Feat/competitive parity 2026 - #262

Bumps [tower-http](https://github.com/tower-rs/tower-http) from 0.6.11 to 0.7.0.
- [Release notes](https://github.com/tower-rs/tower-http/releases)
- [Commits](tower-rs/tower-http@tower-http-0.6.11...tower-http-0.7.0)

---
updated-dependencies:
- dependency-name: tower-http
  dependency-version: 0.7.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

…0' into dependabot/cargo/axum-0.8.9

axum 0.8 breaking changes addressed:

1. Route path syntax ':param' -> '{param}'. axum 0.8 panics at router
   build on any segment starting with ':' (validate_v07_paths). Migrated
   all :param routes in serve.rs, watch_bridge.rs, a2a_http.rs, and
   vibe-indexer/main.rs (route registrations + adjacent doc comments).
   REST doc-labels in commands.rs/app_builder.rs left as ':id' (not
   axum routes).

2. WebSocket Message types: Text(String)->Text(Utf8Bytes),
   Binary(Vec<u8>)->Binary(Bytes). Added .into() at the 8 collab-WS
   send/receive sites in serve.rs.

tower-http 0.7 (CorsLayer/SetResponseHeaderLayer/Any) API unchanged.

Verified: cargo check --workspace clean; a2a_http_bdd (3 scenarios,
12 steps) + serve_integration pass.

* chore(deps): bump axum 0.7→0.8 + tower-http 0.6→0.7 (with route-syntax + WS migration)

Migrates axum 0.7→0.8 and tower-http 0.6→0.7 (coupled — axum 0.8 requires tower-http 0.7). Includes the required source migration: route path syntax :param→{param} (axum 0.8 panics on :param segments) across serve.rs/watch_bridge.rs/a2a_http.rs/vibe-indexer, and WebSocket Message type conversions (Text→Utf8Bytes, Binary→Bytes). tower-http 0.7 CorsLayer/SetResponseHeaderLayer API unchanged. Subsumes #144 (tower-http bump carried here so the two coupled deps land together). Verified: cargo check --workspace clean; a2a_http_bdd 3 scenarios/12 steps pass.

* chore(deps): bump onnx from 1.21.0 to 1.22.0 in /vibe-rl-py (#155)

Bumps [onnx](https://github.com/onnx/onnx) from 1.21.0 to 1.22.0.
- [Release notes](https://github.com/onnx/onnx/releases)
- [Changelog](https://github.com/onnx/onnx/blob/main/docs/Changelog-ml.md)
- [Commits](onnx/onnx@v1.21.0...v1.22.0)

---
updated-dependencies:
- dependency-name: onnx
  dependency-version: 1.22.0
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* chore(deps): bump transformers from 4.57.6 to 5.3.0 in /vibe-rl-py (#150)

Bumps [transformers](https://github.com/huggingface/transformers) from 4.57.6 to 5.3.0.
- [Release notes](https://github.com/huggingface/transformers/releases)
- [Commits](huggingface/transformers@v4.57.6...v5.3.0)

---
updated-dependencies:
- dependency-name: transformers
  dependency-version: 5.3.0
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* chore(deps): bump org.jetbrains.kotlinx:kotlinx-coroutines-play-services (#133)

Bumps [org.jetbrains.kotlinx:kotlinx-coroutines-play-services](https://github.com/Kotlin/kotlinx.coroutines) from 1.8.1 to 1.11.0.
- [Release notes](https://github.com/Kotlin/kotlinx.coroutines/releases)
- [Changelog](https://github.com/Kotlin/kotlinx.coroutines/blob/master/CHANGES.md)
- [Commits](Kotlin/kotlinx.coroutines@1.8.1...1.11.0)

---
updated-dependencies:
- dependency-name: org.jetbrains.kotlinx:kotlinx-coroutines-play-services
  dependency-version: 1.11.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* chore(deps): bump androidx.compose.ui:ui-tooling-preview (#153)

Bumps androidx.compose.ui:ui-tooling-preview from 1.7.6 to 1.11.4.

