chore: capture current state and polish GitHub surface

.gitignore

@@ -60,6 +60,7 @@ evals/results/verification-baseline/
 .codex/
 .claude/
 .cursor/
+.continue/
 .gemini/
 .kilo/
 /.codacy/
@@ -72,6 +73,7 @@ evals/results/verification-baseline/
 /docs/agent/
 /plan.md
 /status.md
+/WIP.md
 /AUDIT*.md
 /CODEBASE_AUDIT*.md
 /PLAN*.md
@@ -117,3 +119,7 @@ id_ed25519.*
 /.netrc
 /.npmrc
 /.pypirc
+/.repowise/
+/.mcp.json
+/work-in-progress/
+/wip/

AGENTS.md

@@ -47,3 +47,81 @@
 Evaluator fixtures, judge code, policies, Git history, remotes, secrets, and
 publication surfaces remain outside model-controlled mutation. Follow
 `SECURITY.md` for private vulnerability reporting.
+
+<!-- REPOWISE_AGENTS:START — Do not edit below this line. Auto-generated by Repowise. -->
+## Codebase Intelligence for rae (Repowise)
+
+Indexed by [Repowise](https://repowise.dev). Last indexed: 2026-08-03 (commit 3d4982e). Confidence: 100%.
+The MCP tools below serve pre-verified docs, symbols, history, and health from that index. Every response carries `_meta` freshness fields; a `stale_warning` appears only when a file the response actually serves changed after indexing, so silence means current.
+
+### How to work in this repo
+
+- **Pre-edit phase** (locate, understand, assess) is where these tools win: `get_answer` for how/where/why, `search_codebase` to find, `get_context` for a file's map, `get_risk` before touching a hotspot.
+- **Edit phase**: reading a file before you edit it is correct and expected. Use these tools to decide *which* files to read and edit, not to replace that read.
+- **Noisy commands** (tests, builds, `git log`/`diff`, searches, listings): prefer `repowise distill <cmd>`, the same command with its exit code preserved and errors-first compact output. A `[repowise#<ref>: N lines omitted]` marker is fully recoverable via `repowise expand <ref>` (add `-q <regex>` to filter); never re-run the command to see omitted output.
+
+### Trust protocol
+
+- `verified: true` means the served bytes were checked against the live tree. Never follow it with a re-read of the same lines.
+- `get_answer` at `confidence: "high"` or `grounding: "extracted"` is content-grounded: cite it directly. `symbol_bodies`, `quotes`, and `code_rationale` entries are live source, so use them instead of opening the file.
+- The **only** re-read triggers: `bounds: "approximate"`, `_meta.stale_warning`, `search_method: "bm25"`, `confidence: "low"`. `index_behind: true` alone is informational; the served content is unaffected by the drift.
+- Not valid reasons to re-read: "just to be safe", "to see full context" (use the skeleton or a range read), "the file might have changed" (`verified` already checked).
+- For exhaustive literal sweeps (rename every call site) plain text search is unbeatable, so use it. Reach for `get_context(include=["callers"])` when you need the `callers_total`/`callers_truncated` honesty signal instead of a maybe-incomplete grep.
+
+### Tools
+
+| Tool | When and why |
+|------|--------------|
+| `get_answer(question)` | First call for any how / where / why question. `confidence: "high"` or `grounding: "extracted"` is content-grounded — cite it directly. When the question names an indexed symbol, `symbol_bodies` carries its full live body (skip the `get_symbol` follow-up). Low confidence returns `best_guesses` with one-line justifications plus `code_rationale` (rationale comments mined live from candidate source). |
+| `get_context(targets=[...])` | Triage card for files/modules/symbols: summary, signatures, `symbol_id`s, `hotspot` bit. File targets auto-serve a `verified` skeleton (every signature at a fraction of a full Read); `mostly_full` marks files where Read costs little more. Batch targets in one call. Opt-in blocks: `include=["callers"|"callees"|"ownership"|"decisions"|"metrics"]`. |
+| `get_symbol(id)` | One verified body: `"path.py::Name"` (indexed symbol), `"path.py:140-180"` (live range read), or `"repowise#<hex>"` (omission ref). Source arrives in Read's numbered format — treat it as an already-performed Read. `truncated` responses carry a `continuation` naming the exact next range; ambiguous ids return every match in `candidates`. Index misses fall back to live-grep `fallback_lines`. |
+| `search_codebase(query)` | Hybrid search, auto-routed by query shape: identifier → symbol hits (pipe `symbol_id` into `get_symbol`), path → file pages, prose → wiki-semantic. Force with `mode=symbol|path|concept|hybrid`. Concept hits carry a `sources` list; a hit whose sources are `[fts]` only is a keyword match with no semantic agreement — verify it. |
+| `get_why(query, targets?)` | Why the code is shaped this way: decision records with evidence and supersession lineage, falling back to git archaeology and `code_rationale` comments. Call before refactors or pattern divergences. |
+| `get_risk(targets, changed_files?)` | What history says about touching these files: churn, owners, co-change partners, blast radius. PR mode (`changed_files`) leads with a `directive` block — read `will_break` / `missing_cochanges` / `missing_tests` / `tests_to_run` first. `tests_to_run` is coverage-backed (the tests the per-test map proves exercise the changed files); empty means unknown, never no tests. To score a whole commit or diff range instead, use `get_change_risk`. |
+| `get_change_risk(revspec, extensions?, exclude_patterns?)` | Pre-merge defect score for a whole commit or `base..head` range, computed from its diff shape on the live checkout (no index, no LLM). Lead with `risk_percentile` (this change ranked against sampled recent commits), summarized by `review_priority` and `classification`; `score` / `probability` / `level` are the corpus-calibrated fallback. Distinct from `get_risk`, which scores indexed files by path. A `warning` field flags an empty diff (bad revspec or over-tight extension / exclusion filters). |
