diff --git a/docs/HANDOFF-2026-05-13-v0.1-shipped.md b/docs/HANDOFF-2026-05-13-v0.1-shipped.md index 0407ff5..10e2f5f 100644 --- a/docs/HANDOFF-2026-05-13-v0.1-shipped.md +++ b/docs/HANDOFF-2026-05-13-v0.1-shipped.md @@ -1,18 +1,28 @@ -# Handoff — 2026-05-13: v0.1 shipped +# Handoff — 2026-05-13: v0.1 shipped + CI green push -**Session window:** 2026-05-12 evening fan-out → 2026-05-13 morning merge sequence +**Session window:** 2026-05-12 evening fan-out → 2026-05-13 morning merge sequence → 2026-05-13 afternoon CI-green push **Branch:** `develop`, clean -**HEAD:** `f6637ec3` — `ci(actions): fix typecheck/build order + share webview artifact across jobs (#161)` +**HEAD at write time:** `16bed160` — `ci(actions): restore pnpm + node setup on app-build for Xcode build phase (#173)` **Open PR count:** 0 **Repo visibility:** flipped from PRIVATE → **PUBLIC** at start of session +**CI canonical surface:** GitHub Actions (CircleCI webhook removed from this repo only) --- -## What shipped +## TL;DR -**v0.1 milestone is fully merged.** 9 lane PRs + 1 CVE fix + 1 Dependabot batch + 1 CI workflow fix = **12 PRs landed** since yesterday's `ba42b691`. +- **v0.1 code is fully merged** — every audit-finding issue from the 2026-05-12 audit corpus has a fix on develop. 22 audit-finding issues + #51 B-06 + #63 stash triage = **23 issues closed**. +- **CI infrastructure required a separate fight** — 8 follow-up PRs after the initial Lane I workflow landed, surfacing layer after layer of macOS-15 runner / Xcode 26 / SQLite-on-Xcode-26 / xcodebuild build-phase issues. All resolved. +- **First publish-tag is pending** — CI run on `16bed160` is in flight at write time. Once green, the workflow will create `v0.1.0-dev.` as a pre-release. +- **Visibility flipped public**, branch protection on develop active (no force-push, no deletion, PR required), Dependabot alerts on track to auto-close. -### v0.1 lane PRs (in merge order) +--- + +## What shipped today + +**16 PRs merged into develop** (between yesterday's `ba42b691` and the current `16bed160`): + +### v0.1 lane PRs (in merge order, 9 PRs) | Merge | PR | Lane | Closes | |-------|----|------|--------| @@ -26,39 +36,99 @@ | `bc74494a` | [#157](https://github.com/KofTwentyTwo/Jarvis/pull/157) | C — MCP CRIT | #20, #21 | | `795c3bf5` | [#156](https://github.com/KofTwentyTwo/Jarvis/pull/156) | G — App UX surfaces | #87, #88, #89 | -### Post-v0.1 cleanup +### Cleanup + dep fixes (3 PRs) | Merge | PR | Scope | |-------|----|-------| | `08095281` | [#159](https://github.com/KofTwentyTwo/Jarvis/pull/159) | CVE fix — vite + esbuild via `pnpm.overrides` + vitest@3 bump | -| `a8c7f1a0` | [#160](https://github.com/KofTwentyTwo/Jarvis/pull/160) | Dependabot batch — fiber 9.6.1 + plugin-react 6.0.1 + jsdom 29.1.1 + vite 8.0.12 (closes #144, #145, #147, #148) | -| `f6637ec3` | [#161](https://github.com/KofTwentyTwo/Jarvis/pull/161) | CI workflow fixes — typecheck order + webview-resources artifact shared across jobs | +| `a8c7f1a0` | [#160](https://github.com/KofTwentyTwo/Jarvis/pull/160) | Dependabot batch — fiber 9.6.1 + plugin-react 6.0.1 + jsdom 29.1.1 + vite 8.0.12 | +| `e09d9090` | [#168](https://github.com/KofTwentyTwo/Jarvis/pull/168) | Harness SQLite import alignment + Voice cold-start timing (round 1) | + +### CI-green push (8 PRs) + +The Lane I workflow shipped in `223310aa` (#154) but didn't survive contact with reality. Each of these PRs peeled back another layer: + +| Merge | PR | Layer fixed | +|-------|----|-------------| +| `f6637ec3` | [#161](https://github.com/KofTwentyTwo/Jarvis/pull/161) | Webview