moving

.github/workflows/ci.yml

@@ -0,0 +1,179 @@
+name: CI
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+
+      - name: Cache npm dependencies
+        uses: actions/cache@v4
+        with:
+          path: ~/.npm
+          key: ${{ runner.os }}-npm-${{ hashFiles('**/package-lock.json') }}
+          restore-keys: |
+            ${{ runner.os }}-npm-
+
+      # NOTE: the switch to `npm ci` (deterministic, lockfile-faithful) is deferred
+      # to the deps/lockfile hardening pass, after the root package-lock.json is
+      # regenerated in sync with every workspace manifest. `npm install` is the
+      # safe, lockfile-tolerant install until then.
+      - run: npm install
+
+      # Real typecheck gate. The old step ran `npx tsc --noEmit` against the root
+      # tsconfig.json, whose `"files": ["apps/web/src/vite-env.d.ts"]` (and no
+      # `include`) typechecks essentially nothing. build:packages is the actual
+      # `tsc --build` chain for every @waggle/* package (shared → hive-mind-core →
+      # core → agent → server) and also emits the dist/ that apps/web unit tests
+      # import; typecheck:web is the real apps/web check (tsc -p tsconfig.app.json).
+      - name: Type check — workspace packages (tsc --build chain)
+        run: npm run build:packages
+
+      - name: Type check — web (apps/web, tsc -p tsconfig.app.json)
+        run: npm run typecheck:web
+
+      - name: Lint (root flat config)
+        run: npm run lint
+
+      - name: Tauri TS typecheck (app/scripts)
+        run: npx tsc -p app/tsconfig.json
+
+      # Runtime tests pack and install workspace packages. Build every ignored
+      # dist/ payload explicitly so CI proves a fresh checkout.
+      - name: Build package-install test runtimes
+        run: |
+          npm run build:hook-runtime
+          npm run build --workspace @waggle/cli
+          npm run build --workspace @waggle-ai/waggle
+          npm run build --workspace waggle-memory-mcp
+
+      - name: Unit tests — packages + cross-cutting (root vitest)
+        run: |
+          npm test -- \
+            --exclude=packages/cli/tests/cli-runtime.test.ts \
+            --exclude=packages/hive-mind-cli/tests/cli-help.test.ts \
+            --exclude=packages/hive-mind-mcp-server/tests/runtime.test.ts \
+            --exclude=packages/launcher/tests/cli.test.ts \
+            --exclude=packages/memory-mcp/tests/runtime.test.ts
+
+      # These tests each create a temporary project and run npm install. Running
+      # several cold installs in parallel makes individual test timeouts measure
+      # runner contention rather than package correctness.
+      - name: Package-install runtime tests (serial)
+        run: |
+          npx vitest run \
+            packages/cli/tests/cli-runtime.test.ts \
+            packages/hive-mind-cli/tests/cli-help.test.ts \
+            packages/hive-mind-mcp-server/tests/runtime.test.ts \
+            packages/launcher/tests/cli.test.ts \
+            packages/memory-mcp/tests/runtime.test.ts \
+            --maxWorkers=1 \
+            --no-file-parallelism
+
+      # The root vitest.config.ts excludes `apps/**`, so apps/web's own 131-file
+      # suite never ran in CI. Run it via its own vitest config (jsdom). Blocking.
+      - name: Unit tests — apps/web
+        run: npm run test -w apps/web
+
+      - name: Security audit (informational)
+        run: npm audit --audit-level=high
+        continue-on-error: true
+
+  # ADVISORY / NON-BLOCKING. `continue-on-error: true` means a red e2e run does
+  # NOT block merges — by design. These specs are broad product/audit journeys
+  # (full-product-audit, power-user-stress, competitive-benchmarks, …) that are
+  # historically flake-prone, so gating merges on them would produce false reds.
+  # The blocking `e2e-smoke` job above covers the stable launch, settings,
+  # memory, workspace, and mobile regression slice. This broad job stays
+  # advisory so exploratory audit coverage can report flakes without blocking
+  # merges.
+  e2e-smoke:
+    runs-on: ubuntu-latest
+    needs: test
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+
+      - name: Cache npm dependencies
+        uses: actions/cache@v4
+        with:
+          path: ~/.npm
+          key: ${{ runner.os }}-npm-${{ hashFiles('**/package-lock.json') }}
+          restore-keys: |
+            ${{ runner.os }}-npm-
+
+      - run: npm install
+      - name: Build packages
+        run: npm run build:packages
+      - name: Build frontend
+        run: npm run build
+      - name: Install Playwright browsers
+        run: npx playwright install --with-deps chromium
+      - name: Run blocking Playwright smoke journeys
+        run: npm run test:e2e:smoke
+        env:
+          WAGGLE_ECHO_MODE: "1"
+          NODE_ENV: test
+          WAGGLE_TRUST_LOCALHOST: "1"
+
+  e2e:
+    runs-on: ubuntu-latest
+    needs: test
+    continue-on-error: true
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+
+      - name: Cache npm dependencies
+        uses: actions/cache@v4
+        with:
+          path: ~/.npm
+          key: ${{ runner.os }}-npm-${{ hashFiles('**/package-lock.json') }}
+          restore-keys: |
+            ${{ runner.os }}-npm-
+
+      - run: npm install
+
+      # apps/web's tsc build imports @waggle/shared etc. which export dist/;
+      # build the workspace packages first (the deploy does this via build:all).
+      - name: Build packages
+        run: npm run build:packages
+
+      - name: Build frontend
+        run: npm run build
+
+      - name: Install Playwright browsers
+        run: npx playwright install --with-deps chromium
+
+      - name: Run Playwright E2E tests
+        run: npx playwright test tests/e2e/
+        env:
+          WAGGLE_ECHO_MODE: "1"
+          NODE_ENV: test
+          # D1: the e2e suite hits /api/* directly without a bearer token; trust
+          # loopback in CI's test server (prod default stays secure). Mirrors
+          # vitest.setup.ts and playwright.config.ts webServer.env.
+          WAGGLE_TRUST_LOCALHOST: "1"
+
+      - name: Upload Playwright report
+        if: failure()
+        uses: actions/upload-artifact@v4
+        with:
+          name: playwright-report
+          path: playwright-report/
+          retention-days: 14

