feat(core)!: adopt Core v4.0.0 (numbered-fragment loader) on the defense role layer

[Gerrrt]

What & why

Adopts Core v4.0.0 (eeaec5045505) on the defensive (blue) role layer. Supersedes the automated sync PR #85: it vendors the same released Core and carries the role-layer adaptation v4's breaking loader contract requires.

Core v4 replaces the named-module chain with numbered NN-name.zsh fragments that the vendored loader globs and sorts by prefix — and it ignores the old _CORE_MODULES array. A role layer that links its stage unnumbered would silently stop loading.

Changes

Vendored Core (git subtree merge of the released sync branch)

• core/ → v4.0.0, core.lock pinned to eeaec5045505.

Defense role-layer adaptation (bootstrap.sh)

• Link the defense stage as the numbered fragment 85-defense.zsh (role band 85–94) instead of the unnumbered defense.zsh the v4 loader would never glob. It sorts after the OS layer (80-os.zsh, from the OS-native repo this stacks on) and before host-local (99-local.zsh) — preserving the old os → defense → local order. Verified hermetically: load order resolves … 80-os 85-defense 99-local. Stale pre-v4 defense.zsh links are dropped on re-bootstrap.
• Rewrite the managed .zshrc to the v4 loader: drop the _CORE_MODULES list (the numbering is the load order now), bump the marker to dotfiles-managed v4, and point local tweaks at 99-local.zsh.

CI

• Bump the four reusable-workflow callers @v3 → @v4 (interfaces unchanged across the major).

Is it actually Core?

No Core edits — core/ is vendored read-only. All hand edits are role-layer (bootstrap.sh + CI callers).

Checks (local)

• bash -n + shellcheck bootstrap.sh → clean.
• Hermetic loader-order probe → 00-tools 10-options 80-os 85-defense 99-local (defense stage correctly banded).
• actionlint on the four bumped workflows → clean.
• shfmt / markdownlint absent locally; CI runs them via the @v4 lint caller.

Migration note

BREAKING CHANGE: shells re-run ./bootstrap.sh to relink the defense stage as 85-defense.zsh and regenerate the v4 .zshrc. Core migration (history relocation, stale unnumbered symlink cleanup) is handled by the OS-native layer's bootstrap this role stacks on.

Closes #85 (superseded by this branch).

---

Generated by Claude Code

[Copilot]

Pull request overview

This PR updates dotfiles-Defense to dotfiles-core v4.0.0 and adapts the defense role layer to Core v4’s numbered NN-*.zsh fragment loader contract, ensuring the defense stage continues to load in the intended os → defense → local order. It also bumps the repo’s reusable-workflow callers from @v3 to @v4.

Changes:

• Vendor Core v4.0.0 (including the new numbered-fragment loader + renames across Core zsh modules/docs/scripts).
• Update bootstrap.sh to link the defense role stage as 85-defense.zsh and generate a v4-managed .zshrc that sources the v4 loader.
• Update CI workflow callers to use the dotfiles-core reusable workflows at @v4.

