Centralize plugin state and filesystem paths in the SDK

.github/workflows/ci.yml

@@ -1,270 +1,61 @@
-name: ci
+name: qualification
 
 on:
   push:
     branches: [main]
   pull_request:
 
-# A new push to the same PR (or to main) supersedes the run in flight;
-# stop paying for the old one. release.yml deliberately does not cancel.
 concurrency:
-  group: ci-${{ github.event.pull_request.number || github.ref }}
+  group: qualify-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
 
-env:
-  FUSE_T_VERSION: 1.2.7
-  CARGO_TERM_COLOR: always
-  # acyclic-fs is fetched from its own git repo (see Cargo.toml); cargo's
-  # built-in libgit2 fetcher can't resolve a pinned commit SHA that isn't a
-  # branch tip on that host, so delegate to the system git CLI instead.
-  CARGO_NET_GIT_FETCH_WITH_CLI: true
+permissions:
+  contents: read
 
 jobs:
-  # Three cheap jobs (changes, deny, lint) run in parallel; the expensive
-  # test matrix (FUSE-T install, release build, acceptance suite on two
-  # OSes) only starts once deny and lint pass, so a formatting slip or a
-  # banned crate is reported in about a minute instead of after a full
-  # matrix run — and it is skipped outright when nothing that could change
-  # a test result was touched.
-
-  # Which parts of the tree a change touches. A job-level filter rather
-  # than a workflow-level `paths-ignore` because branch protection on main
-  # requires the `test (...)` checks: a workflow that never runs leaves
-  # them "expected" forever and blocks the merge, whereas a job skipped by
-  # `if:` reports as skipped, which counts as passing.
-  changes:
-    runs-on: ubuntu-24.04
-    # paths-filter lists a PR's files through the API; the default token
-    # here is read-only on contents and nothing else.
-    permissions:
-      contents: read
-      pull-requests: read
-    outputs:
-      code: ${{ steps.filter.outputs.code }}
-    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-        with:
-          persist-credentials: false
-          # On a push to main the filter diffs against the pre-push commit,
-          # which a depth-1 checkout does not have.
-          fetch-depth: 0
-      - id: filter
-        uses: dorny/paths-filter@ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d # v4.0.3
-        with:
-          # "some file changed that is not docs/prose": a negation-only list
-          # matches nothing, so the positive `**` is required, and
-          # some-with-excludes makes the negations apply to it.
-          predicate-quantifier: some-with-excludes
-          filters: |
-            code:
-              - '**'
-              - '!**/*.md'
-              - '!docs/**'
-              - '!LICENSE'
-              - '!.github/CODEOWNERS'
-
-  # Licenses, advisories, and sources per deny.toml. Keeps the published
-  # SBOM inside the permissive allowlist and fails on known-vulnerable or
-  # yanked crates. Always runs: the secrets scan applies to docs too.
-  deny:
-    runs-on: ubuntu-24.04
-    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-        with:
-          persist-credentials: false
-      - name: Product name is single-sourced (product.toml)
-        run: bash scripts/check-product-name.sh
-      - name: No forbidden files or credential patterns
-        run: bash scripts/check-no-secrets.sh
-      - name: Code quality (line width, TODO format, comment blocks, duplication)
-        run: bash scripts/check-code-quality.sh
-      - uses: EmbarkStudios/cargo-deny-action@3c6349835b2b7b196a839186cb8b78e02f7b5f25 # v2.1.1
-        with:
-          command: check
-          arguments: --locked
-          log-level: warn
-
-  # Formatting and lint. Fast and toolchain-only (no FUSE-T needed).
-  lint:
-    runs-on: ubuntu-24.04
-    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-        with:
-          persist-credentials: false
-      - name: Install toolchain
-        run: |
-          rustup toolchain install stable --profile minimal --component rustfmt --component clippy