.github/workflows/deploy-www.yml

@@ -0,0 +1,99 @@
+name: Deploy Landing Page
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - 'apps/www/**'
+      - 'docs/methodology.md'
+      - 'package.json'
+      - 'package-lock.json'
+      - '.github/workflows/deploy-www.yml'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: www-production
+  cancel-in-progress: true
+
+jobs:
+  deployment_config:
+    runs-on: ubuntu-latest
+    environment:
+      name: production
+      url: https://waggle-os.ai
+    outputs:
+      configured: ${{ steps.vercel.outputs.configured }}
+    env:
+      VERCEL_ORG_ID: ${{ secrets.VERCEL_ORG_ID }}
+      VERCEL_PROJECT_ID: ${{ secrets.VERCEL_PROJECT_ID }}
+      VERCEL_TOKEN: ${{ secrets.VERCEL_TOKEN }}
+    steps:
+      - name: Check Vercel configuration
+        id: vercel
+        shell: bash
+        run: |
+          if [[ -n "$VERCEL_TOKEN" && -n "$VERCEL_ORG_ID" && -n "$VERCEL_PROJECT_ID" ]]; then
+            echo "configured=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "configured=false" >> "$GITHUB_OUTPUT"
+            echo "::warning::Landing page verified but not deployed: Vercel secrets are not configured."
+          fi
+
+  verify:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: npm
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Test public site
+        run: npm run test -w apps/www -- --reporter=dot
+
+      - name: Typecheck public site
+        run: npx tsc --noEmit --project apps/www/tsconfig.json
+
+      - name: Build public site
+        run: npm run build:www
+
+  deploy:
+    runs-on: ubuntu-latest
+    needs: [deployment_config, verify]
+    if: needs.deployment_config.outputs.configured == 'true'
+    environment:
+      name: production
+      url: https://waggle-os.ai
+    env:
+      VERCEL_ORG_ID: ${{ secrets.VERCEL_ORG_ID }}
+      VERCEL_PROJECT_ID: ${{ secrets.VERCEL_PROJECT_ID }}
+      VERCEL_TOKEN: ${{ secrets.VERCEL_TOKEN }}
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: npm
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Pull Vercel production environment
+        working-directory: apps/www
+        run: npx --yes vercel pull --yes --environment=production --token="$VERCEL_TOKEN"
+
+      - name: Build Vercel prebuilt output
+        working-directory: apps/www
+        run: npx --yes vercel build --prod --token="$VERCEL_TOKEN"
+
+      - name: Deploy Vercel prebuilt output
+        working-directory: apps/www
+        run: npx --yes vercel deploy --prebuilt --prod --token="$VERCEL_TOKEN"

.github/workflows/hive-mind-cli-cross-platform.yml

@@ -0,0 +1,101 @@
+name: hive-mind-cli cross-platform install + smoke
+
+# Wave 1 cleanup brief 2026-04-29 §3.5 — windows-latest CI regression test.
+# Verifies that `npm install -g @waggle/hive-mind-cli` followed by `hive-mind-cli doctor`
+# works without ENOENT, quarantine, or manual debug on Windows + macOS + Linux.
+#
+# Acceptance per feedback_memory_install_dead_simple binding rule:
+#   - All three OS matrix cells PASS green
+#   - Zero manual intervention required
+#   - First MCP-style tool call (the doctor smoke test) succeeds in <60s
+
+on:
+  push:
+    branches: [main, 'feature/**']
+    paths:
+      - 'packages/hive-mind-cli/**'
+      - 'packages/hive-mind-shim-core/**'
+      - 'packages/hive-mind-core/**'
+      - 'packages/hive-mind-mcp-server/**'
+      - 'packages/hive-mind-wiki-compiler/**'
+      - 'packages/hive-mind-hooks-claude-code/**'
+      - '.github/workflows/hive-mind-cli-cross-platform.yml'
+  pull_request:
+    branches: [main]
+    paths:
+      - 'packages/hive-mind-cli/**'
+      - 'packages/hive-mind-shim-core/**'
+      - 'packages/hive-mind-core/**'
+
+jobs:
+  install-and-smoke:
+    name: ${{ matrix.os }} install + smoke
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, macos-latest, windows-latest]
+        node-version: ['20.x']
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set up Node.js ${{ matrix.node-version }}
+        uses: actions/setup-node@v4
+        with:
+          node-version: ${{ matrix.node-version }}
+
+      - name: Install workspace deps
+        run: npm install
+
+      # hive-mind-core imports @waggle/shared, whose dist/ is gitignored and so
+      # absent on a clean checkout. hive-mind-core/tsconfig declares no project
+      # reference to it (the OSS subtree-split mirrors that tsconfig, so a
+      # ../shared reference would dangle in the export root), so `tsc --build`
+      # won't bootstrap it. Build shared first — same as ci.yml/tauri-build-pr.yml.
+      - name: Build @waggle/shared (hive-mind-core dep)
+        run: cd packages/shared && npx tsc --build
+
+      - name: Build hive-mind-core (substrate)
+        run: cd packages/hive-mind-core && npx tsc --build
+
+      - name: Build hive-mind-wiki-compiler
+        run: cd packages/hive-mind-wiki-compiler && npx tsc --build
+
+      - name: Build hive-mind-mcp-server
+        run: cd packages/hive-mind-mcp-server && npx tsc --build
+
+      - name: Build hive-mind-cli
+        run: cd packages/hive-mind-cli && npx tsc --build
+
+      - name: Run postinstall (bundles fix on win32, no-op POSIX)
+        run: node packages/hive-mind-cli/postinstall.cjs
+
+      - name: Init hive-mind data dir (scaffold personal.mind for the smoke)
+        run: node packages/hive-mind-cli/dist/index.js init
+        env:
+          HIVE_MIND_DATA_DIR: ${{ runner.temp }}/waggle-ci-home
+
+      - name: Smoke test — hive-mind-cli doctor (independent of upstream hook)
+        run: node packages/hive-mind-cli/dist/index.js doctor
+        env:
+          # doctor + init resolve the mind via HIVE_MIND_DATA_DIR (the CLI never
+          # reads WAGGLE_HOME — that prior env was a no-op). Isolate to a CI temp
+          # dir; init above scaffolds personal.mind there so doctor finds it.
+          HIVE_MIND_DATA_DIR: ${{ runner.temp }}/waggle-ci-home
+
+      - name: Doctor smoke result must be green (no quarantine, no ENOENT)
+        run: |
+          # If we got here, doctor exited 0 — green. Re-emit a confirmation marker
+          # so log scrapers see the success line clearly.
+          echo "::notice title=hive-mind-cli doctor passed::Cross-platform install + smoke verified on ${{ matrix.os }}"
+        shell: bash
+
+  acceptance:
+    name: Wave 1 acceptance gate
+    runs-on: ubuntu-latest
+    needs: install-and-smoke
+    steps:
+      - name: All matrix cells passed
+        run: echo "Wave 1 dead-simple acceptance criteria met across windows-latest + macos-latest + ubuntu-latest."

