feat: review inbound user skills git changes

[santosli]

Summary

• add explicit Check remote -> Review incoming changes -> Apply fast-forward APIs for the shared user-skills repository
• validate repository-wide incoming skill trees, bind stale-safe previews, disclose deployment impact, block deployed deletes/renames, and create internal backup refs
• add JSON CLI/Tauri contracts and a Settings review dialog for behind, dirty, remote-only, and diverged states
• document the origin/main-only v0.7 trust, recovery, and conflict-resolution boundary

Architecture and safety

• no SQLite schema migration; Git commits/refs remain repository identity and existing user skill rows are rebuilt transactionally after apply
• apply re-fetches and recomputes remote URL, branch, local/remote/base SHAs, worktree fingerprint, validated tree, changes, and deployment state before writes
• only clean behind or reviewed safe remote-only repositories can apply; no auto merge/rebase/reset/stash/force-push
• existing local HEAD is preserved at refs/skillbox/backups/inbound/; reindex failure compensates Git to the previous state
• diverged analysis uses read-only merge-tree diagnostics and must be resolved with normal Git tooling outside SkillBox

Verification

• cargo fmt --check
• cargo clippy --workspace --all-targets --all-features --locked -- -D warnings
• cargo test --offline (CLI 28, core 272, desktop 10, git 23, GitHub parser 8)
• npm test (237)
• npm --workspace apps/desktop run build
• npm audit --audit-level=high (0 vulnerabilities)
• cargo audit (0 vulnerabilities; 18 allowed warnings)
• git diff --check
• visual QA: behind, dirty+behind, diverged, remote-only bootstrap, and 1000x760 narrow review

Known limits

• v1 is explicit and origin/main-only; no startup/background fetch
• inbound apply is repository-wide; no selective skill apply
• deployed delete/rename requires undeploy first
• no in-app conflict editor or automatic conflict resolution

Screenshots

• /tmp/skillbox-inbound-review-desktop.png
• /tmp/skillbox-inbound-review-narrow.png
• /tmp/skillbox-inbound-dirty-behind.png
• /tmp/skillbox-inbound-diverged.png

[santosli]

第五轮修复已推送，PR 继续保持 Draft，未 merge/release。

Commits:

• c63aa7b fix(github): close inbound sync race boundaries
• c814091 fix(desktop): preserve inbound review lifecycle

Blocker closure:

1. StrictMode：每次 effect setup 安装独立 controller；cleanup 仅 dispose 本次实例。真实 react-test-renderer replay + 最终 unmount late callback 回归通过。
2. generated .gitignore：先原子转移至 operation-private backup，再绑定 identity/校验；preflight 后 atomic-save 替换会保留自定义内容并中止。
3. backup identity：receipt 绑定 dev/inode/size/hash/mode；restore 先 quarantine 再校验，replacement 不会恢复或报告成功。
4. compensation：HEAD/path ownership/index/worktree/generated defaults/index lock 独立尝试并聚合 outcome；单点冲突不再跳过其他安全恢复。
5. transport：GIT_ALLOW_PROTOCOL 仅允许 file/http/https/ssh/git；custom git-remote-* helper marker/ref-unchanged 回归通过。
6. config scopes：local + worktree execution-bearing config 均 fail closed；worktree URL rewrite/helper marker 回归通过。
7. legacy root：先 expand/normalize effective root，再识别等价默认 root与迁移；tilde/.. alias + 不同 cwd 竞争同一 legacy truth-root lock 回归通过。
8. deadline：origin/config/include/fetch 全部共享 bounded deadline；FIFO global include 超时后 mutation lock 可立即重取。
9. conflict：常数 4 条 Git 命令的 name-status/merge-tree/base-tree 诊断，保留 rename provenance；D/D、same rename、rename/delete、rename/rename 均覆盖。
10. unrelated histories：返回 available=false + reason，UI 不再显示伪 0 conflicts。
11. bounded diagnosis：command-count=4 且共享 total deadline 回归通过。
12. cleanup/partial success：index lock 与 temp cleanup 均 quarantine-then-verify；已完成 Git/worktree/DB 但 lock release 异常返回 success + warnings，并记录 completed_with_warnings。
13. accessibility：loading role=status，error role=alert，均有 aria-live contract test。

Focused regressions:

• skillbox-core inbound suite: 38/38
• skillbox-git: 36/36（含 custom helper/worktree config/deadline/rename）
• Desktop inbound: 17/17
• production-path regressions包含 generated_gitignore_atomic_replacement、replaced_backup_entry、multi-failure compensation、index-lock replacement partial success、legacy alias、blocking preflight、StrictMode replay。

Full qualification:

• cargo fmt --all --check: pass
• cargo clippy --workspace --all-targets --all-features --locked -- -D warnings: pass
• cargo test --offline: pass（core 303/303；git 36/36；CLI 29/29；desktop Rust 10/10；github 8/8）
• npm test: 247/247
• npm --workspace apps/desktop run build: pass
• npm audit --audit-level=high: 0 vulnerabilities
• cargo audit: exit 0，18 个仓库既有 allowlisted warnings
• git diff --check: pass

Visual QA:

• /tmp/skillbox-inbound-behind-v5.png
• /tmp/skillbox-inbound-dirty-v5.png
• /tmp/skillbox-inbound-diverged-v5.png
• /tmp/skillbox-inbound-narrow-v5.png
  1600x900 与 1000x760 均无横向 overflow；Dirty/Diverged 禁用 Apply，Behind 可应用。

CI for c814091 is currently running. I will keep the PR Draft and report final CI state after it completes.

[santosli]

CI read-back for c814091: Test passed in 5m40s; Dependency Audit passed in 26s. PR remains Draft and no merge/release action was taken.

[santosli]

PM fifth-round blockers addressed in d56b6c6. PR remains Draft.

Production-path regressions added and passing:

• backup_fifo_replacement_fails_closed_without_blocking_or_mutation
• backup_special_file_replacement_fails_closed_without_mutation
• backup_oversized_replacement_fails_closed_without_unbounded_read
• index_compensation_ignores_predictable_restore_symlink_and_preserves_external_file
• mutation_lock_canonicalizes_symlink_parent_before_legacy_root_selection
• index_lock_release_keeps_git_excluded_while_restoring_a_replacement_lock
• completed_apply_persists_partial_success_warning_in_operation_history
• network_preflight_uses_complete_git_boolean_semantics_for_worktree_config

Desktop coverage persists partial-success warnings in Settings with accessible alert and dismiss behavior; focused UI tests pass 114/114.

Full qualification:

• cargo fmt --check: pass
• cargo clippy --workspace --all-targets --all-features --locked -- -D warnings: pass
• cargo test --offline: pass (core 310/310, git 37/37, github 8/8, all remaining suites green)
• npm test: 249/249
• desktop build: pass
• npm audit --audit-level=high: 0 vulnerabilities
• cargo audit: 18 repository-allowed warnings, no new blocking advisory
• git diff --check: pass
• GitHub Test and Dependency Audit: success

No merge or release performed.

[santosli]

第七轮修复已推送，PR 保持 Draft。

Commits:

• 1ed3743 fix(github): preserve inbound apply outcomes
• b62e666 fix(github): verify restored inbound state
• 2800d28 test(core): isolate inbound git fixtures

Production-path regressions:

• behind_compensation_preserves_foreign_index_replacement_and_reports_partial_recovery
• remote_only_compensation_preserves_foreign_index_replacement_and_reports_partial_recovery
• compensation_detects_index_replacement_after_restore_exchange
• network_fetch_rejects_local_and_worktree_remote_vcs_helpers_without_execution
• operation_finalize_failure_returns_applied_result_with_warning_without_rollback
• production App commits apply success before best-effort refresh and preserves warnings until dismiss
• App generation-gates best-effort inbound refresh writes against newer operations

Behavior now:

• Index compensation atomically verifies the applied index and restored target identity; foreign replacement is preserved and recovery is reported partial/failed.
• Local/worktree remote.*.vcs is rejected before network Git; helper output is not surfaced.
• A successful apply is committed to UI state before best-effort refresh; refresh failure becomes an accessible partial-success warning.
• Operation-history finalize failure returns Ok + warning, never rolls back or misreports mutation failure.
• Settings inbound warnings persist until explicit dismissal, append/dedupe across applies, and are not mirrored into the global notice.
• Best-effort refresh writes are generation-gated against newer inbound/config operations.

