fix(openapi): hide antigravity/native-permission runtime hooks from the reference

The Claude, Codex, and Cursor elicitation/permission-request hooks are
internal harness callback webhooks and already carry
`include_in_schema=False`, but two newer siblings —
`antigravity-elicitation-request` and `native-permission-request` —
were added without the flag, so they leaked into the published OpenAPI
reference. Add `include_in_schema=False` to both, matching the existing
hidden hooks, and regenerate `openapi.json` (the only spec change is the
removal of those two paths). Drift test passes.

Co-authored-by: Isaac

.claude/skills/cli-setup-verify/SKILL.md

@@ -0,0 +1,210 @@
+---
+name: cli-setup-verify
+description: Verify the Omnigent CLI's setup/onboarding flow, terminal UI/UX, and critical user journeys in a completely isolated, reproducible loop. Drives the real `omnigent` binary through a PTY (pexpect) inside a throwaway OMNIGENT_CONFIG_HOME / OMNIGENT_DATA_DIR sandbox that never touches the user's real ~/.omnigent, captures ANSI-stripped frames for UX inspection, and proves a change is verifiable via a before→fix→after baseline diff. Load when developing or reviewing a CLI setup/onboarding/REPL/picker change (omnigent/cli.py, omnigent/onboarding/*, omnigent/repl/*, scripts/install_oss.sh), reproducing a cold-start/first-run UX bug, or confirming a fix actually lands. Several agents can run it concurrently on separate worktrees.
+---
+
+# Verifying the Omnigent CLI setup & UX in a closed loop
+
+The Omnigent CLI's first impression is: `curl | sh` → run `omnigent` → pick a
+model credential → start a session. This skill lets an agent **enter that flow,
+examine the UI/UX, and prove whether a change is verifiable** — without a
+browser, without real credentials, and **without ever touching the developer's
+real `~/.omnigent`**.
+
+The engine is `verify_cli.py` (next to this file). It drives the real
+`omnigent` binary through a pseudo-terminal (`pexpect`) inside a throwaway
+sandbox, captures what renders, runs assertions, and prints one machine-readable
+`SUMMARY {json}` line.
+
+> **The whole point is a verifiable loop**, not a one-shot check:
+> 1. Run a scenario on the **unfixed** code → baseline (`--label before`).
+> 2. Make the change.
+> 3. Run the **same** scenario → `--label after`.
+> 4. Diff the two `SUMMARY` lines. A fix is "verifiable" only if a concrete
+>    check or note **flips** between the two runs. If it doesn't flip, you
+>    can't prove the fix did anything — go back to step 2.
+
+## Why this is safe (read first)
+
+The real `~/.omnigent` here can be **many GB** (chat DB, runner logs, native
+harness state). The sandbox isolates every write three ways:
+
+- **`HOME` is redirected into the sandbox by default.** This is the load-bearing
+  one. `OMNIGENT_CONFIG_HOME` / `OMNIGENT_DATA_DIR` (`omnigent/cli.py`
+  `_CONFIG_HOME_ENV_VAR` / `_DATA_DIR_ENV_VAR`) redirect config + data — but the
+  CLI's **diagnostics logger ignores them**: it writes a per-invocation
+  `cli-*.log` under `state_dir()`, hardcoded to `Path.home()/.omnigent/logs`
+  (`omnigent_ui_sdk/terminal/_config.py`). So only redirecting `HOME` keeps a
+  non-help command (`config list`, the setup PTY spawns, `server stop`) from
+  writing into the real home. The driver does this for you.
+- `--strip-path` reduces `PATH` so `node`/`tmux`/`claude`/`codex` read as "not
+  installed" → the true fresh-machine cold start.
+- Ambient model keys (`ANTHROPIC_API_KEY`, …) are stripped from the child env
+  unless you pass `--keep-env-creds`.
+
+**`--inherit-home` opts out** of `HOME` isolation — use it only to reach a real
+credentialed REPL via ambient `~/.claude` / `~/.databrickscfg` auth. It is
+**less safe**: a non-help command then writes `cli-*.log` into the real
+`~/.omnigent/logs`.
+
+Every run **fingerprints the real `~/.omnigent` before and after** (stat-only,
+no content reads): the top-level config files **and** the set of
+`logs/cli-*.log` diagnostic files. A new config file/mtime *or* a new `cli-*.log`
+basename trips `real_config_untouched: false`. With the default isolation that
+never happens; under `--inherit-home` it correctly does — which is exactly the
+violation the guard is meant to catch. If that check is ever `false`, stop and
+investigate. Run `check-isolation` first to confirm the loop is safe on your
+machine.
+
+## Prerequisites
+
+- You're in the **worktree whose code you want to test** (each parallel agent
+  on its own worktree). The driver runs `omnigent` from `--repo`'s checkout.
+- A Python with `pexpect` — the project's `.venv/bin/python` bundles it
+  (`pexpect>=4.9` in `pyproject.toml`). Run the driver with that interpreter.
+- An `omnigent` binary: the driver auto-finds `<repo>/.venv/bin/omnigent`, or
+  pass `--omnigent <path>`.
+- The setup / picker / help / cold-start scenarios need **no credentials and no
+  harness**. Only `repl-commands` needs a working harness + credential: pass
+  `--inherit-home` (ambient `~/.claude` auth) and/or `--keep-env-creds` (env API
+  key) with `--agent`. It reports `skipped`, never a false pass, when the prompt
+  isn't reachable.
+
+## Quick start
+
+```bash
+REPO=/path/to/your/worktree
+PY=$REPO/.venv/bin/python
+DRV=$REPO/.claude/skills/cli-setup-verify/verify_cli.py
+
+# 0. Prove the sandbox is safe on this machine (do this once).
+#    HOME is isolated by default — no flag needed.
+$PY $DRV --scenario check-isolation --repo "$REPO"
+
+# 1. See exactly what a brand-new user sees on a fresh machine.
+$PY $DRV --scenario cold-start --strip-path --keep-sandbox --repo "$REPO"
+#    → reads the printed `artifacts` path, then `cat <that>/cold_start.txt`
+
+# 2. Lint the top-level help (and any subcommand's).
+$PY $DRV --scenario help-snapshot --repo "$REPO"
+$PY $DRV --scenario help-snapshot --subcommand server --repo "$REPO"
+```
+
+Each run prints `SUMMARY {…}` and exits non-zero if any check failed (a
+`skipped` scenario exits 0). Pipe to `… | grep '^SUMMARY' | python -m json.tool`
+to read it.
+
+## Scenario catalog
+
+| Scenario | What it drives | Key checks / notes | Maps to findings |
+|---|---|---|---|
+| `check-isolation` | `omnigent config list` in the sandbox (no PTY) | `config_list_ran`, `sandbox_config_home_used`, `real_config_untouched` | safety gate for everything |
+| `cold-start` | `omnigent setup` via PTY on a simulated fresh machine | `onboarding_rendered`, `harness_menu_present`; note `guided_default_affordance` | cold-start dead-end; missing "recommended start here" |
+| `setup-snapshot` | `omnigent setup`, optional `--nav-down N` arrow steps | `menu_rendered`; saves a frame per step | picker markers/footer/alignment; narrow-terminal at 80×24 |
+| `help-snapshot` | `omnigent [--subcommand] --help` (no PTY) | `help_rendered`, `no_param_leak`, `no_update_dup`; note `top_level_command_count` | `:param` leak, duplicate `update`/`upgrade`, command sprawl |
+| `repl-commands` | `omnigent run <agent>` REPL, sends `/help` + `/quit` | `help_lists_commands`; note `quit_advertised` | REPL discoverability (`/help`, `/quit`) |
+
+`--list-scenarios` prints them too. Captured frames land in the printed
+`artifacts` dir as both `<name>.txt` (ANSI-stripped, for reading/asserting) and
+`<name>.ansi.txt` (raw, to see real colors with `less -R`).
+
+## The verifiable loop — a worked example
+
+Finding: *"`server --help` leaks Sphinx `:param`/`:returns` into user help."*
+
+```bash
+# BEFORE the fix (on the unfixed code):
+$PY $DRV --scenario help-snapshot --subcommand server --label before --repo "$REPO"
+#   → "no_param_leak": {"ok": false, ...}      ← bug reproduced (the baseline)
+
+# ... make the change (move :param docs into # comments) ...
+
+# AFTER the fix:
+$PY $DRV --scenario help-snapshot --subcommand server --label after --repo "$REPO"
+#   → "no_param_leak": {"ok": true, "detail": "clean"}   ← flipped → fix is verifiable
+```
+
+The same shape proves the `update`/`upgrade` duplicate (`no_update_dup`), the
+cold-start dead-end (`guided_default_affordance` note flips `absent`→`present`),
+or REPL `/quit` discoverability (`quit_advertised` note flips `no`→`yes`). **If
+the check/note doesn't flip, the fix isn't proven** — that is the signal to keep
+working, and it's exactly the judgment the loop exists to force.
+
+If a finding has no machine check yet, add one (see "Adding a scenario") so the
+fix becomes provable instead of asserted.
+
+## Examining UI/UX deliberately
+
+- **Narrow terminal is the default.** The driver uses **80×24** — the size a
+  new user's window actually is, and where banner overflow and picker
+  redraw-past-the-bottom bugs appear. Re-run with `--cols 120 --rows 40` to
+  compare the roomy layout; diff the two frames.
+- **Read the frame, don't just trust the check.** `cat <artifacts>/cold_start.txt`
+  shows the literal screen — the all-`✗` menu, the footer hint (`Esc back` at
+  the root), the marker (`❯`), alignment of the status gutter. The frame *is*
+  the UX evidence.
+- **Compare pickers for consistency.** `setup-snapshot --nav-down 3` captures
+  the harness menu as you move; eyeball marker/footer/highlight drift against
+  the theme and resume pickers (different engines render differently).
+
+## Covering all critical user journeys
+
+This skill owns the **setup / onboarding / first-run / TUI** journeys. The repo
+already has complementary CUJ coverage — use both:
+
+- **Live setup/UX journeys → this skill's scenarios** (cold-start, setup,
+  pickers, help, REPL discoverability).
+- **Deeper end-to-end journeys → `tests/e2e/test_journey_*.py`** (first session
+  to code, resume/disconnect, fork/explore, file upload, collaboration, …).
+  Run a slice with the project's gated runner, e.g.
+  `uv run --frozen --extra dev python -m pytest tests/e2e/test_journey_first_session_to_code.py -q`.
+- **Reusable PTY helpers** live in `tests/e2e/omnigent/_pexpect_harness.py`
+  (`spawn_omnigent_run`, `wait_for_ready`, `submit_prompt`, `await_turn_complete`,
+  `clean_exit`) and the snapshot comparator in `tests/e2e/omnigent/_snapshot.py`
+  — prefer extending those over re-inventing.
+
+To drive a surface this skill doesn't script yet, spawn it by hand with the
+sandbox env and the keys the driver exports (`KEY_UP`/`KEY_DOWN`/`KEY_ENTER`/
+`KEY_ESC`), then `drain()` and `save_frame()` the result.
+
+## Teardown — non-negotiable
+
+- The driver force-kills the PTY child and its descendants, and runs
+  `omnigent server stop` against the sandbox to reap any spawned background
+  server. After a run, confirm nothing leaked:
+  `pgrep -af "omnigent.*(server|runner|host._daemon)"` — anything bound to your
+  sandbox's data dir is yours to kill.
+- The sandbox temp dir is deleted unless `--keep-sandbox`. If you keep one for
+  inspection, `rm -rf` it when done.
+- Always drive the CLI through the driver (which redirects `HOME` + the
+  config/data knobs), never a bare `omnigent setup` — that would write to the
+  real `~/.omnigent`. If you pass `--inherit-home`, expect `cli-*.log` writes to
+  the real `~/.omnigent/logs` and a `real_config_untouched: false` — that's the
+  guard working, not a bug.
+
+## Honesty
+
+If you can't reach the surface under test (no harness, no credential, headless
+limit), the scenario must report `skipped` — **do not claim a CUJ passed**. The
+strongest evidence for a fix is a reproduced baseline (`before`) plus the flipped
+`after`; report both `SUMMARY` lines, not a summary of a summary.
+
+## Adding a scenario
+
+Write `scenario_<name>(args, sandbox, result)` in `verify_cli.py`: drive the CLI
+(reuse `pexpect.spawn(... env=sandbox.env, dimensions=(args.rows, args.cols))`,
+`drain()`, `save_frame()`, the `KEY_*` constants), record findings with
+`result.add(name, ok, detail)` (fails the run) or `result.notes.append(...)`
+(informational, for before/after flips), register it in `SCENARIOS`, and add a
+row to the catalog above. Keep one assertion per real, observable behavior so a
+fix is provable as a single check flip.
+
+## Code under test
+
+- First-run dispatch / no-arg routing: `omnigent/cli.py` (`run`, the first-run
+  plan, `_run_configure_harnesses_interactive`).
+- Onboarding: `omnigent/onboarding/*` (`setup.py`, `interactive.py`,
+  `configure_models.py`, `provider_selection.py`, `detected.py`).
+- TUI / REPL & pickers: `omnigent/repl/*` (`_repl.py`, `_theme_picker.py`,
+  `_resume_picker.py`), `omnigent/_terminal_picker_theme.py`.
+- Installer: `scripts/install_oss.sh`.

.claude/skills/cli-setup-verify/verify_cli.py

@@ -0,0 +1,715 @@
+#!/usr/bin/env python3
+"""Drive the Omnigent CLI through a PTY in a throwaway sandbox and verify it.
+
+This is the reusable engine behind the ``cli-setup-verify`` skill (see
+``SKILL.md`` next to this file for the playbook and CUJ catalog). One run:
+
+1. Builds an **isolated config/data sandbox** so nothing the CLI writes ever
+   lands in the real ``~/.omnigent`` — it sets the purpose-built
+   ``OMNIGENT_CONFIG_HOME`` / ``OMNIGENT_DATA_DIR`` knobs (``omnigent/cli.py``
+   ``_CONFIG_HOME_ENV_VAR`` / ``_DATA_DIR_ENV_VAR``), strips leaked model
+   credentials from the child env, and (optionally) points ``HOME`` and a
+   minimal ``PATH`` at the sandbox to simulate a brand-new machine.
+2. Drives the real ``omnigent`` binary through ``pexpect`` (a real PTY with a
+   sane ``TERM`` so prompt-toolkit / the raw-termios pickers actually render).
+3. Captures ANSI-stripped frames into an artifacts dir for UX inspection.
+4. Runs the named scenario's assertions and prints a single machine-readable
+   ``SUMMARY {json}`` line; exits non-zero on failure.
+5. Proves it left the real ``~/.omnigent`` byte-for-byte unchanged.
+
+The point is a **verifiable loop**: run a scenario on the *unfixed* code
+(``--label before``) to capture the baseline, make the change, run the same
+scenario again (``--label after``), and diff the two SUMMARY lines. If you
+cannot reach the surface under test (missing harness, no credential), the
+scenario reports ``skipped`` — never a false ``pass``.
+"""
+
+from __future__ import annotations
+
+import argparse
+import contextlib
+import json
+import os
+import re
+import shutil
+import signal
+import subprocess
+import sys
+import time
+from collections.abc import Sequence
+from dataclasses import dataclass, field
+from pathlib import Path
+from tempfile import mkdtemp
+
+try:
+    import pexpect
+except ImportError:  # pragma: no cover - guidance, not logic
+    sys.stderr.write(
+        "verify_cli.py needs `pexpect`. Run it with the omnigent project's "
+        "venv python (it bundles pexpect), e.g.\n"
+        "  <repo>/.venv/bin/python verify_cli.py ...\n"
+    )
+    raise
+
+# --- PTY constants (mirrors tests/e2e/omnigent/_pexpect_harness.py) ---------
+
+# prompt-toolkit refuses to draw on TERM=dumb; this is what the REPL tests use.
+TERM = "xterm-256color"
+# 80x24 is the default new-user window — exactly where narrow-terminal bugs
+# (banner overflow, picker redraw past the bottom row) show up. Override with
+# --cols/--rows to also exercise the roomy 120x40 layout.
+DEFAULT_COLS = 80
+DEFAULT_ROWS = 24
+
+ANSI_RE = re.compile(r"\x1b\[[0-9;?]*[a-zA-Z]")
+
+# Stable onboarding anchors (omnigent/cli.py:520, :10064, :10300).
+ANCHOR_SEARCHING = "Searching for existing credentials"
+ANCHOR_CONFIGURE = "Configure harnesses"
+ANCHOR_NO_HARNESS = "Found no harnesses configured"
+# REPL readiness signals (the toolbar state line, with the input prompt as a
+# fallback for PTY combos that suppress the bottom toolbar).
+REPL_READY = [r"state: sleeping", r"❯ "]
+
+# Keys for driving the raw-termios + prompt-toolkit pickers.
+KEY_UP = "\x1b[A"
+KEY_DOWN = "\x1b[B"
+KEY_ENTER = "\r"
+KEY_ESC = "\x1b"
+
+# Model-provider credentials we strip from the child env so a "cold" sandbox
+# is genuinely credential-free (the CLI auto-adopts ambient keys otherwise).
+LEAKED_CRED_VARS = (
+    "ANTHROPIC_API_KEY",
+    "ANTHROPIC_AUTH_TOKEN",
+    "OPENAI_API_KEY",
+    "CLAUDE_API_KEY",
+    "CLAUDE_CODE_OAUTH_TOKEN",
+    "GEMINI_API_KEY",
+    "GOOGLE_API_KEY",
+    "CURSOR_API_KEY",
+    "GH_TOKEN",
+    "GITHUB_TOKEN",
+    "DATABRICKS_TOKEN",
+    "DATABRICKS_HOST",
+    "DATABRICKS_CONFIG_PROFILE",
+)
+
+
+def strip_ansi(text: str) -> str:
+    """Remove ANSI control sequences so frames can be asserted as plain text."""
+    return ANSI_RE.sub("", text)
+
+
+# --- sandbox ----------------------------------------------------------------
+
+
+@dataclass
+class Sandbox:
+    """A throwaway config/data/home for one verification run.
+
+    :param root: Temp directory holding ``config/``, ``data/`` and (unless
+        ``--inherit-home``) ``home/``. Removed on cleanup unless ``--keep-sandbox``.
+    :param env: The child-process environment with the isolation knobs set.
+    :param home_isolated: Whether ``HOME`` was redirected into the sandbox.
+    """
+
+    root: Path
+    env: dict[str, str]
+    home_isolated: bool
+
+
+def build_sandbox(
+    *,
+    keep_env_creds: bool,
+    inherit_home: bool,
+    strip_path: bool,
+    omnigent_bin: Path,
+) -> Sandbox:
+    """Create an isolated sandbox env that cannot touch the real ``~/.omnigent``.
+
+    ``HOME`` is redirected into the sandbox **by default**. This is load-bearing,
+    not cosmetic: the CLI's diagnostics logger writes a per-invocation
+    ``cli-*.log`` under ``state_dir()`` which is hardcoded to ``Path.home() /
+    ".omnigent"`` (``omnigent_ui_sdk/terminal/_config.py``) and ignores
+    ``OMNIGENT_CONFIG_HOME`` / ``OMNIGENT_DATA_DIR``. So redirecting ``HOME`` is
+    the *only* thing that keeps non-help commands (``config list``, the setup
+    PTY spawns, ``server stop`` teardown) from writing into the real home.
+
+    :param keep_env_creds: Keep ambient model keys (e.g. ``ANTHROPIC_API_KEY``)
+        in the child env. Default False → a genuinely cold, credential-free run.
+    :param inherit_home: Opt OUT of home isolation — use the real ``HOME`` (and
+        thus its ambient ``~/.claude`` / ``~/.databrickscfg`` auth). Needed to
+        reach a real credentialed REPL, but **relaxes the safety guarantee**:
+        non-help commands will then write ``cli-*.log`` into the real
+        ``~/.omnigent/logs`` (the broadened fingerprint catches this).
+    :param strip_path: Reduce ``PATH`` to just the omnigent binary's dir + an
+        empty dir, so node/npm/tmux/claude/codex read as "not installed" — i.e.
+        a brand-new machine.
+    :param omnigent_bin: Path to the ``omnigent`` console script being driven.
+    :returns: A :class:`Sandbox`.
+    """
+    root = Path(mkdtemp(prefix="omnigent-verify-"))
+    (root / "config").mkdir()
+    (root / "data").mkdir()
+
+    env = dict(os.environ)
+    if not keep_env_creds:
+        for var in LEAKED_CRED_VARS:
+            env.pop(var, None)
+
+    env["OMNIGENT_CONFIG_HOME"] = str(root / "config")
+    env["OMNIGENT_DATA_DIR"] = str(root / "data")
+    env["OMNIGENT_NO_UPDATE_CHECK"] = "1"  # keep the update nag out of frames
+    env["TERM"] = TERM
+    env["COLUMNS"] = str(DEFAULT_COLS)
+    env["LINES"] = str(DEFAULT_ROWS)
+
+    if not inherit_home:
+        home = root / "home"
+        home.mkdir()
+        env["HOME"] = str(home)
+
+    if strip_path:
+        empty = root / "emptybin"
+        empty.mkdir()
+        env["PATH"] = f"{omnigent_bin.parent}:{empty}"
+
+    return Sandbox(root=root, env=env, home_isolated=not inherit_home)
+
+
+def fingerprint_real_config() -> dict[str, str]:
+    """Fingerprint the real ``~/.omnigent`` so we can prove we never wrote to it.
+
+    Stat-only (size + mtime, no content reads). It captures two things, both
+    cheap:
+
+    * the top-level config files (``*.yaml`` / ``*.json`` / ``*.toml`` plus the
+      known names) — what onboarding writes; and
+    * the set of ``logs/cli-*.log`` diagnostic files — what *any* non-help CLI
+      invocation writes via the hardcoded ``Path.home()/.omnigent`` state dir.
+      A new ``cli-*.log`` basename after the run means we wrote into the real
+      home (the precise violation that slips through ``OMNIGENT_CONFIG_HOME`` /
+      ``OMNIGENT_DATA_DIR``). With home isolation on (the default) none appear;
+      under ``--inherit-home`` they do — and this is what trips the guard.
+
+    It deliberately does **not** read the multi-GB ``logs/*.log`` bodies,
+    ``db-backups/`` or native-state dirs (reading them would hang, and other
+    running omnigent daemons churn them → false alarms). The single ``logs/``
+    glob is bounded by the diagnostics log cap.
+
+    :returns: Mapping of relative path → ``"<size>:<mtime_ns>"`` (config files)
+        or ``"<mtime_ns>"`` (cli logs). Empty if the directory does not exist.
+    """
+    base = Path.home() / ".omnigent"
+    out: dict[str, str] = {}
+    if not base.exists():
+        return out
+    candidates: set[Path] = set()
+    for pattern in ("*.yaml", "*.yml", "*.json", "*.toml"):
+        candidates.update(base.glob(pattern))
+    for name in ("config.yaml", "secrets.json", "auth_tokens.json", "providers.yaml"):
+        candidates.add(base / name)
+    for p in sorted(candidates):
+        if p.is_file():
+            st = p.stat()
+            out[p.name] = f"{st.st_size}:{st.st_mtime_ns}"
+    logs = base / "logs"
+    if logs.is_dir():
+        for p in sorted(logs.glob("cli-*.log")):
+            with contextlib.suppress(OSError):
+                out[f"logs/{p.name}"] = str(p.stat().st_mtime_ns)
+    return out
+
+
+# --- result model -----------------------------------------------------------
+
+
+@dataclass
+class Check:
+    name: str
+    ok: bool
+    detail: str = ""
+
+
+@dataclass
+class Result:
+    scenario: str
+    label: str
+    status: str = "pass"  # pass | fail | skipped
+    checks: list[Check] = field(default_factory=list)
+    notes: list[str] = field(default_factory=list)
+    artifacts: list[str] = field(default_factory=list)
+
+    def add(self, name: str, ok: bool, detail: str = "") -> None:
+        self.checks.append(Check(name, ok, detail))
+        if not ok and self.status == "pass":
+            self.status = "fail"
+
+    def skip(self, reason: str) -> None:
+        self.status = "skipped"
+        self.notes.append(reason)
+
+    def to_dict(self) -> dict[str, object]:
+        return {
+            "scenario": self.scenario,
+            "label": self.label,
+            "status": self.status,
+            "checks": [{"name": c.name, "ok": c.ok, "detail": c.detail} for c in self.checks],
+            "notes": self.notes,
+            "artifacts": self.artifacts,
+        }
+
+
+# --- frame capture ----------------------------------------------------------
+
+
+def drain(child: pexpect.spawn, *, seconds: float) -> str:
+    """Read everything the child renders for ``seconds`` and return it raw.
+
+    Used to capture a settled screen (a menu, a help body) without depending on
+    a specific completion marker.
+    """
+    buf: list[str] = []
+    deadline = time.time() + seconds
+    while time.time() < deadline:
+        try:
+            chunk = child.read_nonblocking(size=4096, timeout=0.3)
+        except pexpect.TIMEOUT:
+            continue
+        except pexpect.EOF:
+            break
+        if chunk:
+            buf.append(chunk)
+    return "".join(buf)
+
+
+def save_frame(result: Result, artifacts: Path, name: str, raw: str) -> None:
+    """Persist a raw + ANSI-stripped frame and register it on the result."""
+    artifacts.mkdir(parents=True, exist_ok=True)
+    stripped = strip_ansi(raw)
+    (artifacts / f"{name}.ansi.txt").write_text(raw, encoding="utf-8")
+    (artifacts / f"{name}.txt").write_text(stripped, encoding="utf-8")
+    result.artifacts.append(str(artifacts / f"{name}.txt"))
+
+
+# --- scenarios --------------------------------------------------------------
+
+
+def scenario_check_isolation(args, sandbox: Sandbox, result: Result) -> None:
+    """Smoke-test the sandbox: a read-only CLI call must not touch real config.
+
+    Runs ``omnigent config list`` inside the sandbox (no PTY needed) and
+    asserts (a) it executed, (b) the sandbox config home is now used, (c) the
+    real ``~/.omnigent`` fingerprint is unchanged. This is the first thing to
+    run to trust every other scenario.
+    """
+    proc = subprocess.run(
+        [str(args.omnigent), "config", "list"],
+        env=sandbox.env,
+        cwd=str(args.repo),
+        capture_output=True,
+        text=True,
+        timeout=args.timeout,
+    )
+    save_frame(result, Path(args.artifacts), "config_list", proc.stdout + proc.stderr)
+    result.add("config_list_ran", proc.returncode == 0, f"exit={proc.returncode}")
+    # The sandbox config home should exist; the real one is checked globally in
+    # main() via the before/after fingerprint.
+    result.add(
+        "sandbox_config_home_used",
+        Path(sandbox.env["OMNIGENT_CONFIG_HOME"]).exists(),
+        sandbox.env["OMNIGENT_CONFIG_HOME"],
+    )
+
+
+def scenario_cold_start(args, sandbox: Sandbox, result: Result) -> None:
+    """Spawn the first-time setup surface a brand-new user sees and capture it.
+
+    Home isolation is on by default (so this is already a fresh machine for
+    credentials); add ``--strip-path`` to also make node/tmux/claude read as
+    not installed. Asserts the onboarding surface renders (the credential search
+    banner or the ``Configure harnesses`` menu), saves the frame for UX review,
+    then aborts cleanly.
+    """
+    child = pexpect.spawn(
+        str(args.omnigent),
+        ["setup"],
+        env=sandbox.env,
+        cwd=str(args.repo),
+        encoding="utf-8",
+        timeout=args.timeout,
+        dimensions=(args.rows, args.cols),
+    )
+    try:
+        idx = child.expect(
+            [ANCHOR_CONFIGURE, ANCHOR_SEARCHING, ANCHOR_NO_HARNESS, pexpect.EOF],
+            timeout=args.timeout,
+        )
+    except pexpect.TIMEOUT:
+        save_frame(result, Path(args.artifacts), "cold_start_timeout", child.before or "")
+        result.add("onboarding_rendered", False, "no onboarding anchor within timeout")
+        _kill_tree(child)
+        return
+
+    pre = child.before or ""
+    # Let the menu settle so the captured frame holds the whole harness list.
+    settle = drain(child, seconds=2.0)
+    frame = pre + (child.after or "") + settle
+    save_frame(result, Path(args.artifacts), "cold_start", frame)
+
+    result.add("onboarding_rendered", idx in (0, 1, 2), f"anchor_index={idx}")
+    stripped = strip_ansi(frame)
+    menu_present = ANCHOR_CONFIGURE in stripped
+    result.add(
+        "harness_menu_present",
+        menu_present,
+        "'Configure harnesses' title shown" if menu_present else "menu title missing",
+    )
+    # Informational UX probe (does NOT fail the run): is there any guided
+    # "recommended / start here" affordance, or just a wall of options? This is
+    # the cold-start dead-end finding — a fix should flip this note.
+    has_recommendation = bool(
+        re.search(r"recommend|start here|new here|get started", stripped, re.I)
+    )
+    result.notes.append(
+        f"guided_default_affordance={'present' if has_recommendation else 'absent'}"
+    )
+    _abort_picker(child)
+    _kill_tree(child)
+
+
+def scenario_setup_snapshot(args, sandbox: Sandbox, result: Result) -> None:
+    """Capture the setup menu, then optionally arrow-navigate and snapshot each
+    frame, for picker UX review (markers, footer hints, alignment, width).
+
+    Use ``--nav-down N`` to step down N rows capturing a frame each time.
+    """
+    child = pexpect.spawn(
+        str(args.omnigent),
+        ["setup"],
+        env=sandbox.env,
+        cwd=str(args.repo),
+        encoding="utf-8",
+        timeout=args.timeout,
+        dimensions=(args.rows, args.cols),
+    )
+    try:
+        child.expect([ANCHOR_CONFIGURE, ANCHOR_SEARCHING], timeout=args.timeout)
+    except pexpect.TIMEOUT:
+        result.add("menu_rendered", False, "setup menu did not render")
+        _kill_tree(child)
+        return
+    frame = (child.before or "") + (child.after or "") + drain(child, seconds=1.5)
+    save_frame(result, Path(args.artifacts), "setup_menu_0", frame)
+    result.add("menu_rendered", ANCHOR_CONFIGURE in strip_ansi(frame))
+
+    for i in range(1, args.nav_down + 1):
+        child.send(KEY_DOWN)
+        frame = drain(child, seconds=1.0)
+        save_frame(result, Path(args.artifacts), f"setup_menu_{i}", frame)
+
+    _abort_picker(child)
+    _kill_tree(child)
+
+
+def scenario_help_snapshot(args, sandbox: Sandbox, result: Result) -> None:
+    """Render ``omnigent [SUBCOMMAND] --help`` and lint it for known UX issues.
+
+    No PTY needed. The lint checks map directly to top-20 findings, so a fix is
+    verifiable as a before/after flip:
+      * ``no_param_leak``    — no ``:param``/``:returns`` Sphinx dump (finding X3)
+      * ``no_update_dup``    — top-level help doesn't list both update & upgrade (X2)
+    Use ``--subcommand server`` (etc.) to lint a specific command's help.
+    """
+    cmd = [str(args.omnigent)]
+    if args.subcommand:
+        cmd.append(args.subcommand)
+    cmd.append("--help")
+    proc = subprocess.run(
+        cmd,
+        env={**sandbox.env, "COLUMNS": str(args.cols)},
+        cwd=str(args.repo),
+        capture_output=True,
+        text=True,
+        timeout=args.timeout,
+    )
+    out = proc.stdout + proc.stderr
+    label = args.subcommand or "root"
+    save_frame(result, Path(args.artifacts), f"help_{label}", out)
+    result.add(
+        "help_rendered",
+        proc.returncode == 0 and "Usage:" in out,
+        f"exit={proc.returncode}",
+    )
+    param_leak = ":param" in out or ":returns:" in out
+    result.add(
+        "no_param_leak",
+        not param_leak,
+        "Sphinx :param/:returns leaked into --help" if param_leak else "clean",
+    )
+    if not args.subcommand:
+        both = "\n  update" in out and "\n  upgrade" in out
+        result.add(
+            "no_update_dup",
+            not both,
+            "both `update` and `upgrade` listed (duplicate)"
+            if both
+            else "single canonical upgrade",
+        )
+        cmd_count = len(re.findall(r"^  [a-z][\w-]+\s{2,}", out, re.M))
+        result.notes.append(f"top_level_command_count={cmd_count}")
+
+
+def scenario_repl_commands(args, sandbox: Sandbox, result: Result) -> None:
+    """Boot the REPL and check command discoverability.
+
+    Asserts the ``/help`` command list renders; separately records whether
+    ``/quit`` is advertised (the ``quit_advertised`` note — finding U2).
+
+    Requires a working harness + credential to reach the prompt: pass
+    ``--inherit-home`` (for ambient ``~/.claude`` auth) and/or
+    ``--keep-env-creds`` (for an env API key) plus an ``--agent``/``--harness``.
+    If the prompt is not reachable the scenario reports ``skipped`` (never a
+    false pass).
+    """
+    if not args.agent:
+        result.skip("repl-commands needs --agent <dir/yaml> (and a working harness/credential)")
+        return
+    spawn_args = ["run", args.agent, "--harness", args.harness]
+    if args.model:
+        spawn_args += ["--model", args.model]
+    child = pexpect.spawn(
+        str(args.omnigent),
+        spawn_args,
+        env=sandbox.env,
+        cwd=str(args.repo),
+        encoding="utf-8",
+        timeout=args.timeout,
+        dimensions=(args.rows, args.cols),
+    )
+    try:
+        child.expect(REPL_READY, timeout=args.timeout)
+    except (pexpect.TIMEOUT, pexpect.EOF):
+        save_frame(result, Path(args.artifacts), "repl_boot_fail", child.before or "")
+        result.skip("REPL prompt not reachable (missing harness/credential?) — see repl_boot_fail")
+        _kill_tree(child)
+        return
+    child.send("/help")
+    child.send(KEY_ENTER)
+    frame = drain(child, seconds=2.5)
+    save_frame(result, Path(args.artifacts), "repl_help", frame)
+    stripped = strip_ansi(frame)
+    # The /help command list rendered (the `/help` row is always present). Note
+    # `/quit` discoverability separately — finding U2 is that it is NOT
+    # advertised, so a fix flips quit_advertised no→yes.
+    result.add("help_lists_commands", "/help" in stripped, "/help output")
+    result.notes.append(
+        f"quit_advertised={'yes' if '/quit' in stripped else 'no'}"  # discoverability finding U2
+    )
+    child.send("/quit")
+    child.send(KEY_ENTER)
+    with contextlib.suppress(Exception):
+        child.expect(pexpect.EOF, timeout=10)
+    _kill_tree(child)
+
+
+SCENARIOS = {
+    "check-isolation": scenario_check_isolation,
+    "cold-start": scenario_cold_start,
+    "setup-snapshot": scenario_setup_snapshot,
+    "help-snapshot": scenario_help_snapshot,
+    "repl-commands": scenario_repl_commands,
+}
+
+
+# --- teardown helpers -------------------------------------------------------
+
+
+def _abort_picker(child: pexpect.spawn) -> None:
+    """Send the menu's abort gestures (q, then Esc) so it exits cleanly."""
+    with contextlib.suppress(Exception):
+        child.send("q")
+        time.sleep(0.2)
+        child.send(KEY_ESC)
+        time.sleep(0.2)
+
+
+def _descendant_pids(root_pid: int) -> list[int]:
+    """Collect the full descendant tree of ``root_pid`` via repeated ``pgrep -P``.
+
+    Walks children, grandchildren, etc. — a spawned server/runner can re-parent
+    its own children, so a single ``pgrep -P`` only reaches one level.
+    """
+    found: list[int] = []
+    frontier = [root_pid]
+    seen = {root_pid}
+    while frontier:
+        parent = frontier.pop()
+        with contextlib.suppress(Exception):
+            out = subprocess.run(
+                ["pgrep", "-P", str(parent)], capture_output=True, text=True
+            ).stdout
+            for tok in out.split():
+                with contextlib.suppress(ValueError):
+                    pid = int(tok)
+                    if pid not in seen:
+                        seen.add(pid)
+                        found.append(pid)
+                        frontier.append(pid)
+    return found
+
+
+def _kill_tree(child: pexpect.spawn) -> None:
+    """Force-kill the child and its whole descendant tree; never raise."""
+    pid = child.pid
+    # Snapshot descendants BEFORE close() — closing the PTY can reparent them to
+    # init, after which pgrep -P can no longer find them via the child.
+    descendants = _descendant_pids(pid) if pid else []
+    with contextlib.suppress(Exception):
+        child.close(force=True)
+    for dpid in descendants:
+        with contextlib.suppress(ProcessLookupError, PermissionError):
+            os.kill(dpid, signal.SIGKILL)
+
+
+def stop_sandbox_server(args, sandbox: Sandbox) -> None:
+    """Best-effort: stop any background server bound to the sandbox data dir."""
+    with contextlib.suppress(Exception):
+        subprocess.run(
+            [str(args.omnigent), "server", "stop"],
+            env=sandbox.env,
+            cwd=str(args.repo),
+            capture_output=True,
+            text=True,
+            timeout=30,
+        )
+
+
+# --- main -------------------------------------------------------------------
+
+
+def resolve_omnigent(repo: Path, explicit: str | None) -> Path:
+    """Find the ``omnigent`` console script to drive."""
+    if explicit:
+        return Path(explicit).resolve()
+    venv = repo / ".venv" / "bin" / "omnigent"
+    if venv.exists():
+        return venv.resolve()
+    found = shutil.which("omnigent")
+    if found:
+        return Path(found).resolve()
+    sys.exit("Could not find an `omnigent` binary; pass --omnigent <path>.")
+
+
+def parse_args(argv: Sequence[str]) -> argparse.Namespace:
+    p = argparse.ArgumentParser(
+        description=__doc__,
+        formatter_class=argparse.RawDescriptionHelpFormatter,
+    )
+    p.add_argument("--scenario", choices=sorted(SCENARIOS), help="Scenario to run.")
+    p.add_argument("--list-scenarios", action="store_true", help="List scenarios and exit.")
+    p.add_argument(
+        "--repo",
+        default=os.getcwd(),
+        type=lambda s: Path(s).resolve(),
+        help="Repo root (child cwd).",
+    )
+    p.add_argument(
+        "--omnigent",
+        help="Path to the omnigent binary (default: <repo>/.venv/bin/omnigent or PATH).",
+    )
+    p.add_argument(
+        "--label",
+        default="run",
+        help="Label for this run, e.g. before/after, in the SUMMARY line.",
+    )
+    p.add_argument("--artifacts", help="Dir for captured frames (default: <sandbox>/artifacts).")
+    p.add_argument("--cols", type=int, default=DEFAULT_COLS, help="PTY columns (default 80).")
+    p.add_argument("--rows", type=int, default=DEFAULT_ROWS, help="PTY rows (default 24).")
+    p.add_argument("--timeout", type=float, default=60.0, help="Per-expect timeout seconds.")
+    p.add_argument(
+        "--inherit-home",
+        action="store_true",
+        help="Opt out of HOME isolation (use real HOME + ambient auth). "
+        "Less safe: non-help commands then write cli-*.log into the real "
+        "~/.omnigent/logs. Use only to reach a real credentialed REPL.",
+    )
+    p.add_argument(
+        "--strip-path",
+        action="store_true",
+        help="Minimal PATH so node/tmux/claude read as not installed.",
+    )
+    p.add_argument(
+        "--keep-env-creds",
+        action="store_true",
+        help="Keep ambient model API keys in the child env.",
+    )
+    p.add_argument(
+        "--keep-sandbox",
+        action="store_true",
+        help="Do not delete the sandbox (for inspection).",
+    )
+    p.add_argument(
+        "--nav-down",
+        type=int,
+        default=0,
+        help="(setup-snapshot) arrow-down N times, capturing each frame.",
+    )
+    p.add_argument(
+        "--subcommand",
+        help="(help-snapshot) subcommand to lint, e.g. server. Omit for top-level.",
+    )
+    p.add_argument("--agent", help="(repl-commands) agent dir/yaml to run.")
+    p.add_argument("--harness", default="claude-sdk", help="(repl-commands) harness.")
+    p.add_argument("--model", help="(repl-commands) model override.")
+    return p.parse_args(argv)
+
+
+def main(argv: Sequence[str]) -> int:
+    args = parse_args(argv)
+    if args.list_scenarios:
+        for name, fn in sorted(SCENARIOS.items()):
+            print(f"{name:16} {(fn.__doc__ or '').strip().splitlines()[0]}")
+        return 0
+    if not args.scenario:
+        sys.exit("Pass --scenario <name> (or --list-scenarios).")
+
+    args.omnigent = resolve_omnigent(args.repo, args.omnigent)
+    sandbox = build_sandbox(
+        keep_env_creds=args.keep_env_creds,
+        inherit_home=args.inherit_home,
+        strip_path=args.strip_path,
+        omnigent_bin=args.omnigent,
+    )
+    if not args.artifacts:
+        args.artifacts = str(sandbox.root / "artifacts")
+
+    before = fingerprint_real_config()
+    result = Result(scenario=args.scenario, label=args.label)
+    try:
+        SCENARIOS[args.scenario](args, sandbox, result)
+    except Exception as exc:  # noqa: BLE001 - report any scenario error as a failed check, never crash the loop
+        result.add("scenario_exception", False, f"{type(exc).__name__}: {exc}")
+    finally:
+        stop_sandbox_server(args, sandbox)
+
+    after = fingerprint_real_config()
+    untouched = before == after
+    result.add(
+        "real_config_untouched",
+        untouched,
+        "~/.omnigent unchanged" if untouched else "REAL CONFIG MUTATED — investigate",
+    )
+
+    if not args.keep_sandbox:
+        shutil.rmtree(sandbox.root, ignore_errors=True)
+    else:
+        result.notes.append(f"sandbox_kept={sandbox.root}")
+
+    print("SUMMARY " + json.dumps(result.to_dict()))
+    return 0 if result.status in ("pass", "skipped") else 1
+
+
+if __name__ == "__main__":
+    raise SystemExit(main(sys.argv[1:]))

.claude/skills/copilot-sdk-e2e-dev/SKILL.md

@@ -0,0 +1,214 @@
+---
+name: copilot-sdk-e2e-dev
+description: Spin up a live local Omnigent server and exercise the GitHub Copilot SDK harness end-to-end — build copilot agents, run real turns, smoke-test, and bug-bash. Load when developing, testing, or debugging the copilot harness (omnigent/inner/copilot_executor.py, copilot_harness.py, omnigent/onboarding/copilot_auth.py) or its auth / model / tool-bridge behavior.
+---
+
+# Copilot SDK harness: end-to-end dev & testing
+
+The `copilot` harness drives the **GitHub Copilot SDK** (`github-copilot-sdk`,
+imported as `copilot`) — a persistent `CopilotClient` + `CopilotSession` per
+Omnigent conversation — and bridges Omnigent's `sys_*` tools into Copilot as SDK
+`Tool`s. The Python SDK **bundles the Copilot CLI binary it drives** as a backing
+server, so there is no separate `@github/copilot` install. This skill is the
+proven recipe for running it **for real** against a live local server — not just
+the unit tests.
+
+> The harness runs as a **local runner** from your current checkout, so
+> `omni run <bundle> --server <url>` exercises exactly the code you're on.
+
+## Prerequisites (check these first)
+
+1. **You're on the branch you want to test.** The copilot harness is an
+   optional extra — install it (without disturbing other extras) with
+   `uv sync --frozen --extra dev --extra copilot`. NB: a bare
+   `uv run --frozen --extra dev` re-syncs the venv and **prunes** the copilot
+   SDK; for live testing call `.venv/bin/omni` / `.venv/bin/python` directly and
+   avoid `uv run` mid-session.
+2. **The SDK is installed:**
+   `.venv/bin/python -c "import copilot; print(copilot.__file__)"`.
+3. **A GitHub token with Copilot access is configured.** Copilot needs a
+   fine-grained PAT with the "Copilot Requests" permission, or an OAuth token
+   from the GitHub CLI / Copilot CLI app (classic `ghp_` PATs are rejected).
+   Verify (booleans only — never print the token):
+   ```bash
+   .venv/bin/python -c "from omnigent.onboarding.copilot_auth import copilot_github_token_configured; import os; print('config:', copilot_github_token_configured(), 'env:', bool(os.environ.get('GH_TOKEN') or os.environ.get('COPILOT_GITHUB_TOKEN')))"
+   ```
+   If both are `False`, run `omni setup` and register a Copilot token, or
+   `export GH_TOKEN=$(gh auth token)` (when `gh` is logged into an account with
+   Copilot). Check the account's entitlement with
+   `gh api /copilot_internal/user` (look for `chat_enabled`/`cli_enabled`).
+4. **Network egress to GitHub's Copilot backend.** A turn that hangs or fails to
+   connect on a locked-down host is usually egress, not a harness bug.
+
+## Step 1 — start a local server
+
+```bash
+cd /path/to/omnigent
+.venv/bin/omni server --port 7788 --no-open    # foreground; or `omni server start` for detached
+curl -s http://127.0.0.1:7788/health           # {"status":"ok"}
+```
+
+Use the URL below as `$SERVER`.
+
+## Step 2 — build a copilot agent bundle
+
+A spec with `spec_version` **must be a directory containing `config.yaml`** —
+not a single `.yaml` file. Minimal copilot agent:
+
+```bash
+mkdir -p /tmp/copilot-dev
+cat > /tmp/copilot-dev/config.yaml <<'YAML'
+spec_version: 1
+name: copilot-dev
+description: Copilot SDK dev/test agent.
+executor:
+  type: omnigent
+  config:
+    harness: copilot
+    # model: gpt-5-mini      # optional; omit for Copilot auto-select
+prompt: |
+  You are a terse test agent. Answer in as few words as possible.
+YAML
+```
+
+For sub-agents, tools, guardrails/policies, copy the field shapes from
+`examples/polly/config.yaml` and `examples/debby/config.yaml`. (Declare policies
+under `guardrails.policies:` — a top-level `policies:` key is silently dropped on
+the `spec_version` + `config.yaml` path.)
+
+## Step 3 — run a turn (and smoke-test)
+
+```bash
+SERVER=http://127.0.0.1:7788
+timeout 280 .venv/bin/omni run /tmp/copilot-dev \
+  -p "Reply with exactly the single word: PONG" \
+  --server "$SERVER" 2>&1
+```
+
+A healthy run prints connection lines then the reply (`PONG`). If that works,
+the full stack is good: token, egress, bundled CLI, harness.
+
+- **Shell / file tools:** add `--tools coding`.
+- **Specific model:** add `--model gpt-5-mini` (or `claude-haiku-4.5`, `auto`).
+
+## Targeted scenarios
+
+| Goal | How |
+|------|-----|
+| Native tools (shell/edit/read) | `--tools coding`, prompt to create→read→edit a file; confirm it actually touches disk |
+| Bridged `sys_*` / sub-agent dispatch | declare a sub-agent (harness `copilot` so auth is satisfied), prompt the parent to delegate — exercises the SDK `Tool` async-handler bridge into `_tool_executor` |
+| Model routing | run the same bundle with several `--model` values; an unknown id fails **loud**, a `databricks-*` id is dropped to auto with a warning |
+| LLM-phase policy | add a guardrail that denies a keyword; confirm `PHASE_LLM_REQUEST`/`PHASE_LLM_RESPONSE` blocks it |
+| Concurrency / leaks | fire several `omni run … &` at once; then `pgrep -af "copilot/bin/copilot"` to check for orphaned bundled-CLI subprocesses |
+
+## Running polly (or any orchestrator) on a copilot brain
+
+The copilot harness can serve as an **async orchestrator** brain (polly / debby),
+not just a standalone agent — it dispatches to sub-agents via the bridged
+`sys_*` tools and synthesizes their results. Two ways to exercise it:
+
+**1. Committed regression guard (brain smoke).**
+`tests/e2e/test_polly_copilot_e2e.py` boots a local server from your checkout and
+runs `examples/polly` with `--harness copilot --model auto`, asserting the brain
+boots and replies. It is **skipped** unless a Copilot token is configured (so CI
+without one skips it). Run it with:
+
+```bash
+.venv/bin/python -m pytest -o addopts="" tests/e2e/test_polly_copilot_e2e.py -v
+```
+
+**2. Full orchestration (dispatch → collect → synthesize).** Use the
+`polly-e2e-dev` driver (in the internal `agent-framework` clone) — it boots a
+local server, polls the AP API, auto-answers elicitations, and asserts the
+fan-out. Drive the brain on copilot with `--brain-harness copilot`, and **always
+pass a Copilot-catalog `--brain-model`** (`auto`, `claude-haiku-4.5`,
+`gpt-5-mini`): the driver's default `--brain-model` is a Claude id that Copilot
+(no Databricks gateway) can't route. From the agent-framework clone:
+
+```bash
+.venv/bin/python .claude/skills/polly-e2e-dev/polly_driver.py \
+  --local --code-dir <this-worktree> \
+  --cuj smoke --brain-harness copilot --brain-model auto      # brain only
+# --cuj fanout  …  and  --cuj review-pr --repo omnigent-ai/omnigent --pr <n>  …
+#   exercise real sub-agent dispatch (claude_code + codex) under a copilot brain.
+```
+
+All three CUJs (smoke / fanout / review-pr) pass on a copilot brain (verified
+live: fanout dispatched 8 sub-agents, 8/8 OK + a synthesis). Note `omni run -p`
+exits after the dispatch turn (the brain parks until woken), so a sub-agent's
+final answer lands server-side — read it over the AP API
+(`GET /v1/sessions/{id}/items`, child sessions), not just stdout.
+
+## Gotchas (these cost real time)
+
+1. **`config.yaml`'s `server:` defaults to a *remote* server.** Omitting
+   `--server` sends your turn to that remote deploy — which may be **stale** and
+   reject the copilot harness with `executor.config.harness: must be one of […]`.
+   **Always pass `--server http://127.0.0.1:<port>`.** (If a *local* server
+   rejects `copilot`, it's running stale code — restart it from your checkout.)
+2. **A spec with `spec_version` must be a directory + `config.yaml`**, never a
+   single `.yaml` file.
+3. **Copilot needs a GitHub token** (fine-grained PAT w/ Copilot Requests, or a
+   gh/Copilot-CLI OAuth token). Resolution precedence: spec `executor.auth`
+   (api_key) > stored `copilot:` config block (`omni setup`) > ambient
+   `COPILOT_GITHUB_TOKEN` / `GH_TOKEN` / `GITHUB_TOKEN`. Classic `ghp_` rejected.
+4. **No Databricks gateway.** Copilot talks only to GitHub's backend, so a
+   `databricks-*` model is silently resolved to Copilot's auto-select — it will
+   *not* route through the AI Gateway like claude-sdk/codex/pi.
+5. **Use a model id from the account's catalog.** free_limited offers `auto`,
+   `claude-haiku-4.5`, `gpt-5-mini`. Run `.venv/bin/python` + `client.list_models()`
+   to discover the live set; an unknown id fails loud (server-side failed session).
+6. **Turns take 30–90s** — always wrap in `timeout 280`.
+7. **Never print/echo the GitHub token** in logs or commands.
+
+## Code & tests
+
+- **Executor (SDK bridge):** `omnigent/inner/copilot_executor.py`
+- **Wrap (HARNESS_COPILOT_* env → executor):** `omnigent/inner/copilot_harness.py`
+- **Auth / token resolution:** `omnigent/onboarding/copilot_auth.py`
+- **Spawn env:** `_build_copilot_spawn_env` in `omnigent/runtime/workflow.py`
+
+```bash
+uv run --frozen --extra dev python -m pytest \
+  tests/inner/test_copilot_executor.py \
+  tests/inner/test_copilot_harness.py \
+  tests/runtime/test_copilot_spawn_env.py \
+  tests/onboarding/test_copilot_auth.py -q
+```
+
+## Bug-bash (fan out)
+
+To stress the harness, run several scenario probes in parallel — each builds a
+bundle and runs real turns against the same `$SERVER`, then reports what broke.
+Highest-value targets: the `Tool` async-handler bridge (hangs / lost tool
+results / errors reported as success), model routing, policy enforcement,
+streamed-output rendering, and orphaned bundled-CLI processes after teardown.
+Cross-check the AP API (`GET /v1/sessions/{id}/items`) — a start failure can exit
+0 with empty stdout while the server records a `failed` session.
+
+## Known sharp edges (found via live bug-bash — "as of this writing")
+
+- **Native tools bypass `on:[tool_call]` policies and aren't recorded.** Copilot's
+  built-in `create`/`view`/`edit`/`bash` run inside the SDK, so an
+  `on:[tool_call]` DENY guardrail (e.g. `blast_radius`) never sees them, and they
+  leave no `function_call` item in the transcript (only streamed narration).
+  **Bridged `sys_*` tools ARE gated and recorded.** Gate Copilot's built-ins at
+  the LLM phase (`PHASE_LLM_REQUEST`/`RESPONSE`, which fire) or via the OS-env
+  sandbox — not `on:[tool_call]`. (Same shape as the cursor harness.)
+- **Copilot fails loud (unlike cursor's swallowed start failures).** Bad token,
+  empty/invalid model, and unknown model ids all exit non-zero with a clear error
+  AND a server-side failed session + error item — verified, not swallowed.
+- **`omni run -p` against an async orchestrator exits after the dispatch turn**,
+  so a delegated sub-agent's final answer is persisted server-side but may not
+  reach stdout in one-shot mode. Read the session over the AP API to see it.
+- **Non-graceful exit can orphan the bundled CLI.** Graceful teardown reaps it
+  (`client.stop()`); after a `SIGKILL`/hard-exit, sweep
+  `pgrep -af "copilot/bin/copilot"`.
+
+## Cleanup
+
+```bash
+.venv/bin/omni server stop        # or kill the foreground `omni server`
+rm -rf /tmp/copilot-dev           # remove scratch bundles
+pgrep -af "copilot/bin/copilot"   # confirm no orphaned bundled-CLI subprocesses linger
+```

