raghav and aaron reconciliation branch

.github/workflows/ci.yml

@@ -18,6 +18,11 @@ jobs:
       # self-skipping — the skip was the #25 CI-level false-green (an injection or
       # config-merge regression would pass CI because the only test for it skipped).
       - run: pnpm --filter amicode-v2 fetch:opencode
+        env:
+          # gh release download pulls the vendored binary from the PRIVATE
+          # harmoniqs/opencode release; the default GITHUB_TOKEN is scoped to
+          # this repo only, so gh needs a cross-repo token (repo secret).
+          GH_TOKEN: ${{ secrets.OPENCODE_FETCH_TOKEN }}
       - run: pnpm -r run test   # amico-run suite (incl. S31 grep rule) + extension unit suite (incl. the opencode inject/merge integration) + @amicode/schema conformance
       - name: amico-validate — shipped configs conform + linked bin works (0.1c gate)
         run: |
@@ -70,7 +75,11 @@ jobs:
       - uses: actions/setup-node@v4
         with: { node-version: 20, cache: pnpm }
       - run: pnpm install --frozen-lockfile
-      - run: pnpm --filter amicode-v2 package   # amico-run build + ext build + fetch:opencode + vsce
+      - run: pnpm -r run build   # amico-run + extension (same as fast — ensures dist/ is in place before vsce)
+      - run: pnpm --filter amicode-v2 fetch:opencode   # vendor the opencode binary (explicit step, matches fast/boot-smoke)
+        env:
+          GH_TOKEN: ${{ secrets.OPENCODE_FETCH_TOKEN }}   # private-fork release fetch (see fast)
+      - run: pnpm --filter amicode-v2 exec vsce package --no-dependencies --allow-missing-repository -o amicode.vsix
       - run: AMICODE_REQUIRE_VSIX=1 pnpm --filter amicode-v2 exec vitest run test/packaging.test.ts
   boot-smoke:
     strategy:
@@ -84,4 +93,6 @@ jobs:
         with: { node-version: 20, cache: pnpm }
       - run: pnpm install --frozen-lockfile
       - run: pnpm --filter amicode-v2 fetch:opencode
+        env:
+          GH_TOKEN: ${{ secrets.OPENCODE_FETCH_TOKEN }}   # private-fork release fetch (see fast); one step covers both matrix legs
       - run: pnpm --filter amicode-v2 test:smoke

.github/workflows/release.yml

@@ -0,0 +1,53 @@
+# Tag-triggered VSIX release. Push a `v*` tag → full package chain (amico-run +
+# extension + exemplars + vendored opencode via fetch:opencode), channel-gate
+# check on the vendored binary, packaging-manifest gate, then a GitHub release
+# with amicode.vsix attached.
+name: release
+on:
+  push:
+    tags:
+      - "v*"
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: "Existing tag to package and release"
+        required: true
+
+concurrency: ${{ github.workflow }}-${{ github.ref }}
+
+permissions:
+  contents: write
+
+jobs:
+  vsix:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ inputs.tag || github.ref_name }}
+      - uses: pnpm/action-setup@v4
+      - uses: actions/setup-node@v4
+        with: { node-version: 20, cache: pnpm }
+      - run: pnpm install --frozen-lockfile
+      - run: pnpm --filter amicode-v2 run package # amico-run + build + exemplars + fetch:opencode + vsce
+        env:
+          GH_TOKEN: ${{ secrets.OPENCODE_FETCH_TOKEN }} # private-fork release fetch (see ci.yml)
+      - name: Gate check — vendored binary ships the amicode UI ON
+        run: |
+          set -euo pipefail
+          BIN=packages/extension/vendor/opencode/linux-x64/opencode
+          cat packages/extension/vendor/opencode/linux-x64/.source
+          # minified shape: `...general?.newLayoutDesigns,<VAR>)` with `<VAR>=!0` (on) / `=!1` (off)
+          VAR=$(grep -aoh 'newLayoutDesigns,[A-Za-z$_]\{1,8\})' "$BIN" | head -1 | sed 's/newLayoutDesigns,//; s/)//')
+          test -n "$VAR" || { echo "FAIL: gate pattern not found (minifier drift? update this check)"; exit 1; }
+          grep -aq "[^A-Za-z0-9_\$]${VAR}=!0" "$BIN" \
+            || { echo "FAIL: channel gate OFF (${VAR}=!1) — vendored binary hides the amicode UI"; exit 1; }
+          echo "OK: gate ON (${VAR}=!0)"
+      - run: AMICODE_REQUIRE_VSIX=1 pnpm --filter amicode-v2 exec vitest run test/packaging.test.ts
+      - name: Create GitHub release
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          TAG="${{ inputs.tag || github.ref_name }}"
+          gh release create "$TAG" --title "amicode $TAG" --generate-notes \
+            packages/extension/amicode.vsix

