[SashaMIT]

Small, independent. One commit on fix/0.7.1-security; touches the gate, one doc clause, one comment. Nothing is weakened: every rule that changed still enforces a contract, and each was mutation-tested (break the target → the gate fails under that rule's label), with rg and with the grep/Python fallback.

Installer (was: Linux-only)

The installer serves Linux x86_64/aarch64 and Apple silicon macOS, mapped to the signed release platforms, and fails closed on everything else. The gate still required Linux-only wording and forbade the darwin) arm. Now it pins the contract as it is:

• help states the two-platform release lookup;
• linux) PLATFORM="${ARCH}-linux" and PLATFORM="aarch64-darwin" mappings are present;
• macOS hosts that are not Apple silicon are refused (macOS release lookup requires Apple silicon);
• die "Unsupported OS" and die "Unsupported architecture" are present;
• forbid any arm beyond the contract: x86_64-darwin, msys|mingw|cygwin|windows).

Banner rule follows the one-command finish: Opening Home... when a terminal is present, Home is installed. Open it from a terminal: when none is.

docs/INSTALL.md gains one clause — "detects the platform (Linux x86_64/aarch64 or macOS Apple silicon)" — so the docs rule pins a real sentence. README and Getting Started keep their existing Linux-preview rules unchanged: the public endpoint still serves the 0.1.2 Linux preview until the candidate is published, as INSTALL.md says.

Browser lifecycle revision (was: 2.0 literal in the adapter)

The breaking revision is 2.1 (122dc4ade) and lives in elastos-common::browser_protocol; the adapter imports it. Rules now:

• pin BROWSER_ENGINE_PROTOCOL_VERSION: &str = "2.1" in the shared contract;
• require the adapter to put "protocol_version": BROWSER_ENGINE_PROTOCOL_VERSION on the wire;
• forbid a private BROWSER_ENGINE_PROTOCOL_VERSION: &str or "protocol_version": "…" literal in the adapter;
• require Runtime's engine_protocol_version != BROWSER_ENGINE_PROTOCOL_VERSION rejection in gateway_browser.rs.

The v2 cleanup binding/result rules are untouched (they already pass).

Passkey

home-gui/shell-windows.js:174 comment said "passkey"; reworded to "sign-in". The ceremony rule (no navigator.credentials / passkey routes outside Home, System, Inbox, Wallet, providers) is unchanged.

Gates on this branch

check-wci-alignment.sh OK (rg and fallback); home-entropy-check, browser-entropy-check, home-shell-regression-smoke, home-agent-shell-smoke, people-discovery-smoke, browser-window-close-handshake test, diff --check, bash -n all green.

Not touched here, as agreed: vendor-token drift, release artifact metadata (home-agent darwin-arm64: artifact size), Carrier elastos-identity 0.6.0 expectation, clippy needless_return in setup.rs. (Locally home-agent-cancellation.test.mjs fails with a Node 22.23 "Unable to deserialize cloned data" runner error, identical on the untouched tip; not an assertion.)

Made with Cursor

Part of #88.
Part of #87.

[SashaMIT]

Closing: superseded by 0947d02 on feat/0.7.1-models (two-platform installer gates), as agreed.