workbench: main (1.1–1.4a) into problem-workspaces + bridges, stalled/stop truth, model pin, audit sweep, formatter

.github/workflows/ci.yml

@@ -18,6 +18,11 @@ jobs:
       # self-skipping — the skip was the #25 CI-level false-green (an injection or
       # config-merge regression would pass CI because the only test for it skipped).
       - run: pnpm --filter amicode-v2 fetch:opencode
+        env:
+          # gh release download pulls the vendored binary from the PRIVATE
+          # harmoniqs/opencode release; the default GITHUB_TOKEN is scoped to
+          # this repo only, so gh needs a cross-repo token (repo secret).
+          GH_TOKEN: ${{ secrets.OPENCODE_FETCH_TOKEN }}
       - run: pnpm -r run test   # amico-run suite (incl. S31 grep rule) + extension unit suite (incl. the opencode inject/merge integration) + @amicode/schema conformance
       - name: amico-validate — shipped configs conform + linked bin works (0.1c gate)
         run: |
@@ -70,7 +75,11 @@ jobs:
       - uses: actions/setup-node@v4
         with: { node-version: 20, cache: pnpm }
       - run: pnpm install --frozen-lockfile
-      - run: pnpm --filter amicode-v2 package   # amico-run build + ext build + fetch:opencode + vsce
+      - run: pnpm -r run build   # amico-run + extension (same as fast — ensures dist/ is in place before vsce)
+      - run: pnpm --filter amicode-v2 fetch:opencode   # vendor the opencode binary (explicit step, matches fast/boot-smoke)
+        env:
+          GH_TOKEN: ${{ secrets.OPENCODE_FETCH_TOKEN }}   # private-fork release fetch (see fast)
+      - run: pnpm --filter amicode-v2 exec vsce package --no-dependencies --allow-missing-repository -o amicode.vsix
       - run: AMICODE_REQUIRE_VSIX=1 pnpm --filter amicode-v2 exec vitest run test/packaging.test.ts
   boot-smoke:
     strategy:
@@ -84,4 +93,6 @@ jobs:
         with: { node-version: 20, cache: pnpm }
       - run: pnpm install --frozen-lockfile
       - run: pnpm --filter amicode-v2 fetch:opencode
+        env:
+          GH_TOKEN: ${{ secrets.OPENCODE_FETCH_TOKEN }}   # private-fork release fetch (see fast); one step covers both matrix legs
       - run: pnpm --filter amicode-v2 test:smoke

.prettierignore

@@ -0,0 +1,8 @@
+# generated / vendored — never hand-formatted
+node_modules
+dist
+packages/extension/vendor
+packages/extension/exemplars
+*.vsix
+pnpm-lock.yaml
+CHANGELOG.md

.prettierrc

@@ -0,0 +1,4 @@
+{
+  "printWidth": 120,
+  "semi": true
+}

packages/amico-run/esbuild.config.mjs

@@ -1,17 +1,17 @@
-import { build } from 'esbuild'
-import { chmodSync } from 'node:fs'
+import { build } from "esbuild";
+import { chmodSync } from "node:fs";
 
 await build({
-  entryPoints: ['src/cli.ts'],
+  entryPoints: ["src/cli.ts"],
   bundle: true,
-  platform: 'node',
-  target: 'node20',
+  platform: "node",
+  target: "node20",
   // ESM, not CJS: the package is "type": "module", so node executes dist/amico-run.js
   // as ESM — a CJS bundle would die on `require is not defined in ES module scope`.
-  format: 'esm',
-  outfile: 'dist/amico-run.js',
-  banner: { js: '#!/usr/bin/env node' },
+  format: "esm",
+  outfile: "dist/amico-run.js",
+  banner: { js: "#!/usr/bin/env node" },
   sourcemap: true,
-  logLevel: 'info',
-})
-chmodSync('dist/amico-run.js', 0o755)
+  logLevel: "info",
+});
+chmodSync("dist/amico-run.js", 0o755);

packages/amico-run/src/authoring.ts

@@ -4,64 +4,64 @@
 // assets); the gate reads it here. Absent file → conservative built-in
 // defaults (public base ∪ support set) so a bare-but-spec'd dev invocation
 // still gates sanely. $AMICO_AUTHORING_FILE overrides the path (tests).
-import { existsSync, readFileSync } from 'node:fs'
-import { homedir } from 'node:os'
-import { join } from 'node:path'
+import { existsSync, readFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
 
 // NOTE (spec-20260704-113005 §3): session prep ALSO writes an additive
 // `skills: [{source: "library"|"package", package?, name, description, path}]`
 // array — the dual-source skill index the agent was given this session. It is a
 // record for provenance/UI; amico-run does not consume it (unknown fields are
 // ignored here), so it is intentionally NOT in this interface.
 export interface AuthoringConfig {
-  allowlist: string[]      // entitlement-resolved Harmoniqs packages
-  support_set: string[]    // fixed support packages the run-dir contract itself needs
-  registry?: string        // abs path to templates/registry.toml
-  exemplars?: string       // abs path to exemplars/index.json
-  verify_harness?: string  // abs path to julia/verify_rollout.jl
-  verify_tolerance: number // tier-3 re-rollout agreement (absolute)
+  allowlist: string[]; // entitlement-resolved Harmoniqs packages
+  support_set: string[]; // fixed support packages the run-dir contract itself needs
+  registry?: string; // abs path to templates/registry.toml
+  exemplars?: string; // abs path to exemplars/index.json
+  verify_harness?: string; // abs path to julia/verify_rollout.jl
+  verify_tolerance: number; // tier-3 re-rollout agreement (absolute)
 }
 