.prettierignore

@@ -0,0 +1,8 @@
+# generated / vendored — never hand-formatted
+node_modules
+dist
+packages/extension/vendor
+packages/extension/exemplars
+*.vsix
+pnpm-lock.yaml
+CHANGELOG.md

.prettierrc

@@ -0,0 +1,4 @@
+{
+  "printWidth": 120,
+  "semi": true
+}

AGENTS.md

@@ -0,0 +1,80 @@
+# Amicode — agent setup & testing guide
+
+You are (probably) an agent asked to set up, develop, or test Amicode on this machine.
+This file is the canonical path. The human-oriented test script is
+`packages/extension/TESTING.md`; design authority lives in the `harmoniqs/amico` vault
+(see `README.md`). **Do not confuse this file with `packages/extension/AGENTS.md`** —
+that one is the product's runtime instruction set for the in-app agent, not for you.
+
+## What this is
+
+A VS Code extension (`packages/extension`, pnpm workspace) for conversational quantum
+pulse design: chat (an opencode server we vendor, branded as Amicode) → guided interview
+→ LLM-authored Julia solve (Piccolo) via `packages/amico-run` → live Run Inspector.
+Interview flows are data (`packages/extension/scores/`). Schemas: `packages/schema`.
+
+## Prerequisites (verify each; do not assume)
+
+1. `node >= 20`, `corepack enable` (repo pins `pnpm@9.15.9` — never install pnpm globally)
+2. Julia ≥ 1.12 via juliaup: `curl -fsSL https://install.julialang.org | sh`
+3. `gh auth status` succeeds AND `gh repo view harmoniqs/opencode` succeeds
+   (private fork mirror — the vendored binary downloads from its release; if 404, stop
+   and tell the human to request access from Aaron)
+4. An LLM provider for the chat: `opencode auth login` after the binary is vendored
+   (or `ANTHROPIC_API_KEY` in the environment). Without one, the free anonymous tier is
+   used — functional but flaky; do not judge interview-quality bugs on the free tier.
+
+## Setup (in order; each step has a check)
+
+```bash
+git clone git@github.com:harmoniqs/amicode.git && cd amicode
+git checkout aaron/night-l0-pulse-designer   # the testing branch (PR #75) until merged
+corepack enable && pnpm install               # check: exits 0, lockfile untouched
+pnpm -r build                                 # check: packages/extension/dist/extension.js exists
+pnpm --filter amicode-v2 run fetch:opencode   # check: vendor/opencode/<platform>/opencode exists
+                                              # (lock source=local: builds from a harmoniqs/opencode
+                                              # clone at the locked ref — sibling ../opencode, or
+                                              # AMICODE_OPENCODE_SRC / --local <path>; needs bun.
+                                              # No clone → falls back to the gh release download)
+pnpm --filter amicode-v2 test                 # check: 200+ tests pass, 0 fail
+bash packages/extension/scripts/install.sh    # Julia project (~15 min first precompile) + VSIX + lab.toml
+node packages/extension/scripts/healthcheck.mjs   # check: 4/4 ✓ (julia, opencode, amico-run, creds)
+```
+
+macOS note: the vendored binary is unsigned — if Gatekeeper blocks it:
+`xattr -d com.apple.quarantine packages/extension/vendor/opencode/darwin-arm64/opencode`
+
+## Verification gates (run before claiming anything works)
+
+| Gate | Command | Expect |
+|---|---|---|
+| Fast suite | `pnpm --filter amicode-v2 test` | all pass |
+| Boot smoke | `pnpm --filter amicode-v2 run test:smoke` | `[smoke] PASS` |
+| Julia solve E2E | `AMICO_TEST_JULIA_PROJECT=$HOME/.amico/julia pnpm --filter amicode-v2 run test:slow` | template vet passes, F > 0.999 |
+| Live interview E2E | `cd packages/extension && AMICODE_E2E_LIVE=1 npx vitest run test/slow/interview_e2e.test.ts` | tiers A/B/C pass (C needs a provider; flaky on free tier) |
+| Full chain (opt-in, ~3 min) | add `AMICODE_E2E_FULLCHAIN=1` | tier D: interview → real solve → F > 0.99 |
+
+## Development facts you need
+
+- **Dev host**: open this repo in VS Code, F5 ("Run Extension (amicode-v2)"). The opencode
+  server runs on **fixed port 43117** (`amicode.opencodePort`); Remote-SSH users forward it once.
+- **The vendored binary is a build artifact** — never edit it; it comes from
+  `harmoniqs/opencode` (thin fork, patch stack in its `AMICODE-PATCHES.md`). Rebrand/UI work
+  happens THERE, product logic lives HERE in config/plugin/scores (Layer 0).
+- `packages/extension/opencode-plugin/` executes inside opencode's Bun runtime — it is NOT
+  part of the extension bundle; keep it dependency-free; exactly one export.
+- `packages/extension/scores/` — interview flows as data. New user path = new `SCORE.md`
+  (see `scores/README.md`); lint gate: `pnpm --filter amicode-v2 test -- repertoire_lint`.
+- Run artifacts land in `~/.amico/runs/default/<runId>/` (contract: `run.toml`, `AMICODE_ITER`
+  lines, `iter_*.png`, `result.toml`, `pulse.jld2`, `FINISHED`). Validate files with
+  `packages/schema/launcher/amico-validate <file>`.
+- Never commit to `main`; branch + PR. Testing feedback → PR #75 thread.
+
+## Known sharp edges
+
+- `test:slow` without `AMICO_TEST_JULIA_PROJECT` silently skips the Julia gates.
+- The vendor `.sha256` stamp is the ACTUAL binary hash; `.source` records provenance
+  (`local <ref>` or `release <repo>@<tag>`). Local-source installs always rebuild; a
+  release-mode run re-downloads whenever the stamp differs from the lock manifest.
+- Free-tier live e2e tiers are non-deterministic; a single tier-C failure is sampling noise.
+- Julia 1.12.x minor-version drift vs the pinned Manifest prints a warning and proceeds.