-          rustup default stable
-      - name: Cache cargo
-        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
-        with:
-          path: |
-            ~/.cargo/registry
-            ~/.cargo/git
-            target
-          key: lint-cargo-${{ hashFiles('Cargo.lock') }}
-      - name: cargo fmt --check
-        run: cargo fmt --all --check
-      - name: cargo clippy
-        run: cargo clippy --workspace --all-targets --all-features -- -D warnings
-
-  # Line coverage of the unit and integration tests, as a job summary and
-  # an lcov artifact, with a floor so a change can't quietly delete tests.
-  # The daemon, client, and MCP server are exercised by the acceptance
-  # scripts rather than `cargo test`, so they read as 0% here; raise the
-  # floor as unit coverage of those grows, not by counting the scripts.
-  coverage:
-    needs: [changes, deny, lint]
-    if: needs.changes.outputs.code == 'true'
-    runs-on: ubuntu-24.04
-    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-        with:
-          persist-credentials: false
-      - name: Install toolchain
-        run: |
-          rustup toolchain install stable --profile minimal --component llvm-tools-preview
-          rustup default stable
-      - uses: taiki-e/install-action@3f74d7c16a4242f1c95561e98edc25d36adb4375 # v2.87.12
-        with:
-          tool: cargo-llvm-cov
-      - name: Cache cargo
-        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
-        with:
-          path: |
-            ~/.cargo/registry
-            ~/.cargo/git
-            target
-          key: coverage-cargo-${{ hashFiles('Cargo.lock') }}
-      - name: cargo llvm-cov
-        run: |
-          cargo llvm-cov --workspace --all-features --lcov --output-path lcov.info --fail-under-lines 48
-          {
-            echo '## Test coverage (lines)'
-            echo '```'
-            cargo llvm-cov report --summary-only
-            echo '```'
-          } >> "$GITHUB_STEP_SUMMARY"
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: lcov
-          path: lcov.info
-
-  # Windows, which nothing else in this file covers. The lint job runs on
-  # Linux, so every `#[cfg(windows)]` block in the tree is invisible to it —
-  # a Windows-only arm can stop compiling and no other check notices. This
-  # job builds and lints those arms, runs the workspace tests, and drives
-  # the parts of the product whose behaviour genuinely differs there
-  # (named-pipe transport, UTF-16LE names, renaming the repo root, copy
-  # forks). The POSIX acceptance suite is not run: it assumes mount tooling,
-  # symlinks and modes that Windows does not have.
-  windows:
-    needs: [changes, deny, lint]
-    if: >-
-      always()
-      && needs.deny.result == 'success'
-      && needs.lint.result == 'success'
-      && (needs.changes.result != 'success' || needs.changes.outputs.code == 'true')
-    runs-on: windows-2022
-    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-        with:
-          persist-credentials: false
-
-      - name: Install toolchain
-        run: |
-          rustup toolchain install stable --profile minimal --component rustfmt --component clippy
-          rustup default stable
-
-      - name: Cache cargo
-        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
-        with:
-          path: |
-            ~/.cargo/registry
-            ~/.cargo/git
-            target
-          key: windows-cargo-${{ hashFiles('Cargo.lock') }}
-
-      - name: cargo fmt --check
-        run: cargo fmt --all --check
-
-      # The point of the job: lint the cfg(windows) arms the Linux lint job
-      # never compiles.
-      - name: cargo clippy
-        run: cargo clippy --workspace --all-targets --all-features -- -D warnings
-
-      - name: Unit and integration tests
-        run: cargo test --workspace
-
-      - name: Release build
-        run: cargo build --release --locked -p acyclic
-
-      - name: Windows end-to-end smoke
