chore: merge current upstream dev into welcome gutter successor

.config/nextest.toml

@@ -0,0 +1,42 @@
+# CI reliability policy for cargo-nextest.
+#
+# - retries = 1 with flaky-result = "fail": a test that only passes on retry
+#   still FAILS the run; the retry exists to surface flakiness as telemetry,
+#   never to mask it.
+# - process-lifecycle group: process/PTY-reaping tests are load-sensitive and
+#   must not run concurrently within a partition. The in-source mutexes
+#   (PROCESS_TEST_LOCK / PTY_TEST_LOCK) do not serialize nextest's
+#   process-per-test execution, so serialization must happen here.
+#
+# MAINTENANCE CONTRACT: the overrides below name tests exactly. If one of the
+# listed tests is renamed or moved, its override silently stops matching (no
+# nextest warning) and the test loses serialization + its extended timeout.
+# After renaming any listed test, re-run:
+#   cargo nextest show-config test-groups --profile ci
+# and confirm all eight tests still resolve into process-lifecycle.
+nextest-version = { required = "0.9.137" }
+
+[test-groups.process-lifecycle]
+max-threads = 1
+
+[profile.ci]
+fail-fast = false
+retries = 1
+flaky-result = "fail"
+status-level = "retry"
+final-status-level = "flaky"
+slow-timeout = { period = "60s", terminate-after = 2 }
+leak-timeout = "500ms"
+
+[profile.ci.junit]
+path = "junit.xml"
+
+[[profile.ci.overrides]]
+filter = 'package(pi-shell) & (test(=shell::tests::timeout_builtin_reaps_reparented_same_group_grandchild_and_preserves_sibling) | test(=shell::tests::cancelled_command_reaps_reparented_same_group_grandchild) | test(=process::tests::descendants_includes_freshly_spawned_child))'
+test-group = "process-lifecycle"
+slow-timeout = { period = "120s", terminate-after = 2 }
+
+[[profile.ci.overrides]]
+filter = 'package(pi-natives) & (test(=pty::tests::bounded_reader_channel_reports_success_for_high_output) | test(=pty::tests::dropped_session_core_kills_and_reaps_mid_run_child) | test(=pty::tests::dropped_js_pty_session_kills_and_reaps_mid_run_child) | test(=pty::tests::kill_path_reaps_sigterm_trapping_child) | test(=pty::tests::background_grandchild_holding_slave_is_reaped_and_unrelated_sibling_survives))'
+test-group = "process-lifecycle"
+slow-timeout = { period = "120s", terminate-after = 2 }

.github/PULL_REQUEST_TEMPLATE.md

@@ -10,8 +10,18 @@
 
 <!-- How was this tested? -->
 
+## GJC verdict
+
+<!-- Paste one exact-head verdict. Self-approval is BLOCK. If there was no independent architect/critic/human review, write needs-human and stop. -->
+
+```text
+gajae.pr-review-verdict.v1 <merge-approved|merge-blocked|needs-human> sha256:<exact-head-or-diff-hash> reviewer:<architect|critic|human> evidence:<ci-run-url-or-local-command>
+```
+
 ---
 
+- [ ] Target branch is `dev`
 - [ ] `bun check` passes
 - [ ] Tested locally
 - [ ] CHANGELOG updated (if user-facing)
+- [ ] Verdict above matches the exact PR head, not an earlier commit

.github/actions/build-native/action.yml

@@ -82,6 +82,9 @@ runs:
            TARGET_PLATFORM: ${{ inputs.platform }}
            TARGET_ARCH: ${{ inputs.arch }}
            TARGET_VARIANTS: ${{ inputs.variant }}
+           # Tag builds ship the size-tuned dist profile (strip=debuginfo,
+           # fat LTO, panic=unwind preserved); PR/branch builds keep ci.
+           PI_NATIVE_PROFILE: ${{ startsWith(github.ref, 'refs/tags/v') && 'dist' || '' }}
            CARGO_TARGET_AARCH64_UNKNOWN_LINUX_GNU_LINKER: aarch64-linux-gnu-gcc
         run: bun run ci:build:native
       - name: Upload native addon(s)

.github/workflows/public-site-sync.yml

@@ -9,6 +9,9 @@ on:
     - cron: "17 3 * * *"
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
@@ -27,7 +30,7 @@ jobs:
         run: bun run check:public-sync
 
   live-public-sync:
-    name: Live public homepage version
+    name: Live deployed release state
     if: ${{ github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' }}
     runs-on: ubuntu-22.04
     timeout-minutes: 10
@@ -36,5 +39,5 @@ jobs:
       - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6  # v2
         with:
           bun-version: "1.3"
-      - name: Compare live homepage version with repository version
-        run: bun run check:public-live-sync
+      - name: Exercise production remote final-evidence and deployed release-state validation
+        run: bun scripts/check-public-version-sync.ts --live