CLAUDE.md

@@ -0,0 +1,5 @@
+# CLAUDE.md
+
+Read `AGENTS.md` in this directory — it is the canonical agent-forward setup, development,
+and testing guide for this repo. Follow it exactly (prerequisites → setup → verification
+gates). Human test script: `packages/extension/TESTING.md`.

packages/amico-run/esbuild.config.mjs

@@ -1,17 +1,17 @@
-import { build } from 'esbuild'
-import { chmodSync } from 'node:fs'
+import { build } from "esbuild";
+import { chmodSync } from "node:fs";
 
 await build({
-  entryPoints: ['src/cli.ts'],
+  entryPoints: ["src/cli.ts"],
   bundle: true,
-  platform: 'node',
-  target: 'node20',
+  platform: "node",
+  target: "node20",
   // ESM, not CJS: the package is "type": "module", so node executes dist/amico-run.js
   // as ESM — a CJS bundle would die on `require is not defined in ES module scope`.
-  format: 'esm',
-  outfile: 'dist/amico-run.js',
-  banner: { js: '#!/usr/bin/env node' },
+  format: "esm",
+  outfile: "dist/amico-run.js",
+  banner: { js: "#!/usr/bin/env node" },
   sourcemap: true,
-  logLevel: 'info',
-})
-chmodSync('dist/amico-run.js', 0o755)
+  logLevel: "info",
+});
+chmodSync("dist/amico-run.js", 0o755);

packages/amico-run/package.json

@@ -5,21 +5,25 @@
   "type": "module",
   "main": "./src/index.ts",
   "types": "./src/index.ts",
-  "bin": { "amico-run": "./launcher/amico-run" },
-  "engines": { "node": ">=20" },
+  "bin": {
+    "amico-run": "./launcher/amico-run"
+  },
+  "engines": {
+    "node": ">=20"
+  },
   "scripts": {
     "build": "node esbuild.config.mjs",
     "typecheck": "tsc --noEmit",
     "test": "vitest run --passWithNoTests --exclude '**/slow/**'",
     "test:slow": "vitest run test/slow"
   },
   "dependencies": {
-    "@amicode/schema": "workspace:*"
+    "@amicode/schema": "workspace:*",
+    "smol-toml": "^1.3.0"
   },
   "devDependencies": {
     "@types/node": "^22.0.0",
     "esbuild": "^0.24.0",
-    "smol-toml": "^1.3.0",
     "typescript": "^5.6.0",
     "vitest": "^2.1.0"
   }

