release: promote develop → main — security (cross-org IDOR #11981 + app-key scope #11943/#11958) + money fixes to prod

.github/issue-evidence/10689-atlas-video-provider.md

@@ -0,0 +1,72 @@
+# #10689 Atlas Cloud video provider
+
+## Scope
+
+Agent-actionable slice:
+- Add Atlas Cloud as a `/api/v1/generate-video` provider through the existing video registry.
+- Add supported Atlas video model definitions and `video:generation` pricing rows.
+- Keep the FAL video provider path unchanged.
+- Add deterministic provider/pricing tests plus a credential-gated live lane.
+
+## Deterministic evidence
+
+Run from repo root:
+
+```bash
+bun test packages/cloud/shared/src/lib/providers/video/atlascloud-video-generation.test.ts \
+  packages/cloud/shared/src/lib/providers/video/fal-video-generation.test.ts \
+  packages/cloud/shared/src/lib/services/ai-pricing/video-generation-pricing.test.ts \
+  packages/cloud/shared/src/lib/services/media-model-roster.test.ts
+```
+
+Expected coverage:
+- Atlas request body uses documented `generateVideo` payload fields, including
+  image/reference aliases and `generate_audio` for route-level `audio`.
+- Atlas inline output normalization returns a usable `video/*` object.
+- Missing `ATLASCLOUD_API_KEY` fails before upstream dispatch.
+- Every supported Atlas video model has an Atlas `video:generation` pricing row.
+- The checked-in media model roster indexes the wired Atlas video model IDs.
+
+Additional review validation, 2026-07-03:
+
+```bash
+bun test packages/cloud/shared/src/lib/providers/video/atlascloud-video-generation.test.ts \
+  packages/cloud/shared/src/lib/providers/video/atlascloud-video-generation.real.test.ts \
+  packages/cloud/shared/src/lib/providers/video/fal-video-generation.test.ts \
+  packages/cloud/shared/src/lib/services/ai-pricing/video-generation-pricing.test.ts \
+  packages/cloud/shared/src/lib/services/media-model-roster.test.ts
+bun run --cwd packages/cloud/shared typecheck
+bun run --cwd packages/cloud/api typecheck
+bunx @biomejs/biome check packages/cloud/shared/src/lib/providers/video/atlascloud-video-generation.ts \
+  packages/cloud/shared/src/lib/providers/video/atlascloud-video-generation.test.ts \
+  packages/cloud/shared/src/lib/providers/video/atlascloud-video-generation.real.test.ts \
+  packages/cloud/shared/src/lib/providers/video/registry.ts \
+  packages/cloud/shared/src/lib/services/ai-pricing-definitions.ts \
+  packages/cloud/shared/src/lib/services/ai-pricing/providers/atlascloud.ts \
+  packages/cloud/shared/src/lib/services/ai-pricing/providers/fal.ts \
+  packages/cloud/shared/src/lib/services/ai-pricing/lookup.ts \
+  packages/cloud/shared/src/lib/services/ai-pricing/video-generation-pricing.test.ts \
+  packages/cloud/shared/src/lib/services/media-model-roster.ts \
+  packages/cloud/api/v1/generate-video/route.ts
+git diff --check origin/develop..HEAD
+```
+
+Result: deterministic tests passed (`12 pass`, `1 skip` for the credential-gated
+live Atlas lane), both package typechecks passed, targeted Biome passed, and
+diff whitespace check passed.
+
+## Live evidence
+
+N/A from this workspace: no Atlas Cloud production API key or spend budget was available.
+
+Human/operator command when credentials are available:
+
+```bash
+TEST_LANE=post-merge ATLASCLOUD_API_KEY=<redacted> \
+  bun test packages/cloud/shared/src/lib/providers/video/atlascloud-video-generation.real.test.ts
+```
+
+Required manual review after the live lane:
+- Open the returned video URL and confirm the media plays.
+- Attach the generated video artifact or URL, provider request id, route logs, billing row, and generated `generations` row.
+- Add the model matrix required by #10689 for each Atlas model enabled in production.

