feat(context-providers): preregister A/A noise arms and recoverable failure diagnostics

.codevetter/verify.yaml

@@ -0,0 +1,47 @@
+version: 1
+target:
+  command: [pnpm, --dir, apps/desktop, exec, vite, --host, 127.0.0.1, --port, "1420", --strictPort]
+  cwd: .
+  readinessUrl: http://127.0.0.1:1420/
+  baseUrl: http://127.0.0.1:1420
+  allowedEnv: []
+  hmrSettleMs: 150
+  shutdownGraceMs: 2000
+scenarioModules:
+  - apps/desktop/verify/scenarios.mjs
+authProfiles:
+  local-developer:
+    storageState: apps/desktop/tests/fixtures/warm-verification/auth/local-developer.json
+capabilities:
+  - id: app-shell
+    paths:
+      - apps/desktop/src/App.tsx
+      - apps/desktop/src/main.tsx
+      - apps/desktop/src/components/sidebar.tsx
+      - apps/desktop/src/components/persistent-routes.tsx
+    scenarios: [shell-navigation]
+mandatorySmoke: [shell-navigation]
+sharedInfrastructure:
+  paths:
+    - apps/desktop/src/**
+    - apps/desktop/vite.config.ts
+    - apps/desktop/package.json
+    - package.json
+    - pnpm-lock.yaml
+  fallbackScenarios: [shell-navigation]
+network:
+  firstPartyOrigins: [http://127.0.0.1:1420]
+  allowedFirstPartyRequests: [GET /**]
+  blockThirdParty: true
+  allowedThirdPartyOrigins: []
+retention:
+  directory: .codevetter/verify-artifacts
+  maxRuns: 20
+  maxBytes: 104857600
+  maxAgeDays: 14
+budgets:
+  parallelism: 4
+  actionMs: 3000
+  scenarioMs: 10000
+  batchMs: 30000
+  slowInteractionMs: 750

.fleet/design-review.json

@@ -0,0 +1,59 @@
+{
+  "$schema": "fleet.design-review.v1",
+  "version": 1,
+  "project": "codevetter",
+  "target": "T-Rex change and preview verification",
+  "mode": "preserve",
+  "register": "product",
+  "context": {
+    "product": "PRODUCT.md",
+    "design": "DESIGN.md"
+  },
+  "direction": {
+    "references": [],
+    "probes": [],
+    "selected": "existing-design",
+    "approval": "not-required",
+    "before": "artifacts/design/trex-before-1440.png"
+  },
+  "evidence": {
+    "screenshots": [
+      {
+        "width": 390,
+        "path": "artifacts/design/trex-after-390.png"
+      },
+      {
+        "width": 768,
+        "path": "artifacts/design/trex-after-768.png"
+      },
+      {
+        "width": 1440,
+        "path": "artifacts/design/trex-after-1440.png"
+      }
+    ],
+    "projectCheck": {
+      "command": "cd apps/desktop && pnpm exec tsc --noEmit",
+      "status": "pass"
+    },
+    "critique": {
+      "score": 37,
+      "maximum": 40
+    },
+    "audit": {
+      "score": 19,
+      "maximum": 20
+    },
+    "unresolved": {
+      "p0": 0,
+      "p1": 0
+    },
+    "detector": {
+      "posture": "advisory",
+      "findings": []
+    }
+  },
+  "ownerFeedback": {
+    "decision": "delegated",
+    "note": "Owner authorized the bounded preserve-lane implementation with 'go for it'; the incumbent CodeVetter workbench language remains authoritative."
+  }
+}

