Repository closeout: main-only integration, gate-free workflows, bug hunt, #10 and #17 delivery

[DingDingChae]

🧹 Repository closeout: main-only integration, gate-free workflows, bug hunt, #10 and #17 delivery

Scope · 範圍

This task integrates and cleans the repository, removes every code-quality gate from GitHub Actions per the owner's standing decision, hunts and repairs bugs across the whole product, and delivers the two open feature issues.

今次任務會整合同清理個倉庫，按倉主嘅長期決定拆走 GitHub Actions 入面所有測試同 lint 關卡，成個產品由頭到尾搵蟲修蟲，仲要交付兩個開緊嘅功能 issue。蟲唔會自己走，人要去請佢走。

Baseline · 起點 (verified read-only, 2026-09-14)

Fact	Value
Remote main	a4a29eba
Non-main remote branches	19, every tip already an ancestor of main with 0 unique commits
Branches still wired into workflows or policy docs	dev, dev2-go, preview
Workflows still running tests, typecheck or lint	ci.yml, go-ci.yml, gui-preview.yml, service-lifecycle.yml, react-doctor.yml, issue-quality-tests.yml
Open work	#10, #17, PR #16 (its head is already contained in main)

Plan · 計劃

• Fast-forward the local checkout to main and set the commit identity
• Baseline checks: typecheck, root tests, GUI tests and lint, privacy scan, Go build, vet and test
• Lane RC: main becomes the only integration branch; workflow branch filters, enforce-pr-target, the release.yml preview channel, AGENTS.md, CONTRIBUTING.md and MAINTAINERS.md updated; every test, typecheck, lint, vet, race-detector and doctor step removed from GitHub Actions; Windows-only build matrix
• Lane L: replace the remaining placeholder usernames in two GUI test fixtures
• Lane F10: security review, price re-verification against dated first-party sources, real Windows capture, then close Add GitHub Copilot Desktop client support and correct API pricing #10
• Lane F17: Go parity slices (core lifecycle, Windows service, management API, headless CLI, updater), then close [dev2-go] Port proxy lifecycle, management API, and CLI contracts from PR #16 #17
• Bug hunt: a 14-lens finder, refuter and repair pass; every accepted finding is fixed with a red-then-green regression
• Records: README, docs, FEATURE-INVENTORY, CHANGELOG, HANDOFF, ROADMAP, wiki
• Archive the repository to the owner's backup location and verify the archive
• Cleanup: delete the 19 merged remote branches and the task worktrees only after fresh ancestry proof

Note

Every step above is unverified until a comment below says otherwise, with the exact commit and check results. This issue carries the handoff for the whole task.

上面每一步，未有留言講明 commit 同檢查結果之前，都係「未證實」。整個任務嘅交接記錄都放喺呢個 issue。

[DingDingChae]

🚀 In progress · 開工

• Started: 2026-09-14T12:39:19-04:00
• Attempting now: fast-forward the primary checkout to main (a4a29eba), set the commit identity, run the baseline checks, then open one linked worktree per lane (RC, L, F10, F17, and the bug-hunt finders) on task/* branches.
• Where the work lives: the primary checkout on main plus linked worktrees on the owner's machine, one per lane, each on its own task/* branch; integration happens on main one lane at a time.

而家先將本地 checkout 推前到 main（a4a29eba），設定好 commit 身份，跑一輪基準檢查，然後每條 lane 開一個 worktree 各自做各自，最後逐條合返入 main。開工咯。

[DingDingChae]

🧭 Records linked · 紀錄連結

• Progress thread: Progress: repository closeout, gate-free workflows, bug hunt, #10 and #17 delivery (2026-09-14) #44
• Changelog thread for this build series: Changelog: main-only integration and closeout build series (from 2026-09-14) #45
• Project: https://github.com/orgs/Ding-Ding-Projects/projects/41 (task item In Progress)

Phase 0 verified: local main fast-forwarded to a4a29eba, commit identity set, dependencies installed, tree clean. Baseline checks running; their verdicts are not claimed until they land.

