Priority C v1 + v1.1: Notion ingest, real heuristic+LLM extractor, cache contract evolution

.claude/settings.json

@@ -6,7 +6,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "python3 -c \"import json,sys,re; d=json.load(sys.stdin); c=d.get('tool_input',{}).get('command',''); ops=('git commit','git merge ','git pull','git rebase --continue'); [print('bicameral: git write-op detected — call bicameral.link_commit(commit_hash=\\'HEAD\\') now to sync the decision ledger') for _ in [1] if any(op in c for op in ops)]\""
+            "command": "python3 -c \"import json,sys,re; d=json.load(sys.stdin); c=d.get('tool_input',{}).get('command',''); ops=('git commit','git merge ','git pull','git rebase --continue'); [print('bicameral: git write-op detected \u2014 call bicameral.link_commit(commit_hash=\\'HEAD\\') now to sync the decision ledger') for _ in [1] if any(op in c for op in ops)]\""
           }
         ]
       }
@@ -16,7 +16,17 @@
         "hooks": [
           {
             "type": "command",
-            "command": "[ -d .bicameral ] && claude -p '/bicameral:capture-corrections' || true"
+            "command": "python3 -m events.session_end_bridge"
+          }
+        ]
+      }
+    ],
+    "UserPromptSubmit": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "python3 scripts/hooks/preflight_reminder.py"
           }
         ]
       }

.github/dependabot.yml

@@ -0,0 +1,11 @@
+version: 2
+updates:
+  - package-ecosystem: "pip"
+    directory: "/"
+    target-branch: "dev"
+    schedule:
+      interval: "weekly"
+    labels:
+      - "flow:feature"
+      - "dependencies"
+      - "python"

.github/workflows/label-merged-to-dev.yml

@@ -0,0 +1,70 @@
+name: Apply merged-to-dev label
+
+on:
+  pull_request:
+    branches: [dev]
+    types: [closed]
+
+jobs:
+  label:
+    name: Label closed-by-PR issues
+    runs-on: ubuntu-latest
+    if: github.event.pull_request.merged == true
+    permissions:
+      issues: write
+      pull-requests: read
+    steps:
+      - name: Apply merged-to-dev label
+        uses: actions/github-script@v7
+        with:
+          script: |
+            // Workflow caveat: this job needs Settings -> Actions ->
+            // General -> Workflow permissions set to "Read and write
+            // permissions" at the repo level. The job-level
+            // `permissions: issues: write` block can only NARROW what
+            // the repo allows, never expand it. If the repo default
+            // is read-only, addLabels returns 403 "Resource not
+            // accessible by integration" regardless of the job-level
+            // grant.
+            //
+            // See: #115 (root cause + symptoms) and #104 (admin-side
+            // fix tracked alongside branch-protection setup).
+            //
+            // GitHub close keywords (case-insensitive): close, closes,
+            // closed, fix, fixes, fixed, resolve, resolves, resolved.
+            const pr = context.payload.pull_request;
+            const body = pr.body || "";
+            const closeRegex = /(?:close[sd]?|fix(?:es|ed)?|resolve[sd]?)\s+#(\d+)/gi;
+            const matches = [...body.matchAll(closeRegex)];
+            const issues = [...new Set(matches.map(m => parseInt(m[1])))];
+
+            const failed = [];
+            for (const num of issues) {
+              try {
+                await github.rest.issues.addLabels({
+                  owner: context.repo.owner,
+                  repo: context.repo.repo,
+                  issue_number: num,
+                  labels: ["merged-to-dev"]
+                });
+                console.log(`Labeled #${num}`);
+              } catch (e) {
+                console.log(`Failed to label #${num}: ${e.message}`);
+                failed.push({ num, message: e.message });
+              }
+            }
+
+            if (failed.length > 0) {
+              const summary = failed
+                .map(f => `  - #${f.num}: ${f.message}`)
+                .join("\n");
+              throw new Error(
+                `merged-to-dev labeller could not label ${failed.length} ` +
+                `issue(s) referenced by PR #${pr.number}:\n${summary}\n\n` +
+                `Most likely cause: repo Settings -> Actions -> General -> ` +
+                `Workflow permissions is set to read-only. ` +
+                `Job-level "permissions: issues: write" cannot expand a ` +
+                `read-only repo default. See #104 (admin fix) and ` +
+                `#115 (root cause).`
+              );
+            }

.github/workflows/lint-and-typecheck.yml

@@ -0,0 +1,24 @@
+name: Lint & Type Check
+
+on:
+  pull_request:
+    branches: [main, dev]
+
+jobs:
+  lint:
+    name: ruff + mypy
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: '3.11'
+          cache: 'pip'
+      - name: Install
+        run: pip install -e ".[test]"
+      - name: Ruff check
+        run: ruff check .
+      - name: Ruff format check
+        run: ruff format --check .
+      - name: Mypy
+        run: mypy .