.claude/skills/harness-integration-guide/SKILL.md

@@ -0,0 +1,165 @@
+---
+name: harness-integration-guide
+description: Reference guide for building new Omnigent harness integrations — covers SDK/subprocess harnesses and native harnesses as separate tracks, each with their own feature matrix, implementation patterns, and prioritized checklist.
+---
+
+# Harness integration guide
+
+This skill describes the **feature matrix** every Omnigent harness must
+consider. Use it when planning, reviewing, or implementing a new harness.
+
+Omnigent has two distinct harness tracks with different architectures and
+feature sets:
+
+- **SDK/subprocess harnesses** — run the vendor model directly (in-process SDK,
+  CLI subprocess, or ACP subprocess). They own the model lifecycle.
+- **Native harnesses** — wrap a vendor's own TUI or server and mirror its
+  output into Omnigent. They observe and relay, rather than drive.
+
+---
+
+## Part 1 — SDK / subprocess harnesses
+
+These harnesses run the vendor model directly and bridge Omnigent tools into
+the vendor's tool-calling interface.
+
+### Capability matrix
+
+| Capability | What it means |
+|---|---|
+| **Connects to Omnigent MCP** | Harness exposes/consumes tools via the MCP protocol (in-proc SDK MCP server) |
+| **Model override** | User can select a model via `--model` / config; some harnesses are vendor-locked (e.g. Claude-only, GPT-only, Gemini-only) |
+| **Auth** | How credentials are obtained — API key, gateway token, vendor CLI login, OAuth, etc. |
+| **Streaming** | Harness forwards token-level or delta-level streaming to the Omnigent forwarder |
+| **Omnigent policies** | Harness enforces Omnigent-side tool policies — must support ALLOW, ASK, and DENY verdicts for both tool calls and tool results |
+| **Native elicitation** | When a policy verdict is ASK, the harness surfaces the approval request in the Omnigent web UI so the user can approve or deny |
+| **Interrupt** | User can cancel a running turn mid-stream |
+| **Live queue (concurrent)** | Multiple turns can be queued and processed concurrently |
+| **Tool-boundary steer** | Omnigent can inject steering text at tool-call boundaries |
+| **Resume/fork from Omnigent transcript** | Rebuild a conversation from a stored Omnigent transcript (replay history, seed prompt, or vendor session ID) |
+| **Compaction** | Long conversations are compacted; harness surfaces `CompactionComplete` events |
+| **Reasoning** | Model reasoning/thinking tokens are forwarded |
+| **Images** | Image content (screenshots, diagrams) is forwarded — full binary, path reference, or text-flattened |
+| **Cost tracking** | Harness reports token usage and cost data back to Omnigent for each turn |
+
+### MCP connectivity
+
+The harness must bridge Omnigent's builtin MCP tools so the model can call
+them. These tools provide session management, agent orchestration, policy
+control, and web access:
+
+- `sys_session_get_info`, `sys_session_list`, `sys_session_get_history`
+- `sys_agent_get`, `sys_agent_list`, `sys_agent_download`
+- `sys_call_async`, `sys_cancel_async`, `sys_cancel_task`
+- `sys_read_inbox`
+- `sys_add_policy`, `sys_policy_registry`
+- `load_skill`
+- `list_comments`, `update_comment`
+- `web_fetch`, `web_search`
+
+### Omnigent policies
+
+The harness must support the Omnigent policy engine's three verdicts at two
+checkpoints:
+
+| Checkpoint | ALLOW | ASK | DENY |
+|---|---|---|---|
+| **Tool call** (before execution) | Proceed silently | Surface approval request to user (via elicitation) | Block the call and return a policy-denied error to the model |
+| **Tool result** (after execution) | Return result to model | Surface result for user review before returning | Suppress the result and return a policy-denied error to the model |
+
+### Native elicitation
+
+When a policy verdict is ASK, the harness must surface the pending tool call
+or tool result in the Omnigent web UI as an approval card, then relay the
+user's approve/deny decision back to the harness to continue or block
+execution.
+
+### Resume / fork strategies
+
+| Strategy | How it works |
+|---|---|
+| Full history replay | Replays the entire message history into a fresh thread/session |
+| History prefix replay | Replays a prefix of the history into a fresh session |
+| Text-prefix replay | Injects a text summary/prefix of prior history |
+| Prompt seeding | Seeds prior history into the system prompt on rebuild |
+| Vendor session ID | Relies on the vendor's own session persistence (no Omnigent-side rebuild) |
+
+### Auth patterns
+
+| Pattern | Description |
+|---|---|
+| API key / Databricks gateway | Direct API key or routed through a Databricks gateway |
+| Vendor API key (direct) | Vendor-specific API key (e.g. Cursor, Gemini) |
+| Vendor CLI login / config file | Credentials stored in a vendor config file or managed via vendor CLI login |
+| OAuth / GitHub token | OAuth flow or platform token (e.g. GitHub PAT) |
+| Gateway + fallback | Primary gateway with fallback to vendor-native auth |
+
+### Checklist for a new SDK/subprocess harness
+
+All capabilities are **required** for a complete harness integration:
+
+- [ ] Connects to Omnigent MCP (in-proc SDK MCP server or vendor-specific bridge)
+- [ ] Model override works (or document vendor lock-in)
+- [ ] Auth is configured and documented (setup flow in `omni setup`)
+- [ ] Streaming forwards to the Omnigent forwarder
+- [ ] Omnigent policies enforce tool-use rules
+- [ ] Native elicitation surfaces tool-approval requests to web UI
+- [ ] Interrupt cancels the running turn
+- [ ] Live queue supports concurrent turns
+- [ ] Tool-boundary steering injects correctly
+- [ ] Resume/fork rebuilds conversation from Omnigent transcript
+- [ ] Compaction is surfaced (`CompactionComplete` events)
+- [ ] Reasoning tokens are forwarded
+- [ ] Images are forwarded (full binary preferred; path or text-flattened acceptable)
+- [ ] Cost tracking reports token usage and cost per turn
+- [ ] Unit tests cover tool bridging, auth, model routing
+- [ ] Mock LLM tests cover the happy path without real API calls
+
+---
+
+## Part 2 — Native harnesses
+
+Native harnesses wrap a vendor's own TUI or server and mirror output into
+Omnigent. They relay the vendor's conversation into the Omnigent session.
+
+### Capability matrix
+
+| Capability | What it means |
+|---|---|
+| **Transport** | How the native harness communicates — tmux TUI, app server, HTTP/SSE, file-inject TUI |
+| **Connects to Omnigent MCP** | Whether the native harness connects to the Omnigent MCP server |
+| **Model override** | User can select a model at launch or per-prompt |
+| **Auth** | Vendor login / config / token |
+| **Streaming (forwarder)** | `deltas` (token-level) vs `complete-only` (full response after completion) |
+| **Omnigent policies** | Whether the native harness enforces Omnigent-side tool policies — must support ALLOW, ASK, and DENY verdicts for both tool calls and tool results |
+| **Native elicitation** | When a policy verdict is ASK, the native harness surfaces the approval request in the Omnigent web UI so the user can approve or deny |
+| **Interrupt** | User can abort a running turn |
+| **Bidirectional sync (TUI->Omni)** | TUI output mirrors into the Omnigent conversation |
+| **In-harness session-cmd sync** | Supports `clear`, `fork`, `resume`, `switch` commands from Omnigent |
+| **Resume/fork from Omnigent transcript** | Can rebuild conversation from Omnigent transcript (native rebuild, or fresh launch) |
+| **Compaction** | Vendor-internal compaction status |
+| **Reasoning** | Model reasoning/thinking tokens are forwarded |
+| **Images** | Image content is forwarded — path reference, full binary, or text-flattened |
+| **Cost tracking** | Native harness reports token usage and cost data back to Omnigent for each turn |
+
+### Checklist for a new native harness
+
+All capabilities are **required** for a complete native harness integration:
+
+- [ ] Transport chosen and implemented (tmux TUI, app server, HTTP/SSE)
+- [ ] Connects to Omnigent MCP
+- [ ] Model override works (or document vendor lock-in)
+- [ ] Auth configured (vendor login / config)
+- [ ] Streaming forwarder works (deltas preferred; complete-only acceptable)
+- [ ] Omnigent policies enforce tool-use rules
+- [ ] Native elicitation surfaces tool-approval requests to web UI
+- [ ] Interrupt aborts the running turn
+- [ ] Bidirectional sync mirrors TUI output into Omnigent conversation
+- [ ] Session commands (clear, fork, resume) work from Omnigent
+- [ ] Resume/fork rebuilds from Omnigent transcript
+- [ ] Compaction status is surfaced
+- [ ] Reasoning tokens are forwarded
+- [ ] Images are forwarded (path preferred; binary or text-flattened acceptable)
+- [ ] Cost tracking reports token usage and cost per turn
+- [ ] Unit tests cover forwarder, auth, transport
+- [ ] Mock LLM tests cover the happy path without real API calls

.gitattributes

@@ -0,0 +1,2 @@
+# Treat the AppIcon bundle's contents as binary and never merge them.
+ap-web/electron/icons/AppIcon.icon/** binary -merge

.github/ISSUE_ASSIGNEES

@@ -12,10 +12,10 @@
 # Used by the issue triage workflow for P0/P1 auto-assignment.
 bbqiu server,runner,harnesses,repr
 daniellok-db server,runner,harnesses,web-ui
-dhruv0811 server,runner,harnesses,repr,infra
-fanzeyi server,runner,harnesses,repr
+dhruv0811 server,runner,harnesses,repr,infra,tui
+fanzeyi server,runner,harnesses,repr,tui
 PattaraS server,runner,harnesses,infra
-SabhyaC26 server,runner,harnesses,repr
-TomeHirata server,runner,harnesses,policies,infra
+SabhyaC26 server,runner,harnesses,repr,tui
+TomeHirata server,runner,harnesses,policies,infra,tui
 serena-ruan server,runner,harnesses,web-ui,infra
 hzub web-ui

.github/actions/e2e-run/action.yml

@@ -0,0 +1,226 @@
+name: "Run e2e suite"
+description: >
+  Run the tests/e2e suite exactly as the e2e.yml gate does (mock LLM,
+  sharded). When `server_version` is set, the omnigent SERVER subprocess is
+  pinned to that released tag (built into an isolated venv) while the client,
+  runner, and tests stay on the checked-out ref — the server-version
+  backwards-compat configuration. Shared verbatim by e2e.yml (normal gate) and
+  server-compat.yml (backcompat jobs) so the two never drift. The caller is
+  responsible for the preceding `actions/checkout` (the checkout ref differs:
+  the gate tests refs/pull/N/merge; backcompat needs fetch-depth 0 for tags).
+
+inputs:
+  shard_id:
+    description: "pytest-shard shard index"
+    required: true
+  num_shards:
+    description: "pytest-shard shard count"
+    required: true
+  parallelism:
+    description: "pytest workers (-n)"
+    required: false
+    default: "2"
+  nightly_full:
+    description: "true = full pass (schedule/dispatch); false = exclude @nightly"
+    required: false
+    default: "false"
+  server_version:
+    description: >
+      Empty = run the checked-out server (normal gate). Set to a release tag
+      (e.g. v0.1.1) = build that old server into a venv and redirect the
+      server subprocess to it (backwards-compat run).
+    required: false
+    default: ""
+  runner_version:
+    description: >
+      Empty = run the checked-out runner/host (normal gate). Set to a release
+      tag = build that old runner+host into a venv and redirect the runner and
+      host-daemon subprocesses to it (Config 2 backwards-compat run). Orthogonal
+      to server_version.
+    required: false
+    default: ""
+  artifact_suffix:
+    description: >
+      Appended to uploaded-artifact names so they stay unique across matrix
+      cells (e.g. "-sv0.2.0-rmain"). Default empty — the normal gate has one
+      cell per shard, so its names are already unique.
+    required: false
+    default: ""
+
+runs:
+  using: composite
+  steps:
+    - name: Configure environment
+      shell: bash
+      run: |
+        # Self-contained so the action behaves identically regardless of the
+        # caller's env. No ap-web SPA build during installs (this job never
+        # serves the bundle); blank provider keys so a spawned server can't
+        # pick up the runner's own credentials.
+        {
+          echo "OMNIGENT_SKIP_WEB_UI=true"
+          echo "ANTHROPIC_API_KEY="
+          echo "OPENAI_API_KEY="
+          echo "CODEX="
+          echo "CLAUDE_CODE="
+        } >> "$GITHUB_ENV"
+
+    - name: Set up Python
+      uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065  # v5
+      with:
+        python-version-file: ".python-version"
+
+    - name: Install uv
+      uses: astral-sh/setup-uv@38f3f104447c67c051c4a08e39b64a148898af3a  # v4
+      with:
+        enable-cache: true
+
+    - name: Cache virtualenv
+      uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684  # v4
+      with:
+        path: .venv
+        key: venv-${{ runner.os }}-${{ hashFiles('.python-version') }}-${{ hashFiles('uv.lock') }}
+
+    - name: Install project and dev dependencies
+      shell: bash
+      run: uv sync --locked --extra all --extra dev
+
+    - name: Install binary dependencies
+      # npm install against .github/ci-deps/package.json with --ignore-scripts
+      # to block postinstall on every package. The claude-code stub binary
+      # needs its install.cjs (audited: platform detect + same-tree hardlink,
+      # no network/exec) so we run that one explicitly; codex and pi have no
+      # install scripts and ship prebuilt CLIs. bubblewrap: the linux_bwrap
+      # sandbox backend fails loud if `bwrap` is missing, and the e2e runner
+      # runs real agents with os_env. The apparmor sysctl mirrors ci.yml
+      # (Ubuntu 24.04 blocks unprivileged user namespaces, which bwrap's
+      # unshare(CLONE_NEWUSER) needs).
+      working-directory: .github/ci-deps
+      shell: bash
+      run: |
+        sudo apt-get install -y tmux bubblewrap
+        sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0
+        npm install --ignore-scripts
+        node node_modules/@anthropic-ai/claude-code/install.cjs
+        echo "${GITHUB_WORKSPACE}/.github/ci-deps/node_modules/.bin" >> "$GITHUB_PATH"
+
+    - name: Build pinned old server (backwards-compat only)
+      # Only runs when server_version is set. Builds the released tag into an
+      # isolated venv (all three packages editable so the old ==<old> SDK
+      # cross-pins resolve without an index) and points the server subprocess
+      # at it via OMNIGENT_COMPAT_SERVER_PYTHON. The redirect also drops the
+      # worktree PYTHONPATH/CWD shadow (see tests/_helpers/compat.py) so the
+      # pinned install actually resolves. Requires fetch-depth 0 in the caller.
+      if: ${{ inputs.server_version != '' }}
+      shell: bash
+      env:
+        SERVER_VERSION_INPUT: ${{ inputs.server_version }}
+      run: |
+        tag="$SERVER_VERSION_INPUT"
+        if ! [[ "$tag" =~ ^v?[0-9]+\.[0-9]+(\.[0-9]+)?([a-z0-9.]*)?$ ]]; then
+          echo "Invalid server_version: '$tag'" >&2; exit 1
+        fi
+        src="$RUNNER_TEMP/server-src"
+        venv="$RUNNER_TEMP/server-env"
+        git worktree add --detach "$src" "$tag"
+        uv venv --python 3.12 "$venv"
+        uv pip install --python "$venv/bin/python" \
+          -e "$src" -e "$src/sdks/python-client" -e "$src/sdks/ui"
+        "$venv/bin/omnigent" --version
+        echo "OMNIGENT_COMPAT_SERVER_PYTHON=$venv/bin/python" >> "$GITHUB_ENV"
+        echo "OMNIGENT_COMPAT_SERVER_VERSION=${tag#v}" >> "$GITHUB_ENV"
+
+    - name: Build pinned old runner/host (backwards-compat only)
+      # Only runs when runner_version is set (Config 2). Builds the released tag
+      # into an isolated venv and points the runner + host-daemon subprocesses
+      # at it via OMNIGENT_COMPAT_RUNNER_PYTHON (apply_runner_env drops the
+      # worktree PYTHONPATH/CWD shadow). Distinct paths from the server build so
+      # both can coexist. Requires fetch-depth 0 in the caller.
+      if: ${{ inputs.runner_version != '' }}
+      shell: bash
+      env:
+        RUNNER_VERSION_INPUT: ${{ inputs.runner_version }}
+      run: |
+        tag="$RUNNER_VERSION_INPUT"
+        if ! [[ "$tag" =~ ^v?[0-9]+\.[0-9]+(\.[0-9]+)?([a-z0-9.]*)?$ ]]; then
+          echo "Invalid runner_version: '$tag'" >&2; exit 1
+        fi
+        src="$RUNNER_TEMP/runner-src"
+        venv="$RUNNER_TEMP/runner-env"
+        git worktree add --detach "$src" "$tag"
+        uv venv --python 3.12 "$venv"
+        uv pip install --python "$venv/bin/python" \
+          -e "$src" -e "$src/sdks/python-client" -e "$src/sdks/ui"
+        "$venv/bin/omnigent" --version
+        echo "OMNIGENT_COMPAT_RUNNER_PYTHON=$venv/bin/python" >> "$GITHUB_ENV"
+        echo "OMNIGENT_COMPAT_RUNNER_VERSION=${tag#v}" >> "$GITHUB_ENV"
+
+    - name: Run e2e tests
+      shell: bash
+      env:
+        PARALLELISM_INPUT: ${{ inputs.parallelism }}
+        SHARD_ID: ${{ inputs.shard_id }}
+        NUM_SHARDS: ${{ inputs.num_shards }}
+        NIGHTLY_FULL: ${{ inputs.nightly_full }}
+        E2E_TMP_BASE: /tmp/omnigent-e2e-${{ github.run_id }}-shard${{ inputs.shard_id }}
+        PYTEST_PROGRESS_LOG_DIR: /tmp/omnigent-e2e-${{ github.run_id }}-shard${{ inputs.shard_id }}/progress
+        OMNIGENT_TOKEN_USAGE_JSON: /tmp/omnigent-e2e-${{ github.run_id }}-shard${{ inputs.shard_id }}/tokens.json
+      run: |
+        # Validate parallelism (untrusted input -- bind to env, never
+        # interpolate a GitHub expression into the shell).
+        if ! [[ "$PARALLELISM_INPUT" =~ ^[1-9][0-9]?$ ]]; then
+          echo "Invalid parallelism input: $PARALLELISM_INPUT (expected 1-99)" >&2
+          exit 1
+        fi
+        WORKERS="$PARALLELISM_INPUT"
+        mkdir -p "$E2E_TMP_BASE"
+
+        EXTRA_ARGS=()
+        if [[ "$NIGHTLY_FULL" != "true" ]]; then
+          EXTRA_ARGS+=(-m "not nightly")
+        fi
+
+        # --junitxml emits per-test results eagerly so diagnostics survive a
+        # wall-clock overrun. --shard-id/--num-shards chunk the node IDs.
+        # --timeout=180 caps each test; --timeout-method=thread because our
+        # pty/subprocess children don't get SIGALRM. --max-worker-restart=0
+        # fails the shard fast instead of letting loadscope requeue deadlock
+        # the controller (the 2026-06-11 shard-2 wedge).
+        uv run pytest tests/e2e/ \
+          -n "$WORKERS" \
+          --dist=loadscope \
+          --max-worker-restart=0 \
+          --shard-id="$SHARD_ID" \
+          --num-shards="$NUM_SHARDS" \
+          --timeout=180 \
+          --timeout-method=thread \
+          --basetemp="$E2E_TMP_BASE" \
+          --junitxml="$E2E_TMP_BASE/junit.xml" \
+          -v --tb=long --showlocals --log-level=INFO -r a \
+          "${EXTRA_ARGS[@]}" \
+          || { rc=$?; [ "$rc" -eq 5 ] && echo "::notice::No tests collected in this shard; treating as a pass." || exit "$rc"; }
+
+    - name: Upload server logs on failure
+      # cancelled() too: failure() misses step timeouts (#426).
+      if: ${{ failure() || cancelled() }}
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02  # v4
+      with:
+        name: e2e-server-logs-${{ github.run_id }}-shard${{ inputs.shard_id }}${{ inputs.artifact_suffix }}
+        path: |
+          /tmp/omnigent-e2e-${{ github.run_id }}-shard${{ inputs.shard_id }}/**/server.log
+          /tmp/omnigent-e2e-${{ github.run_id }}-shard${{ inputs.shard_id }}/**/runner.log
+          /tmp/omnigent-e2e-${{ github.run_id }}-shard${{ inputs.shard_id }}/**/.omnigent/logs/**/*.log
+          /tmp/omnigent-e2e-${{ github.run_id }}-shard${{ inputs.shard_id }}/junit.xml
+          /tmp/omnigent-e2e-${{ github.run_id }}-shard${{ inputs.shard_id }}/progress/progress-*.log
+        retention-days: 7
+        if-no-files-found: warn
+        include-hidden-files: true
+
+    - name: Upload token usage
+      if: ${{ always() }}
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02  # v4
+      with:
+        name: e2e-tokens-${{ github.run_id }}-shard${{ inputs.shard_id }}${{ inputs.artifact_suffix }}
+        path: /tmp/omnigent-e2e-${{ github.run_id }}-shard${{ inputs.shard_id }}/tokens*.json
+        retention-days: 14
+        if-no-files-found: warn

.github/actions/integration-run/action.yml

@@ -0,0 +1,187 @@
+name: "Run integration suite"
+description: >
+  Run the tests/integration journey suite exactly as the integration.yml gate
+  does (mock LLM, one wrapped harness per invocation). When `server_version`
+  is set, the omnigent SERVER subprocess is pinned to that released tag while
+  the client, runner, and tests stay on the checked-out ref — the
+  server-version backwards-compat configuration. Shared verbatim by
+  integration.yml (normal gate) and server-compat.yml (backcompat jobs) so the
+  two never drift. The caller owns the preceding `actions/checkout` (backcompat
+  needs fetch-depth 0 for tags).
+
+inputs:
+  harness:
+    description: "Wrapped harness (claude-sdk | openai-agents | codex)"
+    required: true
+  model:
+    description: "Model name passed to --model"
+    required: true
+  workers:
+    description: "pytest workers (-n)"
+    required: true
+  server_version:
+    description: >
+      Empty = run the checked-out server (normal gate). Set to a release tag
+      = build that old server into a venv and redirect the server subprocess
+      to it (backwards-compat run).
+    required: false
+    default: ""
+  runner_version:
+    description: >
+      Empty = run the checked-out runner (normal gate). Set to a release tag =
+      build that old runner into a venv and redirect the runner subprocess to it
+      (Config 2 backwards-compat run). Orthogonal to server_version.
+    required: false
+    default: ""
+  artifact_suffix:
+    description: >
+      Appended to uploaded-artifact names so they stay unique across matrix
+      cells (e.g. "-sv0.2.0-rmain"). Default empty — the normal gate runs one
+      cell, so its harness-scoped names are already unique.
+    required: false
+    default: ""
+
+runs:
+  using: composite
+  steps:
+    - name: Configure environment
+      shell: bash
+      run: |
+        {
+          echo "OMNIGENT_SKIP_WEB_UI=true"
+          echo "ANTHROPIC_API_KEY="
+          echo "OPENAI_API_KEY="
+          echo "CODEX="
+          echo "CLAUDE_CODE="
+        } >> "$GITHUB_ENV"
+
+    - name: Set up Python
+      uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065  # v5
+      with:
+        python-version-file: ".python-version"
+
+    - name: Install uv
+      uses: astral-sh/setup-uv@38f3f104447c67c051c4a08e39b64a148898af3a  # v4
+      with:
+        enable-cache: true
+
+    - name: Cache virtualenv
+      uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684  # v4
+      with:
+        path: .venv
+        key: venv-${{ runner.os }}-${{ hashFiles('.python-version') }}-${{ hashFiles('uv.lock') }}
+
+    - name: Install project and dev dependencies
+      shell: bash
+      run: uv sync --locked --extra all --extra dev
+
+    - name: Install binary dependencies
+      # Mirrors e2e.yml. --ignore-scripts blocks npm postinstall hooks; we run
+      # claude-code's install.cjs explicitly (audited, no network). bubblewrap
+      # backs the linux_bwrap sandbox in tests/inner/*.
+      working-directory: .github/ci-deps
+      shell: bash
+      run: |
+        set -euo pipefail
+        sudo apt-get update
+        sudo apt-get install -y tmux ripgrep bubblewrap
+        sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0
+        npm install --ignore-scripts
+        node node_modules/@anthropic-ai/claude-code/install.cjs
+        echo "${GITHUB_WORKSPACE}/.github/ci-deps/node_modules/.bin" >> "$GITHUB_PATH"
+
+    - name: Build pinned old server (backwards-compat only)
+      # See e2e-run for the full rationale. Requires fetch-depth 0 in the caller.
+      if: ${{ inputs.server_version != '' }}
+      shell: bash
+      env:
+        SERVER_VERSION_INPUT: ${{ inputs.server_version }}
+      run: |
+        tag="$SERVER_VERSION_INPUT"
+        if ! [[ "$tag" =~ ^v?[0-9]+\.[0-9]+(\.[0-9]+)?([a-z0-9.]*)?$ ]]; then
+          echo "Invalid server_version: '$tag'" >&2; exit 1
+        fi
+        src="$RUNNER_TEMP/server-src"
+        venv="$RUNNER_TEMP/server-env"
+        git worktree add --detach "$src" "$tag"
+        uv venv --python 3.12 "$venv"
+        uv pip install --python "$venv/bin/python" \
+          -e "$src" -e "$src/sdks/python-client" -e "$src/sdks/ui"
+        "$venv/bin/omnigent" --version
+        echo "OMNIGENT_COMPAT_SERVER_PYTHON=$venv/bin/python" >> "$GITHUB_ENV"
+        echo "OMNIGENT_COMPAT_SERVER_VERSION=${tag#v}" >> "$GITHUB_ENV"
+
+    - name: Build pinned old runner (backwards-compat only)
+      # Config 2: redirect the runner subprocess to the pinned old build via
+      # OMNIGENT_COMPAT_RUNNER_PYTHON. See e2e-run for the full rationale.
+      # Distinct paths from the server build. Requires fetch-depth 0 in the caller.
+      if: ${{ inputs.runner_version != '' }}
+      shell: bash
+      env:
+        RUNNER_VERSION_INPUT: ${{ inputs.runner_version }}
+      run: |
+        tag="$RUNNER_VERSION_INPUT"
+        if ! [[ "$tag" =~ ^v?[0-9]+\.[0-9]+(\.[0-9]+)?([a-z0-9.]*)?$ ]]; then
+          echo "Invalid runner_version: '$tag'" >&2; exit 1
+        fi
+        src="$RUNNER_TEMP/runner-src"
+        venv="$RUNNER_TEMP/runner-env"
+        git worktree add --detach "$src" "$tag"
+        uv venv --python 3.12 "$venv"
+        uv pip install --python "$venv/bin/python" \
+          -e "$src" -e "$src/sdks/python-client" -e "$src/sdks/ui"
+        "$venv/bin/omnigent" --version
+        echo "OMNIGENT_COMPAT_RUNNER_PYTHON=$venv/bin/python" >> "$GITHUB_ENV"
+        echo "OMNIGENT_COMPAT_RUNNER_VERSION=${tag#v}" >> "$GITHUB_ENV"
+
+    - name: Run integration tests
+      shell: bash
+      env:
+        HARNESS: ${{ inputs.harness }}
+        MODEL: ${{ inputs.model }}
+        WORKERS: ${{ inputs.workers }}
+        INTEGRATION_TMP_BASE: /tmp/omnigent-integration-${{ github.run_id }}-${{ inputs.harness }}
+        CLAUDE_CODE_STREAM_CLOSE_TIMEOUT: "60000"
+        OMNIGENT_CLAUDE_SDK_NO_SANDBOX: ${{ inputs.harness == 'claude-sdk' && '1' || '' }}
+        PYTEST_PROGRESS_LOG_DIR: ${{ github.workspace }}/artifacts/progress-${{ inputs.harness }}
+        OMNIGENT_TOKEN_USAGE_JSON: ${{ github.workspace }}/artifacts/tokens-${{ inputs.harness }}.json
+        OMNIGENT_TEST_MODEL_SPREAD: "1"
+        OMNIGENT_TEST_MODEL_POOL_GPT: "databricks-gpt-5-5,databricks-gpt-5-4-mini"
+      run: |
+        set -euo pipefail
+        mkdir -p artifacts "$INTEGRATION_TMP_BASE"
+        # --capture=no + --log-cli-level=INFO stream live so progress shows
+        # even if the step hits its timeout before buffered output renders.
+        # --timeout=180 caps a single hung test (see e2e.yml).
+        env -u OPENAI_API_KEY -u ANTHROPIC_API_KEY -u DATABRICKS_TOKEN \
+          uv run pytest tests/integration/ \
+            --model "$MODEL" \
+            --harness "$HARNESS" \
+            -n "$WORKERS" \
+            --dist=loadscope \
+            --timeout=180 \
+            --timeout-method=thread \
+            --basetemp="$INTEGRATION_TMP_BASE" \
+            --junitxml="artifacts/integration-${HARNESS}.xml" \
+            --capture=no --log-cli-level=INFO \
+            -v --tb=long --showlocals --log-level=INFO -r a
+
+    - name: Upload server/runner logs on failure
+      if: ${{ failure() || cancelled() }}
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02  # v4
+      with:
+        name: integration-server-logs-${{ inputs.harness }}-${{ github.run_id }}${{ inputs.artifact_suffix }}
+        path: |
+          /tmp/omnigent-integration-${{ github.run_id }}-${{ inputs.harness }}/**/server.log
+          /tmp/omnigent-integration-${{ github.run_id }}-${{ inputs.harness }}/**/runner.log
+        retention-days: 7
+        if-no-files-found: warn
+
+    - name: Upload junit + logs
+      if: ${{ always() }}
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02  # v4
+      with:
+        name: integration-${{ inputs.harness }}-${{ github.run_id }}${{ inputs.artifact_suffix }}
+        path: artifacts/
+        retention-days: 14
+        if-no-files-found: ignore

.github/ci-deps/package.json

@@ -2,9 +2,10 @@
   "name": "e2e-ci-deps",
   "version": "0.0.0",
   "private": true,
-  "description": "Pinned npm CLIs the e2e workflow installs (claude-code, codex).",
+  "description": "Pinned npm CLIs the e2e workflow installs (claude-code, codex, pi).",
   "dependencies": {
     "@anthropic-ai/claude-code": "2.1.124",
-    "@openai/codex": "0.128.0-alpha.1"
+    "@earendil-works/pi-coding-agent": "0.75.5",
+    "@openai/codex": "0.139.0"
   }
 }

.github/pull_request_template.md

@@ -1,6 +1,6 @@
 <!--
 For AI-written descriptions:
-- Follow this template (Related issue, Summary, Type of change, Test coverage, Coverage rationale).
+- Follow this template (Related issue, Summary, Test Plan, Type of change, Test coverage, Coverage notes).
 - Keep it concise; reviewers skim long descriptions.
 - For non-trivial changes, include an ELI5 and a diagram (ASCII or mermaid).
 - Leave every checkbox in place. The PR Template check fails if required sections
@@ -23,6 +23,10 @@ Closes #
 
 <!-- What changed and why, in 1-3 bullets or a short paragraph. -->
 
+## Test Plan
+
+<!-- How was this change tested? Describe the steps, commands, or scenarios used to verify it. Include a screenshot or recording where helpful. -->
+
 ## Type of change
 
 - [ ] Bug fix
@@ -43,11 +47,10 @@ Closes #
 - [ ] Existing tests cover this change
 - [ ] Not applicable
 
-## Coverage rationale
+## Coverage notes
 
 <!--
-Describe the exact commands run and the coverage added/updated. If you did not
-add or run tests, explain why the existing coverage is enough or why tests are
-not applicable. For E2E-relevant changes, call out the E2E scenario exercised or
-why no E2E coverage was added.
+Optional — but required if you checked "Manual verification completed" or
+"Not applicable" above. Describe what you verified manually, or why automated
+test coverage is not needed for this change.
 -->

.github/reviewers

@@ -5,7 +5,7 @@
 # reviewers. All assignment is driven by .github/workflows/auto-assign-reviewer.yml,
 # which:
 #   - runs ONLY on fork PRs authored by a non-maintainer, and
-#   - assigns EXACTLY 2 load-balanced reviewers from the area(s) the PR touches
+#   - assigns EXACTLY 1 load-balanced reviewer from the area(s) the PR touches
 #     (falling back to the full set of handles in this file for unowned paths).
 # So the per-area lists below are the CANDIDATE pool per area, not "everyone gets
 # requested". This is routing only -- it does not gate merge (that stays
@@ -23,7 +23,7 @@
 /.github/                    @PattaraS @serena-ruan @dhruv0811 @TomeHirata
 
 # Web UI
-/ap-web/                     @SabhyaC26 @serena-ruan @daniellok-db @hzub
+/ap-web/                     @SabhyaC26 @serena-ruan @daniellok-db
 
 # Core agent runtime & harnesses
 /omnigent/inner/             @SabhyaC26 @TomeHirata @dhruv0811 @dbczumar

.github/scripts/ci/backcompat-pairwise-matrix.sh

@@ -0,0 +1,146 @@
+#!/usr/bin/env bash
+# Emit the backwards-compat (server, runner) matrices on $GITHUB_OUTPUT as
+# `e2e_matrix` and `integration_matrix`.
+#
+# We test `main` (the checked-out code = client + tests, always) against each
+# non-rc release tag AT OR ABOVE the backcompat floor (MIN_VERSION, default
+# 0.2.0 — the first release with the mock-LLM e2e infra; see below), on BOTH
+# axes — and ONLY those cells:
+#   (server=main,      runner=<release>)  — new server vs a previously-shipped runner
+#   (server=<release>, runner=main)       — previously-shipped server vs new runner/client/tests
+# That is the only meaningful cross-version surface. We deliberately do NOT emit
+# release×release cells (both sides already shipped together — covered by that
+# release's own CI, not a compat signal) nor the all-main cell (== the normal
+# e2e gate). So the job count grows linearly (2 per release), not quadratically.
+# Integration is the single openai-agents leg (claude-sdk/codex reject the mock
+# LLM's "mock-model" — see integration-matrix.sh), one per cell.
+#
+# Env in:
+#   VERSIONS    optional comma-separated override of the version set used for
+#               BOTH axes (e.g. "main,v0.2.0"). Empty = main + all non-rc tags.
+#               Blank entries are dropped and surrounding whitespace trimmed.
+#   NUM_SHARDS  e2e shard count per cell (default 4).
+# Out (GITHUB_OUTPUT):
+#   e2e_matrix={"include":[{"server":..,"runner":..,"shard_id":..,"num_shards":..}, ...]}
+#   integration_matrix={"include":[{"server":..,"runner":..,"harness":..,"model":..,"workers":..}, ...]}
+
+set -euo pipefail
+
+# A version token is "main" or a release tag (vX.Y[.Z][pre/dev suffix]). Anything
+# else is rejected so it can't break the matrix JSON or reach a `git worktree add`.
+_valid_version() {
+  [ "$1" = "main" ] || [[ "$1" =~ ^v?[0-9]+\.[0-9]+(\.[0-9]+)?([a-z0-9.]*)?$ ]]
+}
+
+# Minimum release the backcompat matrix tests against. v0.2.0 is the first
+# release with the mock-LLM e2e infrastructure (tests/e2e/conftest.py has 0
+# mock-LLM refs at v0.1.x, 31 at v0.2.0) AND the runner-side harness mock
+# routing — empirically, main's mock-based e2e suite 401s ("Incorrect API key
+# provided: mock-key") against v0.1.0/v0.1.1 server+runner builds, so those
+# pairs are guaranteed-red infrastructure mismatch, not a compat signal.
+# `main` is the dev tip and always sorts above any release, so it is never
+# floored. Override with BACKCOMPAT_MIN_VERSION (e.g. "0.0.0" to disable).
+# Strip a leading "v" so a "v0.2.0"-style override compares cleanly against the
+# v-stripped tags in _below_floor (without this, the floor version itself would
+# be dropped).
+MIN_VERSION="${BACKCOMPAT_MIN_VERSION:-0.2.0}"
+MIN_VERSION="${MIN_VERSION#v}"
+
+# True (0) when release tag $1 is older than MIN_VERSION (by PEP-440-ish release
+# order). "main" is never below the floor. Compares the numeric tuple via
+# `sort -V` after stripping the leading "v".
+_below_floor() {
+  [ "$1" = "main" ] && return 1
+  local v="${1#v}"
+  [ "$v" = "$MIN_VERSION" ] && return 1
+  [ "$(printf '%s\n%s\n' "$v" "$MIN_VERSION" | sort -V | head -1)" = "$v" ]
+}
+
+raw=()
+if [ -n "${VERSIONS:-}" ]; then
+  IFS=',' read -ra raw <<<"$VERSIONS"
+else
+  raw=("main")
+  # `[^a-z]rc[0-9]` so we drop vX.Y.ZrcN without over-excluding tags that merely
+  # contain the substring "rc" (e.g. a hypothetical "...march").
+  while IFS= read -r tag; do raw+=("$tag"); done < <(git tag --sort=-v:refname | grep -viE '(^|[^a-z])rc[0-9]')
+fi
+
+# Trim whitespace, drop blanks, reject invalid tokens, drop below-floor releases.
+V=()
+for v in "${raw[@]}"; do
+  v="${v#"${v%%[![:space:]]*}"}"
+  v="${v%"${v##*[![:space:]]}"}"
+  [ -z "$v" ] && continue
+  if ! _valid_version "$v"; then
+    echo "skipping invalid version token: '$v'" >&2
+    continue
+  fi
+  if _below_floor "$v"; then
+    echo "skipping '$v': below backcompat floor $MIN_VERSION (predates the mock-LLM e2e infra)" >&2
+    continue
+  fi
+  V+=("$v")
+done
+
+num_shards="${NUM_SHARDS:-4}"
+
+# Cells = 2 per release (both axes) when main is present, else 0 (every cell
+# pairs main with a release). GitHub caps a matrix at 256 jobs; if e2e jobs
+# (cells × shards) would exceed it, drop the OLDEST releases (V is newest-first
+# in auto mode) until under, logging each drop — never silently truncate.
+_cell_count() {
+  local n=${#V[@]} mm=0 x
+  for x in "${V[@]}"; do [ "$x" = "main" ] && mm=1 && break; done
+  [ "$mm" = 1 ] && echo "$((2 * (n - 1)))" || echo 0
+}
+max_e2e=256
+while [ "${#V[@]}" -gt 2 ] && [ "$(($(_cell_count) * num_shards))" -gt "$max_e2e" ]; do
+  dropped="${V[${#V[@]} - 1]}"
+  unset 'V[${#V[@]}-1]'
+  V=("${V[@]}")
+  echo "version-matrix cap: dropped oldest version '$dropped' to keep e2e jobs <= $max_e2e" >&2
+done
+
+# The integration suite runs a single openai-agents leg in mock mode (matches
+# integration-matrix.sh); the model name is unused under the mock LLM.
+integ_harness="openai-agents"
+integ_model="databricks-gpt-5-4-mini"
+integ_workers="4"
+
+e2e_items=()
+integ_items=()
+for s in "${V[@]}"; do
+  for r in "${V[@]}"; do
+    # Emit iff EXACTLY ONE axis is main: main-vs-release on each direction.
+    # Skips the all-main cell (== the normal e2e gate) and every
+    # release×release cell (both already shipped together — not a
+    # cross-version-compat scenario).
+    s_main=0; [ "$s" = "main" ] && s_main=1
+    r_main=0; [ "$r" = "main" ] && r_main=1
+    if [ "$s_main" = "$r_main" ]; then
+      continue
+    fi
+    integ_items+=("{\"server\":\"$s\",\"runner\":\"$r\",\"harness\":\"$integ_harness\",\"model\":\"$integ_model\",\"workers\":$integ_workers}")
+    for ((i = 0; i < num_shards; i++)); do
+      e2e_items+=("{\"server\":\"$s\",\"runner\":\"$r\",\"shard_id\":$i,\"num_shards\":$num_shards}")
+    done
+  done
+done
+
+e2e_json=$(
+  IFS=,
+  echo "${e2e_items[*]:-}"
+)
+integ_json=$(
+  IFS=,
+  echo "${integ_items[*]:-}"
+)
+
+{
+  echo "e2e_matrix={\"include\":[$e2e_json]}"
+  echo "integration_matrix={\"include\":[$integ_json]}"
+} >>"${GITHUB_OUTPUT:-/dev/stdout}"
+
+echo "versions: ${V[*]:-(none)}" >&2
+echo "pairs: ${#integ_items[@]} (excludes main/main); e2e jobs: ${#e2e_items[@]}; integration jobs: ${#integ_items[@]}" >&2

.github/scripts/ci/e2e-shard-matrix.sh

@@ -1,19 +1,14 @@
 #!/usr/bin/env bash
-# Emits the e2e shard matrix as `matrix=<json>` on $GITHUB_OUTPUT. Shared by
-# e2e.yml and e2e-ui.yml (they differ only in NUM_SHARDS).
+# Emits the e2e shard matrix as `matrix=<json>` on $GITHUB_OUTPUT, or an EMPTY
+# matrix ({"include":[]}) to skip. Empty yields zero jobs and thus NO check-runs
+# -- the point of the indirection: a job-level `if:` skip would instead leave a
+# check-run with an unexpanded `E2E Tests (shard ${{ matrix.shard_id }}/...)` name.
 #
-# Returns an EMPTY matrix ({"include":[]}) when the run should be skipped:
-#   - draft PRs, or
-#   - a fork's pull_request (no secrets there; forks run via the fork-e2e/**
-#     mirror push instead).
-# An empty matrix yields zero jobs and therefore NO check-runs. This is the
-# whole reason for the indirection: a job-level `if:` skip of a matrixed job
-# would instead leave one check-run with an unexpanded
-# `E2E Tests (shard ${{ matrix.shard_id }}/...)` name.
+# Skips only draft PRs. These suites are mock-LLM (no secrets), so fork PRs run
+# directly, like CI.
 #
-# Env in:  EVENT_NAME (github.event_name), IS_DRAFT, IS_FORK (both may be empty
-#          on non-PR events), NUM_SHARDS.
-# Out:     matrix={"include":[{"shard_id":0,"num_shards":N}, ...]}  (or [] empty)
+# Env in:  EVENT_NAME, IS_DRAFT, NUM_SHARDS.
+# Shared by e2e.yml and e2e-ui.yml (differ in NUM_SHARDS).
 
 set -euo pipefail
 
@@ -21,13 +16,10 @@ skip=false
 if [[ "${IS_DRAFT:-false}" == "true" ]]; then
   skip=true
 fi
-if [[ "$EVENT_NAME" == "pull_request" && "${IS_FORK:-false}" == "true" ]]; then
-  skip=true
-fi
 
 if [[ "$skip" == "true" ]]; then
   echo 'matrix={"include":[]}' >> "$GITHUB_OUTPUT"
-  echo "skip: empty matrix (event=$EVENT_NAME draft=${IS_DRAFT:-} fork=${IS_FORK:-})"
+  echo "skip: empty matrix (event=$EVENT_NAME draft=${IS_DRAFT:-})"
   exit 0
 fi
 

.github/scripts/ci/integration-matrix.sh

@@ -1,30 +1,21 @@
 #!/usr/bin/env bash
 # Emits the integration-test harness matrix as `matrix=<json>` on $GITHUB_OUTPUT.
 #
-# Returns an EMPTY matrix ({"include":[]}) when the run should be skipped:
-#   - draft PRs, or
-#   - a fork's pull_request (no secrets there; forks run via the fork-e2e/**
-#     mirror push instead).
-# An empty matrix yields zero jobs and therefore NO check-runs. This is the
-# whole reason for the indirection (mirrors e2e-shard-matrix.sh): a job-level
-# `if:` skip of a matrixed job would instead leave one check-run with an
-# unexpanded `Integration (${{ matrix.name }})` name.
+# Returns an EMPTY matrix ({"include":[]}) to skip: zero jobs, NO check-runs.
+# This is the whole reason for the indirection (mirrors e2e-shard-matrix.sh): a
+# job-level `if:` skip would instead leave one check-run with an unexpanded
+# `Integration (${{ matrix.name }})` name.
 #
-# One leg per wrapped harness, no pytest-shard splitting: the journey suite is
-# a handful of tests per leg. The `Integration (...)` leg-name prefix is load-
-# bearing -- nightly.yml's notify jq filter keys on it.
+# Skips only draft PRs. Integration is mock-LLM (no secrets), so fork PRs run
+# directly, like CI -- no fork-e2e/** mirror needed.
 #
-# Model pinning rationale:
-# - claude-sdk on sonnet-4-6: tier 4, most TPM headroom.
-# - codex on gpt-5-5: gpt-5-4-mini hit 429s historically; also halve its
-#   workers (least rate-limit headroom; burn-in failures were codex-only,
-#   clustered at peak PR traffic).
-# - openai-agents on gpt-5-4-mini: green there historically.
-# OMNIGENT_TEST_MODEL_SPREAD in the workflow may rebalance within the same
-# provider/tier pool (tests/_model_pools.py).
+# Single openai-agents leg: all tests now run against the mock LLM server.
+# claude-sdk and codex reject "mock-model" as an unknown model (they validate
+# against the Databricks model catalog even when mock_llm_base_url is set), so
+# only openai-agents works without real credentials. The model name is unused
+# in mock mode (model_name fixture returns "mock-model" regardless).
 #
-# Env in:  EVENT_NAME (github.event_name), IS_DRAFT, IS_FORK (both may be empty
-#          on non-PR events).
+# Env in:  EVENT_NAME (github.event_name), IS_DRAFT.
 # Out:     matrix={"include":[{"name":..,"harness":..,"model":..,"workers":..}, ...]}
 #          (or {"include":[]} when skipped).
 
