feat: consolidate TraceDecay V2 PR8-PR13 delivery

.cargo/config.toml

@@ -27,12 +27,11 @@ TRACEDECAY_DISABLE_GLOBAL_DB = { value = "1", force = false }
 # in-process. Installed binaries run outside cargo and are unaffected, but the
 # profile does apply to `cargo run` — use the installed binary (or set
 # TRACEDECAY_DATA_DIR yourself) for real `daemon install-service` runs.
-# Enforced by tests/test_profile_isolation_test.rs.
+# Enforced by tests/core_cli_suite/test_profile_isolation_test.rs.
 TRACEDECAY_DATA_DIR = { value = "target/test-profile/.tracedecay", force = false, relative = true }
 
 [alias]
 # Local default for the full Rust test suite. Requires cargo-nextest:
 # https://nexte.st/docs/installation/pre-built-binaries/
-test-all = "nextest run --workspace --no-fail-fast"
-test-ci = "nextest run --workspace --no-fail-fast"
-dogfood = "run --quiet --release --bin tracedecay -- dogfood"
+test-all = "nextest run --workspace --all-features --no-fail-fast"
+test-ci = "nextest run --workspace --all-features --no-fail-fast"

.claude/skills/evaluating-hook-hints/SKILL.md

@@ -9,7 +9,7 @@ Use this skill for TraceDecay repo development only. These are repo-local dev in
 
 ## Workflow
 
-1. Start with TraceDecay context for `src/hooks/tool_hints.rs`, `src/hooks/tool_hints/classifiers.rs`, `src/hooks/tool_hints/evals.rs`, host adapters in `src/hooks/{codex,claude,cursor}.rs`, and recent transcript evidence.
+1. Start with TraceDecay context for `src/hooks/tool_hints.rs`, `src/hooks/tool_hints/classifiers.rs`, the `src/hooks/tool_hints/evals/` module (`mod.rs` plus `host_cases.rs`), host adapters in `src/hooks/{codex,claude,cursor}.rs`, and recent transcript evidence.
 2. Render model-visible hook input when judging verbosity:
    `scripts/render-codex-hook-inputs.py --glob '/home/zack/.codex/sessions/**/*.jsonl' --all --limit 5 --max-chars 800`.
 3. Run deterministic evals before behavior edits:
@@ -22,7 +22,7 @@ Use this skill for TraceDecay repo development only. These are repo-local dev in
 ## Acceptance Rules
 
 - Hints should be contextual and short; avoid generic TraceDecay availability boilerplate.
-- Real-world transcript cases and synthetic cases should both be represented in `src/hooks/tool_hints/evals.rs`.
+- Real-world transcript cases and synthetic cases should both be represented in `src/hooks/tool_hints/evals/` (`host_cases.rs` holds the per-host scenarios). The module is `#[cfg(test)]`, so it only compiles under a test profile.
 - A normal user prompt should not be wrapped into a noisy `UserPromptSubmit hook (completed)` model-visible user message.
 - No hint is a valid outcome when the request does not need TraceDecay guidance.
 - Repeated native behavior should get at most one initial hint plus one later escalation per category, bounded by the session budget.

.codex/skills/evaluating-hook-hints/SKILL.md

@@ -9,7 +9,7 @@ Use this skill for TraceDecay repo development only. These are repo-local dev in
 
 ## Workflow
 
-1. Start with TraceDecay context for `src/hooks/tool_hints.rs`, `src/hooks/tool_hints/classifiers.rs`, `src/hooks/tool_hints/evals.rs`, host adapters in `src/hooks/{codex,claude,cursor}.rs`, and recent transcript evidence.
+1. Start with TraceDecay context for `src/hooks/tool_hints.rs`, `src/hooks/tool_hints/classifiers.rs`, the `src/hooks/tool_hints/evals/` module (`mod.rs` plus `host_cases.rs`), host adapters in `src/hooks/{codex,claude,cursor}.rs`, and recent transcript evidence.
 2. Render model-visible hook input when judging verbosity:
    `scripts/render-codex-hook-inputs.py --glob '/home/zack/.codex/sessions/**/*.jsonl' --all --limit 5 --max-chars 800`.
 3. Run deterministic evals before behavior edits:
@@ -22,7 +22,7 @@ Use this skill for TraceDecay repo development only. These are repo-local dev in
 ## Acceptance Rules
 
