feat: complete local repository intelligence

.codevetter/verify.yaml

@@ -0,0 +1,47 @@
+version: 1
+target:
+  command: [pnpm, --dir, apps/desktop, exec, vite, --host, 127.0.0.1, --port, "1420", --strictPort]
+  cwd: .
+  readinessUrl: http://127.0.0.1:1420/
+  baseUrl: http://127.0.0.1:1420
+  allowedEnv: []
+  hmrSettleMs: 150
+  shutdownGraceMs: 2000
+scenarioModules:
+  - apps/desktop/verify/scenarios.mjs
+authProfiles:
+  local-developer:
+    storageState: apps/desktop/tests/fixtures/warm-verification/auth/local-developer.json
+capabilities:
+  - id: app-shell
+    paths:
+      - apps/desktop/src/App.tsx
+      - apps/desktop/src/main.tsx
+      - apps/desktop/src/components/sidebar.tsx
+      - apps/desktop/src/components/persistent-routes.tsx
+    scenarios: [shell-navigation]
+mandatorySmoke: [shell-navigation]
+sharedInfrastructure:
+  paths:
+    - apps/desktop/src/**
+    - apps/desktop/vite.config.ts
+    - apps/desktop/package.json
+    - package.json
+    - pnpm-lock.yaml
+  fallbackScenarios: [shell-navigation]
+network:
+  firstPartyOrigins: [http://127.0.0.1:1420]
+  allowedFirstPartyRequests: [GET /**]
+  blockThirdParty: true
+  allowedThirdPartyOrigins: []
+retention:
+  directory: .codevetter/verify-artifacts
+  maxRuns: 20
+  maxBytes: 104857600
+  maxAgeDays: 14
+budgets:
+  parallelism: 4
+  actionMs: 3000
+  scenarioMs: 10000
+  batchMs: 30000
+  slowInteractionMs: 750

.github/workflows/ci.yml

@@ -1,5 +1,8 @@
 name: CI
-on: [push, pull_request]
+on:
+  push:
+    branches: [main]
+  pull_request:
 jobs:
   lint-and-typecheck:
     runs-on: ubuntu-latest
@@ -19,6 +22,9 @@ jobs:
             libayatana-appindicator3-dev \
             librsvg2-dev \
             libxdo-dev
+      - uses: Swatinem/rust-cache@v2
+        with:
+          workspaces: apps/desktop/src-tauri
       - name: Install Dependencies
         run: pnpm install --frozen-lockfile
       - name: Lint
@@ -27,18 +33,29 @@ jobs:
       - name: Type Check
         working-directory: apps/desktop
         run: pnpm exec tsc --noEmit
+      - name: Install focused browser
+        working-directory: apps/desktop
+        run: pnpm exec playwright install --with-deps chromium
       - name: Unit Tests
         working-directory: apps/desktop
-        run: pnpm run test:unit
-      - name: MCP sidecar build smoke
+        # Process-heavy differential fixtures model one singleton-owned daemon.
+        # Serial file execution avoids multiplying Git/browser processes beyond
+        # that production ownership boundary on constrained hosted runners.
+        run: |
+          pnpm exec node --import tsx --test --test-concurrency=1 "src/**/*.test.ts"
+          pnpm exec node --import tsx --test tests/qualification/warm-verification-live.test.ts
+      - name: Prepare MCP sidecar
         working-directory: apps/desktop
         run: pnpm run prepare:mcp-sidecar
       - name: Desktop build
         working-directory: apps/desktop
         run: pnpm run build
       - name: MCP protocol and safety tests
         working-directory: apps/desktop
-        run: "cargo test --manifest-path src-tauri/Cargo.toml mcp::"
-      - name: MCP release-mode stdio lifecycle
+        run: |
+          cargo test --manifest-path src-tauri/Cargo.toml --lib mcp
+          cargo test --manifest-path src-tauri/Cargo.toml --bin codevetter-mcp
+          cargo test --manifest-path src-tauri/Cargo.toml --test mcp_stdio
+      - name: MCP and history browser tests
         working-directory: apps/desktop
-        run: cargo test --release --manifest-path src-tauri/Cargo.toml --test mcp_stdio
+        run: pnpm exec playwright test tests/e2e/mcp-settings.spec.ts tests/e2e/repo-unpacked.spec.ts

.github/workflows/release.yml

@@ -41,6 +41,8 @@ jobs:
 
       - name: Setup Rust
         uses: dtolnay/rust-toolchain@stable
+        with:
+          targets: aarch64-apple-darwin
 
       - name: Setup Bun
         uses: oven-sh/setup-bun@v2
@@ -57,13 +59,23 @@ jobs:
         working-directory: apps/desktop
         run: pnpm exec playwright install chromium
 
-      - name: Qualify canonical graph performance
+      - name: Qualify canonical graph and MCP performance
         working-directory: apps/desktop
+        env:
+          # Hosted runner timing is variable. Keep correctness/resource
+          # qualification here; absolute graph ceilings run on the named machine.
+          CV_GRAPH_BUDGET_MODE: report-only
         run: |
           pnpm qualify:graph
           pnpm qualify:graph:browser
           pnpm bench:mcp
 
+      - name: Prepare release MCP sidecar
+        working-directory: apps/desktop
+        env:
+          TAURI_ENV_TARGET_TRIPLE: aarch64-apple-darwin
+        run: pnpm run prepare:mcp-sidecar:release
+
       - name: Build Tauri app
         id: tauri
         uses: tauri-apps/tauri-action@v0
@@ -89,6 +101,9 @@ jobs:
           includeUpdaterJson: true
           updaterJsonPreferNsis: false
 
+      - name: Verify MCP sidecar in app bundle
+        run: test -x apps/desktop/src-tauri/target/aarch64-apple-darwin/release/bundle/macos/CodeVetter.app/Contents/MacOS/codevetter-mcp
+
       # tauri-action repackages the .app -> .tar.gz AFTER tauri build signed
       # the original tarball, so the on-disk .sig is stale (or absent). Sign
       # the final tarball ourselves with the same minisign key, then upload

.gitignore

@@ -19,6 +19,7 @@ target/
 apps/desktop/src-tauri/target/
 apps/desktop/src-tauri/binaries/codevetter-mcp-*
 apps/desktop/src-tauri/sidecar/
+apps/desktop/src-tauri/binaries/codevetter-mcp-*
 apps/desktop/out/
 apps/desktop/.next/
 
@@ -62,5 +63,12 @@ apps/desktop/coverage/
 .fallow/
 cache.bin
 
+# Warm local verification artifacts (redacted but intentionally ephemeral)
+.codevetter/verify-artifacts/
+
+# Model-assisted scenario candidates remain private until explicit acceptance.
+.codevetter/scenario-candidates/
+.codevetter/private-notes/
+
 # codex CLI project dir
 .codex/