lane/0.4.0: model picker, What's-new, autonomous night, frontdoor loopback, backlog (26 PRs)

.github/workflows/ci.yml

@@ -317,9 +317,9 @@ jobs:
         # linux-x64 + linux-arm64 + darwin-arm64 — every pin machine-gated (spec §5).
         # ubuntu-24.04-arm is the free GitHub-hosted arm runner (public repo), and it
         # is the ONLY place a linux-arm64 binary is executed.
-        # macos-14 boot-smoke: the binary is cross-compiled from linux; native
+        # macos-15 boot-smoke: the binary is cross-compiled from linux; native
         # execution on macOS is the safety net.
-        os: [ubuntu-latest, ubuntu-24.04-arm, macos-14]
+        os: [ubuntu-latest, ubuntu-24.04-arm, macos-15]
     runs-on: ${{ matrix.os }}
     steps:
       - uses: actions/checkout@v7

.gitignore

@@ -13,4 +13,5 @@ packages/extension/bin/
 
 # personal local dev config — machine-specific, not for the container
 opencode.json
-ops/hub/__pycache__/
+# python bytecode, anywhere (#1943)
+__pycache__/

AGENTS.md

@@ -68,6 +68,16 @@ macOS note: the vendored binary is unsigned — if Gatekeeper blocks it:
 | Julia solve E2E | `AMICO_TEST_JULIA_PROJECT=$HOME/.amico/julia pnpm --filter amicode run test:slow` | template vet passes, F > 0.999 |
 | Live interview E2E | `cd packages/extension && AMICODE_E2E_LIVE=1 npx vitest run test/slow/interview_e2e.test.ts` | tiers A/B/C pass (C needs a provider; flaky on free tier) |
 | Full chain (opt-in, ~3 min) | add `AMICODE_E2E_FULLCHAIN=1` | tier D: interview → real solve → F > 0.99 |
+| Pre-push gates (night runner) | `./.notturno/gates` | `RESULT: GREEN` — drift gate + `pnpm -r run typecheck` + vitest of the packages the diff touched (vs the merge-base with `NOTTURNO_BASE`, else the nearest `origin/lane/*`/`origin/main`) |
+
+**Overlay rule (CI's app-bundle drift gate):** any edit under `packages/app-bundle/overlay/**`
+(add, change, delete, rename) must be followed by
+`node packages/app-bundle/scripts/refresh_manifest.mjs` and then
+`node packages/app-bundle/scripts/drift_gate.mjs` (expect `PASS`) **before you commit**;
+commit the refreshed `packages/app-bundle/manifest.json` with the overlay change.
+`refresh_manifest` needs the materialized upstream tree
+(`pnpm --filter @amicode/app-bundle run materialize` once). An overlay edit without the
+refresh reds CI (2 of night batch 1's red PRs, #1980) and reds `./.notturno/gates`.
 
 ## Development facts you need
 
@@ -177,6 +187,12 @@ passes, **promote** it → clean `v0.0.3` → Marketplace. The first promotion o
 bump (alphas never hit the Marketplace, so the version is still free); re-promoting an
 already-published base does.
 
+**After a CLI-changing release, refresh the pinned CLI on every machine** (#1949): the `amico`
+shims run the pinned dist (`~/.amico/server/cli/`), not the checkout, so a CLI change has not
+shipped on a machine until its pin is refreshed. From that machine's freshly built checkout:
+`bash ops/install-cli-pin.sh --dist packages/amico-run/dist` (then `amico doctor` → `pinned_cli`
+reports the new sha). See `ops/README.md` § The pinned CLI root.
+
 ## Known sharp edges
 
 - `test:slow` without `AMICO_TEST_JULIA_PROJECT` silently skips the Julia gates.