.gitignore

@@ -65,6 +65,8 @@ packages/ai/test/.temp-images/
 compaction-results/
 changes/
 __pycache__/
+*.egg-info/
+.pytest_cache/
 
 # Scratch files
 syntax.jsonl
@@ -75,16 +77,12 @@ pi-*.html
 # Generated files
 packages/coding-agent/src/internal-urls/docs-index.generated.ts
 /runs/
-python/gjc-rpc/src/gjc_rpc.egg-info/
 # parallel-agent worktrees
 .wt/
 CPU*.md
 packages/coding-agent/binaries/
 
-# robogjc runtime state
-python/robogjc/data/
-python/robogjc/.cache/
-python/robogjc/src/robogjc/static/
-python/robogjc/web/dist/
-python/robogjc/.env
 .release-040-artifacts/
+
+# Python SDK build output
+python/gjc-sdk/build/

AGENTS.md

@@ -23,7 +23,7 @@ GJC intentionally exposes exactly four default workflow skills. Do not add, docu
 Rules:
 - Bundled default workflow skills load from `packages/coding-agent/src/defaults/gjc/skills`.
 - Bundled role agents load from `packages/coding-agent/src/prompts/agents`.
-- `architect`, `planner`, and `critic` remain read-only for product files, but may use their restricted `bash` tool only for sanctioned workflow CLI persistence (`gjc ralplan --write ...`) and GJC workflow state read/write/contract commands (`gjc state ...`); the bash tool blocks arbitrary env overrides, direct handoffs, state clears, artifact file-path ingestion, and all other command shapes for those role agents, allowing only `GJC_RALPLAN_ARTIFACT` for `gjc ralplan --write ... --artifact-env GJC_RALPLAN_ARTIFACT`.
+- `architect`, `planner`, and `critic` remain read-only for product files, but may use their restricted `bash` tool only for sanctioned workflow CLI persistence (`gjc ralplan --write ...`), GJC workflow state read/write/contract commands (`gjc state ...`), and read-only git inspection (`git status`, `git log`, `git show`, `git diff`, `git blame`, `git rev-parse`, `git ls-files`); the bash tool blocks arbitrary env overrides, direct handoffs, state clears, artifact file-path ingestion, mutating git commands (`git commit`, `git push`, `git reset`, `git checkout`, `git branch -D`, `git config`, ...), and all other command shapes for those role agents, allowing only `GJC_RALPLAN_ARTIFACT` for `gjc ralplan --write ... --artifact-env GJC_RALPLAN_ARTIFACT`.
 - Do not commit repo-visible `.gjc` default definitions; runtime user/project `.gjc` discovery remains supported for local overrides and installed configs.
 - Runtime state, plans, specs, and workflow ledgers belong under `.gjc/`.
 - Preserve upstream attribution in source comments/docs where appropriate, but public commands, paths, and examples must use `gjc` and `.gjc`.

Cargo.toml

@@ -4,7 +4,7 @@ exclude = ["crates/brush-core-vendored", "crates/brush-builtins-vendored", "crat
 resolver = "3"
 
 [workspace.package]
-version = "0.9.0"
+version = "0.11.8"
 edition = "2024"
 license = "MIT"
 authors = ["Yeachan-Heo"]
@@ -22,6 +22,11 @@ codegen-units = 1
 strip = true
 panic = "abort"
 
+[profile.dist]
+inherits = "release"
+panic = "unwind"
+strip = "debuginfo"
+
 [profile.ci]
 inherits = "release"
 # Override release's panic = "abort": the pi-natives blocking-task catch_unwind
@@ -228,6 +233,8 @@ smallvec = { version = "1.15.1", features = [
 # Hashing
 # ──────────────────────────────────────────────────────────────────────────────
 xxhash-rust = { version = "0.8", features = ["xxh32", "xxh64"] }
+hmac = "0.12"
+sha2 = "0.10"
 
 # ──────────────────────────────────────────────────────────────────────────────
 # Memory Management & Allocators
@@ -241,12 +248,15 @@ libc = "0.2"
 os_pipe = "1"
 windows-sys = { version = "0.61", features = [
    "Win32_Foundation",
+   "Win32_Security",
+   "Win32_Security_Authorization",
    "Win32_Storage_FileSystem",
    "Win32_Storage_ProjectedFileSystem",
    "Win32_System_Com",
-   "Win32_System_LibraryLoader",
    "Win32_System_IO",
    "Win32_System_Ioctl",
+   "Win32_System_LibraryLoader",
+   "Win32_System_Threading",
 ] }
 winreg = "0.56"
 
@@ -285,7 +295,6 @@ image = { version = "0.25", default-features = false, features = [
 inferno = { version = "0.12", default-features = false }
 syntect = { version = "5.3", default-features = false, features = [
    "default-syntaxes",
-   "default-themes",
    "regex-fancy",
 ] }