ci(actions): make Typecheck step blocking

PR #165 fixed the one real strict-undefined error in SegmentedRing.tsx; the other ~30 errors reported in CI run 25797533005 were downstream of `TS2307: Cannot find module '@jarvis/bus'` and resolve automatically once `scripts/build-webview.sh` produces the bus package's `dist/index.d.ts` (which CI already runs before typecheck). Removes `continue-on-error: true` from the Typecheck step so typecheck regressions block CI going forward. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
2026-05-13 07:37:26 -05:00
75 changed files with 111 additions and 1536 deletions
@@ -117,28 +117,11 @@ jobs:

  swift-packages:
    name: SPM ${{ matrix.package }}
-    # Self-hosted on Grogu (labels: self-hosted, macOS, ARM64, jarvis) per #180.
-    # The github-hosted macos-15 pool was the rate-limiting step for v0.1:
-    # 13 matrix jobs + 1 app-build job all needed macOS slots, GitHub
-    # scheduled them 1-3 at a time, and total wall-clock was ~1-2h per run
-    # versus actual work of <10m. Self-hosted eliminates the queue.
-    runs-on: [self-hosted, macOS, jarvis]
-    # Security gate: self-hosted runners + public repo would let a fork PR
-    # execute arbitrary code on this machine. Push events only ever come from
-    # maintainers (branch protection blocks unauthorized writes). PRs are
-    # only allowed onto the self-hosted runner when they originate from a
-    # branch on this same repo (i.e., not a fork). Also gates manual dispatch.
-    if: |
-      github.event_name == 'push' ||
-      github.event_name == 'workflow_dispatch' ||
-      (github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository)
+    runs-on: macos-15
    needs: [webview]
    strategy:
      fail-fast: false
      matrix:
-        # VoiceLog removed: no `packages/VoiceLog` directory exists in the
-        # repo. The matrix entry was a phantom that failed with `chdir error:
-        # No such file or directory`. Voice-log work tracked under v1.1.
        package:
          - AgentCore
          - Bus
@@ -153,84 +136,26 @@ jobs:
          - Shell
          - Vision
          - Voice
+          - VoiceLog
    steps:
-      # Grogu is a shared workstation, not an ephemeral VM. Interactive
-      # Xcode test sessions, debugging, or aborted `swift test` runs can
-      # leave orphan xctest/swift-test/swift-driver processes around for
-      # hours, holding Mach services + sockets + ports that a new
-      # WKWebView mount or test-target launch then blocks on (observed:
-      # AgentCore hung 34min on develop CI 25824607025 with 6 zombie
-      # xctests aged 22-24h from prior interactive use).
-      #
-      # Age filter (>= 1 hour): Grogu now has SIBLING runners
-      # (Grogu-jarvis, -2, -3) so concurrent CI jobs can be in flight
-      # simultaneously. CI jobs complete in <10 min, so a 1-hour cutoff
-      # safely reaps interactive-use orphans without killing concurrent
-      # CI work on sibling runners. `ps -o etime` formats: `MM:SS`
-      # (<1h, skip), `HH:MM:SS` (>=1h, kill), `DD-HH:MM:SS` (days, kill).
-      # github-hosted VMs start clean, so this step is gated to self-hosted.
-      - name: Reap orphan xctest/swift-test processes older than 1h (self-hosted only)
-        if: runner.environment == 'self-hosted'
-        run: |
-          age_filter='/(xctest|swift-test|swift-driver)$/ && !/awk/ && (match($2, /-/) || match($2, /[0-9]+:[0-9]+:[0-9]+/)) {print $1}'
-          /bin/ps -A -o pid,etime,comm \
-            | awk "$age_filter" \
-            | xargs -r -I{} kill -TERM {} 2>/dev/null || true
-          sleep 2
-          /bin/ps -A -o pid,etime,comm \
-            | awk "$age_filter" \
-            | xargs -r -I{} kill -9 {} 2>/dev/null || true
-          echo "Surviving xctest/swift-test processes (any age — includes concurrent CI work on sibling runners):"
-          /bin/ps -A -o pid,etime,comm | grep -E '(xctest|swift-test|swift-driver)$' || echo "  (none)"
      - uses: actions/checkout@v4
-      # Project targets macOS 26 Tahoe + Swift 6.2/6.3. Xcode 16 (Swift 6.0)
-      # cannot parse `mlx-audio-swift` v0.1.2's `swift-tools-version:6.2`,
-      # lacks the `withThrowingTaskGroup` overload used by MCP `swift-sdk`
-      # 0.12.0, and rejects `@MainActor` XCTestCase `super.setUp()` patterns
-      # that Swift 6.1+ accepts. The first two paths cover github-hosted
-      # macos-15 (which ships Xcode 26.3); the bare `Xcode.app` fallback
-      # covers self-hosted runners with whatever local Xcode 26.x is the
-      # default (Grogu currently has 26.5). Using DEVELOPER_DIR (per-process)
-      # rather than `sudo xcode-select -s` (system-wide, needs passwordless
-      # sudo on self-hosted) — both paths respect DEVELOPER_DIR identically.
      - name: Select Xcode
-        run: |
-          for path in \
-            /Applications/Xcode_26.3.app/Contents/Developer \
-            /Applications/Xcode_26.app/Contents/Developer \
-            /Applications/Xcode.app/Contents/Developer; do
-            if [ -d "$path" ]; then
-              echo "DEVELOPER_DIR=$path" >> "$GITHUB_ENV"
-              echo "Using Xcode at: $path"
-              exit 0
-            fi
-          done
-          echo "No Xcode 26.x found in any expected path" >&2
-          exit 1
+        run: sudo xcode-select -s /Applications/Xcode_16.app/Contents/Developer || sudo xcode-select -s /Applications/Xcode.app/Contents/Developer
      - name: Show Swift toolchain
        run: |
          swift --version
          xcodebuild -version
      # Download the production webview bundle so Bus + downstream packages
-      # (AgentCore / Harness / MCP / Voice) can mount a real WKWebView with
-      # a working JS bridge. Without this, BusTests fail with `Error: bus
-      # not mounted` because index.html + the JS bundle are missing from
-      # App/Resources/webview/.
+      # (AgentCore / Harness / MCP / Voice / VoiceLog) can mount a real
+      # WKWebView with a working JS bridge. Without this, BusTests fail
+      # with `Error: bus not mounted` because index.html + the JS bundle
+      # are missing from App/Resources/webview/.
      - name: Download webview resources
        uses: actions/download-artifact@v4
        with:
          name: webview-resources
          path: App/Resources/webview/
-      # actions/cache@v4 restores the package's `.build/` and SwiftPM's
-      # global cache. On github-hosted this is a real perf win; on self-hosted
-      # it's both unnecessary (the _work/ dir persists between jobs naturally)
-      # and actively harmful (caches saved on github-hosted have absolute
-      # paths like /Users/runner/work/Jarvis/.../onnxruntime.xcframework
-      # baked into .build/artifacts, which don't resolve on Grogu and break
-      # Voice + Harness with "XCFramework Info.plist not found"). Restrict
-      # the cache action to github-hosted only.
-      - name: Cache SPM build artifacts (github-hosted only)
-        if: runner.environment == 'github-hosted'
+      - name: Cache SPM build artifacts
        uses: actions/cache@v4
        with:
          path: |
@@ -239,38 +164,6 @@ jobs:
          key: spm-${{ matrix.package }}-${{ runner.os }}-${{ hashFiles(format('packages/{0}/Package.resolved', matrix.package), format('packages/{0}/Package.swift', matrix.package)) }}
          restore-keys: |
            spm-${{ matrix.package }}-${{ runner.os }}-
-      # On self-hosted (Grogu) the runner is a LaunchAgent with no UI session,
-      # so SecItemAdd against the locked login keychain returns
-      # errSecInteractionNotAllowed (-25308). Use a pre-created dedicated
-      # keychain `jarvis-runner.keychain-db` (one-time setup on Grogu) and
-      # prepend it to the user search list for this run so test SecItemAdd
-      # calls without an explicit keychain target write there. github-hosted
-      # bakes its own unlocked keychain into the runner image and skips this.
-      - name: Unlock runner keychain (self-hosted only)
-        if: runner.environment == 'self-hosted'
-        env:
-          KEYCHAIN_PASSWORD: ${{ secrets.JARVIS_RUNNER_KEYCHAIN_PASSWORD }}
-        run: |
-          KEYCHAIN_PATH="$HOME/Library/Keychains/jarvis-runner.keychain-db"
-          if [ ! -f "$KEYCHAIN_PATH" ]; then
-            echo "FATAL: runner keychain missing at $KEYCHAIN_PATH" >&2
-            echo "  Create with: security create-keychain -p \"\$KEYCHAIN_PASSWORD\" \"$KEYCHAIN_PATH\"" >&2
-            exit 1
-          fi
-          security unlock-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
-          # NOTE: do NOT re-run `set-keychain-settings` here — the Security
-          # framework requires user interaction for that operation even with
-          # the keychain unlocked, and the LaunchAgent has no UI. The
-          # settings (no-timeout, no-lock-on-sleep) were applied once at
-          # keychain-creation time and persist; we just need to unlock.
-          security list-keychains -d user -s "$KEYCHAIN_PATH" "$HOME/Library/Keychains/login.keychain-db"
-          # On the legacy file-based macOS keychain, SecItemAdd writes to the
-          # user's DEFAULT keychain — the search list only determines read
-          # order. Changing list-keychains alone leaves SecItemAdd targeting
-          # login.keychain-db (locked, returns -25308). Also redirect the
-          # default. SIDE EFFECT documented in CLAUDE.md: this is persistent
-          # for james.maes's user prefs.
-          security default-keychain -d user -s "$KEYCHAIN_PATH"
      - name: swift test
        run: swift test --package-path packages/${{ matrix.package }}

@@ -280,30 +173,11 @@ jobs:
    needs: [boundary-gates, webview]
    steps:
      - uses: actions/checkout@v4
-      # Same Xcode 26.x pin as swift-packages — Xcode 16 cannot resolve
-      # mlx-audio-swift's swift-tools-version:6.2 manifest.
      - name: Select Xcode
-        run: sudo xcode-select -s /Applications/Xcode_26.3.app/Contents/Developer || sudo xcode-select -s /Applications/Xcode_26.app/Contents/Developer
+        run: sudo xcode-select -s /Applications/Xcode_16.app/Contents/Developer || sudo xcode-select -s /Applications/Xcode.app/Contents/Developer
      - name: Install xcodegen
        run: brew install xcodegen
-      # pnpm + node need to be on PATH because Xcode.app's project has a
-      # build-phase script (Script-4B80D79B2A0254274258618C.sh) that calls
-      # scripts/build-webview.sh during the build itself. Even though we
-      # download the prebuilt artifact below, the build phase still runs
-      # and re-stamps the bundle — and would error with
-      # "[build-webview] FATAL: pnpm not found on PATH" without these.
-      - name: Setup pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 10.30.2
-      - name: Setup Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: "20"
-          cache: "pnpm"
-          cache-dependency-path: webview/pnpm-lock.yaml
      # Reuse the webview build from the upstream job rather than rebuilding.
-      # The Xcode build phase will re-stamp these on top.
      - name: Download webview resources
        uses: actions/download-artifact@v4
        with:
@@ -431,51 +305,3 @@ jobs:
          fi
          git tag -a "$TAG" -m "Automated tag from CI for $GH_REF"
          git push origin "$TAG"
-      # GitHub Actions GITHUB_TOKEN cannot trigger downstream workflows. The
-      # separate `release.yml` workflow listens for `push: tags:` events but
-      # never sees a CI-pushed tag — observed on v0.1.0-dev.50 (tag created,
-      # Release object missing, had to be manually created). Create the
-      # Release object directly here in the same job so the Releases page
-      # reflects CI-pushed tags without a manual step. `release.yml` stays
-      # as a fallback for manually-pushed tags (which CAN trigger workflows).
-      - name: Create GitHub Release
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          TAG: ${{ steps.version.outputs.tag }}
-          PRERELEASE: ${{ steps.version.outputs.prerelease }}
-          RUN_URL: ${{ format('https://github.com/{0}/actions/runs/{1}', github.repository, github.run_id) }}
-        run: |
-          set -euo pipefail
-          if ! git rev-parse "refs/tags/$TAG" >/dev/null 2>&1; then
-            echo "Tag $TAG not present locally; nothing to release." >&2
-            exit 0
-          fi
-          if gh release view "$TAG" >/dev/null 2>&1; then
-            echo "Release $TAG already exists — skipping create (idempotent)."
-            exit 0
-          fi
-          prev=$(git tag --list 'v*' --sort=-v:refname | grep -v "^${TAG}$" | head -n 1 || true)
-          notes_file=$(mktemp)
-          {
-            echo "## Changes"
-            echo
-            if [ -n "$prev" ]; then
-              git log --pretty='format:- %s (%h)' "${prev}..${TAG}"
-            else
-              git log --pretty='format:- %s (%h)' -20
-            fi
-            echo
-            echo
-            echo "## Verification"
-            echo
-            echo "- CI build: $RUN_URL"
-            echo "- Boundary gates, webview, app-build, 13/13 SPM packages: all green on this commit"
-          } > "$notes_file"
-          flag=()
-          if [ "$PRERELEASE" = "true" ]; then
-            flag+=("--prerelease")
-          fi
-          gh release create "$TAG" \
-            --title "$TAG" \
-            --notes-file "$notes_file" \
-            "${flag[@]}"
@@ -64,7 +64,7 @@ The top-level shape is fixed and agreed. Push back with specific reasoning only
  - New tokenizer produces ~35% more tokens than Opus 3.x for the same text. Instrument token budgets accordingly; cap `tool_result` content at 8 KB.
  - Cache TTL default is 5 minutes ephemeral. For 1-hour TTL, pass `ttl: "1h"` explicitly on `cache_control` blocks **AND** include the request header `anthropic-beta: extended-cache-ttl-2025-04-11`. Without the beta header, 1h is silently ignored. Verify via DevOverlay watching `cache_creation_input_tokens` vs `cache_read_input_tokens` per turn.
  - Tool-use and extended thinking both stream; the SSE parser must handle `content_block_start` with `input_json_delta` for tool args. Close on `message_stop`, not `message_delta`; swallow `ping`; route `thinking_delta` to its own case; treat `stop_reason: "refusal"` as first-class; emit `partial_tool_use_at_disconnect` on mid-delta termination.
- **Ollama caveat:** as of April 2026, Qwen 3 / 3.5 / Gemma 4 tool-calling is broken in Ollama — confirmed via live issue tracker (ollama/ollama#14493 Qwen 3.5 27B non-functional; #14601 Qwen3 malformed tool defs via `/api/chat`; #14745 qwen3.5:9b print-not-execute; #15315 Gemma 4 tool parser). Root cause: Ollama's renderer/parser maps Qwen 3.5 through a Hermes-style JSON pipeline, but the model was trained on Qwen3-Coder XML format; unclosed `<think>` tags corrupt multi-turn. **Known-good local tool-calling baseline: `qwen2.5-coder:32b-instruct-q8_0`** (the variant pinned by `ModelID.qwen25coder32b`; vanilla `qwen2.5-coder:32b` is not used). Qwen3 stays disabled as opt-in until upstream closes these issues. Llama 4 with the `llama4_pythonic` parser is worth testing but not yet trusted. Document the local model in use alongside every eval run.
+- **Ollama caveat:** as of April 2026, Qwen 3 / 3.5 / Gemma 4 tool-calling is broken in Ollama — confirmed via live issue tracker (ollama/ollama#14493 Qwen 3.5 27B non-functional; #14601 Qwen3 malformed tool defs via `/api/chat`; #14745 qwen3.5:9b print-not-execute; #15315 Gemma 4 tool parser). Root cause: Ollama's renderer/parser maps Qwen 3.5 through a Hermes-style JSON pipeline, but the model was trained on Qwen3-Coder XML format; unclosed `<think>` tags corrupt multi-turn. **Known-good local tool-calling baseline: `qwen2.5-coder:32b`.** Qwen3 stays disabled as opt-in until upstream closes these issues. Llama 4 with the `llama4_pythonic` parser is worth testing but not yet trusted. Document the local model in use alongside every eval run.
 - **Ollama transport gotcha:** `/api/chat` (native NDJSON) emits `tool_calls` on the chunk **preceding** the `done: true` terminator, not with it. Decoder must read `tool_calls` whenever seen and never gate on `done`. Separate decoders for `/api/chat` vs `/v1/chat/completions` (OpenAI-compat SSE with atomic `tool_calls`).
 - **Tool-choice discipline:** `LLMProvider.stream(..., toolChoice:)` is mandatory. Cap-recovery "one more call" sets `.none` (Anthropic: `{type: "none"}`; Ollama: drop `tools` array entirely). Eval asserts zero `.toolUseRequested` on recovery call.

