Sync upstream silo-server main (~925 commits, API v2)

.agents/skills/unslop/SKILL.md

@@ -0,0 +1,30 @@
+---
+name: unslop
+description: Rewrite prose to remove AI-sounding patterns while preserving meaning, evidence, citations, terminology, uncertainty, and the intended tone. Use when the user says "unslop", asks to make writing sound human or less AI-generated, or when another workflow explicitly requests a final prose pass for a human-facing issue, pull request, Discord reply, document, or status update. Do not apply to code, logs, quoted text, exact commands, or machine-readable contracts.
+---
+
+# Unslop
+
+Make the writing sound like a thoughtful person wrote it. Protect accuracy before style.
+
+## Preserve the contract
+
+- Keep the meaning, factual claims, citations, uncertainty, and scope unchanged.
+- Keep exact quotations, code, commands, identifiers, API names, log text, and contractual language exact.
+- Do not invent personality, opinions, anecdotes, confidence, or informality that the author did not supply.
+- Do not remove a hedge that communicates a real evidence limit.
+- Match the audience. A Discord reply, architecture note, and incident report should not share one voice.
+
+## Rewrite
+
+1. Identify the audience, purpose, and expected tone from context.
+2. Read [references/patterns.md](references/patterns.md).
+3. Cut filler, generic framing, repetition, and promotional puffery. Preserve substantive claims; style editing is not fact-checking or permission to delete them. Removing a restatement of material the reader already has, such as a diff or a code comment, is not deleting a claim.
+4. Replace vague language with the concrete fact, mechanism, number, or action when the source supports it.
+5. Prefer plain words and active voice. Keep necessary domain terminology consistent rather than cycling synonyms.
+6. Vary sentence length naturally. Use formatting only when it makes the content easier to scan.
+7. Read the result once as the intended recipient. Fix anything that still sounds templated, promotional, overeager, or sterile.
+
+## Respond
+
+When asked to rewrite, return the revised text only unless the user asks for commentary or alternatives. When asked to review rather than rewrite, identify the highest-impact problems and provide a proposed revision.

.agents/skills/unslop/references/patterns.md

@@ -0,0 +1,40 @@
+# Writing patterns
+
+Use this as a diagnostic list, not as a mechanical ban list. Preserve a construction when it is the clearest accurate choice.
+
+## Cut or replace
+
+- Empty praise, promotional adjectives, and grand claims.
+- Stock openings and closers such as "Certainly", "Great question", "I hope this helps", and "Let me know if".
+- Vague attribution such as "experts say" when no source is named.
+- Generic framing that previews the answer instead of giving it.
+- Forced groups of three, false ranges, and symmetrical "not only X but Y" constructions.
+- Repeated bold labels that merely restate the sentence that follows.
+- Abstract metaphors where a concrete engineering term exists.
+- Dense sentences that make the reader backtrack.
+- Adverbs that stand in for a measurement or stronger verb.
+- Synonym cycling. Give one concept one name.
+- Private vocabulary: names the writer coined while working that the reader has never seen. Use the established name or plain words.
+- Restating what the reader already has, such as the diff, a linked issue, or code comments.
+- Process narrative: how the writer got to the answer, when the reader needs only the answer and its evidence.
+
+## Prefer
+
+- The answer or outcome first.
+- Specific actors and mechanisms.
+- Measured change over adjectives such as "significant".
+- Plain words such as "use", "help", and "if".
+- Sentence-case headings and restrained formatting.
+- A concise plain-English explanation before policy or implementation detail when both matter.
+- Honest uncertainty where the evidence is incomplete.
+
+## Final audit
+
+Ask:
+
+1. Could this paragraph appear unchanged in an unrelated project? If so, make it specific or cut it.
+2. Would a reader who was not part of the work understand the first paragraph? If not, rewrite it in plain words.
+3. Did style editing alter a fact, quote, citation, or confidence level? Restore it.
+4. Does the text sound polished but anonymous? Add the author's actual judgment only when context supplies it.
+5. Did punctuation or formatting become a visible mannerism? Simplify it.
+

