chore(ci)(deps): bump peaceiris/actions-gh-pages from 3 to 4

.cargo/config.toml

@@ -43,8 +43,7 @@ linker = "riscv64-linux-gnu-gcc"
 
 # Build configuration
 [build]
-# Default target for builds
-target = "x86_64-unknown-linux-gnu"
+# Default target intentionally left as host; set --target explicitly (use `cross` for Linux)
 
 # Cross-compilation settings (commented out - let cross-rs handle Docker images)
 # The cross-rs tool automatically manages Docker images for cross-compilation
@@ -92,4 +91,4 @@ color = "auto"
 quiet = false
 
 # Verbose output
-verbose = false
+verbose = false

.claude/hooks/npm_to_bun_guard.sh

@@ -0,0 +1,52 @@
+#!/bin/bash
+#
+# PreToolUse hook that uses terraphim-agent for knowledge graph-based replacement.
+# Replaces npm/yarn/pnpm commands with bun using the KG definitions in docs/src/kg/
+#
+# Installation: Add to .claude/settings.local.json under hooks.PreToolUse
+#
+
+set -e
+
+# Read JSON input from stdin
+INPUT=$(cat)
+
+# Extract tool name and command using jq
+TOOL_NAME=$(echo "$INPUT" | jq -r '.tool_name // empty')
+COMMAND=$(echo "$INPUT" | jq -r '.tool_input.command // empty')
+
+# Only process Bash commands
+[ "$TOOL_NAME" != "Bash" ] && exit 0
+[ -z "$COMMAND" ] && exit 0
+
+# Skip if no package manager references
+echo "$COMMAND" | grep -qE '\b(npm|yarn|pnpm|npx)\b' || exit 0
+
+# Source shared discovery
+if [ -f "scripts/hooks/terraphim-discover.sh" ]; then
+    source "scripts/hooks/terraphim-discover.sh"
+fi
+
+# Discover terraphim-agent
+AGENT=""
+if type discover_terraphim_agent >/dev/null 2>&1; then
+    AGENT=$(discover_terraphim_agent)
+else
+    command -v terraphim-agent >/dev/null 2>&1 && AGENT="terraphim-agent"
+    [ -z "$AGENT" ] && [ -x "./target/release/terraphim-agent" ] && AGENT="./target/release/terraphim-agent"
+    [ -z "$AGENT" ] && [ -x "$HOME/.cargo/bin/terraphim-agent" ] && AGENT="$HOME/.cargo/bin/terraphim-agent"
+fi
+
+# If no agent found, pass through unchanged
+[ -z "$AGENT" ] && exit 0
+
+# Perform replacement
+REPLACED=$("$AGENT" replace --fail-open 2>/dev/null <<< "$COMMAND")
+
+# If replacement changed something, output modified tool_input
+if [ -n "$REPLACED" ] && [ "$REPLACED" != "$COMMAND" ]; then
+    [ "${TERRAPHIM_VERBOSE:-0}" = "1" ] && echo "Terraphim: '$COMMAND' → '$REPLACED'" >&2
+    echo "$INPUT" | jq --arg cmd "$REPLACED" '.tool_input.command = $cmd'
+fi
+
+exit 0

.claude/hooks/post-llm-check.sh

@@ -0,0 +1,71 @@
+#!/bin/bash
+# Post-LLM Checklist Validation Hook
+# Validates LLM outputs against domain checklists
+#
+# This hook runs after tool completion to validate outputs meet
+# required standards.
+#
+# Usage: Called automatically by Claude Code as a PostToolUse hook
+# Input: JSON from stdin with tool_name and tool_result
+# Output: Original JSON with validation annotations
+
+set -euo pipefail
+
+# Read JSON input
+INPUT=$(cat)
+
+# Extract tool name and result
+TOOL_NAME=$(echo "$INPUT" | jq -r '.tool_name // empty')
+TOOL_RESULT=$(echo "$INPUT" | jq -r '.tool_result // empty')
+
+# Only validate certain tools
+case "$TOOL_NAME" in
+    "Write"|"Edit"|"MultiEdit")
+        # Code-related tools - use code_review checklist
+        CHECKLIST="code_review"
+        ;;
+    *)
+        # Pass through other tools
+        echo "$INPUT"
+        exit 0
+        ;;
+esac
+
+if [ -z "$TOOL_RESULT" ]; then
+    echo "$INPUT"
+    exit 0
+fi
+
+# Find terraphim-agent
+AGENT=""
+for path in \
+    "./target/release/terraphim-agent" \
+    "./target/debug/terraphim-agent" \
+    "$(which terraphim-agent 2>/dev/null || true)"; do
+    if [ -x "$path" ]; then
+        AGENT="$path"
+        break
+    fi
+done
+
+if [ -z "$AGENT" ]; then
+    echo "$INPUT"
+    exit 0
+fi
+
+# Validate against checklist (advisory mode)
+VALIDATION=$("$AGENT" validate --checklist "$CHECKLIST" --json "$TOOL_RESULT" 2>/dev/null || echo '{"passed":true}')
+PASSED=$(echo "$VALIDATION" | jq -r '.passed // true')
+
+if [ "$PASSED" = "false" ]; then
+    # Log validation failure (advisory)
+    MISSING=$(echo "$VALIDATION" | jq -r '.missing | join(", ") // "none"')
+    SATISFIED=$(echo "$VALIDATION" | jq -r '.satisfied | join(", ") // "none"')
+
+    echo "Post-LLM checklist validation ($CHECKLIST):" >&2
+    echo "  Satisfied: $SATISFIED" >&2
+    echo "  Missing: $MISSING" >&2
+fi
+
+# Always pass through (advisory mode)
+echo "$INPUT"

