release: promote dev to master for v1.0.0-beta.45

.claude/skills/taos-development-skill/SKILL.md

@@ -180,6 +180,25 @@ I have read the CLA Document and I hereby sign the CLA
 3. Once code is done and local tests pass, `gh pr ready`. Address review feedback with additional
    commits on the same branch. The maintainer merges upstream.
 
+### Do not spend turns waiting
+
+You pay per turn. Spend them on judgement (reading a diff, diagnosing a failure,
+deciding whether a green check is trustworthy), not on waiting or repetition.
+
+- **Do not poll CI in a loop.** `gh pr checks <PR#> --watch` blocks in one call
+  and returns when the run finishes. Re-running `gh pr checks` every minute
+  costs a turn each time and tells you nothing new. (A malformed watch once
+  exited early and reported success while shards were still running, so read
+  the final status rather than trusting that the command returned.)
+- **If you have hand-verified the same property twice, write the test.** Two
+  manual checks is the signal. A test costs nothing per run; re-reading costs
+  every time.
+- **Ask the narrow question.** A targeted `grep` or a symbol-level diff against
+  `origin/dev` usually decides the matter far more cheaply than reading a whole
+  diff. Work out what single fact settles it, then fetch only that.
+- **Do not re-poll a blocked run.** See `action_required` above: surface it and
+  stop. Repeatedly checking a run that is waiting on a human is pure cost.
+
 ## Post-Push Bot Review Cycle
 
 After pushing a PR and marking it ready, automated bots review it. The reliable gate is
@@ -429,6 +448,32 @@ Run `scripts/install-git-hooks.sh` to enable local hooks (`.githooks/pre-commit`
   are available. Most modules use `from __future__ import annotations`.
 - Code style: match surrounding code, one concern per module
 - Use `uv` for dependency management and test running: `uv sync --extra dev`, `uv run pytest`
+- **Read `CONTRIBUTING.md` sections "Verifying your work" and "Avoiding collisions with
+  other contributors".** They are the canonical statement of both; this file does not
+  restate them so the two cannot drift. What follows is only the part specific to
+  working here as an agent.
+
+## Verification (agent specifics)
+
+Green is a claim, not evidence. The repo-level cases are in CONTRIBUTING.md. These are
+the ones that bite agents in particular:
+
+- **Do not report work as done without a PR link.** A branch with commits and no PR is
+  not delivered. A lane once announced completion on an empty branch; the check now runs
+  before any completion is claimed, and the same standard applies to you.
+- **A PR that passes CI can still be empty.** Before saying a card is finished, look at
+  the actual diff and confirm it contains the change described.
+- **Never infer merge conflicts from `git merge-tree`** against branches you have not
+  fetched; it produces confident nonsense. Use GitHub's `mergeable_state`, and treat
+  `unknown` as "not computed yet" and re-query rather than as an answer.
+- **Check the exit status of the command that matters**, not the last one in a pipe.
+  `cmd | tail && echo OK` prints OK when `cmd` failed.
+- **An empty fetch is not a match.** If two files that cannot be identical hash the same,
+  your request failed rather than the contents agreeing.
+- **Verify a bot finding against the code before folding it.** Automated review is often
+  wrong and always confident. Fold what is real, say plainly what is not.
+- **Report honestly.** If tests fail, include the output. If a step was skipped, name it.
+  "Done" means verified.
 
