[aboimpinto]

Summary

Completes the 13-command core navigation slice behind portable command Shapes, in preparation for later crate extraction. No intended user-visible behavior change.

Commands: /anchor, /help, /hotbar, /links, /transcript, /turn, /home, /overview, /workspace, /translate, /voice, /voicesend, /voicecontrol (all existing aliases retained).

• Commands own parsing, branching, formatting and rendering; host adapters supply typed facts and narrow effects. Shared metadata/results/actions/payloads have no App/TUI dependency.
• Keep the existing u32 capability identities; use bits 30/31 for navigation/voice input. Unrelated commands do not gain these new facet slots. The existing WORKSPACE facet does now expose confined anchor operations to its consumers; per-operation authority narrowing remains an acknowledged design follow-up.
• Remove the obsolete App-bound implementations, retain confined anchor I/O and workspace semantics, and move the unchanged voice capture runtime outside the movable command closure. Builtin voice shortcuts cannot be hijacked by a shadowing user command.
• Compile the actual complete production root independently through unpublished tests/portable-core-navigation. Check all 13 registrations exactly once in relative order, complete source closure, all-target normal dependency graph and rejection controls. Integrate CI/developer routing and release-order validation.

This is intentionally one coherent slice: the diff includes moved host tests/runtime and shared-contract consumer updates, rather than shipping parallel implementations. The other 27 core registrations remain out of scope, the core frontier remains pending, and no physical crate movement is claimed.

Current main synchronization — 8975885 (2026-10-21)

Merged main f9fd6a75e in 8975885f0, preserving all history and the post-0.10.2-tag PR merge condition. This brings in the Rust TLS/Vite/MCP fixes and the host-generation restart assertion.

Local integration checks passed: 1,657 native command/fleet/restart tests, 9 portable tests, 7 proof controls, 772 web tests plus 7 dependency-security tests, scoped Clippy, formatting, web build/lint/types/facts/docs and relevant workflow/architecture guards. Two inherited validation repairs are explicit: collapse the fleet environment-host nested if for strict Clippy, and regenerate feature-registry hash/line references without changing feature content. Initial failures were retained.

Rust audit: zero vulnerabilities, four unmaintained warnings retained. Four npm audits: zero vulnerabilities; website reviewed mitigation verified with zero blocked findings. These are local, scoped receipts—not a fresh full-workspace/Windows or numerical-coverage claim.

Upstream full CI is now manual-only. Preserved that workflow policy and both navigation checks; no workflow re-enabled/dispatched and no PR merge/release performed. Full hosted qualification remains pending. Integration details.

Earlier security repair — ccbc863 (2026-10-20)

Fixed the two red bridge audits with a narrow lockfile-only update: follow-redirects 1.16.0 → 1.16.1 in Feishu and WeCom. No SDK/manifests/other package changes and no audit exceptions. Clean locked installs, syntax checks, 19 Feishu tests and 17 WeCom tests passed; both local audits report zero vulnerabilities.

Both hosted audits are now SUCCESS at ccbc863, with downloaded artifacts confirming zero vulnerabilities: Feishu, WeCom. Other new-head checks and maintainer merge timing remain separate. Repair details.

Earlier follow-up — 2152e4d (2026-10-20)

The maintainer-account review approved the prior implementation, with merge held until after the 0.10.2 tag and fresh main/CI qualification. The WORKSPACE authority split is explicitly tracked on the maintainers' side.

2152e4df6 fixes the two remaining small nits: proof-message spacing and builtin voice lookup by VOICE_INFO.name, not array index. User-command overrides remain bypassed. Preserved the maintainer's latest 49767fceb merge; no published history was rewritten or force-pushed.

Fresh integrated checks: 1,215 native command tests, 9 portable tests, 7 proof controls, formatting and scoped TUI Clippy passed. Existing assertions cover shadowed voice, pure named dispatch and missing-name failure. Compiled-host input refreshed. New-head CI is running; previous full-suite/coverage results below are historical, not new-head measurements. Reply.

Earlier review follow-up — 6e73d36

Preserved the maintainer's fc5ac7d904 merge, then addressed the two merge blockers and the developer-routing/proof-maintenance findings in 6e73d36cb. Point-by-point response.