.dockerignore

@@ -14,6 +14,7 @@ web/docs
 # Authoring-only plates (~231MB). Vite already omits them from dist; excluding
 # them from the build context avoids shipping them into every Docker build.
 web/public/images/collection-templates/raw
+web/assets-source
 silo
 streamapp
 *.md

.env.example

@@ -40,7 +40,9 @@ POSTGRES_SHM_SIZE=8gb
 # Optional Meilisearch service. Generate a key, uncomment it, then start the
 # search profile with: docker compose --profile search up -d
 # MEILI_MASTER_KEY=replace-with-output-of-openssl-rand-hex-32
-# MEILISEARCH_IMAGE=getmeili/meilisearch:latest
+# MEILISEARCH_IMAGE=getmeili/meilisearch:v1.54.0
+# Set for one start after changing MEILISEARCH_IMAGE, then remove it.
+# MEILI_UPGRADE_DB=true
 # MEILISEARCH_HOST=127.0.0.1
 # MEILISEARCH_PORT=7700
 
@@ -80,7 +82,6 @@ POSTGRES_SHM_SIZE=8gb
 # SECRET_KEY=replace-with-output-of-openssl-rand-base64-48
 
 # Optional public URL for Prairie. If not set, the server will use the IP address of the container.
-# PRAIRIE_PUBLIC_URL=https://prairie.example.com
 
 # Optional trusted reverse-proxy CIDRs for client IP resolution. When set, this
 # overrides the "Trusted Proxies" admin setting on every startup (the value is
@@ -105,3 +106,16 @@ POSTGRES_SHM_SIZE=8gb
 # Optional server mode override for source runs or standalone worker nodes.
 # MODE=integrated
 #PRAIRIE_MIGRATE_TIMEOUT=60m
+
+# Optional local profiling in every serving process; disabled when empty.
+# Use literal loopback addresses only. Container loopback is accessible from
+# the container's network namespace; do not publish or proxy this port.
+# PRAIRIE_DEBUG_LISTEN=127.0.0.1:6060
+# Optional Prometheus metrics listener; disabled when empty. Keep it on a
+# private monitoring network because the endpoint has no application auth.
+# PRAIRIE_METRICS_LISTEN=127.0.0.1:9091
+# Contention sampling requires the listener and a restart; both default to 0.
+# Block rate is the average blocked nanoseconds per sample: 1000000..1000000000.
+# PRAIRIE_DEBUG_BLOCK_RATE=10000000
+# Mutex fraction samples one in N contention events: 100..1000000.
+# PRAIRIE_DEBUG_MUTEX_FRACTION=100

.github/ISSUE_TEMPLATE/bug-report.yml

@@ -70,6 +70,13 @@ body:
     attributes:
       label: Technical notes
       description: Optional suspected root cause, relevant files, SQL output, or stack traces. Keep this separate from the observed reproduction above.
+  - type: input
+    id: ai-harness
+    attributes:
+      label: AI harness
+      description: Enter the exact agent harness or application, or "none".
+    validations:
+      required: true
   - type: input
     id: ai-tools
     attributes:
@@ -95,6 +102,13 @@ body:
         - Fully AI-generated, human verified
     validations:
       required: true
+  - type: textarea
+    id: ai-review
+    attributes:
+      label: Independent or adversarial review
+      description: Summarize the scope, method, findings, and resolutions, or enter "n/a" when this issue does not require independent or adversarial review.
+    validations:
+      required: true
   - type: checkboxes
     id: confirmations
     attributes:

.github/ISSUE_TEMPLATE/v1-capability-proposal.yml

@@ -9,7 +9,9 @@ body:
         One proposal per **user-facing capability** (e.g. "Manga library type", "Transcoded playback"),
         not per PR or per endpoint. Locked capabilities are what the client teams plan against —
         the **API surface** section is mandatory for a capability to be lockable.
-        Scope state and lock rules: `docs/architecture/v1-scope.md`.
+        Capability scope state and lock rules: `docs/architecture/v1-scope.md`.
+        New API surface targets `/api/v2`, Silo 1.0's stable native contract; `/api/v1` is frozen
+        and takes no new capability work. Contract rules: `docs/architecture/api-contract.md`.
   - type: textarea
     id: summary
     attributes:
@@ -29,12 +31,12 @@ body:
     attributes:
       label: API surface
       description: >
-        Endpoints/payloads clients will call (method + path + notable request/response fields).
-        Plain list now; OpenAPI pointers once the #135 tooling lands. A capability cannot be
-        Locked without this section filled in.
+        Operations clients will call (method + path + operation ID + notable request/response
+        fields), under `/api/v2`. Point at `contracts/api/v2/openapi.json` where the operation
+        already exists. A capability cannot be Locked without this section filled in.
       placeholder: |
-        GET  /api/v1/manga/{seriesId}/chapters — list chapters (id, index, volume, read_state)
-        POST /api/v1/watch-progress — records reading progress (existing endpoint, new item type)
+        GET  /api/v2/manga/{series_id}/chapters (listMangaChapters) — chapters (id, index, volume, read_state)
+        POST /api/v2/sync/progress (syncProgress) — records reading progress (existing operation, new item type)
     validations:
       required: true
   - type: textarea
@@ -54,6 +56,13 @@ body:
         - L
     validations:
       required: true
+  - type: input
+    id: ai-harness
+    attributes:
+      label: AI harness
+      description: Enter the exact agent harness or application, or "none".
+    validations:
+      required: true
   - type: input
     id: ai-tools
     attributes:
@@ -79,3 +88,10 @@ body:
         - Fully AI-generated, human verified
     validations:
       required: true
+  - type: textarea
+    id: ai-review
+    attributes:
+      label: Independent or adversarial review
+      description: Summarize the scope, method, findings, and resolutions, or enter "n/a" when this issue does not require independent or adversarial review.
+    validations:
+      required: true

.github/PULL_REQUEST_TEMPLATE.md

@@ -1,31 +1,54 @@
+<!-- Follow "Write the description" in CONTRIBUTING.md: plain summary first, no restated
+diff, no working history. Agents: then apply .agents/skills/unslop/SKILL.md to the
+title and body before posting. -->
+
 ## Problem
 
+Closes #NNN
+<!-- One "Closes #NNN" line per issue this change fully resolves, so GitHub closes it
+when the PR merges into main. Use "Closes Silo-Server/<repo>#NNN" for an issue in
+another repository. Delete the line when the PR only partly addresses an issue. -->
 Related issue: #NNN
-<!-- Use "Related issue: N/A — narrow fix" only when no prior coordination was needed. -->
+<!-- An epic, sub-issue, or partly addressed issue this work serves and that should
+stay open, or "N/A". An open issue is not required — the Problem section below must
+stand on its own. -->
+Validation tasks: #NNN C1
+<!-- Until 1.0 ships: v1.0 board tasks and cases this change unblocks or changes
+(see "1.0 validation" in AGENTS.md), e.g. "unblocks #1144 C3; changes #1200 C1".
+Write "none" when no validation task is affected. -->
 
-What user or maintainer problem does this solve?
+A short plain-language summary: what goes wrong, who it affects, and what this
+change does about it. Details come after.
 
 ## Approach
 
-Why this approach? Note alternatives or tradeoffs worth knowing about.
+What changed and why this way. Mention an alternative only if a reviewer would ask
+about it. Do not walk through the diff.
 
 ## Validation
 
-Paste the actual commands and results. Name anything not run or not passing.
-Include screenshots or recordings for visible UI changes.
+One line per kind of check and its result; do not list tests by name. Name required
+checks that were not run or did not pass. Include a short output excerpt only when it
+explains a failure.
+<!-- Do not include private domains, hostnames, IPs, Tailscale or Report Shelf URLs,
+local paths, credentials, personal data, or private media details. Attach screenshots
+or recordings only when the user explicitly requests them. A maintainer may end this
+section with `Evidence: https://evidence.siloserver.org/r/<repo>/<topic>/`; that page
+requires Silo-Server organization sign-in. -->
 
 ## Risks
 
 Migration, compatibility, security, or operational impact, or "None identified".
 
