VMAnyware has one validated development baseline as of 2026-10-17. No signed release or broad minimum-OS support guarantee is available yet. Future roadmap targets must be proven separately; upstream Tauri support alone is insufficient.
| Target | Current evidence | Still required |
|---|---|---|
| macOS 27.0.1 arm64, Apple M1 | Native dev launch/bridge; workspace tests/release executable; real Tauri/IPC/bundled-terminal/disposable-agent/shell smoke | Normal startup with deliberately selected real agent/guest, physical keyboard, signing/installers |
| Linux | Arch Linux x86_64: frontend build/23 Node tests; workspace fmt/Clippy and 122 tests (104 server, 18 native HTTP) using a temporary signed-package WebKitGTK prefix. Isolated software-rendered native React/WebKit/Tauri IPC -> actual Axum -> generated-HTTPS start/shutdown passes. Earlier Debian 12 arm64 container checks passed; Ubuntu CI prepared | Normal packaged/native startup, GPU rendering, Linux SSH terminal and first CI run |
| Windows | Actual bundled Tauri client compiles/links on windows-2025 x64 (run 40030829324) | Launch, SSH/identity implementation, process/terminal tests and release packaging |
| iOS | Actual unsigned ARM64 simulator application builds on hosted macOS (run 40144274220) | Launch, simulator/device SSH/terminal/lifecycle, secure storage, signing and release proof |
| Android | ARM64/x86_64 debug APKs build; Android 15/API 35 x86_64 emulator launches the packaged app with actual Tauri bridge, encrypted identity/restart, native guard and painted-layout proof; current APK SSH/PTY/input/rotation/reconnect pass via owned ADB tunnel | Direct-network remote create journey, full software IME/suspend-resume, physical ARM64, current WebView parity, iOS-independent proof and release packaging |
| Browser | Vite build/preview | Native bridge intentionally unavailable; this is not the product's native runtime |
The current Mac reports macOS build 26A434. Apple developer directory is
/Library/Developer/CommandLineTools, not full Xcode. adb and sdkmanager
were not found on PATH during the check; their absence on PATH is not proof
that no SDK exists elsewhere. No personal SDK/configuration files were inspected.
Both current-source debug APKs now compile and are copied to .lab/packages/android/
with verified signatures, package/version/ABI, API 24/36 declarations and exact
embedded-native-library SHA-256 matches. See installation.
Their manifest records runtimeValidatedForTheseApks:false: earlier emulator/SSH
reports below belong to historical APKs and do not prove these new binaries run.
Physical ARM64, fresh runtime/input/network behavior and release signing remain open.
Source now offers explicit save/unlock/forget of the application SSH unlock passphrase through Secret Service, plus an SSH identity-source choice. A real isolated GNOME Keyring/private D-Bus fixture passes roundtrip/failure and native SSH authentication checks; React/Firefox controls pass separate simulated-IPC checks. Joined Linux WebView/production IPC now also passes actual save/use/forget, interactive terminal, remote resize and changed-host refusal with that private keyring. This does not store a non-exportable SSH key, implement macOS Keychain or prove Android runtime behavior. Android Keystore source and refreshed APKs now compile/package independently (ADR 0088); the wrapping key, ciphertext, restart and SSH behavior still need actual device acceptance. See ADR 0087.
The explicit save/use/forget backend is implemented through one default Keychain handle, exact service/scoped account and fixed errors, with save/forget confirmation. The real identity/backend module typechecks for aarch64-apple-darwin using the pinned Rust target and production-locked dependency versions. No Apple SDK/framework link, Tauri build, Keychain call, GUI or macOS runtime is involved in this Linux-host probe:
rustup target add aarch64-apple-darwin
python3 scripts/check-macos-identity-source.pyThe probe creates only ignored .lab files and checks all selected dependency versions/checksums against Cargo.lock. The real macOS application build is covered by a separate path-filtered CI workflow; its result is recorded in STATE.md when observed. Runtime/OS prompts, signing identity, locked store, isolated keychain roundtrip and system-source SSH still need a real approved macOS target. Neither metadata compilation nor a native build closes these gates. See ADR 0090.
The path-filtered Windows client source workflow targets the standard
windows-2025 x64 runner with the repository-pinned Rust/Node versions. It builds
the actual Tauri client and bundled frontend using tauri/custom-protocol, without
launching the app, installing it or accessing a credential store. Actual bundled-client compilation/linking succeeded in run 40030829324 for
00439c4 on 2026-10-24; this is compilation evidence only.
SSH, encrypted application identities and OS-backed secret storage still report
unsupported on Windows. A successful build does not establish those capabilities,
GUI/runtime behavior, signed installers or release support.