 ## Desktop SPA build + test
 

.coderabbit.yaml

@@ -9,3 +9,28 @@ reviews:
     base_branches:
       - master
       - dev
+    # The plan has a finite review quota, and it was being spent in the wrong
+    # places: repeatedly "review limit reached" on real code PRs while lockfile
+    # bumps consumed reviews. #2127 and #2131 both went unreviewed for this
+    # reason on the day this was written.
+    #
+    # Dependabot PRs are version bumps plus a regenerated lockfile. There is no
+    # human-authored logic for a reviewer to reason about, and CI already gates
+    # them, so they are the cheapest thing to stop spending quota on.
+    ignore_usernames:
+      - dependabot
+      - dependabot[bot]
+    # A draft is explicitly not ready. Reviewing it burns a review that will be
+    # burned again when it is marked ready.
+    drafts: false
+  # Generated artefacts dominate the diff without carrying reviewable intent.
+  # A single spa-deps bump is a 2000+ line package-lock diff.
+  path_filters:
+    - "!**/package-lock.json"
+    - "!**/uv.lock"
+    - "!desktop/dist/**"
+    # Only the BUILT desktop bundle under static/, not all of static/: sw.js and
+    # the PWA manifests there are human-authored runtime behaviour and exactly
+    # the kind of change a reviewer should see (Qodo caught the over-broad
+    # original).
+    - "!static/desktop/**"

.github/workflows/ci.yml

@@ -34,7 +34,15 @@ jobs:
   # run at once instead of queueing behind the 2 self-hosted boxes. The VPS +
   # Fedora runners stay free for the kilo lane and GPU/bench work.
 
-  test:
+  # Renamed from "test" to "shards" because sharding changes the check-run names
+  # this job reports. Branch protection matches required checks by NAME, so the
+  # sharded jobs report "test (3.12, 1)" etc and the required contexts
+  # "test (3.12)" / "test (3.13)" would never be reported again. Protection then
+  # waits forever on checks that cannot exist and blocks every PR, including the
+  # one that would fix it. The aggregate "test" job below keeps reporting those
+  # two exact names, so no protection change is needed and there is no window
+  # where dev is wedged.
+  shards:
     runs-on: ubuntu-latest
     # Measured 2026-07-26 over the last 12 job records: 3.13 runs 31-35 min and
     # 3.12 runs 38-41 min. The previous comment claimed "~16 min", which had
@@ -55,6 +63,15 @@ jobs:
         # PR + push runs cover the latest two; the daily cron run
         # below adds 3.11 so the minimum-supported version stays tested.
         python-version: ${{ github.event_name == 'schedule' && fromJSON('["3.11", "3.12", "3.13"]') || fromJSON('["3.12", "3.13"]') }}
+        # Shard the suite across parallel jobs. xdist parallelises WITHIN a job,
+        # but a hosted runner is 2 vCPU, so -n auto caps at 2 workers however
+        # many tests exist -- and the suite has grown 4845 -> 10250 (#2135).
+        # Cores per job were the bottleneck, not the tests.
+        #
+        # A public repo gets ~20 concurrent jobs free and we were using 2, so
+        # this costs nothing. 2 versions x 4 shards = 8 jobs on PR/push, and
+        # 12 on the scheduled run that adds 3.11.
+        shard: [1, 2, 3, 4]
 
     steps:
       - uses: actions/checkout@v7
@@ -78,20 +95,63 @@ jobs:
       # not from a fresh unpinned resolve that can pull in a regressed
       # release (see the fastapi 0.137 incident, #903).
       - name: Install dependencies
-        run: uv sync --frozen --extra dev --python ${{ matrix.python-version }}
+        run: uv sync --frozen --python ${{ matrix.python-version }}
 
       # SPA bundle is stubbed by tests/conftest.py — see pytest_configure.
       # The real build is exercised in the spa-build job below.
 
-      - name: Run tests
-        # Run across all runner cores. The serial suite (4845 tests) took
-        # ~22 min; -n auto cuts it to a few minutes so "merge on green" is
-        # practical. Dropped -v so xdist worker output stays readable.
-        run: uv run --no-sync pytest tests/ --tb=short --ignore=tests/e2e -n auto
-
+      - name: Run tests (shard ${{ matrix.shard }}/4)
+        # --splits/--group partition the suite deterministically and exactly:
+        # verified that the 4 groups union to all 10250 collected tests with no
+        # duplicates and, critically, no drops. A sharding bug that silently
+        # skipped tests would leave CI green while testing less, which is the
+        # one failure mode worth checking rather than assuming.
+        #
+        # -n auto still uses both cores inside each shard.
+        run: >-
+          uv run --no-sync pytest tests/ --tb=short --ignore=tests/e2e
+          -n auto --splits 4 --group ${{ matrix.shard }}
+
+      # Import smoke check: identical in every shard, so run it once per Python
+      # version (shard 1 only) rather than in all 4 shards.
       - name: Verify app starts
+        if: matrix.shard == 1
         run: uv run --no-sync python -c "from tinyagentos.app import create_app; print('OK')"
 