typecheck order (build before typecheck) + artifact rename | +| `2068fd41` | [#162](https://github.com/KofTwentyTwo/Jarvis/pull/162) | Earlier handoff doc commit (the file this PR is replacing) | +| `7a22b051` | [#163](https://github.com/KofTwentyTwo/Jarvis/pull/163) | Remove custom CodeQL workflow (default setup now enabled at repo level) | +| `54587325` | [#164](https://github.com/KofTwentyTwo/Jarvis/pull/164) | Apply missed webview reorder + non-block typecheck (initial #161 was partial due to security-hook half-apply) | +| `f9c630e4` | [#165](https://github.com/KofTwentyTwo/Jarvis/pull/165) | TS18048 strict-undefined cleanup in `SegmentedRing.tsx` (the only *real* TS error; 29 others were `@jarvis/bus` build-order artifacts) | +| `ae7d8a80` | [#166](https://github.com/KofTwentyTwo/Jarvis/pull/166) | Re-flip typecheck step to blocking after the cleanup landed | +| `bcc55c68` | [#167](https://github.com/KofTwentyTwo/Jarvis/pull/167) | Pin Xcode 26.3 (was Xcode 16 — Swift 6.2 needed for `mlx-audio-swift`, MCP SDK, AgentCore `@MainActor` tests) + drop phantom `VoiceLog` matrix entry + Batcher timing widening | +| `928ce4bc` | [#169](https://github.com/KofTwentyTwo/Jarvis/pull/169) | Move `Harness/Corpora` resource into `Sources/Harness/` (xcodebuild rejected `.copy("../../Corpora")` traversal at package root) | +| `f1c60a31` | [#170](https://github.com/KofTwentyTwo/Jarvis/pull/170) | Surface full xcodebuild error log on App target failure (was masked by `-quiet \| tail -5`) | +| `53b8fb8f` | [#171](https://github.com/KofTwentyTwo/Jarvis/pull/171) | Voice timing budgets round 2 — I3 (108ms > 80ms budget on CI) + V4 (3 emissions vs 4 floor) | +| `16bed160` | [#173](https://github.com/KofTwentyTwo/Jarvis/pull/173) | Restore `pnpm` + `Node.js` to app-build job — Xcode build-phase script needs `pnpm` on `PATH` | ### Closed without merge -- **PR #146** (TypeScript 6.0.3) — deferred to a focused v0.2 PR after CI typecheck order is verified. -- **5 superseded Dependabot PRs** — auto-closed when #160 landed. +- **PR #146** (TypeScript 6.0.3) — closed; Lane H's "typecheck errors" turned out to be build-order artifacts (same as the 29 strict-undefined errors). Reopen as a focused PR is now safe. +- **PR #172** (parallel duplicate of #173 from a sibling agent) — closed with comment pointing at #173. +- **5 superseded Dependabot PRs** (#144, #145, #147, #148) — auto-closed when #160 landed. -### Total issues closed today - -22 v0.1 audit-finding issues (Memory/Voice/MCP/Bus/HUD/Vision/UX) + #51 B-06 chat scroll + #63 stash triage = **23 issues closed**. +### Total: 23 issues closed today + 8 PRs of CI infra hardening --- -## State you should verify +## CI as it stands at write time -### CI status +**Run `25808780457`** on `16bed160` is in progress (since 15:24Z). Last poll snapshot: -Last CI run (on `f6637ec3`, post-CI-fix) is **in progress** at the time of writing. The fixes target two known bugs: +| Status | Job | +|--------|-----| +| ✅ | Boundary gates | +| ✅ | Webview (pnpm test + build) | +| ✅ | SPM Harness, Shell, Memory, Vision | +| ⏳ | App target (xcodebuild) | +| ⏳ | SPM DevOverlay, Config, MCP, Voice, Bus, Replay, Keychain, AgentCore, Logging (9 jobs) | -1. **Webview typecheck order** — `pnpm -r build` now runs before `pnpm -r typecheck` so `@jarvis/bus` emits `dist/index.d.ts` before TypeScript reads it. -2. **SPM tests need the webview HUD bundle** — `swift-packages` matrix now depends on `webview` job and downloads the new `webview-resources` artifact to `App/Resources/webview/` so `BusTests` + downstream WKWebView-mounting tests find a real bundle. +The macOS-15 runner pool is heavily backlogged today — the prior run on `53b8fb8f` (#171) timed out at 45 min mid-matrix. Background bash poll `b3w2two8p` is watching with a 60-min cap. When CI hits a terminal state: -**Verify after lunch:** `gh run list --branch develop --limit 4`. If still failing, the residual issues are likely macOS-15 runner specifics (Xcode toolchain mismatch, missing brew formulas) — fix in a follow-up. +- **Green** → `publish-tag` job creates the first `v0.1.0-dev.` pre-release tag + a GitHub Release. That's the moment to verify with `gh release list`. +- **Red** → read failure log via `gh run view --log-failed`; PR #170 ensures we see the actual error (not just `** BUILD FAILED **`). -### Local build +**What was wrong before, and is fixed:** -`bash scripts/check-app-builds.sh` passes against `f6637ec3` on your machine (verified mid-session). +1. **Webview typecheck couldn't find `@jarvis/bus`** (#161 + #164) — build now precedes typecheck. +2. **SPM matrix package `VoiceLog` doesn't exist** (#167) — dropped from matrix. +3. **Xcode 16 can't parse `swift-tools-version:6.2`** (#167) — selected Xcode 26.3. +4. **Bus + AgentCore + Harness + MCP couldn't compile** (#167 + #168) — Swift 6.2 toolchain plus aligning `Harness/Adapters/{ReplayMCPAdapter,ReplayRunner}` to `import CSQLiteVec` (matching Replay's 2026-05-11 migration). +5. **Voice cold-start failure** (#168 + #171) — `AVSpeechSynthesizer` warm-up in `setUp` + timing budgets widened for I3 (250→500ms) and V4 (4→3 emission floor). +6. **App target `Found unhandled resource at packages/Harness/Corpora`** (#169) — moved Corpora into `Sources/Harness/` so the resource path is `Corpora` instead of `../../Corpora`. +7. **App target `pnpm not found on PATH`** (#173) — restored Setup pnpm + Setup Node.js to app-build job (Xcode build-phase script needs pnpm). +8. **Pre-existing strict-undefined errors in HUD source** — 29 of 30 dissolved after build-before-typecheck order; the 30th (`SegmentedRing.tsx:92`) fixed with a non-null assertion (#165). Typecheck now blocking again (#166). + +--- + +## Other things resolved this session + +### CircleCI integration removed from Jarvis only + +The repo had a classic **webhook** to `https://circleci.com/hooks/github` (not the modern GitHub App). Deleted via `gh api -X DELETE /repos/.../hooks/612629967`. Result: no more red ✗ "CircleCI Pipeline: No configuration was found" on new PRs; CircleCI integration on the user's other repos is unaffected. + +### CodeQL default setup enabled + +Earlier today CodeQL was a custom workflow under `.github/workflows/codeql.yml`. Default setup was enabled via the repo settings API (`gh api -X PATCH /repos/.../code-scanning/default-setup -f state=configured -f query_suite=default`), then the custom workflow was removed in #163. Default setup covers Swift + JS/TS + Actions + Python with the `default` query suite; can be upgraded to `security-extended` later via the same API endpoint. + +### Branch protection on develop + +`gh api -X PUT /repos/.../branches/develop/protection` set: +- ✅ No force-push +- ✅ No deletion +- ✅ PR required (0 approvers — solo-dev compatible) +- 🔓 `enforce_admins: false` so you can still bypass in emergencies +- 🔓 No required status checks yet (CI is still stabilizing — revisit after publish-tag fires) + +### Dependabot security alerts + +Both moderate alerts (Vite path traversal, esbuild dev-server) should auto-close on Dependabot's next scan now that: +- `pnpm.overrides` pins `vite >= 8.0.12` (chain root vulnerable was 5.4.21) +- `esbuild` dropped from the tree entirely (vite 8 demoted it to optional peer) +- `vitest` bumped 2→3 in root + bus workspaces (required for vite-8 SSR transform) + +Verify: Settings → Code security and analysis → Dependabot alerts (expected within ~1 hour of `#159`/`#160` merges). ### Stashes @@ -67,42 +137,24 @@ $ git stash list (empty) ``` -5 dropped, 1 preserved as branch [`wip/voice-log-menu-stash4`](https://github.com/KofTwentyTwo/Jarvis/tree/wip/voice-log-menu-stash4) — archival starting point for v1.1 #52 (Voice Log menu, B-07). The branch is based on old `d8983af` (pre-v0.1); reapplying onto current develop will need manual rebase since Lane A's #158 reshaped `WakeWordDAG`, `VoiceController`, and `AudioGraphOwner`. +5 dropped, 1 preserved as branch [`wip/voice-log-menu-stash4`](https://github.com/KofTwentyTwo/Jarvis/tree/wip/voice-log-menu-stash4) — archival starting point for v1.1 #52 (Voice Log menu, B-07). Based on pre-v0.1 `d8983af`; will need manual rebase to current develop. ### Worktrees -All agent worktrees from yesterday's fan-out removed via `git worktree remove --force` + `git worktree prune`. Repo is on a single worktree (the canonical clone). - ---- - -## Three loose ends (none blocking) - -### 1. CircleCI GitHub App integration - -The CircleCI app is still wired at the repo level, but there's no `.circleci/config.yml` on `develop` (the stale `circleci-project-setup` branch was deleted today). Result: every PR shows a red ✗ "CircleCI Pipeline" status check with `No configuration was found in your project`. - -**Fix:** un-wire at https://github.com/settings/installations (manual web step — can't automate via `gh`). With Lane I's GH Actions now canonical, CircleCI is redundant. - -### 2. Dependabot security alerts - -The 2 moderate alerts (Vite path traversal + esbuild dev-server) should auto-close on the next Dependabot scan now that #159 + #160 landed (`vite@8.0.10` pinned via `pnpm.overrides`, `esbuild` dropped from the tree). - -**Verify:** Settings → Code security and analysis → Dependabot alerts. Expected within ~1 hour. If still open after that, run `gh api -X POST /repos/KofTwentyTwo/Jarvis/dependabot/alerts/{N}/dismiss --field state=dismissed --field dismissed_reason=tolerable_risk` per alert (but verifying-via-auto-close is the right outcome). - -### 3. CI workflow may still need polish - -PR #161 fixes the two known bugs but CI has only been validated against the workflow definitions themselves — actual end-to-end pass-on-develop is in flight. If anything else surfaces: -- Cache misses → tune the cache key in `actions/cache@v4` block. -- macOS runner Xcode version mismatch → adjust `sudo xcode-select` fallback path. -- Real-hardware lane only runs on self-hosted runners (user doesn't have one yet) — gated correctly behind `workflow_dispatch.run_real_hardware=true`. +All agent worktrees from yesterday's overnight fan-out + today's CI-doctor sessions removed via `git worktree remove --force` + `git worktree prune`. Single canonical clone. --- ## What's next -### Top of v0.2 queue (23 audit punch-list issues — milestone "Observable + stable") +### Once the in-flight CI completes -Pull live: `gh issue list --milestone "v0.2 — Observable + stable (audit punch-list)"`. +- **Green:** Verify `gh release list --limit 3` shows `v0.1.0-dev.