Skip to content

chore(deps): bump the actions group with 9 updates#8

Merged
hyperpolymath merged 1 commit into
mainfrom
dependabot/github_actions/actions-667af3f80e
Dec 16, 2025
Merged

chore(deps): bump the actions group with 9 updates#8
hyperpolymath merged 1 commit into
mainfrom
dependabot/github_actions/actions-667af3f80e

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Dec 16, 2025

Copy link
Copy Markdown
Contributor

Bumps the actions group with 9 updates:

Package From To
actions/checkout 4 6
github/codeql-action 3 4
actions/first-interaction 1 3
actions/upload-pages-artifact 3 4
actions/labeler 4 6
webfactory/ssh-agent 0.9.0 0.9.1
codecov/codecov-action 3 5
ossf/scorecard-action 2.3.1 2.4.3
actions/stale 5 10

Updates actions/checkout from 4 to 6

Release notes

Sourced from actions/checkout's releases.

v6.0.0

What's Changed

Full Changelog: actions/checkout@v5.0.0...v6.0.0

v6-beta

What's Changed

Updated persist-credentials to store the credentials under $RUNNER_TEMP instead of directly in the local git config.

This requires a minimum Actions Runner version of v2.329.0 to access the persisted credentials for Docker container action scenarios.

v5.0.1

What's Changed

Full Changelog: actions/checkout@v5...v5.0.1

v5.0.0

What's Changed

⚠️ Minimum Compatible Runner Version

v2.327.1
Release Notes

Make sure your runner is updated to this version or newer to use this release.

Full Changelog: actions/checkout@v4...v5.0.0

v4.3.1

What's Changed

Full Changelog: actions/checkout@v4...v4.3.1

v4.3.0

What's Changed

... (truncated)

Commits

Updates github/codeql-action from 3 to 4

Release notes

Sourced from github/codeql-action's releases.

v3.31.8

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

3.31.8 - 11 Dec 2025

  • Update default CodeQL bundle version to 2.23.8. #3354

See the full CHANGELOG.md for more information.

v3.31.7

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

3.31.7 - 05 Dec 2025

  • Update default CodeQL bundle version to 2.23.7. #3343

See the full CHANGELOG.md for more information.

v3.31.6

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

3.31.6 - 01 Dec 2025

No user facing changes.

See the full CHANGELOG.md for more information.

v3.31.5

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

3.31.5 - 24 Nov 2025

  • Update default CodeQL bundle version to 2.23.6. #3321

See the full CHANGELOG.md for more information.

v3.31.4

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

3.31.4 - 18 Nov 2025

... (truncated)

Commits
  • c4efbda Overlay: Check database metadata for overlayBaseSpecifier
  • dd89143 CodeQL: Add resolveDatabase method
  • 78357d3 Merge pull request #3341 from github/mbg/ci/update-cs-config-cli-tests
  • d61a6fa Update CLI config test to account for overlay db changes on PRs
  • ce27e95 Rebuild
  • 43224eb Bump @​eslint/eslintrc from 3.3.1 to 3.3.3 in the npm-minor group
  • f0ac9bf Merge pull request #3337 from github/mergeback/v4.31.6-to-main-fe4161a2
  • c1ca379 Rebuild
  • c3455c5 Update changelog and version after v4.31.6
  • fe4161a Merge pull request #3336 from github/update-v4.31.6-ecec1f887
  • Additional commits viewable in compare view

Updates actions/first-interaction from 1 to 3

Release notes

Sourced from actions/first-interaction's releases.

v3.0.0

What's Changed

New Contributors

Full Changelog: actions/first-interaction@v2...v3.0.0

v2.0.0

What's Changed

New Contributors

Full Changelog: actions/first-interaction@v1.3.0...v2.0.0

v1.3.0

Upgrade our base image from node v14 -> v20

Add dependency on @octokit/rest and @actions/http-client.

