[abrichr]

compile_agent took only WebApp(url=...). It now also takes SurfaceApp: a Windows, macOS, Linux, RDP or Citrix app, named the way a deployment file's backend: section names it.

What changed

• jit.SurfaceApp(backend_section, record_reader=, reset=, open_backend=) and SurfaceApp.from_deployment("deploy.yaml").
• Recording, canaries and runs open the backend through backends.factory.build_backend. The agent drives it through the same AuthoringSession and CaptureComputer the MCP recording tools use.
• The canary and every run are bound to the origin <kind>://<target>, for example macos://TextEdit. Window titles stay out of it, because they can carry a patient name. A program admitted on one origin is refused on any other.
• Named refusals:
  • a section missing its target (for example "backend.kind 'linux' needs backend.linux_app and backend.linux_window_title");
  • kind: web ("use WebApp(url=...)");
  • a Citrix canary or run without rdp_readiness_text, refused before any backend opens;
  • the playwright_mcp dialect on a non-browser app.
• WebApp is unchanged except for an open() method. The web path runs as before.
• docs/JIT.md: a "Desktop and remote apps" section. The "Web apps only" limit is replaced.

What it does not do yet

On RDP and Citrix, a pixel click carries no verified record identity. So the standard run gate refuses the canary with "Identity coverage: ... UNARMED". run --profile standard refuses an unqualified pixel bundle the same way. Arming pixel identity inside the JIT review is a follow-up.

Tests

• tests/test_jit_surface_app.py (fast, every kind): validation, origin binding (a program admitted on one surface is refused on the web and on another surface), the Citrix readiness refusal, and factory wiring.
• tests/test_jit_surface_pixels.py: records MockMed through the real RemoteDisplayBackend and CitrixWorkspaceBackend. tests/surface_kiosk shows Flow the page only as a client window's pixels. The test checks the draft is bound to the surface, the note is lifted to a parameter, and the save effect is mined. It then checks the canary is refused before any input reaches the window. 2 passed in 23 s.
• Existing JIT tests: test_jit.py and test_jit_lifecycle.py pass (111 tests with the new file). tests/e2e/test_jit_cua_e2e.py (web, not run in CI): 4 passed locally.

Part of the backend parity work (#1282).

🤖 Generated with Claude Code

Review fixes (second commit)

• An admission policy names a desktop or remote app with its kind (rdp://10.0.0.5). A bare host names a web app only, so a web entry no longer covers the RDP desktop on the same address.
• Non-web runs keep execution_origin empty, because hosted validation and the egress evidence read it as a browser origin. Replayer.run takes the surface identity as execution_target_origin, and only the JIT admission match reads it. openadapt-flow run --config passes it too, so an admitted JIT desktop program now runs from the CLI.
• The origin is lower case and has no credentials: a Windows agent_url with userinfo is refused.
• New tests:
  • every kind reaches app.open() and the Replayer with the right arguments;
  • the real Replayer refuses a program admitted on another surface before any action;
  • the pixel backends are built through the factory.
• Not changed: the window title stays in the bundle's backend_hints. Replay needs it to bind the same client window, and it lives only in workflow.json, encrypted when the bundle is sealed. Two Windows VMs behind the same tunnel port share an origin; docs/JIT.md says to use one cache directory per environment.