前置工作完成，基準檢查跑緊。

[DingDingChae]

🛑 Handed off: early closeout at the owner's request · 提前收尾交接

Started	2026-09-14T12:39:19-04:00
Stopped	2026-09-14T15:38:21-04:00 (owner requested an early, preservation-first closeout at 15:08)
Elapsed	about 2 h 59 min
main moved	a4a29eba → 80c8892f today; the closeout's final stretch 292cde78 → 80c8892f is 31 commits, 73 files changed, 3166 insertions(+), 1337 deletions(-)
Task state	not complete; everything below that says landed is verified, everything else is preserved and named

✅ Landed on main and verified

• Main-only integration policy with build-only GitHub Actions (merge 9f4b737e): AGENTS.md, CONTRIBUTING.md, MAINTAINERS.md, structure/06_docs-and-release.md; ci.yml, go-ci.yml, gui-preview.yml trigger on main only with no test, typecheck, lint, vet, race or e2e steps; enforce-pr-target.yml allows only main; release.yml loses the preview channel and gains a working DRY_RUN binding; service-lifecycle.yml, react-doctor.yml, issue-quality-tests.yml deleted. Contract tests tests/ci-workflows.test.ts, tests/release-helper.test.ts, tests/squirrel-events.test.ts, tests/release-workflow-contract.test.ts: 99 pass on the lane tip and green again inside the merged-tip run below. Accepted trade, stated plainly: a release can ship from a commit whose tests would have failed.
• Defect hunt, 14 lenses: finders wrote red regressions, independent refuters voted, repair lanes fixed each accepted finding red-then-green. 23 repairs are on main (HANDOFF.md's top entry lists them); highlights: the Windows fsync helper (1611 ms → 222 ms per atomic write, zero PowerShell spawns), atomic scheduling-secrets writes, unique config backup names, malformed Content-Length rejected with 400, ACL hardening soft-fails made visible, GUI bundle split from one 2,965 kB chunk into 52 (largest 861 kB), DST-safe usage day grid, IME composition guard on eight inputs.
• Pricing catalog re-verified against dated sources (45 rows, 7 corrected); fixture usernames that matched a private term scrubbed from two test files; the tracked-file scan now reports only the ordinary words robots (a sitemap file) and a Heap type name.
• Records: HANDOFF.md top entry and ROADMAP.md checklist (4d9106dc, 80c8892f).

🧪 Verification on the merged tip 4e47f6d7 (the two later commits touch only Markdown)

Check	Result
bun run test over the 32 touched suites (every tests/hunt-* plus their siblings and the 4 workflow contract files)	526 pass, 0 fail, 2,710 assertions, 44 s
bun x tsc --noEmit	clean
gui: bun test over the 3 touched suites	13 pass, 0 fail
gui: bun x tsc -b	clean
EDGE-01 remainder: combo-child-headers, effort-policy, forward-admission-separation, openai-api-virtual-models, openai-provider-option-e2e, server-auth	142 pass, 1 fail; the failure is server-auth.test.ts:575 pinning /healthz to eight keys while the payload has carried coordinator since 59af04c6 (2026-08-21), so it was red before this pass and is unrelated to the Content-Length change

🚀 Releases

Push	Run	State
4e47f6d7	https://github.com/Ding-Ding-Projects/opencodex/actions/runs/34886369818	completed, success, build-257 published
4d9106dc	https://github.com/Ding-Ding-Projects/opencodex/actions/runs/34886691576	completed success at handoff
80c8892f	https://github.com/Ding-Ding-Projects/opencodex/actions/runs/34887213660	in_progress at handoff

🧷 Preserved unfinished (pushed, not merged)

task/fix-sec-01 4e1744dc (Copilot scoped API key selection; last 6-file batch untriaged), task/fix-l10n-01 c040c56e (half the finding; no tests run), task/fix-rel-02 bdb66e42 (concurrency fix proven; rewritten attribution test fails on a root-path mismatch), task/go-baseline-red fb3bde78 (17 green Go fixes across 9 packages; internal/server owes two; needs go build, go vet, go test ./... on a merged tip).