@@ -87,7 +87,7 @@ The top-level shape is fixed and agreed. Push back with specific reasoning only
 **Memory stack:**
 - **Store:** SQLite with **FTS5** (keyword search) + **sqlite-vec** extension (vector search), single file under `~/Library/Application Support/Jarvis/`.
 - **Embeddings:** `nomic-embed-text` via Ollama (local, free, 768-dim).
- **Extraction:** mem0's `ADD / UPDATE / NOOP` pattern — after each turn, a local extractor (`qwen3.6:latest` via Ollama, per commit `8d0a959`) decides what facts to commit/update/ignore. **Fully local; no user data ever leaves the machine for memory.**
+- **Extraction:** mem0's `ADD / UPDATE / NOOP` pattern — after each turn, a local extractor (Qwen 2.5-Coder 32B via Ollama) decides what facts to commit/update/ignore. **Fully local; no user data ever leaves the machine for memory.**
 - **Temporal validity:** record `valid_from` / `valid_to` on facts (Zep/Graphiti style) so "Sarah works at Acme" can be superseded without deleting history.
 - **Scope tiers:** `UserDefaults` for trivial prefs, JSON for tool configs/feature flags, SQLite for everything conversational.
 - Secrets (API keys) → macOS **Keychain**, never plaintext, never checked in.
@@ -227,7 +227,7 @@ Codesign + entitlement verification: `bash scripts/verify-entitlements.sh --pre-

 ```bash
 JARVIS_REAL_MODELS=1 swift test --package-path packages/Memory --filter MemoryRegressionCorpusTests
-# requires: local Ollama with nomic-embed-text + qwen3.6:latest (extractor) + qwen2.5-coder:32b-instruct-q8_0 (agent fallback) + loadable vec0.dylib
+# requires: local Ollama with nomic-embed-text + qwen2.5-coder:32b + loadable vec0.dylib

 JARVIS_REAL_CAMERA=1 swift test --package-path packages/Vision --filter CameraCaptureRealHardwareTests
 # requires: real AVCaptureDevice + .authorized TCC
@@ -236,21 +236,7 @@ JARVIS_REAL_MODELS=1 swift test --package-path packages/Voice --filter OrpheusTT
 # requires: ~6 GB Orpheus weights downloaded; produces empirical TTFA measurement
 ```

-Eval harness (Anthropic + local-model eval matrix; corpus in `.planning/evals/`) — pinned to `qwen2.5-coder:32b-instruct-q8_0` for the local-model lane (matches `ModelID.qwen25coder32b`).
-
-### Self-hosted CI runner (Grogu)
-
-`swift-packages` matrix in `.github/workflows/ci.yml` runs on a self-hosted macOS runner (`Grogu-jarvis`, labels `[self-hosted, macOS, ARM64, jarvis]`) rather than the github-hosted `macos-15` pool — the public pool was the v0.1 rate-limiter (1–2h queues for 13-job matrix). See #180.
-
- **Where it lives:** `~/actions-runner-jarvis/` on Grogu. `_work/` symlinked to `/Volumes/HD-2/jarvis-runner-work/` (1.3 TB) to keep boot-disk pressure off.
- **Service:** launchd LaunchAgent `actions.runner.KofTwentyTwo-Jarvis.Grogu-jarvis` (`~/Library/LaunchAgents/`). Manage with `cd ~/actions-runner-jarvis && ./svc.sh {status,start,stop}`. Only runs while user is logged in.
- **Security gate:** the job's `if:` clause blocks fork PRs from triggering it — push, workflow_dispatch, and same-repo PRs only. Belt-and-suspenders: enable "Require approval for all outside collaborators" under Settings → Actions → General.
- **Still on github-hosted `macos-15`:** `app-build` (the xcodebuild app target) and the `real-hardware` opt-in lane. Move opportunistically once the swift-packages path is proven.
- **Xcode selection:** uses `DEVELOPER_DIR` env (per-process), tries `Xcode_26.3.app` → `Xcode_26.app` → `Xcode.app` in order. Grogu currently has Xcode 26.5 at the bare path.
- **Cache:** the `actions/cache@v4` step is gated to `runner.environment == 'github-hosted'`. Self-hosted relies on the persistent `_work/` dir on HD-2 (and SwiftPM's natural `.build/` reuse) instead. Github-hosted caches bake absolute `/Users/runner/...` paths into `.build/artifacts/onnxruntime.xcframework` and other XCFrameworks, which Grogu cannot resolve — restricting the cache action keeps these caches strictly per-environment.
- **Runner keychain** (`~/Library/Keychains/jarvis-runner.keychain-db`): created once on Grogu with password `grogu-jarvis-ci` (also stored as repo secret `JARVIS_RUNNER_KEYCHAIN_PASSWORD`). The LaunchAgent has no UI session, so `SecItemAdd` against a locked login keychain returns `errSecInteractionNotAllowed (-25308)`. CI unlocks `jarvis-runner.keychain-db`, prepends it to the user search list, AND sets it as the user's default keychain before `swift test`. The default-keychain step is necessary because on the legacy file-based macOS keychain, `SecItemAdd` writes to the user's *default* keychain (not the first writable in the search list). **Side effects on interactive use:** (1) `jarvis-runner.keychain-db` sits first in your user search list, and (2) it is also your default keychain — so `SecItemAdd` calls *without* an explicit keychain target write there instead of `login.keychain-db`. Apps that target login keychain explicitly (most do) are unaffected. To undo: `security default-keychain -d user -s ~/Library/Keychains/login.keychain-db && security list-keychains -d user -s ~/Library/Keychains/login.keychain-db`.
- **When Grogu reboots or sleeps**, the LaunchAgent restarts on login but jobs queued during downtime will sit waiting. For long offline windows, push to a branch other than develop or temporarily revert `runs-on:` to `macos-15`.
- **Process hygiene:** the workflow's first step on self-hosted is a `Reap orphan xctest/swift-test processes older than 1h` cleanup. Grogu is a shared workstation — interactive Xcode test runs, aborted `swift test`, or debugger sessions can leak `xctest` / `swift-test` / `swift-driver` processes that hold Mach services + sockets and cause subsequent CI jobs to deadlock (observed: AgentCore hung 34 min on a develop run when 6 such zombies aged 22–24h were present). The age filter (≥1h) keeps concurrent CI work on sibling runners safe (jobs complete in <10 min).
+Eval harness (Anthropic + local-model eval matrix; corpus in `.planning/evals/`) — pinned to `qwen2.5-coder:32b` for the local-model lane.

 # CLAUDE.md

@@ -1,28 +1,18 @@
-# Handoff — 2026-05-13: v0.1 shipped + CI green push
+# Handoff — 2026-05-13: v0.1 shipped

-**Session window:** 2026-05-12 evening fan-out → 2026-05-13 morning merge sequence → 2026-05-13 afternoon CI-green push
+**Session window:** 2026-05-12 evening fan-out → 2026-05-13 morning merge sequence
 **Branch:** `develop`, clean
-**HEAD at write time:** `16bed160` — `ci(actions): restore pnpm + node setup on app-build for Xcode build phase (#173)`
+**HEAD:** `f6637ec3` — `ci(actions): fix typecheck/build order + share webview artifact across jobs (#161)`
 **Open PR count:** 0
 **Repo visibility:** flipped from PRIVATE → **PUBLIC** at start of session
-**CI canonical surface:** GitHub Actions (CircleCI webhook removed from this repo only)

 ---

-## TL;DR
+## What shipped

- **v0.1 code is fully merged** — every audit-finding issue from the 2026-05-12 audit corpus has a fix on develop. 22 audit-finding issues + #51 B-06 + #63 stash triage = **23 issues closed**.
- **CI infrastructure required a separate fight** — 8 follow-up PRs after the initial Lane I workflow landed, surfacing layer after layer of macOS-15 runner / Xcode 26 / SQLite-on-Xcode-26 / xcodebuild build-phase issues. All resolved.
- **First publish-tag is pending** — CI run on `16bed160` is in flight at write time. Once green, the workflow will create `v0.1.0-dev.<run_number>` as a pre-release.
- **Visibility flipped public**, branch protection on develop active (no force-push, no deletion, PR required), Dependabot alerts on track to auto-close.
+**v0.1 milestone is fully merged.** 9 lane PRs + 1 CVE fix + 1 Dependabot batch + 1 CI workflow fix = **12 PRs landed** since yesterday's `ba42b691`.

---
-
-## What shipped today
-
-**16 PRs merged into develop** (between yesterday's `ba42b691` and the current `16bed160`):
-
-### v0.1 lane PRs (in merge order, 9 PRs)
+### v0.1 lane PRs (in merge order)

 | Merge | PR | Lane | Closes |
 |-------|----|------|--------|
@@ -36,99 +26,39 @@
 | `bc74494a` | [#157](https://github.com/KofTwentyTwo/Jarvis/pull/157) | C — MCP CRIT | #20, #21 |
 | `795c3bf5` | [#156](https://github.com/KofTwentyTwo/Jarvis/pull/156) | G — App UX surfaces | #87, #88, #89 |

-### Cleanup + dep fixes (3 PRs)
+### Post-v0.1 cleanup

 | Merge | PR | Scope |
 |-------|----|-------|
 | `08095281` | [#159](https://github.com/KofTwentyTwo/Jarvis/pull/159) | CVE fix — vite + esbuild via `pnpm.overrides` + vitest@3 bump |
-| `a8c7f1a0` | [#160](https://github.com/KofTwentyTwo/Jarvis/pull/160) | Dependabot batch — fiber 9.6.1 + plugin-react 6.0.1 + jsdom 29.1.1 + vite 8.0.12 |
-| `e09d9090` | [#168](https://github.com/KofTwentyTwo/Jarvis/pull/168) | Harness SQLite import alignment + Voice cold-start timing (round 1) |
-
-### CI-green push (8 PRs)
-
-The Lane I workflow shipped in `223310aa` (#154) but didn't survive contact with reality. Each of these PRs peeled back another layer:
-
-| Merge | PR | Layer fixed |
-|-------|----|-------------|
-| `f6637ec3` | [#161](https://github.com/KofTwentyTwo/Jarvis/pull/161) | Webview typecheck order (build before typecheck) + artifact rename |
-| `2068fd41` | [#162](https://github.com/KofTwentyTwo/Jarvis/pull/162) | Earlier handoff doc commit (the file this PR is replacing) |
-| `7a22b051` | [#163](https://github.com/KofTwentyTwo/Jarvis/pull/163) | Remove custom CodeQL workflow (default setup now enabled at repo level) |
-| `54587325` | [#164](https://github.com/KofTwentyTwo/Jarvis/pull/164) | Apply missed webview reorder + non-block typecheck (initial #161 was partial due to security-hook half-apply) |
-| `f9c630e4` | [#165](https://github.com/KofTwentyTwo/Jarvis/pull/165) | TS18048 strict-undefined cleanup in `SegmentedRing.tsx` (the only *real* TS error; 29 others were `@jarvis/bus` build-order artifacts) |
-| `ae7d8a80` | [#166](https://github.com/KofTwentyTwo/Jarvis/pull/166) | Re-flip typecheck step to blocking after the cleanup landed |
-| `bcc55c68` | [#167](https://github.com/KofTwentyTwo/Jarvis/pull/167) | Pin Xcode 26.3 (was Xcode 16 — Swift 6.2 needed for `mlx-audio-swift`, MCP SDK, AgentCore `@MainActor` tests) + drop phantom `VoiceLog` matrix entry + Batcher timing widening |
-| `928ce4bc` | [#169](https://github.com/KofTwentyTwo/Jarvis/pull/169) | Move `Harness/Corpora` resource into `Sources/Harness/` (xcodebuild rejected `.copy("../../Corpora")` traversal at package root) |
-| `f1c60a31` | [#170](https://github.com/KofTwentyTwo/Jarvis/pull/170) | Surface full xcodebuild error log on App target failure (was masked by `-quiet \| tail -5`) |
-| `53b8fb8f` | [#171](https://github.com/KofTwentyTwo/Jarvis/pull/171) | Voice timing budgets round 2 — I3 (108ms > 80ms budget on CI) + V4 (3 emissions vs 4 floor) |
-| `16bed160` | [#173](https://github.com/KofTwentyTwo/Jarvis/pull/173) | Restore `pnpm` + `Node.js` to app-build job — Xcode build-phase script needs `pnpm` on `PATH` |
+| `a8c7f1a0` | [#160](https://github.com/KofTwentyTwo/Jarvis/pull/160) | Dependabot batch — fiber 9.6.1 + plugin-react 6.0.1 + jsdom 29.1.1 + vite 8.0.12 (closes #144, #145, #147, #148) |
+| `f6637ec3` | [#161](https://github.com/KofTwentyTwo/Jarvis/pull/161) | CI workflow fixes — typecheck order + webview-resources artifact shared across jobs |

 ### Closed without merge

- **PR #146** (TypeScript 6.0.3) — closed; Lane H's "typecheck errors" turned out to be build-order artifacts (same as the 29 strict-undefined errors). Reopen as a focused PR is now safe.
- **PR #172** (parallel duplicate of #173 from a sibling agent) — closed with comment pointing at #173.
- **5 superseded Dependabot PRs** (#144, #145, #147, #148) — auto-closed when #160 landed.
+- **PR #146** (TypeScript 6.0.3) — deferred to a focused v0.2 PR after CI typecheck order is verified.
+- **5 superseded Dependabot PRs** — auto-closed when #160 landed.

-### Total: 23 issues closed today + 8 PRs of CI infra hardening
+### Total issues closed today
+
+22 v0.1 audit-finding issues (Memory/Voice/MCP/Bus/HUD/Vision/UX) + #51 B-06 chat scroll + #63 stash triage = **23 issues closed**.

