Add aps: Swift CLI dogfooding AppState

.attest.json

@@ -0,0 +1,6 @@
+{
+  "requireAttestation": false,
+  "requireTestsPassed": false,
+  "requireSignature": false,
+  "requireHumanApprovalWhenVerdictAtLeast": "block"
+}

.augur.toml

@@ -0,0 +1,3 @@
+[thresholds]
+review = 35
+block = 65

.github/workflows/ci.yml

@@ -0,0 +1,35 @@
+name: CI
+
+# Private repo: run on macOS self-hosted runners (not GitHub-hosted).
+# Revisit before making the repository public: fork PRs must not run on
+# self-hosted hosts.
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+  workflow_dispatch:
+
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
+
+permissions:
+  contents: read
+
+jobs:
+  build-test-smoke:
+    runs-on: [self-hosted, macOS]
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@v4
+      - name: Swift version
+        run: swift --version
+      - name: Build (release)
+        run: swift build -c release
+      - name: Test
+        run: swift test
+      - name: Smoke CLI
+        env:
+          APS_BIN: .build/release/aps
+        run: ./Scripts/smoke.sh

.github/workflows/trust.yml

@@ -0,0 +1,77 @@
+name: Trust
+
+# Private repo: CorvidLabs trust gate on macOS self-hosted runners.
+# SpecSync pin is 5.1.1 via Trust v1.0.1 + a runner-temp file:// mirror
+# (non-default SpecSync versions cannot use the remote GitHub download path).
+# Revisit before making the repository public: fork PRs must not run on
+# self-hosted hosts.
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  trust:
+    runs-on: [self-hosted, macOS]
+    timeout-minutes: 45
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v4.1.6
+        with:
+          fetch-depth: 0
+
+      - name: Fetch attest notes
+        run: git fetch origin "+refs/notes/attest:refs/notes/attest" 2>/dev/null || true
+
+      # actions/checkout embeds a token in origin; Trust then treats the worktree
+      # as external and refuses event-derived ranges. Pass the canonical range
+      # explicitly while keeping credentials for private-repo note fetches.
+      - name: Resolve Trust comparison range
+        id: trust_range
+        run: |
+          set -euo pipefail
+          if [ "${{ github.event_name }}" = "pull_request" ]; then
+            echo "range=${{ github.event.pull_request.base.sha }}..${{ github.event.pull_request.head.sha }}" >> "$GITHUB_OUTPUT"
+          elif [ -z "${{ github.event.before }}" ] || [ "${{ github.event.before }}" = "0000000000000000000000000000000000000000" ]; then
+            empty="$(git hash-object -t tree /dev/null)"
+            echo "range=${empty}..${{ github.sha }}" >> "$GITHUB_OUTPUT"
+          else
+            echo "range=${{ github.event.before }}..${{ github.sha }}" >> "$GITHUB_OUTPUT"
+          fi
+
+      # Trust rejects remote download overrides for non-default SpecSync versions.
+      # Stage the 5.1.1 release archives under RUNNER_TEMP for an authority-free
+      # file:// mirror (platform archive + adjacent .sha256).
+      - name: Prepare SpecSync 5.1.1 local mirror
+        id: specsync_mirror
+        run: |
+          set -euo pipefail
+          VERSION="5.1.1"
+          MIRROR="${RUNNER_TEMP}/specsync-${VERSION}-mirror"
+          mkdir -p "$MIRROR"
+          BASE="https://github.com/CorvidLabs/spec-sync/releases/download/v${VERSION}"
+          for asset in \
+            specsync-macos-aarch64.tar.gz \
+            specsync-macos-x86_64.tar.gz
+          do
+            curl -fsSL "${BASE}/${asset}" -o "${MIRROR}/${asset}"
+            curl -fsSL "${BASE}/${asset}.sha256" -o "${MIRROR}/${asset}.sha256"
+            (cd "$MIRROR" && shasum -a 256 -c "${asset}.sha256")
+          done
+          echo "path=${MIRROR}" >> "$GITHUB_OUTPUT"
+
+      - name: CorvidLabs Trust gate
+        id: trust
+        uses: CorvidLabs/trust@c8f969a12209575877b5eca1ec557431621381e0 # v1.0.1
+        with:
+          range: ${{ steps.trust_range.outputs.range }}
+          specsync-version: "5.1.1"
+          specsync-download-base-url: file://${{ steps.specsync_mirror.outputs.path }}
+
+      - name: Check managed agent rules
+        run: |
+          grep -q "CorvidLabs trust toolchain: BEGIN" AGENTS.md
+          grep -q "CorvidLabs trust toolchain: END" AGENTS.md

.gitignore

@@ -0,0 +1,14 @@
+.DS_Store
+/.build
+/.swiftpm
+/*.xcodeproj
+xcuserdata/
+DerivedData/
+.swiftpm/configuration/registries.json
+.swiftpm/xcode/package.xcworkspace/contents.xcworkspacedata
+.netrc
+*.swp
+*~
+
+# CorvidLabs trust toolchain
+augur.json

.specsync/.gitignore

@@ -0,0 +1,5 @@
+cache/
+change.lock
+hashes.json
+*.local
+# Local SpecSync caches / working files

.specsync/change-sequence.json

@@ -0,0 +1,6 @@
+{
+  "schema_version": 1,
+  "sequence": 2,
+  "id": "CHG-0002-fix-filestate-watch-cache-and-path-isolation-from-review",
+  "acknowledged_collisions": []
+}