Reviewed changes

Copilot reviewed 94 out of 104 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
core/zsh/loader.zsh	Switch to v4 numbered-fragment glob+sort loader with profile gating + compilation.
core/zsh/55-maint.zsh	Add maintenance scheduler control-surface fragment (v4 numbering).
core/zsh/50-op.zsh	Add 1Password CLI helper fragment (v4 numbering).
core/zsh/45-plugins.zsh	Move plugins dir to XDG data + update plugin pins and loader paths.
core/zsh/40-bindings.zsh	Add vi-mode bindings fragment (v4 numbering).
core/zsh/35-fzf.zsh	Add fzf config + widgets fragment (v4 numbering).
core/zsh/30-functions.zsh	Update core update dispatch to handle profile-gated updater availability.
core/zsh/25-git.zsh	Add curated git aliases + helpers fragment (v4 numbering).
core/zsh/20-aliases.zsh	Add modern CLI aliases fragment (v4 numbering).
core/zsh/15-history.zsh	Move zsh history to XDG state path for v4 layout.
core/zsh/10-options.zsh	Move compdump to XDG cache for v4 layout.
core/zsh/00-tools.zsh	Add tool detection + cached init generation as the first fragment.
core/SECURITY.md	Update docs to reflect v4 local override filename (99-local).
core/scripts/update-plugins.sh	Update plugin-pin updater to use v4 file paths.
core/scripts/setup.sh	Update docs reference for UI helper path (05-ui).
core/scripts/parity-check.sh	Update parity checks to v4 zsh file paths and updated core dispatch.
core/scripts/parity-aliases.txt	Update docs reference for aliases file path (20-aliases).
core/scripts/new-os-repo.sh	Update scaffolded zshrc + OS symlink naming for v4 loader + 80-os.
core/scripts/lib/common.sh	Update docs reference for UI helper path (05-ui).
core/scripts/freshness-dashboard.sh	Update plugin pins path reference for freshness reporting.
core/scripts/bench-core.sh	Update benchmarking harness to drive the real v4 loader + XDG_DATA_HOME.
core/scripts/audit-core.sh	Update audit gates/allowlists and file-path references for v4 layout.
core/PORTING-MATRIX.md	Update docs references for v4 zsh module filenames.
core/PARITY.md	Update docs references for v4 zsh module filenames.
core/nvim/lua/gerrrt/utils/ui-highlights.lua	Add DAP highlight groups for breakpoint/stopped line styling.
core/nvim/lua/gerrrt/utils/lsp.lua	Remove with_snippets, adjust keymap deletion strategy, add CodeLens map.
core/nvim/lua/gerrrt/servers/yamlls.lua	Convert to table-return config + defer schemastore schema injection.
core/nvim/lua/gerrrt/servers/vue_ls.lua	Convert to table-return config (native vim.lsp.config style).
core/nvim/lua/gerrrt/servers/ty.lua	Convert to table-return config (native vim.lsp.config style).
core/nvim/lua/gerrrt/servers/ts_ls.lua	Convert to table-return config and preserve Vue hybrid plugin wiring.
core/nvim/lua/gerrrt/servers/taplo.lua	Convert to table-return config with correct root_markers semantics.
core/nvim/lua/gerrrt/servers/tailwindcss.lua	Convert to table-return config (native root_markers).
core/nvim/lua/gerrrt/servers/svelte.lua	Convert to table-return config (native root_markers).
core/nvim/lua/gerrrt/servers/solidity_ls_nomicfoundation.lua	Convert to table-return config (native root_markers).
core/nvim/lua/gerrrt/servers/ruff.lua	Convert to table-return config.
core/nvim/lua/gerrrt/servers/marksman.lua	Convert to table-return config.
core/nvim/lua/gerrrt/servers/lua_ls.lua	Convert to table-return config and keep lazydev-driven setup.
core/nvim/lua/gerrrt/servers/jsonls.lua	Convert to table-return config + defer schemastore schema injection.
core/nvim/lua/gerrrt/servers/init.lua	Centralize server list, wildcard capabilities, robust enable gating.
core/nvim/lua/gerrrt/servers/html.lua	Switch snippetSupport to leaf override under wildcard capabilities.
core/nvim/lua/gerrrt/servers/gopls.lua	Convert to table-return config.
core/nvim/lua/gerrrt/servers/emmet_ls.lua	Convert to table-return config.
core/nvim/lua/gerrrt/servers/dockerls.lua	Convert to table-return config with native root_markers.
core/nvim/lua/gerrrt/servers/cssls.lua	Convert to table-return config + snippetSupport leaf override.
core/nvim/lua/gerrrt/servers/clangd.lua	Convert to table-return config.
core/nvim/lua/gerrrt/servers/bashls.lua	Convert to table-return config and keep shellcheckPath disabling.
core/nvim/lua/gerrrt/plugins/which-key.lua	Add missing group prefixes (debug, rename/config, organize, path).
core/nvim/lua/gerrrt/plugins/treesitter-context.lua	Remove ineffective separator = nil assignment and clarify behavior.
core/nvim/lua/gerrrt/plugins/todo-comments.lua	Shift lazy trigger to User FilePost with rationale.
core/nvim/lua/gerrrt/plugins/rustaceanvim.lua	Prevent DAP autoload on Rust file open; add explicit Rust debug entry map.
core/nvim/lua/gerrrt/plugins/nvim-treesitter.lua	Cache installed parsers as a set; invalidate on TSUpdate events.
core/nvim/lua/gerrrt/plugins/nvim-tree.lua	Update legacy adaptive_size to current view.width = {} config.
core/nvim/lua/gerrrt/plugins/nvim-lspconfig.lua	Move load to User FilePost; declare blink.cmp dependency honestly.