---
updated-dependencies:
- dependency-name: androidx.compose.ui:ui-tooling-preview
  dependency-version: 1.11.4
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* chore(deps): bump gradle-wrapper in /vibewatch/VibeCodyWear (#147)

Bumps [gradle-wrapper](https://github.com/gradle/gradle) from 8.10.2 to 9.6.1.
- [Release notes](https://github.com/gradle/gradle/releases)
- [Commits](gradle/gradle@v8.10.2...v9.6.1)

---
updated-dependencies:
- dependency-name: gradle-wrapper
  dependency-version: 9.6.1
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* Dependabot/cargo/axum 0.8.9 (#156)

* chore(deps): bump axum from 0.7.9 to 0.8.9

Bumps [axum](https://github.com/tokio-rs/axum) from 0.7.9 to 0.8.9.
- [Release notes](https://github.com/tokio-rs/axum/releases)
- [Changelog](https://github.com/tokio-rs/axum/blob/main/CHANGELOG.md)
- [Commits](tokio-rs/axum@axum-v0.7.9...axum-v0.8.9)

---
updated-dependencies:
- dependency-name: axum
  dependency-version: 0.8.9
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

* chore(deps): bump tower-http from 0.6.11 to 0.7.0

Bumps [tower-http](https://github.com/tower-rs/tower-http) from 0.6.11 to 0.7.0.
- [Release notes](https://github.com/tower-rs/tower-http/releases)
- [Commits](tower-rs/tower-http@tower-http-0.6.11...tower-http-0.7.0)

---
updated-dependencies:
- dependency-name: tower-http
  dependency-version: 0.7.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

* Migrate axum 0.8 route syntax + WS message types

axum 0.8 breaking changes addressed:

1. Route path syntax ':param' -> '{param}'. axum 0.8 panics at router
   build on any segment starting with ':' (validate_v07_paths). Migrated
   all :param routes in serve.rs, watch_bridge.rs, a2a_http.rs, and
   vibe-indexer/main.rs (route registrations + adjacent doc comments).
   REST doc-labels in commands.rs/app_builder.rs left as ':id' (not
   axum routes).

2. WebSocket Message types: Text(String)->Text(Utf8Bytes),
   Binary(Vec<u8>)->Binary(Bytes). Added .into() at the 8 collab-WS
   send/receive sites in serve.rs.

tower-http 0.7 (CorsLayer/SetResponseHeaderLayer/Any) API unchanged.

Verified: cargo check --workspace clean; a2a_http_bdd (3 scenarios,
12 steps) + serve_integration pass.

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Bumps [typescript](https://github.com/microsoft/TypeScript) from 6.0.3 to 7.0.2.
- [Release notes](https://github.com/microsoft/TypeScript/releases)
- [Commits](https://github.com/microsoft/TypeScript/commits)

---
updated-dependencies:
- dependency-name: typescript
  dependency-version: 7.0.2
  dependency-type: direct:development
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

Bumps [org.jetbrains.kotlin.android](https://github.com/JetBrains/kotlin) from 2.1.0 to 2.4.10.
- [Release notes](https://github.com/JetBrains/kotlin/releases)
- [Changelog](https://github.com/JetBrains/kotlin/blob/master/ChangeLog.md)
- [Commits](JetBrains/kotlin@v2.1.0...v2.4.10)

---
updated-dependencies:
- dependency-name: org.jetbrains.kotlin.android
  dependency-version: 2.4.10
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

Bumps [actions/setup-python](https://github.com/actions/setup-python) from 6 to 7.
- [Release notes](https://github.com/actions/setup-python/releases)
- [Commits](actions/setup-python@v6...v7)

---
updated-dependencies:
- dependency-name: actions/setup-python
  dependency-version: '7'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

Bumps [actions/setup-java](https://github.com/actions/setup-java) from 5.3.0 to 5.7.0.
- [Release notes](https://github.com/actions/setup-java/releases)
- [Commits](actions/setup-java@ad2b381...b6effb0)

---
updated-dependencies:
- dependency-name: actions/setup-java
  dependency-version: 5.7.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

Bumps [actions/setup-node](https://github.com/actions/setup-node) from 6.4.0 to 7.0.0.
- [Release notes](https://github.com/actions/setup-node/releases)
- [Commits](actions/setup-node@48b55a0...8207627)

---
updated-dependencies:
- dependency-name: actions/setup-node
  dependency-version: 7.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

Bumps [jsdom](https://github.com/jsdom/jsdom) from 29.1.1 to 30.0.1.
- [Release notes](https://github.com/jsdom/jsdom/releases)
- [Commits](jsdom/jsdom@v29.1.1...v30.0.1)

---
updated-dependencies:
- dependency-name: jsdom
  dependency-version: 30.0.1
  dependency-type: direct:development
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

Bumps [EmbarkStudios/cargo-deny-action](https://github.com/embarkstudios/cargo-deny-action) from 2.0.20 to 2.1.1.
- [Release notes](https://github.com/embarkstudios/cargo-deny-action/releases)
- [Commits](EmbarkStudios/cargo-deny-action@bb137d7...3c63498)