• Blocking-call allowance relocated, total unchanged at 540; both localization guides corrected.
• Native command paths run host tests again; proof tolerates unrelated registrations while rejecting omissions, duplicates and reordering. Heavy main/PR lint now checks source and normal dependency closure.
• Fresh focused checks: 1,215 native command tests (all 34 relocated host tests), 9 portable tests, 7 proof controls, 34 blocking-call controls, workflow regression, formatting and web facts/docs passed.
• Workspace/anchor per-operation authority remains an explicitly documented unresolved design follow-up. No silent widening or renumbering of u32.
• This new commit is signed off; existing published history was not rewritten. New-head hosted CI/review and maintainer merge remain pending.

Original preservation and verification (historical inputs below)

• Captured 1,125 native observations across 15 locales before migration; subsequent replays were byte-identical for messages, actions, state and persisted bytes. Preserved all 44 original scoped test identities and strengthened existing behavior assertions.
• Fresh Linux full workspace: 19,075 passed, 0 failed, 34 configured skips. Instrumented full workspace: the same counts. Doctests: 3 passed, 8 ignored.
• Native/PTY selection: 58 passed. Actual portable navigation: 9 passed plus 7 rejection controls. Config portability: 35 passed. Architectural boundary/migration controls: 30/63 passed.
• Debug CLI, optimized CLI/TUI release build, formatting and all-target/all-feature Clippy passed.
• Root npm groups 101/101, 19/19, 418/419 (1 skip), 7/7; web 772/772 across 74 files. Web facts/docs/tokens/lint/types/build passed.
• Changed executable production Rust lines: 856/978 = 87.53%, minimum 80%; advisory 95% not reached. Relocated production code, including the unchanged capture body, is included. This is not a claim of full microphone/provider runtime coverage.

All 27 declared local final checks passed at the original recorded input. Native checks ran at a0a9f2541; final d22dfbba9 only refreshes stale generated documentation inherited from current main. All executable sources/manifests/test inputs are identical; affected web checks ran on the final generated bytes. The initial stale-doc failure was retained and repaired, not waived. Hosted CI and maintainer review remain separate evidence.

Base: 5fe4df9c24c61ae4b4bd582bdda52fdbdeab8594.
Head: d22dfbba91863bedd85e4489b7f3369e4e3f9a7b.

Portable proof:

python3 -B scripts/test_check_command_core_navigation_proof.py
sh scripts/check-portable-core-navigation.sh

Original hosted observation — 2026-10-17 (historical, not current head)

At head d22dfbba9, CI run 39005160298 has passed Ubuntu tests (19,075 passed, 34 skipped), Rust lint, safety, MSRV and extension-host checks. Windows concluded success with 18,331 passed, 27 skipped, but nextest reported one leaky browser-launcher test (external_url_launcher_does_not_wait_for_browser_process); this is not a leak-free qualification. macOS native tests had not finished at that observation, so that receipt did not claim full hosted CI. Synthetic CI merge 19c618de33162d1ac567a9ba7796610bb25f99df is not an upstream delivery merge.

Claude's fork-disabled comment is not a review approval. DCO is advisory and reports missing Signed-off-by warnings; no published history was rewritten. Skipped checks/deployment are not counted as executed passes.

Refs #5316. This PR implements only FEAT-031's bounded navigation adoption, not the umbrella decomposition. Required maintainer merge remains pending.

Paulo Aboim Pinto

[claude]

Claude Code Review

This pull request is from a fork — automated review is disabled. A repository maintainer can comment @claude review to run a one-time review.

[Hmbown]

🤖 This review is from Claude Opus 5.5, an AI agent working on behalf of the Codewhale maintainers. It is posted through @Hmbown's account, but Hunter did not write it.

Thank you @aboimpinto for a careful, well-evidenced slice. The 1125-observation byte-identical replay and the 13-pair proof made it reviewable in depth. Each moved command was diffed against its old implementation on main, and the gate checks were re-run on a copy of the head (d22dfbb).

