chore: sync main into frontend control plane prototype

Author: maxliux5

.github/dependabot.yml

@@ -0,0 +1,38 @@
+version: 2
+
+updates:
+  - package-ecosystem: pip
+    directories:
+      - "/"
+      - "/docs"
+      - "/packages/loopx-finance-value-discovery"
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 0
+    groups:
+      python-security:
+        applies-to: security-updates
+        patterns:
+          - "*"
+
+  - package-ecosystem: npm
+    directory: "/apps/presentation/dashboard"
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 0
+    groups:
+      dashboard-security:
+        applies-to: security-updates
+        patterns:
+          - "*"
+
+  - package-ecosystem: github-actions
+    directory: "/"
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 0
+    groups:
+      actions-security:
+        applies-to: security-updates
+        patterns:
+          - "*"

.github/workflows/frontstage-pages.yml

@@ -13,16 +13,20 @@ on:
       - "apps/presentation/site/**"
       - "docs/**"
       - "mkdocs.yaml"
+      - "mkdocs.book.zh.yaml"
+      - "mkdocs.book.en.yaml"
       - "docs/showcases/**"
       - "docs/assets/long-running-loop-openviking-trajectory.png"
       - "docs/assets/long-running-loop-ml-experiment-trajectory.png"
       - "examples/export-frontstage-share-bundle.mjs"
       - "examples/frontstage-share-bundle-smoke.mjs"
       - "examples/readme-star-history-smoke.py"
+      - "examples/dev-book-publication-smoke.py"
       - "examples/goal-channel-frontstage-fixture.py"
       - "examples/showcase-catalog-smoke.py"
       - "examples/status.example.json"
       - "scripts/render-star-history.py"
+      - "scripts/install-from-github.sh"
   push:
     branches:
       - main
@@ -34,16 +38,20 @@ on:
       - "apps/presentation/site/**"
       - "docs/**"
       - "mkdocs.yaml"
+      - "mkdocs.book.zh.yaml"
+      - "mkdocs.book.en.yaml"
       - "docs/showcases/**"
       - "docs/assets/long-running-loop-openviking-trajectory.png"
       - "docs/assets/long-running-loop-ml-experiment-trajectory.png"
       - "examples/export-frontstage-share-bundle.mjs"
       - "examples/frontstage-share-bundle-smoke.mjs"
       - "examples/readme-star-history-smoke.py"
+      - "examples/dev-book-publication-smoke.py"
       - "examples/goal-channel-frontstage-fixture.py"
       - "examples/showcase-catalog-smoke.py"
       - "examples/status.example.json"
       - "scripts/render-star-history.py"
+      - "scripts/install-from-github.sh"
 
 permissions:
   actions: read
@@ -88,9 +96,12 @@ jobs:
       - name: Validate public showcase catalog
         run: python3 examples/showcase-catalog-smoke.py
 
-      - name: Validate README star history
+- name: Validate README star history
         run: python3 examples/readme-star-history-smoke.py
 