.github/workflows/installer-smoke.yml

@@ -0,0 +1,115 @@
+name: Installer Smoke
+
+# Authoritative Linux proof for the one-line self-host installer (steal #5).
+# The installer is developed on Windows, where the esbuild-hoist trap and CRLF
+# quirks are Windows-only — so a green `bash -n` locally is NOT proof it works
+# for the VPS/homelab audience. This job runs install.sh end-to-end from a
+# clean ubuntu runner: it actually installs, builds packages, boots the sidecar,
+# and asserts /health returns 200, then tears it down and asserts the port frees.
+on:
+  pull_request:
+    paths:
+      - install.sh
+      - scripts/waggle-server.sh
+      - .github/workflows/installer-smoke.yml
+  push:
+    paths:
+      - install.sh
+      - scripts/waggle-server.sh
+      - .github/workflows/installer-smoke.yml
+  workflow_dispatch:
+
+jobs:
+  installer-smoke:
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    env:
+      WAGGLE_PORT: "3947"
+    steps:
+      - uses: actions/checkout@v4
+
+      # The `runner` context is not available in job-level env, so the scratch
+      # paths (isolated from the checkout to exercise the real "copy + fresh
+      # install" path) are computed here from $RUNNER_TEMP instead.
+      - name: Compute scratch paths
+        run: |
+          echo "WAGGLE_INSTALL_DIR=$RUNNER_TEMP/waggle" >> "$GITHUB_ENV"
+          echo "WAGGLE_DATA_DIR=$RUNNER_TEMP/wdata" >> "$GITHUB_ENV"
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: npm
+
+      # shellcheck ships pre-installed on ubuntu-latest runners. Findings are
+      # failures — the installer is user-facing shell that runs unsupervised via
+      # `curl | bash`, so lint cleanliness is a correctness gate, not a nicety.
+      - name: shellcheck installer scripts
+        run: shellcheck install.sh scripts/waggle-server.sh
+
+      # The real E2E. --local-source copies THIS checkout (tracked + untracked,
+      # excluding node_modules/dist) into a scratch dir, then does a from-scratch
+      # npm install + build:packages there. --no-web keeps it to API/echo mode
+      # (no vite build); --no-start hands the boot to waggle-server.sh below so we
+      # test the process manager too.
+      - name: Install (install.sh --yes, from-scratch)
+        run: |
+          ./install.sh \
+            --yes \
+            --no-web \
+            --no-start \
+            --local-source "$GITHUB_WORKSPACE" \
+            --dir "$WAGGLE_INSTALL_DIR" \
+            --data-dir "$WAGGLE_DATA_DIR" \
+            --port "$WAGGLE_PORT"
+
+      - name: Start the sidecar (waggle-server.sh start)
+        run: |
+          bash "$WAGGLE_INSTALL_DIR/scripts/waggle-server.sh" start \
+            --port "$WAGGLE_PORT" \
+            --data-dir "$WAGGLE_DATA_DIR"
+
+      # Defensive re-poll. waggle-server.sh already blocks until /health is 200
+      # (up to 60s; the sidecar spends ~9s on marketplace sync before listening),
+      # so this normally passes on the first attempt. The wider 90s budget guards
+      # against a slow cold runner without making the assertion flaky.
+      - name: Wait for /health (HTTP 200)
+        run: |
+          url="http://127.0.0.1:${WAGGLE_PORT}/health"
+          for i in $(seq 1 90); do
+            code="$(curl -s -o /dev/null -w '%{http_code}' --max-time 3 "$url" || echo 000)"
+            if [ "$code" = "200" ]; then
+              echo "healthy after ${i}s (HTTP 200)"
+              exit 0
+            fi
+            sleep 1
+          done
+          echo "::error::/health did not return 200 within 90s"
+          echo "--- last sidecar log lines ---"
+          tail -n 40 "$WAGGLE_DATA_DIR/server.log" 2>/dev/null || true
+          exit 1
+
+      - name: Status
+        run: |
+          bash "$WAGGLE_INSTALL_DIR/scripts/waggle-server.sh" status \
+            --port "$WAGGLE_PORT" \
+            --data-dir "$WAGGLE_DATA_DIR"
+
+      - name: Stop
+        run: |
+          bash "$WAGGLE_INSTALL_DIR/scripts/waggle-server.sh" stop \
+            --port "$WAGGLE_PORT" \
+            --data-dir "$WAGGLE_DATA_DIR"
+
+      - name: Assert port is free after stop
+        run: |
+          url="http://127.0.0.1:${WAGGLE_PORT}/health"
+          if curl -fsS -o /dev/null --max-time 3 "$url"; then
+            echo "::error::/health still responding on port ${WAGGLE_PORT} after stop"
+            exit 1
+          fi
+          echo "port ${WAGGLE_PORT} is free"
+
+      - name: Dump sidecar log on failure
+        if: failure()
+        run: tail -n 100 "$WAGGLE_DATA_DIR/server.log" 2>/dev/null || echo "(no log file)"