Verified good

• Behaviour is preserved for all 13 commands:
  • registration order and aliases;
  • usage and description keys;
  • argument parsing and English messages;
  • anchor bytes, with every write still through fs_confined and the .deepseek fallback;
  • workspace switching;
  • voice and translate toggles.
• Every translated key passes the exact-placeholder check in all 15 locale files.
• Alt+V and the hotbar call the builtin voice handler directly, so a user command cannot shadow them, as you claimed.
• Bits 30 and 31 do not collide with anything.

Needed before merge

1. The blocking-calls ratchet fails. The candidate.canonicalize() site moved from groups/core/core.rs to WorkspaceAdapter::inspect_workspace_target in commands/contract.rs, but scripts/check-blocking-calls-budget.json was not updated. On the head, python3 scripts/check-blocking-calls-budget.py prints contract.rs: path_canonicalize sites 5 > budget 4 and exits 1. Hosted Lint logs the same, but the step is advisory on PRs, so the check shows green. On main it blocks. The fix is net zero: python3 scripts/check-blocking-calls-budget.py --update moves the budget (contract.rs 4→5, core.rs removed). Maintainer edits are enabled on this PR, so I can push that one-file change to your branch if you prefer. Just say so.
2. /links lost its exhaustive locale match. public_site_locale_segment matched every Locale variant, so adding a locale caused a compile error. In links.rs it now matches tag strings with _ => "en". Output is identical today. But docs/LOCALIZATION.md:199-203 and docs/zh_hans/LOCALIZATION.md still say the compiler will point at that function in core.rs. Either keep an exhaustive match, for example by mapping Locale to a portable enum in the adapter, or update both docs.

Worth a look
3. CommandWorkspaceContext (WORKSPACE) gained anchor read/append/replace, a workspace-target probe and home-dir resolution. So /memory, /note, /task, /attach, /init and /plugins now carry anchor-write authority through WORKSPACE. They are first-party handlers, so this is not exploitable. But WORKSPACE was described as path reads (handler.rs), and NAVIGATION or a narrow anchor trait would keep it least-authority.
4. scripts/dev-test.sh now routes edits to the navigation leaves to codewhale-portable-core-navigation. That package has few of the relocated host tests, so a local dev-test on those paths stops running them.
5. The new proof can fail later PRs when main moves. It pins the total core registration count, absolute positions and the exact third-party dependency set, and it runs only on pull_request. When main changes any of those, unrelated PRs fail Test (ubuntu-latest), as happened with the config proof (fixed in 5fe4df9). Checking the 13 pairs' relative order instead of absolute positions would avoid that. The maintainers are also happy to own this follow-up.
6. Nits:

• NAVIGATION/VOICE_INPUT use up the u32 capability space, so a doc comment or a note on what comes next would help.
• "all13" and "other27" in the README need spaces.
• The commits have no Signed-off-by (the DCO check is advisory).

The macOS and Windows test jobs were still running when this review was written. Maintainers will add your CHANGELOG credit at merge.

— Written by Claude Opus 5.5 (AI agent) on behalf of the maintainers.

[Hmbown]

🤖 This reply is from Claude Opus 5.5, an AI agent working on behalf of the Codewhale maintainers. It is posted through @Hmbown's account, but Hunter did not write it.

@aboimpinto, main moved after you opened this, and the PR picked up a conflict in the generated web/data/agent-docs.generated.json. That conflict came from our changes, so I resolved it on your branch: fc5ac7d merges main and regenerates that file with node web/scripts/derive-facts.mjs. check-facts prints OK and no source file was touched. Please git pull before you push again.

Items 1 (the blocking-calls budget) and 2 (the /links locale match or its docs) from the review are still what stands before merge. If you'd like, I can push the one-file budget update.

— Written by Claude Opus 5.5 (AI agent) on behalf of the maintainers.

[aboimpinto]

Thank you for the detailed review and for resolving the generated-doc conflict. I fast-forwarded to your fc5ac7d904 before making changes; that merge is preserved.

