Integrate shared editor and Continue with gated marketplace publication

.docs/verification-extension-publication-20261012.md

@@ -0,0 +1,52 @@
+# Extension publication verification — 12 October 2026
+
+## Tested outputs
+
+- VS Code: 25 actual WASM/host/filesystem tests and 34 packaging/publication tests pass; TypeScript and ESLint pass. Asset importer verifies 133 files from published editor source 05d0aa50151c131db4a3b30b56aba67c00add5fc. Real ZIP regressions reject extraction aliases, changed XML publisher/version/platform and mismatched assets.
+- Native VS Code installed package saved Risk/Concern alternatives and graph JSON. Graph SHA-256: f8648b16470e764bdff5c95064078419d71e8d41d2ca30d4b1508017c166a45d. The export test invokes the packaged Rust helper and a real TextDocument save. It does not demonstrate the webview export dialog.
+- Released grep 1.21.19 read that saved graph: concern retrieved three Risk decisions. Retrieval-only returned no answer. A separate direct CLI --answer run returned a source-grounded answer with three citations. Actual JSON/receipts are retained in the local publication evidence directory.
+- Shared LSP/core: 421 tests passed across the full two-crate suite. Then five real filesystem alias regressions and a six-scenario stale-source export regression passed with the complete 38-test save/export suite. The stale-source test reproduced an actual obsolete output overwrite before the guard and verifies refusal after edits, closure and same-version reopen. Strict all-targets/all-features LSP Clippy and formatting passed. The shared exporter uses the released alternatives crate, including synonyms:: parsing, typed comma terms, conflict refusal, detached exclusion and save/reopen/history tests.
+- Native-launch failure regression uses a nonexistent executable and intentionally exits nonzero. Its retained FAIL receipt identifies the exact snapshotted VSIX hash, proving startup failures do not disappear from CI evidence.
+
+## Actual CI qualification
+
+[VS Code run 38216701669](https://github.com/terraphim/terraphim-ai/actions/runs/38216701669) passed package creation and native Ubuntu 24.04, macOS 14 and Windows 2025 at source `673c921d7fe7b02a2997395af8610b8c61f432a8`. All hosts executed the same VSIX SHA-256 `50f0b1fc060cfa2e77406961dfaec1f0c5b476fbc369888d3bc856fbb469419e`. Downloaded output files were independently hashed: native edit/save, undo, redo, saved annotated brief and exported graph matched every receipt, identically across platforms. Undo differs from the edited file; redo equals it. The earlier Windows failure was real CRLF conversion of the checked-out asset manifest; an LF Git attribute and actual Git checkout regression fixed it without weakening byte checks.
+
+[Continue run 38215897542](https://github.com/terraphim/terraphim-ai/actions/runs/38215897542) passed six real transport/configuration/package/source tests. The downloaded bundle records a clean source tree. Actual MCP receipt: baseline Concern query returned zero chunks; the exported graph returned the Risk line from brief.md, with answer null. The earlier three-decision direct-CLI evidence is a separate corpus/run.
+
+[Zed Gitea run 39016](https://git.terraphim.cloud/terraphim/zed-terraphim/actions/runs/39016) at `76b256d0c90770e8134a8aa124dd11d509c90ea0` passed formatting, native/WASI Clippy, 74 Rust tests, WASI build, architecture guards and 42 Python tests. Actual job logs were read, rather than relying on the summary API (which leaves individual step statuses queued). Runner path-normalization warnings are infrastructure diagnostics; compiler Clippy gates passed. This does not qualify native Zed UI behavior or public installation.
+
+## Legacy command repair
+
+Final package review found two contributed commands depending on absent bindings. The existing `rust-lib` now builds from published Terraphim automata 1.20.4 with Rust 1.96.1/wasm-pack 0.13.1; actual compiled helper and extracted-VSIX tests produce exact Risk/Concern Markdown links while preserving Unicode/CRLF. Invalid graph data throws rather than yielding an empty document. Two Rust and four Node/WASM tests passed, along with 34 Python package/guard tests and prior host/export tests. The legacy NAPI command ID shares the existing server provider and refuses an unavailable server. Its new native tests exercise the installed helper and real unavailable endpoint; the final native matrix below passed for this repaired package; marketplace and full-UI gates remain separate. Live Atomic-resource end-to-end behavior remains separate from helper proof.