.fleet/design-reviews/crash-recovery.json

@@ -0,0 +1,59 @@
+{
+  "$schema": "fleet.design-review.v1",
+  "version": 1,
+  "project": "codevetter",
+  "target": "desktop shell crash recovery and evidence workflow",
+  "mode": "preserve",
+  "register": "product",
+  "context": {
+    "product": "PRODUCT.md",
+    "design": "DESIGN.md"
+  },
+  "direction": {
+    "references": [],
+    "probes": [],
+    "selected": "existing-design",
+    "approval": "not-required",
+    "before": "artifacts/design/crash-recovery-before-1440.png"
+  },
+  "evidence": {
+    "screenshots": [
+      {
+        "width": 390,
+        "path": "artifacts/design/crash-recovery-final-390.jpg"
+      },
+      {
+        "width": 768,
+        "path": "artifacts/design/crash-recovery-final-768.jpg"
+      },
+      {
+        "width": 1440,
+        "path": "artifacts/design/crash-recovery-final-1440.jpg"
+      }
+    ],
+    "projectCheck": {
+      "command": "cd apps/desktop && pnpm exec tsc --noEmit && node --import tsx --test src/lib/ui-incident.test.ts && playwright test tests/e2e/visual-system.spec.ts --grep 'renders a local-only recovery surface'",
+      "status": "pass"
+    },
+    "critique": {
+      "score": 35,
+      "maximum": 40
+    },
+    "audit": {
+      "score": 19,
+      "maximum": 20
+    },
+    "unresolved": {
+      "p0": 0,
+      "p1": 0
+    },
+    "detector": {
+      "posture": "advisory",
+      "findings": []
+    }
+  },
+  "ownerFeedback": {
+    "decision": "keep",
+    "note": "Owner approved the final crash-recovery design with 'go for it'."
+  }
+}

.fleet/design-reviews/focus-desktop-product-surfaces.json

@@ -0,0 +1,59 @@
+{
+  "$schema": "fleet.design-review.v1",
+  "version": 1,
+  "project": "codevetter",
+  "target": "five-surface desktop shell and Performance workbench",
+  "mode": "preserve",
+  "register": "product",
+  "context": {
+    "product": "PRODUCT.md",
+    "design": "DESIGN.md"
+  },
+  "direction": {
+    "references": [],
+    "probes": [],
+    "selected": "existing-design",
+    "approval": "not-required",
+    "before": "artifacts/design/product-surfaces-before-1440.jpg"
+  },
+  "evidence": {
+    "screenshots": [
+      {
+        "width": 390,
+        "path": "artifacts/design/product-surfaces-after-390.jpg"
+      },
+      {
+        "width": 768,
+        "path": "artifacts/design/product-surfaces-after-768.jpg"
+      },
+      {
+        "width": 1440,
+        "path": "artifacts/design/product-surfaces-after-1440.jpg"
+      }
+    ],
+    "projectCheck": {
+      "command": "pnpm lint; desktop tsc --noEmit; focused unit/Rust tests; vite build; bundle, complexity, cycles, duplication, dependency, docs, OpenSpec, diff, and in-app browser checks",
+      "status": "pass"
+    },
+    "critique": {
+      "score": 35,
+      "maximum": 40
+    },
+    "audit": {
+      "score": 19,
+      "maximum": 20
+    },
+    "unresolved": {
+      "p0": 0,
+      "p1": 0
+    },
+    "detector": {
+      "posture": "advisory",
+      "findings": []
+    }
+  },
+  "ownerFeedback": {
+    "decision": "pending",
+    "note": "Owner approved implementation; final rendered-surface feedback remains pending."
+  }
+}

