovery fails, the handler returns 500 (via ? on fail_closed_firestore_transition) rather than proceeding as if the transition succeeded.

Desktop failure-surfacing (Swift APIClient+Apps, Windows token/screen/retention logging) remains unchanged from 3748b45a26.

Head for re-review: 8a15569024