🧹 Cleanup (after a verified backup)

• Backup: opencodex-20260914T191941Z.7z in the owner's OneDrive backup folder, 6,682 files, 333,364,926 bytes, 7z t exit 0, containing .git (13 pack entries, 606 worktree metadata entries), every tracked file and every untracked-not-ignored file; 39,620 ignored paths excluded by .gitignore.
• Deleted after fresh git merge-base --is-ancestor proof against the pushed main: the 19 pre-existing non-main branches (dev, dev2-go, preview, ladder/upstream-v2.8.0, the codex/*, claude/*, feat/* and worktree-wf_* branches, preserve/proxy-start-supervision, settings-drafts-repair), 25 task-owned lane branches with their worktrees, and 4 local-only empty branches. PR fix(proxy): recover lifecycle and retire the legacy dashboard #16 was closed first with its own ancestry proof.
• Retained, with the reason: 13 hunt/* finder branches (regression-only tips, not ancestors), task/copilot-security-review, the four checkpoint branches above, and six lane branches whose tips are not ancestors because their content reached main as re-authored commits (see the incident below): task/fix-int-02, task/fix-rel-01, task/fix-edge-03, task/fix-perf-03, task/fix-ops-01, task/scrub-public-wording. Nothing uncommitted anywhere; stash empty.

⚠️ Incident: commit identity

The app's own state-history code (src/lib/state-history.ts:247) rewrote the repository's .git/config identity to opencodex state history <state-history@localhost> while tests ran in linked worktrees. Two commits on main carry that identity and are left as they are because fixing them means rewriting main: 49223d88 and 292cde78. Every later commit was made with an explicit author and committer environment. The exact test path that triggers the rewrite is not isolated. Related lesson: git stash is shared across linked worktrees and crossed three times between concurrent lanes; nothing was lost.

📌 Open for the next owner

1. Isolate and fix the state-history config rewrite; decide whether 49223d88 and 292cde78 are ever re-authored.
2. Finish and merge the four checkpoint branches.
3. Stale pins and pre-existing red tests: server-auth.test.ts:575 (/healthz keys), uninstall.test.ts:52, codex-shim.test.ts (refreshCodexShimRuntime not imported), codex-catalog-sync-hardening.test.ts, cli-start-journal-order.test.ts, the prepare-release-assets.test.ts fixture's bare tar, count-lines-attribution.test.ts.
4. handleEnsure() is unguarded the way handleStart() was; go/internal/config/recovery.go:13-24 has the backup-name collision fixed in TypeScript.
5. Issue Add GitHub Copilot Desktop client support and correct API pricing #10 closure capture and checklist; issue [dev2-go] Port proxy lifecycle, management API, and CLI contracts from PR #16 #17 Go parity slices; docs-site contributing pages (5 locales) and gui/src/docs/generated-articles.ts still describe the old branch policy; CHANGELOG, README and wiki refresh for this pass.
6. Historical commit messages (24 commits, oldest from July) contain private wording; only a history rewrite could change them, so they stay unless the owner decides otherwise.

倉庫擁有者 15:08 叫停，提前收尾。落咗 main 並且驗證過：只用 main 嘅政策加純 build 嘅 GitHub Actions、23 個修蟲（每個都有先紅後綠嘅回歸測試）、價目表重新核對、紀錄檔更新。合併後 tip 跑 32 個測試檔 526 pass 0 fail，GUI 13 pass，兩邊 typecheck 乾淨。四條未完成 lane 各自 push 做 checkpoint，冇合入。備份先做好（333 MB，7z t 通過），先刪 19 條舊分支同 25 條 lane 分支連 worktree，24 條非祖先分支保留並逐條講明原因。Commit 身份出過事：兩個 main commit 帶錯身份，唔改寫歷史就改唔到，如實記低。任務未完成，剩低嘢列晒喺上面。