refactor!: cut over to workflow architecture

.github/scripts/install-just.sh

@@ -2,8 +2,28 @@
 set -euo pipefail
 
 readonly JUST_VERSION="1.56.0"
-readonly JUST_ARCHIVE="just-${JUST_VERSION}-x86_64-unknown-linux-musl.tar.gz"
-readonly JUST_SHA256="fa2a8ec1015d9df5330941ade12437488fc40d33f9c9f8cd4eb70a26de11b639"
+case "$(uname -s)-$(uname -m)" in
+  Linux-x86_64)
+    readonly JUST_ARCHIVE="just-${JUST_VERSION}-x86_64-unknown-linux-musl.tar.gz"
+    readonly JUST_SHA256="fa2a8ec1015d9df5330941ade12437488fc40d33f9c9f8cd4eb70a26de11b639"
+    ;;
+  Linux-aarch64)
+    readonly JUST_ARCHIVE="just-${JUST_VERSION}-aarch64-unknown-linux-musl.tar.gz"
+    readonly JUST_SHA256="c8c1d656e9f47569ec1ae2bf8779af2621cdeea6bbbba3b0cacd64f951d25e2b"
+    ;;
+  Darwin-arm64)
+    readonly JUST_ARCHIVE="just-${JUST_VERSION}-aarch64-apple-darwin.tar.gz"
+    readonly JUST_SHA256="f35798d4bcdc4db020eef7d2853ad98bbfb97a4d29ee695ba042f18e7fedcc11"
+    ;;
+  Darwin-x86_64)
+    readonly JUST_ARCHIVE="just-${JUST_VERSION}-x86_64-apple-darwin.tar.gz"
+    readonly JUST_SHA256="09b35ff6d17023ffae37ce408d1a78a976d9e001cae54b88e238f7f40db9b783"
+    ;;
+  *)
+    printf 'Unsupported just installer platform: %s-%s\n' "$(uname -s)" "$(uname -m)" >&2
+    exit 1
+    ;;
+esac
 readonly JUST_URL="https://github.com/casey/just/releases/download/${JUST_VERSION}/${JUST_ARCHIVE}"
 readonly DOWNLOAD_DIR="${RUNNER_TEMP:-${TMPDIR:-/tmp}}/pi-hive-just-${JUST_VERSION}"
 readonly INSTALL_DIR="${HOME}/.local/bin"
@@ -14,7 +34,15 @@ curl --fail --location --proto '=https' --tlsv1.2 \
   --retry 3 --retry-all-errors \
   --output "${DOWNLOAD_DIR}/${JUST_ARCHIVE}" \
   "${JUST_URL}"
-printf '%s  %s\n' "${JUST_SHA256}" "${DOWNLOAD_DIR}/${JUST_ARCHIVE}" | sha256sum --check --strict
+if command -v sha256sum >/dev/null 2>&1; then
+  actual_sha256="$(sha256sum "${DOWNLOAD_DIR}/${JUST_ARCHIVE}" | awk '{print $1}')"
+else
+  actual_sha256="$(shasum -a 256 "${DOWNLOAD_DIR}/${JUST_ARCHIVE}" | awk '{print $1}')"
+fi
+if [[ "${actual_sha256}" != "${JUST_SHA256}" ]]; then
+  printf 'just archive checksum mismatch: expected %s, received %s\n' "${JUST_SHA256}" "${actual_sha256}" >&2
+  exit 1
+fi
 tar --extract --gzip --file "${DOWNLOAD_DIR}/${JUST_ARCHIVE}" --directory "${DOWNLOAD_DIR}" just
 install -m 0755 "${DOWNLOAD_DIR}/just" "${INSTALL_DIR}/just"
 printf '%s\n' "${INSTALL_DIR}" >> "${GITHUB_PATH}"

