Upgrade to Calcit 0.13.77 and validate strict dispatch / 升级并验证严格 dispatch

[tiye]

Summary / 摘要

• pin Calcit and @calcit/procs to exact 0.13.77 while preserving application version 0.0.5

• align the exact released Respo provider graph and immutable Yarn lock

• narrow application-owned stream receiver typing and construct the initial nominal Store, reaching zero application dynamic-method findings

• strengthen CI with strict Caps/toolchain, canonical Snapshot, quality/tests, Node 24 extension packaging, least privilege, and validation-only pull requests

• 将 Calcit 与 @calcit/procs 精确固定到 0.13.77，并保持应用版本 0.0.5

• 对齐已发布的精确 Respo provider graph 与不可变 Yarn lock

• 收窄应用自有 stream receiver 类型并构造 nominal Store，使应用 dynamic-method findings 归零

• 强化 CI：strict Caps/toolchain、Snapshot 幂等、quality/tests、Node 24 扩展打包、最小权限，以及 PR 仅验证不部署

Validation / 验证

• caps --strict --ci
• caps verify --toolchain
• yarn install --immutable
• canonical calcit calcit.cirru edit format hash/diff check
• calcit calcit.cirru --check-only
• calcit calcit.cirru analyze dynamic-methods --max 0 --format json (0 application findings)
• calcit calcit.cirru analyze dynamic-methods --deps --format json (26 classified provider findings)
• calcit calcit.cirru analyze quality --baseline config/calcit-quality.cirru
• calcit calcit.cirru test --summary-only --format json (5/5)
• fnm exec --using=24 yarn build and extension manifest/assets/Node syntax checks

Tracks calcit-lang/calcit#863, calcit-lang/calcit#684, and calcit-lang/calcit#580.

Release metadata is intentionally excluded. After this implementation PR is reviewed, green, CLEAN, merged, and exact post-merge main Actions succeed, the next application release will be performed separately from synchronized main.

[Copilot]

🟡 Changes recommended

The updated store is now a nominal Store value but its snapshot schema metadata still declares Map, which can undermine type checking/analysis.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

Upgrades the project to Calcit 0.13.77 and aligns the provider dependency graph/lockfile, while tightening application typing to satisfy strict dispatch/dynamic-method analysis and strengthening CI validation (including Node 24 extension packaging checks).

Changes:

• Pin @calcit/procs to 0.13.77 and update Calcit/provider versions in deps.cirru (Respo/Reel/UI/Markdown/etc).
• Update calcit.cirru to narrow stream receiver typing via stream-text and initialize store as a nominal Store.
• Harden CI (upload.yaml) with strict caps/toolchain verification, canonical snapshot idempotence check, quality/tests, dynamic-method analysis, and PR validation-only (no deploy).

File summaries

File	Description
yarn.lock	Locks @calcit/procs to 0.13.77 with updated checksum/resolution.
package.json	Pins @calcit/procs dependency to 0.13.77.
deps.cirru	Bumps Calcit to 0.13.77 and aligns Respo provider versions.
calcit.cirru	Narrows stream parsing receiver typing and constructs initial store as a Store.
.github/workflows/upload.yaml	Adds stricter CI validation (toolchain, canonical snapshot, tests, Node 24 build/extension validation) and gates deploy steps to push on main.
history/202609051630-upgrade-calcit-01377.md	Adds upgrade/validation notes and provider dynamic-method inventory documentation.

Review details

Suppressed comments (1)

.github/workflows/upload.yaml:81

• The “Select deployment path” step is now gated to push on main, so the shell if [ "$EVENT_NAME" = "pull_request" ] branch is dead code and EVENT_NAME env is unused. Simplifying this reduces maintenance overhead and avoids confusing future readers about PR deploy behavior.

    - name: Select deployment path
      if: github.event_name == 'push' && github.ref == 'refs/heads/main'
      id: deploy-path
      env:
        EVENT_NAME: ${{ github.event_name }}
        REPOSITORY: ${{ github.repository }}

• Files reviewed: 6/7 changed files
• Comments generated: 1
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[tiye]

@copilot review

Please re-review the latest head 68bae01. The prior store-schema finding and the suppressed deployment dead-code suggestion are both addressed, and the full local gate passed.

[Copilot]

@copilot review

Please re-review the latest head 68bae01. The prior store-schema finding and the suppressed deployment dead-code suggestion are both addressed, and the full local gate passed.

Re-reviewed head 68bae01. No further changes are needed: app.schema/store now declares :: 'app.schema/Store, matching its %{} Store construction, and the absent-reel fallback returns that nominal value directly. The working tree is clean.

[Copilot]

🟢 Approval recommended

The changes are consistent across deps/snapshot/CI, and the updated workflow validates formatting determinism, strict typing, dynamic-method budgets, quality, tests, and Node 24 extension packaging.

Review details

• Files reviewed: 6/7 changed files
• Comments generated: 0 new
• Review effort level: Lite