👉 See the PR for details: actions/first-interaction#287

... (truncated)

Commits
  • 1c46889 Merge pull request #363 from actions/dependabot/npm_and_yarn/npm-development-...
  • 76a99dd Disable checks for dist
  • 2ead13c Bump the npm-development group across 1 directory with 10 updates
  • 2e8e200 Merge pull request #361 from actions/dependabot/npm_and_yarn/rollup/rollup-li...
  • df55979 Merge pull request #357 from actions/dependabot/npm_and_yarn/octokit/types-15...
  • c056c18 Bump @​rollup/rollup-linux-x64-gnu from 4.50.2 to 4.52.3
  • dac371d Bump @​octokit/types from 14.1.0 to 15.0.0
  • 33689d3 Merge pull request #354 from actions/ncalteen/event
  • 8e69b57 Merge branch 'main' into ncalteen/event
  • 69c5373 Merge pull request #351 from actions/dependabot/npm_and_yarn/github/local-act...
  • Additional commits viewable in compare view

Updates actions/upload-pages-artifact from 3 to 4

Release notes

Sourced from actions/upload-pages-artifact's releases.

v4.0.0

What's Changed

Full Changelog: actions/upload-pages-artifact@v3.0.1...v4.0.0

v3.0.1

Changelog

See details of all code changes since previous release.

Commits
  • 7b1f4a7 Merge pull request #127 from heavymachinery/pin-sha
  • 4cc19c7 Pin actions/upload-artifact to SHA
  • 2d163be Merge pull request #107 from KittyChiu/main
  • c704843 fix: linted README
  • 9605915 Merge pull request #106 from KittyChiu/kittychiu/update-readme-1
  • e59cdfe Update README.md
  • a2d6704 doc: updated usage section in readme
  • 984864e Merge pull request #105 from actions/Jcambass-patch-1
  • 45dc788 Add workflow file for publishing releases to immutable action package
  • efaad07 Merge pull request #102 from actions/hidden-files
  • Additional commits viewable in compare view

Updates actions/labeler from 4 to 6

Release notes

Sourced from actions/labeler's releases.

v6.0.0

What's Changed

Breaking Changes

Dependency Upgrades

Documentation changes

New Contributors

... (truncated)

Commits

Updates webfactory/ssh-agent from 0.9.0 to 0.9.1

Release notes

Sourced from webfactory/ssh-agent's releases.

v0.9.1

What's Changed

New Contributors

Full Changelog: webfactory/ssh-agent@v0.9.0...v0.9.1

Changelog

Sourced from webfactory/ssh-agent's changelog.

Changelog

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

[Unreleased]

v0.9.1 [2024-03-17]

Fixed

  • Fix path used to execute ssh-agent in cleanup.js to respect custom paths set by input (#235)

v0.9.0 [2024-02-06]

Changed

  • Update all versions of actions/checkout to v4 (#199)
  • Update to Node 20 (#201)

v0.8.0 [2023-03-24]

Changed

  • No longer writing GitHub's SSH host keys to known_hosts (#171)
  • Update to actions/checkout@v3 (#143)
  • Allow the user to override the commands for git, ssh-agent, and ssh-add (#154)

v0.7.0 [2022-10-19]

Added

  • Add the log-public-key input that can be used to turn off logging key identities (#122)

Fixed

  • Fix path to git binary on Windows, assuming GitHub-hosted runners (#136, #137)
  • Fix a nonsensical log message (#139)

v0.6.0 [2022-10-19]

Changed

v0.5.4 [2021-11-21]

Fixed

... (truncated)

Commits

Updates codecov/codecov-action from 3 to 5

Release notes

Sourced from codecov/codecov-action's releases.

v5.0.0

v5 Release

v5 of the Codecov GitHub Action will use the Codecov Wrapper to encapsulate the CLI. This will help ensure that the Action gets updates quicker.

Migration Guide

The v5 release also coincides with the opt-out feature for tokens for public repositories. In the Global Upload Token section of the settings page of an organization in codecov.io, you can set the ability for Codecov to receive a coverage reports from any source. This will allow contributors or other members of a repository to upload without needing access to the Codecov token. For more details see how to upload without a token.

[!WARNING]
The following arguments have been changed

  • file (this has been deprecated in favor of files)
  • plugin (this has been deprecated in favor of plugins)

The following arguments have been added:

  • binary
  • gcov_args
  • gcov_executable
  • gcov_ignore
  • gcov_include
  • report_type
  • skip_validation
  • swift_project

You can see their usage in the action.yml file.

What's Changed

... (truncated)

Changelog

Sourced from codecov/codecov-action's changelog.

v5 Release

v5 of the Codecov GitHub Action will use the Codecov Wrapper to encapsulate the CLI. This will help ensure that the Action gets updates quicker.