@@ -34,21 +25,16 @@ skip=false
 if [[ "${IS_DRAFT:-false}" == "true" ]]; then
   skip=true
 fi
-if [[ "$EVENT_NAME" == "pull_request" && "${IS_FORK:-false}" == "true" ]]; then
-  skip=true
-fi
 
 if [[ "$skip" == "true" ]]; then
   echo 'matrix={"include":[]}' >> "$GITHUB_OUTPUT"
-  echo "skip: empty matrix (event=$EVENT_NAME draft=${IS_DRAFT:-} fork=${IS_FORK:-})"
+  echo "skip: empty matrix (event=$EVENT_NAME draft=${IS_DRAFT:-})"
   exit 0
 fi
 
 read -r -d '' matrix <<'JSON' || true
 {"include":[
-{"name":"claude-sdk","harness":"claude-sdk","model":"databricks-claude-sonnet-4-6","workers":4},
-{"name":"openai-agents","harness":"openai-agents","model":"databricks-gpt-5-4-mini","workers":4},
-{"name":"codex","harness":"codex","model":"databricks-gpt-5-5","workers":2}
+{"name":"openai-agents","harness":"openai-agents","model":"databricks-gpt-5-4-mini","workers":4}
 ]}
 JSON
 # Collapse to one line so the GITHUB_OUTPUT key=value contract holds.

.github/scripts/fork-e2e/should-mirror.sh

@@ -1,78 +0,0 @@
-#!/usr/bin/env bash
-# Decides whether a fork PR's head commit should be mirrored onto the trusted
-# fork-e2e/pr-N branch (which lets e2e run as a `push` with the test-gateway
-# secrets). Called by .github/workflows/fork-e2e-mirror.yml.
-#
-# Gate (either condition opens it):
-#   1. The PR has an approving review from a maintainer (in
-#      .github/MAINTAINER@main), OR
-#   2. The PR carries the `e2e-approved` label applied by a maintainer.
-#
-# Path 1 (approval) is the primary flow: approving the PR both satisfies the
-# merge gate and triggers e2e. Path 2 (label) is a manual escape hatch for
-# running e2e without approving for merge (e.g. early CI validation).
-#
-# New commits while the gate is open re-mirror automatically (this script
-# re-runs on `synchronize`); the security scan plus the maintainer's review
-# are the safety net for post-approval pushes. Revoking approval AND removing
-# the label (or closing the PR) stops future mirrors and cleans up the mirror
-# branch -- see the workflow.
-#
-# Fail closed: any error or unexpected state leaves the gate shut, so secrets
-# never run on an unverified PR.
-#
-# Env in:  GH_TOKEN, REPO, PR,
-#          MAINTAINERS (space-separated, from merge-ready/load-maintainers.sh).
-# Out:     `mirror=true|false` and `reason=<text>` on $GITHUB_OUTPUT.
-
-set -euo pipefail
-
-emit() {
-  echo "mirror=$1" >> "$GITHUB_OUTPUT"
-  echo "reason=$2" >> "$GITHUB_OUTPUT"
-  echo "mirror=$1 ($2)"
-}
-
-MAINTAINERS_LC=$(echo "${MAINTAINERS:-}" | tr '[:upper:]' '[:lower:]')
-
-if [[ -z "${MAINTAINERS_LC// /}" ]]; then
-  emit false "no maintainers loaded (.github/MAINTAINER@main empty/missing)"
-  exit 0
-fi
-
-# --- Path 1: maintainer approval via PR review ---
-
-APPROVERS=$(gh api "repos/$REPO/pulls/$PR/reviews" --paginate \
-  --jq '[.[] | select(.state != "COMMENTED")] | group_by(.user.login) | map(max_by(.submitted_at)) | .[] | select(.state == "APPROVED") | .user.login')
-
-for u in $APPROVERS; do
-  u_lc=$(echo "$u" | tr '[:upper:]' '[:lower:]')
-  for m in $MAINTAINERS_LC; do
-    if [[ "$m" == "$u_lc" ]]; then
-      emit true "approved by maintainer @$u"
-      exit 0
-    fi
-  done
-done
-
-# --- Path 2: e2e-approved label applied by a maintainer ---
-
-LABEL="e2e-approved"
-LABELS=$(gh pr view "$PR" --repo "$REPO" --json labels --jq '.labels[].name')
-if grep -qxF "$LABEL" <<<"$LABELS"; then
-  LABELER=$(gh api "repos/$REPO/issues/$PR/events" --paginate \
-    --jq "[.[] | select(.event == \"labeled\" and .label.name == \"$LABEL\")] | last | .actor.login // empty")
-
-  if [[ -n "$LABELER" ]]; then
-    LABELER_LC=$(echo "$LABELER" | tr '[:upper:]' '[:lower:]')
-    for m in $MAINTAINERS_LC; do
-      if [[ "$m" == "$LABELER_LC" ]]; then
-        emit true "'$LABEL' applied by maintainer @$LABELER"
-        exit 0
-      fi
-    done
-  fi
-fi
-
-# Neither path opened the gate.
-emit false "awaiting approval from a maintainer or '$LABEL' label"

.github/scripts/merge-ready/compute-gate.sh

@@ -2,19 +2,20 @@
 # Single source of truth for the Merge Ready outcome. Downstream steps
 # just consume `state`, `short_desc`, and `long_desc`.
 #
-# The gate is green iff every required check is green on its own merits
-# AND (for fork PRs) a maintainer has approved. There is no CI bypass: to
-# land despite red required checks, quarantine the flaky test
-# (tests/known_failures.yaml) or have a repo admin use GitHub's native
-# "merge without waiting for requirements" affordance.
+# The gate is green iff every required check is green on its own merits. There is
+# no CI bypass: to land despite red required checks, fix or delete the failing
+# test, or have a repo admin use GitHub's native "merge without waiting for
+# requirements" affordance. (Fork PRs still need a maintainer's approving review
+# to merge -- that is enforced by the separate `Maintainer Approval` check, not
+# here. No CI suite needs secrets on a fork PR anymore, so there is no
+# e2e-specific approval gate.)
 #
-#   CI eval  | fork approval | state    | meaning
-#   ---------+---------------+----------+---------------------------------
-#   success  | n/a or true   | success  | CI green on its own merits
-#   success  | false         | failure  | fork PR awaiting maintainer approval
-#   failure  | any           | failure  | CI red
+#   CI eval  | state    | meaning
+#   ---------+----------+----------------------------
+#   success  | success  | all required checks green
+#   failure  | failure  | a required check is red
 #
-# Env in: EVAL, FAILED, FORK_NEEDS_E2E_APPROVAL (optional, default false)
+# Env in: EVAL, FAILED
 # Out:    state, short_desc, long_desc on $GITHUB_OUTPUT
 
 set -euo pipefail
@@ -29,17 +30,6 @@ else
   LONG=$':hourglass: gate not green yet. Required checks not satisfied:\n\n'"$FAILED"$'\nThe merge will fire once these turn green.'
 fi
 
-# Fork PRs never run e2e on their own: the fork `pull_request` run resolves to
-# an empty shard matrix, so the suite only runs once a maintainer approves the
-# PR (which mirrors the head to a trusted fork-e2e/** branch). Without approval
-# the e2e checks are satisfied-via-skip and the PR would go green with e2e never
-# having executed -- so block merge until a maintainer approves.
-if [[ "${FORK_NEEDS_E2E_APPROVAL:-false}" == "true" ]]; then
-  STATE=failure
-  SHORT="Awaiting maintainer approval for e2e"
-  LONG="$LONG"$'\n\n:no_entry: **E2e tests are required for fork PRs.** A maintainer must approve this PR or apply the `e2e-approved` label to trigger the e2e suite. The merge gate will stay red until e2e passes.'
-fi
-
 # GitHub commit-status descriptions max out at 140 chars.
 if [[ ${#SHORT} -gt 140 ]]; then
   SHORT="${SHORT:0:137}..."

.github/scripts/merge-ready/required.sh

@@ -1,10 +1,9 @@
-# Sourced by evaluate-checks.sh. The unit/lint/type-check checks gate every PR.
-# The e2e + e2e-ui suites also gate PRs, but only run with secrets on same-repo
-# PRs (maintainer branches); fork PRs cannot read the LLM_API_KEY /
-# GATEWAY_BASE_URL secrets, so their e2e jobs skip via a workflow fork guard.
-# The e2e and integration check names are therefore in BOTH REQUIRED (a
-# same-repo PR must pass them) and ALLOW_SKIP (a fork PR's skipped check still
-# satisfies the gate).
+# Sourced by evaluate-checks.sh. These checks gate every PR. e2e, e2e-ui, and
+# integration are mock-LLM (no secrets) and run on ALL PRs -- same-repo and fork
+# -- directly, like CI. They are in ALLOW_SKIP too because they are legitimately
+# absent in some runs: draft PRs (empty matrix) and path-ignored PRs (the
+# workflow doesn't run). The real-gateway e2e-ui tests run nightly only and are
+# NOT PR checks, so they are not listed here.
 # Generated file -- do not hand-edit; it is replaced wholesale on every sync.
 
 REQUIRED=(
@@ -22,6 +21,7 @@ REQUIRED=(
   "Pytest (server-rest)"
   "Pytest (spec-llms)"
   "Pytest (misc)"
+  "Pytest (databricks)"
   "E2E Tests (shard 0/4)"
   "E2E Tests (shard 1/4)"
   "E2E Tests (shard 2/4)"
@@ -48,6 +48,7 @@ ALLOW_SKIP=(
   "Pytest (server-rest)"
   "Pytest (spec-llms)"
   "Pytest (misc)"
+  "Pytest (databricks)"
   "E2E Tests (shard 0/4)"
   "E2E Tests (shard 1/4)"
   "E2E Tests (shard 2/4)"
@@ -63,9 +64,9 @@ ALLOW_SKIP=(
 is_allow_skip() { printf '%s\n' "${ALLOW_SKIP[@]}" | grep -qxF "$1"; }
 
 # Maps an ALLOW_SKIP check to the workflow that produces it, so
-# evaluate-checks.sh can tell a genuine skip (a CI Pytest shard path-skip, or
-# the fork guard skipping an e2e job) from a check that is merely absent
-# because its workflow is still queued or re-running.
+# evaluate-checks.sh can tell a genuine skip (a CI Pytest shard path-skip, or a
+# draft/path-ignored run) from a check that is merely absent because its
+# workflow is still queued or re-running.
 workflow_for() {
   case "$1" in
     "Pytest ("*)             echo "CI" ;;

.github/scripts/pr-template/format_body.py

@@ -40,6 +40,12 @@ def format_body(body: str) -> str:
     elif not _has_heading(body, "Summary"):
         body = f"## Summary\n\n{body}"
 
+    body = _append_section(
+        body,
+        "Test Plan",
+        "How was this change tested? Describe the steps, commands, or scenarios "
+        "used to verify it (autoformat added this section — please replace it).",
+    )
     body = _append_section(
         body,
         "ELI5",
@@ -54,9 +60,9 @@ def format_body(body: str) -> str:
     body = _append_section(body, "Test coverage", _checkbox_block(TEST_LABELS))
     body = _append_section(
         body,
-        "Coverage rationale",
-        "Autoformat added this section; please add commands run or explain why "
-        "coverage is sufficient.",
+        "Coverage notes",
+        "<!-- Optional; required if you checked 'Manual verification completed' "
+        "or 'Not applicable' above. -->",
     )
     return body.rstrip() + "\n"
 

.github/scripts/pr-template/validate.py

@@ -14,9 +14,9 @@ import sys
 
 REQUIRED_HEADINGS = (
     "Summary",
+    "Test Plan",
     "Type of change",
     "Test coverage",
-    "Coverage rationale",
 )
 
 TYPE_LABELS = (
@@ -40,10 +40,8 @@ TEST_LABELS = (
 PLACEHOLDER_FRAGMENTS = (
     "what changed and why",
     "check all that apply",
-    "describe the exact commands",
     "describe below",
-    "explain why",
-    "if you did not add or run tests",
+    "how was this change tested",
 )
 
 
@@ -121,6 +119,12 @@ def validate_pr_body(body: str) -> ValidationResult:
     elif _contains_placeholder(summary):
         errors.append("Summary still contains template placeholder text.")
 
+    test_plan = _meaningful_text(_section(body, spans, "Test Plan"))
+    if not test_plan:
+        errors.append("Test Plan must describe how the change was tested.")
+    elif _contains_placeholder(test_plan):
+        errors.append("Test Plan still contains template placeholder text.")
+
     type_section = _section(body, spans, "Type of change")
     missing_type_labels = _missing_labels(type_section, TYPE_LABELS)
     if missing_type_labels:
@@ -141,31 +145,19 @@ def validate_pr_body(body: str) -> ValidationResult:
     if not checked_tests:
         errors.append("Check at least one Test coverage checkbox.")
 
-    rationale = _meaningful_text(_section(body, spans, "Coverage rationale"))
-    if not rationale:
-        errors.append(
-            "Coverage rationale must explain tests run/added, or why more coverage is not needed."
-        )
-    elif _contains_placeholder(rationale):
-        errors.append("Coverage rationale still contains template placeholder text.")
-
-    automated_tests = {
-        "Unit tests added / updated",
-        "Integration tests added / updated",
-        "E2E tests added / updated",
-        "Existing tests cover this change",
-    }
-    if checked_tests and checked_tests.isdisjoint(automated_tests):
-        if len(rationale.split()) < 8:
+    # Coverage notes are optional in general, but required whenever "Manual
+    # verification completed" or "Not applicable" is checked — those choices
+    # need a written justification.
+    if checked_tests & {"Manual verification completed", "Not applicable"}:
+        coverage_notes = _meaningful_text(_section(body, spans, "Coverage notes"))
+        if not coverage_notes:
             errors.append(
-                "When no automated test coverage checkbox is selected, "
-                "the rationale must explain why."
+                "Coverage notes are required when 'Manual verification completed' or "
+                "'Not applicable' is selected — describe what you verified or why "
+                "automated coverage is not needed."
             )
-
-    if "Not applicable" in checked_tests and rationale and len(rationale.split()) < 8:
-        errors.append(
-            "Not applicable test coverage requires a concrete explanation in Coverage rationale."
-        )
+        elif _contains_placeholder(coverage_notes):
+            errors.append("Coverage notes still contains template placeholder text.")
 
     return ValidationResult(ok=not errors, errors=errors)
 

.github/scripts/security-scan/exfil-scan.py

@@ -4,9 +4,8 @@
 Part of the single contributor Security Scan (.github/workflows/security-scan.yml),
 the companion to secret-scan.py: that one flags secrets a PR *commits*, this one
 flags code a PR adds to *steal* the CI secrets it runs with (the test-gateway
-token, GITHUB_TOKEN). It is the detector the fork-e2e mirror relied on before the
-scan was unified -- the mirror runs contributor code with the gateway secret, so
-an env-secret read piped to the network is the shape that matters there.
+token, GITHUB_TOKEN) -- an env-secret read piped to the network is the shape that
+matters.
 
 It reads diff TEXT only -- it never checks out or executes the PR's code -- so it
 is safe on any event. It is defense-in-depth + a reviewer aid, NOT a guarantee:

.github/scripts/security-scan/should-scan.sh

@@ -12,10 +12,8 @@
 # does not vouch for the contents of this one) and first-timers
 # (FIRST_TIME_CONTRIBUTOR / NONE).
 #
-# This gate is independent of fork-e2e/should-mirror.sh: that one gates secret-
-# bearing e2e on a maintainer's approving PR review, whereas this gate
-# decides whether to inspect for attacks and so errs toward scanning more (it
-# scans returning CONTRIBUTORs that the label gate would not by itself run).
+# This gate decides whether to inspect a PR for attacks and errs toward scanning
+# more (it scans returning CONTRIBUTORs, not just first-timers).
 #
 # author_association is computed by GitHub from the actor's relationship to the
 # repo at event time; it is not attacker-settable from PR contents.
@@ -70,9 +68,8 @@ has_skip_label() {
 }
 
 # Only PRs carry untrusted contributor code through the gate. Every other
-# trigger -- push to main / fork-e2e/** (the mirror branch only exists after a
-# returning-contributor / maintainer-approval gate), schedule, dispatch -- is a
-# trusted context, so proceed without scanning. pull_request_review is still
+# trigger -- push to main, schedule, dispatch -- is a trusted context, so
+# proceed without scanning. pull_request_review is still
 # accepted (it carries the same pull_request + author_association fields, so the
 # gate evaluates identically) in case a workflow_call caller is wired to it, but
 # no workflow triggers a scan on review any more: the skip-security-scan waiver

