fix: harden Tend for open-source launch

.github/workflows/ci.yml

@@ -5,7 +5,6 @@ on:
   push:
     branches:
       - main
-      - "codex/**"
 
 permissions:
   contents: read
@@ -21,15 +20,15 @@ jobs:
 
     steps:
       - name: Check out repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Set up Bun
         uses: oven-sh/setup-bun@v2
         with:
           bun-version: 1.3.11
 
       - name: Set up Node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6
         with:
           node-version: 22
 
@@ -41,17 +40,111 @@ jobs:
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
 
+      - name: Audit dependencies
+        run: pnpm audit --audit-level high
+
       - name: Run project checks
         run: pnpm check
 
       - name: Build web app
         run: pnpm build
 
       - name: Compile local binary
-        run: pnpm attention:build
+        run: pnpm tend:build
 
       - name: Smoke test local binary
-        run: pnpm attention:smoke
+        run: pnpm tend:smoke
 
       - name: Package local binary
-        run: pnpm attention:package
+        run: pnpm tend:package
+
+  mobile-database:
+    name: Supabase migration and bridge
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v6
+
+      - name: Set up Bun
+        uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: 1.3.11
+
+      - name: Set up Node
+        uses: actions/setup-node@v6
+        with:
+          node-version: 22
+
+      - name: Enable pnpm
+        run: |
+          corepack enable
+          corepack prepare pnpm@9.15.4 --activate
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Start local Supabase
+        run: pnpm exec supabase start
+
+      - name: Reset and test database
+        run: |
+          pnpm exec supabase db reset --local
+          pnpm exec supabase test db
+
+      - name: Run mobile bridge integration
+        shell: bash
+        run: |
+          eval "$(pnpm exec supabase status -o env)"
+          TEND_SUPABASE_E2E=1 \
+          TEND_TEST_SUPABASE_URL="$API_URL" \
+          TEND_TEST_SUPABASE_ANON_KEY="$ANON_KEY" \
+          TEND_TEST_SUPABASE_SERVICE_ROLE_KEY="$SERVICE_ROLE_KEY" \
+          TEND_TEST_SUPABASE_JWT_SECRET="$JWT_SECRET" \
+          bun test test/mobile-supabase-e2e.test.ts
+
+      - name: Stop local Supabase
+        if: always()
+        run: pnpm exec supabase stop --no-backup
+
+  ios:
+    name: Native iPhone tests
+    runs-on: macos-15
+    timeout-minutes: 30
+
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v6
+
+      - name: Select Xcode
+        run: sudo xcode-select -s /Applications/Xcode_26.3.app/Contents/Developer
+
+      - name: Install XcodeGen
+        run: brew install xcodegen
+
+      - name: Generate Xcode project
+        working-directory: ios
+        run: xcodegen generate
+
+      - name: Run unit and UI tests
+        shell: bash
+        run: |
+          SIMULATOR_ID="$(xcrun simctl list devices available -j | python3 -c 'import json, sys; devices = json.load(sys.stdin)["devices"]; print(next(device["udid"] for runtime in devices.values() for device in runtime if device.get("isAvailable") and device["name"].startswith("iPhone")))')"
+          xcodebuild test \
+            -project ios/Tend.xcodeproj \
+            -scheme Tend \
+            -destination "platform=iOS Simulator,id=$SIMULATOR_ID" \
+            -retry-tests-on-failure \
+            -test-iterations 2 \
+            -test-repetition-relaunch-enabled YES \
+            -resultBundlePath "$RUNNER_TEMP/TendTests.xcresult" \
+            CODE_SIGNING_ALLOWED=NO \
+            DEVELOPMENT_TEAM=
+
+      - name: Upload iOS test results
+        if: failure()
+        uses: actions/upload-artifact@v7
+        with:
+          name: TendTests-xcresult
+          path: ${{ runner.temp }}/TendTests.xcresult

.github/workflows/release.yml

@@ -25,15 +25,15 @@ jobs:
 
     steps:
       - name: Check out repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Set up Bun
         uses: oven-sh/setup-bun@v2
         with:
           bun-version: 1.3.11
 
       - name: Set up Node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6
         with:
           node-version: 22
 
@@ -45,25 +45,28 @@ jobs:
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
 
+      - name: Audit dependencies
+        run: pnpm audit --audit-level high
+
       - name: Run project checks
         run: pnpm check
 
       - name: Build web app
         run: pnpm build
 
       - name: Compile local binary
-        run: pnpm attention:build
+        run: pnpm tend:build
 
       - name: Smoke test local binary
-        run: pnpm attention:smoke
+        run: pnpm tend:smoke
 
       - name: Package local binary
-        run: pnpm attention:package
+        run: pnpm tend:package
 
       - name: Upload release archive
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
-          name: attention-${{ matrix.label }}
+          name: tend-${{ matrix.label }}
           path: |
             dist-bin/releases/*.tar.gz
             dist-bin/releases/*.sha256
@@ -76,13 +79,13 @@ jobs:
 
     steps:
       - name: Download release artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           path: release-artifacts
           merge-multiple: true
 