 ---

-## CI as it stands at write time
+## State you should verify

-**Run `25808780457`** on `16bed160` is in progress (since 15:24Z). Last poll snapshot:
+### CI status

-| Status | Job |
-|--------|-----|
-| ✅ | Boundary gates |
-| ✅ | Webview (pnpm test + build) |
-| ✅ | SPM Harness, Shell, Memory, Vision |
-| ⏳ | App target (xcodebuild) |
-| ⏳ | SPM DevOverlay, Config, MCP, Voice, Bus, Replay, Keychain, AgentCore, Logging (9 jobs) |
+Last CI run (on `f6637ec3`, post-CI-fix) is **in progress** at the time of writing. The fixes target two known bugs:

-The macOS-15 runner pool is heavily backlogged today — the prior run on `53b8fb8f` (#171) timed out at 45 min mid-matrix. Background bash poll `b3w2two8p` is watching with a 60-min cap. When CI hits a terminal state:
+1. **Webview typecheck order** — `pnpm -r build` now runs before `pnpm -r typecheck` so `@jarvis/bus` emits `dist/index.d.ts` before TypeScript reads it.
+2. **SPM tests need the webview HUD bundle** — `swift-packages` matrix now depends on `webview` job and downloads the new `webview-resources` artifact to `App/Resources/webview/` so `BusTests` + downstream WKWebView-mounting tests find a real bundle.

- **Green** → `publish-tag` job creates the first `v0.1.0-dev.<run_number>` pre-release tag + a GitHub Release. That's the moment to verify with `gh release list`.
- **Red** → read failure log via `gh run view <ID> --log-failed`; PR #170 ensures we see the actual error (not just `** BUILD FAILED **`).
+**Verify after lunch:** `gh run list --branch develop --limit 4`. If still failing, the residual issues are likely macOS-15 runner specifics (Xcode toolchain mismatch, missing brew formulas) — fix in a follow-up.

-**What was wrong before, and is fixed:**
+### Local build

-1. **Webview typecheck couldn't find `@jarvis/bus`** (#161 + #164) — build now precedes typecheck.
-2. **SPM matrix package `VoiceLog` doesn't exist** (#167) — dropped from matrix.
-3. **Xcode 16 can't parse `swift-tools-version:6.2`** (#167) — selected Xcode 26.3.
-4. **Bus + AgentCore + Harness + MCP couldn't compile** (#167 + #168) — Swift 6.2 toolchain plus aligning `Harness/Adapters/{ReplayMCPAdapter,ReplayRunner}` to `import CSQLiteVec` (matching Replay's 2026-05-11 migration).
-5. **Voice cold-start failure** (#168 + #171) — `AVSpeechSynthesizer` warm-up in `setUp` + timing budgets widened for I3 (250→500ms) and V4 (4→3 emission floor).
-6. **App target `Found unhandled resource at packages/Harness/Corpora`** (#169) — moved Corpora into `Sources/Harness/` so the resource path is `Corpora` instead of `../../Corpora`.
-7. **App target `pnpm not found on PATH`** (#173) — restored Setup pnpm + Setup Node.js to app-build job (Xcode build-phase script needs pnpm).
-8. **Pre-existing strict-undefined errors in HUD source** — 29 of 30 dissolved after build-before-typecheck order; the 30th (`SegmentedRing.tsx:92`) fixed with a non-null assertion (#165). Typecheck now blocking again (#166).
-
---
-
-## Other things resolved this session
-
-### CircleCI integration removed from Jarvis only
-
-The repo had a classic **webhook** to `https://circleci.com/hooks/github` (not the modern GitHub App). Deleted via `gh api -X DELETE /repos/.../hooks/612629967`. Result: no more red ✗ "CircleCI Pipeline: No configuration was found" on new PRs; CircleCI integration on the user's other repos is unaffected.
-
-### CodeQL default setup enabled
-
-Earlier today CodeQL was a custom workflow under `.github/workflows/codeql.yml`. Default setup was enabled via the repo settings API (`gh api -X PATCH /repos/.../code-scanning/default-setup -f state=configured -f query_suite=default`), then the custom workflow was removed in #163. Default setup covers Swift + JS/TS + Actions + Python with the `default` query suite; can be upgraded to `security-extended` later via the same API endpoint.
-
-### Branch protection on develop
-
-`gh api -X PUT /repos/.../branches/develop/protection` set:
- ✅ No force-push
- ✅ No deletion
- ✅ PR required (0 approvers — solo-dev compatible)
- 🔓 `enforce_admins: false` so you can still bypass in emergencies
- 🔓 No required status checks yet (CI is still stabilizing — revisit after publish-tag fires)
-
-### Dependabot security alerts
-
-Both moderate alerts (Vite path traversal, esbuild dev-server) should auto-close on Dependabot's next scan now that:
- `pnpm.overrides` pins `vite >= 8.0.12` (chain root vulnerable was 5.4.21)
- `esbuild` dropped from the tree entirely (vite 8 demoted it to optional peer)
- `vitest` bumped 2→3 in root + bus workspaces (required for vite-8 SSR transform)
-
-Verify: Settings → Code security and analysis → Dependabot alerts (expected within ~1 hour of `#159`/`#160` merges).
+`bash scripts/check-app-builds.sh` passes against `f6637ec3` on your machine (verified mid-session).

 ### Stashes

@@ -137,24 +67,42 @@ $ git stash list
 (empty)
 ```

-5 dropped, 1 preserved as branch [`wip/voice-log-menu-stash4`](https://github.com/KofTwentyTwo/Jarvis/tree/wip/voice-log-menu-stash4) — archival starting point for v1.1 #52 (Voice Log menu, B-07). Based on pre-v0.1 `d8983af`; will need manual rebase to current develop.
+5 dropped, 1 preserved as branch [`wip/voice-log-menu-stash4`](https://github.com/KofTwentyTwo/Jarvis/tree/wip/voice-log-menu-stash4) — archival starting point for v1.1 #52 (Voice Log menu, B-07). The branch is based on old `d8983af` (pre-v0.1); reapplying onto current develop will need manual rebase since Lane A's #158 reshaped `WakeWordDAG`, `VoiceController`, and `AudioGraphOwner`.

 ### Worktrees

-All agent worktrees from yesterday's overnight fan-out + today's CI-doctor sessions removed via `git worktree remove --force` + `git worktree prune`. Single canonical clone.
+All agent worktrees from yesterday's fan-out removed via `git worktree remove --force` + `git worktree prune`. Repo is on a single worktree (the canonical clone).
+
+---
+
+## Three loose ends (none blocking)
+
+### 1. CircleCI GitHub App integration
+
+The CircleCI app is still wired at the repo level, but there's no `.circleci/config.yml` on `develop` (the stale `circleci-project-setup` branch was deleted today). Result: every PR shows a red ✗ "CircleCI Pipeline" status check with `No configuration was found in your project`.
+
+**Fix:** un-wire at https://github.com/settings/installations (manual web step — can't automate via `gh`). With Lane I's GH Actions now canonical, CircleCI is redundant.
+
+### 2. Dependabot security alerts
+
+The 2 moderate alerts (Vite path traversal + esbuild dev-server) should auto-close on the next Dependabot scan now that #159 + #160 landed (`vite@8.0.10` pinned via `pnpm.overrides`, `esbuild` dropped from the tree).
+
+**Verify:** Settings → Code security and analysis → Dependabot alerts. Expected within ~1 hour. If still open after that, run `gh api -X POST /repos/KofTwentyTwo/Jarvis/dependabot/alerts/{N}/dismiss --field state=dismissed --field dismissed_reason=tolerable_risk` per alert (but verifying-via-auto-close is the right outcome).
+
+### 3. CI workflow may still need polish
+
+PR #161 fixes the two known bugs but CI has only been validated against the workflow definitions themselves — actual end-to-end pass-on-develop is in flight. If anything else surfaces:
+- Cache misses → tune the cache key in `actions/cache@v4` block.
+- macOS runner Xcode version mismatch → adjust `sudo xcode-select` fallback path.
+- Real-hardware lane only runs on self-hosted runners (user doesn't have one yet) — gated correctly behind `workflow_dispatch.run_real_hardware=true`.

 ---

 ## What's next

-### Once the in-flight CI completes
+### Top of v0.2 queue (23 audit punch-list issues — milestone "Observable + stable")

- **Green:** Verify `gh release list --limit 3` shows `v0.1.0-dev.<N>`. Update README with a "release" badge if desired (small follow-up).
- **Red:** Diagnose, fix, repeat. PR #170's full-log change ensures the failure is visible.
-
-### v0.2 milestone — "Observable + stable (audit punch-list)"
-
-23 audit MED/LOW issues remaining. Pull live: `gh issue list --milestone "v0.2 — Observable + stable (audit punch-list)"`.
+Pull live: `gh issue list --milestone "v0.2 — Observable + stable (audit punch-list)"`.

 High-leverage starting points:
 - **Memory MED/LOW:** #17, #18, #19 (cleanup after the CRIT cluster landed).
@@ -166,66 +114,45 @@ High-leverage starting points:

 ### M-0 substrate (v0.5 prerequisite)

-Migration phase M-0 (10 sub-issues #90–#99) can start in parallel — it's all infrastructure (typed JarvisAPI surface scaffolding) and doesn't touch user-facing code paths.
+Migration phase M-0 (10 sub-issues #90–#99) can start in parallel — it's all infrastructure (typed JarvisAPI surface scaffolding) and doesn't touch the running user-facing code paths.

-### Deferred work flagged today
+### Deferred work

- **#146 TypeScript 6.0.3** — safe to reopen now. The "typecheck errors" Lane H flagged were build-order artifacts that #161/#164 fix.
- **Vitest 4.x major bump** — H' recommended as a separate evaluation (vitest 3 is on develop; 4 is a major).
- **Vitest@3 `esbuild` plugin-option → `oxc` migration** — warning logged each test run; v0.2 cleanup.
- **OpenSSF Scorecard workflow** — now that the repo is public, adding `ossf/scorecard-action` is standard. Single workflow file.
- **Lift replay-log fidelity above 8 KB** — PR #157's smaller-fix path (per the design call you OK'd that morning) left replay rows capped at the same 8 KB the model sees. The full audit intent is to let dispatchers return raw bytes; deferred to v0.5/M-3 when `SanitizeForModel` can be moved to a shared module without a dep cycle.
+- **#146 TypeScript 6.0.3** — reopen as a focused PR once CI is verified green (the typecheck errors flagged by Lane H were almost certainly the build-order bug fixed in #161).
+- **Vitest 4.x major bump** — v0.2 issue per H' recommendation.
+- **Vitest@3's `esbuild` plugin-option → `oxc` migration** — v0.2 cleanup, currently a warning per test run.

 ### Empirical verification with real models (any time)

-The CI-friendly stub tests prove the wire shape; the user-facing semantic memory loop needs the real env:
+The agent fixes are CI-friendly with stub embedders, but the user-facing semantic memory loop needs the real env to verify. Quick smoke test:

 ```bash
-ollama list   # confirm nomic-embed-text + qwen2.5-coder
-
-# Open Jarvis, say: "remember that I prefer dark mode"
-# Close + reopen, say: "what did I tell you I prefer?"
-# Expected: fact returns via search_memory.
+ollama list                            # confirm nomic-embed-text + qwen2.5-coder
+# Open Jarvis, have a conversation:
+#   "remember that I prefer dark mode"
+# Close + reopen, then:
+#   "what did I tell you I prefer?"
+# Should come back via search_memory.