CONTEXT.md

@@ -301,6 +301,18 @@ _Avoid_: Explorer (VS Code's native file explorer is separate), Panel (the in-ap
 The multi-document file workspace in the side panel. Holds zero or more files as inner tabs, each rendering its content (markdown rendered with a toggle to edit; text/code files in a CodeMirror editor; images and PDFs inline). Files arrive via Sidebar single-click or a Chat file pill and accumulate as tabs — each closeable and drag-reorderable; opening an already-open file focuses its existing tab rather than duplicating it. A breadcrumb bar under each pane's tab strip shows the active file's project-relative path with interactive sibling navigation. Supports recursive split panes via edge-drop: dragging a tab toward a pane's edge divides the view, and each resulting pane keeps its own tab bar, breadcrumb, zoom, and preview/edit toggle. Empty panes auto-collapse; a minimum pane dimension is enforced so splits can't shrink below a usable size. Opens and activates automatically when the first file is selected; shows a placeholder when no file is open. For committed editing, double-click the Sidebar entry to open a native VS Code tab.
 _Avoid_: Editor (Preview is a multi-document viewer, not a primary editor — committed editing belongs in a native VS Code tab), File browser (the Sidebar is still the primary project-wide file tree; the breadcrumb is a contextual sibling-navigation aid scoped to the open file, not a second tree)
 
+**Paper Mode**:
+A first-class, opt-in session surface for *committed* LaTeX co-editing: the `.tex` editor is primary, Chat docks beneath it, and the compiled PDF sits to the right. Distinct from Preview (which stays a viewer) and from the Work Column layout — Paper Mode is its own layout, not a resize of an existing one. The live editor Draft is the single source of truth; the agent reads it fresh each turn; agent edits arrive as reviewable Pending Hunks rather than direct disk writes; and compilation is manual. Does not depend on the paused wide-mode work.
+_Avoid_: Write mode (superseded name), Overleaf mode, wide mode (a separate, paused feature)
+
+**Draft** (Paper Mode):
+The live in-editor content of a `.tex` file, versioned by a monotonic Content Revision. In Paper Mode it is the single source of truth: the human's typing and accepted agent edits both land here, saves flush it to disk, and the agent always reads it at its current revision. Supersedes disk and any cached copy as the authority for "current content."
+_Avoid_: Buffer (implementation detail), file contents (ambiguous with disk)
+
+**Pending Hunk**:
+A proposed agent edit shown as an inline, reviewable diff decoration in the Paper Mode editor, not yet written to the Draft or disk. Accepted (`✓`) hunks apply to the Draft; rejected (`✗`) hunks vanish. A Pending Hunk that overlaps concurrent human edits becomes a Conflict Hunk requiring explicit resolution — nothing lands unchecked. Only accepted hunks emit mutation-ledger receipts and enter the compiled source.
+_Avoid_: Suggestion, agent write (in Paper Mode the agent proposes, it does not write disk), pending change
+
 ### Developer tooling
 