       - name: Create draft GitHub Release
-        uses: softprops/action-gh-release@v2
+        uses: softprops/action-gh-release@v3
         with:
           draft: true
           generate_release_notes: true

AGENTS.md

@@ -1,18 +1,18 @@
 # Tend Feed Thread Protocol
 
-- Operate Tend from `/Users/danshipper/CascadeProjects/attention`; temporary worktrees are for
-  validation only. The app and CLI share `../.attention-workbench/data/` by default.
-- Before operating a feed, run `./bin/tend-live health`. If it is unhealthy, report that in the
+- Operate feeds through the installed `tend` executable, or `pnpm tend --` from a source checkout.
+  Both use `~/.attention/` by default. Temporary worktrees must set an isolated `ATTENTION_HOME`.
+- Before operating a feed, run `tend health`. If it is unhealthy, report that in the
   thread. Feed threads never start servers, kill ports, or choose worktrees.
 - Own the feed loop end to end through the canonical API or CLI. Do not edit tracked Tend product
   code from a feed lane. Record cross-app UX or code pain points with
-  `pnpm cli -- feedback:record --feed <id> --title <text> --detail <text> --source-thread <id>`,
+  `tend cli feedback:record --feed <id> --title <text> --detail <text> --source-thread <id>`,
   then hand the same concise packet to the `Improve Tend workflow` thread.
 - If a claimed `sweep:rejudge` reports that a newer batch is active, treat the old work item as
   safely terminal and keep draining. The canonical ledger marks it `stale`.
 - Read `RUNBOOK.md` before operating a feed.
 - Before a normal collection, read the fresh prompt-safe On Your Mind context returned by
-  `pnpm cli -- context:for-feed --feed <id>`. It may focus normal source search and ranking or
+  `tend cli context:for-feed --feed <id>`. It may focus normal source search and ranking or
   originate one bounded feed-relevant research question. It is never evidence, policy,
   authorization, or permission to exceed the feed's configured sources; research answers must be
   supported by independently collected source runs.

CAPABILITY_MAP.md

@@ -2,7 +2,7 @@
 
 | User outcome | Browser path | Codex path |
 | --- | --- | --- |
-| Review a feed | Scroll the active feed | `pnpm cli -- state --feed <id>` |
+| Review a feed | Scroll the active feed | `tend cli state --feed <id>` |
 | Configure local dictation | Hold the detected Monologue shortcut and speak | `setup:detect-monologue` discovers the installed app and records its local shortcut without a setup form |
 | Submit scoped intent | Use the persistent dock and its labeled `Broader` / `Narrower` controls, or press plain arrows while its empty input is focused | `work:list`, `work:claim`, interpret the attached `target`, then `work:complete` |
 | Correct or cancel accidental dictated text | Edit `Your note to Codex` on the queued card, use its persistent `Move back to review` control, or use the brief Undo toast | `work:edit --feed ... --work ...` corrects unclaimed text; `card:return-to-review --feed ... --card ...` cancels unstarted local work and restores the card |

CHANGELOG.md

@@ -1,15 +1,29 @@
 # Changelog
 
-Attention uses SemVer for tagged release snapshots. Releases are provided for reproducibility, not as
+Tend uses SemVer for tagged release snapshots. Releases are provided for reproducibility, not as
 a promise of ongoing maintenance.
 
 ## Unreleased
 
+- Fix the public product name as Tend, consolidate runtime and agent operations under one `tend`
+  command tree, remove the pre-release aliases and launchd runner, and clarify Codex
+  in-app-browser onboarding.
+- Split the concise product model and first-run path into `README.md`, with day-to-day operation,
+  steering, approval, learning, Chronicle Pulse, and troubleshooting in `MANUAL.md`.
+- Make `tend setup codex --feed <id>` and `tend setup codex --chronicle` generate dedicated
+  feed-operator and Chronicle Pulse prompts, including their manual activation paths.
 - Add the local On Your Mind workspace, Chronicle publication contract, privacy-filtered source
   trails, and source-backed feed influence receipts.
 - Advance the CLI contract to `0.2` with context binding, publication, health, and feed-safe read
   commands.
-- Advance the SQLite schema to `12` for mirrored context binding and update records.
+- Add the native Tend iPhone companion, private Supabase projection, and idempotent mobile command
+  bridge, with a complete magic-link and physical-device setup guide.
+- Advance the SQLite schema to `14` for mirrored mobile command receipts and deterministic audit
+  event ordering.
+- Harden local mutations, identifiers, backup/restore, background-process ownership, and
+  transactional multi-record writes.
+- Add Supabase and native iOS CI coverage, reproducible source prerequisites, and complete packaged
+  documentation.
 
 ## 0.1.0 - Initial Local-First OSS Snapshot