V2.0

.gitattributes

@@ -0,0 +1 @@
+* text=auto eol=lf

.github/workflows/ci.yml

@@ -4,16 +4,18 @@ on:
   push:
     branches:
       - main
-      - master
   pull_request:
 
 permissions:
   contents: read
 
+env:
+  HUSKY: '0'
+
 jobs:
   tauri-windows:
     name: Tauri Windows required gate
-    runs-on: windows-latest
+    runs-on: windows-2022
 
     steps:
       - name: Checkout
@@ -22,14 +24,23 @@ jobs:
       - name: Setup Node 22
         uses: actions/setup-node@v4
         with:
-          node-version: "22.23.0"
+          node-version: '22.23.0'
           cache: npm
           cache-dependency-path: package-lock.json
 
-      - name: Setup Rust 1.96.0 with rustfmt
+      - name: Test release version handling
+        run: node --test scripts/release-version.test.mjs
+
+      - name: Check app version sources
+        id: version
+        shell: bash
+        run: |
+          node --input-type=module -e 'import { verifyVersions } from "./scripts/release-version.mjs"; import { appendFileSync } from "node:fs"; appendFileSync(process.env.GITHUB_OUTPUT, `version=${verifyVersions(process.cwd())}\n`);'
+
+      - name: Setup Rust 1.96.0 with rustfmt and Clippy
         uses: dtolnay/rust-toolchain@1.96.0
         with:
-          components: rustfmt
+          components: rustfmt, clippy
 
       - name: Cache Rust build outputs
         uses: Swatinem/rust-cache@v2
@@ -39,45 +50,44 @@ jobs:
       - name: Install frontend dependencies
         run: npm ci
 
-      - name: Run frontend tests
-        run: npm test
+      - name: Check frontend format and lint
+        run: npm run check
 
       - name: Build frontend
         run: npm run build
 
       - name: Check Rust formatting
         run: cargo fmt --manifest-path src-tauri/Cargo.toml --all -- --check
 
-      - name: Run Rust tests
-        run: cargo test --manifest-path src-tauri/Cargo.toml -- --nocapture
+      - name: Lint Rust backend
+        run: cargo clippy --manifest-path src-tauri/Cargo.toml --all-targets --locked -- -D warnings
 
-      - name: Assert product config, security, identity, removed scope, and CI contract
-        shell: pwsh
-        env:
-          OMO_CHARACTERIZE_NATIVE_GAPS: '1'
-        run: npm test -- --run src/native-gaps.test.ts
+      - name: Run Rust backend tests
+        run: cargo test --manifest-path src-tauri/Cargo.toml --locked
 
       - name: Build Windows Tauri package
-        run: npm run tauri build
+        run: npm run tauri -- build --ci --target x86_64-pc-windows-msvc --bundles nsis -- --locked
 
       - name: Assert exact Windows NSIS artifact
         shell: pwsh
+        env:
+          APP_VERSION: ${{ steps.version.outputs.version }}
         run: |
-          $artifact = 'src-tauri/target/release/bundle/nsis/omo-switch_0.1.0_x64-setup.exe'
+          $artifact = "src-tauri/target/x86_64-pc-windows-msvc/release/bundle/nsis/opencode-mom_$($env:APP_VERSION)_x64-setup.exe"
           if (-not (Test-Path -LiteralPath $artifact -PathType Leaf)) {
             throw "Expected exact NSIS artifact: $artifact"
           }
 
       - name: Upload Windows Tauri evidence
         uses: actions/upload-artifact@v4
         with:
-          name: omo-switch-tauri-windows-0.1.0
-          path: src-tauri/target/release/bundle/nsis/omo-switch_0.1.0_x64-setup.exe
+          name: opencode-mom-tauri-windows-${{ steps.version.outputs.version }}
+          path: src-tauri/target/x86_64-pc-windows-msvc/release/bundle/nsis/opencode-mom_${{ steps.version.outputs.version }}_x64-setup.exe
           if-no-files-found: error
 
   tauri-macos:
     name: Tauri macOS required gate
-    runs-on: macos-latest
+    runs-on: macos-15
 
     steps:
       - name: Checkout
@@ -86,14 +96,22 @@ jobs:
       - name: Setup Node 22
         uses: actions/setup-node@v4
         with:
-          node-version: "22.23.0"
+          node-version: '22.23.0'
           cache: npm
           cache-dependency-path: package-lock.json
 
-      - name: Setup Rust 1.96.0 with rustfmt
+      - name: Test release version handling
+        run: node --test scripts/release-version.test.mjs
+
+      - name: Check app version sources
+        id: version
+        run: |
+          node --input-type=module -e 'import { verifyVersions } from "./scripts/release-version.mjs"; import { appendFileSync } from "node:fs"; appendFileSync(process.env.GITHUB_OUTPUT, `version=${verifyVersions(process.cwd())}\n`);'
+
+      - name: Setup Rust 1.96.0 with rustfmt and Clippy
         uses: dtolnay/rust-toolchain@1.96.0
         with:
-          components: rustfmt
+          components: rustfmt, clippy
 