 **Rebuild (local)**:

docs/adr/0037-armonia-trust-boundaries.md

@@ -0,0 +1,107 @@
+---
+status: proposed
+date: 2026-10-27
+deciders: Aaron Trowbridge
+tags: [security, fleet, armonia, tailscale, lab-deployment]
+supersedes: []
+related: ["#1872", "#1874", "#1879", "#1887", "#1956", "#1957", "spec-20261026-101500-rd-system-v2-1 (A15, A16)", "amicissimo ADR-0007 (C2 signed artifacts)"]
+---
+
+# ADR 0037: Armonia trust boundaries (Tailscale transport, sovereign clients, sandboxed agents)
+
+## Context
+
+Armonia deployments put a shared hub next to personal machines. The hub is a lab computer or a Modal container. It runs unattended agents and sits in front of instruments. Students, PIs, and outside collaborators attach laptops to it. The lab wants that system to be secure by design. The people using it want install to be one command and one click.
+
+A capability audit of the hub-client posture (2026-10-27) found:
+
+**Already sound:**
+- In hub-client posture the laptop runs no server and opens no port.
+- The tunnel is forward-only and has no `-R`.
+- The agent tool server runs on the hub.
+- Link resolution previews only vault roots.
+- Widget iframes are sandboxed.
+
+**Unsafe:**
+- **Hub-served code runs on the laptop.** The chat panel's JavaScript is served by the hub from a directory the agents' OS user can write. It runs inside the laptop's VS Code and can send about 40 kinds of bridge message to the extension. Some of those:
+  - run processes without consent: `dev-tools-rebuild` and `dev-tools-build-vsix` run git and `pnpm install` in any path;
+  - read the clipboard silently;
+  - change settings;
+  - push workspace paths;
+  - watch arbitrary files;
+  - send typed credentials to the hub.
+- **The frontdoor listened unauthenticated on `0.0.0.0`.** It was reachable from the LAN as well as the tailnet. Fixed by #1957 (loopback by default).
+- **Remote access ran over hand-built SSH tunnels on per-machine ports.** Settings Sync carried one machine's port to another and hung its boot (#1956).
+- **Agents run as the same OS user as everything else on the hub:** the UI it serves, the gates, the charter.
+
+## Decision
+
+### 1. Tailscale is the transport and the identity bootstrap
+- The frontdoor listens on loopback only. It is published to the tailnet with `tailscale serve`, giving HTTPS at `https://<hub>.<tailnet>.ts.net` with Tailscale-issued certificates.
+- Nothing is exposed on a LAN or to the public internet. SSH tunnels survive only as a fallback.
+- The frontdoor maps the verified `Tailscale-User-Login` / `Tailscale-User-Name` headers that `serve` injects to #1874's person principal. These headers are trusted only on the loopback hop from `tailscaled`.
+- The principal model stays transport-independent: an OIDC login can produce the same principal later.
+- **Tailnet policy encodes the boundary**, shipped as a reviewed snippet:
+  - `tag:armonia-hub` accepts traffic from lab members;
+  - `tag:armonia-site` and `tag:lab-instrument` accept traffic only from the hub;
+  - **no rule permits connections to personal devices.**
+- Execution sites (lab PCs, Modal sandboxes, cluster login nodes) join with short-lived, pre-approved tagged auth keys. They are identities by tag, never by person.
+- **Tailscale is transport; Armonia is authorization.** Being reachable grants nothing. Membership, campaigns, charters, and Strumento decide.
+- Labs that cannot use the hosted control plane run **Headscale** (the Enterprise profile), which gives the same model. Where neither is permitted, the fallback is plain WireGuard managed by `armonia init`.
+
+### 2. The client is sovereign: the hub sends data, never code
+- In hub-client posture, the panel loads its UI from the **installed, signed extension**, not from the hub.
+- If a deployment opts into hub-served UI, the client loads it only when its bundle signature verifies against the pinned root set (the amicissimo C2 channel). An agent editing the hub's dist then changes nothing on any laptop.