-export const DEFAULT_ALLOWLIST = ['Piccolo', 'Legato', 'Intonato', 'NamedTrajectories', 'DirectTrajOpt']
-export const DEFAULT_SUPPORT = ['JLD2', 'CairoMakie', 'Makie', 'TOML', 'Printf']
-const DEFAULT_TOLERANCE = 0.001
+export const DEFAULT_ALLOWLIST = ["Piccolo", "Legato", "Intonato", "NamedTrajectories", "DirectTrajOpt"];
+export const DEFAULT_SUPPORT = ["JLD2", "CairoMakie", "Makie", "TOML", "Printf"];
+const DEFAULT_TOLERANCE = 0.001;
 
 function defaults(): AuthoringConfig {
   return {
     allowlist: [...DEFAULT_ALLOWLIST],
     support_set: [...DEFAULT_SUPPORT],
     verify_tolerance: DEFAULT_TOLERANCE,
-  }
+  };
 }
 
 export function authoringFile(): string {
-  const env = process.env.AMICO_AUTHORING_FILE
-  if (env && env.trim() !== '') return env
-  return join(homedir(), '.amico', 'authoring', 'authoring.json')
+  const env = process.env.AMICO_AUTHORING_FILE;
+  if (env && env.trim() !== "") return env;
+  return join(homedir(), ".amico", "authoring", "authoring.json");
 }
 
 export function readAuthoring(): { config: AuthoringConfig; warning?: string } {
-  const file = authoringFile()
-  if (!existsSync(file)) return { config: defaults() }
-  let raw: unknown
+  const file = authoringFile();
+  if (!existsSync(file)) return { config: defaults() };
+  let raw: unknown;
   try {
-    raw = JSON.parse(readFileSync(file, 'utf8'))
+    raw = JSON.parse(readFileSync(file, "utf8"));
   } catch {
-    return { config: defaults(), warning: `malformed authoring.json at ${file} — using built-in defaults` }
+    return { config: defaults(), warning: `malformed authoring.json at ${file} — using built-in defaults` };
   }
-  if (typeof raw !== 'object' || raw === null)
-    return { config: defaults(), warning: `authoring.json at ${file} is not an object — using built-in defaults` }
-  const data = raw as Record<string, unknown>
+  if (typeof raw !== "object" || raw === null)
+    return { config: defaults(), warning: `authoring.json at ${file} is not an object — using built-in defaults` };
+  const data = raw as Record<string, unknown>;
   const strings = (v: unknown): string[] | undefined =>
-    Array.isArray(v) ? v.filter((s): s is string => typeof s === 'string') : undefined
+    Array.isArray(v) ? v.filter((s): s is string => typeof s === "string") : undefined;
   return {
     config: {
       allowlist: strings(data.allowlist) ?? [...DEFAULT_ALLOWLIST],
       support_set: strings(data.support_set) ?? [...DEFAULT_SUPPORT],
-      registry: typeof data.registry === 'string' ? data.registry : undefined,
-      exemplars: typeof data.exemplars === 'string' ? data.exemplars : undefined,
-      verify_harness: typeof data.verify_harness === 'string' ? data.verify_harness : undefined,
-      verify_tolerance: typeof data.verify_tolerance === 'number' ? data.verify_tolerance : DEFAULT_TOLERANCE,
+      registry: typeof data.registry === "string" ? data.registry : undefined,
+      exemplars: typeof data.exemplars === "string" ? data.exemplars : undefined,
+      verify_harness: typeof data.verify_harness === "string" ? data.verify_harness : undefined,
+      verify_tolerance: typeof data.verify_tolerance === "number" ? data.verify_tolerance : DEFAULT_TOLERANCE,
     },
-  }
+  };
 }

packages/amico-run/src/baseline.ts

@@ -6,32 +6,37 @@
 // convention's `# ── FILL IN` / `# ─────` pair; an index entry may override
 // with fill_begin/fill_end regex sources. Unterminated blocks mask to EOF
 // (conservative: an attacker deleting the end marker can't unmask anything).
-import { createHash } from 'node:crypto'
+import { createHash } from "node:crypto";
 
-const DEFAULT_BEGIN = '^# ── FILL IN'
-const DEFAULT_END = '^# ─────'
+const DEFAULT_BEGIN = "^# ── FILL IN";
+const DEFAULT_END = "^# ─────";
 
 export function maskFillPoints(text: string, beginSource?: string, endSource?: string): string {
-  const begin = new RegExp(beginSource ?? DEFAULT_BEGIN)
-  const end = new RegExp(endSource ?? DEFAULT_END)
-  const out: string[] = []
-  let inside = false
-  for (const line of text.split('\n')) {
+  const begin = new RegExp(beginSource ?? DEFAULT_BEGIN);
+  const end = new RegExp(endSource ?? DEFAULT_END);
+  const out: string[] = [];
+  let inside = false;
+  for (const line of text.split("\n")) {
     if (!inside && begin.test(line)) {
-      inside = true
-      out.push(line)
-      continue
+      inside = true;
+      out.push(line);
+      continue;
     }
     if (inside && end.test(line)) {
-      inside = false
-      out.push(line)
-      continue
+      inside = false;
+      out.push(line);
+      continue;
     }
-    out.push(inside ? '#MASKED' : line)
+    out.push(inside ? "#MASKED" : line);
   }
-  return out.join('\n')
+  return out.join("\n");
 }
 
 export function maskedHash(text: string, beginSource?: string, endSource?: string): string {
-  return 'sha256:' + createHash('sha256').update(maskFillPoints(text, beginSource, endSource)).digest('hex')
+  return (
+    "sha256:" +
+    createHash("sha256")
+      .update(maskFillPoints(text, beginSource, endSource))
+      .digest("hex")
+  );
 }