+
+## Independent review and repairs
+
+Review identified and implementation fixed: ZIP extraction aliases, unchecked marketplace XML identity, lost failure receipts, mutable-package receipt hashes, background-editor history routing, and LSP symlink/hardlink source overwrite. Filesystem export regressions reproduced real byte corruption before the guard and pass after it. Zed release/package binding and Continue tag/source binding underwent separate review.
+
+## Unqualified gates
+
+- Native webview interactions, export dialogs/cancellation, clean-profile upgrade/rollback and the complete 41-requirement matrix remain unqualified. The prior local Mac focus failure is retained as a failed attempt; all three native CI hosts subsequently passed the enabled document/history assertions.
+- Native stock Zed and Continue UI acceptance remain pending. All 41 original requirements are not certified for these hosts. The Zed application fork is untouched.
+- Continue retrieval uses a real SDK client/server and released grep; native Continue UI and optional provider synthesis are separate. Automatic approval review rejected the optional Continue/OpenRouter synthesis check; no retry or bypass occurred.
+- No marketplace publication, account federation, public Zed source mirror or catalog merge is claimed. See the publication design for prerequisite order and CI gates.
+
+## Static analysis
+
+UBS was run with the default repository policy and explicitly on the extension files (the default ignore file excludes VS Code). Its Rust production scan reported zero critical findings; warning inventory includes existing test assertions and conservative async-lock/clone/slicing heuristics. The initial JS global-assignment findings were declared closure variables; declarations were separated for clarity. Public SHA-256 comparisons now use explicit constant-time comparison. Continue's only critical static findings are equality comparisons of public SHA-256 file digests, not secret material; independent review and six real tests pass. Static findings are reviewed evidence, not a substitute for Rust/TypeScript tests.
+
+## Evidence locations
+
+Local evidence: `synonym-search-story/extensions-20261012/vscode-export-review`, `vscode-grep` under the task's visualization directory. Continue transport/schema/package receipts are committed under `integrations/continue/proof`. CI artifacts preserve host/platform/package digests, actual saved output and failure receipts. The publication design is `docs/plans/design-extension-marketplaces.md`.
+
+## Public monorepo baseline check
+
+The global commit hook checks the root Rust workspace, which excludes the extension's standalone `rust-lib`. That root check fails in unchanged `terraphim_rlm/src/mcp_tools.rs` against the resolved MCP API (missing Content/RawContent, non-exhaustive Tool literals and removed .raw fields). The same failures were reproduced in an isolated checkout of public main `09670565c4434519c0a688d093467f48a9eb4b17`; those root files are unchanged by this extension PR. The diagnostic Cargo.lock rewrite was discarded. This is a recorded failing baseline, not an extension test pass.
+
+For the extension-only commit, a temporary copy of the existing commit hook targets its Rust checks at the standalone extension Cargo.toml with the pinned toolchain and --locked; all secret/size/format/config/static checks and commit-message validation remain. No persistent hook setting is changed. The private LSP/core commits passed the original complete workspace hook.
+
+## Final repaired package qualification
+
+[Run 38218712077](https://github.com/terraphim/terraphim-ai/actions/runs/38218712077) passed package plus all three native hosts at clean source `4c45aa221ad573266a73cbacdbad2620a42a26ca`. The pull-request run 38218715264 passed too. VSIX SHA-256: `863f2e39c2cd07084af3391064a3f294384d8db67a090ad197620aeacb15b79e`. Downloaded files independently match all 18 receipt hashes. Native checks include the repaired installed Rust link loader and actual unavailable-server refusal, in addition to save/undo/redo/reopen and typed synonym export. Released grep 1.21.19 read each host-produced graph and returned three Risk decisions for Concern with answer null. `docs/verification/extensions-20261012/native-vscode-final.json` records this bounded result. Continue CI run 38218715269 also passed on the same PR revision.
+
+Known unrelated public-root compilation failure: [Gitea issue #3325](https://git.terraphim.cloud/terraphim/terraphim-ai/issues/3325). Marketplace credentials, the Zed catalog package/public binary prerequisites and full native UI acceptance remain open; a passing scoped package test does not close them.