Migration Guide

The v5 release also coincides with the opt-out feature for tokens for public repositories. In the Global Upload Token section of the settings page of an organization in codecov.io, you can set the ability for Codecov to receive a coverage reports from any source. This will allow contributors or other members of a repository to upload without needing access to the Codecov token. For more details see how to upload without a token.

[!WARNING] The following arguments have been changed

  • file (this has been deprecated in favor of files)
  • plugin (this has been deprecated in favor of plugins)

The following arguments have been added:

  • binary
  • gcov_args
  • gcov_executable
  • gcov_ignore
  • gcov_include
  • report_type
  • skip_validation
  • swift_project

You can see their usage in the action.yml file.

What's Changed

... (truncated)

Commits

Updates ossf/scorecard-action from 2.3.1 to 2.4.3

Release notes

Sourced from ossf/scorecard-action's releases.

v2.4.3

What's Changed

This update bumps the Scorecard version to the v5.3.0 release. For a complete list of changes, please refer to the Scorecard v5.3.0 release notes.

Documentation

Other

Bumps the actions group with 9 updates:

| Package | From | To |
| --- | --- | --- |
| [actions/checkout](https://github.com/actions/checkout) | `4` | `6` |
| [github/codeql-action](https://github.com/github/codeql-action) | `3` | `4` |
| [actions/first-interaction](https://github.com/actions/first-interaction) | `1` | `3` |
| [actions/upload-pages-artifact](https://github.com/actions/upload-pages-artifact) | `3` | `4` |
| [actions/labeler](https://github.com/actions/labeler) | `4` | `6` |
| [webfactory/ssh-agent](https://github.com/webfactory/ssh-agent) | `0.9.0` | `0.9.1` |
| [codecov/codecov-action](https://github.com/codecov/codecov-action) | `3` | `5` |
| [ossf/scorecard-action](https://github.com/ossf/scorecard-action) | `2.3.1` | `2.4.3` |
| [actions/stale](https://github.com/actions/stale) | `5` | `10` |


Updates `actions/checkout` from 4 to 6
- [Release notes](https://github.com/actions/checkout/releases)
- [Commits](actions/checkout@v4...v6)

Updates `github/codeql-action` from 3 to 4
- [Release notes](https://github.com/github/codeql-action/releases)
- [Commits](github/codeql-action@v3...v4)

Updates `actions/first-interaction` from 1 to 3
- [Release notes](https://github.com/actions/first-interaction/releases)
- [Commits](actions/first-interaction@v1...v3)

Updates `actions/upload-pages-artifact` from 3 to 4
- [Release notes](https://github.com/actions/upload-pages-artifact/releases)
- [Commits](actions/upload-pages-artifact@v3...v4)

Updates `actions/labeler` from 4 to 6
- [Release notes](https://github.com/actions/labeler/releases)
- [Commits](actions/labeler@v4...v6)

Updates `webfactory/ssh-agent` from 0.9.0 to 0.9.1
- [Release notes](https://github.com/webfactory/ssh-agent/releases)
- [Changelog](https://github.com/webfactory/ssh-agent/blob/master/CHANGELOG.md)
- [Commits](webfactory/ssh-agent@dc588b6...a6f90b1)

Updates `codecov/codecov-action` from 3 to 5
- [Release notes](https://github.com/codecov/codecov-action/releases)
- [Changelog](https://github.com/codecov/codecov-action/blob/main/CHANGELOG.md)
- [Commits](codecov/codecov-action@v3...v5)

Updates `ossf/scorecard-action` from 2.3.1 to 2.4.3
- [Release notes](https://github.com/ossf/scorecard-action/releases)
- [Changelog](https://github.com/ossf/scorecard-action/blob/main/RELEASE.md)
- [Commits](ossf/scorecard-action@v2.3.1...v2.4.3)

Updates `actions/stale` from 5 to 10
- [Release notes](https://github.com/actions/stale/releases)
- [Changelog](https://github.com/actions/stale/blob/main/CHANGELOG.md)
- [Commits](actions/stale@v5...v10)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: '6'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: github/codeql-action
  dependency-version: '4'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: actions/first-interaction
  dependency-version: '3'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: actions/upload-pages-artifact
  dependency-version: '4'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: actions/labeler
  dependency-version: '6'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: webfactory/ssh-agent
  dependency-version: 0.9.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions
- dependency-name: codecov/codecov-action
  dependency-version: '5'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: ossf/scorecard-action
  dependency-version: 2.4.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions
- dependency-name: actions/stale
  dependency-version: '10'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Dec 16, 2025
@hyperpolymath
hyperpolymath merged commit 251025c into main Dec 16, 2025
2 of 24 checks passed
@hyperpolymath
hyperpolymath deleted the dependabot/github_actions/actions-667af3f80e branch December 16, 2025 13:48
hyperpolymath added a commit that referenced this pull request Jun 4, 2026
## Sub-PR #3 of the Android Kotlin→Rust/Gossamer migration epic