.github/workflows/mind-parity-check.yml

@@ -0,0 +1,178 @@
+name: mind-parity-check
+
+# DEPRECATED 2026-04-30 — CC Sesija B monorepo migration §2.6 Task B22.
+#
+# This workflow ran the (then-external) hive-mind repo's mind/+harvest/ tests
+# against waggle-os's substrate to verify behavioral parity while the same code
+# lived in both repos. After CC Sesija B migration, the substrate lives ONLY in
+# waggle-os/packages/hive-mind-core/, and the OSS mirror at
+# github.com/marolinik/hive-mind is generated FROM waggle-os via subtree-split
+# (not maintained as a parallel codebase). Parity checking is therefore
+# definitionally trivial — the OSS export is byte-identical to its source.
+#
+# This workflow is preserved as the deprecation anchor. It will NOT fire on
+# push because trigger paths (packages/core/src/mind/**) no longer exist as
+# tracked content. See sync-mind.yml's deprecation note for the full migration
+# context.
+
+# Memory Sync Repair Step 3.1. Verifies that hive-mind's mind/ + harvest/
+# tests pass against waggle-os's substrate. The check runs the waggle-os
+# committed Step 2 ports (which include adapted versions like db.test.ts)
+# AS BASELINE, then ALSO injects the latest hive-mind tests into the
+# waggle-os checkout under `<basename>-hive-mind.test.ts` filenames so
+# any NEW hive-mind cases since the Step 2 port get exercised.
+#
+# Triggers ONLY when shared substrate paths change. Failure blocks merge
+# unless the failing test is allowlisted in `.parity-allowlist` at the
+# repo root with a documented reason.
+#
+# See `.github/sync.md` for full design rationale and allowlist policy.
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - 'packages/core/src/mind/**'
+      - 'packages/core/src/harvest/**'
+      - 'packages/core/tests/mind/**'
+  pull_request:
+    branches: [main]
+    paths:
+      - 'packages/core/src/mind/**'
+      - 'packages/core/src/harvest/**'
+      - 'packages/core/tests/mind/**'
+
+concurrency:
+  group: mind-parity-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  parity-check:
+    name: hive-mind ↔ waggle-os mind substrate parity
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+
+    steps:
+      - name: Checkout waggle-os
+        uses: actions/checkout@v4
+        with:
+          path: waggle-os
+
+      - name: Checkout hive-mind master
+        uses: actions/checkout@v4
+        with:
+          repository: marolinik/hive-mind
+          ref: master
+          path: hive-mind
+
+      - name: Setup Node 20
+        uses: actions/setup-node@v4
+        with:
+          node-version: 20
+
+      - name: Cache npm dependencies
+        uses: actions/cache@v4
+        with:
+          path: ~/.npm
+          key: ${{ runner.os }}-npm-${{ hashFiles('waggle-os/**/package-lock.json') }}
+          restore-keys: |
+            ${{ runner.os }}-npm-
+
+      - name: Install waggle-os dependencies
+        working-directory: waggle-os
+        run: npm install
+
+      - name: Run waggle-os baseline mind/ tests (committed Step 2 ports)
+        working-directory: waggle-os
+        run: npx vitest run --reporter=default packages/core/tests/mind/
+
+      - name: Inject latest hive-mind tests as -hive-mind suffix files
+        working-directory: waggle-os
+        run: |
+          set -euo pipefail
+
+          allowlist_file=".parity-allowlist"
+          allowlist_basenames=()
+          if [ -f "$allowlist_file" ]; then
+            while IFS= read -r line; do
+              # Strip comments + leading/trailing whitespace; skip blanks
+              clean="${line%%#*}"
+              clean="$(echo "$clean" | tr -d '[:space:]')"
+              [ -z "$clean" ] && continue
+              allowlist_basenames+=("$clean")
+            done < "$allowlist_file"
+            echo "Allowlist entries: ${allowlist_basenames[@]:-<none>}"
+          else
+            echo "No .parity-allowlist file present — no skips."
+          fi
+
+          # Helper: is a basename in the allowlist?
+          is_allowlisted() {
+            local name="$1"
+            for a in "${allowlist_basenames[@]:-}"; do
+              [ "$a" = "$name" ] && return 0
+            done
+            return 1
+          }
+
+          target_dir="packages/core/tests/mind"
+          source_dir="../hive-mind/packages/core/src/mind"
+          injected=0
+          skipped=0
+
+          already_committed=0
+          for src in "$source_dir"/*.test.ts; do
+            [ -e "$src" ] || continue
+            base="$(basename "$src" .test.ts)"
+            target_name="${base}-hive-mind.test.ts"
+            target_path="$target_dir/$target_name"
+
+            if is_allowlisted "$target_name"; then
+              echo "  SKIP (allowlist): $target_name"
+              skipped=$((skipped + 1))
+              continue
+            fi
+
+            if [ -f "$target_path" ]; then
+              # File is committed (Step 2 port). Preserve its bespoke
+              # header comments + any waggle-os adaptations. The
+              # committed version IS what the parity check should
+              # exercise — it's exactly what landed in main.
+              already_committed=$((already_committed + 1))
+              echo "  KEEP (committed): $target_name"
+              continue
+            fi
+
+            cp "$src" "$target_path"
+            # Adapt import paths from hive-mind's adjacent style (`./x.js`) to
+            # waggle-os's separate-tests-folder style (`../../src/mind/x.js`).
+            sed -i "s|from \"\\./|from \"../../src/mind/|g" "$target_path"
+            sed -i "s|from '\\./|from '../../src/mind/|g" "$target_path"
+            injected=$((injected + 1))
+            echo "  INJECT: $target_name"
+          done
+
+          echo ""
+          echo "Injected: $injected new hive-mind test file(s) under -hive-mind suffix"
+          echo "Kept:     $already_committed already-committed Step 2 port file(s)"
+          echo "Skipped:  $skipped allowlisted file(s)"
+
+      - name: Run combined waggle-os + injected hive-mind suite
+        working-directory: waggle-os
+        run: npx vitest run --reporter=default packages/core/tests/mind/
+
+      - name: Informational diff — shared substrate file sizes
+        working-directory: waggle-os
+        if: always()
+        run: |
+          echo "## Substrate file size comparison (informational)"
+          for f in db.ts schema.ts frames.ts search.ts knowledge.ts identity.ts awareness.ts sessions.ts scoring.ts reconcile.ts ontology.ts concept-tracker.ts entity-normalizer.ts embedding-provider.ts inprocess-embedder.ts; do
+            wf="packages/core/src/mind/$f"
+            hf="../hive-mind/packages/core/src/mind/$f"
+            if [ -f "$wf" ] && [ -f "$hf" ]; then
+              wsize=$(wc -c < "$wf")
+              hsize=$(wc -c < "$hf")
+              diff_pct=$(awk -v w="$wsize" -v h="$hsize" 'BEGIN { if (h == 0) print "n/a"; else printf "%.1f%%", ((w - h) / h) * 100 }')
+              echo "  $f: waggle-os=$wsize hive-mind=$hsize delta=$diff_pct"
+            fi
+          done