packages/amico-run/src/authoring.ts

@@ -0,0 +1,67 @@
+// Authoring config (spec C) — the extension→amico-run seam. Session prep
+// writes ~/.amico/authoring/authoring.json (allowlist resolved from
+// entitlements + absolute paths to the bundled registry/exemplars/harness
+// assets); the gate reads it here. Absent file → conservative built-in
+// defaults (public base ∪ support set) so a bare-but-spec'd dev invocation
+// still gates sanely. $AMICO_AUTHORING_FILE overrides the path (tests).
+import { existsSync, readFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+
+// NOTE (spec-20260704-113005 §3): session prep ALSO writes an additive
+// `skills: [{source: "library"|"package", package?, name, description, path}]`
+// array — the dual-source skill index the agent was given this session. It is a
+// record for provenance/UI; amico-run does not consume it (unknown fields are
+// ignored here), so it is intentionally NOT in this interface.
+export interface AuthoringConfig {
+  allowlist: string[]; // entitlement-resolved Harmoniqs packages
+  support_set: string[]; // fixed support packages the run-dir contract itself needs
+  registry?: string; // abs path to templates/registry.toml
+  exemplars?: string; // abs path to exemplars/index.json
+  verify_harness?: string; // abs path to julia/verify_rollout.jl
+  verify_tolerance: number; // tier-3 re-rollout agreement (absolute)
+}
+
+export const DEFAULT_ALLOWLIST = ["Piccolo", "Legato", "Intonato", "NamedTrajectories", "DirectTrajOpt"];
+export const DEFAULT_SUPPORT = ["JLD2", "CairoMakie", "Makie", "TOML", "Printf"];
+const DEFAULT_TOLERANCE = 0.001;
+
+function defaults(): AuthoringConfig {
+  return {
+    allowlist: [...DEFAULT_ALLOWLIST],
+    support_set: [...DEFAULT_SUPPORT],
+    verify_tolerance: DEFAULT_TOLERANCE,
+  };
+}
+
+export function authoringFile(): string {
+  const env = process.env.AMICO_AUTHORING_FILE;
+  if (env && env.trim() !== "") return env;
+  return join(homedir(), ".amico", "authoring", "authoring.json");
+}
+
+export function readAuthoring(): { config: AuthoringConfig; warning?: string } {
+  const file = authoringFile();
+  if (!existsSync(file)) return { config: defaults() };
+  let raw: unknown;
+  try {
+    raw = JSON.parse(readFileSync(file, "utf8"));
+  } catch {
+    return { config: defaults(), warning: `malformed authoring.json at ${file} — using built-in defaults` };
+  }
+  if (typeof raw !== "object" || raw === null)
+    return { config: defaults(), warning: `authoring.json at ${file} is not an object — using built-in defaults` };
+  const data = raw as Record<string, unknown>;
+  const strings = (v: unknown): string[] | undefined =>
+    Array.isArray(v) ? v.filter((s): s is string => typeof s === "string") : undefined;
+  return {
+    config: {
+      allowlist: strings(data.allowlist) ?? [...DEFAULT_ALLOWLIST],
+      support_set: strings(data.support_set) ?? [...DEFAULT_SUPPORT],
+      registry: typeof data.registry === "string" ? data.registry : undefined,
+      exemplars: typeof data.exemplars === "string" ? data.exemplars : undefined,
+      verify_harness: typeof data.verify_harness === "string" ? data.verify_harness : undefined,
+      verify_tolerance: typeof data.verify_tolerance === "number" ? data.verify_tolerance : DEFAULT_TOLERANCE,
+    },
+  };
+}

packages/amico-run/src/baseline.ts

@@ -0,0 +1,42 @@
+// Masked baseline (spec C tier-2 demotion detection) — sha256 of a script
+// with every line strictly BETWEEN the fill-point markers replaced by
+// "#MASKED" (the marker lines themselves are kept). Fill-point edits are
+// invariant; any edit outside them changes the hash, which the gate treats
+// as "no longer the exemplar's physics". Default markers are the template
+// convention's `# ── FILL IN` / `# ─────` pair; an index entry may override
+// with fill_begin/fill_end regex sources. Unterminated blocks mask to EOF
+// (conservative: an attacker deleting the end marker can't unmask anything).
+import { createHash } from "node:crypto";
+
+const DEFAULT_BEGIN = "^# ── FILL IN";
+const DEFAULT_END = "^# ─────";
+
+export function maskFillPoints(text: string, beginSource?: string, endSource?: string): string {
+  const begin = new RegExp(beginSource ?? DEFAULT_BEGIN);
+  const end = new RegExp(endSource ?? DEFAULT_END);
+  const out: string[] = [];
+  let inside = false;
+  for (const line of text.split("\n")) {
+    if (!inside && begin.test(line)) {
+      inside = true;
+      out.push(line);
+      continue;
+    }
+    if (inside && end.test(line)) {
+      inside = false;
+      out.push(line);
+      continue;
+    }
+    out.push(inside ? "#MASKED" : line);
+  }
+  return out.join("\n");
+}
+
+export function maskedHash(text: string, beginSource?: string, endSource?: string): string {
+  return (
+    "sha256:" +
+    createHash("sha256")
+      .update(maskFillPoints(text, beginSource, endSource))
+      .digest("hex")
+  );
+}