.claude/hooks/pre-llm-validate.sh

@@ -0,0 +1,73 @@
+#!/bin/bash
+# Pre-LLM Validation Hook
+# Validates input before LLM calls using knowledge graph connectivity
+#
+# This hook intercepts tool calls and validates the content for semantic
+# coherence before allowing them to proceed.
+#
+# Usage: Called automatically by Claude Code as a PreToolUse hook
+# Input: JSON from stdin with tool_name and tool_input
+# Output: Original JSON (pass-through) or modified JSON with validation warnings
+
+set -euo pipefail
+
+# Read JSON input
+INPUT=$(cat)
+
+# Extract tool name
+TOOL_NAME=$(echo "$INPUT" | jq -r '.tool_name // empty')
+
+# Only validate certain tools that involve LLM context
+case "$TOOL_NAME" in
+    "Task"|"WebSearch"|"WebFetch")
+        # These tools might benefit from pre-validation
+        ;;
+    *)
+        # Pass through other tools unchanged
+        echo "$INPUT"
+        exit 0
+        ;;
+esac
+
+# Find terraphim-agent
+AGENT=""
+for path in \
+    "./target/release/terraphim-agent" \
+    "./target/debug/terraphim-agent" \
+    "$(which terraphim-agent 2>/dev/null || true)"; do
+    if [ -x "$path" ]; then
+        AGENT="$path"
+        break
+    fi
+done
+
+if [ -z "$AGENT" ]; then
+    # No agent found, pass through
+    echo "$INPUT"
+    exit 0
+fi
+
+# Extract prompt/query from tool input
+PROMPT=$(echo "$INPUT" | jq -r '.tool_input.prompt // .tool_input.query // .tool_input.description // empty')
+
+if [ -z "$PROMPT" ]; then
+    # No prompt to validate
+    echo "$INPUT"
+    exit 0
+fi
+
+# Validate connectivity (advisory mode - always pass through)
+VALIDATION=$("$AGENT" validate --connectivity --json "$PROMPT" 2>/dev/null || echo '{"connected":true}')
+CONNECTED=$(echo "$VALIDATION" | jq -r '.connected // true')
+
+if [ "$CONNECTED" = "false" ]; then
+    # Add validation warning to the input but still allow it
+    MATCHED=$(echo "$VALIDATION" | jq -r '.matched_terms | join(", ") // "none"')
+
+    # Log warning (visible in Claude Code logs)
+    echo "Pre-LLM validation warning: Input spans unrelated concepts" >&2
+    echo "Matched terms: $MATCHED" >&2
+fi
+
+# Always pass through (advisory mode)
+echo "$INPUT"

.claude/hooks/subagent-start.json

@@ -0,0 +1,14 @@
+{
+  "hooks": {
+    "SubagentStart": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "cat .docs/summary.md 2>/dev/null || echo 'Terraphim AI: Privacy-first AI assistant'"
+          }
+        ]
+      }
+    ]
+  }
+}

.dockerignore

@@ -0,0 +1,147 @@
+# Git and version control
+.git
+.gitignore
+.gitattributes
+
+# Documentation and examples
+*.md
+docs/
+examples/
+!README.md
+
+# CI/CD files (not needed in container)
+.github/
+.gitlab-ci.yml
+.travis.yml
+
+# Dependencies and caches
+node_modules/
+target/
+Cargo.lock
+
+# Development and test files
+tests/
+test_*.sh
+*_test.go
+*_test.py
+*_test.js
+
+# IDE and editor files
+.vscode/
+.idea/
+*.swp
+*.swo
+*~
+.DS_Store
+Thumbs.db
+
+# OS-specific files
+.DS_Store
+Thumbs.db
+
+# Temporary files
+*.tmp
+*.temp
+*.log
+*.pid
+
+# Build artifacts and outputs
+dist/
+build/
+out/
+*.tar.gz
+*.zip
+*.deb
+*.rpm
+
+# Secrets and configuration
+.env
+.env.*
+secrets/
+*.pem
+*.key
+*.crt
+
+# Large binary assets and media
+*.jpg
+*.jpeg
+*.png
+*.gif
+*.bmp
+*.tiff
+*.svg
+*.ico
+*.mp4
+*.avi
+*.mov
+*.mp3
+*.wav
+
+# Database files
+*.db
+*.sqlite
+*.sqlite3
+
+# Backup and cache directories
+backup/
+.cache/
+.cache-*/
+
+# Terraform and infrastructure
+*.tf
+*.tfstate
+.terraform/
+
+# Docker files (don't copy docker into docker)
+Dockerfile*
+docker-compose*.yml
+.dockerignore
+
+# Scripts not needed in container
+scripts/
+!scripts/install-dependencies.sh
+
+# Local development
+local/
+.local/
+*.local
+
+# Performance profiling
+*.prof
+*.pprof
+perf.data
+
+# Linter and formatter caches
+.cargo/
+.rustup/
+.node_repl_history
+
+# Rust-specific
+rust-toolchain
+**/*.rs.bk
+Cargo.lock
+
+# WASM specific
+wasm-pack.log
+pkg/
+*.wasm.map
+
+# Tauri specific
+src-tauri/target/
+src-tauri/Cargo.lock
+
+# Desktop frontend (handled separately)
+desktop/src/
+desktop/public/
+!desktop/dist/
+desktop/node_modules/
+desktop/.svelte-kit/
+desktop/package-lock.json
+desktop/yarn.lock
+
+# Exclude temporary directories from workflows
+.github/workflows/backup/
+
+# Keep essential rust configuration
+!rust-toolchain.toml
+!.github/rust-toolchain.toml