 sqlite3 ~/Library/Application\ Support/Jarvis/jarvis.db \
-  "SELECT (SELECT COUNT(*) FROM facts) AS facts, (SELECT COUNT(*) FROM facts_vec) AS facts_vec;"
-# Both counts should be > 0 and approximately equal.
+  "SELECT COUNT(*) FROM facts, facts_vec;"
+# Both counts should be non-zero and roughly equal.
 ```

 ---

-## Methodology notes for next session
+## Methodology notes worth remembering for next session

-Five patterns that worked, two that didn't:
+Three patterns that worked and one that didn't:

-**Worked — worktree-isolated background agents.** 10 v0.1 lanes ran in parallel. Each agent pushed its own branch + opened a draft PR. Composes well.
+**Worked:** Worktree-isolated background agents with `isolation: "worktree"`. 10 lanes ran in parallel without stomping each other's state. Each agent pushed its own branch + opened a draft PR.

-**Worked — H' "isolated tmp worktree per Dependabot PR".** Tested 5 dep PRs without polluting any other state. Per-PR worktrees are the right pattern for dep validation.
+**Worked:** The H' "isolated tmp worktree per Dependabot PR" pattern. Lane H' tested 5 Dependabot PRs without polluting the main repo or any other lane's worktree.

-**Worked — squash-merging with `Closes #N` keywords in the PR body (not just the subject).** GitHub auto-closes issues only on the keywords; bare hash references don't trigger it. Today's batch-close had to be manual because subjects used `(#N)` not `Closes #N`.
+**Worked:** Squash-merging with explicit `Closes #N` in the squash subject (or PR body) for auto-closure. The 22 issues I batch-closed today only need that because I'd used bare `(#N)` references in the subjects, not `Closes #N` keywords.

-**Worked — CI Doctor agents that iterate.** PRs #167, #168, #169, #171, #173 came from agents that diagnosed a failure, made a focused fix, opened a PR, watched its CI, then opened the next fix when the previous one revealed a new layer. The key is the agent stays narrow per-PR.
-
-**Worked — background bash poll loops for long-running CI.** Subagents bail out after 5-15 min of "still queued" because they hit context budget. A bash `while true; do gh run view ...; sleep 60; done` survives the wait without burning agent compute.
-
-**Did NOT work — letting subagents run arbitrary `git` commands.** Multiple lanes (Lane F, Lane G, some CI fix doctors) ended up mutating the MAIN repo's HEAD because the agent ran `git checkout` / `git stash` from the main repo path rather than its worktree. **For next session:** brief subagents with `NEVER cd outside your assigned worktree` as a hard rule, repeated in the prompt.
-
-**Did NOT work — relying on subagents to "watch and wait" for slow async signals.** They quit after a few polls and the harness re-emits their final notification over and over (looks like progress, isn't). Use bash background polls for monitoring.
+**Did NOT work:** Letting subagents run arbitrary `git` commands. Multiple lanes (Lane F, Lane G in particular) ended up mutating the main repo's HEAD because the agent ran `git checkout` / `git stash` operations from the main repo path rather than its worktree path. **For next session:** brief subagents with `**NEVER cd outside your assigned worktree**` as a hard rule.

 ---

-## Pointers (where authoritative state lives)
-
- **Project:** `.planning/PROJECT.md` (now stale — should be refreshed to mark v0.1 done)
- **Roadmap:** `.planning/ROADMAP-2026-05-12.md` (still authoritative)
- **GitHub Milestones:** https://github.com/KofTwentyTwo/Jarvis/milestones
- **GitHub Issues:** https://github.com/KofTwentyTwo/Jarvis/issues
- **GitHub Actions:** https://github.com/KofTwentyTwo/Jarvis/actions
- **Dependabot alerts:** https://github.com/KofTwentyTwo/Jarvis/security/dependabot
- **Branch protection settings:** https://github.com/KofTwentyTwo/Jarvis/settings/branches
- **Today's session-state:** `docs/SESSION-STATE.md` (also stale — narrative is from earlier sessions)
- **This doc:** the day-summary, not the system of record
-
---
-
-*Written 2026-05-13 afternoon, mid-CI-validation. Will be obsolete once `v0.1.0-dev.<N>` lands as the first release — that's the canonical moment of "v0.1 shipped".*
+*Authoritative state remains: `.planning/PROJECT.md` (project), `.planning/ROADMAP-2026-05-12.md` (milestone roadmap), GitHub Issues for live triage, GitHub Milestones for v0.2/v0.5/v0.8/v1.0/v1.1 scope. This doc is the day-summary, not the system of record.*
@@ -1,124 +0,0 @@
-# Handoff — 2026-05-14: multi-runner shipped, v0.2 ready
-
-**Session window:** 2026-05-13 afternoon (Grogu single runner setup) → 2026-05-14 (multi-runner expansion + first auto-Release)
-**Branch:** `develop`, clean
-**HEAD at write time:** `774e60a0` — `ci(actions): create GitHub Release directly in publish-tag job (#187)`
-**Open PR count:** 2 (#185, #191 — both with shepherds running)
-**Repo visibility:** PUBLIC
-
---
-
-## TL;DR
-
- **3-runner self-hosted CI on Grogu is live** — `Grogu-jarvis`, `-2`, `-3`. Matrix parallelism observed (≥3 SPM jobs concurrent). Develop CI green in ~5 min vs. ~13 min single-runner.
- **Auto-Release flow proven** — `v0.1.0-dev.64` has a real GitHub Release object, created by the new `gh release create` step in `publish-tag`. No more manual `gh release create` needed.
- **Brainstorm → spec → plan → execute discipline established** via the Superpowers skills. Multi-runner work has a committed spec + plan under `docs/superpowers/{specs,plans}/`. Pattern to follow for v0.2 onward.
- **Memory test flake** surfaced: `MemoryWiringEndToEndTests.testMemoryEnqueueReceivesNonNilUserAndAssistantText` fails intermittently on PR branches but passes on develop. Hypothesis: race in `TurnTranscriptStore` actor under concurrent-runner load. Pre-existing; not from any 2026-05-13/14 code change.
-
---
-
-## What shipped today
-
-### v0.1 mop-up + first dev tag
- **PR #184** (squash `5fc2d3fa`) — Ollama model baseline reconciled to `qwen3.6:latest` (extractor) + `qwen2.5-coder:32b-instruct-q8_0` (agent fallback). Closes #58 (last v0.1 issue).
- **v0.1.0-dev.50** — first release tag of the project. Release object created manually (workflow couldn't trigger downstream).
- **v0.1.0-dev.64** — second release tag. Release object created **automatically** via the new inline `gh release create` step in `publish-tag`.
-
-### Self-hosted runner saga
- **PR #181** (`eef17252`) — Moved `swift-packages` matrix to `Grogu-jarvis`. DEVELOPER_DIR Xcode-select. Fork-PR gate.
- **PR #183** (`81ce64c3`) — Orphan-process reaper at job start (closes #182).
- **PR #189** (`4cdb3560`) — Reaper gets a `>=1h` age filter so sibling runners on Grogu don't kill each other.
- **PR #187** (`774e60a0`) — `publish-tag` step creates the Release object directly instead of relying on `release.yml` triggering on tag push (GITHUB_TOKEN can't trigger downstream workflows).
- **PR #190** (`a26f49fd`) — Multi-runner spec + plan committed to `docs/superpowers/`.
- **PR #185** — open, AgentCore #23+#24 fix. Currently has a Memory-flake CI failure under shepherd watch.
- **PR #191** — open, CLAUDE.md inventory update. Same Memory flake situation.
-
-### Grogu state
- 3 runners installed at `~/actions-runner-jarvis{,-2,-3}/`, each with `_work` symlinked to `/Volumes/HD-2/jarvis-runner-work{,-2,-3}/`.
- LaunchAgents managed by `~/Library/LaunchAgents/actions.runner.KofTwentyTwo-Jarvis.Grogu-jarvis{,-2,-3}.plist`.
- Keychain workflow: `~/Library/Keychains/jarvis-runner.keychain-db`, password in repo secret `JARVIS_RUNNER_KEYCHAIN_PASSWORD`. CI unlocks + makes default + prepends to search list.
- Side effect: `jarvis-runner.keychain-db` is your user's default keychain after CI runs. Undo command in CLAUDE.md.
-
---
-
-## Active background processes at handoff
-
-| Task ID | What | Expected exit |
-|---|---|---|
-| `bny76q2ad` | Final shepherd watching PR #185 + #191 | When both PRs are handled (merged or marked `ci-failed`), or 60-min timeout |
-
-**Log location:** `/tmp/final-shepherd.log`
-
-Reading the log will tell you what the shepherd did. If it marked both PRs `ci-failed` because of the Memory flake, see "Memory flake disposition" below.
-
---
-
-## Memory flake disposition (what to do when you pick up)
-
-`MemoryWiringEndToEndTests.testMemoryEnqueueReceivesNonNilUserAndAssistantText` fails with:
-```
-XCTAssertEqual failed: ("0") is not equal to ("1") - enqueue was not called — BLOCKER-1 regression
-XCTAssertEqual failed: ("nil") is not equal to ("Optional("hi")") - userText empty/nil — Plan 4's submit-time append did not propagate via TurnTranscriptStore
-XCTAssertEqual failed: ("nil") is not equal to ("Optional("hello there")") - assistantText empty/nil — Plan 1's transcript subscriber did not propagate via TurnTranscriptStore
-```
-
-**Evidence it's a flake, not a regression:**
- PR #191 doesn't touch AgentCore at all (only `CLAUDE.md`) yet hits the same exact failure.
- Develop's latest CI (`25832341662`, on `774e60a0`) passed Memory in 45s.
- Both #185 and #191 are branched off slightly different develop SHAs — the test passes on the latest develop but fails on these branch HEADs after forward-merge.
-
-**Recommended next steps:**
-1. Open a new issue: `bug,severity:medium,area:memory` — "MemoryWiringEndToEndTests intermittent failure under concurrent runner load". Describe the `TurnTranscriptStore` race hypothesis.
-2. Either rerun the failed jobs (CI may pass on next attempt) OR merge both PRs as-is since branch protection has 0 required checks and the test passes reliably on develop.
-3. Long-term: file the test as known-flaky in v0.2 milestone.
-
---
-
-## v0.2 Wave 1 (next session start)
-
-Tiny / doc-only / deterministic fixes — safe to land in a single session each:
-
-| Issue | What | Effort | Why first |
-|---|---|---|---|
-| **#19** | MemoryStore.swift stale Phase 7 hedge doc-comments | ~5 min | Pure docs, zero risk |
-| **#45** | Bus 'JarvisBusWorld' docstring drift (20+ docstrings) | ~15 min | Pure docs, mechanical |
-| **#46** | Stale webview bundle artifacts in `App/Resources/webview/assets/` (~50MB) | ~10 min | File deletes |
-| **#37** | STTBackendSelector snake_case vs camelCase mismatch | ~15 min | Single rename |
-| **#178** | Add OpenSSF Scorecard workflow | ~15 min | One new `.github/workflows/` file |
-| **#47** | WebviewBridge.sendRaw NaN→null JSON guard | ~20 min | One-line bug fix |
-
-Each gets brainstorm → spec → plan via the Superpowers skills (specs/plans templates established in `docs/superpowers/`). Brief specs (a few paragraphs) — these are "issue body IS the design" cases.
-
-## v0.2 Wave 2 / Wave 3 — wait
-
-Larger items that need real diagnostic work or design decisions:
- #18 MemoryReplaySink error propagation — needs care
- #23 + #24 already in PR #185 (held)
- #44 HUD audioLevel consumer rewire — MED, design choice
- #43 sessionHistory dead-letter — overlaps M-7, defer
- #176 vitest 4.x major bump — needs eval
- #26 confirmation panel multi-monitor — needs real hardware
- Any M-0..M-7 issue — strategic, gets its own spec → plan
-
---
-
-## Key references
-
- **Spec template:** `docs/superpowers/specs/2026-05-13-multi-runner-grogu-design.md`
- **Plan template:** `docs/superpowers/plans/2026-05-13-multi-runner-grogu.md`
- **Previous handoff:** `docs/HANDOFF-2026-05-13-v0.1-shipped.md` (now superseded for the multi-runner story but still describes v0.1 mop-up)
- **Roadmap:** `.planning/ROADMAP-2026-05-12.md`
- **Live state:** GitHub Issues + Milestones at https://github.com/KofTwentyTwo/Jarvis
- **CI workflow:** `.github/workflows/ci.yml` — has the age-filtered cleanup + inline release create
- **CLAUDE.md `Self-hosted CI runner (Grogu)`** section — operational reference for the 3-runner setup
-
-## What this handoff deliberately doesn't relitigate
-
- The Memory flake's root cause — open a v0.2 bug and move on; develop's CI is reliably green so it's not blocking.
- Whether to merge PR #185 / PR #191 with a known-flaky failure — branch protection allows it; user judgment.
- Wave 2/3 v0.2 issues — they need design conversations; pick them up after Wave 1.
- M-0..M-7 — strategic, gets its own session.
-
---
-
-*Written 2026-05-14 at the natural session-end after multi-runner expansion shipped. Next session should start with `/clear`, read this doc, then read the latest `/tmp/final-shepherd.log` to see what the background shepherd did, then pick up Wave 1.*
@@ -1,374 +0,0 @@
-# Multi-Runner Expansion on Grogu — Implementation Plan
-
-> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
-
-**Goal:** Scale Grogu from 1 to 3 self-hosted GitHub Actions runners so the 13-package SwiftPM matrix parallelizes, cutting develop CI wall-clock from ~13 min serial to ~5 min.
-
-**Architecture:** Two new LaunchAgent runners (`Grogu-jarvis-2`, `Grogu-jarvis-3`), each in its own `~/actions-runner-jarvis-{2,3}/` directory with `_work/` symlinked to `/Volumes/HD-2/jarvis-runner-work-{2,3}/`. All three runners share labels `[self-hosted, macOS, ARM64, jarvis]` so matrix jobs dispatch to whichever is free.
-
-**Tech Stack:** GitHub Actions self-hosted runner v2.334.0 (osx-arm64), `gh` CLI for token + verification, macOS LaunchAgents for per-user service management.
-
-**Spec:** `docs/superpowers/specs/2026-05-13-multi-runner-grogu-design.md`
-
-**Related issues:** #180 (single-runner setup), #182 (zombie cleanup), #186 (auto-release), #188 (age-filter — precondition).
-
---
-
-## File Structure
-
-This plan is primarily operational; the only repo file modified is `CLAUDE.md` (runner inventory documentation).
-
-| Change | Path | Responsibility |
-|---|---|---|
-| **System (new)** | `~/actions-runner-jarvis-2/` | Runner-2 agent binary tree (already pre-staged) |
-| **System (new)** | `~/actions-runner-jarvis-2/_work` → `/Volumes/HD-2/jarvis-runner-work-2/` | Symlink for build artifacts (already pre-staged) |
-| **System (new)** | `~/Library/LaunchAgents/actions.runner.KofTwentyTwo-Jarvis.Grogu-jarvis-2.plist` | LaunchAgent service plist (created by `svc.sh install`) |
-| **System (new)** | `~/actions-runner-jarvis-3/` | Runner-3 agent binary tree (already pre-staged) |
-| **System (new)** | `~/actions-runner-jarvis-3/_work` → `/Volumes/HD-2/jarvis-runner-work-3/` | Symlink (already pre-staged) |
-| **System (new)** | `~/Library/LaunchAgents/actions.runner.KofTwentyTwo-Jarvis.Grogu-jarvis-3.plist` | LaunchAgent plist |
-| **Repo (modify)** | `CLAUDE.md` | Runner inventory section updated to list all 3 runners |
-
-The pre-staging step (download + extract agent + create `_work` symlinks for runner 2 and 3) was performed earlier in the session. Task 2 step 1 verifies that pre-stage rather than redoing it.
-
---
-
-## Task 1: Verify precondition — PR #189 merged to develop
-
-**Files:**
- Read-only check: `origin/develop` git log
-
-PR #189 (age-filter zombie reaper) MUST be on `develop` before either new runner starts accepting jobs. The current cleanup step kills any `xctest`/`swift-test`/`swift-driver` regardless of age; concurrent runners' cleanup steps would mutually kill each other's in-flight tests.
-
- [ ] **Step 1: Fetch latest develop**
-
-```bash
-git fetch origin develop
-```
-
-Expected: no output, or "Updating <hash>..<hash>".
-
- [ ] **Step 2: Verify the age-filter commit is on develop**
-
-```bash
-git log origin/develop --grep="age-filter zombie reaper" --oneline | head -3
-```
-
-Expected: at least one line containing `676c54d ci(actions): age-filter zombie reaper (>= 1h) for multi-runner safety` (the exact SHA prefix may differ post-squash-merge).