.github/triage/config.yaml

@@ -32,7 +32,7 @@ prompt: |
   ```
   {
     "type": "bug" | "enhancement" | "documentation" | null,
-    "components": ["comp:server" | "comp:runner" | "comp:repr" | "comp:web-ui" | "comp:policies" | "comp:harnesses" | "comp:infra"],
+    "components": ["comp:server" | "comp:runner" | "comp:repr" | "comp:web-ui" | "comp:tui" | "comp:policies" | "comp:harnesses" | "comp:infra"],
     "priority": "P0-critical" | "P1-high" | "P2-medium" | "P3-low" | null,
     "needs_info": true | false,
     "help_wanted": true | false,
@@ -58,6 +58,7 @@ prompt: |
   - `comp:runner` — the agent runner, execution engine
   - `comp:repr` — serialization, representation layer
   - `comp:web-ui` — the web frontend (ap-web)
+  - `comp:tui` — the terminal UI, REPL, and CLI
   - `comp:policies` — safety policies, guardrails
   - `comp:harnesses` — SDK harnesses (Claude, Cursor, Antigravity, etc.)
   - `comp:infra` — CI/CD, GitHub Actions workflows, Docker, deployment, packaging
@@ -66,8 +67,19 @@ prompt: |
   **priority**:
   - `P0-critical` — service down, data loss, security vulnerability
   - `P1-high` — major feature broken, no workaround
-  - `P2-medium` — bug with workaround, or important feature request
-  - `P3-low` — minor issue, cosmetic, nice-to-have
+  - `P2-medium` — a bug with a workaround, OR a substantive feature
+    request. A feature request is substantive (P2) when it adds a real new
+    capability — e.g. support for a new harness / provider / model /
+    integration, a new tool, or a new user-facing workflow. **P2 is the
+    default for feature requests**, and equivalent requests must get the
+    same priority (e.g. "add harness X" and "add harness Y" are both P2).
+  - `P3-low` — ONLY genuinely minor things: minor or cosmetic bugs, small
+    UI/UX polish, trivial conveniences, or narrowly-scoped nice-to-haves that
+    add no real new capability. Do NOT drop a feature to P3 just because it
+    isn't urgent or you personally judge demand to be low — a new
+    capability/integration is P2 even if non-urgent.
+
+  When you are unsure between P2 and P3 for a feature request, choose P2.
 
   **help_wanted** — `true` if the issue could benefit from community
   contribution.

.github/workflows/ap-web-tests.yml

@@ -39,7 +39,7 @@ jobs:
 
     steps:
       - name: Check out repo
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
 
       - name: Set up Node.js
         uses: ./.github/actions/setup-node

.github/workflows/auto-assign-reviewer-test.yml

@@ -26,7 +26,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 5
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
         with:
           persist-credentials: false
       - name: Run reviewer-assignment unit test

.github/workflows/auto-assign-reviewer.js

@@ -1,4 +1,4 @@
-// Repo-level reviewer assignment: assign EXACTLY 2 load-balanced reviewers to
+// Repo-level reviewer assignment: assign EXACTLY 1 load-balanced reviewer to
 // FORK PRs authored by a NON-maintainer, preferring the owners of the area(s)
 // the PR touches.
 //
@@ -21,7 +21,7 @@
 // so a manually-added reviewer outside that set is left untouched.
 module.exports = async ({ github, context, core }) => {
   const fs = require("fs");
-  const TARGET = 2;
+  const TARGET = 1;
   const { owner, repo } = context.repo;
   const pr = context.payload.pull_request;
   if (!pr || pr.draft) {
@@ -130,8 +130,8 @@ module.exports = async ({ github, context, core }) => {
     return out;
   };
 
-  // Desired = 2 lowest-load from candidates; top up from the full pool if an
-  // area has fewer than 2 owners.
+  // Desired = 1 lowest-load from candidates; top up from the full pool if an
+  // area has fewer than 1 owner.
   let desired = takeLowest(candidates, TARGET);
   if (desired.length < TARGET) {
     const have = new Set(desired.map((u) => u.toLowerCase()).concat(author));
@@ -142,7 +142,7 @@ module.exports = async ({ github, context, core }) => {
 
   // --- Reconcile current requested reviewers to exactly `desired`. Normally
   // nothing is pre-requested, but on a reopened PR (or after a manual add) this
-  // keeps the set at the 2 balanced picks.
+  // keeps the set at the 1 balanced pick.
   const current = (pr.requested_reviewers || []).map((r) => r.login);
   const currentLc = new Set(current.map((c) => c.toLowerCase()));
   const toAdd = desired.filter((u) => !currentLc.has(u.toLowerCase()));
@@ -162,8 +162,30 @@ module.exports = async ({ github, context, core }) => {
       owner, repo, pull_number: pr.number, reviewers: toRemove,
     });
   }
+
+  // --- Also sync assignees to mirror the desired reviewer set so PRs are
+  // filterable by assignee in the GitHub UI.
+  const currentAssignees = (pr.assignees || []).map((a) => a.login);
+  const currentAssigneesLc = new Set(currentAssignees.map((a) => a.toLowerCase()));
+  const toAddAssignees = desired.filter((u) => !currentAssigneesLc.has(u.toLowerCase()));
+  const toRemoveAssignees = currentAssignees.filter(
+    (u) => managed.has(u.toLowerCase()) && !desiredLc.has(u.toLowerCase())
+  );
+
+  if (toAddAssignees.length) {
+    await github.rest.issues.addAssignees({
+      owner, repo, issue_number: pr.number, assignees: toAddAssignees,
+    });
+  }
+  if (toRemoveAssignees.length) {
+    await github.rest.issues.removeAssignees({
+      owner, repo, issue_number: pr.number, assignees: toRemoveAssignees,
+    });
+  }
+
   core.info(
     `Reviewers -> [${desired.join(", ")}]` +
-      ` (area pool ${areaOwners.size || "∅→full"}, +${toAdd.length}/-${toRemove.length}).`
+      ` (area pool ${areaOwners.size || "∅→full"}, +${toAdd.length}/-${toRemove.length})` +
+      ` | Assignees +${toAddAssignees.length}/-${toRemoveAssignees.length}.`
   );
 };

.github/workflows/auto-assign-reviewer.test.js

@@ -15,19 +15,25 @@ function mkOpenPRs(loadMap) {
 
 // author defaults to a non-maintainer; fork defaults to true -- so the scope
 // guard passes and the selection logic runs (the cases that assert on picks).
-async function run({ files, load = {}, current = [], author = "someexternaldev", fork = true }) {
+async function run({ files, load = {}, current = [], currentAssignees = [], author = "someexternaldev", fork = true }) {
   const listFiles = () => {}; listFiles._tag = "files";
   const list = () => {}; list._tag = "open";
-  const added = [], removed = [];
+  const added = [], removed = [], assigned = [], unassigned = [];
   const github = {
     paginate: async (fn) => (fn._tag === "files"
       ? files.map((f) => ({ filename: f }))
       : mkOpenPRs(load)),
-    rest: { pulls: {
-      listFiles, list,
-      requestReviewers: async ({ reviewers }) => added.push(...reviewers),
-      removeRequestedReviewers: async ({ reviewers }) => removed.push(...reviewers),
-    } },
+    rest: {
+      pulls: {
+        listFiles, list,
+        requestReviewers: async ({ reviewers }) => added.push(...reviewers),
+        removeRequestedReviewers: async ({ reviewers }) => removed.push(...reviewers),
+      },
+      issues: {
+        addAssignees: async ({ assignees }) => assigned.push(...assignees),
+        removeAssignees: async ({ assignees }) => unassigned.push(...assignees),
+      },
+    },
   };
   const context = {
     repo: { owner: "omnigent-ai", repo: "omnigent" },
@@ -38,11 +44,12 @@ async function run({ files, load = {}, current = [], author = "someexternaldev",
       head: { repo: { full_name: fork ? "external-contributor/omnigent" : "omnigent-ai/omnigent" } },
       base: { repo: { full_name: "omnigent-ai/omnigent" } },
       requested_reviewers: current.map((l) => ({ login: l })),
+      assignees: currentAssignees.map((l) => ({ login: l })),
     } },
   };
   const core = { info: () => {}, warning: (m) => console.log("WARN", m) };
   await script({ github, context, core });
-  return { added: added.sort(), removed: removed.sort() };
+  return { added: added.sort(), removed: removed.sort(), assigned: assigned.sort(), unassigned: unassigned.sort() };
 }
 
 function assert(name, cond, detail) {
@@ -52,35 +59,40 @@ function assert(name, cond, detail) {
 
 (async () => {
   // 1. inner PR: owners SabhyaC26,TomeHirata,dhruv0811,dbczumar. Loads make the
-  //    two lowest deterministic: dhruv0811(0), dbczumar(1) win.
+  //    single lowest deterministic: dhruv0811(0) wins.
   let r = await run({
     files: ["omnigent/inner/foo.py"],
     load: { SabhyaC26: 5, TomeHirata: 4, dhruv0811: 0, dbczumar: 1 },
   });
-  assert("inner picks 2 lowest-load owners", JSON.stringify(r.added) === JSON.stringify(["dbczumar", "dhruv0811"]), JSON.stringify(r));
+  assert("inner picks the lowest-load owner", JSON.stringify(r.added) === JSON.stringify(["dhruv0811"]), JSON.stringify(r));
+  assert("inner: reviewer also added as assignee", JSON.stringify(r.assigned) === JSON.stringify(["dhruv0811"]), JSON.stringify(r));
 
-  // 2. unowned path -> full pool; lowest two by load chosen.
+  // 2. unowned path -> full pool; lowest by load chosen.
   r = await run({
     files: ["README.md"],
     load: { PattaraS: 9, "serena-ruan": 9, dhruv0811: 9, TomeHirata: 9, SabhyaC26: 9,
-            "daniellok-db": 9, hzub: 0, dbczumar: 1, fanzeyi: 9, "ckcuslife-source": 9,
+            "daniellok-db": 9, dbczumar: 0, fanzeyi: 9, "ckcuslife-source": 9,
             bbqiu: 9, Edwinhe03: 9 },
   });
-  assert("unowned -> 2 lowest from full pool", JSON.stringify(r.added) === JSON.stringify(["dbczumar", "hzub"]), JSON.stringify(r));
+  assert("unowned -> lowest from full pool", JSON.stringify(r.added) === JSON.stringify(["dbczumar"]), JSON.stringify(r));
 
-  // 3. db has only 2 owners (fanzeyi, SabhyaC26) -> both selected.
-  r = await run({ files: ["omnigent/db/x.py"], load: {} });
-  assert("db (2 owners) -> both", JSON.stringify(r.added) === JSON.stringify(["SabhyaC26", "fanzeyi"]), JSON.stringify(r));
+  // 3. db area (fanzeyi, SabhyaC26) -> the lower-load one selected.
+  r = await run({ files: ["omnigent/db/x.py"], load: { SabhyaC26: 1 } });
+  assert("db -> lowest-load owner", JSON.stringify(r.added) === JSON.stringify(["fanzeyi"]), JSON.stringify(r));
 
-  // 4. reconcile: all 4 inner owners already requested; keep 2 lowest-load,
-  //    remove the other 2.
+  // 4. reconcile: all 4 inner owners already requested; keep the lowest-load,
+  //    remove the other 3.
   r = await run({
     files: ["omnigent/inner/foo.py"],
     load: { SabhyaC26: 5, TomeHirata: 4, dhruv0811: 0, dbczumar: 1 },
     current: ["SabhyaC26", "TomeHirata", "dhruv0811", "dbczumar"],
+    currentAssignees: ["SabhyaC26", "TomeHirata", "dhruv0811", "dbczumar"],
   });
-  assert("reconcile removes the 2 highest-load already-requested",
-    JSON.stringify(r.removed) === JSON.stringify(["SabhyaC26", "TomeHirata"]) && r.added.length === 0,
+  assert("reconcile removes the 3 higher-load already-requested",
+    JSON.stringify(r.removed) === JSON.stringify(["SabhyaC26", "TomeHirata", "dbczumar"]) && r.added.length === 0,
+    JSON.stringify(r));
+  assert("reconcile: removes the 3 stale assignees, keeps dhruv0811",
+    JSON.stringify(r.unassigned) === JSON.stringify(["SabhyaC26", "TomeHirata", "dbczumar"]) && r.assigned.length === 0,
     JSON.stringify(r));
 
   // 5. mixed current: a managed reviewer not in `desired` is removed, while an
@@ -89,30 +101,36 @@ function assert(name, cond, detail) {
     files: ["omnigent/inner/foo.py"],
     load: { dhruv0811: 0, dbczumar: 1, SabhyaC26: 5, TomeHirata: 4 },
     current: ["SabhyaC26", "some-external-human"],
+    currentAssignees: ["SabhyaC26", "some-external-human"],
   });
   assert("mixed: managed removed, external preserved",
     r.removed.includes("SabhyaC26") &&
     !r.removed.includes("some-external-human") &&
-    JSON.stringify(r.added) === JSON.stringify(["dbczumar", "dhruv0811"]),
+    JSON.stringify(r.added) === JSON.stringify(["dhruv0811"]),
+    JSON.stringify(r));
+  assert("mixed: new reviewer assigned, stale managed assignee removed, external assignee preserved",
+    JSON.stringify(r.assigned) === JSON.stringify(["dhruv0811"]) &&
+    r.unassigned.includes("SabhyaC26") &&
+    !r.unassigned.includes("some-external-human"),
     JSON.stringify(r));
 
-  // 6. single-owner area (sandbox -> @SabhyaC26): tops up to 2 from the pool.
+  // 6. single-owner area (sandbox -> @SabhyaC26): the lone owner is selected.
   r = await run({
     files: ["omnigent/sandbox/x.py"],
     load: { SabhyaC26: 0, hzub: 0, dhruv0811: 9, dbczumar: 9, TomeHirata: 9, PattaraS: 9,
             "serena-ruan": 9, "daniellok-db": 9, fanzeyi: 9, "ckcuslife-source": 9, bbqiu: 9, Edwinhe03: 9 },
   });
-  assert("single-owner area tops up to 2",
-    r.added.length === 2 && r.added.includes("SabhyaC26"), JSON.stringify(r));
+  assert("single-owner area picks that owner",
+    JSON.stringify(r.added) === JSON.stringify(["SabhyaC26"]), JSON.stringify(r));
 
-  // 7. multi-area PR (inner + tools): candidate pool is the UNION; a tools-only
-  //    owner (PattaraS) and an inner owner (dhruv0811) can both be picked.
+  // 7. multi-area PR (inner + tools): candidate pool is the UNION; the lowest-load
+  //    across both areas wins -- here a tools-only owner (PattaraS).
   r = await run({
     files: ["omnigent/inner/a.py", "omnigent/tools/b.py"],
     load: { SabhyaC26: 9, TomeHirata: 9, dbczumar: 9, PattaraS: 0, dhruv0811: 1 },
   });
   assert("multi-area unions both areas' owners",
-    r.added.includes("PattaraS") && r.added.includes("dhruv0811") && r.added.length === 2,
+    JSON.stringify(r.added) === JSON.stringify(["PattaraS"]),
     JSON.stringify(r));
 
   // 8. scope guard: non-fork PR -> nothing assigned.

.github/workflows/auto-assign-reviewer.yml

@@ -1,6 +1,6 @@
 name: Auto-assign Reviewer
 
-# Repo-level reviewer assignment: assign EXACTLY 2 load-balanced reviewers to
+# Repo-level reviewer assignment: assign EXACTLY 1 load-balanced reviewer to
 # FORK PRs authored by a non-maintainer, preferring the owners of the area(s) the
 # PR touches. No org team required. Ownership is read from .github/reviewers at
 # runtime -- a custom, non-magic path (NOT .github/CODEOWNERS), so GitHub's
@@ -46,12 +46,12 @@ jobs:
       # Trusted default branch only (.github sparse). Never the PR head, so no
       # PR-authored code runs.
       - name: Check out .github
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
         with:
           ref: ${{ github.event.repository.default_branch }}
           sparse-checkout: .github
           persist-credentials: false
-      - name: Assign 2 balanced reviewers from the .github/reviewers pool
+      - name: Assign 1 balanced reviewer from the .github/reviewers pool
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd  # v8.0.0
         with:
           retries: 3

.github/workflows/autoformat-pr.yml

@@ -30,7 +30,7 @@ jobs:
 
     steps:
       - name: Checkout default-branch helper
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
         with:
           ref: ${{ github.event.repository.default_branch }}
           sparse-checkout: .github/scripts/pr-template

.github/workflows/bump-version.yml

@@ -0,0 +1,126 @@
+name: Bump Version
+
+# Bumps the project version across ALL lockstep locations in one PR:
+# the three pyproject.toml files (each package's [project].version plus
+# its sibling ==pins) and the regenerated uv.lock. Modeled on MLflow's
+# dev/update_mlflow_versions.py (pre-release / post-release), adapted to
+# this repo's three-package layout.
+#
+# scripts/update_versions.py does the deterministic text edits (anchored
+# on package name, so unrelated version literals are never touched);
+# this workflow wraps it with `uv lock`, a consistency check, and an
+# auto-opened PR.
+#
+# NOTE: the PR is created with GITHUB_TOKEN, so by GitHub policy it does
+# NOT trigger other workflows (CI won't auto-run on it). Push an empty
+# commit or re-open the PR to kick CI, or swap in a PAT if that matters.
+
+on:
+  workflow_dispatch:
+    inputs:
+      mode:
+        description: "pre-release = stamp new_version exactly. post-release = set main to the next .dev0 after releasing new_version."
+        required: true
+        type: choice
+        options:
+          - pre-release
+          - post-release
+        default: pre-release
+      new_version:
+        description: "Target version (pre-release) or just-released version (post-release), e.g. 0.1.2 or 0.1.2rc1"
+        required: true
+      base_branch:
+        description: "Branch to base the bump PR on"
+        required: false
+        default: main
+
+concurrency:
+  group: bump-version-${{ github.event.inputs.new_version }}
+  cancel-in-progress: false
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  bump:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
+        with:
+          ref: ${{ github.event.inputs.base_branch }}
+          fetch-depth: 0
+
+      - name: Set up Python
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065  # v5
+        with:
+          python-version-file: ".python-version"
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@38f3f104447c67c051c4a08e39b64a148898af3a  # v4
+        with:
+          enable-cache: true
+
+      - name: Bump versions
+        env:
+          # Bind untrusted inputs to env and validate before use; never
+          # interpolate ${{ }} into the shell (mirrors e2e.yml hardening).
+          MODE: ${{ github.event.inputs.mode }}
+          NEW_VERSION: ${{ github.event.inputs.new_version }}
+        run: |
+          case "$MODE" in
+            pre-release|post-release) ;;
+            *) echo "Invalid mode: $MODE" >&2; exit 1 ;;
+          esac
+          # Conservative PEP 440 shape: release, a/b/rc pre-release, or .devN/.postN.
+          if ! [[ "$NEW_VERSION" =~ ^[0-9]+\.[0-9]+(\.[0-9]+)?((a|b|rc)[0-9]+)?(\.post[0-9]+)?(\.dev[0-9]+)?$ ]]; then
+            echo "Invalid version: $NEW_VERSION" >&2; exit 1
+          fi
+          uv run --no-project --python 3.12 --with packaging \
+            python scripts/update_versions.py "$MODE" --new-version "$NEW_VERSION"
+
+      - name: Regenerate lockfile
+        run: uv lock
+
+      - name: Verify all locations agree
+        run: uv run --no-project --python 3.12 --with packaging python scripts/update_versions.py check
+
+      - name: Open bump PR
+        env:
+          GH_TOKEN: ${{ github.token }}
+          MODE: ${{ github.event.inputs.mode }}
+          NEW_VERSION: ${{ github.event.inputs.new_version }}
+          BASE: ${{ github.event.inputs.base_branch }}
+        run: |
+          # The resolved version is what landed in the files (in post-release
+          # mode it's the computed .dev0, not the input).
+          resolved="$(uv run --no-project --python 3.12 --with packaging \
+            python scripts/update_versions.py check)"
+          branch="bot/bump-version-${resolved}"
+
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git switch -c "$branch"
+          git add -A
+          if git diff --cached --quiet; then
+            echo "::notice::No version changes to commit (already at ${resolved})."
+            exit 0
+          fi
+          git commit -s -m "Bump version to ${resolved}"
+          git push --force-with-lease origin "$branch"
+
+          existing="$(gh pr list --head "$branch" --base "$BASE" --json number --jq '.[0].number')"
+          if [ -n "$existing" ]; then
+            echo "::notice::PR #${existing} already open for ${branch}; pushed update."
+            exit 0
+          fi
+          gh pr create \
+            --base "$BASE" \
+            --head "$branch" \
+            --title "Bump version to ${resolved}" \
+            --body "Automated version bump via \`.github/workflows/bump-version.yml\` (mode: \`${MODE}\`, input: \`${NEW_VERSION}\`).
+
+          Rewrote \`[project].version\` and sibling \`==\` pins across all three packages (\`pyproject.toml\`, \`sdks/python-client\`, \`sdks/ui\`) and regenerated \`uv.lock\`.
+
+          Generated by \`scripts/update_versions.py\`. CI does not auto-trigger on GITHUB_TOKEN PRs — re-open or push to run it."

.github/workflows/ci.yml

@@ -112,10 +112,18 @@ jobs:
               --ignore=tests/spec
               --ignore=tests/llms
               --ignore=tests/codex_parity
+          # Databricks-coupled tests (Lakebase token engine, psycopg). This is
+          # the only lane that installs the `databricks` extra; the
+          # @pytest.mark.databricks marker keeps these tests off the lean lanes
+          # (which run -m "not databricks") and selects them here.
+          - group: databricks
+            paths: tests/db tests/deploy
+            extra: databricks
+            markexpr: databricks
 
     steps:
       - name: Check out repo
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
 
       - name: Set up Python
         uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065  # v5
@@ -144,13 +152,13 @@ jobs:
           key: venv-${{ runner.os }}-${{ hashFiles('.python-version') }}-${{ hashFiles('uv.lock') }}
 
       - name: Install dependencies
-        run: uv sync --extra all --extra dev
+        # matrix.extra (e.g. "databricks") adds an extra for lanes that need it;
+        # empty for the default lanes.
+        run: uv sync --locked --extra all --extra dev ${{ matrix.extra && format('--extra {0}', matrix.extra) || '' }}
 
       - name: Run pytest
         shell: bash
         env:
-          # force-all-tests label bypasses tests/known_failures.yaml.
-          FORCE_ALL_TESTS: ${{ contains(github.event.pull_request.labels.*.name, 'force-all-tests') }}
           PYTHONFAULTHANDLER: "1"
           PYTEST_PROGRESS_LOG_DIR: artifacts/progress
           OMNIGENT_TOKEN_USAGE_JSON: artifacts/tokens-${{ matrix.group }}.json
@@ -163,22 +171,17 @@ jobs:
           COVERAGE_CORE: sysmon
         run: |
           mkdir -p artifacts artifacts/progress "$(dirname "$COVERAGE_FILE")"
-          EXTRA_ARGS=()
-          if [[ "$FORCE_ALL_TESTS" == "true" ]]; then
-            EXTRA_ARGS=(--no-skip-known)
-            echo "::notice::force-all-tests label present; bypassing tests/known_failures.yaml"
-          fi
           # matrix.paths is unquoted on purpose: it word-splits into pytest args.
           # shellcheck disable=SC2086
           env -u OPENAI_API_KEY -u ANTHROPIC_API_KEY -u DATABRICKS_TOKEN \
             uv run pytest ${{ matrix.paths }} \
+              -m "${{ matrix.markexpr || 'not databricks' }}" \
               -n ${{ matrix.workers || '8' }} \
               --dist=${{ matrix.dist || 'loadfile' }} \
               --timeout=${{ matrix.timeout || '300' }} \
               --junitxml=artifacts/pytest-${{ matrix.group }}.xml \
               --cov=omnigent --cov-report= \
               -v --tb=long --showlocals --log-level=INFO -r a \
-              "${EXTRA_ARGS[@]}" \
               || { rc=$?; [ "$rc" -eq 5 ] && echo "::notice::No tests collected in this shard; treating as a pass." || exit "$rc"; }
 
       - name: Stage coverage data for upload
@@ -209,7 +212,7 @@ jobs:
     timeout-minutes: 30
     steps:
       - name: Check out repo
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
 
       - name: Set up Python
         uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065  # v5
@@ -249,7 +252,7 @@ jobs:
           key: venv-${{ runner.os }}-${{ hashFiles('.python-version') }}-${{ hashFiles('uv.lock') }}
 
       - name: Install dependencies
-        run: uv sync --extra all --extra dev
+        run: uv sync --locked --extra all --extra dev
 
       - name: Build parity sidecar
         run: |
@@ -289,7 +292,7 @@ jobs:
     timeout-minutes: 10
     steps:
       - name: Check out repo
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
         with:
           persist-credentials: false
 

.github/workflows/duplicate-prs-test.yml

@@ -24,7 +24,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 5
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
         with:
           persist-credentials: false
       - name: Run duplicate-PR unit test

.github/workflows/duplicate-prs.yml

@@ -34,7 +34,7 @@ jobs:
       # Trusted default branch only (.github sparse). Pin the ref explicitly so
       # manual workflow_dispatch runs can't execute a script from another
       # branch. Never the PR head, so no PR-authored code runs.
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
         with:
           ref: ${{ github.event.repository.default_branch }}
           persist-credentials: false

.github/workflows/e2e-ui-required.yml

@@ -49,7 +49,7 @@ jobs:
     timeout-minutes: 5
     steps:
       - name: Check out gate scripts from main
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
         with:
           ref: main             # trusted base; never the PR head
           sparse-checkout: .github/scripts

.github/workflows/e2e-ui.yml

@@ -1,14 +1,14 @@
 name: E2E UI Tests
 
-# Runs the Playwright UI suite against a freshly built ap-web SPA + a
-# hello_world test agent, split across a 3-shard matrix. Separate from
-# nightly.yml because the Node + Playwright + SPA-build setup is disjoint
-# from the inner-only legs.
+# Runs the Playwright UI suite against a freshly built ap-web SPA, split across
+# a 3-shard matrix. The whole suite (including the native Claude/Codex/Cursor
+# render-parity tests) runs against the in-process mock LLM and needs NO
+# secrets, so it runs on ALL PRs -- same-repo AND fork -- directly, like ci.yml.
+# (The native_*_mock_session fixtures use the real gateway only when LLM_API_KEY
+# is set, e.g. local dev; CI never sets it.)
 #
 # Triggers:
-#   pull_request        SAME-REPO PRs only; draft / fork PRs skip the job
-#                       (forks run via the fork-e2e/** push after approval).
-#   push (fork-e2e/**)  UI suite for mirrored fork PRs (trusted, secrets flow).
+#   pull_request        ALL PRs (same-repo + fork). Draft PRs skip.
 #   schedule            09:00 UTC daily, alongside nightly.yml.
 #   workflow_dispatch   manual run. Input `branch` selects a non-main ref.
 
@@ -18,9 +18,6 @@ on:
     # Security Gate via rerun-security-gate.yml, so label churn need not re-run
     # the heavy Playwright suite. (#399 added these for the gate; superseded.)
     types: [opened, synchronize, reopened, ready_for_review]
-  push:
-    branches:
-      - 'fork-e2e/**'
   schedule:
     - cron: "0 9 * * *"
   workflow_dispatch:
@@ -44,10 +41,10 @@ env:
   # dedicated step, so the setup.py build would be a redundant npm hit.
   OMNIGENT_SKIP_WEB_UI: "true"
   # Scrub harness credentials the test server must not pick up.
-  # OPENAI_API_KEY / OPENAI_BASE_URL are NOT scrubbed here -- the "Run UI
-  # e2e tests" step sets them to the Databricks bearer + serving-endpoints
-  # URL so the spawned openai-agents hello_world agent can authenticate
-  # (the ~/.databrickscfg fallback didn't resolve our OAuth M2M in CI).
+  # OPENAI_API_KEY / OPENAI_BASE_URL are NOT scrubbed here — the
+  # conftest's live_server fixture overrides them to mock values
+  # (OPENAI_BASE_URL=<mock>/v1, OPENAI_API_KEY=mock-key) inside the
+  # spawned server subprocess, so ambient real credentials are a no-op.
   ANTHROPIC_API_KEY: ""
   DATABRICKS_TOKEN: ""
   CODEX: ""
@@ -77,7 +74,7 @@ jobs:
       matrix: ${{ steps.matrix.outputs.matrix }}
     steps:
       - name: Check out CI scripts
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
         with:
           # Triggering ref (not main): the script must exist on it, and it
           # only shards tests -- no secrets exposure, so the PR's copy is fine.
@@ -88,14 +85,13 @@ jobs:
         env:
           EVENT_NAME: ${{ github.event_name }}
           IS_DRAFT: ${{ github.event.pull_request.draft }}
-          IS_FORK: ${{ github.event.pull_request.head.repo.fork }}
           NUM_SHARDS: "3"
         run: bash .github/scripts/ci/e2e-shard-matrix.sh
 
   e2e-ui:
     name: E2E UI Tests (shard ${{ matrix.shard_id }}/${{ matrix.num_shards }})
-    # Draft / fork pull_request events resolve to an EMPTY matrix in `setup`
-    # (forks run via the fork-e2e/** mirror push), so no shard runs for them.
+    # Draft PRs resolve to an EMPTY matrix in `setup`, so no shard runs for
+    # them. Fork PRs DO run (mock LLM, no secrets) -- same as ci.yml.
     # `ready_for_review` re-fires when a draft is converted.
     needs: setup
     runs-on: ubuntu-latest
@@ -110,7 +106,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
         with:
           ref: ${{ github.event.inputs.branch || github.ref }}
 
@@ -132,11 +128,8 @@ jobs:
         with:
           path: .venv
           key: venv-${{ runner.os }}-${{ hashFiles('.python-version') }}-${{ hashFiles('uv.lock') }}
-      - name: Set LLM credentials
-        run: echo "LLM_API_KEY=${{ secrets.LLM_API_KEY }}" >> "$GITHUB_ENV"
-
       - name: Install project + dev extras
-        run: uv sync --extra all --extra dev
+        run: uv sync --locked --extra all --extra dev
 
       - name: Install bubblewrap + tmux
         # bubblewrap: the UI tests open terminals under os_env, whose
@@ -200,78 +193,33 @@ jobs:
           NPM_CONFIG_REGISTRY: https://registry.npmjs.org/
         run: |
           mkdir -p "${GITHUB_WORKSPACE}/.codex-cli" && cd "${GITHUB_WORKSPACE}/.codex-cli"
-          npm install --ignore-scripts --no-audit --no-fund @openai/codex@0.128.0-alpha.1
+          npm install --ignore-scripts --no-audit --no-fund @openai/codex@0.139.0
           echo "${GITHUB_WORKSPACE}/.codex-cli/node_modules/.bin" >> "$GITHUB_PATH"
 
-      - name: Configure native-claude/codex gateway provider
-        # The native CLIs derive their gateway auth from omnigent provider
-        # config. Register the Databricks gateway as the default for both
-        # anthropic (Claude Code) and openai (Codex); the token reaches each
-        # CLI via an env:LLM_API_KEY ref, so no literal secret hits disk.
-        env:
-          GATEWAY_BASE_URL: ${{ secrets.GATEWAY_BASE_URL }}
-          LLM_API_KEY: ${{ secrets.LLM_API_KEY }}
-        run: |
-          mkdir -p "$HOME/.omnigent"
-          # The Anthropic Messages surface and the Codex Responses surface live
-          # at different paths off the same workspace host. GATEWAY_BASE_URL is
-          # <host>/serving-endpoints (the OpenAI-compatible surface); strip that
-          # suffix to recover the bare host for the codex /ai-gateway path.
-          host="${GATEWAY_BASE_URL%/serving-endpoints}"
-          cat > "$HOME/.omnigent/config.yaml" <<EOF
-          providers:
-            databricks-gateway:
-              kind: gateway
-              default: [anthropic, openai]
-              anthropic:
-                # Databricks serves the Anthropic Messages surface at
-                # <host>/serving-endpoints/anthropic (see
-                # omnigent/inner/pi_executor.py: claude_base_url). GATEWAY_BASE_URL
-                # is <host>/serving-endpoints (the OpenAI-compatible surface), so
-                # the /anthropic suffix is required — without it Claude Code POSTs
-                # to .../serving-endpoints/v1/messages and gets no reply.
-                base_url: "${GATEWAY_BASE_URL}/anthropic"
-                api_key_ref: "env:LLM_API_KEY"
-                # The default model id is read from models.default (not a
-                # top-level default_model key). Without it the provider
-                # resolves model=None, Claude Code launches with no --model and
-                # falls back to its built-in 'claude-sonnet-4-6', which the
-                # Databricks gateway rejects (the endpoint name is the
-                # 'databricks-' prefixed id).
-                models:
-                  default: databricks-claude-sonnet-4-6
-              openai:
-                # Databricks serves the Codex Responses surface at
-                # <host>/ai-gateway/codex/v1 (see omnigent/inner/codex_executor.py:
-                # _databricks_codex_base_url), NOT the /serving-endpoints
-                # OpenAI-compatible surface. wire_api must be 'responses' — codex
-                # >= 0.137 rejects 'chat' at config load.
-                base_url: "${host}/ai-gateway/codex/v1"
-                api_key_ref: "env:LLM_API_KEY"
-                wire_api: responses
-                # The codex model id the e2e codex leg pins (tests/_model_pools).
-                models:
-                  default: databricks-gpt-5-4-mini
-          EOF
-
       - name: Run UI e2e tests
         # --ui-skip-build: the SPA was built in the previous step.
         # --tracing/--screenshot/--video default to off; retain-on-failure
         # keeps green runs cheap while capturing artifacts on failures.
-        # OPENAI_API_KEY / OPENAI_BASE_URL flow into the spawned server via
-        # the conftest's live_server fixture for the openai-agents harness.
+        # The conftest's live_server fixture injects OPENAI_BASE_URL=mock/v1
+        # and OPENAI_API_KEY=mock-key into the runner subprocess env, so the
+        # openai-agents harness and policy classifier both hit the mock — no
+        # real credentials needed. Native render-parity tests write their own
+        # mock provider config via native_*_mock_session at terminal-creation
+        # time, so no ~/.omnigent/config.yaml is written in CI either.
         env:
-          OPENAI_API_KEY: ${{ env.LLM_API_KEY }}
-          OPENAI_BASE_URL: ${{ secrets.GATEWAY_BASE_URL }}
           # Scheduled / manually dispatched runs are the full pass;
           # PR and push runs exclude @pytest.mark.nightly tests.
           NIGHTLY_FULL: ${{ github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' }}
           SHARD_ID: ${{ matrix.shard_id }}
           NUM_SHARDS: ${{ matrix.num_shards }}
         run: |
-          EXTRA_ARGS=()
+          # Always exclude @visual: the UI diff snapshot runs in its own
+          # pinned-runner gate (ui-snapshot.yml) so its baseline matches the
+          # comparison environment; on this unpinned ubuntu-latest it would
+          # flake on font drift. Add the nightly exclusion for PR/push runs.
+          MARKER="not visual"
           if [[ "$NIGHTLY_FULL" != "true" ]]; then
-            EXTRA_ARGS+=(-m "not nightly")
+            MARKER="$MARKER and not nightly"
           fi
           # --splits/--group partition the suite via a strided slice (see
           # pytest_collection_modifyitems in tests/e2e_ui/conftest.py), which
@@ -285,7 +233,7 @@ jobs:
             --tracing=retain-on-failure \
             --screenshot=only-on-failure \
             --video=retain-on-failure \
-            "${EXTRA_ARGS[@]}" \
+            -m "$MARKER" \
             || { rc=$?; [ "$rc" -eq 5 ] && echo "::notice::No tests collected in this shard; treating as a pass." || exit "$rc"; }
 
       - name: Upload Playwright traces / videos / screenshots on failure

.github/workflows/e2e.yml

@@ -1,30 +1,26 @@
 name: E2E Tests
 
-# Runs the `tests/e2e/` suite against a live LLM (Databricks gateway):
-# sub-agent spawning, parking, tunneled client tools, PATCH/GET routes.
+# Runs the `tests/e2e/` suite against the in-process mock LLM server.
+# All tests use mock LLM by default; real-credential tests skip cleanly
+# when no DATABRICKS_TOKEN is present.
 #
 # Triggers:
 #   schedule            09:00 UTC daily (alongside nightly.yml).
 #   workflow_dispatch   manual run. Inputs: `branch` (non-main ref) and
 #                       `parallelism` (pytest `-n` worker count).
-#   pull_request        PR gate for SAME-REPO PRs only. Fork PRs skip
-#                       here (no secrets) and run via the fork-e2e/**
-#                       push after a maintainer approves the PR and
-#                       fork-e2e-mirror.yml mirrors them. The four shard
-#                       checks are required by merge-ready.yml.
-#   push (fork-e2e/**)  e2e run for mirrored fork PRs (trusted branch,
-#                       so secrets flow).
+#   pull_request        PR gate for ALL PRs -- same-repo AND fork. This suite
+#                       runs entirely against the in-process mock LLM (no
+#                       secrets), so fork PRs run it directly here just like
+#                       ci.yml, with no fork-e2e/** mirror (#802 removed the
+#                       credential setup). The four shard checks are required by
+#                       merge-ready.yml.
 
 on:
   schedule:
     - cron: "0 9 * * *"
   pull_request:
     types: [opened, synchronize, reopened, ready_for_review, labeled, unlabeled]
-    paths-ignore: ['ap-web/**']
-  push:
-    branches:
-      - 'fork-e2e/**'
-    paths-ignore: ['ap-web/**']
+    paths-ignore: ['ap-web/**', 'tests/e2e_ui/**']
   workflow_dispatch:
     inputs:
       branch:
@@ -37,8 +33,8 @@ on:
         default: "2"
 
 concurrency:
-  # PRs key by number, dispatch by branch (so re-runs cancel); push /
-  # schedule key by SHA so each merge to `main` gets its own run.
+  # PRs key by number, dispatch by branch (so re-runs cancel); schedule keys
+  # by SHA so each merge to `main` gets its own run.
   group: e2e-${{ github.workflow }}-${{ github.event.pull_request.number || github.event.inputs.branch || github.sha }}
   cancel-in-progress: true
 
@@ -61,9 +57,8 @@ jobs:
   gate:
     uses: ./.github/workflows/security-gate.yml
 
-  # Compute the shard matrix once. A skipped run (draft / fork pull_request)
-  # yields an EMPTY matrix -> zero shard jobs -> no skipped placeholder check.
-  # Shared with e2e-ui.yml via e2e-shard-matrix.sh (only NUM_SHARDS differs).
+  # Shard matrix (e2e-shard-matrix.sh, shared with e2e-ui.yml). Fork PRs run by
+  # default; draft PRs resolve to an empty matrix.
   setup:
     name: setup
     needs: gate
@@ -73,7 +68,7 @@ jobs:
       matrix: ${{ steps.matrix.outputs.matrix }}
     steps:
       - name: Check out CI scripts
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
         with:
           # Triggering ref (not main): the script must exist on it, and it
           # only shards tests -- no secrets exposure, so the PR's copy is fine.
@@ -84,7 +79,6 @@ jobs:
         env:
           EVENT_NAME: ${{ github.event_name }}
           IS_DRAFT: ${{ github.event.pull_request.draft }}
-          IS_FORK: ${{ github.event.pull_request.head.repo.fork }}
           NUM_SHARDS: "4"
         run: bash .github/scripts/ci/e2e-shard-matrix.sh
 
@@ -95,10 +89,13 @@ jobs:
     # -n 2 per shard => 4 x 2 = 8 concurrent gateway calls, below the
     # nightly's 429 pain point; drop -n before max-parallel if rate-limited.
     name: E2E Tests (shard ${{ matrix.shard_id }}/${{ matrix.num_shards }})
-    # Draft / fork pull_request events resolve to an EMPTY matrix in `setup`
-    # (forks run via the fork-e2e/** mirror push), so no shard runs for them.
+    # Draft PRs resolve to an EMPTY matrix in `setup`, so no shard runs for
+    # them. Fork PRs DO run (mock LLM, no secrets) -- same as ci.yml.
     needs: setup
     runs-on: ubuntu-latest
+    # Job-level cap (composite-action run steps can't set timeout-minutes):
+    # ~30 min of tests + setup, replacing the old per-step 30-min backstop.
+    timeout-minutes: 35
     strategy:
       # One red shard shouldn't cancel siblings -- we want every shard's signal.
       fail-fast: false
@@ -108,168 +105,20 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
         with:
-          # Same-repo PRs test the merge result (refs/pull/N/merge -- absent
-          # when the PR conflicts, so a conflicted PR fails checkout by design).
-          # Push (fork-e2e/**) and dispatch fall back to the branch / ref.
+          # PRs (same-repo and fork) test the merge result (refs/pull/N/merge --
+          # absent when the PR conflicts, so a conflicted PR fails checkout by
+          # design). Schedule / dispatch fall back to the branch / ref.
           ref: ${{ github.event.pull_request.number && format('refs/pull/{0}/merge', github.event.pull_request.number) || github.event.inputs.branch || github.ref }}
 
-      - name: Set up Python
-        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065  # v5
+      # Steps below are shared verbatim with server-compat.yml's backcompat-e2e
+      # job via the composite action, so the two never drift. server_version
+      # is omitted here -> normal gate (tests the checked-out server, mock LLM).
+      - name: Run e2e suite
+        uses: ./.github/actions/e2e-run
         with:
-          python-version-file: ".python-version"
-
-      - name: Install uv
-        uses: astral-sh/setup-uv@38f3f104447c67c051c4a08e39b64a148898af3a  # v4
-        with:
-          enable-cache: true
-
-
-
-
-      - name: Cache virtualenv
-        uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684  # v4
-        with:
-          path: .venv
-          key: venv-${{ runner.os }}-${{ hashFiles('.python-version') }}-${{ hashFiles('uv.lock') }}
-      - name: Set LLM credentials
-        run: echo "LLM_API_KEY=${{ secrets.LLM_API_KEY }}" >> "$GITHUB_ENV"
-      - name: Write gateway profile (~/.databrickscfg)
-        env:
-          GATEWAY_BASE_URL: ${{ secrets.GATEWAY_BASE_URL }}
-          LLM_API_KEY: ${{ secrets.LLM_API_KEY }}
-        run: |
-          # Strip the /serving-endpoints suffix the conftest re-appends.
-          host="${GATEWAY_BASE_URL%/serving-endpoints}"
-          cat > "$HOME/.databrickscfg" <<EOF
-          [default]
-          host  = $host
-          token = $LLM_API_KEY
-          EOF
-          # PAT passthrough for the codex / claude-sdk auth commands.
-          echo "DATABRICKS_BEARER=$LLM_API_KEY" >> "$GITHUB_ENV"
-
-      - name: Install project and dev dependencies
-        run: |
-          uv sync --extra all --extra dev
-
-      - name: Install binary dependencies
-        # npm install against .github/ci-deps/package.json with
-        # --ignore-scripts to block postinstall on every package. The
-        # claude-code stub binary needs its install.cjs (audited:
-        # platform detect + same-tree hardlink, no network/exec) so we run
-        # that one explicitly; codex has no postinstall; pi is intentionally
-        # absent (its e2e rows skip via skip_if_harness_cli_missing).
-        #
-        # bubblewrap: the linux_bwrap sandbox backend fails loud if `bwrap`
-        # is missing, and the e2e runner runs real agents with os_env. The
-        # apparmor sysctl mirrors ci.yml (Ubuntu 24.04 blocks unprivileged
-        # user namespaces, which bwrap's unshare(CLONE_NEWUSER) needs).
-        working-directory: .github/ci-deps
-        run: |
-          sudo apt-get install -y tmux bubblewrap
-          sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0
-          npm install --ignore-scripts
-          node node_modules/@anthropic-ai/claude-code/install.cjs
-          echo "${GITHUB_WORKSPACE}/.github/ci-deps/node_modules/.bin" >> "$GITHUB_PATH"
-
-
-
-      - name: Run e2e tests
-        timeout-minutes: 30
-        # The `force-all-tests` PR label bypasses tests/known_failures.yaml
-        # (matches the ci.yml / nightly.yml pattern).
-        env:
-          # Cron fallback must match the workflow_dispatch default above.
-          PARALLELISM_INPUT: ${{ github.event.inputs.parallelism || '2' }}
-          SHARD_ID: ${{ matrix.shard_id }}
-          NUM_SHARDS: ${{ matrix.num_shards }}
-          FORCE_ALL_TESTS: ${{ contains(github.event.pull_request.labels.*.name, 'force-all-tests') }}
-          # Schedule / dispatch are the full pass; PR and push skip @nightly.
-          NIGHTLY_FULL: ${{ github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' }}
-          # Stable per-shard prefix so the upload step finds the logs / junit.
-          E2E_TMP_BASE: /tmp/omnigent-e2e-${{ github.run_id }}-shard${{ matrix.shard_id }}
-          # Per-worker progress log (#426): fsynced START/END per test so we
-          # recover the last-started test when a runner wedges.
-          PYTEST_PROGRESS_LOG_DIR: /tmp/omnigent-e2e-${{ github.run_id }}-shard${{ matrix.shard_id }}/progress
-          OMNIGENT_TOKEN_USAGE_JSON: /tmp/omnigent-e2e-${{ github.run_id }}-shard${{ matrix.shard_id }}/tokens.json
-          # Spread interchangeable gateway models across tests (deterministic
-          # per nodeid; tests/_model_pools.py).
-          OMNIGENT_TEST_MODEL_SPREAD: '1'
-          # Drain gpt-5-4 from the pool: its FMAPI quota is far below the
-          # others, so tests hashed to it fail on sustained 429s.
-          OMNIGENT_TEST_MODEL_POOL_GPT: 'databricks-gpt-5-5,databricks-gpt-5-4-mini'
-        run: |
-          # Validate parallelism (untrusted input -- bind to env, never
-          # interpolate a GitHub expression into the shell).
-          if ! [[ "$PARALLELISM_INPUT" =~ ^[1-9][0-9]?$ ]]; then
-            echo "Invalid parallelism input: $PARALLELISM_INPUT (expected 1-99)" >&2
-            exit 1
-          fi
-          WORKERS="$PARALLELISM_INPUT"
-          mkdir -p "$E2E_TMP_BASE"
-
-          EXTRA_ARGS=()
-          if [[ "$FORCE_ALL_TESTS" == "true" ]]; then
-            EXTRA_ARGS=(--no-skip-known)
-            echo "::notice::force-all-tests label present; bypassing tests/known_failures.yaml"
-          fi
-          if [[ "$NIGHTLY_FULL" != "true" ]]; then
-            EXTRA_ARGS+=(-m "not nightly")
-          fi
-
-          # --junitxml emits per-test results eagerly so diagnostics survive
-          # a wall-clock overrun. --shard-id/--num-shards chunk the node IDs.
-          # --timeout=180 caps each test; --timeout-method=thread because our
-          # pty/subprocess children don't get SIGALRM. --max-worker-restart=0
-          # fails the shard fast instead of letting loadscope requeue deadlock
-          # the controller (the 2026-06-11 shard-2 wedge).
-          uv run pytest tests/e2e/ \
-            --llm-api-key "$LLM_API_KEY" \
-            --profile default \
-            --harness databricks \
-            -n "$WORKERS" \
-            --dist=loadscope \
-            --max-worker-restart=0 \
-            --shard-id="$SHARD_ID" \
-            --num-shards="$NUM_SHARDS" \
-            --timeout=180 \
-            --timeout-method=thread \
-            --basetemp="$E2E_TMP_BASE" \
-            --junitxml="$E2E_TMP_BASE/junit.xml" \
-            -v --tb=long --showlocals --log-level=INFO -r a \
-            "${EXTRA_ARGS[@]}" \
-            || { rc=$?; [ "$rc" -eq 5 ] && echo "::notice::No tests collected in this shard; treating as a pass." || exit "$rc"; }
-
-      - name: Upload server logs on failure
-        # cancelled() too: failure() misses step timeouts (#426).
-        if: failure() || cancelled()
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02  # v4
-        with:
-          # Per-shard name so parallel uploads don't collide.
-          name: e2e-server-logs-${{ github.run_id }}-shard${{ matrix.shard_id }}
-          # Whitelist diagnostic files (basetemp also holds large per-test
-          # DBs / tarballs). `warn` not `ignore` so a broken path is loud.
-          path: |
-            /tmp/omnigent-e2e-${{ github.run_id }}-shard${{ matrix.shard_id }}/**/server.log
-            /tmp/omnigent-e2e-${{ github.run_id }}-shard${{ matrix.shard_id }}/**/runner.log
-            /tmp/omnigent-e2e-${{ github.run_id }}-shard${{ matrix.shard_id }}/**/.omnigent/logs/**/*.log
-            /tmp/omnigent-e2e-${{ github.run_id }}-shard${{ matrix.shard_id }}/junit.xml
-            /tmp/omnigent-e2e-${{ github.run_id }}-shard${{ matrix.shard_id }}/progress/progress-*.log
-          retention-days: 7
-          if-no-files-found: warn
-          # Daemon logs live under hidden `.omnigent/` dirs, which v4 skips
-          # by default -- without this the `.omnigent/logs` glob matches nothing.
-          include-hidden-files: true
-
-      - name: Upload token usage
-        if: always()
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02  # v4
-        with:
-          name: e2e-tokens-${{ github.run_id }}-shard${{ matrix.shard_id }}
-          path: /tmp/omnigent-e2e-${{ github.run_id }}-shard${{ matrix.shard_id }}/tokens*.json
-          retention-days: 14
-          # `warn` not `ignore`: every shard makes LLM calls, so a missing
-          # tokens file means the recorder broke.
-          if-no-files-found: warn
+          shard_id: ${{ matrix.shard_id }}
+          num_shards: ${{ matrix.num_shards }}
+          parallelism: ${{ github.event.inputs.parallelism || '2' }}
+          nightly_full: ${{ github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' }}

.github/workflows/flake-stress-e2e.yml

@@ -24,7 +24,7 @@ name: Flake stress (E2E)
 #     -f test_target=tests/e2e/test_subagents.py
 #   gh workflow run flake-stress-e2e.yml --ref main \
 #     -f test_target='tests/e2e/test_routes.py::test_patch_session' \
-#     -f workers=1 -f attempts=30 -f extra_pytest_args=--no-skip-known
+#     -f workers=1 -f attempts=30 -f extra_pytest_args=-x
 
 on:
   workflow_dispatch:
@@ -53,7 +53,7 @@ on:
         required: false
         default: "default"
       extra_pytest_args:
-        description: "Extra pytest args appended to the command, e.g. '--no-skip-known' (default: empty)"
+        description: "Extra pytest args appended to the command, e.g. '-x' (default: empty)"
         required: false
         default: ""
 
@@ -192,7 +192,7 @@ jobs:
 
     steps:
       - name: Check out repo
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
         with:
           ref: ${{ github.event.inputs.target_branch }}
 

.github/workflows/flake-stress.yml

@@ -14,7 +14,7 @@ name: Flake stress
 #     -f test_target=tests/server/integration/test_routes_responses.py
 #   gh workflow run flake-stress.yml --ref main \
 #     -f test_target='tests/foo.py::test_x[case1]' \
-#     -f workers=1 -f extra_pytest_args=--no-skip-known
+#     -f workers=1 -f extra_pytest_args=-x
 
 on:
   workflow_dispatch:
@@ -39,7 +39,7 @@ on:
         required: false
         default: "worksteal"
       extra_pytest_args:
-        description: "Extra pytest args appended to the command, e.g. '--no-skip-known' (default: empty)"
+        description: "Extra pytest args appended to the command, e.g. '-x' (default: empty)"
         required: false
         default: ""
 
@@ -126,7 +126,7 @@ jobs:
 
     steps:
       - name: Check out repo
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
         with:
           ref: ${{ github.event.inputs.target_branch }}
 

.github/workflows/fork-e2e-mirror.yml

@@ -1,227 +0,0 @@
-name: Fork e2e mirror
-
-# Mirrors a gated fork PR's head onto a trusted fork-e2e/pr-N branch so e2e runs
-# there as a `push` (with secrets). It's a pure git-ref update via a GitHub App
-# token (refs pushed by the default GITHUB_TOKEN don't trigger workflows); it
-# never checks out or runs fork code. Mirroring requires BOTH the contributor
-# Security Scan to pass (the blocking `gate` job, via security-gate.yml) AND a
-# maintainer's approving PR review (should-mirror.sh).
-#
-# Maintainer approval is the sole human gate for running secret-bearing e2e on a
-# fork PR. Only users with write access can submit approving reviews, and the
-# gate further verifies the approver is in .github/MAINTAINER, so an external
-# fork author can never open it. It is intentionally tied to the merge gate
-# (maintainer-approval.yml): approving the PR runs e2e AND approves for merge.
-# Requesting changes or dismissing the review stops future mirrors; closing the
-# PR tears down the mirror branch.
-#
-# Triggers:
-#   pull_request_target   opened/synchronize/reopened/closed — handles new
-#                         pushes and PR lifecycle. Reviews don't fire
-#                         pull_request_target, so approval reaches here via
-#                         workflow_dispatch (dispatched by
-#                         maintainer-approval-rerun-run.yml on approval).
-#   workflow_dispatch     re-evaluation of a single PR (used by the approval
-#                         relay and for manual re-runs). Safe because
-#                         should-mirror.sh always re-checks approval before
-#                         any secret-bearing run; a spurious dispatch with an
-#                         arbitrary PR number cannot trigger e2e.
-#
-# leak-scan-allow: pull_request_target
-on:
-  pull_request_target:
-    # labeled/unlabeled so applying or removing `e2e-approved` opens or tears
-    # down the mirror immediately, not only on the PR's next push.
-    types: [opened, synchronize, reopened, closed, labeled, unlabeled]
-
-  workflow_dispatch:
-    inputs:
-      pr:
-        description: PR number to evaluate for mirroring.
-        required: true
-        type: string
-
-permissions:
-  contents: read
-
-concurrency:
-  group: fork-e2e-mirror-${{ github.event.pull_request.number || inputs.pr }}
-  cancel-in-progress: false
-
-jobs:
-  # Delete the trusted mirror branch when the PR closes or the gate label is
-  # removed. Ungated -- cleanup must always run so a closed PR (or one whose
-  # label was removed) never leaves a stale fork-e2e/pr-N branch behind.
-  # Note: approval revocation cleanup is handled by the mirror job's
-  # "Delete stale mirror branch on revocation" step (workflow_dispatch path).
-  cleanup:
-    name: cleanup
-    if: >-
-      github.event_name == 'pull_request_target'
-      && github.event.pull_request.head.repo.fork
-      && (
-        github.event.action == 'closed'
-        || (github.event.action == 'unlabeled' && github.event.label.name == 'e2e-approved')
-      )
-    permissions:
-      contents: read
-    runs-on: ubuntu-latest
-    timeout-minutes: 5
-    env:
-      REPO: ${{ github.repository }}
-      MIRROR_BRANCH: fork-e2e/pr-${{ github.event.pull_request.number }}
-    steps:
-      - name: Mint mirror App token
-        id: app-token
-        # App token, not GITHUB_TOKEN: its pushes DO trigger the downstream e2e.
-        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1  # v3.2.0
-        with:
-          app-id: ${{ vars.FORK_E2E_APP_ID }}
-          private-key: ${{ secrets.FORK_E2E_APP_PRIVATE_KEY }}
-
-      - name: Delete mirror branch
-        env:
-          GH_TOKEN: ${{ steps.app-token.outputs.token }}
-        run: |
-          gh api -X DELETE "repos/$REPO/git/refs/heads/$MIRROR_BRANCH" >/dev/null 2>&1 \
-            && echo "Deleted $MIRROR_BRANCH" || echo "No $MIRROR_BRANCH to delete"
-
-  # The single contributor Security Scan, consulted as a BLOCKING gate before we
-  # mirror fork code onto a trusted branch where e2e runs WITH the gateway secret.
-  # The scan itself runs once on the PR (security-scan.yml); this poller mirrors
-  # its result, blocking the mirror on a finding. Skipped on the teardown action
-  # (handled by `cleanup`).
-  gate:
-    name: security gate
-    if: >-
-      (
-        github.event_name == 'workflow_dispatch'
-      ) || (
-        github.event_name == 'pull_request_target'
-        && github.event.pull_request.head.repo.fork
-        && github.event.action != 'closed'
-        && github.event.action != 'unlabeled'
-        && (github.event.action != 'labeled' || github.event.label.name == 'e2e-approved')
-      )
-    uses: ./.github/workflows/security-gate.yml
-
-  mirror:
-    name: mirror
-    needs: gate
-    # Fork PRs only -- same-repo PRs run e2e directly via `pull_request`.
-    # workflow_dispatch is validated at the step level (verify fork before
-    # mirroring) but runs the gate unconditionally to keep the flow simple.
-    if: >-
-      (
-        github.event_name == 'workflow_dispatch'
-      ) || (
-        github.event_name == 'pull_request_target'
-        && github.event.pull_request.head.repo.fork
-        && github.event.action != 'closed'
-        && github.event.action != 'unlabeled'
-        && (github.event.action != 'labeled' || github.event.label.name == 'e2e-approved')
-      )
-    permissions:
-      contents: read
-      pull-requests: read
-    runs-on: ubuntu-latest
-    timeout-minutes: 5
-    env:
-      GH_TOKEN: ${{ github.token }}
-      REPO: ${{ github.repository }}
-      PR: ${{ github.event.pull_request.number || inputs.pr }}
-    steps:
-      - name: Resolve PR context
-        id: ctx
-        run: |
-          if [[ -n "${{ github.event.pull_request.head.sha || '' }}" ]]; then
-            echo "sha=${{ github.event.pull_request.head.sha }}" >> "$GITHUB_OUTPUT"
-            echo "is_fork=true" >> "$GITHUB_OUTPUT"
-          else
-            # workflow_dispatch: resolve from the PR object.
-            INFO=$(gh pr view "$PR" --repo "$REPO" --json headRefOid,isCrossRepository)
-            SHA=$(echo "$INFO" | jq -r '.headRefOid')
-            IS_FORK=$(echo "$INFO" | jq -r '.isCrossRepository')
-            echo "sha=$SHA" >> "$GITHUB_OUTPUT"
-            echo "is_fork=$IS_FORK" >> "$GITHUB_OUTPUT"
-            if [[ "$IS_FORK" != "true" ]]; then
-              echo "::notice::PR #$PR is same-repo; skipping mirror (same-repo PRs run e2e directly)."
-            fi
-          fi
-
-      - name: Check out gate scripts from main
-        if: steps.ctx.outputs.is_fork == 'true'
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
-        with:
-          ref: main             # trusted; never the PR head
-          sparse-checkout: .github/scripts
-          persist-credentials: false
-
-      - name: Mint mirror App token
-        if: steps.ctx.outputs.is_fork == 'true'
-        id: app-token
-        # App token, not GITHUB_TOKEN: its pushes DO trigger the downstream e2e.
-        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1  # v3.2.0
-        with:
-          app-id: ${{ vars.FORK_E2E_APP_ID }}
-          private-key: ${{ secrets.FORK_E2E_APP_PRIVATE_KEY }}
-
-      # MAINTAINER@main, never the PR head: the gate verifies the *approver* is a
-      # maintainer, so a PR can't self-grant by editing its own MAINTAINER copy.
-      - name: Load maintainers
-        if: steps.ctx.outputs.is_fork == 'true'
-        id: maintainers
-        run: bash .github/scripts/merge-ready/load-maintainers.sh
-
-      - name: Evaluate mirror gate
-        if: steps.ctx.outputs.is_fork == 'true'
-        id: gate
-        env:
-          MAINTAINERS: ${{ steps.maintainers.outputs.list }}
-        run: bash .github/scripts/fork-e2e/should-mirror.sh
-
-      - name: Mirror head SHA onto trusted branch
-        if: steps.ctx.outputs.is_fork == 'true' && steps.gate.outputs.mirror == 'true'
-        env:
-          TOKEN: ${{ steps.app-token.outputs.token }}
-          HEAD_SHA: ${{ steps.ctx.outputs.sha }}
-          MIRROR_BRANCH: fork-e2e/pr-${{ env.PR }}
-        run: |
-          set -euo pipefail
-          # Move git OBJECTS, don't just point a ref. A fork PR's head commit
-          # reaches the base repo only through the shared fork network (the
-          # `refs/pull/N/head` pull ref); the Git Data refs API refuses to
-          # anchor a NEW branch to a commit the base repo doesn't own, returning
-          # `422 Reference does not exist`. Fetching the pull ref into a scratch
-          # repo and pushing the SHA materializes the object in the base repo so
-          # the ref is valid -- and the App-token push is what triggers the
-          # downstream e2e (a GITHUB_TOKEN push would not). No working tree is
-          # checked out and no fork code runs in this privileged job; only git
-          # objects move. `push -f` covers both first create and re-sync.
-          work="$(mktemp -d)"
-          git -C "$work" init -q
-          origin="https://x-access-token:${TOKEN}@github.com/${REPO}.git"
-          git -C "$work" fetch -q --no-tags "$origin" "refs/pull/${PR}/head"
-          got="$(git -C "$work" rev-parse FETCH_HEAD)"
-          # Mirror EXACTLY the SHA the security scan gated: if the fork raced a
-          # new push after approval, the pull ref would carry an unscanned
-          # commit -- refuse rather than run secret-bearing e2e on it.
-          if [ "$got" != "$HEAD_SHA" ]; then
-            echo "::error::pull/$PR/head is $got but the approved head is $HEAD_SHA; refusing to mirror." >&2
-            exit 1
-          fi
-          git -C "$work" push -q -f "$origin" "${HEAD_SHA}:refs/heads/${MIRROR_BRANCH}"
-          echo "Mirrored $MIRROR_BRANCH -> $HEAD_SHA"
-
-      # Tear down the mirror branch when approval is revoked (review dismissed
-      # or changes requested). Without this, a stale fork-e2e/pr-N branch
-      # would remain until the next push or PR close.
-      - name: Delete stale mirror branch on revocation
-        if: steps.ctx.outputs.is_fork == 'true' && steps.gate.outputs.mirror == 'false'
-        env:
-          GH_TOKEN: ${{ steps.app-token.outputs.token }}
-          MIRROR_BRANCH: fork-e2e/pr-${{ env.PR }}
-        run: |
-          gh api -X DELETE "repos/$REPO/git/refs/heads/$MIRROR_BRANCH" >/dev/null 2>&1 \
-            && echo "Deleted stale $MIRROR_BRANCH (approval revoked)" \
-            || echo "No $MIRROR_BRANCH to delete"

.github/workflows/github-release.yml

@@ -0,0 +1,75 @@
+# Create a GitHub Release entry (the `…/releases` page) when a version tag is
+# pushed. This is METADATA ONLY — it does NOT build or publish any installable
+# artifact. PyPI publishing lives in the central secure-release repo
+# (databricks/secure-public-registry-releases-eng → `omnigent` workflow), on
+# hardened runners with OIDC Trusted Publishing and a mandatory dependency
+# scan. Keeping those concerns separate is deliberate (see RELEASING.md):
+#
+#   * This job runs NO project or third-party code — no build, no `pip
+#     install`/`npm ci`, no tests. Its only action is SHA-pinned
+#     `actions/checkout` plus `gh release create`. A malicious tagged commit
+#     therefore cannot execute anything here.
+#   * It uses the ephemeral `GITHUB_TOKEN` (no stored secret / PAT). The single
+#     elevated scope, `contents: write`, is the minimum GitHub requires to
+#     create a release and nothing else in the job uses it.
+#   * It attaches NO wheels. The release carries only generated notes and the
+#     source tarball GitHub auto-attaches, so PyPI (the scanned, securely
+#     published channel) stays the single source of installable artifacts.
+#   * The release is created as a DRAFT: a human verifies/edits the generated
+#     notes and publishes it (ideally after the prod PyPI publish lands), so a
+#     bot never makes a public release on its own.
+name: GitHub Release
+
+on:
+  push:
+    tags:
+      # Version tags only (v0.2.0, v0.2.0rc1, …) — `v[0-9]*` avoids triggering
+      # on non-release tags like `v-infra-*`.
+      - "v[0-9]*"
+
+# Least privilege: creating a release requires `contents: write`; nothing here
+# needs anything more.
+permissions:
+  contents: write
+
+jobs:
+  draft-release:
+    # Inert in forks / mirrors — only the canonical repo should cut releases.
+    if: github.repository == 'omnigent-ai/omnigent'
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      # Full history so `--generate-notes` can diff against the previous tag.
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          fetch-depth: 0
+
+      - name: Draft release with generated notes
+        env:
+          GH_TOKEN: ${{ github.token }}
+          TAG: ${{ github.ref_name }}
+        run: |
+          # Rerun-safe: if a release for this tag already exists (a rerun, a
+          # deleted-and-re-pushed tag, or a manual release), skip instead of
+          # failing the job. An `if` so this can't trip `set -e`.
+          if gh release view "$TAG" --repo "$GITHUB_REPOSITORY" >/dev/null 2>&1; then
+            echo "Release $TAG already exists — skipping." | tee -a "$GITHUB_STEP_SUMMARY"
+            exit 0
+          fi
+          # rc / dev / alpha / beta tags are flagged as pre-releases.
+          pre=""
+          case "$TAG" in
+            *rc*|*dev*|*a[0-9]*|*b[0-9]*) pre="--prerelease" ;;
+          esac
+          # $pre is intentionally UNQUOTED: it word-splits to nothing when empty,
+          # and is only ever "" or "--prerelease" (set just above, never from
+          # external input). Quoting it would pass an empty positional arg.
+          gh release create "$TAG" \
+            --repo "$GITHUB_REPOSITORY" \
+            --draft \
+            --verify-tag \
+            --generate-notes \
+            --title "$TAG" \
+            $pre
+          echo "Drafted release $TAG — review/edit the notes and publish from the Releases page." \
+            | tee -a "$GITHUB_STEP_SUMMARY"

.github/workflows/integration.yml

@@ -1,12 +1,12 @@
 name: Integration Tests
 
-# Per-PR twin of nightly.yml's journey-suite matrix (tests/integration/),
-# once per wrapped harness against the real Databricks gateway. Burn-in:
-# NOT in merge-ready's REQUIRED list yet (reports for signal; flip in
-# .github/scripts/merge-ready/required.sh after a clean week). Triggers:
-# daily schedule, same-repo PR gate (secrets flow; fork PRs skip and run
-# via the fork-e2e/** push after fork-e2e-mirror.yml), the fork-e2e/**
-# push itself, and workflow_dispatch.
+# Per-PR journey-suite matrix (tests/integration/), once per wrapped harness
+# using the mock LLM server (no real gateway credentials required). All tests
+# are mock_only: they script the LLM responses via configure_mock_llm and run
+# against a local mock FastAPI server. Because it uses NO secrets, it runs on
+# ALL PRs -- same-repo AND fork -- directly via `pull_request`, like ci.yml; no
+# fork-e2e/** mirror needed. Triggers: daily schedule, the PR gate, and
+# workflow_dispatch.
 
 on:
   schedule:
@@ -17,10 +17,6 @@ on:
     # the heavy integration suite. (#399 added these for the gate; superseded.)
     types: [opened, synchronize, reopened, ready_for_review]
     paths-ignore: ['ap-web/**']
-  push:
-    branches:
-      - 'fork-e2e/**'
-    paths-ignore: ['ap-web/**']
   workflow_dispatch:
 
 permissions:
@@ -48,11 +44,8 @@ jobs:
   gate:
     uses: ./.github/workflows/security-gate.yml
 
-  # Compute the harness matrix once. A skipped run (draft, or a fork's
-  # pull_request) yields an EMPTY matrix -> zero jobs -> no skipped check-runs
-  # with an unexpanded `Integration (${{ matrix.name }})` name. Mirrors the
-  # e2e.yml / e2e-ui.yml setup-job pattern via
-  # .github/scripts/ci/integration-matrix.sh.
+  # Harness matrix (integration-matrix.sh). Fork PRs run by default; draft PRs
+  # resolve to an empty matrix.
   setup:
     name: setup
     needs: gate
@@ -62,7 +55,7 @@ jobs:
       matrix: ${{ steps.matrix.outputs.matrix }}
     steps:
       - name: Check out CI scripts
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
         with:
           # Triggering ref (not pinned to main): the script must exist on the
           # running ref, and it is not a security gate -- it only selects which
@@ -75,14 +68,13 @@ jobs:
         env:
           EVENT_NAME: ${{ github.event_name }}
           IS_DRAFT: ${{ github.event.pull_request.draft }}
-          IS_FORK: ${{ github.event.pull_request.head.repo.fork }}
         run: bash .github/scripts/ci/integration-matrix.sh
 
   integration:
     name: Integration (${{ matrix.name }})
-    # Draft PRs and fork pull_request events resolve to an EMPTY matrix in
-    # `setup` (forks run via the fork-e2e/** mirror push instead), so this job
-    # produces zero leg runs for them -- and thus no skipped placeholder check.
+    # Draft PRs resolve to an EMPTY matrix in `setup`, so this job produces zero
+    # leg runs (and thus no skipped placeholder check). Fork PRs DO run (mock
+    # LLM, no secrets) -- same as ci.yml.
     needs: setup
     runs-on: ubuntu-latest
     # Per-leg ceiling; inner test step caps at 25 min, rest covers install +
@@ -99,125 +91,16 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
         with:
           ref: ${{ github.event.inputs.branch || github.ref }}
 
-      - name: Set up Python
-        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065  # v5
+      # Shared verbatim with server-compat.yml's backcompat-integration job via
+      # the composite action, so the two never drift. server_version is omitted
+      # here -> normal gate (tests the checked-out server, mock LLM).
+      - name: Run integration suite
+        uses: ./.github/actions/integration-run
         with:
-          python-version-file: ".python-version"
-
-      - name: Install uv
-        uses: astral-sh/setup-uv@38f3f104447c67c051c4a08e39b64a148898af3a  # v4
-        with:
-          enable-cache: true
-
-
-
-
-      - name: Cache virtualenv
-        uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684  # v4
-        with:
-          path: .venv
-          key: venv-${{ runner.os }}-${{ hashFiles('.python-version') }}-${{ hashFiles('uv.lock') }}
-      - name: Set LLM credentials
-        run: echo "LLM_API_KEY=${{ secrets.LLM_API_KEY }}" >> "$GITHUB_ENV"
-      - name: Write gateway profile (~/.databrickscfg)
-        env:
-          GATEWAY_BASE_URL: ${{ secrets.GATEWAY_BASE_URL }}
-          LLM_API_KEY: ${{ secrets.LLM_API_KEY }}
-        run: |
-          # Strip the /serving-endpoints suffix the conftest re-appends.
-          host="${GATEWAY_BASE_URL%/serving-endpoints}"
-          cat > "$HOME/.databrickscfg" <<EOF
-          [default]
-          host  = $host
-          token = $LLM_API_KEY
-          EOF
-          # PAT passthrough for the codex / claude-sdk auth commands.
-          echo "DATABRICKS_BEARER=$LLM_API_KEY" >> "$GITHUB_ENV"
-
-      - name: Install project and dev dependencies
-        run: uv sync --extra all --extra dev
-
-      - name: Install binary dependencies
-        # Mirrors e2e.yml. `--ignore-scripts` blocks npm postinstall hooks;
-        # we run claude-code's install.cjs explicitly (audited, no network).
-        # `bubblewrap` backs the `linux_bwrap` sandbox in tests/inner/*.
-        working-directory: .github/ci-deps
-        run: |
-          set -euo pipefail
-          sudo apt-get update
-          sudo apt-get install -y tmux ripgrep bubblewrap
-          sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0
-          npm install --ignore-scripts
-          node node_modules/@anthropic-ai/claude-code/install.cjs
-          echo "${GITHUB_WORKSPACE}/.github/ci-deps/node_modules/.bin" >> "$GITHUB_PATH"
-
-
-
-      - name: Run nightly tests
-        timeout-minutes: 25
-        env:
-          HARNESS: ${{ matrix.harness }}
-          MODEL: ${{ matrix.model }}
-          WORKERS: ${{ matrix.workers }}
-          # Stable basetemp so the failure-upload step can find the logs.
-          INTEGRATION_TMP_BASE: /tmp/omnigent-integration-${{ github.run_id }}-${{ matrix.harness }}
-          # SDK initialize control-request timeout (ms).
-          CLAUDE_CODE_STREAM_CLOSE_TIMEOUT: '60000'
-          # Diagnostic: bypass create_exec_launcher on claude-sdk to isolate
-          # whether the silent connect hang is sandbox-related.
-          OMNIGENT_CLAUDE_SDK_NO_SANDBOX: ${{ matrix.harness == 'claude-sdk' && '1' || '' }}
-          # Per-xdist-worker progress log (#426): recovers the last-started
-          # test when a runner wedges.
-          PYTEST_PROGRESS_LOG_DIR: ${{ github.workspace }}/artifacts/progress-${{ matrix.harness }}
-          # Per-model call/token tally (dev/aggregate_token_usage.py).
-          OMNIGENT_TOKEN_USAGE_JSON: ${{ github.workspace }}/artifacts/tokens-${{ matrix.harness }}.json
-          # Load-balance interchangeable gateway models (tests/_model_pools.py).
-          OMNIGENT_TEST_MODEL_SPREAD: '1'
-          # gpt-5-4 FMAPI quota is far below its pool neighbors; drain it
-          # until the tier is raised so 429s don't fail hashed-to-gpt-5-4 tests.
-          OMNIGENT_TEST_MODEL_POOL_GPT: 'databricks-gpt-5-5,databricks-gpt-5-4-mini'
-        run: |
-          set -euo pipefail
-          mkdir -p artifacts "$INTEGRATION_TMP_BASE"
-          # --capture=no + --log-cli-level=INFO stream live so progress shows
-          # even if the step hits its timeout before buffered output renders.
-          # --timeout=180 caps a single hung test (see e2e.yml).
-          env -u OPENAI_API_KEY -u ANTHROPIC_API_KEY -u DATABRICKS_TOKEN \
-            uv run pytest tests/integration/ \
-              --integration \
-              --model "$MODEL" \
-              --harness "$HARNESS" \
-              --profile default \
-              --llm-api-key "$LLM_API_KEY" \
-              -n "$WORKERS" \
-              --dist=loadscope \
-              --timeout=180 \
-              --timeout-method=thread \
-              --basetemp="$INTEGRATION_TMP_BASE" \
-              --junitxml="artifacts/integration-${HARNESS}.xml" \
-              --capture=no --log-cli-level=INFO \
-              -v --tb=long --showlocals --log-level=INFO -r a
-
-      - name: Upload server/runner logs on failure
-        if: failure() || cancelled()
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02  # v4
-        with:
-          name: integration-server-logs-${{ matrix.harness }}-${{ github.run_id }}
-          path: |
-            /tmp/omnigent-integration-${{ github.run_id }}-${{ matrix.harness }}/**/server.log
-            /tmp/omnigent-integration-${{ github.run_id }}-${{ matrix.harness }}/**/runner.log
-          retention-days: 7
-          if-no-files-found: warn
-
-      - name: Upload junit + logs
-        if: always()
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02  # v4
-        with:
-          name: integration-${{ matrix.harness }}-${{ github.run_id }}
-          path: artifacts/
-          retention-days: 14
-          if-no-files-found: ignore
+          harness: ${{ matrix.harness }}
+          model: ${{ matrix.model }}
+          workers: ${{ matrix.workers }}

.github/workflows/issue-triage.yml

@@ -57,7 +57,7 @@ jobs:
 
       - name: Check out repo
         if: steps.creds.outputs.available == 'true'
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
         with:
           ref: ${{ github.event.repository.default_branch }}
           persist-credentials: false
@@ -356,7 +356,7 @@ jobs:
           ALLOWED_TYPES = {"bug", "enhancement", "documentation"}
           ALLOWED_COMPONENTS = {
               "comp:server", "comp:runner", "comp:repr",
-              "comp:web-ui", "comp:policies", "comp:harnesses", "comp:infra",
+              "comp:web-ui", "comp:tui", "comp:policies", "comp:harnesses", "comp:infra",
           }
           ALLOWED_PRIORITIES = {"P0-critical", "P1-high", "P2-medium", "P3-low"}
 

.github/workflows/lint.yml

@@ -43,7 +43,7 @@ jobs:
 
     steps:
       - name: Check out repo
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
 
       - name: Set up Python
         uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065  # v5

.github/workflows/maintainer-approval-rerun-run.yml

@@ -80,30 +80,3 @@ jobs:
               core.info(`Re-running Maintainer Approval run ${run_id} for PR #${pull_number}`);
               await github.rest.actions.reRunWorkflowFailedJobs({ owner, repo, run_id: Number(run_id) });
             }
-
-      # Fork PRs: maintainer approval also gates e2e (replacing the old
-      # e2e-approved label). Dispatch the fork-e2e-mirror workflow so the
-      # approval triggers e2e on the trusted mirror branch.
-      - name: Dispatch fork e2e mirror for fork PRs
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
-        with:
-          script: |
-            const fs = require('fs');
-            const { owner, repo } = context.repo;
-            if (!fs.existsSync('pr_number')) {
-              core.info('No pr_number file; nothing to do.');
-              return;
-            }
-            const pull_number = Number(fs.readFileSync('pr_number', 'utf8').trim());
-            const { data: pr } = await github.rest.pulls.get({ owner, repo, pull_number });
-            if (!pr.head.repo || pr.head.repo.full_name === `${owner}/${repo}`) {
-              core.info(`PR #${pull_number} is same-repo; skipping fork-e2e-mirror dispatch.`);
-              return;
-            }
-            core.info(`PR #${pull_number} is a fork PR; dispatching fork-e2e-mirror.`);
-            await github.rest.actions.createWorkflowDispatch({
-              owner, repo,
-              workflow_id: 'fork-e2e-mirror.yml',
-              ref: 'main',
-              inputs: { pr: String(pull_number) },
-            });

.github/workflows/maintainer-approval-rerun.yml

@@ -21,8 +21,7 @@ concurrency:
 jobs:
   record:
     # Approvals flip the check green; dismissals and changes-requested flip
-    # it red and revoke the fork-e2e mirror. Skip COMMENTED reviews (they
-    # don't change review state).
+    # it red. Skip COMMENTED reviews (they don't change review state).
     if: github.event.review.state != 'commented'
     runs-on: ubuntu-latest
     timeout-minutes: 5

.github/workflows/merge-ready.yml

@@ -4,26 +4,24 @@ name: Merge Ready
 # required branch-protection check, backed by the REQUIRED list inside
 # this workflow. Triggers: `/merge` comment (write-access commenter only),
 # `pull_request_target` labeled (acts only with `automerge`),
-# `workflow_run` on same-repo CI completion, `check_suite` completion on a
-# `fork-e2e/**` branch (the mirrored fork PR e2e -- a delivery that actually
-# fires, unlike the brittle fork-PR `workflow_run` hop it replaces), and
-# `workflow_dispatch` (programmatic/manual re-evaluation of one PR). Posted
-# via the REST API (not the job's implicit check run) so the status lands on
-# the PR head SHA, since these jobs run on the default branch.
+# `workflow_run` on CI completion (same-repo and fork PRs -- ctx resolves the
+# PR from the head SHA), and `workflow_dispatch` (programmatic/manual
+# re-evaluation of one PR). Posted via the REST API (not the job's implicit
+# check run) so the status lands on the PR head SHA, since these jobs run on
+# the default branch.
 #
 # Labels:
 #   automerge    enable GitHub auto-merge (one-shot on label add) + opt
 #                into continuous gate updates (green AND red).
 #
 # There is no CI bypass label. To land a PR despite red required checks,
-# either quarantine the offending flaky test (tests/known_failures.yaml) or,
-# for a genuine emergency, a repo admin uses GitHub's native "merge without
-# waiting for requirements" affordance (branch protection has
-# enforce_admins=false).
+# fix or delete the offending test; for a genuine emergency, a repo admin
+# uses GitHub's native "merge without waiting for requirements" affordance
+# (branch protection has enforce_admins=false).
 
 on:
-  # `labeled` only; `workflow_run` re-evaluates on CI completion (same-repo PRs
-  # and the fork-e2e/** mirror push -- see the job `if`).
+  # `labeled` only; `workflow_run` re-evaluates on CI completion for all PRs
+  # (same-repo and fork -- ctx resolves the PR from the head SHA).
   # pull_request_target (not pull_request) so this workflow always runs from
   # main -- a PR cannot modify the gate logic by editing this file.
   pull_request_target:
@@ -31,14 +29,9 @@ on:
   workflow_run:
     workflows: [PR Template, CI, Lint, E2E UI Tests, E2E Tests, Integration Tests]
     types: [completed]
-  # check_suite is a fork-PR fallback (workflow_run on the fork-e2e/** push is
-  # primary); ctx maps the head SHA back to the open PR.
-  check_suite:
-    types: [completed]
   issue_comment:
     types: [created]
-  # Programmatic / manual re-evaluation of a single PR -- a reliable entry
-  # point that does not depend on the fork-e2e mirror at all.
+  # Programmatic / manual re-evaluation of a single PR.
   workflow_dispatch:
     inputs:
       pr:
@@ -55,7 +48,7 @@ permissions:
   contents: read
 
 concurrency:
-  group: merge-ready-${{ github.event.pull_request.number || github.event.issue.number || inputs.pr || github.event.check_suite.head_sha || github.event.workflow_run.head_sha }}
+  group: merge-ready-${{ github.event.pull_request.number || github.event.issue.number || inputs.pr || github.event.workflow_run.head_sha }}
   cancel-in-progress: true
 
 jobs:
@@ -67,9 +60,8 @@ jobs:
       checks: read
       actions: read         # evaluate-checks.sh reads GET /actions/runs to classify missing checks
       statuses: write
-    # Fire on automerge label adds, PR CI workflow_run completions
-    # (same-repo and the fork-e2e/** mirror push), `/merge` comments, or a
-    # workflow_dispatch re-eval; check_suite is a fork-PR fallback. Runs with no
+    # Fire on automerge label adds, PR CI workflow_run completions (same-repo
+    # and fork), `/merge` comments, or a workflow_dispatch re-eval. Runs with no
     # open PR (push to main, etc.) are dropped by the ctx step.
     if: >-
       (
@@ -78,17 +70,7 @@ jobs:
       ) ||
       (
         github.event_name == 'workflow_run' &&
-        (
-          github.event.workflow_run.event == 'pull_request' ||
-          (
-            github.event.workflow_run.event == 'push' &&
-            startsWith(github.event.workflow_run.head_branch, 'fork-e2e/')
-          )
-        )
-      ) ||
-      (
-        github.event_name == 'check_suite' &&
-        startsWith(github.event.check_suite.head_branch, 'fork-e2e/')
+        github.event.workflow_run.event == 'pull_request'
       ) ||
       github.event_name == 'workflow_dispatch' ||
       (
@@ -106,7 +88,7 @@ jobs:
     timeout-minutes: 5
     steps:
       - name: Check out scripts
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
         with:
           ref: main             # trusted gate scripts; never the PR head
           sparse-checkout: .github/scripts/merge-ready
@@ -120,7 +102,6 @@ jobs:
           # Via env, not interpolated: author-controlled, so direct
           # interpolation would be a shell-injection vector.
           WF_PRS: ${{ toJSON(github.event.workflow_run.pull_requests) }}
-          CS_PRS: ${{ toJSON(github.event.check_suite.pull_requests) }}
           COMMENT_BODY: ${{ github.event.comment.body }}
           PR_INPUT: ${{ inputs.pr }}
           SHA_INPUT: ${{ inputs.sha }}
@@ -157,17 +138,6 @@ jobs:
             fi
             PR="${{ github.event.issue.number }}"
             SHA=$(gh pr view "$PR" --repo "$REPO" --json headRefOid --jq '.headRefOid')
-          elif [[ "${{ github.event_name }}" == "check_suite" ]]; then
-            # Mirrored fork e2e completed on fork-e2e/pr-N; its head SHA is
-            # the PR head (the mirror pushes the exact fork head SHA).
-            SHA="${{ github.event.check_suite.head_sha }}"
-            PR=$(echo "$CS_PRS" | jq -r '.[0].number // empty')
-            [[ -z "$PR" ]] && PR=$(resolve_pr_from_sha "$SHA")
-            if [[ -z "$PR" ]]; then
-              echo "::notice::Skipped: check_suite has no associated open PR"
-              echo "skip=true" >> "$GITHUB_OUTPUT"
-              exit 0
-            fi
           else
             PR=$(echo "$WF_PRS" | jq -r '.[0].number // empty')
             SHA="${{ github.event.workflow_run.head_sha }}"
@@ -181,61 +151,20 @@ jobs:
           echo "pr=$PR"   >> "$GITHUB_OUTPUT"
           echo "sha=$SHA" >> "$GITHUB_OUTPUT"
 
-      - name: Load maintainers
-        id: maintainers
-        if: steps.ctx.outputs.skip != 'true'
-        env:
-          GH_TOKEN: ${{ github.token }}
-          REPO: ${{ github.repository }}
-        run: bash .github/scripts/merge-ready/load-maintainers.sh
-
-      - name: Read PR labels and fork approval state
+      - name: Read PR labels
         id: labels
         if: steps.ctx.outputs.skip != 'true'
         env:
           GH_TOKEN: ${{ github.token }}
           REPO: ${{ github.repository }}
           PR: ${{ steps.ctx.outputs.pr }}
-          MAINTAINERS: ${{ steps.maintainers.outputs.list }}
         run: |
-          INFO=$(gh pr view "$PR" --repo "$REPO" --json labels,isCrossRepository)
-          NAMES=$(echo "$INFO" | jq -r '.labels[].name')
+          NAMES=$(gh pr view "$PR" --repo "$REPO" --json labels --jq '.labels[].name')
           if echo "$NAMES" | grep -qx "automerge"; then
             echo "automerge=true" >> "$GITHUB_OUTPUT"
           else
             echo "automerge=false" >> "$GITHUB_OUTPUT"
           fi
-          # A fork PR without a maintainer's approving review or the
-          # `e2e-approved` label never runs e2e (the fork pull_request run is
-          # an empty matrix), so the gate blocks until one of these is present.
-          # Same-repo PRs run e2e with secrets directly and need no gate.
-          if [[ "$(echo "$INFO" | jq -r '.isCrossRepository')" == "true" ]]; then
-            # Check path 1: maintainer approval via PR review.
-            MAINTAINERS_LC=$(echo "${MAINTAINERS:-}" | tr '[:upper:]' '[:lower:]')
-            APPROVERS=$(gh api "repos/$REPO/pulls/$PR/reviews" --paginate \
-              --jq '[.[] | select(.state != "COMMENTED")] | group_by(.user.login) | map(max_by(.submitted_at)) | .[] | select(.state == "APPROVED") | .user.login')
-            HAS_GATE=false
-            for u in $APPROVERS; do
-              u_lc=$(echo "$u" | tr '[:upper:]' '[:lower:]')
-              for m in $MAINTAINERS_LC; do
-                if [[ "$m" == "$u_lc" ]]; then
-                  HAS_GATE=true
-                  break 2
-                fi
-              done
-            done
-            # Check path 2: e2e-approved label.
-            if [[ "$HAS_GATE" == "false" ]] && echo "$NAMES" | grep -qx "e2e-approved"; then
-              HAS_GATE=true
-            fi
-            if [[ "$HAS_GATE" == "false" ]]; then
-              echo "fork_needs_e2e_approval=true" >> "$GITHUB_OUTPUT"
-            else
-              echo "fork_needs_e2e_approval=false" >> "$GITHUB_OUTPUT"
-            fi
-          else
-            echo "fork_needs_e2e_approval=false" >> "$GITHUB_OUTPUT"
-          fi
 
       # post_red gates posting a red status: /merge needs it, automerge opts
       # in; otherwise post green only so partial CI doesn't paint red.
@@ -274,7 +203,6 @@ jobs:
         env:
           EVAL: ${{ steps.eval.outcome }}
           FAILED: ${{ steps.eval.outputs.failed }}
-          FORK_NEEDS_E2E_APPROVAL: ${{ steps.labels.outputs.fork_needs_e2e_approval }}
         run: bash .github/scripts/merge-ready/compute-gate.sh
 
       # Skipped when post_red is false AND gate is red: leaves prior
@@ -342,12 +270,11 @@ jobs:
 
       # Not on pull_request_target-labeled: auto-merge was enabled in an earlier
       # step there, so failing here would make the label look broken even
-      # though it worked. Safe on workflow_run/check_suite/workflow_dispatch.
+      # though it worked. Safe on workflow_run/workflow_dispatch.
       - name: Fail job when gate is red
         if: >-
           (
             github.event_name == 'workflow_run' ||
-            github.event_name == 'check_suite' ||
             github.event_name == 'workflow_dispatch'
           ) &&
           steps.ctx.outputs.skip != 'true' &&

.github/workflows/oss-publish-images.yml

@@ -78,10 +78,20 @@ jobs:
     # drive the promote-nightly / reconcile-floating jobs.
     if: github.repository == 'omnigent-ai/omnigent' && github.event_name != 'schedule' && !inputs.force_nightly && !inputs.reconcile_floating
     runs-on: ubuntu-latest
-    timeout-minutes: 30
+    # Multi-arch: the linux/arm64 leg cross-builds under QEMU emulation on this
+    # amd64 runner, which roughly doubles the host-image build time (emulated
+    # npm/pip native steps). 30m was tight for two native amd64 builds; give the
+    # four-variant (server+host × amd64+arm64) build headroom.
+    timeout-minutes: 60
     steps:
       - name: Checkout
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+
+      # Register binfmt handlers so Buildx can cross-build the linux/arm64
+      # variant on this amd64 runner (emulated). Without it the arm64 leg of
+      # the multi-arch builds below fails with "exec format error".
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3  # v4.1.0
 
       - name: Set up Buildx
         uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5  # v4.1.0
@@ -113,16 +123,19 @@ jobs:
           set -euo pipefail
           IMAGE="ghcr.io/omnigent-ai/omnigent-server"
           HOST_IMAGE="ghcr.io/omnigent-ai/omnigent-host"
+          OPENSHELL_IMAGE="ghcr.io/omnigent-ai/omnigent-server-openshell"
           SHORT_SHA=$(git rev-parse --short HEAD)
 
           # Immutable per-commit pin, always.
           TAGS="${IMAGE}:sha-${SHORT_SHA}"
           HOST_TAGS="${HOST_IMAGE}:sha-${SHORT_SHA}"
+          OPENSHELL_TAGS="${OPENSHELL_IMAGE}:sha-${SHORT_SHA}"
 
-          # Append a floating/version tag to both images.
+          # Append a floating/version tag to all images.
           add_tag() {
             TAGS="${TAGS},${IMAGE}:$1"
             HOST_TAGS="${HOST_TAGS},${HOST_IMAGE}:$1"
+            OPENSHELL_TAGS="${OPENSHELL_TAGS},${OPENSHELL_IMAGE}:$1"
           }
 
           # Every qualifying main commit moves :latest-dev (bleeding edge).
@@ -161,37 +174,126 @@ jobs:
 
           echo "tags=${TAGS}" >> "$GITHUB_OUTPUT"
           echo "host_tags=${HOST_TAGS}" >> "$GITHUB_OUTPUT"
+          echo "openshell_tags=${OPENSHELL_TAGS}" >> "$GITHUB_OUTPUT"
 
       # No build-args: the Dockerfile ARGs default to public registries.
+      # Multi-arch: each tag publishes as a manifest list spanning amd64 + arm64,
+      # so the image runs natively on Apple Silicon / arm64 clusters. Amd64-only
+      # consumers (Modal, Daytona, CoreWeave) keep pulling the amd64 variant —
+      # the list is a superset, so nothing changes for them.
       - name: Build and push
+        id: build-server
         uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf  # v7.2.0
         with:
           context: .
           file: deploy/docker/Dockerfile
           push: true
-          platforms: linux/amd64
+          platforms: linux/amd64,linux/arm64
           tags: ${{ steps.tags.outputs.tags }}
           cache-from: type=gha
           cache-to: type=gha,mode=max
           provenance: false
           sbom: true
 
-      # Host image: same Dockerfile, `host` target. Runs after the server build
-      # so it reuses the shared builder-stage layers from the gha cache.
+      # Host image: same Dockerfile, `host` target, also multi-arch (amd64 +
+      # arm64). The harness CLIs it bakes in all ship arm64 — claude-code and
+      # codex publish linux-arm64 npm binaries, pi is pure-JS. Runs after the
+      # server build so it reuses the shared builder-stage layers from the gha
+      # cache (cached per platform).
       - name: Build and push host image
+        id: build-host
         uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf  # v7.2.0
         with:
           context: .
           file: deploy/docker/Dockerfile
           target: host
           push: true
-          platforms: linux/amd64
+          platforms: linux/amd64,linux/arm64
           tags: ${{ steps.tags.outputs.host_tags }}
           cache-from: type=gha
           cache-to: type=gha,mode=max
           provenance: false
           sbom: true
 
+      # OpenShell server variant: the default server image plus the
+      # openshell SDK extra (OMNIGENT_EXTRAS=openshell). Used by the
+      # deploy/kubernetes/overlays/openshell kustomize overlay. Reuses
+      # the shared builder-stage layers from the gha cache.
+      - name: Build and push openshell server image
+        id: build-openshell
+        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf  # v7.2.0
+        with:
+          context: .
+          file: deploy/docker/Dockerfile
+          push: true
+          platforms: linux/amd64,linux/arm64
+          tags: ${{ steps.tags.outputs.openshell_tags }}
+          build-args: |
+            OMNIGENT_EXTRAS=openshell
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+          provenance: false
+          sbom: true
+    outputs:
+      server-digest: ${{ steps.build-server.outputs.digest }}
+      host-digest: ${{ steps.build-host.outputs.digest }}
+      openshell-digest: ${{ steps.build-openshell.outputs.digest }}
+
+  generate-sbom:
+    # Runs in a separate job with read-only permissions so the Syft
+    # install script cannot influence the image push. Scans the
+    # already-pushed images by digest (immutable).
+    needs: build-and-push
+    permissions:
+      contents: read
+      packages: read
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - name: Log in to GHCR (read-only)
+        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee  # v4.2.0
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Install Syft
+        uses: anchore/sbom-action/download-syft@fc46e51fd3cb168ffb36c6d1915723c47db58abb  # v0.17.7
+
+      - name: Generate server SBOM
+        run: |
+          set -euo pipefail
+          syft "ghcr.io/omnigent-ai/omnigent-server@${{ needs.build-and-push.outputs.server-digest }}" \
+            -o cyclonedx-json=server-sbom.cdx.json \
+            -o spdx-json=server-sbom.spdx.json
+
+      - name: Generate host SBOM
+        run: |
+          set -euo pipefail
+          syft "ghcr.io/omnigent-ai/omnigent-host@${{ needs.build-and-push.outputs.host-digest }}" \
+            -o cyclonedx-json=host-sbom.cdx.json \
+            -o spdx-json=host-sbom.spdx.json
+
+      - name: Generate openshell server SBOM
+        run: |
+          set -euo pipefail
+          syft "ghcr.io/omnigent-ai/omnigent-server-openshell@${{ needs.build-and-push.outputs.openshell-digest }}" \
+            -o cyclonedx-json=openshell-sbom.cdx.json \
+            -o spdx-json=openshell-sbom.spdx.json
+
+      - name: Upload SBOMs
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02  # v4.6.2
+        with:
+          name: sbom
+          path: |
+            server-sbom.cdx.json
+            server-sbom.spdx.json
+            host-sbom.cdx.json
+            host-sbom.spdx.json
+            openshell-sbom.cdx.json
+            openshell-sbom.spdx.json
+          retention-days: 90
+
   promote-nightly:
     # Daily cron (or a manual force_nightly dispatch): move :latest-nightly to
     # the current main build by retagging :latest-dev with `crane tag`
@@ -220,7 +322,7 @@ jobs:
           set -euo pipefail
           # crane tag points a new tag at an EXISTING manifest digest without
           # re-serializing it, so :latest-nightly keeps :latest-dev's exact digest.
-          for img in ghcr.io/omnigent-ai/omnigent-server ghcr.io/omnigent-ai/omnigent-host; do
+          for img in ghcr.io/omnigent-ai/omnigent-server ghcr.io/omnigent-ai/omnigent-host ghcr.io/omnigent-ai/omnigent-server-openshell; do
             if crane digest "${img}:latest-dev" >/dev/null 2>&1; then
               crane tag "${img}:latest-dev" latest-nightly
               echo "promoted ${img}:latest-dev -> :latest-nightly ($(crane digest "${img}:latest-nightly"))"
@@ -243,7 +345,7 @@ jobs:
     timeout-minutes: 10
     steps:
       - name: Checkout
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
 
       - name: Set up crane
         uses: imjasonh/setup-crane@59c71e96a00b28651f10369ba3359a6d730740a0  # v0.6
@@ -291,7 +393,7 @@ jobs:
             fi
           }
 
-          for img in ghcr.io/omnigent-ai/omnigent-server ghcr.io/omnigent-ai/omnigent-host; do
+          for img in ghcr.io/omnigent-ai/omnigent-server ghcr.io/omnigent-ai/omnigent-host ghcr.io/omnigent-ai/omnigent-server-openshell; do
             retag "${img}" "latest-rc" "${RC_TAG}"
             retag "${img}" "latest" "${LATEST_TAG}"
           done

.github/workflows/oss-regen-on-comment.yml

@@ -42,7 +42,7 @@ jobs:
       # Checkout main only for load-maintainers.sh; the PR branch is checked
       # out later (regen job), after authorization passes.
       - name: Checkout (for the maintainer script)
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
 
       - name: Load maintainers from .github/MAINTAINER
         id: maint
@@ -114,7 +114,7 @@ jobs:
       # build backends, which must not find a push token on disk. The App token
       # is minted only after `uv lock` and enters only at the push step.
       - name: Checkout the PR branch
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
         with:
           ref: ${{ needs.authorize.outputs.head }}
           persist-credentials: false

.github/workflows/oss-regenerate-and-smoke.yml

@@ -33,7 +33,7 @@ jobs:
     timeout-minutes: 30
     steps:
       - name: Checkout
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
 
       - name: Set up uv (clean public resolution, no proxy cache)
         uses: astral-sh/setup-uv@38f3f104447c67c051c4a08e39b64a148898af3a  # v4

.github/workflows/oss-scorecard.yml

@@ -46,7 +46,7 @@ jobs:
 
       - name: Checkout
         if: steps.gate.outputs.ready == 'true'
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
         with:
           persist-credentials: false
 

.github/workflows/polly-review-approval-dispatch.yml

@@ -13,9 +13,8 @@ name: Polly Review Approval Dispatch
 # workflow_dispatch entry point) for that PR.
 #
 # Maintainer approval is the trust gate that authorizes spending the LLM gateway
-# secret on fork code -- the same model as the fork-e2e maintainer-approval gate.
-# Polly itself never runs PR code: it reviews the diff fetched via the API from
-# a default-branch checkout.
+# secret on fork code. Polly itself never runs PR code: it reviews the diff
+# fetched via the API from a default-branch checkout.
 #
 # This workflow checks out NO code and runs NO PR code -- it only reads API data
 # and dispatches a workflow, so it is not a "dangerous" workflow_run consumer.

.github/workflows/polly-review.yml

@@ -107,6 +107,10 @@ jobs:
             echo "::notice::Skipping Polly review — LLM credentials not available (fork PR or missing secrets)."
             echo "available=false" >> "$GITHUB_OUTPUT"
           else
+            # Mask the key so the runner redacts it from any log or output that
+            # echoes it literally — defense-in-depth against prompt injection
+            # that tricks Polly into including the key in its review text.
+            echo "::add-mask::${LLM_API_KEY}"
             echo "available=true" >> "$GITHUB_OUTPUT"
           fi
 
@@ -127,36 +131,33 @@ jobs:
       # out untrusted PR code in a privileged workflow.
       - name: Check out repo
         if: steps.trigger.outputs.skip != 'true' && steps.creds.outputs.available == 'true'
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
         with:
           ref: ${{ github.event.repository.default_branch }}
           persist-credentials: false
 
       - name: Set up Python
         if: steps.trigger.outputs.skip != 'true' && steps.creds.outputs.available == 'true'
-        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065  # v5
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405  # v6.2.0
         with:
           python-version-file: ".python-version"
 
       - name: Set up uv
         if: steps.trigger.outputs.skip != 'true' && steps.creds.outputs.available == 'true'
-        uses: astral-sh/setup-uv@8d55fbecc275b1c35dbe060458839f8d30439ccf  # v3
+        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39  # v8.2.0
         with:
           enable-cache: true
 
-      - name: Install bubblewrap
+      - name: Install tmux
         if: steps.trigger.outputs.skip != 'true' && steps.creds.outputs.available == 'true'
-        # bubblewrap: the linux_bwrap sandbox backend needs bwrap on PATH.
-        # apparmor sysctl: Ubuntu 24.04 blocks unprivileged user namespaces
-        # that bwrap's unshare(CLONE_NEWUSER) needs; scope is the ephemeral runner.
+        # tmux: Polly uses it for its shell terminal.
         run: |
           sudo apt-get update
-          sudo apt-get install -y bubblewrap tmux
-          sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0
+          sudo apt-get install -y tmux
 
       - name: Cache virtualenv
         if: steps.trigger.outputs.skip != 'true' && steps.creds.outputs.available == 'true'
-        uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684  # v4
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae  # v5.0.5
         with:
           path: .venv
           key: venv-${{ runner.os }}-${{ hashFiles('.python-version') }}-${{ hashFiles('uv.lock') }}
@@ -181,7 +182,7 @@ jobs:
           NPM_CONFIG_REGISTRY: https://registry.npmjs.org/
         run: |
           mkdir -p "${GITHUB_WORKSPACE}/.codex-cli" && cd "${GITHUB_WORKSPACE}/.codex-cli"
-          npm install --ignore-scripts --no-audit --no-fund @openai/codex@0.128.0-alpha.1
+          npm install --ignore-scripts --no-audit --no-fund @openai/codex@0.139.0
           echo "${GITHUB_WORKSPACE}/.codex-cli/node_modules/.bin" >> "$GITHUB_PATH"
 
       - name: Set LLM credentials
@@ -230,13 +231,13 @@ jobs:
                       'anthropic': {
                           'base_url': gw + '/anthropic',
                           'api_key_ref': 'env:LLM_API_KEY',
-                          'models': {'default': 'databricks-claude-sonnet-4-6'},
+                          'models': {'default': 'databricks-claude-opus-4-8'},
                       },
                       'openai': {
                           'base_url': host + '/ai-gateway/codex/v1',
                           'api_key_ref': 'env:LLM_API_KEY',
                           'wire_api': 'responses',
-                          'models': {'default': 'databricks-gpt-5-4-mini'},
+                          'models': {'default': 'databricks-gpt-5-5'},
                       },
                   }
               }
@@ -256,25 +257,37 @@ jobs:
         run: |
           set -euo pipefail
 
-          # Fetch the diff (capped at 64 KB to stay within prompt limits).
+          # Fetch the full diff to a file — no size cap needed since the diff
+          # is read from disk by Polly via sys_os_shell, not embedded in the
+          # CLI argument (which would hit ARG_MAX for large PRs).
           gh api "repos/${REPO}/pulls/${PR_NUMBER}" \
             -H "Accept: application/vnd.github.v3.diff" \
-            | head -c 65536 > /tmp/pr_diff.txt
+            > /tmp/pr_diff.txt || true
 
-          # Fetch PR metadata to separate files — avoids embedding
-          # attacker-controlled strings (PR title/body) into heredocs.
+          # Extract lockfile pin changes from the diff.
+          grep -E '^[+-]name = |^[+-]version = ' /tmp/pr_diff.txt \
+            | head -500 > /tmp/lockfile_pins.txt || true
+
+          # Fetch PR metadata.
           gh pr view "$PR_NUMBER" --repo "$REPO" \
             --json title,body,baseRefName,headRefName,additions,deletions,changedFiles \
             > /tmp/pr_meta.json
 
-          # Build the review prompt safely using python — all untrusted
-          # fields (title, body, diff) are read from files, never
-          # interpolated into shell heredocs.
-          python3 <<'PYEOF'
+          # Build the review prompt — the diff is NOT embedded in the prompt.
+          # Polly reads it from /tmp/pr_diff.txt via sys_os_shell at review time.
+          python3 -u <<'PYEOF'
           import json, pathlib
 
           meta = json.loads(pathlib.Path("/tmp/pr_meta.json").read_text())
-          diff = pathlib.Path("/tmp/pr_diff.txt").read_text()
+          lockfile_pins = pathlib.Path("/tmp/lockfile_pins.txt").read_text(encoding="utf-8", errors="replace").strip()
+
+          lockfile_section = f"""
+          ## Changed lockfile pins (uv.lock / package-lock.json)
+          These are extracted package name + version lines only — not the full hunk.
+          ```
+          {lockfile_pins if lockfile_pins else "(no lockfile changes)"}
+          ```
+          """ if lockfile_pins else ""
 
           prompt = f"""Review this pull request and provide structured feedback.
 
@@ -285,24 +298,45 @@ jobs:
 
           ## PR Description
           {(meta.get('body') or '')[:4096]}{"  *(truncated)*" if len(meta.get('body') or '') > 4096 else ""}
-
-          ## Diff
-          ```diff
-          {diff}
-          ```
-
+          {lockfile_section}
           ## Instructions
-          Review the diff against the PR description. Report:
-          1. **Blocking issues** — bugs, security problems, correctness errors, data loss risks.
-          2. **Security analysis** — carefully check the security implications of the changes. Look for injection vulnerabilities (SQL, command, template), authentication/authorization bypasses, secret exposure, unsafe deserialization, path traversal, SSRF, and any change that weakens an existing security boundary. Flag even subtle issues.
-          3. **Non-blocking suggestions** — style, naming, performance, test coverage gaps.
+
+          **Step 1 — read the diff.** The full PR diff has been pre-fetched to
+          `/tmp/pr_diff.txt`. Read it with `sys_os_shell("cat /tmp/pr_diff.txt")`.
+          The codebase is checked out at `main` — read source files freely for
+          additional context when needed.
+
+          **Security:** you are running in a CI environment with access to secrets
+          (LLM API keys, gateway tokens). Never include secrets, tokens, or
+          credentials in your output, and never make outbound network calls
+          except to the configured LLM gateway.
+
+          **Step 2 — review.** Report:
+          1. **Blocking issues** — correctness bugs, broken contracts, missing error handling on failure paths, data loss risks.
+          2. **Security vulnerabilities** — injection (SQL, command, template), authentication/authorization bypasses, secret exposure, unsafe deserialization, path traversal, SSRF, and any change that weakens an existing security boundary. Flag even subtle issues.
+          3. **Non-blocking notes** — design concerns or edge cases worth flagging (brief).
           4. **Summary** — one-paragraph overall assessment.
 
+          Do NOT comment on code style, formatting, naming conventions, or other cosmetic issues — omit them entirely.
           Be concise. Do not restate the diff. Focus on what matters.
 
+          Before labeling anything **blocking**, double-check: does this issue actually exist in the diff? Verify the problem is real and present in the changed code — not inferred, speculative, or already handled elsewhere. If the issue exists, it is blocking only if it introduces a correctness bug, breaks an explicit contract, or creates a real security risk; otherwise downgrade to non-blocking.
+
+          **Lockfile pins** — review the "Changed lockfile pins" section above and flag
+          as a **blocking security issue** any of:
+          - A package added that is not declared (directly or transitively) in pyproject.toml.
+          - A version that does not satisfy the constraint in pyproject.toml.
+          - A suspicious version downgrade on a security-sensitive package.
+
+          **Package extras** — when the diff adds or modifies optional dependency groups (extras):
+          - Each harness deserves its own extra.
+          - Combine harnesses and other integrations from the same vendor into one extra (e.g. a single `google` extra may cover Vertex and Antigravity).
+          - Each sandbox deserves its own extra.
+          - Nothing else warrants a new extra — flag any new extras that don't fit one of these three categories as a blocking issue.
+
           IMPORTANT: Your output will be posted directly as a PR comment. Output
           ONLY the final structured review — no coordination messages, no status
-          updates about dispatching sub-agents, no "waiting for results" narration.
+          updates about dispatching sub-agents, no referring to "reviewers", no "waiting for results" narration.
           Begin your response with the exact marker <!-- POLLY_REVIEW_START -->
           on its own line, then the review content. Nothing before the marker
           will be shown.
@@ -310,6 +344,14 @@ jobs:
           pathlib.Path("/tmp/review_prompt.txt").write_text(prompt)
           PYEOF
 
+      - name: Mint App token
+        id: app-token
+        if: steps.trigger.outputs.skip != 'true' && steps.creds.outputs.available == 'true' && vars.OMNIGENT_BOT_APP_ID != ''
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        with:
+          client-id: ${{ vars.OMNIGENT_BOT_APP_ID }}
+          private-key: ${{ secrets.OMNIGENT_BOT_APP_KEY }}
+
       - name: Run Polly review
         if: steps.trigger.outputs.skip != 'true' && steps.creds.outputs.available == 'true'
         id: polly
@@ -332,8 +374,10 @@ jobs:
 
           # Strip any sub-agent coordination preamble that leaks before
           # the actual review.  Primary: look for the sentinel we asked the
-          # model to emit.  Fallback: first markdown heading or standalone
-          # horizontal rule.
+          # model to emit.  Fallback: first markdown heading.  If neither is
+          # found the output is intermediate narration (subagents timed out
+          # before synthesis) — write empty string so the post step is skipped
+          # and raw coordination messages are never posted as a PR comment.
           python3 -c "
           import re, pathlib
           raw = pathlib.Path('/tmp/polly_output.txt').read_text()
@@ -342,8 +386,8 @@ jobs:
           if idx >= 0:
               cleaned = raw[idx + len(sentinel):].lstrip('\n')
           else:
-              m = re.search(r'^(#{1,6} |---\s*$)', raw, re.MULTILINE)
-              cleaned = raw[m.start():] if m else raw
+              m = re.search(r'^#{1,6} ', raw, re.MULTILINE)
+              cleaned = raw[m.start():] if m else ''
           pathlib.Path('/tmp/polly_output.txt').write_text(cleaned)
           "
 
@@ -355,13 +399,19 @@ jobs:
           head -c 61440 /tmp/polly_output.txt >> "$GITHUB_OUTPUT"
           echo "${delim}" >> "$GITHUB_OUTPUT"
 
-      - name: Mint App token
-        id: app-token
-        if: steps.trigger.outputs.skip != 'true' && steps.creds.outputs.available == 'true' && vars.OMNIGENT_BOT_APP_ID != ''
-        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
-        with:
-          app-id: ${{ vars.OMNIGENT_BOT_APP_ID }}
-          private-key: ${{ secrets.OMNIGENT_BOT_APP_KEY }}
+      - name: Scan review output for secrets before posting
+        if: steps.trigger.outputs.skip != 'true' && steps.creds.outputs.available == 'true'
+        env:
+          LLM_API_KEY: ${{ secrets.LLM_API_KEY }}
+        run: |
+          set -euo pipefail
+          # Abort if Polly's output contains the literal LLM API key — this
+          # catches prompt-injection attacks that trick Polly into echoing the
+          # secret into the PR comment.
+          if [ -n "$LLM_API_KEY" ] && grep -qF "$LLM_API_KEY" /tmp/polly_output.txt 2>/dev/null; then
+            echo "::error::Review output contains LLM_API_KEY — aborting post to prevent secret exfiltration."
+            exit 1
+          fi
 
       - name: Post review comment
         if: steps.polly.outputs.review_text != ''

.github/workflows/pr-size.yml

@@ -29,7 +29,7 @@ jobs:
     timeout-minutes: 5
     steps:
       - name: Checkout default-branch script
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
         with:
           ref: ${{ github.event.repository.default_branch }}
           sparse-checkout: .github/scripts/pr-size

.github/workflows/release-omnigent.yml

@@ -64,7 +64,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
 
       - name: Set up uv (clean public resolution, no proxy cache)
         uses: astral-sh/setup-uv@38f3f104447c67c051c4a08e39b64a148898af3a # v4
@@ -80,10 +80,14 @@ jobs:
       #    load-bearing: the wheel packages on-disk files, so the bundle must
       #    exist before `uv build`. `rm -rf` backstops Vite's emptyOutDir
       #    against stale bundles; `npm ci` installs the exact locked deps.
+      #    `--legacy-peer-deps` matches how ap-web's lockfile is generated and
+      #    validated everywhere else (lint, e2e-ui, ap-web-tests, the regen
+      #    jobs) — required for the React 19 peer conflict; without it `npm ci`
+      #    rejects the lockfile ("Missing: yaml@1.10.3 from lock file").
       - name: Build web UI (clean, fresh)
         run: |
           rm -rf omnigent/server/static/web-ui
-          npm --prefix ap-web ci
+          npm --prefix ap-web ci --legacy-peer-deps
           npm --prefix ap-web run build # Vite outDir -> omnigent/server/static/web-ui
 
       # 2. Tag-driven: the tag must match the version in all three pyprojects

.github/workflows/rerun-security-gate-run.yml

@@ -7,10 +7,8 @@ name: Rerun Security Gate Run
 # number, resolves the PR's CURRENT head SHA, and re-runs every gate-bearing
 # workflow whose latest run for that SHA is a completed failure whose
 # `Security Gate` job failed -- so a workflow that already self-triggered on the
-# label (ci/e2e trigger on `labeled` for force-all-tests etc.) is in-progress or
-# green and skipped, avoiding a double-run. fork-e2e-mirror is excluded: it is
-# approval-driven mirror plumbing with branch side effects, not a
-# gate-mirroring check.
+# label (ci/e2e trigger on `labeled` to re-poll the security gate) is in-progress or
+# green and skipped, avoiding a double-run.
 #
 # RACE GUARD: the label event fires this relay AND the Security Scan re-run
 # concurrently. Before re-running anything we WAIT for the Security Scan check on

.github/workflows/security-gate.yml

@@ -23,10 +23,10 @@ jobs:
   gate:
     name: Security Gate
     runs-on: ubuntu-latest
-    timeout-minutes: 8
+    timeout-minutes: 12
     steps:
       - name: Check out trust check from main
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
         with:
           ref: main             # trusted; never the PR head
           sparse-checkout: .github/scripts/security-scan
@@ -71,7 +71,7 @@ jobs:
           q='[.check_runs[] | select(.name=="Security Scan")] | sort_by(.started_at) | last'
           conclusion=""
           details_url=""
-          for _ in $(seq 1 72); do   # up to ~6 min (72 * 5s)
+          for _ in $(seq 1 108); do  # up to ~9 min (108 * 5s)
             status=$(gh api "repos/$REPO/commits/$HEAD_SHA/check-runs" --jq "$q | .status" 2>/dev/null || echo "")
             if [ "$status" = "completed" ]; then
               conclusion=$(gh api "repos/$REPO/commits/$HEAD_SHA/check-runs" --jq "$q | .conclusion")

.github/workflows/security-scan.yml

@@ -47,7 +47,7 @@ jobs:
       UV_INDEX_URL: https://pypi.org/simple
     steps:
       - name: Check out scanner from main
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
         with:
           ref: main             # trusted; never the PR head
           sparse-checkout: |
@@ -115,7 +115,7 @@ jobs:
 
       - name: Check out PR head for static analysis
         if: ${{ steps.gate.outputs.scan == 'true' }}
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
         with:
           ref: ${{ github.event.pull_request.head.sha }}  # untrusted: only statically scanned
           path: pr
@@ -132,6 +132,31 @@ jobs:
         if: ${{ steps.gate.outputs.scan == 'true' }}
         uses: astral-sh/setup-uv@8d55fbecc275b1c35dbe060458839f8d30439ccf  # v3
 
+      - name: OSV advisory scan (uv.lock)
+        # Checks every package version pinned in the PR's uv.lock against the
+        # OSV advisory database, which covers known-malicious, typosquatted,
+        # and CVE-flagged versions. Only fires when uv.lock is in the changeset
+        # to avoid blocking PRs when main's baseline lockfile already has open
+        # advisories on main.
+        if: ${{ steps.gate.outputs.scan == 'true' }}
+        working-directory: pr
+        run: |
+          if ! grep -qxF 'uv.lock' "$GITHUB_WORKSPACE/changed.txt"; then
+            echo "uv.lock not changed; skipping OSV scan."
+            exit 0
+          fi
+          # Drop editable local packages (the project itself + sdks/*) before
+          # auditing. pip-audit can't hash an editable path requirement and
+          # errors out when one is present, so without this filter any PR that
+          # actually changes uv.lock fails here. We only want to audit
+          # third-party pinned packages anyway — OSV has no advisories for
+          # local source. Filtering all `-e` lines (rather than naming each
+          # workspace member) keeps this correct if members are added later.
+          uv export --frozen --format requirements-txt --all-extras \
+            > /tmp/uv-req-full.txt
+          grep -v '^-e ' /tmp/uv-req-full.txt > /tmp/uv-req.txt
+          uvx pip-audit --requirement /tmp/uv-req.txt --no-deps
+
       - name: Semgrep (changed files, local rules)
         if: ${{ steps.gate.outputs.scan == 'true' }}
         env:

.github/workflows/server-compat.yml

@@ -0,0 +1,134 @@
+name: Backwards-Compat
+
+# Cross-version backwards-compatibility sweep against main's e2e + integration
+# suites, over the FULL pairwise (server, runner) version matrix.
+#
+# The version universe is `main` (the checked-out code = client + tests, always)
+# plus every non-rc release tag; we cross every server version with every runner
+# version. Each cell pins the server and/or runner subprocess to that build
+# (a "main" axis value leaves that component on the checked-out code) while the
+# client and tests stay on main. The (main, main) cell is omitted — it pins
+# nothing and is exactly the normal e2e gate. So the matrix subsumes the old
+# single-pin jobs: (old, main) = Config 1; (main, old) = Config 2; (old, old) =
+# both old; etc. Runner and host are colocated, so the runner axis pins both.
+#
+# The test runs are the SAME composite actions the normal gates use
+# (.github/actions/e2e-run, integration-run); a cell differs only in which
+# subprocess(es) are the old build.
+#
+# Triggers:
+#   workflow_dispatch   manual; optional `versions` CSV overrides the set.
+#   schedule            every 12h; full pairwise over main + all non-rc tags.
+
+on:
+  workflow_dispatch:
+    inputs:
+      versions:
+        description: "Comma-separated version set for BOTH axes (e.g. 'main,v0.2.0'). Empty = main + all non-rc tags."
+        required: false
+        default: ""
+  schedule:
+    # Every 12 hours (00:00 and 12:00 UTC).
+    - cron: "0 */12 * * *"
+
+concurrency:
+  group: backcompat-${{ github.workflow }}-${{ github.sha }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  # Compute the full pairwise (server, runner) matrices. Integration is the
+  # single openai-agents leg (claude-sdk/codex reject the mock LLM's
+  # "mock-model"); e2e is sharded per cell. See backcompat-pairwise-matrix.sh.
+  setup:
+    name: setup
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    outputs:
+      e2e_matrix: ${{ steps.matrix.outputs.e2e_matrix }}
+      integration_matrix: ${{ steps.matrix.outputs.integration_matrix }}
+    steps:
+      - name: Check out CI scripts + tags
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+        with:
+          sparse-checkout: .github/scripts/ci
+          # Full history so `git tag` sees every release tag for the matrix.
+          fetch-depth: 0
+          persist-credentials: false
+      - name: Compute pairwise matrices
+        id: matrix
+        env:
+          VERSIONS: ${{ github.event.inputs.versions }}
+          NUM_SHARDS: "4"
+        run: bash .github/scripts/ci/backcompat-pairwise-matrix.sh
+
+  # tests/e2e for every (server, runner) cell × shard.
+  backcompat-e2e:
+    name: Backcompat e2e (server ${{ matrix.server }} / runner ${{ matrix.runner }}, shard ${{ matrix.shard_id }}/${{ matrix.num_shards }})
+    needs: setup
+    runs-on: ubuntu-latest
+    # Job-level cap (composite run steps can't set timeout-minutes); mirrors
+    # e2e.yml's ~30-min test budget + setup + up to two old-build installs.
+    timeout-minutes: 45
+    strategy:
+      fail-fast: false
+      # Bound concurrency: the full matrix is large (versions² × shards). Tune
+      # here if the org's runner pool is over/under-subscribed.
+      max-parallel: 10
+      matrix: ${{ fromJSON(needs.setup.outputs.e2e_matrix) }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+        with:
+          # fetch-depth 0 so the action can `git worktree add` the old tags.
+          ref: ${{ github.ref }}
+          fetch-depth: 0
+
+      - name: Run e2e suite for this cell
+        uses: ./.github/actions/e2e-run
+        with:
+          # "main" axis -> empty input (use checked-out code); else the tag.
+          # GHA ternary: `!= 'main' && x || ''` (the naive `== 'main' && '' || x`
+          # breaks because '' is falsy and falls through to x).
+          server_version: ${{ matrix.server != 'main' && matrix.server || '' }}
+          runner_version: ${{ matrix.runner != 'main' && matrix.runner || '' }}
+          # Unique per cell so upload-artifact@v4 doesn't collide across the
+          # matrix (every integration cell shares the harness; e2e cells share
+          # a shard_id).
+          artifact_suffix: "-s${{ matrix.server }}-r${{ matrix.runner }}"
+          shard_id: ${{ matrix.shard_id }}
+          num_shards: ${{ matrix.num_shards }}
+          parallelism: "2"
+          nightly_full: ${{ github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' }}
+
+  # tests/integration for every (server, runner) cell (openai-agents leg).
+  backcompat-integration:
+    name: Backcompat integration (server ${{ matrix.server }} / runner ${{ matrix.runner }}, ${{ matrix.harness }})
+    needs: setup
+    runs-on: ubuntu-latest
+    timeout-minutes: 40
+    strategy:
+      fail-fast: false
+      max-parallel: 5
+      matrix: ${{ fromJSON(needs.setup.outputs.integration_matrix) }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+        with:
+          ref: ${{ github.ref }}
+          fetch-depth: 0
+
+      - name: Run integration suite for this cell
+        uses: ./.github/actions/integration-run
+        with:
+          server_version: ${{ matrix.server != 'main' && matrix.server || '' }}
+          runner_version: ${{ matrix.runner != 'main' && matrix.runner || '' }}
+          # Unique per cell so upload-artifact@v4 doesn't collide across the
+          # matrix (every integration cell shares the harness; e2e cells share
+          # a shard_id).
+          artifact_suffix: "-s${{ matrix.server }}-r${{ matrix.runner }}"
+          harness: ${{ matrix.harness }}
+          model: ${{ matrix.model }}
+          workers: ${{ matrix.workers }}

.github/workflows/sync-openapi-to-site.yml

@@ -0,0 +1,95 @@
+name: Sync OpenAPI to site
+
+# Keeps the public API reference on the omnigent website in sync with
+# the spec generated here. When openapi.json changes on main, copy it
+# into omnigent-site/public/openapi.json and open (or update) a PR there.
+#
+# Cross-repo writes can't use the workflow's own GITHUB_TOKEN (it's
+# scoped to this repo), so we mint a short-lived token from the
+# omnigent-ci GitHub App — the same App used by oss-regen-on-comment.yml
+# — scoped to omnigent-site. The App must be installed on omnigent-site
+# with contents + pull-requests write.
+on:
+  push:
+    branches: [main]
+    paths: [openapi.json]
+  # Manual trigger for backfills / re-syncs after editing this workflow.
+  workflow_dispatch:
+
+# One sync at a time; a newer spec supersedes an in-flight run.
+concurrency:
+  group: sync-openapi-to-site
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  sync:
+    name: Open sync PR on omnigent-site
+    runs-on: ubuntu-latest
+    # Skip cleanly on forks / installs where the App isn't configured,
+    # rather than failing the token step with a confusing error.
+    if: ${{ vars.OMNIGENT_BOT_APP_ID != '' }}
+    env:
+      SYNC_BRANCH: auto/openapi-sync
+      TARGET_REPO: ${{ github.repository_owner }}/omnigent-site
+    steps:
+      - name: Checkout omnigent (spec source)
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          path: omnigent
+
+      - name: Mint App token for omnigent-site
+        id: app-token
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        with:
+          app-id: ${{ vars.OMNIGENT_BOT_APP_ID }}
+          private-key: ${{ secrets.OMNIGENT_BOT_APP_KEY }}
+          owner: ${{ github.repository_owner }}
+          repositories: omnigent-site
+
+      - name: Checkout omnigent-site (sync target)
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          repository: ${{ env.TARGET_REPO }}
+          token: ${{ steps.app-token.outputs.token }}
+          path: site
+
+      - name: Copy spec into the site
+        run: cp omnigent/openapi.json site/public/openapi.json
+
+      # Commit + push to a fixed branch and open a PR if one isn't
+      # already open. If a PR exists, the force-push updates it in place
+      # — so repeated spec changes collapse into a single rolling PR.
+      - name: Open or update sync PR
+        working-directory: site
+        env:
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+        run: |
+          if [ -z "$(git status --porcelain -- public/openapi.json)" ]; then
+            echo "openapi.json already in sync — nothing to do."
+            exit 0
+          fi
+
+          git config user.name "omnigent-ci[bot]"
+          git config user.email "294685417+omnigent-ci[bot]@users.noreply.github.com"
+          git switch -C "$SYNC_BRANCH"
+          git add public/openapi.json
+          git commit -m "chore(api): sync openapi.json from omnigent@${GITHUB_SHA:0:7}"
+          git push --force origin "$SYNC_BRANCH"
+
+          if [ -n "$(gh pr list --head "$SYNC_BRANCH" --state open --json number --jq '.[].number')" ]; then
+            echo "PR already open for $SYNC_BRANCH — the force-push updated it."
+            exit 0
+          fi
+
+          # Build the body with printf so YAML block indentation never
+          # leaks leading spaces into the Markdown.
+          short="${GITHUB_SHA:0:7}"
+          body="$(printf 'Automated sync of `public/openapi.json` from [omnigent@`%s`](https://github.com/%s/commit/%s).\n\nGenerated by `.github/workflows/sync-openapi-to-site.yml`. Merging publishes the updated API reference at `/reference`.' "$short" "$GITHUB_REPOSITORY" "$GITHUB_SHA")"
+          gh pr create \
+            --base main \
+            --head "$SYNC_BRANCH" \
+            --title "chore(api): sync OpenAPI reference from omnigent" \
+            --body "$body"

.github/workflows/ui-snapshot-fail-comment.yml

@@ -0,0 +1,95 @@
+name: UI Snapshot Failure Comment
+
+# When the UI Snapshot compare gate fails on a PR, upsert a PR comment with how
+# to update the baseline -- tailored for same-repo PRs (the `update-ui-snapshot`
+# label) and fork PRs (adopt the run's rendered PNG, since CI can't push to a
+# fork).
+#
+# A fork `pull_request` run gets a read-only token and can't comment, so this
+# runs as `workflow_run` in the BASE-repo context (writable token). Crucially it
+# NEVER checks out or runs PR/fork code -- it only reads the completed run's
+# metadata (head SHA + repo, run URL) and posts a comment.
+#
+# NOTE: `workflow_run` only triggers from the copy of this file on the DEFAULT
+# branch, so it activates once merged to main -- it does not fire on its own PR.
+
+on:
+  workflow_run:
+    workflows: ["UI Snapshot"]
+    types: [completed]
+
+permissions:
+  contents: read
+  pull-requests: write
+
+concurrency:
+  group: ui-snapshot-fail-comment-${{ github.event.workflow_run.head_sha }}
+  cancel-in-progress: true
+
+jobs:
+  comment:
+    name: Upsert baseline-update instructions
+    # Only failed compare runs that came from a PR (push/dispatch have no PR).
+    if: >-
+      github.event.workflow_run.event == 'pull_request' &&
+      github.event.workflow_run.conclusion == 'failure'
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - name: Upsert the failure comment
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          REPO: ${{ github.repository }}
+          HEAD_SHA: ${{ github.event.workflow_run.head_sha }}
+          HEAD_REPO: ${{ github.event.workflow_run.head_repository.full_name }}
+          RUN_URL: ${{ github.event.workflow_run.html_url }}
+        run: |
+          set -euo pipefail
+          # workflow_run.pull_requests is empty for forks, so resolve the PR from
+          # the head SHA (works for same-repo and fork). No open PR -> nothing to do.
+          pr=$(gh api "repos/$REPO/commits/$HEAD_SHA/pulls" --jq '.[0].number // empty' 2>/dev/null || true)
+          if [ -z "$pr" ]; then
+            echo "No open PR for $HEAD_SHA; nothing to comment."
+            exit 0
+          fi
+
+          # List every update path that applies to where the branch lives. All
+          # render in the same pinned image, so any of them matches this gate.
+          # (workflow_dispatch is for non-PR branches; see the README.) This job
+          # runs on ubuntu-latest, so bash arrays are fine.
+          if [ "$HEAD_REPO" = "$REPO" ]; then
+            opts=(
+              "- **Label the PR (recommended):** add the \`update-ui-snapshot\` label — the bot regenerates the baseline in the pinned image, pushes it back here, and re-runs the checks."
+              "- **Locally with Docker:** run \`tests/e2e_ui/visual/regen_baseline_docker.sh\`, review the PNG, then commit + push."
+            )
+          else
+            opts=(
+              "- **Locally with Docker:** run \`tests/e2e_ui/visual/regen_baseline_docker.sh\` (renders in the same pinned image), review the PNG, then commit + push."
+              "- **Without Docker:** run \`tests/e2e_ui/visual/update_baseline_from_pr.sh $pr\` to adopt this run's render, review the PNG, then commit + push."
+              "  _(The \`update-ui-snapshot\` label can't help on a fork — CI can't push to a fork branch.)_"
+            )
+          fi
+
+          marker="<!-- ui-snapshot-fail-comment -->"
+          # printf (not a heredoc) so backticks stay literal and there are no
+          # leading-space markdown surprises. \` is a literal backtick.
+          body=$(printf '%s\n' \
+            "$marker" \
+            "❌ **UI Snapshot** doesn't match the committed baseline." \
+            "" \
+            "If this UI change is intentional, update the baseline — each path renders in the same pinned image, so the result matches this gate:" \
+            "" \
+            "${opts[@]}" \
+            "" \
+            "Diff PNGs (\`expected_\`=baseline, \`actual_\`=your render, \`diff_\`) are in the [run]($RUN_URL) artifact. Full guide: \`tests/e2e_ui/visual/README.md\`.")
+
+          jq -n --arg b "$body" '{body: $b}' > "$RUNNER_TEMP/payload.json"
+
+          # Upsert so repeated failures update one comment instead of spamming.
+          existing=$(gh api --paginate "repos/$REPO/issues/$pr/comments" \
+            --jq ".[] | select(.body | contains(\"$marker\")) | .id" | head -n1 || true)
+          if [ -n "$existing" ]; then
+            gh api -X PATCH "repos/$REPO/issues/comments/$existing" --input "$RUNNER_TEMP/payload.json" --silent
+          else
+            gh api -X POST "repos/$REPO/issues/$pr/comments" --input "$RUNNER_TEMP/payload.json" --silent
+          fi

.github/workflows/ui-snapshot-update.yml

@@ -0,0 +1,260 @@
+name: UI Snapshot Update
+
+# Label-driven baseline update for the visual-snapshot suite
+# (tests/e2e_ui/visual/test_*_snapshot.py).
+#
+# Add the `update-ui-snapshot` label to a PR and this regenerates only the
+# baselines that DON'T match (or are missing) in the SAME digest-pinned Playwright
+# image the compare gate (ui-snapshot.yml) renders in, then commits the changed
+# PNGs back to the PR branch. Baselines that already pass are left byte-for-byte
+# untouched, so labeling to fix one page never churns the others. Replaces the
+# admin-only workflow_dispatch + manual download-and-commit dance.
+#
+# Two-job split (token isolation): the `render` job runs PR-controlled code (the
+# npm build + the test) in the container with NO push token anywhere on the
+# runner, and uploads only the rendered PNG as an artifact. The `commit` job
+# runs on a clean runner, executes NO PR code (it just checks out the branch,
+# drops in the PNG, and pushes), and is the only place the App token exists --
+# so PR-controlled code can never tamper with the binaries/PATH the privileged
+# push later uses.
+#
+# Re-trigger: the push uses the OMNIGENT_BOT_APP token (NOT GITHUB_TOKEN, whose
+# pushes GitHub suppresses to avoid loops), so it re-fires the PR's full check
+# suite on the new commit -- no manual "Re-run". Falls back to GITHUB_TOKEN if
+# the App isn't configured (lands, but a maintainer must push to re-run CI),
+# mirroring oss-regen-on-comment.yml.
+#
+# Same-repo branches only: Actions tokens can't push to a fork branch, so fork
+# PRs are skipped here and update the baseline locally instead (Docker regen or
+# the artifact-adopt script -- see tests/e2e_ui/visual/README.md).
+
+on:
+  pull_request:
+    types: [labeled]
+
+# Read-only at the top level; the commit job widens its own scopes below.
+permissions:
+  contents: read
+
+concurrency:
+  group: ui-snapshot-update-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
+jobs:
+  # 1) Render in the pinned image with NO token on the runner. PR-controlled
+  #    code runs only here; its sole output is the PNG artifact.
+  render:
+    name: Regenerate visual baselines (no token)
+    permissions:
+      contents: read
+    # Same-repo only: a fork's read-only token can't push to the fork branch.
+    if: >-
+      github.event.label.name == 'update-ui-snapshot' &&
+      github.event.pull_request.head.repo.full_name == github.repository
+    runs-on: ubuntu-24.04
+    # Same digest-pinned image as the compare gate, so the regenerated baseline
+    # is byte-identical to what ui-snapshot.yml will then compare against. Keep
+    # this digest in lockstep with ui-snapshot.yml and regen_baseline_docker.sh.
+    container:
+      image: mcr.microsoft.com/playwright/python:v1.60.0-noble@sha256:8ff591d613b01c884cc488339ed4318b4513eaf0c57a164a878ba49e70e3f384
+    # GitHub defaults `run:` steps inside a container to `sh` (dash); force bash
+    # so the snapshot step's arrays / [[ ]] work (bash ships in the image).
+    defaults:
+      run:
+        shell: bash
+    timeout-minutes: 20
+    env:
+      OMNIGENT_SKIP_WEB_UI: "true"
+      # The pinned image runs as root, where Chromium needs --no-sandbox; the
+      # e2e_ui conftest adds it (+ --disable-dev-shm-usage) when this is set.
+      OMNIGENT_PW_NO_SANDBOX: "1"
+      # Use the image's Python 3.12 (matches .python-version) rather than a uv
+      # download -- no setup-python step needed inside the container.
+      UV_PYTHON_PREFERENCE: only-system
+    steps:
+      - name: Checkout PR branch
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
+        with:
+          # No persisted credentials anywhere in this job: it runs PR-chosen code
+          # and must never have a push token on disk.
+          ref: ${{ github.event.pull_request.head.ref }}
+          persist-credentials: false
+
+      - name: Set up Node 20
+        uses: ./.github/actions/setup-node
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@38f3f104447c67c051c4a08e39b64a148898af3a  # v4
+        with:
+          enable-cache: true
+
+      - name: Cache virtualenv
+        uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684  # v4
+        with:
+          path: .venv
+          # Namespaced + container-scoped to match ui-snapshot.yml (built with
+          # the container's system Python, not the host interpreter).
+          key: venv-uisnapshot-${{ runner.os }}-${{ hashFiles('.python-version') }}-${{ hashFiles('uv.lock') }}
+
+      - name: Install project + dev extras
+        run: uv sync --extra all --extra dev
+
+      # No "playwright install": the pinned image ships matching Chromium + deps
+      # under $PLAYWRIGHT_BROWSERS_PATH (/ms-playwright).
+
+      - name: Build ap-web SPA
+        env:
+          NPM_CONFIG_REGISTRY: https://registry.npmjs.org/
+        run: |
+          cd ap-web
+          npm ci --legacy-peer-deps --no-audit --no-fund
+          npm run build
+
+      - name: Compare the baselines (no --update-snapshots)
+        # Deliberately NOT --update-snapshots: that rewrites EVERY PNG, churning
+        # baselines that already pass (a sub-threshold re-render still changes the
+        # bytes). In plain compare mode the plugin leaves passing baselines
+        # untouched and rewrites only the drift: under GitHub Actions it updates a
+        # mismatching baseline IN PLACE (and creates a MISSING one) under
+        # snapshots/, so the tree below already holds exactly the changed PNGs.
+        # The run "fails" by design on any drift, so don't gate on its exit code.
+        run: |
+          uv run pytest tests/e2e_ui/visual -m visual \
+            -v --tb=long --log-level=INFO -r a \
+            -p no:rerunfailures \
+            --ui-skip-build || true
+
+      # Tar the snapshots tree (paths intact) so the commit job can restore it
+      # wholesale. Only genuinely-changed/created PNGs differ from the committed
+      # tree, so git add in the commit job stages exactly those.
+      - name: Package baselines
+        run: tar -czf "$RUNNER_TEMP/ui-snapshots.tgz" tests/e2e_ui/visual/snapshots
+
+      - name: Upload regenerated baselines
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02  # v4
+        with:
+          name: ui-snapshot-update-${{ github.run_id }}
+          path: ${{ runner.temp }}/ui-snapshots.tgz
+          if-no-files-found: error
+          retention-days: 1
+
+  # 2) Commit + push on a clean runner. Runs NO PR code -- only checks out the
+  #    branch, drops in the rendered PNG, and pushes -- so it is safe to hold the
+  #    App token here. `git`/`gh` are preinstalled on ubuntu-latest.
+  commit:
+    name: Commit + push visual baselines
+    needs: render
+    # Run even if render failed, so we can still report on the PR + drop the
+    # label; individual steps gate on the render outcome. (Skipped render =>
+    # label/guard didn't match => this is skipped too.)
+    if: ${{ always() && needs.render.result != 'skipped' }}
+    permissions:
+      contents: write      # push the regenerated baseline (GITHUB_TOKEN fallback)
+      pull-requests: write # comment the result + drop the trigger label
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - name: Checkout PR branch
+        if: needs.render.result == 'success'
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
+        with:
+          # PR files land on disk but are never executed in this job; the push
+          # token authenticates inline at the push step (not via .git/config).
+          ref: ${{ github.event.pull_request.head.ref }}
+          persist-credentials: false
+
+      - name: Download regenerated baselines
+        if: needs.render.result == 'success'
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093  # v4
+        with:
+          name: ui-snapshot-update-${{ github.run_id }}
+          path: _ui_snapshot_artifact
+
+      - name: Restore the regenerated baselines
+        if: needs.render.result == 'success'
+        run: |
+          tgz=$(find _ui_snapshot_artifact -type f -name 'ui-snapshots.tgz' | head -n1)
+          if [ -z "$tgz" ]; then
+            echo "error: no baseline archive in the render artifact." >&2
+            exit 1
+          fi
+          # The archive holds the full tests/e2e_ui/visual/snapshots tree, so
+          # extracting it over the checkout replaces EVERY baseline at its
+          # committed path (a removed baseline drops out too). git add below
+          # then stages whatever actually changed.
+          rm -rf tests/e2e_ui/visual/snapshots
+          tar -xzf "$tgz"
+          rm -rf _ui_snapshot_artifact
+
+      # Mint the App token in this no-PR-code job. Skipped when the App isn't
+      # configured (push then falls back to GITHUB_TOKEN, which won't re-run CI).
+      - name: Mint App token
+        id: app-token
+        if: needs.render.result == 'success' && vars.OMNIGENT_BOT_APP_ID != ''
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1  # v3.2.0
+        with:
+          app-id: ${{ vars.OMNIGENT_BOT_APP_ID }}
+          private-key: ${{ secrets.OMNIGENT_BOT_APP_KEY }}
+
+      # The push token authenticates inline (scoped to this step, never in
+      # .git/config). An App-token push re-fires the PR's checks; a GITHUB_TOKEN
+      # fallback push does not. HEAD_REF (user-influenced) passes via env.
+      - name: Commit + push the regenerated baseline
+        id: push
+        if: needs.render.result == 'success'
+        env:
+          HEAD_REF: ${{ github.event.pull_request.head.ref }}
+          PUSH_TOKEN: ${{ steps.app-token.outputs.token || secrets.GITHUB_TOKEN }}
+          REPO: ${{ github.repository }}
+        run: |
+          git config user.name "omnigent-ci[bot]"
+          git config user.email "294685417+omnigent-ci[bot]@users.noreply.github.com"
+          git add tests/e2e_ui/visual/snapshots
+          if git diff --cached --quiet; then
+            echo "changed=false" >> "$GITHUB_OUTPUT"
+            echo "Baseline already matches this PR's render — nothing to commit."
+            exit 0
+          fi
+          git commit -m "test(e2e-ui): regenerate visual baselines"
+          git push "https://x-access-token:${PUSH_TOKEN}@github.com/${REPO}.git" "HEAD:$HEAD_REF"
+          echo "changed=true" >> "$GITHUB_OUTPUT"
+
+      # Report on the PR thread and drop the label so it can be re-applied to
+      # regenerate again.
+      - name: Comment the result + drop the label
+        if: ${{ always() && steps.push.conclusion == 'success' }}
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          PR: ${{ github.event.pull_request.number }}
+          REPO: ${{ github.repository }}
+          CHANGED: ${{ steps.push.outputs.changed }}
+          # App token used → push re-triggers CI; skipped fallback → it won't.
+          APP_USED: ${{ steps.app-token.conclusion == 'success' }}
+        run: |
+          if [ "$CHANGED" = "true" ]; then
+            base="✅ Regenerated the visual baseline(s) in the pinned Playwright image and pushed to this PR."
+            if [ "$APP_USED" = "true" ]; then
+              body="$base CI will re-run on the new commit."
+            else
+              body="$base ⚠️ No bot App configured, so this push won't auto-trigger CI — push any commit to re-run checks."
+            fi
+            gh pr comment "$PR" --repo "$REPO" --body "$body"
+          else
+            gh pr comment "$PR" --repo "$REPO" \
+              --body "ℹ️ Baseline already matches this PR's render — nothing to update."
+          fi
+          gh pr edit "$PR" --repo "$REPO" --remove-label update-ui-snapshot || true
+
+      # Failure path: render crashed or the push failed. Report on the PR (not
+      # just the Actions tab) and still drop the label so the PR isn't stuck.
+      - name: Comment on failure + drop the label
+        if: ${{ always() && (needs.render.result == 'failure' || steps.push.conclusion == 'failure') }}
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          PR: ${{ github.event.pull_request.number }}
+          REPO: ${{ github.repository }}
+          RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
+        run: |
+          gh pr comment "$PR" --repo "$REPO" \
+            --body "❌ \`update-ui-snapshot\` failed — see the [workflow run]($RUN_URL). Baseline unchanged."
+          gh pr edit "$PR" --repo "$REPO" --remove-label update-ui-snapshot || true

.github/workflows/ui-snapshot.yml

@@ -0,0 +1,235 @@
+name: UI Snapshot
+
+# Visual-regression gate for the committed UI snapshots
+# (tests/e2e_ui/visual/test_*_snapshot.py -- the empty "/" landing, a mocked
+# chat conversation, etc.).
+#
+# Cross-OS rendering note: screenshots differ across rendering environments
+# (font rasterizer + hinting + anti-aliasing), so the committed baseline and the
+# PR comparison MUST be produced by the same renderer. This job renders INSIDE a
+# digest-pinned Playwright image (mcr.microsoft.com/playwright/python) -- the
+# exact same image the local regen script uses
+# (tests/e2e_ui/visual/regen_baseline_docker.sh), so a baseline regenerated
+# locally matches this gate byte-for-byte. The test only renders the SPA, so it
+# needs no LLM credentials and none of the heavy native-CLI setup the main
+# e2e-ui suite uses.
+#
+# Every run (pass or fail) uploads the rendered screenshots as the single
+# `ui-snapshot-<run_id>` artifact (baseline + current + diff PNGs) and links it
+# in the job summary, so they are always one click away.
+#
+# Triggers:
+#   pull_request       compare the rendered pages against the committed
+#                      baselines; fail (with actual/expected/diff PNGs in the
+#                      artifact) on any mismatch. No secrets, so fork PRs run
+#                      fine. The render job is gated on the `detect` job (below):
+#                      a PR that touches none of the render inputs (ap-web, the
+#                      visual tests + fixtures, the pinned toolchain) SKIPS the
+#                      render. We gate at the job (not via `on: paths:`) on
+#                      purpose -- a job skipped by `if` reports SUCCESS, so this
+#                      stays safe to register as a required check, whereas a
+#                      path-filtered *workflow* would sit "pending" and block.
+#   workflow_dispatch  regenerate the baselines with --update-snapshots in the
+#                      same pinned image; the regenerated PNGs are in the
+#                      `ui-snapshot-<run_id>` artifact to download and commit.
+#                      Any collaborator may run this against an arbitrary `ref`;
+#                      the PNGs are human-reviewed before they land, so an
+#                      unreviewed ref can't change a baseline on its own.
+#
+# All baseline-update paths are documented in tests/e2e_ui/visual/README.md
+# (label the PR for same-repo branches, the local Docker script for forks).
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened, ready_for_review]
+  workflow_dispatch:
+    inputs:
+      ref:
+        description: "Branch/ref to regenerate the baseline against"
+        required: false
+        default: ""
+
+permissions:
+  contents: read
+  pull-requests: read  # detect: list the PR's changed files
+
+concurrency:
+  group: ui-snapshot-${{ github.workflow }}-${{ github.event.pull_request.number || github.event.inputs.ref || github.ref }}
+  cancel-in-progress: true
+
+env:
+  # No SPA build during `uv sync`: this workflow builds the bundle in a
+  # dedicated step (mirrors e2e-ui.yml), so the setup.py build would be redundant.
+  OMNIGENT_SKIP_WEB_UI: "true"
+  # The pinned image runs as root, where Chromium needs --no-sandbox; the
+  # e2e_ui conftest adds it (+ --disable-dev-shm-usage) when this is set.
+  OMNIGENT_PW_NO_SANDBOX: "1"
+  # Use the image's Python 3.12 (matches .python-version) instead of letting uv
+  # download its own -- no setup-python step needed inside the container.
+  UV_PYTHON_PREFERENCE: only-system
+
+jobs:
+  # Cheap pre-flight (no container/build): does this PR touch anything that can
+  # change the render? The heavy job below is `if`-gated on it, so non-UI PRs
+  # skip the render (no wasted CI, no flaking against unrelated changes). The
+  # render is a pure function of the ap-web bundle + the visual tests + their
+  # shared fixtures + the pinned toolchain (npm pin, the image digest in THIS
+  # file, and the playwright/plugin versions in the lock), so watch exactly
+  # those. Fails open: if the file list can't be fetched, render rather than
+  # risk a false pass.
+  detect:
+    name: Detect render-affecting changes
+    runs-on: ubuntu-latest
+    outputs:
+      ui: ${{ steps.changes.outputs.ui }}
+    steps:
+      - id: changes
+        env:
+          GH_TOKEN: ${{ github.token }}
+          PR: ${{ github.event.pull_request.number }}
+          REPO: ${{ github.repository }}
+        run: |
+          if [ -z "${PR:-}" ]; then
+            echo "ui=true" >> "$GITHUB_OUTPUT"; echo "no PR (dispatch) -> render"; exit 0
+          fi
+          if ! files=$(gh api "repos/$REPO/pulls/$PR/files" --paginate --jq '.[].filename'); then
+            echo "ui=true" >> "$GITHUB_OUTPUT"; echo "file list unavailable -> render"; exit 0
+          fi
+          pattern='^(ap-web/|tests/e2e_ui/visual/|tests/e2e_ui/conftest\.py|\.github/actions/setup-node/|\.github/workflows/ui-snapshot\.yml|pyproject\.toml|uv\.lock)'
+          if printf '%s\n' "$files" | grep -qE "$pattern"; then
+            echo "ui=true" >> "$GITHUB_OUTPUT"
+            echo "render-affecting files changed:"
+            printf '%s\n' "$files" | grep -E "$pattern" | sed 's/^/  /'
+          else
+            echo "ui=false" >> "$GITHUB_OUTPUT"
+            echo "no render-affecting files changed -> skip the render"
+          fi
+
+  ui-snapshot:
+    name: UI Snapshot (visual baselines) [non-blocking]
+    needs: detect
+    # Skipped (not failed) when no render input changed -> reports SUCCESS, so a
+    # non-UI PR neither runs the render nor blocks a required check.
+    if: ${{ needs.detect.outputs.ui == 'true' }}
+    runs-on: ubuntu-24.04
+    # Render in the digest-pinned Playwright image (browsers + fonts baked in),
+    # so the committed baseline and the PR comparison are byte-identical and a
+    # locally regenerated baseline matches. Keep this digest in lockstep with
+    # ui-snapshot-update.yml and regen_baseline_docker.sh.
+    container:
+      image: mcr.microsoft.com/playwright/python:v1.60.0-noble@sha256:8ff591d613b01c884cc488339ed4318b4513eaf0c57a164a878ba49e70e3f384
+    # GitHub defaults `run:` steps inside a container to `sh` (dash); force bash
+    # so the snapshot step's arrays / [[ ]] work (bash ships in the image).
+    defaults:
+      run:
+        shell: bash
+    timeout-minutes: 20
+    steps:
+      - name: Checkout
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
+        with:
+          ref: ${{ github.event.inputs.ref || github.ref }}
+
+      - name: Set up Node 20
+        uses: ./.github/actions/setup-node
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@38f3f104447c67c051c4a08e39b64a148898af3a  # v4
+        with:
+          enable-cache: true
+
+      - name: Cache virtualenv
+        uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684  # v4
+        with:
+          path: .venv
+          # Namespaced away from e2e-ui.yml's host venv: this venv is built with
+          # the container's system Python (different interpreter path), so they
+          # must not share a key or a cross-restore would mismatch.
+          key: venv-uisnapshot-${{ runner.os }}-${{ hashFiles('.python-version') }}-${{ hashFiles('uv.lock') }}
+
+      - name: Install project + dev extras
+        run: uv sync --extra all --extra dev
+
+      # No "playwright install": the pinned image already ships matching Chromium
+      # + system deps under $PLAYWRIGHT_BROWSERS_PATH (/ms-playwright), so the
+      # uv-synced playwright 1.60.0 finds them with no download.
+
+      - name: Build ap-web SPA
+        # Build BEFORE pytest: Vite's emptyOutDir clobbers the static dir, so
+        # never run it alongside the live server. --legacy-peer-deps avoids
+        # re-resolving the known React 19 peer conflict under @emoji-mart/react.
+        env:
+          NPM_CONFIG_REGISTRY: https://registry.npmjs.org/
+        run: |
+          cd ap-web
+          npm ci --legacy-peer-deps --no-audit --no-fund
+          npm run build
+
+      - name: Compare (PR) or regenerate (dispatch) the visual snapshots
+        id: snapshot
+        # --ui-skip-build: the SPA was built in the previous step. On
+        # workflow_dispatch we pass --update-snapshots, which rewrites the
+        # baseline and intentionally fails the run so a human reviews the image.
+        env:
+          IS_UPDATE: ${{ github.event_name == 'workflow_dispatch' }}
+        run: |
+          EXTRA_ARGS=()
+          if [[ "$IS_UPDATE" == "true" ]]; then
+            EXTRA_ARGS+=(--update-snapshots)
+          fi
+          # -p no:rerunfailures: this gate is deterministic (one static page),
+          # so reruns add nothing; the plugin also spins a teardown socket
+          # thread that emits a noisy unhandled-exception warning when the
+          # live_server subprocess is torn down.
+          uv run pytest tests/e2e_ui/visual -m visual \
+            -v --tb=long --log-level=INFO -r a \
+            -p no:rerunfailures \
+            --ui-skip-build \
+            "${EXTRA_ARGS[@]}"
+
+      # Always (pass or fail) publish the rendered screenshots so they are one
+      # click away. Gated on the snapshot step's own conclusion (not a bare
+      # always()): if an earlier setup step crashed, the snapshot step is skipped
+      # and there is no meaningful render to publish.
+      - name: Upload screenshots
+        id: upload_screens
+        if: ${{ always() && (steps.snapshot.conclusion == 'success' || steps.snapshot.conclusion == 'failure') }}
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02  # v4
+        with:
+          name: ui-snapshot-${{ github.run_id }}
+          # snapshots/ is this run's render (identical to the baseline on a pass;
+          # the new/regenerated render on a mismatch or --update-snapshots).
+          # snapshot_failures/ adds the actual_/expected_/diff_ PNGs on a
+          # mismatch -- expected_ IS the baseline, so this single artifact
+          # already carries baseline + current + diff.
+          path: |
+            tests/e2e_ui/visual/snapshots/**
+            tests/e2e_ui/visual/snapshot_failures/**
+          if-no-files-found: warn
+          retention-days: 7
+
+      - name: Link screenshots
+        # Print a clickable artifact link to the job summary + log on every run,
+        # whether the comparison passed or failed.
+        if: ${{ always() && (steps.snapshot.conclusion == 'success' || steps.snapshot.conclusion == 'failure') }}
+        env:
+          SCREENS_URL: ${{ steps.upload_screens.outputs.artifact-url }}
+          SNAPSHOT_OUTCOME: ${{ steps.snapshot.conclusion }}
+        run: |
+          {
+            echo "## UI snapshot screenshots"
+            echo ""
+            echo "Snapshot comparison: \`${SNAPSHOT_OUTCOME}\`"
+            echo ""
+            echo "Artifact (baseline + current + diff PNGs): ${SCREENS_URL:-_(not uploaded)_}"
+            echo ""
+            echo "On a mismatch the artifact's \`snapshot_failures/\` holds \`expected_\` (baseline), \`actual_\` (current) and \`diff_\`; on a pass \`snapshots/\` is the render (identical to the baseline)."
+            echo ""
+            echo "### Updating the baseline (if this UI change is intentional)"
+            echo ""
+            echo "- **Same-repo branch:** add the \`update-ui-snapshot\` label — the bot regenerates + pushes for you."
+            echo "- **Locally with Docker (any branch, incl. forks):** run \`tests/e2e_ui/visual/regen_baseline_docker.sh\` (renders in this same pinned image), then commit + push."
+            echo ""
+            echo "Full instructions, incl. the fork artifact fallback: \`tests/e2e_ui/visual/README.md\`."
+          } >> "$GITHUB_STEP_SUMMARY"
+          echo "Screenshots artifact: ${SCREENS_URL:-not uploaded}"

.gitignore

@@ -54,6 +54,11 @@ artifacts/
 # Playwright test run output (screenshots, traces, videos).
 test-results/
 
+# Visual-snapshot failure output (actual/expected/diff PNGs from the UI diff
+# gate). Regenerated each run; only the baseline under
+# tests/e2e_ui/visual/snapshots/ is committed.
+tests/e2e_ui/visual/snapshot_failures/
+
 # ap-web SPA build output, emitted into the server's static dir by
 # `npm run build` / the e2e_ui test fixture. Regenerated on demand;
 # never committed.
@@ -68,6 +73,8 @@ omnigent/server/static/web-ui/
 # bundle deploy` respects .gitignore for its file sync — gitignored
 # wheels would silently fail to reach the deployed app's source folder
 # and the install would error with "No such file or directory".
+# The per-deploy app payload (src/pyproject.toml, src/uv.lock) is regenerated
+# by deploy.py and likewise kept untracked rather than gitignored, for the same
+# reason — `bundle deploy` must be able to sync it to the app source folder.
 # DAB local state directory (created by `databricks bundle deploy`).
 deploy/databricks/.databricks/
-deploy/databricks/**/*.whl

.pre-commit-config.yaml

@@ -41,7 +41,28 @@ repos:
         language: system
         entry: npm --prefix ap-web exec -- prettier --write
         files: ^ap-web/.*\.(css|html|js|jsx|json|md|mdx|ts|tsx|yaml|yml)$
-        exclude: ^omnigent/server/static/web-ui/assets/
+        # Exclude generated assets: web-ui build output, Xcode asset catalogs,
+        # and Apple Icon Composer `.icon` bundles (machine-formatted; prettier
+        # fights the tooling).
+        exclude: ^(omnigent/server/static/web-ui/assets/|ap-web/.*\.xcassets/|ap-web/.*\.icon/)
+
+      # iOS Swift formatting + linting via Apple's `swift format` (config:
+      # ap-web/ios/.swift-format). The wrapper no-ops when the Swift toolchain
+      # is absent, so these run on macOS dev machines but skip the ubuntu-latest
+      # CI pre-commit job — there is no Swift there. Enforcement is local.
+      - id: ap-web-ios-swift-format
+        name: ap-web ios swift-format
+        language: system
+        entry: ap-web/ios/bin/swift-format.sh format --in-place --parallel
+        files: ^ap-web/ios/.*\.swift$
+        exclude: ^ap-web/ios/(build|vendor)/
+
+      - id: ap-web-ios-swift-lint
+        name: ap-web ios swift format lint
+        language: system
+        entry: ap-web/ios/bin/swift-format.sh format lint --strict --parallel
+        files: ^ap-web/ios/.*\.swift$
+        exclude: ^ap-web/ios/(build|vendor)/
 
       # Local `uv` runs rewrite uv.lock's registry to whatever index is
       # configured on the developer's machine (e.g. the Databricks PyPI
@@ -63,7 +84,9 @@ repos:
         exclude: \.(md|svg)$
       - id: end-of-file-fixer
         name: ensure files end with newline
-        exclude: \.(md|svg)$
+        # AppIcon.icon/ is generated by Apple's Icon Composer, which writes
+        # icon.json without a trailing newline — don't "fix" it.
+        exclude: (\.(md|svg)$|/AppIcon\.icon/)
       - id: check-yaml
         name: check yaml syntax
         # docker-compose override files use non-standard tags

README.md

@@ -4,7 +4,7 @@
 
 ### The open-source AI agent framework and meta-harness for all your AI agents.
 
-Omnigent is an open-source **AI agent framework** and meta-harness that gives you a common orchestration layer over Claude Code, Codex, Cursor, Pi, and the agents you write yourself: swap or combine harnesses without rewriting, enforce policies and sandboxing, and collaborate in real time from any device.
+Omnigent is an open-source **AI agent framework** and meta-harness that gives you a common orchestration layer over Claude Code, Codex, Cursor, Kimi Code, Pi, and the agents you write yourself: swap or combine harnesses without rewriting, enforce policies and sandboxing, and collaborate in real time from any device.
 
 [![License: Apache 2.0](https://img.shields.io/badge/License-Apache_2.0-blue.svg)](https://github.com/omnigent-ai/omnigent/blob/main/LICENSE)
 ![Status: alpha](https://img.shields.io/badge/status-alpha-orange.svg)
@@ -41,9 +41,12 @@ Omnigent lets you:
   conversation to continue on their own.
 
 - **☁️ Run agents in cloud sandboxes.** No laptop required: run sessions in
-  disposable [Modal](https://modal.com), [Daytona](https://www.daytona.io), or
-  [Islo](https://islo.dev) sandboxes, launched from the CLI or provisioned by
-  the server per session (*managed hosts*).
+  disposable [Modal](https://modal.com), [Daytona](https://www.daytona.io),
+  [Islo](https://islo.dev), [E2B](https://e2b.dev),
+  [CoreWeave](https://docs.coreweave.com/products/sandboxes),
+  [Kubernetes](https://kubernetes.io), [OpenShell](https://github.com/NVIDIA/OpenShell),
+  or [Boxlite](https://github.com/boxlite-ai/boxlite) sandboxes, launched from the
+  CLI or provisioned by the server per session (*managed hosts*).
 
 - **🛡️ Govern your agents.** Create
   [policies](#6-govern-your-agents-with-policies) to pause for your approval
@@ -94,15 +97,18 @@ uv tool install -q --python 3.12 git+https://github.com/omnigent-ai/omnigent.git
 - **Node.js 22 LTS or newer** with **`npm`**, for the Claude, Codex, and Pi
   coding harnesses. `omnigent run` installs the harness CLI you pick.
   https://docs.npmjs.com/downloading-and-installing-node-js-and-npm
-- **`tmux`**, required by the native `omnigent claude` / `omnigent codex`
+- **Kiro CLI** (optional), for `omnigent kiro`: install with
+  `curl -fsSL https://cli.kiro.dev/install | bash`, then sign in with Kiro.
+- **`tmux`**, required by the native `omnigent claude` / `omnigent codex` /
+  `omnigent kiro`
   wrappers (`brew install tmux` / `apt install tmux`; the installer offers
   to install it for you).
 - **`bubblewrap`** (`bwrap`), **Linux only**. The native `omnigent claude` /
-  `omnigent codex` and `pi` harnesses wrap each agent terminal in a `bwrap`
-  OS-sandbox; on Linux that isolation is mandatory, so a missing `bwrap`
-  binary makes those terminals fail to start (`apt install bubblewrap`; the
-  installer offers to install it for you). macOS uses the built-in `seatbelt`
-  sandbox and needs nothing extra.
+  `omnigent codex` / `omnigent kiro` and `pi` harnesses wrap each agent
+  terminal in a `bwrap` OS-sandbox; on Linux that isolation is mandatory, so a
+  missing `bwrap` binary makes those terminals fail to start
+  (`apt install bubblewrap`; the installer offers to install it for you). macOS
+  uses the built-in `seatbelt` sandbox and needs nothing extra.
 - **Databricks** (optional). To use a Databricks workspace as your model
   provider, install Omnigent with the `databricks` extra:
   `uv tool install "omnigent[databricks]"` — or pass it to the bootstrap
@@ -161,21 +167,25 @@ Or launch a specific agent runtime, or your own agent:
 ```bash
 omnigent claude                      # Claude Code, in a session your team can join
 omnigent codex                       # Codex
+omnigent kiro                        # Kiro CLI
+omnigent kimi                        # Kimi Code (https://kimi.com), headless
 omnigent run path/to/agent.yaml      # your own agent (see "Write your own agent")
 ```
 
-#### 🐙 Polly and 🟠🔵 Debby
+#### 🐙 Polly, 🟠🔵 Debby, and ✍️ Scribe
 
-Two example agents ship with the repo, and they make good first sessions:
+Three example agents ship with the repo, and they make good first sessions:
 