.github/workflows/ci.yml

@@ -45,7 +45,36 @@ jobs:
         run: npm ci --prefix ui/web
 
       - name: Run Node.js compatibility gates
-        run: just typecheck-core test-node-compat dashboard-typecheck dashboard-test-unit
+        run: just typecheck-core test-node-compat dashboard-typecheck dashboard-test-unit verify-node-package-compat
+
+  macos:
+    name: macOS workflow runtime
+    runs-on: macos-14
+    timeout-minutes: 30
+    steps:
+      - name: Checkout
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+
+      - name: Setup Node.js
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: "lts/*"
+          cache: "npm"
+
+      - name: Install just
+        run: bash .github/scripts/install-just.sh
+
+      - name: Install root dependencies
+        run: npm ci
+
+      - name: Install dashboard dependencies
+        run: npm ci --prefix ui/web
+
+      - name: Verify and rebuild Darwin native helpers
+        run: just darwin-native-verify && just darwin-native-build && just darwin-native-verify
+
+      - name: Run macOS core gates
+        run: just typecheck-core test verify-node-package-compat
 
   verify:
     runs-on: ubuntu-latest
@@ -81,7 +110,7 @@ jobs:
         run: just ci
 
       - name: Require committed generated artifacts
-        run: git diff --exit-code -- ui/web/dist ui/review/dist
+        run: git diff --exit-code -- ui/web/dist schemas
 
       - name: Generate coverage reports
         run: just coverage
@@ -111,7 +140,7 @@ jobs:
         run: node scripts/check-licenses.mjs
 
       - name: Audit root dependencies
-        run: npm audit --audit-level=high
+        run: node scripts/check-npm-audit.mjs
 
       - name: Audit dashboard dependencies
         run: npm audit --prefix ui/web --audit-level=high

.github/workflows/release.yml

@@ -1,9 +1,9 @@
 name: Release
 
 # Publishes to npm. Trigger either by publishing a GitHub Release:
-#   gh release create v0.1.0 --generate-notes
+#   gh release create vX.Y.Z --generate-notes
 # or manually, passing the existing tag:
-#   gh workflow run Release -f tag=v0.1.0
+#   gh workflow run Release -f tag=vX.Y.Z
 # The tag must match the package.json version, or the job fails before publishing.
 
 on:
@@ -12,7 +12,7 @@ on:
   workflow_dispatch:
     inputs:
       tag:
-        description: "Existing git tag to publish (e.g. v0.1.0)"
+        description: "Existing git tag to publish (e.g. vX.Y.Z)"
         required: true
         type: string
 
@@ -28,7 +28,7 @@ jobs:
   publish:
     environment: npm
     runs-on: ubuntu-latest
-    timeout-minutes: 45
+    timeout-minutes: 60
     steps:
       - name: Resolve release tag
         id: tag
@@ -99,23 +99,30 @@ jobs:
           fi
 
       - name: Run release gates
-        run: just ci
+        run: just release-gate
 
       - name: Verify tagged release state
         env:
           RELEASE_TAG: ${{ steps.tag.outputs.value }}
         run: just release-verify
 
-      - name: Publish to npm with trusted publishing
-        env:
-          RELEASE_TAG: ${{ steps.tag.outputs.value }}
-        run: npm publish --provenance --access public
-
       - name: Generate release SBOMs and dependency manifest
         run: just release-artifacts
 
+      - name: Validate release artifacts
+        run: just release-artifacts-verify
+
       - name: Attach release artifacts
         env:
           GH_TOKEN: ${{ github.token }}
           RELEASE_TAG: ${{ steps.tag.outputs.value }}
         run: gh release upload "$RELEASE_TAG" release-artifacts/* --clobber
+
+      # The aggregate above is the authoritative workflow gate. Ignoring npm
+      # lifecycle scripts here avoids rerunning the same full gate recursively;
+      # direct local npm publish still executes prepublishOnly, including artifact
+      # generation and validation after the unchanged tagged-state check.
+      - name: Publish to npm with trusted publishing
+        env:
+          RELEASE_TAG: ${{ steps.tag.outputs.value }}
+        run: npm publish --provenance --access public --ignore-scripts

.gitignore

@@ -15,6 +15,9 @@ coverage/
 
 # Runtime hive state / local telemetry
 .pi/
+# Workflow configuration fixtures intentionally contain nested project manifests.
+!/tests/fixtures/workflow-configs/**/.pi/
+!/tests/fixtures/workflow-configs/**/.pi/**
 .atl/
 *.db
 *.db-shm
@@ -26,10 +29,13 @@ coverage/
 
 # Local project notes and temporary planning documents
 /notes/
+/.pi-subagents/
 
 # NOTE: ui/web/dist/ is intentionally NOT ignored — it ships prebuilt so the
 # extension needs no build step at install time. Rebuild it after editing
 # ui/web/src/ with: just dashboard-build
 
 # Local Claude Code workspace (skills, scheduled tasks, etc.)
 .claude/
+!examples/**/.pi/
+!examples/**/.pi/**

AGENTS.md

@@ -2,7 +2,7 @@
 
 ## Project purpose
 
-`pi-hive` is a Pi package that provides a hierarchical multi-agent orchestration extension plus a local telemetry dashboard.
+`pi-hive` is a Linux and macOS Pi package that provides a hierarchical multi-agent orchestration extension plus a local telemetry dashboard. Darwin descriptor-relative filesystem operations must use the committed N-API helper and preserve Linux-equivalent fail-closed identity guarantees. Do not claim Windows process-tree termination support; Windows-form paths remain fail-closed security test inputs.
 
