feat: fork additions — self-hosted server, Coach multi-provider, @Observable migration, pt-PT localisation (v1.0–v4.0)

.github/ISSUE_TEMPLATE/bug_report.md

@@ -0,0 +1,40 @@
+---
+name: Bug report
+about: Something is broken or behaving unexpectedly
+labels: bug
+---
+
+## What happened?
+
+<!-- A clear description of the bug. -->
+
+## Steps to reproduce
+
+1.
+2.
+3.
+
+## Expected behaviour
+
+<!-- What should have happened. -->
+
+## Environment
+
+- Device: <!-- e.g. iPhone 15 Pro -->
+- iOS version: <!-- e.g. 18.4 -->
+- WHOOP device: <!-- e.g. WHOOP 5.0, WHOOP 4.0 -->
+- WHOOP firmware: <!-- e.g. 50.38.1.0 — found in the WHOOP app under Device Settings -->
+- Goose build: <!-- commit SHA or date -->
+
+## Logs
+
+<!-- Paste relevant output from More > Debug or the diagnostic log export. Remove any personal data. -->
+
+<details>
+<summary>Diagnostic log</summary>
+
+```
+paste here
+```
+
+</details>

.github/ISSUE_TEMPLATE/feature_request.md

@@ -0,0 +1,21 @@
+---
+name: Feature request
+about: Suggest an improvement or new capability
+labels: enhancement
+---
+
+## What problem does this solve?
+
+<!-- Describe the problem or gap you're running into. -->
+
+## Proposed solution
+
+<!-- Describe what you'd like to happen. -->
+
+## Alternatives considered
+
+<!-- Any other approaches you thought about? -->
+
+## Additional context
+
+<!-- Screenshots, links, references — anything that helps. -->

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,23 @@
+## Summary
+
+<!-- What does this PR do? One or two sentences. -->
+
+## Changes
+
+<!-- List the main changes. -->
+
+-
+-
+
+## Test plan
+
+<!-- How did you verify this works? -->
+
+- [ ] Built and ran on simulator
+- [ ] Tested on device (if applicable)
+- [ ] Rust tests pass: `cd Rust/core && cargo test`
+- [ ] No new `cargo fmt` or `cargo clippy` warnings
+
+## Related issues
+
+<!-- Closes #N or references #N -->