---
updated-dependencies:
- dependency-name: EmbarkStudios/cargo-deny-action
  dependency-version: 2.1.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

Bumps [tree-sitter](https://github.com/tree-sitter/tree-sitter) from 0.25.10 to 0.26.11.
- [Release notes](https://github.com/tree-sitter/tree-sitter/releases)
- [Commits](tree-sitter/tree-sitter@v0.25.10...v0.26.11)

---
updated-dependencies:
- dependency-name: tree-sitter
  dependency-version: 0.26.11
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

Bumps [sysinfo](https://github.com/GuillaumeGomez/sysinfo) from 0.36.1 to 0.39.6.
- [Changelog](https://github.com/GuillaumeGomez/sysinfo/blob/main/CHANGELOG.md)
- [Commits](GuillaumeGomez/sysinfo@v0.36.1...v0.39.6)

---
updated-dependencies:
- dependency-name: sysinfo
  dependency-version: 0.39.6
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

Bumps [tokio-tungstenite](https://github.com/snapview/tokio-tungstenite) from 0.28.0 to 0.29.0.
- [Changelog](https://github.com/snapview/tokio-tungstenite/blob/master/CHANGELOG.md)
- [Commits](snapview/tokio-tungstenite@v0.28.0...v0.29.0)

---
updated-dependencies:
- dependency-name: tokio-tungstenite
  dependency-version: 0.29.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

Bumps [rustyline](https://github.com/kkawakam/rustyline) from 14.0.0 to 17.0.2.
- [Release notes](https://github.com/kkawakam/rustyline/releases)
- [Changelog](https://github.com/kkawakam/rustyline/blob/master/History.md)
- [Commits](kkawakam/rustyline@v14.0.0...v17.0.2)

---
updated-dependencies:
- dependency-name: rustyline
  dependency-version: 17.0.2
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

Bumps [typescript](https://github.com/microsoft/TypeScript) from 6.0.3 to 7.0.2.
- [Release notes](https://github.com/microsoft/TypeScript/releases)
- [Commits](https://github.com/microsoft/TypeScript/commits)

---
updated-dependencies:
- dependency-name: typescript
  dependency-version: 7.0.2
  dependency-type: direct:development
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

Bumps [chacha20poly1305](https://github.com/RustCrypto/AEADs) from 0.10.1 to 0.11.0.
- [Commits](RustCrypto/AEADs@chacha20poly1305-v0.10.1...chacha20poly1305-v0.11.0)

---
updated-dependencies:
- dependency-name: chacha20poly1305
  dependency-version: 0.11.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

Bumps [gradle-wrapper](https://github.com/gradle/gradle) from 9.6.1 to 9.7.0.
- [Release notes](https://github.com/gradle/gradle/releases)
- [Commits](gradle/gradle@v9.6.1...v9.7.0)

---
updated-dependencies:
- dependency-name: gradle-wrapper
  dependency-version: 9.7.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

Bumps [flutter_secure_storage](https://github.com/mogol/flutter_secure_storage) from 10.3.1 to 11.0.0.
- [Release notes](https://github.com/mogol/flutter_secure_storage/releases)
- [Commits](juliansteenbakker/flutter_secure_storage@v10.3.1...flutter_secure_storage-v11.0.0)

---
updated-dependencies:
- dependency-name: flutter_secure_storage
  dependency-version: 11.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

… updates

Bumps the vibecoder-minor group with 5 updates in the /vibecoder directory:

| Package | From | To |
| --- | --- | --- |
| [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react) | `1.28.0` | `1.29.0` |
| [y-websocket](https://github.com/yjs/y-websocket) | `3.0.0` | `3.1.0` |
| [yjs](https://github.com/yjs/yjs) | `13.6.31` | `13.6.32` |
| [monaco-editor](https://github.com/microsoft/monaco-editor) | `0.55.1` | `0.56.0` |
| [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `8.2.0` | `8.2.1` |



Updates `lucide-react` from 1.28.0 to 1.29.0
- [Release notes](https://github.com/lucide-icons/lucide/releases)
- [Commits](https://github.com/lucide-icons/lucide/commits/1.29.0/packages/lucide-react)

Updates `y-websocket` from 3.0.0 to 3.1.0
- [Release notes](https://github.com/yjs/y-websocket/releases)
- [Commits](yjs/y-websocket@v3.0.0...v3.1.0)

Updates `yjs` from 13.6.31 to 13.6.32
- [Release notes](https://github.com/yjs/yjs/releases)
- [Commits](yjs/yjs@v13.6.31...v13.6.32)

