Merge remote-tracking branch 'upstream/dev' into feat/priority-levels

Author: XertroV

.github/scripts/pr-quality.test.cjs

@@ -115,7 +115,7 @@ describe("assessPrDescription", () => {
 });
 
 describe("collectPrQualityFailures", () => {
-  const allowed = ["dev", "dev2-go"];
+  const allowed = ["dev"];
 
   it("reports wrong_base without requiring ancestry inputs", () => {
     const failures = collectPrQualityFailures({

.github/workflows/ci.yml

@@ -2,7 +2,7 @@ name: Cross-platform CI
 
 on:
   pull_request:
-    branches: [main, dev, dev2-go]
+    branches: [main, dev]
     paths:
       - "src/**"
       - "bin/**"

.github/workflows/enforce-pr-target.yml

@@ -42,7 +42,7 @@ jobs:
               path.join(process.cwd(), ".github", "scripts", "pr-quality.cjs"),
             );
 
-            const ALLOWED_BASES = ["dev", "dev2-go"];
+            const ALLOWED_BASES = ["dev"];
             const DEFAULT_BASE = "dev";
             const TITLE_PREFIX = "[WRONG BRANCH] ";
             const COMMENT_MARKER = "<!-- pr-quality-enforcer -->";
@@ -211,7 +211,7 @@ jobs:
                   "",
                   `This pull request currently targets ${inlineCode(pr.base.ref)}, but pull requests must target one of ${ALLOWED_BASES.map(inlineCode).join(" or ")}.`,
                   "",
-                  `@${pr.user.login} Please retarget this PR to ${inlineCode(DEFAULT_BASE)}. Most contributions go to ${inlineCode(DEFAULT_BASE)} first; use ${inlineCode("dev2-go")} only for scoped Go native-port work. \`main\` receives only release promotions. See our [Contributing guide](https://lidge-jun.github.io/opencodex/contributing/) for details. Thanks! 🙏`
+                  `@${pr.user.login} Please retarget this PR to ${inlineCode(DEFAULT_BASE)}. All contributions go to ${inlineCode(DEFAULT_BASE)}; \`main\` receives only release promotions. See our [Contributing guide](https://lidge-jun.github.io/opencodex/contributing/) for details. Thanks! 🙏`
                 );
               }
 

.github/workflows/service-lifecycle.yml

@@ -2,7 +2,7 @@ name: Service lifecycle
 
 on:
   pull_request:
-    branches: [main, dev, dev2-go]
+    branches: [main, dev]
     paths:
       - "src/service.ts"
       # Keep in sync with the release.yml service-gate regex (release.yml "Require

.gitignore

@@ -3,7 +3,16 @@ dist/
 .env
 *.log
 .DS_Store
+
+# Maintainer-only planning notes. `devlog` is a private submodule
+# (lidge-jun/opencodex-internal) pinned by gitlink; its contents are never
+# tracked here. Commit inside the submodule, then bump the pointer separately.
 devlog/
+
+# Scratch space. Security working notes — unreleased findings, draft advisories,
+# exploit reasoning, pre-disclosure patch plans — belong here or in a
+# `mktemp -d` path, and nowhere else. Not devlog/, not a private repo. See the
+# "Security working notes" section of AGENTS.md.
 .tmp/
 .opencode/
 

.gitmodules

@@ -0,0 +1,6 @@
+[submodule "devlog"]
+	path = devlog
+	url = https://github.com/lidge-jun/opencodex-internal.git
+	ignore = dirty
+	update = none
+	shallow = true

AGENTS.md

@@ -16,16 +16,70 @@ Bun-native TypeScript with no separate server compile step.
   `tests/helpers/`, broader scenarios in `tests/e2e-style/`.
 - `gui/` — React + Vite dashboard; packaged output is served from `gui/dist`.
 - `docs-site/` — public docs (Astro + Starlight), deployed to GitHub Pages.
-- `go/` — Go native runtime (primary on the `dev2-go` line during transition).
+- `go/` — retired Go native-runtime experiment; kept only where the TypeScript
+  runtime still references it. New work does not go here.
 - `structure/` — maintainer invariants and architecture notes; read before
   changing shared subsystems.
 - `scripts/` — release and maintenance tooling; `scripts/release.ts` is the
   release authority.
-- `devlog/` — planning and investigation artifacts (mostly gitignored).
+- `devlog/` — maintainer-only planning and investigation notes. This is a
+  **private submodule** (`lidge-jun/opencodex-internal`), not a directory of
+  this repository. See "The `devlog` submodule" below.
 