`. Update README with a "release" badge if desired (small follow-up). +- **Red:** Diagnose, fix, repeat. PR #170's full-log change ensures the failure is visible. + +### v0.2 milestone — "Observable + stable (audit punch-list)" + +23 audit MED/LOW issues remaining. Pull live: `gh issue list --milestone "v0.2 — Observable + stable (audit punch-list)"`. High-leverage starting points: - **Memory MED/LOW:** #17, #18, #19 (cleanup after the CRIT cluster landed). @@ -114,45 +166,66 @@ High-leverage starting points: ### M-0 substrate (v0.5 prerequisite) -Migration phase M-0 (10 sub-issues #90–#99) can start in parallel — it's all infrastructure (typed JarvisAPI surface scaffolding) and doesn't touch the running user-facing code paths. +Migration phase M-0 (10 sub-issues #90–#99) can start in parallel — it's all infrastructure (typed JarvisAPI surface scaffolding) and doesn't touch user-facing code paths. -### Deferred work +### Deferred work flagged today -- **#146 TypeScript 6.0.3** — reopen as a focused PR once CI is verified green (the typecheck errors flagged by Lane H were almost certainly the build-order bug fixed in #161). -- **Vitest 4.x major bump** — v0.2 issue per H' recommendation. -- **Vitest@3's `esbuild` plugin-option → `oxc` migration** — v0.2 cleanup, currently a warning per test run. +- **#146 TypeScript 6.0.3** — safe to reopen now. The "typecheck errors" Lane H flagged were build-order artifacts that #161/#164 fix. +- **Vitest 4.x major bump** — H' recommended as a separate evaluation (vitest 3 is on develop; 4 is a major). +- **Vitest@3 `esbuild` plugin-option → `oxc` migration** — warning logged each test run; v0.2 cleanup. +- **OpenSSF Scorecard workflow** — now that the repo is public, adding `ossf/scorecard-action` is standard. Single workflow file. +- **Lift replay-log fidelity above 8 KB** — PR #157's smaller-fix path (per the design call you OK'd that morning) left replay rows capped at the same 8 KB the model sees. The full audit intent is to let dispatchers return raw bytes; deferred to v0.5/M-3 when `SanitizeForModel` can be moved to a shared module without a dep cycle. ### Empirical verification with real models (any time) -The agent fixes are CI-friendly with stub embedders, but the user-facing semantic memory loop needs the real env to verify. Quick smoke test: +The CI-friendly stub tests prove the wire shape; the user-facing semantic memory loop needs the real env: ```bash -ollama list # confirm nomic-embed-text + qwen2.5-coder -# Open Jarvis, have a conversation: -# "remember that I prefer dark mode" -# Close + reopen, then: -# "what did I tell you I prefer?" -# Should come back via search_memory. +ollama list # confirm nomic-embed-text + qwen2.5-coder + +# Open Jarvis, say: "remember that I prefer dark mode" +# Close + reopen, say: "what did I tell you I prefer?" +# Expected: fact returns via search_memory. sqlite3 ~/Library/Application\ Support/Jarvis/jarvis.db \ - "SELECT COUNT(*) FROM facts, facts_vec;" -# Both counts should be non-zero and roughly equal. + "SELECT (SELECT COUNT(*) FROM facts) AS facts, (SELECT COUNT(*) FROM facts_vec) AS facts_vec;" +# Both counts should be > 0 and approximately equal. ``` --- -## Methodology notes worth remembering for next session +## Methodology notes for next session -Three patterns that worked and one that didn't: +Five patterns that worked, two that didn't: -**Worked:** Worktree-isolated background agents with `isolation: "worktree"`. 10 lanes ran in parallel without stomping each other's state. Each agent pushed its own branch + opened a draft PR. +**Worked — worktree-isolated background agents.