Updates `monaco-editor` from 0.55.1 to 0.56.0
- [Release notes](https://github.com/microsoft/monaco-editor/releases)
- [Changelog](https://github.com/microsoft/monaco-editor/blob/main/CHANGELOG.md)
- [Commits](microsoft/monaco-editor@v0.55.1...v0.56.0)

Updates `vite` from 8.2.0 to 8.2.1
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v8.2.1/packages/vite)

---
updated-dependencies:
- dependency-name: lucide-react
  dependency-version: 1.29.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: vibecoder-minor
- dependency-name: y-websocket
  dependency-version: 3.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: vibecoder-minor
- dependency-name: yjs
  dependency-version: 13.6.32
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: vibecoder-minor
- dependency-name: monaco-editor
  dependency-version: 0.56.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: vibecoder-minor
- dependency-name: vite
  dependency-version: 8.2.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: vibecoder-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

Bumps [gradle-wrapper](https://github.com/gradle/gradle) from 9.6.1 to 9.7.0.
- [Release notes](https://github.com/gradle/gradle/releases)
- [Commits](gradle/gradle@v9.6.1...v9.7.0)

---
updated-dependencies:
- dependency-name: gradle-wrapper
  dependency-version: 9.7.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

Bumps [gradle-wrapper](https://github.com/gradle/gradle) from 9.6.1 to 9.7.0.
- [Release notes](https://github.com/gradle/gradle/releases)
- [Commits](gradle/gradle@v9.6.1...v9.7.0)

---
updated-dependencies:
- dependency-name: gradle-wrapper
  dependency-version: 9.7.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

Bumps the vibeaichat-minor group in /vibeaichat with 1 update: [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite).


Updates `vite` from 8.2.0 to 8.2.1
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v8.2.1/packages/vite)

---
updated-dependencies:
- dependency-name: vite
  dependency-version: 8.2.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: vibeaichat-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

…updates

Bumps the vibedesk-minor group with 2 updates in the /vibedesk directory: [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react) and [@tauri-apps/cli](https://github.com/tauri-apps/tauri).


Updates `lucide-react` from 1.28.0 to 1.29.0
- [Release notes](https://github.com/lucide-icons/lucide/releases)
- [Commits](https://github.com/lucide-icons/lucide/commits/1.29.0/packages/lucide-react)

Updates `@tauri-apps/cli` from 2.11.2 to 2.11.4
- [Release notes](https://github.com/tauri-apps/tauri/releases)
- [Commits](https://github.com/tauri-apps/tauri/compare/@tauri-apps/cli-v2.11.2...@tauri-apps/cli-v2.11.4)

---
updated-dependencies:
- dependency-name: "@tauri-apps/cli"
  dependency-version: 2.11.4
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: vibedesk-minor
- dependency-name: lucide-react
  dependency-version: 1.29.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: vibedesk-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

My previous commit replaced the single-line `run: npx tauri build` with a
multi-line POSIX-shell block that exports the Apple variables conditionally.
Windows runners default to PowerShell, so all three Windows bundles failed with

    ParserError: D:\a\_temp\<id>.ps1:2

before tauri ever started. They had been green.

GitHub provides bash on Windows runners, and the rest of the workflow already
uses `shell: bash` for its cross-platform steps (see "Collect artifacts"), so
this matches the existing convention rather than introducing one.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Replace rsa crate usage with ring for RS256 JWT signing in vibe-broker to avoid a timing side-channel advisory. Add pkcs8 PEM→DER helper, comprehensive unit tests that verify JWT structure and signature verification, and a test PEM fixture. Also trim syntect default features (dropping yaml-rust) and update Cargo.toml/Cargo.lock to reflect dependency changes.

Bumps [similar](https://github.com/mitsuhiko/similar) from 2.7.0 to 3.1.2.
- [Changelog](https://github.com/mitsuhiko/similar/blob/main/CHANGELOG.md)
- [Commits](mitsuhiko/similar@2.7.0...3.1.2)

---
updated-dependencies:
- dependency-name: similar
  dependency-version: 3.1.2
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

Bumps [typescript](https://github.com/microsoft/TypeScript) from 5.9.3 to 7.0.2.
- [Release notes](https://github.com/microsoft/TypeScript/releases)
- [Commits](https://github.com/microsoft/TypeScript/commits)

---
updated-dependencies:
- dependency-name: typescript
  dependency-version: 7.0.2
  dependency-type: direct:development
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

…bundles

v0.5.7 and v0.5.8 both went green, uploaded artifacts, and were killed by
macOS on every user's machine: the signing step fell back to ad-hoc, and
nothing downstream checked. build-cli had guarded against that since it was
written; the three Tauri app bundles and the iOS .ipa had not.