.github/workflows/preflight-eval.yml

@@ -12,7 +12,7 @@ name: Preflight Failure-Mode Eval
 
 on:
   pull_request:
-    branches: [main]
+    branches: [main, dev]
     paths:
       - 'handlers/preflight.py'
       - 'handlers/sync_middleware.py'
@@ -78,6 +78,21 @@ jobs:
             -v --tb=short \
             --junitxml=test-results/preflight-skill-eval.xml
 
+      # Phase 3: §C cost/latency baseline. Asymmetric ±20% regression rule
+      # against committed baselines in tests/eval/cost_baseline.jsonl, with
+      # noise floors (10 tokens / 0.5ms) below which deltas are dismissed
+      # as measurement variance. Cleanly skips per-platform when no
+      # baseline row exists (e.g. first Linux run with Darwin-only
+      # baselines committed); record locally with
+      # BICAMERAL_EVAL_RECORD_BASELINE=1 and commit the row.
+      - name: Phase 3 — cost/latency baseline
+        id: phase3
+        continue-on-error: true
+        run: |
+          pytest tests/eval/run_preflight_cost_eval.py \
+            -v --tb=short \
+            --junitxml=test-results/preflight-cost-eval.xml
+
       - name: Surface results in step summary
         if: always()
         uses: test-summary/action@v2

.github/workflows/secret-scan.yml

@@ -0,0 +1,24 @@
+name: Secret Scan
+
+on:
+  pull_request:
+    branches: [main, dev]
+
+# gitleaks-action@v2 requires a paid license for organizations
+# (https://github.com/gitleaks/gitleaks-action#-announcement).
+# We use trufflehog instead — free for all repos, equally capable
+# detector ruleset, and faster cold-start than spinning up a
+# gitleaks container.
+jobs:
+  trufflehog:
+    name: TruffleHog
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0  # full history so trufflehog can scan the diff range
+      - uses: trufflesecurity/trufflehog@main
+        with:
+          base: ${{ github.event.pull_request.base.sha }}
+          head: ${{ github.event.pull_request.head.sha }}
+          extra_args: --only-verified

.github/workflows/test-mcp-regression.yml

@@ -2,15 +2,20 @@ name: MCP Regression Tests
 
 on:
   pull_request:
-    branches: [main]
+    branches: [main, dev]
 
 env:
   PYTHON_VERSION: '3.11'
 
 jobs:
   mcp-tests:
     name: MCP Regression Suite
-    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, windows-latest]
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 20
     # Needed so ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }} / ANTHROPIC_API_KEY
     # (environment secrets scoped to `ci-test`) is injected into the M1
     # extraction step. The env is gate-free so this does not block
@@ -19,6 +24,7 @@ jobs:
     env:
       SURREAL_URL: 'memory://'
       REPO_PATH: ${{ github.workspace }}
+      BICAMERAL_SKIP_CONSENT_NOTICE: '1'
     steps:
       - uses: actions/checkout@v4
 
@@ -46,7 +52,10 @@ jobs:
       # ── Clone OSS repos for eval ground truth ────────────────────────
       # Only medusa is needed — saleor/vendure were used by eval_code_locator.py
       # which was removed in v0.6.4 when search_code was nuked.
+      # Ubuntu-only: bash function syntax + medusa corpus consumed by
+      # the Linux-only M1 adversarial eval and E2E report below.
       - name: Clone eval repos (shallow, pinned commits)
+        if: matrix.os == 'ubuntu-latest'
         run: |
           clone_at_commit() {
             local repo_url=$1 dest=$2 commit=$3
@@ -79,6 +88,7 @@ jobs:
       # "secret is not set" from "secret is set to empty string" from
       # "secret is set correctly" without ever exposing the key.
       - name: M1 secret visibility probe
+        if: matrix.os == 'ubuntu-latest'
         run: |
           set +e
           if [ -n "${ANTHROPIC_API_KEY}" ]; then
@@ -108,6 +118,7 @@ jobs:
       # as a red "M1 adversarial" step in the job without failing the
       # whole build, so the rest of the regression suite still reports.
       - name: M1 adversarial corpus eval (warn-only)
+        if: matrix.os == 'ubuntu-latest'
         continue-on-error: true
         env:
           ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
@@ -119,8 +130,12 @@ jobs:
           -o test-results/m1-adversarial.json
 
       # ── Generate rich E2E report from artifacts ────────────────────
+      # Ubuntu-only: the script consumes the medusa adversarial corpus
+      # (cloned only on Ubuntu above) plus the Phase 3 E2E artifacts
+      # the report builds. Windows runs the unit + integration suite
+      # for cross-platform coverage but skips the corpus-driven E2E.
       - name: Generate E2E report
-        if: always()
+        if: always() && matrix.os == 'ubuntu-latest'
         run: python tests/generate_e2e_report.py
 
       # ── Generate step summary from JUnit XML ───────────────────────
@@ -136,6 +151,6 @@ jobs:
         uses: actions/upload-artifact@v4
         if: always()
         with:
-          name: mcp-test-results
+          name: mcp-test-results-${{ matrix.os }}
           path: test-results/
           retention-days: 30

.github/workflows/test-schema-persistence.yml

@@ -9,7 +9,7 @@ on:
       - 'tests/test_schema_persistence.py'
       - 'pyproject.toml'
   pull_request:
-    branches: [main]
+    branches: [main, dev]
     paths:
       - 'ledger/schema.py'
       - 'ledger/client.py'