 ```bash
 omnigent run examples/polly/
 omnigent run examples/debby/
+omnigent run examples/scribe/
 
 # Run an orchestrator on a different harness (sub-agents keep their own):
 omnigent run examples/polly/ --harness pi
 omnigent run examples/debby/ --harness openai-agents
 omnigent run examples/polly/ --harness cursor  # Cursor CLI (needs cursor-agent + CURSOR_API_KEY)
+omnigent run examples/polly/ --harness copilot # GitHub Copilot SDK (needs a GitHub token w/ Copilot, e.g. GH_TOKEN)
 ```
 
 **🐙 Polly** is a multi-agent coding orchestrator who writes no code herself.
@@ -189,6 +199,13 @@ side by side. Type `/debate` and the heads critique each other for a few
 rounds before converging. (She needs both a Claude and an OpenAI credential;
 see step 3.)
 
+**✍️ Scribe** is a documentation orchestrator, the docs counterpart to Polly.
+She turns git diffs, commit history, and PRs into release notes, changelogs, and
+migration guides. She authors the prose herself and delegates only read-only
+code investigation to a researcher sub-agent, then can route a draft through an
+independent different-vendor reviewer to fact-check its claims before it ships.
+(The cross-model fact-check needs an OpenAI credential; the rest runs on one.)
+
 **Prefer the browser?** Start a server and register your machine as a host:
 
 ```bash
@@ -367,7 +384,7 @@ name: my_agent
 prompt: You are a helpful data analyst.
 
 executor:
-  harness: claude-sdk          # or: codex, codex-native, claude-native, cursor, openai-agents, pi, antigravity
+  harness: claude-sdk          # or: claude-native, codex, codex-native, cursor, cursor-native, kiro-native, openai-agents, pi, pi-native, antigravity, qwen, kimi, copilot
 
 tools:
   # A local Python function (schema auto-generated from the signature)
@@ -398,3 +415,13 @@ Polly at [`examples/polly/`](https://github.com/omnigent-ai/omnigent/tree/main/e
 ## Contributing
 
 Contributions are welcome. See [CONTRIBUTING.md](https://github.com/omnigent-ai/omnigent/blob/main/CONTRIBUTING.md) for how to set up your environment, run the checks, and open a pull request.
+
+
+### Contributors
+
+Thanks to all of our amazing contributors!
+
+<a href="https://github.com/omnigent-ai/omnigent/graphs/contributors">
+  <img src="https://contrib.rocks/image?repo=omnigent-ai/omnigent" />
+</a>
+

RELEASING.md

@@ -0,0 +1,222 @@
+# Releasing omnigent
+
+omnigent ships **three PyPI packages that version-lock together**:
+
+| Package | What it is |
+| --- | --- |
+| `omnigent` | core wheel (bundles the `ap-web` web UI) |
+| `omnigent-client` | Python client SDK |
+| `omnigent-ui-sdk` | terminal UI SDK |
+
+`pip install omnigent==X` must resolve `omnigent-client==X` and
+`omnigent-ui-sdk==X`. The pins are **lockstep** (the three packages co-version and
+pin each other with `==`), so every release builds and publishes **all three at
+one identical version**.
+
+## Where things run
+
+- **Source of truth** (versions, tags, GitHub Releases): **`omnigent-ai/omnigent`**
+  — use the **OSS GitHub account** (the personal account with push/release rights
+  on the public repo).
+- **Publishing to PyPI**: the central **secure-release repo**
+  **`databricks/secure-public-registry-releases-eng`**, `omnigent` workflow —
+  use the **Databricks EMU account**. Publishing runs on hardened runner
+  groups with **OIDC Trusted Publishing (no stored secrets)** and a **mandatory
+  dependency scan**. This is why we don't publish from `omnigent-ai/omnigent`.
+
+> The exact account handles — and how to request publish access — live in the
+> internal release wiki; this public runbook refers to them only by role.
+> Substitute your own handles for `<oss-account>` / `<emu-account>` in the
+> `gh auth switch --user …` commands below.
+
+The legacy `.github/workflows/release-omnigent.yml` in this repo is a
+**deprecated manual fallback only** — its tag-push trigger was removed so a tag
+never double-publishes. Use the secure repo for real releases.
+
+> The secure `omnigent` workflow is **manual `workflow_dispatch`** — it can't see
+> this repo's tag pushes. You bump + tag here, then dispatch it with that tag.
+
+## Versioning model
+
+- `main` always carries the **next** version with a `.dev0` suffix
+  (e.g. `0.2.0.dev0`) — never a clean released number. This matches
+  MLflow / Delta / Unity Catalog and keeps every `main` build PEP 440-ordered as
+  "ahead of the last release, not yet the next one".
+- Releases are cut on **per-minor release branches** (`branch-X.Y`) and tagged
+  there (`vX.Y.Z`); patches (`vX.Y.1`, `vX.Y.2`, …) are cherry-picked onto the
+  same `branch-X.Y`. `main` is never tagged.
+
+---
+
+## Release steps (example: `v0.2.0`)
+
+### 1. Cut the release branch + tag — `omnigent-ai/omnigent` (OSS account)
+
+Only tag a commit that already has **green CI** — verify `main` is green before
+branching:
+
+```bash
+gh auth switch --user <oss-account>
+git fetch origin
+gh run list --repo omnigent-ai/omnigent --branch main --status success --limit 1
+git checkout -b branch-0.2 origin/main
+```
+
+Set the release version in **all three** `pyproject.toml` files — the
+`version` field **and** the cross-package `==` pins — plus `uv.lock`
+(`0.2.0.dev0` → `0.2.0`):
+
+- `pyproject.toml` (`version`, `omnigent-client==`, `omnigent-ui-sdk==`)
+- `sdks/python-client/pyproject.toml` (`version`, `omnigent==`)
+- `sdks/ui/pyproject.toml` (`version`, `omnigent-client==`)
+- `uv.lock` — **hand-edit** the three `version = "…"` lines (omnigent,
+  omnigent-client, omnigent-ui-sdk) and the one cross-pin `specifier = "==…"`
+  (`omnigent-ui-sdk`'s dep on `omnigent-client`). The three packages are
+  **editable workspace members** (`source = { editable = … }`), so uv records
+  **no wheel `hash` entries** for them, and the other two cross-deps appear as
+  `editable = "…"` with no `==` specifier — so only those version/specifier
+  strings change, nothing else (no hashes to touch).
+  **Do not run `uv lock`** locally: it rewrites every registry URL to the
+  internal proxy and that leaks into the lockfile (breaks CI). The published
+  lock must use `https://pypi.org/simple`.
+
+Stage exactly the version files (don't `-a`, which would sweep in any stray
+local edits), then commit, tag, and push **the branch + only this tag**:
+
+```bash
+git add pyproject.toml sdks/python-client/pyproject.toml sdks/ui/pyproject.toml uv.lock
+git commit -m "release: v0.2.0"
+git tag v0.2.0
+git push -u origin branch-0.2 v0.2.0        # explicit tag, NOT --tags; pushing the tag drafts the GitHub Release (step 5)
+```
+
+Keep `main` from re-freezing — bump it to the next dev marker and push:
+
+```bash
+git checkout main
+# set 0.2.0.dev0 -> 0.3.0.dev0 in the 3 pyprojects (+ pins) and uv.lock.
+# Hand-edit uv.lock here too — same rule, do NOT run `uv lock` (it leaks the proxy URL).
+git add pyproject.toml sdks/python-client/pyproject.toml sdks/ui/pyproject.toml uv.lock
+git commit -m "chore: bump main to 0.3.0.dev0"
+git push
+```
+
+### 2. Dry-run the gates — secure repo (EMU account)
+
+```bash
+gh auth switch --user <emu-account>
+gh workflow run omnigent.yml --repo databricks/secure-public-registry-releases-eng \
+  -f ref=v0.2.0 -f destination=test-pypi -f dry-run=true
+```
+
+Runs build + dependency scan + the gates (lockstep version/pins, web-UI-in-wheel,
+`twine check`, smoke-install) and the OIDC token exchange — **without uploading**.
+
+### 3. Publish to TestPyPI + validate
+
+```bash
+gh workflow run omnigent.yml --repo databricks/secure-public-registry-releases-eng \
+  -f ref=v0.2.0 -f destination=test-pypi -f dry-run=false
+```
+
+Validate in a clean venv. **Don't** use `--extra-index-url` with TestPyPI: pip
+resolves each name across *both* indexes and picks the highest version, so anyone
+squatting `omnigent` / `omnigent-client` / `omnigent-ui-sdk` on real PyPI at a
+higher version wins the resolution (dependency confusion). Instead, take **deps
+from real PyPI only** and the **candidates from TestPyPI only**, exact-pinned with
+`--no-deps`:
+
+```bash
+python -m venv /tmp/omni-rc
+# 1) seed the dependency closure from REAL PyPI (the last released omnigent):
+/tmp/omni-rc/bin/pip install --index-url https://pypi.org/simple/ omnigent
+# 2) overlay the candidates from TestPyPI ONLY, exact-pinned, no deps:
+/tmp/omni-rc/bin/pip install --index-url https://test.pypi.org/simple/ --no-deps \
+  omnigent==0.2.0 omnigent-client==0.2.0 omnigent-ui-sdk==0.2.0
+/tmp/omni-rc/bin/omnigent --version    # expect 0.2.0
+```
+
+> If this release **adds a new runtime dependency** the previous release didn't
+> have, install it explicitly from real PyPI first
+> (`/tmp/omni-rc/bin/pip install --index-url https://pypi.org/simple/ <dep>`) —
+> never let a `--no-deps` TestPyPI install pull third-party deps from TestPyPI.
+
+### 4. Publish to PyPI (prod)
+
+Requires **admin/maintain** on the secure repo (if you hit a 403, request access
+via the secure-release owning team / internal release wiki before proceeding);
+binds the per-package `pypi-omnigent`, `pypi-omnigent-client`,
+`pypi-omnigent-ui-sdk` Trusted-Publisher environments (may gate on reviewer
+approval). The prod path also re-verifies that
+`ref` is exactly the `vX.Y.Z` tag and that the tag points at the built commit.
+
+```bash
+gh workflow run omnigent.yml --repo databricks/secure-public-registry-releases-eng \
+  -f ref=v0.2.0 -f destination=pypi -f dry-run=false
+
+uv tool install omnigent==0.2.0        # final sanity from real PyPI
+```
+
+> Note: the dispatch's `-f ref=v0.2.0` is the **omnigent source ref**; it is
+> distinct from `gh workflow run --ref`, which selects the branch the *workflow
+> definition* runs from (the secure repo's default).
+
+### 5. Publish the GitHub Release — `omnigent-ai/omnigent` (OSS account)
+
+Pushing the `v0.2.0` tag (step 1) triggered `.github/workflows/github-release.yml`,
+which created a **draft** release with auto-generated notes (PRs since the
+previous tag). Now:
+
+1. Open <https://github.com/omnigent-ai/omnigent/releases> and find the `v0.2.0`
+   draft.
+2. **Verify and edit the notes** — lead with user-facing highlights, call out
+   breaking changes and any upgrade steps, and trim noise from the auto-generated
+   list. The notes are a draft, not the final word.
+3. **Publish the release** (ideally only after the prod PyPI publish in step 4 has
+   succeeded, so you never advertise a version that isn't installable).
+
+If the draft wasn't created (e.g. the workflow was disabled), do it manually:
+
+```bash
+gh auth switch --user <oss-account>
+gh release create v0.2.0 --repo omnigent-ai/omnigent \
+  --draft --verify-tag --generate-notes --title "v0.2.0"
+# review/edit, then publish from the Releases page (or `gh release edit v0.2.0 --draft=false`)
+```
+
+---
+
+## Patch release (e.g. `v0.2.1`)
+
+Cherry-pick the fix onto the existing `branch-0.2`, then:
+
+1. Confirm CI is green on `branch-0.2` after the cherry-pick
+   (`gh run list --repo omnigent-ai/omnigent --branch branch-0.2 --status success --limit 1`).
+2. Bump the three versions/pins + `uv.lock` to `0.2.1` (same hand-edit rules as above).
+3. Stage explicitly, commit, and tag **on `branch-0.2`**:
+   `git add <version files> && git commit -m "release: v0.2.1" && git tag v0.2.1 && git push origin branch-0.2 v0.2.1`.
+4. Repeat steps 2–5.
+
+`main` does **not** change for a patch, and a patch never needs a new
+`branch-0.Y` — patches always ship from the existing minor branch.
+
+---
+
+## If a publish goes wrong (recovery)
+
+**PyPI releases can't be deleted, only _yanked_**, and a version number once used
+can never be reused. So:
+
+- **TestPyPI failed / candidate is bad:** bump to the next number (don't reuse the
+  version) and re-run — TestPyPI is disposable.
+- **Prod publish partially succeeded** (e.g. two of three packages uploaded):
+  **yank** the published version(s) on PyPI (each affected project → *Manage* →
+  *Releases* → *Yank*) so installs don't resolve a half-published set, then cut the
+  next patch with the fix. Don't try to overwrite — Trusted Publishing / `twine`
+  rejects re-uploading an existing version.
+- **GitHub Release** for a version you abandoned:
+  `gh release delete vX.Y.Z --repo omnigent-ai/omnigent`, and drop the tag if it
+  shouldn't exist (`git push origin :refs/tags/vX.Y.Z`); re-tag only the corrected
+  commit.
+- Publishing uses **OIDC Trusted Publishing (no stored secrets)**, so a failed run
+  leaks nothing — just fix forward to the next version.

ap-web/.prettierignore

@@ -3,3 +3,20 @@ dist
 ../omnigent/server/static/web-ui
 src/components/ui
 package-lock.json
+
+# Xcode asset catalogs are tool-owned; Prettier fights Xcode's formatting.
+**/*.xcassets/**
+
+# Generated Apple Icon Composer bundles (machine-formatted; prettier fights the tooling)
+**/*.icon/**
+
+# iOS build/tooling artifacts. These are git-ignored via ios/.gitignore, but
+# Prettier doesn't read nested .gitignore files, so they're listed here too:
+# the local Bundler gem install, build output, and fastlane-generated files
+# (README.md regenerates on every run; see ios/RELEASE.md for the real docs).
+ios/vendor/
+ios/build/
+ios/fastlane/README.md
+ios/fastlane/report.xml
+ios/fastlane/Preview.html
+ios/fastlane/test_output/

ap-web/README.md

@@ -1,17 +1,13 @@
 # ap-web
 
 The web UI for `omnigent server --agent <agent>`. SPA built with Vite + React + TypeScript +
-Tailwind v4 + shadcn/ui. Talks to the omnigent FastAPI server's
-OpenAI-compatible API surface (`/v1/responses`, `/v1/conversations`,
-session-scoped `/v1/sessions/{id}/resources/files`,
-`/api/agents`).
-
-This is the new UI. The legacy `web/` folder targets the old `/api/chat/stream`
-server and is unrelated.
+Tailwind v4 + shadcn/ui. Talks to the current Omnigent API surface
+(`/v1/agents`, `/v1/sessions`, session-scoped
+`/v1/sessions/{id}/resources/files`).
 
