workspace housekeeping — certification, architecture, vision, submodule pin
five cross-cutting PRs closed workspace hygiene items that had been open since the workspace root was bootstrapped.
five cross-cutting PRs closed workspace hygiene items that had been open since the workspace root was bootstrapped.
The standalone Analyze auth chain now mints scoped keys, revokes them on terminal state, and fails fast on clone-auth 403.
khaos-tools pin advances d06bbb62 to d65ea0d3; brings firstpassrefreshbaseline.go into the workspace; closes auth-chain hardening arc across 8 PRs.
MergeJourney lands as step 4 of 5; single-chunk path is deterministic projection; multi-chunk synthesis retries once on evidence hallucination.
per-chunk LLM synthesis with artifact persistence lands as step 3 of 5; evidence-hallucination is a hard-error with retry-once.
429 responses carry Retry-After header and retry_after_seconds body field; integer-ceiling math, no math.Ceil.
new POST endpoint triggers first-pass baseline refresh; 202/409/404/401 cases fully covered across 14 handler tests.
design-only deliverable: act-based map-reduce primary, scene-window fallback; significance-threshold disqualified; StageIsIdempotent(StageCoverage) remains false.
stale-baseline CTA calls useFirstPassStatus.refreshBaseline(); RefreshBaselineOutcome discriminated union covers accepted/already_running/no_baseline/error; loading guard blocks double-click race.
CloudFront ResponseHeadersPolicy fixes Safari CORS on app.khaosmachine.com; view.khaosmachine.com CloudFront+S3 stack ships.

user menu fills out with profile, integrations, preferences, and appearance panels; avatar upload and theme tokenization land.
XIFty-routed metadata sidecars, sharp thumbnails, EXIF extraction, and video frame thumbnails land in the media plane.
public profile and avatar upload land in khaos-storage; first user-facing identity surface goes live.

S3 multipart uploads and signed reads land; assets and media plane comes online alongside the git plane.
native Khaos Machine storage spec locked; Go confirmed as backend language; khaos-tools-api TDD rewrite ships 86.8% coverage.

OIDC deploy role, Parser API SAM stack, hosted UI at app.khaosmachine.com, and share-viewer CloudFront stack land via GitHub Actions.
primary Cognito pool stays out of Khaos Storage; cross-product identity bridge spec finalized; hosted-shell projects shelf design brief ships.
5-state custom KhaosLogo SF Symbol set lands in the macOS menubar; invisible-icon regression fixed in v0.3.202.
welcome SPA wired end-to-end in khaosd: route, status API, menubar item, and provider auth disambiguation.

casting preflight endpoint lands; khaosd checks voice catalog reachability before permitting a casting run.

khaos-builder doctor lands: preflight checks for the Mac Mini operator — keychain, Xcode, gh CLI, foundation paths, notarize credentials.
khaos-foundation houses 99 spec files; WFL IPC v1 compliance check added; eliminate-sqlite spec closed; deploy-automation tag patterns finalized.
coverage report pipeline complete: prompt, assembler, freshness check, file-lock, and token-budget estimator all ship.
CoverageReportHandler, Status, and Generate endpoints land in khaosd, backing the coverage app's data plane.
coverage app goes from scaffold to a standing app: types, attributed-value primitive, rubric panel, print stylesheet, onboarding wizard, demo banner.
the macOS menu bar app ships: Swift 6 strict mode, Sparkle auto-updates, LaunchAgent login item, CDN-signed release pipeline.
eight high-complexity TUI functions split to pass gocognit; console/settings/import view model tests added across 9 packages; onboarding view wired.
SQLite migrated to pure-Go driver then removed entirely; MemoryStorage and StoryMutator replace it; CGO eliminated from macOS and Linux matrices.
52 SQLite/CGO test failures resolved in khaos-tools; WFL IPC v1 compliance check ships; eliminate-sqlite spec closed.
the legacy subprocess executor is removed; all job dispatch now routes through the Reflex DAG engine with a cancel race fix.
khaos-tools now parses Final Draft .fdx and Storyist .sbx formats in addition to Fountain.
Story Player gains subtitle display, audio playback, and on-demand audio generation from the composition timeline.

Reflex gains COMPUTE_SCOPE node, persisted-state crash recovery, retry vs fail-fast error classification, and CI coverage floor.
Reflex IPC moves to typed structs, removing 1,111 LOC of legacy map dispatch and adding 19 benchmarks.
shadcn-vue and Reka UI primitives adopted; Phosphor icon migration completes; KSettings and KProvider redesigned across the workspace.

scene IDs now stable across re-runs; analysis path layout flattened; composition-events extraction and migration enrichment begin.
khaosd bootstrapped from a stub to a full daemon: embedded SPA, SSE topics, WFL bridge, console API.
the installer pipeline ships: macOS .pkg, Linux .deb/.rpm, S3+CloudFront CDN at preview.khaosmachine.com, version manifest for update checking.
khaos-tui initializes as a Bubble Tea TUI: project list, import wizard with native file picker, scene/character/location navigation, analysis gating.
four LLM providers now available in khaos-tools; unified ProviderFactory centralizes retry and adapter registration.