+- **The bridge is a capability table.** Every message kind is classed per posture:
+  - **view:** no side effects;
+  - **consented:** a native VS Code prompt naming the hub and the action, optionally remembered per hub;
+  - **forbidden in hub-client posture:** `dev-tools-*`, `data-storage-update`, `skill-providers-autodiscover`/`add`, arbitrary `watch-files`.
+- **Clipboard** reads happen only from a real user paste in the webview. There is no read-on-request path.
+- **Share nothing by default.** Workspace paths are not pushed to the hub. Opening, watching, and previewing local files is limited to folders the user has explicitly shared with that hub, listed and revocable in a "Shared with <hub>" view.
+- **Personal credentials stay on the laptop.** Hub-side features use deployment or service credentials. A form that would store a user's key on a hub says so before submit.
+- **The laptop keeps its own audit log** of every request the hub made and how it was answered.
+
+### 3. Agents are sandboxed apart from what users run
+- On the hub, agents run as a separate OS user (or in a container, gVisor, or Modal Sandbox per #1879).
+- That user cannot write:
+  - the served UI;
+  - the gate scripts;
+  - the charter;
+  - the deployment config;
+  - other principals' worktrees.
+- Credentials reachable by agents are short-lived and bound to a principal (A15 mint records; Bedrock via identity tokens per #1887, not keys).
+
+### 4. Install is one command and one click
+- **Hub:** `armonia init --lab "<name>"`. It runs these steps:
+  1. host checks;
+  2. creates the agent user and sandbox runtime;
+  3. joins the tailnet and tags the machine;
+  4. emits the ACL snippet (or applies it through the API);
+  5. mints the lab starter vault and signs the conservative charter;
+  6. installs services that update from the signed channel;
+  7. prints a join link and QR code.
+- **Laptop:** install the extension, then open the join link.
+  - The Tailscale login, via the institution's SSO, admits the device.
+  - MagicDNS locates the hub.
+  - A "share folders?" screen opens with nothing selected.
+  - No ports, keys, or settings files are involved.
+- **Instrument or site machine:** `armonia site join --kind lab` with a one-time tagged key. Outbound only.
+- **`armonia doctor`** reports tailnet membership, identity, hub reachability, version skew, signatures, and charter state. Each result is a named outcome with its remedy.
+
+## Consequences
+
+- Port drift, tunnel daemons, and the `fleet.repair` port migration stop being necessary once clients use the MagicDNS URL. #1956's machine-scoped settings remain, as defense in depth.
+- A compromised hub, or an agent on it, can no longer run code, read the clipboard, or browse files on a laptop. The worst case reduces to what the user shared or explicitly consented to.
+- Tailscale becomes a deployment dependency for the Lab and Harmoniqs profiles. The Open profile (local only) is unaffected. Headscale or WireGuard cover labs that cannot use it.
+- The capability table and signed UI bundle are new extension work. Hub-served UI stops being the default update path for laptops: UI updates ride the signed extension or a signed bundle.
+
+## Slices
+
+1. **#1957** frontdoor loopback bind (done and live).
+2. `tailscale serve` publishing plus identity-header principal mapping in the frontdoor. Clients use the MagicDNS URL. The tunnel becomes a fallback.
+3. The bridge capability table: forbid or consent per posture, clipboard on paste only, `open-file`/`watch-files` scoped to shared folders, no automatic workspace push.
+4. The panel loads UI from the extension in hub-client posture; signed hub bundle opt-in.
+5. Separate agent OS user on the hub with read-only served UI, gates, and charter (with #1879).
+6. Tailnet ACL/grants snippet plus tagged site auth keys; `armonia site join`.
+7. `armonia init` and `armonia doctor`.
+8. The "Shared with <hub>" view and the laptop-side audit log.

