feat: introduce Rig agent runtime migration

crates/galaxy_core/src/channel/channel_tests.rs

@@ -12,3 +12,13 @@ fn local_control_channel_names_do_not_expose_legacy_branding() {
     );
     assert_eq!(Channel::Oss.local_control_channel_name(), "oss");
 }
+
+#[test]
+fn only_oss_disables_warp_service_egress() {
+    assert!(Channel::Stable.allows_warp_service_egress());
+    assert!(Channel::Preview.allows_warp_service_egress());
+    assert!(Channel::Dev.allows_warp_service_egress());
+    assert!(Channel::Local.allows_warp_service_egress());
+    assert!(Channel::Integration.allows_warp_service_egress());
+    assert!(!Channel::Oss.allows_warp_service_egress());
+}

crates/galaxy_core/src/channel/config.rs

@@ -52,6 +52,23 @@ pub struct WarpServerConfig {
 }
 
 impl WarpServerConfig {
+    /// Returns a loopback-only configuration for builds that must not communicate
+    /// with Warp-operated services.
+    ///
+    /// Loopback URLs keep legacy URL construction code valid while ensuring any
+    /// accidentally reachable request remains on the user's machine. Callers
+    /// must still fail closed before attempting authentication because Firebase
+    /// token exchange uses provider-owned URLs rather than `server_root_url`.
+    pub fn disabled() -> Self {
+        Self {
+            server_root_url: "http://127.0.0.1:9".into(),
+            rtc_server_url: "ws://127.0.0.1:9/graphql/v2".into(),
+            session_sharing_server_url: None,
+            firebase_auth_api_key: "".into(),
+            iap_config: None,
+        }
+    }
+
     pub fn production() -> Self {
         Self {
             server_root_url: "https://app.warp.dev".into(),
@@ -63,6 +80,10 @@ impl WarpServerConfig {
     }
 }
 
+#[cfg(test)]
+#[path = "config_tests.rs"]
+mod tests;
+
 #[derive(Debug, Deserialize, Serialize)]
 pub struct OzConfig {
     /// Root URL for the Oz (ambient agent management) dashboard.

crates/galaxy_core/src/channel/config_tests.rs

@@ -0,0 +1,12 @@
+use super::WarpServerConfig;
+
+#[test]
+fn disabled_warp_services_are_loopback_only() {
+    let config = WarpServerConfig::disabled();
+
+    assert_eq!(config.server_root_url, "http://127.0.0.1:9");
+    assert_eq!(config.rtc_server_url, "ws://127.0.0.1:9/graphql/v2");
+    assert!(config.session_sharing_server_url.is_none());
+    assert!(config.firebase_auth_api_key.is_empty());
+    assert!(config.iap_config.is_none());
+}

crates/galaxy_core/src/channel/mod.rs

@@ -47,6 +47,22 @@ impl Channel {
         }
     }
 
+    /// Whether this channel may communicate with Warp-operated services.
+    ///
+    /// The OSS product is local-first. Provider endpoints explicitly configured
+    /// by the user are outside this policy, but inherited Warp authentication,
+    /// cloud sync, RTC, and session-sharing services must remain unavailable.
+    pub fn allows_warp_service_egress(&self) -> bool {
+        match self {
+            Channel::Stable
+            | Channel::Preview
+            | Channel::Dev
+            | Channel::Local
+            | Channel::Integration => true,
+            Channel::Oss => false,
+        }
+    }
+
     /// Returns the CLI command name corresponding to this channel.
     pub fn cli_command_name(&self) -> &'static str {
         match self {

crates/galaxy_core/src/channel/state.rs

@@ -44,7 +44,7 @@ impl ChannelState {
             config: ChannelConfig {
                 app_id,
                 logfile_name: "".into(),
-                server_config: WarpServerConfig::production(),
+                server_config: WarpServerConfig::disabled(),
                 oz_config: OzConfig::production(),
                 telemetry_config: None,
                 autoupdate_config: None,