 - Hints should be contextual and short; avoid generic TraceDecay availability boilerplate.
-- Real-world transcript cases and synthetic cases should both be represented in `src/hooks/tool_hints/evals.rs`.
+- Real-world transcript cases and synthetic cases should both be represented in `src/hooks/tool_hints/evals/` (`host_cases.rs` holds the per-host scenarios). The module is `#[cfg(test)]`, so it only compiles under a test profile.
 - A normal user prompt should not be wrapped into a noisy `UserPromptSubmit hook (completed)` model-visible user message.
 - No hint is a valid outcome when the request does not need TraceDecay guidance.
 - Repeated native behavior should get at most one initial hint plus one later escalation per category, bounded by the session budget.

.config/nextest.toml

@@ -1,5 +1,6 @@
 [profile.default]
-test-threads = 8
+# CI remains separately capped at 8 threads.
+test-threads = 16
 
 [profile.ci]
 fail-fast = false
@@ -22,7 +23,7 @@ path = "junit.xml"
 # any assertion or adding a sleep. Applies on all hosts (the flake is a
 # scheduler-starvation timeout, not a Windows-only concern).
 [[profile.ci.overrides]]
-filter = '(binary(=daemon_suite) & test(/^git_watch_test::(fifty_commit_rebase_needs_one_sync|concurrent_syncs_are_single_flight|deleted_branch_store_is_garbage_collected)$/)) | (binary(=tracedecay) & test(~daemon::git_watch::tests::))'
+filter = '(binary(=daemon_suite) & test(/^git_watch_test::(fifty_commit_rebase_needs_one_sync|concurrent_syncs_are_single_flight|deleted_branch_store_gc_fails_closed_without_daemon_administration)$/)) | (binary(=tracedecay) & test(~daemon::git_watch::tests::))'
 slow-timeout = { period = "60s", terminate-after = 10 }
 
 [test-groups]
@@ -45,11 +46,11 @@ filter = 'binary(=dashboard_api_test)'
 threads-required = "num-cpus"
 
 [[profile.ci.overrides]]
-filter = 'binary(=core_cli_suite) & test(/^tool_daemon_test::(daemon_socket_is_owner_only|daemon_sigterm_exits_while_project_client_is_connected)$/)'
+filter = 'binary(=core_cli_suite) & test(/^tool_daemon_test::(daemon_socket_is_owner_only|daemon_sigterm_exits_while_authenticated_project_client_is_connected)$/)'
 threads-required = "num-cpus"
 
 [[profile.default.overrides]]
-filter = 'binary(=core_cli_suite) & test(/^tool_daemon_test::(daemon_socket_is_owner_only|daemon_sigterm_exits_while_project_client_is_connected)$/)'
+filter = 'binary(=core_cli_suite) & test(/^tool_daemon_test::(daemon_socket_is_owner_only|daemon_sigterm_exits_while_authenticated_project_client_is_connected)$/)'
 threads-required = "num-cpus"
 
 [[profile.ci.overrides]]

.gitattributes

@@ -13,3 +13,15 @@ src/agents/claude_agents/** text eol=lf
 # the binary via include_str! and the generated-plugin snapshot test asserts
 # their exact bytes.
 src/agents/hermes/templates/** text eol=lf
+# PR5 benchmark evidence attests the embedded harness and manifest byte-for-byte.
+# Keep those bytes identical when Git checks the repository out on Windows.
+src/sessions/claude_observation_benchmark.rs text eol=lf
+src/sessions/claude_observation_benchmark/** text eol=lf
+benchmarks/pr5-observation/** text eol=lf
+# PR7 workload/evidence JSON stays LF for portable checkout digests.
+benchmarks/pr7-memory/** text eol=lf
+# Vendored, patched tree-sitter grammars: generated parser sources are
+# reviewed upstream-of-generation (grammar.js + patches), not line-by-line.
+# Collapse them out of PR diffs and language stats.
+vendor/** linguist-generated=true
+crates/tracedecay-code-extraction/vendor/** linguist-generated=true