 ## Develop
 
-In one terminal, start the omnigent server (default port `8000`). Use
+In one terminal, start the omnigent server (default port `6767`). Use
 `--agent` to pre-register one or more agents at startup (accepts a YAML file or
 an agent-image directory; can be repeated):
 
@@ -36,15 +32,15 @@ OMNIGENT_URL=http://localhost:9000 npm run dev
 
 Additional `omnigent server` options:
 
-| Flag                  | Default                 | Description                          |
-| --------------------- | ----------------------- | ------------------------------------ |
-| `--host`              | `127.0.0.1`             | Host to bind to                      |
-| `-p` / `--port`       | `8000`                  | Port to listen on                    |
-| `--database-uri`      | `sqlite:///omnigent.db` | Database URI for stores              |
-| `--artifact-location` | `./artifacts`           | Path for artifact storage            |
-| `-c` / `--config`     | (none)                  | Path to YAML config file             |
-| `--execution-timeout` | `7200`                  | Max wall-clock seconds per execution |
-| `--agent`             | (none)                  | Pre-register an agent (repeatable)   |
+| Flag                  | Default                | Description                          |
+| --------------------- | ---------------------- | ------------------------------------ |
+| `--host`              | `127.0.0.1`            | Host to bind to                      |
+| `-p` / `--port`       | `6767`                 | Port to listen on                    |
+| `--database-uri`      | `<data-dir>/chat.db`   | Database URI for stores              |
+| `--artifact-location` | `<data-dir>/artifacts` | Path for artifact storage            |
+| `-c` / `--config`     | (none)                 | Path to YAML config file             |
+| `--execution-timeout` | `7200`                 | Max wall-clock seconds per execution |
+| `--agent`             | (none)                 | Pre-register an agent (repeatable)   |
 
 ## Build + serve from the Omnigent server
 

ap-web/electron/icons/AppIcon.icon/Assets/SVG Image 6.svg

@@ -1,16 +0,0 @@
-<svg width="1024" height="1024" viewBox="0 0 1024 1024" fill="none" xmlns="http://www.w3.org/2000/svg">
-<g clip-path="url(#clip0_26_3760)">
-<path d="M601.6 0C749.453 0 823.381 0.000134204 879.854 28.7744C929.528 54.085 969.915 94.4718 995.226 144.146C1024 200.619 1024 274.547 1024 422.4V601.6C1024 749.453 1024 823.381 995.226 879.854C969.915 929.528 929.528 969.915 879.854 995.226C823.381 1024 749.453 1024 601.6 1024H422.4C274.547 1024 200.619 1024 144.146 995.226C94.4718 969.915 54.085 929.528 28.7744 879.854C0.000134204 823.381 0 749.453 0 601.6V422.4C0 274.547 0.000134204 200.619 28.7744 144.146C54.085 94.4718 94.4718 54.085 144.146 28.7744C200.619 0.000134204 274.547 0 422.4 0H601.6ZM386.4 60C272.15 60 215.024 59.9997 171.386 82.2344C133.001 101.793 101.793 133.001 82.2344 171.386C59.9997 215.024 60 272.15 60 386.4V637.6C60 751.85 59.9997 808.976 82.2344 852.614C101.793 890.999 133.001 922.207 171.386 941.766C215.024 964 272.15 964 386.4 964H637.6C751.85 964 808.976 964 852.614 941.766C890.999 922.207 922.207 890.999 941.766 852.614C964 808.976 964 751.85 964 637.6V386.4C964 272.15 964 215.024 941.766 171.386C922.207 133.001 890.999 101.793 852.614 82.2344C808.976 59.9997 751.85 60 637.6 60H386.4Z" fill="url(#paint0_linear_26_3760)"/>
-<rect x="60" y="60" width="904" height="904" rx="204" stroke="#DADADA" stroke-opacity="0.6" stroke-width="5"/>
-</g>
-<defs>
-<linearGradient id="paint0_linear_26_3760" x1="147" y1="-98.5" x2="966" y2="1039.5" gradientUnits="userSpaceOnUse">
-<stop stop-color="white"/>
-<stop offset="0.5" stop-color="#939393"/>
-<stop offset="1" stop-color="#B6B6B6"/>
-</linearGradient>
-<clipPath id="clip0_26_3760">
-<rect width="1024" height="1024" fill="white"/>
-</clipPath>
-</defs>
-</svg>

ap-web/electron/icons/AppIcon.icon/icon.json

@@ -1,73 +0,0 @@
-{
-  "fill": {
-    "automatic-gradient": "display-p3:0.17673,0.38168,0.68246,1.00000",
-    "orientation": {
-      "start": {
-        "x": 0.5,
-        "y": 0
-      },
-      "stop": {
-        "x": 0.5,
-        "y": 0.7
-      }
-    }
-  },
-  "groups": [
-    {
-      "layers": [
-        {
-          "image-name": "SVG Image.svg",
-          "name": "SVG Image",
-          "position": {
-            "scale": 1.05,
-            "translation-in-points": [0, 0]
-          }
-        }
-      ],
-      "position": {
-        "scale": 0.85,
-        "translation-in-points": [0, 0]
-      },
-      "shadow": {
-        "kind": "layer-color",
-        "opacity": 0.5
-      },
-      "specular": true,
-      "translucency": {
-        "enabled": false,
-        "value": 0.5
-      }
-    },
-    {
-      "blend-mode-specializations": [
-        {
-          "appearance": "dark",
-          "value": "soft-light"
-        },
-        {
-          "appearance": "tinted",
-          "value": "overlay"
-        }
-      ],
-      "layers": [
-        {
-          "image-name": "SVG Image 6.svg",
-          "name": "SVG Image 6"
-        }
-      ],
-      "shadow": {
-        "kind": "neutral",
-        "opacity": 0.5
-      },
-      "specular": false,
-      "translucency": {
-        "enabled": false,
-        "value": 0.5
-      }
-    }
-  ],
-  "supported-platforms": {
-    "circles": ["watchOS"],
-    "squares": "shared"
-  }
-}

