feat(cua-driver): Project Centennial preview

[f-trycua]

Summary

• add the opt-in encrypted local Project Centennial history foundation and macOS adapter
• expose permission-gated status/query tools with bounded metadata-only results
• add explicit history-first consultation guidance for continuation requests
• document the storage profile, privacy boundaries, lifecycle, recovery, and agent integration contract
• preserve uninstall data by default and require explicit cryptographic purge
• confine production storage and purge to a platform-derived, marker-owned root; reject unmarked, malformed, linked, relative, and Windows reparse-point roots before key destruction or deletion

Computer History remains off by default. Enabling capture does not grant an agent read access; status and query use separate existing Cua capabilities.

Validation

• cargo fmt --all -- --check
• cargo check -p cua-driver-core -p platform-macos -p cua-driver
• cargo test -p cua-driver-core history --lib --no-fail-fast — 42 passed
• cargo test -p cua-driver --bin cua-driver history --no-fail-fast — 13 passed
• cargo test -p platform-macos history --no-fail-fast — 1 passed, 1 release-qualification Keychain test ignored locally
• workflow YAML, shell syntax, JSON schema, diff, credential, and public-doc residue checks
• synthetic uninstall purge fixture
• local installer/Lume harness tests — 91 passed, 1 expected skip
• focused destructive-path tests prove refusal before key/file mutation for arbitrary non-empty roots, relative roots, name-only legacy roots, Unix symlinks, managed-file symlinks, and admission-state links

Exact-head host qualification at 226b3ffe7df8f700c58aec45c4fcafe2d4e4bc70:

• certificate-backed 0.20.0 install with bundle id com.trycua.driver.local, Team ID YCK386LBJ7, and strict signature verification
• runtime provenance matched the exact candidate SHA
• the pre-marker encrypted local store was explicitly marked after its fixed namespace and complete allowlisted layout were verified; no key, chunk, or state file was replaced
• the existing encrypted store reopened enabled and ready with zero drops, retained prior history, recorded paired metadata-only Chess frame actions, and survived daemon restart
• the representative Chess frame move and exact restoration were independently read back; both completions were confirmed through the accessibility route

The earlier complete macOS Lume matrix on the stacked candidate passed every history-specific Keychain lifecycle, cryptographic purge, retention, and latency gate. The matrix was 156/157 overall; the only failure was an unrelated background Tauri left-click cursor-drift cell.

Known limitation

Screen Recording was not granted to the host's local-development bundle, so this exact-head host replay used Accessibility and external frame readback rather than screenshot/pixel rows. The release packaging workflow separately verifies the production bundle's restricted entitlements and provisioning profile.

Stack

The Windows/Linux extension is intentionally isolated in the follow-up stacked pull request.

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.