Tighten repo hygiene and Core validation

.agents/test-matrix.yml

@@ -10,15 +10,15 @@ rules:
       - "Tests/*.swift"
       - "Tests/FastTests.manifest"
     checks:
-      - "bash build.sh"
+      - "bash build.sh --no-open"
       - "bash run-tests.sh"
 
   - paths:
       - "Sources/Meeting/**"
       - "Sources/TranscriptedCore/**"
       - "Tests/Integration/**"
     checks:
-      - "bash build.sh"
+      - "bash build.sh --no-open"
       - "bash run-tests.sh"
       - "bash run-integration-smoke.sh"
 
@@ -29,6 +29,52 @@ rules:
     checks:
       - "bash run-e2e-smoke.sh"
 
+  - paths:
+      - "build-deps.sh"
+      - "scripts/entrypoints/build-deps.sh"
+    checks:
+      - "scripts/dev/agent-preflight.sh"
+      - "bash -n build-deps.sh"
+      - "bash -n scripts/entrypoints/build-deps.sh"
+      - "bash build-deps.sh --force"
+
+  - paths:
+      - "build.sh"
+      - "scripts/entrypoints/build.sh"
+    checks:
+      - "scripts/dev/agent-preflight.sh"
+      - "bash -n build.sh"
+      - "bash -n scripts/entrypoints/build.sh"
+      - "bash build.sh --no-open"
+
+  - paths:
+      - "run-tests.sh"
+      - "scripts/entrypoints/run-tests.sh"
+      - "Tests/FastTests.manifest"
+    checks:
+      - "scripts/dev/agent-preflight.sh"
+      - "bash -n run-tests.sh"
+      - "bash -n scripts/entrypoints/run-tests.sh"
+      - "bash run-tests.sh"
+
+  - paths:
+      - "run-integration-smoke.sh"
+      - "scripts/entrypoints/run-integration-smoke.sh"
+      - "Tests/Integration/**"
+    checks:
+      - "scripts/dev/agent-preflight.sh"
+      - "bash -n run-integration-smoke.sh"
+      - "bash -n scripts/entrypoints/run-integration-smoke.sh"
+      - "bash run-integration-smoke.sh"
+
+  - paths:
+      - "run-daily-audio-reliability.sh"
+      - "scripts/ops/daily-audio-reliability-check.sh"
+    checks:
+      - "scripts/dev/agent-preflight.sh"
+      - "bash -n run-daily-audio-reliability.sh"
+      - "bash -n scripts/ops/daily-audio-reliability-check.sh"
+
   - paths:
       - "scripts/ops/transcripted-qa-bench.sh"
       - "scripts/ops/validate-meeting-corpus.py"
@@ -39,6 +85,18 @@ rules:
       - "python3 -m py_compile scripts/ops/validate-meeting-corpus.py"
       - "python3 -m py_compile scripts/ops/compare-meeting-corpus.py"
 
+  - paths:
+      - "scripts/ops/agent-todo-runner.rb"
+      - "scripts/ops/agent-todo-launchagent.sh"
+      - "scripts/ops/qa-gate-check.sh"
+      - "scripts/ops/qa-gate-closeout.sh"
+    checks:
+      - "scripts/dev/agent-preflight.sh"
+      - "ruby -c scripts/ops/agent-todo-runner.rb"
+      - "bash -n scripts/ops/agent-todo-launchagent.sh"
+      - "bash -n scripts/ops/qa-gate-check.sh"
+      - "bash -n scripts/ops/qa-gate-closeout.sh"
+
   - paths:
       - "Tests/TranscriptedCoreTests/LiveCaptureSmokeTests.swift"
       - "run-live-capture-smoke.sh"
@@ -51,7 +109,7 @@ rules:
       - "Sources/TranscriptedCore/**"
       - "Tests/TranscriptedCoreTests/**"
     checks:
-      - "bash build.sh"
+      - "bash build.sh --no-open"
       - "bash run-tests.sh"
       - "bash run-integration-smoke.sh"
       - "swift test"
@@ -62,7 +120,7 @@ rules:
       - "docs/sparkle-updates.md"
       - "docs/appcast.xml"
     checks:
-      - "bash build.sh"
+      - "bash build.sh --no-open"
       - "bash run-tests.sh"
 
   - paths:
@@ -74,7 +132,7 @@ rules:
       - "Casks/**"
       - "docs/appcast.xml"
     checks:
-      - "bash build.sh"
+      - "bash build.sh --no-open"
       - "bash run-tests.sh"
       - "SKIP_NOTARIZATION=1 bash build-beta.sh <token> <user-name>"
 
@@ -99,8 +157,11 @@ rules:
       - "AGENTS.md"
       - "CLAUDE.md"
       - "CONTRIBUTING.md"
+      - "WORKFLOW.md"
       - "docs/**"
       - ".agents/**"
+      - ".github/**"
+      - "scripts/dev/agent-preflight.sh"
     checks:
       - "scripts/dev/agent-preflight.sh"
 

.github/ISSUE_TEMPLATE/agent_task.md

@@ -19,3 +19,8 @@ assignees: ""
 ## Verification
 
 - [ ]
+
+## Queue note
+
+This template does not start the local runner by itself. After checking the
+issue is ready for Codex, add the `agent todo` label.

.github/ISSUE_TEMPLATE/bug_report.md

@@ -36,6 +36,8 @@ What actually happened.
 
 **Diagnostics**
 If you have logs, screenshots, or exported diagnostics, attach them here.
+Please redact transcripts, audio, meeting titles, speaker names, emails, tokens,
+absolute paths, and private customer or meeting data before uploading.
 
 If this report is about the old standalone Transcripted app, say so explicitly
 and include the legacy ref you were using (`legacy/transcripted-standalone` or

.github/ISSUE_TEMPLATE/feature_request.md

@@ -30,6 +30,8 @@ Any other approaches you've thought about.
 
 **Anything else?**
 Examples, screenshots, links, or things we should avoid.
+Please do not include private transcripts, audio, meeting titles, speaker names,
+emails, tokens, absolute paths, or customer data.
 
 If this request is specifically about the old standalone Transcripted app, say
 that explicitly so it can be triaged against the legacy branch/tag.

.github/PULL_REQUEST_TEMPLATE.md

@@ -13,10 +13,12 @@
 
 ## How I checked it
 
-- [ ] `bash build.sh`
+- [ ] `scripts/dev/agent-preflight.sh`
+- [ ] `bash build.sh --no-open`
 - [ ] `bash run-tests.sh`
-- [ ] Performance budget passed (`bash build.sh` runs the bundle gate; run `scripts/ops/performance-budget.rb --events "$HOME/Library/Application Support/Transcripted/logs/events.jsonl"` for runtime-sensitive changes)
+- [ ] Performance budget passed (`bash build.sh --no-open` runs the bundle gate; run `scripts/ops/performance-budget.rb --events "$HOME/Library/Application Support/Transcripted/logs/events.jsonl"` for runtime-sensitive changes)
 - [ ] `bash run-integration-smoke.sh` if I touched `Sources/Meeting/` or `Sources/TranscriptedCore/`
+- [ ] `swift test` if I touched `Package.swift`, `Sources/TranscriptedCore/`, or the public core seam
 - [ ] Manual check:
 
 ## Risk Review
@@ -25,6 +27,9 @@
 - [ ] Storage path or migration impact reviewed
 - [ ] Public-facing copy stays concrete and matches current product scope
 - [ ] Release/update impact reviewed (`CFBundleShortVersionString`, `docs/appcast.xml`, or user-facing caveats if applicable)
+- [ ] Agent PRs link the issue/workpad and stay draft until human review
+- [ ] UI changes include sanitized `.agent-review/visuals/` evidence
+- [ ] No private transcripts, audio, tokens, personal paths, or customer data are included
 
 ## Notes
 

.github/workflows/qa-gate-auto-close-bet88.yml

@@ -13,7 +13,8 @@ jobs:
       ${{
         github.event.issue.number == 428 &&
         github.actor != 'github-actions[bot]' &&
-        github.event.comment.user.login == 'r3dbars'
+        github.event.comment.user.login == 'r3dbars' &&
+        contains(github.event.issue.labels.*.name, 'qa-gate-auto-close')
       }}
     runs-on: ubuntu-latest
     timeout-minutes: 5
@@ -52,7 +53,6 @@ jobs:
         with:
           script: |
             const issue_number = context.payload.issue.number;
-            const child_issue_number = 456;
             const owner = context.repo.owner;
             const repo = context.repo.repo;
             await github.rest.issues.update({
@@ -68,27 +68,13 @@ jobs:
               issue_number,
               body: "Auto-close: detected top-level PASS comment for BET-88 QA gate."
             });
-            await github.rest.issues.update({
-              owner,
-              repo,
-              issue_number: child_issue_number,
-              state: "closed",
-              state_reason: "completed"
-            });
-            await github.rest.issues.createComment({
-              owner,
-              repo,
-              issue_number: child_issue_number,
-              body: "Auto-close: BET-88 QA gate transitioned to PASS on #428."
-            });
 
       - name: Open or reuse follow-up issue on FAIL
         if: steps.detect.outputs.status == 'fail'
         uses: actions/github-script@v7
         with:
           script: |
             const issue_number = context.payload.issue.number;
-            const child_issue_number = 456;
             const owner = context.repo.owner;
             const repo = context.repo.repo;
             const failComment = context.payload.comment?.html_url ?? "";
@@ -128,16 +114,3 @@ jobs:
               issue_number,
               body: `Auto-follow-up: detected top-level FAIL. Tracking fix in #${followup.number}.`
             });
-            await github.rest.issues.update({
-              owner,
-              repo,
-              issue_number: child_issue_number,
-              state: "closed",
-              state_reason: "completed"
-            });
-            await github.rest.issues.createComment({
-              owner,
-              repo,
-              issue_number: child_issue_number,
-              body: `Auto-close: BET-88 QA gate transitioned to FAIL on #428. Follow-up is #${followup.number}.`
-            });

.github/workflows/repo-hygiene.yml

@@ -0,0 +1,51 @@
+name: Repo Hygiene
+
+on:
+  pull_request:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  repo-hygiene:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v5
+        with:
+          fetch-depth: 0
+
+      - name: Agent preflight
+        shell: bash
+        run: bash scripts/dev/agent-preflight.sh origin/main
+
+      - name: Shell syntax
+        shell: bash
+        run: |
+          set -euo pipefail
+          bash -n build-deps.sh
+          bash -n build-beta.sh
+          bash -n build.sh
+          bash -n run-tests.sh
+          bash -n run-integration-smoke.sh
+          bash -n run-e2e-smoke.sh
+          bash -n run-live-capture-smoke.sh
+          bash -n run-daily-audio-reliability.sh
+          find scripts -name '*.sh' -print0 | xargs -0 -n1 bash -n
+
+      - name: Ruby syntax
+        shell: bash
+        run: ruby -c scripts/ops/agent-todo-runner.rb
+
+      - name: Python syntax
+        shell: bash
+        run: |
+          set -euo pipefail
+          python3 -m py_compile scripts/ops/validate-meeting-corpus.py
+          python3 -m py_compile scripts/ops/compare-meeting-corpus.py
+          python3 -m py_compile scripts/ops/nightly-security-check.py
+          python3 -m py_compile scripts/ops/generate-nightly-digest.py
+          python3 -m py_compile scripts/ops/build-codex-memory-index.py

AGENTS.md

@@ -60,15 +60,15 @@ file taking precedence when there is any conflict.
 
 ```bash
 bash build-deps.sh
-bash build.sh
+bash build.sh --no-open
 bash run-tests.sh
 bash run-integration-smoke.sh
 swift test
 ```
 
 Rules:
 
-1. After changing Swift source, run `bash build.sh` and `bash run-tests.sh`.
+1. After changing Swift source, run `bash build.sh --no-open` and `bash run-tests.sh`.
 2. If you touch `Sources/Meeting/` or `Sources/TranscriptedCore/`, also run `bash run-integration-smoke.sh`.
 3. If you touch `Package.swift`, `Sources/TranscriptedCore/`, or the public core seam, also run `swift test`.
 4. `build.sh` must not compile `Sources/TranscriptedCore/` directly into the app target.
@@ -100,7 +100,7 @@ Rules:
    - any automatic-check / automatic-download flags
 9. Preferred release verification for release-path changes:
    - `bash build-deps.sh --force` when dependency tooling changes
-   - `bash build.sh`
+   - `bash build.sh --no-open`
    - `bash run-tests.sh`
    - `SKIP_NOTARIZATION=1 bash build-beta.sh <token> <user-name>` for packaging smoke, or the full notarized path when cutting a real release
 
@@ -141,7 +141,7 @@ Rules:
    - Settings should still expose the anonymous analytics toggle
    - Settings should still expose the `Send Test Sentry Event` action when Sentry is configured
 12. Preferred verification for observability-related changes:
-   - `bash build.sh`
+   - `bash build.sh --no-open`
    - `bash run-tests.sh`
    - confirm Sentry, analytics, and observability preference tests still pass through `run-tests.sh`
 

AGENT_START.md

@@ -46,7 +46,7 @@ checks for the files changed.
 
 Default rules:
 
-- Swift app change: `bash build.sh` and `bash run-tests.sh`
+- Swift app change: `bash build.sh --no-open` and `bash run-tests.sh`
 - `Sources/Meeting/` or `Sources/TranscriptedCore/`: also `bash run-integration-smoke.sh`
 - `Package.swift` or public core seam: also `swift test`
 - release/update path: read `docs/release-packaging.md` and `docs/sparkle-updates.md`

CLAUDE.md

@@ -28,15 +28,15 @@ Before making assumptions about the codebase:
 6. `Sources/CLAUDE.md` — app target orientation
 7. the nearest local `CLAUDE.md` for the area you are changing (see "Subsystem docs" below)
 
-When docs disagree, prefer: current repo-level docs → current source → local `CLAUDE.md` whose file lists still match the tree → `docs/archive/` only as context.
+When docs disagree, split the decision: `AGENTS.md` and `.agents/test-matrix.yml` win for workflow contracts; current source wins for runtime behavior and file existence; local `CLAUDE.md` files explain subsystem intent when their file lists still match the tree; `docs/archive/` is context only.
 
 ## Build and test
 
 Common commands (thin root wrappers; implementations live under `scripts/entrypoints/`):
 
 ```bash
 bash build-deps.sh                 # build/refresh prebuilt deps under deps-libs/, deps-frameworks/, deps-modules/
-bash build.sh                      # authoritative app build (raw swiftc, NOT swift build)
+bash build.sh --no-open            # authoritative app build for non-interactive verification
 bash run-tests.sh                  # curated fast tests (manifest-driven)
 bash run-integration-smoke.sh      # app/core linkage + wake recovery + MicRecordingFileMerger
 bash run-e2e-smoke.sh              # deterministic release-critical artifact smoke (no mic/TCC)
@@ -48,18 +48,18 @@ bash scripts/dev/agent-preflight.sh  # prints suggested verification map for the
 
 Verification rules (mirror `.agents/test-matrix.yml`; if a change matches multiple rules, run the union):
 
-- Touched `Sources/**/*.swift`, root `Tests/*.swift`, or `Tests/FastTests.manifest` → `bash build.sh` + `bash run-tests.sh`
-- Touched `Sources/Meeting/**`, `Sources/TranscriptedCore/**`, or `Tests/Integration/**` → `bash build.sh` + `bash run-tests.sh` + `bash run-integration-smoke.sh`
+- Touched `Sources/**/*.swift`, root `Tests/*.swift`, or `Tests/FastTests.manifest` → `bash build.sh --no-open` + `bash run-tests.sh`
+- Touched `Sources/Meeting/**`, `Sources/TranscriptedCore/**`, or `Tests/Integration/**` → `bash build.sh --no-open` + `bash run-tests.sh` + `bash run-integration-smoke.sh`
 - Touched `Tests/E2E/**`, `run-e2e-smoke.sh`, or `scripts/entrypoints/run-e2e-smoke.sh` → `bash run-e2e-smoke.sh`
 - Touched QA bench/corpus files (`scripts/ops/transcripted-qa-bench.sh`, `scripts/ops/validate-meeting-corpus.py`, `scripts/ops/compare-meeting-corpus.py`, `docs/qa-test-bench.md`) → quick QA bench + Python compile checks
 - Touched live-capture smoke paths (`Tests/TranscriptedCoreTests/LiveCaptureSmokeTests.swift`, `run-live-capture-smoke.sh`, `scripts/entrypoints/run-live-capture-smoke.sh`) → `bash run-live-capture-smoke.sh --skip-build`
-- Touched `Package.swift`, `Sources/TranscriptedCore/**`, or `Tests/TranscriptedCoreTests/**` → `bash build.sh` + `bash run-tests.sh` + `bash run-integration-smoke.sh` + `swift test`
-- Touched `Sources/Observability/**`, `Info.plist`, `docs/sparkle-updates.md`, or `docs/appcast.xml` → `bash build.sh` + `bash run-tests.sh`
-- Touched release path (`build-beta.sh`, `scripts/entrypoints/build-beta.sh`, `scripts/release/**`, `docs/release-packaging.md`, `docs/sparkle-updates.md`, `Casks/**`, `docs/appcast.xml`) → `bash build.sh` + `bash run-tests.sh` + `SKIP_NOTARIZATION=1 bash build-beta.sh <token> <user-name>`
+- Touched `Package.swift`, `Sources/TranscriptedCore/**`, or `Tests/TranscriptedCoreTests/**` → `bash build.sh --no-open` + `bash run-tests.sh` + `bash run-integration-smoke.sh` + `swift test`
+- Touched `Sources/Observability/**`, `Info.plist`, `docs/sparkle-updates.md`, or `docs/appcast.xml` → `bash build.sh --no-open` + `bash run-tests.sh`
+- Touched release path (`build-beta.sh`, `scripts/entrypoints/build-beta.sh`, `scripts/release/**`, `docs/release-packaging.md`, `docs/sparkle-updates.md`, `Casks/**`, `docs/appcast.xml`) → `bash build.sh --no-open` + `bash run-tests.sh` + `SKIP_NOTARIZATION=1 bash build-beta.sh <token> <user-name>`
 - Touched `Tools/TranscriptedCLI/**` → `swift test --package-path Tools/TranscriptedCLI`
 - Touched `Tools/TranscriptedMCP/**` → `swift test --package-path Tools/TranscriptedMCP`
 - Touched `Tools/TranscriptedQA/**` → `swift test --package-path Tools/TranscriptedQA`
-- Touched docs/agent files (`README.md`, `AGENT_START.md`, `AGENTS.md`, `CLAUDE.md`, `CONTRIBUTING.md`, `docs/**`, `.agents/**`) → `scripts/dev/agent-preflight.sh`
+- Touched docs/agent files (`README.md`, `AGENT_START.md`, `AGENTS.md`, `CLAUDE.md`, `CONTRIBUTING.md`, `WORKFLOW.md`, `docs/**`, `.agents/**`, `.github/**`) → `scripts/dev/agent-preflight.sh`
 
 ### Fast-test gotchas