fix: stabilize diagnostics and low-end hooks (#441)

* refactor(core): isolate diagnostics sink boundary

Keep structured log construction and GDPR redaction renderer-neutral, then pass the typed LogEntry to the existing IDB, Tauri JSONL, and development-console adapters. Preserve all logger APIs and sink behavior; this slice does not switch production authority or migrate callers.\n\nValidation: targeted Vitest 22/22, Biome, tsgo, docs metrics, native-readiness, desktop import guardrail, and diff checks passed. No new dependency or suppression was added. Local hooks remain bypassed only because pnpm reports ERR_PNPM_VERIFY_DEPS_BEFORE_RUN on the existing install; CI remains authoritative.

* docs(native): keep diagnostics maturity evidence honest

Record the new typed sink boundary as locally proven and CI merge-gated until this PR lands; retain the existing CI-proven Core/redaction parity claims. No architecture or authority status changes.\n\nValidation: docs metrics, native-readiness, and diff checks passed. Local hook bypass remains limited to the known ERR_PNPM_VERIFY_DEPS_BEFORE_RUN install mismatch.

* fix(diagnostics): redact nested sensitive context

Address Amazon Q security finding PRRT_kwDOQOeAgc6bGOWM: nested password/token values could bypass the previous top-level-only redaction. Recursively sanitize JSON-like objects and arrays in TypeScript and Rust, preserve non-mutating behavior, and update the shared parity fixture.\n\nValidation: targeted Vitest 22/22, tsgo, Biome, cargo fmt --check, and worldscript-diagnostics unit plus shared-fixture tests passed. The full local Cargo test also reached only the separate doctest, which could not create its temporary directory because this environment exposes /tmp as read-only; the test-only command passed. No dependency, suppression, authority switch, or baseline change. Local hooks remain bypassed only for ERR_PNPM_VERIFY_DEPS_BEFORE_RUN.

* fix(diagnostics): route sinks through desktop platform

* chore(tooling): stabilize low-end git hooks

* fix(desktop): preserve adapter diagnostics context

* fix: close release and translation quality blind spots

* test: stabilize tauri runtime mock initialization

* fix: close diagnostics review and coverage gaps

* style: apply rustfmt to diagnostics redaction

* test: close diagnostics coverage gaps

* fix: allow tagless release-truth checks

* fix: align native IV redaction

Author: qnbs

AGENTS.md

@@ -33,9 +33,9 @@ The app supports a multi-provider AI stack (Gemini, OpenAI, Claude, Grok, OpenRo
    ```bash
    pnpm run ci:prepush
    ```
-   This gate is mandatory before every push and after every local correction before re-pushing; all three checks must exit successfully. A targeted test or changed-file lint run alone is not push evidence. The pre-commit hook checks staged files with Biome, while the pre-push gate runs the full repository lint before typecheck and i18n validation. If branch switching or a lockfile/package-manifest change makes pnpm report dependency verification errors, repair first with `pnpm install --frozen-lockfile` and rerun the complete pre-push gate.
+   This gate is mandatory before every push and after every local correction before re-pushing; it runs sequentially with a single-checker project typecheck, i18n parity/quality and bundle checks, release/doc truth, and lightweight native guardrails. The pre-commit hook separately runs staged-file Biome checks. Full repository lint, coverage, E2E, Storybook, Lighthouse, and mutation checks belong to cloud CI. If branch switching or a lockfile/package-manifest change makes pnpm report dependency verification errors, run `node scripts/dependency-state.mjs reconcile` and rerun the complete pre-push gate.
    Optional targeted smoke test: `pnpm exec vitest run <path>` **without** `--coverage`.
-   **Hard rule:** Never invoke `pnpm test`, `npm run test`, or a bare Vitest wrapper; always use an explicit `pnpm exec vitest run <path>` command to avoid watch-mode hangs on constrained hardware.
+   **Hard rule:** Never invoke `pnpm test`, `npm run test`, or a bare Vitest wrapper; always use an explicit `pnpm exec vitest run <path>` command to avoid watch-mode hangs on constrained hardware. Never start multiple heavyweight processes concurrently.
 4. **Audit cloud CI logs, fix locally, then re-push** – If the cloud CI run fails, inspect the logs via GitHub web UI or `gh run watch`, reproduce the specific failing test or lint error in isolation, fix it locally (quick tier to verify), commit, and push again for another cloud CI run.
 5. **Sequential execution** – Do not parallelize builds, tests, or processes locally. Use single-threaded modes and avoid background tasks that compete for RAM/CPU.
 6. **Resource budget** – Avoid spinning up the dev server (`pnpm run dev`) for extended periods if not needed. Prefer one-off commands (`pnpm run build`, `pnpm run typecheck`) and stop the server when done.
@@ -169,6 +169,7 @@ pnpm run lint               # Biome lint (--error-on-warnings)
 pnpm run lint:fix           # Biome check --write (lint + format)
 pnpm run format             # Biome format --write
 pnpm run typecheck          # tsgo --project tsconfig.tsgo.json --noEmit --checkers 4
+pnpm run typecheck:single   # local low-end typecheck: one checker, sequential
 pnpm run i18n:check         # Locale key parity vs English + rebuild bundles + content guard
 pnpm run parity:check       # Feature parity audit
 pnpm run suppressions:check # Biome-ignore count ratchet
@@ -261,8 +262,10 @@ On any non-trivial change, add a single-line comment explaining **why**, not wha
 ### Commit Messages
 
 Conventional Commits: `feat:`, `fix:`, `docs:`, `refactor:`, `test:`, `chore:`.
-After an explicit `pnpm run hooks:install`, the pre-commit hook runs `biome check --write` on staged
-files via `simple-git-hooks` + `lint-staged`, and the pre-push hook runs `pnpm run ci:prepush`.
+After an explicit `pnpm run hooks:install`, the pre-commit hook runs `lint-staged` on staged files
+through `node scripts/hooks/pre-commit.mjs`; the pre-push hook runs
+`node scripts/hooks/pre-push.mjs`. These direct Node entrypoints verify the content fingerprint
+and invoke local binaries without pnpm's workspace-state preflight in the hook path.
 The pre-commit hook is not a substitute for the complete pre-push gate; CI remains mandatory when
 hooks are not installed.
 
@@ -273,12 +276,21 @@ hooks are not installed.
 ### Philosophy
 
 - **Cloud CI-first:** The canonical quality gate is GitHub Actions. Low-end local machines should run only the "Quick" tier.
-- **Quick tier (local, before every push):** `pnpm run ci:prepush` runs the full repository lint, then
-  the exact CI typecheck and i18n checks sequentially. Staged-file Biome validation still runs in
-  pre-commit. Run the gate
-  again after every correction before re-pushing; do not push based only on a targeted test or a
-  changed-file lint run. Optionally: `pnpm exec vitest run <path>`
-  **without** `--coverage`.
+- **Quick tier (local, before every push):** `pnpm run ci:prepush` runs the project typecheck with
+  one checker, i18n parity/quality/bundle/content checks, release/doc truth, and lightweight desktop guardrails sequentially;
+  the pre-commit hook separately runs staged-file Biome checks. Run the gate again after every
+  correction before re-pushing; do not
+  push based only on a targeted test or a changed-file lint run. Optionally:
+  `pnpm exec vitest run <path>` **without** `--coverage`.
+- **Dependency state:** `pnpm run deps:verify` compares a content fingerprint of dependency
+  manifests, workspace package manifests, and patches. After a dependency-related branch switch,
+  run `node scripts/dependency-state.mjs reconcile` (or `pnpm run deps:reconcile` when pnpm can
+  start); never use `--no-verify` as the
+  normal recovery path.
+- **Low-resource policy:** Never run Biome, multiple TypeScript checkers, Vitest, Cargo, Vite,
+  Storybook, or other heavyweight processes concurrently on the development workstation. Full
+  repository lint/tests, E2E, coverage, Lighthouse, and mutation testing are cloud-CI work unless
+  the user explicitly requests a narrowly scoped local run.
 - **Vitest watch-mode hard rule:** Never invoke `pnpm test`, `npm run test`, or a bare Vitest wrapper; use an explicit targeted `pnpm exec vitest run <path>` command so constrained hardware never waits on watch mode.
 - **Heavy tier (CI):** Vitest with coverage thresholds, Playwright E2E (desktop + mobile emulation), Lighthouse CI, Stryker mutation, Storybook static build, bundle budget + analyze.
 
@@ -375,6 +387,8 @@ Never commit directly to `main` — always a feature branch + PR, even for a sin
 
 **Review-comment completeness — check three independent channels before declaring a PR review-clean, every time:** (1) GraphQL `reviewThreads` for inline per-line comments; (2) `gh api repos/<owner>/<repo>/issues/<PR>/comments` for plain top-level bot comments (qodo-code-review posts its real findings only here, never as `reviewThreads`); (3) `gh api repos/<owner>/<repo>/pulls/<PR>/reviews`, reading each review's full `.body` text (CodeRabbit's "🧹 Nitpick comments" and outside-diff-range findings live here, collapsed, invisible to the other two channels). A bot using one channel on a PR doesn't mean the others are covered.
 
+**Squash-merge verification:** Never infer a missing merge from `git merge-base --is-ancestor` alone. For every PR, verify `state=MERGED`, `merged_at`, and the resulting `merge_commit_sha`; compare the base commit immediately before the merge with that resulting `main` commit, including changed files, additions, and deletions. Use patch/tree equivalence as an optional corroboration. This is required because GitHub squash merges intentionally produce a new commit whose SHA is not the PR head SHA.
+
 **Known review bots on this repo** (confirm still installed — this list can drift): CodeRabbit (`@coderabbitai review` to re-trigger), CodeAnt AI (5 CI status checks only — `CodeAnt - Quality Gates/SAST/SCA/SCR/Test Coverage` — not inline PR comments here), qodo-code-review (top-level comments, see above), Amazon Q Developer (`/q review` as a fresh top-level comment — not inside an existing thread; quota-conscious — call it once CodeRabbit/CodeAnt's own loop has already reached quiescence, not after every fix commit), Graphite AI Reviews (automatic, no confirmed manual trigger), chatgpt-codex-connector (intermittent/quota-limited availability — verify it's currently active rather than assuming silence means "nothing to report"). A bot's silence is not a clean pass by itself — for security/sandbox/IPC/FFI/packaging-adjacent PRs, verify at least one bot produced real review output (its actual comment/review text), not just a green check-run.
 
 **PR size:** keep every PR's changed-file count under ~100 — several review bots skip inline comments above that threshold. Check with `git diff --name-only <base>...HEAD | wc -l` before pushing; split into the fewest stacked PRs that stay under the limit if needed.

CHANGELOG.md

@@ -7,8 +7,6 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
-## [1.28.0] — 2026-08-21
-
 ### Added
 
 - **Cloud model catalog defense-in-depth:** current Anthropic, OpenAI, and xAI model IDs now
@@ -38,6 +36,9 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Changed
 
+- **Diagnostics sink boundary:** structured log construction and recursive redaction now remain
+  portable before serialized IDB, Tauri JSONL, and development-console adapters receive the record;
+  legacy logger APIs remain compatible and no sink authority switch is claimed.
 - **Coverage scope and threshold calibration:** coverage now measures the root application/PWA
   shell; CI recalibrated floors to L80/F72/B66/S78 from the expanded-scope measurement, and the
   token audit baseline was ratcheted down from 160 to the verified current count of 159.
@@ -46,6 +47,11 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   retires CEF from the target architecture.
 - **DesktopPlatform boundary:** direct Tauri imports are mechanically constrained by the zero-
   tolerance guardrail while the renderer-neutral contract becomes the native transition surface.
+- **Diagnostics parity and task contracts:** Rust/TypeScript wire-shape and redaction fixtures now
+  cover the diagnostics boundary, and TaskSupervisor requests/results reject unsupported contract
+  versions before native execution (#437, #439, #440).
+- **Native maturity evidence:** the G1 qualification ledger now records the partial, evidence-backed
+  status of the native migration without claiming a production authority switch (#438).
 
 ### Fixed
 

CONTRIBUTING.md

@@ -189,7 +189,7 @@ Run the smallest gate that matches your change — sequentially, one heavy comma
 
 | Your change… | Run locally before pushing |
 |---|---|
-| **Always** | `pnpm run lint` · `pnpm run typecheck` · targeted `pnpm exec vitest run <path>` (no `--coverage`) |
+| **Always** | `pnpm run ci:prepush` |
 | **Touched any locale JSON** | `pnpm run i18n:check` (parity + bundle rebuild) |
 | **Added/removed a feature flag** | `pnpm exec tsx scripts/audit-feature-parity.ts` (must report 0 drifts) |
 | **Touched `packages/ai-core`, `workers/`, or `vite.config.ts`** | `pnpm run build && pnpm run smoke:prod` (prod-only crash guard) |
@@ -200,7 +200,9 @@ Coverage, E2E, Lighthouse, Stryker, and Storybook test-runner are **CI gate jobs
 
 ### Local vs CI (low-end friendly)
 
-- **Before every push (recommended):** `pnpm run lint`, `pnpm run typecheck`, `pnpm run i18n:check`. Optional: targeted `pnpm exec vitest run <path>` for a quick smoke.
+- **Before every push:** `pnpm run ci:prepush` (sequential single-checker typecheck, i18n parity/quality, release/doc truth, and lightweight guardrails); the pre-commit hook runs staged Biome checks. Optional: targeted `pnpm exec vitest run <path>` for a quick smoke.
+- **Full local gate (manual):** `pnpm run ci:local:full`; full tests, coverage, E2E, Storybook, Lighthouse, and mutation testing remain CI-owned on low-end hardware.
+- **Dependency recovery:** run `node scripts/dependency-state.mjs reconcile` when pnpm reports stale dependency state. It performs the frozen install and records the content fingerprint atomically; `pnpm run deps:reconcile` is the convenience wrapper when pnpm can launch.
 - **Vitest hard rule:** Never invoke `pnpm test`, `npm run test`, or a bare Vitest wrapper; watch mode hangs constrained hardware. Use an explicit targeted `pnpm exec vitest run <path>` command.
 - **Full gate:** GitHub Actions runs Vitest **with** coverage thresholds, Playwright (desktop + mobile emulation in CI), Lighthouse, etc. A **green CI run** is the merge bar — you are **not** required to pass full E2E or LHCI on a weak laptop.
 - **Optional local E2E:** `CI=true pnpm run test:e2e` when debugging; optional mobile project: `RUN_MOBILE_E2E=1` (see [`docs/CI.md`](docs/CI.md)).
@@ -387,13 +389,11 @@ Open a **focused PR per theme** (storage vs. i18n vs. collaboration) to keep rev
 
 1. Fork the repository and create a feature branch
 2. Write or update tests for your changes
-3. Let CI run the full test suite; locally use only targeted `pnpm exec vitest run <path>`.
-4. Ensure Biome passes: `pnpm run lint`
-5. Ensure i18n parity: `pnpm run i18n:check`
-6. Ensure types compile: `pnpm run typecheck`
-7. Ensure the build succeeds when build-affecting files changed; GitHub Actions runs the canonical build gate for every PR.
-8. Submit a PR against `main` with a clear description
-9. Request review from at least one maintainer
+3. Run the sequential local gate: `pnpm run ci:prepush` (and the optional targeted `pnpm exec vitest run <path>` when useful).
+4. Let CI run the full lint and test suite; it is authoritative for the heavy tier.
+5. Ensure the build succeeds when build-affecting files changed; GitHub Actions runs the canonical build gate for every PR.
+6. Submit a PR against `main` with a clear description
+7. Request review from at least one maintainer
 
 The CI pipeline will automatically run lint, i18n check, typecheck, tests, and build on every PR.
 

README.md

@@ -9,7 +9,7 @@
   <img src="https://img.shields.io/badge/TypeScript-7.x_(tsgo)-3178C6?logo=typescript&logoColor=white" alt="TypeScript 7 (tsgo)">
   <img src="https://img.shields.io/badge/AI-Gemini_%7C_OpenAI_%7C_OpenRouter_%7C_Ollama_%7C_WebLLM-4285F4?logo=google" alt="Gemini · OpenAI · OpenRouter · Ollama · WebLLM">
   <img src="https://img.shields.io/badge/Local_AI-WebGPU_%7C_ONNX_%7C_Transformers.js-8B5CF6" alt="WebGPU · ONNX · Transformers.js">
-  <img src="https://img.shields.io/badge/Version-v1.28.0-6366F1" alt="v1.28.0">
+  <img src="https://img.shields.io/badge/Next-v1.28.0-6366F1" alt="Next v1.28.0 (unreleased)">
   <img src="https://img.shields.io/badge/Storage-IndexedDB_v8-F59E0B" alt="IndexedDB v8">
   <img src="https://img.shields.io/badge/PWA-v3.0-5BB974?logo=pwa" alt="PWA v3.0">
   <img src="https://img.shields.io/badge/i18n-19_locales-2922_keys-0EA5E9" alt="i18n 19 locales — 2922 keys">

biome.json

@@ -125,7 +125,7 @@
       }
     },
     {
-      "includes": ["services/logger.ts"],
+      "includes": ["services/logger.ts", "services/diagnostics/logSinks.ts"],
       "linter": {
         "rules": {
           "suspicious": {

crates/worldscript-diagnostics/src/lib.rs

@@ -32,24 +32,32 @@ pub struct LogEntry {
     pub context: Option<Map<String, Value>>,
 }
 
-/// Redact sensitive top-level context keys using the existing TypeScript contract.
+/// Redact sensitive keys recursively in JSON objects and arrays.
 ///
-/// The current TS implementation intentionally redacts keys only, not values nested under
-/// otherwise-safe keys. Keeping that scope exact avoids an unreviewed wire-contract change.
+/// This mirrors the TypeScript diagnostics boundary so sensitive values cannot bypass redaction
+/// by being placed below an otherwise-safe object key.
 pub fn sanitize_context(context: &Map<String, Value>) -> Map<String, Value> {
     context
         .iter()
         .map(|(key, value)| {
             let sanitized = if is_sensitive_key(key) {
                 Value::String(REDACTED.to_string())
             } else {
-                value.clone()
+                sanitize_value(value)
             };
             (key.clone(), sanitized)
         })
         .collect()
 }
 
+fn sanitize_value(value: &Value) -> Value {
+    match value {
+        Value::Object(object) => Value::Object(sanitize_context(object)),
+        Value::Array(items) => Value::Array(items.iter().map(sanitize_value).collect()),
+        _ => value.clone(),
+    }
+}
+
 /// Return a sanitized copy of a structured log entry without mutating its input.
 pub fn sanitize_entry(entry: &LogEntry) -> LogEntry {
     LogEntry {
@@ -60,10 +68,43 @@ pub fn sanitize_entry(entry: &LogEntry) -> LogEntry {
 
 fn is_sensitive_key(key: &str) -> bool {
     let lowercase = key.to_ascii_lowercase();
+    // QNBS-v3: normalize separator variants so native redaction matches the shared diagnostics contract.
+    let compact = lowercase.replace(['_', '-'], "");
     lowercase.contains("key")
         || lowercase.contains("token")
         || lowercase.contains("password")
         || lowercase.contains("passphrase")
+        || is_iv_key(key)
+        || compact.contains("initializationvector")
+        || compact.contains("initialvector")
+}
+
+fn is_iv_key(key: &str) -> bool {
+    let bytes = key.as_bytes();
+    let is_iv = |index: usize| {
+        bytes.get(index).is_some_and(|b| *b == b'i' || *b == b'I')
+            && bytes
+                .get(index + 1)
+                .is_some_and(|b| *b == b'v' || *b == b'V')
+    };
+    for index in 0..bytes.len().saturating_sub(1) {
+        if !is_iv(index) {
+            continue;
+        }
+        let before_ok = index == 0
+            || bytes[index - 1] == b'_'
+            || bytes[index - 1] == b'-'
+            || bytes[index - 1].is_ascii_lowercase();
+        let after = bytes.get(index + 2).copied();
+        let after_ok = after.is_none()
+            || after == Some(b'_')
+            || after == Some(b'-')
+            || after.is_some_and(|b| b.is_ascii_uppercase());
+        if before_ok && after_ok {
+            return true;
+        }
+    }
+    false
 }
 
 #[cfg(test)]
@@ -90,10 +131,7 @@ mod tests {
         assert_eq!(sanitized["myPassword"], json!(REDACTED));
         assert_eq!(sanitized["recoveryPassphrase"], json!(REDACTED));
         assert_eq!(sanitized["userId"], json!(42));
-        assert_eq!(
-            sanitized["nested"],
-            json!({ "token": "still-owned-by-the-nested-value" })
-        );
+        assert_eq!(sanitized["nested"], json!({ "token": REDACTED }));
         assert_eq!(context["apiKey"], json!("secret"));
     }
 
@@ -140,4 +178,34 @@ mod tests {
         );
         assert_eq!(entry.context.as_ref().unwrap()["apiKey"], json!("secret"));
     }
+
+    #[test]
+    fn redacts_iv_variants_without_redacting_ordinary_words() {
+        let context = serde_json::from_value(json!({
+            "iv": "one",
+            "ivHex": "two",
+            "encryptionIv": "three",
+            "initializationVector": "four",
+            "initialization_vector": "five",
+            "initialization-vector": "six",
+            "initial_vector": "seven",
+            "initial-vector": "eight",
+            "ivory": "safe",
+            "privilege": "safe"
+        }))
+        .expect("fixture context is an object");
+
+        let sanitized = sanitize_context(&context);
+
+        assert_eq!(sanitized["iv"], json!(REDACTED));
+        assert_eq!(sanitized["ivHex"], json!(REDACTED));
+        assert_eq!(sanitized["encryptionIv"], json!(REDACTED));
+        assert_eq!(sanitized["initializationVector"], json!(REDACTED));
+        assert_eq!(sanitized["initialization_vector"], json!(REDACTED));
+        assert_eq!(sanitized["initialization-vector"], json!(REDACTED));
+        assert_eq!(sanitized["initial_vector"], json!(REDACTED));
+        assert_eq!(sanitized["initial-vector"], json!(REDACTED));
+        assert_eq!(sanitized["ivory"], json!("safe"));
+        assert_eq!(sanitized["privilege"], json!("safe"));
+    }
 }