chore(deps): bump github/codeql-action from 3 to 4

Bumps [github/codeql-action](https://github.com/github/codeql-action) from 3 to 4.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/v3...v4)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-version: '4'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

.github/workflows/scorecard.yml

@@ -57,6 +57,6 @@ jobs:
           publish_results: true
 
       - name: Upload SARIF to code-scanning
-        uses: github/codeql-action/upload-sarif@v3
+        uses: github/codeql-action/upload-sarif@v4
         with:
           sarif_file: results.sarif

.github/workflows/semgrep.yml

@@ -47,7 +47,7 @@ jobs:
 
       - name: Upload SARIF (when present)
         if: hashFiles('semgrep.sarif') != ''
-        uses: github/codeql-action/upload-sarif@v3
+        uses: github/codeql-action/upload-sarif@v4
         with:
           sarif_file: semgrep.sarif
           category: semgrep

README.md

@@ -54,7 +54,46 @@ view, the Bus is the only legal way they talk. Subsystems live in
 single-purpose SPM packages; **18 boundary-gate scripts** keep the
 isolation honest.
 
-![Jarvis 2-Process Architecture Topology](docs/architecture.png)
+```mermaid
+flowchart TB
+    User[User<br/>voice / text / hotkey]
+
+    subgraph Swift["Swift host (AppKit + SwiftUI)"]
+        AppDel[AppDelegate<br/>install DAG + lifecycle]
+        Orch[AgentOrchestrator<br/>tool-loop + streaming]
+        Bridge[WebviewBridge<br/>typed JSON Bus]
+        Voice[Voice<br/>wake / STT / TTS]
+        Vision[Vision<br/>camera + frame-attach]
+        Memory[Memory<br/>SQLite + vec + mem0]
+        MCP[MCPRuntime<br/>helpers + in-proc tools]
+        Replay[Replay<br/>turn-by-turn audit log]
+        Boot[BootHealth<br/>NOT FAKED probes]
+    end
+
+    LLM["LLMProvider<br/>Anthropic Opus 4.7 / Ollama"]
+
+    subgraph Web["WKWebView (React + R3F)"]
+        Ring[Particle ring]
+        Chat[Chat panel]
+        DevOv[Dev Overlay]
+    end
+
+    User --> Voice
+    User --> Bridge
+    AppDel --> Vision
+    AppDel --> Orch
+    AppDel --> Voice
+    AppDel --> Boot
+    Voice --> Orch
+    Orch <--> LLM
+    Orch --> MCP
+    Orch --> Memory
+    Orch --> Vision
+    Orch --> Replay
+    Orch --> Bridge
+    Boot --> Bridge
+    Bridge <-->|Bus protocol| Web
+```
 
 The deep architecture doc is [`ARCHITECTURE.md`](ARCHITECTURE.md) (subsystem
 deep-dives, anti-patterns, navigation cheat sheet). The v1.0 typed-API
@@ -97,7 +136,21 @@ asserts the spawn-line ordering AND that `voiceInstallTask` awaits
 `agentInstallTask?.value` (a strictly stronger guarantee than spawn-order
 alone).
 
-![Jarvis Install Order Sequence](docs/install_order.png)
+```mermaid
+flowchart LR
+    Boot([applicationWillFinishLaunching]) --> Vision[installVision]
+    Boot --> Memory[installMemory]
+    Boot --> MCP[installMCP]
+    Boot --> Replay[installReplay]
+    Vision --> Agent[installAgent]
+    Memory --> Agent
+    MCP --> Agent
+    Replay --> Agent
+    Agent --> Voice[installVoice]
+    Voice --> Probes[registerBootHealthProbes]
+    Probes --> Bridge[Webview handshake]
+    Bridge --> Ready([HUD ready])
+```
 
 ## Build & run
 
@@ -163,7 +216,21 @@ subscribers that need it. If a subsystem is degraded, the orchestrator
 **injects a system-prompt preamble** so the agent doesn't promise to
 remember things the memory store can't actually persist.
 
-![Jarvis Agent Turn Lifecycle](docs/turn_lifecycle.png)
+```mermaid
+flowchart LR
+    In[User input<br/>text / voice transcript] --> Orch[AgentOrchestrator]
+    Health[BootHealth.rollup] -->|degradation preamble| Orch
+    Orch --> Provider[LLMProvider.stream]
+    Provider --> Events[(streaming events<br/>token / thinking / tool-use / stop)]
+    Events --> Bcast[Broadcaster<br/>single consumer]
+    Bcast --> Tx[Transcript]
+    Bcast --> Mem[Memory extractor]
+    Bcast --> Dev[DevOverlay]
+    Bcast --> Voice[Voice / TTS]
+    Bcast --> Bus[WebviewBridge → HUD]
+    Orch --> Tools[MCP tool calls]
+    Tools --> Provider
+```
 
 ## Boot-health probes
 
@@ -174,7 +241,32 @@ failures turn the menu-bar icon **red**, raise a non-dismissible HUD
 banner, and inject the degradation preamble into the agent's system
 prompt.
 
-![Jarvis Boot-Health Probe Ladder](docs/boot_health.png)
+```mermaid
+flowchart LR
+    M[MemoryBootHealthProbe<br/>vec0 + FTS5 reachable]
+    A[AnthropicBootHealthProbe<br/>keychain has API key]
+    O[OllamaBootHealthProbe<br/>service reachable + model loaded]
+    Vc[VoiceBootHealthProbe<br/>audio graph alive]
+    Vi[VisionBootHealthProbe<br/>AVCapture authorized]
+    Mc[MCPBootHealthProbe<br/>helper apps + in-proc tools]
+    R[ReplayBootHealthProbe<br/>WAL writable]
+    W[WebviewBootHealthProbe<br/>handshake completed]
+    Roll[BootHealthOrchestrator.rollup]
+    Icon[Menu-bar icon<br/>red on critical]
+    Banner[Non-dismissible banner]
+    Pre[Agent system-prompt<br/>degradation preamble]
+    M --> Roll
+    A --> Roll
+    O --> Roll
+    Vc --> Roll
+    Vi --> Roll
+    Mc --> Roll
+    R --> Roll
+    W --> Roll
+    Roll --> Icon
+    Roll --> Banner
+    Roll --> Pre
+```
 
 ## Project culture