Release Lopu assistant, Builder, and rich text to main

[lopugit]

✅ Develop S3 preview ready

• Commit: 89352f94
• Environment: Vercel Custom Environment develop
• Preview: https://pr-668.previews.dev.thingtime.com
• Last successfully built: 06/09 13:12 AEST (Australia/Melbourne)
• Immutable deployment: https://thingtime-jiee0w4zk-lopugits-projects.vercel.app
• Vercel status: open deployment

The alias passed the develop bucket CORS preflight and a final live PR/SHA fence.

Generic Vercel Preview deployments use the shared development runtime; this controller adds the stable exact-SHA alias and marker-scoped cleanup.

Summary

Integrate the user-selected Lopu assistant, component library, Builder suites and live details, and rich-text improvements into main. Includes the Watch release ancestry from #667; this is not a promotion of the entire develop branch.

Sources: #291 at 6c9a243, #578 at e87f9ff, #612 at b169d31, #592 at 2233103, #635 at ddf4658. Preserve main's component expansion limits and account-cache cleanup while combining new Builder scope/action behavior. Both native Watch and Lopu widget targets remain embedded; ActivityKit is excluded from the Watch target.

Integration corrections include safe signed-out Watch approval rendering, bounded nested component action data, Lopu composer mobile sizing, and finite PM2 lifecycle behavior.

Verification

• Full combined unit suite: 1,934 passed before the final focused UI fixes; follow-up editor 87, Lopu UI 91, and notifications 31 passed.
• Typecheck ratchet retains the existing 108-error baseline; targeted lint has no errors.
• iPhone, embedded Watch, Lopu widget and XCTest products build successfully. Tests compiled, not executed on a newly booted phone simulator.
• Isolated Chrome at 1280px and 390px: Builder catalog filtering and nested preview, signed-out pairing, four-square whole-code clipboard paste with leading zero, Lopu draft composer and settings popover. No page errors or horizontal overflow; top-to-bottom scrolling checked. No provider chat request or real Watch approval performed.
• Latest rich-text overlay source receipt includes desktop, 390px and 320px interactive checks; integrated editor tests pass. Physical iOS editing menus remain device acceptance.
• Graph refresh and final exact-SHA hosted checks are in progress. Keep automatic edits and merges paused until release verification completes.

Delivery

The user explicitly authorized these selected features to merge into lopugit/thingtime main. Main merge is pending required checks and exact-SHA deployment verification.

Local: http://localhost:17890 (HMR 17891, Nitro 17892). Tailscale/Funnel unavailable: the installed shim targets a missing Tailscale.app binary; no mapping changed.

Preview: pending the trusted Vercel preview controller; discover and verify its exact-SHA URL before final delivery.

Recording automation remains separate in #665; provider-backed audio acceptance and APNs integration are not claimed complete here.

Exact integration follow-up

Product fix 43d2401 and graph snapshot 89352f9 add safe style-tune initialization without crypto.randomUUID and border-box sizing. Integrated editor tests: 88 passed; Chrome 1280/390/320px initializes 16 fields and verifies Changes close/open and selection undo without page errors or horizontal overflow. The graph is structurally and semantically refreshed.

GitGuardian reports two historical generic-password occurrences in the combined ancestry: verify-app-suites.mjs at 93e2fff (old synthetic registration fixture, current implementation uses throwawayCredential()), and PasskeysManager.tsx at 6a4b330 (password-variable guard). No scanner disposition or credential/history rewrite was performed; the findings are not claimed resolved. Main release still awaits all required checks and exact-SHA preview.

Main release receipt (2026-09-06)

Merged to main at 2f94edb after all four required checks passed for 89352f9. Exact-SHA preview dpl_9Zmpa9y7p7K9iZPKmiUEgExiUHXL is READY and its Nitro/storage health is ready. Vercel Security Checkpoint prevented browser rendering on that preview; the integrated local browser checks are recorded above. Production deployment is being verified separately.

[gitguardian]

⚠️ GitGuardian has uncovered 2 secrets following the scan of your pull request.

Please consider investigating the findings and remediating the incidents. Failure to do so may lead to compromising the associated services or software components.

🔎 Detected hardcoded secrets in your pull request

GitGuardian id	GitGuardian status	Secret	Commit	Filename
36831149	Triggered	Generic Password	93e2fff	remix/scripts/verify-app-suites.mjs	View secret
36961236	Triggered	Generic Password	6a4b330	remix/app/components/Settings/PasskeysManager.tsx	View secret

🛠 Guidelines to remediate hardcoded secrets

1. Understand the implications of revoking this secret by investigating where it is used in your code.
2. Replace and store your secrets safely. Learn here the best practices.
3. Revoke and rotate these secrets.
4. If possible, rewrite git history. Rewriting git history is not a trivial act. You might completely break other contributing developers' workflow and you risk accidentally deleting legitimate data.

To avoid such incidents in the future consider

• following these best practices for managing and storing secrets including API keys and other credentials
• install secret detection on pre-commit to catch secret before it leaves your machine and ease remediation.

---

^{🦉 GitGuardian detects secrets in your source code to help developers and security teams secure the modern development process. You are seeing this because you or someone else with access to this repository has authorized GitGuardian to scan your pull request.}