       - name: Cache Rust build outputs
         uses: Swatinem/rust-cache@v2
@@ -103,38 +121,88 @@ jobs:
       - name: Install frontend dependencies
         run: npm ci
 
-      - name: Run frontend tests
-        run: npm test
+      - name: Check frontend format and lint
+        run: npm run check
 
       - name: Build frontend
         run: npm run build
 
+      - name: Fetch macOS helper dependencies
+        run: cargo fetch --manifest-path src-tauri/native/macos-helper/Cargo.toml --locked --target aarch64-apple-darwin
+
+      - name: Check macOS helper formatting
+        run: cargo fmt --manifest-path src-tauri/native/macos-helper/Cargo.toml --all -- --check
+
+      - name: Check macOS helper
+        run: cargo check --manifest-path src-tauri/native/macos-helper/Cargo.toml --all-targets --offline --locked
+
+      - name: Test macOS helper
+        run: cargo test --manifest-path src-tauri/native/macos-helper/Cargo.toml --offline --locked
+
+      - name: Lint macOS helper
+        run: cargo clippy --manifest-path src-tauri/native/macos-helper/Cargo.toml --all-targets --offline --locked -- -D warnings
+
       - name: Check Rust formatting
         run: cargo fmt --manifest-path src-tauri/Cargo.toml --all -- --check
 
-      - name: Run Rust tests
-        run: cargo test --manifest-path src-tauri/Cargo.toml -- --nocapture
+      - name: Lint Rust backend
+        run: cargo clippy --manifest-path src-tauri/Cargo.toml --all-targets --locked -- -D warnings
 
-      - name: Assert product config, security, identity, removed scope, and CI contract
-        env:
-          OMO_CHARACTERIZE_NATIVE_GAPS: '1'
-        run: npm test -- --run src/native-gaps.test.ts
+      - name: Run Rust backend tests
+        run: cargo test --manifest-path src-tauri/Cargo.toml --locked
 
       - name: Build macOS Tauri packages
-        run: npm run tauri build
+        run: npm run tauri -- build --ci --target aarch64-apple-darwin --bundles app,dmg -- --locked
 
       - name: Assert exact macOS app and DMG artifacts
         shell: bash
+        env:
+          APP_VERSION: ${{ steps.version.outputs.version }}
         run: |
           set -euo pipefail
-          test -d 'src-tauri/target/release/bundle/macos/omo-switch.app'
-          test -f 'src-tauri/target/release/bundle/dmg/omo-switch_0.1.0_aarch64.dmg'
+          test -d 'src-tauri/target/aarch64-apple-darwin/release/bundle/macos/opencode-mom.app'
+          test -f "src-tauri/target/aarch64-apple-darwin/release/bundle/dmg/opencode-mom_${APP_VERSION}_aarch64.dmg"
 
       - name: Upload macOS Tauri evidence
         uses: actions/upload-artifact@v4
         with:
-          name: omo-switch-tauri-macos-0.1.0
+          name: opencode-mom-tauri-macos-${{ steps.version.outputs.version }}
           path: |
-            src-tauri/target/release/bundle/macos/omo-switch.app
-            src-tauri/target/release/bundle/dmg/omo-switch_0.1.0_aarch64.dmg
+            src-tauri/target/aarch64-apple-darwin/release/bundle/dmg/opencode-mom_${{ steps.version.outputs.version }}_aarch64.dmg
           if-no-files-found: error
+
+  rust-msrv:
+    name: Rust minimum supported versions
+    runs-on: macos-15
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup helper Rust 1.77.2
+        uses: dtolnay/rust-toolchain@1.77.2
+
+      - name: Setup backend Rust 1.90.0
+        uses: dtolnay/rust-toolchain@1.90.0
+
+      - name: Cache Rust build outputs
+        uses: Swatinem/rust-cache@v2
+        with:
+          workspaces: |
+            src-tauri -> target
+            src-tauri/native/macos-helper -> target
+
+      - name: Fetch macOS helper dependencies
+        run: cargo +1.90.0 fetch --manifest-path src-tauri/native/macos-helper/Cargo.toml --locked --target aarch64-apple-darwin
+
+      - name: Fetch macOS helper dependencies for MSRV
+        run: cargo +1.77.2 fetch --manifest-path src-tauri/native/macos-helper/Cargo.toml --locked --target aarch64-apple-darwin
+
+      - name: Check Rust backend MSRV
+        run: cargo +1.90.0 check --manifest-path src-tauri/Cargo.toml --all-targets --locked
+
+      - name: Check macOS helper MSRV
+        run: cargo +1.77.2 check --manifest-path src-tauri/native/macos-helper/Cargo.toml --all-targets --offline --locked
+
+      - name: Test macOS helper MSRV
+        run: cargo +1.77.2 test --manifest-path src-tauri/native/macos-helper/Cargo.toml --offline --locked