.github/workflows/continue-integration.yml

@@ -0,0 +1,109 @@
+name: Continue integration
+on:
+  pull_request:
+    paths: ['integrations/continue/**', '.github/workflows/continue-integration.yml']
+  push:
+    branches: [main]
+    tags: ['terraphim_continue-v*']
+    paths: ['integrations/continue/**', '.github/workflows/continue-integration.yml']
+  workflow_dispatch:
+permissions:
+  contents: read
+jobs:
+  verify-and-package:
+    timeout-minutes: 10
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065
+        with:
+          python-version: '3.12'
+      - name: Install pinned MCP SDK
+        run: python -m pip install -r integrations/continue/requirements.txt
+      - name: Verify released CLI and actual MCP outputs
+        shell: bash
+        run: |
+          set -euo pipefail
+          mkdir -p "$RUNNER_TEMP/continue-grep"
+          cd "$RUNNER_TEMP/continue-grep"
+          curl --fail --location --retry 3 --output grep.tar.gz https://github.com/terraphim/terraphim-clients/releases/download/v1.21.19/terraphim-grep-1.21.19-x86_64-unknown-linux-musl.tar.gz
+          echo 'd95ae22a7a84c294e700e957ff94ad25195481fce80ea7673a240c6240257220  grep.tar.gz' | sha256sum --check --strict
+          tar -xzf grep.tar.gz
+          binary="$(python -c 'from pathlib import Path; p=list(Path(".").rglob("terraphim-grep")); assert len(p)==1; print(p[0].resolve())')"
+          cd "$GITHUB_WORKSPACE"
+          TERRAPHIM_GREP_BINARY="$binary" TERRAPHIM_EXPORTED_GRAPH="$GITHUB_WORKSPACE/integrations/continue/risk-concern.exported.json" TERRAPHIM_CONTINUE_RECEIPT="$RUNNER_TEMP/continue-receipt.json" python -m unittest discover -s integrations/continue
+      - name: Package separate integration
+        run: python integrations/continue/package.py continue-dist
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
+        with:
+          name: terraphim-continue-integration
+          path: |
+            continue-dist/*
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
+        with:
+          name: terraphim-continue-output-proof
+          path: ${{ runner.temp }}/continue-receipt.json
+  attach-to-published-release:
+    if: startsWith(github.ref, 'refs/tags/terraphim_continue-v')
+    needs: verify-and-package
+    timeout-minutes: 15
+    environment: continue-releases
+    concurrency:
+      group: continue-release-${{ github.ref }}
+      cancel-in-progress: false
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093
+        with:
+          name: terraphim-continue-integration
+          path: integration
+      - name: Attach separately downloadable integration
+        env:
+          GH_TOKEN: ${{ github.token }}
+          RELEASE_TAG: ${{ github.ref_name }}
+          GH_REPO: ${{ github.repository }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          expected="$(python -c 'import json; m=json.load(open("integrations/continue/integration.json")); print(m["tagPrefix"] + m["version"])')"
+          test "$RELEASE_TAG" = "$expected"
+          version="$(python -c 'import json; print(json.load(open("integrations/continue/integration.json"))["version"])')"
+          export CONTINUE_ARCHIVE_NAME="terraphim-continue-integration-$version.zip"
+          cd integration
+          sha256sum --check --strict terraphim-continue-SHA256SUMS
+          qualify_source() {
+            python ../integrations/continue/verify_source.py --tag "$RELEASE_TAG" --qualified "$GITHUB_SHA" --archive "$CONTINUE_ARCHIVE_NAME"
+          }
+          qualify_source
+          # Dedicated tag/release only. Existing release is accepted only for identical assets.
+          if gh release view "$RELEASE_TAG" --json assets > existing.json 2>/dev/null; then
+            python -c 'import json,os; a=json.load(open("existing.json"))["assets"]; assert sorted(x["name"] for x in a)==sorted(["terraphim-continue-SHA256SUMS",os.environ["CONTINUE_ARCHIVE_NAME"]])'
+            mkdir existing
+            gh release download "$RELEASE_TAG" --dir existing
+            cmp "$CONTINUE_ARCHIVE_NAME" "existing/$CONTINUE_ARCHIVE_NAME"
+            cmp terraphim-continue-SHA256SUMS existing/terraphim-continue-SHA256SUMS
+          else
+            qualify_source
+            gh release create "$RELEASE_TAG" --verify-tag --draft --title "Terraphim Continue integration $version" --notes "Agent-mode MCP tools backed by released terraphim-grep. Actual SDK transport qualified; native Continue UI and full editor parity remain unqualified." --latest=false
+            qualify_source
+            gh release upload "$RELEASE_TAG" "$CONTINUE_ARCHIVE_NAME" terraphim-continue-SHA256SUMS
+          fi
+          qualify_source
+          gh release edit "$RELEASE_TAG" --draft=false --latest=false
+          # No authentication header, curl configuration or netrc: verify the public release.
