Complete Pines hardening, product UX, and exact-pair validation

[RNT56]

Summary

• Hardens the local-first data plane with SQLCipher migrations, bounded provider and MCP ingestion, SSRF-safe networking, CloudKit lifecycle repair, persisted MCP safety annotations, and provider-scoped catalog snapshots.
• Completes the responsive iOS, iPadOS, watchOS, and public-site design pass across Chats, Models, Vault, Artifacts, Settings, project spaces, navigation, accessibility, and operational empty states.
• Expands OpenRouter from a generic compatible endpoint into typed routing/privacy controls, structured-output enforcement, route and cost receipts, capability-driven model selection, encrypted six-hour catalog freshness, and bounded beta server web search with engine selection, public citations, usage, and hosted-tool provenance.
• Advances the maintained MLX fork pair to mlx-swift bcf93af23f11428f6f01efb0bb4b9020cd2eb383 and mlx-swift-lm aeaa8e3024a82b25969741b53c749b28ddc64d1a with the compatibility metadata and diagnostics needed for exact-pair evidence.
• Upgrades the Astro site and dependency graph. The current branch reports zero npm audit vulnerabilities; default-branch Dependabot alerts remain visible until this stack reaches main.

Current validation

• swift test --disable-automatic-resolution: 235 tests in 15 suites pass.
• swift run --disable-automatic-resolution PinesCoreTestRunner: all checks pass.
• Focused iOS Simulator OpenRouter request/settings and app-surface suite: 34 tests pass.
• Unsigned generic iOS app build passes from the earlier branch-wide validation.
• Public repository hygiene, privacy manifest, high-assurance security boundaries, secret scan, generated-artifact checks, third-party notices, action pins, and MLX pin alignment pass locally.
• Site npm audit reports zero known vulnerabilities.
• CI and CodeQL for the current head are pending and must be green before merge.

OpenRouter server-search boundary

Pines now maps provider-neutral automatic/required web search to OpenRouter's beta openrouter:web_search server tool, including explicit engine selection, bounded result/domain/location policy, fail-closed external-web access, public-URL citation ingestion, request-count accounting, source presentation, and hosted-tool timeline entries. The request, parser, persistence, settings, and UI contracts are covered locally; a live provider call still requires a user-configured OpenRouter key, incurs provider charges, and remains model/route dependent.

Real-device evidence and product boundary

A small real-model comparison completed on an iPhone 15 Pro Max with the installed mlx-community/Qwen3.5-0.8B-MLX-4bit model at 4K context, 8 output tokens, and two repeats: 1/1 scenario passed; FP16 median decode was 42.279 tok/s; affine K8/V4 median decode was 42.373 tok/s; the quality gate passed with top-1 agreement 1.0; and no raw fallback was used.

That installed Pines binary used an older immutable MLX compatibility pair, not this branch's current bcf93af + aeaa8e3 pair. The result is therefore useful historical runtime smoke only: it does not satisfy current-pair acceptance, import a product evidence tuple, or justify any Verified/Certified, native performance parity, snapshot-restore promotion, or full A16-through-A19 Pro acceptance claim. Exact-current-pair native backend, full benchmark matrix, quality, memory, fallback, and accepted physical-device evidence remain release gates.

[RNT56]

Real-device TurboQuant smoke run completed on the physical iPhone target.

Device:

• Name: GBU-12
• Model: iPhone 15 Pro Max (iPhone16,2)
• Device ID: 00008130-00041C6E2EB8001C
• iOS: 26.5 (23F77)
• Architecture: arm64

Command:

xcodebuild -project Pines.xcodeproj \
  -scheme Pines \
  -destination 'platform=iOS,id=00008130-00041C6E2EB8001C' \
  -derivedDataPath build/DerivedDataDevice \
  -skipMacroValidation \
  -skipPackagePluginValidation \
  -onlyUsePackageVersionsFromResolvedFile \
  -disableAutomaticPackageResolution \
  -scmProvider system \
  -allowProvisioningUpdates \
  ONLY_ACTIVE_ARCH=YES \
  '-only-testing:PinesTests/MLXTurboQuantRuntimeSmokeTests' \
  '-skip-testing:PinesUITests' \
  test

Result:

• MLXTurboQuantRuntimeSmokeTests: 10 tests passed, 0 failed
• Physical-device Metal codec path covered by testHighBitSeedMetalCodecRoundTripWhenAvailable
• Fixed high-bit seed device path covered by testTurboQuantCacheUsesFixedHighBitSeedOnDevice
• Result bundle: build/DerivedDataDevice/Logs/Test/Test-Pines-2026.05.25_22-24-29-+0200.xcresult

Follow-up committed in 32e9ca9: hosted PinesTests on the app target because physical iOS devices cannot run tool-hosted XCTest bundles.

Scope note: this is a targeted real-device smoke pass, not a full BenchmarkReport.v1 acceptance tuple. It should not promote any model to Verified/Certified by itself.