+  # Aggregate gate. Reports the exact check names branch protection requires
+  # ("test (3.12)", "test (3.13)") so the required-context list does not have to
+  # change when the shard count does. An explicit `name:` is used verbatim by
+  # GitHub rather than having the matrix values appended, which is what makes
+  # reproducing the old names possible at all.
+  #
+  # `if: always()` is load-bearing. Without it this job is SKIPPED when the
+  # shards fail, and GitHub treats a skipped required check as satisfied -- so a
+  # red suite would report a green gate. It must run and fail explicitly.
+  test:
+    name: test (${{ matrix.python-version }})
+    needs: shards
+    if: always()
+    runs-on: ubuntu-latest
+    strategy:
+      # Both gates must report their own conclusion. With the default
+      # fail-fast, the first gate to fail CANCELS its sibling, so a red suite
+      # reported "test (3.12) failure, test (3.13) cancelled" -- observed on a
+      # deliberate-failure branch. Cancelled is not success so protection still
+      # blocks, but which version broke becomes a coin flip, and a required
+      # check whose conclusion depends on scheduling order is not a gate worth
+      # trusting.
+      fail-fast: false
+      matrix:
+        python-version: ["3.12", "3.13"]
+    steps:
+      - name: Gate on shard results
+        run: |
+          echo "shards concluded: ${{ needs.shards.result }}"
+          if [ "${{ needs.shards.result }}" != "success" ]; then
+            echo "::error::test shards did not all pass"
+            exit 1
+          fi
+
   lint:
     runs-on: ubuntu-latest
     steps:
@@ -108,7 +168,7 @@ jobs:
           enable-cache: true
 
       - name: Install dependencies
-        run: uv sync --frozen --extra dev --python 3.12
+        run: uv sync --frozen --python 3.12
 
       - name: Check for syntax errors
         run: uv run --no-sync python -m compileall tinyagentos/ -q

.github/workflows/deleted-symbols-gate.yml

@@ -0,0 +1,41 @@
+name: Deleted symbols gate
+
+# Detects PRs that silently delete Python symbols (def/class/test names) that
+# landed on the target branch after the PR's merge base. A PR cut before
+# hardening commits landed on dev would silently delete them when merged --
+# git reports "Automatic merge went well" with no conflict because the PR
+# branch simply wins on files dev touched after the branch point.
+#
+# This check fails such PRs and names the deleted symbols and the commits that
+# added them. A "Removes-Intentionally: <symbol>" trailer in the PR body
+# waives named symbols, making deliberate deletions a conscious, auditable act.
+#
+# See scripts/check_deleted_symbols.py for the implementation.
+
+on:
+  pull_request:
+    branches: [master, dev]
+
+jobs:
+  deleted-symbols-gate:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    env:
+      BASE_REF: ${{ github.base_ref }}
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+
+      - uses: actions/setup-python@v7
+        with:
+          python-version: "3.12"
+
+      - name: Fetch base branch
+        run: git fetch origin "$BASE_REF"
+
+      - name: Check for silently deleted symbols
+        env:
+          PR_BODY: ${{ github.event.pull_request.body }}
+        run: python scripts/check_deleted_symbols.py --base "origin/$BASE_REF"

.github/workflows/doc-gate.yml

@@ -34,6 +34,9 @@ jobs:
       - name: Schema-migration guard (#1865)
         run: python scripts/check_schema_migrations.py
 