.github/workflows/release.yml

@@ -0,0 +1,145 @@
+# Waggle — Release Build Workflow
+#
+# Builds desktop apps for Windows (NSIS) and macOS (DMG) on tag push.
+# Publishes artifacts as GitHub Release assets.
+#
+# Trigger: push tag v* (e.g., v1.0.0)
+# Also supports manual dispatch for testing.
+
+name: Release Build
+
+on:
+  push:
+    tags:
+      - 'v*'
+  workflow_dispatch:
+
+permissions:
+  contents: write
+
+jobs:
+  build-windows:
+    runs-on: windows-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: npm
+
+      - name: Setup Rust
+        uses: dtolnay/rust-toolchain@stable
+
+      - name: Rust cache
+        uses: Swatinem/rust-cache@v2
+        with:
+          workspaces: app/src-tauri
+
+      - name: Install dependencies
+        run: npm install
+
+      - name: Build packages (shared -> core -> agent -> server)
+        run: npm run build:packages
+
+      - name: Build sidecar
+        run: node scripts/build-sidecar.mjs
+
+      - name: Bundle native dependencies
+        run: node scripts/bundle-native-deps.mjs
+
+      - name: Bundle Node.js runtime
+        run: node scripts/bundle-node.mjs
+
+      - name: Stage sidecar dependencies
+        run: node scripts/stage-sidecar-deps.mjs
+
+      - name: Build frontend
+        run: cd apps/web && npx vite build
+
+      - name: Build Tauri (Windows)
+        uses: tauri-apps/tauri-action@v0
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        with:
+          projectPath: app
+          tagName: ${{ github.ref_name }}
+          releaseName: 'Waggle ${{ github.ref_name }}'
+          releaseBody: 'See the release notes for details.'
+          releaseDraft: true
+          prerelease: false
+
+  build-macos:
+    runs-on: macos-latest
+    strategy:
+      matrix:
+        target: [aarch64-apple-darwin, x86_64-apple-darwin]
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: npm
+
+      - name: Setup Rust
+        uses: dtolnay/rust-toolchain@stable
+        with:
+          targets: ${{ matrix.target }}
+
+      - name: Rust cache
+        uses: Swatinem/rust-cache@v2
+        with:
+          workspaces: app/src-tauri
+
+      - name: Install dependencies
+        run: npm install
+
+      - name: Build packages (shared -> core -> agent -> server)
+        run: npm run build:packages
+
+      - name: Build sidecar
+        run: node scripts/build-sidecar.mjs
+
+      - name: Bundle native dependencies
+        run: node scripts/bundle-native-deps.mjs
+        env:
+          TARGET_ARCH: ${{ matrix.target == 'aarch64-apple-darwin' && 'arm64' || 'x64' }}
+
+      - name: Bundle Node.js runtime
+        run: node scripts/bundle-node.mjs
+        env:
+          TARGET_ARCH: ${{ matrix.target == 'aarch64-apple-darwin' && 'arm64' || 'x64' }}
+
+      - name: Stage sidecar dependencies
+        run: node scripts/stage-sidecar-deps.mjs
+        env:
+          TARGET_ARCH: ${{ matrix.target == 'aarch64-apple-darwin' && 'arm64' || 'x64' }}
+
+      - name: Build frontend
+        run: cd apps/web && npx vite build
+
+      - name: Build Tauri (macOS)
+        uses: tauri-apps/tauri-action@v0
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        with:
+          projectPath: app
+          tagName: ${{ github.ref_name }}
+          releaseName: 'Waggle ${{ github.ref_name }}'
+          releaseBody: 'See the release notes for details.'
+          releaseDraft: true
+          prerelease: false
+          args: --target ${{ matrix.target }}
+
+  # NOTE: the Tauri auto-updater is disabled for v1 (plugins.updater removed from
+  # tauri.conf.json — see BUILD P0-2 / P1-8). The former `update-manifest` job
+  # published a latest.json with EMPTY signatures, which every client rejected at
+  # signature verification. Re-enabling the updater requires:
+  #   1. Provision a TAURI_SIGNING_PRIVATE_KEY (+ password) repo secret.
+  #   2. Restore `plugins.updater` (endpoints + pubkey) in tauri.conf.json and
+  #      set bundle.createUpdaterArtifacts so tauri-action emits signed .sig files.
+  #   3. Restore a latest.json generator that reads the real signatures from the
+  #      build artifacts (tauri-action can publish the manifest directly).