 Read the nearest nested `AGENTS.md` before changing files in a scoped
 directory (`src/`, `gui/`, `docs-site/`, `scripts/`, `.github/`).
 
+## The `devlog` submodule
+
+Planning notes, triage matrices, and investigation artifacts live in the private
+`lidge-jun/opencodex-internal` repository, wired in as the `devlog` submodule.
+They quote live infrastructure state, provider behaviour, unfixed defects, and
+internal triage reasoning, so a public clone should carry the runtime and its
+docs and nothing else.
+
+The pointer is deliberately **loose**, so a missing or stale `devlog` can never
+fail a check:
+
+- `.gitmodules` declares `ignore = dirty`, `update = none`, and `shallow = true`.
+  A dirty or moved submodule working tree does not show up in `git status` on
+  the parent, and `git submodule update` will not touch it unless asked
+  explicitly.
+- No workflow checks it out. `actions/checkout` runs without `submodules:`, so
+  CI clones the public tree only and the private URL is never resolved.
+- Nothing in the build, test, typecheck, or privacy-scan path reads from
+  `devlog/`. Contributors without access see an empty directory and every gate
+  still passes.
+- `devlog/` stays listed in `.gitignore` for the working tree; the submodule
+  gitlink is tracked, its contents are not.
+
+Two rules keep it that way. Never commit anything under `devlog/` to *this*
+repository — commit inside the submodule, then update the pointer here as a
+separate commit. And never nest a git repository inside the submodule: a
+`160000` gitlink in a tree that CI does not initialize breaks
+`actions/checkout` for every contributor, which is exactly what happened before
+this split.
+
+## Security working notes
+
+**Security work is done in scratch space, never in a tracked directory.** That
+includes unreleased findings, severity assessments, draft advisories, exploit
+or bypass reasoning, reproduction steps for an unfixed defect, and
+pre-disclosure patch plans.
+
+Use `.tmp/` in the working tree (already gitignored) or a `mktemp -d` path.
+`devlog/` is **not** an acceptable location, and neither is a private
+repository: both get cloned across machines and CI, both outlive the embargo,
+and neither history is practical to purge afterwards.
+
+Only the published outcome reaches a repository — the fix itself, its
+regression test, the release note, the advisory once it is public. Draft the
+advisory in scratch space and delete the scratch directory once the advisory is
+live.
+
+This applies to `AGENTS.md`-following agents as much as to humans. If a task
+asks you to write up a security finding, put the write-up in scratch space and
+say where it is; do not add it to `devlog/`, `structure/`, or `docs-site/`.
+
 ## Commands
 
 ```bash
@@ -42,34 +96,29 @@ non-trivial change. CI runs these on Linux, Windows, and macOS.
 
 ## Branch policy
 
-- `dev` — integration branch and the default target. A pull request goes here
-  unless it belongs to a scoped line below.
-- `dev2-go` — parallel integration line for the Go native port: `go/`,
-  `bin/native-runtime.mjs`, `src/lib/runtime-entry.ts`, and the Go
-  release-asset tooling. Open for pull requests: the target-branch check
-  accepts `dev` and `dev2-go` as integration targets. Keep it to scoped Go
-  native-port work — the check cannot tell an intentional target from a
-  mistaken one, so that boundary is a review decision. It converges back
-  through maintainer-controlled merges, and promotion to `main` still happens
-  only from `dev`.
+- `dev` — the single integration branch and the target for every pull request.
 - `main` — release branch. It only moves by maintainer-controlled promotion
   from `dev` (releases, docs deploys). Do not open feature PRs against `main`.
 - `preview` — prerelease train (`x.y.z-preview.*` versions).
 
-### Transition to `dev2-go`
+### The retired `dev2-go` line
+
+The project previously ran a parallel `dev2-go` integration line that was
+rebuilding the runtime as a Go native port, and every merge into `dev` had to be
+carried onto it. That dual-track policy is over: maintaining two integration
+lines cost more than the port returned, and dogfooding the Go runtime kept
+surfacing new defects.
 
-The project is moving its primary runtime to the Go native port, so `dev2-go`
-has to keep receiving everything that lands on `dev`. Pull requests against
-`dev` stay welcome and unchanged — the extra work belongs to the maintainer who
-merges them.
+`dev2-go` has been deleted, along with the `codex/260728-go-port-*` and
+`tmp/dev2-go-source-export` side branches. The full history lives in
+[lidge-jun/opencodex-go-archive](https://github.com/lidge-jun/opencodex-go-archive)
+and the final tip is tagged `archive/dev2-go` in this repository. There is no