Qualification:

• cargo fmt --check: pass
• locked clippy with -D warnings: pass
• cargo test --offline: pass locally (core 314/314, skillbox-git 38/38, CLI 29/29, remaining suites green)
• npm test: 251/251
• desktop build: pass
• npm audit --audit-level=high: 0 vulnerabilities
• cargo audit: 18 repository-allowed warnings
• git diff --check: pass
• backup fixture stress: 4 concurrent Cargo processes, 16/16 each, all pass
• GitHub CI run: https://github.com/santosli/SkillBox/actions/runs/30540347921
  • Test: pass
  • Dependency Audit: pass

The first CI retry exposed only a test-fixture temp-directory collision under concurrent backup regressions. 2800d28 gives fixtures process-id + timestamp + atomic-counter identity; the replacement CI is green.

No Ready, merge, release, tag, or Homebrew action was performed.

[santosli]

第八轮复审修复已推送到 20d3d05，PR 保持 Draft。

本轮关闭项与 production-path regressions：

• Index restore 绑定 device/inode/size/content hash，并在 exchange 后及 receipt 清理前精确复核：compensation_detects_same_inode_restored_index_content_change、compensation_detects_index_replacement_after_restore_exchange。
• Shared mutation lock 返回 canonical truth root，所有 13 个 core mutation callsites 锁内只使用该 root：inbound_apply_stays_on_locked_truth_root_after_alias_retarget（含 alias retarget + 第二进程）。
• Apply mutation 前探测实际 repo volume atomic exchange 能力；index-lock release 使用 private quarantine/exchange 避免 public stat/unlink race：atomic_exchange_capability_failure_blocks_before_inbound_mutation、index_lock_release_preserves_replacement_before_final_quarantine。
• local/worktree url.*.pushInsteadOf fail closed：network_push_rejects_local_and_worktree_push_url_rewrites_without_execution，marker 未执行且 secret 未泄漏。
• Desktop inbound/outbound/save/check/status refresh 共用 monotonic generation：newer outbound sync revokes a pending inbound apply refresh、newer remote save revokes an older inbound check result。
• Canonical truth-root migration 同时修正了 delete preview/apply identity；CLI delete workflow 回归通过。

验证：

• core inbound focused: 52/52
• skillbox-git: 39/39
• Desktop inbound + layout: 117/117
• full Rust: CLI 29/29, core 318/318, desktop Rust 10/10, git 39/39, github 8/8, doc-tests pass
• npm test: 252/252
• desktop build: pass
• cargo fmt: pass
• clippy locked -D warnings: pass
• npm audit high: 0 vulnerabilities
• cargo audit: pass, 18 existing allowed warnings
• git diff --check: pass
• GitHub Test: pass (8m31s)
• GitHub Dependency Audit: pass (29s)

文档已同步 canonical truth-root、content-bound index recovery、atomic-exchange preflight、pushInsteadOf 及 UI generation 边界。PR 仍为 Draft，未 Ready/merge/release。

[santosli]

第八轮 blocker 修复已推送，PR 继续保持 Draft。

Commit: 6c465d1 fix(github): close inbound consistency races

逐项修复与 production-path regressions：

1. origin URL / pushURL custom helper

   • local/worktree remote.origin.url 与 remote.origin.pushurl 现在在 network Git 前做 fail-closed transport/syntax 校验。
   • 保留正常 local/file/http/https/ssh/git 和 git@host:path SCP URL；global credential helper 边界未改变。
   • network_fetch_and_push_reject_custom_origin_urls_without_execution: local/worktree × fetch/pushURL marker 均未执行、remote ref 未更新、helper stderr secret 未泄漏。
   • repository_origin_url_validation_keeps_supported_git_transports: 支持的 URL 形式保持可用。

2. Desktop authoritative generation

   • refreshSkillStatuses() 在函数入口、任何 paint/await 前领取 generation。browser/full/single-skill success/error 全部分支提交前 gate。
   • newer Save remote 立即撤销旧 refresh 并恢复全局 ready 状态。
   • refresh claims its generation before paint and cannot overwrite a newer remote save
   • single-skill refresh success and error cannot overwrite a newer remote save