 The extension must stay safe to install globally: it should do nothing unless the current project opts in with `.pi/hive/hive-config.yaml`.
 

CHANGELOG.md

@@ -1,24 +1,30 @@
 # Changelog
 
-All notable changes to pi-hive are documented here. Release headings match the
-version in `package.json`; the release workflow refuses to publish a version
-without a corresponding section.
+## [1.0.0] - 2026-07-22
 
-## [Unreleased]
+### Breaking
 
-### Changed
+- Replaced the fixed pre-1.0 runtime with schema-v1 config-first workflows.
+- Removed fixed mode switching, dual-team configuration, semantic agent enforcement, planner stages, fixed artifact commands, keyboard cycling, and plan-specific dashboard routes.
+- Removed automatic loading of pre-1.0 configuration and durable YAML memory. Migration is manual; see README and SETUP.
+- Started a separate workflow telemetry projection. Historical telemetry files remain untouched and are not displayed or migrated.
 
-- Hardened release publishing with protected-environment approval, npm trusted
-  publishing, reproducibility checks, and attached software bills of materials.
+### Added
 
-## [0.1.0] - 2026-07-05
+- Strict YAML registries, reusable agents, recursive workflow teams, immutable activation snapshots, and capability narrowing.
+- Linked workflow sessions with multi-run chat semantics, explicit handoff, recovery, cancellation, budgets, and change accounting.
+- Generic artifact adapters for `none`, Markdown plans, and OpenSpec with leases, checkpoints, and exact approvals.
+- Durable questions, attached local OKF knowledge, bounded enrichment, workflow telemetry, authenticated API v1, and the workflow dashboard.
+- Checked-in combined, split-handoff, Markdown lifecycle, artifact-free, and invalid migration examples.
+- Added macOS arm64/x64 workflow-runtime support with packaged N-API descriptor-relative filesystem helpers and Darwin process identity.
 
-### Added
+### Fixed
+
+- Added lazy, bind-once artifact workspace discovery and explicit `workspace-bind` dispatch through the generic artifact tools, so production combined, Markdown, and split workflows no longer require out-of-band runtime binding.
+- Packaged the combined and split OpenSpec examples with a minimal initialized `openspec/` layout, so copied examples can scaffold their first workspace without hidden setup.
+- Made idle normal and workflow Pi 0.80 sessions safely persistable, precreated linked sessions through Pi's public `SessionManager`, and committed replacement authority before the single native switch so the first target `session_start` restores the exact runtime without a follow-up reload.
 
-- Hierarchical multi-agent orchestration for opted-in Pi projects.
-- OpenSpec-backed planning, review, approval, and execution gates.
-- Local-only telemetry collection and a prebuilt React dashboard.
-- Project-scoped policy enforcement, lifecycle management, and privacy controls.
+### Security
 
-[Unreleased]: https://github.com/demetere/pi-hive/compare/v0.1.0...HEAD
-[0.1.0]: https://github.com/demetere/pi-hive/releases/tag/v0.1.0
+- Preserved unconfigured inertness, Node-compatible core loading, loopback-only dashboard binding, authenticated exact-object controls, bounded output/pagination, and Pi mutation-queue participation.
+- Documented that capability enforcement is not an OS sandbox, network denial is best effort, and delegation prose is not DLP.

CONTRIBUTING.md

@@ -3,9 +3,9 @@
 Thanks for your interest in improving `pi-hive`. This guide covers the toolchain,
 the local workflow, and the gates your change must pass.
 