+      - name: Validate Developer Book publication
+        run: python3 examples/dev-book-publication-smoke.py
+
       - name: Validate public-safe frontstage bundle
         working-directory: apps/presentation/dashboard
         run: npm run smoke:frontstage-share-bundle
@@ -102,18 +113,40 @@ jobs:
       - name: Fetch complete GitHub stargazer history
         if: github.event_name != 'pull_request'
         env:
-          GH_TOKEN: ${{ github.token }}
+          # Since July 2026, GitHub restricts this endpoint to repository
+          # collaborators. Keep this credential read-only and repo-scoped.
+          GH_TOKEN: ${{ secrets.STAR_HISTORY_READ_TOKEN }}
         run: |
           set -euo pipefail
+          if [[ -z "${GH_TOKEN:-}" ]]; then
+            echo "::error title=Missing star-history credential::Set STAR_HISTORY_READ_TOKEN to a fine-grained PAT limited to this repository with Metadata: read." >&2
+            exit 1
+          fi
+          owner="${GITHUB_REPOSITORY%%/*}"
+          repo="${GITHUB_REPOSITORY#*/}"
+          count_query='query($owner: String!, $repo: String!) {
+            repository(owner: $owner, name: $repo) { stargazerCount }
+          }'
+          history_query='query($owner: String!, $repo: String!, $endCursor: String) {
+            repository(owner: $owner, name: $repo) {
+              stargazers(first: 100, after: $endCursor, orderBy: {field: STARRED_AT, direction: ASC}) {
+                edges { starredAt }
+                pageInfo { hasNextPage endCursor }
+              }
+            }
+          }'
           for attempt in 1 2 3; do
-            count_before="$(gh api "/repos/$GITHUB_REPOSITORY" --jq .stargazers_count)"
-            gh api --paginate --slurp \
-              --header "Accept: application/vnd.github.star+json" \
-              --header "X-GitHub-Api-Version: 2026-03-10" \
-              "/repos/$GITHUB_REPOSITORY/stargazers?per_page=100" \
+            count_before="$(gh api graphql -f query="$count_query" -F owner="$owner" -F repo="$repo" --jq .data.repository.stargazerCount)"
+            gh api graphql --paginate --slurp \
+              -f query="$history_query" \
+              -F owner="$owner" \
+              -F repo="$repo" \
+              > "$RUNNER_TEMP/loopx-stargazer-pages.json"
+            jq '[.[].data.repository.stargazers.edges[] | {starred_at: .starredAt}]' \
+              "$RUNNER_TEMP/loopx-stargazer-pages.json" \
               > "$RUNNER_TEMP/loopx-stargazers.json"
-            count_after="$(gh api "/repos/$GITHUB_REPOSITORY" --jq .stargazers_count)"
-            fetched_count="$(jq '[.[][]] | length' "$RUNNER_TEMP/loopx-stargazers.json")"
+            count_after="$(gh api graphql -f query="$count_query" -F owner="$owner" -F repo="$repo" --jq .data.repository.stargazerCount)"
+            fetched_count="$(jq 'length' "$RUNNER_TEMP/loopx-stargazers.json")"
             if [[ "$count_before" == "$count_after" && "$fetched_count" == "$count_after" ]]; then
               printf '%s\n' "$count_after" > "$RUNNER_TEMP/loopx-stargazers-count"
               break
@@ -137,6 +170,15 @@ jobs:
       - name: Build documentation site
         run: mkdocs build --strict --site-dir output/frontstage-pages/site/docs
 
+      - name: Build Chinese Developer Book
+        run: mkdocs build --strict --config-file mkdocs.book.zh.yaml --site-dir output/frontstage-pages/site/docs/book
+
+      - name: Build English Developer Book
+        run: mkdocs build --strict --config-file mkdocs.book.en.yaml --site-dir output/frontstage-pages/site/docs/book/en
+
+      - name: Validate rendered Developer Book
+        run: python3 examples/dev-book-publication-smoke.py --site-dir output/frontstage-pages/site/docs/book
+
       - name: Configure Pages
         if: github.event_name != 'pull_request'
         uses: actions/configure-pages@v6

.github/workflows/python-tests.yml

@@ -6,6 +6,7 @@ on:
       - ".github/workflows/python-tests.yml"
       - "loopx/**"
       - "tests/**"
+      - "examples/**"
       - "pyproject.toml"
   push:
     branches:
@@ -14,6 +15,7 @@ on:
       - ".github/workflows/python-tests.yml"
       - "loopx/**"
       - "tests/**"
+      - "examples/**"
       - "pyproject.toml"
 
 permissions:

CONTRIBUTING.md

@@ -50,6 +50,9 @@ Use the [developer guide](docs/development/README.md) as the stable entry point.
 Before changing scheduler, quota, todo/gate, onboarding, agent-facing output,
 or release behavior, read the bilingual
 [testing and quality guide](docs/development/testing-and-quality.md).
+Before adding or consolidating a public smoke, use the bilingual
+[good smoke guide](docs/development/good-smokes.md) to define its durable
+invariant, independent oracle, cadence, and public-safe fixture boundary.
 
 Install and verify the checkout:
 

GOVERNANCE.md

@@ -29,6 +29,7 @@ as a maintainer or grant release, security, or governance authority.
 | [`@Hoey041`](https://github.com/Hoey041) | Write | Active |
 | [`@maxliux5`](https://github.com/maxliux5) | Write | Invitation pending |
 | [`@JackyCSer`](https://github.com/JackyCSer) | Write | Invitation pending |
+| [`@steven-kid`](https://github.com/steven-kid) | Write | Invitation pending |
 
 GitHub's repository settings are the operational source of truth for access.
 This public snapshot should be updated through a pull request when a write-role