.fleet/design-reviews/sidebar.json

@@ -0,0 +1,59 @@
+{
+  "$schema": "fleet.design-review.v1",
+  "version": 1,
+  "project": "codevetter",
+  "target": "desktop primary navigation sidebar",
+  "mode": "preserve",
+  "register": "product",
+  "context": {
+    "product": "PRODUCT.md",
+    "design": "DESIGN.md"
+  },
+  "direction": {
+    "references": [],
+    "probes": [],
+    "selected": "existing-design",
+    "approval": "not-required",
+    "before": "artifacts/design/trex-before-1440.png"
+  },
+  "evidence": {
+    "screenshots": [
+      {
+        "width": 390,
+        "path": "artifacts/design/sidebar-after-390.png"
+      },
+      {
+        "width": 768,
+        "path": "artifacts/design/sidebar-after-768.png"
+      },
+      {
+        "width": 1440,
+        "path": "artifacts/design/sidebar-after-1440.png"
+      }
+    ],
+    "projectCheck": {
+      "command": "biome check touched files; tsc --noEmit; targeted Playwright visual-system and smoke tests; git diff --check",
+      "status": "pass"
+    },
+    "critique": {
+      "score": 33,
+      "maximum": 40
+    },
+    "audit": {
+      "score": 18,
+      "maximum": 20
+    },
+    "unresolved": {
+      "p0": 0,
+      "p1": 0
+    },
+    "detector": {
+      "posture": "advisory",
+      "findings": []
+    }
+  },
+  "ownerFeedback": {
+    "decision": "keep",
+    "note": "Owner confirmed the implemented sidebar is better and chose to stay with this direction."
+  }
+}

.github/dependabot.yml

@@ -0,0 +1,15 @@
+version: 2
+updates:
+  - package-ecosystem: npm
+    directory: /
+    schedule:
+      interval: weekly
+    groups:
+      ccusage-runtime:
+        patterns:
+          - ccusage
+          - '@ccusage/*'
+    labels:
+      - dependencies
+      - ccusage
+    open-pull-requests-limit: 5

.github/workflows/auto-release.yml

@@ -0,0 +1,84 @@
+name: Auto-publish release
+
+# When tauri.conf.json's version changes on main:
+#   1. Create a GitHub release with tag v<version>.
+#   2. Dispatch release.yml directly to build + sign + upload artifacts.
+#
+# Step 2 is required because workflows triggered by GITHUB_TOKEN (which is
+# how step 1 creates the release) do NOT cascade to other workflows — this
+# is a documented anti-recursion safeguard. workflow_dispatch is the one
+# event that fires even from GITHUB_TOKEN, so we use it explicitly.
+#
+# Idempotent: if a release with that tag already exists, this no-ops.
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - "apps/desktop/src-tauri/tauri.conf.json"
+  workflow_dispatch:
+
+permissions:
+  contents: write
+  actions: write
+
+concurrency:
+  group: auto-release-${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+
+      - name: Read version from tauri.conf.json
+        id: ver
+        run: |
+          set -euo pipefail
+          VERSION=$(jq -r '.version' apps/desktop/src-tauri/tauri.conf.json)
+          if [ -z "$VERSION" ] || [ "$VERSION" = "null" ]; then
+            echo "::error::No version field in apps/desktop/src-tauri/tauri.conf.json"
+            exit 1
+          fi
+          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
+          echo "tag=v$VERSION" >> "$GITHUB_OUTPUT"
+
+      - name: Check if release already exists
+        id: check
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          set -euo pipefail
+          if gh release view "${{ steps.ver.outputs.tag }}" \
+              --repo "$GITHUB_REPOSITORY" >/dev/null 2>&1; then
+            echo "exists=true" >> "$GITHUB_OUTPUT"
+            echo "Release ${{ steps.ver.outputs.tag }} already exists — skipping."
+          else
+            echo "exists=false" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Create GitHub release
+        if: steps.check.outputs.exists != 'true'
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          set -euo pipefail
+          gh release create "${{ steps.ver.outputs.tag }}" \
+            --repo "$GITHUB_REPOSITORY" \
+            --target "$GITHUB_SHA" \
+            --title "CodeVetter ${{ steps.ver.outputs.tag }}" \
+            --generate-notes
+
+      - name: Dispatch release build workflow
+        if: steps.check.outputs.exists != 'true'
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          set -euo pipefail
+          gh workflow run release.yml \
+            --repo "$GITHUB_REPOSITORY" \
+            --ref main \
+            -f tag="${{ steps.ver.outputs.tag }}"