.github/workflows/sync-mind.yml

@@ -0,0 +1,230 @@
+name: sync-mind-to-hive-mind
+
+# DEPRECATED 2026-04-30 — CC Sesija B monorepo migration §2.6 Task B22.
+#
+# This workflow was the bidirectional-sync mechanism between waggle-os and the
+# now-archived `marolinik/hive-mind` repo while substrate code lived in BOTH
+# places (packages/core/src/mind/ + packages/core/src/harvest/ in waggle-os,
+# duplicated in hive-mind/packages/core/src/{mind,harvest}/).
+#
+# After CC Sesija B migration (commits ff5b4aa..b59d188 on
+# feature/hive-mind-monorepo-migration), the substrate lives ONLY in
+# waggle-os/packages/hive-mind-core/. The OSS distribution mechanism is now
+# `git subtree split` from waggle-os monorepo to public mirror — see
+# `scripts/oss-subtree-split.sh` and `packages/hive-mind-core/CONTRIBUTING.md`.
+#
+# This workflow is preserved for AUDIT TRAIL purposes (the historical
+# trigger paths and concurrency settings are referenced in EXTRACTION.md and
+# the .github/sync.md operating manual). It will NOT fire on push because the
+# trigger paths (packages/core/src/mind/** + packages/core/src/harvest/**) no
+# longer exist as tracked content — they were git-mv'd to packages/hive-mind-core/
+# on commit 3b556c0.
+#
+# DO NOT delete this file as part of cleanup — leave it as the deprecation
+# anchor. If the workflow ever needs reactivation, trigger paths must be
+# updated to the new packages/hive-mind-core/ location AND the
+# @hive-mind ↔ @waggle name remapping must be added.
+
+# Memory Sync Repair Step 3.2 — waggle-os → hive-mind direction.
+#
+# Triggered when waggle-os main receives a push that touches shared
+# substrate paths (mind/ or harvest/), this workflow extracts the
+# filtered diff (excluding NOT-extracted files per EXTRACTION.md), opens
+# a PR against marolinik/hive-mind master with the patch applied, and
+# tags the PR with the source SHA.
+#
+# This is the SECONDARY direction empirically — Steps 1+2 found
+# hive-mind is the more active substrate repo (ahead in 2/5 audit
+# dimensions, +14 organic test files). The PRIMARY direction
+# (hive-mind push → auto-PR ka waggle-os) is intentionally NOT
+# implemented in this file because it requires a workflow living in
+# the hive-mind repo, which is out of CC-2 scope. It will be added
+# via a sibling PR to hive-mind once Step 3 here is ratified.
+#
+# See `.github/sync.md` for full design rationale, EXTRACTION.md
+# filter list, and how to extend bidirectional sync.
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - 'packages/core/src/mind/**'
+      - 'packages/core/src/harvest/**'
+
+concurrency:
+  group: sync-mind-${{ github.ref }}
+  # Don't cancel — every main push to mind/ or harvest/ deserves its own
+  # sync attempt (the resulting hive-mind PR is per-commit traceable).
+  cancel-in-progress: false
+
+jobs:
+  open-hive-mind-pr:
+    name: Open auto-sync PR to marolinik/hive-mind
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+
+    # `HIVE_MIND_SYNC_TOKEN` is a fine-grained PAT scoped to
+    # marolinik/hive-mind with `pull_request: write` + `contents: write`.
+    # Configured by Marko via `gh secret set HIVE_MIND_SYNC_TOKEN`.
+    # Without the secret, the job fails fast with a documented error
+    # rather than silently skipping.
+    if: ${{ vars.MIND_SYNC_ENABLED == 'true' }}
+
+    steps:
+      - name: Checkout waggle-os (full history for the diff)
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Verify HIVE_MIND_SYNC_TOKEN is configured
+        run: |
+          if [ -z "${{ secrets.HIVE_MIND_SYNC_TOKEN }}" ]; then
+            echo "::error::HIVE_MIND_SYNC_TOKEN secret is not configured."
+            echo "::error::Run: gh secret set HIVE_MIND_SYNC_TOKEN --repo marolinik/waggle-os"
+            echo "::error::See .github/sync.md for full setup instructions."
+            exit 1
+          fi
+
+      - name: Compute filtered diff (exclude NOT-extracted paths)
+        id: diff
+        run: |
+          set -euo pipefail
+
+          # Files that MUST be excluded from sync per EXTRACTION.md
+          # "NOT Extracted" section. Sync attempts that include these paths
+          # would leak Waggle-specific code (vault, compliance, evolution,
+          # tier system) into the hive-mind Apache-2.0 release artifact.
+          excluded_paths=(
+            'packages/core/src/mind/vault.ts'
+            'packages/core/src/mind/evolution-runs.ts'
+            'packages/core/src/mind/execution-traces.ts'
+            'packages/core/src/mind/improvement-signals.ts'
+            'packages/core/src/compliance'
+          )
+
+          # Build the rev range. `${{ github.event.before }}` is the parent
+          # commit of this push; `${{ github.sha }}` is the new HEAD. For a
+          # branch's first push or a force-push, `before` may be all-zeros;
+          # in that case fall back to the previous merge-base via reflog.
+          before_sha='${{ github.event.before }}'
+          after_sha='${{ github.sha }}'
+          if [ "$before_sha" = "0000000000000000000000000000000000000000" ]; then
+            echo "::warning::push has no `before` SHA — falling back to HEAD~1"
+            before_sha="$(git rev-parse HEAD~1)"
+          fi
+
+          # All shared-substrate files in this push, before exclusion.
+          changed=$(git diff --name-only "$before_sha" "$after_sha" -- \
+            'packages/core/src/mind/**' 'packages/core/src/harvest/**')
+
+          # Apply EXTRACTION.md "NOT extracted" exclusions.
