chore: certify current production baseline

[OneBigHen]

Phase 00 records the re-audit against the extracted production readiness pack. Local evidence: clean frozen install across 24 workspaces; forced check 115/115 successful with zero cached tasks; Playwright 43 passed and 2 skipped across desktop, iPad, and iPhone profiles; package, collaboration, supply-chain, boundary, dependency, secret, and SBOM gates passed. Current product gaps remain explicitly recorded in the capability matrix and execution ledger. Numbered implementation phases remain uncertified until binding acceptance evidence is implemented and verified.

Summary by CodeRabbit

• New Features
  • Added Source Studio for ingesting and synthesizing content from documents, spreadsheets, presentations, images, audio, and video.
  • Expanded the spatial editor with layers, assets, annotations, camera bookmarks, alignment, isolation, undo/redo, shortcuts, and recovery.
  • Added a local asset library with search and procedural scientific equipment templates.
  • Added companion settings for setup, sign-in, pairing, encrypted secrets, and storage health.
• Improvements
  • Added citations, confidence, provider details, personal release export, full backups, and connection status.
• Security
  • Strengthened session protection, archive validation, approval handling, supply-chain checks, and release trust indicators.

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: e6ad9c53-7b01-4a7d-85d8-66212ccc50fc

📝 Walkthrough

Walkthrough

The PR adds single-user security, canonical guide state, spatial editing, asset management, multimodal ingestion, source-grounded synthesis, unsigned personal releases, companion settings, and blocking CI checks.

Changes

GuideForge production-readiness and authoring

Layer / File(s)	Summary
Single-user policy and blocking CI controls .github/workflows/ci.yml, AGENTS*.md, apps/companion/*, apps/api/src/*, scripts/*, docs/security/*	CI adds PostgreSQL integration tests, blocking audit, license, SBOM, secret, policy, and Playwright checks. The companion adds owner authentication, encrypted secrets, pairing, recovery, session controls, and transport enforcement.
Canonical guide contract and command state packages/guide-schema/*, packages/commands/*, packages/collaboration/*, packages/domain/*	Guide snapshots advance to version 4 with scene, training, sources, step metadata, migrations, semantic comparison, Yjs synchronization, and typed commands.
Multimodal ingestion and source-grounded synthesis packages/ingestion/*, packages/synthesis/*, apps/worker-documents/*, apps/web/src/services/sourceStudio*, apps/web/src/services/sourceSynthesis*	Sources receive deterministic format detection, conversion receipts, stable regions, OCR and media routing, conflict detection, cancellation, grounded synthesis, validation, repair, and pending proposals.
Asset library and package safety packages/assets/*, packages/package-gforge/*, apps/web/src/services/assetLibrary.ts, apps/web/src/services/guideStore.ts	The asset library adds local search, license decisions, procedural GLB generation, attribution reports, archive preflight, safe paths, asset import, and unsigned personal releases.
Canonical scene persistence and spatial editor packages/scene-core/*, apps/web/src/services/sceneStore.ts, apps/web/src/routes/scene.$guideId.tsx	Scene state moves to collaborative working documents. The editor adds layers, asset attachment, annotations, cameras, isolation, alignment and distribution axes, undo/redo, keyboard controls, and WebGL recovery.
Source Studio, proposal provenance, and web integration apps/web/src/routes/sources.$guideId.tsx, apps/web/src/routes/settings.tsx, apps/web/src/components/*, apps/web/src/services/aiProposals.ts, apps/web/src/routeTree.gen.ts	The web app adds Source Studio and settings routes, source upload and preview flows, companion status, synthesis controls, proposal citation and receipt display, encrypted-secret management, and generated route metadata.
API ownership, provenance, and personal releases apps/api/src/*, apps/web/src/routes/edit.$guideId.tsx, apps/xr-web/src/main.tsx, packages/package-gforge/src/release.ts	The API derives owner roles, validates origins and content hashes, applies rate limits, uses stable audit context, and returns proposal provenance. Release flows support unsigned personal packages and XR trust warnings.
Storage migrations, fixtures, documentation, and workspace wiring packages/storage-web/src/index.ts, docs/adr/*, docs/progress/*, package.json, pnpm-workspace.yaml, apps/*/package.json, packages/*/package.json	Storage adds proposal provenance and source records. Reports, ADRs, fixtures, package manifests, dependency catalogs, styles, and test setup record the updated contracts and validation evidence.

Estimated code review effort: 5 (Critical) | ~120 minutes

Sequence Diagram(s)

sequenceDiagram
  participant Author
  participant Companion
  participant SourceStudio
  participant Ingestion
  participant Synthesis
  participant GuideStore
  participant SpatialEditor
  Author->>Companion: configure owner session
  Companion->>Author: return authenticated companion state
  Author->>SourceStudio: upload guide sources
  SourceStudio->>Ingestion: convert bytes and build source regions
  Ingestion->>SourceStudio: return receipts, conflicts, and processing status
  Author->>Synthesis: request procedure synthesis
  Synthesis->>GuideStore: persist citation-grounded pending proposals
  Author->>SpatialEditor: edit canonical scene
  SpatialEditor->>GuideStore: commit scene changes to the working document

Loading

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[OneBigHen]

@claude Please perform an adversarial production-readiness review of this branch before it merges to main (GF3 gate per PLAN_TONIGHT.md).

Scope: all 48+ commits vs main — especially phases 06-17 work that has never had CI until today (now green: check + e2e), plus recent fixes:

• ci.yml: standalone pnpm install + poppler-utils for hosted runners
• nanoid override 3.3.18 (high advisory via postcss)
• prettier formatting batch
• OpenRouter provider routing, runtime receipts, multimodal fallback seams

Key questions:

1. Any data-loss or correctness regressions in the canonical sources model (packages/collaboration) and citation SHA-256 migration?
2. Is the single-owner companion (SQLite, no RBAC surface) consistent and free of leftover enterprise auth paths?
3. Does anything block cutting a release candidate (pnpm release:prepare)?

Flag anything that should block merge to main.