.github/actions/clean-windows-test-children/action.yml

@@ -0,0 +1,35 @@
+name: Clean abandoned Windows test children
+description: >-
+  Stop tracedecay.exe processes launched from this workspace whose parent has
+  already exited, so a leaked daemon cannot hold the runner or the workspace.
+
+runs:
+  using: composite
+  steps:
+    - shell: pwsh
+      run: |
+        $workspace = (Resolve-Path $env:GITHUB_WORKSPACE).Path
+        $all = Get-CimInstance Win32_Process
+        $liveProcessIds = [System.Collections.Generic.HashSet[uint32]]::new()
+        foreach ($process in $all) {
+          [void]$liveProcessIds.Add([uint32]$process.ProcessId)
+        }
+        $stale = foreach ($process in $all) {
+          if ($process.Name -ne "tracedecay.exe") {
+            continue
+          }
+          if (-not $process.CommandLine) {
+            continue
+          }
+          $inCurrentWorkspace = $process.CommandLine.IndexOf($workspace, [StringComparison]::OrdinalIgnoreCase) -ge 0
+          if (-not $inCurrentWorkspace) {
+            continue
+          }
+          if (-not $liveProcessIds.Contains([uint32]$process.ParentProcessId)) {
+            $process
+          }
+        }
+        foreach ($process in $stale) {
+          Write-Host "Stopping abandoned tracedecay child pid=$($process.ProcessId)"
+          Stop-Process -Id $process.ProcessId -Force -ErrorAction SilentlyContinue
+        }

.github/actions/install-ast-grep/action.yml

@@ -0,0 +1,18 @@
+name: Install ast-grep
+description: Install the pinned ast-grep CLI globally and verify it runs.
+
+inputs:
+  version:
+    description: Exact @ast-grep/cli version to install.
+    required: true
+
+runs:
+  using: composite
+  steps:
+    - shell: bash
+      run: |
+        set -euo pipefail
+        npm install --global "@ast-grep/cli@${VERSION}"
+        ast-grep --version
+      env:
+        VERSION: ${{ inputs.version }}

.github/actions/tune-windows-runner/action.yml

@@ -0,0 +1,49 @@
+name: Tune Windows runner I/O
+description: >-
+  Disable Defender real-time scanning for the hot build/test paths and,
+  optionally, move TMP/TEMP onto the fast workspace drive.
+
+inputs:
+  redirect-temp:
+    description: >-
+      Point TMP/TEMP at RUNNER_TEMP so tempfile::TempDir in nextest test
+      processes lands on the fast workspace drive. Build-only jobs leave this
+      off; they create few temp files and do not run the product.
+    required: false
+    default: "false"
+
+runs:
+  using: composite
+  steps:
+    - name: Exclude hot paths from Defender
+      shell: pwsh
+      run: |
+        # Defender real-time scanning taxes the compiler's many short-lived
+        # object/incremental files and the many short-lived SQLite/tempdir
+        # files these tests create; hosted runners are elevated, so turn it
+        # off and exclude the hot paths as a fallback.
+        Set-MpPreference -DisableRealtimeMonitoring $true -ErrorAction SilentlyContinue
+        $exclusions = @(
+          $env:GITHUB_WORKSPACE,
+          $env:RUNNER_TEMP,
+          [System.IO.Path]::GetTempPath(),
+          $env:CARGO_HOME,
+          $env:RUSTUP_HOME,
+          "$env:USERPROFILE\.cargo",
+          "$env:USERPROFILE\.rustup"
+        ) | Where-Object { $_ } | Select-Object -Unique
+        foreach ($path in $exclusions) {
+          Add-MpPreference -ExclusionPath $path -ErrorAction SilentlyContinue
+        }
+
+    - name: Redirect TMP/TEMP to the fast workspace drive
+      if: inputs.redirect-temp == 'true'
+      shell: pwsh
+      run: |
+        # Default user TEMP is on the slow C: drive; RUNNER_TEMP shares the
+        # faster workspace drive. Point TMP/TEMP there so tempfile::TempDir in
+        # the nextest test processes follows.
+        $fastTemp = Join-Path $env:RUNNER_TEMP "tmp"
+        New-Item -ItemType Directory -Path $fastTemp -Force | Out-Null
+        "TMP=$fastTemp" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append
+        "TEMP=$fastTemp" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append