Triage from dev

.claude/settings.json

@@ -6,7 +6,16 @@
         "hooks": [
           {
             "type": "command",
-            "command": "python3 -c \"import json,sys,re; d=json.load(sys.stdin); c=d.get('tool_input',{}).get('command',''); ops=('git commit','git merge ','git pull','git rebase --continue'); [print('bicameral: git write-op detected — call bicameral.link_commit(commit_hash=\\'HEAD\\') now to sync the decision ledger') for _ in [1] if any(op in c for op in ops)]\""
+            "command": "python3 scripts/hooks/post_commit_sync_reminder.py"
+          }
+        ]
+      },
+      {
+        "matcher": "mcp__bicameral__bicameral_preflight",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "python3 scripts/hooks/post_preflight_capture_reminder.py"
           }
         ]
       }
@@ -16,7 +25,17 @@
         "hooks": [
           {
             "type": "command",
-            "command": "[ -d .bicameral ] && claude -p '/bicameral:capture-corrections' || true"
+            "command": "[ -d .bicameral ] && [ -z \"$BICAMERAL_SESSION_END_RUNNING\" ] && BICAMERAL_SESSION_END_RUNNING=1 claude -p '/bicameral:capture-corrections --auto-ingest' || true"
+          }
+        ]
+      }
+    ],
+    "UserPromptSubmit": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "python3 scripts/hooks/preflight_reminder.py"
           }
         ]
       }

.github/workflows/label-merged-to-dev.yml

@@ -0,0 +1,70 @@
+name: Apply merged-to-dev label
+
+on:
+  pull_request:
+    branches: [dev]
+    types: [closed]
+
+jobs:
+  label:
+    name: Label closed-by-PR issues
+    runs-on: ubuntu-latest
+    if: github.event.pull_request.merged == true
+    permissions:
+      issues: write
+      pull-requests: read
+    steps:
+      - name: Apply merged-to-dev label
+        uses: actions/github-script@v7
+        with:
+          script: |
+            // Workflow caveat: this job needs Settings -> Actions ->
+            // General -> Workflow permissions set to "Read and write
+            // permissions" at the repo level. The job-level
+            // `permissions: issues: write` block can only NARROW what
+            // the repo allows, never expand it. If the repo default
+            // is read-only, addLabels returns 403 "Resource not
+            // accessible by integration" regardless of the job-level
+            // grant.
+            //
+            // See: #115 (root cause + symptoms) and #104 (admin-side
+            // fix tracked alongside branch-protection setup).
+            //
+            // GitHub close keywords (case-insensitive): close, closes,
+            // closed, fix, fixes, fixed, resolve, resolves, resolved.
+            const pr = context.payload.pull_request;
+            const body = pr.body || "";
+            const closeRegex = /(?:close[sd]?|fix(?:es|ed)?|resolve[sd]?)\s+#(\d+)/gi;
+            const matches = [...body.matchAll(closeRegex)];
+            const issues = [...new Set(matches.map(m => parseInt(m[1])))];
+
+            const failed = [];
+            for (const num of issues) {
+              try {
+                await github.rest.issues.addLabels({
+                  owner: context.repo.owner,
+                  repo: context.repo.repo,
+                  issue_number: num,
+                  labels: ["merged-to-dev"]
+                });
+                console.log(`Labeled #${num}`);
+              } catch (e) {
+                console.log(`Failed to label #${num}: ${e.message}`);
+                failed.push({ num, message: e.message });
+              }
+            }
+
+            if (failed.length > 0) {
+              const summary = failed
+                .map(f => `  - #${f.num}: ${f.message}`)
+                .join("\n");
+              throw new Error(
+                `merged-to-dev labeller could not label ${failed.length} ` +
+                `issue(s) referenced by PR #${pr.number}:\n${summary}\n\n` +
+                `Most likely cause: repo Settings -> Actions -> General -> ` +
+                `Workflow permissions is set to read-only. ` +
+                `Job-level "permissions: issues: write" cannot expand a ` +
+                `read-only repo default. See #104 (admin fix) and ` +
+                `#115 (root cause).`
+              );
+            }

.github/workflows/lint-and-typecheck.yml

@@ -0,0 +1,24 @@
+name: Lint & Type Check
+
+on:
+  pull_request:
+    branches: [main, dev]
+
+jobs:
+  lint:
+    name: ruff + mypy
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: '3.11'
+          cache: 'pip'
+      - name: Install
+        run: pip install -e ".[test]"
+      - name: Ruff check
+        run: ruff check .
+      - name: Ruff format check
+        run: ruff format --check .
+      - name: Mypy
+        run: mypy .

