Feature/v0 3 2 ci gates

.clinerules

@@ -1,17 +1,7 @@
 # MCB — Cline Rules
 
-All project rules, architecture, conventions, and commands are defined in
-`CLAUDE.md` at the repository root. Read it fully before making changes.
+`AGENTS.md` is the project single source of truth for all agent rules,
+architecture, conventions, commands, beads workflow, validation, and Git policy.
 
-See `AGENTS.md` for the full AI agent configuration index.
-
-## Essential Rules
-
-- **Architecture**: Clean Architecture — dependencies flow inward only. Run `make validate` to verify.
-- **Error handling**: Use `Error::vcs("msg")` constructors, never `unwrap()`/`expect()` in production.
-- **Lints**: `unsafe_code = "deny"`, `dead_code = "deny"`. Zero clippy warnings required.
-- **Testing**: `make test` (1700+ tests). New logic must include tests.
-- **Build**: Always use `make` targets (`make build`, `make lint`, `make test`, `make check`).
-- **Commits**: Conventional Commits format — `feat(scope): description`.
-- **Change philosophy**: Surgical edits, maximum reuse, no bypasses. Fix all warnings every cycle.
-- **MVI 200**: Source files under ~200 lines; split into submodules when growing.
+`CLAUDE.md` is intentionally only a thin pointer back to `AGENTS.md`; do not use
+it as a second rule source and do not duplicate the universal core here.

.config/nextest.toml

@@ -0,0 +1,23 @@
+# cargo-nextest configuration.
+#
+# mcb-server integration tests share a process-wide test context
+# (`tests/utils/test_fixtures.rs`: `OnceLock<Option<SharedTestContext>>` with a
+# heavy provider/DB init). Under `cargo test` that context initializes ONCE per
+# test binary and is shared by all threads. nextest instead runs ONE PROCESS PER
+# TEST, so each test re-initializes the context; running them concurrently makes
+# several heavy inits collide and return `None` ("shared test context init
+# failed"). Serialize the integration tests so only one init runs at a time —
+# this matches the cargo-test execution semantics without losing nextest's speed
+# on the rest of the suite.
+
+[test-groups]
+serial-shared-context = { max-threads = 1 }
+
+[[profile.default.overrides]]
+filter = 'package(mcb-server) and kind(test)'
+test-group = 'serial-shared-context'
+# Defense-in-depth: the CI warm-up step (`make test SCOPE=warmup`) populates the
+# hf-hub cache in-job so these load the model offline. retries absorbs a residual
+# transient HF 429 on a genuine cold-cache run — visible in nextest output, not a
+# silent fallback. Primary fix is the warm-up; this is the safety net.
+retries = 2

.continue/rules/mcb.md

@@ -5,18 +5,8 @@ globs: ["**/*.rs", "**/*.toml", "**/*.md"]
 
 # MCB — Continue.dev Rules
 
-All project rules, architecture, conventions, and commands are defined in
-`CLAUDE.md` at the repository root. Read it fully before making changes.
+`AGENTS.md` is the project single source of truth for all agent rules,
+architecture, conventions, commands, beads workflow, validation, and Git policy.
 
-See `AGENTS.md` for the full AI agent configuration index.
-
-## Essential Rules
-
-- **Architecture**: Clean Architecture — dependencies flow inward only. Run `make validate` to verify.
-- **Error handling**: Use `Error::vcs("msg")` constructors, never `unwrap()`/`expect()` in production.
-- **Lints**: `unsafe_code = "deny"`, `dead_code = "deny"`. Zero clippy warnings required.
-- **Testing**: `make test` (1700+ tests). New logic must include tests.
-- **Build**: Always use `make` targets (`make build`, `make lint`, `make test`, `make check`).
-- **Commits**: Conventional Commits format — `feat(scope): description`.
-- **Change philosophy**: Surgical edits, maximum reuse, no bypasses. Fix all warnings every cycle.
-- **MVI 200**: Source files under ~200 lines; split into submodules when growing.
+`CLAUDE.md` is intentionally only a thin pointer back to `AGENTS.md`; do not use
+it as a second rule source and do not duplicate the universal core here.

