ci: deploy dogfood-gate, add Groove manifest and CRG tests

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: hyperpolymath

.github/workflows/dogfood-gate.yml

@@ -120,40 +120,39 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
 
-      - name: Setup Deno
-        uses: denoland/setup-deno@v2
-        with:
-          deno-version: v2.x
-
-      - name: Clone and run empty-linter
+      - name: Scan for invisible characters
         id: lint
         run: |
-          git clone --depth 1 https://github.com/hyperpolymath/empty-linter.git "$HOME/empty-linter" 2>/dev/null || true
-          if [ -f "$HOME/empty-linter/deno.json" ]; then
-            cd "$HOME/empty-linter"
-            # Build ReScript output if needed
-            if [ -f "rescript.json" ]; then
-              deno task build 2>/dev/null || true
-            fi
-            set +e
-            deno run --allow-read src/cli/Main.res.js "$GITHUB_WORKSPACE" > /tmp/empty-lint-results.txt 2>&1
-            EL_EXIT=$?
-            set -e
-            FINDINGS=$(wc -l < /tmp/empty-lint-results.txt)
-            echo "findings=$FINDINGS" >> "$GITHUB_OUTPUT"
-            echo "exit_code=$EL_EXIT" >> "$GITHUB_OUTPUT"
-            echo "ready=true" >> "$GITHUB_OUTPUT"
-
-            # Emit annotations
-            while IFS= read -r line; do
-              if echo "$line" | grep -q ':'; then
-                echo "::warning::$line"
-              fi
-            done < /tmp/empty-lint-results.txt
-          else
-            echo "::notice::empty-linter not available — skipping"
-            echo "ready=false" >> "$GITHUB_OUTPUT"
-          fi
+          # Inline invisible character detection (from empty-linter's core patterns).
+          # Checks for: zero-width spaces, zero-width joiners, BOM, soft hyphens,
+          # non-breaking spaces, null bytes, and other invisible Unicode in source files.
+          set +e
+          PATTERNS='\xc2\xa0|\xe2\x80\x8b|\xe2\x80\x8c|\xe2\x80\x8d|\xef\xbb\xbf|\xc2\xad|\xe2\x80\x8e|\xe2\x80\x8f|\xe2\x80\xaa|\xe2\x80\xab|\xe2\x80\xac|\xe2\x80\xad|\xe2\x80\xae|\x00'
+          find "$GITHUB_WORKSPACE" \
+            -not -path '*/.git/*' -not -path '*/node_modules/*' \
+            -not -path '*/.deno/*' -not -path '*/target/*' \
+            -not -path '*/_build/*' -not -path '*/deps/*' \
+            -not -path '*/external_corpora/*' -not -path '*/.lake/*' \
+            -type f \( -name '*.rs' -o -name '*.ex' -o -name '*.exs' -o -name '*.res' \
+              -o -name '*.js' -o -name '*.ts' -o -name '*.json' -o -name '*.toml' \
+              -o -name '*.yml' -o -name '*.yaml' -o -name '*.md' -o -name '*.adoc' \
+              -o -name '*.idr' -o -name '*.zig' -o -name '*.v' -o -name '*.jl' \
+              -o -name '*.gleam' -o -name '*.hs' -o -name '*.ml' -o -name '*.sh' \) \
+            -exec grep -Prl "$PATTERNS" {} \; > /tmp/empty-lint-results.txt 2>/dev/null
+          EL_EXIT=$?
+          set -e
+
+          FINDINGS=$(wc -l < /tmp/empty-lint-results.txt 2>/dev/null || echo 0)
+          echo "findings=$FINDINGS" >> "$GITHUB_OUTPUT"
+          echo "exit_code=$EL_EXIT" >> "$GITHUB_OUTPUT"
+          echo "ready=true" >> "$GITHUB_OUTPUT"
+
+          # Emit annotations for each file with invisible chars
+          while IFS= read -r filepath; do
+            [ -z "$filepath" ] && continue
+            REL_PATH="${filepath#$GITHUB_WORKSPACE/}"
+            echo "::warning file=${REL_PATH}::Invisible Unicode characters detected (zero-width space, BOM, NBSP, etc.)"
+          done < /tmp/empty-lint-results.txt
 
       - name: Write summary
         run: |

.github/workflows/security-scan.yml

@@ -28,24 +28,24 @@ jobs:
         with:
           toolchain: stable
 
-      - name: Cache panic-attacker binary
+      - name: Cache panic-attack binary
         id: cache-pa
         uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4
         with:
-          path: ~/.cargo/bin/panic-attacker
-          key: panic-attacker-${{ runner.os }}
+          path: ~/.cargo/bin/panic-attack
+          key: panic-attack-${{ runner.os }}
 
-      - name: Build panic-attacker
+      - name: Build panic-attack
         if: steps.cache-pa.outputs.cache-hit != 'true'
         run: |
           git clone https://github.com/hyperpolymath/panic-attacker.git /tmp/panic-attacker
           cd /tmp/panic-attacker
           cargo build --release
-          cp target/release/panic-attacker ~/.cargo/bin/
+          cp target/release/panic-attack ~/.cargo/bin/
 
       - name: Run panic-attack assail
         run: |
-          panic-attacker assail . --output /tmp/scan-results.json
+          panic-attack assail . --output /tmp/scan-results.json
           echo "## Panic-Attack Scan Results" >> $GITHUB_STEP_SUMMARY
           WEAK_POINTS=$(jq '.weak_points | length' /tmp/scan-results.json 2>/dev/null || echo 0)
           echo "- Weak points found: $WEAK_POINTS" >> $GITHUB_STEP_SUMMARY

TEST-NEEDS.md

@@ -1,5 +1,7 @@
 # TEST-NEEDS.md - Project Wharf Testing State
 
+## CRG Grade: C — ACHIEVED 2026-04-04
+
 **CRG Target:** C (unit + smoke + build + P2P + E2E + reflexive + contract + aspect tests + benchmarks baselined)
 
 **Last Updated:** 2026-04-04