-New here? Read the [README](./README.md) "What this is" section for the concepts
-(config-first ownership, the plan → hive flow, OpenSpec, Plannotator) and
-[SETUP.md](./SETUP.md) for how a hive is authored. The extension is config-first:
+New here? Read the [README quick start](./README.md#quick-start) for schema-v1
+workflow selection, linked sessions, capability policy, and artifact adapters, then
+[SETUP.md](./SETUP.md) for how a workflow is authored. The extension is config-first:
 it registers nothing until a project has `.pi/hive/hive-config.yaml`, so keep that
 opt-in guarantee intact in any change.
 
@@ -17,10 +17,10 @@ Install these before building:
   task routes through the `Justfile`, which is the source of truth. Run `just --list`
   to see all recipes. (CI installs `just` via its official script; do the same
   locally.)
-- **[Bun](https://bun.sh) ≥ 1.1** — required for the telemetry dashboard server
+- **[Bun](https://bun.sh) ≥ 1.3.14** — required for the local dashboard server
   (`bun:sqlite`) and the Bun-only test suite (`just test-db`).
-- **[Node.js](https://nodejs.org) ≥ 20** — runs the extension and the Node test suite.
-  CI uses Node 24.
+- **[Node.js](https://nodejs.org) ≥ 20.19.0** — runs the extension, build tools,
+  and the Node test suite. CI uses Node 24.
 - **[Pi](https://github.com/earendil-works/pi-coding-agent)** — to actually run the
   extension end to end. Pi provides `@earendil-works/pi-coding-agent` and
   `@earendil-works/pi-tui` at load time (they are peer dependencies).
@@ -43,7 +43,7 @@ The extension only activates in a project that contains `.pi/hive/hive-config.ya
 
 ## Working on the dashboard
 
-The dashboard is a Solid + Vite SPA under `ui/web/`. Its built bundle
+The dashboard is a React + Vite SPA under `ui/web/`. Its built bundle
 (`ui/web/dist/`) is **committed** so end users need no build step. After editing
 anything under `ui/web/src/`, rebuild and re-stamp the bundle:
 
@@ -59,22 +59,22 @@ running telemetry server.
 
 ## Before you open a PR
 
-Run the same gates as CI:
+Run the local verification gate, then the same aggregate gate as CI:
 
 ```sh
-just ci             # typecheck (core + dashboard), tests, dashboard freshness,
-                    # package-manifest verification, and `npm pack --dry-run`
+just verify         # ESLint, typechecks, tests, generated/dashboard/package checks
+just ci             # verify plus clean packaging and install/release checks
 ```
 
-Your PR must pass `just ci` green.
+Your PR must pass both `just verify` and `just ci` green. ESLint is mandatory;
+fix lint findings rather than bypassing the configured rules.
 
 ## Code style
 
-There is no ESLint/Prettier gate by design — TypeScript's type checkers
-(`strict` for the dashboard, `noImplicitAny` for the core) are the enforced
-correctness gate. Match the surrounding style: 2-space indent, double quotes,
-semicolons, named exports. Keep diffs minimal and idiomatic to the file you are
-editing.
+ESLint and TypeScript's type checkers (`strict` for the dashboard and core)
+are enforced by `just verify` and `just ci`. Match the surrounding style:
+2-space indent, double quotes, semicolons, and named exports. Keep diffs minimal
+and idiomatic to the file you are editing.
 
 ## Commit and PR conventions
 
@@ -111,15 +111,14 @@ You can also publish an existing tag manually (e.g. if the release event doesn't
 fire): `gh workflow run Release -f tag=vX.Y.Z`, or via the Actions tab → Release →
 "Run workflow".
 
-The tag (e.g. `v0.1.0`) must match `package.json`'s version, and `just ci` must
+The tag (e.g. `vX.Y.Z`) must match `package.json`'s version, and `just ci` must
 pass, or the workflow fails before publishing — so a broken or mistagged build
 cannot ship. The published tarball ships only the `files` allowlist (runtime code +
 the prebuilt `ui/web/dist/`); dependency folders never ship.
 
-**One-time setup:** add an npm access token that can publish in CI — a **granular**
-token with "bypass 2FA" enabled, or a classic **automation** token — as the
-`NPM_TOKEN` repository secret (Settings → Secrets and variables → Actions). A plain
-publish token fails with a 403 when the account has 2FA-on-publish enabled.
+**One-time setup:** configure the npm package's GitHub Actions trusted publisher
+for this repository and the protected `npm` environment. The release workflow uses
+GitHub OIDC with provenance and intentionally has no long-lived npm token fallback.
 Publishing to npm is what makes the package appear in the gallery.
 
 ## Security