core/nvim/lua/gerrrt/plugins/nvim-lint.lua	Move load to User FilePost with rationale.
core/nvim/lua/gerrrt/plugins/nvim-dap.lua	Add nvim-dap + dap-python plugin spec, keys, signs, and python setup logic.
core/nvim/lua/gerrrt/plugins/mini-nvim.lua	Remove dependency-induced eager treesitter load; fix mini.surround gsn mapping.
core/nvim/lua/gerrrt/plugins/mason-tool-installer.lua	Clarify FilePost timing and explicitly avoid debugpy in ensure_installed.
core/nvim/lua/gerrrt/plugins/lualine-nvim.lua	Fix buffer context under globalstatus; add Python venv display and width-gating.
core/nvim/lua/gerrrt/plugins/harpoon.lua	Guard against adding unnamed buffers to harpoon list.
core/nvim/lua/gerrrt/plugins/gitsigns-nvim.lua	Fix visual-mode stage/reset by passing explicit range; move to FilePost.
core/nvim/lua/gerrrt/plugins/fidget-nvim.lua	Correct winblend comment/setting to match plugin defaults.
core/nvim/lua/gerrrt/plugins/conform.lua	Remove redundant config wrapper (defaults already handle opts).
core/nvim/lua/gerrrt/plugins/bufferline-nvim.lua	Remove unreachable hover reveal close icon setting (show_buffer_close_icons=false).
core/nvim/lua/gerrrt/plugins/blink-cmp.lua	Clarify snippet engine behavior under luasnip preset.
core/nvim/lua/gerrrt/config/providers.lua	Disable node/python providers to eliminate checkhealth noise (per config constraints).
core/nvim/lua/gerrrt/config/options.lua	Remove showmatch; simplify undo dir setup; relocate mouse maps note.
core/nvim/lua/gerrrt/config/lazy.lua	Default specs to lazy; expand runtime disabled_plugins with rationale.
core/nvim/lua/gerrrt/config/keymaps.lua	Move mouse drag-disable maps here; switch Ex maps to ; improve copy-path UX.
core/nvim/lua/gerrrt/config/autocmds.lua	Implement User FilePost event and version-gate yank highlight helper.
core/nvim/lua/gerrrt/cheatsheet.lua	Expand cheatsheet scope and include new/previously-missing bindings.
core/nvim/lazy-lock.json	Update Neovim plugin lockfile (adds dap, bumps treesitter/schemastore, etc.).
core/mise/config.toml	Update docs path for local zsh overrides under v4.
core/Makefile	Update plugin-update target description for v4 plugins filename.
core/maint/dotfiles-maint.sh	Update v4 plugin dir path, plugins.zsh filename, and compdump location handling.
core/lib/ux.sh	Update references from ui.zsh → 05-ui.zsh in comments.
core/lib/bootstrap-lib.sh	Add v4 migration + v4 zshrc writer + update OS-layer symlink naming.
core/lazygit/config.yml	Update docs references for fzf + aliases filenames under v4.
core/jujutsu/config.toml	Update docs reference for aliases file under v4.
core/core.version	Bump Core semantic version marker to 4.0.0.
core/core.manifest	Update manifest to v4 numbered-fragment files and ordering contract.
core/ARCHITECTURE.md	Update architecture docs to reflect v4 numbered load order and bands.
core/aliases.md	Update alias source paths and load-order references to v4 filenames.
core/.pre-commit-config.yaml	Update docs reference for op helper path under v4.
core/.gitignore	Update ignored local zsh override filename to 99-local.zsh.
core/.github/workflows/freshness.yml	Update pinned zsh plugin file path for automation.
core/.github/workflows/bootstrap-test.yml	Update reusable workflow guidance + v4 symlink and zshrc assertions.
core/.github/ISSUE_TEMPLATE/bug_report.md	Update example file paths for v4 zsh filenames.
core/.claude/commands/tool-scout.md	Update referenced filenames for v4 tooling docs.
core/.claude/commands/freshness-triage.md	Update referenced filenames for v4 freshness docs.
core/.claude/commands/doc-audit.md	Update referenced filenames for v4 doc-audit guidance.
core/.claude/agents/tool-scout.md	Update referenced filenames for v4 agent guidance.
core/.claude/agents/doc-consistency.md	Update referenced filenames for v4 agent guidance.
core/.bin/sync-upstream.sh	Update docs reference for aliases file under v4.
core.lock	Pin vendored Core provenance to v4.0.0 tag + SHA.
bootstrap.sh	Link defense stage as 85-defense.zsh and generate v4-managed .zshrc loader stub.
.github/workflows/notify-web.yml	Bump reusable workflow reference to dotfiles-core @v4.
.github/workflows/lint.yml	Bump reusable workflow reference to dotfiles-core @v4.
.github/workflows/core-integrity.yml	Bump reusable workflow reference to dotfiles-core @v4.
.github/workflows/auto-tag.yml	Bump reusable workflow reference to dotfiles-core @v4.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Gerrrt]

Fair doc nit — the header should note that CORE_PROFILE is resolved and left in scope on purpose (so subshells/the user can read the active profile), not that only the _cl_* scratch vars persist. But core/ is a vendored git subtree copy of dotfiles-core and is read-only here (the guard / integrity check enforces it byte-for-byte against the released commit), so it can't be edited in this PR — it would fail CI and be overwritten on the next sync. Tracking it upstream alongside the read -r CORE_PROFILE _ < robustness tweak for a Core v4.0.1 doc/hardening pass; both fan out here on the next sync. Not blocking.

---

Generated by Claude Code