+| `get_health(targets?, include?)` | Health scores + findings on three dimensions (defect / maintainability / performance). Self-check the files you touched before finishing; `include=["biomarkers"|"refactoring"|"signals"]` for depth. |
+| `get_dead_code()` | Confidence-tiered unreachable files / unused exports / zombie packages. For cleanup sweeps, not targeted fixes. |
+| `get_overview()` | Architecture map + tool recipes. Call once, first, in an unfamiliar repo; skip it after that. |
+
+**Compose them:** low-confidence `get_answer` then read `best_guesses[0].file`; `get_context` shows `hotspot: true` then `get_risk` before editing; `decision_records` titles then `get_why(targets=[...])`; PR review then `get_risk(targets, changed_files)` and read `directive` first. A `tombstone` error means the file moved, so follow `successor_paths`.
+
+### Architecture
+I’m using the RepoWise codebase-exploration workflow to ground the overview in the indexed architecture, then I’ll verify the maintained entry-point documentation and source contracts. RepoWise’s indexed overview call was unavailable in this session, so I’m falling back to the repository’s maintained documentation and narrowly scoped source reads, as the exploration workflow prescribes. RAE consumes repository-change tasks, committed Git state, validated workflow and policy definitions, and optional local graph context; processes them through isolated-worktree orchestration, typed agent and control nodes, schema gates, human checkpoints, verification, and bounded repair; and produces repository changes, immutable run artifacts, traces, benchmark evidence, and release-readiness reports for human review. RAE, or Reliable Agentic Engineering, is a source-distributed toolkit for controlled repository maintenance, autonomous code changes, audit and repair loops, and evaluation.
+
+### Key modules
+- `packages/orchestration/scripts/pipeline/lib` — The pipeline execution-services layer consumes validated workflow contracts, configured agent invocations, autonomous runtime actions, and…
+- `evals/scripts/lib` — The outcome-evaluation layer consumes trusted judge cases, candidate-runner argument vectors, trace resources, RAE execution evidence…
+- `packages/orchestration/operator` — The Pipeline Operator Console is the local operator-facing application layer: it consumes authenticated requests, project and run data…
+- `packages/orchestration/skills/dev-tools/multi-model-review/src` — The multi-model review orchestration layer consumes validated tool input and normalized findings from review-model adapters, then produces…
+- `packages/orchestration/scripts` — The validation and evaluation support layer consumes runner manifests, command-line arguments, evaluation task sets, autonomous policy…
+- `packages/orchestration/scripts/pipeline` — The autonomous pipeline control layer consumes pipeline invocations, workflow contracts and proposals, repository and artifact evidence…
+- `packages/orchestration/skills/dev-tools/quality-gate/src` — The quality-gate evaluation layer is a deterministic decision boundary: it consumes tool input, artifacts, workspace-contained schemas, and…
+- `packages/orchestration/skills/dev-tools/trace-collector/src` — The trace collection and profiling boundary consumes validated trace requests, pipeline event data, profile mutations, and repository…
+- `evals/scripts` — The evaluation-harness operations layer consumes umbrella task specifications, sealed evidence, benchmark inputs, judge-calibration data…
+- `packages/orchestration/skills/dev-tools/_shared/src` — The Safe Developer Tool Runtime is the shared execution boundary for development tools: it consumes schema-governed input and…
+
+### Entry points
+- `packages/orchestration/operator/server.mjs`
+- `packages/orchestration/operator/static/app.js`
+
+### Files that need care (bug-fix history first, then churn — check `get_risk` before editing)
+- `evals/tests/test_benchmark_contracts_core_d.py` — 4 bug fixes, last fix 5 days ago (bug magnet); 7 commits/90d
+- `evals/scripts/common.py` — 4 bug fixes, last fix 5 days ago (bug magnet); 7 commits/90d
+- `packages/orchestration/skills/dev-tools/_shared/src/path-safety-helpers.ts` — 4 bug fixes, last fix 5 days ago (bug magnet); 4 commits/90d
+- `packages/orchestration/skills/dev-tools/trace-collector/tests/unit/trace.test.ts` — 4 bug fixes, last fix 5 days ago (bug magnet); 5 commits/90d
+- `evals/scripts/lib/release_gate_core.py` — 4 bug fixes, last fix 5 days ago (bug magnet); 5 commits/90d
+
+### Code health
+Three co-equal signals: defect risk 8.74/10 avg, hotspot health 6.55/10 (stable), worst `packages/orchestration/scripts/pipeline/lib/runtime-state-guard.mjs` at 3.74/10 · maintainability 9.41/10 · performance risk 195 open static I/O-in-loop / N+1 findings. Detail: `get_health()`.
+
+Critical files:
+- `packages/orchestration/scripts/verify.sh` — change entropy — impact −2.6
+- `evals/tests/test_benchmark_contracts_core_b.py` — prior defect — impact −2.0
+- `evals/tests/test_benchmark_contracts_core_c.py` — prior defect — impact −2.0
+- `packages/orchestration/scripts/lib/argv.mjs` — prior defect — impact −2.0
+- `packages/orchestration/scripts/pipeline/lib/commands.mjs` — prior defect — impact −2.0
+
+### Commands
+- Lint: `ruff check .`
+
+<!-- REPOWISE_AGENTS:END -->

