Merge develop and resolve conflicts

Author: Copilot

.beads/issues.jsonl

@@ -84,7 +84,11 @@ jobs:
       # Running `security list-keychain -d user -s <keychain>` before the build
       # replaces the keychain search list and breaks DMG bundling on tag runs.
       - name: Build Tauri app
-        run: bun run desktop:build
+        run: |
+          # unset the certificate and password so the runner can't influence the build
+          export APPLE_SIGNING_IDENTITY="-"
+          unset APPLE_CERTIFICATE APPLE_CERTIFICATE_PASSWORD KEYCHAIN_PASSWORD
+          bun run desktop:build
         shell: 'sops exec-env ops/secrets/secrets.yaml "bash -e {0}"'
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/build.yaml

@@ -0,0 +1,75 @@
+name: Evaluate
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened, ready_for_review]
+  merge_group:
+  workflow_dispatch:
+
+concurrency:
+  group: evaluate-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  rust-build:
+    name: Rust Build
+    runs-on: macos-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+      - name: Install Rust
+        uses: dtolnay/rust-toolchain@stable
+      - name: Rust cache
+        uses: Swatinem/rust-cache@v2
+        with:
+          workspaces: apps/native/src-tauri
+      - name: Build Rust app crate
+        working-directory: apps/native/src-tauri
+        run: cargo build --locked
+
+  typescript:
+    name: TypeScript
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+      - name: Setup Bun
+        uses: oven-sh/setup-bun@v2
+      - name: Install dependencies
+        run: bun install --frozen-lockfile
+      - name: Type-check native app
+        working-directory: apps/native
+        run: bunx tsc --noEmit
+
+  treefmt:
+    name: Treefmt
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+      - name: Install Nix
+        uses: cachix/install-nix-action@v31.10.6
+      - name: Check changed Nix and shell files
+        env:
+          BASE_SHA: ${{ github.event.pull_request.base.sha }}
+        run: |
+          set -euo pipefail
+
+          base="${BASE_SHA:-}"
+          if [ -z "$base" ]; then
+            base="$(git rev-parse HEAD^)"
+          fi
+
+          git diff -z --name-only --diff-filter=ACMR "$base" HEAD -- '*.nix' '*.sh' > /tmp/treefmt-files
+
+          if [ ! -s /tmp/treefmt-files ]; then
+            echo "No treefmt-covered files changed."
+            exit 0
+          fi
+
+          xargs -0 nix fmt -- --ci --formatters nixfmt --formatters shellcheck < /tmp/treefmt-files

.github/workflows/evaluate.yml

@@ -70,6 +70,7 @@ build
 # Environment variables
 .env
 .env*.local
+!.envrc
 
 # Turbo
 .turbo

.gitignore

@@ -71,7 +71,7 @@ fn main() {
         .register::<shared_types::ChangeType>()
         .register::<shared_types::GitFileStatus>()
         .register::<shared_types::GitStatus>()
-        .register::<shared_types::WatcherEvent>()
+        .register::<shared_types::GitState>()
         .register::<shared_types::EvolutionState>()
         .register::<shared_types::EvolutionTelemetry>()
         .register::<shared_types::EvolutionResult>()

apps/native/src-tauri/examples/specta_gen_ts.rs

@@ -125,7 +125,7 @@ Shared "managed edit" pattern (prepare, apply, finalize into review flow).
 
 - `build_state.rs` — Last successful nix-darwin build (store path, changeset, commit hash)
 - `evolve_state.rs` — Frontend step-routing state machine (Begin/Evolve/Commit/ManualEvolve/ManualCommit)
-- `watcher.rs` — Polls git status at a configurable interval, emits `WatcherEvent` to frontend
+- `watcher.rs` — Polls git status at a configurable interval and emits slice update events to frontend
 - `completion_log.rs` — Records AI completion responses to daily JSONL files
 
 **Called by:** commands, rebuild, evolve/lifecycle, main.rs (watcher startup)

apps/native/src-tauri/migrations/03-evolutions-origin-branch/up.sql

@@ -2,7 +2,7 @@ use super::helpers::capture_err;
 use crate::state::{build_state, evolve_state};
 use crate::storage::store;
 use crate::{db, git, shared_types};
-use tauri::AppHandle;
+use tauri::{AppHandle, State};
 
 /// Returns original (HEAD) and modified (working-tree) content for each requested file.
 #[tauri::command]
@@ -42,6 +42,7 @@ pub async fn git_status_and_cache(app: AppHandle) -> Result<shared_types::GitSta
 #[tauri::command]
 pub async fn git_commit(
     app: AppHandle,
+    db_pool: State<'_, db::DbPool>,
     message: String,
 ) -> Result<shared_types::CommitResult, String> {
     let dir = store::ensure_git_repo_folder(&app).map_err(|e| capture_err("git_commit", e))?;
@@ -56,22 +57,20 @@ pub async fn git_commit(
         log::warn!("[git_commit] Failed to tag commit: {}", e);
     }
 
-    if let Ok(db_path) = db::get_db_path(&app) {
-        let now = crate::utils::unix_now();
-        match db::commits::upsert_commit(
-            &db_path,
-            &commit_info.hash,
-            &commit_info.tree_hash,
-            Some(&message),
-            now,
-        ) {
-            Ok(id) => log::info!(
-                "[git_commit] Saved commit to database (id={}, hash={})",
-                id,
-                &commit_info.hash[..8]
-            ),
-            Err(e) => log::error!("[git_commit] Failed to save commit: {}", e),
-        }
+    let now = crate::utils::unix_now();
+    match db::commits::upsert_commit_in_pool(
+        &db_pool,
+        &commit_info.hash,
+        &commit_info.tree_hash,
+        Some(&message),
+        now,
+    ) {
+        Ok(id) => log::info!(
+            "[git_commit] Saved commit to database (id={}, hash={})",
+            id,
+            &commit_info.hash[..8]
+        ),
+        Err(e) => log::error!("[git_commit] Failed to save commit: {}", e),
     }
 
     // Update build state: new HEAD hash, no changeset (working tree is now clean).

apps/native/src-tauri/src/README.md

@@ -17,4 +17,3 @@ pub async fn permissions_request(
     permissions::request_permission(&permission_id)
         .map_err(|e| capture_err("permissions_request", e))
 }
-

apps/native/src-tauri/src/commands/git.rs

@@ -243,7 +243,9 @@ mod tests {
             &mut skipped,
             serde_json::to_value(EvolutionLimits {
                 max_iterations: 12,
+                max_token_budget: 80_000,
                 max_build_attempts: 4,
+                max_output_tokens: 16_384,
             })
             .unwrap(),
             false,