+      - name: Retrofit-migration guard (#2188)
+        run: python scripts/check_retrofit_migrations.py
+
       - name: Diff gate (Layer B)
         env:
           BASE_REF: ${{ github.base_ref }}

.github/workflows/security.yml

@@ -3,11 +3,27 @@ name: Security
 on:
   push:
     branches: [master]
+  # dev is where work actually lands: every exec PR targets dev, and master only
+  # receives it later at a release promotion. Auditing master-only meant the
+  # dependency audit NEVER ran on a pull request, so a vulnerable dependency
+  # could merge into dev and ship in a beta without anything looking at it. The
+  # weekly cron still covers master, but that is after the fact and on the wrong
+  # branch. Verified clean on dev before enabling: pip-audit reports no known
+  # vulnerabilities, so this does not block the open queue.
   pull_request:
-    branches: [master]
+    branches: [master, dev]
   schedule:
     - cron: "0 6 * * 1"
 
+# Mirror ci.yml: this now runs on every dev PR update, so superseded runs must
+# cancel or each push leaves an orphaned audit burning runner minutes. Pushes to
+# master and dev are deliberately NOT cancelled, so the branch record stays
+# complete. (qodo on #2189, verified: ci.yml carries this block and security.yml
+# did not, which only started to matter once the dev trigger was added.)
+concurrency:
+  group: security-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.ref != 'refs/heads/master' && github.ref != 'refs/heads/dev' }}
+
 permissions:
   contents: read
 

.gitignore

@@ -92,6 +92,9 @@ screenshots.zip
 data/.auth_user.json
 data/browser_cookie_key.hex
 
+# Hub identity — runtime state, never track (contains generated keypairs)
+data/hub/
+
 # Vite/TS incremental build artifact — regenerated on every build, must not be tracked
 # (a tracked copy dirties the tree and blocks the in-app git-pull update).
 desktop/tsconfig.tsbuildinfo
@@ -128,3 +131,48 @@ data/pending-restart.json
 # Stray dev screenshot artifacts
 desktop-initial.png
 venv/
+
+# Credential material must never be committable. An agent stored a registry
+# token at /opt/taos/secrets/ on 2026-07-27 - correct permissions, but inside the
+# deployed git checkout and one "git add -A" away from a public repo.
+secrets/
+*.token
+*.cred
+
+# Credential material under data/. On 2026-07-27 three of these sat UNTRACKED in
+# the deployed checkout - one 'git add -A' from a public repo. Never committed
+# (verified against full history), but untracked is not the same as safe.
+#
+# Deliberately NOT using 'data/*' deny-all: data/archive, data/sessions and
+# data/guides.yaml are legitimately tracked, and a blanket rule would silently
+# ignore NEW files there - trading a credential risk for a data-loss-by-
+# invisibility one. Enumerate the secrets instead, and keep this list current.
+data/.secrets_key
+data/.seeded-agent-tokens.json
+data/secrets.db*
+data/*.key
+data/*.token
+
+# Key material and secrets. Added 2026-07-27 after data/hub/identity.json was
+# committed to PR #2043 with signing_private and encryption_private in
+# PLAINTEXT. data/hub/ is already covered above; these patterns close the REST
+# of the surface, which was open: an identity.json or a *.key written anywhere
+# outside data/hub/ had nothing stopping it. Pattern-based on purpose, since a
+# per-file allowlist cannot catch a file that does not exist yet.
+# Verified against every tracked file: none become ignored.
+*.key
+*_private.pem
+*_private.key
+*_private.json
+*_private_key*
+identity.json
+*.p8
+*credentials.json
+
+# Credential bundles. Added 2026-07-27: @taOS-website-dev ran the same audit
+# on its repo and found shapes my first pass (PR #2171) missed. Verified on
+# origin/dev: creds.json, my_creds.json and data/creds.json were all NOT
+# ignored, while *credentials.json already was. Matching the *creds* stem
+# closes the shorter spelling, which is the one people actually type.
+# Verified against every tracked file on origin/dev: 0 become ignored.
+*creds*.json