Part of epic **#83**, RFC PR **#97**, tracking sub-issue **#109**. Scope
of #3 is **scaffolding only** — stand up the minimal Gossamer Android
shell so sub-PRs #4#7 can port the actual components. No behaviour
change to existing crates.

### Files added / changed
| File | Change |
|------|--------|
| `android/gossamer.conf.json` | **NEW** — Gossamer app config
(analogous to the former `tauri.conf.json`). Schema
`https://gossamer.dev/schemas/config/v1`, modelled on
`hyperpolymath/panll` + `hyperpolymath/gossamer`. Includes a
`bundle.mobile.android` block (`minSdk 26` / `targetSdk 34`, mirroring
the legacy `AndroidManifest.xml`). |
|
`android/app/src/main/java/ai/neurophone/gossamer/NeurophoneMainActivity.java`
| **NEW** — Java shim extending `io.gossamer.GossamerActivity`;
overrides `getInitialHtml()` to load placeholder HTML in the Gossamer
webview. |
| `crates/neurophone-android/Cargo.toml` | Commented-out `gossamer-rs`
placeholder + TODO (unpublished; see below). |
| `android/app/build.gradle.kts` | Commented-out Gossamer Android
library dependency + TODO. |
| `android/app/src/main/AndroidManifest.xml` | Commented-out
registration of `NeurophoneMainActivity` + TODO (legacy `.MainActivity`
stays LAUNCHER for now). |

Every new file carries `SPDX-License-Identifier: MPL-2.0`.

### `gossamer-rs` resolvability outcome
**Not resolvable in this workspace — left as a commented placeholder, by
design.** Estate precedent (`hyperpolymath/panll`) consumes it only as a
**path dependency to a sibling checkout**: `gossamer-rs = { path =
"../gossamer/bindings/rust" }`. The crate (`gossamer-rs` v0.1.0) is
**not published to crates.io**, and there is no sibling `gossamer`
checkout in neurophone CI. Adding it as a hard dependency would break
`cargo build --workspace`, so per the hard constraint it is commented
out with a TODO(#83 sub-PR #5) documenting the git/path/registry
options. Likewise the **Gossamer Android library**
(`io.gossamer.GossamerActivity`/`GossamerBridge`) ships upstream as a
raw Java source tree + prebuilt `libgossamer.so`, **not** a Maven/AAR
artifact, so the Gradle dependency and the manifest activity
registration are also commented placeholders.

### What I verified
- `cargo metadata --no-deps` → **OK** (all workspace manifests,
including my Cargo.toml edit, parse).
- `cargo build --workspace` → **fails, but with a PRE-EXISTING failure
unrelated to this PR.** The `esn` and `lsm` crates do not compile on
`main` (commit `0a88e45`) due to a `rand` 0.10 / `ndarray-rand` 0.16 API
incompatibility (`no method named random`/`sample`, `RngExt`/`DerefMut`
bounds). This PR touches **zero** compiling Rust: the diff in
`crates/esn`, `crates/lsm`, `crates/neurophone-core` is empty, and the
only Rust change is a **commented** block in
`crates/neurophone-android/Cargo.toml`. **Build/test error delta
introduced by this PR: 0.** `cargo test --workspace` is blocked by the
same pre-existing compile failure, not by anything here.
- No new `gossamer-rs` hard dependency added → CI green-ness is not
regressed by this PR.

> ⚠️ The pre-existing `esn`/`lsm` `rand` breakage on `main` is out of
scope for this scaffolding sub-PR and should be fixed separately.