- Verify, don't trust. Each macOS bundle job (VibeCoder, VibeAIChat,
  VibeDesk) and the iOS packaging step now run `codesign --verify --deep
  --strict` and fail the job when the result is `Signature=adhoc` despite a
  certificate having been imported. Ad-hoc remains the intended outcome when
  no certificate is configured — the check only runs when one was.
- Notarize the CLI binary. A Developer ID signature alone is not enough for
  a quarantined download; the ticket lives on Apple's servers for a bare
  Mach-O (stapling only works for .app/.dmg/.pkg), and `notarytool --wait`
  returns 0 only on Accepted. Skipped with a notice when credentials are
  absent.
- APPLE_KEYCHAIN_PASSWORD is no longer required. The keychain is created,
  used and discarded inside the job, so a generated password protects the
  same nothing — and removes the silent failure where an empty one makes
  `security` behave differently than intended.
- Signed iOS builds. Gated on all three of APPLE_TEAM_ID /
  APPLE_DIST_CERT_P12_BASE64 / APPLE_IOS_PROFILE_BASE64; the unsigned
  sideloadable .ipa still ships when they are absent.
- watchOS gate checks every secret it needs, not just APPLE_TEAM_ID, which
  is shared with the desktop jobs — configuring desktop signing used to arm
  this job and then kill it on an empty provisioning profile. Its `if:` also
  referenced its own step output, so it always evaluated true. TestFlight
  upload is now gated separately from producing a signed IPA.
- The ad-hoc notices say what actually happens (macOS kills the app;
  `xattr -dr com.apple.quarantine`) instead of "unidentified developer,
  right-click → Open", which does not reliably fix it.
- scripts/setup-apple-signing.sh configures all of the above secrets from a
  Mac that holds the certificate. It pairs certificate and private key by
  public modulus — PEM export order is not guaranteed, and pairing by
  position yields a .p12 that imports cleanly and then cannot sign.
- .cargo/audit.toml collects the RUSTSEC suppression list that had been
  copied into three places and drifted, which is how v0.5.8's release failed
  on an advisory only one copy carried.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

…2' into feat/competitive-parity-2026

…into feat/competitive-parity-2026

… into feat/competitive-parity-2026

# Conflicts:
#	Cargo.lock

…te-0.29.0' into feat/competitive-parity-2026

…6.11' into feat/competitive-parity-2026

… feat/competitive-parity-2026

# Conflicts:
#	Cargo.lock

Resolved entirely to HEAD. The branch predates the VibeUI -> VibeCoder
rename by 224 commits, so git matched vibeui/package.json onto
vibecoder/package.json. Every version on its side is older than HEAD's
(typescript-eslint 8.57.2 < 8.66.0, vite 8.0.16 < 8.2.1, vitest 4.1.0 <
4.1.10) and it lacks the dompurify overrides block. Its only forward
change is typescript 7, which cannot resolve against typescript-eslint.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Three conflicts, all resolved deliberately:

- .github/workflows/release.yml — all three hunks are additions present
  only on HEAD: the 'verify the bundle is not ad-hoc signed' guard. The
  release branch predates it. Taking its side would delete the check that
  exists because v0.5.7 and v0.5.8 shipped ad-hoc-signed bundles that
  macOS killed on every user's machine. Kept HEAD.

- vibecli/crates/vibe-broker/Cargo.toml — base64 0.23 (Dependabot bump
  already merged here) over the branch's 0.22.

- vibecli/crates/vibe-broker/src/token_mint.rs — pure rustfmt difference,
  no semantic change (hunk 1 differs only by closure braces). Took the
  formatted side, since that branch exists to fix a red 'Rust (fmt)';
  cargo fmt --check is clean on the result.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Introduce an explicit-trigger "ghost text" inline completion feature. Adds /v1/ghost/complete server route and daemon->vibe_ai glue, a new vibecoder lib (ghostText.ts) with unit tests, and registers the provider + Alt+\ keybinding in the App UI (forwards provider+model). Update LSP completion context mapping to translate Monaco trigger kinds to LSP. VS Code extension: add ghostComplete command, inline provider, API client method, settings and keybinding. Gate: only responds to explicit/user trigger (no debounce or keystroke-driven requests); truncated responses are surfaced.

The Dependabot typescript ^7.0.2 bump is merged here (vibeaichat has no
typescript-eslint, so unlike vibecoder and vscode-extension it can take
it). TS 7 raises TS2882 on side-effect imports with no declaration, and
vibeaichat had no .d.ts at all — four errors on './App.css' and the
@vibe/shared stylesheets.