The path-filtered iOS client source workflow prepares an actual unsigned
Apple Silicon simulator application with the locked Tauri CLI, frontend and Cargo
dependencies. It generates the Xcode project on the runner, targets
aarch64-apple-ios-sim, checks Xcode/simulator SDK/CocoaPods availability, and runs
ios build --debug --target aarch64-sim --no-sign --ci -- --locked.
No simulator boot, installation, app launch, signing credential or secure-store
operation is part of this workflow.
Run 40144274220
succeeded for e4a39c9. Logs confirm Finished 1 iOS Bundle and the generated
gen/apple/build/arm64-sim/VMAnyware.app. Actual environment: macOS 15.7.9 ARM64,
Xcode 16.4 (16F6), simulator SDK 18.5, CocoaPods 1.17.0 and Rust 1.99.1.
This proves application compilation/packaging, not launch or runtime behavior.
That initial run did not retain a downloadable artifact. Follow-up
run 40144618222
for debed94 succeeds with artifact vmanyware-ios-simulator-arm64 (14-day
retention). Its downloaded tar archive passes SHA-256 verification and contains
an executable ARM64 Mach-O plus bundle identifier dev.vmanyware.client and platform
iPhoneSimulator. The plist declares minimum OS 15.0; runtime compatibility at that
minimum is untested. Archive SHA-256:
a94ac374b698a6938907caee9ec0e2456a160a3a1532973201a20d10d639a497.
Local copy: ignored .lab/packages/ios/run-40144618222/. No app was launched.
Local inspection on 2026-10-25 found only Apple Command Line Tools selected and no usable xcodebuild or CocoaPods command; no local iOS build was attempted. The installed Tauri CLI is 2.12.3; its matching upstream source confirms no-sign and forwarded Cargo arguments. Official references: Tauri CLI and iOS prerequisites.
| Tool | Tested version/configuration |
|---|---|
| Rust/Cargo | 1.99.1, pinned in rust-toolchain.toml; rustfmt and Clippy |
| Node | 26.11.1 |
| npm | 11.20.0; use committed package lock with npm ci |
| Rust dependencies | Committed root Cargo lock |
| Native client | Tauri 2 with React/TypeScript/Vite; exact versions in locks |
Run make doctor, npm --prefix apps/client ci, then make check on the
validated Mac. make check-server avoids native client builds. Browser and
native development commands share the Vite port and should run separately.
The isolated SSH experiment has its own Cargo manifest/lock and optional check
command; it is not part of the application dependency graph or mobile proof.
Native packaging, cross-compilation and on-device tests need the corresponding platform tools. Do not infer a lower macOS minimum or universal architecture support from a successful build on this machine. The Mac's lack of nested virtualization does not block the local service or localhost SSH tests; real Proxmox tests will use the user's separate PC.
For platform setup, consult official Tauri prerequisites. Use upstream instructions as prerequisites and record actual project results before changing the table. See interim feasibility for open risks.
make check-linux-server checks committed HEAD, not working-tree edits, using
an anonymous Docker configuration and the explicit local Unix socket. It archives
tracked source into a disposable directory and runs locked server formatting,
Clippy and tests in the digest-pinned Rust 1.99.1 Debian 12 arm64 image. The
container has two CPUs, 2 GiB RAM, a PID limit, no extra capabilities and no
published ports. No personal configuration, credentials or Docker socket is
mounted. Public image/component/crate downloads require network access.
The container and temporary source are removed afterward; the image remains in
the local Docker cache. This opt-in check is separate from default checks and
provides neither GitHub Actions nor Linux desktop evidence.
make check-linux-client uses the same isolation and cleanup, with the pinned
Node 26.11.1 Debian 12 arm64 image. It runs npm ci --no-audit --no-fund, the
TypeScript/Vite build and seven controller tests in the disposable source copy.
Node 26.11.1/npm 11.20.0 passed these checks on 2026-10-17. Native Tauri is not
built or launched by this target. Both Linux targets share scripts/check-linux.mjs.
The 2026-10-18 temporary signed-package prefix unblocked workspace compilation/Clippy and all 95 Linux tests (80 server, 15 native HTTP). The frontend build, 15 Node tests and disposable Firefox simulated-IPC walkthrough also pass. No global package was installed, no native graphical window launched and no Linux SSH terminal support inferred. Standard native checks still require installed native prerequisites or the retained temporary build prefix.
ADR 0019 limits the initial MVP terminal to macOS. iOS, Android, Linux and Windows native terminals are unsupported until separately validated. This is a scope decision, not mobile feasibility evidence or a release-readiness claim for macOS.