3. canonical truth root path semantics

   • mutation lock 先 expand ~、按 cwd 建立绝对路径，再按 OS existing-parent/symlink 解析得到 canonical truth root；不再在相对路径或未解析 symlink 上做 lexical collapse。
   • mutation_lock_preserves_parent_and_symlink_resolution_before_creation: 覆盖不同 cwd 的 ../SkillBox、symlink-parent/..、等价 alias 互斥和不创建错误目录。

4. post-reindex plain edit

   • reindex 后、成功返回/index-lock release 前再次验证 expected HEAD 和 clean reviewed worktree。
   • 并发普通编辑触发可审计 rollback/partial recovery，不覆盖用户内容、不误报 success；concurrent edit 会 no-replace 恢复到原路径，冲突时保留 recovery material。
   • concurrent_plain_edit_after_reindex_is_preserved_and_not_reported_as_success: 用户内容保留，HEAD 恢复，worktree dirty，operation phase=final_consistency，compensation 明确失败而非 clean success。

验证：

• focused core inbound: 53/53
• focused skillbox-git: 41/41
• focused Desktop inbound/layout: 119/119
• cargo fmt --check: pass
• locked clippy -D warnings: pass
• cargo test --offline: pass (29 CLI + 320 core + 10 desktop lib + 41 git + 8 github)
• npm test: 254/254
• desktop build: pass
• npm audit --audit-level=high: 0 vulnerabilities
• cargo audit: pass with 18 existing allowlisted warnings
• git diff --check: pass
• GitHub CI Test: pass (10m21s)
• GitHub Dependency Audit: pass (29s)

PR remains Draft; no merge/release performed.

[santosli]

第九轮 SQLite recovery blocker 已修复，PR 继续保持 Draft。

Commit: 9becd94 fix(github): restore inbound index after rollback

实现边界：

• reindex_user_skills 在同一个 SQLite transaction 内、删除/替换 type=user rows 前读取精确 row snapshot，包含 name/description/version/managed_path/status/content_hash/updated_at。Snapshot 仅驻留内存，不进入 audit payload。
• final consistency 失败后，Git/worktree compensation 与 SQLite snapshot restore 独立执行；一个失败不会跳过另一个。
• aggregate compensation.succeeded 只有 required recovery 全部成功才为 true；operation payload 新增独立 gitRecovery 与 databaseRecovery attempted/succeeded/error。
• dirty/malformed worktree 不用于猜测或重建旧 DB index；恢复精确 pre-apply rows。DB restore 自身失败时保留实际 rows并明确 partial recovery，不再次改写用户文件。

Production-path regressions：

1. concurrent_plain_edit_after_reindex_is_preserved_and_not_reported_as_success
   • incoming 同时修改 demo SKILL.md/content_hash，并新增 incoming-only skill，barrier 时确认 SQLite 已是 incoming rows。
   • 普通编辑器随后写入 tracked README，final consistency 失败。
   • 断言用户内容保留、HEAD 回旧 SHA、worktree dirty、incoming-only DB row 被移除、demo content_hash 精确回到 pre-apply snapshot。
   • audit: phase=final_consistency，gitRecovery=false（并发内容保留导致 partial），databaseRecovery=true，aggregate compensation=false。
2. failed_database_recovery_is_audited_without_overwriting_concurrent_user_content
   • incoming-only row 已 commit 后注入 DB restore failure，同时保留并发用户文件。
   • 断言 Git/HEAD recovery 成功、用户内容未覆盖、DB 仍保持可观察 incoming rows而非伪装恢复。
   • audit: gitRecovery=true，databaseRecovery=false + exact injected error，aggregate compensation=false，API error 明确 User skill index recovery failed。

验证：

• focused core inbound: 54/54
• cargo fmt: pass
• locked clippy -D warnings: pass
• cargo test --offline: pass（29 CLI + 321 core + 10 desktop lib + 41 git + 8 github = 409）
• npm test: 254/254
• desktop build: pass
• npm audit high: 0 vulnerabilities
• cargo audit: pass with 18 existing allowlisted warnings
• git diff --check: pass
• GitHub Test: pass 9m17s
• GitHub Dependency Audit: pass 20s
• CI run: https://github.com/santosli/SkillBox/actions/runs/30547644300

HEAD/local/remote = 9becd947a50ac94c4872d58902c24b6b5894ef90; worktree clean; PR Draft/CLEAN。未 Ready、merge、release。