Adds the same src/vite-env.d.ts that vibecoder already carries.
tsc --noEmit is clean on TypeScript 7.0.2.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

…ty-2026

Contributes axum 0.8.9 in Cargo.lock; Cargo.toml's `axum = "0.8"`
already covered it. Every other conflict resolved to HEAD — the branch
is from PR #157 and predates several renames and fixes, so its side is
uniformly older:

- serve.rs / watch_bridge.rs — 'VibeX' and 'VibeUI' naming, superseded
  by the VibeDesk and VibeCoder renames.
- vibe-rl-py/pyproject.toml — mujoco>=3.0 / gymnasium>=0.29 against
  HEAD's >=3.11.0 / >=1.3.0, and it reinstates the accept-rom-license
  extra that HEAD removed because gymnasium 1.0 dropped it.
- gradle wrapper — older than the 9.7.0 already merged from
  dependabot/gradle/vibewatch/VibeCodyWear/gradle-wrapper-9.7.0.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Introduce explicit-trigger "ghost text" docs and hook up related tests and fixes.

- Add docs/ghost-text.md and expose it in docs/_config.yml sidebar.
- Update docs/diffcomplete.md to describe ghost-text as an explicit-trigger alternative and clarify behavior.
- Add server-side tests for POST /v1/ghost/complete: unauthenticated 401 and empty-window BAD_REQUEST checks (vibecli/vibecli-cli/src/serve.rs).
- Update frontend tests (DiffCompleteModal) to include the model field when sending provider so the backend preserves the host's model choice.
- Add LSP mapping tests (toLspCompletionContext) to ensure Monaco trigger kinds map correctly to LSP (avoid emitting LSP's invalid 0).

Rationale: document and validate the new short-form inline completion flow (explicit trigger only), and fix/test completion trigger mapping and model forwarding to avoid provider/model misrouting.

sha2 0.11 + hmac 0.13 moved to digest 0.11, which splits the traits the
old code relied on. Rather than pinning back to 0.10/0.12, migrate the
four call sites:

- `Mac` no longer provides `new_from_slice` — it moved to `KeyInit`, so
  import both in mitm.rs, bedrock.rs and zhipu.rs.
- `finalize()` returns `hybrid_array::Array`, which has no `LowerHex`
  impl, so `format!("{:x}", …)` no longer compiles. kodegraph's
  `hash_content` folds the bytes into lowercase hex by hand.

That hash is a persisted cache key (`file_path -> content hash`), so its
encoding is on-disk format, not an implementation detail — a changed
encoding would invalidate every stored hash and read as a performance
regression rather than a format break. Pin it with a known-answer test;
the existing determinism test would not have caught the difference.

Verified: `cargo check -p vibe-ai -p vibe-broker -p kodegraph` clean,
`cargo test -p kodegraph --lib incremental` 4 passed.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Same class of breakage as the previous commit, across four crates whose
majors landed as pin-only bumps with no code migration:

- hmac 0.13: `new_from_slice` moved from `Mac` to `KeyInit` — import both
  in cloud_ai.rs, company_secrets.rs, github_app.rs, plugin_signing.rs,
  watch_auth.rs.
- sha2 0.11: `finalize()`/`digest()` return `hybrid_array::Array`, which
  has no `LowerHex`, so `format!("{:x}", …)` no longer compiles. Replaced
  with `hex::encode`, which emits the same lowercase hex — these strings
  are manifest digests and signature payloads compared against stored
  values, so the encoding had to stay byte-identical.
- p256 0.14: `to_encoded_point` → `to_sec1_point` in signed_agent_card.rs;
  its re-exported `rand_core::OsRng` is gone, so the `SigningKey::random`
  calls in tests take `rand::rngs::SysRng` instead.
- rustyline: `Highlighter::highlight_char`'s `forced: bool` became
  `kind: CmdKind` in repl.rs.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

…red boilerplate

Two passes over the 1,143-file skill library.

Frontmatter: every skill now carries `name` and `description` ahead of
the existing `category`/`triggers`/`tools_allowed`. The description is a
one-liner in "<what it is>. Use when the task involves <triggers>" form,
so a skill can be selected from a catalog listing without loading its
body.

Deduplication: the AI-personnel and sector-operations skills repeated the
same seven-step lifecycle, inputs/outputs, decision-rights, metrics,
failure-modes and context-modifier prose verbatim in hundreds of files.
Those blocks now point at three new shared skills —
shared-ai-personnel-pattern, shared-sector-operations-pattern,
shared-national-context-modifiers — plus
shared-embodied-autonomy-architecture. Net -5,892 lines.