-
-If empty: PR #189 is not yet merged. Stop the plan here and re-run from Task 1 once it is. Do NOT proceed to Task 2 — starting concurrent runners against an un-filtered cleanup step will trigger mutual xctest kill.
-
---
-
-## Task 2: Register Grogu-jarvis-2
-
-**Files:**
- System: `~/actions-runner-jarvis-2/` (pre-staged binaries — verify only)
- System: `~/actions-runner-jarvis-2/_work` symlink (pre-staged — verify only)
- System (new): `~/actions-runner-jarvis-2/.runner` (created by `config.sh`)
- System (new): `~/Library/LaunchAgents/actions.runner.KofTwentyTwo-Jarvis.Grogu-jarvis-2.plist` (created by `svc.sh install`)
-
- [ ] **Step 1: Verify pre-stage**
-
-```bash
-test -x ~/actions-runner-jarvis-2/config.sh && \
-  readlink ~/actions-runner-jarvis-2/_work | grep -q '/Volumes/HD-2/jarvis-runner-work-2$' && \
-  echo "OK: pre-stage intact" || echo "FAIL"
-```
-
-Expected: `OK: pre-stage intact`.
-
-If FAIL: re-run the pre-stage block from earlier in the session — `mkdir -p` the dirs on HD-2, download `actions-runner-osx-arm64-2.334.0.tar.gz`, extract into `~/actions-runner-jarvis-2/`, `ln -s /Volumes/HD-2/jarvis-runner-work-2 ~/actions-runner-jarvis-2/_work`.
-
- [ ] **Step 2: Get a fresh registration token**
-
-```bash
-TOKEN=$(gh api -X POST /repos/KofTwentyTwo/Jarvis/actions/runners/registration-token -q '.token')
-test -n "$TOKEN" && echo "Token acquired (len=${#TOKEN})" || echo "FAIL"
-```
-
-Expected: `Token acquired (len=33)` or similar non-zero length. Token expires in 1 hour; do not pause between this step and step 4.
-
-If FAIL: check `gh auth status` — the active account must have `workflow` scope on the KofTwentyTwo/Jarvis repo.
-
- [ ] **Step 3: Configure runner-2 (unattended)**
-
-```bash
-cd ~/actions-runner-jarvis-2
-./config.sh \
-  --url https://github.com/KofTwentyTwo/Jarvis \
-  --token "$TOKEN" \
-  --name "Grogu-jarvis-2" \
-  --labels "jarvis" \
-  --work "_work" \
-  --unattended \
-  --replace 2>&1 | grep -v -i 'token' | tail -10
-```
-
-Expected last lines include `√ Connected to GitHub`, `√ Runner successfully added`, `√ Settings Saved.`. The `grep -v token` strips any line containing the literal token string from the logged output as a defense-in-depth measure (the token itself is short-lived but should not be left in scrollback).
-
- [ ] **Step 4: Install + start as LaunchAgent**
-
-```bash
-cd ~/actions-runner-jarvis-2
-./svc.sh install
-./svc.sh start
-./svc.sh status
-```
-
-Expected last block:
-```
-status actions.runner.KofTwentyTwo-Jarvis.Grogu-jarvis-2:
-/Users/james.maes/Library/LaunchAgents/actions.runner.KofTwentyTwo-Jarvis.Grogu-jarvis-2.plist
-
-Started:
-<PID> 0 actions.runner.KofTwentyTwo-Jarvis.Grogu-jarvis-2
-```
-
-(PID will vary.)
-
- [ ] **Step 5: Verify runner-2 is online via GitHub API**
-
-```bash
-gh api /repos/KofTwentyTwo/Jarvis/actions/runners \
-  -q '.runners[] | select(.name=="Grogu-jarvis-2") | {name, status, busy, labels: [.labels[].name]}'
-```
-
-Expected:
-```json
-{"busy":false,"labels":["self-hosted","macOS","ARM64","jarvis"],"name":"Grogu-jarvis-2","status":"online"}
-```
-
-If `status` is anything other than `online`, check `~/Library/Logs/actions.runner.KofTwentyTwo-Jarvis.Grogu-jarvis-2/stdout.log` for the runner-side error and stop the plan.
-
---
-
-## Task 3: Register Grogu-jarvis-3
-
-Identical sequence to Task 2 with `-2` replaced by `-3` everywhere. Per the spec's sequential-validation principle, do NOT start runner-3 until runner-2 is confirmed `status=online, busy=false`.
-
-**Files:**
- System: `~/actions-runner-jarvis-3/` (pre-staged — verify only)
- System: `~/actions-runner-jarvis-3/_work` symlink (pre-staged — verify only)
- System (new): `~/actions-runner-jarvis-3/.runner` (created by `config.sh`)
- System (new): `~/Library/LaunchAgents/actions.runner.KofTwentyTwo-Jarvis.Grogu-jarvis-3.plist`
-
- [ ] **Step 1: Verify pre-stage**
-
-```bash
-test -x ~/actions-runner-jarvis-3/config.sh && \
-  readlink ~/actions-runner-jarvis-3/_work | grep -q '/Volumes/HD-2/jarvis-runner-work-3$' && \
-  echo "OK: pre-stage intact" || echo "FAIL"
-```
-
-Expected: `OK: pre-stage intact`.
-
- [ ] **Step 2: Get a fresh registration token**
-
-```bash
-TOKEN=$(gh api -X POST /repos/KofTwentyTwo/Jarvis/actions/runners/registration-token -q '.token')
-test -n "$TOKEN" && echo "Token acquired (len=${#TOKEN})" || echo "FAIL"
-```
-
-Expected: `Token acquired (len=33)` or similar.
-
- [ ] **Step 3: Configure runner-3 (unattended)**
-
-```bash
-cd ~/actions-runner-jarvis-3
-./config.sh \
-  --url https://github.com/KofTwentyTwo/Jarvis \
-  --token "$TOKEN" \
-  --name "Grogu-jarvis-3" \
-  --labels "jarvis" \
-  --work "_work" \
-  --unattended \
-  --replace 2>&1 | grep -v -i 'token' | tail -10
-```
-
-Expected last lines: `√ Connected to GitHub`, `√ Runner successfully added`, `√ Settings Saved.`
-
- [ ] **Step 4: Install + start as LaunchAgent**
-
-```bash
-cd ~/actions-runner-jarvis-3
-./svc.sh install
-./svc.sh start
-./svc.sh status
-```
-
-Expected: `Started: <PID> 0 actions.runner.KofTwentyTwo-Jarvis.Grogu-jarvis-3`.
-
- [ ] **Step 5: Verify runner-3 is online**
-
-```bash
-gh api /repos/KofTwentyTwo/Jarvis/actions/runners \
-  -q '.runners[] | select(.name=="Grogu-jarvis-3") | {name, status, busy, labels: [.labels[].name]}'
-```
-
-Expected:
-```json
-{"busy":false,"labels":["self-hosted","macOS","ARM64","jarvis"],"name":"Grogu-jarvis-3","status":"online"}
-```
-
- [ ] **Step 6: Confirm all 3 runners visible**
-
-```bash
-gh api /repos/KofTwentyTwo/Jarvis/actions/runners \
-  -q '.runners | length, [.runners[].name] | sort'
-```
-
-Expected (exactly):
-```
-3
-["Grogu-jarvis","Grogu-jarvis-2","Grogu-jarvis-3"]
-```
-
-If the count is anything other than 3, stop and investigate which runner failed to register.
-
---
-
-## Task 4: Acceptance — observe matrix parallelism
-
-**Files:** none.
-
-**Premise:** PR #185 (`fix/agent-cache-text-blocks-23-24`) was cancelled earlier in this session with one previously-failed SPM job. Rerun it to get a CI run with the new runner topology in effect. Watch for ≥3 SPM jobs in `in_progress` simultaneously.
-
- [ ] **Step 1: Identify the PR #185 run id**
-
-```bash
-RUN_ID=$(gh run list --branch fix/agent-cache-text-blocks-23-24 --workflow=CI --limit 1 --json databaseId -q '.[0].databaseId')
-echo "PR #185 latest run: $RUN_ID"
-```
-
-Expected: a numeric run id, e.g. `25827802988`.
-
- [ ] **Step 2: Trigger a full rerun**
-
-```bash
-gh run rerun "$RUN_ID" --repo KofTwentyTwo/Jarvis
-sleep 5
-gh run view "$RUN_ID" --json status,conclusion -q '"\(.status) / \(.conclusion // "(none)")"'
-```
-
-Expected: `queued / (none)` or `in_progress / (none)`. (Using `gh run rerun` without `--failed` reruns the whole workflow so we observe a fresh matrix dispatch across all runners.)
-
- [ ] **Step 3: Wait for matrix dispatch, then sample concurrent jobs**
-
-Wait ~60-90 seconds for the webview/boundary jobs to complete and the SPM matrix to start dispatching.
-
-```bash
-sleep 90
-gh run view "$RUN_ID" --json jobs -q '[.jobs[] | select(.name | startswith("SPM ")) | select(.status == "in_progress") | .name] | "in_progress count: \(length)\nnames: \(.)"'
-```
-
-Expected: `in_progress count: 3` (or higher if the matrix has dispatched more quickly than expected) followed by three SPM job names.
-
-If `in_progress count: 1`: GitHub may have only just started dispatching. Wait another 60 seconds and re-sample. If still 1 after 5 minutes, investigate — possibly one or both new runners are offline. Cross-check with `gh api /repos/.../actions/runners -q '.runners[].busy'` (should show ≥2 `true`).
-
- [ ] **Step 4: Cross-verify on Grogu**
-
-```bash
-gh api /repos/KofTwentyTwo/Jarvis/actions/runners \
-  -q '[.runners[] | select(.busy == true) | .name] | "busy runners: \(length)\nnames: \(.)"'
-```
-
-Expected: `busy runners: 3` and the three runner names. (If 2, the matrix is partially dispatched; if 1, only the original runner is being used — investigate.)
-
- [ ] **Step 5: Wait for the run to terminate**
-
-```bash
-gh run watch "$RUN_ID" --repo KofTwentyTwo/Jarvis --exit-status
-echo "Exit: $?"
-```
-
-Expected: process exits with 0 and a `✓ run completed with 'success'` message. Wall-clock from trigger to completion should be approximately 5–7 minutes (vs the prior ~13 min single-runner baseline). If the run conclusion is `failure`, inspect failed jobs via `gh run view "$RUN_ID" --log-failed` to determine whether the failure is multi-runner-related (e.g., test-suite race) or pre-existing flakiness (e.g., the AgentCore deadlock seen earlier).
-
---
-
-## Task 5: Update CLAUDE.md with the new runner inventory
-
-**Files:**
- Modify: `CLAUDE.md` (the "Self-hosted CI runner (Grogu)" section)
-
- [ ] **Step 1: Create a branch**
-
-```bash
-git fetch origin develop
-git checkout -b docs/multi-runner-inventory origin/develop
-```
-
-Expected: `Switched to a new branch 'docs/multi-runner-inventory'`.
-
- [ ] **Step 2: Locate the runner section in CLAUDE.md**
-
-```bash
-grep -n "Where it lives\|Service:\|jarvis-runner.keychain" CLAUDE.md | head -3
-```
-
-Expected: three line numbers pointing into the `### Self-hosted CI runner (Grogu)` section.
-
- [ ] **Step 3: Replace the "Where it lives" + "Service" bullets with multi-runner equivalents**
-
-Edit the two bullets via the `Edit` tool. The OLD text:
-
-```
- **Where it lives:** `~/actions-runner-jarvis/` on Grogu. `_work/` symlinked to `/Volumes/HD-2/jarvis-runner-work/` (1.3 TB) to keep boot-disk pressure off.
- **Service:** launchd LaunchAgent `actions.runner.KofTwentyTwo-Jarvis.Grogu-jarvis` (`~/Library/LaunchAgents/`). Manage with `cd ~/actions-runner-jarvis && ./svc.sh {status,start,stop}`. Only runs while user is logged in.
-```
-
-The NEW text:
-
-```
- **Where they live:** three runners on Grogu — `~/actions-runner-jarvis/` (Grogu-jarvis), `~/actions-runner-jarvis-2/` (Grogu-jarvis-2), `~/actions-runner-jarvis-3/` (Grogu-jarvis-3). Each `_work/` symlinked to `/Volumes/HD-2/jarvis-runner-work{,-2,-3}/` (1.3 TB available, ~10 GB peak per runner) to keep boot-disk pressure off.
- **Service:** one launchd LaunchAgent per runner — `actions.runner.KofTwentyTwo-Jarvis.Grogu-jarvis{,-2,-3}.plist` in `~/Library/LaunchAgents/`. Manage individually with `cd ~/actions-runner-jarvis-N && ./svc.sh {status,start,stop}` (omit `-N` for runner 1). All three only run while user is logged in.
- **Why three:** the 13-package SPM matrix parallelizes across runners. Single-runner serial = ~13 min CI; three-runner parallel = ~5 min. Grogu has 24 cores / 128 GB RAM; 3 concurrent SwiftPM cold builds peak at ~24 cores + ~24 GB, well within budget. See `docs/superpowers/specs/2026-05-13-multi-runner-grogu-design.md`.
-```
-
- [ ] **Step 4: Stage + commit**
-
-```bash
-git add CLAUDE.md
-git diff --cached --stat
-git commit -m "docs(claude-md): runner inventory updated for 3-runner Grogu setup
-
-Replaces single-runner 'Where it lives' / 'Service' bullets with the
-3-runner inventory (Grogu-jarvis, -2, -3). Adds a brief 'Why three'
-bullet documenting the parallelism win and links to the spec.
-
-Refs #180"
-```
-
-Expected output: `[docs/multi-runner-inventory <sha>] docs(claude-md): runner inventory updated...` and `1 file changed`.
-
- [ ] **Step 5: Push + open PR**
-
-```bash
-git push -u origin docs/multi-runner-inventory
-gh pr create --base develop --head docs/multi-runner-inventory \
-  --title "docs(claude-md): runner inventory updated for 3-runner Grogu setup" \
-  --body "Updates CLAUDE.md's \`Self-hosted CI runner\` section to reflect the new 3-runner Grogu topology (Grogu-jarvis, -2, -3) post-multi-runner-expansion. No behavior change — documentation only.
-
-Spec: \`docs/superpowers/specs/2026-05-13-multi-runner-grogu-design.md\`
-Plan: \`docs/superpowers/plans/2026-05-13-multi-runner-grogu.md\`
-
-Refs #180"
-```
-
-Expected: the new PR URL is printed. Note the PR number; the runner-side CI for this PR is itself an acceptance test (it will exercise the new 3-runner topology).
-
---
-
-## Definition of done
-
- All steps above are checked off.
- `gh api /repos/KofTwentyTwo/Jarvis/actions/runners` returns 3 runners, all `status=online`.
- The retriggered PR #185 CI run terminates with `conclusion=success` and showed ≥3 SPM jobs `in_progress` simultaneously during execution.
- `docs/multi-runner-inventory` PR is open (or merged) updating CLAUDE.md.
-
-## Self-review (run by author before handoff)
-
- ✅ **Spec coverage:** every component in the spec is covered by a task — runner registration (Tasks 2+3), acceptance validation (Task 4), doc update (Task 5), precondition (Task 1).
- ✅ **No placeholders:** every step has concrete commands and expected output.
- ✅ **Type consistency:** runner names (`Grogu-jarvis-N`), labels (`jarvis`), plist paths, and `_work` symlink targets are spelled identically across tasks.
- ✅ **Spec out-of-scope items not present:** no warm-cache work, no monitoring/alerting, no per-runner labels.
- ✅ **Rollback path documented in spec, referenced as needed.**
@@ -1,133 +0,0 @@
-# Multi-runner expansion on Grogu — design
-
-**Date:** 2026-05-13
-**Status:** approved (brainstorm phase, awaiting implementation plan)
-**Workstream:** A — local CI capacity scaling
-**Related issues:** #180 (single-runner setup), #182 (zombie cleanup), #186 (auto-release), #188 (age-filter)
-
-## Problem
-
-Develop CI wall-clock is bottlenecked on a single self-hosted runner (`Grogu-jarvis`) serializing the 13-package SwiftPM matrix. Each cold matrix job takes 1–2 minutes, so a full CI run is 13–15 minutes of serial work plus app-build on github-hosted in parallel. Grogu's hardware (24 physical cores, 128 GB RAM, 1.3 TB free on HD-2) is heavily under-utilized — single-runner load is ~5% of capacity.
-
-Adding sibling runners would parallelize the matrix and roughly cut CI wall-clock by the runner count. Three runners is the recommended target: comfortably within hardware capacity (~24 cores used at peak when all three are mid-SwiftPM-build) without contending with interactive developer work.
-
-## Goal
-
-Three self-hosted runners on Grogu (`Grogu-jarvis`, `Grogu-jarvis-2`, `Grogu-jarvis-3`), each with its own `_work/` directory on HD-2, each registered as a LaunchAgent under james.maes's user session, all sharing labels `[self-hosted, macOS, ARM64, jarvis]` so GitHub Actions dispatches matrix jobs to whichever runner is free.
-
-**Acceptance bar (minimum):** a green develop CI run after registration where `gh run view --json jobs` shows ≥3 SPM matrix jobs in `in_progress` state simultaneously. Warm-cache persistence and runner-health monitoring are explicit non-goals for this phase — they fall to follow-up tickets.
-
-## Components
-
-| Runner | Agent dir | `_work` symlink target | LaunchAgent plist | GitHub name |
-|---|---|---|---|---|
-| 1 (existing) | `~/actions-runner-jarvis/` | `/Volumes/HD-2/jarvis-runner-work/` | `actions.runner.KofTwentyTwo-Jarvis.Grogu-jarvis.plist` | `Grogu-jarvis` |
-| 2 (new) | `~/actions-runner-jarvis-2/` | `/Volumes/HD-2/jarvis-runner-work-2/` | `actions.runner.KofTwentyTwo-Jarvis.Grogu-jarvis-2.plist` | `Grogu-jarvis-2` |
-| 3 (new) | `~/actions-runner-jarvis-3/` | `/Volumes/HD-2/jarvis-runner-work-3/` | `actions.runner.KofTwentyTwo-Jarvis.Grogu-jarvis-3.plist` | `Grogu-jarvis-3` |
-
-All three runners share the same label set; jobs targeting `runs-on: [self-hosted, macOS, jarvis]` will dispatch to any free runner.
-