.github/issue-evidence/10721-calendar-rrule/README.md

@@ -0,0 +1,79 @@
+# #11788 / #10721 — calendar RRULE / recurring-event semantics
+
+Evidence that LifeOps calendar actions now honor RRULE/recurring-event
+semantics end to end: recurrence-aware create, explicit instance-vs-series
+intent on update/delete, series mutations that target the series master
+(never an iteration over flattened occurrences), and recurrence metadata on
+readback.
+
+## Artifacts
+
+| File | What it proves |
+| --- | --- |
+| `live-llm-trajectory.json` | **Real-LLM trajectories** (live `claude` CLI, haiku — not the proxy, not a mock) driving the PRODUCTION `CALENDAR` action handler. Contains every prompt the handler built, every raw model response, the provider-bound service calls, and the grounded replies for 4 scenarios (see below). Reviewed by hand. |
+| `live-rrule-evidence.mts` | The runner that produced the trajectory (drives `createCalendarActionRunner` with the live model at the `CalendarActionDeps` seam and a spied `CalendarService`). Re-run: `cp` into `plugins/plugin-calendar/` and `bun live-rrule-evidence.mts`. |
+| `fail-without-fix.txt` | The new test suites run against the **pre-fix** `calendar-handler.ts` + `CalendarService.ts` from `origin/develop`: **22 failures** (ambiguous recurring delete mutates without asking, recurrence dropped on create, no series-master resolution, invalid RRULE silently ignored, …). All 22 pass with the fix. |
+| `test-runs.txt` | Full local runs: plugin-calendar suite (**195 passing / 2 skipped** incl. 54 new recurrence tests), plugin-google (**22**), packages/shared (**1049**), typecheck across all 7 affected packages. |
+
+## Live-LLM scenario results (from `live-llm-trajectory.json`)
+
+1. **create-recurring** — "book a 30 minute morning run … every monday at 7am
+   eastern": the live model planned `create_event` and extracted
+   `RRULE:FREQ=WEEKLY;BYDAY=MO` itself; `createCalendarEvent` received
+   `recurrence: ["RRULE:FREQ=WEEKLY;BYDAY=MO"]`; reply: *"Created calendar
+   event "morning run" … It repeats weekly on Monday."*
+2. **update-ambiguous** — "move my team standup to 10am" against a recurring
+   occurrence: the model extraction did **not** invent a scope, the handler
+   clarified — *""Team Standup" repeats weekly on Wednesday. should i change
+   just this occurrence or the whole series?"* — and **no mutation was
+   issued**.
+3. **update-instance** — "move just this one team standup occurrence to
+   10am": live extraction returned `recurrenceScope: "instance"`;
+   `updateCalendarEvent` was called with the occurrence id +
+   `recurrenceScope: "instance"`.
+4. **delete-series** — "delete the whole series of my team standup": exactly
+   **one** `deleteCalendarEvent` call with `recurrenceScope: "series"`.
+
+## Acceptance criteria mapping
+
+- *"Create a recurring …" produces a recurring event through the real
+  calendar service path and readback shows the recurrence metadata* —
+  live scenario 1 + `calendar-recurrence-service.test.ts`
+  ("normalizes recurrence to the provider and surfaces it on readback":
+  provider input, `event.recurrence`, and the PGlite cache row all carry the
+  RRULE) + plugin-google contract test (insert/patch `requestBody.recurrence`,
+  readback mapping).
+- *Update/delete of a recurring title requires explicit single occurrence vs
+  series intent when ambiguous* — live scenario 2 +
+  `calendar-recurrence-ops.test.ts` (ambiguous update & delete → clarification,
+  zero mutation calls).
+- *A single occurrence update/delete does not mutate/delete the whole series* —
+  live scenario 3 + ops/service tests (instance scope patches/deletes only the
+  addressed occurrence id).
+- *A series update/delete does not require iterating over flattened
+  occurrences* — live scenario 4 + service test: ONE provider call against the
+  resolved series-master id (cache-first via `recurringEventId`, provider
+  `getEvent` fallback), plus cached-occurrence purge.
+- *Multi-account `grantId + calendarId` isolation is preserved* — service test
+  "series scope deletes the master once and purges cached occurrences,
+  preserving other accounts" (foreign-grant rows survive the purge).
+- *DST correctness* — `recurrence.test.ts` expands a daily-9am rule across the
+  2026-03-08 spring-forward and 2026-11-01 fall-back (America/New_York):
+  local wall-clock time holds, exactly one occurrence per local day; expected
+  instants independently verified against `Intl.DateTimeFormat`.
+  COUNT/UNTIL termination and weekly/monthly next-occurrence covered.
+
+## Required evidence not applicable
+
+- **Video walkthrough / before-after screenshots (desktop + mobile)** —
+  N/A: no UI surface changed; this is an action/service/contract change. The
+  user-visible surface is chat replies, which are captured verbatim (grounded
+  reply text) in `live-llm-trajectory.json`.
+- **Live Google Calendar API round-trip** — N/A in this environment: no
+  `GOOGLE_CALENDAR_ACCESS_TOKEN` available. The provider seam is covered by
+  the recorded-wire contract tests (`google-calendar-connector.contract.test.ts`
+  pattern, extended in `plugins/plugin-google/src/index.test.ts`) and the
+  existing live drift lane `google-calendar-connector.real.test.ts`
+  (post-merge, token-gated) exercises `mapEvent` against the real API,
+  including the new `recurrence`/`recurringEventId` fields.
+- **Audio** — N/A: no voice path touched.

.github/issue-evidence/10721-calendar-rrule/fail-without-fix.txt

@@ -0,0 +1,25 @@
+     × normalizes recurrence to the provider and surfaces it on readback 34ms
+     × rejects invalid recurrence fail-closed — no provider call, no one-off event 7ms
+     × rejects recurring creates on the Apple Calendar path 6ms
+     × series scope through an occurrence id patches the cached series master 6ms
+     × series scope for an uncached id resolves the master via the provider 4ms
+     × recurrence lines imply a series edit and reach the provider patch 5ms
+     × rejects recurrence lines with instance scope (rules are series-level) 5ms
+     × rejects an invalid recurrenceScope fail-closed 5ms
+     × series scope deletes the master once and purges cached occurrences, preserving other accounts 7ms
+     × rejects an invalid recurrenceScope fail-closed 6ms
+     × recurrence failures are CalendarServiceError instances 7ms
+     × ambiguous intent → clarification, and nothing is updated 22ms
+     × "just this" phrasing → patches only the addressed occurrence 5ms
+     × "whole series" phrasing → one series-scoped patch 4ms
+     × explicit recurrenceScope detail wins without special phrasing 3ms
+     × a recurrence-rule change is implicitly a series edit 4ms
+     × ambiguous intent → clarification, and nothing is deleted 2ms
+     × "just this" phrasing → deletes only the addressed occurrence 2ms
+     × "whole series" phrasing → exactly one series-scoped delete call 2ms
+     × explicit eventId path forwards a structured recurrenceScope 2ms
+     × carries structured RRULE recurrence into the create request 4ms
+     × accepts recurrence via the rrule alias detail key 3ms
+⎯⎯⎯⎯⎯⎯ Failed Tests 22 ⎯⎯⎯⎯⎯⎯⎯
+ Test Files  2 failed (2)
+      Tests  22 failed | 5 passed (27)