.github/workflows/secret-scan.yml

@@ -0,0 +1,24 @@
+name: Secret Scan
+
+on:
+  pull_request:
+    branches: [main, dev]
+
+# gitleaks-action@v2 requires a paid license for organizations
+# (https://github.com/gitleaks/gitleaks-action#-announcement).
+# We use trufflehog instead — free for all repos, equally capable
+# detector ruleset, and faster cold-start than spinning up a
+# gitleaks container.
+jobs:
+  trufflehog:
+    name: TruffleHog
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0  # full history so trufflehog can scan the diff range
+      - uses: trufflesecurity/trufflehog@main
+        with:
+          base: ${{ github.event.pull_request.base.sha }}
+          head: ${{ github.event.pull_request.head.sha }}
+          extra_args: --only-verified

.github/workflows/test-mcp-regression.yml

@@ -2,15 +2,20 @@ name: MCP Regression Tests
 
 on:
   pull_request:
-    branches: [main]
+    branches: [main, dev]
 
 env:
   PYTHON_VERSION: '3.11'
 
 jobs:
   mcp-tests:
     name: MCP Regression Suite
-    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, windows-latest]
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 20
     # Needed so ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }} / ANTHROPIC_API_KEY
     # (environment secrets scoped to `ci-test`) is injected into the M1
     # extraction step. The env is gate-free so this does not block
@@ -47,7 +52,10 @@ jobs:
       # ── Clone OSS repos for eval ground truth ────────────────────────
       # Only medusa is needed — saleor/vendure were used by eval_code_locator.py
       # which was removed in v0.6.4 when search_code was nuked.
+      # Ubuntu-only: bash function syntax + medusa corpus consumed by
+      # the Linux-only M1 adversarial eval and E2E report below.
       - name: Clone eval repos (shallow, pinned commits)
+        if: matrix.os == 'ubuntu-latest'
         run: |
           clone_at_commit() {
             local repo_url=$1 dest=$2 commit=$3
@@ -80,6 +88,7 @@ jobs:
       # "secret is not set" from "secret is set to empty string" from
       # "secret is set correctly" without ever exposing the key.
       - name: M1 secret visibility probe
+        if: matrix.os == 'ubuntu-latest'
         run: |
           set +e
           if [ -n "${ANTHROPIC_API_KEY}" ]; then
@@ -109,6 +118,7 @@ jobs:
       # as a red "M1 adversarial" step in the job without failing the
       # whole build, so the rest of the regression suite still reports.
       - name: M1 adversarial corpus eval (warn-only)
+        if: matrix.os == 'ubuntu-latest'
         continue-on-error: true
         env:
           ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
@@ -120,8 +130,12 @@ jobs:
           -o test-results/m1-adversarial.json
 
       # ── Generate rich E2E report from artifacts ────────────────────
+      # Ubuntu-only: the script consumes the medusa adversarial corpus
+      # (cloned only on Ubuntu above) plus the Phase 3 E2E artifacts
+      # the report builds. Windows runs the unit + integration suite
+      # for cross-platform coverage but skips the corpus-driven E2E.
       - name: Generate E2E report
-        if: always()
+        if: always() && matrix.os == 'ubuntu-latest'
         run: python tests/generate_e2e_report.py
 
       # ── Generate step summary from JUnit XML ───────────────────────
@@ -137,6 +151,6 @@ jobs:
         uses: actions/upload-artifact@v4
         if: always()
         with:
-          name: mcp-test-results
+          name: mcp-test-results-${{ matrix.os }}
           path: test-results/
           retention-days: 30