Pushed 6e73d36cb:

1. Blocking budget: reproduced the failing ratchet, then moved the one canonicalization allowance from core.rs to contract.rs. Total allowance stays 540 → 540; unrelated budgets are unchanged. The checker and its 34 controls now pass. No additional budget patch is needed.
2. Locale mapping: updated both localization guides to the actual links.rs tag mapping, its English fallback, and the explicit website-locale review needed when adding a language. No host Locale dependency or duplicate enum was introduced.
3. Developer routing: command-source paths again select native commands:: tests. The actual /links source route ran 1,215 tests, including all 34 relocated host tests. The explicit portable area remains available separately.
4. Proof maintenance: removed the total-core count and absolute-position pins. The proof still requires all 13 navigation entries exactly once in relative order. Controls accept unrelated insertions and reject missing/duplicate/reordered entries. Source/normal-graph checks now also run in heavy main lint, not just PRs. The reviewed dependency allowlist remains deliberate; new normal dependencies must not silently admit runtime/storage services.
5. Nits: fixed README spacing, documented exhaustion of the u32 capability space, and signed off this new commit. I did not rewrite the already-published commits or your merge.

Item 3 remains a design follow-up: you are right that WORKSPACE consumers now have access to the confined anchor operations. The README and stale capability description now acknowledge that limitation; documentation does not narrow authority. A per-operation/anchor capability split needs a separate contract decision without silently widening or renumbering the agreed 32-bit representation. I am not marking that concern fixed.

Also verified: 9 portable tests, 7 proof controls (including the new drift cases), workflow regression, formatting, and web facts/docs. New-head hosted CI is pending; earlier full-suite/coverage results are not presented as new-head receipts.

Paulo Aboim Pinto

[Hmbown]

🤖 This review is from Claude Opus 5.5, an AI agent working on behalf of the Codewhale maintainers. It is posted through @Hmbown's account, but Hunter did not write it.

Thanks @aboimpinto. 6e73d36 answers the earlier review point by point. I re-checked it at 6cbdcb8:

• The blocking-calls budget now passes on its own merits (Lint: 539 sites, within budget).
• Both LOCALIZATION guides describe the tag mapping in links.rs. Its output matches the old exhaustive match for all 15 locales.
• dev-test.sh routes command source paths back to the native commands:: tests. Only the portable package and navigation.rs route specially.
• The proof checks only the relative order of the 13 registrations, and the source and graph check also runs on main.
• CI is green on all three platforms: Ubuntu 19,075, macOS 19,078 and Windows 18,331 passed. The one leaky Windows test also leaks on main.

LGTM. Three nits, none blocking:

1. scripts/check-command-core-navigation-proof.py still prints "all13" in its FAIL and PASS messages.
2. The Alt+V shortcut dispatches by index (dispatch::<10> in core_navigation_voice_host.rs). A lookup by VOICE_INFO.name would not depend on array order.
3. The WORKSPACE anchor-authority split stays open, and we'll track it on our side. It needs a capability-representation decision first, because bits 30 and 31 use up the u32.

As planned, this merges after the 0.10.2 tag, with CI re-run on a fresh merge with main. We'll add your CHANGELOG credit at merge.

— Written by Claude Opus 5.5 (AI agent) on behalf of the maintainers.

[aboimpinto]

Thank you for the approval and for tracking the WORKSPACE authority split on your side.

Addressed the two small nits in 2152e4df6:

• Corrected the remaining “all13” proof messages.
• The voice shortcut now looks up the builtin using VOICE_INFO.name, rather than dispatch::<10>. It still bypasses user-command overrides and uses the registered capability-scoped handler. Existing tests also cover pure named dispatch and safe rejection of a missing builtin.

I preserved your latest 49767fceb main merge. Only our unpublished nit commit was replayed on top after Git rejected the stale push; no published history was rewritten or force-pushed. Fresh integrated verification passed 1,215 native command tests, 9 portable tests, 7 proof controls, formatting and scoped TUI Clippy, with the compiled-host input refreshed.

Understood on the post-0.10.2-tag merge timing and fresh main/CI qualification. These focused results do not replace new-head hosted checks or the final merge gate. No capability-representation change was added.

CI update: the new security run fails the Feishu and WeCom bridge audits. Both artifacts identify follow-redirects@1.16.0 with GHSA-q3jh-wrc6-jgq8 and GHSA-8r9p-f939-6h3c, high-severity advisories affecting >=1.16.0 <1.16.1. Both bridge lockfiles are byte-identical to main da467bb5e; this is a shared dependency finding, not a navigation change. I have retained the failed receipts and am flagging this for the security/release baseline fix rather than waiving it or silently adding dependency work to this slice.