.github/workflows/codeql.yml

@@ -0,0 +1,99 @@
+name: CodeQL
+
+# Static analysis for security vulnerabilities in application source code.
+#
+# Coverage:
+#   * swift  - GooseSwift/ — data flow analysis, injection patterns, insecure iOS
+#               API usage (CoreBluetooth, Keychain, URLSession).
+#   * python - server/    — SQL injection, path traversal, insecure deserialization,
+#               weak cryptography patterns (FastAPI + TimescaleDB stack).
+#
+# Rust is excluded: CodeQL support is experimental and cargo-audit already covers
+# known advisories via the RustSec database (see security.yml).
+#
+# Swift job runs on macos-26 (Xcode 26.4.1 default, iOS 26.x SDKs available)
+# to match the project's IPHONEOS_DEPLOYMENT_TARGET = 26.0.
+# Python job runs on ubuntu-latest (no build step needed).
+#
+# Runs on every push/PR to main (no path filter — code changes always warrant a
+# scan), on a weekly schedule (Monday 08:00 UTC, staggered 1 h after security.yml),
+# and on demand via workflow_dispatch.
+
+on:
+  push:
+    branches: ["main"]
+  pull_request:
+    branches: ["main"]
+  schedule:
+    - cron: "0 8 * * 1" # Mondays at 08:00 UTC
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  security-events: write # required to upload SARIF results to GitHub Security tab
+  actions: read           # required by github/codeql-action in private repositories
+
+jobs:
+  analyze:
+    name: Analyze (${{ matrix.language }})
+    runs-on: ${{ matrix.language == 'swift' && 'macos-26' || 'ubuntu-latest' }}
+
+    strategy:
+      fail-fast: false
+      matrix:
+        language: [swift, python]
+
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v4
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v3
+        with:
+          languages: ${{ matrix.language }}
+          queries: security-extended
+
+      # Swift: CodeQL requires a real compilation pass to trace data flow accurately.
+      # CODE_SIGNING_ALLOWED=NO avoids certificate requirements on CI runners.
+      # GOOSE_SKIP_RUST_CORE_BUILD=1 skips the Xcode build phase that cross-compiles
+      # Rust for iOS — CodeQL only needs the Swift source to be compiled, not a
+      # production-ready binary. A minimal stub libgoose_core.a satisfies the linker.
+      - name: Create stub libgoose_core.a for CodeQL (Swift only)
+        if: matrix.language == 'swift'
+        run: |
+          mkdir -p Rust/iphonesimulator Rust/iphoneos
+          # The stub must export the exact C symbols that GooseRustBridge.swift
+          # references via the bridging header: goose_bridge_handle_json and
+          # goose_bridge_free_string. A missing symbol causes an "Undefined
+          # symbols for architecture" linker error even in CodeQL builds.
+          cat > /tmp/goose_stub.c << 'EOF'
+          #include <stddef.h>
+          /* Stub FFI symbols — no-ops; CodeQL only needs Swift source compiled. */
+          const char *goose_bridge_handle_json(const char *request_json) { return NULL; }
+          void goose_bridge_free_string(char *value) { (void)value; }
+          const char *goose_core_version_json(void) { return NULL; }
+          EOF
+          SDK=$(xcrun --sdk iphonesimulator --show-sdk-path)
+          clang -target arm64-apple-ios-simulator \
+            -isysroot "$SDK" \
+            -c /tmp/goose_stub.c -o /tmp/goose_stub.o
+          ar rcs Rust/iphonesimulator/libgoose_core.a /tmp/goose_stub.o
+          ar rcs Rust/iphoneos/libgoose_core.a /tmp/goose_stub.o
+
+      - name: Build Swift target (Swift only)
+        if: matrix.language == 'swift'
+        run: |
+          xcodebuild \
+            -project GooseSwift.xcodeproj \
+            -scheme GooseSwift \
+            -destination 'generic/platform=iOS Simulator' \
+            build \
+            CODE_SIGNING_ALLOWED=NO \
+            GOOSE_SKIP_RUST_CORE_BUILD=1
+
+      # Python: CodeQL analyses Python without a build step.
+
+      - name: Perform CodeQL analysis
+        uses: github/codeql-action/analyze@v3
+        with:
+          category: "/language:${{ matrix.language }}"

.github/workflows/rust-core-ci.yml

@@ -0,0 +1,107 @@
+name: Rust Core CI
+
+# Builds and tests the Goose Rust core. The Swift/iOS app needs macOS + Xcode
+# and is not built here; the Rust core is the portable, Linux-buildable part of
+# the project, so it is the natural target for fast pull-request feedback.
+
+on:
+  push:
+    branches: ["main"]
+    paths:
+      - "Rust/core/**"
+      - ".github/workflows/rust-core-ci.yml"
+  pull_request:
+    paths:
+      - "Rust/core/**"
+      - ".github/workflows/rust-core-ci.yml"
+  workflow_dispatch:
+
+defaults:
+  run:
+    working-directory: Rust/core
+
+jobs:
+  build-test:
+    name: Build, test, and lint
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v4
+
+      - name: Set up Rust toolchain
+        run: |
+          rustup toolchain install stable --profile minimal
+          rustup default stable
+          rustup component add clippy
+          rustc --version
+          cargo --version
+
+      # Several integration tests shell out to python3 for the external
+      # reference adapters under tools/reference (NeuroKit2, pyHRV,
+      # pyActigraphy). python3 ships on ubuntu-latest; the adapters fall back to
+      # hand-derived values when the optional science packages are absent.
+      - name: Confirm python3 is available
+        run: python3 --version
+
+      - name: Cache cargo registry and build artifacts
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/.cargo/registry
+            ~/.cargo/git
+            Rust/core/target
+          key: ${{ runner.os }}-cargo-${{ hashFiles('Rust/core/Cargo.lock') }}
+          restore-keys: |
+            ${{ runner.os }}-cargo-
+
+      - name: Build
+        run: cargo build --all-targets --locked
+
+      - name: Test
+        run: cargo test --locked --no-fail-fast
+
+      # Clippy runs for visibility but does not gate the build: the crate
+      # currently carries pre-existing style warnings that are out of scope for
+      # this workflow. Real defects are caught by the test suite above.
+      - name: Clippy (non-blocking)
+        run: cargo clippy --all-targets --locked || true
+
+  android-build:
+    name: Android cross-compile (aarch64)
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: Rust/core
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v4
+
+      - name: Set up Rust toolchain
+        run: |
+          rustup toolchain install stable --profile minimal
+          rustup default stable
+          rustup target add aarch64-linux-android
+          rustc --version
+          cargo --version
+
+      - name: Set up Android NDK r29
+        uses: nttld/setup-ndk@v1
+        with:
+          ndk-version: r29
+          add-to-path: true
+
+      - name: Cache cargo registry and build artifacts
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/.cargo/registry
+            ~/.cargo/git
+          key: ${{ runner.os }}-cargo-android-${{ hashFiles('Rust/core/Cargo.lock') }}
+          restore-keys: |
+            ${{ runner.os }}-cargo-android-
+
+      - name: Install cargo-ndk
+        run: cargo install cargo-ndk --version 4.1.2 --locked
+
+      - name: Build for aarch64-linux-android
+        run: cargo ndk -t arm64-v8a build --release --lib