The native lifecycle harness now passes real WebKit/Tauri IPC and actual control-plane/provider transport in owned Xvfb/Mesa/XDG/D-Bus namespaces. It drives explicit start/graceful-shutdown confirmation against generated HTTPS only. This updates the earlier compile-only HTTP evidence; it does not establish normal packaged startup, native profile restart, hardware GPU rendering, SSH or real Proxmox support.
ADR 0046 adds an explicit passphrase-encrypted Ed25519 identity and public-key insertion in remote creation. Unix source is enabled for Linux/macOS/Android/iOS, but only Linux compilation and owned local fixtures are proven. It is encrypted app-local storage, not an OS keystore or mobile SSH support claim. Existing agent/PTY still requires macOS. Mobile storage/backup policy, native command invocation and on-device authentication/terminal runtime remain open. Android/iOS SDK commands are absent from this Linux PATH and only the host Rust target is installed; this does not rule out SDKs elsewhere.
ADR 0047 enables the shared Unix host/authentication/PTY source with the encrypted app key. Generated localhost SSH and a real disposable /bin/sh prove authentication, strict fresh host verification, output, resize, Ctrl-C, close and reconnect on Linux. React/Firefox simulated IPC proves the visible application-key flow and stale cleanup separately. This updates the initial macOS-only source boundary; it is not packaged Linux/native GUI or mobile support. No current macOS-agent regression run is claimed on Linux. Android/iOS build/runtime, native command dispatch, key-storage backup policy, software keyboard and suspension remain required. Next build/launch attempt targets Android on Linux provisionally, pending the user's platform preference; iOS remains in the roadmap.
ADR 0048 and the owned emulator procedure record actual SDK/NDK installation, two debug APKs and Android 15 x86_64 native evidence. The editable generated Android project is retained in Git. Min API 24/target 36 are configuration values, not tested OS bounds. Real WebView/Tauri commands create an encrypted identity and reopen the same key after process restart; endpoint/session guards reject invalid inputs. A framebuffer check plus reviewed screenshot proves actual painted launch, distinct from DOM or native protocol compilation. ARM64 was packaged but not executed. APK signatures are debug signatures; no release/Play, physical phone, Android SSH session, keyboard/lifecycle or iOS claim is made.
The current x86_64 debug APK passes actual native SSH trust/authentication, typed
shell commands, rotation/OS PTY size, foreground interrupt, reconnect and process
death cleanup on the owned Android 15 emulator. The emulator host alias returned
Network is unreachable in an independent TCP probe, so this evidence explicitly
uses an owned ADB reverse tunnel. Direct remote network access remains unverified.
The software keyboard is visible; command input uses ADB events, not physical or
complete software-IME interaction. Controls wrap with 44px targets; a current
terminal screenshot was reviewed. ADR 0049 and the Android harness README record
scope and remaining limits. Historical statements above describe earlier slices.
The current x86_64 APK now initializes the Android TLS verifier and packages its matching Kotlin component. A per-connection public CA supports privately issued server certificates without changing device roots or disabling verification. The owned native HTTPS harness uses the production server with an isolated DB, a generated HTTPS proxy and explicit ADB reverse mappings. It verifies issuer/ hostname refusal before HTTP, actual bearer rejection, authenticated connection, retained failed-operation/target recovery and explicit reconnection after process restart without token/profile persistence or request replay. No writes are sent. The absent template catalog remains an actionable error. These are native Android checks, not browser IPC simulation. Direct deployed access, complete create-to-SSH, physical devices and release/iOS support remain separate gates (ADR 0050).
The current x86_64 APK now completes real native confirmation/API/production-worker creation and strict readiness against an owned HTTPS provider fixture, followed by explicit exact-address/account handoff. The same app key is asserted in Cloud-Init and authenticates to a real localhost OS-shell SSH peer after explicitly changing the endpoint to the owned ADB tunnel. Exactly one creation and expected provider mutations remain unchanged across SSH/restart. No native IPC is mocked. The guest/IP and readiness evidence are simulated; this is not real VM or direct network proof. ADR 0052 and .lab/android-create records separate these boundaries.
The same current x86_64 APK now passes native verified HTTPS/create/API/worker and strict SSH/PTY using 10.0.2.2 directly, including a cold-boot repeat with an owned TCP readiness probe. No data-plane ADB reverse mapping exists before or after the journey; ADB/CDP remains instrumentation only. No route/firewall/trust modification was required. The older intermittent failures were not reproduced; their precise cause remains unproven. Reports label direct and tunnel transports. ADR 0053 supersedes the historical host-alias limitation, while synthetic guest, physical/deployed network, full IME/lifecycle and real VM limits still apply.