Refocus Stackcord on durable agent coordination with an optional project harness

[kcrmin]

Stackcord couples agent coordination to Git mailbox workflows and makes people learn project-harness policy before starting work. This change introduces a standalone coordination runtime and a task-first local workspace. Worker A can pause, worker B can resume the same checkpoint, and stale sessions cannot overwrite the new owner's progress.

Changes

• Add an Apache-2.0 core module with transactional bbolt state, idempotent mutations, dependency checks, bounded context, ownership fencing and consistent backups. Core has no CLI, GUI, Git or model dependency.
• Add stackcord start: reuse private per-user data and credentials, open the browser, exchange a five-minute one-use launch code for an HttpOnly same-origin session. Existing explicit serve configuration remains available.
• Simplify the EN/KO console to a project switcher, active/all tasks and selected progress. Creating the first task needs only a goal. IDs are generated; activity, settings and technical details open on demand. A copyable task-specific instruction connects existing AI tools without claiming automatic model execution.
• Preserve drafts, focus targets, expanded details and retry identities across refreshes. Reject stale asynchronous results after disconnect or project changes.
• Isolate Git/QDD/contracts/DBML/governance/release functionality under stackcord harness; retain hidden compatibility aliases and existing persisted data. Keep the optional GUI in the same open-source repository.
• Replace full-stack-first onboarding with paired core/runtime guides and explicit compatibility boundaries.
• Repair dependency review by enabling the repository dependency graph and alerts. Separate CodeQL, Go vulnerability scans and dependency review, add an event-aware Security gate, and bound/cancel redundant workflow runs.
• Verify release tags against exact main-branch source and passing CI/Security before packaging; isolate read-only builds from production-environment draft creation and verify staged checksums. Replace the unverified rc_digest input with expected_sha.

Validation

• Full CLI tests and vet; core race tests and vet; targeted runtime/console and existing harness race checks.
• 11 console regressions, including disconnect during bootstrap, project switching, draft preservation, lost-response retries and automatic refresh focus.
• Native macOS browser: first connection, goal-only task creation, AI instruction copy, reload persistence, Korean/English and responsive layout.
• Existing multi-repository dogfood, repository/plugin/release checks, 18 EN/KO documentation pairs and secret scan.
• CGO-free Darwin/Windows/Linux builds; latest UI follow-up built on macOS and cross-built for Windows/Linux amd64. Native Windows/Linux browser launch was not tested locally.
• Independent review findings fixed and rechecked. Bounded-history fixtures are byte checks, not measured model-token savings.
• CI/CD follow-up: 90 Python tests; actionlint and GoReleaser configuration; exact-tag/source and fail-closed gate regressions. Independent bounded review found no blockers.
• Local GoReleaser snapshot built all four platform binaries; rendered four Plugin packages; all eight staged asset checksums passed. This was a temporary local snapshot, not a public release or hosted release dispatch.
• Commit 92e6ada17fa93dede6feab563cf72976478d2a65: CI passed, including macOS/Windows native suites, dogfood, contracts, cross-builds and CI gate; Security passed, including dependency review, CodeQL, both-module vulnerability scans and Security gate.

Boundaries

The runtime does not launch models, detect/reset provider quota or verify reported code completion. The local browser session and API token share one trusted runtime's authority; this is not tenant or human-only authorization. The database is authoritative and needs backups. No automatic Git history migration, destructive deletion, organization transfer, merge or release is included.

Dependency review is enabled and its repository prerequisite has been repaired. Release publication remains manual; the release workflow has not been dispatched as part of this change.

Design and verification details: docs/design/coordination-core.md. CI/CD operation and release inputs: docs/guides/ci-cd-en.md and docs/guides/ci-cd-ko.md.

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.