-Agent binaries are v2.334.0 (osx-arm64) — already extracted into the new runner dirs as a pre-staging step; only `config.sh` + `svc.sh install/start` remain.
-
-## Precondition
-
-PR #189 (age-filter for the orphan-process cleanup step) **must be on `develop`** before either new runner starts accepting jobs. The current cleanup step kills ANY `xctest`/`swift-test`/`swift-driver` process at job start; with concurrent runners, sibling cleanup steps would mutually destroy each other's in-flight tests. PR #189 narrows the kill set to processes ≥1 hour old — concurrent CI jobs (typically <10 min) are safe.
-
-The gating sequence is enforced operationally, not via code: don't run `./svc.sh start` on runner 2 or 3 until `git log origin/develop` shows the age-filter merge.
-
-## Sequence — register one runner
-
-For each `N` in `{2, 3}`:
-
-1. Obtain a fresh registration token (1-hour expiry):
-   ```
-   gh api -X POST /repos/KofTwentyTwo/Jarvis/actions/runners/registration-token
-   ```
-2. Configure:
-   ```
-   cd ~/actions-runner-jarvis-N
-   ./config.sh \
-     --url https://github.com/KofTwentyTwo/Jarvis \
-     --token "$TOKEN" \
-     --name "Grogu-jarvis-N" \
-     --labels "jarvis" \
-     --work "_work" \
-     --unattended \
-     --replace
-   ```
-3. Install as LaunchAgent + start:
-   ```
-   ./svc.sh install
-   ./svc.sh start
-   ```
-4. Verify online via GitHub API:
-   ```
-   gh api /repos/KofTwentyTwo/Jarvis/actions/runners -q '.runners[] | select(.name=="Grogu-jarvis-N") | {status, busy, labels}'
-   ```
-   Expected: `status=online, busy=false, labels=[self-hosted, macOS, ARM64, jarvis]`.
-
-Sequential ordering (runner 2 fully online before configuring runner 3) makes any misconfiguration easy to bisect.
-
-## Acceptance validation
-
-After both runners are online:
-
-1. Retrigger a stuck or cancelled CI run via `gh run rerun <id>` (PR #185 already has a failed AgentCore job that can serve as the test bed).
-2. While the run is in progress, run:
-   ```
-   gh run view <id> --json jobs -q '.jobs[] | select(.status == "in_progress") | .name'
-   ```
-   Expected: at least 3 SPM matrix job names listed simultaneously, e.g., `SPM Bus`, `SPM Memory`, `SPM Voice`.
-3. Cross-verify on Grogu:
-   ```
-   gh api /repos/KofTwentyTwo/Jarvis/actions/runners -q '.runners[] | {name, busy}'
-   ```
-   Expected: at least 3 runners with `busy=true` during peak matrix execution.
-4. Wait for the run to terminate. Confirm `conclusion = success` (no cross-runner interference caused failures).
-
-## Failure modes & mitigations
-
-| Mode | Probability | Mitigation |
-|---|---|---|
-| Mutual xctest kill from un-filtered cleanup | High (without #189) | PR #189 precondition — age-filter at ≥1h. Don't start new runners until merged. |
-| HD-2 disk pressure | Negligible | 1.3 TB free; 3 `_work` dirs × ~10 GB peak = 30 GB. |
-| CPU/RAM saturation | Low | 3 concurrent SwiftPM builds peak at ~24 cores + ~24 GB. Within 24/128 budget. Headroom for interactive work. |
-| Keychain races (`unlock-keychain`) | Negligible | `security unlock-keychain` is idempotent; default-keychain set persistently for the user. |
-| Shared SwiftPM global cache races | Low | `~/Library/Caches/org.swift.swiftpm` is mostly read-after-populate. If contention surfaces, the per-package `actions/checkout clean: true` wipes per-job state cleanly. |
-| Test port conflicts | Low | Jarvis tests use process-local Mach IPC (WKWebView) and per-process temp DBs (SQLite). No fixed-port servers found in audit. |
-| One runner goes offline silently | Medium | Surfaces only at the next CI run (other runners pick up jobs). No alerting — explicit follow-up scope. |
-| Runner agent auto-update breaks during long-running job | Low | Unlikely on a single-job timescale; runner updates happen between jobs. |
-
-## Rollback
-
-Each runner is independently revertible.
-
- **Pause a runner** (keeps registration): `cd ~/actions-runner-jarvis-N && ./svc.sh stop`
- **Deregister a runner** (free the slot):
-  - On Grogu: `./svc.sh uninstall`
-  - Via GitHub: `gh api -X DELETE /repos/KofTwentyTwo/Jarvis/actions/runners/<id>` (or `./config.sh remove --token $(gh api -X POST /repos/.../actions/runners/remove-token)`)
- **Revert to single runner**: stop + uninstall + deregister runners 2 and 3. Workflow unchanged (the `runs-on` selector targets the shared label set, not specific runners).
-
-No code or workflow changes are required to roll back, which is the strongest possible safety property for an infrastructure change.
-
-## Out of scope
-
- Warm-cache persistence (`actions/checkout clean: false` or custom DerivedData paths). Saves ~3 min per CI run but adds workflow complexity. Follow-up issue.
- Runner-health monitoring / alerting. Currently relies on `gh api .../actions/runners` snapshots and manual log inspection on Grogu. Follow-up issue.
- Per-runner-distinct labels (e.g., `runner-2`, `runner-3`). Default identical labels maximize matrix parallelism; per-runner labels would only matter for targeting a specific machine, which we don't need.
- Scaling beyond 3 runners. Hardware can support more, but matrix size (13 jobs) caps useful parallelism at ~4 runners. Cross that bridge only if matrix grows.
-
-## Definition of done
-
- `gh api /repos/KofTwentyTwo/Jarvis/actions/runners` shows three runners, all `status=online`.
- A retriggered CI run shows ≥3 SPM jobs `in_progress` simultaneously at peak.
- The retriggered run terminates `success` (no failures attributable to multi-runner setup).
- `CLAUDE.md` updated with the new runner inventory and operational notes.
- Spec document committed and merged.
-
-## References
-
- #180 — original single-runner setup
- #182 — zombie cleanup
- #188 — age-filter for multi-runner safety (precondition)
- `~/.claude/plugins/cache/claude-plugins-official/superpowers/5.1.0/skills/brainstorming` — process this design followed
@@ -1,114 +0,0 @@
-# v0.2 Wave 1 sequencing and execution — design
-
-**Status:** approved 2026-05-14 (autonomous execution authorized)
-**Authors:** brainstorm with James + Claude (Opus 4.7)
-**Scope:** Six tiny v0.2 issues (#19, #37, #45, #46, #47, #178) — sequenced into three PRs.
-
-## Goal
-
-Land all six Wave 1 issues against `develop` in three coherent PRs, in an order that minimises CI exposure to the known `MemoryWiringEndToEndTests` flake and keeps each PR's narrative reviewable as a single story.
-
-## Why three PRs, not six and not two
-
-Six individual PRs (the handoff's implicit default) maximises history granularity but burns 6× the SPM CI matrix and exposes us to the Memory flake on every branch. Two giant PRs maximise throughput but mix surfaces (build script + new workflow + bundle rebuild + Swift code) into a single review and a single revert unit.
-
-Three PRs grouped by surface area give us:
-
- 3× CI runs instead of 6×.
- Each PR has one coherent narrative (docs ⋄ infra ⋄ code).
- Each PR can be reverted independently without untangling unrelated work.
-
-## Composition
-
-### PR 1 — "Doc drift cleanup" (`docs/v0.2-wave-1-doc-drift`)
-
-**Issues:** #19 (MemoryStore stale Phase-7 doc-comments) + #45 (Bus JarvisBusWorld drift across 20+ docstrings post `fb41c5f`).
-
-**Why grouped:** both are descriptive/textual changes to documentation that no longer matches the code. #45 already requires a `@jarvis/bus` bundle rebuild and a new grep-gate, so it warrants doc-class company rather than mixing with real code fixes. Both touch package-internal documentation only; no behavioural change.
-
-**Deliverables:**
-
- `packages/Memory/Sources/Memory/MemoryStore.swift` — scrub "Plan 07-02 wires", "Plan 07-03 will replace", "future ops plan" hedges. Keep the 2026-05-11 comment at line 464–468 intact (it is correct).
- Bus comments renamed across `WebviewBridge.swift`, `Injection.js`, `webview/packages/bus/src/bridge.ts`, `webview/packages/hud/src/main.tsx`, `App/AppDelegate.swift` — replace "JarvisBusWorld" / "WKContentWorld('JarvisBusWorld')" / cross-world-attach language with "page world" / "shared world" / "defensive double-install guard".
- `bridge.ts:60–99` rationale rewritten — the duck-type `isJarvisBusShape` guard is now defensive against double-install (both `Injection.js`'s stub and the bundle's `installJarvisBus` running in the same page world), not cross-world attach. Comment must say this without misleading; do **not** delete the guard itself.
- Bundle rebuilt: `webview/packages/bus/dist/bridge.{js,d.ts}` regenerated via `pnpm --filter @jarvis/bus build` (or equivalent).
- `@jarvis/bus` `package.json` patch-version bumped to reflect comment changes in dist (matches existing project convention of patch-bumping when the published comments shift).
- New grep-gate: `scripts/check-no-jarvis-bus-world-references.sh` — fails if any tracked file outside `.planning/`, `docs/`, or git-history references contains the literal `JarvisBusWorld`. Wired into the boundary-gates list in CI and in `CLAUDE.md`.
-
-**Closes:** #19, #45.
-
-### PR 2 — "Build hygiene" (`ci/v0.2-wave-1-build-hygiene`)
-
-**Issues:** #46 (stale webview bundle artifacts) + #178 (OpenSSF Scorecard workflow).
-
-**Why grouped:** both touch repo-level infrastructure (`scripts/` and `.github/workflows/`) and neither touches Swift packages, so the heavy SPM matrix runs but with low chance of new test failures. Quick CI; safe to land first.
-
-**Deliverables:**
-
- `scripts/build-webview.sh` — before the existing `rsync -a ... dist/ -> App/Resources/webview/` at line 88, add an explicit cleanup of `App/Resources/webview/assets/*.js`, `*.js.map`, `*.css` (preserving `bus-harness.html`, the directory's `.gitignore`, and any other already-excluded files). Easiest mechanism: pass `--delete-excluded` plus an `--exclude` for each preserve target, or `rm -f` the asset glob before rsync. Either works; preference is `rm -f` of the explicit asset glob because it's grep-able.
- `App/Resources/webview/assets/` — delete the 10 stale `index-*.js` files and their `.map` siblings in the same commit so the directory is clean post-merge.
- `.github/workflows/scorecard.yml` — new file. Trigger `schedule: cron: "0 6 * * 1"` (weekly Mondays) + `push: branches: [develop]` + `workflow_dispatch`. Permissions: `id-token: write`, `contents: read`, `security-events: write`. Uses `ossf/scorecard-action@v2.4.0` (or latest at execution time). Upload SARIF to GitHub code-scanning.
- `README.md` — add OpenSSF Scorecard badge near the top (under the title or alongside existing badges). Badge URL pattern is the standard `https://api.scorecard.dev/projects/github.com/KofTwentyTwo/Jarvis/badge`.
-
-**Closes:** #46, #178.
-
-### PR 3 — "Small code fixes" (`fix/v0.2-wave-1-code-fixes`)
-
-**Issues:** #37 (STTBackendSelector snake_case vs call-site camelCase) + #47 (WebviewBridge NaN→null JSON guard for `audioLevel`).
-
-**Why grouped:** both are genuine one-shot code fixes with a unit test each, in different packages (Voice/App + Bus). Landing them together gives one Swift-package-test cycle for both fixes.
-
-**Deliverables for #37:**
-
- Decision: standardise on **camelCase** at call sites (matches existing identifier style elsewhere in the codebase). Update the constants in `STTBackendSelector` to camelCase string values, OR delete the unused constants in favour of an enum if call sites can adopt cheaply. Master agent picks the smaller diff after a quick read.
- Single rename or constant-shape change; ensure `App/AppDelegate.swift:2028` (and any other call sites a grep reveals) is consistent.
- Existing tests must still pass; if none cover the constant identity, add a small one in `packages/Voice/Tests/` asserting the chosen shape.
-
-**Deliverables for #47:**
-
- First verify #47 is still latent or has become active post-#42: grep for the audioLevel consumer in `webview/packages/hud/` and check whether real decode errors are firing in any logged scenario. Either way, ship the clamp.
- `packages/Bus/Sources/Bus/WebviewBridge.swift` — in `sendRaw` (or the `BusOutbound.audioLevel.encode` path, whichever is the cleanest place), replace non-finite `rms` floats with `0.0` before encoding. Inline fix only; do not refactor `AudioLevelEmitter` simultaneously (separate concern).
- New unit test: `BusOutboundEncodingTests` (or extend the nearest existing suite) asserts `BusOutbound.audioLevel(rms: .nan)` decodes JS-side with `rms == 0.0`. Use the existing harness convention (`Mock*` only if recording, `Stub*` for canned data, `Fake*` for stateful) per CLAUDE.md.
-
-**Closes:** #37, #47.
-
-## Landing order
-
-1. **PR 2 first** — lowest blast radius, lightest CI footprint, validates the multi-runner pipeline on something we can revert in seconds if it breaks.
-2. **PR 1 second** — purely descriptive, no behavioural change. CI surface is large (Bus + Memory packages, full webview build), but new tests should not fail because no logic moves.
-3. **PR 3 last** — real code touches. By the time we get here, the Memory flake is the only plausible failure mode, so if a job goes red we know it is the flake.
-
-## Memory-flake disposition
-
-Per `docs/HANDOFF-2026-05-14-multi-runner-shipped.md`: `MemoryWiringEndToEndTests` flakes intermittently on PR branches under concurrent-runner load. Branch protection has zero required checks, so flake-induced red is not blocking.
-
-Master agent policy:
-
-1. If a PR's CI fails on Memory only, rerun the failed jobs once.
-2. If they pass on rerun, merge.
-3. If they fail a second time, leave the PR open with the Memory failure visible and open `bug,severity:medium,area:memory` issue documenting the test as known-flaky in v0.2. Do not merge without user sign-off.
-4. If any *non-Memory* check fails, stop and report back — do not rerun, do not merge.
-
-## Non-goals
-
- Do not touch PRs #185, #191, #192. They are tracked in a separate disposition.
- Do not open or address Wave 2/3 issues (#18, #23/#24, #43, #44, #176, #26, M-series epics).
- Do not refactor `AudioLevelEmitter` while fixing #47.
- Do not change branch protection settings.
- Do not bypass pre-commit hooks (`--no-verify`).
- Do not force-push.
- Do not rebase #185/#191/#192 onto the new tip of develop.
-
-## Success criteria
-
- Issues #19, #37, #45, #46, #47, #178 all closed via merge.
- `develop` HEAD's CI is green after all three merges.
- `App/Resources/webview/assets/` contains only the active bundle (one `index-*.js` + `.map` + `.css`) after PR 2 merges.
- OpenSSF Scorecard workflow appears in Actions → Workflows and has at least one successful run (or a clearly-named permission failure to address in a follow-up).
- Grep for `JarvisBusWorld` outside `.planning/`, `docs/`, and committed history returns nothing.
- `swift test --package-path packages/Bus` passes including the new NaN-clamp test.
- No new test doubles violate the `Mock*`/`Stub*`/`Fake*` convention.
-
-## Effort budget
-
-~90 min of coding across the three PRs, plus CI wait time. Master agent should target completion in 90 min wall clock; if it falls behind, it must report partial progress rather than rush.
@@ -43,20 +43,6 @@ public struct CacheHints: Sendable, Equatable {
    /// Once the system prompt grows past the threshold (e.g. memory
    /// hydration adds context, presence enrichment lengthens the prompt)
    /// the hint resumes automatically.
-    ///
-    /// **Current production state (as of v0.1):** `selfAwarePreamble` is
-    /// ~700 chars and the orchestrator is constructed with an `.empty`
-    /// initial context, so the threshold is never crossed on a healthy