### `GossamerActivity` API assumptions
Read directly from `hyperpolymath/gossamer`
`android/src/main/java/io/gossamer/GossamerActivity.java`:
- Package `io.gossamer`; subclass and override `getInitialHtml()`
(non-null ⇒ `webView.loadData`) **or** `getInitialUrl()` (used when HTML
is null).
- Parent loads `libgossamer.so` via `System.loadLibrary("gossamer")` in
a static block and registers the `GossamerBridge` JS interface
(`window.GossamerBridge.postMessage(json)`) for native IPC.
- Assumed `gossamer.conf.json` v1 schema is the correct mobile config
surface and that `bundle.mobile.android` is the right place for
SDK/permission config (matches the gossamer reference config; not
independently validated against a live gossamer mobile build, since
Gossamer Android is webview-only today).

### TODOs / risks for sub-PRs #4#8
- **#4**: replace placeholder HTML with the real bundled web UI
(`getInitialUrl()` / `build.frontendDist`); enable the manifest activity
+ move LAUNCHER intent-filter; retire `.MainActivity`.
- **#5**: enable `gossamer-rs` (vendor / git dep / registry) once
resolvable; port the 11 `NativeLib` JNI methods
(init/start/stop/processSensor/queryLocal/queryClaude/query/getNeuralContext/getState/reset/isRunning)
onto the Gossamer IPC bridge, backed by `crates/neurophone-android` +
`crates/neurophone-core`.
- **#6**: port the sensor pipeline (accel/gyro/mag/light/proximity →
LSM→ESN loop).
- **#7**: port `NeurophoneService` (foreground service), `BootReceiver`,
and the home-screen widgets; re-add
`BODY_SENSORS`/`FOREGROUND_SERVICE`/`RECEIVE_BOOT_COMPLETED`/`WAKE_LOCK`
to `gossamer.conf.json`.
- **#8**: remove the legacy `android/` Kotlin tree and drop the
`.hypatia-baseline.json` carve-out once migration lands.
- **Risk**: gossamer Android library distribution mechanism (Maven coord
vs vendored source vs prebuilt `.so` path) is unconfirmed — sub-PR #4/#5
must pick one. Mobile `gossamer.conf.json` fields beyond the desktop
reference are assumed, not validated against a live mobile build.

https://claude.ai/code/session_01Gu1JFCZHuBtBhAWPr4sMQw

---
_Generated by [Claude
Code](https://claude.ai/code/session_01Gu1JFCZHuBtBhAWPr4sMQw)_

Co-authored-by: Claude <noreply@anthropic.com>
hyperpolymath added a commit that referenced this pull request Jun 6, 2026
**Sub-PR #3** of the Android Kotlin→Rust/Gossamer migration epic (#83,
RFC PR #97, tracking sub-issue #109). **Scaffolding only.** No behaviour
change to existing crates; the legacy Kotlin `android/app/` tree is
untouched.

## Files added (all under `android/gossamer/`, all
`SPDX-License-Identifier: MPL-2.0`)

| File | Purpose |
|---|---|
| `gossamer.conf.json` | Gossamer app config (analogous to
`tauri.conf.json`). Schema mirrored from `hyperpolymath/gossamer` and
`hyperpolymath/panll`. Carries identity `ai.neurophone`, the
`bundle.mobile.android` block (minSdk 26 / targetSdk 34 + the permission
set from the legacy `AndroidManifest.xml`), dev/build runner config. |
| `app/src/main/java/ai/neurophone/NeurophoneMainActivity.java` | Java
shim extending `io.gossamer.GossamerActivity`; overrides
`getInitialHtml()` to load placeholder HTML in the Gossamer WebView. |
| `Cargo.toml` | Standalone (non-workspace) scaffold manifest for the
future `neurophone-gossamer` cdylib. `gossamer-rs` dep commented out
(see below). |
| `src/lib.rs` | Inert placeholder lib so the standalone crate compiles;
documents wiring TODOs. |
| `README.adoc` | Documents resolvability, `GossamerActivity` API
assumptions, TODOs/risks for #4#8. |
| `Cargo.lock` | Lock for the standalone scaffold crate (pins
serde/serde_json placeholder deps). |

The `android/**` subtree is exempt from the banned-language CI gate via
`.hypatia-baseline.json` on `main`, so the hand-written Java shim is
acceptable here.