.gemini/styleguide.md

@@ -1,7 +1,8 @@
 # MCB — Gemini Code Assist Style Guide
 
-> Single source of truth: [`CLAUDE.md`](../CLAUDE.md). This file adds Gemini-specific
-> PR review priorities. See [`AGENTS.md`](../AGENTS.md) for the full agent configuration index.
+> Single source of truth: [`AGENTS.md`](../AGENTS.md). `CLAUDE.md` is only a
+> pointer back to `AGENTS.md`. This file adds Gemini-specific PR review
+> priorities without restating the universal core.
 
 ## PR Review Priorities (ordered)
 
@@ -34,14 +35,14 @@
 
 ## Quality Gate Checklist
 
-- `make lint` passes (clippy + fmt)
+- `make check WHAT=lint` passes (clippy + fmt)
 - `make test` passes (1700+ tests)
-- `make validate` passes (zero architecture violations)
+- `make check WHAT=validate` passes (zero architecture violations)
 - Conventional Commits format used
 
 ## Key Documentation
 
-- [`CLAUDE.md`](../CLAUDE.md) — all rules, patterns, commands (single source of truth)
+- [`AGENTS.md`](../AGENTS.md) — all rules, patterns, commands, and beads workflow
 - [`docs/architecture/ARCHITECTURE.md`](../docs/architecture/ARCHITECTURE.md) — architecture details
 - [`docs/developer/CONTRIBUTING.md`](../docs/developer/CONTRIBUTING.md) — contributor guide
 - [`docs/adr/`](../docs/adr/) — 52 Architecture Decision Records

.github/actions/native-deps/action.yml

@@ -0,0 +1,53 @@
+---
+# SSOT for native build dependencies (protoc + ONNX Runtime), cross-platform.
+# Replaces the Unix `setup-ci.sh` call plus the Windows protoc/ONNX PowerShell
+# blocks that were copy-pasted across ci.yml (test-cross, release-build) and
+# release.yml. One definition, used everywhere.
+name: Native build dependencies
+description: Install protoc and ONNX Runtime for the current OS (Unix via setup-ci.sh, Windows via PowerShell).
+inputs:
+  setup-flags:
+    description: Extra flags forwarded to .github/setup-ci.sh on Unix (e.g. --install-audit).
+    required: false
+    default: ""
+runs:
+  using: composite
+  steps:
+    - name: Install dependencies (Unix)
+      if: runner.os != 'Windows'
+      shell: bash
+      run: bash .github/setup-ci.sh ${{ inputs.setup-flags }}
+    - name: Install protoc (Windows)
+      if: runner.os == 'Windows'
+      shell: pwsh
+      env:
+        PROTOC_VERSION: "29.3"
+        PROTOC_SHA256: "57ea59e9f551ad8d71ffaa9b5cfbe0ca1f4e720972a1db7ec2d12ab44bff9383"
+      run: |
+        $base = "https://github.com/protocolbuffers/protobuf/releases/download"
+        $url = "$base/v${env:PROTOC_VERSION}/protoc-${env:PROTOC_VERSION}-win64.zip"
+        $zip = "$env:TEMP\protoc.zip"
+        Invoke-WebRequest -Uri $url -OutFile $zip -ErrorAction Stop
+        $hash = (Get-FileHash $zip -Algorithm SHA256).Hash.ToLower()
+        if ($hash -ne $env:PROTOC_SHA256) {
+          throw "protoc checksum mismatch: expected $($env:PROTOC_SHA256), got $hash"
+        }
+        Expand-Archive $zip -DestinationPath "$env:TEMP\protoc" -Force
+        Add-Content -Path $env:GITHUB_PATH -Value "$env:TEMP\protoc\bin"
+    - name: Install ONNX Runtime (Windows)
+      if: runner.os == 'Windows'
+      shell: pwsh
+      env:
+        ORT_VERSION: "1.23.2"
+      run: |
+        $url = "https://github.com/microsoft/onnxruntime/releases/download/v${env:ORT_VERSION}/onnxruntime-win-x64-${env:ORT_VERSION}.zip"
+        $zip = "$env:TEMP\onnxruntime.zip"
+        $dest = "$env:TEMP\onnxruntime"
+        Write-Host "Installing ONNX Runtime ${env:ORT_VERSION} (Windows x64)..."
+        Invoke-WebRequest -Uri $url -OutFile $zip -ErrorAction Stop
+        Expand-Archive $zip -DestinationPath $dest -Force
+        $ortDir = "$dest\onnxruntime-win-x64-${env:ORT_VERSION}"
+        $ortLib = "$ortDir\lib"
+        Add-Content -Path $env:GITHUB_PATH -Value $ortLib
+        Add-Content -Path $env:GITHUB_ENV -Value "ORT_DYLIB_PATH=$ortLib\onnxruntime.dll"
+        Add-Content -Path $env:GITHUB_ENV -Value "PATH=$ortLib;$env:PATH"

