1# Portal platform and relative-pointer support23Portal's only supported download is macOS arm64. Its relative-pointer path uses4CoreGraphics cursor disassociation and has live Mac-to-Gamescope hardware5evidence. No other target is published, advertised, or reachable from goq.sh.67All platform claims also inherit the multi-viewer acceptance boundary: native8MoQ control v2 supports three viewers by default (hard ceiling eight), while9control v1/grouped-v3 remains exclusive. Only one viewer may hold slot-0 input10focus, regardless of client platform.1112## Release tiers1314Building a target and supporting a target are separate decisions. Portal has15three tiers, and a target only moves up a tier through a reviewed policy change16backed by the acceptance evidence below.1718| Tier | Targets | What the project does |19| --- | --- | --- |20| Published | macOS arm64 | Ad-hoc signed, attested, attached to the GitHub Release with its SHA-256, and linked from goq.sh after operator verification. Not notarized: macOS blocks the first launch |21| Preview | macOS x86_64, Linux x86_64, Windows x86_64 | Built unsigned from the exact release tag and attested on every release. Retained only as a 14-day Actions artifact. Never a release asset, never linked, never advertised |22| Unsupported | Everything else, including arm64 Linux and arm64 Windows | Not built and not gated |2324Preview artifacts exist so the matrix cannot silently rot and so platform UAT25has exact, provenance-bound bytes to test. They are not a download channel.26Because they carry no signature, a preview artifact obtained from anywhere27other than the tag's own workflow run must be treated as untrusted.2829A preview build is a default-feature build. It therefore has no relative30pointer, per the build policy below, and is not a usable substitute for the31macOS client for mouse-driven games.3233`jobs.preview` in `.github/workflows/portal-release.yml` holds only34`contents: read`, so it is structurally incapable of adding an asset to the35release. `.github/workflows/ci.yml` compile-checks the preview targets under36both pointer policies on every pull request.3738## Build policy3940| Client build | Relative pointer | Other negotiated input |41| --- | --- | --- |42| macOS | Enabled through the native CoreGraphics path | Absolute pointer, keyboard/text, and gamepad remain available when granted |43| Non-macOS, default features | Not offered; any unexpected relative-pointer or pointer-feedback response is masked locally | Absolute pointer, keyboard/text, gamepad, and input acknowledgements remain available when granted |44| Non-macOS with `experimental-non-macos-pointer-capture` | Enabled through Tao cursor grab plus browser Pointer Lock | Same independently granted input capabilities |4546The experimental flag makes the non-macOS code available for testing; it does47not make that platform supported and must not appear in a published build.48Compile both policies with:4950```bash51cargo check --locked -p portal --all-targets52cargo check --locked -p portal --all-targets \53 --features experimental-non-macos-pointer-capture54```5556The complete repository gate runs the default test suite and separately57compiles the experimental branch. On Linux CI this proves both non-macOS58configurations compile. The `portal-target-matrix` CI job repeats both59compilations natively for macOS x86_64 and Windows x86_64, so a preview target60cannot break without a pull request failing. Portal's macOS release job61continues to build without feature flags.6263## Non-macOS acceptance checklist6465Complete this checklist independently for each OS/webview combination before66proposing default or release support. Preserve the exact Portal commit,67operating-system version, webview version, and window-system/session type with68the evidence.69701. Build and launch Portal without the experimental feature. Connect to a host71 offering every input capability and confirm diagnostics do not report72 relative pointer or pointer-position feedback. Confirm absolute motion and73 buttons, keyboard/text, and a physical gamepad still work when their grants74 are present.752. Build the exact same commit with76 `experimental-non-macos-pointer-capture`. Confirm the embedded webview77 implements `requestPointerLock`, reports ownership changes, and supplies78 bounded `movementX`/`movementY` deltas.793. Against the UMPC Gamescope session, enter and exit control at least ten80 times. Exercise motion, left/right click, both scroll axes, keyboard, and a81 physical controller in an actual game. Confirm the remote pointer maps to82 the native host surface rather than the encoded size.834. While control is active, test window focus loss/regain, Pointer Lock loss,84 disconnect, reconnect, and application exit. Portal must visibly leave85 control when ownership is lost, restore the local cursor, bound release86 retries, and leave no held host input.875. Repeat under the platform's materially different window systems or88 webviews. Linux requires separate Wayland/WebKitGTK and X11/WebKitGTK89 evidence when both are claimed; Windows requires the shipped WebView290 runtime. Record unavailable APIs as an explicit unsupported result rather91 than bypassing the gate.926. Run `./scripts/verify-demo-build.sh` and retain the exact Portal-to-UMPC93 session evidence required by `AGENTS.md`. A config check, unit test, or94 compile-only result is not hardware acceptance.957. Join the exact candidate as one of three simultaneous control-v2 viewers.96 Verify the roster and local opaque handle, request and transfer slot-0 focus97 by controller, and confirm focus loss immediately tears down local pointer,98 keyboard, and gamepad routing before another viewer injects.998. While this platform is the holder and while it is a spectator, exercise100 same-peer replacement, live input and view revocation, and one constrained101 viewer. Survivor video/audio and diagnostics must continue on the same media102 generation with bounded queues. Repeat legacy mode separately and confirm a103 second client receives the explicit exclusive-mode rejection.1049. On Windows, close the enrollment-storage gap before proposing support.105 `secure_config_dir` and `read_bounded_file` in106 `src-tauri/src/commands/enrollment.rs` hard-gate their ownership check,107 `0o700` tightening, and `O_NOFOLLOW` open behind `#[cfg(unix)]`. A Windows108 build therefore stores the enrollment profile without an equivalent109 owner-only ACL or symlink/junction refusal. Windows needs its own reviewed110 implementation of both protections; compiling is not the same as being safe.111112Removing the feature gate requires reviewed evidence for every platform being113enabled and an explicit release-policy change. Do not infer support from Tao114or webview API availability alone.