revert(safety): remove Emergency Stop for desktop automation (#4600)

[senamakel]

Summary

Fully undoes #4600 (feat(safety): Emergency Stop for desktop automation (#4255)) — removes the Emergency Stop button, the AutomationHalted banner, and all supporting halt/resume machinery, per product decision to drop the feature.

Removed

• Rust core: the entire src/openhuman/emergency_stop/ domain (types/state/ops/schemas/mod), its controller registration in core/all.rs, and boot init in core/jsonrpc.rs.
• Events: AutomationHalted / AutomationResumed domain events and the automation_halt web-channel bridge subscriber (web_chat/event_bus.rs).
• Enforcement hooks: the fail-closed halt guards in the cron scheduler, the tinyagents approval/security middleware, and screen-intelligence input actions.
• Frontend: EmergencyStopButton, AutomationHaltedBanner, emergencyApi, hydrateEmergencyState, safetySlice, socket automation_halt handling, App.tsx wiring, and all related i18n keys + tests.
• Design/plan docs under docs/superpowers/*emergency-stop*.

Notes for reviewers

• Module rename: since feat(safety): Emergency Stop for desktop automation (#4255) #4600 merged, channels::providers::web was renamed to web_chat. Three revert conflicts (jsonrpc.rs, channels/runtime/startup.rs, web_chat/event_bus.rs) were resolved keeping the current rename and dropping only the emergency-stop bits.
• Preserved an unrelated improvement: the cron run_agent_job full anyhow-chain ({e:#}) error-formatting fix shipped in the same PR is kept — a later test (cron_agent_job_short_loopback_send_error_stays_retryable) depends on it. It is unrelated to Emergency Stop.

Validation

• cargo check (core) ✓ · tsc typecheck ✓
• i18n:check / i18n:english:check ✓
• Frontend unit tests: 772 passed ✓
• Rust event-bus + cron suites: 121 passed ✓
• json_rpc_e2e integration test compiles ✓

Note: the pre-existing cron_agent_job_short_loopback_send_error_stays_retryable test overflows the default debug thread stack locally (unrelated to this change — the code path is byte-identical to main and it passes with RUST_MIN_STACK raised).

Summary by CodeRabbit

• Changes
  • Removed the desktop Emergency Stop control and the automation-halted banner.
  • Automation halt/resume state is no longer restored or synchronized when the app opens.
  • Automation halt/resume notifications are no longer shown in the desktop interface.
  • Workflow canvas labels now include side-panel and legend controls.
• Localization
  • Added localized privacy status labels indicating whether an action is local or external (replacing the removed safety-related strings).

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: ccb25d0f-acae-4a3d-ba44-284b676396a6

📥 Commits

Reviewing files that changed from the base of the PR and between c026793 and 0a2329d.

📒 Files selected for processing (1)

• src/openhuman/learning/startup.rs

---

📝 Walkthrough

Walkthrough

The pull request removes desktop automation emergency-stop functionality across the React shell, Redux store, socket events, Rust event and runtime paths, translations, web-channel bridges, and related tests.

Changes

Emergency stop removal

Layer / File(s)	Summary
Remove frontend safety surfaces app/src/App.tsx, app/src/lib/i18n/*	The desktop shell no longer hydrates or renders emergency-stop controls, and safety translations are replaced by privacy-status and workflow labels.
Remove frontend safety state wiring app/src/store/*, app/src/test/test-utils.tsx, app/src/services/socketService.ts	The safety Redux slice and automation-halt socket handling are removed from application and test stores.
Remove backend event infrastructure src/core/*, src/openhuman/mod.rs, src/core/jsonrpc.rs	Emergency-stop event variants and controller registration are removed, while approval and egress surface registration remains.
Remove runtime enforcement gates src/openhuman/cron/*, src/openhuman/screen_intelligence/ops.rs, src/openhuman/tinyagents/middleware.rs	Cron execution, accessibility input, and external-effect tool handling no longer apply emergency-stop checks.
Remove web-channel and test coverage src/openhuman/web_chat/*, src/openhuman/channels/runtime/startup.rs, tests/json_rpc_e2e.rs	The automation-halt web bridge and emergency-stop JSON-RPC coverage are deleted; a learning subscriber test is made retryable.

Estimated code review effort: 5 (Critical) | ~120 minutes

Possibly related PRs

• tinyhumansai/openhuman#4600: Adds the emergency-stop feature removed here.
• tinyhumansai/openhuman#4849: Updates overlapping localization toward privacy-status disclosure.

Suggested labels: feature, rust-core

Suggested reviewers: oxoxdev, m3ga-mind

Poem

I’m a rabbit watching halt buttons go,
While old stop events leave the flow.
Privacy pills now softly glow,
Approval bridges onward go—
Hop, hop, shipped! 🐇

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the main change: reverting and removing desktop automation Emergency Stop functionality.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

---

_{Comment @coderabbitai help to get the list of available commands.}

[senamakel]

CI note — coverage failure is a pre-existing, unrelated flake (#5076)

The only red check, Rust Core Coverage (cargo-llvm-cov), fails on learning::startup::tests::learning_subscriber_fires_with_no_channel_configured — a test from #5003/#5025 that this revert does not touch. Filed as #5076.

Why it shows up here: this PR edits src/openhuman/mod.rs (to drop pub mod emergency_stop;), which widens the coverage module filter to run the entire openhuman suite in one instrumented process. That test asserts on a shared global event bus + bounded candidate::global() ring under heavy concurrent load, so its event/candidates are dropped before the assertion reads them. It passes in isolation and when only the learning module runs, and reproduces identically on main under the same broad filter. This is the first PR since #5025 to trigger that filter.

I attempted two minimal in-test mitigations (re-publish-until-seen; only-cache-successful-registration) and neither cleared it in CI — a reliable fix needs the subscriber to run on an injectable/isolated bus+buffer, which is out of scope for an Emergency-Stop revert. Those attempts have been dropped; this branch is now a pure revert.

Everything actually about the change is green: clippy/fmt, frontend checks, i18n, the --no-default-features feature-gate-off build, and CodeRabbit. Requesting a maintainer review + coverage-gate override, tracked by #5076.