+          filtered_files=()
+          while IFS= read -r f; do
+            [ -z "$f" ] && continue
+            skip=false
+            for excl in "${excluded_paths[@]}"; do
+              case "$f" in
+                "$excl"|"$excl"/*)
+                  skip=true
+                  break
+                  ;;
+              esac
+            done
+            $skip || filtered_files+=("$f")
+          done <<< "$changed"
+
+          if [ ${#filtered_files[@]} -eq 0 ]; then
+            echo "No syncable changes after EXTRACTION.md filtering."
+            echo "skip=true" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+
+          echo "Files to sync:"
+          printf '  %s\n' "${filtered_files[@]}"
+
+          # Generate a patch limited to the filtered files. This patch will
+          # apply to hive-mind because the directory layout matches:
+          # waggle-os `packages/core/src/{mind,harvest}/...` ↔
+          # hive-mind  `packages/core/src/{mind,harvest}/...`.
+          mkdir -p .sync-output
+          git diff "$before_sha" "$after_sha" -- "${filtered_files[@]}" > .sync-output/patch.diff
+
+          # Capture the original commit subjects for the PR description.
+          git log --format='- %h %s' "$before_sha".."$after_sha" -- "${filtered_files[@]}" > .sync-output/commits.txt
+
+          echo "skip=false" >> "$GITHUB_OUTPUT"
+          echo "after_sha=$after_sha" >> "$GITHUB_OUTPUT"
+          echo "after_short=$(git rev-parse --short "$after_sha")" >> "$GITHUB_OUTPUT"
+          echo "first_subject=$(git log -1 --format=%s "$after_sha")" >> "$GITHUB_OUTPUT"
+
+      - name: Checkout hive-mind for patch application
+        if: steps.diff.outputs.skip != 'true'
+        uses: actions/checkout@v4
+        with:
+          repository: marolinik/hive-mind
+          ref: master
+          token: ${{ secrets.HIVE_MIND_SYNC_TOKEN }}
+          path: hive-mind
+          fetch-depth: 0
+
+      - name: Apply patch to hive-mind branch + push
+        if: steps.diff.outputs.skip != 'true'
+        working-directory: hive-mind
+        env:
+          GH_TOKEN: ${{ secrets.HIVE_MIND_SYNC_TOKEN }}
+        run: |
+          set -euo pipefail
+
+          branch_name="auto-sync/waggle-os-${{ steps.diff.outputs.after_short }}"
+          git config user.name 'waggle-os-sync-bot'
+          git config user.email 'sync-bot@waggle-os.ai'
+          git checkout -b "$branch_name"
+
+          # Apply the filtered patch. The waggle-os layout is identical
+          # under packages/core/src/{mind,harvest}/ so the patch applies
+          # directly without `--directory` rewriting.
+          if ! git apply --3way ../.sync-output/patch.diff; then
+            echo "::error::Patch did not apply cleanly. Manual reconciliation required."
+            echo "::error::Source SHA: ${{ steps.diff.outputs.after_sha }}"
+            exit 1
+          fi
+
+          git add -A
+          git commit -m "chore(sync): auto-sync from waggle-os@${{ steps.diff.outputs.after_short }}
+
+          Source: marolinik/waggle-os main @ ${{ steps.diff.outputs.after_sha }}
+          Subject: ${{ steps.diff.outputs.first_subject }}
+
+          See PR description for the full list of waggle-os commits in this batch."
+
+          git push origin "$branch_name"
+
+      - name: Open PR on hive-mind
+        if: steps.diff.outputs.skip != 'true'
+        working-directory: hive-mind
+        env:
+          GH_TOKEN: ${{ secrets.HIVE_MIND_SYNC_TOKEN }}
+        run: |
+          set -euo pipefail
+          branch_name="auto-sync/waggle-os-${{ steps.diff.outputs.after_short }}"
+          commit_list="$(cat ../.sync-output/commits.txt)"
+
+          gh pr create \
+            --repo marolinik/hive-mind \
+            --base master \
+            --head "$branch_name" \
+            --title "auto-sync from waggle-os@${{ steps.diff.outputs.after_short }}: ${{ steps.diff.outputs.first_subject }}" \
+            --body "$(printf 'Automated cross-repo sync — Memory Sync Repair Step 3.2 (waggle-os → hive-mind direction).\n\n## Source\n- Repo: marolinik/waggle-os\n- Branch: main\n- HEAD: %s\n- Workflow run: %s/%s/actions/runs/%s\n\n## Filtering\nThis patch was filtered to exclude paths listed under "NOT Extracted" in EXTRACTION.md:\n- packages/core/src/mind/vault.ts\n- packages/core/src/mind/evolution-runs.ts\n- packages/core/src/mind/execution-traces.ts\n- packages/core/src/mind/improvement-signals.ts\n- packages/core/src/compliance\n\n## Originating commits in this batch\n\n%s\n\n## Review checklist\n- [ ] Patch applied cleanly to hive-mind master without 3-way conflicts\n- [ ] No NOT-extracted paths sneaked through (sanity-check the diff against EXTRACTION.md)\n- [ ] Test deltas (if any) make sense for the OSS surface; no Waggle-specific test fixtures\n- [ ] mind-parity-check on waggle-os side is GREEN before merging this PR (otherwise the sync would re-introduce a regression)' \
+              "${{ steps.diff.outputs.after_sha }}" \
+              "${{ github.server_url }}" \
+              "${{ github.repository }}" \
+              "${{ github.run_id }}" \
+              "$commit_list")"
+
+      - name: Upload patch as artifact (debug aid)
+        if: always() && steps.diff.outputs.skip != 'true'
+        uses: actions/upload-artifact@v4
+        with:
+          name: sync-patch-${{ steps.diff.outputs.after_short }}
+          path: .sync-output/
+          retention-days: 30

