Refocus Stackcord on durable agent coordination with an optional project harness

.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "stackcord",
   "version": "1.0.0",
-  "description": "AI-guided service discovery and durable context for multi-repository full-stack collaboration with deterministic local verification.",
+  "description": "Optional Stackcord project harness: durable Git context, service discovery, contracts, multi-repository coordination and release verification.",
   "author": {
     "name": "kcrmin",
     "url": "https://github.com/kcrmin"

.codex-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "stackcord",
   "version": "1.0.0",
-  "description": "AI-guided service discovery and durable context for multi-repository full-stack collaboration with deterministic local verification.",
+  "description": "Optional Stackcord project harness: durable Git context, service discovery, contracts, multi-repository coordination and release verification.",
   "author": {
     "name": "kcrmin",
     "url": "https://github.com/kcrmin"
@@ -22,7 +22,7 @@
   "hooks": "./hooks/codex.json",
   "interface": {
     "displayName": "Stackcord",
-    "shortDescription": "Keep service meaning coherent across people, agents, and repositories.",
+    "shortDescription": "Optional project harness for Git-backed project continuity.",
     "longDescription": "Use natural language to discover a service, create or adopt a framework-neutral harness, keep people and AI aligned on product meaning, require assigned Git accounts for protected policy approval, reconcile one external task source with semantic work reservation, recover multi-repository context after cloning or compaction, and verify one exact release candidate.",
     "developerName": "kcrmin",
     "category": "Productivity",

.github/workflows/ci.yml

@@ -15,6 +15,7 @@ concurrency:
 jobs:
   changes:
     runs-on: ubuntu-24.04
+    timeout-minutes: 20
     outputs:
       full: ${{ steps.scope.outputs.full }}
     steps:
@@ -45,14 +46,20 @@ jobs:
             artifact: stackcord-windows-amd64
             extension: .exe
     runs-on: ${{ matrix.os }}
+    timeout-minutes: 20
     steps:
       - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd
         with:
           persist-credentials: false
       - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16
         with:
           go-version: 1.26.6
-          cache-dependency-path: cli/go.sum
+          cache-dependency-path: |
+            core/go.sum
+            cli/go.sum
+      - name: Core library tests and static analysis
+        working-directory: core
+        run: go test ./... && go vet ./...
       - name: Unit and integration tests
         working-directory: cli
         run: go test ./...
@@ -76,14 +83,23 @@ jobs:
   repository-contracts:
     needs: changes
     runs-on: ubuntu-24.04
+    timeout-minutes: 20
     steps:
       - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd
         with:
           persist-credentials: false
       - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16
         with:
           go-version: 1.26.6
-          cache-dependency-path: cli/go.sum
+          cache-dependency-path: |
+            core/go.sum
+            cli/go.sum
+      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1
+        with:
+          python-version: "3.13"
+      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38
+        with:
+          node-version: "24"
       - name: Plugin, documentation, security, and strict-profile contracts
         env:
           PYTHONPATH: scripts
@@ -98,6 +114,7 @@ jobs:
             validate_release_config_test \
             validate_ci_test \
             ci_scope_test \
+            release_preflight_test \
             -v
           python3 scripts/validate_plugin.py .
           python3 scripts/validate_agent_eval.py .
@@ -106,27 +123,42 @@ jobs:
           python3 scripts/validate_release_config.py .
           python3 -m unittest discover -s evals/baseline -p '*_test.py' -v
           python3 -m unittest discover -s profiles/strict-release/scripts -p '*_test.py' -v
+      - name: Coordination race checks
+        if: needs.changes.outputs.full == 'true'
+        working-directory: core
+        run: go test -race ./coordination ./httpapi
+      - name: Console behavior
+        run: node --test cli/internal/console/console.test.cjs
       - name: Workflow syntax
         run: go run github.com/rhysd/actionlint/cmd/actionlint@v1.7.12 .github/workflows/*.yml
       - name: Shared channel, control center and HTTP server race checks
         if: needs.changes.outputs.full == 'true'
         working-directory: cli
-        run: go test -race ./internal/channel ./internal/dashboard ./internal/controlcenter
+        run: go test -race ./internal/harness/channel ./internal/harness/dashboard ./internal/harness/controlcenter ./internal/runtimecmd ./internal/console
       - name: GoReleaser configuration
-        run: go run github.com/goreleaser/goreleaser/v2@v2.17.0 check
+        uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94
+        with:
+          version: v2.17.0
+          args: check
 
   product-dogfood:
     needs: changes
     if: needs.changes.outputs.full == 'true'
     runs-on: ubuntu-24.04
+    timeout-minutes: 20
     steps:
       - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd
         with:
           persist-credentials: false
       - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16
         with:
           go-version: 1.26.6
-          cache-dependency-path: cli/go.sum
+          cache-dependency-path: |
+            core/go.sum
+            cli/go.sum
+      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1
+        with:
+          python-version: "3.13"
       - name: Multi-repository service continuity scenario
         env:
           STACKCORD_RUN_DOGFOOD: "1"
@@ -138,6 +170,7 @@ jobs:
             --output-json "$RUNNER_TEMP/baseline.json" \
             --output-markdown "$RUNNER_TEMP/report.md"
       - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
+        if: always()
         with:
           name: service-continuity-dogfood
           path: |
@@ -150,14 +183,17 @@ jobs:
     needs: changes
     if: needs.changes.outputs.full == 'true'
     runs-on: ubuntu-24.04
+    timeout-minutes: 20
     steps:
       - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd
         with:
           persist-credentials: false
       - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16
         with:
           go-version: 1.26.6
-          cache-dependency-path: cli/go.sum
+          cache-dependency-path: |
+            core/go.sum
+            cli/go.sum
       - name: Build all supported targets without CGO
         shell: bash
         run: |
@@ -178,6 +214,7 @@ jobs:
     if: always()
     needs: [changes, repository-contracts, native, product-dogfood, cross-build]
     runs-on: ubuntu-24.04
+    timeout-minutes: 20
     steps:
       - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd
         with:

.github/workflows/release.yml

@@ -4,11 +4,11 @@ on:
   workflow_dispatch:
     inputs:
       tag:
-        description: Exact candidate tag, for example v1.0.0
+        description: Existing release tag, for example v1.0.1
         required: true
         type: string
-      rc_digest:
-        description: Exact locally verified sha256 release-candidate digest
+      expected_sha:
+        description: Full 40-character source commit SHA that passed CI and Security on main
         required: true
         type: string
 
@@ -17,39 +17,61 @@ concurrency:
   cancel-in-progress: false
 
 permissions:
-  contents: write
+  contents: read
 
 jobs:
   stage:
+    # Run the verifier from the maintained main branch, not from an arbitrary tag.
+    if: github.ref == 'refs/heads/main'
     runs-on: ubuntu-24.04
-    environment: production
+    timeout-minutes: 25
+    permissions:
+      contents: read
+      actions: read
+    outputs:
+      source_sha: ${{ steps.preflight.outputs.source_sha }}
     steps:
       - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd
         with:
+          ref: main
           fetch-depth: 0
           persist-credentials: false
-          ref: ${{ inputs.tag }}
-      - name: Verify exact tag and candidate input
+      - name: Verify exact source and successful main checks
+        id: preflight
         env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           TAG: ${{ inputs.tag }}
-          RC_DIGEST: ${{ inputs.rc_digest }}
-        run: |
-          [[ "$TAG" =~ ^v(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$ ]]
-          [[ "$RC_DIGEST" =~ ^sha256:[0-9a-f]{64}$ ]]
-          test "$(git describe --tags --exact-match HEAD)" = "$TAG"
-          test "$(python3 -c 'import json; print(json.load(open(".codex-plugin/plugin.json"))["version"])')" = "${TAG#v}"
+          EXPECTED_SHA: ${{ inputs.expected_sha }}
+        run: python3 scripts/release_preflight.py --tag "$TAG" --expected-sha "$EXPECTED_SHA"
+      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd
+        with:
+          ref: ${{ steps.preflight.outputs.source_sha }}
+          fetch-depth: 0
+          persist-credentials: false
       - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16
         with:
           go-version: 1.26.6
-          cache-dependency-path: cli/go.sum
-      - name: Test exact source
+          cache-dependency-path: |
+            core/go.sum
+            cli/go.sum
+      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38
+        with:
+          node-version: "24"
+      - name: Core continuity race checks and static analysis
+        working-directory: core
+        run: go test -race ./... && go vet ./...
+      - name: Test exact CLI source
         working-directory: cli
         run: go test -race ./... && go vet ./...
+      - name: Console behavior
+        run: node --test cli/internal/console/console.test.cjs
       - uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94
         with:
           distribution: goreleaser
           version: v2.17.0
           args: release --clean --skip=publish
+        env:
+          GORELEASER_CURRENT_TAG: ${{ inputs.tag }}
       - name: Render deterministic Plugin packages
         env:
           VERSION: ${{ inputs.tag }}
@@ -64,19 +86,50 @@ jobs:
       - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
         with:
           name: verified-release-staging
-          path: dist/
+          path: dist/release-assets/
           if-no-files-found: error
+          retention-days: 14
+
+  draft:
+    name: Create release draft
+    needs: stage
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+    environment: production
+    permissions:
+      contents: write
+      actions: read
+    steps:
+      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd
+        with:
+          ref: main
+          fetch-depth: 0
+          persist-credentials: false
+      - name: Recheck source and checks before creating the draft
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          TAG: ${{ inputs.tag }}
+          EXPECTED_SHA: ${{ needs.stage.outputs.source_sha }}
+        run: python3 scripts/release_preflight.py --tag "$TAG" --expected-sha "$EXPECTED_SHA"
+      - uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0
+        with:
+          name: verified-release-staging
+          path: release-assets
+      - name: Verify staged checksums
+        working-directory: release-assets
+        run: sha256sum --check checksums.txt
       - name: Create draft GitHub release
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GH_REPO: ${{ github.repository }}
           TAG: ${{ inputs.tag }}
-          RC_DIGEST: ${{ inputs.rc_digest }}
+          SOURCE_SHA: ${{ needs.stage.outputs.source_sha }}
         run: |
           gh release create "$TAG" \
-            dist/release-assets/* \
+            release-assets/* \
             --draft \
             --verify-tag \
             --title "$TAG" \
-            --notes "Release candidate: $RC_DIGEST
+            --notes "Verified source: $SOURCE_SHA
 
-          Verify checksums.txt before installing. Publishing this draft remains an explicit user action."
+          CI and Security passed for this exact main-branch source. Verify checksums.txt before installing. Publishing this draft remains an explicit user action."