.github/actions/warm-fastembed/action.yml

@@ -0,0 +1,22 @@
+---
+# SSOT for the FastEmbed cache warm-up (replaces 4 identical inline blocks).
+# Populates .cache/mcb/fastembed via the SAME hf-hub Rust code path the tests use
+# (make test SCOPE=warmup runs the init test once), so the on-disk
+# blobs+refs+snapshots layout is valid in-job and tests resolve the model offline.
+# The retry loop survives a transient HF 429 on a genuine cold-cache download.
+name: Warm FastEmbed cache
+description: Populate the FastEmbed model cache via the hf-hub Rust path for offline test loads.
+runs:
+  using: composite
+  steps:
+    - name: Warm FastEmbed cache (Rust path)
+      shell: bash
+      env:
+        FASTEMBED_CACHE_DIR: .cache/mcb/fastembed
+      run: |
+        for attempt in 1 2 3 4 5; do
+          if make test SCOPE=warmup; then break; fi
+          [ "$attempt" -eq 5 ] && { echo 'FastEmbed warm-up failed after 5 attempts' >&2; exit 1; }
+          echo "warm-up attempt $attempt failed (likely HF 429); backing off $((attempt*20))s..."
+          sleep $((attempt * 20))
+        done

.github/setup-ci.sh

@@ -133,18 +133,35 @@ Darwin)
 	;;
 esac
 
+# Install a Rust crate. Prefer cargo-binstall when available for speed,
+# but fall back to cargo install so environments without binstall still work.
+_mcb_install_crate() {
+	local crate="$1"
+	if command -v cargo-binstall &>/dev/null; then
+		cargo binstall -y "$crate" >/dev/null 2>&1
+	else
+		cargo install "$crate" --locked --quiet
+	fi
+}
+
 # Parse optional flags
+# Ensure sccache is available (mandatory compilation cache)
+if ! command -v sccache &>/dev/null; then
+	echo "Installing sccache (mandatory compilation cache)..." >&2
+	_mcb_install_crate sccache
+fi
+
 while [[ $# -gt 0 ]]; do
 	case $1 in
 	--install-audit)
 		if ! command -v cargo-audit &>/dev/null; then
-			cargo install cargo-audit --locked --quiet
+			_mcb_install_crate cargo-audit
 		fi
 		shift
 		;;
 	--install-coverage)
 		if ! command -v cargo-tarpaulin &>/dev/null; then
-			cargo install cargo-tarpaulin --locked --quiet
+			_mcb_install_crate cargo-tarpaulin
 		fi
 		shift
 		;;
@@ -167,6 +184,14 @@ while [[ $# -gt 0 ]]; do
 		fi
 		shift
 		;;
+	--install-nextest)
+		command -v cargo-nextest &>/dev/null || _mcb_install_crate cargo-nextest
+		shift
+		;;
+	--install-typos)
+		command -v typos &>/dev/null || _mcb_install_crate typos-cli
+		shift
+		;;
 	*)
 		echo "Error: Unknown option: $1" >&2
 		exit 1