.github/workflows/tauri-build-pr.yml

@@ -0,0 +1,178 @@
+# Waggle — Tauri Build Verification (per-PR + main pushes)
+#
+# CC Sesija A §2.4 Task A13 (PM-reframed scope). Verifies the desktop app
+# builds cleanly on Win + macOS for every PR + main push, so a regression
+# can't sneak in unnoticed between releases. Distinct from release.yml
+# which only triggers on `v*` tags + uploads to GitHub Releases (this
+# workflow only uploads to the workflow run as artifacts for download
+# verification, no release publishing).
+#
+# Exit signal: green CI here means tag-push to release.yml is safe to
+# pull the trigger on. Red CI here = same investigation flow as release.yml
+# (Rust compile / Vite build / sidecar bundle / native dep failure).
+
+name: Tauri Build Verification
+
+on:
+  pull_request:
+    branches:
+      - main
+    paths:
+      - 'app/**'
+      - 'apps/web/**'
+      - 'packages/**'
+      - 'scripts/**'
+      - 'package.json'
+      - 'package-lock.json'
+      - '.github/workflows/tauri-build-pr.yml'
+  push:
+    branches:
+      - main
+    paths:
+      - 'app/**'
+      - 'apps/web/**'
+      - 'packages/**'
+      - 'scripts/**'
+      - 'package.json'
+      - 'package-lock.json'
+  workflow_dispatch:
+
+jobs:
+  verify-windows:
+    runs-on: windows-latest
+    timeout-minutes: 45
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: npm
+
+      - name: Setup Rust
+        uses: dtolnay/rust-toolchain@stable
+
+      - name: Rust cache
+        uses: Swatinem/rust-cache@v2
+        with:
+          workspaces: app/src-tauri
+
+      - name: Install dependencies
+        run: npm install
+
+      - name: Build packages (shared → core → agent → server)
+        run: npm run build:packages
+
+      - name: Build sidecar
+        run: node scripts/build-sidecar.mjs
+
+      - name: Bundle native dependencies
+        run: node scripts/bundle-native-deps.mjs
+
+      - name: Bundle Node.js runtime
+        run: node scripts/bundle-node.mjs
+
+      - name: Stage sidecar dependencies
+        run: node scripts/stage-sidecar-deps.mjs
+
+      - name: Build frontend
+        run: cd apps/web && npx vite build
+
+      - name: Build Tauri (Windows)
+        # @tauri-apps/cli is declared in app/package.json devDeps but is absent
+        # from package-lock.json, so `npm install` never installs it and a bare
+        # `npx tauri` errors "could not determine executable to run". Fetch the
+        # CLI explicitly by package name (npx resolves the win32 binary).
+        run: cd app && npx --yes @tauri-apps/cli@2 build
+        env:
+          # Skip code signing for PR verification — release.yml handles signing
+          # only on tag push.
+          TAURI_PRIVATE_KEY: ''
+          TAURI_KEY_PASSWORD: ''
+
+      - name: Upload Windows artifacts
+        uses: actions/upload-artifact@v4
+        if: always()
+        with:
+          name: waggle-windows-${{ github.sha }}
+          path: |
+            app/src-tauri/target/release/bundle/nsis/*.exe
+            app/src-tauri/target/release/bundle/msi/*.msi
+          if-no-files-found: warn
+          retention-days: 7
+
+  verify-macos:
+    runs-on: macos-latest
+    timeout-minutes: 60
+    strategy:
+      # Per-arch, matching release.yml. Universal builds are rejected by the
+      # bundle scripts (sqlite-vec / onnxruntime / node ship per-arch binaries),
+      # so each arch is staged and built separately.
+      matrix:
+        target: [aarch64-apple-darwin, x86_64-apple-darwin]
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: npm
+
+      - name: Setup Rust
+        uses: dtolnay/rust-toolchain@stable
+        with:
+          targets: ${{ matrix.target }}
+
+      - name: Rust cache
+        uses: Swatinem/rust-cache@v2
+        with:
+          workspaces: app/src-tauri
+
+      - name: Install dependencies
+        run: npm install
+
+      - name: Build packages (shared → core → agent → server)
+        run: npm run build:packages
+
+      - name: Build sidecar
+        run: node scripts/build-sidecar.mjs
+
+      - name: Bundle native dependencies
+        run: node scripts/bundle-native-deps.mjs
+        env:
+          TARGET_ARCH: ${{ matrix.target == 'aarch64-apple-darwin' && 'arm64' || 'x64' }}
+
+      - name: Bundle Node.js runtime
+        run: node scripts/bundle-node.mjs
+        env:
+          TARGET_ARCH: ${{ matrix.target == 'aarch64-apple-darwin' && 'arm64' || 'x64' }}
+
+      - name: Stage sidecar dependencies
+        run: node scripts/stage-sidecar-deps.mjs
+        env:
+          TARGET_ARCH: ${{ matrix.target == 'aarch64-apple-darwin' && 'arm64' || 'x64' }}
+
+      - name: Build frontend
+        run: cd apps/web && npx vite build
+
+      - name: Build Tauri (macOS ${{ matrix.target }})
+        # See verify-windows note: fetch @tauri-apps/cli by package name (absent
+        # from the lockfile). Built per-arch — universal is rejected by the
+        # bundle scripts (per-arch native modules), matching release.yml.
+        run: cd app && npx --yes @tauri-apps/cli@2 build --target ${{ matrix.target }}
+        env:
+          TAURI_PRIVATE_KEY: ''
+          TAURI_KEY_PASSWORD: ''
+
+      - name: Upload macOS artifacts
+        uses: actions/upload-artifact@v4
+        if: always()
+        with:
+          name: waggle-macos-${{ matrix.target }}-${{ github.sha }}
+          path: |
+            app/src-tauri/target/${{ matrix.target }}/release/bundle/dmg/*.dmg
+            app/src-tauri/target/${{ matrix.target }}/release/bundle/macos/*.app
+          if-no-files-found: warn
+          retention-days: 7