-    /// boot — `eligibleForSystemPrompt` returns `nil` on every turn and
-    /// the prompt cache is effectively dormant. This is intentional
-    /// cost-acceptance: padding the preamble to ≥4096 chars would
-    /// require real prompt-engineering work and risks bleeding
-    /// irrelevant context into the model. Cache hits resume naturally
-    /// once Memory M-4 (v0.8 milestone) lands `searchFacts`-driven
-    /// hydration that grows the prompt past 1024 tokens organically;
-    /// see #23 for the audit context. Until then, every turn pays full
-    /// input-token cost — a ~30–80% cost reduction is on the table once
-    /// M-4 ships.
    public static func eligibleForSystemPrompt(
        _ systemPromptText: String,
        ttl: CacheTTL = .extended1h
@@ -508,15 +508,6 @@ public actor AgentOrchestrator {
        // for the current pass. Reset on each pass restart (initial entry +
        // T1→T2 escalation re-enter via `continue outer`).
        var assistantTextSoFar: String = ""
-        // #24: text accumulated since the most recent toolUse append (or
-        // since the start of the round if no toolUse yet). Distinct from
-        // `assistantTextSoFar` which stays cumulative for D-02 vision
-        // routing on endTurn. This buffer feeds the assistant message
-        // history alongside each toolUse block so the model sees its own
-        // narration ("Let me check..." → tool_use(get_time)) on subsequent
-        // round-trips; previously the text was dropped entirely from
-        // history and the model would deny ever saying it.
-        var assistantTextSinceLastFlush: String = ""
        // D-02: escalation gets ONE shot. The second low-confidence outcome
        // stays on T1 (the user got the response we have). This mirrors the
        // AGENT-09 retry budget but is independent of it.
@@ -584,10 +575,6 @@ public actor AgentOrchestrator {
                        // can hand it to VisionRouter.evaluatePostResponse.
                        // Reset on `continue outer` from the escalation arm.
                        assistantTextSoFar += s
-                        // #24: also accumulate into the per-tool-use flush
-                        // buffer so the next toolUseRequested attaches the
-                        // preceding narration to its assistant message.
-                        assistantTextSinceLastFlush += s
                        await replayLog.record(.textDelta(s), for: currentTurnId)
                        await events.send(.tokenDelta(turnId: currentTurnId, text: s))

@@ -614,29 +601,9 @@ public actor AgentOrchestrator {
                        // history so providers that require the original
                        // tool_use round-trip (Anthropic) can resolve the
                        // tool_use_id when the next tool_result lands.
-                        //
-                        // #24: bundle any text the model emitted since the
-                        // last flush — Opus 4.7 commonly narrates ("Let me
-                        // check the time...") before calling a tool. Without
-                        // this the text was dropped from history and the
-                        // model would deny ever saying it on a follow-up.
-                        // Trim whitespace-only text to avoid emitting empty
-                        // text blocks (which Anthropic rejects with a 400).
-                        var assistantContent: [LLMMessage.ContentBlock] = []
-                        let pendingText = assistantTextSinceLastFlush
-                            .trimmingCharacters(in: .whitespacesAndNewlines)
-                        if !pendingText.isEmpty {
-                            assistantContent.append(.text(pendingText))
-                        }
-                        assistantContent.append(
-                            .toolUse(id: req.id, name: req.name, argsJSON: req.argsJSON)
-                        )
-                        messages.append(LLMMessage(role: .assistant, content: assistantContent))
-                        // Consumed — the next toolUseRequested in the same
-                        // round (rare but possible) gets only the text that
-                        // came BETWEEN the two tool_use blocks. D-02's
-                        // cumulative `assistantTextSoFar` is untouched.
-                        assistantTextSinceLastFlush = ""
+                        messages.append(LLMMessage(role: .assistant, content: [
+                            .toolUse(id: req.id, name: req.name, argsJSON: req.argsJSON),
+                        ]))

                        do {
                            let resultData = try await toolDispatcher.dispatch(toolUse: req)
@@ -1,210 +0,0 @@
-import XCTest
-import AgentCore
-import Config
-import Replay
-@testable import AgentOrchestrator
-
-/// **#24 — assistant text blocks alongside tool_use must not be dropped.**
-///
-/// Opus 4.7 frequently narrates before invoking a tool ("Let me check the
-/// time for you..." → `tool_use(get_time)`). Before this fix, the
-/// orchestrator appended only the `.toolUse` block to `messages`, so on
-/// the next round-trip the model had no record of saying anything — a
-/// user follow-up like "what did you say before checking the time?"
-/// would get a denial.
-///
-/// These tests assert the assistant message at the round-trip boundary
-/// contains BOTH the preceding text and the tool_use block. D-02's
-/// cumulative `assistantTextSoFar` is preserved separately; only the
-/// per-flush buffer is consumed.
-@MainActor
-final class AssistantTextWithToolUseTests: XCTestCase {
-
-    var tempHome: TempReplayHome!
-
-    override func setUp() async throws {
-        try await super.setUp()
-        tempHome = TempReplayHome.make()
-    }
-
-    override func tearDown() async throws {
-        tempHome?.cleanup()
-        try await super.tearDown()
-    }
-
-    private func buildOrchestrator(
-        provider: MockLLMProvider,
-        dispatcher: any ToolDispatcher
-    ) async throws -> AgentOrchestrator {
-        let replay = try ReplayLog(databaseURL: tempHome.dbURL)
-        let session = try await replay.beginSession(appVersion: "test", buildSHA: "deadbeef")
-        return AgentOrchestrator(
-            configStore: makeConfigStore(),
-            providerFactory: { _ in provider },
-            toolDispatcher: dispatcher,
-            replayLog: replay,
-            sessionId: session,
-            systemPrompt: "you are jarvis",
-            availableTools: []
-        )
-    }
-
-    private func collectUntilIdle(orch: AgentOrchestrator, timeout: TimeInterval = 5.0) async {
-        let deadline = Date().addingTimeInterval(timeout)
-        for await event in orch.events {
-            if case .stateChange(.idle) = event { return }
-            if Date() > deadline { return }
-        }
-    }
-
-    // MARK: - ATU-1
-
-    /// Single text-then-tool sequence: model emits "Let me check..." then
-    /// `tool_use(get_time)`. The assistant message in the second provider
-    /// call must contain a `.text` block AND a `.toolUse` block.
-    func test_ATU1_textBeforeToolUseBundledIntoSameAssistantMessage() async throws {
-        let toolReq = ToolUseRequest(id: "tu1", name: "get_time", argsJSON: Data("{}".utf8))
-        let mock = MockLLMProvider(scripts: [
-            .init(events: [
-                .messageStart(LLMMessageStart(messageId: "m1", model: "x", usagePrefix: nil)),
-                .textDelta("Let me check the time for you... "),
-                .toolUseRequested(toolReq),
-                .stopReason(.toolUse),
-                .messageStop,
-            ]),
-            .init(events: [
-                .messageStart(LLMMessageStart(messageId: "m2", model: "x", usagePrefix: nil)),
-                .textDelta("It's 12:34."),
-                .stopReason(.endTurn),
-                .messageStop,
-            ]),
-        ])
-        let dispatcher = StubToolDispatcher(dispatch: { _ in Data("12:34".utf8) })
-
-        let orch = try await buildOrchestrator(provider: mock, dispatcher: dispatcher)
-        _ = await orch.submit(.text("what time"))
-        await collectUntilIdle(orch: orch)
-
-        let calls = await mock.getRecordedCalls()
-        XCTAssertEqual(calls.count, 2, "expected 2 provider calls (tool-use loop)")
-
-        // Find the assistant message containing the tool_use block in the
-        // second call's history.
-        let secondCall = calls[1].messages
-        guard let assistantWithTool = secondCall.first(where: { msg in
-            msg.role == .assistant && msg.content.contains(where: { block in
-                if case .toolUse(id: "tu1", _, _) = block { return true }
-                return false
-            })
-        }) else {
-            return XCTFail("no assistant message with the tool_use block found in second call")
-        }
-
-        // Block ordering: text first, then tool_use.
-        let blockKinds = assistantWithTool.content.map { block -> String in
-            switch block {
-            case .text: return "text"
-            case .toolUse: return "toolUse"
-            case .toolResult: return "toolResult"
-            }
-        }
-        XCTAssertEqual(blockKinds, ["text", "toolUse"],
-            "assistant block sequence must be [text, toolUse] — got \(blockKinds)")
-
-        // The text content matches what the model streamed (trimmed).
-        if case .text(let txt) = assistantWithTool.content[0] {
-            XCTAssertEqual(txt, "Let me check the time for you...",
-                "text block must contain the streamed narration (trimmed)")
-        } else {
-            XCTFail("expected first block to be .text")
-        }
-    }
-
-    // MARK: - ATU-2
-
-    /// If the model emits a tool_use with NO preceding text (Opus
-    /// occasionally does this — straight to tool), the assistant message
-    /// must contain ONLY the toolUse block (no empty `.text("")` block,
-    /// which Anthropic rejects with a 400).
-    func test_ATU2_noPrecedingTextOnlyToolUseBlock() async throws {
-        let toolReq = ToolUseRequest(id: "tu2", name: "get_time", argsJSON: Data("{}".utf8))
-        let mock = MockLLMProvider(scripts: [
-            .init(events: [
-                .messageStart(LLMMessageStart(messageId: "m1", model: "x", usagePrefix: nil)),
-                .toolUseRequested(toolReq),
-                .stopReason(.toolUse),
-                .messageStop,
-            ]),
-            .init(events: [
-                .messageStart(LLMMessageStart(messageId: "m2", model: "x", usagePrefix: nil)),
-                .textDelta("done"),
-                .stopReason(.endTurn),
-                .messageStop,
-            ]),
-        ])
-        let dispatcher = StubToolDispatcher(dispatch: { _ in Data("12:34".utf8) })
-
-        let orch = try await buildOrchestrator(provider: mock, dispatcher: dispatcher)
-        _ = await orch.submit(.text("time"))
-        await collectUntilIdle(orch: orch)
-
-        let calls = await mock.getRecordedCalls()
-        guard let assistantWithTool = calls[1].messages.first(where: { msg in
-            msg.role == .assistant && msg.content.contains(where: { block in
-                if case .toolUse(id: "tu2", _, _) = block { return true }
-                return false
-            })
-        }) else {
-            return XCTFail("expected assistant message with tool_use block")
-        }
-
-        XCTAssertEqual(assistantWithTool.content.count, 1,
-            "no preceding text — assistant message must contain only the toolUse block, got \(assistantWithTool.content.count) blocks")
-        if case .toolUse = assistantWithTool.content[0] {
-            // ok
-        } else {
-            XCTFail("expected sole content block to be .toolUse")
-        }
-    }
-
-    // MARK: - ATU-3
-
-    /// Whitespace-only preceding text must NOT be emitted as a `.text`
-    /// block (Anthropic rejects empty/whitespace-only text blocks). The
-    /// implementation trims whitespace before testing for emptiness.
-    func test_ATU3_whitespaceOnlyTextNotEmitted() async throws {
-        let toolReq = ToolUseRequest(id: "tu3", name: "get_time", argsJSON: Data("{}".utf8))
-        let mock = MockLLMProvider(scripts: [
-            .init(events: [
-                .messageStart(LLMMessageStart(messageId: "m1", model: "x", usagePrefix: nil)),
-                .textDelta("   \n\t  "),  // whitespace only
-                .toolUseRequested(toolReq),
-                .stopReason(.toolUse),
-                .messageStop,
-            ]),
-            .init(events: [
-                .messageStart(LLMMessageStart(messageId: "m2", model: "x", usagePrefix: nil)),
-                .stopReason(.endTurn),
-                .messageStop,
-            ]),
-        ])
-        let dispatcher = StubToolDispatcher(dispatch: { _ in Data("ok".utf8) })
-
-        let orch = try await buildOrchestrator(provider: mock, dispatcher: dispatcher)
-        _ = await orch.submit(.text("hi"))
-        await collectUntilIdle(orch: orch)
-
-        let calls = await mock.getRecordedCalls()
-        guard let assistantWithTool = calls[1].messages.first(where: { msg in
-            msg.role == .assistant && msg.content.contains(where: { block in
-                if case .toolUse(id: "tu3", _, _) = block { return true }
-                return false
-            })
-        }) else {
-            return XCTFail("expected assistant message with tool_use block")
-        }
-
-        XCTAssertEqual(assistantWithTool.content.count, 1,
-            "whitespace-only preceding text must be dropped, leaving only the toolUse block")
-    }
-}
@@ -159,20 +159,7 @@ extension BusOutbound: Codable {
            try container.encode(text, forKey: .text)
        case .audioLevel(let rms):
            try container.encode(Discriminator.audioLevel, forKey: .type)
-            // Issue #47: JSON has no canonical encoding for `Float.nan` or
-            // `±Float.infinity`. Foundation's `JSONEncoder` defaults to
-            // throwing for non-finite floats (`JSONEncoder.NonConformingFloat-
-            // EncodingStrategy.throw`), which would crash the per-frame bus
-            // path the moment `AudioLevelEmitter` produces a NaN — easy to
-            // hit on a CoreAudio over-/underflow or a buffer of all-zero
-            // samples. Clamp non-finite to 0.0 inline at the encode site so
-            // the rms float in the wire JSON is always a finite, ring-shader-
-            // safe number. The HUD-side consumer (`webview/packages/hud/src/
-            // bus/client.ts`) currently no-ops on audioLevel; the clamp is
-            // defensive against the bug becoming active once the consumer is
-            // wired up.
-            let safe = rms.isFinite ? rms : 0.0
-            try container.encode(safe, forKey: .rms)
+            try container.encode(rms, forKey: .rms)
        case .toolCallStart(let id, let name, let argsPreview):
            try container.encode(Discriminator.toolCallStart, forKey: .type)
            try container.encode(id.uuidString.lowercased(), forKey: .id)
@@ -3,13 +3,7 @@ import XCTest

 /// Exercises `OutboundBatcher` behaviour against a recording fake sink. All
 /// timing assertions are designed to survive CI jitter — the batcher's nominal
-/// window is 33ms; tests wait 250ms (≈7.5x) before asserting. The earlier