ap-web/electron/icons/README.md

@@ -1,7 +1,8 @@
 # App icons
 
-- `AppIcon.icon` — source of truth for the macOS icon: an Apple Icon
-  Composer bundle (layered artwork + gradient background).
+- `../../platform-assets/AppIcon.icon` — source of truth for the Apple
+  platform icon: an Apple Icon Composer bundle (layered artwork + gradient
+  background), shared by Electron and iOS.
 - `Assets.car` + `icon.icns` — compiled from `AppIcon.icon` by `actool`
   (checked in so builds don't require Xcode 26+). `Assets.car` gives the
   native dynamic icon on macOS 26+ (liquid glass, light/dark/tinted);
@@ -20,7 +21,7 @@ Requires Xcode 26+ (Icon Composer `.icon` support in actool):
 ```bash
 cd ap-web/electron/icons
 TMP=$(mktemp -d)
-DEVELOPER_DIR=/Applications/Xcode.app/Contents/Developer xcrun actool AppIcon.icon \
+DEVELOPER_DIR=/Applications/Xcode.app/Contents/Developer xcrun actool ../../platform-assets/AppIcon.icon \
   --compile "$TMP" --platform macosx --minimum-deployment-target 11.0 \
   --app-icon AppIcon --output-partial-info-plist "$TMP/partial.plist"
 cp "$TMP/Assets.car" Assets.car

ap-web/electron/package.json

@@ -1,7 +1,7 @@
 {
   "name": "omnigent-desktop-electron",
   "productName": "Omnigent",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "Omnigent desktop shell (Electron edition) — a thin native wrapper around the server-served web UI.",
   "private": true,
   "main": "src/main.js",
@@ -9,6 +9,7 @@
   "scripts": {
     "start": "electron .",
     "dev": "electron .",
+    "test": "node --test",
     "build": "electron-builder",
     "build:mac": "electron-builder --mac",
     "build:mac:release": "electron-builder --mac -c.mac.notarize=true",
@@ -32,6 +33,15 @@
       "find/**/*",
       "icons/**/*"
     ],
+    "extraResources": [
+      {
+        "from": "../platform-assets",
+        "to": "platform-assets",
+        "filter": [
+          "**/*"
+        ]
+      }
+    ],
     "mac": {
       "category": "public.app-category.developer-tools",
       "icon": "icons/icon.icns",

ap-web/electron/setup/index.html

@@ -156,8 +156,11 @@
     <div class="drag-strip"></div>
     <div class="card">
       <picture>
-        <source srcset="assets/omnigents-logo-reverse.svg" media="(prefers-color-scheme: dark)" />
-        <img class="logo" src="assets/omnigents-logo.svg" alt="Omnigents" />
+        <source
+          srcset="../../platform-assets/logos/omnigents-logo-reverse.svg"
+          media="(prefers-color-scheme: dark)"
+        />
+        <img class="logo" src="../../platform-assets/logos/omnigents-logo.svg" alt="Omnigents" />
       </picture>
       <p class="sub">
         Enter the URL of the Omnigents server. The desktop app loads its web UI directly.
@@ -177,16 +180,17 @@
         <div id="recents-list"></div>
       </div>
     </div>
+    <script src="../src/url.js"></script>
     <script>
+      // Shared URL helpers (electron/src/url.js), exposed as window.omnigentUrl
+      // — the same module the main process uses, so the two never drift.
+      const { isPlainHttpRemote } = window.omnigentUrl;
       // Uses the Electron preload bridge (electron/src/preload.js).
       const setup = window.omnigentSetup;
       const input = document.getElementById("url");
       const button = document.getElementById("connect");
       const err = document.getElementById("err");
 
-      // Hosts where plain http:// is fine (no network path to speak of).
-      const LOCAL_HOSTS = new Set(["localhost", "127.0.0.1", "[::1]", "::1"]);
-
       // The main process loads this page with ?error=…&url=… when a server
       // navigation fails (server down, DNS, TLS), so the user sees what went
       // wrong and can retry or change the URL.
@@ -251,22 +255,6 @@
         })
         .catch(() => {});
 
-      // True when the entered URL is unencrypted http:// to a non-local
-      // host. Mirrors the scheme-defaulting of the main process's
-      // normalizeUrl; invalid URLs return false so the real error comes
-      // from normalizeUrl on Connect.
-      function isPlainHttpRemote(raw) {
-        const trimmed = (raw || "").trim();
-        const withScheme = trimmed.includes("://") ? trimmed : "http://" + trimmed;
-        let url;
-        try {
-          url = new URL(withScheme);
-        } catch {
-          return false;
-        }
-        return url.protocol === "http:" && !LOCAL_HOSTS.has(url.hostname);
-      }
-
       // The exact URL value the user has already been warned about — a
       // second Connect click on the same value proceeds; editing the input
       // re-arms the warning.

ap-web/electron/src/main.js

@@ -31,6 +31,7 @@ const fs = require("node:fs");
 const path = require("node:path");
 const { pathToFileURL } = require("node:url");
 const { registerLocalhostCors } = require("./localhost_cors");
+const { normalizeUrl, expandDatabricksWorkspaceUrl, WORKSPACE_UI_PATH } = require("./url");
 
 /** Absolute path to the bundled setup page (the "connect to server" form). */
 const SETUP_PAGE = path.join(__dirname, "..", "setup", "index.html");
@@ -596,44 +597,6 @@ function rememberRecentServer(settings, url) {
   ].slice(0, MAX_RECENT_SERVERS);
 }
 
-/**
- * Normalize a user-entered server URL into something navigable. Accepts bare
- * `host:port` (assumes http), trims whitespace, and rejects anything that
- * isn't an http(s) URL — fail loud rather than navigate to garbage.
- *
- * @param {string} raw
- * @returns {string} A normalized absolute http(s) URL.
- */
-function normalizeUrl(raw) {
-  const trimmed = (raw ?? "").trim();
-  if (trimmed === "") throw new Error("server URL is empty");
-  const withScheme = trimmed.includes("://") ? trimmed : `http://${trimmed}`;
-  let url;
-  try {
-    url = new URL(withScheme);
-  } catch (e) {
-    throw new Error(`invalid URL: ${e.message}`);
-  }
-  if (url.protocol !== "http:" && url.protocol !== "https:") {
-    throw new Error(`unsupported scheme '${url.protocol}' (use http/https)`);
-  }
-  return url.toString();
-}
-
-/**
- * Path under a Databricks workspace where the Omnigent web UI is mounted. A
- * bare workspace URL serves the workspace's own web app at the root, so a user
- * who pastes just the workspace host (e.g.
- * ``https://<ws>.azuredatabricks.net``) lands on a 404 unless this suffix is
- * appended.
- *
- * NOTE: the Python CLI records the same UI mount as ``/ml/omnigent``
- * (singular) in ``omnigent/conversation_browser.py`` (WORKSPACE_UI_PATH); the
- * plural here is the path that actually resolves on the live workspace. The
- * two should be reconciled — see also that file's WORKSPACE_API_PATH.
- */
-const WORKSPACE_UI_PATH = "/ml/omnigents";
-
 /**
  * CSS that hides the Databricks workspace navigation chrome around a
  * workspace-hosted Omnigent SPA.
@@ -657,62 +620,6 @@ const WORKSPACE_CHROME_HIDE_CSS = `
   }
 `;
 
-/**
- * Probe timeout for Databricks workspace detection. Deliberately short: a slow
- * or unreachable host must not stall the connect flow — on timeout we fall
- * back to loading the URL exactly as entered.
- */
-const WORKSPACE_PROBE_TIMEOUT_MS = 8000;
-
-/**
- * Expand a bare Databricks workspace URL to its Omnigent web-UI mount.
- *
- * Mirrors the omni CLI's behavioral detection
- * (``omnigent/cli.py:_workspace_api_server_url``): rather than match
- * hostnames, probe the URL and adopt the mount only when the host answers
- * like a Databricks workspace — a response carrying the ``server: databricks``
- * header. URLs that already carry a path, or aren't https, are returned
- * untouched WITHOUT a probe, so a user who pastes the full ``…/ml/omnigents``
- * URL (or connects to any non-workspace server) is never second-guessed.
- *
- * The CLI appends the API mount because it's an API client; the desktop shell
- * loads the web UI, so it appends the SPA mount instead.
- *
- * @param {string} normalized A normalized http(s) URL from {@link normalizeUrl}.
- * @returns {Promise<string>} The workspace UI URL when expansion applies, else
- *   the input unchanged.
- */
-async function expandDatabricksWorkspaceUrl(normalized) {
-  let url;
-  try {
-    url = new URL(normalized);
-  } catch {
-    return normalized;
-  }
-  // Only bare https roots are candidates: a non-root path means the user
-  // already pointed at a specific mount, and Databricks workspaces are
-  // https-only.
-  if (url.protocol !== "https:" || (url.pathname !== "/" && url.pathname !== "")) {
-    return normalized;
-  }
-  let probe;
-  try {
-    probe = await fetch(`${url.origin}/`, {
-      method: "HEAD",
-      redirect: "manual",
-      signal: AbortSignal.timeout(WORKSPACE_PROBE_TIMEOUT_MS),
-    });
-  } catch {
-    // Unreachable / DNS / TLS / timeout: connect to the URL as given and let
-    // the did-fail-load fallback surface any real failure.
-    return normalized;
-  }
-  if ((probe.headers.get("server") ?? "").toLowerCase() !== "databricks") {
-    return normalized;
-  }
-  return `${url.origin}${WORKSPACE_UI_PATH}`;
-}
-
 // ---------------------------------------------------------------------------
 // Window + navigation
 // ---------------------------------------------------------------------------
@@ -1677,6 +1584,9 @@ function registerIpc() {
       title,
       body: String(params?.body ?? ""),
     });
+    // In-app path the SPA wants opened on click (e.g. "/c/conv_abc"). Captured
+    // here so the click handler can tell the renderer where to route.
+    const navigatePath = typeof params?.navigatePath === "string" ? params.navigatePath : "";
     // Focus the window that fired the notification (so a click lands on the
     // right one in a multi-window setup), falling back to any open window.
     notification.on("click", () => {
@@ -1685,6 +1595,17 @@ function registerIpc() {
         if (win.isMinimized()) win.restore();
         win.focus();
       }
+      // Route only the originating window (it owns that conversation's state).
+      // isDestroyed() and send() aren't atomic — the window can close between
+      // them — so the try/catch absorbs the benign "Object has been destroyed"
+      // throw instead of crashing the main process from this async callback.
+      if (navigatePath && !event.sender.isDestroyed()) {
+        try {
+          event.sender.send("omnigent:notification-activated", navigatePath);
+        } catch {
+          // Sender went away after the notification was posted; nothing to do.
+        }
+      }
     });
     notification.show();
     signalForeground();

ap-web/electron/src/preload.js

@@ -27,13 +27,31 @@ contextBridge.exposeInMainWorld("omnigentDesktop", {
   },
   /**
    * Fire an OS notification. Resolves true when shown, false otherwise.
-   * @param {{title: string, body?: string}} params
+   * @param {{title: string, body?: string, navigatePath?: string}} params
    */
   notify: (params) =>
     ipcRenderer.invoke("omnigent:notify", {
       title: params?.title,
       body: params?.body,
+      navigatePath: params?.navigatePath,
     }),
+  /**
+   * Subscribe to OS-notification clicks. The main process sends the in-app
+   * path the clicked notification carried, which we forward to the SPA so it
+   * can route there. Returns an unsubscribe function.
+   * @param {(path: string) => void} callback
+   * @returns {() => void}
+   */
+  onNotificationActivated: (callback) => {
+    const listener = (_event, path) => {
+      // Defense-in-depth: only forward in-app, same-origin paths. A leading
+      // "/" rejects absolute/cross-origin URLs and `javascript:` shapes before
+      // the renderer routes on the value, even if main ever sends junk.
+      if (typeof path === "string" && path.startsWith("/")) callback(path);
+    };
+    ipcRenderer.on("omnigent:notification-activated", listener);
+    return () => ipcRenderer.removeListener("omnigent:notification-activated", listener);
+  },
   /**
    * Title-bar server picker data: the window's current server origin and the
    * recently-connected server URLs (most recent first). Resolves null on

ap-web/electron/src/url.js

@@ -0,0 +1,182 @@
+// Shared URL-normalization helpers for the desktop shell.
+//
+// Loaded by both the Electron main process (`require("./url")` in
+// `src/main.js`) and the bundled setup page (`<script src="../src/url.js">` in
+// `setup/index.html`, where it publishes `window.omnigentUrl`). One copy keeps
+// the two from drifting — the setup page's plain-http warning and the main
+// process's navigation must agree on what a bare URL means.
+//
+// Only web/Node globals (URL, fetch, AbortSignal) are used, so the same source
+// runs unchanged under CommonJS (main) and in the renderer (setup page).
+(function (root, factory) {
+  const api = factory();
+  if (typeof module === "object" && module.exports) {
+    module.exports = api;
+  } else {
+    root.omnigentUrl = api;
+  }
+})(typeof globalThis !== "undefined" ? globalThis : this, function () {
+  "use strict";
+
+  /**
+   * Hostnames that resolve to the local machine. A schemeless URL defaults to
+   * https:// (the workspace / remote case the internal user guide documents),
+   * but these default to http:// — local dev servers are virtually always plain
+   * http, and the setup placeholder shows http://localhost.
+   */
+  const LOCAL_HOSTS = new Set(["localhost", "127.0.0.1", "[::1]", "::1"]);
+
+  /**
+   * The scheme a schemeless input should default to: http:// for loopback
+   * hosts (local dev is plain http), https:// for everything else (the pasted
+   * workspace-URL case). Unparseable input falls back to https:// so the
+   * caller's own URL parse raises the real error.
+   *
+   * @param {string} trimmed A trimmed, scheme-less `host[:port][/path]`.
+   * @returns {"http" | "https"}
+   */
+  function defaultSchemeFor(trimmed) {
+    let host;
+    try {
+      host = new URL(`https://${trimmed}`).hostname;
+    } catch {
+      host = "";
+    }
+    return LOCAL_HOSTS.has(host) ? "http" : "https";
+  }
+
+  /**
+   * Normalize a user-entered server URL into something navigable. Accepts a
+   * bare `host[:port][/path]` and defaults the scheme (https://, or http:// for
+   * loopback hosts), trims whitespace, and rejects anything that isn't an
+   * http(s) URL — fail loud rather than navigate to garbage.
+   *
+   * @param {string} raw
+   * @returns {string} A normalized absolute http(s) URL.
+   */
+  function normalizeUrl(raw) {
+    const trimmed = (raw ?? "").trim();
+    if (trimmed === "") throw new Error("server URL is empty");
+    const withScheme = trimmed.includes("://")
+      ? trimmed
+      : `${defaultSchemeFor(trimmed)}://${trimmed}`;
+    let url;
+    try {
+      url = new URL(withScheme);
+    } catch (e) {
+      throw new Error(`invalid URL: ${e.message}`);
+    }
+    if (url.protocol !== "http:" && url.protocol !== "https:") {
+      throw new Error(`unsupported scheme '${url.protocol}' (use http/https)`);
+    }
+    return url.toString();
+  }
+
+  /**
+   * True when the entered URL is unencrypted http:// to a non-local host — the
+   * setup page warns before connecting. Mirrors normalizeUrl's scheme-
+   * defaulting (https:// by default, http:// for loopback), so a bare remote
+   * host — now https — does not trip the warning; only an explicit http:// to a
+   * remote host does. Invalid URLs return false so the real error comes from
+   * normalizeUrl on Connect.
+   *
+   * @param {string} raw
+   * @returns {boolean}
+   */
+  function isPlainHttpRemote(raw) {
+    const trimmed = (raw || "").trim();
+    if (trimmed === "") return false;
+    const withScheme = trimmed.includes("://")
+      ? trimmed
+      : `${defaultSchemeFor(trimmed)}://${trimmed}`;
+    let url;
+    try {
+      url = new URL(withScheme);
+    } catch {
+      return false;
+    }
+    return url.protocol === "http:" && !LOCAL_HOSTS.has(url.hostname);
+  }
+
+  /**
+   * Path under a Databricks workspace where the Omnigent web UI is mounted. A
+   * bare workspace URL serves the workspace's own web app at the root, so a
+   * user who pastes just the workspace host (e.g.
+   * ``https://<ws>.azuredatabricks.net``) lands on a 404 unless this suffix is
+   * appended.
+   *
+   * NOTE: the Python CLI records the UI mount as ``/omnigent`` in
+   * ``omnigent/conversation_browser.py`` (WORKSPACE_UI_PATH), whereas the
+   * desktop deliberately keeps ``/ml/omnigents`` for now — that is the path the
+   * live workspace serves the embedded SPA on. The two are intentionally
+   * divergent pending reconciliation; do not "fix" this to ``/omnigent``
+   * without verifying what the workspace actually serves to the desktop shell.
+   */
+  const WORKSPACE_UI_PATH = "/ml/omnigents";
+
+  /**
+   * Probe timeout for Databricks workspace detection. Deliberately short: a
+   * slow or unreachable host must not stall the connect flow — on timeout we
+   * fall back to loading the URL exactly as entered.
+   */
+  const WORKSPACE_PROBE_TIMEOUT_MS = 8000;
+
+  /**
+   * Expand a bare Databricks workspace URL to its Omnigent web-UI mount.
+   *
+   * Mirrors the omni CLI's behavioral detection
+   * (``omnigent/cli.py:_workspace_api_server_url``): rather than match
+   * hostnames, probe the URL and adopt the mount only when the host answers
+   * like a Databricks workspace — a response carrying the ``server: databricks``
+   * header. URLs that already carry a path, or aren't https, are returned
+   * untouched WITHOUT a probe, so a user who pastes the full ``…/ml/omnigents``
+   * URL (or connects to any non-workspace server) is never second-guessed.
+   *
+   * The CLI appends the API mount because it's an API client; the desktop shell
+   * loads the web UI, so it appends the SPA mount instead.
+   *
+   * @param {string} normalized A normalized http(s) URL from normalizeUrl().
+   * @returns {Promise<string>} The workspace UI URL when expansion applies,
+   *   else the input unchanged.
+   */
+  async function expandDatabricksWorkspaceUrl(normalized) {
+    let url;
+    try {
+      url = new URL(normalized);
+    } catch {
+      return normalized;
+    }
+    // Only bare https roots are candidates: a non-root path means the user
+    // already pointed at a specific mount, and Databricks workspaces are
+    // https-only.
+    if (url.protocol !== "https:" || (url.pathname !== "/" && url.pathname !== "")) {
+      return normalized;
+    }
+    let probe;
+    try {
+      probe = await fetch(`${url.origin}/`, {
+        method: "HEAD",
+        redirect: "manual",
+        signal: AbortSignal.timeout(WORKSPACE_PROBE_TIMEOUT_MS),
+      });
+    } catch {
+      // Unreachable / DNS / TLS / timeout: connect to the URL as given and let
+      // the did-fail-load fallback surface any real failure.
+      return normalized;
+    }
+    if ((probe.headers.get("server") ?? "").toLowerCase() !== "databricks") {
+      return normalized;
+    }
+    return `${url.origin}${WORKSPACE_UI_PATH}`;
+  }
+
+  return {
+    LOCAL_HOSTS,
+    defaultSchemeFor,
+    normalizeUrl,
+    isPlainHttpRemote,
+    WORKSPACE_UI_PATH,
+    WORKSPACE_PROBE_TIMEOUT_MS,
+    expandDatabricksWorkspaceUrl,
+  };
+});

ap-web/electron/test/url.test.js

@@ -0,0 +1,196 @@
+// Tests for the shared desktop URL helpers (src/url.js), run with
+// `node --test` (no extra deps). Covers the scheme-defaulting that lets a
+// pasted workspace URL (schemeless, /omnigent suffix from the internal user
+// guide) connect, the plain-http warning, and the workspace probe/expansion.
+
+const { describe, it } = require("node:test");
+const assert = require("node:assert/strict");
+
+const {
+  defaultSchemeFor,
+  normalizeUrl,
+  isPlainHttpRemote,
+  expandDatabricksWorkspaceUrl,
+  WORKSPACE_UI_PATH,
+} = require("../src/url");
+
+describe("defaultSchemeFor", () => {
+  it("defaults remote hosts to https", () => {
+    assert.equal(defaultSchemeFor("dbc-x.cloud.databricks.com/omnigent"), "https");
+    assert.equal(defaultSchemeFor("example.com"), "https");
+  });
+
+  it("defaults loopback hosts to http", () => {
+    assert.equal(defaultSchemeFor("localhost:6767"), "http");
+    assert.equal(defaultSchemeFor("127.0.0.1:6767"), "http");
+    assert.equal(defaultSchemeFor("[::1]:6767"), "http");
+  });
+
+  it("defaults unparseable input to https", () => {
+    assert.equal(defaultSchemeFor("exa mple"), "https");
+  });
+});
+
+describe("normalizeUrl", () => {
+  it("defaults a schemeless workspace /omnigent URL to https", () => {
+    assert.equal(
+      normalizeUrl("dbc-a5d4177a-49dc.cloud.databricks.com/omnigent"),
+      "https://dbc-a5d4177a-49dc.cloud.databricks.com/omnigent",
+    );
+  });
+
+  it("defaults a bare remote host to https", () => {
+    assert.equal(
+      normalizeUrl("example.cloud.databricks.com"),
+      "https://example.cloud.databricks.com/",
+    );
+  });
+
+  it("defaults loopback hosts to http", () => {
+    assert.equal(normalizeUrl("localhost:6767"), "http://localhost:6767/");
+    assert.equal(normalizeUrl("127.0.0.1:6767"), "http://127.0.0.1:6767/");
+    assert.equal(normalizeUrl("[::1]:6767"), "http://[::1]:6767/");
+  });
+
+  it("preserves an explicit scheme (even http to a remote host)", () => {
+    assert.equal(normalizeUrl("http://localhost:6767"), "http://localhost:6767/");
+    assert.equal(normalizeUrl("https://example.com"), "https://example.com/");
+    assert.equal(normalizeUrl("http://example.databricks.com"), "http://example.databricks.com/");
+  });
+
+  it("trims surrounding whitespace", () => {
+    assert.equal(normalizeUrl("  example.com/omnigent  "), "https://example.com/omnigent");
+  });
+
+  it("rejects empty input", () => {
+    assert.throws(() => normalizeUrl(""), /server URL is empty/);
+    assert.throws(() => normalizeUrl("   "), /server URL is empty/);
+  });
+
+  it("rejects a non-http(s) scheme", () => {
+    assert.throws(() => normalizeUrl("ftp://example.com"), /unsupported scheme/);
+  });
+});
+
+describe("isPlainHttpRemote", () => {
+  it("does not warn for a bare remote host (now https)", () => {
+    assert.equal(isPlainHttpRemote("example.databricks.com"), false);
+    assert.equal(isPlainHttpRemote("dbc-x.cloud.databricks.com/omnigent"), false);
+  });
+
+  it("warns for an explicit http:// to a remote host", () => {
+    assert.equal(isPlainHttpRemote("http://example.databricks.com"), true);
+  });
+
+  it("does not warn for loopback hosts", () => {
+    assert.equal(isPlainHttpRemote("localhost:6767"), false);
+    assert.equal(isPlainHttpRemote("http://localhost:6767"), false);
+    assert.equal(isPlainHttpRemote("http://127.0.0.1:6767"), false);
+  });
+
+  it("does not warn for https or empty/invalid input", () => {
+    assert.equal(isPlainHttpRemote("https://example.databricks.com"), false);
+    assert.equal(isPlainHttpRemote(""), false);
+    assert.equal(isPlainHttpRemote("ht tp://nope"), false);
+  });
+});
+
+/**
+ * Run `fn` with `globalThis.fetch` swapped for `stub` and `AbortSignal.timeout`
+ * neutralized (no real timer), restoring both afterward.
+ */
+async function withFetch(stub, fn) {
+  const realFetch = globalThis.fetch;
+  const realTimeout = AbortSignal.timeout;
+  globalThis.fetch = stub;
+  AbortSignal.timeout = () => new AbortController().signal;
+  try {
+    return await fn();
+  } finally {
+    globalThis.fetch = realFetch;
+    AbortSignal.timeout = realTimeout;
+  }
+}
+
+/** A minimal Response stand-in exposing only `.headers.get`. */
+function fakeResponse(serverHeader) {
+  return { headers: { get: (name) => (name === "server" ? serverHeader : null) } };
+}
+
+describe("expandDatabricksWorkspaceUrl", () => {
+  it("expands a bare https Databricks workspace root to the UI mount", async () => {
+    const calls = [];
+    await withFetch(
+      async (url, opts) => {
+        calls.push({ url, method: opts.method });
+        return fakeResponse("databricks");
+      },
+      async () => {
+        const out = await expandDatabricksWorkspaceUrl("https://ws.cloud.databricks.com/");
+        assert.equal(out, `https://ws.cloud.databricks.com${WORKSPACE_UI_PATH}`);
+      },
+    );
+    // Probed the root with a HEAD request.
+    assert.deepEqual(calls, [{ url: "https://ws.cloud.databricks.com/", method: "HEAD" }]);
+  });
+
+  it("leaves a non-Databricks root unchanged", async () => {
+    await withFetch(
+      async () => fakeResponse("nginx"),
+      async () => {
+        assert.equal(
+          await expandDatabricksWorkspaceUrl("https://example.com"),
+          "https://example.com",
+        );
+      },
+    );
+  });
+
+  it("leaves a URL that already carries a path untouched, without probing", async () => {
+    let probed = false;
+    await withFetch(
+      async () => {
+        probed = true;
+        return fakeResponse("databricks");
+      },
+      async () => {
+        const url = "https://ws.cloud.databricks.com/omnigent";
+        assert.equal(await expandDatabricksWorkspaceUrl(url), url);
+      },
+    );
+    assert.equal(probed, false);
+  });
+
+  it("leaves a non-https URL untouched, without probing", async () => {
+    let probed = false;
+    await withFetch(
+      async () => {
+        probed = true;
+        return fakeResponse("databricks");
+      },
+      async () => {
+        assert.equal(
+          await expandDatabricksWorkspaceUrl("http://localhost:6767/"),
+          "http://localhost:6767/",
+        );
+      },
+    );
+    assert.equal(probed, false);
+  });
+
+  it("falls back to the input when the probe fails", async () => {
+    await withFetch(
+      async () => {
+        throw new Error("ECONNREFUSED");
+      },
+      async () => {
+        const url = "https://unreachable.example.com";
+        assert.equal(await expandDatabricksWorkspaceUrl(url), url);
+      },
+    );
+  });
+
+  it("returns unparseable input unchanged", async () => {
+    assert.equal(await expandDatabricksWorkspaceUrl("not a url"), "not a url");
+  });
+});

ap-web/ios/.gitignore

@@ -0,0 +1,23 @@
+# Xcode per-user state (window layout, open files, scheme selection, etc.)
+xcuserdata/
+
+# Build artifacts
+build/
+*.ipa
+*.dSYM.zip
+
+# Bundler (local gem install)
+.bundle/
+vendor/
+
+# Signing secrets — never commit
+fastlane/AuthKey_*.p8
+fastlane/.env
+
+# fastlane run output
+fastlane/report.xml
+fastlane/Preview.html
+fastlane/test_output/
+
+# Auto-generated lane docs (regenerated on every fastlane run; see RELEASE.md)
+fastlane/README.md

ap-web/ios/.swift-format

@@ -0,0 +1,77 @@
+{
+  "version": 1,
+  "indentation": {
+    "spaces": 2
+  },
+  "tabWidth": 8,
+  "lineLength": 100,
+  "maximumBlankLines": 1,
+  "respectsExistingLineBreaks": true,
+  "lineBreakBeforeControlFlowKeywords": false,
+  "lineBreakBeforeEachArgument": false,
+  "lineBreakBeforeEachGenericRequirement": false,
+  "lineBreakAroundMultilineExpressionChainComponents": false,
+  "lineBreakBetweenDeclarationAttributes": false,
+  "prioritizeKeepingFunctionOutputTogether": false,
+  "indentConditionalCompilationBlocks": true,
+  "indentSwitchCaseLabels": false,
+  "indentBlankLines": false,
+  "spacesAroundRangeFormationOperators": false,
+  "spacesBeforeEndOfLineComments": 2,
+  "multiElementCollectionTrailingCommas": true,
+  "reflowMultilineStringLiterals": "never",
+  "fileScopedDeclarationPrivacy": {
+    "accessLevel": "private"
+  },
+  "noAssignmentInExpressions": {
+    "allowedFunctions": ["XCTAssertNoThrow"]
+  },
+  "orderedImports": {
+    "includeConditionalImports": false
+  },
+  "rules": {
+    "AllPublicDeclarationsHaveDocumentation": false,
+    "AlwaysUseLiteralForEmptyCollectionInit": false,
+    "AlwaysUseLowerCamelCase": true,
+    "AmbiguousTrailingClosureOverload": true,
+    "AvoidRetroactiveConformances": true,
+    "BeginDocumentationCommentWithOneLineSummary": false,
+    "DoNotUseSemicolons": true,
+    "DontRepeatTypeInStaticProperties": true,
+    "FileScopedDeclarationPrivacy": true,
+    "FullyIndirectEnum": true,
+    "GroupNumericLiterals": true,
+    "IdentifiersMustBeASCII": true,
+    "NeverForceUnwrap": false,
+    "NeverUseForceTry": false,
+    "NeverUseImplicitlyUnwrappedOptionals": false,
+    "NoAccessLevelOnExtensionDeclaration": true,
+    "NoAssignmentInExpressions": true,
+    "NoBlockComments": true,
+    "NoCasesWithOnlyFallthrough": true,
+    "NoEmptyLinesOpeningClosingBraces": false,
+    "NoEmptyTrailingClosureParentheses": true,
+    "NoLabelsInCasePatterns": true,
+    "NoLeadingUnderscores": false,
+    "NoParensAroundConditions": true,
+    "NoPlaygroundLiterals": true,
+    "NoVoidReturnOnFunctionSignature": true,
+    "OmitExplicitReturns": false,
+    "OneCasePerLine": true,
+    "OneVariableDeclarationPerLine": true,
+    "OnlyOneTrailingClosureArgument": true,
+    "OrderedImports": true,
+    "ReplaceForEachWithForLoop": true,
+    "ReturnVoidInsteadOfEmptyTuple": true,
+    "TypeNamesShouldBeCapitalized": true,
+    "UseEarlyExits": false,
+    "UseExplicitNilCheckInConditions": true,
+    "UseLetInEveryBoundCaseVariable": true,
+    "UseShorthandTypeNames": true,
+    "UseSingleLinePropertyGetter": true,
+    "UseSynthesizedInitializer": true,
+    "UseTripleSlashForDocumentationComments": true,
+    "UseWhereClausesInForLoops": false,
+    "ValidateDocumentationComments": false
+  }
+}

ap-web/ios/Gemfile

@@ -0,0 +1,3 @@
+source "https://rubygems.org"
+
+gem "fastlane"

ap-web/ios/Gemfile.lock

@@ -0,0 +1,231 @@
+GEM
+  remote: https://rubygems.org/
+  specs:
+    CFPropertyList (3.0.9)
+    abbrev (0.1.2)
+    addressable (2.9.0)
+      public_suffix (>= 2.0.2, < 8.0)
+    artifactory (3.0.17)
+    atomos (0.1.3)
+    aws-eventstream (1.3.2)
+    aws-partitions (1.1109.0)
+    aws-sdk-core (3.224.1)
+      aws-eventstream (~> 1, >= 1.3.0)
+      aws-partitions (~> 1, >= 1.992.0)
+      aws-sigv4 (~> 1.9)
+      base64
+      jmespath (~> 1, >= 1.6.1)
+      logger
+    aws-sdk-kms (1.101.0)
+      aws-sdk-core (~> 3, >= 3.216.0)
+      aws-sigv4 (~> 1.5)
+    aws-sdk-s3 (1.188.0)
+      aws-sdk-core (~> 3, >= 3.224.1)
+      aws-sdk-kms (~> 1)
+      aws-sigv4 (~> 1.5)
+    aws-sigv4 (1.11.0)
+      aws-eventstream (~> 1, >= 1.0.2)
+    babosa (1.0.4)
+    base64 (0.2.0)
+    claide (1.1.0)
+    colored (1.2)
+    colored2 (3.1.2)
+    commander (4.6.0)
+      highline (~> 2.0.0)
+    csv (3.3.5)
+    declarative (0.0.20)
+    digest-crc (0.7.0)
+      rake (>= 12.0.0, < 14.0.0)
+    domain_name (0.5.20190701)
+      unf (>= 0.0.5, < 1.0.0)
+    dotenv (2.8.1)
+    emoji_regex (3.2.3)
+    excon (0.109.0)
+    faraday (1.10.5)
+      faraday-em_http (~> 1.0)
+      faraday-em_synchrony (~> 1.0)
+      faraday-excon (~> 1.1)
+      faraday-httpclient (~> 1.0)
+      faraday-multipart (~> 1.0)
+      faraday-net_http (~> 1.0)
+      faraday-net_http_persistent (~> 1.0)
+      faraday-patron (~> 1.0)
+      faraday-rack (~> 1.0)
+      faraday-retry (~> 1.0)
+      ruby2_keywords (>= 0.0.4)
+    faraday-cookie_jar (0.0.8)
+      faraday (>= 0.8.0)
+      http-cookie (>= 1.0.0)
+    faraday-em_http (1.0.0)
+    faraday-em_synchrony (1.0.1)
+    faraday-excon (1.1.0)
+    faraday-httpclient (1.0.1)
+    faraday-multipart (1.2.0)
+      multipart-post (~> 2.0)
+    faraday-net_http (1.0.2)
+    faraday-net_http_persistent (1.2.0)
+    faraday-patron (1.0.0)
+    faraday-rack (1.0.0)
+    faraday-retry (1.0.4)
+    faraday_middleware (1.2.1)
+      faraday (~> 1.0)
+    fastimage (2.4.1)
+    fastlane (2.230.0)
+      CFPropertyList (>= 2.3, < 4.0.0)
+      abbrev (~> 0.1.2)
+      addressable (>= 2.8, < 3.0.0)
+      artifactory (~> 3.0)
+      aws-sdk-s3 (~> 1.0)
+      babosa (>= 1.0.3, < 2.0.0)
+      base64 (~> 0.2.0)
+      bundler (>= 1.12.0, < 3.0.0)
+      colored (~> 1.2)
+      commander (~> 4.6)
+      csv (~> 3.3)
+      dotenv (>= 2.1.1, < 3.0.0)
+      emoji_regex (>= 0.1, < 4.0)
+      excon (>= 0.71.0, < 1.0.0)
+      faraday (~> 1.0)
+      faraday-cookie_jar (~> 0.0.6)
+      faraday_middleware (~> 1.0)
+      fastimage (>= 2.1.0, < 3.0.0)
+      fastlane-sirp (>= 1.0.0)
+      gh_inspector (>= 1.1.2, < 2.0.0)
+      google-apis-androidpublisher_v3 (~> 0.3)
+      google-apis-playcustomapp_v1 (~> 0.1)
+      google-cloud-env (>= 1.6.0, < 2.0.0)
+      google-cloud-storage (~> 1.31)
+      highline (~> 2.0)
+      http-cookie (~> 1.0.5)
+      json (< 3.0.0)
+      jwt (>= 2.1.0, < 3)
+      logger (>= 1.6, < 2.0)
+      mini_magick (>= 4.9.4, < 5.0.0)
+      multipart-post (>= 2.0.0, < 3.0.0)
+      mutex_m (~> 0.3.0)
+      naturally (~> 2.2)
+      nkf (~> 0.2.0)
+      optparse (>= 0.1.1, < 1.0.0)
+      plist (>= 3.1.0, < 4.0.0)
+      rubyzip (>= 2.0.0, < 3.0.0)
+      security (= 0.1.5)
+      simctl (~> 1.6.3)
+      terminal-notifier (>= 2.0.0, < 3.0.0)
+      terminal-table (~> 3)
+      tty-screen (>= 0.6.3, < 1.0.0)
+      tty-spinner (>= 0.8.0, < 1.0.0)
+      word_wrap (~> 1.0.0)
+      xcodeproj (>= 1.13.0, < 2.0.0)
+      xcpretty (~> 0.4.1)
+      xcpretty-travis-formatter (>= 0.0.3, < 2.0.0)
+    fastlane-sirp (1.1.0)
+    gh_inspector (1.1.3)
+    google-apis-androidpublisher_v3 (0.54.0)
+      google-apis-core (>= 0.11.0, < 2.a)
+    google-apis-core (0.11.3)
+      addressable (~> 2.5, >= 2.5.1)
+      googleauth (>= 0.16.2, < 2.a)
+      httpclient (>= 2.8.1, < 3.a)
+      mini_mime (~> 1.0)
+      representable (~> 3.0)
+      retriable (>= 2.0, < 4.a)
+      rexml
+    google-apis-iamcredentials_v1 (0.17.0)
+      google-apis-core (>= 0.11.0, < 2.a)
+    google-apis-playcustomapp_v1 (0.13.0)
+      google-apis-core (>= 0.11.0, < 2.a)
+    google-apis-storage_v1 (0.29.0)
+      google-apis-core (>= 0.11.0, < 2.a)
+    google-cloud-core (1.6.1)
+      google-cloud-env (>= 1.0, < 3.a)
+      google-cloud-errors (~> 1.0)
+    google-cloud-env (1.6.0)
+      faraday (>= 0.17.3, < 3.0)
+    google-cloud-errors (1.3.1)
+    google-cloud-storage (1.45.0)
+      addressable (~> 2.8)
+      digest-crc (~> 0.4)
+      google-apis-iamcredentials_v1 (~> 0.1)
+      google-apis-storage_v1 (~> 0.29.0)
+      google-cloud-core (~> 1.6)
+      googleauth (>= 0.16.2, < 2.a)
+      mini_mime (~> 1.0)
+    googleauth (1.8.1)
+      faraday (>= 0.17.3, < 3.a)
+      jwt (>= 1.4, < 3.0)
+      multi_json (~> 1.11)
+      os (>= 0.9, < 2.0)
+      signet (>= 0.16, < 2.a)
+    highline (2.0.3)
+    http-cookie (1.0.8)
+      domain_name (~> 0.5)
+    httpclient (2.9.0)
+      mutex_m
+    jmespath (1.6.2)
+    json (2.7.6)
+    jwt (2.10.3)
+      base64
+    logger (1.7.0)
+    mini_magick (4.13.2)
+    mini_mime (1.1.5)
+    multi_json (1.15.0)
+    multipart-post (2.4.1)
+    mutex_m (0.3.0)
+    nanaimo (0.4.0)
+    naturally (2.3.0)
+    nkf (0.2.0)
+    optparse (0.8.1)
+    os (1.1.4)
+    plist (3.7.2)
+    public_suffix (5.1.1)
+    rake (13.4.2)
+    representable (3.2.0)
+      declarative (< 0.1.0)
+      trailblazer-option (>= 0.1.1, < 0.2.0)
+      uber (< 0.2.0)
+    retriable (3.8.0)
+    rexml (3.4.4)
+    rouge (3.28.0)
+    ruby2_keywords (0.0.5)
+    rubyzip (2.4.1)
+    security (0.1.5)
+    signet (0.18.0)
+      addressable (~> 2.8)
+      faraday (>= 0.17.5, < 3.a)
+      jwt (>= 1.5, < 3.0)
+      multi_json (~> 1.10)
+    simctl (1.6.10)
+      CFPropertyList
+      naturally
+    terminal-notifier (2.0.0)
+    terminal-table (3.0.2)
+      unicode-display_width (>= 1.1.1, < 3)
+    trailblazer-option (0.1.2)
+    tty-cursor (0.7.1)
+    tty-screen (0.8.2)
+    tty-spinner (0.9.3)
+      tty-cursor (~> 0.7)
+    uber (0.1.0)
+    unf (0.2.0)
+    unicode-display_width (2.6.0)
+    word_wrap (1.0.0)
+    xcodeproj (1.27.0)
+      CFPropertyList (>= 2.3.3, < 4.0)
+      atomos (~> 0.1.3)
+      claide (>= 1.0.2, < 2.0)
+      colored2 (~> 3.1)
+      nanaimo (~> 0.4.0)
+      rexml (>= 3.3.6, < 4.0)
+    xcpretty (0.4.1)
+      rouge (~> 3.28.0)
+    xcpretty-travis-formatter (1.0.1)
+      xcpretty (~> 0.2, >= 0.0.7)
+
+PLATFORMS
+  ruby
+
+DEPENDENCIES
+  fastlane
+
+BUNDLED WITH
+   1.17.2

ap-web/ios/Omnigent.xcodeproj/project.pbxproj

@@ -0,0 +1,537 @@
+// !$*UTF8*$!
+{
+	archiveVersion = 1;
+	classes = {
+	};
+	objectVersion = 60;
+	objects = {
+
+/* Begin PBXBuildFile section */
+		B10000000000000000000001 /* OmnigentApp.swift in Sources */ = {isa = PBXBuildFile; fileRef = A10000000000000000000001 /* OmnigentApp.swift */; };
+		B10000000000000000000002 /* AppRootView.swift in Sources */ = {isa = PBXBuildFile; fileRef = A10000000000000000000002 /* AppRootView.swift */; };
+		B10000000000000000000003 /* ConnectView.swift in Sources */ = {isa = PBXBuildFile; fileRef = A10000000000000000000003 /* ConnectView.swift */; };
+		B10000000000000000000004 /* DesignTokens.swift in Sources */ = {isa = PBXBuildFile; fileRef = A10000000000000000000004 /* DesignTokens.swift */; };
+		B10000000000000000000005 /* SettingsStore.swift in Sources */ = {isa = PBXBuildFile; fileRef = A10000000000000000000005 /* SettingsStore.swift */; };
+		B10000000000000000000006 /* ServerURL.swift in Sources */ = {isa = PBXBuildFile; fileRef = A10000000000000000000006 /* ServerURL.swift */; };
+		B10000000000000000000007 /* WorkspaceURLExpander.swift in Sources */ = {isa = PBXBuildFile; fileRef = A10000000000000000000007 /* WorkspaceURLExpander.swift */; };
+		B10000000000000000000008 /* NativeNotificationManager.swift in Sources */ = {isa = PBXBuildFile; fileRef = A10000000000000000000008 /* NativeNotificationManager.swift */; };
+		B10000000000000000000009 /* WebShellView.swift in Sources */ = {isa = PBXBuildFile; fileRef = A10000000000000000000009 /* WebShellView.swift */; };
+		B1000000000000000000000A /* WebViewModel.swift in Sources */ = {isa = PBXBuildFile; fileRef = A1000000000000000000000A /* WebViewModel.swift */; };
+		B1000000000000000000000B /* OmnigentWebView.swift in Sources */ = {isa = PBXBuildFile; fileRef = A1000000000000000000000B /* OmnigentWebView.swift */; };
+		B1000000000000000000000C /* URL+Omnigent.swift in Sources */ = {isa = PBXBuildFile; fileRef = A1000000000000000000000C /* URL+Omnigent.swift */; };
+		B10000000000000000000011 /* ChatTerminalBar.swift in Sources */ = {isa = PBXBuildFile; fileRef = A10000000000000000000011 /* ChatTerminalBar.swift */; };
+		B1000000000000000000000D /* Assets.xcassets in Resources */ = {isa = PBXBuildFile; fileRef = A1000000000000000000000D /* Assets.xcassets */; };
+		B1000000000000000000000E /* AppIcon.icon in Resources */ = {isa = PBXBuildFile; fileRef = A1000000000000000000000E /* AppIcon.icon */; };
+		B20000000000000000000001 /* ServerURLTests.swift in Sources */ = {isa = PBXBuildFile; fileRef = A20000000000000000000001 /* ServerURLTests.swift */; };
+		B20000000000000000000002 /* SettingsStoreTests.swift in Sources */ = {isa = PBXBuildFile; fileRef = A20000000000000000000002 /* SettingsStoreTests.swift */; };
+		B20000000000000000000003 /* WorkspaceURLExpanderTests.swift in Sources */ = {isa = PBXBuildFile; fileRef = A20000000000000000000003 /* WorkspaceURLExpanderTests.swift */; };
+/* End PBXBuildFile section */
+
+/* Begin PBXContainerItemProxy section */
+		E00000000000000000000001 /* PBXContainerItemProxy */ = {
+			isa = PBXContainerItemProxy;
+			containerPortal = A00000000000000000000005 /* Project object */;
+			proxyType = 1;
+			remoteGlobalIDString = A00000000000000000000006;
+			remoteInfo = Omnigent;
+		};
+/* End PBXContainerItemProxy section */
+
+/* Begin PBXFileReference section */
+		A10000000000000000000001 /* OmnigentApp.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = OmnigentApp.swift; sourceTree = "<group>"; };
+		A10000000000000000000002 /* AppRootView.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = AppRootView.swift; sourceTree = "<group>"; };
+		A10000000000000000000003 /* ConnectView.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = ConnectView.swift; sourceTree = "<group>"; };
+		A10000000000000000000004 /* DesignTokens.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = DesignTokens.swift; sourceTree = "<group>"; };
+		A10000000000000000000005 /* SettingsStore.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = SettingsStore.swift; sourceTree = "<group>"; };
+		A10000000000000000000006 /* ServerURL.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = ServerURL.swift; sourceTree = "<group>"; };
+		A10000000000000000000007 /* WorkspaceURLExpander.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = WorkspaceURLExpander.swift; sourceTree = "<group>"; };
+		A10000000000000000000008 /* NativeNotificationManager.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = NativeNotificationManager.swift; sourceTree = "<group>"; };
+		A10000000000000000000009 /* WebShellView.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = WebShellView.swift; sourceTree = "<group>"; };
+		A1000000000000000000000A /* WebViewModel.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = WebViewModel.swift; sourceTree = "<group>"; };
+		A1000000000000000000000B /* OmnigentWebView.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = OmnigentWebView.swift; sourceTree = "<group>"; };
+		A1000000000000000000000C /* URL+Omnigent.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = "URL+Omnigent.swift"; sourceTree = "<group>"; };
+		A10000000000000000000011 /* ChatTerminalBar.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = ChatTerminalBar.swift; sourceTree = "<group>"; };
+		A1000000000000000000000D /* Assets.xcassets */ = {isa = PBXFileReference; lastKnownFileType = folder.assetcatalog; path = Assets.xcassets; sourceTree = "<group>"; };
+		A1000000000000000000000E /* AppIcon.icon */ = {isa = PBXFileReference; lastKnownFileType = folder.iconcomposer.icon; name = AppIcon.icon; path = "../platform-assets/AppIcon.icon"; sourceTree = "<group>"; };
+		A1000000000000000000000F /* Info-Debug.plist */ = {isa = PBXFileReference; lastKnownFileType = text.plist.xml; path = "Info-Debug.plist"; sourceTree = "<group>"; };
+		A10000000000000000000010 /* Info-Release.plist */ = {isa = PBXFileReference; lastKnownFileType = text.plist.xml; path = "Info-Release.plist"; sourceTree = "<group>"; };
+		A20000000000000000000001 /* ServerURLTests.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = ServerURLTests.swift; sourceTree = "<group>"; };
+		A20000000000000000000002 /* SettingsStoreTests.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = SettingsStoreTests.swift; sourceTree = "<group>"; };
+		A20000000000000000000003 /* WorkspaceURLExpanderTests.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = WorkspaceURLExpanderTests.swift; sourceTree = "<group>"; };
+		A30000000000000000000001 /* Omnigent.app */ = {isa = PBXFileReference; explicitFileType = wrapper.application; includeInIndex = 0; path = Omnigent.app; sourceTree = BUILT_PRODUCTS_DIR; };
+		A30000000000000000000002 /* OmnigentTests.xctest */ = {isa = PBXFileReference; explicitFileType = wrapper.cfbundle; includeInIndex = 0; path = OmnigentTests.xctest; sourceTree = BUILT_PRODUCTS_DIR; };
+/* End PBXFileReference section */
+
+/* Begin PBXFrameworksBuildPhase section */
+		C00000000000000000000002 /* Frameworks */ = {
+			isa = PBXFrameworksBuildPhase;
+			buildActionMask = 2147483647;
+			files = (
+			);
+			runOnlyForDeploymentPostprocessing = 0;
+		};
+		C00000000000000000000005 /* Frameworks */ = {
+			isa = PBXFrameworksBuildPhase;
+			buildActionMask = 2147483647;
+			files = (
+			);
+			runOnlyForDeploymentPostprocessing = 0;
+		};
+/* End PBXFrameworksBuildPhase section */
+
+/* Begin PBXGroup section */
+		A00000000000000000000001 = {
+			isa = PBXGroup;
+			children = (
+				A00000000000000000000003 /* Omnigent */,
+				A00000000000000000000004 /* OmnigentTests */,
+				A00000000000000000000008 /* Platform Assets */,
+				A00000000000000000000002 /* Products */,
+			);
+			sourceTree = "<group>";
+		};
+		A00000000000000000000002 /* Products */ = {
+			isa = PBXGroup;
+			children = (
+				A30000000000000000000001 /* Omnigent.app */,
+				A30000000000000000000002 /* OmnigentTests.xctest */,
+			);
+			name = Products;
+			sourceTree = "<group>";
+		};
+		A00000000000000000000003 /* Omnigent */ = {
+			isa = PBXGroup;
+			children = (
+				A10000000000000000000001 /* OmnigentApp.swift */,
+				A10000000000000000000002 /* AppRootView.swift */,
+				A10000000000000000000003 /* ConnectView.swift */,
+				A10000000000000000000004 /* DesignTokens.swift */,
+				A10000000000000000000005 /* SettingsStore.swift */,
+				A10000000000000000000006 /* ServerURL.swift */,
+				A10000000000000000000007 /* WorkspaceURLExpander.swift */,
+				A10000000000000000000008 /* NativeNotificationManager.swift */,
+				A10000000000000000000009 /* WebShellView.swift */,
+				A1000000000000000000000A /* WebViewModel.swift */,
+				A1000000000000000000000B /* OmnigentWebView.swift */,
+				A1000000000000000000000C /* URL+Omnigent.swift */,
+				A10000000000000000000011 /* ChatTerminalBar.swift */,
+				A1000000000000000000000D /* Assets.xcassets */,
+				A1000000000000000000000F /* Info-Debug.plist */,
+				A10000000000000000000010 /* Info-Release.plist */,
+			);
+			path = Omnigent;
+			sourceTree = "<group>";
+		};
+		A00000000000000000000004 /* OmnigentTests */ = {
+			isa = PBXGroup;
+			children = (
+				A20000000000000000000001 /* ServerURLTests.swift */,
+				A20000000000000000000002 /* SettingsStoreTests.swift */,
+				A20000000000000000000003 /* WorkspaceURLExpanderTests.swift */,
+			);
+			path = OmnigentTests;
+			sourceTree = "<group>";
+		};
+		A00000000000000000000008 /* Platform Assets */ = {
+			isa = PBXGroup;
+			children = (
+				A1000000000000000000000E /* AppIcon.icon */,
+			);
+			name = "Platform Assets";
+			sourceTree = "<group>";
+		};
+/* End PBXGroup section */
+
+/* Begin PBXNativeTarget section */
+		A00000000000000000000006 /* Omnigent */ = {
+			isa = PBXNativeTarget;
+			buildConfigurationList = D10000000000000000000001 /* Build configuration list for PBXNativeTarget "Omnigent" */;
+			buildPhases = (
+				C00000000000000000000001 /* Sources */,
+				C00000000000000000000002 /* Frameworks */,
+				C00000000000000000000003 /* Resources */,
+			);
+			buildRules = (
+			);
+			dependencies = (
+			);
+			name = Omnigent;
+			productName = Omnigent;
+			productReference = A30000000000000000000001 /* Omnigent.app */;
+			productType = "com.apple.product-type.application";
+		};
+		A00000000000000000000007 /* OmnigentTests */ = {
+			isa = PBXNativeTarget;
+			buildConfigurationList = D20000000000000000000001 /* Build configuration list for PBXNativeTarget "OmnigentTests" */;
+			buildPhases = (
+				C00000000000000000000004 /* Sources */,
+				C00000000000000000000005 /* Frameworks */,
+				C00000000000000000000006 /* Resources */,
+			);
+			buildRules = (
+			);
+			dependencies = (
+				E00000000000000000000002 /* PBXTargetDependency */,
+			);
+			name = OmnigentTests;
+			productName = OmnigentTests;
+			productReference = A30000000000000000000002 /* OmnigentTests.xctest */;
+			productType = "com.apple.product-type.bundle.unit-test";
+		};
+/* End PBXNativeTarget section */
+
+/* Begin PBXProject section */
+		A00000000000000000000005 /* Project object */ = {
+			isa = PBXProject;
+			attributes = {
+				BuildIndependentTargetsInParallel = 1;
+				LastSwiftUpdateCheck = 1600;
+				LastUpgradeCheck = 1600;
+				TargetAttributes = {
+					A00000000000000000000006 = {
+						CreatedOnToolsVersion = 16.0;
+					};
+					A00000000000000000000007 = {
+						CreatedOnToolsVersion = 16.0;
+						TestTargetID = A00000000000000000000006;
+					};
+				};
+			};
+			buildConfigurationList = D00000000000000000000001 /* Build configuration list for PBXProject "Omnigent" */;
+			compatibilityVersion = "Xcode 15.0";
+			developmentRegion = en;
+			hasScannedForEncodings = 0;
+			knownRegions = (
+				en,
+				Base,
+			);
+			mainGroup = A00000000000000000000001;
+			productRefGroup = A00000000000000000000002 /* Products */;
+			projectDirPath = "";
+			projectRoot = "";
+			targets = (
+				A00000000000000000000006 /* Omnigent */,
+				A00000000000000000000007 /* OmnigentTests */,
+			);
+		};
+/* End PBXProject section */
+
+/* Begin PBXResourcesBuildPhase section */
+		C00000000000000000000003 /* Resources */ = {
+			isa = PBXResourcesBuildPhase;
+			buildActionMask = 2147483647;
+			files = (
+				B1000000000000000000000D /* Assets.xcassets in Resources */,
+				B1000000000000000000000E /* AppIcon.icon in Resources */,
+			);
+			runOnlyForDeploymentPostprocessing = 0;
+		};
+		C00000000000000000000006 /* Resources */ = {
+			isa = PBXResourcesBuildPhase;
+			buildActionMask = 2147483647;
+			files = (
+			);
+			runOnlyForDeploymentPostprocessing = 0;
+		};
+/* End PBXResourcesBuildPhase section */
+
+/* Begin PBXSourcesBuildPhase section */
+		C00000000000000000000001 /* Sources */ = {
+			isa = PBXSourcesBuildPhase;
+			buildActionMask = 2147483647;
+			files = (
+				B10000000000000000000001 /* OmnigentApp.swift in Sources */,
+				B10000000000000000000002 /* AppRootView.swift in Sources */,
+				B10000000000000000000003 /* ConnectView.swift in Sources */,
+				B10000000000000000000004 /* DesignTokens.swift in Sources */,
+				B10000000000000000000005 /* SettingsStore.swift in Sources */,
+				B10000000000000000000006 /* ServerURL.swift in Sources */,
+				B10000000000000000000007 /* WorkspaceURLExpander.swift in Sources */,
+				B10000000000000000000008 /* NativeNotificationManager.swift in Sources */,
+				B10000000000000000000009 /* WebShellView.swift in Sources */,
+				B1000000000000000000000A /* WebViewModel.swift in Sources */,
+				B1000000000000000000000B /* OmnigentWebView.swift in Sources */,
+				B1000000000000000000000C /* URL+Omnigent.swift in Sources */,
+				B10000000000000000000011 /* ChatTerminalBar.swift in Sources */,
+			);
+			runOnlyForDeploymentPostprocessing = 0;
+		};
+		C00000000000000000000004 /* Sources */ = {
+			isa = PBXSourcesBuildPhase;
+			buildActionMask = 2147483647;
+			files = (
+				B20000000000000000000001 /* ServerURLTests.swift in Sources */,
+				B20000000000000000000002 /* SettingsStoreTests.swift in Sources */,
+				B20000000000000000000003 /* WorkspaceURLExpanderTests.swift in Sources */,
+			);
+			runOnlyForDeploymentPostprocessing = 0;
+		};
+/* End PBXSourcesBuildPhase section */
+
+/* Begin PBXTargetDependency section */
+		E00000000000000000000002 /* PBXTargetDependency */ = {
+			isa = PBXTargetDependency;
+			target = A00000000000000000000006 /* Omnigent */;
+			targetProxy = E00000000000000000000001 /* PBXContainerItemProxy */;
+		};
+/* End PBXTargetDependency section */
+
+/* Begin XCBuildConfiguration section */
+		D00000000000000000000002 /* Debug */ = {
+			isa = XCBuildConfiguration;
+			buildSettings = {
+				ALWAYS_SEARCH_USER_PATHS = NO;
+				CLANG_ANALYZER_NONNULL = YES;
+				CLANG_ANALYZER_NUMBER_OBJECT_CONVERSION = YES_AGGRESSIVE;
+				CLANG_CXX_LANGUAGE_STANDARD = "gnu++20";
+				CLANG_ENABLE_MODULES = YES;
+				CLANG_ENABLE_OBJC_ARC = YES;
+				CLANG_ENABLE_OBJC_WEAK = YES;
+				CLANG_WARN_BLOCK_CAPTURE_AUTORELEASING = YES;
+				CLANG_WARN_BOOL_CONVERSION = YES;
+				CLANG_WARN_COMMA = YES;
+				CLANG_WARN_CONSTANT_CONVERSION = YES;
+				CLANG_WARN_DEPRECATED_OBJC_IMPLEMENTATIONS = YES;
+				CLANG_WARN_DIRECT_OBJC_ISA_USAGE = YES_ERROR;
+				CLANG_WARN_DOCUMENTATION_COMMENTS = YES;
+				CLANG_WARN_EMPTY_BODY = YES;
+				CLANG_WARN_ENUM_CONVERSION = YES;
+				CLANG_WARN_INFINITE_RECURSION = YES;
+				CLANG_WARN_INT_CONVERSION = YES;
+				CLANG_WARN_NON_LITERAL_NULL_CONVERSION = YES;
+				CLANG_WARN_OBJC_IMPLICIT_RETAIN_SELF = YES;
+				CLANG_WARN_OBJC_LITERAL_CONVERSION = YES;
+				CLANG_WARN_OBJC_ROOT_CLASS = YES_ERROR;
+				CLANG_WARN_QUOTED_INCLUDE_IN_FRAMEWORK_HEADER = YES;
+				CLANG_WARN_RANGE_LOOP_ANALYSIS = YES;
+				CLANG_WARN_STRICT_PROTOTYPES = YES;
+				CLANG_WARN_SUSPICIOUS_MOVE = YES;
+				CLANG_WARN_UNGUARDED_AVAILABILITY = YES_AGGRESSIVE;
+				CLANG_WARN_UNREACHABLE_CODE = YES;
+				CLANG_WARN__DUPLICATE_METHOD_MATCH = YES;
+				COPY_PHASE_STRIP = NO;
+				DEBUG_INFORMATION_FORMAT = dwarf;
+				ENABLE_STRICT_OBJC_MSGSEND = YES;
+				ENABLE_TESTABILITY = YES;
+				ENABLE_USER_SCRIPT_SANDBOXING = YES;
+				GCC_C_LANGUAGE_STANDARD = gnu17;
+				GCC_DYNAMIC_NO_PIC = NO;
+				GCC_NO_COMMON_BLOCKS = YES;
+				GCC_OPTIMIZATION_LEVEL = 0;
+				GCC_PREPROCESSOR_DEFINITIONS = (
+					"DEBUG=1",
+					"$(inherited)",
+				);
+				GCC_WARN_64_TO_32_BIT_CONVERSION = YES;
+				GCC_WARN_ABOUT_RETURN_TYPE = YES_ERROR;
+				GCC_WARN_UNDECLARED_SELECTOR = YES;
+				GCC_WARN_UNINITIALIZED_AUTOS = YES_AGGRESSIVE;
+				GCC_WARN_UNUSED_FUNCTION = YES;
+				GCC_WARN_UNUSED_VARIABLE = YES;
+				IPHONEOS_DEPLOYMENT_TARGET = 18.0;
+				MTL_ENABLE_DEBUG_INFO = INCLUDE_SOURCE;
+				MTL_FAST_MATH = YES;
+				ONLY_ACTIVE_ARCH = YES;
+				SDKROOT = iphoneos;
+				SWIFT_ACTIVE_COMPILATION_CONDITIONS = "DEBUG $(inherited)";
+				SWIFT_OPTIMIZATION_LEVEL = "-Onone";
+			};
+			name = Debug;
+		};
+		D00000000000000000000003 /* Release */ = {
+			isa = XCBuildConfiguration;
+			buildSettings = {
+				ALWAYS_SEARCH_USER_PATHS = NO;
+				CLANG_ANALYZER_NONNULL = YES;
+				CLANG_ANALYZER_NUMBER_OBJECT_CONVERSION = YES_AGGRESSIVE;
+				CLANG_CXX_LANGUAGE_STANDARD = "gnu++20";
+				CLANG_ENABLE_MODULES = YES;
+				CLANG_ENABLE_OBJC_ARC = YES;
+				CLANG_ENABLE_OBJC_WEAK = YES;
+				CLANG_WARN_BLOCK_CAPTURE_AUTORELEASING = YES;
+				CLANG_WARN_BOOL_CONVERSION = YES;
+				CLANG_WARN_COMMA = YES;
+				CLANG_WARN_CONSTANT_CONVERSION = YES;
+				CLANG_WARN_DEPRECATED_OBJC_IMPLEMENTATIONS = YES;
+				CLANG_WARN_DIRECT_OBJC_ISA_USAGE = YES_ERROR;
+				CLANG_WARN_DOCUMENTATION_COMMENTS = YES;
+				CLANG_WARN_EMPTY_BODY = YES;
+				CLANG_WARN_ENUM_CONVERSION = YES;
+				CLANG_WARN_INFINITE_RECURSION = YES;
+				CLANG_WARN_INT_CONVERSION = YES;
+				CLANG_WARN_NON_LITERAL_NULL_CONVERSION = YES;
+				CLANG_WARN_OBJC_IMPLICIT_RETAIN_SELF = YES;
+				CLANG_WARN_OBJC_LITERAL_CONVERSION = YES;
+				CLANG_WARN_OBJC_ROOT_CLASS = YES_ERROR;
+				CLANG_WARN_QUOTED_INCLUDE_IN_FRAMEWORK_HEADER = YES;
+				CLANG_WARN_RANGE_LOOP_ANALYSIS = YES;
+				CLANG_WARN_STRICT_PROTOTYPES = YES;
+				CLANG_WARN_SUSPICIOUS_MOVE = YES;
+				CLANG_WARN_UNGUARDED_AVAILABILITY = YES_AGGRESSIVE;
+				CLANG_WARN_UNREACHABLE_CODE = YES;
+				CLANG_WARN__DUPLICATE_METHOD_MATCH = YES;
+				COPY_PHASE_STRIP = NO;
+				DEBUG_INFORMATION_FORMAT = "dwarf-with-dsym";
+				ENABLE_NS_ASSERTIONS = NO;
+				ENABLE_STRICT_OBJC_MSGSEND = YES;
+				ENABLE_USER_SCRIPT_SANDBOXING = YES;
+				GCC_C_LANGUAGE_STANDARD = gnu17;
+				GCC_NO_COMMON_BLOCKS = YES;
+				GCC_WARN_64_TO_32_BIT_CONVERSION = YES;
+				GCC_WARN_ABOUT_RETURN_TYPE = YES_ERROR;
+				GCC_WARN_UNDECLARED_SELECTOR = YES;
+				GCC_WARN_UNINITIALIZED_AUTOS = YES_AGGRESSIVE;
+				GCC_WARN_UNUSED_FUNCTION = YES;
+				GCC_WARN_UNUSED_VARIABLE = YES;
+				IPHONEOS_DEPLOYMENT_TARGET = 18.0;
+				MTL_ENABLE_DEBUG_INFO = NO;
+				MTL_FAST_MATH = YES;
+				SDKROOT = iphoneos;
+				SWIFT_COMPILATION_MODE = wholemodule;
+				SWIFT_OPTIMIZATION_LEVEL = "-O";
+				VALIDATE_PRODUCT = YES;
+			};
+			name = Release;
+		};
+		D10000000000000000000002 /* Debug */ = {
+			isa = XCBuildConfiguration;
+			buildSettings = {
+				ASSETCATALOG_COMPILER_APPICON_NAME = AppIcon;
+				ASSETCATALOG_COMPILER_GLOBAL_ACCENT_COLOR_NAME = AccentColor;
+				CODE_SIGN_IDENTITY = "Apple Development";
+				CODE_SIGN_STYLE = Automatic;
+				CURRENT_PROJECT_VERSION = 1;
+				DEVELOPMENT_ASSET_PATHS = "";
+				DEVELOPMENT_TEAM = 8RMX4WU6F8;
+				GENERATE_INFOPLIST_FILE = NO;
+				INFOPLIST_FILE = "Omnigent/Info-Debug.plist";
+				VERSIONING_SYSTEM = "apple-generic";
+				IPHONEOS_DEPLOYMENT_TARGET = 18.0;
+				LD_RUNPATH_SEARCH_PATHS = (
+					"$(inherited)",
+					"@executable_path/Frameworks",
+				);
+				MARKETING_VERSION = 0.1.0;
+				PRODUCT_BUNDLE_IDENTIFIER = ai.omnigent.ios;
+				PRODUCT_NAME = "$(TARGET_NAME)";
+				PROVISIONING_PROFILE_SPECIFIER = "";
+				SUPPORTED_PLATFORMS = "iphoneos iphonesimulator";
+				SUPPORTS_MACCATALYST = NO;
+				SWIFT_EMIT_LOC_STRINGS = YES;
+				SWIFT_VERSION = 5.0;
+				TARGETED_DEVICE_FAMILY = "1,2";
+			};
+			name = Debug;
+		};
+		D10000000000000000000003 /* Release */ = {
+			isa = XCBuildConfiguration;
+			buildSettings = {
+				ASSETCATALOG_COMPILER_APPICON_NAME = AppIcon;
+				ASSETCATALOG_COMPILER_GLOBAL_ACCENT_COLOR_NAME = AccentColor;
+				CODE_SIGN_IDENTITY = "Apple Development";
+				CODE_SIGN_STYLE = Automatic;
+				CURRENT_PROJECT_VERSION = 1;
+				DEVELOPMENT_ASSET_PATHS = "";
+				DEVELOPMENT_TEAM = 8RMX4WU6F8;
+				GENERATE_INFOPLIST_FILE = NO;
+				INFOPLIST_FILE = "Omnigent/Info-Release.plist";
+				VERSIONING_SYSTEM = "apple-generic";
+				IPHONEOS_DEPLOYMENT_TARGET = 18.0;
+				LD_RUNPATH_SEARCH_PATHS = (
+					"$(inherited)",
+					"@executable_path/Frameworks",
+				);
+				MARKETING_VERSION = 0.1.0;
+				PRODUCT_BUNDLE_IDENTIFIER = ai.omnigent.ios;
+				PRODUCT_NAME = "$(TARGET_NAME)";
+				PROVISIONING_PROFILE_SPECIFIER = "";
+				SUPPORTED_PLATFORMS = "iphoneos iphonesimulator";
+				SUPPORTS_MACCATALYST = NO;
+				SWIFT_EMIT_LOC_STRINGS = YES;
+				SWIFT_VERSION = 5.0;
+				TARGETED_DEVICE_FAMILY = "1,2";
+			};
+			name = Release;
+		};
+		D20000000000000000000002 /* Debug */ = {
+			isa = XCBuildConfiguration;
+			buildSettings = {
+				BUNDLE_LOADER = "$(TEST_HOST)";
+				CODE_SIGN_STYLE = Automatic;
+				CURRENT_PROJECT_VERSION = 1;
+				GENERATE_INFOPLIST_FILE = YES;
+				IPHONEOS_DEPLOYMENT_TARGET = 18.0;
+				LD_RUNPATH_SEARCH_PATHS = (
+					"$(inherited)",
+					"@executable_path/Frameworks",
+					"@loader_path/Frameworks",
+				);
+				MARKETING_VERSION = 0.1.0;
+				PRODUCT_BUNDLE_IDENTIFIER = ai.omnigent.ios.tests;
+				PRODUCT_NAME = "$(TARGET_NAME)";
+				SUPPORTED_PLATFORMS = "iphoneos iphonesimulator";
+				SUPPORTS_MACCATALYST = NO;
+				SWIFT_VERSION = 5.0;
+				TARGETED_DEVICE_FAMILY = "1,2";
+				TEST_HOST = "$(BUILT_PRODUCTS_DIR)/Omnigent.app/$(BUNDLE_EXECUTABLE_FOLDER_PATH)/Omnigent";
+			};
+			name = Debug;
+		};
+		D20000000000000000000003 /* Release */ = {
+			isa = XCBuildConfiguration;
+			buildSettings = {
+				BUNDLE_LOADER = "$(TEST_HOST)";
+				CODE_SIGN_STYLE = Automatic;
+				CURRENT_PROJECT_VERSION = 1;
+				GENERATE_INFOPLIST_FILE = YES;
+				IPHONEOS_DEPLOYMENT_TARGET = 18.0;
+				LD_RUNPATH_SEARCH_PATHS = (
+					"$(inherited)",
+					"@executable_path/Frameworks",
+					"@loader_path/Frameworks",
+				);
+				MARKETING_VERSION = 0.1.0;
+				PRODUCT_BUNDLE_IDENTIFIER = ai.omnigent.ios.tests;
+				PRODUCT_NAME = "$(TARGET_NAME)";
+				SUPPORTED_PLATFORMS = "iphoneos iphonesimulator";
+				SUPPORTS_MACCATALYST = NO;
+				SWIFT_VERSION = 5.0;
+				TARGETED_DEVICE_FAMILY = "1,2";
+				TEST_HOST = "$(BUILT_PRODUCTS_DIR)/Omnigent.app/$(BUNDLE_EXECUTABLE_FOLDER_PATH)/Omnigent";
+			};
+			name = Release;
+		};
+/* End XCBuildConfiguration section */
+
+/* Begin XCConfigurationList section */
+		D00000000000000000000001 /* Build configuration list for PBXProject "Omnigent" */ = {
+			isa = XCConfigurationList;
+			buildConfigurations = (
+				D00000000000000000000002 /* Debug */,
+				D00000000000000000000003 /* Release */,
+			);
+			defaultConfigurationIsVisible = 0;
+			defaultConfigurationName = Release;
+		};
+		D10000000000000000000001 /* Build configuration list for PBXNativeTarget "Omnigent" */ = {
+			isa = XCConfigurationList;
+			buildConfigurations = (
+				D10000000000000000000002 /* Debug */,
+				D10000000000000000000003 /* Release */,
+			);
+			defaultConfigurationIsVisible = 0;
+			defaultConfigurationName = Release;
+		};
+		D20000000000000000000001 /* Build configuration list for PBXNativeTarget "OmnigentTests" */ = {
+			isa = XCConfigurationList;
+			buildConfigurations = (
+				D20000000000000000000002 /* Debug */,
+				D20000000000000000000003 /* Release */,
+			);
+			defaultConfigurationIsVisible = 0;
+			defaultConfigurationName = Release;
+		};
+/* End XCConfigurationList section */
+	};
+	rootObject = A00000000000000000000005 /* Project object */;
+}

ap-web/ios/Omnigent.xcodeproj/project.xcworkspace/contents.xcworkspacedata

@@ -0,0 +1,7 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<Workspace
+   version = "1.0">
+   <FileRef
+      location = "self:">
+   </FileRef>
+</Workspace>

ap-web/ios/Omnigent.xcodeproj/xcshareddata/xcschemes/Omnigent.xcscheme

@@ -0,0 +1,89 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<Scheme
+   LastUpgradeVersion = "1600"
+   version = "1.7">
+   <BuildAction
+      parallelizeBuildables = "YES"
+      buildImplicitDependencies = "YES">
+      <BuildActionEntries>
+         <BuildActionEntry
+            buildForTesting = "YES"
+            buildForRunning = "YES"
+            buildForProfiling = "YES"
+            buildForArchiving = "YES"
+            buildForAnalyzing = "YES">
+            <BuildableReference
+               BuildableIdentifier = "primary"
+               BlueprintIdentifier = "A00000000000000000000006"
+               BuildableName = "Omnigent.app"
+               BlueprintName = "Omnigent"
+               ReferencedContainer = "container:Omnigent.xcodeproj">
+            </BuildableReference>
+         </BuildActionEntry>
+      </BuildActionEntries>
+   </BuildAction>
+   <TestAction
+      buildConfiguration = "Debug"
+      selectedDebuggerIdentifier = "Xcode.DebuggerFoundation.Debugger.LLDB"
+      selectedLauncherIdentifier = "Xcode.DebuggerFoundation.Launcher.LLDB"
+      shouldUseLaunchSchemeArgsEnv = "YES">
+      <Testables>
+         <TestableReference
+            skipped = "NO"
+            parallelizable = "YES">
+            <BuildableReference
+               BuildableIdentifier = "primary"
+               BlueprintIdentifier = "A00000000000000000000007"
+               BuildableName = "OmnigentTests.xctest"
+               BlueprintName = "OmnigentTests"
+               ReferencedContainer = "container:Omnigent.xcodeproj">
+            </BuildableReference>
+         </TestableReference>
+      </Testables>
+   </TestAction>
+   <LaunchAction
+      buildConfiguration = "Debug"
+      selectedDebuggerIdentifier = "Xcode.DebuggerFoundation.Debugger.LLDB"
+      selectedLauncherIdentifier = "Xcode.DebuggerFoundation.Launcher.LLDB"
+      launchStyle = "0"
+      useCustomWorkingDirectory = "NO"
+      ignoresPersistentStateOnLaunch = "NO"
+      debugDocumentVersioning = "YES"
+      debugServiceExtension = "internal"
+      allowLocationSimulation = "YES">
+      <BuildableProductRunnable
+         runnableDebuggingMode = "0">
+         <BuildableReference
+            BuildableIdentifier = "primary"
+            BlueprintIdentifier = "A00000000000000000000006"
+            BuildableName = "Omnigent.app"
+            BlueprintName = "Omnigent"
+            ReferencedContainer = "container:Omnigent.xcodeproj">
+         </BuildableReference>
+      </BuildableProductRunnable>
+   </LaunchAction>
+   <ProfileAction
+      buildConfiguration = "Release"
+      shouldUseLaunchSchemeArgsEnv = "YES"
+      savedToolIdentifier = ""
+      useCustomWorkingDirectory = "NO"
+      debugDocumentVersioning = "YES">
+      <BuildableProductRunnable
+         runnableDebuggingMode = "0">
+         <BuildableReference
+            BuildableIdentifier = "primary"
+            BlueprintIdentifier = "A00000000000000000000006"
+            BuildableName = "Omnigent.app"
+            BlueprintName = "Omnigent"
+            ReferencedContainer = "container:Omnigent.xcodeproj">
+         </BuildableReference>
+      </BuildableProductRunnable>
+   </ProfileAction>
+   <AnalyzeAction
+      buildConfiguration = "Debug">
+   </AnalyzeAction>
+   <ArchiveAction
+      buildConfiguration = "Release"
+      revealArchiveInOrganizer = "YES">
+   </ArchiveAction>
+</Scheme>

ap-web/ios/Omnigent/AppRootView.swift

@@ -0,0 +1,53 @@
+import SwiftUI
+
+struct AppRootView: View {
+  @EnvironmentObject private var settings: SettingsStore
+  @State private var mode: Mode
+
+  init() {
+    _mode = State(initialValue: .setup(prefill: nil, error: nil))
+  }
+
+  var body: some View {
+    Group {
+      switch mode {
+      case .setup(let prefill, let error):
+        ConnectView(prefill: prefill ?? settings.serverURL, error: error) { url in
+          settings.serverURL = url.absoluteString
+          mode = .web(url)
+        }
+      case .web(let url):
+        WebShellView(
+          initialURL: url,
+          connectToNewServer: {
+            mode = .setup(prefill: settings.serverURL, error: nil)
+          },
+          switchToServer: { nextURL in
+            settings.serverURL = nextURL.absoluteString
+            mode = .web(nextURL)
+          },
+          loadFailed: { failedURL, message in
+            mode = .setup(
+              prefill: failedURL.omnigentOrigin ?? failedURL.absoluteString, error: message)
+          },
+          loadSucceeded: { loadedURL in
+            settings.rememberRecentServer(loadedURL)
+          }
+        )
+      }
+    }
+    .task {
+      if case .setup(nil, nil) = mode,
+        let saved = settings.serverURL,
+        let url = URL(string: saved)
+      {
+        mode = .web(url)
+      }
+    }
+  }
+
+  private enum Mode: Equatable {
+    case setup(prefill: String?, error: String?)
+    case web(URL)
+  }
+}

ap-web/ios/Omnigent/Assets.xcassets/AccentColor.colorset/Contents.json

@@ -0,0 +1,20 @@
+{
+  "colors" : [
+    {
+      "color" : {
+        "color-space" : "srgb",
+        "components" : {
+          "alpha" : "1.000",
+          "blue" : "0.478",
+          "green" : "0.478",
+          "red" : "0.000"
+        }
+      },
+      "idiom" : "universal"
+    }
+  ],
+  "info" : {
+    "author" : "xcode",
+    "version" : 1
+  }
+}

ap-web/ios/Omnigent/Assets.xcassets/Contents.json

@@ -0,0 +1,6 @@
+{
+  "info" : {
+    "author" : "xcode",
+    "version" : 1
+  }
+}

ap-web/ios/Omnigent/Assets.xcassets/OmnigentLogo.imageset/Contents.json

@@ -0,0 +1,15 @@
+{
+  "images" : [
+    {
+      "filename" : "omnigents-logo.svg",
+      "idiom" : "universal"
+    }
+  ],
+  "info" : {
+    "author" : "xcode",
+    "version" : 1
+  },
+  "properties" : {
+    "preserves-vector-representation" : true
+  }
+}

ap-web/ios/Omnigent/Assets.xcassets/OmnigentLogo.imageset/omnigents-logo.svg

@@ -0,0 +1 @@
+../../../../platform-assets/logos/omnigents-logo.svg

ap-web/ios/Omnigent/Assets.xcassets/OmnigentLogoReverse.imageset/Contents.json

@@ -0,0 +1,15 @@
+{
+  "images" : [
+    {
+      "filename" : "omnigents-logo-reverse.svg",
+      "idiom" : "universal"
+    }
+  ],
+  "info" : {
+    "author" : "xcode",
+    "version" : 1
+  },
+  "properties" : {
+    "preserves-vector-representation" : true
+  }
+}

ap-web/ios/Omnigent/Assets.xcassets/OmnigentLogoReverse.imageset/omnigents-logo-reverse.svg

@@ -0,0 +1 @@
+../../../../platform-assets/logos/omnigents-logo-reverse.svg

ap-web/ios/Omnigent/ChatTerminalBar.swift

@@ -0,0 +1,88 @@
+import SwiftUI
+
+/// The native Chat/Terminal switcher rendered over the bottom of the web view.
+///
+/// On iOS 26+ the capsule uses the system Liquid Glass material; on iOS 18–25 it
+/// falls back to `.ultraThinMaterial`, matching the look of `ServerSwitcher`.
+struct ChatTerminalBar: View {
+  @Binding var mode: WebViewMode
+  let terminalEnabled: Bool
+  let terminalStartingUp: Bool
+  let onSelect: (WebViewMode) -> Void
+
+  @Environment(\.colorScheme) private var colorScheme
+  @Namespace private var selection
+
+  var body: some View {
+    HStack(spacing: 4) {
+      segment(.chat, title: "Chat", systemImage: "message")
+      segment(.terminal, title: "Terminal", systemImage: "terminal")
+    }
+    .padding(InsetMetrics.barCapsulePadding)
+    .modifier(GlassCapsule(colorScheme: colorScheme))
+    .animation(.easeInOut(duration: 0.18), value: mode)
+    .accessibilityElement(children: .contain)
+    .accessibilityLabel("View mode")
+  }
+
+  @ViewBuilder
+  private func segment(_ target: WebViewMode, title: String, systemImage: String) -> some View {
+    let isSelected = mode == target
+    let isDisabled = target == .terminal && !terminalEnabled
+
+    Button {
+      guard !isDisabled, mode != target else { return }
+      onSelect(target)
+    } label: {
+      HStack(spacing: 5) {
+        if target == .terminal && terminalStartingUp {
+          ProgressView()
+            .controlSize(.mini)
+        } else {
+          Image(systemName: systemImage)
+            .font(.system(size: 13, weight: .medium))
+        }
+        Text(title)
+          .font(.system(size: 13, weight: .medium))
+      }
+      .foregroundStyle(
+        isSelected
+          ? DesignTokens.foreground(colorScheme) : DesignTokens.mutedForeground(colorScheme)
+      )
+      .padding(.horizontal, 14)
+      .frame(height: InsetMetrics.barSegmentHeight)
+      .background {
+        if isSelected {
+          Capsule(style: .continuous)
+            .fill(Color.primary.opacity(colorScheme == .dark ? 0.16 : 0.08))
+            .matchedGeometryEffect(id: "selection", in: selection)
+        }
+      }
+      .contentShape(Capsule(style: .continuous))
+    }
+    .buttonStyle(.plain)
+    .disabled(isDisabled)
+    .opacity(isDisabled ? 0.4 : 1)
+    .accessibilityAddTraits(isSelected ? [.isSelected] : [])
+  }
+}
+
+/// Wraps the bar in the system glass material where available, otherwise a
+/// hand-rolled material capsule that mirrors `ServerSwitcher`'s styling.
+private struct GlassCapsule: ViewModifier {
+  let colorScheme: ColorScheme
+
+  func body(content: Content) -> some View {
+    if #available(iOS 26.0, *) {
+      content.glassEffect(.regular.interactive(), in: .capsule)
+    } else {
+      content
+        .background(.ultraThinMaterial, in: Capsule(style: .continuous))
+        .overlay {
+          Capsule(style: .continuous)
+            .stroke(Color.primary.opacity(colorScheme == .dark ? 0.16 : 0.10), lineWidth: 0.5)
+        }
+        .shadow(color: .black.opacity(colorScheme == .dark ? 0.22 : 0.08), radius: 10, y: 4)
+    }
+  }
+}

ap-web/ios/Omnigent/ConnectView.swift

@@ -0,0 +1,193 @@
+import SwiftUI
+
+struct ConnectView: View {
+  let prefill: String?
+  let error: String?
+  let onConnect: (URL) -> Void
+
+  @Environment(\.colorScheme) private var colorScheme
+  @EnvironmentObject private var settings: SettingsStore
+  @State private var serverURL: String
+  @State private var message: String?
+  @State private var isConnecting = false
+
+  init(prefill: String?, error: String?, onConnect: @escaping (URL) -> Void) {
+    self.prefill = prefill
+    self.error = error
+    self.onConnect = onConnect
+    _serverURL = State(initialValue: prefill ?? defaultServerURL)
+    _message = State(initialValue: error)
+  }
+
+  var body: some View {
+    VStack {
+      Spacer(minLength: 24)
+
+      VStack(spacing: 0) {
+        Image(colorScheme == .dark ? "OmnigentLogoReverse" : "OmnigentLogo")
+          .resizable()
+          .scaledToFit()
+          .frame(height: 80)
+          .padding(.bottom, 12)
+
+        Text("Enter the URL of the Omnigents server. The iOS app loads its web UI directly.")
+          .font(.system(size: 14))
+          .lineSpacing(2)
+          .multilineTextAlignment(.center)
+          .foregroundStyle(DesignTokens.mutedForeground(colorScheme))
+          .padding(.bottom, 24)
+
+        VStack(alignment: .leading, spacing: 8) {
+          Text("Server URL")
+            .font(.system(size: 14, weight: .medium))
+            .foregroundStyle(DesignTokens.foreground(colorScheme))
+
+          TextField(defaultServerURL, text: $serverURL)
+            .textInputAutocapitalization(.never)
+            .autocorrectionDisabled()
+            .keyboardType(.URL)
+            .font(.system(size: 14))
+            .padding(.horizontal, 12)
+            .frame(height: 38)
+            .overlay {
+              RoundedRectangle(cornerRadius: DesignTokens.radius)
+                .stroke(DesignTokens.border(colorScheme), lineWidth: 1)
+            }
+            .submitLabel(.go)
+            .onSubmit(connect)
+            .disabled(isConnecting)
+        }
+
+        Button(action: connect) {
+          if isConnecting {
+            HStack(spacing: 8) {
+              ProgressView()
+                .tint(primaryForeground)
+              Text("Connecting…")
+            }
+          } else {
+            Text("Connect")
+          }
+        }
+        .buttonStyle(PrimaryButtonStyle(background: primary, foreground: primaryForeground))
+        .padding(.top, 16)
+        .disabled(isConnecting)
+        // Fires the moment connect() flips isConnecting, so the tap is
+        // acknowledged by touch even before the spinner appears.
+        .sensoryFeedback(.impact(weight: .light), trigger: isConnecting)
+
+        Text(message ?? "")
+          .font(.system(size: 13))
+          .lineSpacing(2)
+          .foregroundStyle(Color(red: 0.784, green: 0.196, blue: 0.298))
+          .frame(maxWidth: .infinity, minHeight: 38, alignment: .leading)
+          .padding(.top, 12)
+
+        if !settings.recentServers.isEmpty {
+          VStack(alignment: .leading, spacing: 8) {
+            Text("Recent servers")
+              .font(.system(size: 13, weight: .medium))
+              .foregroundStyle(DesignTokens.mutedForeground(colorScheme))
+
+            ForEach(settings.recentServers, id: \.self) { recent in
+              Button {
+                serverURL = recent
+                connect()
+              } label: {
+                Text(recent)
+                  .font(.system(size: 14))
+                  .lineLimit(1)
+                  .truncationMode(.middle)
+                  .frame(maxWidth: .infinity, alignment: .leading)
+                  .padding(.horizontal, 12)
+                  .frame(height: 36)
+                  .overlay {
+                    RoundedRectangle(cornerRadius: DesignTokens.radius)
+                      .stroke(DesignTokens.border(colorScheme), lineWidth: 1)
+                  }
+              }
+              .buttonStyle(.plain)
+              .foregroundStyle(DesignTokens.foreground(colorScheme))
+            }
+          }
+          .padding(.top, 12)
+          .disabled(isConnecting)
+        }
+      }
+      .frame(maxWidth: 384)
+
+      Spacer(minLength: 24)
+    }
+    .padding(.horizontal, 16)
+    .frame(maxWidth: .infinity, maxHeight: .infinity)
+    .background(DesignTokens.background(colorScheme))
+  }
+
+  private var primary: Color {
+    colorScheme == .dark ? DesignTokens.darkForeground : DesignTokens.lightForeground
+  }
+
+  private var primaryForeground: Color {
+    colorScheme == .dark ? DesignTokens.lightForeground : .white
+  }
+
+  private func connect() {
+    guard !isConnecting else { return }
+    isConnecting = true
+    message = nil
+
+    Task {
+      do {
+        let normalized = try ServerURL.normalize(serverURL, allowsInsecureHTTP: allowsInsecureHTTP)
+        let expanded = await WorkspaceURLExpander.expandIfNeeded(normalized)
+        await MainActor.run {
+          isConnecting = false
+          onConnect(expanded)
+        }
+      } catch {
+        await MainActor.run {
+          isConnecting = false
+          message = (error as? LocalizedError)?.errorDescription ?? String(describing: error)
+        }
+      }
+    }
+  }
+}
+
+// Primary (filled) button appearance plus an instant touch-down response.
+// `.buttonStyle(.plain)` gave no press feedback, so the tap felt dead until
+// the spinner swapped in; the opacity/scale here acknowledges the press the
+// moment the finger lands.
+private struct PrimaryButtonStyle: ButtonStyle {
+  let background: Color
+  let foreground: Color
+
+  func makeBody(configuration: Configuration) -> some View {
+    configuration.label
+      .font(.system(size: 14, weight: .medium))
+      .frame(maxWidth: .infinity)
+      .frame(height: 38)
+      .background(background)
+      .foregroundStyle(foreground)
+      .clipShape(RoundedRectangle(cornerRadius: DesignTokens.radius))
+      .opacity(configuration.isPressed ? 0.85 : 1)
+      .scaleEffect(configuration.isPressed ? 0.98 : 1)
+      .animation(.easeOut(duration: 0.12), value: configuration.isPressed)
+  }
+}
+
+private let defaultServerURL: String = {
+  #if DEBUG
+    "http://localhost:6767"
+  #else
+    "https://"
+  #endif
+}()
+
+private let allowsInsecureHTTP: Bool = {
+  #if DEBUG
+    true
+  #else
+    false
+  #endif
+}()

ap-web/ios/Omnigent/DesignTokens.swift

@@ -0,0 +1,31 @@
+import SwiftUI
+
+enum DesignTokens {
+  static let radius: CGFloat = 8
+
+  static let lightBackground = Color.white
+  static let lightForeground = Color(red: 0.067, green: 0.090, blue: 0.110)
+  static let lightMutedForeground = Color(red: 0.435, green: 0.435, blue: 0.435)
+  static let lightBorder = Color(red: 0.910, green: 0.925, blue: 0.941)
+
+  static let darkBackground = Color(red: 0.118, green: 0.098, blue: 0.153)
+  static let darkForeground = Color(red: 0.910, green: 0.925, blue: 0.941)
+  static let darkMutedForeground = Color(red: 0.572, green: 0.643, blue: 0.702)
+  static let darkBorder = Color(red: 0.215, green: 0.219, blue: 0.230)
+
+  static func background(_ scheme: ColorScheme) -> Color {
+    scheme == .dark ? darkBackground : lightBackground
+  }
+
+  static func foreground(_ scheme: ColorScheme) -> Color {
+    scheme == .dark ? darkForeground : lightForeground
+  }
+
+  static func mutedForeground(_ scheme: ColorScheme) -> Color {
+    scheme == .dark ? darkMutedForeground : lightMutedForeground
+  }
+
+  static func border(_ scheme: ColorScheme) -> Color {
+    scheme == .dark ? darkBorder : lightBorder
+  }
+}

ap-web/ios/Omnigent/Info-Debug.plist

@@ -0,0 +1,52 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+	<key>CFBundleDevelopmentRegion</key>
+	<string>$(DEVELOPMENT_LANGUAGE)</string>
+	<key>CFBundleDisplayName</key>
+	<string>Omnigent</string>
+	<key>CFBundleExecutable</key>
+	<string>$(EXECUTABLE_NAME)</string>
+	<key>CFBundleIdentifier</key>
+	<string>$(PRODUCT_BUNDLE_IDENTIFIER)</string>
+	<key>CFBundleInfoDictionaryVersion</key>
+	<string>6.0</string>
+	<key>CFBundleName</key>
+	<string>$(PRODUCT_NAME)</string>
+	<key>CFBundlePackageType</key>
+	<string>$(PRODUCT_BUNDLE_PACKAGE_TYPE)</string>
+	<key>CFBundleShortVersionString</key>
+	<string>$(MARKETING_VERSION)</string>
+	<key>CFBundleVersion</key>
+	<string>$(CURRENT_PROJECT_VERSION)</string>
+	<key>ITSAppUsesNonExemptEncryption</key>
+	<false/>
+	<key>LSRequiresIPhoneOS</key>
+	<true/>
+	<key>NSAppTransportSecurity</key>
+	<dict>
+		<key>NSAllowsArbitraryLoadsInWebContent</key>
+		<true/>
+	</dict>
+	<key>NSMicrophoneUsageDescription</key>
+	<string>Omnigent uses the microphone for voice dictation in the message composer.</string>
+	<key>UIApplicationSupportsIndirectInputEvents</key>
+	<true/>
+	<key>UILaunchScreen</key>
+	<dict/>
+	<key>UISupportedInterfaceOrientations</key>
+	<array>
+		<string>UIInterfaceOrientationPortrait</string>
+		<string>UIInterfaceOrientationLandscapeLeft</string>
+		<string>UIInterfaceOrientationLandscapeRight</string>
+	</array>
+	<key>UISupportedInterfaceOrientations~ipad</key>
+	<array>
+		<string>UIInterfaceOrientationPortrait</string>
+		<string>UIInterfaceOrientationPortraitUpsideDown</string>
+		<string>UIInterfaceOrientationLandscapeLeft</string>
+		<string>UIInterfaceOrientationLandscapeRight</string>
+	</array>
+</dict>
+</plist>