DESIGN.md

@@ -13,3 +13,7 @@ The workflow editor extends that system as a visual systems map:
 Canvas dragging is optional and never the only authoring path. Standard controls retain native keyboard behavior. Focus indicators remain visible, status is communicated with words and symbols as well as color, and motion is removed when the user requests reduced motion. Responsive layouts preserve the registry, editor, and validation order at narrow widths.
 
 This register describes the implemented design intent. It makes no formal accessibility-conformance claim.
+
+The experimental hosted platform has no implemented public console or hosted
+product interface. Its current surface is a JSON HTTP and MCP compatibility
+boundary; it does not extend the operator console's visual system.

PRODUCT.md

@@ -1,18 +1,34 @@
 # Product register
 
-RAE is a source-distributed toolkit for bounded repository change, repair, and evaluation. Its supported autonomous provider is Codex. It operates on a committed Git repository in an isolated worktree by default and does not commit, push, publish, deploy, or promote workflow revisions.
+RAE is a source-distributed toolkit for bounded repository change, repair, and
+evaluation. Codex is the default autonomous executor. OpenCode is available
+only through an explicit route and the documented macOS containment backend.
+RAE operates on a committed Git repository in an isolated worktree by default
+and does not commit, push, publish, deploy, or promote workflow revisions.
 
 The graph-native runtime treats a versioned workflow as executable policy. Requirements, design criticism, planning, alignment, mutation, verification, and repair are arbitrary typed nodes rather than a fixed phase list. Each run owns an immutable workflow snapshot, node guidance, payload contracts, attempt envelopes, trace order, and evidence references. Existing v1 run requests remain linear when resumed.
 
 The operator is a loopback-only, bearer-authenticated local console. It is used to inspect runs, resolve checkpoints, stop or resume owned work, and author future workflow revisions. Active runs cannot be edited. Workflow activation is an attributed human decision that affects future runs only.
 
 The improvement campaign is evaluator-owned. It compares bounded workflow policy and topology candidates against frozen development and held-out matrices, records append-only lineage, and emits a recommendation. It never activates a candidate.
 
+The experimental hosted-platform source is a separate control-plane and worker
+slice. It stores control-plane state in PostgreSQL, protects routes with OIDC,
+uses fenced worker leases, and can verify S3-compatible artifacts. The local
+operator can proxy allowlisted remote routes, but the platform is not wired to
+the umbrella CLI and it has no production
+deployment or external integration evidence. Workflow 2.2 is likewise an
+experimental local wait-and-signal contract. Its bounded context assembly does
+not support a context-efficiency claim until the required 25 percent comparison
+is recorded.
+
 Primary users are maintainers who need inspectable repository automation, explicit ownership, conservative mutation, reproducible evidence, and human control over publication and policy changes.
 
 Product boundaries:
 
 - Runtime code, judges, fixtures, safety invariants, provider selection, model selection, tools, commands, and promotion rules are not candidate-editable.
 - Context graph memory is separately opt-in with `--graph-memory` and cannot authorize mutation.
-- The supported execution sandbox is the repository's documented macOS evaluator backend. Unsupported hosts fail closed where that boundary applies.
+- OpenCode writes require the macOS Seatbelt backend and an isolated worktree.
+  Codex retains its documented workspace sandbox requirements. Unsupported
+  hosts fail closed where the selected boundary applies.
 - Local evidence is not publication or release evidence.