-/// 80ms wait was tight enough that macOS-15 GitHub Actions runners (cold
-/// build + cold WKWebView mount sharing the box) intermittently dropped
-/// `test_tokenDeltaConcat` with sendCount=0 — the 33ms `Task.sleep` had not
-/// yet hopped back through the batcher actor + main actor by the time the
-/// test resumed. 250ms gives the scheduled drain ample time without making
-/// the suite noticeably slower (the four affected tests cost ~1s total).
+/// window is 33ms; tests wait ≥60ms (≈2x) before asserting.
 ///
 /// The fake is `@MainActor`-isolated because `BusOutbound` does not cross
 /// actor boundaries by default under Swift 6 strict concurrency, and the
@@ -27,16 +21,13 @@ final class BatcherTests: XCTestCase {
        }
    }

-    // A small drain-wait helper. The batcher window is 33ms; wait 250ms to
-    // let the scheduled drain fire and propagate the main-actor hop. The
-    // earlier 80ms wait was flaky on macos-15 CI runners (cold builds racing
-    // a cold WKWebView mount on the same box) — see commit message + doc
-    // comment above. `@MainActor` because each test is main-actor-isolated
-    // and Swift 6 strict concurrency disallows sending `self` across a
-    // nonisolated boundary.
+    // A small drain-wait helper. The batcher window is 33ms; wait 80ms to let
+    // the scheduled drain fire and propagate the main-actor hop.
+    // `@MainActor` because each test is main-actor-isolated and Swift 6 strict
+    // concurrency disallows sending `self` across a nonisolated boundary.
    @MainActor
    private func waitForDrain() async {
-        try? await Task.sleep(for: .milliseconds(250))
+        try? await Task.sleep(for: .milliseconds(80))
    }

    // MARK: - Tests
@@ -123,44 +123,6 @@ final class CodableRoundTripTests: XCTestCase {
        )
    }

-    /// Issue #47: `BusOutbound.audioLevel` encodes a `Float`, and Foundation's
-    /// default `JSONEncoder.NonConformingFloatEncodingStrategy` is `.throw`.
-    /// A non-finite `rms` (NaN from a CoreAudio over-/underflow, or ±∞ from a
-    /// pathological emitter buffer) would crash the per-frame bus path inside
-    /// `WebviewBridge.sendRaw`. The encode site in `BusOutbound.swift` clamps
-    /// non-finite floats to `0.0`; this test pins the contract so the clamp
-    /// can't silently regress.
-    func test_audioLevel_nanIsClampedToZero() throws {
-        let encoded = try BusCoder.makeEncoder().encode(BusOutbound.audioLevel(rms: .nan))
-        let decoded = try BusCoder.makeDecoder().decode(BusOutbound.self, from: encoded)
-        guard case .audioLevel(let rms) = decoded else {
-            XCTFail("expected .audioLevel after round-trip, got \(decoded)")
-            return
-        }
-        XCTAssertEqual(rms, 0.0, "NaN rms must be clamped to 0.0 at encode time (#47)")
-        XCTAssertTrue(rms.isFinite, "post-clamp rms must be finite")
-    }
-
-    /// Companion to `test_audioLevel_nanIsClampedToZero` — covers the ±∞
-    /// edge cases. CoreAudio drivers don't normally emit infinities, but the
-    /// encode-time clamp is sourced from `Float.isFinite`, which covers both
-    /// NaN and ±∞ via one check; locking the contract here prevents a future
-    /// refactor from narrowing the guard to NaN-only.
-    func test_audioLevel_infinityIsClampedToZero() throws {
-        let encoder = BusCoder.makeEncoder()
-        let decoder = BusCoder.makeDecoder()
-
-        for value in [Float.infinity, -Float.infinity] {
-            let encoded = try encoder.encode(BusOutbound.audioLevel(rms: value))
-            let decoded = try decoder.decode(BusOutbound.self, from: encoded)
-            guard case .audioLevel(let rms) = decoded else {
-                XCTFail("expected .audioLevel for \(value)")
-                continue
-            }
-            XCTAssertEqual(rms, 0.0, "±∞ rms (\(value)) must be clamped to 0.0 (#47)")
-        }
-    }
-
    func test_roundTrip_toolCallStart() throws {
        let id = UUID(uuidString: "550e8400-e29b-41d4-a716-446655440000")!
        try assertOutboundRoundTrips(
@@ -64,7 +64,7 @@ let package = Package(
            ],
            path: "Sources/Harness",
            resources: [
-                .copy("Corpora"),
+                .copy("../../Corpora"),
            ],
            swiftSettings: [.swiftLanguageMode(.v6)]
        ),
@@ -1,14 +1,5 @@
 import Foundation
-// D-5/D-6 closure cascade: `import SQLite3` would pull the SDK's stripped
-// `SQLite3.tbd` and its `sqlite3ext.h`, which on Xcode 26.x macOS 26.x SDKs
-// declares `set_errmsg` / `db_status64` (SQLite 3.51+ struct members).
-// `Replay`'s `SQLiteConnection` `@_exported import CSQLiteVec`s the bundled
-// jkrukowski/SQLiteVec build, whose vendored `sqlite3ext.h` does **not**
-// have those members. Importing both modules produces conflicting
-// `struct sqlite3_api_routines` definitions and the compile fails. Importing
-// `CSQLiteVec` directly here (matching `Replay`) keeps a single coherent
-// SQLite surface and the `sqlite3_*` call sites below are unchanged.
-import CSQLiteVec
+import SQLite3
 import AgentCore
 import AgentOrchestrator
 import Replay
@@ -1,12 +1,5 @@
 import Foundation
-// D-5/D-6 closure cascade: `import SQLite3` (SDK overlay) conflicts with the
-// `CSQLiteVec` module that Replay's `SQLiteConnection` `@_exported import`s.
-// Xcode 26.x macOS 26 SDK adds `set_errmsg` / `db_status64` to the system
-// `sqlite3_api_routines`; the bundled jkrukowski/SQLiteVec build does not,
-// so importing both yields conflicting struct definitions. Use the bundled
-// module instead — `sqlite3_*` symbols below resolve via the same
-// statically-linked SQLite that `Replay` and `Memory` already use.
-import CSQLiteVec
+import SQLite3
 import AgentCore
 import AgentOrchestrator
 import Replay
@@ -12,7 +12,7 @@ import OllamaProvider
 //
 // Gated by JARVIS_REAL_MODELS=1 — skipped in CI. Runs interactively against
 // a real local Ollama with both `nomic-embed-text` (embedding) and
-// `qwen3.6:latest` (extractor, per commit 8d0a959) pulled.
+// `qwen2.5-coder:32b` (extractor) pulled.
 //
 // Run interactively on the developer's Apple Silicon Mac:
 //   JARVIS_REAL_MODELS=1 swift test --package-path packages/Memory --filter MemoryRegressionCorpusTests
@@ -37,7 +37,7 @@ final class MemoryRegressionCorpusTests: XCTestCase {
    private func skipIfNotRealModels() throws {
        try XCTSkipUnless(
            ProcessInfo.processInfo.environment["JARVIS_REAL_MODELS"] == "1",
-            "Set JARVIS_REAL_MODELS=1 to run memory regression corpus (requires local Ollama with nomic-embed-text + qwen3.6:latest, plus a loadable vec0.dylib)"
+            "Set JARVIS_REAL_MODELS=1 to run memory regression corpus (requires local Ollama with nomic-embed-text + qwen2.5-coder:32b, plus a loadable vec0.dylib)"
        )
    }

@@ -28,16 +28,6 @@ public protocol STTWarningLogger: Sendable {
 public enum STTBackendSelector {

    // MARK: - Valid backend strings
-    //
-    // Canonical backend identifiers. Snake_case is the wire shape stored in
-    // `PerTurnSnapshot.stt.backend`. Call sites (`AppDelegate.sttBackend`)
-    // SHOULD reference these constants rather than the bare string literals;
-    // `STTBackendSwitchTests.testB5_canonicalConstantsRoundTripThroughMake`
-    // locks the round-trip contract by asserting both that the constants
-    // map to the right `STTProvider` AND that camelCase string literals
-    // (the pre-2026-05-12 anti-pattern from Issue #29 / #37) fall through
-    // to the default branch with a warning. Do not rename without updating
-    // `PerTurnSnapshot` and the regression test in lockstep.

    public static let backendSpeechAnalyzer = "speech_analyzer"
    public static let backendWhisperKit = "whisperkit"
@@ -13,46 +13,9 @@ import AVFoundation

 final class AVSpeechSmokeTests: XCTestCase {

-    // MARK: - Cold-start warm-up
-    //
-    // `AVSpeechSynthesizer` pays a one-time per-process cost on its very first
-    // `speak()` call: the speech subsystem loads the default voice and
-    // initializes the audio path. On Apple Silicon dev machines this is well
-    // under 200 ms and never disturbs the A1 2 s budget. On the macos-15
-    // GitHub Actions hosted runner — colder, multi-tenant box, slower disk —
-    // the same first call has been measured at ~4 s (see CI run 25801448991
-    // job 75792456290: testA1 failed at 4.07 s). The 2 s assertion is a real
-    // regression budget for the warm path; we don't want to bump it. The fix
-    // is to pay the cold-start cost in a class-level `setUp` so every test
-    // method below runs against a warm engine.
-    //
-    // `setUp(_:)` is the modern async XCTest entry point; using
-    // `class func setUp()` would not allow `await`, and the warm-up
-    // genuinely needs to await the synthesizer's delegate callback.
-    //
-    // We warm up before every test rather than gating on a `static var`
-    // because Swift 6 strict concurrency rejects unsynchronized mutable
-    // static state, and adding a lock here for a ~200ms saving per test
-    // is more complexity than the savings warrant. After the first
-    // warm-up call, the macOS process-wide speech subsystem stays primed,
-    // so subsequent setUp() warm-ups are themselves fast (~tens of ms).
-    override func setUp() async throws {
-        try await super.setUp()
-        // Drive one full speak() to amortize voice/audio-path init. The
-        // synthesizer is local; the 1-char utterance keeps cold-start cost
-        // bounded. We don't assert anything here — only its side effect of
-        // priming the speech subsystem matters.
-        let warmer = AVSpeechSynth()
-        await warmer.speak(" ", voice: nil)
-    }
-
    // MARK: A1 — speak resolves within 2 seconds

    func testA1_speakResolvesWithinTwoSeconds() async throws {
-        // Warm path: synthesizer has already been driven once in setUp().
-        // The 2 s budget asserts the steady-state cost (not cold-start cost),
-        // which is what users actually experience after the first utterance
-        // of a session.
        let synth = AVSpeechSynth()
        let deadline = Date().addingTimeInterval(2.0)
        await synth.speak("OK", voice: nil)
@@ -114,19 +114,10 @@ final class TTSInterruptTests: XCTestCase {
        let (stream, cont) = AsyncStream<TTSEvent>.makeStream()

        let (avEngine, playerNode, format) = makeAudioComponents()
-        // Stall widened 100 → 400 → 800 ms over successive CI runs. The
-        // semantic under test is "InterruptSequence's 20ms completion timeout
-        // fires before the sink stall would have completed on its own" —
-        // measured by `elapsed < stallDuration`. CI run 25801448991 observed
-        // elapsed=108ms (already past the 100ms stall); CI run 25805500292
-        // observed elapsed=263ms (already past the 250ms budget but still
-        // under the 400ms stall). Widening stall to 800ms keeps the
-        // semantic intact while giving the cold macos-15 GitHub Actions
-        // runner generous headroom.
        let sink = StallingSink(
            playerNode: playerNode,
            format: format,
-            stallDuration: .milliseconds(800)
+            stallDuration: .milliseconds(100)
        )
        try avEngine.start()
        playerNode.play()
@@ -151,14 +142,11 @@ final class TTSInterruptTests: XCTestCase {
        var events: [TTSEvent] = []
        for await e in stream { events.append(e) }

-        // .ttsStopped must fire before the 800 ms stall completes (20 ms timeout
-        // + CI overhead). Budget = 500 ms: 20 ms timeout + ~480 ms of allowable
-        // actor-hop / scheduling overhead on a cold CI runner, still well
-        // under the 800 ms stall ceiling that would invalidate the semantic.
+        // .ttsStopped must fire before the 100 ms stall completes (20 ms timeout)
        XCTAssertLessThan(
            elapsed,
-            0.500,
-            "InterruptSequence must complete within ~500 ms (20 ms timeout + CI overhead), got \(elapsed * 1000) ms"
+            0.080,
+            "InterruptSequence must complete within ~80 ms (20 ms timeout + overhead), got \(elapsed * 1000) ms"
        )
        XCTAssertTrue(events.contains(.ttsStopped), ".ttsStopped must fire on timeout")

@@ -93,16 +93,7 @@ final class VoiceControllerTests: XCTestCase {

        let emitter = AudioLevelEmitter(subscription: subscription, bus: recorder, hzRate: 30)
        await emitter.start()
-        // 1000ms window (250 → 500 → 1000 over successive CI runs). At 30 Hz
-        // we expect ~30 samples; floor of 3 still asserts the emitter is
-        // running. The macos-15 GitHub Actions runner is materially slower
-        // than the user's Apple Silicon dev box — CI run 25801448991 saw 2
-        // emissions in 250 ms, CI run 25805500292 saw 3 in 500 ms. The floor
-        // is intentionally generous so this test is a "the emitter ticks
-        // periodically" smoke check, not a strict 30 Hz validation; the
-        // production guarantee is enforced by AudioLevelEmitter's internal
-        // sleep loop, not by counting ticks here.
-        try await Task.sleep(for: .milliseconds(1000))
+        try await Task.sleep(for: .milliseconds(250))
        await emitter.stop()

        let levels = await recorder.audioLevels
@@ -112,9 +103,9 @@ final class VoiceControllerTests: XCTestCase {
            XCTAssertGreaterThan(rms, 0.0, "RMS should be positive")
        }

-        // At 30 Hz over 1000ms we expect ~30 samples; minimum 3 (CI cold-start slack)
-        XCTAssertGreaterThanOrEqual(levels.count, 3,
-            "Emitter should tick at least 3 times over 1s")
+        // At 30 Hz over 250ms we expect ~7 samples; minimum 4 (slack for timing jitter)
+        XCTAssertGreaterThanOrEqual(levels.count, 4,
+            "Should emit ~30 Hz × 0.25s = ~7 emissions, minimum 4")
    }

    // MARK: - V5 (P1-3): stale STT finalize from a prior session is dropped
@@ -32,36 +32,18 @@ fi
 # via Logger.critical with "JarvisEntitlementsVerified missing/false".
 # Isolation eliminates the race entirely; bundle launches cleanly.
 echo "[check-app-builds] xcodebuild build (Debug, arm64, isolated DerivedData)..."
-
-# Capture the full xcodebuild log to a tempfile so we can summarise errors
-# on failure. `-quiet` + `tail -5` previously suppressed every signal except
-# `** BUILD FAILED **`, making CI failures undebuggable without re-running
-# locally. The set-pipefail + tee ensures we keep both a streamed (quiet)
-# console view and the full log for grep'ing.
-LOG="$(mktemp -t check-app-builds-XXXXXX.log)"
-trap 'rm -f "$LOG"' EXIT
-
-set +e
 xcodebuild build \
  -project Jarvis.xcodeproj \
  -scheme Jarvis \
  -destination 'platform=macOS,arch=arm64' \
  -configuration Debug \
  -derivedDataPath "$REPO_ROOT/build" \
-  > "$LOG" 2>&1
-status=$?
-set -e
+  -quiet 2>&1 | tail -5

-if [ "$status" -eq 0 ]; then
-  tail -5 "$LOG"
+if [ "${PIPESTATUS[0]}" -eq 0 ]; then
  echo "[check-app-builds] PASS — App target compiles cleanly"
  exit 0
+else
+  echo "[check-app-builds] FAIL — App target compile errors above" >&2
+  exit 1
 fi
-
-# Failure path: surface every `error:` line plus a generous tail for context.
-echo "[check-app-builds] FAIL — xcodebuild exited $status. Error lines:" >&2
-grep -E "error:|fatal error:|: error " "$LOG" >&2 || true
-echo >&2
-echo "[check-app-builds] Last 80 lines of xcodebuild output:" >&2
-tail -80 "$LOG" >&2
-exit 1