Also adds skills-index.md, and drops four skills fully superseded by
others (agile-project-management, ai-agent-development, ai-rag-pipeline,
architecture-event-driven); no code or doc referenced them.

Known issue: 204 files carry the "Inputs and outputs" shared-pattern
pointer twice, where the pass replaced two adjacent paragraphs with the
same line. Cosmetic, fixed separately.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

…ble-5

Two registry corrections, both cases of a model list stating something
about the world that nobody re-checked.

gemini-3.5-pro was written in during a June refresh on the strength of a
projected GA date, as both a listed model and the Gemini *default*. It
never GA'd — announced at I/O 2026-05-19, delayed three times, still a
limited Vertex AI preview in August 2026. So every user who selected the
Gemini provider got a model id the API rejects on first call. Default
moves to gemini-3.6-flash, which shipped 2026-07-21.

claude-fable-5 is the inverse: it was omitted with a comment calling it
"not a routable production option" after the 2026-06-12 export-control
suspension. That directive was lifted on 06-30 and Fable 5 returned
globally on 07-01 — the comment had been stale for 40 days. Restored to
both `claude` and `claude-code`. Mythos 5 stays out, but for a reason the
type can express: it came back only for approved US organisations, and a
flat string[] cannot say "available to some callers", so listing it would
403 for most users. It waits on per-model availability metadata.

useModelRegistry.bdd.test.ts is rewritten as a registry-integrity guard:
it cannot know whether a model id is real, but it does pin that no
provider defaults to a model it does not also list — the exact shape the
phantom took. That guard already found a second instance: `vercel_ai`
offers an empty list and an empty default, and is parked in an explicit
exemption roster rather than papered over with invented ids.

Docs updated to match: FEATURE-MATRIX and model-comparison both listed
gemini-3.5-pro as the current flagship and VibeCody's default.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

`cargo check --workspace --all-targets` is green; a plain `cargo check`
was already green with these 30 errors latent, because every remaining
site lives in a `#[cfg(test)]` block or a BDD test target.

- **OsRng -> rand::rng() (16 sites).** p256 0.14 moves elliptic-curve to
  rand_core 0.10, which deleted `OsRng` outright. rand_core 0.10 defines
  `CryptoRng` as a blanket impl over `TryCryptoRng<Error = Infallible>`;
  `SysRng` reads OS entropy and can fail, so it does not qualify, while
  `ThreadRng`'s error is `Infallible`, so it does. Tried SysRng first —
  the compiler rejected it, which is why this went through a build rather
  than a claim.

- **to_encoded_point -> to_sec1_point (9 sites).** Same signature, same
  doc, return type renamed EncodedPoint -> Sec1Point. The production site
  feeds .x()/.y() into a JWK, so encoded key bytes are unchanged and
  existing agent cards still verify.

- **One more {:x} digest site** in plugin_signing.rs, where sha2 0.11's
  Array dropped LowerHex.

Three comments asserted the *opposite* of the truth — that p256 bundled
an older rand_core than the workspace `rand`, so rand's OsRng could not
satisfy the bound. Both are on rand_core 0.10 now and the exclusion runs
the other way, on fallibility. Rewritten; an inverted reason invites the
next person to "fix" it back.

No production code generates P-256 keys — all 16 RNG sites are test-only.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

The dedup pass replaced each boilerplate paragraph with a pointer at the
shared skill's *section*. Where one section had absorbed two adjacent
source paragraphs, both were replaced by the same pointer, leaving it
printed twice with a blank line between.

Three sections were affected across 287 files — "Inputs and outputs"
(204 files, from "Typical inputs:" + "Typical outputs:"), "Cognitive and
control architecture (assumed)" (142), and "Adapting to any nation
(context modifiers)" (27).

No content is lost: each shared skill carries both source paragraphs
under the one heading, using the "Variant — also seen in this position"
convention. Verified before collapsing — the merged text is present in
shared-ai-personnel-pattern.md, shared-embodied-autonomy-architecture.md
and shared-national-context-modifiers.md.

Deletion-only: 746 lines removed, zero added, and only identical pointers
separated by nothing but blank lines were collapsed — two *different*
pointers in a row are left alone.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

The registry-integrity rewrite in 0ccb438 took useModelRegistry's test
file from 25 cases to 5. The 5 that remain are the right guard for the
phantom-model defect, but the rewrite also dropped two things that were
not replaced by anything.

**Hook behaviour** — every test that actually mounted the hook went away,
leaving `refresh()`, the localStorage TTL cache, the dynamic Ollama merge
and the `loading` flag with no coverage at all. Restored as a separate
file, useModelRegistry.hook.bdd.test.ts, so the split is explicit: the
integrity file asserts over the static tables and mounts nothing; this
one mounts the hook and asserts what it does.