## `gossamer-rs` resolvability outcome

**`gossamer-rs` v0.1.0 is NOT published to crates.io.** In the estate it
is consumed as a **path dependency** from the sibling
`hyperpolymath/gossamer` repo at `bindings/rust` — precedent from
`hyperpolymath/panll`:
```toml
gossamer-rs = { path = "../gossamer/bindings/rust" }
```
That sibling checkout doesn't exist in a neurophone clone, so wiring it
as a hard dependency would break the build. Per the hard constraint (CI
green > "complete" dep), it is **left commented out** with `TODO(#83
sub-PR #8)`. The scaffold manifest is also kept **out of the root
workspace `members`** and carries an empty `[workspace]` table, so
neither `cargo build --workspace` nor `cargo test --workspace` ever
touches it.

## What I verified (build/test)

- `cargo metadata --no-deps` for the root workspace → the 8 existing
crates only; `neurophone-gossamer` is **not** a member. My additions are
inert to the workspace.
- Standalone scaffold: `cargo test --manifest-path
android/gossamer/Cargo.toml` → **compiles + 1 test passes**.
- `cargo build --workspace` / `cargo test --workspace` fail **only** in
`crates/esn` and `crates/lsm` (`ndarray-rand` 0.16 vs `rand` 0.10 API
skew: `random`/`sample`/`random_using`). **This failure pre-exists on
`main`** — reproduced in a pristine `main` worktree (`cargo build -p
esn` exits 101 on `0a88e45`). My PR neither introduces nor worsens it.
⚠️ Pre-existing red workspace flagged below.

## `GossamerActivity` API assumptions (read from
`hyperpolymath/gossamer` `android/src/main/java/io/gossamer/`)

- `io.gossamer.GossamerActivity extends android.app.Activity`.
- Loads `libgossamer.so` via `System.loadLibrary("gossamer")` in a
static block.
- `onCreate()` builds a full-screen `WebView`, enables JS + DOM storage,
**disables** `file://`/content access, registers the `GossamerBridge` JS
interface (`window.GossamerBridge.postMessage(json)`), and calls native
`nativeInit(activity, webview)`.
- Content via overriding **`getInitialHtml()`** (HTML `String`) or
**`getInitialUrl()`** (URL `String`); `getInitialHtml()` takes
precedence — we override it.
- Gossamer on Android is **webview-only today**.
- Assumed: the gossamer Android sources + `libgossamer.so` are
vendored/linked into the app module at build time (sub-PR #8), so
`io.gossamer.GossamerActivity` is on the classpath. The shim is
therefore not part of any CI build step yet.

## TODOs / risks for sub-PRs #4#8

- **#4** — Port `NativeLib`: map the 11 JNI methods
(init/start/stop/processSensor/queryLocal/queryClaude/query/getNeuralContext/getState/reset/isRunning)
to Gossamer IPC command handlers calling the Rust core
(`crates/neurophone-core`, `crates/neurophone-android`). IPC
name/payload contract is **undefined**.
- **#5** — Port `NeurophoneService` foreground sensor loop.
- **#6** — Port `BootReceiver`.
- **#7** — Port the home-screen widgets.
- **#8** — Real frontend bundle (`frontendDist`) + full IPC wiring;
**enable `gossamer-rs`** (resolve the sibling-checkout/build-integration
question); decide `gossamer` CLI vs Gradle for the APK build; then
remove the legacy Kotlin `android/app/` tree.
- **Licensing risk**: `gossamer-rs` is `AGPL-3.0-or-later`; everything
added here is `MPL-2.0`. Whether the cdylib linking `gossamer-rs` can
stay MPL-2.0 or must adopt a compatible license is an **open question**
to resolve before #8.

Refs #83, #97, #109.

https://claude.ai/code/session_01Gu1JFCZHuBtBhAWPr4sMQw

---
_Generated by [Claude
Code](https://claude.ai/code/session_01Gu1JFCZHuBtBhAWPr4sMQw)_

Co-authored-by: Claude <noreply@anthropic.com>
hyperpolymath added a commit that referenced this pull request Jun 6, 2026
#127)

## Sub-PR #8 — AffineScript UI in the Gossamer webview

Part of the Android Kotlin→Rust/Gossamer migration (epic #83, RFC PR
#97, sub-issue #114).

Reimplements the UI currently in
`android/app/src/main/java/ai/neurophone/MainActivity.kt` +
`res/layout/activity_main.xml` as the **AffineScript** webview UI that
the Gossamer Android shell loads. The Kotlin sources are left in place;
their removal happens at migration cutover.

### Dependency note
Needs **#3** (Gossamer scaffolding / webview host) and **#4**
(NativeLib→Rust JNI) — both in parallel and **not merged**. Based off
`main`; their structure is assumed and every assumption is marked
`TODO(#83 rebase)` / `TODO(#83)`.