-        shell: bash
-        env:
-          ACYCLIC_BIN: ${{ github.workspace }}/target/release/acyclic.exe
-        run: bash tests/acceptance/windows-smoke.sh
-
-  test:
-    needs: [changes, deny, lint]
-    # Fail closed: run when the change filter says code moved, and also
-    # when the filter job itself failed (an empty output must not read as
-    # "nothing to test", since a skipped required check counts as passing).
-    # deny and lint failing still skip this job; those are required checks
-    # in their own right, so the PR stays red.
-    if: >-
-      always()
-      && needs.deny.result == 'success'
-      && needs.lint.result == 'success'
-      && (needs.changes.result != 'success' || needs.changes.outputs.code == 'true')
+  qualify:
     strategy:
       fail-fast: false
       matrix:
-        os: [macos-14, ubuntu-24.04]
+        os: [ubuntu-24.04, windows-2022, macos-14]
     runs-on: ${{ matrix.os }}
+    timeout-minutes: 20
     steps:
       - name: Checkout plugin
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
-          path: graphcoder-plugin
-
-      - name: Install FUSE-T (macOS)
+          path: worktrees/graphcoder/plugin-sdk-lab
+          persist-credentials: false
+      - name: Checkout SDK
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          repository: acyclic-labs/sdk
+          ref: codex/generation-reader
+          path: sdk
+          persist-credentials: false
+      - name: Install FUSE-T on macOS
         if: runner.os == 'macOS'
+        shell: bash
         run: |
-          set -euo pipefail
           curl --fail --location --retry 5 \
-            "https://github.com/macos-fuse-t/fuse-t/releases/download/${FUSE_T_VERSION}/fuse-t-macos-installer-${FUSE_T_VERSION}.pkg" \
+            https://github.com/macos-fuse-t/fuse-t/releases/download/1.2.7/fuse-t-macos-installer-1.2.7.pkg \
             --output /tmp/fuse-t.pkg
           sudo installer -pkg /tmp/fuse-t.pkg -target /
-          test -d /usr/local/include/fuse3
-
-      - name: Install toolchain
-        run: rustup toolchain install stable --profile minimal && rustup default stable
-
-      - name: Cache cargo
+      - name: Install Bun
+        uses: oven-sh/setup-bun@735343b667d3e6f658f44d0eca948eb6282f2b76 # v2.0.2
+        with:
+          bun-version: 1.3.14
+      - name: Cache immutable dependencies and build outputs
         uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
         with:
           path: |
             ~/.cargo/registry
             ~/.cargo/git
-            graphcoder-plugin/target
-          key: ${{ matrix.os }}-cargo-${{ hashFiles('graphcoder-plugin/Cargo.lock') }}
-
-      - name: Unit and integration tests
-        working-directory: graphcoder-plugin
-        run: cargo test --workspace
-
-      - name: Release build (acceptance + latency gate run against it)
-        working-directory: graphcoder-plugin
-        run: cargo build --release
-
-      - name: Acceptance suite
-        working-directory: graphcoder-plugin
-        env:
-          ACYCLIC_BIN: ${{ github.workspace }}/graphcoder-plugin/target/release/acyclic
-          ACYCLIC_QUAL: ${{ github.workspace }}/graphcoder-plugin/target/release/acyclic-qual
-          # Smaller corpus keeps CI wall-clock sane; the budget is unchanged.
-          ACYCLIC_LAT_FILES: "5000"
-          ACYCLIC_LAT_MB: "64"
-          ACYCLIC_SOAK_ROUNDS: "30"
-        run: bash tests/acceptance/run-all.sh
+            ~/.bun/install/cache
+            sdk/target-*
+          key: qualify-${{ matrix.os }}-${{ hashFiles('sdk/Cargo.lock', 'sdk/bun.lock', 'sdk/rust/**/*.rs', 'sdk/typescript/**/*.ts', 'worktrees/graphcoder/plugin-sdk-lab/Cargo.lock', 'worktrees/graphcoder/plugin-sdk-lab/crates/**/*.rs') }}
+          restore-keys: |
+            qualify-${{ matrix.os }}-
+      - name: Run the shared bounded gate
+        shell: pwsh
+        run: python sdk/scripts/qualify-local.py --plugin-root worktrees/graphcoder/plugin-sdk-lab