docs/adr/0038-paper-mode-snapshot-base-3way-merge.md

@@ -0,0 +1,27 @@
+# ADR 0038 — Paper Mode: live-draft source of truth and snapshot-base 3-way merge for AI/human co-editing
+
+Status: proposed (2026-09-28)
+
+Tracking: harmoniqs/amicode#1620 · Glossary: `CONTEXT.md` (Paper Mode, Draft, Pending Hunk)
+
+Paper Mode is a new opt-in session surface for *committed* LaTeX writing (editor primary, Chat docked beneath, PDF right; distinct from Preview, which stays a viewer, and independent of the paused wide-mode work). It exists because Amicode has no safe surface for AI and human to co-edit the same `.tex`: today the agent reads a stale disk/cache snapshot (edits it "saw" go missing from its output), agent writes bypass the editor buffer (the human must reopen the file), concurrent edits clobber silently, and there is no way to review an agent change before it lands or to control when compilation runs.
+
+The decision is fourfold, and each part is hard to reverse because tooling, UI, and the mutation boundary all bind to it:
+
+1. **The live editor Draft is the single source of truth**, versioned by a monotonic Content Revision (extending the content-revision rule ADR-0013 already mandates). In Paper Mode the agent's Read/Edit tools read the Draft *at its current revision every turn* — never disk, never a cache. "The agent always sees my edits" becomes true by construction and checkable, because the revision it read is stamped. This supersedes the coarse revert-based fix in #1422, which only reverts a *clean* buffer and blocks while the human is typing — insufficient for real co-editing.
+
+2. **Agent edits propose to a review layer; they do not write disk.** An agent Edit/Write in Paper Mode produces Pending Hunks — inline diff decorations in the editor — leaving the Draft and disk unchanged until the human accepts. The human's own typing writes the Draft as normal and is always authoritative. Un-accepted agent text is therefore never in the file, which is what makes "the AI never interferes," "human always wins," and "nothing compiles behind my back" all fall out of one mechanism.
+
+3. **Concurrent edits reconcile via a snapshot-base 3-way merge.** The Content Revision the agent read at edit-start is captured as the merge base. At apply time we 3-way merge (base → human-edited Draft, base → agent hunks): non-overlapping regions land as Pending Hunks; regions both parties touched become **Conflict Hunks** the human must resolve. Conflicts are **never auto-resolved** — the human explicitly wanted to be able to check whether their text was removed. CM6's `@codemirror/merge` (already a dependency, already used in `editable-diff-view.tsx`) supplies the merge/decoration primitive.
+
+4. **Compilation is manual, on the accepted Draft.** It fires only on an explicit Compile action and compiles the Draft as it stands — Pending (un-accepted) Hunks are excluded because they are not yet in the file. Accepted hunks emit ADR-0017 mutation-ledger receipts (appearing in Files Changed with real provenance); pending and rejected hunks emit nothing.
+
+## Considered options
+
+- **Agent-writes-disk with a revert-style overlay (today's #1422 model), rejected.** Reachable from current code, but the agent's text *is* in the file before the human approves, so "human always wins," "review before it lands," and "compile only on approve" all become muddy special cases rather than consequences of the model. The dirty-buffer guard also silently blocks agent edits whenever the human is typing, which is the opposite of collaboration.
+- **CRDT live merge (Yjs), rejected for now.** A shared mergeable document gives Google-Docs-style seamlessness, but it is a heavy, hard-to-reverse architectural commitment, and per-hunk human review sits *on top* of it anyway. The snapshot-base 3-way merge delivers the reviewed-collaboration requirement with far less machinery; revisit only if real-time multi-human co-presence becomes a requirement.
+- **Promote Preview into a primary editor, rejected.** Reverses ADR-0013 and the glossary's deliberate "Preview = viewer" boundary and tangles viewer and editor responsibilities in one component. Paper Mode is a separate bounded surface instead.
+
+## Consequences
+
+The agent's Edit/Write tools gain a Paper-Mode-specific behavior (propose to the review layer instead of writing disk), which must fail closed — an agent edit that cannot be expressed as a Pending Hunk is surfaced, not silently written. The Draft/revision authority and the review/merge UI are new machinery, but both build on primitives that already exist (ADR-0013 content revisions, ADR-0017 receipts, `@codemirror/merge`). Paper Mode deliberately does **not** depend on the paused wide-mode work (#1434) and is built as its own layout. LaTeX language intelligence (#1513), SyncTeX (#1432/#1514), an outline navigator, and in-editor search (#1430) are out of scope — they dock into Paper Mode later as independent slices. Revisit this decision only if Amicode adopts real-time multi-human collaboration, at which point option 2 (CRDT) is the successor.

docs/releases/0.3.10.md

@@ -0,0 +1,25 @@
+---
+version: 0.3.10
+date: 2026-10-27
+highlights:
+  - title: Sticky widgets
+    body: >-
+      Opt a widget into "sticky" and it docks as a compact strip when you
+      scroll it out of view, so a live readout stays in sight while the
+      conversation moves on.
+  - title: Step-limited subagents report what they finished
+    body: >-
+      A subagent that runs out of steps now hands back an EXHAUSTED receipt —
+      what it finished and what is left — instead of stopping silently.
+  - title: Specs that file their own issues
+    body: >-
+      "amico spec slices" turns a spec's plan rows into linked GitHub issues,
+      and "amico census" gives a quick read of open work with named gaps and a
+      72-hour stall tripwire.
+  - title: Safer hub deploys
+    body: >-
+      The hub now deploys a lane build with an atomic switch, pinned
+      provenance, and one-step rollback.
+links:
+  notes: https://github.com/harmoniqs/amicode/releases/tag/v0.3.10
+---