+## Checklist
+
+- [ ] I read and can explain the complete diff.
+- [ ] This pull request addresses one concern.
+
 ## AI Disclosure
 
+- Harness: exact agent harness or application, or "none"
 - Tool(s): exact tool name(s), or "none"
 - Model(s): exact model identifier(s) reported by each tool, or "n/a"
 - Involvement: Fully AI-generated, human verified | AI-assisted | Human-written, AI-reviewed | No AI used
-- Adversarial review: scope, method, findings, and resolutions, or "n/a" only when no AI or implementation change was involved
-
-## Checklist
-
-- [ ] I read and can explain the complete diff.
-- [ ] This pull request addresses one concern.
+- Adversarial review: scope, method, findings, and resolutions, or "n/a" when this change does not require independent or adversarial review

.github/actions/setup-go/action.yml

@@ -0,0 +1,64 @@
+name: Set up Go for this repository
+description: >-
+  Installs libvips, the Go toolchain from go.mod, a per-commit build and module
+  cache, and the stub frontend bundle that cmd/prairie embeds.
+
+inputs:
+  cache-name:
+    description: >-
+      Distinguishes the build cache of one job from another's. Jobs compile
+      different things (a lint job type-checks, a test job builds test
+      binaries), so each keeps a cache that matches its own work.
+    required: true
+
+runs:
+  using: composite
+  steps:
+    # github.com/h2non/bimg binds libvips through cgo and pkg-config, so
+    # nothing under ./... compiles without the headers. The Dockerfile
+    # installs the same package in its build stage.
+    - name: Install libvips
+      shell: bash
+      run: |
+        # libvips and its dependencies use the runner's official Ubuntu sources.
+        test -f /etc/apt/sources.list.d/ubuntu.sources
+        apt_options=(
+          -o Dir::Etc::sourcelist=/etc/apt/sources.list.d/ubuntu.sources
+          -o Dir::Etc::sourceparts=-
+        )
+        sudo apt-get "${apt_options[@]}" update
+        sudo apt-get "${apt_options[@]}" install -y --no-install-recommends libvips-dev
+
+    # setup-go's own cache is keyed on go.sum alone and written only on a
+    # miss, so between dependency bumps every run restored a build cache
+    # from weeks ago and recompiled the tree. The cache below is keyed on the
+    # commit and restored by prefix, so each run starts from the newest
+    # cache any earlier run saved.
+    - name: Set up Go
+      uses: actions/setup-go@v6
+      with:
+        go-version-file: go.mod
+        cache: false
+
+    - name: Read the Go version
+      id: go
+      shell: bash
+      run: echo "version=$(go env GOVERSION)" >> "$GITHUB_OUTPUT"
+
+    - name: Restore the Go build and module cache
+      uses: actions/cache@v4
+      with:
+        path: |
+          ~/.cache/go-build
+          ~/go/pkg/mod
+        key: go-${{ inputs.cache-name }}-${{ runner.os }}-${{ steps.go.outputs.version }}-${{ hashFiles('go.sum') }}-${{ github.sha }}
+        restore-keys: |
+          go-${{ inputs.cache-name }}-${{ runner.os }}-${{ steps.go.outputs.version }}-${{ hashFiles('go.sum') }}-
+          go-${{ inputs.cache-name }}-${{ runner.os }}-${{ steps.go.outputs.version }}-
+
+    # cmd/prairie embeds the built frontend, so nothing under ./... compiles
+    # without web/dist. The Go jobs never serve it, so a placeholder is
+    # enough; the Docker workflow builds the real bundle.
+    - name: Stub the embedded frontend bundle
+      shell: bash
+      run: make embed-stub