CHANGELOG.md

@@ -9,6 +9,15 @@ Pre-1.0; `main` is the only supported line (see `SECURITY.md`).
 
 ### Changed
 
+- **The unfinished session-shadowing feature was removed.** It depended on
+  replacing the live repository with a native mount, was not wired into host
+  approval flows, and could not work consistently across platforms. Existing
+  `dry_run` configuration is now rejected; explicit forks remain available.
+  Before replacing the old binary, use that binary to stop every daemon with
+  an active shadow mount. A new protocol-v2 CLI cannot stop a protocol-v1
+  daemon. If the old daemon already crashed, recover the real tree with
+  `fusermount3 -u <repo>` (or `fusermount -u <repo>`) on Linux, or
+  `umount -f <repo>` (then `diskutil unmount force <repo>` if needed) on macOS.
 - **A cold daemon no longer delays the agent's first turn.** The session-start
   hook waits at most 300ms for the daemon; past that it prints a one-line
   notice and returns while the first snapshot builds in the background (251s
@@ -19,8 +28,8 @@ Pre-1.0; `main` is the only supported line (see `SECURITY.md`).
   O(tree) (7s per fork and 6s per promote on 5,000 files); it now runs on the
   existing idle and every-N timers, like every other checkpoint. A fork is cut
   at its exact base generation, published or not.
-- **The daemon exits after an hour idle** with no session, fork, or Safe Mode
-  session (`daemon_idle_exit_ms`, 0 disables). Twenty daemons were found alive
+- **The daemon exits after an hour idle** with no session or fork
+  (`daemon_idle_exit_ms`, 0 disables). Twenty daemons were found alive
   on one machine, eleven for repos that no longer existed.
 - `acyclic status` reports the store size from a cache refreshed in the
   background instead of walking the object directory on every call.
@@ -79,8 +88,6 @@ were 0.0.1. Host coverage, Speculation and Windows are what this release adds.
   the conversation, not just by commit.
 - **Forks** (Launch 3) — copy-on-write materialization for running parallel attempts, with
   promotion back via three-way merge.
-- **Safe Mode** (Launch 4) — session redirection and interposition so agent mistakes land in a
-  redirected session rather than the working tree; needs the native mount layer.
 - **Speculation** — the daemon computes what the agent is about to ask for while nobody is
   waiting: the previous-session brief when a session ends, and (optionally, with a model
   command the developer names) a summary of each turn at the turn boundary. Results are keyed
@@ -91,10 +98,10 @@ were 0.0.1. Host coverage, Speculation and Windows are what this release adds.
 - Published to npm as `@acyclic-labs/plugin`.
 - **Windows x64 support** — the daemon transport gains a named-pipe implementation alongside the
   Unix domain socket, and host names are encoded per platform (UTF-16LE on Windows) so capture,
-  diff, exclusions and the Safe Mode guard agree with the filesystem. Verified on Windows 11 and
-  covered by a `windows-2022` CI job. Two caveats: forks are always full copies there (ProjFS
-  projects a fork but does not carry writes back, so a mounted fork would silently lose work) and
-  Safe Mode needs a real mount, so it is unavailable. See `docs/windows-verification.md`.
+  diff, exclusions and guarded fork paths agree with the filesystem. Verified on Windows 11 and
+  covered by a `windows-2022` CI job. Forks use full copies there because ProjFS projects a fork
+  but does not carry writes back, so a mounted fork would silently lose work. See
+  `docs/windows-verification.md`.
 
 ### Fixed
 

CONTRIBUTING.md

@@ -13,7 +13,7 @@ Acceptance suites (end-to-end, run against a real repo) live in `tests/acceptanc
 tests/acceptance/run-all.sh
 ```
 
-Individual suites (`journey.sh`, `timeline.sh`, `forks.sh`, `merge.sh`, `safe-mode.sh`, etc.) can
+Individual suites (`journey.sh`, `timeline.sh`, `forks.sh`, `merge.sh`, etc.) can
 be run with `bash tests/acceptance/<suite>.sh` if you're iterating on one feature.
 
 The `*-e2e.sh` suites drive the real host CLIs (Claude Code, Codex, cursor-agent, OpenCode) and
@@ -76,7 +76,7 @@ guards what those can't express. The rules, and why each exists:
 - **No lossy `as` casts** between integer widths or signs (`cast_possible_truncation`,
   `cast_sign_loss`, `cast_possible_wrap`, `cast_precision_loss`, `cast_lossless`). Use
   `u64::from`, `i64::try_from(x).unwrap_or(i64::MAX)`, or an `allow` that says why the value
-  is in range. `acyclic_engine::unix_now()` and `short_hex()` exist so the two most common
+  is in range. `acyclic::unix_now()` and `short_hex()` exist so the two most common
   cases are written once.
 - **Closed sets are enums, not strings.** Anything the CLI parses or the wire carries with a
   fixed vocabulary — checkpoint kinds, hook events, host names, restore actions, diff change
@@ -100,13 +100,13 @@ guards what those can't express. The rules, and why each exists:
 The public product name is defined once, in `product.toml`, and threaded through everywhere else:
 `product::NAME` in Rust, `scripts/product.sh` in shell. Never hardcode the name as a literal
 string or path in source — `scripts/check-product-name.sh` fails CI if it drifts. Crate names
-(`acyclic`, `acyclic-engine`, `acyclic-proto`, `acyclic-qual`) are internal identifiers and are
+(`acyclic`, `acyclic-qual`) are internal identifiers and are
 exempt from this check.
 
 ## Design context
 
 `docs/design/` has the design docs and implementation notes behind the bigger features (Rewind,
-Timeline, Forks, Safe Mode). Worth a skim before working on any of them — they capture the
+Timeline, Forks). Worth a skim before working on any of them — they capture the
 tradeoffs and constraints that shaped the current architecture, including a few (like snapshot
 GC) that are intentionally deferred.