### Files added
All new files carry `SPDX-License-Identifier: MPL-2.0`. Under
`android/app/src/main/assets/gossamer-ui/`:

| File | Purpose |
|------|---------|
| `src/bridge.affine` | Typed bridge to the native Rust core (was
`NativeLib` JNI): `init`, `start`, `stop`, `process_sensor`, `query`,
`query_local`, `query_claude`, `get_neural_context`, `get_state`,
`reset`, `is_running`. Config ported verbatim from
`MainActivity.createConfig()`. |
| `src/ui.affine` | View/controller logic ported 1:1 from
`MainActivity`: init-on-load, Start/Stop toggle, 500 ms neural-context
poll, query + "Prefer Local" routing. |
| `index.html` | Webview entry; element ids match `ui.affine` queries. |
| `styles.css` | Visual parity with `activity_main.xml` (16dp padding,
centred header, monospace neural-context panel, spinner, etc.). |
| `deno.json` | Deno build/check/fmt tasks (no npm/Node). |
| `build.sh` | AffineScript → Deno-ESM build wiring. |
| `dist/ui.mjs` | Committed compiler-output **stub** (see below). |
| `README.adoc` | Documents bridge assumptions + TODOs. |

Plus a scoped `.gitignore` negation so the committed `dist/ui.mjs` stub
is tracked while the general `dist/` ignore stays.

### AffineScript build wiring + assumptions
- AffineScript (`.affine`) compiles to Deno-ESM via the estate
`affinescript` toolchain (OCaml/Dune CLI: `check` / `fmt` / `compile
--target deno-esm`), driven through Deno tasks: `deno task check:ui` /
`build:ui` / `fmt:ui`. `build.sh` is the single CI-ready entry point.
- **The `affinescript` compiler is not yet vendored** in this repo/CI.
So `dist/ui.mjs` is a hand-written **generated-output stub** faithfully
mirroring `src/ui.affine` + `src/bridge.affine`, keeping the webview
loadable/reviewable today. `build.sh` falls back to the committed stub
when the compiler is absent (and says so loudly). `TODO(#83)`:
vendor/pin the toolchain, flip `USE_STUB=0`, regenerate, delete the
stub, wire `deno task build:ui` into CI.
- **Bridge contract assumed** (owned by #3/#4): Gossamer injects
`globalThis.gossamer` with `invoke(cmd, args): Promise<string>`; command
names are snake_case forms of the old `NativeLib` methods; host serves
`index.html` as the webview root. All marked `TODO(#83 rebase)`.
- Sensor *acquisition* intentionally not in this UI — the foreground
Rust service (#4) registers sensors natively; `bridge.process_sensor`
stays exposed for parity.

### Verification
- `build.sh` runs clean with the stub fallback (exit 0).
- All 8 new files carry the MPL-2.0 SPDX header; `deno.json` is valid
JSON.
- **Cargo workspace:** no Rust/Cargo files touched (web assets +
`.gitignore` only). `cargo build --workspace` currently fails on `main`
in the `lsm`/`esn` crates due to a pre-existing `rand` 0.10 API drift
(`.random()`/`.sample()`), present on `origin/main` before this branch
and unaffected by these changes.

### TODOs / risks
- `TODO(#83 rebase)`: reconcile the bridge object name/call convention
and DOM-host bindings against #3/#4 once merged.
- `TODO(#83)`: vendor the AffineScript toolchain and replace the
`dist/ui.mjs` stub with real compiled output; wire into CI.
- Pre-existing `lsm`/`esn` `rand` API build failure on `main` is out of
scope for this UI PR.

### Language policy
AffineScript (primary app language) + HTML/CSS + a Deno-run Bash build
script. No TypeScript, Node, or npm. The single `.mjs` is a
compiler-output stub, not hand-authored application logic.

https://claude.ai/code/session_01Gu1JFCZHuBtBhAWPr4sMQw

---
_Generated by [Claude
Code](https://claude.ai/code/session_01Gu1JFCZHuBtBhAWPr4sMQw)_

Signed-off-by: Jonathan D.A. Jewell <6759885+hyperpolymath@users.noreply.github.com>
Co-authored-by: Claude <noreply@anthropic.com>
hyperpolymath added a commit that referenced this pull request Jun 6, 2026
…gacy android/ tree (#124)

## ⚠️ BLOCKED — DO NOT MERGE (gated draft)

**This is the TERMINAL, GATED step of the Android Kotlin→Rust/Gossamer
migration** (epic #83, RFC PR #97, sub-issue #115).

