# Desktop guardrails

- `check-electron-cutover.sh` enforces the macOS/Windows Electron and Linux daemon-only cutover boundary. It rejects restored Wails/Web embed dependencies, retired native UI routes, WebView2 packaging, Desktop host inference from `window.location`, and unsafe Electron renderer privileges or generic IPC.
- `check-electron-cutover-test.sh` is the fixture-driven self-test for that guardrail.
- `check-no-isolated-execution.sh` scans Git-tracked text and rejects the retired delegated-runtime feature vocabulary, worker credential scope, lifecycle tools, prompt/runtime identifiers, policy UI identifiers, persisted MCP/CLI switches, and legacy execution workdirs. Its allowlist is limited to exact historical/cleanup migrations, migration regressions, and the hard-disabled server outbound compatibility projection.
- `check-no-isolated-execution-test.sh` proves ordinary Task/Workflow/Exec/runtime vocabulary remains allowed, untracked files are ignored, every retired rule is denied outside its exact boundary, and an allowed path cannot use a different retired token.

Run the Electron pair with `make check-electron-cutover`. Run the retired-surface pair directly from the repository root. Both pairs are part of `make harness-fast`.