**Retired-model guard** — the list of 12 ids confirmed dead on 2026-08-05
(Ollama Cloud 410s, Anthropic and Groq deprecations) went with it. That
is the exact mirror of the phantom-model case the rewrite was written to
prevent: a phantom is an id that is not real *yet*, a retirement is one
that is no longer real, and both reach the user as a first-call failure.
Folded back into the integrity file, where it belongs.

Both restored files keep the original's fix of importing CACHE_KEY rather
than redeclaring it — the literal went stale on the `:v2` bump and the
cache assertions passed against a key nothing reads.

Verified by mutation, not just by green: setting CACHE_TTL_MS to 0 fails
the fresh-cache case, and truncating the dynamic Ollama list fails the
refresh case. Full run: 323 tests across 14 hook files, tsc --noEmit clean.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

The p256 0.14 bump brought ecdsa 0.17, which marks SigningKey::random
#[deprecated(since = "0.17.0", note = "use the `Generate` trait
instead")]. The OsRng migration in the previous commit was therefore
correct but landed 16 call sites on an API already scheduled for
removal — 18 of the build's 34 deprecation warnings, all self-inflicted.

Uses Generate::generate_from_rng(&mut rand::rng()) — same infallible
CryptoRng bound, no feature gate. Generate::generate() would be terser
but sits behind a `getrandom` feature I did not confirm is enabled.

VERIFICATION — partial, stated precisely:

  - An isolated probe crate (p256 0.14 + rand 0.10, own target dir)
    compiles AND runs this exact call form: generate_from_rng resolves
    with `use p256::elliptic_curve::Generate`, to_sec1_point yields
    32-byte x and y, and sign/verify round-trips.
  - Static scope check: all 10 edited files have the Generate import
    reachable from every call site (watch_auth.rs carries four
    function-local imports covering its five calls).
  - NOT yet compiled in-tree. Three attempts were SIGTERMed while queued
    on the shared target lock — another agent session on this machine is
    reaping cargo processes. The edits are a mechanical rename plus
    imports, and the probe covers the API risk, but a green in-tree
    build is still outstanding.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

…/vibecody into feat/competitive-parity-2026

PR #260 squash-merged this branch into main, collapsing 96 commits into
one. Git therefore saw main's squash and this branch's originals as two
independent sets of edits to the same lines, and every file touched
since the previous squash conflicted — 298 files.

Resolved in favour of this branch throughout. That is safe here, and
checked rather than assumed: the set of files differing between main and
this branch is exactly the set touched by the three commits made after
the squash point (a0c8951 skills-pointer dedup, 1949878 test
restoration, 664bb70 ecdsa 0.17), 301 files on both sides with an empty
set difference. main carries no change this branch lacks, so the merged
tree must equal this branch's pre-merge tree — verified below.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

664bb70 does not compile. skill_catalog.rs has three
SigningKey::generate_from_rng calls in three separate functions, each
with its own function-local `use p256::ecdsa::SigningKey;`. The script
that added the `Generate` import used replace(..., 1), so only the
first function got it:

  error[E0599]: no associated function named `generate_from_rng` found
    --> vibecli/vibecli-cli/src/skill_catalog.rs:833:31
    --> vibecli/vibecli-cli/src/skill_catalog.rs:916:31

My verification missed it: I ran a scope-aware check on watch_auth.rs
(whose four function-local imports I had noticed) but for the other nine
files only checked whether the import appeared anywhere in the file —
which cannot distinguish module-level from function-local. The probe
crate proved the API form, never the edits, and I let it stand in for
coverage it could not give.

Now verified by walking back from every call site for an import at an
enclosing indent: 0 uncovered sites across all files.

Still not compiled in-tree — eight attempts were killed by another agent
session's cargo-reaping loops on this machine, the last after building
723 crates in an isolated target dir. CI is the next real check.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Replace p256::ecdsa SigningKey::generate_from_rng calls with SigningKey::try_generate_from_rng(...).expect("ThreadRng is Infallible") in tests. This updates error handling to the p256 API (ThreadRng is infallible), removing the old generate_from_rng usage. Files updated: context_assembler.rs, mcp_governance.rs, plugin_install.rs, plugin_runtime.rs, plugin_signing.rs, session_resume_protocol.rs, signed_agent_card.rs, skill_catalog.rs, watch_auth.rs, and tests/watch_p256_auth_bdd.rs.

…ty-2026

Workspace build warnings fixes