+carry or port obligation attached to a `dev` merge any more, and the
+`needs-go-port` label is gone.
 
-A merge into `dev` does not finish the task. The merging maintainer also
-rebases that work onto `dev2-go`, ports whatever needs a Go counterpart under
-`go/`, and merges the port. The item is done only when both lines carry the
-change. If a change has no Go counterpart, say so in the merge or tracking
-issue; if the port has to wait, open a `needs-go-port` tracking issue against
-`dev2-go` naming the source commits before closing out the `dev` merge.
-[`MAINTAINERS.md`](./MAINTAINERS.md) holds the authoritative wording.
+Bun-native TypeScript is the only runtime line. If native code returns, the
+expectation is an incremental module (for example Rust via N-API) landing on
+`dev`, not a second full-runtime branch.
 
 The Claude Desktop integration formerly carried on the `claudedesktop` branch is
 now fully merged into `dev`, and that branch has been retired. Desktop work
@@ -81,10 +130,10 @@ is ordinary maintenance rather than noise — open it as a normal pull request
 and name the source commits in the description.
 
 The **`enforce-target`** CI check rejects pull requests whose head
-ancestry sits on the **`main`** tip while far behind **`dev`** or **`dev2-go`**,
-and rejects empty, thin, or malformed descriptions; authors with repository
-push permission skip the ancestry heuristic only. As with approval requirements
-in [`MAINTAINERS.md`](./MAINTAINERS.md), this is enforced by convention until
+ancestry sits on the **`main`** tip while far behind **`dev`**, and rejects
+empty, thin, or malformed descriptions; authors with repository push permission
+skip the ancestry heuristic only. As with approval requirements in
+[`MAINTAINERS.md`](./MAINTAINERS.md), this is enforced by convention until
 branch protection is configured.
 
 [`MAINTAINERS.md`](./MAINTAINERS.md) is authoritative for review and merge
@@ -100,12 +149,8 @@ reviewers (Codex, CodeRabbit).
   language. Be detailed and specific: name the file and line, describe the
   concrete failure mode, and suggest a fix. Avoid vague or purely stylistic
   commentary.
-- **Branch targeting:** flag any pull request that targets neither `dev` nor
-  `dev2-go` (releases and maintainer promotions are the only exceptions).
-  `dev2-go` is accepted by the automation but scoped by review: if a pull
-  request targets it without touching `go/`, the native runtime entrypoint, or
-  the Go release-asset tooling, ask the author to retarget to `dev`. The
-  automation cannot make that judgement, which is why it is yours.
+- **Branch targeting:** flag any pull request that does not target `dev`
+  (releases and maintainer promotions are the only exceptions).
 - **Security boundary (highest priority):** changes touching authentication,
   credential/token handling, OAuth flows, GitHub Actions workflows, release
   automation (`scripts/release.ts`, `.github/workflows/release.yml`), or

CONTRIBUTING.md

@@ -10,25 +10,17 @@ Thanks for helping with opencodex.
 
 ## Branches
 
-- `dev` — default integration target for pull requests.
-- `dev2-go` — parallel integration line for the Go native port (`go/`, the
-  native runtime entrypoint, and the Go release-asset tooling). Open for pull
-  requests alongside `dev`. Send work here only when it belongs to the Go port;
-  anything else goes to `dev`. The automated check accepts both targets and
-  cannot tell them apart, so scope is settled in review.
+- `dev` — the only integration target for pull requests.
 - `main` — releases only; moves by maintainer-controlled promotion from `dev`.
 - `preview` — prerelease train.
 
-While the project moves its primary runtime to the Go native port, `dev2-go`
-has to keep receiving everything that lands on `dev`. Nothing changes for
-contributors: keep opening pull requests against `dev`. After merging, a
-maintainer rebases the work onto `dev2-go` and ports whatever needs a Go
-counterpart, and the item is finished only once both lines carry it. See
-[`MAINTAINERS.md`](./MAINTAINERS.md) for the full rule.
+The `dev2-go` Go native-port line has been retired. Its history is archived at
+[lidge-jun/opencodex-go-archive](https://github.com/lidge-jun/opencodex-go-archive),
+and everything now goes to `dev`. See [`MAINTAINERS.md`](./MAINTAINERS.md) for
+the reasoning.
 
-Porting and rebase pull requests are welcome: carrying a fix across integration
-lines, or rebasing a stale branch onto the current head, is normal
-contribution. Note the source commits in the description.
+Rebase pull requests are welcome: bringing a stale branch onto the current head
+is normal contribution. Note the source commits in the description.
 
 Agent-facing repository and review rules live in [`AGENTS.md`](./AGENTS.md).