Paulo Aboim Pinto

[aboimpinto]

The two red bridge audits are fixed in ccbc86312.

Only the follow-redirects entries in the Feishu and WeCom lockfiles changed: 1.16.0 → 1.16.1 (version, tarball URL and integrity). SDK versions, manifests, all other packages and audit policy are unchanged.

• Clean locked installs and syntax checks passed.
• Feishu: 19/19 tests; WeCom: 17/17 tests.
• Both local audits report zero vulnerabilities.
• Both previously failing hosted checks are now SUCCESS at this exact head: Feishu, WeCom. Downloaded audit artifacts also confirm zero vulnerabilities.

This fixes GHSA-q3jh-wrc6-jgq8 and GHSA-8r9p-f939-6h3c without exclusions or a lower threshold. Other new-head checks and the agreed maintainer merge/release timing remain separate. The security repair is isolated in this lockfile-only commit for the shared baseline if useful.

Subsequent check results: the same run now reports five other failures: cargo-audit/cargo-deny flag rustls-webpki0.103.15 and webpki-root-certs/webpki-roots1.0.9 (RUSTSEC-2026-0382/0383/0381); web and telemetry audits flag Vite (GHSA-698v-4r3x-3vcv); extension-host flags the MCP client SDK (GHSA-6prh-2h8m-c8cw). The website classifier still verifies its existing braces mitigation; Vite is the new blocking finding there. The three npm locks and the affected Rust package records match main; this bridge-only commit did not change them. Logs/artifacts are retained, and these failures are not waived. This update confirms the original two checks are green, not that all CI is green; the additional security updates are a separate remaining batch.

Paulo Aboim Pinto

[Hmbown]

🤖 This reply is from Claude Opus 5.5, an AI agent working on behalf of the Codewhale maintainers. It is posted through @Hmbown's account, but Hunter did not write it.

@aboimpinto, thank you for clearing the Feishu and WeCom audits in ccbc863. The checks still red at that head don't come from files this PR changes:

• cargo-audit and cargo-deny (advisories): the three vulnerabilities are in rustls-webpki 0.103.15 and webpki-roots/webpki-root-certs 1.0.9, inherited from your branch's base. Current main already has 0.103.16 and 1.0.10.
• npm-audit (web, telemetry-ingest, extension-host): this PR doesn't touch those lockfiles.
• Test (windows-latest): the one failure is extension_host::tests::killed_host_fails_calls_once_and_replays_with_fresh_owners, outside this PR's files.

Nothing is needed from you before the 0.10.2 tag. Your branch still merges cleanly into today's main; the only shared files are ci.yml, Cargo.lock and the two bridge lockfiles, and main already carries the same follow-redirects 1.16.1 bump. As agreed in the review, the merge waits for the tag. After that we'll bring main into the branch, rerun the command tests, the portable crate and proof checks and Windows, and then merge.

[aboimpinto]

Kept the branch current in 8975885f0 by merging main f9fd6a75e, while retaining the agreed post-0.10.2-tag merge timing.

This brings in the TLS/Vite/MCP fixes and the host-generation assertion replacing PID inequality. Integrated local verification passed 1,657 native command/fleet/restart tests, 9 portable tests, 7 proof controls, and 772 web tests plus 7 security controls. Scoped Clippy, web build/lint/types/facts/docs and relevant workflow/architecture guards also passed. The formerly failing restart test passed locally on Linux; I am not claiming a fresh Windows receipt.

Two small inherited validation repairs are included and called out in the merge commit: collapse the nested fleet environment-host if required by Clippy, and regenerate the feature registry's source hash/line references. No feature content, threshold or suppression changed.

Rust audit now reports zero vulnerabilities (four unmaintained warnings retained); telemetry, extension-host and both bridge npm audits report zero vulnerabilities. The website's existing reviewed mitigation verifies with no blocked findings.

I preserved main's manual-only workflow triggers, both navigation checks and all published history. No workflow was re-enabled or manually dispatched, and no PR merge/release was performed. Hosted qualification and final merge remain with the maintainers under the agreed release timing.

Paulo Aboim Pinto