+          mkdir public-readback
+          curl -q --fail --location --retry 10 --retry-delay 5 --max-time 20 --output "public-readback/$CONTINUE_ARCHIVE_NAME" "https://github.com/$GH_REPO/releases/download/$RELEASE_TAG/$CONTINUE_ARCHIVE_NAME"
+          curl -q --fail --location --retry 10 --retry-delay 5 --max-time 20 --output public-readback/terraphim-continue-SHA256SUMS "https://github.com/$GH_REPO/releases/download/$RELEASE_TAG/terraphim-continue-SHA256SUMS"
+          cmp "$CONTINUE_ARCHIVE_NAME" "public-readback/$CONTINUE_ARCHIVE_NAME"
+          cmp terraphim-continue-SHA256SUMS public-readback/terraphim-continue-SHA256SUMS
+          cd public-readback
+          sha256sum --check --strict terraphim-continue-SHA256SUMS

.github/workflows/vscode-extension.yml

@@ -0,0 +1,99 @@
+name: VS Code extension
+on:
+  pull_request:
+    paths: ['vs-code-terraphim-it/**', '.github/workflows/vscode-*.yml']
+  push:
+    branches: [main, 'codex/**']
+    paths: ['vs-code-terraphim-it/**', '.github/workflows/vscode-*.yml']
+  workflow_dispatch:
+  workflow_call:
+
+permissions:
+  contents: read
+
+jobs:
+  package:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 35
+    defaults:
+      run:
+        working-directory: vs-code-terraphim-it
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020
+        with:
+          node-version: '22'
+          cache: npm
+          cache-dependency-path: vs-code-terraphim-it/package-lock.json
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065
+        with:
+          python-version: '3.12'
+      - run: npm ci --ignore-scripts --no-audit --no-fund
+      - run: npm run editor:fetch
+      - name: Build existing Terraphim link engine from locked public crates
+        env:
+          RUSTC_WRAPPER: ''
+          RUSTC_WORKSPACE_WRAPPER: ''
+          CARGO_BUILD_BUILD_DIR: target/build
+        run: |
+          set -euo pipefail
+          cd rust-lib
+          rustup show active-toolchain
+          cargo install wasm-pack --version 0.13.1 --locked
+          cargo fmt --all -- --check
+          cargo test --locked
+          cargo clippy --locked --all-targets -- -D warnings
+          cd ..
+          npm run build-rust
+      - run: npm run compile && npm run lint && npm run test:legacy && npm run test:assets && npm run test:host && npm run test:export
+      - run: npm run package:vsix
+      - run: python3 scripts/verify_vsix.py terraphim-it.vsix --output release-manifest.json
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
+        with:
+          name: vscode-package-${{ github.sha }}
+          path: |
+            vs-code-terraphim-it/terraphim-it.vsix
+            vs-code-terraphim-it/release-manifest.json
+            vs-code-terraphim-it/SHA256SUMS
+          if-no-files-found: error
+          retention-days: 30
+  native:
+    needs: package
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-24.04, macos-14, windows-2025]
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 20
+    defaults:
+      run:
+        working-directory: vs-code-terraphim-it
+        shell: bash
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020
+        with:
+          node-version: '22'
+      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093
+        with:
+          name: vscode-package-${{ github.sha }}
+          path: vs-code-terraphim-it
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065
+        with:
+          python-version: '3.12'
+      - run: npm ci --ignore-scripts --no-audit --no-fund
+      - name: Check package integrity before executing it
+        run: python3 -c "import hashlib,json,pathlib; p=pathlib.Path('terraphim-it.vsix'); assert hashlib.sha256(p.read_bytes()).hexdigest()==json.load(open('release-manifest.json'))['sha256']"
+      - name: Exercise actual packaged extension in native host
+        run: |
+          if [[ "$RUNNER_OS" == Linux ]]; then xvfb-run -a npm run test:native; else npm run test:native; fi
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
+        if: always()
+        with:
+          name: vscode-native-${{ matrix.os }}-${{ github.sha }}
+          path: vs-code-terraphim-it/native-results
+          if-no-files-found: error