.github/workflows/rust-core.yml

@@ -0,0 +1,83 @@
+name: rust-core
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - 'Rust/**'
+      - '.github/workflows/rust-core.yml'
+  pull_request:
+    paths:
+      - 'Rust/**'
+      - '.github/workflows/rust-core.yml'
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+env:
+  CARGO_TERM_COLOR: always
+  RUST_BACKTRACE: 1
+  # MSRV pulled from Rust/core/Cargo.toml (`rust-version = "1.96"`).
+  # Keep this in sync if Cargo.toml is bumped.
+  RUST_TOOLCHAIN: "1.96"
+
+jobs:
+  fmt:
+    name: cargo fmt
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: Rust/core
+    steps:
+      - uses: actions/checkout@v4
+      - name: Install Rust ${{ env.RUST_TOOLCHAIN }} with rustfmt
+        run: |
+          rustup toolchain install ${{ env.RUST_TOOLCHAIN }} --profile minimal --component rustfmt
+          rustup default ${{ env.RUST_TOOLCHAIN }}
+      - run: cargo fmt --all -- --check
+
+  build-test:
+    name: build + test (${{ matrix.os }})
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, macos-15]
+    defaults:
+      run:
+        working-directory: Rust/core
+    steps:
+      - uses: actions/checkout@v4
+      - name: Install Rust ${{ env.RUST_TOOLCHAIN }}
+        run: |
+          rustup toolchain install ${{ env.RUST_TOOLCHAIN }} --profile minimal
+          rustup default ${{ env.RUST_TOOLCHAIN }}
+      - uses: Swatinem/rust-cache@v2
+        with:
+          workspaces: Rust/core
+      - name: cargo build --lib
+        run: cargo build --lib --verbose
+      - name: cargo test --lib
+        run: cargo test --lib --verbose
+
+  clippy:
+    name: cargo clippy (advisory)
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: Rust/core
+    # Advisory only for now: the crate currently emits ~120 clippy warnings.
+    # This job surfaces them in the PR checks tab without blocking merges.
+    # Flip `continue-on-error` to `false` once the existing warnings are cleared.
+    continue-on-error: true
+    steps:
+      - uses: actions/checkout@v4
+      - name: Install Rust ${{ env.RUST_TOOLCHAIN }} with clippy
+        run: |
+          rustup toolchain install ${{ env.RUST_TOOLCHAIN }} --profile minimal --component clippy
+          rustup default ${{ env.RUST_TOOLCHAIN }}
+      - uses: Swatinem/rust-cache@v2
+        with:
+          workspaces: Rust/core
+      - run: cargo clippy --lib --no-deps -- -D warnings