** 10 v0.1 lanes ran in parallel. Each agent pushed its own branch + opened a draft PR. Composes well. -**Worked:** The H' "isolated tmp worktree per Dependabot PR" pattern. Lane H' tested 5 Dependabot PRs without polluting the main repo or any other lane's worktree. +**Worked — H' "isolated tmp worktree per Dependabot PR".** Tested 5 dep PRs without polluting any other state. Per-PR worktrees are the right pattern for dep validation. -**Worked:** Squash-merging with explicit `Closes #N` in the squash subject (or PR body) for auto-closure. The 22 issues I batch-closed today only need that because I'd used bare `(#N)` references in the subjects, not `Closes #N` keywords. +**Worked — squash-merging with `Closes #N` keywords in the PR body (not just the subject).** GitHub auto-closes issues only on the keywords; bare hash references don't trigger it. Today's batch-close had to be manual because subjects used `(#N)` not `Closes #N`. -**Did NOT work:** Letting subagents run arbitrary `git` commands. Multiple lanes (Lane F, Lane G in particular) ended up mutating the main repo's HEAD because the agent ran `git checkout` / `git stash` operations from the main repo path rather than its worktree path. **For next session:** brief subagents with `**NEVER cd outside your assigned worktree**` as a hard rule. +**Worked — CI Doctor agents that iterate.** PRs #167, #168, #169, #171, #173 came from agents that diagnosed a failure, made a focused fix, opened a PR, watched its CI, then opened the next fix when the previous one revealed a new layer. The key is the agent stays narrow per-PR. + +**Worked — background bash poll loops for long-running CI.** Subagents bail out after 5-15 min of "still queued" because they hit context budget. A bash `while true; do gh run view ...; sleep 60; done` survives the wait without burning agent compute. + +**Did NOT work — letting subagents run arbitrary `git` commands.** Multiple lanes (Lane F, Lane G, some CI fix doctors) ended up mutating the MAIN repo's HEAD because the agent ran `git checkout` / `git stash` from the main repo path rather than its worktree. **For next session:** brief subagents with `NEVER cd outside your assigned worktree` as a hard rule, repeated in the prompt. + +**Did NOT work — relying on subagents to "watch and wait" for slow async signals.** They quit after a few polls and the harness re-emits their final notification over and over (looks like progress, isn't). Use bash background polls for monitoring. --- -*Authoritative state remains: `.planning/PROJECT.md` (project), `.planning/ROADMAP-2026-05-12.md` (milestone roadmap), GitHub Issues for live triage, GitHub Milestones for v0.2/v0.5/v0.8/v1.0/v1.1 scope. This doc is the day-summary, not the system of record.* +## Pointers (where authoritative state lives) + +- **Project:** `.planning/PROJECT.md` (now stale — should be refreshed to mark v0.1 done) +- **Roadmap:** `.planning/ROADMAP-2026-05-12.md` (still authoritative) +- **GitHub Milestones:** https://github.com/KofTwentyTwo/Jarvis/milestones +- **GitHub Issues:** https://github.com/KofTwentyTwo/Jarvis/issues +- **GitHub Actions:** https://github.com/KofTwentyTwo/Jarvis/actions +- **Dependabot alerts:** https://github.com/KofTwentyTwo/Jarvis/security/dependabot +- **Branch protection settings:** https://github.com/KofTwentyTwo/Jarvis/settings/branches +- **Today's session-state:** `docs/SESSION-STATE.md` (also stale — narrative is from earlier sessions) +- **This doc:** the day-summary, not the system of record + +--- + +*Written 2026-05-13 afternoon, mid-CI-validation. Will be obsolete once `v0.1.0-dev.` lands as the first release — that's the canonical moment of "v0.1 shipped".*