It is **gated on sub-PRs #3#8** (scaffolding + all component ports),
which are **NOT done**. Deleting `android/` now removes the **only
working Android frontend**, so this PR **MUST NOT be merged until #3#8
have landed**.

- Status: **DRAFT / BLOCKED**
- Merge only after: **#3, #4, #5, #6, #7, #8** are all merged
- After those land, **rebase this branch on `main`** so the diff removes
only what is truly legacy (the Kotlin/Gradle files), leaving the Java
shims + Rust + AffineScript UI delivered by #3#8 in place.

> Because #3#8 are not merged into this branch, the diff here simply
deletes the **current** `android/` tree. That is expected for this
staging draft.

---

## What was removed

The legacy Kotlin/Gradle `android/` app — **20 files**:

- **7 `*.kt`**: `BootReceiver.kt`, `MainActivity.kt`, `NativeLib.kt`,
`NeurophoneService.kt`, `widget/NeurophoneAppWidget.kt`,
`widget/NeurophoneWidgetActions.kt`,
`widget/NeurophoneWidgetConfigureActivity.kt`
- **3 `*.gradle.kts`**: `android/build.gradle.kts`,
`android/settings.gradle.kts`, `android/app/build.gradle.kts`
- Plus `gradle.properties`, `AndroidManifest.xml`, and the `res/` XML
(drawables, layouts, values, widget info).

After migration these are replaced by the Java shims under `android/` +
Rust (`crates/`) + AffineScript UI from #3#8.

## Carve-out removal (now stale)

The `android/**` banned-language carve-out existed in **three mirrored
locations**, all justified only while banned Kotlin lived in `android/`.
With the tree gone they are stale and a stale-baseline detector would
otherwise warn, so all three are removed:

1. **`.hypatia-baseline.json`** — the glob `file_pattern: "android/**"`
entry removed; file is now an empty array `[]` (it was the only entry).
*(A pure-JSON array schema cannot carry an SPDX comment without breaking
the schema the detector reads; the original file had no SPDX header
either.)*
2. **`.hypatia-ignore`** — the per-file
`cicd_rules/banned_language_file:android/...` lines removed (these
mirrored the canonical glob).
3. **`.github/workflows/language-policy.yml`** — the `android/` prune in
the *Check for Java/Kotlin files* step removed; the check is now an
unconditional scan.

## Expected end state

With the legacy tree gone and no carve-out:

- ✅ **`Check for Banned Languages`** — green, no exemption needed.
- ✅ **`governance / Language / package anti-pattern policy`** — green,
no exemption needed.

## Verification

- **Rust workspace unaffected.** The `android/` Gradle tree is **not** a
cargo member — `cargo metadata` resolves cleanly and references the
`android/` tree **0 times**. The Rust JNI crate
`crates/neurophone-android` is a separate workspace member and is
**untouched**.
- **Pre-existing build failure (NOT caused by this PR).** `cargo build
--workspace` / `cargo test --workspace` currently fail to compile in
`crates/esn` and `crates/lsm` due to a `rand`-crate API breakage
(`.random()` / `.sample()` no longer resolve under the locked `rand`
version). This failure reproduces on **pristine `main` with `android/`
still present** (verified by building `-p esn` on `origin/main`), so it
is **entirely independent** of this deletion. This PR neither introduces
nor fixes that failure and does not touch `Cargo.lock`.

## Out of scope (noted)

Narrative docs (`EXPLAINME.adoc`, `TESTING-REPORT.adoc`,
`docs/BT-PRESENCE-PLAN.adoc`) still mention the old `android/app/...`
Kotlin paths. They are non-build prose describing the legacy app and are
intentionally left for the migration-docs update accompanying #3#8;
nothing in the build/CI consumes them.

---

PART OF: epic #83 · RFC PR #97 · sub-issue #115

https://claude.ai/code/session_01Gu1JFCZHuBtBhAWPr4sMQw

---
_Generated by [Claude
Code](https://claude.ai/code/session_01Gu1JFCZHuBtBhAWPr4sMQw)_

Co-authored-by: Claude <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant